drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 #ifdef CONFIG_B43_BCMA
1159 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1160 {
1161         u32 flags = 0;
1162
1163         if (gmode)
1164                 flags = B43_BCMA_IOCTL_GMODE;
1165         flags |= B43_BCMA_IOCTL_PHY_CLKEN;
1166         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1167         b43_device_enable(dev, flags);
1168
1169         /* TODO: reset PHY */
1170 }
1171 #endif
1172
1173 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1174 {
1175         struct ssb_device *sdev = dev->dev->sdev;
1176         u32 tmslow;
1177         u32 flags = 0;
1178
1179         if (gmode)
1180                 flags |= B43_TMSLOW_GMODE;
1181         flags |= B43_TMSLOW_PHYCLKEN;
1182         flags |= B43_TMSLOW_PHYRESET;
1183         if (dev->phy.type == B43_PHYTYPE_N)
1184                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1185         b43_device_enable(dev, flags);
1186         msleep(2);              /* Wait for the PLL to turn on. */
1187
1188         /* Now take the PHY out of Reset again */
1189         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1190         tmslow |= SSB_TMSLOW_FGC;
1191         tmslow &= ~B43_TMSLOW_PHYRESET;
1192         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1193         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1194         msleep(1);
1195         tmslow &= ~SSB_TMSLOW_FGC;
1196         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1197         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1198         msleep(1);
1199 }
1200
1201 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1202 {
1203         u32 macctl;
1204
1205         switch (dev->dev->bus_type) {
1206 #ifdef CONFIG_B43_BCMA
1207         case B43_BUS_BCMA:
1208                 b43_bcma_wireless_core_reset(dev, gmode);
1209                 break;
1210 #endif
1211 #ifdef CONFIG_B43_SSB
1212         case B43_BUS_SSB:
1213                 b43_ssb_wireless_core_reset(dev, gmode);
1214                 break;
1215 #endif
1216         }
1217
1218         /* Turn Analog ON, but only if we already know the PHY-type.
1219          * This protects against very early setup where we don't know the
1220          * PHY-type, yet. wireless_core_reset will be called once again later,
1221          * when we know the PHY-type. */
1222         if (dev->phy.ops)
1223                 dev->phy.ops->switch_analog(dev, 1);
1224
1225         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1226         macctl &= ~B43_MACCTL_GMODE;
1227         if (gmode)
1228                 macctl |= B43_MACCTL_GMODE;
1229         macctl |= B43_MACCTL_IHR_ENABLED;
1230         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1231 }
1232
1233 static void handle_irq_transmit_status(struct b43_wldev *dev)
1234 {
1235         u32 v0, v1;
1236         u16 tmp;
1237         struct b43_txstatus stat;
1238
1239         while (1) {
1240                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1241                 if (!(v0 & 0x00000001))
1242                         break;
1243                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1244
1245                 stat.cookie = (v0 >> 16);
1246                 stat.seq = (v1 & 0x0000FFFF);
1247                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1248                 tmp = (v0 & 0x0000FFFF);
1249                 stat.frame_count = ((tmp & 0xF000) >> 12);
1250                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1251                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1252                 stat.pm_indicated = !!(tmp & 0x0080);
1253                 stat.intermediate = !!(tmp & 0x0040);
1254                 stat.for_ampdu = !!(tmp & 0x0020);
1255                 stat.acked = !!(tmp & 0x0002);
1256
1257                 b43_handle_txstatus(dev, &stat);
1258         }
1259 }
1260
1261 static void drain_txstatus_queue(struct b43_wldev *dev)
1262 {
1263         u32 dummy;
1264
1265         if (dev->dev->core_rev < 5)
1266                 return;
1267         /* Read all entries from the microcode TXstatus FIFO
1268          * and throw them away.
