drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 static int modparam_hwtkip;
  84 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  85 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  86
  87 static int modparam_qos = 1;
  88 module_param_named(qos, modparam_qos, int, 0444);
  89 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  90
  91 static int modparam_btcoex = 1;
  92 module_param_named(btcoex, modparam_btcoex, int, 0444);
  93 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  94
  95 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
  96 module_param_named(verbose, b43_modparam_verbose, int, 0644);
  97 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
  98
  99
 100 static const struct ssb_device_id b43_ssb_tbl[] = {
 101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 106         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 107         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 108         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 109         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 110         SSB_DEVTABLE_END
 111 };
 112
 113 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 114
 115 /* Channel and ratetables are shared for all devices.
 116  * They can't be const, because ieee80211 puts some precalculated
 117  * data in there. This data is the same for all devices, so we don't
 118  * get concurrency issues */
 119 #define RATETAB_ENT(_rateid, _flags) \
 120         {                                                               \
 121                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 122                 .hw_value       = (_rateid),                            \
 123                 .flags          = (_flags),                             \
 124         }
 125
 126 /*
 127  * NOTE: When changing this, sync with xmit.c's
 128  *       b43_plcp_get_bitrate_idx_* functions!
 129  */
 130 static struct ieee80211_rate __b43_ratetable[] = {
 131         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 132         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 133         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 134         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 135         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 136         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 137         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 138         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 139         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 140         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 141         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 142         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 143 };
 144
 145 #define b43_a_ratetable         (__b43_ratetable + 4)
 146 #define b43_a_ratetable_size    8
 147 #define b43_b_ratetable         (__b43_ratetable + 0)
 148 #define b43_b_ratetable_size    4
 149 #define b43_g_ratetable         (__b43_ratetable + 0)
 150 #define b43_g_ratetable_size    12
 151
 152 #define CHAN4G(_channel, _freq, _flags) {                       \
 153         .band                   = IEEE80211_BAND_2GHZ,          \
 154         .center_freq            = (_freq),                      \
 155         .hw_value               = (_channel),                   \
 156         .flags                  = (_flags),                     \
 157         .max_antenna_gain       = 0,                            \
 158         .max_power              = 30,                           \
 159 }
 160 static struct ieee80211_channel b43_2ghz_chantable[] = {
 161         CHAN4G(1, 2412, 0),
 162         CHAN4G(2, 2417, 0),
 163         CHAN4G(3, 2422, 0),
 164         CHAN4G(4, 2427, 0),
 165         CHAN4G(5, 2432, 0),
 166         CHAN4G(6, 2437, 0),
 167         CHAN4G(7, 2442, 0),
 168         CHAN4G(8, 2447, 0),
 169         CHAN4G(9, 2452, 0),
 170         CHAN4G(10, 2457, 0),
 171         CHAN4G(11, 2462, 0),
 172         CHAN4G(12, 2467, 0),
 173         CHAN4G(13, 2472, 0),
 174         CHAN4G(14, 2484, 0),
 175 };
 176 #undef CHAN4G
 177
 178 #define CHAN5G(_channel, _flags) {                              \
 179         .band                   = IEEE80211_BAND_5GHZ,          \
 180         .center_freq            = 5000 + (5 * (_channel)),      \
 181         .hw_value               = (_channel),                   \
 182         .flags                  = (_flags),                     \
 183         .max_antenna_gain       = 0,                            \
 184         .max_power              = 30,                           \
 185 }
 186 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 187         CHAN5G(32, 0),          CHAN5G(34, 0),
 188         CHAN5G(36, 0),          CHAN5G(38, 0),
 189         CHAN5G(40, 0),          CHAN5G(42, 0),
 190         CHAN5G(44, 0),          CHAN5G(46, 0),
 191         CHAN5G(48, 0),          CHAN5G(50, 0),
 192         CHAN5G(52, 0),          CHAN5G(54, 0),
 193         CHAN5G(56, 0),          CHAN5G(58, 0),
 194         CHAN5G(60, 0),          CHAN5G(62, 0),
 195         CHAN5G(64, 0),          CHAN5G(66, 0),
 196         CHAN5G(68, 0),          CHAN5G(70, 0),
 197         CHAN5G(72, 0),          CHAN5G(74, 0),
 198         CHAN5G(76, 0),          CHAN5G(78, 0),
 199         CHAN5G(80, 0),          CHAN5G(82, 0),
 200         CHAN5G(84, 0),          CHAN5G(86, 0),
 201         CHAN5G(88, 0),          CHAN5G(90, 0),
 202         CHAN5G(92, 0),          CHAN5G(94, 0),
 203         CHAN5G(96, 0),          CHAN5G(98, 0),
 204         CHAN5G(100, 0),         CHAN5G(102, 0),
 205         CHAN5G(104, 0),         CHAN5G(106, 0),
 206         CHAN5G(108, 0),         CHAN5G(110, 0),
 207         CHAN5G(112, 0),         CHAN5G(114, 0),
 208         CHAN5G(116, 0),         CHAN5G(118, 0),
 209         CHAN5G(120, 0),         CHAN5G(122, 0),
 210         CHAN5G(124, 0),         CHAN5G(126, 0),
 211         CHAN5G(128, 0),         CHAN5G(130, 0),
 212         CHAN5G(132, 0),         CHAN5G(134, 0),
 213         CHAN5G(136, 0),         CHAN5G(138, 0),
 214         CHAN5G(140, 0),         CHAN5G(142, 0),
 215         CHAN5G(144, 0),         CHAN5G(145, 0),
 216         CHAN5G(146, 0),         CHAN5G(147, 0),
 217         CHAN5G(148, 0),         CHAN5G(149, 0),
 218         CHAN5G(150, 0),         CHAN5G(151, 0),
 219         CHAN5G(152, 0),         CHAN5G(153, 0),
 220         CHAN5G(154, 0),         CHAN5G(155, 0),
 221         CHAN5G(156, 0),         CHAN5G(157, 0),
 222         CHAN5G(158, 0),         CHAN5G(159, 0),
 223         CHAN5G(160, 0),         CHAN5G(161, 0),
 224         CHAN5G(162, 0),         CHAN5G(163, 0),
 225         CHAN5G(164, 0),         CHAN5G(165, 0),
 226         CHAN5G(166, 0),         CHAN5G(168, 0),
 227         CHAN5G(170, 0),         CHAN5G(172, 0),
 228         CHAN5G(174, 0),         CHAN5G(176, 0),
 229         CHAN5G(178, 0),         CHAN5G(180, 0),
 230         CHAN5G(182, 0),         CHAN5G(184, 0),
 231         CHAN5G(186, 0),         CHAN5G(188, 0),
 232         CHAN5G(190, 0),         CHAN5G(192, 0),
 233         CHAN5G(194, 0),         CHAN5G(196, 0),
 234         CHAN5G(198, 0),         CHAN5G(200, 0),
 235         CHAN5G(202, 0),         CHAN5G(204, 0),
 236         CHAN5G(206, 0),         CHAN5G(208, 0),
 237         CHAN5G(210, 0),         CHAN5G(212, 0),
 238         CHAN5G(214, 0),         CHAN5G(216, 0),
 239         CHAN5G(218, 0),         CHAN5G(220, 0),
 240         CHAN5G(222, 0),         CHAN5G(224, 0),
 241         CHAN5G(226, 0),         CHAN5G(228, 0),
 242 };
 243
 244 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 245         CHAN5G(34, 0),          CHAN5G(36, 0),
 246         CHAN5G(38, 0),          CHAN5G(40, 0),
 247         CHAN5G(42, 0),          CHAN5G(44, 0),
 248         CHAN5G(46, 0),          CHAN5G(48, 0),
 249         CHAN5G(52, 0),          CHAN5G(56, 0),
 250         CHAN5G(60, 0),          CHAN5G(64, 0),
 251         CHAN5G(100, 0),         CHAN5G(104, 0),
 252         CHAN5G(108, 0),         CHAN5G(112, 0),
 253         CHAN5G(116, 0),         CHAN5G(120, 0),
 254         CHAN5G(124, 0),         CHAN5G(128, 0),
 255         CHAN5G(132, 0),         CHAN5G(136, 0),
 256         CHAN5G(140, 0),         CHAN5G(149, 0),
 257         CHAN5G(153, 0),         CHAN5G(157, 0),
 258         CHAN5G(161, 0),         CHAN5G(165, 0),
 259         CHAN5G(184, 0),         CHAN5G(188, 0),
 260         CHAN5G(192, 0),         CHAN5G(196, 0),
 261         CHAN5G(200, 0),         CHAN5G(204, 0),
 262         CHAN5G(208, 0),         CHAN5G(212, 0),
 263         CHAN5G(216, 0),
 264 };
 265 #undef CHAN5G
 266
 267 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 268         .band           = IEEE80211_BAND_5GHZ,
 269         .channels       = b43_5ghz_nphy_chantable,
 270         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 271         .bitrates       = b43_a_ratetable,
 272         .n_bitrates     = b43_a_ratetable_size,
 273 };
 274
 275 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 276         .band           = IEEE80211_BAND_5GHZ,
 277         .channels       = b43_5ghz_aphy_chantable,
 278         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 279         .bitrates       = b43_a_ratetable,
 280         .n_bitrates     = b43_a_ratetable_size,
 281 };
 282
 283 static struct ieee80211_supported_band b43_band_2GHz = {
 284         .band           = IEEE80211_BAND_2GHZ,
 285         .channels       = b43_2ghz_chantable,
 286         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 287         .bitrates       = b43_g_ratetable,
 288         .n_bitrates     = b43_g_ratetable_size,
 289 };
 290
 291 static void b43_wireless_core_exit(struct b43_wldev *dev);
 292 static int b43_wireless_core_init(struct b43_wldev *dev);
 293 static void b43_wireless_core_stop(struct b43_wldev *dev);
 294 static int b43_wireless_core_start(struct b43_wldev *dev);
 295
 296 static int b43_ratelimit(struct b43_wl *wl)
 297 {
 298         if (!wl || !wl->current_dev)
 299                 return 1;
 300         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 301                 return 1;
 302         /* We are up and running.
 303          * Ratelimit the messages to avoid DoS over the net. */
 304         return net_ratelimit();
 305 }
 306
 307 void b43info(struct b43_wl *wl, const char *fmt, ...)
 308 {
 309         va_list args;
 310
 311         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 312                 return;
 313         if (!b43_ratelimit(wl))
 314                 return;
 315         va_start(args, fmt);
 316         printk(KERN_INFO "b43-%s: ",
 317                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 318         vprintk(fmt, args);
 319         va_end(args);
 320 }
 321
 322 void b43err(struct b43_wl *wl, const char *fmt, ...)
 323 {
 324         va_list args;
 325
 326         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 327                 return;
 328         if (!b43_ratelimit(wl))
 329                 return;
 330         va_start(args, fmt);
 331         printk(KERN_ERR "b43-%s ERROR: ",
 332                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 333         vprintk(fmt, args);
 334         va_end(args);
 335 }
 336
 337 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 338 {
 339         va_list args;
 340
 341         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 342                 return;
 343         if (!b43_ratelimit(wl))
 344                 return;
 345         va_start(args, fmt);
 346         printk(KERN_WARNING "b43-%s warning: ",
 347                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 348         vprintk(fmt, args);
 349         va_end(args);
 350 }
 351
 352 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 353 {
 354         va_list args;
 355
 356         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 357                 return;
 358         va_start(args, fmt);
 359         printk(KERN_DEBUG "b43-%s debug: ",
 360                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 361         vprintk(fmt, args);
 362         va_end(args);
 363 }
 364
 365 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 366 {
 367         u32 macctl;
 368
 369         B43_WARN_ON(offset % 4 != 0);
 370
 371         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 372         if (macctl & B43_MACCTL_BE)
 373                 val = swab32(val);
 374
 375         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 376         mmiowb();
 377         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 378 }
 379
 380 static inline void b43_shm_control_word(struct b43_wldev *dev,
 381                                         u16 routing, u16 offset)
 382 {
 383         u32 control;
 384
 385         /* "offset" is the WORD offset. */
 386         control = routing;
 387         control <<= 16;
 388         control |= offset;
 389         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 390 }
 391
 392 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 393 {
 394         u32 ret;
 395
 396         if (routing == B43_SHM_SHARED) {
 397                 B43_WARN_ON(offset & 0x0001);
 398                 if (offset & 0x0003) {
 399                         /* Unaligned access */
 400                         b43_shm_control_word(dev, routing, offset >> 2);
 401                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 402                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 403                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 404
 405                         goto out;
 406                 }
 407                 offset >>= 2;
 408         }
 409         b43_shm_control_word(dev, routing, offset);
 410         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 411 out:
 412         return ret;
 413 }
 414
 415 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 416 {
 417         struct b43_wl *wl = dev->wl;
 418         unsigned long flags;
 419         u32 ret;
 420
 421         spin_lock_irqsave(&wl->shm_lock, flags);
 422         ret = __b43_shm_read32(dev, routing, offset);
 423         spin_unlock_irqrestore(&wl->shm_lock, flags);
 424
 425         return ret;
 426 }
 427
 428 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 429 {
 430         u16 ret;
 431
 432         if (routing == B43_SHM_SHARED) {
 433                 B43_WARN_ON(offset & 0x0001);
 434                 if (offset & 0x0003) {
 435                         /* Unaligned access */
 436                         b43_shm_control_word(dev, routing, offset >> 2);
 437                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 438
 439                         goto out;
 440                 }
 441                 offset >>= 2;
 442         }
 443         b43_shm_control_word(dev, routing, offset);
 444         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 445 out:
 446         return ret;
 447 }
 448
 449 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 450 {
 451         struct b43_wl *wl = dev->wl;
 452         unsigned long flags;
 453         u16 ret;
 454
 455         spin_lock_irqsave(&wl->shm_lock, flags);
 456         ret = __b43_shm_read16(dev, routing, offset);
 457         spin_unlock_irqrestore(&wl->shm_lock, flags);
 458
 459         return ret;
 460 }
 461
 462 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 463 {
 464         if (routing == B43_SHM_SHARED) {
 465                 B43_WARN_ON(offset & 0x0001);
 466                 if (offset & 0x0003) {
 467                         /* Unaligned access */
 468                         b43_shm_control_word(dev, routing, offset >> 2);
 469                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 470                                     value & 0xFFFF);
 471                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 472                         b43_write16(dev, B43_MMIO_SHM_DATA,
 473                                     (value >> 16) & 0xFFFF);
 474                         return;
 475                 }
 476                 offset >>= 2;
 477         }
 478         b43_shm_control_word(dev, routing, offset);
 479         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 480 }
 481
 482 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 483 {
 484         struct b43_wl *wl = dev->wl;
 485         unsigned long flags;
 486
 487         spin_lock_irqsave(&wl->shm_lock, flags);
 488         __b43_shm_write32(dev, routing, offset, value);
 489         spin_unlock_irqrestore(&wl->shm_lock, flags);
 490 }
 491
 492 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 493 {
 494         if (routing == B43_SHM_SHARED) {
 495                 B43_WARN_ON(offset & 0x0001);
 496                 if (offset & 0x0003) {
 497                         /* Unaligned access */
 498                         b43_shm_control_word(dev, routing, offset >> 2);
 499                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         struct b43_wl *wl = dev->wl;
 511         unsigned long flags;
 512
 513         spin_lock_irqsave(&wl->shm_lock, flags);
 514         __b43_shm_write16(dev, routing, offset, value);
 515         spin_unlock_irqrestore(&wl->shm_lock, flags);
 516 }
 517
 518 /* Read HostFlags */
 519 u64 b43_hf_read(struct b43_wldev *dev)
 520 {
 521         u64 ret;
 522
 523         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 524         ret <<= 16;
 525         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 526         ret <<= 16;
 527         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 528
 529         return ret;
 530 }
 531
 532 /* Write HostFlags */
 533 void b43_hf_write(struct b43_wldev *dev, u64 value)
 534 {
 535         u16 lo, mi, hi;
 536
 537         lo = (value & 0x00000000FFFFULL);
 538         mi = (value & 0x0000FFFF0000ULL) >> 16;
 539         hi = (value & 0xFFFF00000000ULL) >> 32;
 540         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 541         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 542         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 543 }
 544
 545 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 546 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 547 {
 548         B43_WARN_ON(!dev->fw.opensource);
 549         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 550 }
 551
 552 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 553 {
 554         u32 low, high;
 555
 556         B43_WARN_ON(dev->dev->id.revision < 3);
 557
 558         /* The hardware guarantees us an atomic read, if we
 559          * read the low register first. */
 560         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 561         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 562
 563         *tsf = high;
 564         *tsf <<= 32;
 565         *tsf |= low;
 566 }
 567
 568 static void b43_time_lock(struct b43_wldev *dev)
 569 {
 570         u32 macctl;
 571
 572         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 573         macctl |= B43_MACCTL_TBTTHOLD;
 574         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 575         /* Commit the write */
 576         b43_read32(dev, B43_MMIO_MACCTL);
 577 }
 578
 579 static void b43_time_unlock(struct b43_wldev *dev)
 580 {
 581         u32 macctl;
 582
 583         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 584         macctl &= ~B43_MACCTL_TBTTHOLD;
 585         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 586         /* Commit the write */
 587         b43_read32(dev, B43_MMIO_MACCTL);
 588 }
 589
 590 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 591 {
 592         u32 low, high;
 593
 594         B43_WARN_ON(dev->dev->id.revision < 3);
 595
 596         low = tsf;
 597         high = (tsf >> 32);
 598         /* The hardware guarantees us an atomic write, if we
 599          * write the low register first. */
 600         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 601         mmiowb();
 602         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 603         mmiowb();
 604 }
 605
 606 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 607 {
 608         b43_time_lock(dev);
 609         b43_tsf_write_locked(dev, tsf);
 610         b43_time_unlock(dev);
 611 }
 612
 613 static
 614 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 615 {
 616         static const u8 zero_addr[ETH_ALEN] = { 0 };
 617         u16 data;
 618
 619         if (!mac)
 620                 mac = zero_addr;
 621
 622         offset |= 0x0020;
 623         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 624
 625         data = mac[0];
 626         data |= mac[1] << 8;
 627         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 628         data = mac[2];
 629         data |= mac[3] << 8;
 630         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 631         data = mac[4];
 632         data |= mac[5] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634 }
 635
 636 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 637 {
 638         const u8 *mac;
 639         const u8 *bssid;
 640         u8 mac_bssid[ETH_ALEN * 2];
 641         int i;
 642         u32 tmp;
 643
 644         bssid = dev->wl->bssid;
 645         mac = dev->wl->mac_addr;
 646
 647         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 648
 649         memcpy(mac_bssid, mac, ETH_ALEN);
 650         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 651
 652         /* Write our MAC address and BSSID to template ram */
 653         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 654                 tmp = (u32) (mac_bssid[i + 0]);
 655                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 656                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 657                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 658                 b43_ram_write(dev, 0x20 + i, tmp);
 659         }
 660 }
 661
 662 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 663 {
 664         b43_write_mac_bssid_templates(dev);
 665         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 666 }
 667
 668 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 669 {
 670         /* slot_time is in usec. */
 671         if (dev->phy.type != B43_PHYTYPE_G)
 672                 return;
 673         b43_write16(dev, 0x684, 510 + slot_time);
 674         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 675 }
 676
 677 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 678 {
 679         b43_set_slot_time(dev, 9);
 680 }
 681
 682 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 683 {
 684         b43_set_slot_time(dev, 20);
 685 }
 686
 687 /* Synchronize IRQ top- and bottom-half.
 688  * IRQs must be masked before calling this.
