b43: add hardware tkip
[pandora-kernel.git] / drivers / net / wireless / b43 / main.c
1 /*
2
3   Broadcom B43 wireless driver
4
5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11   Some parts of the code in this file are derived from the ipw2200
12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14   This program is free software; you can redistribute it and/or modify
15   it under the terms of the GNU General Public License as published by
16   the Free Software Foundation; either version 2 of the License, or
17   (at your option) any later version.
18
19   This program is distributed in the hope that it will be useful,
20   but WITHOUT ANY WARRANTY; without even the implied warranty of
21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22   GNU General Public License for more details.
23
24   You should have received a copy of the GNU General Public License
25   along with this program; see the file COPYING.  If not, write to
26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27   Boston, MA 02110-1301, USA.
28
29 */
30
31 #include <linux/delay.h>
32 #include <linux/init.h>
33 #include <linux/moduleparam.h>
34 #include <linux/if_arp.h>
35 #include <linux/etherdevice.h>
36 #include <linux/firmware.h>
37 #include <linux/wireless.h>
38 #include <linux/workqueue.h>
39 #include <linux/skbuff.h>
40 #include <linux/io.h>
41 #include <linux/dma-mapping.h>
42 #include <asm/unaligned.h>
43
44 #include "b43.h"
45 #include "main.h"
46 #include "debugfs.h"
47 #include "phy_common.h"
48 #include "phy_g.h"
49 #include "phy_n.h"
50 #include "dma.h"
51 #include "pio.h"
52 #include "sysfs.h"
53 #include "xmit.h"
54 #include "lo.h"
55 #include "pcmcia.h"
56
57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58 MODULE_AUTHOR("Martin Langer");
59 MODULE_AUTHOR("Stefano Brivio");
60 MODULE_AUTHOR("Michael Buesch");
61 MODULE_LICENSE("GPL");
62
63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66 static int modparam_bad_frames_preempt;
67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68 MODULE_PARM_DESC(bad_frames_preempt,
69                  "enable(1) / disable(0) Bad Frames Preemption");
70
71 static char modparam_fwpostfix[16];
72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75 static int modparam_hwpctl;
76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79 static int modparam_nohwcrypt;
80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83 static int modparam_hwtkip;
84 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
85 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
86
87 static int modparam_qos = 1;
88 module_param_named(qos, modparam_qos, int, 0444);
89 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
90
91 static int modparam_btcoex = 1;
92 module_param_named(btcoex, modparam_btcoex, int, 0444);
93 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
94
95 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
96 module_param_named(verbose, b43_modparam_verbose, int, 0644);
97 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
98
99
100 static const struct ssb_device_id b43_ssb_tbl[] = {
101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
106         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
107         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
108         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
109         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
110         SSB_DEVTABLE_END
111 };
112
113 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
114
115 /* Channel and ratetables are shared for all devices.
116  * They can't be const, because ieee80211 puts some precalculated
117  * data in there. This data is the same for all devices, so we don't
118  * get concurrency issues */
119 #define RATETAB_ENT(_rateid, _flags) \
120         {                                                               \
121                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
122                 .hw_value       = (_rateid),                            \
123                 .flags          = (_flags),                             \
124         }
125
126 /*
127  * NOTE: When changing this, sync with xmit.c's
128  *       b43_plcp_get_bitrate_idx_* functions!
129  */
130 static struct ieee80211_rate __b43_ratetable[] = {
131         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
132         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
133         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
134         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
135         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
136         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
137         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
138         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
139         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
140         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
141         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
142         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
143 };
144
145 #define b43_a_ratetable         (__b43_ratetable + 4)
146 #define b43_a_ratetable_size    8
147 #define b43_b_ratetable         (__b43_ratetable + 0)
148 #define b43_b_ratetable_size    4
149 #define b43_g_ratetable         (__b43_ratetable + 0)
150 #define b43_g_ratetable_size    12
151
152 #define CHAN4G(_channel, _freq, _flags) {                       \
153         .band                   = IEEE80211_BAND_2GHZ,          \
154         .center_freq            = (_freq),                      \
155         .hw_value               = (_channel),                   \
156         .flags                  = (_flags),                     \
157         .max_antenna_gain       = 0,                            \
158         .max_power              = 30,                           \
159 }
160 static struct ieee80211_channel b43_2ghz_chantable[] = {
161         CHAN4G(1, 2412, 0),
162         CHAN4G(2, 2417, 0),
163         CHAN4G(3, 2422, 0),
164         CHAN4G(4, 2427, 0),
165         CHAN4G(5, 2432, 0),
166         CHAN4G(6, 2437, 0),
167         CHAN4G(7, 2442, 0),
168         CHAN4G(8, 2447, 0),
169         CHAN4G(9, 2452, 0),
170         CHAN4G(10, 2457, 0),
171         CHAN4G(11, 2462, 0),
172         CHAN4G(12, 2467, 0),
173         CHAN4G(13, 2472, 0),
174         CHAN4G(14, 2484, 0),
175 };
176 #undef CHAN4G
177
178 #define CHAN5G(_channel, _flags) {                              \
179         .band                   = IEEE80211_BAND_5GHZ,          \
180         .center_freq            = 5000 + (5 * (_channel)),      \
181         .hw_value               = (_channel),                   \
182         .flags                  = (_flags),                     \
183         .max_antenna_gain       = 0,                            \
184         .max_power              = 30,                           \
185 }
186 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
187         CHAN5G(32, 0),          CHAN5G(34, 0),
188         CHAN5G(36, 0),          CHAN5G(38, 0),
189         CHAN5G(40, 0),          CHAN5G(42, 0),
190         CHAN5G(44, 0),          CHAN5G(46, 0),
191         CHAN5G(48, 0),          CHAN5G(50, 0),
192         CHAN5G(52, 0),          CHAN5G(54, 0),
193         CHAN5G(56, 0),          CHAN5G(58, 0),
194         CHAN5G(60, 0),          CHAN5G(62, 0),
195         CHAN5G(64, 0),          CHAN5G(66, 0),
196         CHAN5G(68, 0),          CHAN5G(70, 0),
197         CHAN5G(72, 0),          CHAN5G(74, 0),
198         CHAN5G(76, 0),          CHAN5G(78, 0),
199         CHAN5G(80, 0),          CHAN5G(82, 0),
200         CHAN5G(84, 0),          CHAN5G(86, 0),
201         CHAN5G(88, 0),          CHAN5G(90, 0),
202         CHAN5G(92, 0),          CHAN5G(94, 0),
203         CHAN5G(96, 0),          CHAN5G(98, 0),
204         CHAN5G(100, 0),         CHAN5G(102, 0),
205         CHAN5G(104, 0),         CHAN5G(106, 0),
206         CHAN5G(108, 0),         CHAN5G(110, 0),
207         CHAN5G(112, 0),         CHAN5G(114, 0),
208         CHAN5G(116, 0),         CHAN5G(118, 0),
209         CHAN5G(120, 0),         CHAN5G(122, 0),
210         CHAN5G(124, 0),         CHAN5G(126, 0),
211         CHAN5G(128, 0),         CHAN5G(130, 0),
212         CHAN5G(132, 0),         CHAN5G(134, 0),
213         CHAN5G(136, 0),         CHAN5G(138, 0),
214         CHAN5G(140, 0),         CHAN5G(142, 0),
215         CHAN5G(144, 0),         CHAN5G(145, 0),
216         CHAN5G(146, 0),         CHAN5G(147, 0),
217         CHAN5G(148, 0),         CHAN5G(149, 0),
218         CHAN5G(150, 0),         CHAN5G(151, 0),
219         CHAN5G(152, 0),         CHAN5G(153, 0),
220         CHAN5G(154, 0),         CHAN5G(155, 0),
221         CHAN5G(156, 0),         CHAN5G(157, 0),
222         CHAN5G(158, 0),         CHAN5G(159, 0),
223         CHAN5G(160, 0),         CHAN5G(161, 0),
224         CHAN5G(162, 0),         CHAN5G(163, 0),
225         CHAN5G(164, 0),         CHAN5G(165, 0),
226         CHAN5G(166, 0),         CHAN5G(168, 0),
227         CHAN5G(170, 0),         CHAN5G(172, 0),
228         CHAN5G(174, 0),         CHAN5G(176, 0),
229         CHAN5G(178, 0),         CHAN5G(180, 0),
230         CHAN5G(182, 0),         CHAN5G(184, 0),
231         CHAN5G(186, 0),         CHAN5G(188, 0),
232         CHAN5G(190, 0),         CHAN5G(192, 0),
233         CHAN5G(194, 0),         CHAN5G(196, 0),
234         CHAN5G(198, 0),         CHAN5G(200, 0),
235         CHAN5G(202, 0),         CHAN5G(204, 0),
236         CHAN5G(206, 0),         CHAN5G(208, 0),
237         CHAN5G(210, 0),         CHAN5G(212, 0),
238         CHAN5G(214, 0),         CHAN5G(216, 0),
239         CHAN5G(218, 0),         CHAN5G(220, 0),
240         CHAN5G(222, 0),         CHAN5G(224, 0),
241         CHAN5G(226, 0),         CHAN5G(228, 0),
242 };
243
244 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
245         CHAN5G(34, 0),          CHAN5G(36, 0),
246         CHAN5G(38, 0),          CHAN5G(40, 0),
247         CHAN5G(42, 0),          CHAN5G(44, 0),
248         CHAN5G(46, 0),          CHAN5G(48, 0),
249         CHAN5G(52, 0),          CHAN5G(56, 0),
250         CHAN5G(60, 0),          CHAN5G(64, 0),
251         CHAN5G(100, 0),         CHAN5G(104, 0),
252         CHAN5G(108, 0),         CHAN5G(112, 0),
253         CHAN5G(116, 0),         CHAN5G(120, 0),
254         CHAN5G(124, 0),         CHAN5G(128, 0),
255         CHAN5G(132, 0),         CHAN5G(136, 0),
256         CHAN5G(140, 0),         CHAN5G(149, 0),
257         CHAN5G(153, 0),         CHAN5G(157, 0),
258         CHAN5G(161, 0),         CHAN5G(165, 0),
259         CHAN5G(184, 0),         CHAN5G(188, 0),
260         CHAN5G(192, 0),         CHAN5G(196, 0),
261         CHAN5G(200, 0),         CHAN5G(204, 0),
262         CHAN5G(208, 0),         CHAN5G(212, 0),
263         CHAN5G(216, 0),
264 };
265 #undef CHAN5G
266
267 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
268         .band           = IEEE80211_BAND_5GHZ,
269         .channels       = b43_5ghz_nphy_chantable,
270         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
271         .bitrates       = b43_a_ratetable,
272         .n_bitrates     = b43_a_ratetable_size,
273 };
274
275 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
276         .band           = IEEE80211_BAND_5GHZ,
277         .channels       = b43_5ghz_aphy_chantable,
278         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
279         .bitrates       = b43_a_ratetable,
280         .n_bitrates     = b43_a_ratetable_size,
281 };
282
283 static struct ieee80211_supported_band b43_band_2GHz = {
284         .band           = IEEE80211_BAND_2GHZ,
285         .channels       = b43_2ghz_chantable,
286         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
287         .bitrates       = b43_g_ratetable,
288         .n_bitrates     = b43_g_ratetable_size,
289 };
290
291 static void b43_wireless_core_exit(struct b43_wldev *dev);
292 static int b43_wireless_core_init(struct b43_wldev *dev);
293 static void b43_wireless_core_stop(struct b43_wldev *dev);
294 static int b43_wireless_core_start(struct b43_wldev *dev);
295
296 static int b43_ratelimit(struct b43_wl *wl)
297 {
298         if (!wl || !wl->current_dev)
299                 return 1;
300         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
301                 return 1;
302         /* We are up and running.
303          * Ratelimit the messages to avoid DoS over the net. */
304         return net_ratelimit();
305 }
306
307 void b43info(struct b43_wl *wl, const char *fmt, ...)
