drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 #ifdef CONFIG_B43_BCMA
1159 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1160 {
1161         u32 flags;
1162
1163         /* Put PHY into reset */
1164         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1165         flags |= B43_BCMA_IOCTL_PHY_RESET;
1166         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1167         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1168         udelay(2);
1169
1170         /* Take PHY out of reset */
1171         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1172         flags &= ~B43_BCMA_IOCTL_PHY_RESET;
1173         flags |= BCMA_IOCTL_FGC;
1174         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1175         udelay(1);
1176
1177         /* Do not force clock anymore */
1178         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1179         flags &= ~BCMA_IOCTL_FGC;
1180         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1181         udelay(1);
1182 }
1183
1184 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1185 {
1186         b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
1187         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1188         b43_bcma_phy_reset(dev);
1189         bcma_core_pll_ctl(dev->dev->bdev, 0x300, 0x3000000, true);
1190 }
1191 #endif
1192
1193 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1194 {
1195         struct ssb_device *sdev = dev->dev->sdev;
1196         u32 tmslow;
1197         u32 flags = 0;
1198
1199         if (gmode)
1200                 flags |= B43_TMSLOW_GMODE;
1201         flags |= B43_TMSLOW_PHYCLKEN;
1202         flags |= B43_TMSLOW_PHYRESET;
1203         if (dev->phy.type == B43_PHYTYPE_N)
1204                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1205         b43_device_enable(dev, flags);
1206         msleep(2);              /* Wait for the PLL to turn on. */
1207
1208         /* Now take the PHY out of Reset again */
1209         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1210         tmslow |= SSB_TMSLOW_FGC;
1211         tmslow &= ~B43_TMSLOW_PHYRESET;
1212         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1213         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1214         msleep(1);
1215         tmslow &= ~SSB_TMSLOW_FGC;
1216         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1217         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1218         msleep(1);
1219 }
1220
1221 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1222 {
1223         u32 macctl;
1224
1225         switch (dev->dev->bus_type) {
1226 #ifdef CONFIG_B43_BCMA
1227         case B43_BUS_BCMA:
1228                 b43_bcma_wireless_core_reset(dev, gmode);
1229                 break;
1230 #endif
1231 #ifdef CONFIG_B43_SSB
1232         case B43_BUS_SSB:
1233                 b43_ssb_wireless_core_reset(dev, gmode);
1234                 break;
1235 #endif
1236         }
1237
1238         /* Turn Analog ON, but only if we already know the PHY-type.
1239          * This protects against very early setup where we don't know the
1240          * PHY-type, yet. wireless_core_reset will be called once again later,
1241          * when we know the PHY-type. */
1242         if (dev->phy.ops)
1243                 dev->phy.ops->switch_analog(dev, 1);
1244
1245         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1246         macctl &= ~B43_MACCTL_GMODE;
1247         if (gmode)
1248                 macctl |= B43_MACCTL_GMODE;
1249         macctl |= B43_MACCTL_IHR_ENABLED;
1250         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1251 }
1252
1253 static void handle_irq_transmit_status(struct b43_wldev *dev)
1254 {
1255         u32 v0, v1;
1256         u16 tmp;
1257         struct b43_txstatus stat;
1258
1259         while (1) {
1260                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1261                 if (!(v0 & 0x00000001))
1262                         break;
1263                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1264
1265                 stat.cookie = (v0 >> 16);
1266                 stat.seq = (v1 & 0x0000FFFF);
1267                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1268                 tmp = (v0 & 0x0000FFFF);
1269                 stat.frame_count = ((tmp & 0xF000) >> 12);
1270                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1271                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1272                 stat.pm_indicated = !!(tmp & 0x0080);
1273                 stat.intermediate = !!(tmp & 0x0040);
1274                 stat.for_ampdu = !!(tmp & 0x0020);
1275                 stat.acked = !!(tmp & 0x0002);
1276
1277                 b43_handle_txstatus(dev, &stat);
1278         }
1279 }
1280
1281 static void drain_txstatus_queue(struct b43_wldev *dev)
1282 {
1283         u32 dummy;
1284
1285         if (dev->dev->core_rev < 5)
1286                 return;
1287         /* Read all entries from the microcode TXstatus FIFO
1288          * and throw them away.
1289          */
1290         while (1) {
1291                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1292                 if (!(dummy & 0x00000001))
1293                         break;
1294                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1295         }
1296 }
1297
1298 static u32 b43_jssi_read(struct b43_wldev *dev)
1299 {
1300         u32 val = 0;
1301
1302         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1303         val <<= 16;
1304         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1305
1306         return val;
1307 }
1308
1309 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1310 {
1311         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1312         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1313 }
1314
1315 static void b43_generate_noise_sample(struct b43_wldev *dev)
1316 {
1317         b43_jssi_write(dev, 0x7F7F7F7F);
1318         b43_write32(dev, B43_MMIO_MACCMD,
1319                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1320 }
1321
1322 static void b43_calculate_link_quality(struct b43_wldev *dev)
1323 {
1324         /* Top half of Link Quality calculation. */
1325
1326         if (dev->phy.type != B43_PHYTYPE_G)
1327                 return;
1328         if (dev->noisecalc.calculation_running)
1329                 return;
1330         dev->noisecalc.calculation_running = 1;
1331         dev->noisecalc.nr_samples = 0;
1332
1333         b43_generate_noise_sample(dev);
1334 }
1335
1336 static void handle_irq_noise(struct b43_wldev *dev)
1337 {
1338         struct b43_phy_g *phy = dev->phy.g;
1339         u16 tmp;
1340         u8 noise[4];
1341         u8 i, j;
1342         s32 average;
1343
1344         /* Bottom half of Link Quality calculation. */
1345
1346         if (dev->phy.type != B43_PHYTYPE_G)
1347                 return;
1348
1349         /* Possible race condition: It might be possible that the user
1350          * changed to a different channel in the meantime since we
1351          * started the calculation. We ignore that fact, since it's
1352          * not really that much of a problem. The background noise is
1353          * an estimation only anyway. Slightly wrong results will get damped
1354          * by the averaging of the 8 sample rounds. Additionally the
1355          * value is shortlived. So it will be replaced by the next noise
1356          * calculation round soon. */
1357
1358         B43_WARN_ON(!dev->noisecalc.calculation_running);
1359         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1360         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1361             noise[2] == 0x7F || noise[3] == 0x7F)
1362                 goto generate_new;
1363
1364         /* Get the noise samples. */
1365         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1366         i = dev->noisecalc.nr_samples;
1367         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1368         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1369         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1370         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1371         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1372         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1373         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1374         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1375         dev->noisecalc.nr_samples++;
1376         if (dev->noisecalc.nr_samples == 8) {
1377                 /* Calculate the Link Quality by the noise samples. */
1378                 average = 0;
1379                 for (i = 0; i < 8; i++) {
1380                         for (j = 0; j < 4; j++)
1381                                 average += dev->noisecalc.samples[i][j];
1382                 }
1383                 average /= (8 * 4);
1384                 average *= 125;
1385                 average += 64;
1386                 average /= 128;
1387                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1388                 tmp = (tmp / 128) & 0x1F;
1389                 if (tmp >= 8)
1390                         average += 2;
1391                 else
1392                         average -= 25;
1393                 if (tmp == 8)
1394                         average -= 72;
1395                 else
1396                         average -= 48;
1397
1398                 dev->stats.link_noise = average;
1399                 dev->noisecalc.calculation_running = 0;
1400                 return;
1401         }
1402 generate_new:
1403         b43_generate_noise_sample(dev);
1404 }
1405
1406 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1407 {
1408         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1409                 ///TODO: PS TBTT
1410         } else {
1411                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1412                         b43_power_saving_ctl_bits(dev, 0);
1413         }
1414         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1415                 dev->dfq_valid = 1;
1416 }
1417
1418 static void handle_irq_atim_end(struct b43_wldev *dev)
1419 {
1420         if (dev->dfq_valid) {
1421                 b43_write32(dev, B43_MMIO_MACCMD,
1422                             b43_read32(dev, B43_MMIO_MACCMD)
1423                             | B43_MACCMD_DFQ_VALID);
1424                 dev->dfq_valid = 0;
1425         }
1426 }
1427
1428 static void handle_irq_pmq(struct b43_wldev *dev)
1429 {
1430         u32 tmp;
1431
1432         //TODO: AP mode.
1433
1434         while (1) {
1435                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1436                 if (!(tmp & 0x00000008))
1437                         break;
1438         }
1439         /* 16bit write is odd, but correct. */
1440         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1441 }
1442
1443 static void b43_write_template_common(struct b43_wldev *dev,
1444                                       const u8 *data, u16 size,
1445                                       u16 ram_offset,
1446                                       u16 shm_size_offset, u8 rate)
1447 {
1448         u32 i, tmp;
1449         struct b43_plcp_hdr4 plcp;
1450
1451         plcp.data = 0;
1452         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1453         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1454         ram_offset += sizeof(u32);
1455         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1456          * So leave the first two bytes of the next write blank.
1457          */
1458         tmp = (u32) (data[0]) << 16;
1459         tmp |= (u32) (data[1]) << 24;
1460         b43_ram_write(dev, ram_offset, tmp);
1461         ram_offset += sizeof(u32);
1462         for (i = 2; i < size; i += sizeof(u32)) {
1463                 tmp = (u32) (data[i + 0]);
1464                 if (i + 1 < size)
1465                         tmp |= (u32) (data[i + 1]) << 8;
1466                 if (i + 2 < size)
1467                         tmp |= (u32) (data[i + 2]) << 16;
1468                 if (i + 3 < size)
1469                         tmp |= (u32) (data[i + 3]) << 24;
1470                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1471         }
1472         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1473                         size + sizeof(struct b43_plcp_hdr6));
1474 }
1475
1476 /* Check if the use of the antenna that ieee80211 told us to
1477  * use is possible. This will fall back to DEFAULT.
1478  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1479 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1480                                   u8 antenna_nr)
1481 {
1482         u8 antenna_mask;
1483
1484         if (antenna_nr == 0) {
1485                 /* Zero means "use default antenna". That's always OK. */
1486                 return 0;
1487         }
1488
1489         /* Get the mask of available antennas. */
1490         if (dev->phy.gmode)
1491                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1492         else
1493                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1494
1495         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1496                 /* This antenna is not available. Fall back to default. */
1497                 return 0;
1498         }
1499
1500         return antenna_nr;
1501 }
1502
1503 /* Convert a b43 antenna number value to the PHY TX control value. */
1504 static u16 b43_antenna_to_phyctl(int antenna)
1505 {
1506         switch (antenna) {
1507         case B43_ANTENNA0:
1508                 return B43_TXH_PHY_ANT0;
1509         case B43_ANTENNA1:
1510                 return B43_TXH_PHY_ANT1;
1511         case B43_ANTENNA2:
1512                 return B43_TXH_PHY_ANT2;
1513         case B43_ANTENNA3:
1514                 return B43_TXH_PHY_ANT3;
1515         case B43_ANTENNA_AUTO0:
1516         case B43_ANTENNA_AUTO1:
1517                 return B43_TXH_PHY_ANT01AUTO;
1518         }
1519         B43_WARN_ON(1);
1520         return 0;
1521 }
1522
1523 static void b43_write_beacon_template(struct b43_wldev *dev,
1524                                       u16 ram_offset,
1525                                       u16 shm_size_offset)
1526 {
1527         unsigned int i, len, variable_len;
1528         const struct ieee80211_mgmt *bcn;
1529         const u8 *ie;
1530         bool tim_found = 0;
1531         unsigned int rate;
1532         u16 ctl;
1533         int antenna;
1534         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1535
1536         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1537         len = min((size_t) dev->wl->current_beacon->len,
1538                   0x200 - sizeof(struct b43_plcp_hdr6));
1539         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1540
1541         b43_write_template_common(dev, (const u8 *)bcn,
1542                                   len, ram_offset, shm_size_offset, rate);
1543
1544         /* Write the PHY TX control parameters. */
1545         antenna = B43_ANTENNA_DEFAULT;
1546         antenna = b43_antenna_to_phyctl(antenna);
1547         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1548         /* We can't send beacons with short preamble. Would get PHY errors. */
1549         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1550         ctl &= ~B43_TXH_PHY_ANT;
1551         ctl &= ~B43_TXH_PHY_ENC;
1552         ctl |= antenna;
1553         if (b43_is_cck_rate(rate))
1554                 ctl |= B43_TXH_PHY_ENC_CCK;
1555         else
1556                 ctl |= B43_TXH_PHY_ENC_OFDM;
1557         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1558
1559         /* Find the position of the TIM and the DTIM_period value
1560          * and write them to SHM. */
1561         ie = bcn->u.beacon.variable;
1562         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1563         for (i = 0; i < variable_len - 2; ) {
1564                 uint8_t ie_id, ie_len;
1565
1566                 ie_id = ie[i];
1567                 ie_len = ie[i + 1];
1568                 if (ie_id == 5) {
1569                         u16 tim_position;
1570                         u16 dtim_period;
1571                         /* This is the TIM Information Element */
1572
1573                         /* Check whether the ie_len is in the beacon data range. */
1574                         if (variable_len < ie_len + 2 + i)
1575                                 break;
1576                         /* A valid TIM is at least 4 bytes long. */
1577                         if (ie_len < 4)
1578                                 break;
1579                         tim_found = 1;
1580
1581                         tim_position = sizeof(struct b43_plcp_hdr6);
1582                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1583                         tim_position += i;
1584
1585                         dtim_period = ie[i + 3];
1586
1587                         b43_shm_write16(dev, B43_SHM_SHARED,
1588                                         B43_SHM_SH_TIMBPOS, tim_position);
1589                         b43_shm_write16(dev, B43_SHM_SHARED,
1590                                         B43_SHM_SH_DTIMPER, dtim_period);
1591                         break;
1592                 }
1593                 i += ie_len + 2;
1594         }
1595         if (!tim_found) {
1596                 /*
1597                  * If ucode wants to modify TIM do it behind the beacon, this
1598                  * will happen, for example, when doing mesh networking.
1599                  */
1600                 b43_shm_write16(dev, B43_SHM_SHARED,
1601                                 B43_SHM_SH_TIMBPOS,
1602                                 len + sizeof(struct b43_plcp_hdr6));
1603                 b43_shm_write16(dev, B43_SHM_SHARED,
1604                                 B43_SHM_SH_DTIMPER, 0);
1605         }
1606         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1607 }
1608
1609 static void b43_upload_beacon0(struct b43_wldev *dev)
1610 {
1611         struct b43_wl *wl = dev->wl;
1612
1613         if (wl->beacon0_uploaded)
1614                 return;
1615         b43_write_beacon_template(dev, 0x68, 0x18);
1616         wl->beacon0_uploaded = 1;
1617 }
1618
1619 static void b43_upload_beacon1(struct b43_wldev *dev)
1620 {
1621         struct b43_wl *wl = dev->wl;
1622
1623         if (wl->beacon1_uploaded)
1624                 return;
1625         b43_write_beacon_template(dev, 0x468, 0x1A);
1626         wl->beacon1_uploaded = 1;
1627 }
1628
1629 static void handle_irq_beacon(struct b43_wldev *dev)
1630 {
1631         struct b43_wl *wl = dev->wl;
1632         u32 cmd, beacon0_valid, beacon1_valid;
1633
1634         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1635             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1636             !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1637                 return;
1638
1639         /* This is the bottom half of the asynchronous beacon update. */
1640
1641         /* Ignore interrupt in the future. */
1642         dev->irq_mask &= ~B43_IRQ_BEACON;
1643
1644         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1645         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1646         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1647
1648         /* Schedule interrupt manually, if busy. */
1649         if (beacon0_valid && beacon1_valid) {
1650                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1651                 dev->irq_mask |= B43_IRQ_BEACON;
1652                 return;
1653         }
1654
1655         if (unlikely(wl->beacon_templates_virgin)) {
1656                 /* We never uploaded a beacon before.