1269          */
1270         while (1) {
1271                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1272                 if (!(dummy & 0x00000001))
1273                         break;
1274                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1275         }
1276 }
1277
1278 static u32 b43_jssi_read(struct b43_wldev *dev)
1279 {
1280         u32 val = 0;
1281
1282         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1283         val <<= 16;
1284         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1285
1286         return val;
1287 }
1288
1289 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1290 {
1291         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1292         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1293 }
1294
1295 static void b43_generate_noise_sample(struct b43_wldev *dev)
1296 {
1297         b43_jssi_write(dev, 0x7F7F7F7F);
1298         b43_write32(dev, B43_MMIO_MACCMD,
1299                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1300 }
1301
1302 static void b43_calculate_link_quality(struct b43_wldev *dev)
1303 {
1304         /* Top half of Link Quality calculation. */
1305
1306         if (dev->phy.type != B43_PHYTYPE_G)
1307                 return;
1308         if (dev->noisecalc.calculation_running)
1309                 return;
1310         dev->noisecalc.calculation_running = 1;
1311         dev->noisecalc.nr_samples = 0;
1312
1313         b43_generate_noise_sample(dev);
1314 }
1315
1316 static void handle_irq_noise(struct b43_wldev *dev)
1317 {
1318         struct b43_phy_g *phy = dev->phy.g;
1319         u16 tmp;
1320         u8 noise[4];
1321         u8 i, j;
1322         s32 average;
1323
1324         /* Bottom half of Link Quality calculation. */
1325
1326         if (dev->phy.type != B43_PHYTYPE_G)
1327                 return;
1328
1329         /* Possible race condition: It might be possible that the user
1330          * changed to a different channel in the meantime since we
1331          * started the calculation. We ignore that fact, since it's
1332          * not really that much of a problem. The background noise is
1333          * an estimation only anyway. Slightly wrong results will get damped
1334          * by the averaging of the 8 sample rounds. Additionally the
1335          * value is shortlived. So it will be replaced by the next noise
1336          * calculation round soon. */
1337
1338         B43_WARN_ON(!dev->noisecalc.calculation_running);
1339         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1340         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1341             noise[2] == 0x7F || noise[3] == 0x7F)
1342                 goto generate_new;
1343
1344         /* Get the noise samples. */
1345         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1346         i = dev->noisecalc.nr_samples;
1347         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1348         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1349         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1350         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1351         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1352         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1353         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1354         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1355         dev->noisecalc.nr_samples++;
1356         if (dev->noisecalc.nr_samples == 8) {
1357                 /* Calculate the Link Quality by the noise samples. */
1358                 average = 0;
1359                 for (i = 0; i < 8; i++) {
1360                         for (j = 0; j < 4; j++)
1361                                 average += dev->noisecalc.samples[i][j];
1362                 }
1363                 average /= (8 * 4);
1364                 average *= 125;
1365                 average += 64;
1366                 average /= 128;
1367                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1368                 tmp = (tmp / 128) & 0x1F;
1369                 if (tmp >= 8)
1370                         average += 2;
1371                 else
1372                         average -= 25;
1373                 if (tmp == 8)
1374                         average -= 72;
1375                 else
1376                         average -= 48;
1377
1378                 dev->stats.link_noise = average;
1379                 dev->noisecalc.calculation_running = 0;
1380                 return;
1381         }
1382 generate_new:
1383         b43_generate_noise_sample(dev);
1384 }
1385
1386 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1387 {
1388         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1389                 ///TODO: PS TBTT
1390         } else {
1391                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1392                         b43_power_saving_ctl_bits(dev, 0);
1393         }
1394         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1395                 dev->dfq_valid = 1;
1396 }
1397
1398 static void handle_irq_atim_end(struct b43_wldev *dev)
1399 {
1400         if (dev->dfq_valid) {
1401                 b43_write32(dev, B43_MMIO_MACCMD,
1402                             b43_read32(dev, B43_MMIO_MACCMD)
1403                             | B43_MACCMD_DFQ_VALID);
1404                 dev->dfq_valid = 0;
1405         }
1406 }
1407
1408 static void handle_irq_pmq(struct b43_wldev *dev)
1409 {
1410         u32 tmp;
1411
1412         //TODO: AP mode.
1413
1414         while (1) {
1415                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1416                 if (!(tmp & 0x00000008))
1417                         break;
1418         }
1419         /* 16bit write is odd, but correct. */
1420         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1421 }
1422
1423 static void b43_write_template_common(struct b43_wldev *dev,
1424                                       const u8 *data, u16 size,
1425                                       u16 ram_offset,
1426                                       u16 shm_size_offset, u8 rate)
1427 {
1428         u32 i, tmp;
1429         struct b43_plcp_hdr4 plcp;
1430
1431         plcp.data = 0;
1432         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1433         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1434         ram_offset += sizeof(u32);
1435         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1436          * So leave the first two bytes of the next write blank.
1437          */
1438         tmp = (u32) (data[0]) << 16;
1439         tmp |= (u32) (data[1]) << 24;
1440         b43_ram_write(dev, ram_offset, tmp);
1441         ram_offset += sizeof(u32);
1442         for (i = 2; i < size; i += sizeof(u32)) {
1443                 tmp = (u32) (data[i + 0]);
1444                 if (i + 1 < size)
1445                         tmp |= (u32) (data[i + 1]) << 8;
1446                 if (i + 2 < size)
1447                         tmp |= (u32) (data[i + 2]) << 16;
1448                 if (i + 3 < size)
1449                         tmp |= (u32) (data[i + 3]) << 24;
1450                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1451         }
1452         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1453                         size + sizeof(struct b43_plcp_hdr6));
1454 }
1455
1456 /* Check if the use of the antenna that ieee80211 told us to
1457  * use is possible. This will fall back to DEFAULT.