 689  * This must not be called with the irq_lock held.
 690  */
 691 static void b43_synchronize_irq(struct b43_wldev *dev)
 692 {
 693         synchronize_irq(dev->dev->irq);
 694         tasklet_kill(&dev->isr_tasklet);
 695 }
 696
 697 /* DummyTransmission function, as documented on
 698  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 699  */
 700 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 701 {
 702         struct b43_wl *wl = dev->wl;
 703         struct b43_phy *phy = &dev->phy;
 704         unsigned int i, max_loop;
 705         u16 value;
 706         u32 buffer[5] = {
 707                 0x00000000,
 708                 0x00D40000,
 709                 0x00000000,
 710                 0x01000000,
 711                 0x00000000,
 712         };
 713
 714         if (ofdm) {
 715                 max_loop = 0x1E;
 716                 buffer[0] = 0x000201CC;
 717         } else {
 718                 max_loop = 0xFA;
 719                 buffer[0] = 0x000B846E;
 720         }
 721
 722         spin_lock_irq(&wl->irq_lock);
 723         write_lock(&wl->tx_lock);
 724
 725         for (i = 0; i < 5; i++)
 726                 b43_ram_write(dev, i * 4, buffer[i]);
 727
 728         b43_write16(dev, 0x0568, 0x0000);
 729         if (dev->dev->id.revision < 11)
 730                 b43_write16(dev, 0x07C0, 0x0000);
 731         else
 732                 b43_write16(dev, 0x07C0, 0x0100);
 733         value = (ofdm ? 0x41 : 0x40);
 734         b43_write16(dev, 0x050C, value);
 735         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 736                 b43_write16(dev, 0x0514, 0x1A02);
 737         b43_write16(dev, 0x0508, 0x0000);
 738         b43_write16(dev, 0x050A, 0x0000);
 739         b43_write16(dev, 0x054C, 0x0000);
 740         b43_write16(dev, 0x056A, 0x0014);
 741         b43_write16(dev, 0x0568, 0x0826);
 742         b43_write16(dev, 0x0500, 0x0000);
 743         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 744                 //SPEC TODO
 745         }
 746
 747         switch (phy->type) {
 748         case B43_PHYTYPE_N:
 749                 b43_write16(dev, 0x0502, 0x00D0);
 750                 break;
 751         case B43_PHYTYPE_LP:
 752                 b43_write16(dev, 0x0502, 0x0050);
 753                 break;
 754         default:
 755                 b43_write16(dev, 0x0502, 0x0030);
 756         }
 757
 758         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 759                 b43_radio_write16(dev, 0x0051, 0x0017);
 760         for (i = 0x00; i < max_loop; i++) {
 761                 value = b43_read16(dev, 0x050E);
 762                 if (value & 0x0080)
 763                         break;
 764                 udelay(10);
 765         }
 766         for (i = 0x00; i < 0x0A; i++) {
 767                 value = b43_read16(dev, 0x050E);
 768                 if (value & 0x0400)
 769                         break;
 770                 udelay(10);
 771         }
 772         for (i = 0x00; i < 0x19; i++) {
 773                 value = b43_read16(dev, 0x0690);
 774                 if (!(value & 0x0100))
 775                         break;
 776                 udelay(10);
 777         }
 778         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 779                 b43_radio_write16(dev, 0x0051, 0x0037);
 780
 781         write_unlock(&wl->tx_lock);
 782         spin_unlock_irq(&wl->irq_lock);
 783 }
 784
 785 static void key_write(struct b43_wldev *dev,
 786                       u8 index, u8 algorithm, const u8 *key)
 787 {
 788         unsigned int i;
 789         u32 offset;
 790         u16 value;
 791         u16 kidx;
 792
 793         /* Key index/algo block */
 794         kidx = b43_kidx_to_fw(dev, index);
 795         value = ((kidx << 4) | algorithm);
 796         b43_shm_write16(dev, B43_SHM_SHARED,
 797                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 798
 799         /* Write the key to the Key Table Pointer offset */
 800         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 801         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 802                 value = key[i];
 803                 value |= (u16) (key[i + 1]) << 8;
 804                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 805         }
 806 }
 807
 808 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 809 {
 810         u32 addrtmp[2] = { 0, 0, };
 811         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 812
 813         if (b43_new_kidx_api(dev))
 814                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 815
 816         B43_WARN_ON(index < pairwise_keys_start);
 817         /* We have four default TX keys and possibly four default RX keys.
 818          * Physical mac 0 is mapped to physical key 4 or 8, depending
 819          * on the firmware version.
 820          * So we must adjust the index here.
 821          */
 822         index -= pairwise_keys_start;
 823         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 824
 825         if (addr) {
 826                 addrtmp[0] = addr[0];
 827                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 828                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 829                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 830                 addrtmp[1] = addr[4];
 831                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 832         }
 833
 834         /* Receive match transmitter address (RCMTA) mechanism */
 835         b43_shm_write32(dev, B43_SHM_RCMTA,
 836                         (index * 2) + 0, addrtmp[0]);
 837         b43_shm_write16(dev, B43_SHM_RCMTA,
 838                         (index * 2) + 1, addrtmp[1]);
 839 }
 840
 841 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 842  * When a packet is received, the iv32 is checked.
 843  * - if it doesn't the packet is returned without modification (and software
 844  *   decryption can be done). That's what happen when iv16 wrap.
 845  * - if it does, the rc4 key is computed, and decryption is tried.
 846  *   Either it will success and B43_RX_MAC_DEC is returned,
 847  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 848  *   and the packet is not usable (it got modified by the ucode).
 849  * So in order to never have B43_RX_MAC_DECERR, we should provide
 850  * a iv32 and phase1key that match. Because we drop packets in case of
 851  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 852  * packets will be lost without higher layer knowing (ie no resync possible
 853  * until next wrap).
 854  *
 855  * NOTE : this should support 50 key like RCMTA because
 856  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 857  */
 858 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 859                 u16 *phase1key)
 860 {
 861         unsigned int i;
 862         u32 offset;
 863         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 864
 865         if (!modparam_hwtkip)
 866                 return;
 867
 868         if (b43_new_kidx_api(dev))
 869                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 870
 871         B43_WARN_ON(index < pairwise_keys_start);
 872         /* We have four default TX keys and possibly four default RX keys.
 873          * Physical mac 0 is mapped to physical key 4 or 8, depending
 874          * on the firmware version.
 875          * So we must adjust the index here.
 876          */
 877         index -= pairwise_keys_start;
 878         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 879
 880         if (b43_debug(dev, B43_DBG_KEYS)) {
 881                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 882                                 index, iv32);
 883         }
 884         /* Write the key to the  RX tkip shared mem */
 885         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 886         for (i = 0; i < 10; i += 2) {
 887                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 888                                 phase1key ? phase1key[i / 2] : 0);
 889         }
 890         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 891         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 892 }
 893
 894 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 895                         struct ieee80211_key_conf *keyconf, const u8 *addr,
 896                         u32 iv32, u16 *phase1key)
 897 {
 898         struct b43_wl *wl = hw_to_b43_wl(hw);
 899         struct b43_wldev *dev;
 900         int index = keyconf->hw_key_idx;
 901
 902         if (B43_WARN_ON(!modparam_hwtkip))
 903                 return;
 904
 905         mutex_lock(&wl->mutex);
 906
 907         dev = wl->current_dev;
 908         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
 909                 goto out_unlock;
 910
 911         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 912
 913         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 914         keymac_write(dev, index, addr);
 915
 916 out_unlock:
 917         mutex_unlock(&wl->mutex);
 918 }
 919
 920 static void do_key_write(struct b43_wldev *dev,
 921                          u8 index, u8 algorithm,
 922                          const u8 *key, size_t key_len, const u8 *mac_addr)
 923 {
 924         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 925         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 926
 927         if (b43_new_kidx_api(dev))
 928                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 929
 930         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 931         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 932
 933         if (index >= pairwise_keys_start)
 934                 keymac_write(dev, index, NULL); /* First zero out mac. */
 935         if (algorithm == B43_SEC_ALGO_TKIP) {
 936                 /*
 937                  * We should provide an initial iv32, phase1key pair.
 938                  * We could start with iv32=0 and compute the corresponding
 939                  * phase1key, but this means calling ieee80211_get_tkip_key
 940                  * with a fake skb (or export other tkip function).
 941                  * Because we are lazy we hope iv32 won't start with
 942                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 943                  * correct pair.
 944                  */
 945                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 946         } else if (index >= pairwise_keys_start) /* clear it */
 947                 rx_tkip_phase1_write(dev, index, 0, NULL);
 948         if (key)
 949                 memcpy(buf, key, key_len);
 950         key_write(dev, index, algorithm, buf);
 951         if (index >= pairwise_keys_start)
 952                 keymac_write(dev, index, mac_addr);
 953
 954         dev->key[index].algorithm = algorithm;
 955 }
 956
 957 static int b43_key_write(struct b43_wldev *dev,
 958                          int index, u8 algorithm,
 959                          const u8 *key, size_t key_len,
 960                          const u8 *mac_addr,
 961                          struct ieee80211_key_conf *keyconf)
 962 {
 963         int i;
 964         int pairwise_keys_start;
 965
 966         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 967          *      - Temporal Encryption Key (128 bits)
 968          *      - Temporal Authenticator Tx MIC Key (64 bits)
 969          *      - Temporal Authenticator Rx MIC Key (64 bits)
 970          *
 971          *      Hardware only store TEK
 972          */
 973         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 974                 key_len = 16;
 975         if (key_len > B43_SEC_KEYSIZE)
 976                 return -EINVAL;
 977         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 978                 /* Check that we don't already have this key. */
 979                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 980         }
 981         if (index < 0) {
 982                 /* Pairwise key. Get an empty slot for the key. */
 983                 if (b43_new_kidx_api(dev))
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 985                 else
 986                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 987                 for (i = pairwise_keys_start;
 988                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 989                      i++) {
 990                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 991                         if (!dev->key[i].keyconf) {
 992                                 /* found empty */
 993                                 index = i;
 994                                 break;
 995                         }
 996                 }
 997                 if (index < 0) {
 998                         b43warn(dev->wl, "Out of hardware key memory\n");
 999                         return -ENOSPC;
1000                 }
1001         } else
1002                 B43_WARN_ON(index > 3);
1003
1004         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1005         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1006                 /* Default RX key */
1007                 B43_WARN_ON(mac_addr);
1008                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1009         }
1010         keyconf->hw_key_idx = index;
1011         dev->key[index].keyconf = keyconf;
1012
1013         return 0;
1014 }
1015
1016 static int b43_key_clear(struct b43_wldev *dev, int index)
1017 {
1018         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1019                 return -EINVAL;
1020         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1021                      NULL, B43_SEC_KEYSIZE, NULL);
1022         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1023                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1024                              NULL, B43_SEC_KEYSIZE, NULL);
1025         }
1026         dev->key[index].keyconf = NULL;
1027
1028         return 0;
1029 }
1030
1031 static void b43_clear_keys(struct b43_wldev *dev)
1032 {
1033         int i, count;
1034
1035         if (b43_new_kidx_api(dev))
1036                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1037         else
1038                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1039         for (i = 0; i < count; i++)
1040                 b43_key_clear(dev, i);
1041 }
1042
1043 static void b43_dump_keymemory(struct b43_wldev *dev)
1044 {
1045         unsigned int i, index, count, offset, pairwise_keys_start;
1046         u8 mac[ETH_ALEN];
1047         u16 algo;
1048         u32 rcmta0;
1049         u16 rcmta1;
1050         u64 hf;
1051         struct b43_key *key;
1052
1053         if (!b43_debug(dev, B43_DBG_KEYS))
1054                 return;
1055
1056         hf = b43_hf_read(dev);
1057         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1058                !!(hf & B43_HF_USEDEFKEYS));
1059         if (b43_new_kidx_api(dev)) {
1060                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1061                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1062         } else {
1063                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1064                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1065         }
1066         for (index = 0; index < count; index++) {
1067                 key = &(dev->key[index]);
1068                 printk(KERN_DEBUG "Key slot %02u: %s",
1069                        index, (key->keyconf == NULL) ? " " : "*");
1070                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1071                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1072                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1073                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1074                 }
1075
1076                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1077                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1078                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1079
1080                 if (index >= pairwise_keys_start) {
1081                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1082                                 printk("   TKIP: ");
1083                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1084                                 for (i = 0; i < 14; i += 2) {
1085                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1086                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1087                                 }
1088                         }
1089                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 0);
1091                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1092                                                 ((index - pairwise_keys_start) * 2) + 1);
1093                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1094                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1095                         printk("   MAC: %pM", mac);
1096                 } else
1097                         printk("   DEFAULT KEY");
1098                 printk("\n");
1099         }
1100 }
1101
1102 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1103 {
1104         u32 macctl;
1105         u16 ucstat;
1106         bool hwps;
1107         bool awake;
1108         int i;
1109
1110         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1111                     (ps_flags & B43_PS_DISABLED));
1112         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1113
1114         if (ps_flags & B43_PS_ENABLED) {
1115                 hwps = 1;
1116         } else if (ps_flags & B43_PS_DISABLED) {
1117                 hwps = 0;
1118         } else {
1119                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1120                 //      and thus is not an AP and we are associated, set bit 25
1121         }
1122         if (ps_flags & B43_PS_AWAKE) {
1123                 awake = 1;
1124         } else if (ps_flags & B43_PS_ASLEEP) {
1125                 awake = 0;
1126         } else {
1127                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1128                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1129                 //      successful, set bit26
1130         }
1131
1132 /* FIXME: For now we force awake-on and hwps-off */
1133         hwps = 0;
1134         awake = 1;
1135
1136         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1137         if (hwps)
1138                 macctl |= B43_MACCTL_HWPS;
1139         else
1140                 macctl &= ~B43_MACCTL_HWPS;
1141         if (awake)
1142                 macctl |= B43_MACCTL_AWAKE;
1143         else
1144                 macctl &= ~B43_MACCTL_AWAKE;
1145         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1146         /* Commit write */
1147         b43_read32(dev, B43_MMIO_MACCTL);
1148         if (awake && dev->dev->id.revision >= 5) {
1149                 /* Wait for the microcode to wake up. */
1150                 for (i = 0; i < 100; i++) {
1151                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1152                                                 B43_SHM_SH_UCODESTAT);
1153                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1154                                 break;
1155                         udelay(10);
1156                 }
1157         }
1158 }
1159
1160 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1161 {
1162         u32 tmslow;
1163         u32 macctl;
1164
1165         flags |= B43_TMSLOW_PHYCLKEN;
1166         flags |= B43_TMSLOW_PHYRESET;
1167         ssb_device_enable(dev->dev, flags);
1168         msleep(2);              /* Wait for the PLL to turn on. */
1169
1170         /* Now take the PHY out of Reset again */
1171         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1172         tmslow |= SSB_TMSLOW_FGC;
1173         tmslow &= ~B43_TMSLOW_PHYRESET;
1174         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1175         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1176         msleep(1);
1177         tmslow &= ~SSB_TMSLOW_FGC;
1178         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1179         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1180         msleep(1);
1181
1182         /* Turn Analog ON, but only if we already know the PHY-type.
1183          * This protects against very early setup where we don't know the
1184          * PHY-type, yet. wireless_core_reset will be called once again later,
1185          * when we know the PHY-type. */
1186         if (dev->phy.ops)
1187                 dev->phy.ops->switch_analog(dev, 1);
1188
1189         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1190         macctl &= ~B43_MACCTL_GMODE;
1191         if (flags & B43_TMSLOW_GMODE)
1192                 macctl |= B43_MACCTL_GMODE;
1193         macctl |= B43_MACCTL_IHR_ENABLED;
1194         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1195 }
1196
1197 static void handle_irq_transmit_status(struct b43_wldev *dev)
1198 {
1199         u32 v0, v1;
1200         u16 tmp;
1201         struct b43_txstatus stat;
1202
1203         while (1) {
1204                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1205                 if (!(v0 & 0x00000001))
1206                         break;
1207                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1208
1209                 stat.cookie = (v0 >> 16);
1210                 stat.seq = (v1 & 0x0000FFFF);
1211                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1212                 tmp = (v0 & 0x0000FFFF);
1213                 stat.frame_count = ((tmp & 0xF000) >> 12);
1214                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1215                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1216                 stat.pm_indicated = !!(tmp & 0x0080);
1217                 stat.intermediate = !!(tmp & 0x0040);
1218                 stat.for_ampdu = !!(tmp & 0x0020);
1219                 stat.acked = !!(tmp & 0x0002);
1220
1221                 b43_handle_txstatus(dev, &stat);
1222         }
1223 }
1224
1225 static void drain_txstatus_queue(struct b43_wldev *dev)
1226 {
1227         u32 dummy;
1228
1229         if (dev->dev->id.revision < 5)
1230                 return;
1231         /* Read all entries from the microcode TXstatus FIFO
1232          * and throw them away.
1233          */
1234         while (1) {
1235                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1236                 if (!(dummy & 0x00000001))
1237                         break;
1238                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1239         }
1240 }
1241
1242 static u32 b43_jssi_read(struct b43_wldev *dev)
1243 {
1244         u32 val = 0;
1245
1246         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1247         val <<= 16;
1248         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1249
1250         return val;
1251 }
1252
1253 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1254 {
1255         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1256         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1257 }
1258
1259 static void b43_generate_noise_sample(struct b43_wldev *dev)
1260 {
1261         b43_jssi_write(dev, 0x7F7F7F7F);
1262         b43_write32(dev, B43_MMIO_MACCMD,
1263                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1264 }
1265
1266 static void b43_calculate_link_quality(struct b43_wldev *dev)
1267 {
1268         /* Top half of Link Quality calculation. */
1269
1270         if (dev->phy.type != B43_PHYTYPE_G)
1271                 return;
1272         if (dev->noisecalc.calculation_running)
1273                 return;
1274         dev->noisecalc.calculation_running = 1;
1275         dev->noisecalc.nr_samples = 0;
1276
1277         b43_generate_noise_sample(dev);
1278 }
1279
1280 static void handle_irq_noise(struct b43_wldev *dev)
1281 {
1282         struct b43_phy_g *phy = dev->phy.g;
1283         u16 tmp;
1284         u8 noise[4];
1285         u8 i, j;
1286         s32 average;
1287
1288         /* Bottom half of Link Quality calculation. */
1289
1290         if (dev->phy.type != B43_PHYTYPE_G)
1291                 return;
1292
1293         /* Possible race condition: It might be possible that the user
1294          * changed to a different channel in the meantime since we
1295          * started the calculation. We ignore that fact, since it's
1296          * not really that much of a problem. The background noise is
1297          * an estimation only anyway. Slightly wrong results will get damped
1298          * by the averaging of the 8 sample rounds. Additionally the
1299          * value is shortlived. So it will be replaced by the next noise
1300          * calculation round soon. */
1301
1302         B43_WARN_ON(!dev->noisecalc.calculation_running);
1303         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1304         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1305             noise[2] == 0x7F || noise[3] == 0x7F)
1306                 goto generate_new;
1307
1308         /* Get the noise samples. */
1309         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1310         i = dev->noisecalc.nr_samples;
1311         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1312         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1313         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1314         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1315         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1316         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1317         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1318         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1319         dev->noisecalc.nr_samples++;
1320         if (dev->noisecalc.nr_samples == 8) {
1321                 /* Calculate the Link Quality by the noise samples. */
1322                 average = 0;
1323                 for (i = 0; i < 8; i++) {
1324                         for (j = 0; j < 4; j++)
1325                                 average += dev->noisecalc.samples[i][j];
1326                 }
1327                 average /= (8 * 4);
1328                 average *= 125;
1329                 average += 64;
1330                 average /= 128;
1331                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1332                 tmp = (tmp / 128) & 0x1F;
1333                 if (tmp >= 8)
1334                         average += 2;
1335                 else
1336                         average -= 25;
1337                 if (tmp == 8)
1338                         average -= 72;
1339                 else
1340                         average -= 48;
1341
1342                 dev->stats.link_noise = average;
1343                 dev->noisecalc.calculation_running = 0;
1344                 return;
1345         }
1346 generate_new:
1347         b43_generate_noise_sample(dev);
1348 }
1349
1350 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1351 {
1352         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1353                 ///TODO: PS TBTT
1354         } else {
1355                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1356                         b43_power_saving_ctl_bits(dev, 0);
1357         }
1358         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1359                 dev->dfq_valid = 1;
1360 }
1361
1362 static void handle_irq_atim_end(struct b43_wldev *dev)
1363 {
1364         if (dev->dfq_valid) {
1365                 b43_write32(dev, B43_MMIO_MACCMD,
1366                             b43_read32(dev, B43_MMIO_MACCMD)
1367                             | B43_MACCMD_DFQ_VALID);
1368                 dev->dfq_valid = 0;
1369         }
1370 }
1371
1372 static void handle_irq_pmq(struct b43_wldev *dev)
1373 {
1374         u32 tmp;
1375
1376         //TODO: AP mode.