308 {
309         va_list args;
310
311         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
312                 return;
313         if (!b43_ratelimit(wl))
314                 return;
315         va_start(args, fmt);
316         printk(KERN_INFO "b43-%s: ",
317                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
318         vprintk(fmt, args);
319         va_end(args);
320 }
321
322 void b43err(struct b43_wl *wl, const char *fmt, ...)
323 {
324         va_list args;
325
326         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
327                 return;
328         if (!b43_ratelimit(wl))
329                 return;
330         va_start(args, fmt);
331         printk(KERN_ERR "b43-%s ERROR: ",
332                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
333         vprintk(fmt, args);
334         va_end(args);
335 }
336
337 void b43warn(struct b43_wl *wl, const char *fmt, ...)
338 {
339         va_list args;
340
341         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
342                 return;
343         if (!b43_ratelimit(wl))
344                 return;
345         va_start(args, fmt);
346         printk(KERN_WARNING "b43-%s warning: ",
347                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
348         vprintk(fmt, args);
349         va_end(args);
350 }
351
352 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
353 {
354         va_list args;
355
356         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
357                 return;
358         va_start(args, fmt);
359         printk(KERN_DEBUG "b43-%s debug: ",
360                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
361         vprintk(fmt, args);
362         va_end(args);
363 }
364
365 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
366 {
367         u32 macctl;
368
369         B43_WARN_ON(offset % 4 != 0);
370
371         macctl = b43_read32(dev, B43_MMIO_MACCTL);
372         if (macctl & B43_MACCTL_BE)
373                 val = swab32(val);
374
375         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
376         mmiowb();
377         b43_write32(dev, B43_MMIO_RAM_DATA, val);
378 }
379
380 static inline void b43_shm_control_word(struct b43_wldev *dev,
381                                         u16 routing, u16 offset)
382 {
383         u32 control;
384
385         /* "offset" is the WORD offset. */
386         control = routing;
387         control <<= 16;
388         control |= offset;
389         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
390 }
391
392 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
393 {
394         u32 ret;
395
396         if (routing == B43_SHM_SHARED) {
397                 B43_WARN_ON(offset & 0x0001);
398                 if (offset & 0x0003) {
399                         /* Unaligned access */
400                         b43_shm_control_word(dev, routing, offset >> 2);
401                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
402                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
403                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
404
405                         goto out;
406                 }
407                 offset >>= 2;
408         }
409         b43_shm_control_word(dev, routing, offset);
410         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
411 out:
412         return ret;
413 }
414
415 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
416 {
417         struct b43_wl *wl = dev->wl;
418         unsigned long flags;
419         u32 ret;
420
421         spin_lock_irqsave(&wl->shm_lock, flags);
422         ret = __b43_shm_read32(dev, routing, offset);
423         spin_unlock_irqrestore(&wl->shm_lock, flags);
424
425         return ret;
426 }
427
428 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
429 {
430         u16 ret;
431
432         if (routing == B43_SHM_SHARED) {
433                 B43_WARN_ON(offset & 0x0001);
434                 if (offset & 0x0003) {
435                         /* Unaligned access */
436                         b43_shm_control_word(dev, routing, offset >> 2);
437                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
438
439                         goto out;
440                 }
441                 offset >>= 2;
442         }
443         b43_shm_control_word(dev, routing, offset);
444         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
445 out:
446         return ret;
447 }
448
449 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
450 {
451         struct b43_wl *wl = dev->wl;
452         unsigned long flags;
453         u16 ret;
454
455         spin_lock_irqsave(&wl->shm_lock, flags);
456         ret = __b43_shm_read16(dev, routing, offset);
457         spin_unlock_irqrestore(&wl->shm_lock, flags);
458
459         return ret;
460 }
461
462 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
463 {
464         if (routing == B43_SHM_SHARED) {
465                 B43_WARN_ON(offset & 0x0001);
466                 if (offset & 0x0003) {
467                         /* Unaligned access */
468                         b43_shm_control_word(dev, routing, offset >> 2);
469                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
470                                     value & 0xFFFF);
471                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
472                         b43_write16(dev, B43_MMIO_SHM_DATA,
473                                     (value >> 16) & 0xFFFF);
474                         return;
475                 }
476                 offset >>= 2;
477         }
478         b43_shm_control_word(dev, routing, offset);
479         b43_write32(dev, B43_MMIO_SHM_DATA, value);
480 }
481
482 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
483 {
484         struct b43_wl *wl = dev->wl;
485         unsigned long flags;
486
487         spin_lock_irqsave(&wl->shm_lock, flags);
488         __b43_shm_write32(dev, routing, offset, value);
489         spin_unlock_irqrestore(&wl->shm_lock, flags);
490 }
491
492 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
493 {
494         if (routing == B43_SHM_SHARED) {
495                 B43_WARN_ON(offset & 0x0001);
496                 if (offset & 0x0003) {
497                         /* Unaligned access */
498                         b43_shm_control_word(dev, routing, offset >> 2);
499                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
500                         return;
501                 }
502                 offset >>= 2;
503         }
504         b43_shm_control_word(dev, routing, offset);
505         b43_write16(dev, B43_MMIO_SHM_DATA, value);
506 }
507
508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
509 {
510         struct b43_wl *wl = dev->wl;
511         unsigned long flags;
512
513         spin_lock_irqsave(&wl->shm_lock, flags);
514         __b43_shm_write16(dev, routing, offset, value);
515         spin_unlock_irqrestore(&wl->shm_lock, flags);
516 }
517
518 /* Read HostFlags */
519 u64 b43_hf_read(struct b43_wldev *dev)
520 {
521         u64 ret;
522
523         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
524         ret <<= 16;
525         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
526         ret <<= 16;
527         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
528
529         return ret;
530 }
531
532 /* Write HostFlags */
533 void b43_hf_write(struct b43_wldev *dev, u64 value)
534 {
535         u16 lo, mi, hi;
536
537         lo = (value & 0x00000000FFFFULL);
538         mi = (value & 0x0000FFFF0000ULL) >> 16;
539         hi = (value & 0xFFFF00000000ULL) >> 32;
540         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
541         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
542         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
543 }
544
545 /* Read the firmware capabilities bitmask (Opensource firmware only) */
546 static u16 b43_fwcapa_read(struct b43_wldev *dev)
547 {
548         B43_WARN_ON(!dev->fw.opensource);
549         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
550 }
551
552 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
553 {
554         u32 low, high;
555
556         B43_WARN_ON(dev->dev->id.revision < 3);
557
558         /* The hardware guarantees us an atomic read, if we
559          * read the low register first. */
560         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
561         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
562
563         *tsf = high;
564         *tsf <<= 32;
565         *tsf |= low;
566 }
567
568 static void b43_time_lock(struct b43_wldev *dev)
569 {
570         u32 macctl;
571
572         macctl = b43_read32(dev, B43_MMIO_MACCTL);
573         macctl |= B43_MACCTL_TBTTHOLD;
574         b43_write32(dev, B43_MMIO_MACCTL, macctl);
575         /* Commit the write */
576         b43_read32(dev, B43_MMIO_MACCTL);
577 }
578
579 static void b43_time_unlock(struct b43_wldev *dev)
580 {
581         u32 macctl;
582
583         macctl = b43_read32(dev, B43_MMIO_MACCTL);
584         macctl &= ~B43_MACCTL_TBTTHOLD;
585         b43_write32(dev, B43_MMIO_MACCTL, macctl);
586         /* Commit the write */
587         b43_read32(dev, B43_MMIO_MACCTL);
588 }
589
590 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
591 {
592         u32 low, high;
593
594         B43_WARN_ON(dev->dev->id.revision < 3);
595
596         low = tsf;
597         high = (tsf >> 32);
598         /* The hardware guarantees us an atomic write, if we
599          * write the low register first. */
600         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
601         mmiowb();
602         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
603         mmiowb();
604 }
605
606 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
607 {
608         b43_time_lock(dev);
609         b43_tsf_write_locked(dev, tsf);
610         b43_time_unlock(dev);
611 }
612
613 static
614 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
615 {
616         static const u8 zero_addr[ETH_ALEN] = { 0 };
617         u16 data;
618
619         if (!mac)
620                 mac = zero_addr;
621
622         offset |= 0x0020;
623         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
624
625         data = mac[0];
626         data |= mac[1] << 8;
627         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
628         data = mac[2];
629         data |= mac[3] << 8;
630         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
631         data = mac[4];
632         data |= mac[5] << 8;
633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
634 }
635
636 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
637 {
638         const u8 *mac;
639         const u8 *bssid;
640         u8 mac_bssid[ETH_ALEN * 2];
641         int i;
642         u32 tmp;
643
644         bssid = dev->wl->bssid;
645         mac = dev->wl->mac_addr;
646
647         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
648
649         memcpy(mac_bssid, mac, ETH_ALEN);
650         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
651
652         /* Write our MAC address and BSSID to template ram */
653         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
654                 tmp = (u32) (mac_bssid[i + 0]);
655                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
656                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
657                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
658                 b43_ram_write(dev, 0x20 + i, tmp);
659         }
660 }
661
662 static void b43_upload_card_macaddress(struct b43_wldev *dev)
663 {
664         b43_write_mac_bssid_templates(dev);
665         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
666 }
667
668 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
669 {
670         /* slot_time is in usec. */
671         if (dev->phy.type != B43_PHYTYPE_G)
672                 return;
673         b43_write16(dev, 0x684, 510 + slot_time);
674         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
675 }
676
677 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
678 {
679         b43_set_slot_time(dev, 9);
680 }
681
682 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
683 {
684         b43_set_slot_time(dev, 20);
685 }
686
687 /* Synchronize IRQ top- and bottom-half.
688  * IRQs must be masked before calling this.
689  * This must not be called with the irq_lock held.
690  */
691 static void b43_synchronize_irq(struct b43_wldev *dev)
692 {
693         synchronize_irq(dev->dev->irq);
694         tasklet_kill(&dev->isr_tasklet);
695 }
696
697 /* DummyTransmission function, as documented on
698  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
699  */
700 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
701 {
702         struct b43_wl *wl = dev->wl;
703         struct b43_phy *phy = &dev->phy;
704         unsigned int i, max_loop;
705         u16 value;
706         u32 buffer[5] = {
707                 0x00000000,
708                 0x00D40000,
709                 0x00000000,
710                 0x01000000,
711                 0x00000000,
712         };
713
714         if (ofdm) {
715                 max_loop = 0x1E;
716                 buffer[0] = 0x000201CC;
717         } else {
718                 max_loop = 0xFA;
719                 buffer[0] = 0x000B846E;
720         }
721
722         spin_lock_irq(&wl->irq_lock);
723         write_lock(&wl->tx_lock);
724
725         for (i = 0; i < 5; i++)
726                 b43_ram_write(dev, i * 4, buffer[i]);
727
728         b43_write16(dev, 0x0568, 0x0000);
729         if (dev->dev->id.revision < 11)
730                 b43_write16(dev, 0x07C0, 0x0000);
731         else
732                 b43_write16(dev, 0x07C0, 0x0100);
733         value = (ofdm ? 0x41 : 0x40);
734         b43_write16(dev, 0x050C, value);
735         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
736                 b43_write16(dev, 0x0514, 0x1A02);
737         b43_write16(dev, 0x0508, 0x0000);
738         b43_write16(dev, 0x050A, 0x0000);
739         b43_write16(dev, 0x054C, 0x0000);
740         b43_write16(dev, 0x056A, 0x0014);
741         b43_write16(dev, 0x0568, 0x0826);
742         b43_write16(dev, 0x0500, 0x0000);
743         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
744                 //SPEC TODO
745         }
746
747         switch (phy->type) {
748         case B43_PHYTYPE_N:
749                 b43_write16(dev, 0x0502, 0x00D0);
750                 break;
751         case B43_PHYTYPE_LP:
752                 b43_write16(dev, 0x0502, 0x0050);
753                 break;
754         default:
755                 b43_write16(dev, 0x0502, 0x0030);
756         }
757
758         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
759                 b43_radio_write16(dev, 0x0051, 0x0017);
760         for (i = 0x00; i < max_loop; i++) {
761                 value = b43_read16(dev, 0x050E);
762                 if (value & 0x0080)
763                         break;
764                 udelay(10);
765         }
766         for (i = 0x00; i < 0x0A; i++) {
767                 value = b43_read16(dev, 0x050E);
768                 if (value & 0x0400)
769                         break;
770                 udelay(10);
771         }
772         for (i = 0x00; i < 0x19; i++) {
773                 value = b43_read16(dev, 0x0690);
774                 if (!(value & 0x0100))
775                         break;
776                 udelay(10);
777         }
778         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
779                 b43_radio_write16(dev, 0x0051, 0x0037);
780
781         write_unlock(&wl->tx_lock);
782         spin_unlock_irq(&wl->irq_lock);
783 }
784
785 static void key_write(struct b43_wldev *dev,
786                       u8 index, u8 algorithm, const u8 *key)
787 {
788         unsigned int i;
789         u32 offset;
790         u16 value;
791         u16 kidx;
792
793         /* Key index/algo block */
794         kidx = b43_kidx_to_fw(dev, index);
795         value = ((kidx << 4) | algorithm);
796         b43_shm_write16(dev, B43_SHM_SHARED,
797                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
798
799         /* Write the key to the Key Table Pointer offset */
800         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
801         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
802                 value = key[i];
803                 value |= (u16) (key[i + 1]) << 8;
804                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
805         }
806 }
807
808 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
809 {
810         u32 addrtmp[2] = { 0, 0, };
811         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
812
813         if (b43_new_kidx_api(dev))
814                 pairwise_keys_start = B43_NR_GROUP_KEYS;
815
816         B43_WARN_ON(index < pairwise_keys_start);
817         /* We have four default TX keys and possibly four default RX keys.