1458  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1459 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1460                                   u8 antenna_nr)
1461 {
1462         u8 antenna_mask;
1463
1464         if (antenna_nr == 0) {
1465                 /* Zero means "use default antenna". That's always OK. */
1466                 return 0;
1467         }
1468
1469         /* Get the mask of available antennas. */
1470         if (dev->phy.gmode)
1471                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1472         else
1473                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1474
1475         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1476                 /* This antenna is not available. Fall back to default. */
1477                 return 0;
1478         }
1479
1480         return antenna_nr;
1481 }
1482
1483 /* Convert a b43 antenna number value to the PHY TX control value. */
1484 static u16 b43_antenna_to_phyctl(int antenna)
1485 {
1486         switch (antenna) {
1487         case B43_ANTENNA0:
1488                 return B43_TXH_PHY_ANT0;
1489         case B43_ANTENNA1:
1490                 return B43_TXH_PHY_ANT1;
1491         case B43_ANTENNA2:
1492                 return B43_TXH_PHY_ANT2;
1493         case B43_ANTENNA3:
1494                 return B43_TXH_PHY_ANT3;
1495         case B43_ANTENNA_AUTO0:
1496         case B43_ANTENNA_AUTO1:
1497                 return B43_TXH_PHY_ANT01AUTO;
1498         }
1499         B43_WARN_ON(1);
1500         return 0;
1501 }
1502
1503 static void b43_write_beacon_template(struct b43_wldev *dev,
1504                                       u16 ram_offset,
1505                                       u16 shm_size_offset)
1506 {
1507         unsigned int i, len, variable_len;
1508         const struct ieee80211_mgmt *bcn;
1509         const u8 *ie;
1510         bool tim_found = 0;
1511         unsigned int rate;
1512         u16 ctl;
1513         int antenna;
1514         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1515
1516         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1517         len = min((size_t) dev->wl->current_beacon->len,
1518                   0x200 - sizeof(struct b43_plcp_hdr6));
1519         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1520
1521         b43_write_template_common(dev, (const u8 *)bcn,
1522                                   len, ram_offset, shm_size_offset, rate);
1523
1524         /* Write the PHY TX control parameters. */
1525         antenna = B43_ANTENNA_DEFAULT;
1526         antenna = b43_antenna_to_phyctl(antenna);
1527         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1528         /* We can't send beacons with short preamble. Would get PHY errors. */
1529         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1530         ctl &= ~B43_TXH_PHY_ANT;
1531         ctl &= ~B43_TXH_PHY_ENC;
1532         ctl |= antenna;
1533         if (b43_is_cck_rate(rate))
1534                 ctl |= B43_TXH_PHY_ENC_CCK;
1535         else
1536                 ctl |= B43_TXH_PHY_ENC_OFDM;
1537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1538
1539         /* Find the position of the TIM and the DTIM_period value
1540          * and write them to SHM. */
1541         ie = bcn->u.beacon.variable;
1542         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1543         for (i = 0; i < variable_len - 2; ) {
1544                 uint8_t ie_id, ie_len;
1545
1546                 ie_id = ie[i];
1547                 ie_len = ie[i + 1];
1548                 if (ie_id == 5) {
1549                         u16 tim_position;
1550                         u16 dtim_period;
1551                         /* This is the TIM Information Element */
1552
1553                         /* Check whether the ie_len is in the beacon data range. */
1554                         if (variable_len < ie_len + 2 + i)
1555                                 break;
1556                         /* A valid TIM is at least 4 bytes long. */
1557                         if (ie_len < 4)
1558                                 break;
1559                         tim_found = 1;
1560
1561                         tim_position = sizeof(struct b43_plcp_hdr6);
1562                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1563                         tim_position += i;
1564
1565                         dtim_period = ie[i + 3];
1566
1567                         b43_shm_write16(dev, B43_SHM_SHARED,
1568                                         B43_SHM_SH_TIMBPOS, tim_position);
1569                         b43_shm_write16(dev, B43_SHM_SHARED,
1570                                         B43_SHM_SH_DTIMPER, dtim_period);
1571                         break;
1572                 }
1573                 i += ie_len + 2;
1574         }
1575         if (!tim_found) {
1576                 /*
1577                  * If ucode wants to modify TIM do it behind the beacon, this
1578                  * will happen, for example, when doing mesh networking.
1579                  */
1580                 b43_shm_write16(dev, B43_SHM_SHARED,
1581                                 B43_SHM_SH_TIMBPOS,
1582                                 len + sizeof(struct b43_plcp_hdr6));
1583                 b43_shm_write16(dev, B43_SHM_SHARED,
1584                                 B43_SHM_SH_DTIMPER, 0);
1585         }
1586         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1587 }
1588
1589 static void b43_upload_beacon0(struct b43_wldev *dev)
1590 {
1591         struct b43_wl *wl = dev->wl;
1592
1593         if (wl->beacon0_uploaded)
1594                 return;
1595         b43_write_beacon_template(dev, 0x68, 0x18);
1596         wl->beacon0_uploaded = 1;
1597 }
1598
1599 static void b43_upload_beacon1(struct b43_wldev *dev)
1600 {
1601         struct b43_wl *wl = dev->wl;
1602
1603         if (wl->beacon1_uploaded)
1604                 return;
1605         b43_write_beacon_template(dev, 0x468, 0x1A);
1606         wl->beacon1_uploaded = 1;
1607 }
1608
1609 static void handle_irq_beacon(struct b43_wldev *dev)
1610 {
1611         struct b43_wl *wl = dev->wl;
1612         u32 cmd, beacon0_valid, beacon1_valid;
1613
1614         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1615             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1616                 return;
1617
1618         /* This is the bottom half of the asynchronous beacon update. */
1619
1620         /* Ignore interrupt in the future. */
1621         dev->irq_mask &= ~B43_IRQ_BEACON;
1622
1623         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1624         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1625         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1626
1627         /* Schedule interrupt manually, if busy. */
1628         if (beacon0_valid && beacon1_valid) {
1629                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1630                 dev->irq_mask |= B43_IRQ_BEACON;
1631                 return;
1632         }
1633
1634         if (unlikely(wl->beacon_templates_virgin)) {
1635                 /* We never uploaded a beacon before.