1377
1378         while (1) {
1379                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1380                 if (!(tmp & 0x00000008))
1381                         break;
1382         }
1383         /* 16bit write is odd, but correct. */
1384         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1385 }
1386
1387 static void b43_write_template_common(struct b43_wldev *dev,
1388                                       const u8 *data, u16 size,
1389                                       u16 ram_offset,
1390                                       u16 shm_size_offset, u8 rate)
1391 {
1392         u32 i, tmp;
1393         struct b43_plcp_hdr4 plcp;
1394
1395         plcp.data = 0;
1396         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1397         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1398         ram_offset += sizeof(u32);
1399         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1400          * So leave the first two bytes of the next write blank.
1401          */
1402         tmp = (u32) (data[0]) << 16;
1403         tmp |= (u32) (data[1]) << 24;
1404         b43_ram_write(dev, ram_offset, tmp);
1405         ram_offset += sizeof(u32);
1406         for (i = 2; i < size; i += sizeof(u32)) {
1407                 tmp = (u32) (data[i + 0]);
1408                 if (i + 1 < size)
1409                         tmp |= (u32) (data[i + 1]) << 8;
1410                 if (i + 2 < size)
1411                         tmp |= (u32) (data[i + 2]) << 16;
1412                 if (i + 3 < size)
1413                         tmp |= (u32) (data[i + 3]) << 24;
1414                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1415         }
1416         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1417                         size + sizeof(struct b43_plcp_hdr6));
1418 }
1419
1420 /* Check if the use of the antenna that ieee80211 told us to
1421  * use is possible. This will fall back to DEFAULT.
1422  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1423 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1424                                   u8 antenna_nr)
1425 {
1426         u8 antenna_mask;
1427
1428         if (antenna_nr == 0) {
1429                 /* Zero means "use default antenna". That's always OK. */
1430                 return 0;
1431         }
1432
1433         /* Get the mask of available antennas. */
1434         if (dev->phy.gmode)
1435                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1436         else
1437                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1438
1439         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1440                 /* This antenna is not available. Fall back to default. */
1441                 return 0;
1442         }
1443
1444         return antenna_nr;
1445 }
1446
1447 /* Convert a b43 antenna number value to the PHY TX control value. */
1448 static u16 b43_antenna_to_phyctl(int antenna)
1449 {
1450         switch (antenna) {
1451         case B43_ANTENNA0:
1452                 return B43_TXH_PHY_ANT0;
1453         case B43_ANTENNA1:
1454                 return B43_TXH_PHY_ANT1;
1455         case B43_ANTENNA2:
1456                 return B43_TXH_PHY_ANT2;
1457         case B43_ANTENNA3:
1458                 return B43_TXH_PHY_ANT3;
1459         case B43_ANTENNA_AUTO:
1460                 return B43_TXH_PHY_ANT01AUTO;
1461         }
1462         B43_WARN_ON(1);
1463         return 0;
1464 }
1465
1466 static void b43_write_beacon_template(struct b43_wldev *dev,
1467                                       u16 ram_offset,
1468                                       u16 shm_size_offset)
1469 {
1470         unsigned int i, len, variable_len;
1471         const struct ieee80211_mgmt *bcn;
1472         const u8 *ie;
1473         bool tim_found = 0;
1474         unsigned int rate;
1475         u16 ctl;
1476         int antenna;
1477         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1478
1479         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1480         len = min((size_t) dev->wl->current_beacon->len,
1481                   0x200 - sizeof(struct b43_plcp_hdr6));
1482         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1483
1484         b43_write_template_common(dev, (const u8 *)bcn,
1485                                   len, ram_offset, shm_size_offset, rate);
1486
1487         /* Write the PHY TX control parameters. */
1488         antenna = B43_ANTENNA_DEFAULT;
1489         antenna = b43_antenna_to_phyctl(antenna);
1490         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1491         /* We can't send beacons with short preamble. Would get PHY errors. */
1492         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1493         ctl &= ~B43_TXH_PHY_ANT;
1494         ctl &= ~B43_TXH_PHY_ENC;
1495         ctl |= antenna;
1496         if (b43_is_cck_rate(rate))
1497                 ctl |= B43_TXH_PHY_ENC_CCK;
1498         else
1499                 ctl |= B43_TXH_PHY_ENC_OFDM;
1500         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1501
1502         /* Find the position of the TIM and the DTIM_period value
1503          * and write them to SHM. */
1504         ie = bcn->u.beacon.variable;
1505         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1506         for (i = 0; i < variable_len - 2; ) {
1507                 uint8_t ie_id, ie_len;
1508
1509                 ie_id = ie[i];
1510                 ie_len = ie[i + 1];
1511                 if (ie_id == 5) {
1512                         u16 tim_position;
1513                         u16 dtim_period;
1514                         /* This is the TIM Information Element */
1515
1516                         /* Check whether the ie_len is in the beacon data range. */
1517                         if (variable_len < ie_len + 2 + i)
1518                                 break;
1519                         /* A valid TIM is at least 4 bytes long. */
1520                         if (ie_len < 4)
1521                                 break;
1522                         tim_found = 1;
1523
1524                         tim_position = sizeof(struct b43_plcp_hdr6);
1525                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1526                         tim_position += i;
1527
1528                         dtim_period = ie[i + 3];
1529
1530                         b43_shm_write16(dev, B43_SHM_SHARED,
1531                                         B43_SHM_SH_TIMBPOS, tim_position);
1532                         b43_shm_write16(dev, B43_SHM_SHARED,
1533                                         B43_SHM_SH_DTIMPER, dtim_period);
1534                         break;
1535                 }
1536                 i += ie_len + 2;
1537         }
1538         if (!tim_found) {
1539                 /*
1540                  * If ucode wants to modify TIM do it behind the beacon, this
1541                  * will happen, for example, when doing mesh networking.
1542                  */
1543                 b43_shm_write16(dev, B43_SHM_SHARED,
1544                                 B43_SHM_SH_TIMBPOS,
1545                                 len + sizeof(struct b43_plcp_hdr6));
1546                 b43_shm_write16(dev, B43_SHM_SHARED,
1547                                 B43_SHM_SH_DTIMPER, 0);
1548         }
1549         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1550 }
1551
1552 static void b43_upload_beacon0(struct b43_wldev *dev)
1553 {
1554         struct b43_wl *wl = dev->wl;
1555
1556         if (wl->beacon0_uploaded)
1557                 return;
1558         b43_write_beacon_template(dev, 0x68, 0x18);
1559         wl->beacon0_uploaded = 1;
1560 }
1561
1562 static void b43_upload_beacon1(struct b43_wldev *dev)
1563 {
1564         struct b43_wl *wl = dev->wl;
1565
1566         if (wl->beacon1_uploaded)
1567                 return;
1568         b43_write_beacon_template(dev, 0x468, 0x1A);
1569         wl->beacon1_uploaded = 1;
1570 }
1571
1572 static void handle_irq_beacon(struct b43_wldev *dev)
1573 {
1574         struct b43_wl *wl = dev->wl;
1575         u32 cmd, beacon0_valid, beacon1_valid;
1576
1577         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1578             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1579                 return;
1580
1581         /* This is the bottom half of the asynchronous beacon update. */
1582
1583         /* Ignore interrupt in the future. */
1584         dev->irq_mask &= ~B43_IRQ_BEACON;
1585
1586         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1587         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1588         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1589
1590         /* Schedule interrupt manually, if busy. */
1591         if (beacon0_valid && beacon1_valid) {
1592                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1593                 dev->irq_mask |= B43_IRQ_BEACON;
1594                 return;
1595         }
1596
1597         if (unlikely(wl->beacon_templates_virgin)) {
1598                 /* We never uploaded a beacon before.
1599                  * Upload both templates now, but only mark one valid. */
1600                 wl->beacon_templates_virgin = 0;
1601                 b43_upload_beacon0(dev);
1602                 b43_upload_beacon1(dev);
1603                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1604                 cmd |= B43_MACCMD_BEACON0_VALID;
1605                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1606         } else {
1607                 if (!beacon0_valid) {
1608                         b43_upload_beacon0(dev);
1609                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1610                         cmd |= B43_MACCMD_BEACON0_VALID;
1611                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1612                 } else if (!beacon1_valid) {
1613                         b43_upload_beacon1(dev);
1614                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1615                         cmd |= B43_MACCMD_BEACON1_VALID;
1616                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1617                 }
1618         }
1619 }
1620
1621 static void b43_beacon_update_trigger_work(struct work_struct *work)
1622 {
1623         struct b43_wl *wl = container_of(work, struct b43_wl,
1624                                          beacon_update_trigger);
1625         struct b43_wldev *dev;
1626
1627         mutex_lock(&wl->mutex);
1628         dev = wl->current_dev;
1629         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1630                 spin_lock_irq(&wl->irq_lock);
1631                 /* update beacon right away or defer to irq */
1632                 handle_irq_beacon(dev);
1633                 /* The handler might have updated the IRQ mask. */
1634                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1635                 mmiowb();
1636                 spin_unlock_irq(&wl->irq_lock);
1637         }
1638         mutex_unlock(&wl->mutex);
1639 }
1640
1641 /* Asynchronously update the packet templates in template RAM.
1642  * Locking: Requires wl->irq_lock to be locked. */
1643 static void b43_update_templates(struct b43_wl *wl)
1644 {
1645         struct sk_buff *beacon;
1646
1647         /* This is the top half of the ansynchronous beacon update.
1648          * The bottom half is the beacon IRQ.
1649          * Beacon update must be asynchronous to avoid sending an
1650          * invalid beacon. This can happen for example, if the firmware
1651          * transmits a beacon while we are updating it. */
1652
1653         /* We could modify the existing beacon and set the aid bit in
1654          * the TIM field, but that would probably require resizing and
1655          * moving of data within the beacon template.
1656          * Simply request a new beacon and let mac80211 do the hard work. */
1657         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1658         if (unlikely(!beacon))
1659                 return;
1660
1661         if (wl->current_beacon)
1662                 dev_kfree_skb_any(wl->current_beacon);
1663         wl->current_beacon = beacon;
1664         wl->beacon0_uploaded = 0;
1665         wl->beacon1_uploaded = 0;
1666         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1667 }
1668
1669 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1670 {
1671         b43_time_lock(dev);
1672         if (dev->dev->id.revision >= 3) {
1673                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1674                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1675         } else {
1676                 b43_write16(dev, 0x606, (beacon_int >> 6));
1677                 b43_write16(dev, 0x610, beacon_int);
1678         }
1679         b43_time_unlock(dev);
1680         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1681 }
1682
1683 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1684 {
1685         u16 reason;
1686
1687         /* Read the register that contains the reason code for the panic. */
1688         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1689         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1690
1691         switch (reason) {
1692         default:
1693                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1694                 /* fallthrough */
1695         case B43_FWPANIC_DIE:
1696                 /* Do not restart the controller or firmware.
1697                  * The device is nonfunctional from now on.
1698                  * Restarting would result in this panic to trigger again,
1699                  * so we avoid that recursion. */
1700                 break;
1701         case B43_FWPANIC_RESTART:
1702                 b43_controller_restart(dev, "Microcode panic");
1703                 break;
1704         }
1705 }
1706
1707 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1708 {
1709         unsigned int i, cnt;
1710         u16 reason, marker_id, marker_line;
1711         __le16 *buf;
1712
1713         /* The proprietary firmware doesn't have this IRQ. */
1714         if (!dev->fw.opensource)
1715                 return;
1716
1717         /* Read the register that contains the reason code for this IRQ. */
1718         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1719
1720         switch (reason) {
1721         case B43_DEBUGIRQ_PANIC:
1722                 b43_handle_firmware_panic(dev);
1723                 break;
1724         case B43_DEBUGIRQ_DUMP_SHM:
1725                 if (!B43_DEBUG)
1726                         break; /* Only with driver debugging enabled. */
1727                 buf = kmalloc(4096, GFP_ATOMIC);
1728                 if (!buf) {
1729                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1730                         goto out;
1731                 }
1732                 for (i = 0; i < 4096; i += 2) {
1733                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1734                         buf[i / 2] = cpu_to_le16(tmp);
1735                 }
1736                 b43info(dev->wl, "Shared memory dump:\n");
1737                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1738                                16, 2, buf, 4096, 1);
1739                 kfree(buf);
1740                 break;
1741         case B43_DEBUGIRQ_DUMP_REGS:
1742                 if (!B43_DEBUG)
1743                         break; /* Only with driver debugging enabled. */
1744                 b43info(dev->wl, "Microcode register dump:\n");
1745                 for (i = 0, cnt = 0; i < 64; i++) {
1746                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1747                         if (cnt == 0)
1748                                 printk(KERN_INFO);
1749                         printk("r%02u: 0x%04X  ", i, tmp);
1750                         cnt++;
1751                         if (cnt == 6) {
1752                                 printk("\n");
1753                                 cnt = 0;
1754                         }
1755                 }
1756                 printk("\n");
1757                 break;
1758         case B43_DEBUGIRQ_MARKER:
1759                 if (!B43_DEBUG)
1760                         break; /* Only with driver debugging enabled. */
1761                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1762                                            B43_MARKER_ID_REG);
1763                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1764                                              B43_MARKER_LINE_REG);
1765                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1766                         "at line number %u\n",
1767                         marker_id, marker_line);
1768                 break;
1769         default:
1770                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1771                        reason);
1772         }
1773 out:
1774         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1775         b43_shm_write16(dev, B43_SHM_SCRATCH,
1776                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1777 }
1778
1779 /* Interrupt handler bottom-half */
1780 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1781 {
1782         u32 reason;
1783         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1784         u32 merged_dma_reason = 0;
1785         int i;
1786         unsigned long flags;
1787
1788         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1789
1790         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1791
1792         reason = dev->irq_reason;
1793         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1794                 dma_reason[i] = dev->dma_reason[i];
1795                 merged_dma_reason |= dma_reason[i];
1796         }
1797
1798         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1799                 b43err(dev->wl, "MAC transmission error\n");
1800
1801         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1802                 b43err(dev->wl, "PHY transmission error\n");
1803                 rmb();
1804                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1805                         atomic_set(&dev->phy.txerr_cnt,
1806                                    B43_PHY_TX_BADNESS_LIMIT);
1807                         b43err(dev->wl, "Too many PHY TX errors, "
1808                                         "restarting the controller\n");
1809                         b43_controller_restart(dev, "PHY TX errors");
1810                 }
1811         }
1812
1813         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1814                                           B43_DMAIRQ_NONFATALMASK))) {
1815                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1816                         b43err(dev->wl, "Fatal DMA error: "
1817                                "0x%08X, 0x%08X, 0x%08X, "
1818                                "0x%08X, 0x%08X, 0x%08X\n",
1819                                dma_reason[0], dma_reason[1],
1820                                dma_reason[2], dma_reason[3],
1821                                dma_reason[4], dma_reason[5]);
1822                         b43_controller_restart(dev, "DMA error");
1823                         mmiowb();
1824                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1825                         return;
1826                 }
1827                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1828                         b43err(dev->wl, "DMA error: "
1829                                "0x%08X, 0x%08X, 0x%08X, "
1830                                "0x%08X, 0x%08X, 0x%08X\n",
1831                                dma_reason[0], dma_reason[1],
1832                                dma_reason[2], dma_reason[3],
1833                                dma_reason[4], dma_reason[5]);
1834                 }
1835         }
1836
1837         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1838                 handle_irq_ucode_debug(dev);
1839         if (reason & B43_IRQ_TBTT_INDI)
1840                 handle_irq_tbtt_indication(dev);
1841         if (reason & B43_IRQ_ATIM_END)
1842                 handle_irq_atim_end(dev);
1843         if (reason & B43_IRQ_BEACON)
1844                 handle_irq_beacon(dev);
1845         if (reason & B43_IRQ_PMQ)
1846                 handle_irq_pmq(dev);
1847         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1848                 ;/* TODO */
1849         if (reason & B43_IRQ_NOISESAMPLE_OK)
1850                 handle_irq_noise(dev);
1851
1852         /* Check the DMA reason registers for received data. */
1853         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1854                 if (b43_using_pio_transfers(dev))
1855                         b43_pio_rx(dev->pio.rx_queue);
1856                 else
1857                         b43_dma_rx(dev->dma.rx_ring);
1858         }
1859         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1860         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1861         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1862         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1863         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1864
1865         if (reason & B43_IRQ_TX_OK)
1866                 handle_irq_transmit_status(dev);
1867
1868         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1869         mmiowb();
1870         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1871 }
1872
1873 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1874 {
1875         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1876
1877         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1878         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1879         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1880         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1881         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1882 /* Unused ring
1883         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1884 */
1885 }
1886
1887 /* Interrupt handler top-half */
1888 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1889 {
1890         irqreturn_t ret = IRQ_NONE;
1891         struct b43_wldev *dev = dev_id;
1892         u32 reason;
1893
1894         B43_WARN_ON(!dev);
1895
1896         spin_lock(&dev->wl->irq_lock);
1897
1898         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1899                 /* This can only happen on shared IRQ lines. */
1900                 goto out;
1901         }
1902         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1903         if (reason == 0xffffffff)       /* shared IRQ */
1904                 goto out;
1905         ret = IRQ_HANDLED;
1906         reason &= dev->irq_mask;
1907         if (!reason)
1908                 goto out;
1909
1910         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1911             & 0x0001DC00;
1912         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1913             & 0x0000DC00;
1914         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1915             & 0x0000DC00;
1916         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1917             & 0x0001DC00;
1918         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1919             & 0x0000DC00;
1920 /* Unused ring
1921         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1922             & 0x0000DC00;
1923 */
1924
1925         b43_interrupt_ack(dev, reason);
1926         /* disable all IRQs. They are enabled again in the bottom half. */
1927         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1928         /* save the reason code and call our bottom half. */
1929         dev->irq_reason = reason;
1930         tasklet_schedule(&dev->isr_tasklet);
1931 out:
1932         mmiowb();
1933         spin_unlock(&dev->wl->irq_lock);
1934
1935         return ret;
1936 }
1937
1938 void b43_do_release_fw(struct b43_firmware_file *fw)
1939 {
1940         release_firmware(fw->data);
1941         fw->data = NULL;
1942         fw->filename = NULL;
1943 }
1944
1945 static void b43_release_firmware(struct b43_wldev *dev)
1946 {
1947         b43_do_release_fw(&dev->fw.ucode);
1948         b43_do_release_fw(&dev->fw.pcm);
1949         b43_do_release_fw(&dev->fw.initvals);
1950         b43_do_release_fw(&dev->fw.initvals_band);
1951 }
1952
1953 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1954 {
1955         const char text[] =
1956                 "You must go to " \
1957                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1958                 "and download the correct firmware for this driver version. " \
1959                 "Please carefully read all instructions on this website.\n";
1960
1961         if (error)
1962                 b43err(wl, text);
1963         else
1964                 b43warn(wl, text);
1965 }
1966
1967 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1968                       const char *name,
1969                       struct b43_firmware_file *fw)
1970 {
1971         const struct firmware *blob;
1972         struct b43_fw_header *hdr;
1973         u32 size;
1974         int err;
1975
1976         if (!name) {
1977                 /* Don't fetch anything. Free possibly cached firmware. */
1978                 /* FIXME: We should probably keep it anyway, to save some headache
1979                  * on suspend/resume with multiband devices. */
1980                 b43_do_release_fw(fw);
1981                 return 0;
1982         }
1983         if (fw->filename) {
1984                 if ((fw->type == ctx->req_type) &&
1985                     (strcmp(fw->filename, name) == 0))
1986                         return 0; /* Already have this fw. */
1987                 /* Free the cached firmware first. */
1988                 /* FIXME: We should probably do this later after we successfully
1989                  * got the new fw. This could reduce headache with multiband devices.