1657                  * Upload both templates now, but only mark one valid. */
1658                 wl->beacon_templates_virgin = 0;
1659                 b43_upload_beacon0(dev);
1660                 b43_upload_beacon1(dev);
1661                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1662                 cmd |= B43_MACCMD_BEACON0_VALID;
1663                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1664         } else {
1665                 if (!beacon0_valid) {
1666                         b43_upload_beacon0(dev);
1667                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1668                         cmd |= B43_MACCMD_BEACON0_VALID;
1669                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1670                 } else if (!beacon1_valid) {
1671                         b43_upload_beacon1(dev);
1672                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1673                         cmd |= B43_MACCMD_BEACON1_VALID;
1674                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1675                 }
1676         }
1677 }
1678
1679 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1680 {
1681         u32 old_irq_mask = dev->irq_mask;
1682
1683         /* update beacon right away or defer to irq */
1684         handle_irq_beacon(dev);
1685         if (old_irq_mask != dev->irq_mask) {
1686                 /* The handler updated the IRQ mask. */
1687                 B43_WARN_ON(!dev->irq_mask);
1688                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1689                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1690                 } else {
1691                         /* Device interrupts are currently disabled. That means
1692                          * we just ran the hardirq handler and scheduled the
1693                          * IRQ thread. The thread will write the IRQ mask when
1694                          * it finished, so there's nothing to do here. Writing
1695                          * the mask _here_ would incorrectly re-enable IRQs. */
1696                 }
1697         }
1698 }
1699
1700 static void b43_beacon_update_trigger_work(struct work_struct *work)
1701 {
1702         struct b43_wl *wl = container_of(work, struct b43_wl,
1703                                          beacon_update_trigger);
1704         struct b43_wldev *dev;
1705
1706         mutex_lock(&wl->mutex);
1707         dev = wl->current_dev;
1708         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1709                 if (b43_bus_host_is_sdio(dev->dev)) {
1710                         /* wl->mutex is enough. */
1711                         b43_do_beacon_update_trigger_work(dev);
1712                         mmiowb();
1713                 } else {
1714                         spin_lock_irq(&wl->hardirq_lock);
1715                         b43_do_beacon_update_trigger_work(dev);
1716                         mmiowb();
1717                         spin_unlock_irq(&wl->hardirq_lock);
1718                 }
1719         }
1720         mutex_unlock(&wl->mutex);
1721 }
1722
1723 /* Asynchronously update the packet templates in template RAM.
1724  * Locking: Requires wl->mutex to be locked. */
1725 static void b43_update_templates(struct b43_wl *wl)
1726 {
1727         struct sk_buff *beacon;
1728
1729         /* This is the top half of the ansynchronous beacon update.
1730          * The bottom half is the beacon IRQ.
1731          * Beacon update must be asynchronous to avoid sending an
1732          * invalid beacon. This can happen for example, if the firmware
1733          * transmits a beacon while we are updating it. */
1734
1735         /* We could modify the existing beacon and set the aid bit in
1736          * the TIM field, but that would probably require resizing and
1737          * moving of data within the beacon template.
1738          * Simply request a new beacon and let mac80211 do the hard work. */
1739         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1740         if (unlikely(!beacon))
1741                 return;
1742
1743         if (wl->current_beacon)
1744                 dev_kfree_skb_any(wl->current_beacon);
1745         wl->current_beacon = beacon;
1746         wl->beacon0_uploaded = 0;
1747         wl->beacon1_uploaded = 0;
1748         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1749 }
1750
1751 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1752 {
1753         b43_time_lock(dev);
1754         if (dev->dev->core_rev >= 3) {
1755                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1756                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1757         } else {
1758                 b43_write16(dev, 0x606, (beacon_int >> 6));
1759                 b43_write16(dev, 0x610, beacon_int);
1760         }
1761         b43_time_unlock(dev);
1762         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1763 }
1764
1765 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1766 {
1767         u16 reason;
1768
1769         /* Read the register that contains the reason code for the panic. */
1770         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1771         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1772
1773         switch (reason) {
1774         default:
1775                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1776                 /* fallthrough */
1777         case B43_FWPANIC_DIE:
1778                 /* Do not restart the controller or firmware.
1779                  * The device is nonfunctional from now on.
1780                  * Restarting would result in this panic to trigger again,
1781                  * so we avoid that recursion. */
1782                 break;
1783         case B43_FWPANIC_RESTART:
1784                 b43_controller_restart(dev, "Microcode panic");
1785                 break;
1786         }
1787 }
1788
1789 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1790 {
1791         unsigned int i, cnt;
1792         u16 reason, marker_id, marker_line;
1793         __le16 *buf;
1794
1795         /* The proprietary firmware doesn't have this IRQ. */
1796         if (!dev->fw.opensource)
1797                 return;
1798
1799         /* Read the register that contains the reason code for this IRQ. */
1800         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1801
1802         switch (reason) {
1803         case B43_DEBUGIRQ_PANIC:
1804                 b43_handle_firmware_panic(dev);
1805                 break;
1806         case B43_DEBUGIRQ_DUMP_SHM:
1807                 if (!B43_DEBUG)
1808                         break; /* Only with driver debugging enabled. */
1809                 buf = kmalloc(4096, GFP_ATOMIC);
1810                 if (!buf) {
1811                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1812                         goto out;
1813                 }
1814                 for (i = 0; i < 4096; i += 2) {
1815                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1816                         buf[i / 2] = cpu_to_le16(tmp);
1817                 }
1818                 b43info(dev->wl, "Shared memory dump:\n");
1819                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1820                                16, 2, buf, 4096, 1);
1821                 kfree(buf);
1822                 break;
1823         case B43_DEBUGIRQ_DUMP_REGS:
1824                 if (!B43_DEBUG)
1825                         break; /* Only with driver debugging enabled. */
1826                 b43info(dev->wl, "Microcode register dump:\n");
1827                 for (i = 0, cnt = 0; i < 64; i++) {
1828                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1829                         if (cnt == 0)
1830                                 printk(KERN_INFO);
1831                         printk("r%02u: 0x%04X  ", i, tmp);
1832                         cnt++;
1833                         if (cnt == 6) {
1834                                 printk("\n");
1835                                 cnt = 0;
1836                         }
1837                 }
1838                 printk("\n");
1839                 break;
1840         case B43_DEBUGIRQ_MARKER:
1841                 if (!B43_DEBUG)
1842                         break; /* Only with driver debugging enabled. */
1843                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1844                                            B43_MARKER_ID_REG);
1845                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1846                                              B43_MARKER_LINE_REG);
1847                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1848                         "at line number %u\n",
1849                         marker_id, marker_line);
1850                 break;
1851         default:
1852                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1853                        reason);
1854         }
1855 out:
1856         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1857         b43_shm_write16(dev, B43_SHM_SCRATCH,
1858                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1859 }
1860
1861 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1862 {
1863         u32 reason;
1864         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1865         u32 merged_dma_reason = 0;
1866         int i;
1867
1868         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1869                 return;
1870
1871         reason = dev->irq_reason;
1872         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1873                 dma_reason[i] = dev->dma_reason[i];
1874                 merged_dma_reason |= dma_reason[i];
1875         }
1876
1877         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1878                 b43err(dev->wl, "MAC transmission error\n");
1879
1880         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1881                 b43err(dev->wl, "PHY transmission error\n");
1882                 rmb();
1883                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1884                         atomic_set(&dev->phy.txerr_cnt,
1885                                    B43_PHY_TX_BADNESS_LIMIT);
1886                         b43err(dev->wl, "Too many PHY TX errors, "
1887                                         "restarting the controller\n");
1888                         b43_controller_restart(dev, "PHY TX errors");
1889                 }
1890         }
1891
1892         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1893                                           B43_DMAIRQ_NONFATALMASK))) {
1894                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1895                         b43err(dev->wl, "Fatal DMA error: "
1896                                "0x%08X, 0x%08X, 0x%08X, "
1897                                "0x%08X, 0x%08X, 0x%08X\n",
1898                                dma_reason[0], dma_reason[1],
1899                                dma_reason[2], dma_reason[3],
1900                                dma_reason[4], dma_reason[5]);
1901                         b43err(dev->wl, "This device does not support DMA "
1902                                "on your system. It will now be switched to PIO.\n");
1903                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1904                         dev->use_pio = 1;
1905                         b43_controller_restart(dev, "DMA error");
1906                         return;
1907                 }
1908                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1909                         b43err(dev->wl, "DMA error: "
1910                                "0x%08X, 0x%08X, 0x%08X, "
1911                                "0x%08X, 0x%08X, 0x%08X\n",
1912                                dma_reason[0], dma_reason[1],
1913                                dma_reason[2], dma_reason[3],
1914                                dma_reason[4], dma_reason[5]);
1915                 }
1916         }
1917
1918         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1919                 handle_irq_ucode_debug(dev);
1920         if (reason & B43_IRQ_TBTT_INDI)
1921                 handle_irq_tbtt_indication(dev);
1922         if (reason & B43_IRQ_ATIM_END)
1923                 handle_irq_atim_end(dev);
1924         if (reason & B43_IRQ_BEACON)
1925                 handle_irq_beacon(dev);
1926         if (reason & B43_IRQ_PMQ)
1927                 handle_irq_pmq(dev);
1928         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1929                 ;/* TODO */
1930         if (reason & B43_IRQ_NOISESAMPLE_OK)
1931                 handle_irq_noise(dev);
1932
1933         /* Check the DMA reason registers for received data. */
1934         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1935                 if (b43_using_pio_transfers(dev))
1936                         b43_pio_rx(dev->pio.rx_queue);
1937                 else
1938                         b43_dma_rx(dev->dma.rx_ring);
1939         }
1940         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1941         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1942         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1943         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1944         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1945
1946         if (reason & B43_IRQ_TX_OK)
1947                 handle_irq_transmit_status(dev);
1948
1949         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1950         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1951
1952 #if B43_DEBUG
1953         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1954                 dev->irq_count++;
1955                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1956                         if (reason & (1 << i))
1957                                 dev->irq_bit_count[i]++;
1958                 }
1959         }
1960 #endif
1961 }
1962
1963 /* Interrupt thread handler. Handles device interrupts in thread context. */
1964 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1965 {
1966         struct b43_wldev *dev = dev_id;
1967
1968         mutex_lock(&dev->wl->mutex);
1969         b43_do_interrupt_thread(dev);
1970         mmiowb();
1971         mutex_unlock(&dev->wl->mutex);
1972
1973         return IRQ_HANDLED;
1974 }
1975
1976 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1977 {
1978         u32 reason;
1979
1980         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1981          * On SDIO, this runs under wl->mutex. */
1982
1983         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1984         if (reason == 0xffffffff)       /* shared IRQ */
1985                 return IRQ_NONE;
1986         reason &= dev->irq_mask;
1987         if (!reason)
1988                 return IRQ_NONE;
1989
1990         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1991             & 0x0001DC00;
1992         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1993             & 0x0000DC00;
1994         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1995             & 0x0000DC00;
1996         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1997             & 0x0001DC00;
1998         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1999             & 0x0000DC00;
2000 /* Unused ring
2001         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2002             & 0x0000DC00;
2003 */
2004
2005         /* ACK the interrupt. */
2006         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2007         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2008         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2009         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2010         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2011         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2012 /* Unused ring
2013         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2014 */
2015
2016         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2017         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2018         /* Save the reason bitmasks for the IRQ thread handler. */
2019         dev->irq_reason = reason;
2020
2021         return IRQ_WAKE_THREAD;
2022 }
2023
2024 /* Interrupt handler top-half. This runs with interrupts disabled. */
2025 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2026 {
2027         struct b43_wldev *dev = dev_id;
2028         irqreturn_t ret;
2029
2030         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2031                 return IRQ_NONE;
2032
2033         spin_lock(&dev->wl->hardirq_lock);
2034         ret = b43_do_interrupt(dev);
2035         mmiowb();
2036         spin_unlock(&dev->wl->hardirq_lock);
2037
2038         return ret;
2039 }
2040
2041 /* SDIO interrupt handler. This runs in process context. */
2042 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2043 {
2044         struct b43_wl *wl = dev->wl;
2045         irqreturn_t ret;
2046
2047         mutex_lock(&wl->mutex);
2048
2049         ret = b43_do_interrupt(dev);
2050         if (ret == IRQ_WAKE_THREAD)
2051                 b43_do_interrupt_thread(dev);
2052
2053         mutex_unlock(&wl->mutex);
2054 }
2055
2056 void b43_do_release_fw(struct b43_firmware_file *fw)
2057 {
2058         release_firmware(fw->data);
2059         fw->data = NULL;
2060         fw->filename = NULL;
2061 }
2062
2063 static void b43_release_firmware(struct b43_wldev *dev)
2064 {
2065         b43_do_release_fw(&dev->fw.ucode);
2066         b43_do_release_fw(&dev->fw.pcm);
2067         b43_do_release_fw(&dev->fw.initvals);
2068         b43_do_release_fw(&dev->fw.initvals_band);
2069 }
2070
2071 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2072 {
2073         const char text[] =
2074                 "You must go to " \
2075                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2076                 "and download the correct firmware for this driver version. " \
2077                 "Please carefully read all instructions on this website.\n";
2078
2079         if (error)
2080                 b43err(wl, text);
2081         else
2082                 b43warn(wl, text);
2083 }
2084
2085 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2086                       const char *name,
2087                       struct b43_firmware_file *fw)
2088 {
2089         const struct firmware *blob;
2090         struct b43_fw_header *hdr;
2091         u32 size;
2092         int err;
2093
2094         if (!name) {
2095                 /* Don't fetch anything. Free possibly cached firmware. */
2096                 /* FIXME: We should probably keep it anyway, to save some headache
2097                  * on suspend/resume with multiband devices. */
2098                 b43_do_release_fw(fw);
2099                 return 0;
2100         }
2101         if (fw->filename) {
2102                 if ((fw->type == ctx->req_type) &&
2103                     (strcmp(fw->filename, name) == 0))
2104                         return 0; /* Already have this fw. */
2105                 /* Free the cached firmware first. */
2106                 /* FIXME: We should probably do this later after we successfully
2107                  * got the new fw. This could reduce headache with multiband devices.