1636                  * Upload both templates now, but only mark one valid. */
1637                 wl->beacon_templates_virgin = 0;
1638                 b43_upload_beacon0(dev);
1639                 b43_upload_beacon1(dev);
1640                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1641                 cmd |= B43_MACCMD_BEACON0_VALID;
1642                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1643         } else {
1644                 if (!beacon0_valid) {
1645                         b43_upload_beacon0(dev);
1646                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1647                         cmd |= B43_MACCMD_BEACON0_VALID;
1648                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1649                 } else if (!beacon1_valid) {
1650                         b43_upload_beacon1(dev);
1651                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1652                         cmd |= B43_MACCMD_BEACON1_VALID;
1653                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1654                 }
1655         }
1656 }
1657
1658 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1659 {
1660         u32 old_irq_mask = dev->irq_mask;
1661
1662         /* update beacon right away or defer to irq */
1663         handle_irq_beacon(dev);
1664         if (old_irq_mask != dev->irq_mask) {
1665                 /* The handler updated the IRQ mask. */
1666                 B43_WARN_ON(!dev->irq_mask);
1667                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1668                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1669                 } else {
1670                         /* Device interrupts are currently disabled. That means
1671                          * we just ran the hardirq handler and scheduled the
1672                          * IRQ thread. The thread will write the IRQ mask when
1673                          * it finished, so there's nothing to do here. Writing
1674                          * the mask _here_ would incorrectly re-enable IRQs. */
1675                 }
1676         }
1677 }
1678
1679 static void b43_beacon_update_trigger_work(struct work_struct *work)
1680 {
1681         struct b43_wl *wl = container_of(work, struct b43_wl,
1682                                          beacon_update_trigger);
1683         struct b43_wldev *dev;
1684
1685         mutex_lock(&wl->mutex);
1686         dev = wl->current_dev;
1687         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1688                 if (b43_bus_host_is_sdio(dev->dev)) {
1689                         /* wl->mutex is enough. */
1690                         b43_do_beacon_update_trigger_work(dev);
1691                         mmiowb();
1692                 } else {
1693                         spin_lock_irq(&wl->hardirq_lock);
1694                         b43_do_beacon_update_trigger_work(dev);
1695                         mmiowb();
1696                         spin_unlock_irq(&wl->hardirq_lock);
1697                 }
1698         }
1699         mutex_unlock(&wl->mutex);
1700 }
1701
1702 /* Asynchronously update the packet templates in template RAM.
1703  * Locking: Requires wl->mutex to be locked. */
1704 static void b43_update_templates(struct b43_wl *wl)
1705 {
1706         struct sk_buff *beacon;
1707
1708         /* This is the top half of the ansynchronous beacon update.
1709          * The bottom half is the beacon IRQ.
1710          * Beacon update must be asynchronous to avoid sending an
1711          * invalid beacon. This can happen for example, if the firmware
1712          * transmits a beacon while we are updating it. */
1713
1714         /* We could modify the existing beacon and set the aid bit in
1715          * the TIM field, but that would probably require resizing and
1716          * moving of data within the beacon template.
1717          * Simply request a new beacon and let mac80211 do the hard work. */
1718         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1719         if (unlikely(!beacon))
1720                 return;
1721
1722         if (wl->current_beacon)
1723                 dev_kfree_skb_any(wl->current_beacon);
1724         wl->current_beacon = beacon;
1725         wl->beacon0_uploaded = 0;
1726         wl->beacon1_uploaded = 0;
1727         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1728 }
1729
1730 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1731 {
1732         b43_time_lock(dev);
1733         if (dev->dev->core_rev >= 3) {
1734                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1735                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1736         } else {
1737                 b43_write16(dev, 0x606, (beacon_int >> 6));
1738                 b43_write16(dev, 0x610, beacon_int);
1739         }
1740         b43_time_unlock(dev);
1741         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1742 }
1743
1744 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1745 {
1746         u16 reason;
1747
1748         /* Read the register that contains the reason code for the panic. */
1749         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1750         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1751
1752         switch (reason) {
1753         default:
1754                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1755                 /* fallthrough */
1756         case B43_FWPANIC_DIE:
1757                 /* Do not restart the controller or firmware.
1758                  * The device is nonfunctional from now on.