1990                  * We could also redesign this to cache the firmware for all possible
1991                  * bands all the time. */
1992                 b43_do_release_fw(fw);
1993         }
1994
1995         switch (ctx->req_type) {
1996         case B43_FWTYPE_PROPRIETARY:
1997                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1998                          "b43%s/%s.fw",
1999                          modparam_fwpostfix, name);
2000                 break;
2001         case B43_FWTYPE_OPENSOURCE:
2002                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2003                          "b43-open%s/%s.fw",
2004                          modparam_fwpostfix, name);
2005                 break;
2006         default:
2007                 B43_WARN_ON(1);
2008                 return -ENOSYS;
2009         }
2010         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2011         if (err == -ENOENT) {
2012                 snprintf(ctx->errors[ctx->req_type],
2013                          sizeof(ctx->errors[ctx->req_type]),
2014                          "Firmware file \"%s\" not found\n", ctx->fwname);
2015                 return err;
2016         } else if (err) {
2017                 snprintf(ctx->errors[ctx->req_type],
2018                          sizeof(ctx->errors[ctx->req_type]),
2019                          "Firmware file \"%s\" request failed (err=%d)\n",
2020                          ctx->fwname, err);
2021                 return err;
2022         }
2023         if (blob->size < sizeof(struct b43_fw_header))
2024                 goto err_format;
2025         hdr = (struct b43_fw_header *)(blob->data);
2026         switch (hdr->type) {
2027         case B43_FW_TYPE_UCODE:
2028         case B43_FW_TYPE_PCM:
2029                 size = be32_to_cpu(hdr->size);
2030                 if (size != blob->size - sizeof(struct b43_fw_header))
2031                         goto err_format;
2032                 /* fallthrough */
2033         case B43_FW_TYPE_IV:
2034                 if (hdr->ver != 1)
2035                         goto err_format;
2036                 break;
2037         default:
2038                 goto err_format;
2039         }
2040
2041         fw->data = blob;
2042         fw->filename = name;
2043         fw->type = ctx->req_type;
2044
2045         return 0;
2046
2047 err_format:
2048         snprintf(ctx->errors[ctx->req_type],
2049                  sizeof(ctx->errors[ctx->req_type]),
2050                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2051         release_firmware(blob);
2052
2053         return -EPROTO;
2054 }
2055
2056 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2057 {
2058         struct b43_wldev *dev = ctx->dev;
2059         struct b43_firmware *fw = &ctx->dev->fw;
2060         const u8 rev = ctx->dev->dev->id.revision;
2061         const char *filename;
2062         u32 tmshigh;
2063         int err;
2064
2065         /* Get microcode */
2066         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2067         if ((rev >= 5) && (rev <= 10))
2068                 filename = "ucode5";
2069         else if ((rev >= 11) && (rev <= 12))
2070                 filename = "ucode11";
2071         else if (rev == 13)
2072                 filename = "ucode13";
2073         else if (rev == 14)
2074                 filename = "ucode14";
2075         else if (rev >= 15)
2076                 filename = "ucode15";
2077         else
2078                 goto err_no_ucode;
2079         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2080         if (err)
2081                 goto err_load;
2082
2083         /* Get PCM code */
2084         if ((rev >= 5) && (rev <= 10))
2085                 filename = "pcm5";
2086         else if (rev >= 11)
2087                 filename = NULL;
2088         else
2089                 goto err_no_pcm;
2090         fw->pcm_request_failed = 0;
2091         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2092         if (err == -ENOENT) {
2093                 /* We did not find a PCM file? Not fatal, but
2094                  * core rev <= 10 must do without hwcrypto then. */
2095                 fw->pcm_request_failed = 1;
2096         } else if (err)
2097                 goto err_load;
2098
2099         /* Get initvals */
2100         switch (dev->phy.type) {
2101         case B43_PHYTYPE_A:
2102                 if ((rev >= 5) && (rev <= 10)) {
2103                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2104                                 filename = "a0g1initvals5";
2105                         else
2106                                 filename = "a0g0initvals5";
2107                 } else
2108                         goto err_no_initvals;
2109                 break;
2110         case B43_PHYTYPE_G:
2111                 if ((rev >= 5) && (rev <= 10))
2112                         filename = "b0g0initvals5";
2113                 else if (rev >= 13)
2114                         filename = "b0g0initvals13";
2115                 else
2116                         goto err_no_initvals;
2117                 break;
2118         case B43_PHYTYPE_N:
2119                 if ((rev >= 11) && (rev <= 12))
2120                         filename = "n0initvals11";
2121                 else
2122                         goto err_no_initvals;
2123                 break;
2124         case B43_PHYTYPE_LP:
2125                 if (rev == 13)
2126                         filename = "lp0initvals13";
2127                 else if (rev == 14)
2128                         filename = "lp0initvals14";
2129                 else if (rev >= 15)
2130                         filename = "lp0initvals15";
2131                 else
2132                         goto err_no_initvals;
2133                 break;
2134         default:
2135                 goto err_no_initvals;
2136         }
2137         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2138         if (err)
2139                 goto err_load;
2140
2141         /* Get bandswitch initvals */
2142         switch (dev->phy.type) {
2143         case B43_PHYTYPE_A:
2144                 if ((rev >= 5) && (rev <= 10)) {
2145                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2146                                 filename = "a0g1bsinitvals5";
2147                         else
2148                                 filename = "a0g0bsinitvals5";
2149                 } else if (rev >= 11)
2150                         filename = NULL;
2151                 else
2152                         goto err_no_initvals;
2153                 break;
2154         case B43_PHYTYPE_G:
2155                 if ((rev >= 5) && (rev <= 10))
2156                         filename = "b0g0bsinitvals5";
2157                 else if (rev >= 11)
2158                         filename = NULL;
2159                 else
2160                         goto err_no_initvals;
2161                 break;
2162         case B43_PHYTYPE_N:
2163                 if ((rev >= 11) && (rev <= 12))
2164                         filename = "n0bsinitvals11";
2165                 else
2166                         goto err_no_initvals;
2167                 break;
2168         case B43_PHYTYPE_LP:
2169                 if (rev == 13)
2170                         filename = "lp0bsinitvals13";
2171                 else if (rev == 14)
2172                         filename = "lp0bsinitvals14";
2173                 else if (rev >= 15)
2174                         filename = "lp0bsinitvals15";
2175                 else
2176                         goto err_no_initvals;
2177                 break;
2178         default:
2179                 goto err_no_initvals;
2180         }
2181         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2182         if (err)
2183                 goto err_load;
2184
2185         return 0;
2186
2187 err_no_ucode:
2188         err = ctx->fatal_failure = -EOPNOTSUPP;
2189         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2190                "is required for your device (wl-core rev %u)\n", rev);
2191         goto error;
2192
2193 err_no_pcm:
2194         err = ctx->fatal_failure = -EOPNOTSUPP;
2195         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2196                "is required for your device (wl-core rev %u)\n", rev);
2197         goto error;
2198
2199 err_no_initvals:
2200         err = ctx->fatal_failure = -EOPNOTSUPP;
2201         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2202                "is required for your device (wl-core rev %u)\n", rev);
2203         goto error;
2204
2205 err_load:
2206         /* We failed to load this firmware image. The error message
2207          * already is in ctx->errors. Return and let our caller decide
2208          * what to do. */
2209         goto error;
2210
2211 error:
2212         b43_release_firmware(dev);
2213         return err;
2214 }
2215
2216 static int b43_request_firmware(struct b43_wldev *dev)
2217 {
2218         struct b43_request_fw_context *ctx;
2219         unsigned int i;
2220         int err;
2221         const char *errmsg;
2222
2223         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2224         if (!ctx)
2225                 return -ENOMEM;
2226         ctx->dev = dev;
2227
2228         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2229         err = b43_try_request_fw(ctx);
2230         if (!err)
2231                 goto out; /* Successfully loaded it. */
2232         err = ctx->fatal_failure;
2233         if (err)
2234                 goto out;
2235
2236         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2237         err = b43_try_request_fw(ctx);
2238         if (!err)
2239                 goto out; /* Successfully loaded it. */
2240         err = ctx->fatal_failure;
2241         if (err)
2242                 goto out;
2243
2244         /* Could not find a usable firmware. Print the errors. */
2245         for (i = 0; i < B43_NR_FWTYPES; i++) {
2246                 errmsg = ctx->errors[i];
2247                 if (strlen(errmsg))
2248                         b43err(dev->wl, errmsg);
2249         }
2250         b43_print_fw_helptext(dev->wl, 1);
2251         err = -ENOENT;
2252
2253 out:
2254         kfree(ctx);
2255         return err;
2256 }
2257
2258 static int b43_upload_microcode(struct b43_wldev *dev)
2259 {
2260         const size_t hdr_len = sizeof(struct b43_fw_header);
2261         const __be32 *data;
2262         unsigned int i, len;
2263         u16 fwrev, fwpatch, fwdate, fwtime;
2264         u32 tmp, macctl;
2265         int err = 0;
2266
2267         /* Jump the microcode PSM to offset 0 */
2268         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2269         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2270         macctl |= B43_MACCTL_PSM_JMP0;
2271         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2272         /* Zero out all microcode PSM registers and shared memory. */
2273         for (i = 0; i < 64; i++)
2274                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2275         for (i = 0; i < 4096; i += 2)
2276                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2277
2278         /* Upload Microcode. */
2279         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2280         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2281         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2282         for (i = 0; i < len; i++) {
2283                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2284                 udelay(10);
2285         }
2286
2287         if (dev->fw.pcm.data) {
2288                 /* Upload PCM data. */
2289                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2290                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2291                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2292                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2293                 /* No need for autoinc bit in SHM_HW */
2294                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2295                 for (i = 0; i < len; i++) {
2296                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2297                         udelay(10);
2298                 }
2299         }
2300
2301         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2302
2303         /* Start the microcode PSM */
2304         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2305         macctl &= ~B43_MACCTL_PSM_JMP0;
2306         macctl |= B43_MACCTL_PSM_RUN;
2307         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2308
2309         /* Wait for the microcode to load and respond */
2310         i = 0;
2311         while (1) {
2312                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2313                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2314                         break;
2315                 i++;
2316                 if (i >= 20) {
2317                         b43err(dev->wl, "Microcode not responding\n");
2318                         b43_print_fw_helptext(dev->wl, 1);
2319                         err = -ENODEV;
2320                         goto error;
2321                 }
2322                 msleep_interruptible(50);
2323                 if (signal_pending(current)) {
2324                         err = -EINTR;
2325                         goto error;
2326                 }
2327         }
2328         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2329
2330         /* Get and check the revisions. */
2331         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2332         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2333         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2334         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2335
2336         if (fwrev <= 0x128) {
2337                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2338                        "binary drivers older than version 4.x is unsupported. "
2339                        "You must upgrade your firmware files.\n");
2340                 b43_print_fw_helptext(dev->wl, 1);
2341                 err = -EOPNOTSUPP;
2342                 goto error;
2343         }
2344         dev->fw.rev = fwrev;
2345         dev->fw.patch = fwpatch;
2346         dev->fw.opensource = (fwdate == 0xFFFF);
2347
2348         /* Default to use-all-queues. */
2349         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2350         dev->qos_enabled = !!modparam_qos;
2351         /* Default to firmware/hardware crypto acceleration. */
2352         dev->hwcrypto_enabled = 1;
2353
2354         if (dev->fw.opensource) {
2355                 u16 fwcapa;
2356
2357                 /* Patchlevel info is encoded in the "time" field. */
2358                 dev->fw.patch = fwtime;
2359                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2360                         dev->fw.rev, dev->fw.patch);
2361
2362                 fwcapa = b43_fwcapa_read(dev);
2363                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2364                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2365                         /* Disable hardware crypto and fall back to software crypto. */
2366                         dev->hwcrypto_enabled = 0;
2367                 }
2368                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2369                         b43info(dev->wl, "QoS not supported by firmware\n");
2370                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2371                          * ieee80211_unregister to make sure the networking core can
2372                          * properly free possible resources. */
2373                         dev->wl->hw->queues = 1;
2374                         dev->qos_enabled = 0;
2375                 }
2376         } else {
2377                 b43info(dev->wl, "Loading firmware version %u.%u "
2378                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2379                         fwrev, fwpatch,
2380                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2381                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2382                 if (dev->fw.pcm_request_failed) {
2383                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2384                                 "Hardware accelerated cryptography is disabled.\n");
2385                         b43_print_fw_helptext(dev->wl, 0);
2386                 }
2387         }
2388
2389         if (b43_is_old_txhdr_format(dev)) {
2390                 /* We're over the deadline, but we keep support for old fw
2391                  * until it turns out to be in major conflict with something new. */
2392                 b43warn(dev->wl, "You are using an old firmware image. "
2393                         "Support for old firmware will be removed soon "
2394                         "(official deadline was July 2008).\n");
2395                 b43_print_fw_helptext(dev->wl, 0);
2396         }
2397
2398         return 0;
2399
2400 error:
2401         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2402         macctl &= ~B43_MACCTL_PSM_RUN;
2403         macctl |= B43_MACCTL_PSM_JMP0;
2404         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2405
2406         return err;
2407 }
2408
2409 static int b43_write_initvals(struct b43_wldev *dev,
2410                               const struct b43_iv *ivals,
2411                               size_t count,
2412                               size_t array_size)
2413 {
2414         const struct b43_iv *iv;
2415         u16 offset;
2416         size_t i;
2417         bool bit32;
2418
2419         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2420         iv = ivals;
2421         for (i = 0; i < count; i++) {
2422                 if (array_size < sizeof(iv->offset_size))
2423                         goto err_format;
2424                 array_size -= sizeof(iv->offset_size);
2425                 offset = be16_to_cpu(iv->offset_size);
2426                 bit32 = !!(offset & B43_IV_32BIT);
2427                 offset &= B43_IV_OFFSET_MASK;
2428                 if (offset >= 0x1000)
2429                         goto err_format;
2430                 if (bit32) {
2431                         u32 value;
2432
2433                         if (array_size < sizeof(iv->data.d32))
2434                                 goto err_format;
2435                         array_size -= sizeof(iv->data.d32);
2436
2437                         value = get_unaligned_be32(&iv->data.d32);
2438                         b43_write32(dev, offset, value);
2439
2440                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2441                                                         sizeof(__be16) +
2442                                                         sizeof(__be32));
2443                 } else {
2444                         u16 value;
2445
2446                         if (array_size < sizeof(iv->data.d16))
2447                                 goto err_format;
2448                         array_size -= sizeof(iv->data.d16);
2449
2450                         value = be16_to_cpu(iv->data.d16);
2451                         b43_write16(dev, offset, value);
2452
2453                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2454                                                         sizeof(__be16) +
2455                                                         sizeof(__be16));
2456                 }
2457         }
2458         if (array_size)
2459                 goto err_format;
2460
2461         return 0;
2462
2463 err_format:
2464         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2465         b43_print_fw_helptext(dev->wl, 1);
2466
2467         return -EPROTO;
2468 }
2469
2470 static int b43_upload_initvals(struct b43_wldev *dev)
2471 {
2472         const size_t hdr_len = sizeof(struct b43_fw_header);
2473         const struct b43_fw_header *hdr;
2474         struct b43_firmware *fw = &dev->fw;
2475         const struct b43_iv *ivals;
2476         size_t count;
2477         int err;
2478
2479         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2480         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2481         count = be32_to_cpu(hdr->size);
2482         err = b43_write_initvals(dev, ivals, count,
2483                                  fw->initvals.data->size - hdr_len);
2484         if (err)
2485                 goto out;
2486         if (fw->initvals_band.data) {
2487                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2488                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2489                 count = be32_to_cpu(hdr->size);
2490                 err = b43_write_initvals(dev, ivals, count,
2491                                          fw->initvals_band.data->size - hdr_len);
2492                 if (err)
2493                         goto out;
2494         }
2495 out:
2496
2497         return err;
2498 }
2499
2500 /* Initialize the GPIOs
2501  * http://bcm-specs.sipsolutions.net/GPIO
2502  */
2503 static int b43_gpio_init(struct b43_wldev *dev)
2504 {
2505         struct ssb_bus *bus = dev->dev->bus;
2506         struct ssb_device *gpiodev, *pcidev = NULL;
2507         u32 mask, set;
2508
2509         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2510                     & ~B43_MACCTL_GPOUTSMSK);
2511
2512         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2513                     | 0x000F);
2514
2515         mask = 0x0000001F;
2516         set = 0x0000000F;
2517         if (dev->dev->bus->chip_id == 0x4301) {
2518                 mask |= 0x0060;
2519                 set |= 0x0060;
2520         }
2521         if (0 /* FIXME: conditional unknown */ ) {
2522                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2523                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2524                             | 0x0100);
2525                 mask |= 0x0180;
2526                 set |= 0x0180;
2527         }
2528         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2529                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2530                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2531                             | 0x0200);
2532                 mask |= 0x0200;
2533                 set |= 0x0200;
2534         }
2535         if (dev->dev->id.revision >= 2)
2536                 mask |= 0x0010; /* FIXME: This is redundant. */
2537
2538 #ifdef CONFIG_SSB_DRIVER_PCICORE
2539         pcidev = bus->pcicore.dev;
2540 #endif
2541         gpiodev = bus->chipco.dev ? : pcidev;
2542         if (!gpiodev)
2543                 return 0;
2544         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2545                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2546                      & mask) | set);
2547
2548         return 0;
2549 }
2550
2551 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2552 static void b43_gpio_cleanup(struct b43_wldev *dev)
2553 {
2554         struct ssb_bus *bus = dev->dev->bus;
2555         struct ssb_device *gpiodev, *pcidev = NULL;
2556
2557 #ifdef CONFIG_SSB_DRIVER_PCICORE
2558         pcidev = bus->pcicore.dev;
2559 #endif
2560         gpiodev = bus->chipco.dev ? : pcidev;
2561         if (!gpiodev)
2562                 return;
2563         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2564 }
2565
2566 /* http://bcm-specs.sipsolutions.net/EnableMac */
2567 void b43_mac_enable(struct b43_wldev *dev)
2568 {
2569         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2570                 u16 fwstate;
2571
2572                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2573                                          B43_SHM_SH_UCODESTAT);
2574                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2575                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2576                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2577                                "should be suspended, but current state is %u\n",
2578                                fwstate);
2579                 }
2580         }
2581
2582         dev->mac_suspended--;
2583         B43_WARN_ON(dev->mac_suspended < 0);
2584         if (dev->mac_suspended == 0) {
2585                 b43_write32(dev, B43_MMIO_MACCTL,
2586                             b43_read32(dev, B43_MMIO_MACCTL)
2587                             | B43_MACCTL_ENABLED);
2588                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2589                             B43_IRQ_MAC_SUSPENDED);
2590                 /* Commit writes */
2591                 b43_read32(dev, B43_MMIO_MACCTL);
2592                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2593                 b43_power_saving_ctl_bits(dev, 0);
2594         }
2595 }
2596