818          * Physical mac 0 is mapped to physical key 4 or 8, depending
819          * on the firmware version.
820          * So we must adjust the index here.
821          */
822         index -= pairwise_keys_start;
823         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
824
825         if (addr) {
826                 addrtmp[0] = addr[0];
827                 addrtmp[0] |= ((u32) (addr[1]) << 8);
828                 addrtmp[0] |= ((u32) (addr[2]) << 16);
829                 addrtmp[0] |= ((u32) (addr[3]) << 24);
830                 addrtmp[1] = addr[4];
831                 addrtmp[1] |= ((u32) (addr[5]) << 8);
832         }
833
834         /* Receive match transmitter address (RCMTA) mechanism */
835         b43_shm_write32(dev, B43_SHM_RCMTA,
836                         (index * 2) + 0, addrtmp[0]);
837         b43_shm_write16(dev, B43_SHM_RCMTA,
838                         (index * 2) + 1, addrtmp[1]);
839 }
840
841 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
842  * When a packet is received, the iv32 is checked.
843  * - if it doesn't the packet is returned without modification (and software
844  *   decryption can be done). That's what happen when iv16 wrap.
845  * - if it does, the rc4 key is computed, and decryption is tried.
846  *   Either it will success and B43_RX_MAC_DEC is returned,
847  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
848  *   and the packet is not usable (it got modified by the ucode).
849  * So in order to never have B43_RX_MAC_DECERR, we should provide
850  * a iv32 and phase1key that match. Because we drop packets in case of
851  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
852  * packets will be lost without higher layer knowing (ie no resync possible
853  * until next wrap).
854  *
855  * NOTE : this should support 50 key like RCMTA because
856  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
857  */
858 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
859                 u16 *phase1key)
860 {
861         unsigned int i;
862         u32 offset;
863         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
864
865         if (!modparam_hwtkip)
866                 return;
867
868         if (b43_new_kidx_api(dev))
869                 pairwise_keys_start = B43_NR_GROUP_KEYS;
870
871         B43_WARN_ON(index < pairwise_keys_start);
872         /* We have four default TX keys and possibly four default RX keys.
873          * Physical mac 0 is mapped to physical key 4 or 8, depending
874          * on the firmware version.
875          * So we must adjust the index here.
876          */
877         index -= pairwise_keys_start;
878         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
879
880         if (b43_debug(dev, B43_DBG_KEYS)) {
881                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
882                                 index, iv32);
883         }
884         /* Write the key to the  RX tkip shared mem */
885         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
886         for (i = 0; i < 10; i += 2) {
887                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
888                                 phase1key ? phase1key[i / 2] : 0);
889         }
890         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
891         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
892 }
893
894 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
895                         struct ieee80211_key_conf *keyconf, const u8 *addr,
896                         u32 iv32, u16 *phase1key)
897 {
898         struct b43_wl *wl = hw_to_b43_wl(hw);
899         struct b43_wldev *dev;
900         int index = keyconf->hw_key_idx;
901
902         if (B43_WARN_ON(!modparam_hwtkip))
903                 return;
904
905         mutex_lock(&wl->mutex);
906
907         dev = wl->current_dev;
908         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
909                 goto out_unlock;
910
911         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
912
913         rx_tkip_phase1_write(dev, index, iv32, phase1key);
914         keymac_write(dev, index, addr);
915
916 out_unlock:
917         mutex_unlock(&wl->mutex);
918 }
919
920 static void do_key_write(struct b43_wldev *dev,
921                          u8 index, u8 algorithm,
922                          const u8 *key, size_t key_len, const u8 *mac_addr)
923 {
924         u8 buf[B43_SEC_KEYSIZE] = { 0, };
925         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
926
927         if (b43_new_kidx_api(dev))
928                 pairwise_keys_start = B43_NR_GROUP_KEYS;
929
930         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
931         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
932
933         if (index >= pairwise_keys_start)
934                 keymac_write(dev, index, NULL); /* First zero out mac. */
935         if (algorithm == B43_SEC_ALGO_TKIP) {
936                 /*
937                  * We should provide an initial iv32, phase1key pair.
938                  * We could start with iv32=0 and compute the corresponding
939                  * phase1key, but this means calling ieee80211_get_tkip_key
940                  * with a fake skb (or export other tkip function).
941                  * Because we are lazy we hope iv32 won't start with
942                  * 0xffffffff and let's b43_op_update_tkip_key provide a
943                  * correct pair.
944                  */
945                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
946         } else if (index >= pairwise_keys_start) /* clear it */
947                 rx_tkip_phase1_write(dev, index, 0, NULL);
948         if (key)
949                 memcpy(buf, key, key_len);
950         key_write(dev, index, algorithm, buf);
951         if (index >= pairwise_keys_start)
952                 keymac_write(dev, index, mac_addr);
953
954         dev->key[index].algorithm = algorithm;
955 }
956
957 static int b43_key_write(struct b43_wldev *dev,
958                          int index, u8 algorithm,
959                          const u8 *key, size_t key_len,
960                          const u8 *mac_addr,
961                          struct ieee80211_key_conf *keyconf)
962 {
963         int i;
964         int pairwise_keys_start;
965
966         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
967          *      - Temporal Encryption Key (128 bits)
968          *      - Temporal Authenticator Tx MIC Key (64 bits)
969          *      - Temporal Authenticator Rx MIC Key (64 bits)
970          *
971          *      Hardware only store TEK
972          */
973         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
974                 key_len = 16;
975         if (key_len > B43_SEC_KEYSIZE)
976                 return -EINVAL;
977         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
978                 /* Check that we don't already have this key. */
979                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
980         }
981         if (index < 0) {
982                 /* Pairwise key. Get an empty slot for the key. */
983                 if (b43_new_kidx_api(dev))
984                         pairwise_keys_start = B43_NR_GROUP_KEYS;
985                 else
986                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
987                 for (i = pairwise_keys_start;
988                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
989                      i++) {
990                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
991                         if (!dev->key[i].keyconf) {
992                                 /* found empty */
993                                 index = i;
994                                 break;
995                         }
996                 }
997                 if (index < 0) {
998                         b43warn(dev->wl, "Out of hardware key memory\n");
999                         return -ENOSPC;
1000                 }
1001         } else
1002                 B43_WARN_ON(index > 3);
1003
1004         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1005         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1006                 /* Default RX key */
1007                 B43_WARN_ON(mac_addr);
1008                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1009         }
1010         keyconf->hw_key_idx = index;
1011         dev->key[index].keyconf = keyconf;
1012
1013         return 0;
1014 }
1015
1016 static int b43_key_clear(struct b43_wldev *dev, int index)
1017 {
1018         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1019                 return -EINVAL;
1020         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1021                      NULL, B43_SEC_KEYSIZE, NULL);
1022         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1023                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1024                              NULL, B43_SEC_KEYSIZE, NULL);
1025         }
1026         dev->key[index].keyconf = NULL;
1027
1028         return 0;
1029 }
1030
1031 static void b43_clear_keys(struct b43_wldev *dev)
1032 {
1033         int i, count;
1034
1035         if (b43_new_kidx_api(dev))
1036                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1037         else
1038                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1039         for (i = 0; i < count; i++)
1040                 b43_key_clear(dev, i);
1041 }
1042
1043 static void b43_dump_keymemory(struct b43_wldev *dev)
1044 {
1045         unsigned int i, index, count, offset, pairwise_keys_start;
1046         u8 mac[ETH_ALEN];
1047         u16 algo;
1048         u32 rcmta0;
1049         u16 rcmta1;
1050         u64 hf;
1051         struct b43_key *key;
1052
1053         if (!b43_debug(dev, B43_DBG_KEYS))
1054                 return;
1055
1056         hf = b43_hf_read(dev);
1057         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1058                !!(hf & B43_HF_USEDEFKEYS));
1059         if (b43_new_kidx_api(dev)) {
1060                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1061                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1062         } else {
1063                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1064                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1065         }
1066         for (index = 0; index < count; index++) {
1067                 key = &(dev->key[index]);
1068                 printk(KERN_DEBUG "Key slot %02u: %s",
1069                        index, (key->keyconf == NULL) ? " " : "*");
1070                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1071                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1072                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1073                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1074                 }
1075
1076                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1077                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1078                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1079
1080                 if (index >= pairwise_keys_start) {
1081                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1082                                 printk("   TKIP: ");
1083                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1084                                 for (i = 0; i < 14; i += 2) {
1085                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1086                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1087                                 }
1088                         }
1089                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 0);
1091                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1092                                                 ((index - pairwise_keys_start) * 2) + 1);
1093                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1094                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1095                         printk("   MAC: %pM", mac);
1096                 } else
1097                         printk("   DEFAULT KEY");
1098                 printk("\n");
1099         }
1100 }
1101
1102 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1103 {
1104         u32 macctl;
1105         u16 ucstat;
1106         bool hwps;
1107         bool awake;
1108         int i;
1109
1110         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1111                     (ps_flags & B43_PS_DISABLED));
1112         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1113
1114         if (ps_flags & B43_PS_ENABLED) {
1115                 hwps = 1;
1116         } else if (ps_flags & B43_PS_DISABLED) {
1117                 hwps = 0;
1118         } else {
1119                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1120                 //      and thus is not an AP and we are associated, set bit 25
1121         }
1122         if (ps_flags & B43_PS_AWAKE) {
1123                 awake = 1;
1124         } else if (ps_flags & B43_PS_ASLEEP) {
1125                 awake = 0;
1126         } else {
1127                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1128                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1129                 //      successful, set bit26
1130         }
1131
1132 /* FIXME: For now we force awake-on and hwps-off */
1133         hwps = 0;
1134         awake = 1;
1135
1136         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1137         if (hwps)
1138                 macctl |= B43_MACCTL_HWPS;
1139         else
1140                 macctl &= ~B43_MACCTL_HWPS;
1141         if (awake)
1142                 macctl |= B43_MACCTL_AWAKE;
1143         else
1144                 macctl &= ~B43_MACCTL_AWAKE;
1145         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1146         /* Commit write */
1147         b43_read32(dev, B43_MMIO_MACCTL);
1148         if (awake && dev->dev->id.revision >= 5) {
1149                 /* Wait for the microcode to wake up. */
1150                 for (i = 0; i < 100; i++) {
1151                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1152                                                 B43_SHM_SH_UCODESTAT);
1153                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1154                                 break;
1155                         udelay(10);
1156                 }
1157         }
1158 }
1159
1160 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1161 {
1162         u32 tmslow;
1163         u32 macctl;
1164
1165         flags |= B43_TMSLOW_PHYCLKEN;
1166         flags |= B43_TMSLOW_PHYRESET;
1167         ssb_device_enable(dev->dev, flags);
1168         msleep(2);              /* Wait for the PLL to turn on. */
1169
1170         /* Now take the PHY out of Reset again */
1171         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1172         tmslow |= SSB_TMSLOW_FGC;
1173         tmslow &= ~B43_TMSLOW_PHYRESET;
1174         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1175         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1176         msleep(1);
1177         tmslow &= ~SSB_TMSLOW_FGC;
1178         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1179         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1180         msleep(1);
1181
1182         /* Turn Analog ON, but only if we already know the PHY-type.