1759                  * Restarting would result in this panic to trigger again,
1760                  * so we avoid that recursion. */
1761                 break;
1762         case B43_FWPANIC_RESTART:
1763                 b43_controller_restart(dev, "Microcode panic");
1764                 break;
1765         }
1766 }
1767
1768 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1769 {
1770         unsigned int i, cnt;
1771         u16 reason, marker_id, marker_line;
1772         __le16 *buf;
1773
1774         /* The proprietary firmware doesn't have this IRQ. */
1775         if (!dev->fw.opensource)
1776                 return;
1777
1778         /* Read the register that contains the reason code for this IRQ. */
1779         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1780
1781         switch (reason) {
1782         case B43_DEBUGIRQ_PANIC:
1783                 b43_handle_firmware_panic(dev);
1784                 break;
1785         case B43_DEBUGIRQ_DUMP_SHM:
1786                 if (!B43_DEBUG)
1787                         break; /* Only with driver debugging enabled. */
1788                 buf = kmalloc(4096, GFP_ATOMIC);
1789                 if (!buf) {
1790                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1791                         goto out;
1792                 }
1793                 for (i = 0; i < 4096; i += 2) {
1794                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1795                         buf[i / 2] = cpu_to_le16(tmp);
1796                 }
1797                 b43info(dev->wl, "Shared memory dump:\n");
1798                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1799                                16, 2, buf, 4096, 1);
1800                 kfree(buf);
1801                 break;
1802         case B43_DEBUGIRQ_DUMP_REGS:
1803                 if (!B43_DEBUG)
1804                         break; /* Only with driver debugging enabled. */
1805                 b43info(dev->wl, "Microcode register dump:\n");
1806                 for (i = 0, cnt = 0; i < 64; i++) {
1807                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1808                         if (cnt == 0)
1809                                 printk(KERN_INFO);
1810                         printk("r%02u: 0x%04X  ", i, tmp);
1811                         cnt++;
1812                         if (cnt == 6) {
1813                                 printk("\n");
1814                                 cnt = 0;
1815                         }
1816                 }
1817                 printk("\n");
1818                 break;
1819         case B43_DEBUGIRQ_MARKER:
1820                 if (!B43_DEBUG)
1821                         break; /* Only with driver debugging enabled. */
1822                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1823                                            B43_MARKER_ID_REG);
1824                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1825                                              B43_MARKER_LINE_REG);
1826                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1827                         "at line number %u\n",
1828                         marker_id, marker_line);
1829                 break;
1830         default:
1831                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1832                        reason);
1833         }
1834 out:
1835         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1836         b43_shm_write16(dev, B43_SHM_SCRATCH,
1837                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1838 }
1839
1840 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1841 {
1842         u32 reason;
1843         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1844         u32 merged_dma_reason = 0;
1845         int i;
1846
1847         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1848                 return;
1849
1850         reason = dev->irq_reason;
1851         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1852                 dma_reason[i] = dev->dma_reason[i];
1853                 merged_dma_reason |= dma_reason[i];
1854         }
1855
1856         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1857                 b43err(dev->wl, "MAC transmission error\n");
1858
1859         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1860                 b43err(dev->wl, "PHY transmission error\n");
1861                 rmb();
1862                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1863                         atomic_set(&dev->phy.txerr_cnt,
1864                                    B43_PHY_TX_BADNESS_LIMIT);
1865                         b43err(dev->wl, "Too many PHY TX errors, "
1866                                         "restarting the controller\n");
1867                         b43_controller_restart(dev, "PHY TX errors");
1868                 }
1869         }
1870
1871         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1872                                           B43_DMAIRQ_NONFATALMASK))) {
1873                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1874                         b43err(dev->wl, "Fatal DMA error: "
1875                                "0x%08X, 0x%08X, 0x%08X, "
1876                                "0x%08X, 0x%08X, 0x%08X\n",
1877                                dma_reason[0], dma_reason[1],
1878                                dma_reason[2], dma_reason[3],
1879                                dma_reason[4], dma_reason[5]);
1880                         b43err(dev->wl, "This device does not support DMA "
1881                                "on your system. It will now be switched to PIO.\n");
1882                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1883                         dev->use_pio = 1;
1884                         b43_controller_restart(dev, "DMA error");
1885                         return;
1886                 }
1887                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1888                         b43err(dev->wl, "DMA error: "
1889                                "0x%08X, 0x%08X, 0x%08X, "
1890                                "0x%08X, 0x%08X, 0x%08X\n",
1891                                dma_reason[0], dma_reason[1],
1892                                dma_reason[2], dma_reason[3],
1893                                dma_reason[4], dma_reason[5]);
1894                 }
1895         }
1896
1897         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1898                 handle_irq_ucode_debug(dev);
1899         if (reason & B43_IRQ_TBTT_INDI)
1900                 handle_irq_tbtt_indication(dev);
1901         if (reason & B43_IRQ_ATIM_END)
1902                 handle_irq_atim_end(dev);
1903         if (reason & B43_IRQ_BEACON)
1904                 handle_irq_beacon(dev);
1905         if (reason & B43_IRQ_PMQ)