2597 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2598 void b43_mac_suspend(struct b43_wldev *dev)
2599 {
2600         int i;
2601         u32 tmp;
2602
2603         might_sleep();
2604         B43_WARN_ON(dev->mac_suspended < 0);
2605
2606         if (dev->mac_suspended == 0) {
2607                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2608                 b43_write32(dev, B43_MMIO_MACCTL,
2609                             b43_read32(dev, B43_MMIO_MACCTL)
2610                             & ~B43_MACCTL_ENABLED);
2611                 /* force pci to flush the write */
2612                 b43_read32(dev, B43_MMIO_MACCTL);
2613                 for (i = 35; i; i--) {
2614                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2615                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2616                                 goto out;
2617                         udelay(10);
2618                 }
2619                 /* Hm, it seems this will take some time. Use msleep(). */
2620                 for (i = 40; i; i--) {
2621                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2622                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2623                                 goto out;
2624                         msleep(1);
2625                 }
2626                 b43err(dev->wl, "MAC suspend failed\n");
2627         }
2628 out:
2629         dev->mac_suspended++;
2630 }
2631
2632 static void b43_adjust_opmode(struct b43_wldev *dev)
2633 {
2634         struct b43_wl *wl = dev->wl;
2635         u32 ctl;
2636         u16 cfp_pretbtt;
2637
2638         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2639         /* Reset status to STA infrastructure mode. */
2640         ctl &= ~B43_MACCTL_AP;
2641         ctl &= ~B43_MACCTL_KEEP_CTL;
2642         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2643         ctl &= ~B43_MACCTL_KEEP_BAD;
2644         ctl &= ~B43_MACCTL_PROMISC;
2645         ctl &= ~B43_MACCTL_BEACPROMISC;
2646         ctl |= B43_MACCTL_INFRA;
2647
2648         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2649             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2650                 ctl |= B43_MACCTL_AP;
2651         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2652                 ctl &= ~B43_MACCTL_INFRA;
2653
2654         if (wl->filter_flags & FIF_CONTROL)
2655                 ctl |= B43_MACCTL_KEEP_CTL;
2656         if (wl->filter_flags & FIF_FCSFAIL)
2657                 ctl |= B43_MACCTL_KEEP_BAD;
2658         if (wl->filter_flags & FIF_PLCPFAIL)
2659                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2660         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2661                 ctl |= B43_MACCTL_PROMISC;
2662         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2663                 ctl |= B43_MACCTL_BEACPROMISC;
2664
2665         /* Workaround: On old hardware the HW-MAC-address-filter
2666          * doesn't work properly, so always run promisc in filter
2667          * it in software. */
2668         if (dev->dev->id.revision <= 4)
2669                 ctl |= B43_MACCTL_PROMISC;
2670
2671         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2672
2673         cfp_pretbtt = 2;
2674         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2675                 if (dev->dev->bus->chip_id == 0x4306 &&
2676                     dev->dev->bus->chip_rev == 3)
2677                         cfp_pretbtt = 100;
2678                 else
2679                         cfp_pretbtt = 50;
2680         }
2681         b43_write16(dev, 0x612, cfp_pretbtt);
2682 }
2683
2684 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2685 {
2686         u16 offset;
2687
2688         if (is_ofdm) {
2689                 offset = 0x480;
2690                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2691         } else {
2692                 offset = 0x4C0;
2693                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2694         }
2695         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2696                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2697 }
2698
2699 static void b43_rate_memory_init(struct b43_wldev *dev)
2700 {
2701         switch (dev->phy.type) {
2702         case B43_PHYTYPE_A:
2703         case B43_PHYTYPE_G:
2704         case B43_PHYTYPE_N:
2705         case B43_PHYTYPE_LP:
2706                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2707                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2708                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2709                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2710                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2711                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2712                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2713                 if (dev->phy.type == B43_PHYTYPE_A)
2714                         break;
2715                 /* fallthrough */
2716         case B43_PHYTYPE_B:
2717                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2718                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2719                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2720                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2721                 break;
2722         default:
2723                 B43_WARN_ON(1);
2724         }
2725 }
2726
2727 /* Set the default values for the PHY TX Control Words. */
2728 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2729 {
2730         u16 ctl = 0;
2731
2732         ctl |= B43_TXH_PHY_ENC_CCK;
2733         ctl |= B43_TXH_PHY_ANT01AUTO;
2734         ctl |= B43_TXH_PHY_TXPWR;
2735
2736         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2737         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2738         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2739 }
2740
2741 /* Set the TX-Antenna for management frames sent by firmware. */
2742 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2743 {
2744         u16 ant;
2745         u16 tmp;
2746
2747         ant = b43_antenna_to_phyctl(antenna);
2748
2749         /* For ACK/CTS */
2750         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2751         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2752         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2753         /* For Probe Resposes */
2754         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2755         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2756         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2757 }
2758
2759 /* This is the opposite of b43_chip_init() */
2760 static void b43_chip_exit(struct b43_wldev *dev)
2761 {
2762         b43_phy_exit(dev);
2763         b43_gpio_cleanup(dev);
2764         /* firmware is released later */
2765 }
2766
2767 /* Initialize the chip
2768  * http://bcm-specs.sipsolutions.net/ChipInit
2769  */
2770 static int b43_chip_init(struct b43_wldev *dev)
2771 {
2772         struct b43_phy *phy = &dev->phy;
2773         int err;
2774         u32 value32, macctl;
2775         u16 value16;
2776
2777         /* Initialize the MAC control */
2778         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2779         if (dev->phy.gmode)
2780                 macctl |= B43_MACCTL_GMODE;
2781         macctl |= B43_MACCTL_INFRA;
2782         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2783
2784         err = b43_request_firmware(dev);
2785         if (err)
2786                 goto out;
2787         err = b43_upload_microcode(dev);
2788         if (err)
2789                 goto out;       /* firmware is released later */
2790
2791         err = b43_gpio_init(dev);
2792         if (err)
2793                 goto out;       /* firmware is released later */
2794
2795         err = b43_upload_initvals(dev);
2796         if (err)
2797                 goto err_gpio_clean;
2798
2799         /* Turn the Analog on and initialize the PHY. */
2800         phy->ops->switch_analog(dev, 1);
2801         err = b43_phy_init(dev);
2802         if (err)
2803                 goto err_gpio_clean;
2804
2805         /* Disable Interference Mitigation. */
2806         if (phy->ops->interf_mitigation)
2807                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2808
2809         /* Select the antennae */
2810         if (phy->ops->set_rx_antenna)
2811                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2812         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2813
2814         if (phy->type == B43_PHYTYPE_B) {
2815                 value16 = b43_read16(dev, 0x005E);
2816                 value16 |= 0x0004;
2817                 b43_write16(dev, 0x005E, value16);
2818         }
2819         b43_write32(dev, 0x0100, 0x01000000);
2820         if (dev->dev->id.revision < 5)
2821                 b43_write32(dev, 0x010C, 0x01000000);
2822
2823         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2824                     & ~B43_MACCTL_INFRA);
2825         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2826                     | B43_MACCTL_INFRA);
2827
2828         /* Probe Response Timeout value */
2829         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2830         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2831
2832         /* Initially set the wireless operation mode. */
2833         b43_adjust_opmode(dev);
2834
2835         if (dev->dev->id.revision < 3) {
2836                 b43_write16(dev, 0x060E, 0x0000);
2837                 b43_write16(dev, 0x0610, 0x8000);
2838                 b43_write16(dev, 0x0604, 0x0000);
2839                 b43_write16(dev, 0x0606, 0x0200);
2840         } else {
2841                 b43_write32(dev, 0x0188, 0x80000000);
2842                 b43_write32(dev, 0x018C, 0x02000000);
2843         }
2844         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2845         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2846         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2847         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2848         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2849         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2850         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2851
2852         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2853         value32 |= 0x00100000;
2854         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2855
2856         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2857                     dev->dev->bus->chipco.fast_pwrup_delay);
2858
2859         err = 0;
2860         b43dbg(dev->wl, "Chip initialized\n");
2861 out:
2862         return err;
2863
2864 err_gpio_clean:
2865         b43_gpio_cleanup(dev);
2866         return err;
2867 }
2868
2869 static void b43_periodic_every60sec(struct b43_wldev *dev)
2870 {
2871         const struct b43_phy_operations *ops = dev->phy.ops;
2872
2873         if (ops->pwork_60sec)
2874                 ops->pwork_60sec(dev);
2875
2876         /* Force check the TX power emission now. */
2877         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2878 }
2879
2880 static void b43_periodic_every30sec(struct b43_wldev *dev)
2881 {
2882         /* Update device statistics. */
2883         b43_calculate_link_quality(dev);
2884 }
2885
2886 static void b43_periodic_every15sec(struct b43_wldev *dev)
2887 {
2888         struct b43_phy *phy = &dev->phy;
2889         u16 wdr;
2890
2891         if (dev->fw.opensource) {
2892                 /* Check if the firmware is still alive.
2893                  * It will reset the watchdog counter to 0 in its idle loop. */
2894                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2895                 if (unlikely(wdr)) {
2896                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2897                         b43_controller_restart(dev, "Firmware watchdog");
2898                         return;
2899                 } else {
2900                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2901                                         B43_WATCHDOG_REG, 1);
2902                 }
2903         }
2904
2905         if (phy->ops->pwork_15sec)
2906                 phy->ops->pwork_15sec(dev);
2907
2908         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2909         wmb();
2910 }
2911
2912 static void do_periodic_work(struct b43_wldev *dev)
2913 {
2914         unsigned int state;
2915
2916         state = dev->periodic_state;
2917         if (state % 4 == 0)
2918                 b43_periodic_every60sec(dev);
2919         if (state % 2 == 0)
2920                 b43_periodic_every30sec(dev);
2921         b43_periodic_every15sec(dev);
2922 }
2923
2924 /* Periodic work locking policy:
2925  *      The whole periodic work handler is protected by
2926  *      wl->mutex. If another lock is needed somewhere in the
2927  *      pwork callchain, it's aquired in-place, where it's needed.
2928  */
2929 static void b43_periodic_work_handler(struct work_struct *work)
2930 {
2931         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2932                                              periodic_work.work);
2933         struct b43_wl *wl = dev->wl;
2934         unsigned long delay;
2935
2936         mutex_lock(&wl->mutex);
2937
2938         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2939                 goto out;
2940         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2941                 goto out_requeue;
2942
2943         do_periodic_work(dev);
2944
2945         dev->periodic_state++;
2946 out_requeue:
2947         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2948                 delay = msecs_to_jiffies(50);
2949         else
2950                 delay = round_jiffies_relative(HZ * 15);
2951         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2952 out:
2953         mutex_unlock(&wl->mutex);
2954 }
2955
2956 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2957 {
2958         struct delayed_work *work = &dev->periodic_work;
2959
2960         dev->periodic_state = 0;
2961         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2962         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2963 }
2964
2965 /* Check if communication with the device works correctly. */
2966 static int b43_validate_chipaccess(struct b43_wldev *dev)
2967 {
2968         u32 v, backup0, backup4;
2969
2970         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2971         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2972
2973         /* Check for read/write and endianness problems. */
2974         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2975         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2976                 goto error;
2977         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2978         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2979                 goto error;
2980
2981         /* Check if unaligned 32bit SHM_SHARED access works properly.
2982          * However, don't bail out on failure, because it's noncritical. */
2983         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
2984         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
2985         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
2986         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
2987         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
2988                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
2989         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
2990         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
2991             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
2992             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
2993             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
2994                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
2995
2996         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
2997         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
2998
2999         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
3000                 /* The 32bit register shadows the two 16bit registers
3001                  * with update sideeffects. Validate this. */
3002                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3003                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3004                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3005                         goto error;
3006                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3007                         goto error;
3008         }
3009         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3010
3011         v = b43_read32(dev, B43_MMIO_MACCTL);
3012         v |= B43_MACCTL_GMODE;
3013         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3014                 goto error;
3015
3016         return 0;
3017 error:
3018         b43err(dev->wl, "Failed to validate the chipaccess\n");
3019         return -ENODEV;
3020 }
3021
3022 static void b43_security_init(struct b43_wldev *dev)
3023 {
3024         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3025         /* KTP is a word address, but we address SHM bytewise.
3026          * So multiply by two.
3027          */
3028         dev->ktp *= 2;
3029         /* Number of RCMTA address slots */
3030         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3031         /* Clear the key memory. */
3032         b43_clear_keys(dev);
3033 }
3034
3035 #ifdef CONFIG_B43_HWRNG
3036 static int b43_rng_read(struct hwrng *rng, u32 *data)
3037 {
3038         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3039         unsigned long flags;
3040
3041         /* Don't take wl->mutex here, as it could deadlock with
3042          * hwrng internal locking. It's not needed to take
3043          * wl->mutex here, anyway. */
3044
3045         spin_lock_irqsave(&wl->irq_lock, flags);
3046         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
3047         spin_unlock_irqrestore(&wl->irq_lock, flags);
3048
3049         return (sizeof(u16));
3050 }
3051 #endif /* CONFIG_B43_HWRNG */
3052
3053 static void b43_rng_exit(struct b43_wl *wl)
3054 {
3055 #ifdef CONFIG_B43_HWRNG
3056         if (wl->rng_initialized)
3057                 hwrng_unregister(&wl->rng);
3058 #endif /* CONFIG_B43_HWRNG */
3059 }
3060
3061 static int b43_rng_init(struct b43_wl *wl)
3062 {
3063         int err = 0;
3064
3065 #ifdef CONFIG_B43_HWRNG
3066         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3067                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3068         wl->rng.name = wl->rng_name;
3069         wl->rng.data_read = b43_rng_read;
3070         wl->rng.priv = (unsigned long)wl;
3071         wl->rng_initialized = 1;
3072         err = hwrng_register(&wl->rng);
3073         if (err) {
3074                 wl->rng_initialized = 0;
3075                 b43err(wl, "Failed to register the random "
3076                        "number generator (%d)\n", err);
3077         }
3078 #endif /* CONFIG_B43_HWRNG */
3079
3080         return err;
3081 }
3082
3083 static int b43_op_tx(struct ieee80211_hw *hw,
3084                      struct sk_buff *skb)
3085 {
3086         struct b43_wl *wl = hw_to_b43_wl(hw);
3087         struct b43_wldev *dev = wl->current_dev;
3088         unsigned long flags;
3089         int err;
3090
3091         if (unlikely(skb->len < 2 + 2 + 6)) {
3092                 /* Too short, this can't be a valid frame. */
3093                 goto drop_packet;
3094         }
3095         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3096         if (unlikely(!dev))
3097                 goto drop_packet;
3098
3099         /* Transmissions on seperate queues can run concurrently. */
3100         read_lock_irqsave(&wl->tx_lock, flags);
3101
3102         err = -ENODEV;
3103         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3104                 if (b43_using_pio_transfers(dev))
3105                         err = b43_pio_tx(dev, skb);
3106                 else
3107                         err = b43_dma_tx(dev, skb);
3108         }
3109
3110         read_unlock_irqrestore(&wl->tx_lock, flags);
3111
3112         if (unlikely(err))
3113                 goto drop_packet;
3114         return NETDEV_TX_OK;
3115
3116 drop_packet:
3117         /* We can not transmit this packet. Drop it. */
3118         dev_kfree_skb_any(skb);
3119         return NETDEV_TX_OK;
3120 }
3121
3122 /* Locking: wl->irq_lock */
3123 static void b43_qos_params_upload(struct b43_wldev *dev,
3124                                   const struct ieee80211_tx_queue_params *p,
3125                                   u16 shm_offset)
3126 {
3127         u16 params[B43_NR_QOSPARAMS];
3128         int bslots, tmp;
3129         unsigned int i;
3130
3131         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3132
3133         memset(&params, 0, sizeof(params));
3134
3135         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3136         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3137         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3138         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3139         params[B43_QOSPARAM_AIFS] = p->aifs;
3140         params[B43_QOSPARAM_BSLOTS] = bslots;
3141         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3142
3143         for (i = 0; i < ARRAY_SIZE(params); i++) {
3144                 if (i == B43_QOSPARAM_STATUS) {
3145                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3146                                              shm_offset + (i * 2));
3147                         /* Mark the parameters as updated. */
3148                         tmp |= 0x100;
3149                         b43_shm_write16(dev, B43_SHM_SHARED,
3150                                         shm_offset + (i * 2),
3151                                         tmp);
3152                 } else {
3153                         b43_shm_write16(dev, B43_SHM_SHARED,
3154                                         shm_offset + (i * 2),
3155                                         params[i]);
3156                 }
3157         }
3158 }
3159
3160 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3161 static const u16 b43_qos_shm_offsets[] = {
3162         /* [mac80211-queue-nr] = SHM_OFFSET, */
3163         [0] = B43_QOS_VOICE,
3164         [1] = B43_QOS_VIDEO,
3165         [2] = B43_QOS_BESTEFFORT,
3166         [3] = B43_QOS_BACKGROUND,
3167 };
3168
3169 /* Update all QOS parameters in hardware. */
3170 static void b43_qos_upload_all(struct b43_wldev *dev)
3171 {
3172         struct b43_wl *wl = dev->wl;
3173         struct b43_qos_params *params;
3174         unsigned int i;
3175
3176         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3177                      ARRAY_SIZE(wl->qos_params));
3178
3179         b43_mac_suspend(dev);
3180         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3181                 params = &(wl->qos_params[i]);
3182                 b43_qos_params_upload(dev, &(params->p),
3183                                       b43_qos_shm_offsets[i]);
3184         }
3185         b43_mac_enable(dev);
3186 }
3187
3188 static void b43_qos_clear(struct b43_wl *wl)
3189 {
3190         struct b43_qos_params *params;
3191         unsigned int i;
3192
3193         /* Initialize QoS parameters to sane defaults. */
3194
3195         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3196                      ARRAY_SIZE(wl->qos_params));
3197
3198         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3199                 params = &(wl->qos_params[i]);
3200
3201                 switch (b43_qos_shm_offsets[i]) {
3202                 case B43_QOS_VOICE:
3203                         params->p.txop = 0;
3204                         params->p.aifs = 2;
3205                         params->p.cw_min = 0x0001;
3206                         params->p.cw_max = 0x0001;
3207                         break;
3208                 case B43_QOS_VIDEO:
3209                         params->p.txop = 0;
3210                         params->p.aifs = 2;
3211                         params->p.cw_min = 0x0001;
3212                         params->p.cw_max = 0x0001;
3213                         break;
3214                 case B43_QOS_BESTEFFORT:
3215                         params->p.txop = 0;
3216                         params->p.aifs = 3;
3217                         params->p.cw_min = 0x0001;
3218                         params->p.cw_max = 0x03FF;
3219                         break;
3220                 case B43_QOS_BACKGROUND:
3221                         params->p.txop = 0;
3222                         params->p.aifs = 7;