2108                  * We could also redesign this to cache the firmware for all possible
2109                  * bands all the time. */
2110                 b43_do_release_fw(fw);
2111         }
2112
2113         switch (ctx->req_type) {
2114         case B43_FWTYPE_PROPRIETARY:
2115                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2116                          "b43%s/%s.fw",
2117                          modparam_fwpostfix, name);
2118                 break;
2119         case B43_FWTYPE_OPENSOURCE:
2120                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2121                          "b43-open%s/%s.fw",
2122                          modparam_fwpostfix, name);
2123                 break;
2124         default:
2125                 B43_WARN_ON(1);
2126                 return -ENOSYS;
2127         }
2128         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2129         if (err == -ENOENT) {
2130                 snprintf(ctx->errors[ctx->req_type],
2131                          sizeof(ctx->errors[ctx->req_type]),
2132                          "Firmware file \"%s\" not found\n", ctx->fwname);
2133                 return err;
2134         } else if (err) {
2135                 snprintf(ctx->errors[ctx->req_type],
2136                          sizeof(ctx->errors[ctx->req_type]),
2137                          "Firmware file \"%s\" request failed (err=%d)\n",
2138                          ctx->fwname, err);
2139                 return err;
2140         }
2141         if (blob->size < sizeof(struct b43_fw_header))
2142                 goto err_format;
2143         hdr = (struct b43_fw_header *)(blob->data);
2144         switch (hdr->type) {
2145         case B43_FW_TYPE_UCODE:
2146         case B43_FW_TYPE_PCM:
2147                 size = be32_to_cpu(hdr->size);
2148                 if (size != blob->size - sizeof(struct b43_fw_header))
2149                         goto err_format;
2150                 /* fallthrough */
2151         case B43_FW_TYPE_IV:
2152                 if (hdr->ver != 1)
2153                         goto err_format;
2154                 break;
2155         default:
2156                 goto err_format;
2157         }
2158
2159         fw->data = blob;
2160         fw->filename = name;
2161         fw->type = ctx->req_type;
2162
2163         return 0;
2164
2165 err_format:
2166         snprintf(ctx->errors[ctx->req_type],
2167                  sizeof(ctx->errors[ctx->req_type]),
2168                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2169         release_firmware(blob);
2170
2171         return -EPROTO;
2172 }
2173
2174 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2175 {
2176         struct b43_wldev *dev = ctx->dev;
2177         struct b43_firmware *fw = &ctx->dev->fw;
2178         const u8 rev = ctx->dev->dev->core_rev;
2179         const char *filename;
2180         u32 tmshigh;
2181         int err;
2182
2183         /* Files for HT and LCN were found by trying one by one */
2184
2185         /* Get microcode */
2186         if ((rev >= 5) && (rev <= 10)) {
2187                 filename = "ucode5";
2188         } else if ((rev >= 11) && (rev <= 12)) {
2189                 filename = "ucode11";
2190         } else if (rev == 13) {
2191                 filename = "ucode13";
2192         } else if (rev == 14) {
2193                 filename = "ucode14";
2194         } else if (rev == 15) {
2195                 filename = "ucode15";
2196         } else {
2197                 switch (dev->phy.type) {
2198                 case B43_PHYTYPE_N:
2199                         if (rev >= 16)
2200                                 filename = "ucode16_mimo";
2201                         else
2202                                 goto err_no_ucode;
2203                         break;
2204                 case B43_PHYTYPE_HT:
2205                         if (rev == 29)
2206                                 filename = "ucode29_mimo";
2207                         else
2208                                 goto err_no_ucode;
2209                         break;
2210                 case B43_PHYTYPE_LCN:
2211                         if (rev == 24)
2212                                 filename = "ucode24_mimo";
2213                         else
2214                                 goto err_no_ucode;
2215                         break;
2216                 default:
2217                         goto err_no_ucode;
2218                 }
2219         }
2220         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2221         if (err)
2222                 goto err_load;
2223
2224         /* Get PCM code */
2225         if ((rev >= 5) && (rev <= 10))
2226                 filename = "pcm5";
2227         else if (rev >= 11)
2228                 filename = NULL;
2229         else
2230                 goto err_no_pcm;
2231         fw->pcm_request_failed = 0;
2232         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2233         if (err == -ENOENT) {
2234                 /* We did not find a PCM file? Not fatal, but
2235                  * core rev <= 10 must do without hwcrypto then. */
2236                 fw->pcm_request_failed = 1;
2237         } else if (err)
2238                 goto err_load;
2239
2240         /* Get initvals */
2241         switch (dev->phy.type) {
2242         case B43_PHYTYPE_A:
2243                 if ((rev >= 5) && (rev <= 10)) {
2244                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2245                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2246                                 filename = "a0g1initvals5";
2247                         else
2248                                 filename = "a0g0initvals5";
2249                 } else
2250                         goto err_no_initvals;
2251                 break;
2252         case B43_PHYTYPE_G:
2253                 if ((rev >= 5) && (rev <= 10))
2254                         filename = "b0g0initvals5";
2255                 else if (rev >= 13)
2256                         filename = "b0g0initvals13";
2257                 else
2258                         goto err_no_initvals;
2259                 break;
2260         case B43_PHYTYPE_N:
2261                 if (rev >= 16)
2262                         filename = "n0initvals16";
2263                 else if ((rev >= 11) && (rev <= 12))
2264                         filename = "n0initvals11";
2265                 else
2266                         goto err_no_initvals;
2267                 break;
2268         case B43_PHYTYPE_LP:
2269                 if (rev == 13)
2270                         filename = "lp0initvals13";
2271                 else if (rev == 14)
2272                         filename = "lp0initvals14";
2273                 else if (rev >= 15)
2274                         filename = "lp0initvals15";
2275                 else
2276                         goto err_no_initvals;
2277                 break;
2278         case B43_PHYTYPE_HT:
2279                 if (rev == 29)
2280                         filename = "ht0initvals29";
2281                 else
2282                         goto err_no_initvals;
2283                 break;
2284         case B43_PHYTYPE_LCN:
2285                 if (rev == 24)
2286                         filename = "lcn0initvals24";
2287                 else
2288                         goto err_no_initvals;
2289                 break;
2290         default:
2291                 goto err_no_initvals;
2292         }
2293         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2294         if (err)
2295                 goto err_load;
2296
2297         /* Get bandswitch initvals */
2298         switch (dev->phy.type) {
2299         case B43_PHYTYPE_A:
2300                 if ((rev >= 5) && (rev <= 10)) {
2301                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2302                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2303                                 filename = "a0g1bsinitvals5";
2304                         else
2305                                 filename = "a0g0bsinitvals5";
2306                 } else if (rev >= 11)
2307                         filename = NULL;
2308                 else
2309                         goto err_no_initvals;
2310                 break;
2311         case B43_PHYTYPE_G:
2312                 if ((rev >= 5) && (rev <= 10))
2313                         filename = "b0g0bsinitvals5";
2314                 else if (rev >= 11)
2315                         filename = NULL;
2316                 else
2317                         goto err_no_initvals;
2318                 break;
2319         case B43_PHYTYPE_N:
2320                 if (rev >= 16)
2321                         filename = "n0bsinitvals16";
2322                 else if ((rev >= 11) && (rev <= 12))
2323                         filename = "n0bsinitvals11";
2324                 else
2325                         goto err_no_initvals;
2326                 break;
2327         case B43_PHYTYPE_LP:
2328                 if (rev == 13)
2329                         filename = "lp0bsinitvals13";
2330                 else if (rev == 14)
2331                         filename = "lp0bsinitvals14";
2332                 else if (rev >= 15)
2333                         filename = "lp0bsinitvals15";
2334                 else
2335                         goto err_no_initvals;
2336                 break;
2337         case B43_PHYTYPE_HT:
2338                 if (rev == 29)
2339                         filename = "ht0bsinitvals29";
2340                 else
2341                         goto err_no_initvals;
2342                 break;
2343         case B43_PHYTYPE_LCN:
2344                 if (rev == 24)
2345                         filename = "lcn0bsinitvals24";
2346                 else
2347                         goto err_no_initvals;
2348                 break;
2349         default:
2350                 goto err_no_initvals;
2351         }
2352         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2353         if (err)
2354                 goto err_load;
2355
2356         return 0;
2357
2358 err_no_ucode:
2359         err = ctx->fatal_failure = -EOPNOTSUPP;
2360         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2361                "is required for your device (wl-core rev %u)\n", rev);
2362         goto error;
2363
2364 err_no_pcm:
2365         err = ctx->fatal_failure = -EOPNOTSUPP;
2366         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2367                "is required for your device (wl-core rev %u)\n", rev);
2368         goto error;
2369
2370 err_no_initvals:
2371         err = ctx->fatal_failure = -EOPNOTSUPP;
2372         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2373                "is required for your device (wl-core rev %u)\n", rev);
2374         goto error;
2375
2376 err_load:
2377         /* We failed to load this firmware image. The error message
2378          * already is in ctx->errors. Return and let our caller decide
2379          * what to do. */
2380         goto error;
2381
2382 error:
2383         b43_release_firmware(dev);
2384         return err;
2385 }
2386
2387 static int b43_request_firmware(struct b43_wldev *dev)
2388 {
2389         struct b43_request_fw_context *ctx;
2390         unsigned int i;
2391         int err;
2392         const char *errmsg;
2393
2394         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2395         if (!ctx)
2396                 return -ENOMEM;
2397         ctx->dev = dev;
2398
2399         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2400         err = b43_try_request_fw(ctx);
2401         if (!err)
2402                 goto out; /* Successfully loaded it. */
2403         err = ctx->fatal_failure;
2404         if (err)
2405                 goto out;
2406
2407         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2408         err = b43_try_request_fw(ctx);
2409         if (!err)
2410                 goto out; /* Successfully loaded it. */
2411         err = ctx->fatal_failure;
2412         if (err)
2413                 goto out;
2414
2415         /* Could not find a usable firmware. Print the errors. */
2416         for (i = 0; i < B43_NR_FWTYPES; i++) {
2417                 errmsg = ctx->errors[i];
2418                 if (strlen(errmsg))
2419                         b43err(dev->wl, errmsg);
2420         }
2421         b43_print_fw_helptext(dev->wl, 1);
2422         err = -ENOENT;
2423
2424 out:
2425         kfree(ctx);
2426         return err;
2427 }
2428
2429 static int b43_upload_microcode(struct b43_wldev *dev)
2430 {
2431         struct wiphy *wiphy = dev->wl->hw->wiphy;
2432         const size_t hdr_len = sizeof(struct b43_fw_header);
2433         const __be32 *data;
2434         unsigned int i, len;
2435         u16 fwrev, fwpatch, fwdate, fwtime;
2436         u32 tmp, macctl;
2437         int err = 0;
2438
2439         /* Jump the microcode PSM to offset 0 */
2440         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2441         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2442         macctl |= B43_MACCTL_PSM_JMP0;
2443         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2444         /* Zero out all microcode PSM registers and shared memory. */
2445         for (i = 0; i < 64; i++)
2446                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2447         for (i = 0; i < 4096; i += 2)
2448                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2449
2450         /* Upload Microcode. */
2451         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2452         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2453         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2454         for (i = 0; i < len; i++) {
2455                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2456                 udelay(10);
2457         }
2458
2459         if (dev->fw.pcm.data) {
2460                 /* Upload PCM data. */
2461                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2462                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2463                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2464                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2465                 /* No need for autoinc bit in SHM_HW */
2466                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2467                 for (i = 0; i < len; i++) {
2468                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2469                         udelay(10);
2470                 }
2471         }
2472
2473         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2474
2475         /* Start the microcode PSM */
2476         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2477         macctl &= ~B43_MACCTL_PSM_JMP0;
2478         macctl |= B43_MACCTL_PSM_RUN;
2479         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2480
2481         /* Wait for the microcode to load and respond */
2482         i = 0;
2483         while (1) {
2484                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2485                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2486                         break;
2487                 i++;
2488                 if (i >= 20) {
2489                         b43err(dev->wl, "Microcode not responding\n");
2490                         b43_print_fw_helptext(dev->wl, 1);
2491                         err = -ENODEV;
2492                         goto error;
2493                 }
2494                 msleep(50);
2495         }
2496         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2497
2498         /* Get and check the revisions. */
2499         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2500         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2501         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2502         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2503
2504         if (fwrev <= 0x128) {
2505                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2506                        "binary drivers older than version 4.x is unsupported. "
2507                        "You must upgrade your firmware files.\n");
2508                 b43_print_fw_helptext(dev->wl, 1);
2509                 err = -EOPNOTSUPP;
2510                 goto error;
2511         }
2512         dev->fw.rev = fwrev;
2513         dev->fw.patch = fwpatch;
2514         dev->fw.opensource = (fwdate == 0xFFFF);
2515
2516         /* Default to use-all-queues. */
2517         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2518         dev->qos_enabled = !!modparam_qos;
2519         /* Default to firmware/hardware crypto acceleration. */
2520         dev->hwcrypto_enabled = 1;
2521
2522         if (dev->fw.opensource) {
2523                 u16 fwcapa;
2524
2525                 /* Patchlevel info is encoded in the "time" field. */
2526                 dev->fw.patch = fwtime;
2527                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2528                         dev->fw.rev, dev->fw.patch);
2529
2530                 fwcapa = b43_fwcapa_read(dev);
2531                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2532                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2533                         /* Disable hardware crypto and fall back to software crypto. */
2534                         dev->hwcrypto_enabled = 0;
2535                 }
2536                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2537                         b43info(dev->wl, "QoS not supported by firmware\n");
2538                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2539                          * ieee80211_unregister to make sure the networking core can
2540                          * properly free possible resources. */
2541                         dev->wl->hw->queues = 1;
2542                         dev->qos_enabled = 0;
2543                 }
2544         } else {
2545                 b43info(dev->wl, "Loading firmware version %u.%u "
2546                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2547                         fwrev, fwpatch,
2548                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2549                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2550                 if (dev->fw.pcm_request_failed) {
2551                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2552                                 "Hardware accelerated cryptography is disabled.\n");
2553                         b43_print_fw_helptext(dev->wl, 0);
2554                 }
2555         }
2556
2557         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2558                         dev->fw.rev, dev->fw.patch);
2559         wiphy->hw_version = dev->dev->core_id;
2560
2561         if (b43_is_old_txhdr_format(dev)) {
2562                 /* We're over the deadline, but we keep support for old fw
2563                  * until it turns out to be in major conflict with something new. */
2564                 b43warn(dev->wl, "You are using an old firmware image. "
2565                         "Support for old firmware will be removed soon "
2566                         "(official deadline was July 2008).\n");
2567                 b43_print_fw_helptext(dev->wl, 0);
2568         }
2569
2570         return 0;
2571
2572 error:
2573         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2574         macctl &= ~B43_MACCTL_PSM_RUN;
2575         macctl |= B43_MACCTL_PSM_JMP0;
2576         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2577
2578         return err;
2579 }
2580
2581 static int b43_write_initvals(struct b43_wldev *dev,
2582                               const struct b43_iv *ivals,
2583                               size_t count,
2584                               size_t array_size)
2585 {
2586         const struct b43_iv *iv;
2587         u16 offset;
2588         size_t i;
2589         bool bit32;
2590
2591         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2592         iv = ivals;
2593         for (i = 0; i < count; i++) {
2594                 if (array_size < sizeof(iv->offset_size))
2595                         goto err_format;
2596                 array_size -= sizeof(iv->offset_size);
2597                 offset = be16_to_cpu(iv->offset_size);
2598                 bit32 = !!(offset & B43_IV_32BIT);
2599                 offset &= B43_IV_OFFSET_MASK;
2600                 if (offset >= 0x1000)
2601                         goto err_format;
2602                 if (bit32) {
2603                         u32 value;
2604
2605                         if (array_size < sizeof(iv->data.d32))
2606                                 goto err_format;
2607                         array_size -= sizeof(iv->data.d32);
2608
2609                         value = get_unaligned_be32(&iv->data.d32);
2610                         b43_write32(dev, offset, value);
2611
2612                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2613                                                         sizeof(__be16) +
2614                                                         sizeof(__be32));
2615                 } else {
2616                         u16 value;
2617
2618                         if (array_size < sizeof(iv->data.d16))
2619                                 goto err_format;
2620                         array_size -= sizeof(iv->data.d16);
2621
2622                         value = be16_to_cpu(iv->data.d16);
2623                         b43_write16(dev, offset, value);
2624
2625                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2626                                                         sizeof(__be16) +
2627                                                         sizeof(__be16));
2628                 }
2629         }
2630         if (array_size)
2631                 goto err_format;
2632
2633         return 0;
2634
2635 err_format:
2636         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2637         b43_print_fw_helptext(dev->wl, 1);
2638
2639         return -EPROTO;
2640 }
2641
2642 static int b43_upload_initvals(struct b43_wldev *dev)
2643 {
2644         const size_t hdr_len = sizeof(struct b43_fw_header);
2645         const struct b43_fw_header *hdr;
2646         struct b43_firmware *fw = &dev->fw;
2647         const struct b43_iv *ivals;
2648         size_t count;
2649         int err;
2650
2651         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2652         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2653         count = be32_to_cpu(hdr->size);
2654         err = b43_write_initvals(dev, ivals, count,
2655                                  fw->initvals.data->size - hdr_len);
2656         if (err)
2657                 goto out;
2658         if (fw->initvals_band.data) {
2659                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2660                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2661                 count = be32_to_cpu(hdr->size);
2662                 err = b43_write_initvals(dev, ivals, count,
2663                                          fw->initvals_band.data->size - hdr_len);
2664                 if (err)
2665                         goto out;
2666         }
2667 out:
2668
2669         return err;
2670 }
2671
2672 /* Initialize the GPIOs
2673  * http://bcm-specs.sipsolutions.net/GPIO
2674  */
2675 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2676 {
2677         struct ssb_bus *bus = dev->dev->sdev->bus;
2678
2679 #ifdef CONFIG_SSB_DRIVER_PCICORE
2680         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2681 #else
2682         return bus->chipco.dev;
2683 #endif
2684 }
2685
2686 static int b43_gpio_init(struct b43_wldev *dev)
2687 {
2688         struct ssb_device *gpiodev;
2689         u32 mask, set;
2690
2691         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2692                     & ~B43_MACCTL_GPOUTSMSK);
2693
2694         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2695                     | 0x000F);
2696
2697         mask = 0x0000001F;
2698         set = 0x0000000F;
2699         if (dev->dev->chip_id == 0x4301) {
2700                 mask |= 0x0060;
2701                 set |= 0x0060;
2702         }
2703         if (0 /* FIXME: conditional unknown */ ) {
2704                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2705                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2706                             | 0x0100);
2707                 mask |= 0x0180;
2708                 set |= 0x0180;
2709         }
2710         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2711                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2712                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2713                             | 0x0200);
2714                 mask |= 0x0200;
2715                 set |= 0x0200;
2716         }
2717         if (dev->dev->core_rev >= 2)
2718                 mask |= 0x0010; /* FIXME: This is redundant. */
2719
2720         switch (dev->dev->bus_type) {
2721 #ifdef CONFIG_B43_BCMA
2722         case B43_BUS_BCMA:
2723                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2724                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2725                                         BCMA_CC_GPIOCTL) & mask) | set);
2726                 break;
2727 #endif
2728 #ifdef CONFIG_B43_SSB
2729         case B43_BUS_SSB:
2730                 gpiodev = b43_ssb_gpio_dev(dev);
2731                 if (gpiodev)
2732                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2733                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2734                                     & mask) | set);
2735                 break;
2736 #endif
2737         }
2738
2739         return 0;
2740 }
2741
2742 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2743 static void b43_gpio_cleanup(struct b43_wldev *dev)
2744 {
2745         struct ssb_device *gpiodev;
2746
2747         switch (dev->dev->bus_type) {
2748 #ifdef CONFIG_B43_BCMA
2749         case B43_BUS_BCMA:
2750                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2751                                 0);
2752                 break;
2753 #endif
2754 #ifdef CONFIG_B43_SSB
2755         case B43_BUS_SSB:
2756                 gpiodev = b43_ssb_gpio_dev(dev);
2757                 if (gpiodev)
2758                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2759                 break;
2760 #endif
2761         }
2762 }
2763
2764 /* http://bcm-specs.sipsolutions.net/EnableMac */
2765 void b43_mac_enable(struct b43_wldev *dev)
2766 {
2767         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2768                 u16 fwstate;
2769
2770                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2771                                          B43_SHM_SH_UCODESTAT);
2772                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2773                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2774                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2775                                "should be suspended, but current state is %u\n",
2776                                fwstate);
2777                 }
2778         }
2779
2780         dev->mac_suspended--;
2781         B43_WARN_ON(dev->mac_suspended < 0);
2782         if (dev->mac_suspended == 0) {
2783                 b43_write32(dev, B43_MMIO_MACCTL,
2784                             b43_read32(dev, B43_MMIO_MACCTL)
2785                             | B43_MACCTL_ENABLED);
2786                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2787                             B43_IRQ_MAC_SUSPENDED);
2788                 /* Commit writes */
2789                 b43_read32(dev, B43_MMIO_MACCTL);
2790                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2791                 b43_power_saving_ctl_bits(dev, 0);
2792         }
2793 }
2794
2795 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2796 void b43_mac_suspend(struct b43_wldev *dev)
2797 {
2798         int i;
2799         u32 tmp;
2800
2801         might_sleep();
2802         B43_WARN_ON(dev->mac_suspended < 0);
2803
2804         if (dev->mac_suspended == 0) {
2805                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2806                 b43_write32(dev, B43_MMIO_MACCTL,
2807                             b43_read32(dev, B43_MMIO_MACCTL)
2808                             & ~B43_MACCTL_ENABLED);
2809                 /* force pci to flush the write */
2810                 b43_read32(dev, B43_MMIO_MACCTL);
2811                 for (i = 35; i; i--) {
2812                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2813                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2814                                 goto out;
2815                         udelay(10);
2816                 }
2817                 /* Hm, it seems this will take some time. Use msleep(). */
2818                 for (i = 40; i; i--) {
2819                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2820                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2821                                 goto out;
2822                         msleep(1);
2823                 }
2824                 b43err(dev->wl, "MAC suspend failed\n");
2825         }
2826 out:
2827         dev->mac_suspended++;
2828 }
2829
2830 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2831 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2832 {
2833         u32 tmp;
2834
2835         switch (dev->dev->bus_type) {
2836 #ifdef CONFIG_B43_BCMA
2837         case B43_BUS_BCMA:
2838                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
2839                 if (on)
2840                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2841                 else
2842                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2843                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
2844                 break;
2845 #endif
2846 #ifdef CONFIG_B43_SSB
2847         case B43_BUS_SSB:
2848                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2849                 if (on)
2850                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2851                 else
2852                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2853                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2854                 break;
2855 #endif
2856         }
2857 }
2858
2859 static void b43_adjust_opmode(struct b43_wldev *dev)
2860 {
2861         struct b43_wl *wl = dev->wl;
2862         u32 ctl;
2863         u16 cfp_pretbtt;
2864
2865         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2866         /* Reset status to STA infrastructure mode. */
2867         ctl &= ~B43_MACCTL_AP;
2868         ctl &= ~B43_MACCTL_KEEP_CTL;
2869         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2870         ctl &= ~B43_MACCTL_KEEP_BAD;
2871         ctl &= ~B43_MACCTL_PROMISC;
2872         ctl &= ~B43_MACCTL_BEACPROMISC;
2873         ctl |= B43_MACCTL_INFRA;
2874
2875         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2876             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2877                 ctl |= B43_MACCTL_AP;
2878         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2879                 ctl &= ~B43_MACCTL_INFRA;
2880
2881         if (wl->filter_flags & FIF_CONTROL)
2882                 ctl |= B43_MACCTL_KEEP_CTL;
2883         if (wl->filter_flags & FIF_FCSFAIL)
2884                 ctl |= B43_MACCTL_KEEP_BAD;
2885         if (wl->filter_flags & FIF_PLCPFAIL)
2886                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2887         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2888                 ctl |= B43_MACCTL_PROMISC;
2889         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2890                 ctl |= B43_MACCTL_BEACPROMISC;
2891
2892         /* Workaround: On old hardware the HW-MAC-address-filter
2893          * doesn't work properly, so always run promisc in filter
2894          * it in software. */
2895         if (dev->dev->core_rev <= 4)
2896                 ctl |= B43_MACCTL_PROMISC;
2897
2898         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2899
2900         cfp_pretbtt = 2;
2901         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2902                 if (dev->dev->chip_id == 0x4306 &&
2903                     dev->dev->chip_rev == 3)
2904                         cfp_pretbtt = 100;
2905                 else
2906                         cfp_pretbtt = 50;
2907         }
2908         b43_write16(dev, 0x612, cfp_pretbtt);
2909
2910         /* FIXME: We don't currently implement the PMQ mechanism,
2911          *        so always disable it. If we want to implement PMQ,
2912          *        we need to enable it here (clear DISCPMQ) in AP mode.