1906                 handle_irq_pmq(dev);
1907         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1908                 ;/* TODO */
1909         if (reason & B43_IRQ_NOISESAMPLE_OK)
1910                 handle_irq_noise(dev);
1911
1912         /* Check the DMA reason registers for received data. */
1913         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1914                 if (b43_using_pio_transfers(dev))
1915                         b43_pio_rx(dev->pio.rx_queue);
1916                 else
1917                         b43_dma_rx(dev->dma.rx_ring);
1918         }
1919         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1920         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1921         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1922         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1923         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1924
1925         if (reason & B43_IRQ_TX_OK)
1926                 handle_irq_transmit_status(dev);
1927
1928         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1929         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1930
1931 #if B43_DEBUG
1932         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1933                 dev->irq_count++;
1934                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1935                         if (reason & (1 << i))
1936                                 dev->irq_bit_count[i]++;
1937                 }
1938         }
1939 #endif
1940 }
1941
1942 /* Interrupt thread handler. Handles device interrupts in thread context. */
1943 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1944 {
1945         struct b43_wldev *dev = dev_id;
1946
1947         mutex_lock(&dev->wl->mutex);
1948         b43_do_interrupt_thread(dev);
1949         mmiowb();
1950         mutex_unlock(&dev->wl->mutex);
1951
1952         return IRQ_HANDLED;
1953 }
1954
1955 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1956 {
1957         u32 reason;
1958
1959         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1960          * On SDIO, this runs under wl->mutex. */
1961
1962         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1963         if (reason == 0xffffffff)       /* shared IRQ */
1964                 return IRQ_NONE;
1965         reason &= dev->irq_mask;
1966         if (!reason)
1967                 return IRQ_HANDLED;
1968
1969         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1970             & 0x0001DC00;
1971         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1972             & 0x0000DC00;
1973         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1974             & 0x0000DC00;
1975         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1976             & 0x0001DC00;
1977         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1978             & 0x0000DC00;
1979 /* Unused ring
1980         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1981             & 0x0000DC00;
1982 */
1983
1984         /* ACK the interrupt. */
1985         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1986         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1987         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1988         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1989         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1990         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1991 /* Unused ring
1992         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1993 */
1994
1995         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1996         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1997         /* Save the reason bitmasks for the IRQ thread handler. */
1998         dev->irq_reason = reason;
1999
2000         return IRQ_WAKE_THREAD;
2001 }
2002
2003 /* Interrupt handler top-half. This runs with interrupts disabled. */
2004 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2005 {
2006         struct b43_wldev *dev = dev_id;
2007         irqreturn_t ret;
2008
2009         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2010                 return IRQ_NONE;
2011
2012         spin_lock(&dev->wl->hardirq_lock);
2013         ret = b43_do_interrupt(dev);
2014         mmiowb();
2015         spin_unlock(&dev->wl->hardirq_lock);
2016
2017         return ret;
2018 }
2019
2020 /* SDIO interrupt handler. This runs in process context. */
2021 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2022 {
2023         struct b43_wl *wl = dev->wl;
2024         irqreturn_t ret;
2025
2026         mutex_lock(&wl->mutex);
2027
2028         ret = b43_do_interrupt(dev);
2029         if (ret == IRQ_WAKE_THREAD)
2030                 b43_do_interrupt_thread(dev);
2031
2032         mutex_unlock(&wl->mutex);
2033 }
2034
2035 void b43_do_release_fw(struct b43_firmware_file *fw)
2036 {
2037         release_firmware(fw->data);
2038         fw->data = NULL;
2039         fw->filename = NULL;
2040 }
2041
2042 static void b43_release_firmware(struct b43_wldev *dev)
2043 {
2044         b43_do_release_fw(&dev->fw.ucode);
2045         b43_do_release_fw(&dev->fw.pcm);
2046         b43_do_release_fw(&dev->fw.initvals);
2047         b43_do_release_fw(&dev->fw.initvals_band);
2048 }
2049
2050 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2051 {
2052         const char text[] =
2053                 "You must go to " \
2054                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2055                 "and download the correct firmware for this driver version. " \
2056                 "Please carefully read all instructions on this website.\n";
2057
2058         if (error)
2059                 b43err(wl, text);
2060         else
2061                 b43warn(wl, text);
2062 }
2063
2064 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2065                       const char *name,
2066                       struct b43_firmware_file *fw)
2067 {
2068         const struct firmware *blob;
2069         struct b43_fw_header *hdr;
2070         u32 size;
2071         int err;
2072
2073         if (!name) {
2074                 /* Don't fetch anything. Free possibly cached firmware. */
2075                 /* FIXME: We should probably keep it anyway, to save some headache
2076                  * on suspend/resume with multiband devices. */
2077                 b43_do_release_fw(fw);
2078                 return 0;
2079         }
2080         if (fw->filename) {
2081                 if ((fw->type == ctx->req_type) &&
2082                     (strcmp(fw->filename, name) == 0))
2083                         return 0; /* Already have this fw. */
2084                 /* Free the cached firmware first. */
2085                 /* FIXME: We should probably do this later after we successfully
2086                  * got the new fw. This could reduce headache with multiband devices.