1183          * This protects against very early setup where we don't know the
1184          * PHY-type, yet. wireless_core_reset will be called once again later,
1185          * when we know the PHY-type. */
1186         if (dev->phy.ops)
1187                 dev->phy.ops->switch_analog(dev, 1);
1188
1189         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1190         macctl &= ~B43_MACCTL_GMODE;
1191         if (flags & B43_TMSLOW_GMODE)
1192                 macctl |= B43_MACCTL_GMODE;
1193         macctl |= B43_MACCTL_IHR_ENABLED;
1194         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1195 }
1196
1197 static void handle_irq_transmit_status(struct b43_wldev *dev)
1198 {
1199         u32 v0, v1;
1200         u16 tmp;
1201         struct b43_txstatus stat;
1202
1203         while (1) {
1204                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1205                 if (!(v0 & 0x00000001))
1206                         break;
1207                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1208
1209                 stat.cookie = (v0 >> 16);
1210                 stat.seq = (v1 & 0x0000FFFF);
1211                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1212                 tmp = (v0 & 0x0000FFFF);
1213                 stat.frame_count = ((tmp & 0xF000) >> 12);
1214                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1215                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1216                 stat.pm_indicated = !!(tmp & 0x0080);
1217                 stat.intermediate = !!(tmp & 0x0040);
1218                 stat.for_ampdu = !!(tmp & 0x0020);
1219                 stat.acked = !!(tmp & 0x0002);
1220
1221                 b43_handle_txstatus(dev, &stat);
1222         }
1223 }
1224
1225 static void drain_txstatus_queue(struct b43_wldev *dev)
1226 {
1227         u32 dummy;
1228
1229         if (dev->dev->id.revision < 5)
1230                 return;
1231         /* Read all entries from the microcode TXstatus FIFO
1232          * and throw them away.
1233          */
1234         while (1) {
1235                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1236                 if (!(dummy & 0x00000001))
1237                         break;
1238                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1239         }
1240 }
1241
1242 static u32 b43_jssi_read(struct b43_wldev *dev)
1243 {
1244         u32 val = 0;
1245
1246         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1247         val <<= 16;
1248         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1249
1250         return val;
1251 }
1252
1253 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1254 {
1255         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1256         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1257 }
1258
1259 static void b43_generate_noise_sample(struct b43_wldev *dev)
1260 {
1261         b43_jssi_write(dev, 0x7F7F7F7F);
1262         b43_write32(dev, B43_MMIO_MACCMD,
1263                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1264 }
1265
1266 static void b43_calculate_link_quality(struct b43_wldev *dev)
1267 {
1268         /* Top half of Link Quality calculation. */
1269
1270         if (dev->phy.type != B43_PHYTYPE_G)
1271                 return;
1272         if (dev->noisecalc.calculation_running)
1273                 return;
1274         dev->noisecalc.calculation_running = 1;
1275         dev->noisecalc.nr_samples = 0;
1276
1277         b43_generate_noise_sample(dev);
1278 }
1279
1280 static void handle_irq_noise(struct b43_wldev *dev)
1281 {
1282         struct b43_phy_g *phy = dev->phy.g;
1283         u16 tmp;
1284         u8 noise[4];
1285         u8 i, j;
1286         s32 average;
1287
1288         /* Bottom half of Link Quality calculation. */
1289
1290         if (dev->phy.type != B43_PHYTYPE_G)
1291                 return;
1292
1293         /* Possible race condition: It might be possible that the user
1294          * changed to a different channel in the meantime since we
1295          * started the calculation. We ignore that fact, since it's
1296          * not really that much of a problem. The background noise is
1297          * an estimation only anyway. Slightly wrong results will get damped
1298          * by the averaging of the 8 sample rounds. Additionally the
1299          * value is shortlived. So it will be replaced by the next noise
1300          * calculation round soon. */
1301
1302         B43_WARN_ON(!dev->noisecalc.calculation_running);
1303         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1304         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1305             noise[2] == 0x7F || noise[3] == 0x7F)
1306                 goto generate_new;
1307
1308         /* Get the noise samples. */
1309         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1310         i = dev->noisecalc.nr_samples;
1311         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1312         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1313         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1314         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1315         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1316         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1317         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1318         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1319         dev->noisecalc.nr_samples++;
1320         if (dev->noisecalc.nr_samples == 8) {
1321                 /* Calculate the Link Quality by the noise samples. */
1322                 average = 0;
1323                 for (i = 0; i < 8; i++) {
1324                         for (j = 0; j < 4; j++)
1325                                 average += dev->noisecalc.samples[i][j];
1326                 }
1327                 average /= (8 * 4);
1328                 average *= 125;
1329                 average += 64;
1330                 average /= 128;
1331                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1332                 tmp = (tmp / 128) & 0x1F;
1333                 if (tmp >= 8)
1334                         average += 2;
1335                 else
1336                         average -= 25;
1337                 if (tmp == 8)
1338                         average -= 72;
1339                 else
1340                         average -= 48;
1341
1342                 dev->stats.link_noise = average;
1343                 dev->noisecalc.calculation_running = 0;
1344                 return;
1345         }
1346 generate_new:
1347         b43_generate_noise_sample(dev);
1348 }
1349
1350 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1351 {
1352         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1353                 ///TODO: PS TBTT
1354         } else {
1355                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1356                         b43_power_saving_ctl_bits(dev, 0);
1357         }
1358         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1359                 dev->dfq_valid = 1;
1360 }
1361
1362 static void handle_irq_atim_end(struct b43_wldev *dev)
1363 {
1364         if (dev->dfq_valid) {
1365                 b43_write32(dev, B43_MMIO_MACCMD,
1366                             b43_read32(dev, B43_MMIO_MACCMD)
1367                             | B43_MACCMD_DFQ_VALID);
1368                 dev->dfq_valid = 0;
1369         }
1370 }
1371
1372 static void handle_irq_pmq(struct b43_wldev *dev)
1373 {
1374         u32 tmp;
1375
1376         //TODO: AP mode.
1377
1378         while (1) {
1379                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1380                 if (!(tmp & 0x00000008))
1381                         break;
1382         }
1383         /* 16bit write is odd, but correct. */
1384         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1385 }
1386
1387 static void b43_write_template_common(struct b43_wldev *dev,
1388                                       const u8 *data, u16 size,
1389                                       u16 ram_offset,
1390                                       u16 shm_size_offset, u8 rate)
1391 {
1392         u32 i, tmp;
1393         struct b43_plcp_hdr4 plcp;
1394
1395         plcp.data = 0;
1396         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1397         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1398         ram_offset += sizeof(u32);
1399         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1400          * So leave the first two bytes of the next write blank.
1401          */
1402         tmp = (u32) (data[0]) << 16;
1403         tmp |= (u32) (data[1]) << 24;
1404         b43_ram_write(dev, ram_offset, tmp);
1405         ram_offset += sizeof(u32);
1406         for (i = 2; i < size; i += sizeof(u32)) {
1407                 tmp = (u32) (data[i + 0]);
1408                 if (i + 1 < size)
1409                         tmp |= (u32) (data[i + 1]) << 8;
1410                 if (i + 2 < size)
1411                         tmp |= (u32) (data[i + 2]) << 16;
1412                 if (i + 3 < size)
1413                         tmp |= (u32) (data[i + 3]) << 24;
1414                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1415         }
1416         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1417                         size + sizeof(struct b43_plcp_hdr6));
1418 }
1419
1420 /* Check if the use of the antenna that ieee80211 told us to
1421  * use is possible. This will fall back to DEFAULT.
1422  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1423 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1424                                   u8 antenna_nr)
1425 {
1426         u8 antenna_mask;
1427
1428         if (antenna_nr == 0) {
1429                 /* Zero means "use default antenna". That's always OK. */
1430                 return 0;
1431         }
1432
1433         /* Get the mask of available antennas. */
1434         if (dev->phy.gmode)
1435                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1436         else
1437                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1438
1439         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1440                 /* This antenna is not available. Fall back to default. */
1441                 return 0;
1442         }
1443
1444         return antenna_nr;
1445 }
1446
1447 /* Convert a b43 antenna number value to the PHY TX control value. */
1448 static u16 b43_antenna_to_phyctl(int antenna)
1449 {
1450         switch (antenna) {
1451         case B43_ANTENNA0:
1452                 return B43_TXH_PHY_ANT0;
1453         case B43_ANTENNA1:
1454                 return B43_TXH_PHY_ANT1;
1455         case B43_ANTENNA2:
1456                 return B43_TXH_PHY_ANT2;
1457         case B43_ANTENNA3:
1458                 return B43_TXH_PHY_ANT3;
1459         case B43_ANTENNA_AUTO:
1460                 return B43_TXH_PHY_ANT01AUTO;
1461         }
1462         B43_WARN_ON(1);
1463         return 0;
1464 }
1465
1466 static void b43_write_beacon_template(struct b43_wldev *dev,
1467                                       u16 ram_offset,
1468                                       u16 shm_size_offset)
1469 {
1470         unsigned int i, len, variable_len;
1471         const struct ieee80211_mgmt *bcn;
1472         const u8 *ie;
1473         bool tim_found = 0;
1474         unsigned int rate;
1475         u16 ctl;
1476         int antenna;
1477         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1478
1479         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1480         len = min((size_t) dev->wl->current_beacon->len,
1481                   0x200 - sizeof(struct b43_plcp_hdr6));
1482         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1483
1484         b43_write_template_common(dev, (const u8 *)bcn,
1485                                   len, ram_offset, shm_size_offset, rate);
1486
1487         /* Write the PHY TX control parameters. */
1488         antenna = B43_ANTENNA_DEFAULT;
1489         antenna = b43_antenna_to_phyctl(antenna);
1490         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1491         /* We can't send beacons with short preamble. Would get PHY errors. */
1492         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1493         ctl &= ~B43_TXH_PHY_ANT;
1494         ctl &= ~B43_TXH_PHY_ENC;
1495         ctl |= antenna;
1496         if (b43_is_cck_rate(rate))
1497                 ctl |= B43_TXH_PHY_ENC_CCK;
1498         else
1499                 ctl |= B43_TXH_PHY_ENC_OFDM;
1500         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1501
1502         /* Find the position of the TIM and the DTIM_period value
1503          * and write them to SHM. */
1504         ie = bcn->u.beacon.variable;
1505         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1506         for (i = 0; i < variable_len - 2; ) {
1507                 uint8_t ie_id, ie_len;
1508
1509                 ie_id = ie[i];
1510                 ie_len = ie[i + 1];
1511                 if (ie_id == 5) {
1512                         u16 tim_position;
1513                         u16 dtim_period;
1514                         /* This is the TIM Information Element */
1515
1516                         /* Check whether the ie_len is in the beacon data range. */
1517                         if (variable_len < ie_len + 2 + i)
1518                                 break;
1519                         /* A valid TIM is at least 4 bytes long. */
1520                         if (ie_len < 4)
1521                                 break;
1522                         tim_found = 1;
1523
1524                         tim_position = sizeof(struct b43_plcp_hdr6);
1525                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1526                         tim_position += i;
1527
1528                         dtim_period = ie[i + 3];
1529
1530                         b43_shm_write16(dev, B43_SHM_SHARED,
1531                                         B43_SHM_SH_TIMBPOS, tim_position);
1532                         b43_shm_write16(dev, B43_SHM_SHARED,
1533                                         B43_SHM_SH_DTIMPER, dtim_period);
1534                         break;
1535                 }
1536                 i += ie_len + 2;
1537         }
1538         if (!tim_found) {
1539                 /*
1540                  * If ucode wants to modify TIM do it behind the beacon, this
1541                  * will happen, for example, when doing mesh networking.