2913          */
2914         if (0  /* ctl & B43_MACCTL_AP */) {
2915                 b43_write32(dev, B43_MMIO_MACCTL,
2916                             b43_read32(dev, B43_MMIO_MACCTL)
2917                             & ~B43_MACCTL_DISCPMQ);
2918         } else {
2919                 b43_write32(dev, B43_MMIO_MACCTL,
2920                             b43_read32(dev, B43_MMIO_MACCTL)
2921                             | B43_MACCTL_DISCPMQ);
2922         }
2923 }
2924
2925 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2926 {
2927         u16 offset;
2928
2929         if (is_ofdm) {
2930                 offset = 0x480;
2931                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2932         } else {
2933                 offset = 0x4C0;
2934                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2935         }
2936         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2937                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2938 }
2939
2940 static void b43_rate_memory_init(struct b43_wldev *dev)
2941 {
2942         switch (dev->phy.type) {
2943         case B43_PHYTYPE_A:
2944         case B43_PHYTYPE_G:
2945         case B43_PHYTYPE_N:
2946         case B43_PHYTYPE_LP:
2947                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2948                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2949                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2950                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2951                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2952                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2953                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2954                 if (dev->phy.type == B43_PHYTYPE_A)
2955                         break;
2956                 /* fallthrough */
2957         case B43_PHYTYPE_B:
2958                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2959                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2960                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2961                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2962                 break;
2963         default:
2964                 B43_WARN_ON(1);
2965         }
2966 }
2967
2968 /* Set the default values for the PHY TX Control Words. */
2969 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2970 {
2971         u16 ctl = 0;
2972
2973         ctl |= B43_TXH_PHY_ENC_CCK;
2974         ctl |= B43_TXH_PHY_ANT01AUTO;
2975         ctl |= B43_TXH_PHY_TXPWR;
2976
2977         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2978         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2979         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2980 }
2981
2982 /* Set the TX-Antenna for management frames sent by firmware. */
2983 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2984 {
2985         u16 ant;
2986         u16 tmp;
2987
2988         ant = b43_antenna_to_phyctl(antenna);
2989
2990         /* For ACK/CTS */
2991         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2992         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2993         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2994         /* For Probe Resposes */
2995         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2996         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2997         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2998 }
2999
3000 /* This is the opposite of b43_chip_init() */
3001 static void b43_chip_exit(struct b43_wldev *dev)
3002 {
3003         b43_phy_exit(dev);
3004         b43_gpio_cleanup(dev);
3005         /* firmware is released later */
3006 }
3007
3008 /* Initialize the chip
3009  * http://bcm-specs.sipsolutions.net/ChipInit
3010  */
3011 static int b43_chip_init(struct b43_wldev *dev)
3012 {
3013         struct b43_phy *phy = &dev->phy;
3014         int err;
3015         u32 macctl;
3016         u16 value16;
3017
3018         /* Initialize the MAC control */
3019         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3020         if (dev->phy.gmode)
3021                 macctl |= B43_MACCTL_GMODE;
3022         macctl |= B43_MACCTL_INFRA;
3023         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3024
3025         err = b43_request_firmware(dev);
3026         if (err)
3027                 goto out;
3028         err = b43_upload_microcode(dev);
3029         if (err)
3030                 goto out;       /* firmware is released later */
3031
3032         err = b43_gpio_init(dev);
3033         if (err)
3034                 goto out;       /* firmware is released later */
3035
3036         err = b43_upload_initvals(dev);
3037         if (err)
3038                 goto err_gpio_clean;
3039
3040         /* Turn the Analog on and initialize the PHY. */
3041         phy->ops->switch_analog(dev, 1);
3042         err = b43_phy_init(dev);
3043         if (err)
3044                 goto err_gpio_clean;
3045
3046         /* Disable Interference Mitigation. */
3047         if (phy->ops->interf_mitigation)
3048                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3049
3050         /* Select the antennae */
3051         if (phy->ops->set_rx_antenna)
3052                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3053         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3054
3055         if (phy->type == B43_PHYTYPE_B) {
3056                 value16 = b43_read16(dev, 0x005E);
3057                 value16 |= 0x0004;
3058                 b43_write16(dev, 0x005E, value16);
3059         }
3060         b43_write32(dev, 0x0100, 0x01000000);
3061         if (dev->dev->core_rev < 5)
3062                 b43_write32(dev, 0x010C, 0x01000000);
3063
3064         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3065                     & ~B43_MACCTL_INFRA);
3066         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3067                     | B43_MACCTL_INFRA);
3068
3069         /* Probe Response Timeout value */
3070         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3071         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3072
3073         /* Initially set the wireless operation mode. */
3074         b43_adjust_opmode(dev);
3075
3076         if (dev->dev->core_rev < 3) {
3077                 b43_write16(dev, 0x060E, 0x0000);
3078                 b43_write16(dev, 0x0610, 0x8000);
3079                 b43_write16(dev, 0x0604, 0x0000);
3080                 b43_write16(dev, 0x0606, 0x0200);
3081         } else {
3082                 b43_write32(dev, 0x0188, 0x80000000);
3083                 b43_write32(dev, 0x018C, 0x02000000);
3084         }
3085         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3086         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3087         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3088         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3089         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3090         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3091         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3092
3093         b43_mac_phy_clock_set(dev, true);
3094
3095         switch (dev->dev->bus_type) {
3096 #ifdef CONFIG_B43_BCMA
3097         case B43_BUS_BCMA:
3098                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3099                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3100                 break;
3101 #endif
3102 #ifdef CONFIG_B43_SSB
3103         case B43_BUS_SSB:
3104                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3105                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3106                 break;
3107 #endif
3108         }
3109
3110         err = 0;
3111         b43dbg(dev->wl, "Chip initialized\n");
3112 out:
3113         return err;
3114
3115 err_gpio_clean:
3116         b43_gpio_cleanup(dev);
3117         return err;
3118 }
3119
3120 static void b43_periodic_every60sec(struct b43_wldev *dev)
3121 {
3122         const struct b43_phy_operations *ops = dev->phy.ops;
3123
3124         if (ops->pwork_60sec)
3125                 ops->pwork_60sec(dev);
3126
3127         /* Force check the TX power emission now. */
3128         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3129 }
3130
3131 static void b43_periodic_every30sec(struct b43_wldev *dev)
3132 {
3133         /* Update device statistics. */
3134         b43_calculate_link_quality(dev);
3135 }
3136
3137 static void b43_periodic_every15sec(struct b43_wldev *dev)
3138 {
3139         struct b43_phy *phy = &dev->phy;
3140         u16 wdr;
3141
3142         if (dev->fw.opensource) {
3143                 /* Check if the firmware is still alive.
3144                  * It will reset the watchdog counter to 0 in its idle loop. */
3145                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3146                 if (unlikely(wdr)) {
3147                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3148                         b43_controller_restart(dev, "Firmware watchdog");
3149                         return;
3150                 } else {
3151                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3152                                         B43_WATCHDOG_REG, 1);
3153                 }
3154         }
3155
3156         if (phy->ops->pwork_15sec)
3157                 phy->ops->pwork_15sec(dev);
3158
3159         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3160         wmb();
3161
3162 #if B43_DEBUG
3163         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3164                 unsigned int i;
3165
3166                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3167                        dev->irq_count / 15,
3168                        dev->tx_count / 15,
3169                        dev->rx_count / 15);
3170                 dev->irq_count = 0;
3171                 dev->tx_count = 0;
3172                 dev->rx_count = 0;
3173                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3174                         if (dev->irq_bit_count[i]) {
3175                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3176                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3177                                 dev->irq_bit_count[i] = 0;
3178                         }
3179                 }
3180         }
3181 #endif
3182 }
3183
3184 static void do_periodic_work(struct b43_wldev *dev)
3185 {
3186         unsigned int state;
3187
3188         state = dev->periodic_state;
3189         if (state % 4 == 0)
3190                 b43_periodic_every60sec(dev);
3191         if (state % 2 == 0)
3192                 b43_periodic_every30sec(dev);
3193         b43_periodic_every15sec(dev);
3194 }
3195
3196 /* Periodic work locking policy:
3197  *      The whole periodic work handler is protected by
3198  *      wl->mutex. If another lock is needed somewhere in the
3199  *      pwork callchain, it's acquired in-place, where it's needed.
3200  */
3201 static void b43_periodic_work_handler(struct work_struct *work)
3202 {
3203         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3204                                              periodic_work.work);
3205         struct b43_wl *wl = dev->wl;
3206         unsigned long delay;
3207
3208         mutex_lock(&wl->mutex);
3209
3210         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3211                 goto out;
3212         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3213                 goto out_requeue;
3214
3215         do_periodic_work(dev);
3216
3217         dev->periodic_state++;
3218 out_requeue:
3219         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3220                 delay = msecs_to_jiffies(50);
3221         else
3222                 delay = round_jiffies_relative(HZ * 15);
3223         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3224 out:
3225         mutex_unlock(&wl->mutex);
3226 }
3227
3228 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3229 {
3230         struct delayed_work *work = &dev->periodic_work;
3231
3232         dev->periodic_state = 0;
3233         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3234         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3235 }
3236
3237 /* Check if communication with the device works correctly. */
3238 static int b43_validate_chipaccess(struct b43_wldev *dev)
3239 {
3240         u32 v, backup0, backup4;
3241
3242         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3243         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3244
3245         /* Check for read/write and endianness problems. */
3246         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3247         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3248                 goto error;
3249         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3250         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3251                 goto error;
3252
3253         /* Check if unaligned 32bit SHM_SHARED access works properly.
3254          * However, don't bail out on failure, because it's noncritical. */
3255         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3256         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3257         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3258         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3259         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3260                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3261         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3262         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3263             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3264             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3265             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3266                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3267
3268         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3269         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3270
3271         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3272                 /* The 32bit register shadows the two 16bit registers
3273                  * with update sideeffects. Validate this. */
3274                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3275                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3276                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3277                         goto error;
3278                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3279                         goto error;
3280         }
3281         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3282
3283         v = b43_read32(dev, B43_MMIO_MACCTL);
3284         v |= B43_MACCTL_GMODE;
3285         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3286                 goto error;
3287
3288         return 0;
3289 error:
3290         b43err(dev->wl, "Failed to validate the chipaccess\n");
3291         return -ENODEV;
3292 }
3293
3294 static void b43_security_init(struct b43_wldev *dev)
3295 {
3296         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3297         /* KTP is a word address, but we address SHM bytewise.
3298          * So multiply by two.