2087                  * We could also redesign this to cache the firmware for all possible
2088                  * bands all the time. */
2089                 b43_do_release_fw(fw);
2090         }
2091
2092         switch (ctx->req_type) {
2093         case B43_FWTYPE_PROPRIETARY:
2094                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2095                          "b43%s/%s.fw",
2096                          modparam_fwpostfix, name);
2097                 break;
2098         case B43_FWTYPE_OPENSOURCE:
2099                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2100                          "b43-open%s/%s.fw",
2101                          modparam_fwpostfix, name);
2102                 break;
2103         default:
2104                 B43_WARN_ON(1);
2105                 return -ENOSYS;
2106         }
2107         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2108         if (err == -ENOENT) {
2109                 snprintf(ctx->errors[ctx->req_type],
2110                          sizeof(ctx->errors[ctx->req_type]),
2111                          "Firmware file \"%s\" not found\n", ctx->fwname);
2112                 return err;
2113         } else if (err) {
2114                 snprintf(ctx->errors[ctx->req_type],
2115                          sizeof(ctx->errors[ctx->req_type]),
2116                          "Firmware file \"%s\" request failed (err=%d)\n",
2117                          ctx->fwname, err);
2118                 return err;
2119         }
2120         if (blob->size < sizeof(struct b43_fw_header))
2121                 goto err_format;
2122         hdr = (struct b43_fw_header *)(blob->data);
2123         switch (hdr->type) {
2124         case B43_FW_TYPE_UCODE:
2125         case B43_FW_TYPE_PCM:
2126                 size = be32_to_cpu(hdr->size);
2127                 if (size != blob->size - sizeof(struct b43_fw_header))
2128                         goto err_format;
2129                 /* fallthrough */
2130         case B43_FW_TYPE_IV:
2131                 if (hdr->ver != 1)
2132                         goto err_format;
2133                 break;
2134         default:
2135                 goto err_format;
2136         }
2137
2138         fw->data = blob;
2139         fw->filename = name;
2140         fw->type = ctx->req_type;
2141
2142         return 0;
2143
2144 err_format:
2145         snprintf(ctx->errors[ctx->req_type],
2146                  sizeof(ctx->errors[ctx->req_type]),
2147                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2148         release_firmware(blob);
2149
2150         return -EPROTO;
2151 }
2152
2153 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2154 {
2155         struct b43_wldev *dev = ctx->dev;
2156         struct b43_firmware *fw = &ctx->dev->fw;
2157         const u8 rev = ctx->dev->dev->core_rev;
2158         const char *filename;
2159         u32 tmshigh;
2160         int err;
2161
2162         /* Get microcode */
2163         if ((rev >= 5) && (rev <= 10)) {
2164                 filename = "ucode5";
2165         } else if ((rev >= 11) && (rev <= 12)) {
2166                 filename = "ucode11";
2167         } else if (rev == 13) {
2168                 filename = "ucode13";
2169         } else if (rev == 14) {
2170                 filename = "ucode14";
2171         } else if (rev == 15) {
2172                 filename = "ucode15";
2173         } else {
2174                 switch (dev->phy.type) {
2175                 case B43_PHYTYPE_N:
2176                         if (rev >= 16)
2177                                 filename = "ucode16_mimo";
2178                         else
2179                                 goto err_no_ucode;
2180                         break;
2181                 default:
2182                         goto err_no_ucode;
2183                 }
2184         }
2185         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2186         if (err)
2187                 goto err_load;
2188
2189         /* Get PCM code */
2190         if ((rev >= 5) && (rev <= 10))
2191                 filename = "pcm5";
2192         else if (rev >= 11)
2193                 filename = NULL;
2194         else
2195                 goto err_no_pcm;
2196         fw->pcm_request_failed = 0;
2197         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2198         if (err == -ENOENT) {
2199                 /* We did not find a PCM file? Not fatal, but
2200                  * core rev <= 10 must do without hwcrypto then. */
2201                 fw->pcm_request_failed = 1;
2202         } else if (err)
2203                 goto err_load;
2204
2205         /* Get initvals */
2206         switch (dev->phy.type) {
2207         case B43_PHYTYPE_A:
2208                 if ((rev >= 5) && (rev <= 10)) {
2209                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2210                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2211                                 filename = "a0g1initvals5";
2212                         else
2213                                 filename = "a0g0initvals5";
2214                 } else
2215                         goto err_no_initvals;
2216                 break;
2217         case B43_PHYTYPE_G:
2218                 if ((rev >= 5) && (rev <= 10))
2219                         filename = "b0g0initvals5";
2220                 else if (rev >= 13)
2221                         filename = "b0g0initvals13";
2222                 else
2223                         goto err_no_initvals;
2224                 break;
2225         case B43_PHYTYPE_N:
2226                 if (rev >= 16)
2227                         filename = "n0initvals16";
2228                 else if ((rev >= 11) && (rev <= 12))
2229                         filename = "n0initvals11";
2230                 else
2231                         goto err_no_initvals;
2232                 break;
2233         case B43_PHYTYPE_LP:
2234                 if (rev == 13)
2235                         filename = "lp0initvals13";
2236                 else if (rev == 14)
2237                         filename = "lp0initvals14";
2238                 else if (rev >= 15)
2239                         filename = "lp0initvals15";
2240                 else
2241                         goto err_no_initvals;
2242                 break;
2243         default:
2244                 goto err_no_initvals;
2245         }
2246         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2247         if (err)
2248                 goto err_load;
2249
2250         /* Get bandswitch initvals */
2251         switch (dev->phy.type) {
2252         case B43_PHYTYPE_A:
2253                 if ((rev >= 5) && (rev <= 10)) {
2254                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2255                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2256                                 filename = "a0g1bsinitvals5";
2257                         else
2258                                 filename = "a0g0bsinitvals5";
2259                 } else if (rev >= 11)
2260                         filename = NULL;
2261                 else
2262                         goto err_no_initvals;
2263                 break;
2264         case B43_PHYTYPE_G:
2265                 if ((rev >= 5) && (rev <= 10))