1542                  */
1543                 b43_shm_write16(dev, B43_SHM_SHARED,
1544                                 B43_SHM_SH_TIMBPOS,
1545                                 len + sizeof(struct b43_plcp_hdr6));
1546                 b43_shm_write16(dev, B43_SHM_SHARED,
1547                                 B43_SHM_SH_DTIMPER, 0);
1548         }
1549         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1550 }
1551
1552 static void b43_upload_beacon0(struct b43_wldev *dev)
1553 {
1554         struct b43_wl *wl = dev->wl;
1555
1556         if (wl->beacon0_uploaded)
1557                 return;
1558         b43_write_beacon_template(dev, 0x68, 0x18);
1559         wl->beacon0_uploaded = 1;
1560 }
1561
1562 static void b43_upload_beacon1(struct b43_wldev *dev)
1563 {
1564         struct b43_wl *wl = dev->wl;
1565
1566         if (wl->beacon1_uploaded)
1567                 return;
1568         b43_write_beacon_template(dev, 0x468, 0x1A);
1569         wl->beacon1_uploaded = 1;
1570 }
1571
1572 static void handle_irq_beacon(struct b43_wldev *dev)
1573 {
1574         struct b43_wl *wl = dev->wl;
1575         u32 cmd, beacon0_valid, beacon1_valid;
1576
1577         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1578             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1579                 return;
1580
1581         /* This is the bottom half of the asynchronous beacon update. */
1582
1583         /* Ignore interrupt in the future. */
1584         dev->irq_mask &= ~B43_IRQ_BEACON;
1585
1586         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1587         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1588         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1589
1590         /* Schedule interrupt manually, if busy. */
1591         if (beacon0_valid && beacon1_valid) {
1592                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1593                 dev->irq_mask |= B43_IRQ_BEACON;
1594                 return;
1595         }
1596
1597         if (unlikely(wl->beacon_templates_virgin)) {
1598                 /* We never uploaded a beacon before.
1599                  * Upload both templates now, but only mark one valid. */
1600                 wl->beacon_templates_virgin = 0;
1601                 b43_upload_beacon0(dev);
1602                 b43_upload_beacon1(dev);
1603                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1604                 cmd |= B43_MACCMD_BEACON0_VALID;
1605                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1606         } else {
1607                 if (!beacon0_valid) {
1608                         b43_upload_beacon0(dev);
1609                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1610                         cmd |= B43_MACCMD_BEACON0_VALID;
1611                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1612                 } else if (!beacon1_valid) {
1613                         b43_upload_beacon1(dev);
1614                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1615                         cmd |= B43_MACCMD_BEACON1_VALID;
1616                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1617                 }
1618         }
1619 }
1620
1621 static void b43_beacon_update_trigger_work(struct work_struct *work)
1622 {
1623         struct b43_wl *wl = container_of(work, struct b43_wl,
1624                                          beacon_update_trigger);
1625         struct b43_wldev *dev;
1626
1627         mutex_lock(&wl->mutex);
1628         dev = wl->current_dev;
1629         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1630                 spin_lock_irq(&wl->irq_lock);
1631                 /* update beacon right away or defer to irq */
1632                 handle_irq_beacon(dev);
1633                 /* The handler might have updated the IRQ mask. */
1634                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1635                 mmiowb();
1636                 spin_unlock_irq(&wl->irq_lock);
1637         }
1638         mutex_unlock(&wl->mutex);
1639 }
1640
1641 /* Asynchronously update the packet templates in template RAM.
1642  * Locking: Requires wl->irq_lock to be locked. */
1643 static void b43_update_templates(struct b43_wl *wl)
1644 {
1645         struct sk_buff *beacon;
1646
1647         /* This is the top half of the ansynchronous beacon update.
1648          * The bottom half is the beacon IRQ.
1649          * Beacon update must be asynchronous to avoid sending an
1650          * invalid beacon. This can happen for example, if the firmware
1651          * transmits a beacon while we are updating it. */
1652
1653         /* We could modify the existing beacon and set the aid bit in
1654          * the TIM field, but that would probably require resizing and
1655          * moving of data within the beacon template.
1656          * Simply request a new beacon and let mac80211 do the hard work. */
1657         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1658         if (unlikely(!beacon))
1659                 return;
1660
1661         if (wl->current_beacon)
1662                 dev_kfree_skb_any(wl->current_beacon);
1663         wl->current_beacon = beacon;
1664         wl->beacon0_uploaded = 0;
1665         wl->beacon1_uploaded = 0;
1666         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1667 }
1668
1669 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1670 {
1671         b43_time_lock(dev);
1672         if (dev->dev->id.revision >= 3) {
1673                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1674                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1675         } else {
1676                 b43_write16(dev, 0x606, (beacon_int >> 6));
1677                 b43_write16(dev, 0x610, beacon_int);
1678         }
1679         b43_time_unlock(dev);
1680         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1681 }
1682
1683 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1684 {
1685         u16 reason;
1686
1687         /* Read the register that contains the reason code for the panic. */
1688         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1689         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1690
1691         switch (reason) {
1692         default:
1693                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1694                 /* fallthrough */
1695         case B43_FWPANIC_DIE:
1696                 /* Do not restart the controller or firmware.
1697                  * The device is nonfunctional from now on.
1698                  * Restarting would result in this panic to trigger again,
1699                  * so we avoid that recursion. */
1700                 break;
1701         case B43_FWPANIC_RESTART:
1702                 b43_controller_restart(dev, "Microcode panic");
1703                 break;
1704         }
1705 }
1706
1707 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1708 {
1709         unsigned int i, cnt;
1710         u16 reason, marker_id, marker_line;
1711         __le16 *buf;
1712
1713         /* The proprietary firmware doesn't have this IRQ. */
1714         if (!dev->fw.opensource)
1715                 return;
1716
1717         /* Read the register that contains the reason code for this IRQ. */
1718         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1719
1720         switch (reason) {
1721         case B43_DEBUGIRQ_PANIC:
1722                 b43_handle_firmware_panic(dev);
1723                 break;
1724         case B43_DEBUGIRQ_DUMP_SHM:
1725                 if (!B43_DEBUG)
1726                         break; /* Only with driver debugging enabled. */
1727                 buf = kmalloc(4096, GFP_ATOMIC);
1728                 if (!buf) {
1729                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1730                         goto out;
1731                 }
1732                 for (i = 0; i < 4096; i += 2) {
1733                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1734                         buf[i / 2] = cpu_to_le16(tmp);
1735                 }
1736                 b43info(dev->wl, "Shared memory dump:\n");
1737                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1738                                16, 2, buf, 4096, 1);
1739                 kfree(buf);
1740                 break;
1741         case B43_DEBUGIRQ_DUMP_REGS:
1742                 if (!B43_DEBUG)
1743                         break; /* Only with driver debugging enabled. */
1744                 b43info(dev->wl, "Microcode register dump:\n");
1745                 for (i = 0, cnt = 0; i < 64; i++) {
1746                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1747                         if (cnt == 0)
1748                                 printk(KERN_INFO);
1749                         printk("r%02u: 0x%04X  ", i, tmp);
1750                         cnt++;
1751                         if (cnt == 6) {
1752                                 printk("\n");
1753                                 cnt = 0;
1754                         }
1755                 }
1756                 printk("\n");
1757                 break;
1758         case B43_DEBUGIRQ_MARKER:
1759                 if (!B43_DEBUG)
1760                         break; /* Only with driver debugging enabled. */
1761                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1762                                            B43_MARKER_ID_REG);
1763                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1764                                              B43_MARKER_LINE_REG);
1765                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1766                         "at line number %u\n",
1767                         marker_id, marker_line);
1768                 break;
1769         default:
1770                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1771                        reason);
1772         }
1773 out:
1774         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1775         b43_shm_write16(dev, B43_SHM_SCRATCH,
1776                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1777 }
1778
1779 /* Interrupt handler bottom-half */
1780 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1781 {
1782         u32 reason;
1783         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1784         u32 merged_dma_reason = 0;
1785         int i;
1786         unsigned long flags;
1787
1788         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1789
1790         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1791
1792         reason = dev->irq_reason;
1793         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1794                 dma_reason[i] = dev->dma_reason[i];
1795                 merged_dma_reason |= dma_reason[i];
1796         }
1797
1798         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1799                 b43err(dev->wl, "MAC transmission error\n");
1800
1801         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1802                 b43err(dev->wl, "PHY transmission error\n");
1803                 rmb();
1804                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1805                         atomic_set(&dev->phy.txerr_cnt,
1806                                    B43_PHY_TX_BADNESS_LIMIT);
1807                         b43err(dev->wl, "Too many PHY TX errors, "
1808                                         "restarting the controller\n");
1809                         b43_controller_restart(dev, "PHY TX errors");
1810                 }
1811         }
1812
1813         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1814                                           B43_DMAIRQ_NONFATALMASK))) {
1815                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1816                         b43err(dev->wl, "Fatal DMA error: "
1817                                "0x%08X, 0x%08X, 0x%08X, "
1818                                "0x%08X, 0x%08X, 0x%08X\n",
1819                                dma_reason[0], dma_reason[1],
1820                                dma_reason[2], dma_reason[3],
1821                                dma_reason[4], dma_reason[5]);
1822                         b43_controller_restart(dev, "DMA error");
1823                         mmiowb();
1824                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1825                         return;
1826                 }
1827                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1828                         b43err(dev->wl, "DMA error: "
1829                                "0x%08X, 0x%08X, 0x%08X, "
1830                                "0x%08X, 0x%08X, 0x%08X\n",
1831                                dma_reason[0], dma_reason[1],
1832                                dma_reason[2], dma_reason[3],
1833                                dma_reason[4], dma_reason[5]);
1834                 }
1835         }
1836
1837         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1838                 handle_irq_ucode_debug(dev);
1839         if (reason & B43_IRQ_TBTT_INDI)
1840                 handle_irq_tbtt_indication(dev);
1841         if (reason & B43_IRQ_ATIM_END)
1842                 handle_irq_atim_end(dev);
1843         if (reason & B43_IRQ_BEACON)
1844                 handle_irq_beacon(dev);
1845         if (reason & B43_IRQ_PMQ)
1846                 handle_irq_pmq(dev);
1847         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1848                 ;/* TODO */
1849         if (reason & B43_IRQ_NOISESAMPLE_OK)
1850                 handle_irq_noise(dev);
1851
1852         /* Check the DMA reason registers for received data. */
1853         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1854                 if (b43_using_pio_transfers(dev))
1855                         b43_pio_rx(dev->pio.rx_queue);
1856                 else
1857                         b43_dma_rx(dev->dma.rx_ring);
1858         }
1859         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1860         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1861         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1862         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1863         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1864
1865         if (reason & B43_IRQ_TX_OK)
1866                 handle_irq_transmit_status(dev);
1867
1868         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1869         mmiowb();
1870         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1871 }
1872
1873 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1874 {
1875         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1876
1877         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1878         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1879         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1880         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1881         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1882 /* Unused ring
1883         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1884 */
1885 }
1886
1887 /* Interrupt handler top-half */
1888 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1889 {
1890         irqreturn_t ret = IRQ_NONE;
1891         struct b43_wldev *dev = dev_id;
1892         u32 reason;
1893
1894         B43_WARN_ON(!dev);
1895
1896         spin_lock(&dev->wl->irq_lock);
1897
1898         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1899                 /* This can only happen on shared IRQ lines. */
1900                 goto out;
1901         }
1902         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1903         if (reason == 0xffffffff)       /* shared IRQ */
1904                 goto out;
1905         ret = IRQ_HANDLED;
1906         reason &= dev->irq_mask;
1907         if (!reason)
1908                 goto out;
1909
1910         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1911             & 0x0001DC00;
1912         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1913             & 0x0000DC00;
1914         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1915             & 0x0000DC00;
1916         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1917             & 0x0001DC00;
1918         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1919             & 0x0000DC00;
1920 /* Unused ring
1921         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1922             & 0x0000DC00;
1923 */
1924
1925         b43_interrupt_ack(dev, reason);
1926         /* disable all IRQs. They are enabled again in the bottom half. */
1927         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1928         /* save the reason code and call our bottom half. */
1929         dev->irq_reason = reason;
1930         tasklet_schedule(&dev->isr_tasklet);
1931 out:
1932         mmiowb();
1933         spin_unlock(&dev->wl->irq_lock);
1934
1935         return ret;
1936 }
1937
1938 void b43_do_release_fw(struct b43_firmware_file *fw)
1939 {
1940         release_firmware(fw->data);
1941         fw->data = NULL;
1942         fw->filename = NULL;
1943 }
1944
1945 static void b43_release_firmware(struct b43_wldev *dev)
1946 {
1947         b43_do_release_fw(&dev->fw.ucode);
1948         b43_do_release_fw(&dev->fw.pcm);
1949         b43_do_release_fw(&dev->fw.initvals);
1950         b43_do_release_fw(&dev->fw.initvals_band);
1951 }
1952
1953 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1954 {
1955         const char text[] =
1956                 "You must go to " \
1957                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1958                 "and download the correct firmware for this driver version. " \
1959                 "Please carefully read all instructions on this website.\n";
1960
1961         if (error)
1962                 b43err(wl, text);
1963         else
1964                 b43warn(wl, text);
1965 }
1966
1967 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1968                       const char *name,
1969                       struct b43_firmware_file *fw)
1970 {
1971         const struct firmware *blob;
1972         struct b43_fw_header *hdr;
1973         u32 size;
1974         int err;
1975
1976         if (!name) {
1977                 /* Don't fetch anything. Free possibly cached firmware. */
1978                 /* FIXME: We should probably keep it anyway, to save some headache
1979                  * on suspend/resume with multiband devices. */
1980                 b43_do_release_fw(fw);
1981                 return 0;
1982         }
1983         if (fw->filename) {
1984                 if ((fw->type == ctx->req_type) &&
1985                     (strcmp(fw->filename, name) == 0))
1986                         return 0; /* Already have this fw. */
1987                 /* Free the cached firmware first. */
1988                 /* FIXME: We should probably do this later after we successfully
1989                  * got the new fw. This could reduce headache with multiband devices.