3299          */
3300         dev->ktp *= 2;
3301         /* Number of RCMTA address slots */
3302         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3303         /* Clear the key memory. */
3304         b43_clear_keys(dev);
3305 }
3306
3307 #ifdef CONFIG_B43_HWRNG
3308 static int b43_rng_read(struct hwrng *rng, u32 *data)
3309 {
3310         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3311         struct b43_wldev *dev;
3312         int count = -ENODEV;
3313
3314         mutex_lock(&wl->mutex);
3315         dev = wl->current_dev;
3316         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3317                 *data = b43_read16(dev, B43_MMIO_RNG);
3318                 count = sizeof(u16);
3319         }
3320         mutex_unlock(&wl->mutex);
3321
3322         return count;
3323 }
3324 #endif /* CONFIG_B43_HWRNG */
3325
3326 static void b43_rng_exit(struct b43_wl *wl)
3327 {
3328 #ifdef CONFIG_B43_HWRNG
3329         if (wl->rng_initialized)
3330                 hwrng_unregister(&wl->rng);
3331 #endif /* CONFIG_B43_HWRNG */
3332 }
3333
3334 static int b43_rng_init(struct b43_wl *wl)
3335 {
3336         int err = 0;
3337
3338 #ifdef CONFIG_B43_HWRNG
3339         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3340                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3341         wl->rng.name = wl->rng_name;
3342         wl->rng.data_read = b43_rng_read;
3343         wl->rng.priv = (unsigned long)wl;
3344         wl->rng_initialized = 1;
3345         err = hwrng_register(&wl->rng);
3346         if (err) {
3347                 wl->rng_initialized = 0;
3348                 b43err(wl, "Failed to register the random "
3349                        "number generator (%d)\n", err);
3350         }
3351 #endif /* CONFIG_B43_HWRNG */
3352
3353         return err;
3354 }
3355
3356 static void b43_tx_work(struct work_struct *work)
3357 {
3358         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3359         struct b43_wldev *dev;
3360         struct sk_buff *skb;
3361         int err = 0;
3362
3363         mutex_lock(&wl->mutex);
3364         dev = wl->current_dev;
3365         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3366                 mutex_unlock(&wl->mutex);
3367                 return;
3368         }
3369
3370         while (skb_queue_len(&wl->tx_queue)) {
3371                 skb = skb_dequeue(&wl->tx_queue);
3372
3373                 if (b43_using_pio_transfers(dev))
3374                         err = b43_pio_tx(dev, skb);
3375                 else
3376                         err = b43_dma_tx(dev, skb);
3377                 if (unlikely(err))
3378                         dev_kfree_skb(skb); /* Drop it */
3379         }
3380
3381 #if B43_DEBUG
3382         dev->tx_count++;
3383 #endif
3384         mutex_unlock(&wl->mutex);
3385 }
3386
3387 static void b43_op_tx(struct ieee80211_hw *hw,
3388                      struct sk_buff *skb)
3389 {
3390         struct b43_wl *wl = hw_to_b43_wl(hw);
3391
3392         if (unlikely(skb->len < 2 + 2 + 6)) {
3393                 /* Too short, this can't be a valid frame. */
3394                 dev_kfree_skb_any(skb);
3395                 return;
3396         }
3397         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3398
3399         skb_queue_tail(&wl->tx_queue, skb);
3400         ieee80211_queue_work(wl->hw, &wl->tx_work);
3401 }
3402
3403 static void b43_qos_params_upload(struct b43_wldev *dev,
3404                                   const struct ieee80211_tx_queue_params *p,
3405                                   u16 shm_offset)
3406 {
3407         u16 params[B43_NR_QOSPARAMS];
3408         int bslots, tmp;
3409         unsigned int i;
3410
3411         if (!dev->qos_enabled)
3412                 return;
3413
3414         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3415
3416         memset(&params, 0, sizeof(params));
3417
3418         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3419         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3420         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3421         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3422         params[B43_QOSPARAM_AIFS] = p->aifs;
3423         params[B43_QOSPARAM_BSLOTS] = bslots;
3424         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3425
3426         for (i = 0; i < ARRAY_SIZE(params); i++) {
3427                 if (i == B43_QOSPARAM_STATUS) {
3428                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3429                                              shm_offset + (i * 2));
3430                         /* Mark the parameters as updated. */
3431                         tmp |= 0x100;
3432                         b43_shm_write16(dev, B43_SHM_SHARED,
3433                                         shm_offset + (i * 2),
3434                                         tmp);
3435                 } else {
3436                         b43_shm_write16(dev, B43_SHM_SHARED,
3437                                         shm_offset + (i * 2),
3438                                         params[i]);
3439                 }
3440         }
3441 }
3442
3443 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3444 static const u16 b43_qos_shm_offsets[] = {
3445         /* [mac80211-queue-nr] = SHM_OFFSET, */
3446         [0] = B43_QOS_VOICE,
3447         [1] = B43_QOS_VIDEO,
3448         [2] = B43_QOS_BESTEFFORT,
3449         [3] = B43_QOS_BACKGROUND,
3450 };
3451
3452 /* Update all QOS parameters in hardware. */
3453 static void b43_qos_upload_all(struct b43_wldev *dev)
3454 {
3455         struct b43_wl *wl = dev->wl;
3456         struct b43_qos_params *params;
3457         unsigned int i;
3458
3459         if (!dev->qos_enabled)
3460                 return;
3461
3462         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3463                      ARRAY_SIZE(wl->qos_params));
3464
3465         b43_mac_suspend(dev);
3466         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3467                 params = &(wl->qos_params[i]);
3468                 b43_qos_params_upload(dev, &(params->p),
3469                                       b43_qos_shm_offsets[i]);
3470         }
3471         b43_mac_enable(dev);
3472 }
3473
3474 static void b43_qos_clear(struct b43_wl *wl)
3475 {
3476         struct b43_qos_params *params;
3477         unsigned int i;
3478
3479         /* Initialize QoS parameters to sane defaults. */
3480
3481         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3482                      ARRAY_SIZE(wl->qos_params));
3483
3484         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3485                 params = &(wl->qos_params[i]);
3486
3487                 switch (b43_qos_shm_offsets[i]) {
3488                 case B43_QOS_VOICE:
3489                         params->p.txop = 0;
3490                         params->p.aifs = 2;
3491                         params->p.cw_min = 0x0001;
3492                         params->p.cw_max = 0x0001;
3493                         break;
3494                 case B43_QOS_VIDEO:
3495                         params->p.txop = 0;
3496                         params->p.aifs = 2;
3497                         params->p.cw_min = 0x0001;
3498                         params->p.cw_max = 0x0001;
3499                         break;
3500                 case B43_QOS_BESTEFFORT:
3501                         params->p.txop = 0;
3502                         params->p.aifs = 3;
3503                         params->p.cw_min = 0x0001;
3504                         params->p.cw_max = 0x03FF;
3505                         break;
3506                 case B43_QOS_BACKGROUND:
3507                         params->p.txop = 0;
3508                         params->p.aifs = 7;
3509                         params->p.cw_min = 0x0001;
3510                         params->p.cw_max = 0x03FF;
3511                         break;
3512                 default:
3513                         B43_WARN_ON(1);
3514                 }
3515         }
3516 }
3517
3518 /* Initialize the core's QOS capabilities */
3519 static void b43_qos_init(struct b43_wldev *dev)
3520 {
3521         if (!dev->qos_enabled) {
3522                 /* Disable QOS support. */
3523                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3524                 b43_write16(dev, B43_MMIO_IFSCTL,
3525                             b43_read16(dev, B43_MMIO_IFSCTL)
3526                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3527                 b43dbg(dev->wl, "QoS disabled\n");
3528                 return;
3529         }
3530
3531         /* Upload the current QOS parameters. */
3532         b43_qos_upload_all(dev);
3533
3534         /* Enable QOS support. */
3535         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3536         b43_write16(dev, B43_MMIO_IFSCTL,
3537                     b43_read16(dev, B43_MMIO_IFSCTL)
3538                     | B43_MMIO_IFSCTL_USE_EDCF);
3539         b43dbg(dev->wl, "QoS enabled\n");
3540 }
3541
3542 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3543                           const struct ieee80211_tx_queue_params *params)
3544 {
3545         struct b43_wl *wl = hw_to_b43_wl(hw);
3546         struct b43_wldev *dev;
3547         unsigned int queue = (unsigned int)_queue;
3548         int err = -ENODEV;
3549
3550         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3551                 /* Queue not available or don't support setting
3552                  * params on this queue. Return success to not
3553                  * confuse mac80211. */
3554                 return 0;
3555         }
3556         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3557                      ARRAY_SIZE(wl->qos_params));
3558
3559         mutex_lock(&wl->mutex);
3560         dev = wl->current_dev;
3561         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3562                 goto out_unlock;
3563
3564         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3565         b43_mac_suspend(dev);
3566         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3567                               b43_qos_shm_offsets[queue]);
3568         b43_mac_enable(dev);
3569         err = 0;
3570
3571 out_unlock:
3572         mutex_unlock(&wl->mutex);
3573
3574         return err;
3575 }
3576
3577 static int b43_op_get_stats(struct ieee80211_hw *hw,
3578                             struct ieee80211_low_level_stats *stats)
3579 {
3580         struct b43_wl *wl = hw_to_b43_wl(hw);
3581
3582         mutex_lock(&wl->mutex);
3583         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3584         mutex_unlock(&wl->mutex);
3585
3586         return 0;
3587 }
3588
3589 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3590 {
3591         struct b43_wl *wl = hw_to_b43_wl(hw);
3592         struct b43_wldev *dev;
3593         u64 tsf;
3594
3595         mutex_lock(&wl->mutex);
3596         dev = wl->current_dev;
3597
3598         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3599                 b43_tsf_read(dev, &tsf);
3600         else
3601                 tsf = 0;
3602
3603         mutex_unlock(&wl->mutex);
3604
3605         return tsf;
3606 }
3607
3608 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3609 {
3610         struct b43_wl *wl = hw_to_b43_wl(hw);
3611         struct b43_wldev *dev;
3612
3613         mutex_lock(&wl->mutex);
3614         dev = wl->current_dev;
3615
3616         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3617                 b43_tsf_write(dev, tsf);
3618
3619         mutex_unlock(&wl->mutex);
3620 }
3621
3622 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3623 {
3624         u32 tmp;
3625
3626         switch (dev->dev->bus_type) {
3627 #ifdef CONFIG_B43_BCMA
3628         case B43_BUS_BCMA:
3629                 b43err(dev->wl,
3630                        "Putting PHY into reset not supported on BCMA\n");
3631                 break;
3632 #endif
3633 #ifdef CONFIG_B43_SSB
3634         case B43_BUS_SSB:
3635                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3636                 tmp &= ~B43_TMSLOW_GMODE;
3637                 tmp |= B43_TMSLOW_PHYRESET;
3638                 tmp |= SSB_TMSLOW_FGC;
3639                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3640                 msleep(1);
3641
3642                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3643                 tmp &= ~SSB_TMSLOW_FGC;
3644                 tmp |= B43_TMSLOW_PHYRESET;
3645                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3646                 msleep(1);
3647
3648                 break;
3649 #endif
3650         }
3651 }
3652
3653 static const char *band_to_string(enum ieee80211_band band)
3654 {
3655         switch (band) {
3656         case IEEE80211_BAND_5GHZ:
3657                 return "5";
3658         case IEEE80211_BAND_2GHZ:
3659                 return "2.4";
3660         default:
3661                 break;
3662         }
3663         B43_WARN_ON(1);
3664         return "";
3665 }
3666
3667 /* Expects wl->mutex locked */
3668 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3669 {
3670         struct b43_wldev *up_dev = NULL;
3671         struct b43_wldev *down_dev;
3672         struct b43_wldev *d;
3673         int err;
3674         bool uninitialized_var(gmode);
3675         int prev_status;
3676
3677         /* Find a device and PHY which supports the band. */
3678         list_for_each_entry(d, &wl->devlist, list) {
3679                 switch (chan->band) {
3680                 case IEEE80211_BAND_5GHZ:
3681                         if (d->phy.supports_5ghz) {
3682                                 up_dev = d;
3683                                 gmode = 0;
3684                         }
3685                         break;
3686                 case IEEE80211_BAND_2GHZ:
3687                         if (d->phy.supports_2ghz) {
3688                                 up_dev = d;
3689                                 gmode = 1;
3690                         }
3691                         break;
3692                 default:
3693                         B43_WARN_ON(1);
3694                         return -EINVAL;
3695                 }
3696                 if (up_dev)
3697                         break;
3698         }
3699         if (!up_dev) {
3700                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3701                        band_to_string(chan->band));
3702                 return -ENODEV;
3703         }
3704         if ((up_dev == wl->current_dev) &&
3705             (!!wl->current_dev->phy.gmode == !!gmode)) {
3706                 /* This device is already running. */
3707                 return 0;
3708         }
3709         b43dbg(wl, "Switching to %s-GHz band\n",
3710                band_to_string(chan->band));
3711         down_dev = wl->current_dev;
3712
3713         prev_status = b43_status(down_dev);
3714         /* Shutdown the currently running core. */
3715         if (prev_status >= B43_STAT_STARTED)
3716                 down_dev = b43_wireless_core_stop(down_dev);
3717         if (prev_status >= B43_STAT_INITIALIZED)
3718                 b43_wireless_core_exit(down_dev);
3719
3720         if (down_dev != up_dev) {
3721                 /* We switch to a different core, so we put PHY into
3722                  * RESET on the old core. */
3723                 b43_put_phy_into_reset(down_dev);
3724         }
3725
3726         /* Now start the new core. */
3727         up_dev->phy.gmode = gmode;
3728         if (prev_status >= B43_STAT_INITIALIZED) {
3729                 err = b43_wireless_core_init(up_dev);
3730                 if (err) {
3731                         b43err(wl, "Fatal: Could not initialize device for "
3732                                "selected %s-GHz band\n",
3733                                band_to_string(chan->band));
3734                         goto init_failure;
3735                 }
3736         }
3737         if (prev_status >= B43_STAT_STARTED) {
3738                 err = b43_wireless_core_start(up_dev);
3739                 if (err) {
3740                         b43err(wl, "Fatal: Coult not start device for "
3741                                "selected %s-GHz band\n",
3742                                band_to_string(chan->band));
3743                         b43_wireless_core_exit(up_dev);
3744                         goto init_failure;
3745                 }
3746         }
3747         B43_WARN_ON(b43_status(up_dev) != prev_status);
3748
3749         wl->current_dev = up_dev;
3750
3751         return 0;
3752 init_failure:
3753         /* Whoops, failed to init the new core. No core is operating now. */
3754         wl->current_dev = NULL;
3755         return err;
3756 }
3757
3758 /* Write the short and long frame retry limit values. */
3759 static void b43_set_retry_limits(struct b43_wldev *dev,
3760                                  unsigned int short_retry,
3761                                  unsigned int long_retry)
3762 {
3763         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3764          * the chip-internal counter. */
3765         short_retry = min(short_retry, (unsigned int)0xF);
3766         long_retry = min(long_retry, (unsigned int)0xF);
3767
3768         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3769                         short_retry);
3770         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3771                         long_retry);
3772 }
3773
3774 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3775 {
3776         struct b43_wl *wl = hw_to_b43_wl(hw);
3777         struct b43_wldev *dev;
3778         struct b43_phy *phy;
3779         struct ieee80211_conf *conf = &hw->conf;
3780         int antenna;
3781         int err = 0;
3782
3783         mutex_lock(&wl->mutex);
3784
3785         /* Switch the band (if necessary). This might change the active core. */
3786         err = b43_switch_band(wl, conf->channel);
3787         if (err)
3788                 goto out_unlock_mutex;
3789         dev = wl->current_dev;
3790         phy = &dev->phy;
3791
3792         if (conf_is_ht(conf))
3793                 phy->is_40mhz =
3794                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3795         else
3796                 phy->is_40mhz = false;
3797
3798         b43_mac_suspend(dev);
3799
3800         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3801                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3802                                           conf->long_frame_max_tx_count);
3803         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3804         if (!changed)
3805                 goto out_mac_enable;
3806
3807         /* Switch to the requested channel.