3223                         params->p.cw_min = 0x0001;
3224                         params->p.cw_max = 0x03FF;
3225                         break;
3226                 default:
3227                         B43_WARN_ON(1);
3228                 }
3229         }
3230 }
3231
3232 /* Initialize the core's QOS capabilities */
3233 static void b43_qos_init(struct b43_wldev *dev)
3234 {
3235         /* Upload the current QOS parameters. */
3236         b43_qos_upload_all(dev);
3237
3238         /* Enable QOS support. */
3239         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3240         b43_write16(dev, B43_MMIO_IFSCTL,
3241                     b43_read16(dev, B43_MMIO_IFSCTL)
3242                     | B43_MMIO_IFSCTL_USE_EDCF);
3243 }
3244
3245 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3246                           const struct ieee80211_tx_queue_params *params)
3247 {
3248         struct b43_wl *wl = hw_to_b43_wl(hw);
3249         struct b43_wldev *dev;
3250         unsigned int queue = (unsigned int)_queue;
3251         int err = -ENODEV;
3252
3253         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3254                 /* Queue not available or don't support setting
3255                  * params on this queue. Return success to not
3256                  * confuse mac80211. */
3257                 return 0;
3258         }
3259         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3260                      ARRAY_SIZE(wl->qos_params));
3261
3262         mutex_lock(&wl->mutex);
3263         dev = wl->current_dev;
3264         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3265                 goto out_unlock;
3266
3267         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3268         b43_mac_suspend(dev);
3269         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3270                               b43_qos_shm_offsets[queue]);
3271         b43_mac_enable(dev);
3272         err = 0;
3273
3274 out_unlock:
3275         mutex_unlock(&wl->mutex);
3276
3277         return err;
3278 }
3279
3280 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3281                                struct ieee80211_tx_queue_stats *stats)
3282 {
3283         struct b43_wl *wl = hw_to_b43_wl(hw);
3284         struct b43_wldev *dev = wl->current_dev;
3285         unsigned long flags;
3286         int err = -ENODEV;
3287
3288         if (!dev)
3289                 goto out;
3290         spin_lock_irqsave(&wl->irq_lock, flags);
3291         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3292                 if (b43_using_pio_transfers(dev))
3293                         b43_pio_get_tx_stats(dev, stats);
3294                 else
3295                         b43_dma_get_tx_stats(dev, stats);
3296                 err = 0;
3297         }
3298         spin_unlock_irqrestore(&wl->irq_lock, flags);
3299 out:
3300         return err;
3301 }
3302
3303 static int b43_op_get_stats(struct ieee80211_hw *hw,
3304                             struct ieee80211_low_level_stats *stats)
3305 {
3306         struct b43_wl *wl = hw_to_b43_wl(hw);
3307         unsigned long flags;
3308
3309         spin_lock_irqsave(&wl->irq_lock, flags);
3310         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3311         spin_unlock_irqrestore(&wl->irq_lock, flags);
3312
3313         return 0;
3314 }
3315
3316 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3317 {
3318         struct b43_wl *wl = hw_to_b43_wl(hw);
3319         struct b43_wldev *dev;
3320         u64 tsf;
3321
3322         mutex_lock(&wl->mutex);
3323         spin_lock_irq(&wl->irq_lock);
3324         dev = wl->current_dev;
3325
3326         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3327                 b43_tsf_read(dev, &tsf);
3328         else
3329                 tsf = 0;
3330
3331         spin_unlock_irq(&wl->irq_lock);
3332         mutex_unlock(&wl->mutex);
3333
3334         return tsf;
3335 }
3336
3337 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3338 {
3339         struct b43_wl *wl = hw_to_b43_wl(hw);
3340         struct b43_wldev *dev;
3341
3342         mutex_lock(&wl->mutex);
3343         spin_lock_irq(&wl->irq_lock);
3344         dev = wl->current_dev;
3345
3346         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3347                 b43_tsf_write(dev, tsf);
3348
3349         spin_unlock_irq(&wl->irq_lock);
3350         mutex_unlock(&wl->mutex);
3351 }
3352
3353 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3354 {
3355         struct ssb_device *sdev = dev->dev;
3356         u32 tmslow;
3357
3358         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3359         tmslow &= ~B43_TMSLOW_GMODE;
3360         tmslow |= B43_TMSLOW_PHYRESET;
3361         tmslow |= SSB_TMSLOW_FGC;
3362         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3363         msleep(1);
3364
3365         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3366         tmslow &= ~SSB_TMSLOW_FGC;
3367         tmslow |= B43_TMSLOW_PHYRESET;
3368         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3369         msleep(1);
3370 }
3371
3372 static const char *band_to_string(enum ieee80211_band band)
3373 {
3374         switch (band) {
3375         case IEEE80211_BAND_5GHZ:
3376                 return "5";
3377         case IEEE80211_BAND_2GHZ:
3378                 return "2.4";
3379         default:
3380                 break;
3381         }
3382         B43_WARN_ON(1);
3383         return "";
3384 }
3385
3386 /* Expects wl->mutex locked */
3387 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3388 {
3389         struct b43_wldev *up_dev = NULL;
3390         struct b43_wldev *down_dev;
3391         struct b43_wldev *d;
3392         int err;
3393         bool uninitialized_var(gmode);
3394         int prev_status;
3395
3396         /* Find a device and PHY which supports the band. */
3397         list_for_each_entry(d, &wl->devlist, list) {
3398                 switch (chan->band) {
3399                 case IEEE80211_BAND_5GHZ:
3400                         if (d->phy.supports_5ghz) {
3401                                 up_dev = d;
3402                                 gmode = 0;
3403                         }
3404                         break;
3405                 case IEEE80211_BAND_2GHZ:
3406                         if (d->phy.supports_2ghz) {
3407                                 up_dev = d;
3408                                 gmode = 1;
3409                         }
3410                         break;
3411                 default:
3412                         B43_WARN_ON(1);
3413                         return -EINVAL;
3414                 }
3415                 if (up_dev)
3416                         break;
3417         }
3418         if (!up_dev) {
3419                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3420                        band_to_string(chan->band));
3421                 return -ENODEV;
3422         }
3423         if ((up_dev == wl->current_dev) &&
3424             (!!wl->current_dev->phy.gmode == !!gmode)) {
3425                 /* This device is already running. */
3426                 return 0;
3427         }
3428         b43dbg(wl, "Switching to %s-GHz band\n",
3429                band_to_string(chan->band));
3430         down_dev = wl->current_dev;
3431
3432         prev_status = b43_status(down_dev);
3433         /* Shutdown the currently running core. */
3434         if (prev_status >= B43_STAT_STARTED)
3435                 b43_wireless_core_stop(down_dev);
3436         if (prev_status >= B43_STAT_INITIALIZED)
3437                 b43_wireless_core_exit(down_dev);
3438
3439         if (down_dev != up_dev) {
3440                 /* We switch to a different core, so we put PHY into
3441                  * RESET on the old core. */
3442                 b43_put_phy_into_reset(down_dev);
3443         }
3444
3445         /* Now start the new core. */
3446         up_dev->phy.gmode = gmode;
3447         if (prev_status >= B43_STAT_INITIALIZED) {
3448                 err = b43_wireless_core_init(up_dev);
3449                 if (err) {
3450                         b43err(wl, "Fatal: Could not initialize device for "
3451                                "selected %s-GHz band\n",
3452                                band_to_string(chan->band));
3453                         goto init_failure;
3454                 }
3455         }
3456         if (prev_status >= B43_STAT_STARTED) {
3457                 err = b43_wireless_core_start(up_dev);
3458                 if (err) {
3459                         b43err(wl, "Fatal: Coult not start device for "
3460                                "selected %s-GHz band\n",
3461                                band_to_string(chan->band));
3462                         b43_wireless_core_exit(up_dev);
3463                         goto init_failure;
3464                 }
3465         }
3466         B43_WARN_ON(b43_status(up_dev) != prev_status);
3467
3468         wl->current_dev = up_dev;
3469
3470         return 0;
3471 init_failure:
3472         /* Whoops, failed to init the new core. No core is operating now. */
3473         wl->current_dev = NULL;
3474         return err;
3475 }
3476
3477 /* Write the short and long frame retry limit values. */
3478 static void b43_set_retry_limits(struct b43_wldev *dev,
3479                                  unsigned int short_retry,
3480                                  unsigned int long_retry)
3481 {
3482         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3483          * the chip-internal counter. */
3484         short_retry = min(short_retry, (unsigned int)0xF);
3485         long_retry = min(long_retry, (unsigned int)0xF);
3486
3487         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3488                         short_retry);
3489         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3490                         long_retry);
3491 }
3492
3493 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3494 {
3495         struct b43_wl *wl = hw_to_b43_wl(hw);
3496         struct b43_wldev *dev;
3497         struct b43_phy *phy;
3498         struct ieee80211_conf *conf = &hw->conf;
3499         unsigned long flags;
3500         int antenna;
3501         int err = 0;
3502
3503         mutex_lock(&wl->mutex);
3504
3505         /* Switch the band (if necessary). This might change the active core. */
3506         err = b43_switch_band(wl, conf->channel);
3507         if (err)
3508                 goto out_unlock_mutex;
3509         dev = wl->current_dev;
3510         phy = &dev->phy;
3511
3512         b43_mac_suspend(dev);
3513
3514         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3515                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3516                                           conf->long_frame_max_tx_count);
3517         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3518         if (!changed)
3519                 goto out_mac_enable;
3520
3521         /* Switch to the requested channel.
3522          * The firmware takes care of races with the TX handler. */
3523         if (conf->channel->hw_value != phy->channel)
3524                 b43_switch_channel(dev, conf->channel->hw_value);
3525
3526         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3527
3528         /* Adjust the desired TX power level. */
3529         if (conf->power_level != 0) {
3530                 spin_lock_irqsave(&wl->irq_lock, flags);
3531                 if (conf->power_level != phy->desired_txpower) {
3532                         phy->desired_txpower = conf->power_level;
3533                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3534                                                    B43_TXPWR_IGNORE_TSSI);
3535                 }
3536                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3537         }
3538
3539         /* Antennas for RX and management frame TX. */
3540         antenna = B43_ANTENNA_DEFAULT;
3541         b43_mgmtframe_txantenna(dev, antenna);
3542         antenna = B43_ANTENNA_DEFAULT;
3543         if (phy->ops->set_rx_antenna)
3544                 phy->ops->set_rx_antenna(dev, antenna);
3545
3546         if (wl->radio_enabled != phy->radio_on) {
3547                 if (wl->radio_enabled) {
3548                         b43_software_rfkill(dev, false);
3549                         b43info(dev->wl, "Radio turned on by software\n");
3550                         if (!dev->radio_hw_enable) {
3551                                 b43info(dev->wl, "The hardware RF-kill button "
3552                                         "still turns the radio physically off. "
3553                                         "Press the button to turn it on.\n");
3554                         }
3555                 } else {
3556                         b43_software_rfkill(dev, true);
3557                         b43info(dev->wl, "Radio turned off by software\n");
3558                 }
3559         }
3560
3561 out_mac_enable:
3562         b43_mac_enable(dev);
3563 out_unlock_mutex:
3564         mutex_unlock(&wl->mutex);
3565
3566         return err;
3567 }
3568
3569 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3570 {
3571         struct ieee80211_supported_band *sband =
3572                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3573         struct ieee80211_rate *rate;
3574         int i;
3575         u16 basic, direct, offset, basic_offset, rateptr;
3576
3577         for (i = 0; i < sband->n_bitrates; i++) {
3578                 rate = &sband->bitrates[i];
3579
3580                 if (b43_is_cck_rate(rate->hw_value)) {
3581                         direct = B43_SHM_SH_CCKDIRECT;
3582                         basic = B43_SHM_SH_CCKBASIC;
3583                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3584                         offset &= 0xF;
3585                 } else {
3586                         direct = B43_SHM_SH_OFDMDIRECT;
3587                         basic = B43_SHM_SH_OFDMBASIC;
3588                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3589                         offset &= 0xF;
3590                 }
3591
3592                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3593
3594                 if (b43_is_cck_rate(rate->hw_value)) {
3595                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3596                         basic_offset &= 0xF;
3597                 } else {
3598                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3599                         basic_offset &= 0xF;
3600                 }
3601
3602                 /*
3603                  * Get the pointer that we need to point to
3604                  * from the direct map
3605                  */
3606                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3607                                          direct + 2 * basic_offset);
3608                 /* and write it to the basic map */
3609                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3610                                 rateptr);
3611         }
3612 }
3613
3614 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3615                                     struct ieee80211_vif *vif,
3616                                     struct ieee80211_bss_conf *conf,
3617                                     u32 changed)
3618 {
3619         struct b43_wl *wl = hw_to_b43_wl(hw);
3620         struct b43_wldev *dev;
3621         unsigned long flags;
3622
3623         mutex_lock(&wl->mutex);
3624
3625         dev = wl->current_dev;
3626         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3627                 goto out_unlock_mutex;
3628
3629         B43_WARN_ON(wl->vif != vif);
3630
3631         spin_lock_irqsave(&wl->irq_lock, flags);
3632         if (changed & BSS_CHANGED_BSSID) {
3633                 if (conf->bssid)
3634                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3635                 else
3636                         memset(wl->bssid, 0, ETH_ALEN);
3637         }
3638
3639         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3640                 if (changed & BSS_CHANGED_BEACON &&
3641                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3642                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3643                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3644                         b43_update_templates(wl);
3645
3646                 if (changed & BSS_CHANGED_BSSID)
3647                         b43_write_mac_bssid_templates(dev);
3648         }
3649         spin_unlock_irqrestore(&wl->irq_lock, flags);
3650
3651         b43_mac_suspend(dev);
3652
3653         /* Update templates for AP/mesh mode. */
3654         if (changed & BSS_CHANGED_BEACON_INT &&
3655             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3656              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3657              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3658                 b43_set_beacon_int(dev, conf->beacon_int);
3659
3660         if (changed & BSS_CHANGED_BASIC_RATES)
3661                 b43_update_basic_rates(dev, conf->basic_rates);
3662
3663         if (changed & BSS_CHANGED_ERP_SLOT) {
3664                 if (conf->use_short_slot)
3665                         b43_short_slot_timing_enable(dev);
3666                 else
3667                         b43_short_slot_timing_disable(dev);
3668         }
3669
3670         b43_mac_enable(dev);
3671 out_unlock_mutex:
3672         mutex_unlock(&wl->mutex);
3673 }
3674
3675 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3676                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3677                           struct ieee80211_key_conf *key)
3678 {
3679         struct b43_wl *wl = hw_to_b43_wl(hw);
3680         struct b43_wldev *dev;
3681         u8 algorithm;
3682         u8 index;
3683         int err;
3684         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3685
3686         if (modparam_nohwcrypt)
3687                 return -ENOSPC; /* User disabled HW-crypto */
3688
3689         mutex_lock(&wl->mutex);
3690         spin_lock_irq(&wl->irq_lock);
3691         write_lock(&wl->tx_lock);
3692         /* Why do we need all this locking here?
3693          * mutex     -> Every config operation must take it.
3694          * irq_lock  -> We modify the dev->key array, which is accessed
3695          *              in the IRQ handlers.
3696          * tx_lock   -> We modify the dev->key array, which is accessed
3697          *              in the TX handler.
3698          */
3699
3700         dev = wl->current_dev;
3701         err = -ENODEV;
3702         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3703                 goto out_unlock;
3704
3705         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3706                 /* We don't have firmware for the crypto engine.
3707                  * Must use software-crypto. */
3708                 err = -EOPNOTSUPP;
3709                 goto out_unlock;
3710         }
3711
3712         err = -EINVAL;
3713         switch (key->alg) {
3714         case ALG_WEP:
3715                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3716                         algorithm = B43_SEC_ALGO_WEP40;
3717                 else
3718                         algorithm = B43_SEC_ALGO_WEP104;
3719                 break;
3720         case ALG_TKIP:
3721                 algorithm = B43_SEC_ALGO_TKIP;
3722                 break;
3723         case ALG_CCMP:
3724                 algorithm = B43_SEC_ALGO_AES;
3725                 break;
3726         default:
3727                 B43_WARN_ON(1);
3728                 goto out_unlock;
3729         }
3730         index = (u8) (key->keyidx);
3731         if (index > 3)
3732                 goto out_unlock;
3733
3734         switch (cmd) {
3735         case SET_KEY:
3736                 if (algorithm == B43_SEC_ALGO_TKIP &&
3737                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3738                     !modparam_hwtkip)) {
3739                         /* We support only pairwise key */
3740                         err = -EOPNOTSUPP;
3741                         goto out_unlock;
3742                 }
3743
3744                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3745                         if (WARN_ON(!sta)) {
3746                                 err = -EOPNOTSUPP;
3747                                 goto out_unlock;
3748                         }
3749                         /* Pairwise key with an assigned MAC address. */
3750                         err = b43_key_write(dev, -1, algorithm,
3751                                             key->key, key->keylen,
3752                                             sta->addr, key);
3753                 } else {
3754                         /* Group key */
3755                         err = b43_key_write(dev, index, algorithm,
3756                                             key->key, key->keylen, NULL, key);
3757                 }
3758                 if (err)
3759                         goto out_unlock;
3760
3761                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3762                     algorithm == B43_SEC_ALGO_WEP104) {
3763                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3764                 } else {
3765                         b43_hf_write(dev,
3766                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3767                 }
3768                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3769                 if (algorithm == B43_SEC_ALGO_TKIP)
3770                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3771                 break;
3772         case DISABLE_KEY: {
3773                 err = b43_key_clear(dev, key->hw_key_idx);
3774                 if (err)
3775                         goto out_unlock;
3776                 break;
3777         }
3778         default:
3779                 B43_WARN_ON(1);
3780         }
3781
3782 out_unlock:
3783         if (!err) {
3784                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3785                        "mac: %pM\n",
3786                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3787                        sta ? sta->addr : bcast_addr);
3788                 b43_dump_keymemory(dev);
3789         }
3790         write_unlock(&wl->tx_lock);
3791         spin_unlock_irq(&wl->irq_lock);
3792         mutex_unlock(&wl->mutex);
3793
3794         return err;
3795 }
3796
3797 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3798                                     unsigned int changed, unsigned int *fflags,
3799                                     u64 multicast)
3800 {
3801         struct b43_wl *wl = hw_to_b43_wl(hw);
3802         struct b43_wldev *dev = wl->current_dev;
3803         unsigned long flags;
3804
3805         if (!dev) {
3806                 *fflags = 0;
3807                 return;
3808         }
3809
3810         spin_lock_irqsave(&wl->irq_lock, flags);
3811         *fflags &= FIF_PROMISC_IN_BSS |
3812                   FIF_ALLMULTI |
3813                   FIF_FCSFAIL |
3814                   FIF_PLCPFAIL |
3815                   FIF_CONTROL |
3816                   FIF_OTHER_BSS |
3817                   FIF_BCN_PRBRESP_PROMISC;
3818
3819         changed &= FIF_PROMISC_IN_BSS |
3820                    FIF_ALLMULTI |
3821                    FIF_FCSFAIL |
3822                    FIF_PLCPFAIL |
3823                    FIF_CONTROL |
3824                    FIF_OTHER_BSS |
3825                    FIF_BCN_PRBRESP_PROMISC;
3826
3827         wl->filter_flags = *fflags;
3828
3829         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3830                 b43_adjust_opmode(dev);
3831         spin_unlock_irqrestore(&wl->irq_lock, flags);
3832 }
3833
3834 /* Locking: wl->mutex */
3835 static void b43_wireless_core_stop(struct b43_wldev *dev)
3836 {
3837         struct b43_wl *wl = dev->wl;
3838         unsigned long flags;
3839
3840         if (b43_status(dev) < B43_STAT_STARTED)
3841                 return;
3842
3843         /* Disable and sync interrupts. We must do this before than
3844          * setting the status to INITIALIZED, as the interrupt handler
3845          * won't care about IRQs then. */
3846         spin_lock_irqsave(&wl->irq_lock, flags);
3847         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3848         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3849         spin_unlock_irqrestore(&wl->irq_lock, flags);
3850         b43_synchronize_irq(dev);
3851
3852         write_lock_irqsave(&wl->tx_lock, flags);
3853         b43_set_status(dev, B43_STAT_INITIALIZED);
3854         write_unlock_irqrestore(&wl->tx_lock, flags);
3855
3856         b43_pio_stop(dev);
3857         mutex_unlock(&wl->mutex);
3858         /* Must unlock as it would otherwise deadlock. No races here.