1990                  * We could also redesign this to cache the firmware for all possible
1991                  * bands all the time. */
1992                 b43_do_release_fw(fw);
1993         }
1994
1995         switch (ctx->req_type) {
1996         case B43_FWTYPE_PROPRIETARY:
1997                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1998                          "b43%s/%s.fw",
1999                          modparam_fwpostfix, name);
2000                 break;
2001         case B43_FWTYPE_OPENSOURCE:
2002                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2003                          "b43-open%s/%s.fw",
2004                          modparam_fwpostfix, name);
2005                 break;
2006         default:
2007                 B43_WARN_ON(1);
2008                 return -ENOSYS;
2009         }
2010         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2011         if (err == -ENOENT) {
2012                 snprintf(ctx->errors[ctx->req_type],
2013                          sizeof(ctx->errors[ctx->req_type]),
2014                          "Firmware file \"%s\" not found\n", ctx->fwname);
2015                 return err;
2016         } else if (err) {
2017                 snprintf(ctx->errors[ctx->req_type],
2018                          sizeof(ctx->errors[ctx->req_type]),
2019                          "Firmware file \"%s\" request failed (err=%d)\n",
2020                          ctx->fwname, err);
2021                 return err;
2022         }
2023         if (blob->size < sizeof(struct b43_fw_header))
2024                 goto err_format;
2025         hdr = (struct b43_fw_header *)(blob->data);
2026         switch (hdr->type) {
2027         case B43_FW_TYPE_UCODE:
2028         case B43_FW_TYPE_PCM:
2029                 size = be32_to_cpu(hdr->size);
2030                 if (size != blob->size - sizeof(struct b43_fw_header))
2031                         goto err_format;
2032                 /* fallthrough */
2033         case B43_FW_TYPE_IV:
2034                 if (hdr->ver != 1)
2035                         goto err_format;
2036                 break;
2037         default:
2038                 goto err_format;
2039         }
2040
2041         fw->data = blob;
2042         fw->filename = name;
2043         fw->type = ctx->req_type;
2044
2045         return 0;
2046
2047 err_format:
2048         snprintf(ctx->errors[ctx->req_type],
2049                  sizeof(ctx->errors[ctx->req_type]),
2050                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2051         release_firmware(blob);
2052
2053         return -EPROTO;
2054 }
2055
2056 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2057 {
2058         struct b43_wldev *dev = ctx->dev;
2059         struct b43_firmware *fw = &ctx->dev->fw;
2060         const u8 rev = ctx->dev->dev->id.revision;
2061         const char *filename;
2062         u32 tmshigh;
2063         int err;
2064
2065         /* Get microcode */
2066         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2067         if ((rev >= 5) && (rev <= 10))
2068                 filename = "ucode5";
2069         else if ((rev >= 11) && (rev <= 12))
2070                 filename = "ucode11";
2071         else if (rev == 13)
2072                 filename = "ucode13";
2073         else if (rev == 14)
2074                 filename = "ucode14";
2075         else if (rev >= 15)
2076                 filename = "ucode15";
2077         else
2078                 goto err_no_ucode;
2079         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2080         if (err)
2081                 goto err_load;
2082
2083         /* Get PCM code */
2084         if ((rev >= 5) && (rev <= 10))
2085                 filename = "pcm5";
2086         else if (rev >= 11)
2087                 filename = NULL;
2088         else
2089                 goto err_no_pcm;
2090         fw->pcm_request_failed = 0;
2091         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2092         if (err == -ENOENT) {
2093                 /* We did not find a PCM file? Not fatal, but
2094                  * core rev <= 10 must do without hwcrypto then. */
2095                 fw->pcm_request_failed = 1;
2096         } else if (err)
2097                 goto err_load;
2098
2099         /* Get initvals */
2100         switch (dev->phy.type) {
2101         case B43_PHYTYPE_A:
2102                 if ((rev >= 5) && (rev <= 10)) {
2103                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2104                                 filename = "a0g1initvals5";
2105                         else
2106                                 filename = "a0g0initvals5";
2107                 } else
2108                         goto err_no_initvals;
2109                 break;
2110         case B43_PHYTYPE_G:
2111                 if ((rev >= 5) && (rev <= 10))
2112                         filename = "b0g0initvals5";
2113                 else if (rev >= 13)
2114                         filename = "b0g0initvals13";
2115                 else
2116                         goto err_no_initvals;
2117                 break;
2118         case B43_PHYTYPE_N:
2119                 if ((rev >= 11) && (rev <= 12))
2120                         filename = "n0initvals11";
2121                 else
2122                         goto err_no_initvals;
2123                 break;
2124         case B43_PHYTYPE_LP:
2125                 if (rev == 13)
2126                         filename = "lp0initvals13";
2127                 else if (rev == 14)
2128                         filename = "lp0initvals14";
2129                 else if (rev >= 15)
2130                         filename = "lp0initvals15";
2131                 else
2132                         goto err_no_initvals;
2133                 break;
2134         default:
2135                 goto err_no_initvals;
2136         }
2137         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2138         if (err)
2139                 goto err_load;
2140
2141         /* Get bandswitch initvals */
2142         switch (dev->phy.type) {
2143         case B43_PHYTYPE_A:
2144                 if ((rev >= 5) && (rev <= 10)) {
2145                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2146                                 filename = "a0g1bsinitvals5";
2147                         else
2148                                 filename = "a0g0bsinitvals5";
2149                 } else if (rev >= 11)
2150                         filename = NULL;
2151                 else
2152                         goto err_no_initvals;
2153                 break;
2154         case B43_PHYTYPE_G:
2155                 if ((rev >= 5) && (rev <= 10))
2156                         filename = "b0g0bsinitvals5";
2157                 else if (rev >= 11)
2158                         filename = NULL;
2159                 else
2160                         goto err_no_initvals;
2161                 break;
2162         case B43_PHYTYPE_N:
2163                 if ((rev >= 11) && (rev <= 12))
2164                         filename = "n0bsinitvals11";
2165                 else
2166                         goto err_no_initvals;
2167                 break;
2168         case B43_PHYTYPE_LP:
2169                 if (rev == 13)
2170                         filename = "lp0bsinitvals13";
2171                 else if (rev == 14)
2172                         filename = "lp0bsinitvals14";
2173                 else if (rev >= 15)
2174                         filename = "lp0bsinitvals15";
2175                 else
2176                         goto err_no_initvals;
2177                 break;
2178         default:
2179                 goto err_no_initvals;
2180         }
2181         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2182         if (err)
2183                 goto err_load;
2184
2185         return 0;
2186
2187 err_no_ucode:
2188         err = ctx->fatal_failure = -EOPNOTSUPP;
2189         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2190                "is required for your device (wl-core rev %u)\n", rev);
2191         goto error;
2192
2193 err_no_pcm:
2194         err = ctx->fatal_failure = -EOPNOTSUPP;
2195         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2196                "is required for your device (wl-core rev %u)\n", rev);
2197         goto error;
2198
2199 err_no_initvals:
2200         err = ctx->fatal_failure = -EOPNOTSUPP;
2201         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2202                "is required for your device (wl-core rev %u)\n", rev);
2203         goto error;
2204
2205 err_load:
2206         /* We failed to load this firmware image. The error message
2207          * already is in ctx->errors. Return and let our caller decide
2208          * what to do. */
2209         goto error;
2210
2211 error:
2212         b43_release_firmware(dev);
2213         return err;
2214 }
2215
2216 static int b43_request_firmware(struct b43_wldev *dev)
2217 {
2218         struct b43_request_fw_context *ctx;
2219         unsigned int i;
2220         int err;
2221         const char *errmsg;
2222
2223         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2224         if (!ctx)
2225                 return -ENOMEM;
2226         ctx->dev = dev;
2227
2228         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2229         err = b43_try_request_fw(ctx);
2230         if (!err)
2231                 goto out; /* Successfully loaded it. */
2232         err = ctx->fatal_failure;
2233         if (err)
2234                 goto out;
2235
2236         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2237         err = b43_try_request_fw(ctx);
2238         if (!err)
2239                 goto out; /* Successfully loaded it. */
2240         err = ctx->fatal_failure;
2241         if (err)
2242                 goto out;
2243
2244         /* Could not find a usable firmware. Print the errors. */
2245         for (i = 0; i < B43_NR_FWTYPES; i++) {
2246                 errmsg = ctx->errors[i];
2247                 if (strlen(errmsg))
2248                         b43err(dev->wl, errmsg);
2249         }
2250         b43_print_fw_helptext(dev->wl, 1);
2251         err = -ENOENT;
2252
2253 out:
2254         kfree(ctx);
2255         return err;
2256 }
2257
2258 static int b43_upload_microcode(struct b43_wldev *dev)
2259 {
2260         const size_t hdr_len = sizeof(struct b43_fw_header);
2261         const __be32 *data;
2262         unsigned int i, len;
2263         u16 fwrev, fwpatch, fwdate, fwtime;
2264         u32 tmp, macctl;
2265         int err = 0;
2266
2267         /* Jump the microcode PSM to offset 0 */
2268         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2269         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2270         macctl |= B43_MACCTL_PSM_JMP0;
2271         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2272         /* Zero out all microcode PSM registers and shared memory. */
2273         for (i = 0; i < 64; i++)
2274                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2275         for (i = 0; i < 4096; i += 2)
2276                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2277
2278         /* Upload Microcode. */
2279         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2280         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2281         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2282         for (i = 0; i < len; i++) {
2283                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2284                 udelay(10);
2285         }
2286
2287         if (dev->fw.pcm.data) {
2288                 /* Upload PCM data. */
2289                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2290                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2291                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2292                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2293                 /* No need for autoinc bit in SHM_HW */
2294                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2295                 for (i = 0; i < len; i++) {
2296                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2297                         udelay(10);
2298                 }
2299         }
2300
2301         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2302
2303         /* Start the microcode PSM */
2304         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2305         macctl &= ~B43_MACCTL_PSM_JMP0;
2306         macctl |= B43_MACCTL_PSM_RUN;
2307         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2308
2309         /* Wait for the microcode to load and respond */
2310         i = 0;
2311         while (1) {
2312                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2313                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2314                         break;
2315                 i++;
2316                 if (i >= 20) {
2317                         b43err(dev->wl, "Microcode not responding\n");
2318                         b43_print_fw_helptext(dev->wl, 1);
2319                         err = -ENODEV;
2320                         goto error;
2321                 }
2322                 msleep_interruptible(50);
2323                 if (signal_pending(current)) {
2324                         err = -EINTR;
2325                         goto error;
2326                 }
2327         }
2328         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2329
2330         /* Get and check the revisions. */
2331         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2332         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2333         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2334         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2335
2336         if (fwrev <= 0x128) {
2337                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2338                        "binary drivers older than version 4.x is unsupported. "
2339                        "You must upgrade your firmware files.\n");
2340                 b43_print_fw_helptext(dev->wl, 1);
2341                 err = -EOPNOTSUPP;
2342                 goto error;
2343         }
2344         dev->fw.rev = fwrev;
2345         dev->fw.patch = fwpatch;
2346         dev->fw.opensource = (fwdate == 0xFFFF);
2347
2348         /* Default to use-all-queues. */
2349         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2350         dev->qos_enabled = !!modparam_qos;