3808          * The firmware takes care of races with the TX handler. */
3809         if (conf->channel->hw_value != phy->channel)
3810                 b43_switch_channel(dev, conf->channel->hw_value);
3811
3812         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3813
3814         /* Adjust the desired TX power level. */
3815         if (conf->power_level != 0) {
3816                 if (conf->power_level != phy->desired_txpower) {
3817                         phy->desired_txpower = conf->power_level;
3818                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3819                                                    B43_TXPWR_IGNORE_TSSI);
3820                 }
3821         }
3822
3823         /* Antennas for RX and management frame TX. */
3824         antenna = B43_ANTENNA_DEFAULT;
3825         b43_mgmtframe_txantenna(dev, antenna);
3826         antenna = B43_ANTENNA_DEFAULT;
3827         if (phy->ops->set_rx_antenna)
3828                 phy->ops->set_rx_antenna(dev, antenna);
3829
3830         if (wl->radio_enabled != phy->radio_on) {
3831                 if (wl->radio_enabled) {
3832                         b43_software_rfkill(dev, false);
3833                         b43info(dev->wl, "Radio turned on by software\n");
3834                         if (!dev->radio_hw_enable) {
3835                                 b43info(dev->wl, "The hardware RF-kill button "
3836                                         "still turns the radio physically off. "
3837                                         "Press the button to turn it on.\n");
3838                         }
3839                 } else {
3840                         b43_software_rfkill(dev, true);
3841                         b43info(dev->wl, "Radio turned off by software\n");
3842                 }
3843         }
3844
3845 out_mac_enable:
3846         b43_mac_enable(dev);
3847 out_unlock_mutex:
3848         mutex_unlock(&wl->mutex);
3849
3850         return err;
3851 }
3852
3853 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3854 {
3855         struct ieee80211_supported_band *sband =
3856                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3857         struct ieee80211_rate *rate;
3858         int i;
3859         u16 basic, direct, offset, basic_offset, rateptr;
3860
3861         for (i = 0; i < sband->n_bitrates; i++) {
3862                 rate = &sband->bitrates[i];
3863
3864                 if (b43_is_cck_rate(rate->hw_value)) {
3865                         direct = B43_SHM_SH_CCKDIRECT;
3866                         basic = B43_SHM_SH_CCKBASIC;
3867                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3868                         offset &= 0xF;
3869                 } else {
3870                         direct = B43_SHM_SH_OFDMDIRECT;
3871                         basic = B43_SHM_SH_OFDMBASIC;
3872                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3873                         offset &= 0xF;
3874                 }
3875
3876                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3877
3878                 if (b43_is_cck_rate(rate->hw_value)) {
3879                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3880                         basic_offset &= 0xF;
3881                 } else {
3882                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3883                         basic_offset &= 0xF;
3884                 }
3885
3886                 /*
3887                  * Get the pointer that we need to point to
3888                  * from the direct map
3889                  */
3890                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3891                                          direct + 2 * basic_offset);
3892                 /* and write it to the basic map */
3893                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3894                                 rateptr);
3895         }
3896 }
3897
3898 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3899                                     struct ieee80211_vif *vif,
3900                                     struct ieee80211_bss_conf *conf,
3901                                     u32 changed)
3902 {
3903         struct b43_wl *wl = hw_to_b43_wl(hw);
3904         struct b43_wldev *dev;
3905
3906         mutex_lock(&wl->mutex);
3907
3908         dev = wl->current_dev;
3909         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3910                 goto out_unlock_mutex;
3911
3912         B43_WARN_ON(wl->vif != vif);
3913
3914         if (changed & BSS_CHANGED_BSSID) {
3915                 if (conf->bssid)
3916                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3917                 else
3918                         memset(wl->bssid, 0, ETH_ALEN);
3919         }
3920
3921         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3922                 if (changed & BSS_CHANGED_BEACON &&
3923                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3924                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3925                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3926                         b43_update_templates(wl);
3927
3928                 if (changed & BSS_CHANGED_BSSID)
3929                         b43_write_mac_bssid_templates(dev);
3930         }
3931
3932         b43_mac_suspend(dev);
3933
3934         /* Update templates for AP/mesh mode. */
3935         if (changed & BSS_CHANGED_BEACON_INT &&
3936             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3937              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3938              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3939                 b43_set_beacon_int(dev, conf->beacon_int);
3940
3941         if (changed & BSS_CHANGED_BASIC_RATES)
3942                 b43_update_basic_rates(dev, conf->basic_rates);
3943
3944         if (changed & BSS_CHANGED_ERP_SLOT) {
3945                 if (conf->use_short_slot)
3946                         b43_short_slot_timing_enable(dev);
3947                 else
3948                         b43_short_slot_timing_disable(dev);
3949         }
3950
3951         b43_mac_enable(dev);
3952 out_unlock_mutex:
3953         mutex_unlock(&wl->mutex);
3954 }
3955
3956 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3957                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3958                           struct ieee80211_key_conf *key)
3959 {
3960         struct b43_wl *wl = hw_to_b43_wl(hw);
3961         struct b43_wldev *dev;
3962         u8 algorithm;
3963         u8 index;
3964         int err;
3965         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3966
3967         if (modparam_nohwcrypt)
3968                 return -ENOSPC; /* User disabled HW-crypto */
3969
3970         mutex_lock(&wl->mutex);
3971
3972         dev = wl->current_dev;
3973         err = -ENODEV;
3974         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3975                 goto out_unlock;
3976
3977         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3978                 /* We don't have firmware for the crypto engine.
3979                  * Must use software-crypto. */
3980                 err = -EOPNOTSUPP;
3981                 goto out_unlock;
3982         }
3983
3984         err = -EINVAL;
3985         switch (key->cipher) {
3986         case WLAN_CIPHER_SUITE_WEP40:
3987                 algorithm = B43_SEC_ALGO_WEP40;
3988                 break;
3989         case WLAN_CIPHER_SUITE_WEP104:
3990                 algorithm = B43_SEC_ALGO_WEP104;
3991                 break;
3992         case WLAN_CIPHER_SUITE_TKIP:
3993                 algorithm = B43_SEC_ALGO_TKIP;
3994                 break;
3995         case WLAN_CIPHER_SUITE_CCMP:
3996                 algorithm = B43_SEC_ALGO_AES;
3997                 break;
3998         default:
3999                 B43_WARN_ON(1);
4000                 goto out_unlock;
4001         }
4002         index = (u8) (key->keyidx);
4003         if (index > 3)
4004                 goto out_unlock;
4005
4006         switch (cmd) {
4007         case SET_KEY:
4008                 if (algorithm == B43_SEC_ALGO_TKIP &&
4009                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4010                     !modparam_hwtkip)) {
4011                         /* We support only pairwise key */
4012                         err = -EOPNOTSUPP;
4013                         goto out_unlock;
4014                 }
4015
4016                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4017                         if (WARN_ON(!sta)) {
4018                                 err = -EOPNOTSUPP;
4019                                 goto out_unlock;
4020                         }
4021                         /* Pairwise key with an assigned MAC address. */
4022                         err = b43_key_write(dev, -1, algorithm,
4023                                             key->key, key->keylen,
4024                                             sta->addr, key);
4025                 } else {
4026                         /* Group key */
4027                         err = b43_key_write(dev, index, algorithm,
4028                                             key->key, key->keylen, NULL, key);
4029                 }
4030                 if (err)
4031                         goto out_unlock;
4032
4033                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4034                     algorithm == B43_SEC_ALGO_WEP104) {
4035                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4036                 } else {
4037                         b43_hf_write(dev,
4038                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4039                 }
4040                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4041                 if (algorithm == B43_SEC_ALGO_TKIP)
4042                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4043                 break;
4044         case DISABLE_KEY: {
4045                 err = b43_key_clear(dev, key->hw_key_idx);
4046                 if (err)
4047                         goto out_unlock;
4048                 break;
4049         }
4050         default:
4051                 B43_WARN_ON(1);
4052         }
4053
4054 out_unlock:
4055         if (!err) {
4056                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4057                        "mac: %pM\n",
4058                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4059                        sta ? sta->addr : bcast_addr);
4060                 b43_dump_keymemory(dev);
4061         }
4062         mutex_unlock(&wl->mutex);
4063
4064         return err;
4065 }
4066
4067 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4068                                     unsigned int changed, unsigned int *fflags,
4069                                     u64 multicast)
4070 {
4071         struct b43_wl *wl = hw_to_b43_wl(hw);
4072         struct b43_wldev *dev;
4073
4074         mutex_lock(&wl->mutex);
4075         dev = wl->current_dev;
4076         if (!dev) {
4077                 *fflags = 0;
4078                 goto out_unlock;
4079         }
4080
4081         *fflags &= FIF_PROMISC_IN_BSS |
4082                   FIF_ALLMULTI |
4083                   FIF_FCSFAIL |
4084                   FIF_PLCPFAIL |
4085                   FIF_CONTROL |
4086                   FIF_OTHER_BSS |
4087                   FIF_BCN_PRBRESP_PROMISC;
4088
4089         changed &= FIF_PROMISC_IN_BSS |
4090                    FIF_ALLMULTI |
4091                    FIF_FCSFAIL |
4092                    FIF_PLCPFAIL |
4093                    FIF_CONTROL |
4094                    FIF_OTHER_BSS |
4095                    FIF_BCN_PRBRESP_PROMISC;
4096
4097         wl->filter_flags = *fflags;
4098
4099         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4100                 b43_adjust_opmode(dev);
4101
4102 out_unlock:
4103         mutex_unlock(&wl->mutex);
4104 }
4105
4106 /* Locking: wl->mutex
4107  * Returns the current dev. This might be different from the passed in dev,
4108  * because the core might be gone away while we unlocked the mutex. */
4109 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4110 {
4111         struct b43_wl *wl = dev->wl;
4112         struct b43_wldev *orig_dev;
4113         u32 mask;
4114
4115 redo:
4116         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4117                 return dev;
4118
4119         /* Cancel work. Unlock to avoid deadlocks. */
4120         mutex_unlock(&wl->mutex);
4121         cancel_delayed_work_sync(&dev->periodic_work);
4122         cancel_work_sync(&wl->tx_work);
4123         mutex_lock(&wl->mutex);
4124         dev = wl->current_dev;
4125         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4126                 /* Whoops, aliens ate up the device while we were unlocked. */
4127                 return dev;
4128         }
4129
4130         /* Disable interrupts on the device. */
4131         b43_set_status(dev, B43_STAT_INITIALIZED);
4132         if (b43_bus_host_is_sdio(dev->dev)) {
4133                 /* wl->mutex is locked. That is enough. */
4134                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4135                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4136         } else {
4137                 spin_lock_irq(&wl->hardirq_lock);
4138                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4139                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4140                 spin_unlock_irq(&wl->hardirq_lock);
4141         }
4142         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4143         orig_dev = dev;
4144         mutex_unlock(&wl->mutex);
4145         if (b43_bus_host_is_sdio(dev->dev)) {
4146                 b43_sdio_free_irq(dev);
4147         } else {
4148                 synchronize_irq(dev->dev->irq);
4149                 free_irq(dev->dev->irq, dev);
4150         }
4151         mutex_lock(&wl->mutex);
4152         dev = wl->current_dev;
4153         if (!dev)
4154                 return dev;
4155         if (dev != orig_dev) {
4156                 if (b43_status(dev) >= B43_STAT_STARTED)
4157                         goto redo;
4158                 return dev;
4159         }
4160         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4161         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4162
4163         /* Drain the TX queue */
4164         while (skb_queue_len(&wl->tx_queue))
4165                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4166
4167         b43_mac_suspend(dev);
4168         b43_leds_exit(dev);
4169         b43dbg(wl, "Wireless interface stopped\n");
4170
4171         return dev;
4172 }
4173
4174 /* Locking: wl->mutex */
4175 static int b43_wireless_core_start(struct b43_wldev *dev)
4176 {
4177         int err;
4178
4179         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4180
4181         drain_txstatus_queue(dev);
4182         if (b43_bus_host_is_sdio(dev->dev)) {
4183                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4184                 if (err) {
4185                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4186                         goto out;
4187                 }
4188         } else {
4189                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4190                                            b43_interrupt_thread_handler,
4191                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4192                 if (err) {
4193                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4194                                dev->dev->irq);
4195                         goto out;
4196                 }
4197         }
4198
4199         /* We are ready to run. */
4200         ieee80211_wake_queues(dev->wl->hw);
4201         b43_set_status(dev, B43_STAT_STARTED);
4202
4203         /* Start data flow (TX/RX). */
4204         b43_mac_enable(dev);
4205         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4206
4207         /* Start maintenance work */
4208         b43_periodic_tasks_setup(dev);
4209
4210         b43_leds_init(dev);
4211
4212         b43dbg(dev->wl, "Wireless interface started\n");
4213 out:
4214         return err;
4215 }
4216
4217 /* Get PHY and RADIO versioning numbers */
4218 static int b43_phy_versioning(struct b43_wldev *dev)
4219 {
4220         struct b43_phy *phy = &dev->phy;
4221         u32 tmp;
4222         u8 analog_type;
4223         u8 phy_type;
4224         u8 phy_rev;
4225         u16 radio_manuf;
4226         u16 radio_ver;
4227         u16 radio_rev;
4228         int unsupported = 0;
4229
4230         /* Get PHY versioning */
4231         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4232         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4233         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4234         phy_rev = (tmp & B43_PHYVER_VERSION);
4235         switch (phy_type) {
4236         case B43_PHYTYPE_A:
4237                 if (phy_rev >= 4)
4238                         unsupported = 1;
4239                 break;
4240         case B43_PHYTYPE_B:
4241                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4242                     && phy_rev != 7)
4243                         unsupported = 1;
4244                 break;
4245         case B43_PHYTYPE_G:
4246                 if (phy_rev > 9)
4247                         unsupported = 1;
4248                 break;
4249 #ifdef CONFIG_B43_PHY_N
4250         case B43_PHYTYPE_N:
4251                 if (phy_rev > 9)
4252                         unsupported = 1;
4253                 break;
4254 #endif
4255 #ifdef CONFIG_B43_PHY_LP
4256         case B43_PHYTYPE_LP:
4257                 if (phy_rev > 2)
4258                         unsupported = 1;
4259                 break;
4260 #endif
4261 #ifdef CONFIG_B43_PHY_HT
4262         case B43_PHYTYPE_HT:
4263                 if (phy_rev > 1)
4264                         unsupported = 1;
4265                 break;
4266 #endif
4267 #ifdef CONFIG_B43_PHY_LCN
4268         case B43_PHYTYPE_LCN:
4269                 if (phy_rev > 1)
4270                         unsupported = 1;
4271                 break;
4272 #endif
4273         default:
4274                 unsupported = 1;
4275         }
4276         if (unsupported) {
4277                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4278                        "(Analog %u, Type %u, Revision %u)\n",
4279                        analog_type, phy_type, phy_rev);
4280                 return -EOPNOTSUPP;
4281         }
4282         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4283                analog_type, phy_type, phy_rev);
4284
4285         /* Get RADIO versioning */
4286         if (dev->dev->core_rev >= 24) {
4287                 u16 radio24[3];
4288
4289                 for (tmp = 0; tmp < 3; tmp++) {
4290                         b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4291                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4292                 }
4293
4294                 /* Broadcom uses "id" for our "ver" and has separated "ver" */
4295                 /* radio_ver = (radio24[0] & 0xF0) >> 4; */
4296
4297                 radio_manuf = 0x17F;
4298                 radio_ver = (radio24[2] << 8) | radio24[1];
4299                 radio_rev = (radio24[0] & 0xF);
4300         } else {
4301                 if (dev->dev->chip_id == 0x4317) {
4302                         if (dev->dev->chip_rev == 0)
4303                                 tmp = 0x3205017F;
4304                         else if (dev->dev->chip_rev == 1)
4305                                 tmp = 0x4205017F;
4306                         else
4307                                 tmp = 0x5205017F;
4308                 } else {
4309                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4310                                     B43_RADIOCTL_ID);
4311                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4312                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4313                                     B43_RADIOCTL_ID);
4314                         tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4315                                 << 16;
4316                 }
4317                 radio_manuf = (tmp & 0x00000FFF);
4318                 radio_ver = (tmp & 0x0FFFF000) >> 12;
4319                 radio_rev = (tmp & 0xF0000000) >> 28;
4320         }
4321
4322         if (radio_manuf != 0x17F /* Broadcom */)
4323                 unsupported = 1;
4324         switch (phy_type) {
4325         case B43_PHYTYPE_A:
4326                 if (radio_ver != 0x2060)
4327                         unsupported = 1;
4328                 if (radio_rev != 1)
4329                         unsupported = 1;
4330                 if (radio_manuf != 0x17F)
4331                         unsupported = 1;
4332                 break;
4333         case B43_PHYTYPE_B:
4334                 if ((radio_ver & 0xFFF0) != 0x2050)
4335                         unsupported = 1;
4336                 break;
4337         case B43_PHYTYPE_G:
4338                 if (radio_ver != 0x2050)
4339                         unsupported = 1;
4340                 break;
4341         case B43_PHYTYPE_N:
4342                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4343                         unsupported = 1;
4344                 break;
4345         case B43_PHYTYPE_LP:
4346                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4347                         unsupported = 1;
4348                 break;
4349         case B43_PHYTYPE_HT:
4350                 if (radio_ver != 0x2059)
4351                         unsupported = 1;
4352                 break;
4353         case B43_PHYTYPE_LCN:
4354                 if (radio_ver != 0x2064)
4355                         unsupported = 1;
4356                 break;
4357         default:
4358                 B43_WARN_ON(1);
4359         }
4360         if (unsupported) {