3859          * Cancel the possibly running self-rearming periodic work. */
3860         cancel_delayed_work_sync(&dev->periodic_work);
3861         mutex_lock(&wl->mutex);
3862
3863         b43_mac_suspend(dev);
3864         free_irq(dev->dev->irq, dev);
3865         b43dbg(wl, "Wireless interface stopped\n");
3866 }
3867
3868 /* Locking: wl->mutex */
3869 static int b43_wireless_core_start(struct b43_wldev *dev)
3870 {
3871         int err;
3872
3873         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3874
3875         drain_txstatus_queue(dev);
3876         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3877                           IRQF_SHARED, KBUILD_MODNAME, dev);
3878         if (err) {
3879                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3880                 goto out;
3881         }
3882
3883         /* We are ready to run. */
3884         b43_set_status(dev, B43_STAT_STARTED);
3885
3886         /* Start data flow (TX/RX). */
3887         b43_mac_enable(dev);
3888         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3889
3890         /* Start maintainance work */
3891         b43_periodic_tasks_setup(dev);
3892
3893         b43dbg(dev->wl, "Wireless interface started\n");
3894       out:
3895         return err;
3896 }
3897
3898 /* Get PHY and RADIO versioning numbers */
3899 static int b43_phy_versioning(struct b43_wldev *dev)
3900 {
3901         struct b43_phy *phy = &dev->phy;
3902         u32 tmp;
3903         u8 analog_type;
3904         u8 phy_type;
3905         u8 phy_rev;
3906         u16 radio_manuf;
3907         u16 radio_ver;
3908         u16 radio_rev;
3909         int unsupported = 0;
3910
3911         /* Get PHY versioning */
3912         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3913         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3914         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3915         phy_rev = (tmp & B43_PHYVER_VERSION);
3916         switch (phy_type) {
3917         case B43_PHYTYPE_A:
3918                 if (phy_rev >= 4)
3919                         unsupported = 1;
3920                 break;
3921         case B43_PHYTYPE_B:
3922                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3923                     && phy_rev != 7)
3924                         unsupported = 1;
3925                 break;
3926         case B43_PHYTYPE_G:
3927                 if (phy_rev > 9)
3928                         unsupported = 1;
3929                 break;
3930 #ifdef CONFIG_B43_NPHY
3931         case B43_PHYTYPE_N:
3932                 if (phy_rev > 4)
3933                         unsupported = 1;
3934                 break;
3935 #endif
3936 #ifdef CONFIG_B43_PHY_LP
3937         case B43_PHYTYPE_LP:
3938                 if (phy_rev > 2)
3939                         unsupported = 1;
3940                 break;
3941 #endif
3942         default:
3943                 unsupported = 1;
3944         };
3945         if (unsupported) {
3946                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3947                        "(Analog %u, Type %u, Revision %u)\n",
3948                        analog_type, phy_type, phy_rev);
3949                 return -EOPNOTSUPP;
3950         }
3951         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3952                analog_type, phy_type, phy_rev);
3953
3954         /* Get RADIO versioning */
3955         if (dev->dev->bus->chip_id == 0x4317) {
3956                 if (dev->dev->bus->chip_rev == 0)
3957                         tmp = 0x3205017F;
3958                 else if (dev->dev->bus->chip_rev == 1)
3959                         tmp = 0x4205017F;
3960                 else
3961                         tmp = 0x5205017F;
3962         } else {
3963                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3964                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3965                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3966                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3967         }
3968         radio_manuf = (tmp & 0x00000FFF);
3969         radio_ver = (tmp & 0x0FFFF000) >> 12;
3970         radio_rev = (tmp & 0xF0000000) >> 28;
3971         if (radio_manuf != 0x17F /* Broadcom */)
3972                 unsupported = 1;
3973         switch (phy_type) {
3974         case B43_PHYTYPE_A:
3975                 if (radio_ver != 0x2060)
3976                         unsupported = 1;
3977                 if (radio_rev != 1)
3978                         unsupported = 1;
3979                 if (radio_manuf != 0x17F)
3980                         unsupported = 1;
3981                 break;
3982         case B43_PHYTYPE_B:
3983                 if ((radio_ver & 0xFFF0) != 0x2050)
3984                         unsupported = 1;
3985                 break;
3986         case B43_PHYTYPE_G:
3987                 if (radio_ver != 0x2050)
3988                         unsupported = 1;
3989                 break;
3990         case B43_PHYTYPE_N:
3991                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
3992                         unsupported = 1;
3993                 break;
3994         case B43_PHYTYPE_LP:
3995                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
3996                         unsupported = 1;
3997                 break;
3998         default:
3999                 B43_WARN_ON(1);
4000         }
4001         if (unsupported) {
4002                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4003                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4004                        radio_manuf, radio_ver, radio_rev);
4005                 return -EOPNOTSUPP;
4006         }
4007         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4008                radio_manuf, radio_ver, radio_rev);
4009
4010         phy->radio_manuf = radio_manuf;
4011         phy->radio_ver = radio_ver;
4012         phy->radio_rev = radio_rev;
4013
4014         phy->analog = analog_type;
4015         phy->type = phy_type;
4016         phy->rev = phy_rev;
4017
4018         return 0;
4019 }
4020
4021 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4022                                       struct b43_phy *phy)
4023 {
4024         phy->hardware_power_control = !!modparam_hwpctl;
4025         phy->next_txpwr_check_time = jiffies;
4026         /* PHY TX errors counter. */
4027         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4028
4029 #if B43_DEBUG
4030         phy->phy_locked = 0;
4031         phy->radio_locked = 0;
4032 #endif
4033 }
4034
4035 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4036 {
4037         dev->dfq_valid = 0;
4038
4039         /* Assume the radio is enabled. If it's not enabled, the state will
4040          * immediately get fixed on the first periodic work run. */
4041         dev->radio_hw_enable = 1;
4042
4043         /* Stats */
4044         memset(&dev->stats, 0, sizeof(dev->stats));
4045
4046         setup_struct_phy_for_init(dev, &dev->phy);
4047
4048         /* IRQ related flags */
4049         dev->irq_reason = 0;
4050         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4051         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4052         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4053                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4054
4055         dev->mac_suspended = 1;
4056
4057         /* Noise calculation context */
4058         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4059 }
4060
4061 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4062 {
4063         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
4064         u64 hf;
4065
4066         if (!modparam_btcoex)
4067                 return;
4068         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4069                 return;
4070         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4071                 return;
4072
4073         hf = b43_hf_read(dev);
4074         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4075                 hf |= B43_HF_BTCOEXALT;
4076         else
4077                 hf |= B43_HF_BTCOEX;
4078         b43_hf_write(dev, hf);
4079 }
4080
4081 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4082 {
4083         if (!modparam_btcoex)
4084                 return;
4085         //TODO
4086 }
4087
4088 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4089 {
4090 #ifdef CONFIG_SSB_DRIVER_PCICORE
4091         struct ssb_bus *bus = dev->dev->bus;
4092         u32 tmp;
4093
4094         if (bus->pcicore.dev &&
4095             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
4096             bus->pcicore.dev->id.revision <= 5) {
4097                 /* IMCFGLO timeouts workaround. */
4098                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
4099                 tmp &= ~SSB_IMCFGLO_REQTO;
4100                 tmp &= ~SSB_IMCFGLO_SERTO;
4101                 switch (bus->bustype) {
4102                 case SSB_BUSTYPE_PCI:
4103                 case SSB_BUSTYPE_PCMCIA:
4104                         tmp |= 0x32;
4105                         break;
4106                 case SSB_BUSTYPE_SSB:
4107                         tmp |= 0x53;
4108                         break;
4109                 }
4110                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
4111         }
4112 #endif /* CONFIG_SSB_DRIVER_PCICORE */
4113 }
4114
4115 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4116 {
4117         u16 pu_delay;
4118
4119         /* The time value is in microseconds. */
4120         if (dev->phy.type == B43_PHYTYPE_A)
4121                 pu_delay = 3700;
4122         else
4123                 pu_delay = 1050;
4124         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4125                 pu_delay = 500;
4126         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4127                 pu_delay = max(pu_delay, (u16)2400);
4128
4129         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4130 }
4131
4132 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4133 static void b43_set_pretbtt(struct b43_wldev *dev)
4134 {
4135         u16 pretbtt;
4136
4137         /* The time value is in microseconds. */
4138         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4139                 pretbtt = 2;
4140         } else {
4141                 if (dev->phy.type == B43_PHYTYPE_A)
4142                         pretbtt = 120;
4143                 else
4144                         pretbtt = 250;
4145         }
4146         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4147         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4148 }
4149
4150 /* Shutdown a wireless core */
4151 /* Locking: wl->mutex */
4152 static void b43_wireless_core_exit(struct b43_wldev *dev)
4153 {
4154         u32 macctl;
4155
4156         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4157         if (b43_status(dev) != B43_STAT_INITIALIZED)
4158                 return;
4159         b43_set_status(dev, B43_STAT_UNINIT);
4160
4161         /* Stop the microcode PSM. */
4162         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4163         macctl &= ~B43_MACCTL_PSM_RUN;
4164         macctl |= B43_MACCTL_PSM_JMP0;
4165         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4166
4167         if (!dev->suspend_in_progress) {
4168                 b43_leds_exit(dev);
4169                 b43_rng_exit(dev->wl);
4170         }
4171         b43_dma_free(dev);
4172         b43_pio_free(dev);
4173         b43_chip_exit(dev);
4174         dev->phy.ops->switch_analog(dev, 0);
4175         if (dev->wl->current_beacon) {
4176                 dev_kfree_skb_any(dev->wl->current_beacon);
4177                 dev->wl->current_beacon = NULL;
4178         }
4179
4180         ssb_device_disable(dev->dev, 0);
4181         ssb_bus_may_powerdown(dev->dev->bus);
4182 }
4183
4184 /* Initialize a wireless core */
4185 static int b43_wireless_core_init(struct b43_wldev *dev)
4186 {
4187         struct b43_wl *wl = dev->wl;
4188         struct ssb_bus *bus = dev->dev->bus;
4189         struct ssb_sprom *sprom = &bus->sprom;
4190         struct b43_phy *phy = &dev->phy;
4191         int err;
4192         u64 hf;
4193         u32 tmp;
4194
4195         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4196
4197         err = ssb_bus_powerup(bus, 0);
4198         if (err)
4199                 goto out;
4200         if (!ssb_device_is_enabled(dev->dev)) {
4201                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4202                 b43_wireless_core_reset(dev, tmp);
4203         }
4204
4205         /* Reset all data structures. */
4206         setup_struct_wldev_for_init(dev);
4207         phy->ops->prepare_structs(dev);
4208
4209         /* Enable IRQ routing to this device. */
4210         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4211
4212         b43_imcfglo_timeouts_workaround(dev);
4213         b43_bluetooth_coext_disable(dev);
4214         if (phy->ops->prepare_hardware) {
4215                 err = phy->ops->prepare_hardware(dev);
4216                 if (err)
4217                         goto err_busdown;
4218         }
4219         err = b43_chip_init(dev);
4220         if (err)
4221                 goto err_busdown;
4222         b43_shm_write16(dev, B43_SHM_SHARED,
4223                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4224         hf = b43_hf_read(dev);
4225         if (phy->type == B43_PHYTYPE_G) {
4226                 hf |= B43_HF_SYMW;
4227                 if (phy->rev == 1)
4228                         hf |= B43_HF_GDCW;
4229                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4230                         hf |= B43_HF_OFDMPABOOST;
4231         }
4232         if (phy->radio_ver == 0x2050) {
4233                 if (phy->radio_rev == 6)
4234                         hf |= B43_HF_4318TSSI;
4235                 if (phy->radio_rev < 6)
4236                         hf |= B43_HF_VCORECALC;
4237         }
4238         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4239                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4240 #ifdef CONFIG_SSB_DRIVER_PCICORE
4241         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4242             (bus->pcicore.dev->id.revision <= 10))
4243                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4244 #endif
4245         hf &= ~B43_HF_SKCFPUP;
4246         b43_hf_write(dev, hf);
4247
4248         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4249                              B43_DEFAULT_LONG_RETRY_LIMIT);
4250         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4251         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4252
4253         /* Disable sending probe responses from firmware.
4254          * Setting the MaxTime to one usec will always trigger
4255          * a timeout, so we never send any probe resp.
4256          * A timeout of zero is infinite. */
4257         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4258
4259         b43_rate_memory_init(dev);
4260         b43_set_phytxctl_defaults(dev);
4261
4262         /* Minimum Contention Window */
4263         if (phy->type == B43_PHYTYPE_B) {
4264                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4265         } else {
4266                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4267         }
4268         /* Maximum Contention Window */
4269         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4270
4271         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4272                 dev->__using_pio_transfers = 1;
4273                 err = b43_pio_init(dev);
4274         } else {
4275                 dev->__using_pio_transfers = 0;
4276                 err = b43_dma_init(dev);
4277         }
4278         if (err)
4279                 goto err_chip_exit;
4280         b43_qos_init(dev);
4281         b43_set_synth_pu_delay(dev, 1);
4282         b43_bluetooth_coext_enable(dev);
4283
4284         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4285         b43_upload_card_macaddress(dev);
4286         b43_security_init(dev);
4287         if (!dev->suspend_in_progress)
4288                 b43_rng_init(wl);
4289
4290         b43_set_status(dev, B43_STAT_INITIALIZED);
4291
4292         if (!dev->suspend_in_progress)
4293                 b43_leds_init(dev);
4294 out:
4295         return err;
4296
4297 err_chip_exit:
4298         b43_chip_exit(dev);
4299 err_busdown:
4300         ssb_bus_may_powerdown(bus);
4301         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4302         return err;
4303 }
4304
4305 static int b43_op_add_interface(struct ieee80211_hw *hw,
4306                                 struct ieee80211_if_init_conf *conf)
4307 {
4308         struct b43_wl *wl = hw_to_b43_wl(hw);
4309         struct b43_wldev *dev;
4310         unsigned long flags;
4311         int err = -EOPNOTSUPP;
4312
4313         /* TODO: allow WDS/AP devices to coexist */
4314
4315         if (conf->type != NL80211_IFTYPE_AP &&
4316             conf->type != NL80211_IFTYPE_MESH_POINT &&
4317             conf->type != NL80211_IFTYPE_STATION &&
4318             conf->type != NL80211_IFTYPE_WDS &&
4319             conf->type != NL80211_IFTYPE_ADHOC)
4320                 return -EOPNOTSUPP;
4321
4322         mutex_lock(&wl->mutex);
4323         if (wl->operating)
4324                 goto out_mutex_unlock;
4325
4326         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4327
4328         dev = wl->current_dev;
4329         wl->operating = 1;
4330         wl->vif = conf->vif;
4331         wl->if_type = conf->type;
4332         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4333
4334         spin_lock_irqsave(&wl->irq_lock, flags);
4335         b43_adjust_opmode(dev);
4336         b43_set_pretbtt(dev);
4337         b43_set_synth_pu_delay(dev, 0);
4338         b43_upload_card_macaddress(dev);
4339         spin_unlock_irqrestore(&wl->irq_lock, flags);
4340
4341         err = 0;
4342  out_mutex_unlock:
4343         mutex_unlock(&wl->mutex);
4344
4345         return err;
4346 }
4347
4348 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4349                                     struct ieee80211_if_init_conf *conf)
4350 {
4351         struct b43_wl *wl = hw_to_b43_wl(hw);
4352         struct b43_wldev *dev = wl->current_dev;
4353         unsigned long flags;
4354
4355         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4356
4357         mutex_lock(&wl->mutex);
4358
4359         B43_WARN_ON(!wl->operating);
4360         B43_WARN_ON(wl->vif != conf->vif);
4361         wl->vif = NULL;
4362
4363         wl->operating = 0;
4364
4365         spin_lock_irqsave(&wl->irq_lock, flags);
4366         b43_adjust_opmode(dev);
4367         memset(wl->mac_addr, 0, ETH_ALEN);
4368         b43_upload_card_macaddress(dev);
4369         spin_unlock_irqrestore(&wl->irq_lock, flags);
4370
4371         mutex_unlock(&wl->mutex);
4372 }
4373
4374 static int b43_op_start(struct ieee80211_hw *hw)
4375 {
4376         struct b43_wl *wl = hw_to_b43_wl(hw);
4377         struct b43_wldev *dev = wl->current_dev;
4378         int did_init = 0;
4379         int err = 0;
4380
4381         /* Kill all old instance specific information to make sure
4382          * the card won't use it in the short timeframe between start
4383          * and mac80211 reconfiguring it. */
4384         memset(wl->bssid, 0, ETH_ALEN);
4385         memset(wl->mac_addr, 0, ETH_ALEN);
4386         wl->filter_flags = 0;
4387         wl->radiotap_enabled = 0;
4388         b43_qos_clear(wl);
4389         wl->beacon0_uploaded = 0;
4390         wl->beacon1_uploaded = 0;
4391         wl->beacon_templates_virgin = 1;
4392         wl->radio_enabled = 1;
4393
4394         mutex_lock(&wl->mutex);
4395
4396         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4397                 err = b43_wireless_core_init(dev);
4398                 if (err)
4399                         goto out_mutex_unlock;
4400                 did_init = 1;
4401         }
4402
4403         if (b43_status(dev) < B43_STAT_STARTED) {
4404                 err = b43_wireless_core_start(dev);
4405                 if (err) {
4406                         if (did_init)
4407                                 b43_wireless_core_exit(dev);
4408                         goto out_mutex_unlock;
4409                 }
4410         }
4411
4412         /* XXX: only do if device doesn't support rfkill irq */
4413         wiphy_rfkill_start_polling(hw->wiphy);
4414
4415  out_mutex_unlock:
4416         mutex_unlock(&wl->mutex);
4417
4418         return err;
4419 }
4420
4421 static void b43_op_stop(struct ieee80211_hw *hw)
4422 {
4423         struct b43_wl *wl = hw_to_b43_wl(hw);
4424         struct b43_wldev *dev = wl->current_dev;
4425
4426         cancel_work_sync(&(wl->beacon_update_trigger));
4427
4428         mutex_lock(&wl->mutex);
4429         if (b43_status(dev) >= B43_STAT_STARTED)
4430                 b43_wireless_core_stop(dev);
4431         b43_wireless_core_exit(dev);
4432         wl->radio_enabled = 0;
4433         mutex_unlock(&wl->mutex);
4434
4435         cancel_work_sync(&(wl->txpower_adjust_work));
4436 }
4437
4438 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4439                                  struct ieee80211_sta *sta, bool set)
4440 {
4441         struct b43_wl *wl = hw_to_b43_wl(hw);
4442         unsigned long flags;
4443
4444         spin_lock_irqsave(&wl->irq_lock, flags);
4445         b43_update_templates(wl);
4446         spin_unlock_irqrestore(&wl->irq_lock, flags);
4447
4448         return 0;
4449 }
4450
4451 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4452                               struct ieee80211_vif *vif,
4453                               enum sta_notify_cmd notify_cmd,
4454                               struct ieee80211_sta *sta)
4455 {
4456         struct b43_wl *wl = hw_to_b43_wl(hw);
4457
4458         B43_WARN_ON(!vif || wl->vif != vif);
4459 }
4460
4461 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4462 {
4463         struct b43_wl *wl = hw_to_b43_wl(hw);
4464         struct b43_wldev *dev;
4465
4466         mutex_lock(&wl->mutex);
4467         dev = wl->current_dev;
4468         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4469                 /* Disable CFP update during scan on other channels. */
4470                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4471         }
4472         mutex_unlock(&wl->mutex);
4473 }
4474
4475 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4476 {
4477         struct b43_wl *wl = hw_to_b43_wl(hw);
4478         struct b43_wldev *dev;
4479
4480         mutex_lock(&wl->mutex);
4481         dev = wl->current_dev;
4482         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4483                 /* Re-enable CFP update. */
4484                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4485         }
4486         mutex_unlock(&wl->mutex);
4487 }
4488
4489 static const struct ieee80211_ops b43_hw_ops = {
4490         .tx                     = b43_op_tx,
4491         .conf_tx                = b43_op_conf_tx,
4492         .add_interface          = b43_op_add_interface,
4493         .remove_interface       = b43_op_remove_interface,
4494         .config                 = b43_op_config,
4495         .bss_info_changed       = b43_op_bss_info_changed,
4496         .configure_filter       = b43_op_configure_filter,
4497         .set_key                = b43_op_set_key,
4498         .update_tkip_key        = b43_op_update_tkip_key,
4499         .get_stats              = b43_op_get_stats,
4500         .get_tx_stats           = b43_op_get_tx_stats,
4501         .get_tsf                = b43_op_get_tsf,
4502         .set_tsf                = b43_op_set_tsf,
4503         .start                  = b43_op_start,
4504         .stop                   = b43_op_stop,
4505         .set_tim                = b43_op_beacon_set_tim,
4506         .sta_notify             = b43_op_sta_notify,
4507         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4508         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4509         .rfkill_poll            = b43_rfkill_poll,
4510 };
4511
4512 /* Hard-reset the chip. Do not call this directly.