2351         /* Default to firmware/hardware crypto acceleration. */
2352         dev->hwcrypto_enabled = 1;
2353
2354         if (dev->fw.opensource) {
2355                 u16 fwcapa;
2356
2357                 /* Patchlevel info is encoded in the "time" field. */
2358                 dev->fw.patch = fwtime;
2359                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2360                         dev->fw.rev, dev->fw.patch);
2361
2362                 fwcapa = b43_fwcapa_read(dev);
2363                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2364                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2365                         /* Disable hardware crypto and fall back to software crypto. */
2366                         dev->hwcrypto_enabled = 0;
2367                 }
2368                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2369                         b43info(dev->wl, "QoS not supported by firmware\n");
2370                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2371                          * ieee80211_unregister to make sure the networking core can
2372                          * properly free possible resources. */
2373                         dev->wl->hw->queues = 1;
2374                         dev->qos_enabled = 0;
2375                 }
2376         } else {
2377                 b43info(dev->wl, "Loading firmware version %u.%u "
2378                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2379                         fwrev, fwpatch,
2380                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2381                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2382                 if (dev->fw.pcm_request_failed) {
2383                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2384                                 "Hardware accelerated cryptography is disabled.\n");
2385                         b43_print_fw_helptext(dev->wl, 0);
2386                 }
2387         }
2388
2389         if (b43_is_old_txhdr_format(dev)) {
2390                 /* We're over the deadline, but we keep support for old fw
2391                  * until it turns out to be in major conflict with something new. */
2392                 b43warn(dev->wl, "You are using an old firmware image. "
2393                         "Support for old firmware will be removed soon "
2394                         "(official deadline was July 2008).\n");
2395                 b43_print_fw_helptext(dev->wl, 0);
2396         }
2397
2398         return 0;
2399
2400 error:
2401         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2402         macctl &= ~B43_MACCTL_PSM_RUN;
2403         macctl |= B43_MACCTL_PSM_JMP0;
2404         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2405
2406         return err;
2407 }
2408
2409 static int b43_write_initvals(struct b43_wldev *dev,
2410                               const struct b43_iv *ivals,
2411                               size_t count,
2412                               size_t array_size)
2413 {
2414         const struct b43_iv *iv;
2415         u16 offset;
2416         size_t i;
2417         bool bit32;
2418
2419         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2420         iv = ivals;
2421         for (i = 0; i < count; i++) {
2422                 if (array_size < sizeof(iv->offset_size))
2423                         goto err_format;
2424                 array_size -= sizeof(iv->offset_size);
2425                 offset = be16_to_cpu(iv->offset_size);
2426                 bit32 = !!(offset & B43_IV_32BIT);
2427                 offset &= B43_IV_OFFSET_MASK;
2428                 if (offset >= 0x1000)
2429                         goto err_format;
2430                 if (bit32) {
2431                         u32 value;
2432
2433                         if (array_size < sizeof(iv->data.d32))
2434                                 goto err_format;
2435                         array_size -= sizeof(iv->data.d32);
2436
2437                         value = get_unaligned_be32(&iv->data.d32);
2438                         b43_write32(dev, offset, value);
2439
2440                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2441                                                         sizeof(__be16) +
2442                                                         sizeof(__be32));
2443                 } else {
2444                         u16 value;
2445
2446                         if (array_size < sizeof(iv->data.d16))
2447                                 goto err_format;
2448                         array_size -= sizeof(iv->data.d16);
2449
2450                         value = be16_to_cpu(iv->data.d16);
2451                         b43_write16(dev, offset, value);
2452
2453                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2454                                                         sizeof(__be16) +
2455                                                         sizeof(__be16));
2456                 }
2457         }
2458         if (array_size)
2459                 goto err_format;
2460
2461         return 0;
2462
2463 err_format:
2464         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2465         b43_print_fw_helptext(dev->wl, 1);
2466
2467         return -EPROTO;
2468 }
2469
2470 static int b43_upload_initvals(struct b43_wldev *dev)
2471 {
2472         const size_t hdr_len = sizeof(struct b43_fw_header);
2473         const struct b43_fw_header *hdr;
2474         struct b43_firmware *fw = &dev->fw;
2475         const struct b43_iv *ivals;
2476         size_t count;
2477         int err;
2478
2479         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2480         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2481         count = be32_to_cpu(hdr->size);
2482         err = b43_write_initvals(dev, ivals, count,
2483                                  fw->initvals.data->size - hdr_len);
2484         if (err)
2485                 goto out;
2486         if (fw->initvals_band.data) {
2487                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2488                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2489                 count = be32_to_cpu(hdr->size);
2490                 err = b43_write_initvals(dev, ivals, count,
2491                                          fw->initvals_band.data->size - hdr_len);
2492                 if (err)
2493                         goto out;
2494         }
2495 out:
2496
2497         return err;
2498 }
2499
2500 /* Initialize the GPIOs
2501  * http://bcm-specs.sipsolutions.net/GPIO
2502  */
2503 static int b43_gpio_init(struct b43_wldev *dev)
2504 {
2505         struct ssb_bus *bus = dev->dev->bus;
2506         struct ssb_device *gpiodev, *pcidev = NULL;
2507         u32 mask, set;
2508
2509         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2510                     & ~B43_MACCTL_GPOUTSMSK);
2511
2512         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2513                     | 0x000F);
2514
2515         mask = 0x0000001F;
2516         set = 0x0000000F;
2517         if (dev->dev->bus->chip_id == 0x4301) {
2518                 mask |= 0x0060;
2519                 set |= 0x0060;
2520         }
2521         if (0 /* FIXME: conditional unknown */ ) {
2522                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2523                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2524                             | 0x0100);
2525                 mask |= 0x0180;
2526                 set |= 0x0180;
2527         }
2528         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2529                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2530                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2531                             | 0x0200);
2532                 mask |= 0x0200;
2533                 set |= 0x0200;
2534         }
2535         if (dev->dev->id.revision >= 2)
2536                 mask |= 0x0010; /* FIXME: This is redundant. */
2537
2538 #ifdef CONFIG_SSB_DRIVER_PCICORE
2539         pcidev = bus->pcicore.dev;
2540 #endif
2541         gpiodev = bus->chipco.dev ? : pcidev;
2542         if (!gpiodev)
2543                 return 0;
2544         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2545                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2546                      & mask) | set);
2547
2548         return 0;
2549 }
2550
2551 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2552 static void b43_gpio_cleanup(struct b43_wldev *dev)
2553 {
2554         struct ssb_bus *bus = dev->dev->bus;
2555         struct ssb_device *gpiodev, *pcidev = NULL;
2556
2557 #ifdef CONFIG_SSB_DRIVER_PCICORE
2558         pcidev = bus->pcicore.dev;
2559 #endif
2560         gpiodev = bus->chipco.dev ? : pcidev;
2561         if (!gpiodev)
2562                 return;
2563         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2564 }
2565
2566 /* http://bcm-specs.sipsolutions.net/EnableMac */
2567 void b43_mac_enable(struct b43_wldev *dev)
2568 {
2569         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2570                 u16 fwstate;
2571
2572                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2573                                          B43_SHM_SH_UCODESTAT);
2574                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2575                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2576                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2577                                "should be suspended, but current state is %u\n",
2578                                fwstate);
2579                 }
2580         }
2581
2582         dev->mac_suspended--;
2583         B43_WARN_ON(dev->mac_suspended < 0);
2584         if (dev->mac_suspended == 0) {
2585                 b43_write32(dev, B43_MMIO_MACCTL,
2586                             b43_read32(dev, B43_MMIO_MACCTL)
2587                             | B43_MACCTL_ENABLED);
2588                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2589                             B43_IRQ_MAC_SUSPENDED);
2590                 /* Commit writes */
2591                 b43_read32(dev, B43_MMIO_MACCTL);
2592                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2593                 b43_power_saving_ctl_bits(dev, 0);
2594         }
2595 }
2596
2597 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2598 void b43_mac_suspend(struct b43_wldev *dev)
2599 {
2600         int i;
2601         u32 tmp;
2602
2603         might_sleep();
2604         B43_WARN_ON(dev->mac_suspended < 0);
2605
2606         if (dev->mac_suspended == 0) {
2607                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2608                 b43_write32(dev, B43_MMIO_MACCTL,
2609                             b43_read32(dev, B43_MMIO_MACCTL)
2610                             & ~B43_MACCTL_ENABLED);
2611                 /* force pci to flush the write */
2612                 b43_read32(dev, B43_MMIO_MACCTL);
2613                 for (i = 35; i; i--) {
2614                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2615                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2616                                 goto out;
2617                         udelay(10);
2618                 }
2619                 /* Hm, it seems this will take some time. Use msleep(). */
2620                 for (i = 40; i; i--) {
2621                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2622                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2623                                 goto out;
2624                         msleep(1);
2625                 }
2626                 b43err(dev->wl, "MAC suspend failed\n");
2627         }
2628 out:
2629         dev->mac_suspended++;
2630 }
2631
2632 static void b43_adjust_opmode(struct b43_wldev *dev)
2633 {
2634         struct b43_wl *wl = dev->wl;
2635         u32 ctl;
2636         u16 cfp_pretbtt;
2637
2638         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2639         /* Reset status to STA infrastructure mode. */
2640         ctl &= ~B43_MACCTL_AP;
2641         ctl &= ~B43_MACCTL_KEEP_CTL;
2642         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2643         ctl &= ~B43_MACCTL_KEEP_BAD;
2644         ctl &= ~B43_MACCTL_PROMISC;
2645         ctl &= ~B43_MACCTL_BEACPROMISC;
2646         ctl |= B43_MACCTL_INFRA;
2647
2648         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2649             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2650                 ctl |= B43_MACCTL_AP;
2651         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2652                 ctl &= ~B43_MACCTL_INFRA;
2653
2654         if (wl->filter_flags & FIF_CONTROL)
2655                 ctl |= B43_MACCTL_KEEP_CTL;
2656         if (wl->filter_flags & FIF_FCSFAIL)
2657                 ctl |= B43_MACCTL_KEEP_BAD;
2658         if (wl->filter_flags & FIF_PLCPFAIL)
2659                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2660         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2661                 ctl |= B43_MACCTL_PROMISC;
2662         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2663                 ctl |= B43_MACCTL_BEACPROMISC;
2664
2665         /* Workaround: On old hardware the HW-MAC-address-filter
2666          * doesn't work properly, so always run promisc in filter
2667          * it in software. */
2668         if (dev->dev->id.revision <= 4)
2669                 ctl |= B43_MACCTL_PROMISC;
2670
2671         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2672
2673         cfp_pretbtt = 2;
2674         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2675                 if (dev->dev->bus->chip_id == 0x4306 &&
2676                     dev->dev->bus->chip_rev == 3)
2677                         cfp_pretbtt = 100;
2678                 else
2679                         cfp_pretbtt = 50;
2680         }
2681         b43_write16(dev, 0x612, cfp_pretbtt);
2682 }
2683
2684 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2685 {
2686         u16 offset;
2687
2688         if (is_ofdm) {
2689                 offset = 0x480;
2690                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2691         } else {
2692                 offset = 0x4C0;
2693                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2694         }
2695         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2696                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2697 }