4361                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4362                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4363                        radio_manuf, radio_ver, radio_rev);
4364                 return -EOPNOTSUPP;
4365         }
4366         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4367                radio_manuf, radio_ver, radio_rev);
4368
4369         phy->radio_manuf = radio_manuf;
4370         phy->radio_ver = radio_ver;
4371         phy->radio_rev = radio_rev;
4372
4373         phy->analog = analog_type;
4374         phy->type = phy_type;
4375         phy->rev = phy_rev;
4376
4377         return 0;
4378 }
4379
4380 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4381                                       struct b43_phy *phy)
4382 {
4383         phy->hardware_power_control = !!modparam_hwpctl;
4384         phy->next_txpwr_check_time = jiffies;
4385         /* PHY TX errors counter. */
4386         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4387
4388 #if B43_DEBUG
4389         phy->phy_locked = 0;
4390         phy->radio_locked = 0;
4391 #endif
4392 }
4393
4394 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4395 {
4396         dev->dfq_valid = 0;
4397
4398         /* Assume the radio is enabled. If it's not enabled, the state will
4399          * immediately get fixed on the first periodic work run. */
4400         dev->radio_hw_enable = 1;
4401
4402         /* Stats */
4403         memset(&dev->stats, 0, sizeof(dev->stats));
4404
4405         setup_struct_phy_for_init(dev, &dev->phy);
4406
4407         /* IRQ related flags */
4408         dev->irq_reason = 0;
4409         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4410         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4411         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4412                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4413
4414         dev->mac_suspended = 1;
4415
4416         /* Noise calculation context */
4417         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4418 }
4419
4420 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4421 {
4422         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4423         u64 hf;
4424
4425         if (!modparam_btcoex)
4426                 return;
4427         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4428                 return;
4429         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4430                 return;
4431
4432         hf = b43_hf_read(dev);
4433         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4434                 hf |= B43_HF_BTCOEXALT;
4435         else
4436                 hf |= B43_HF_BTCOEX;
4437         b43_hf_write(dev, hf);
4438 }
4439
4440 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4441 {
4442         if (!modparam_btcoex)
4443                 return;
4444         //TODO
4445 }
4446
4447 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4448 {
4449         struct ssb_bus *bus;
4450         u32 tmp;
4451
4452         if (dev->dev->bus_type != B43_BUS_SSB)
4453                 return;
4454
4455         bus = dev->dev->sdev->bus;
4456
4457         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4458             (bus->chip_id == 0x4312)) {
4459                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4460                 tmp &= ~SSB_IMCFGLO_REQTO;
4461                 tmp &= ~SSB_IMCFGLO_SERTO;
4462                 tmp |= 0x3;
4463                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4464                 ssb_commit_settings(bus);
4465         }
4466 }
4467
4468 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4469 {
4470         u16 pu_delay;
4471
4472         /* The time value is in microseconds. */
4473         if (dev->phy.type == B43_PHYTYPE_A)
4474                 pu_delay = 3700;
4475         else
4476                 pu_delay = 1050;
4477         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4478                 pu_delay = 500;
4479         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4480                 pu_delay = max(pu_delay, (u16)2400);
4481
4482         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4483 }
4484
4485 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4486 static void b43_set_pretbtt(struct b43_wldev *dev)
4487 {
4488         u16 pretbtt;
4489
4490         /* The time value is in microseconds. */
4491         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4492                 pretbtt = 2;
4493         } else {
4494                 if (dev->phy.type == B43_PHYTYPE_A)
4495                         pretbtt = 120;
4496                 else
4497                         pretbtt = 250;
4498         }
4499         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4500         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4501 }
4502
4503 /* Shutdown a wireless core */
4504 /* Locking: wl->mutex */
4505 static void b43_wireless_core_exit(struct b43_wldev *dev)
4506 {
4507         u32 macctl;
4508
4509         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4510         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4511                 return;
4512
4513         /* Unregister HW RNG driver */
4514         b43_rng_exit(dev->wl);
4515
4516         b43_set_status(dev, B43_STAT_UNINIT);
4517
4518         /* Stop the microcode PSM. */
4519         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4520         macctl &= ~B43_MACCTL_PSM_RUN;
4521         macctl |= B43_MACCTL_PSM_JMP0;
4522         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4523
4524         b43_dma_free(dev);
4525         b43_pio_free(dev);
4526         b43_chip_exit(dev);
4527         dev->phy.ops->switch_analog(dev, 0);
4528         if (dev->wl->current_beacon) {
4529                 dev_kfree_skb_any(dev->wl->current_beacon);
4530                 dev->wl->current_beacon = NULL;
4531         }
4532
4533         b43_device_disable(dev, 0);
4534         b43_bus_may_powerdown(dev);
4535 }
4536
4537 /* Initialize a wireless core */
4538 static int b43_wireless_core_init(struct b43_wldev *dev)
4539 {
4540         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4541         struct b43_phy *phy = &dev->phy;
4542         int err;
4543         u64 hf;
4544
4545         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4546
4547         err = b43_bus_powerup(dev, 0);
4548         if (err)
4549                 goto out;
4550         if (!b43_device_is_enabled(dev))
4551                 b43_wireless_core_reset(dev, phy->gmode);
4552
4553         /* Reset all data structures. */
4554         setup_struct_wldev_for_init(dev);
4555         phy->ops->prepare_structs(dev);
4556
4557         /* Enable IRQ routing to this device. */
4558         switch (dev->dev->bus_type) {
4559 #ifdef CONFIG_B43_BCMA
4560         case B43_BUS_BCMA:
4561                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
4562                                       dev->dev->bdev, true);
4563                 break;
4564 #endif
4565 #ifdef CONFIG_B43_SSB
4566         case B43_BUS_SSB:
4567                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4568                                                dev->dev->sdev);
4569                 break;
4570 #endif
4571         }
4572
4573         b43_imcfglo_timeouts_workaround(dev);
4574         b43_bluetooth_coext_disable(dev);
4575         if (phy->ops->prepare_hardware) {
4576                 err = phy->ops->prepare_hardware(dev);
4577                 if (err)
4578                         goto err_busdown;
4579         }
4580         err = b43_chip_init(dev);
4581         if (err)
4582                 goto err_busdown;
4583         b43_shm_write16(dev, B43_SHM_SHARED,
4584                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4585         hf = b43_hf_read(dev);
4586         if (phy->type == B43_PHYTYPE_G) {
4587                 hf |= B43_HF_SYMW;
4588                 if (phy->rev == 1)
4589                         hf |= B43_HF_GDCW;
4590                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4591                         hf |= B43_HF_OFDMPABOOST;
4592         }
4593         if (phy->radio_ver == 0x2050) {
4594                 if (phy->radio_rev == 6)
4595                         hf |= B43_HF_4318TSSI;
4596                 if (phy->radio_rev < 6)
4597                         hf |= B43_HF_VCORECALC;
4598         }
4599         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4600                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4601 #ifdef CONFIG_SSB_DRIVER_PCICORE
4602         if (dev->dev->bus_type == B43_BUS_SSB &&
4603             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4604             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4605                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4606 #endif
4607         hf &= ~B43_HF_SKCFPUP;
4608         b43_hf_write(dev, hf);
4609
4610         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4611                              B43_DEFAULT_LONG_RETRY_LIMIT);
4612         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4613         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4614
4615         /* Disable sending probe responses from firmware.
4616          * Setting the MaxTime to one usec will always trigger
4617          * a timeout, so we never send any probe resp.
4618          * A timeout of zero is infinite. */
4619         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4620
4621         b43_rate_memory_init(dev);
4622         b43_set_phytxctl_defaults(dev);
4623
4624         /* Minimum Contention Window */
4625         if (phy->type == B43_PHYTYPE_B)
4626                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4627         else
4628                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4629         /* Maximum Contention Window */
4630         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4631
4632         if (b43_bus_host_is_pcmcia(dev->dev) ||
4633             b43_bus_host_is_sdio(dev->dev) ||
4634             dev->use_pio) {
4635                 dev->__using_pio_transfers = 1;
4636                 err = b43_pio_init(dev);
4637         } else {
4638                 dev->__using_pio_transfers = 0;
4639                 err = b43_dma_init(dev);
4640         }
4641         if (err)
4642                 goto err_chip_exit;
4643         b43_qos_init(dev);
4644         b43_set_synth_pu_delay(dev, 1);
4645         b43_bluetooth_coext_enable(dev);
4646
4647         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4648         b43_upload_card_macaddress(dev);
4649         b43_security_init(dev);
4650
4651         ieee80211_wake_queues(dev->wl->hw);
4652
4653         b43_set_status(dev, B43_STAT_INITIALIZED);
4654
4655         /* Register HW RNG driver */
4656         b43_rng_init(dev->wl);
4657
4658 out:
4659         return err;
4660
4661 err_chip_exit:
4662         b43_chip_exit(dev);
4663 err_busdown:
4664         b43_bus_may_powerdown(dev);
4665         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4666         return err;
4667 }
4668
4669 static int b43_op_add_interface(struct ieee80211_hw *hw,
4670                                 struct ieee80211_vif *vif)
4671 {
4672         struct b43_wl *wl = hw_to_b43_wl(hw);
4673         struct b43_wldev *dev;
4674         int err = -EOPNOTSUPP;
4675
4676         /* TODO: allow WDS/AP devices to coexist */
4677
4678         if (vif->type != NL80211_IFTYPE_AP &&
4679             vif->type != NL80211_IFTYPE_MESH_POINT &&
4680             vif->type != NL80211_IFTYPE_STATION &&
4681             vif->type != NL80211_IFTYPE_WDS &&
4682             vif->type != NL80211_IFTYPE_ADHOC)
4683                 return -EOPNOTSUPP;
4684
4685         mutex_lock(&wl->mutex);
4686         if (wl->operating)
4687                 goto out_mutex_unlock;
4688
4689         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4690
4691         dev = wl->current_dev;
4692         wl->operating = 1;
4693         wl->vif = vif;
4694         wl->if_type = vif->type;
4695         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4696
4697         b43_adjust_opmode(dev);
4698         b43_set_pretbtt(dev);
4699         b43_set_synth_pu_delay(dev, 0);
4700         b43_upload_card_macaddress(dev);
4701
4702         err = 0;
4703  out_mutex_unlock:
4704         mutex_unlock(&wl->mutex);
4705
4706         return err;
4707 }
4708
4709 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4710                                     struct ieee80211_vif *vif)
4711 {
4712         struct b43_wl *wl = hw_to_b43_wl(hw);
4713         struct b43_wldev *dev = wl->current_dev;
4714
4715         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4716
4717         mutex_lock(&wl->mutex);
4718
4719         B43_WARN_ON(!wl->operating);
4720         B43_WARN_ON(wl->vif != vif);
4721         wl->vif = NULL;
4722
4723         wl->operating = 0;
4724
4725         b43_adjust_opmode(dev);
4726         memset(wl->mac_addr, 0, ETH_ALEN);
4727         b43_upload_card_macaddress(dev);
4728
4729         mutex_unlock(&wl->mutex);
4730 }
4731
4732 static int b43_op_start(struct ieee80211_hw *hw)
4733 {
4734         struct b43_wl *wl = hw_to_b43_wl(hw);
4735         struct b43_wldev *dev = wl->current_dev;
4736         int did_init = 0;
4737         int err = 0;
4738
4739         /* Kill all old instance specific information to make sure
4740          * the card won't use it in the short timeframe between start
4741          * and mac80211 reconfiguring it. */
4742         memset(wl->bssid, 0, ETH_ALEN);
4743         memset(wl->mac_addr, 0, ETH_ALEN);
4744         wl->filter_flags = 0;
4745         wl->radiotap_enabled = 0;
4746         b43_qos_clear(wl);
4747         wl->beacon0_uploaded = 0;
4748         wl->beacon1_uploaded = 0;
4749         wl->beacon_templates_virgin = 1;
4750         wl->radio_enabled = 1;
4751
4752         mutex_lock(&wl->mutex);
4753
4754         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4755                 err = b43_wireless_core_init(dev);
4756                 if (err)
4757                         goto out_mutex_unlock;
4758                 did_init = 1;
4759         }
4760
4761         if (b43_status(dev) < B43_STAT_STARTED) {
4762                 err = b43_wireless_core_start(dev);
4763                 if (err) {
4764                         if (did_init)
4765                                 b43_wireless_core_exit(dev);
4766                         goto out_mutex_unlock;
4767                 }
4768         }
4769
4770         /* XXX: only do if device doesn't support rfkill irq */
4771         wiphy_rfkill_start_polling(hw->wiphy);
4772
4773  out_mutex_unlock:
4774         mutex_unlock(&wl->mutex);
4775
4776         return err;
4777 }
4778
4779 static void b43_op_stop(struct ieee80211_hw *hw)
4780 {
4781         struct b43_wl *wl = hw_to_b43_wl(hw);
4782         struct b43_wldev *dev = wl->current_dev;
4783
4784         cancel_work_sync(&(wl->beacon_update_trigger));
4785
4786         mutex_lock(&wl->mutex);
4787         if (b43_status(dev) >= B43_STAT_STARTED) {
4788                 dev = b43_wireless_core_stop(dev);
4789                 if (!dev)
4790                         goto out_unlock;
4791         }
4792         b43_wireless_core_exit(dev);
4793         wl->radio_enabled = 0;
4794
4795 out_unlock:
4796         mutex_unlock(&wl->mutex);
4797
4798         cancel_work_sync(&(wl->txpower_adjust_work));
4799 }
4800
4801 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4802                                  struct ieee80211_sta *sta, bool set)
4803 {
4804         struct b43_wl *wl = hw_to_b43_wl(hw);
4805
4806         /* FIXME: add locking */
4807         b43_update_templates(wl);
4808
4809         return 0;
4810 }
4811
4812 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4813                               struct ieee80211_vif *vif,
4814                               enum sta_notify_cmd notify_cmd,
4815                               struct ieee80211_sta *sta)
4816 {
4817         struct b43_wl *wl = hw_to_b43_wl(hw);
4818
4819         B43_WARN_ON(!vif || wl->vif != vif);
4820 }
4821
4822 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4823 {
4824         struct b43_wl *wl = hw_to_b43_wl(hw);
4825         struct b43_wldev *dev;
4826
4827         mutex_lock(&wl->mutex);
4828         dev = wl->current_dev;
4829         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4830                 /* Disable CFP update during scan on other channels. */
4831                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4832         }
4833         mutex_unlock(&wl->mutex);
4834 }
4835
4836 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4837 {
4838         struct b43_wl *wl = hw_to_b43_wl(hw);
4839         struct b43_wldev *dev;
4840
4841         mutex_lock(&wl->mutex);
4842         dev = wl->current_dev;
4843         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4844                 /* Re-enable CFP update. */
4845                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4846         }
4847         mutex_unlock(&wl->mutex);
4848 }
4849
4850 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4851                              struct survey_info *survey)
4852 {
4853         struct b43_wl *wl = hw_to_b43_wl(hw);
4854         struct b43_wldev *dev = wl->current_dev;
4855         struct ieee80211_conf *conf = &hw->conf;
4856
4857         if (idx != 0)
4858                 return -ENOENT;
4859
4860         survey->channel = conf->channel;
4861         survey->filled = SURVEY_INFO_NOISE_DBM;
4862         survey->noise = dev->stats.link_noise;
4863
4864         return 0;
4865 }
4866
4867 static const struct ieee80211_ops b43_hw_ops = {
4868         .tx                     = b43_op_tx,
4869         .conf_tx                = b43_op_conf_tx,
4870         .add_interface          = b43_op_add_interface,
4871         .remove_interface       = b43_op_remove_interface,
4872         .config                 = b43_op_config,
4873         .bss_info_changed       = b43_op_bss_info_changed,
4874         .configure_filter       = b43_op_configure_filter,
4875         .set_key                = b43_op_set_key,
4876         .update_tkip_key        = b43_op_update_tkip_key,
4877         .get_stats              = b43_op_get_stats,
4878         .get_tsf                = b43_op_get_tsf,
4879         .set_tsf                = b43_op_set_tsf,
4880         .start                  = b43_op_start,
4881         .stop                   = b43_op_stop,
4882         .set_tim                = b43_op_beacon_set_tim,
4883         .sta_notify             = b43_op_sta_notify,
4884         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4885         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4886         .get_survey             = b43_op_get_survey,
4887         .rfkill_poll            = b43_rfkill_poll,
4888 };
4889
4890 /* Hard-reset the chip. Do not call this directly.
4891  * Use b43_controller_restart()
4892  */
4893 static void b43_chip_reset(struct work_struct *work)
4894 {
4895         struct b43_wldev *dev =
4896             container_of(work, struct b43_wldev, restart_work);
4897         struct b43_wl *wl = dev->wl;
4898         int err = 0;
4899         int prev_status;
4900
4901         mutex_lock(&wl->mutex);
4902
4903         prev_status = b43_status(dev);
4904         /* Bring the device down... */
4905         if (prev_status >= B43_STAT_STARTED) {
4906                 dev = b43_wireless_core_stop(dev);
4907                 if (!dev) {
4908                         err = -ENODEV;
4909                         goto out;
4910                 }
4911         }
4912         if (prev_status >= B43_STAT_INITIALIZED)
4913                 b43_wireless_core_exit(dev);
4914
4915         /* ...and up again. */
4916         if (prev_status >= B43_STAT_INITIALIZED) {
4917                 err = b43_wireless_core_init(dev);
4918                 if (err)
4919                         goto out;
4920         }
4921         if (prev_status >= B43_STAT_STARTED) {
4922                 err = b43_wireless_core_start(dev);
4923                 if (err) {
4924                         b43_wireless_core_exit(dev);
4925                         goto out;
4926                 }
4927         }
4928 out:
4929         if (err)
4930                 wl->current_dev = NULL; /* Failed to init the dev. */
4931         mutex_unlock(&wl->mutex);
4932         if (err)
4933                 b43err(wl, "Controller restart FAILED\n");
4934         else
4935                 b43info(wl, "Controller restarted\n");
4936 }
4937
4938 static int b43_setup_bands(struct b43_wldev *dev,
4939                            bool have_2ghz_phy, bool have_5ghz_phy)
4940 {
4941         struct ieee80211_hw *hw = dev->wl->hw;
4942
4943         if (have_2ghz_phy)
4944                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4945         if (dev->phy.type == B43_PHYTYPE_N) {
4946                 if (have_5ghz_phy)
4947                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4948         } else {
4949                 if (have_5ghz_phy)
4950                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4951         }
4952
4953         dev->phy.supports_2ghz = have_2ghz_phy;
4954         dev->phy.supports_5ghz = have_5ghz_phy;
4955
4956         return 0;
4957 }
4958
4959 static void b43_wireless_core_detach(struct b43_wldev *dev)
4960 {
4961         /* We release firmware that late to not be required to re-request
4962          * is all the time when we reinit the core. */
4963         b43_release_firmware(dev);
4964         b43_phy_free(dev);
4965 }
4966
4967 static int b43_wireless_core_attach(struct b43_wldev *dev)
4968 {
4969         struct b43_wl *wl = dev->wl;
4970         struct pci_dev *pdev = NULL;
4971         int err;
4972         u32 tmp;
4973         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4974
4975         /* Do NOT do any device initialization here.