4513  * Use b43_controller_restart()
4514  */
4515 static void b43_chip_reset(struct work_struct *work)
4516 {
4517         struct b43_wldev *dev =
4518             container_of(work, struct b43_wldev, restart_work);
4519         struct b43_wl *wl = dev->wl;
4520         int err = 0;
4521         int prev_status;
4522
4523         mutex_lock(&wl->mutex);
4524
4525         prev_status = b43_status(dev);
4526         /* Bring the device down... */
4527         if (prev_status >= B43_STAT_STARTED)
4528                 b43_wireless_core_stop(dev);
4529         if (prev_status >= B43_STAT_INITIALIZED)
4530                 b43_wireless_core_exit(dev);
4531
4532         /* ...and up again. */
4533         if (prev_status >= B43_STAT_INITIALIZED) {
4534                 err = b43_wireless_core_init(dev);
4535                 if (err)
4536                         goto out;
4537         }
4538         if (prev_status >= B43_STAT_STARTED) {
4539                 err = b43_wireless_core_start(dev);
4540                 if (err) {
4541                         b43_wireless_core_exit(dev);
4542                         goto out;
4543                 }
4544         }
4545 out:
4546         if (err)
4547                 wl->current_dev = NULL; /* Failed to init the dev. */
4548         mutex_unlock(&wl->mutex);
4549         if (err)
4550                 b43err(wl, "Controller restart FAILED\n");
4551         else
4552                 b43info(wl, "Controller restarted\n");
4553 }
4554
4555 static int b43_setup_bands(struct b43_wldev *dev,
4556                            bool have_2ghz_phy, bool have_5ghz_phy)
4557 {
4558         struct ieee80211_hw *hw = dev->wl->hw;
4559
4560         if (have_2ghz_phy)
4561                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4562         if (dev->phy.type == B43_PHYTYPE_N) {
4563                 if (have_5ghz_phy)
4564                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4565         } else {
4566                 if (have_5ghz_phy)
4567                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4568         }
4569
4570         dev->phy.supports_2ghz = have_2ghz_phy;
4571         dev->phy.supports_5ghz = have_5ghz_phy;
4572
4573         return 0;
4574 }
4575
4576 static void b43_wireless_core_detach(struct b43_wldev *dev)
4577 {
4578         /* We release firmware that late to not be required to re-request
4579          * is all the time when we reinit the core. */
4580         b43_release_firmware(dev);
4581         b43_phy_free(dev);
4582 }
4583
4584 static int b43_wireless_core_attach(struct b43_wldev *dev)
4585 {
4586         struct b43_wl *wl = dev->wl;
4587         struct ssb_bus *bus = dev->dev->bus;
4588         struct pci_dev *pdev = bus->host_pci;
4589         int err;
4590         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4591         u32 tmp;
4592
4593         /* Do NOT do any device initialization here.
4594          * Do it in wireless_core_init() instead.
4595          * This function is for gathering basic information about the HW, only.
4596          * Also some structs may be set up here. But most likely you want to have
4597          * that in core_init(), too.
4598          */
4599
4600         err = ssb_bus_powerup(bus, 0);
4601         if (err) {
4602                 b43err(wl, "Bus powerup failed\n");
4603                 goto out;
4604         }
4605         /* Get the PHY type. */
4606         if (dev->dev->id.revision >= 5) {
4607                 u32 tmshigh;
4608
4609                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4610                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4611                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4612         } else
4613                 B43_WARN_ON(1);
4614
4615         dev->phy.gmode = have_2ghz_phy;
4616         dev->phy.radio_on = 1;
4617         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4618         b43_wireless_core_reset(dev, tmp);
4619
4620         err = b43_phy_versioning(dev);
4621         if (err)
4622                 goto err_powerdown;
4623         /* Check if this device supports multiband. */
4624         if (!pdev ||
4625             (pdev->device != 0x4312 &&
4626              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4627                 /* No multiband support. */
4628                 have_2ghz_phy = 0;
4629                 have_5ghz_phy = 0;
4630                 switch (dev->phy.type) {
4631                 case B43_PHYTYPE_A:
4632                         have_5ghz_phy = 1;
4633                         break;
4634                 case B43_PHYTYPE_LP: //FIXME not always!
4635 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4636                         have_5ghz_phy = 1;
4637 #endif
4638                 case B43_PHYTYPE_G:
4639                 case B43_PHYTYPE_N:
4640                         have_2ghz_phy = 1;
4641                         break;
4642                 default:
4643                         B43_WARN_ON(1);
4644                 }
4645         }
4646         if (dev->phy.type == B43_PHYTYPE_A) {
4647                 /* FIXME */
4648                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4649                 err = -EOPNOTSUPP;
4650                 goto err_powerdown;
4651         }
4652         if (1 /* disable A-PHY */) {
4653                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4654                 if (dev->phy.type != B43_PHYTYPE_N &&
4655                     dev->phy.type != B43_PHYTYPE_LP) {
4656                         have_2ghz_phy = 1;
4657                         have_5ghz_phy = 0;
4658                 }
4659         }
4660
4661         err = b43_phy_allocate(dev);
4662         if (err)
4663                 goto err_powerdown;
4664
4665         dev->phy.gmode = have_2ghz_phy;
4666         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4667         b43_wireless_core_reset(dev, tmp);
4668
4669         err = b43_validate_chipaccess(dev);
4670         if (err)
4671                 goto err_phy_free;
4672         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4673         if (err)
4674                 goto err_phy_free;
4675
4676         /* Now set some default "current_dev" */
4677         if (!wl->current_dev)
4678                 wl->current_dev = dev;
4679         INIT_WORK(&dev->restart_work, b43_chip_reset);
4680
4681         dev->phy.ops->switch_analog(dev, 0);
4682         ssb_device_disable(dev->dev, 0);
4683         ssb_bus_may_powerdown(bus);
4684
4685 out:
4686         return err;
4687
4688 err_phy_free:
4689         b43_phy_free(dev);
4690 err_powerdown:
4691         ssb_bus_may_powerdown(bus);
4692         return err;
4693 }
4694
4695 static void b43_one_core_detach(struct ssb_device *dev)
4696 {
4697         struct b43_wldev *wldev;
4698         struct b43_wl *wl;
4699
4700         /* Do not cancel ieee80211-workqueue based work here.
4701          * See comment in b43_remove(). */
4702
4703         wldev = ssb_get_drvdata(dev);
4704         wl = wldev->wl;
4705         b43_debugfs_remove_device(wldev);
4706         b43_wireless_core_detach(wldev);
4707         list_del(&wldev->list);
4708         wl->nr_devs--;
4709         ssb_set_drvdata(dev, NULL);
4710         kfree(wldev);
4711 }
4712
4713 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4714 {
4715         struct b43_wldev *wldev;
4716         struct pci_dev *pdev;
4717         int err = -ENOMEM;
4718
4719         if (!list_empty(&wl->devlist)) {
4720                 /* We are not the first core on this chip. */
4721                 pdev = dev->bus->host_pci;
4722                 /* Only special chips support more than one wireless
4723                  * core, although some of the other chips have more than
4724                  * one wireless core as well. Check for this and
4725                  * bail out early.
4726                  */
4727                 if (!pdev ||
4728                     ((pdev->device != 0x4321) &&
4729                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4730                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4731                         return -ENODEV;
4732                 }
4733         }
4734
4735         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4736         if (!wldev)
4737                 goto out;
4738
4739         wldev->dev = dev;
4740         wldev->wl = wl;
4741         b43_set_status(wldev, B43_STAT_UNINIT);
4742         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4743         tasklet_init(&wldev->isr_tasklet,
4744                      (void (*)(unsigned long))b43_interrupt_tasklet,
4745                      (unsigned long)wldev);
4746         INIT_LIST_HEAD(&wldev->list);
4747
4748         err = b43_wireless_core_attach(wldev);
4749         if (err)
4750                 goto err_kfree_wldev;
4751
4752         list_add(&wldev->list, &wl->devlist);
4753         wl->nr_devs++;
4754         ssb_set_drvdata(dev, wldev);
4755         b43_debugfs_add_device(wldev);
4756
4757       out:
4758         return err;
4759
4760       err_kfree_wldev:
4761         kfree(wldev);
4762         return err;
4763 }
4764
4765 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4766         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4767         (pdev->device == _device) &&                                    \
4768         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4769         (pdev->subsystem_device == _subdevice)                          )
4770
4771 static void b43_sprom_fixup(struct ssb_bus *bus)
4772 {
4773         struct pci_dev *pdev;
4774
4775         /* boardflags workarounds */
4776         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4777             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4778                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4779         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4780             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4781                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4782         if (bus->bustype == SSB_BUSTYPE_PCI) {
4783                 pdev = bus->host_pci;
4784                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4785                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4786                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4787                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4788                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4789                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4790                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4791                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4792         }
4793 }
4794
4795 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4796 {
4797         struct ieee80211_hw *hw = wl->hw;
4798
4799         ssb_set_devtypedata(dev, NULL);
4800         ieee80211_free_hw(hw);
4801 }
4802
4803 static int b43_wireless_init(struct ssb_device *dev)
4804 {
4805         struct ssb_sprom *sprom = &dev->bus->sprom;
4806         struct ieee80211_hw *hw;
4807         struct b43_wl *wl;
4808         int err = -ENOMEM;
4809
4810         b43_sprom_fixup(dev->bus);
4811
4812         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4813         if (!hw) {
4814                 b43err(NULL, "Could not allocate ieee80211 device\n");
4815                 goto out;
4816         }
4817         wl = hw_to_b43_wl(hw);
4818
4819         /* fill hw info */
4820         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4821                     IEEE80211_HW_SIGNAL_DBM |
4822                     IEEE80211_HW_NOISE_DBM;
4823
4824         hw->wiphy->interface_modes =
4825                 BIT(NL80211_IFTYPE_AP) |
4826                 BIT(NL80211_IFTYPE_MESH_POINT) |
4827                 BIT(NL80211_IFTYPE_STATION) |
4828                 BIT(NL80211_IFTYPE_WDS) |
4829                 BIT(NL80211_IFTYPE_ADHOC);
4830
4831         hw->queues = modparam_qos ? 4 : 1;
4832         wl->mac80211_initially_registered_queues = hw->queues;
4833         hw->max_rates = 2;
4834         SET_IEEE80211_DEV(hw, dev->dev);
4835         if (is_valid_ether_addr(sprom->et1mac))
4836                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4837         else
4838                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4839
4840         /* Initialize struct b43_wl */
4841         wl->hw = hw;
4842         spin_lock_init(&wl->irq_lock);
4843         rwlock_init(&wl->tx_lock);
4844         spin_lock_init(&wl->leds_lock);
4845         spin_lock_init(&wl->shm_lock);
4846         mutex_init(&wl->mutex);
4847         INIT_LIST_HEAD(&wl->devlist);
4848         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4849         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4850
4851         ssb_set_devtypedata(dev, wl);
4852         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4853                 dev->bus->chip_id, dev->id.revision);
4854         err = 0;
4855 out:
4856         return err;
4857 }
4858
4859 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4860 {
4861         struct b43_wl *wl;
4862         int err;
4863         int first = 0;
4864
4865         wl = ssb_get_devtypedata(dev);
4866         if (!wl) {
4867                 /* Probing the first core. Must setup common struct b43_wl */
4868                 first = 1;
4869                 err = b43_wireless_init(dev);
4870                 if (err)
4871                         goto out;
4872                 wl = ssb_get_devtypedata(dev);
4873                 B43_WARN_ON(!wl);
4874         }
4875         err = b43_one_core_attach(dev, wl);
4876         if (err)
4877                 goto err_wireless_exit;
4878
4879         if (first) {
4880                 err = ieee80211_register_hw(wl->hw);
4881                 if (err)
4882                         goto err_one_core_detach;
4883         }
4884
4885       out:
4886         return err;
4887
4888       err_one_core_detach:
4889         b43_one_core_detach(dev);
4890       err_wireless_exit:
4891         if (first)
4892                 b43_wireless_exit(dev, wl);
4893         return err;
4894 }
4895
4896 static void b43_remove(struct ssb_device *dev)
4897 {
4898         struct b43_wl *wl = ssb_get_devtypedata(dev);
4899         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4900
4901         /* We must cancel any work here before unregistering from ieee80211,
4902          * as the ieee80211 unreg will destroy the workqueue. */
4903         cancel_work_sync(&wldev->restart_work);
4904
4905         B43_WARN_ON(!wl);
4906         if (wl->current_dev == wldev) {
4907                 /* Restore the queues count before unregistering, because firmware detect
4908                  * might have modified it. Restoring is important, so the networking
4909                  * stack can properly free resources. */
4910                 wl->hw->queues = wl->mac80211_initially_registered_queues;
4911                 ieee80211_unregister_hw(wl->hw);
4912         }
4913
4914         b43_one_core_detach(dev);
4915
4916         if (list_empty(&wl->devlist)) {
4917                 /* Last core on the chip unregistered.
4918                  * We can destroy common struct b43_wl.
4919                  */
4920                 b43_wireless_exit(dev, wl);
4921         }
4922 }
4923
4924 /* Perform a hardware reset. This can be called from any context. */
4925 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4926 {
4927         /* Must avoid requeueing, if we are in shutdown. */
4928         if (b43_status(dev) < B43_STAT_INITIALIZED)
4929                 return;
4930         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4931         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
4932 }
4933
4934 #ifdef CONFIG_PM
4935
4936 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4937 {
4938         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4939         struct b43_wl *wl = wldev->wl;
4940
4941         b43dbg(wl, "Suspending...\n");
4942
4943         mutex_lock(&wl->mutex);
4944         wldev->suspend_in_progress = true;
4945         wldev->suspend_init_status = b43_status(wldev);
4946         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4947                 b43_wireless_core_stop(wldev);
4948         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4949                 b43_wireless_core_exit(wldev);
4950         mutex_unlock(&wl->mutex);
4951
4952         b43dbg(wl, "Device suspended.\n");
4953
4954         return 0;
4955 }
4956
4957 static int b43_resume(struct ssb_device *dev)
4958 {
4959         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4960         struct b43_wl *wl = wldev->wl;
4961         int err = 0;
4962
4963         b43dbg(wl, "Resuming...\n");
4964
4965         mutex_lock(&wl->mutex);
4966         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4967                 err = b43_wireless_core_init(wldev);
4968                 if (err) {
4969                         b43err(wl, "Resume failed at core init\n");
4970                         goto out;
4971                 }
4972         }
4973         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4974                 err = b43_wireless_core_start(wldev);
4975                 if (err) {
4976                         b43_leds_exit(wldev);
4977                         b43_rng_exit(wldev->wl);
4978                         b43_wireless_core_exit(wldev);
4979                         b43err(wl, "Resume failed at core start\n");
4980                         goto out;
4981                 }
4982         }
4983         b43dbg(wl, "Device resumed.\n");
4984  out:
4985         wldev->suspend_in_progress = false;
4986         mutex_unlock(&wl->mutex);
4987         return err;
4988 }
4989
4990 #else /* CONFIG_PM */
4991 # define b43_suspend    NULL
4992 # define b43_resume     NULL
4993 #endif /* CONFIG_PM */
4994
4995 static struct ssb_driver b43_ssb_driver = {
4996         .name           = KBUILD_MODNAME,
4997         .id_table       = b43_ssb_tbl,
4998         .probe          = b43_probe,
4999         .remove         = b43_remove,
5000         .suspend        = b43_suspend,
5001         .resume         = b43_resume,
5002 };
5003
5004 static void b43_print_driverinfo(void)
5005 {
5006         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5007                    *feat_leds = "";
5008
5009 #ifdef CONFIG_B43_PCI_AUTOSELECT
5010         feat_pci = "P";
5011 #endif
5012 #ifdef CONFIG_B43_PCMCIA
5013         feat_pcmcia = "M";
5014 #endif
5015 #ifdef CONFIG_B43_NPHY
5016         feat_nphy = "N";
5017 #endif
5018 #ifdef CONFIG_B43_LEDS
5019         feat_leds = "L";
5020 #endif
5021         printk(KERN_INFO "Broadcom 43xx driver loaded "
5022                "[ Features: %s%s%s%s, Firmware-ID: "
5023                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5024                feat_pci, feat_pcmcia, feat_nphy,
5025                feat_leds);
5026 }
5027
5028 static int __init b43_init(void)
5029 {
5030         int err;
5031
5032         b43_debugfs_init();
5033         err = b43_pcmcia_init();
5034         if (err)
5035                 goto err_dfs_exit;
5036         err = ssb_driver_register(&b43_ssb_driver);
5037         if (err)
5038                 goto err_pcmcia_exit;
5039         b43_print_driverinfo();
5040
5041         return err;
5042
5043 err_pcmcia_exit:
5044         b43_pcmcia_exit();
5045 err_dfs_exit:
5046         b43_debugfs_exit();
5047         return err;
5048 }
5049
5050 static void __exit b43_exit(void)
5051 {
5052         ssb_driver_unregister(&b43_ssb_driver);
5053         b43_pcmcia_exit();
5054         b43_debugfs_exit();
5055 }
5056
5057 module_init(b43_init)
5058 module_exit(b43_exit)