2698
2699 static void b43_rate_memory_init(struct b43_wldev *dev)
2700 {
2701         switch (dev->phy.type) {
2702         case B43_PHYTYPE_A:
2703         case B43_PHYTYPE_G:
2704         case B43_PHYTYPE_N:
2705         case B43_PHYTYPE_LP:
2706                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2707                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2708                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2709                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2710                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2711                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2712                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2713                 if (dev->phy.type == B43_PHYTYPE_A)
2714                         break;
2715                 /* fallthrough */
2716         case B43_PHYTYPE_B:
2717                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2718                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2719                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2720                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2721                 break;
2722         default:
2723                 B43_WARN_ON(1);
2724         }
2725 }
2726
2727 /* Set the default values for the PHY TX Control Words. */
2728 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2729 {
2730         u16 ctl = 0;
2731
2732         ctl |= B43_TXH_PHY_ENC_CCK;
2733         ctl |= B43_TXH_PHY_ANT01AUTO;
2734         ctl |= B43_TXH_PHY_TXPWR;
2735
2736         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2737         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2738         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2739 }
2740
2741 /* Set the TX-Antenna for management frames sent by firmware. */
2742 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2743 {
2744         u16 ant;
2745         u16 tmp;
2746
2747         ant = b43_antenna_to_phyctl(antenna);
2748
2749         /* For ACK/CTS */
2750         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2751         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2752         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2753         /* For Probe Resposes */
2754         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2755         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2756         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2757 }
2758
2759 /* This is the opposite of b43_chip_init() */
2760 static void b43_chip_exit(struct b43_wldev *dev)
2761 {
2762         b43_phy_exit(dev);
2763         b43_gpio_cleanup(dev);
2764         /* firmware is released later */
2765 }
2766
2767 /* Initialize the chip
2768  * http://bcm-specs.sipsolutions.net/ChipInit
2769  */
2770 static int b43_chip_init(struct b43_wldev *dev)
2771 {
2772         struct b43_phy *phy = &dev->phy;
2773         int err;
2774         u32 value32, macctl;
2775         u16 value16;
2776
2777         /* Initialize the MAC control */
2778         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2779         if (dev->phy.gmode)
2780                 macctl |= B43_MACCTL_GMODE;
2781         macctl |= B43_MACCTL_INFRA;
2782         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2783
2784         err = b43_request_firmware(dev);
2785         if (err)
2786                 goto out;
2787         err = b43_upload_microcode(dev);
2788         if (err)
2789                 goto out;       /* firmware is released later */
2790
2791         err = b43_gpio_init(dev);
2792         if (err)
2793                 goto out;       /* firmware is released later */
2794
2795         err = b43_upload_initvals(dev);
2796         if (err)
2797                 goto err_gpio_clean;
2798
2799         /* Turn the Analog on and initialize the PHY. */
2800         phy->ops->switch_analog(dev, 1);
2801         err = b43_phy_init(dev);
2802         if (err)
2803                 goto err_gpio_clean;
2804
2805         /* Disable Interference Mitigation. */
2806         if (phy->ops->interf_mitigation)
2807                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2808
2809         /* Select the antennae */
2810         if (phy->ops->set_rx_antenna)
2811                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2812         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2813
2814         if (phy->type == B43_PHYTYPE_B) {
2815                 value16 = b43_read16(dev, 0x005E);
2816                 value16 |= 0x0004;
2817                 b43_write16(dev, 0x005E, value16);
2818         }
2819         b43_write32(dev, 0x0100, 0x01000000);
2820         if (dev->dev->id.revision < 5)
2821                 b43_write32(dev, 0x010C, 0x01000000);
2822
2823         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2824                     & ~B43_MACCTL_INFRA);
2825         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2826                     | B43_MACCTL_INFRA);
2827
2828         /* Probe Response Timeout value */
2829         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2830         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2831
2832         /* Initially set the wireless operation mode. */
2833         b43_adjust_opmode(dev);
2834
2835         if (dev->dev->id.revision < 3) {
2836                 b43_write16(dev, 0x060E, 0x0000);
2837                 b43_write16(dev, 0x0610, 0x8000);
2838                 b43_write16(dev, 0x0604, 0x0000);
2839                 b43_write16(dev, 0x0606, 0x0200);
2840         } else {
2841                 b43_write32(dev, 0x0188, 0x80000000);
2842                 b43_write32(dev, 0x018C, 0x02000000);
2843         }
2844         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2845         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2846         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2847         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2848         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2849         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2850         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2851
2852         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2853         value32 |= 0x00100000;
2854         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2855
2856         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2857                     dev->dev->bus->chipco.fast_pwrup_delay);
2858
2859         err = 0;
2860         b43dbg(dev->wl, "Chip initialized\n");
2861 out:
2862         return err;
2863
2864 err_gpio_clean:
2865         b43_gpio_cleanup(dev);
2866         return err;
2867 }
2868
2869 static void b43_periodic_every60sec(struct b43_wldev *dev)
2870 {
2871         const struct b43_phy_operations *ops = dev->phy.ops;
2872
2873         if (ops->pwork_60sec)
2874                 ops->pwork_60sec(dev);
2875
2876         /* Force check the TX power emission now. */
2877         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2878 }
2879
2880 static void b43_periodic_every30sec(struct b43_wldev *dev)
2881 {
2882         /* Update device statistics. */
2883         b43_calculate_link_quality(dev);
2884 }
2885
2886 static void b43_periodic_every15sec(struct b43_wldev *dev)
2887 {
2888         struct b43_phy *phy = &dev->phy;
2889         u16 wdr;
2890
2891         if (dev->fw.opensource) {
2892                 /* Check if the firmware is still alive.
2893                  * It will reset the watchdog counter to 0 in its idle loop. */
2894                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2895                 if (unlikely(wdr)) {
2896                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2897                         b43_controller_restart(dev, "Firmware watchdog");
2898                         return;
2899                 } else {
2900                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2901                                         B43_WATCHDOG_REG, 1);
2902                 }
2903         }
2904
2905         if (phy->ops->pwork_15sec)
2906                 phy->ops->pwork_15sec(dev);
2907
2908         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2909         wmb();
2910 }
2911
2912 static void do_periodic_work(struct b43_wldev *dev)
2913 {
2914         unsigned int state;
2915
2916         state = dev->periodic_state;
2917         if (state % 4 == 0)
2918                 b43_periodic_every60sec(dev);
2919         if (state % 2 == 0)
2920                 b43_periodic_every30sec(dev);
2921         b43_periodic_every15sec(dev);
2922 }
2923
2924 /* Periodic work locking policy:
2925  *      The whole periodic work handler is protected by
2926  *      wl->mutex. If another lock is needed somewhere in the
2927  *      pwork callchain, it's aquired in-place, where it's needed.
2928  */
2929 static void b43_periodic_work_handler(struct work_struct *work)
2930 {
2931         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2932                                              periodic_work.work);
2933         struct b43_wl *wl = dev->wl;
2934         unsigned long delay;
2935
2936         mutex_lock(&wl->mutex);
2937
2938         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2939                 goto out;
2940         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2941                 goto out_requeue;
2942
2943         do_periodic_work(dev);
2944
2945         dev->periodic_state++;
2946 out_requeue:
2947         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2948                 delay = msecs_to_jiffies(50);
2949         else
2950                 delay = round_jiffies_relative(HZ * 15);
2951         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2952 out:
2953         mutex_unlock(&wl->mutex);
2954 }
2955
2956 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2957 {
2958         struct delayed_work *work = &dev->periodic_work;
2959
2960         dev->periodic_state = 0;
2961         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2962         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2963 }
2964
2965 /* Check if communication with the device works correctly. */
2966 static int b43_validate_chipaccess(struct b43_wldev *dev)
2967 {
2968         u32 v, backup0, backup4;
2969
2970         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2971         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2972
2973         /* Check for read/write and endianness problems. */
2974         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2975         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2976                 goto error;
2977         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2978         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2979                 goto error;
2980
2981         /* Check if unaligned 32bit SHM_SHARED access works properly.
2982          * However, don't bail out on failure, because it's noncritical. */
2983         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
2984         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
2985         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
2986         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
2987         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
2988                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
2989         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
2990         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
2991             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
2992             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
2993             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
2994                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
2995
2996         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
2997         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
2998
2999         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
3000                 /* The 32bit register shadows the two 16bit registers
3001                  * with update sideeffects. Validate this. */
3002                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3003                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3004                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3005                         goto error;
3006                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3007                         goto error;
3008         }
3009         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3010
3011         v = b43_read32(dev, B43_MMIO_MACCTL);
3012         v |= B43_MACCTL_GMODE;
3013         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3014                 goto error;
3015
3016         return 0;
3017 error:
3018         b43err(dev->wl, "Failed to validate the chipaccess\n");
3019         return -ENODEV;
3020 }
3021
3022 static void b43_security_init(struct b43_wldev *dev)
3023 {
3024         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3025         /* KTP is a word address, but we address SHM bytewise.
3026          * So multiply by two.
3027          */
3028         dev->ktp *= 2;
3029         /* Number of RCMTA address slots */
3030         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3031         /* Clear the key memory. */
3032         b43_clear_keys(dev);
3033 }
3034
3035 #ifdef CONFIG_B43_HWRNG
3036 static int b43_rng_read(struct hwrng *rng, u32 *data)
3037 {
3038         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3039         unsigned long flags;
3040
3041         /* Don't take wl->mutex here, as it could deadlock with
3042          * hwrng internal locking. It's not needed to take
3043          * wl->mutex here, anyway. */
3044
3045         spin_lock_irqsave(&wl->irq_lock, flags);
3046         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
3047         spin_unlock_irqrestore(&wl->irq_lock, flags);
3048
3049         return (sizeof(u16));
3050 }
3051 #endif /* CONFIG_B43_HWRNG */
3052
3053 static void b43_rng_exit(struct b43_wl *wl)
3054 {
3055 #ifdef CONFIG_B43_HWRNG
3056         if (wl->rng_initialized)
3057                 hwrng_unregister(&wl->rng);
3058 #endif /* CONFIG_B43_HWRNG */
3059 }
3060
3061 static int b43_rng_init(struct b43_wl *wl)
3062 {
3063         int err = 0;
3064