4976          * Do it in wireless_core_init() instead.
4977          * This function is for gathering basic information about the HW, only.
4978          * Also some structs may be set up here. But most likely you want to have
4979          * that in core_init(), too.
4980          */
4981
4982 #ifdef CONFIG_B43_SSB
4983         if (dev->dev->bus_type == B43_BUS_SSB &&
4984             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
4985                 pdev = dev->dev->sdev->bus->host_pci;
4986 #endif
4987
4988         err = b43_bus_powerup(dev, 0);
4989         if (err) {
4990                 b43err(wl, "Bus powerup failed\n");
4991                 goto out;
4992         }
4993
4994         /* Get the PHY type. */
4995         switch (dev->dev->bus_type) {
4996 #ifdef CONFIG_B43_BCMA
4997         case B43_BUS_BCMA:
4998                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
4999                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5000                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5001                 break;
5002 #endif
5003 #ifdef CONFIG_B43_SSB
5004         case B43_BUS_SSB:
5005                 if (dev->dev->core_rev >= 5) {
5006                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5007                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5008                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5009                 } else
5010                         B43_WARN_ON(1);
5011                 break;
5012 #endif
5013         }
5014
5015         dev->phy.gmode = have_2ghz_phy;
5016         dev->phy.radio_on = 1;
5017         b43_wireless_core_reset(dev, dev->phy.gmode);
5018
5019         err = b43_phy_versioning(dev);
5020         if (err)
5021                 goto err_powerdown;
5022         /* Check if this device supports multiband. */
5023         if (!pdev ||
5024             (pdev->device != 0x4312 &&
5025              pdev->device != 0x4319 && pdev->device != 0x4324)) {
5026                 /* No multiband support. */
5027                 have_2ghz_phy = 0;
5028                 have_5ghz_phy = 0;
5029                 switch (dev->phy.type) {
5030                 case B43_PHYTYPE_A:
5031                         have_5ghz_phy = 1;
5032                         break;
5033                 case B43_PHYTYPE_LP: //FIXME not always!
5034 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
5035                         have_5ghz_phy = 1;
5036 #endif
5037                 case B43_PHYTYPE_G:
5038                 case B43_PHYTYPE_N:
5039                 case B43_PHYTYPE_HT:
5040                 case B43_PHYTYPE_LCN:
5041                         have_2ghz_phy = 1;
5042                         break;
5043                 default:
5044                         B43_WARN_ON(1);
5045                 }
5046         }
5047         if (dev->phy.type == B43_PHYTYPE_A) {
5048                 /* FIXME */
5049                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
5050                 err = -EOPNOTSUPP;
5051                 goto err_powerdown;
5052         }
5053         if (1 /* disable A-PHY */) {
5054                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
5055                 if (dev->phy.type != B43_PHYTYPE_N &&
5056                     dev->phy.type != B43_PHYTYPE_LP) {
5057                         have_2ghz_phy = 1;
5058                         have_5ghz_phy = 0;
5059                 }
5060         }
5061
5062         err = b43_phy_allocate(dev);
5063         if (err)
5064                 goto err_powerdown;
5065
5066         dev->phy.gmode = have_2ghz_phy;
5067         b43_wireless_core_reset(dev, dev->phy.gmode);
5068
5069         err = b43_validate_chipaccess(dev);
5070         if (err)
5071                 goto err_phy_free;
5072         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5073         if (err)
5074                 goto err_phy_free;
5075
5076         /* Now set some default "current_dev" */
5077         if (!wl->current_dev)
5078                 wl->current_dev = dev;
5079         INIT_WORK(&dev->restart_work, b43_chip_reset);
5080
5081         dev->phy.ops->switch_analog(dev, 0);
5082         b43_device_disable(dev, 0);
5083         b43_bus_may_powerdown(dev);
5084
5085 out:
5086         return err;
5087
5088 err_phy_free:
5089         b43_phy_free(dev);
5090 err_powerdown:
5091         b43_bus_may_powerdown(dev);
5092         return err;
5093 }
5094
5095 static void b43_one_core_detach(struct b43_bus_dev *dev)
5096 {
5097         struct b43_wldev *wldev;
5098         struct b43_wl *wl;
5099
5100         /* Do not cancel ieee80211-workqueue based work here.
5101          * See comment in b43_remove(). */
5102
5103         wldev = b43_bus_get_wldev(dev);
5104         wl = wldev->wl;
5105         b43_debugfs_remove_device(wldev);
5106         b43_wireless_core_detach(wldev);
5107         list_del(&wldev->list);
5108         wl->nr_devs--;
5109         b43_bus_set_wldev(dev, NULL);
5110         kfree(wldev);
5111 }
5112
5113 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5114 {
5115         struct b43_wldev *wldev;
5116         int err = -ENOMEM;
5117
5118         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5119         if (!wldev)
5120                 goto out;
5121
5122         wldev->use_pio = b43_modparam_pio;
5123         wldev->dev = dev;
5124         wldev->wl = wl;
5125         b43_set_status(wldev, B43_STAT_UNINIT);
5126         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5127         INIT_LIST_HEAD(&wldev->list);
5128
5129         err = b43_wireless_core_attach(wldev);
5130         if (err)
5131                 goto err_kfree_wldev;
5132
5133         list_add(&wldev->list, &wl->devlist);
5134         wl->nr_devs++;
5135         b43_bus_set_wldev(dev, wldev);
5136         b43_debugfs_add_device(wldev);
5137
5138       out:
5139         return err;
5140
5141       err_kfree_wldev:
5142         kfree(wldev);
5143         return err;
5144 }
5145
5146 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5147         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5148         (pdev->device == _device) &&                                    \
5149         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5150         (pdev->subsystem_device == _subdevice)                          )
5151
5152 static void b43_sprom_fixup(struct ssb_bus *bus)
5153 {
5154         struct pci_dev *pdev;
5155
5156         /* boardflags workarounds */
5157         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5158             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
5159                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5160         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5161             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
5162                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5163         if (bus->bustype == SSB_BUSTYPE_PCI) {
5164                 pdev = bus->host_pci;
5165                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5166                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5167                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5168                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5169                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5170                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5171                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5172                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5173         }
5174 }
5175
5176 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5177 {
5178         struct ieee80211_hw *hw = wl->hw;
5179
5180         ssb_set_devtypedata(dev->sdev, NULL);
5181         ieee80211_free_hw(hw);
5182 }
5183
5184 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5185 {
5186         struct ssb_sprom *sprom = dev->bus_sprom;
5187         struct ieee80211_hw *hw;
5188         struct b43_wl *wl;
5189         char chip_name[6];
5190
5191         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5192         if (!hw) {
5193                 b43err(NULL, "Could not allocate ieee80211 device\n");
5194                 return ERR_PTR(-ENOMEM);
5195         }
5196         wl = hw_to_b43_wl(hw);
5197
5198         /* fill hw info */
5199         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5200                     IEEE80211_HW_SIGNAL_DBM;
5201
5202         hw->wiphy->interface_modes =
5203                 BIT(NL80211_IFTYPE_AP) |
5204                 BIT(NL80211_IFTYPE_MESH_POINT) |
5205                 BIT(NL80211_IFTYPE_STATION) |
5206                 BIT(NL80211_IFTYPE_WDS) |
5207                 BIT(NL80211_IFTYPE_ADHOC);
5208
5209         hw->queues = modparam_qos ? 4 : 1;
5210         wl->mac80211_initially_registered_queues = hw->queues;
5211         hw->max_rates = 2;
5212         SET_IEEE80211_DEV(hw, dev->dev);
5213         if (is_valid_ether_addr(sprom->et1mac))
5214                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5215         else
5216                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5217
5218         /* Initialize struct b43_wl */
5219         wl->hw = hw;
5220         mutex_init(&wl->mutex);
5221         spin_lock_init(&wl->hardirq_lock);
5222         INIT_LIST_HEAD(&wl->devlist);
5223         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5224         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5225         INIT_WORK(&wl->tx_work, b43_tx_work);
5226         skb_queue_head_init(&wl->tx_queue);
5227
5228         snprintf(chip_name, ARRAY_SIZE(chip_name),
5229                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5230         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5231                 dev->core_rev);
5232         return wl;
5233 }
5234
5235 #ifdef CONFIG_B43_BCMA
5236 static int b43_bcma_probe(struct bcma_device *core)
5237 {
5238         struct b43_bus_dev *dev;
5239         struct b43_wl *wl;
5240         int err;
5241
5242         dev = b43_bus_dev_bcma_init(core);
5243         if (!dev)
5244                 return -ENODEV;
5245
5246         wl = b43_wireless_init(dev);
5247         if (IS_ERR(wl)) {
5248                 err = PTR_ERR(wl);
5249                 goto bcma_out;
5250         }
5251
5252         err = b43_one_core_attach(dev, wl);
5253         if (err)
5254                 goto bcma_err_wireless_exit;
5255
5256         err = ieee80211_register_hw(wl->hw);
5257         if (err)
5258                 goto bcma_err_one_core_detach;
5259         b43_leds_register(wl->current_dev);
5260
5261 bcma_out:
5262         return err;
5263
5264 bcma_err_one_core_detach:
5265         b43_one_core_detach(dev);
5266 bcma_err_wireless_exit:
5267         ieee80211_free_hw(wl->hw);
5268         return err;
5269 }
5270
5271 static void b43_bcma_remove(struct bcma_device *core)
5272 {
5273         struct b43_wldev *wldev = bcma_get_drvdata(core);
5274         struct b43_wl *wl = wldev->wl;
5275
5276         /* We must cancel any work here before unregistering from ieee80211,
5277          * as the ieee80211 unreg will destroy the workqueue. */
5278         cancel_work_sync(&wldev->restart_work);
5279
5280         /* Restore the queues count before unregistering, because firmware detect
5281          * might have modified it. Restoring is important, so the networking
5282          * stack can properly free resources. */
5283         wl->hw->queues = wl->mac80211_initially_registered_queues;
5284         b43_leds_stop(wldev);
5285         ieee80211_unregister_hw(wl->hw);
5286
5287         b43_one_core_detach(wldev->dev);
5288
5289         b43_leds_unregister(wl);
5290
5291         ieee80211_free_hw(wl->hw);
5292 }
5293
5294 static struct bcma_driver b43_bcma_driver = {
5295         .name           = KBUILD_MODNAME,
5296         .id_table       = b43_bcma_tbl,
5297         .probe          = b43_bcma_probe,
5298         .remove         = b43_bcma_remove,
5299 };
5300 #endif
5301
5302 #ifdef CONFIG_B43_SSB
5303 static
5304 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5305 {
5306         struct b43_bus_dev *dev;
5307         struct b43_wl *wl;
5308         int err;
5309         int first = 0;
5310
5311         dev = b43_bus_dev_ssb_init(sdev);
5312         if (!dev)
5313                 return -ENOMEM;
5314
5315         wl = ssb_get_devtypedata(sdev);
5316         if (!wl) {
5317                 /* Probing the first core. Must setup common struct b43_wl */
5318                 first = 1;
5319                 b43_sprom_fixup(sdev->bus);
5320                 wl = b43_wireless_init(dev);
5321                 if (IS_ERR(wl)) {
5322                         err = PTR_ERR(wl);
5323                         goto out;
5324                 }
5325                 ssb_set_devtypedata(sdev, wl);
5326                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5327         }
5328         err = b43_one_core_attach(dev, wl);
5329         if (err)
5330                 goto err_wireless_exit;
5331
5332         if (first) {
5333                 err = ieee80211_register_hw(wl->hw);
5334                 if (err)
5335                         goto err_one_core_detach;
5336                 b43_leds_register(wl->current_dev);
5337         }
5338
5339       out:
5340         return err;
5341
5342       err_one_core_detach:
5343         b43_one_core_detach(dev);
5344       err_wireless_exit:
5345         if (first)
5346                 b43_wireless_exit(dev, wl);
5347         return err;
5348 }
5349
5350 static void b43_ssb_remove(struct ssb_device *sdev)
5351 {
5352         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5353         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5354         struct b43_bus_dev *dev = wldev->dev;
5355
5356         /* We must cancel any work here before unregistering from ieee80211,
5357          * as the ieee80211 unreg will destroy the workqueue. */
5358         cancel_work_sync(&wldev->restart_work);
5359
5360         B43_WARN_ON(!wl);
5361         if (wl->current_dev == wldev) {
5362                 /* Restore the queues count before unregistering, because firmware detect
5363                  * might have modified it. Restoring is important, so the networking
5364                  * stack can properly free resources. */
5365                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5366                 b43_leds_stop(wldev);
5367                 ieee80211_unregister_hw(wl->hw);
5368         }
5369
5370         b43_one_core_detach(dev);
5371
5372         if (list_empty(&wl->devlist)) {
5373                 b43_leds_unregister(wl);
5374                 /* Last core on the chip unregistered.
5375                  * We can destroy common struct b43_wl.
5376                  */
5377                 b43_wireless_exit(dev, wl);
5378         }
5379 }
5380
5381 static struct ssb_driver b43_ssb_driver = {
5382         .name           = KBUILD_MODNAME,
5383         .id_table       = b43_ssb_tbl,
5384         .probe          = b43_ssb_probe,
5385         .remove         = b43_ssb_remove,
5386 };
5387 #endif /* CONFIG_B43_SSB */
5388
5389 /* Perform a hardware reset. This can be called from any context. */
5390 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5391 {
5392         /* Must avoid requeueing, if we are in shutdown. */
5393         if (b43_status(dev) < B43_STAT_INITIALIZED)
5394                 return;
5395         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5396         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5397 }
5398
5399 static void b43_print_driverinfo(void)
5400 {
5401         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5402                    *feat_leds = "", *feat_sdio = "";
5403
5404 #ifdef CONFIG_B43_PCI_AUTOSELECT
5405         feat_pci = "P";
5406 #endif
5407 #ifdef CONFIG_B43_PCMCIA
5408         feat_pcmcia = "M";
5409 #endif
5410 #ifdef CONFIG_B43_PHY_N
5411         feat_nphy = "N";
5412 #endif
5413 #ifdef CONFIG_B43_LEDS
5414         feat_leds = "L";
5415 #endif
5416 #ifdef CONFIG_B43_SDIO
5417         feat_sdio = "S";
5418 #endif
5419         printk(KERN_INFO "Broadcom 43xx driver loaded "
5420                "[ Features: %s%s%s%s%s, Firmware-ID: "
5421                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5422                feat_pci, feat_pcmcia, feat_nphy,
5423                feat_leds, feat_sdio);
5424 }
5425
5426 static int __init b43_init(void)
5427 {
5428         int err;
5429
5430         b43_debugfs_init();
5431         err = b43_pcmcia_init();
5432         if (err)
5433                 goto err_dfs_exit;
5434         err = b43_sdio_init();
5435         if (err)
5436                 goto err_pcmcia_exit;
5437 #ifdef CONFIG_B43_BCMA
5438         err = bcma_driver_register(&b43_bcma_driver);
5439         if (err)
5440                 goto err_sdio_exit;
5441 #endif
5442 #ifdef CONFIG_B43_SSB
5443         err = ssb_driver_register(&b43_ssb_driver);
5444         if (err)
5445                 goto err_bcma_driver_exit;
5446 #endif
5447         b43_print_driverinfo();
5448
5449         return err;
5450
5451 #ifdef CONFIG_B43_SSB
5452 err_bcma_driver_exit:
5453 #endif
5454 #ifdef CONFIG_B43_BCMA
5455         bcma_driver_unregister(&b43_bcma_driver);
5456 err_sdio_exit:
5457 #endif
5458         b43_sdio_exit();
5459 err_pcmcia_exit:
5460         b43_pcmcia_exit();
5461 err_dfs_exit:
5462         b43_debugfs_exit();
5463         return err;
5464 }
5465
5466 static void __exit b43_exit(void)
5467 {
5468 #ifdef CONFIG_B43_SSB
5469         ssb_driver_unregister(&b43_ssb_driver);
5470 #endif
5471 #ifdef CONFIG_B43_BCMA
5472         bcma_driver_unregister(&b43_bcma_driver);
5473 #endif
5474         b43_sdio_exit();
5475         b43_pcmcia_exit();
5476         b43_debugfs_exit();
5477 }
5478
5479 module_init(b43_init)
5480 module_exit(b43_exit)