2266                         filename = "b0g0bsinitvals5";
2267                 else if (rev >= 11)
2268                         filename = NULL;
2269                 else
2270                         goto err_no_initvals;
2271                 break;
2272         case B43_PHYTYPE_N:
2273                 if (rev >= 16)
2274                         filename = "n0bsinitvals16";
2275                 else if ((rev >= 11) && (rev <= 12))
2276                         filename = "n0bsinitvals11";
2277                 else
2278                         goto err_no_initvals;
2279                 break;
2280         case B43_PHYTYPE_LP:
2281                 if (rev == 13)
2282                         filename = "lp0bsinitvals13";
2283                 else if (rev == 14)
2284                         filename = "lp0bsinitvals14";
2285                 else if (rev >= 15)
2286                         filename = "lp0bsinitvals15";
2287                 else
2288                         goto err_no_initvals;
2289                 break;
2290         default:
2291                 goto err_no_initvals;
2292         }
2293         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2294         if (err)
2295                 goto err_load;
2296
2297         return 0;
2298
2299 err_no_ucode:
2300         err = ctx->fatal_failure = -EOPNOTSUPP;
2301         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2302                "is required for your device (wl-core rev %u)\n", rev);
2303         goto error;
2304
2305 err_no_pcm:
2306         err = ctx->fatal_failure = -EOPNOTSUPP;
2307         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2308                "is required for your device (wl-core rev %u)\n", rev);
2309         goto error;
2310
2311 err_no_initvals:
2312         err = ctx->fatal_failure = -EOPNOTSUPP;
2313         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2314                "is required for your device (wl-core rev %u)\n", rev);
2315         goto error;
2316
2317 err_load:
2318         /* We failed to load this firmware image. The error message
2319          * already is in ctx->errors. Return and let our caller decide
2320          * what to do. */
2321         goto error;
2322
2323 error:
2324         b43_release_firmware(dev);
2325         return err;
2326 }
2327
2328 static int b43_request_firmware(struct b43_wldev *dev)
2329 {
2330         struct b43_request_fw_context *ctx;
2331         unsigned int i;
2332         int err;
2333         const char *errmsg;
2334
2335         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2336         if (!ctx)
2337                 return -ENOMEM;
2338         ctx->dev = dev;
2339
2340         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2341         err = b43_try_request_fw(ctx);
2342         if (!err)
2343                 goto out; /* Successfully loaded it. */
2344         err = ctx->fatal_failure;
2345         if (err)
2346                 goto out;
2347
2348         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2349         err = b43_try_request_fw(ctx);
2350         if (!err)
2351                 goto out; /* Successfully loaded it. */
2352         err = ctx->fatal_failure;
2353         if (err)
2354                 goto out;
2355
2356         /* Could not find a usable firmware. Print the errors. */
2357         for (i = 0; i < B43_NR_FWTYPES; i++) {
2358                 errmsg = ctx->errors[i];
2359                 if (strlen(errmsg))
2360                         b43err(dev->wl, errmsg);
2361         }
2362         b43_print_fw_helptext(dev->wl, 1);
2363         err = -ENOENT;
2364
2365 out:
2366         kfree(ctx);
2367         return err;
2368 }
2369
2370 static int b43_upload_microcode(struct b43_wldev *dev)
2371 {
2372         struct wiphy *wiphy = dev->wl->hw->wiphy;
2373         const size_t hdr_len = sizeof(struct b43_fw_header);
2374         const __be32 *data;
2375         unsigned int i, len;
2376         u16 fwrev, fwpatch, fwdate, fwtime;
2377         u32 tmp, macctl;
2378         int err = 0;
2379
2380         /* Jump the microcode PSM to offset 0 */
2381         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2382         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2383         macctl |= B43_MACCTL_PSM_JMP0;
2384         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2385         /* Zero out all microcode PSM registers and shared memory. */
2386         for (i = 0; i < 64; i++)
2387                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2388         for (i = 0; i < 4096; i += 2)
2389                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2390
2391         /* Upload Microcode. */
2392         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2393         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2394         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2395         for (i = 0; i < len; i++) {
2396                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2397                 udelay(10);
2398         }
2399
2400         if (dev->fw.pcm.data) {
2401                 /* Upload PCM data. */
2402                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2403                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2404                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2405                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2406                 /* No need for autoinc bit in SHM_HW */
2407                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2408                 for (i = 0; i < len; i++) {
2409                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2410                         udelay(10);
2411                 }
2412         }
2413
2414         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2415
2416         /* Start the microcode PSM */
2417         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2418         macctl &= ~B43_MACCTL_PSM_JMP0;
2419         macctl |= B43_MACCTL_PSM_RUN;
2420         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2421
2422         /* Wait for the microcode to load and respond */
2423         i = 0;
2424         while (1) {
2425                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2426                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2427                         break;
2428                 i++;
2429                 if (i >= 20) {
2430                         b43err(dev->wl, "Microcode not responding\n");
2431                         b43_print_fw_helptext(dev->wl, 1);
2432                         err = -ENODEV;
2433                         goto error;
2434                 }
2435                 msleep(50);
2436         }
2437         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2438
2439         /* Get and check the revisions. */
2440         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2441         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2442         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2443         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2444
2445         if (fwrev <= 0x128) {
2446                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2447                        "binary drivers older than version 4.x is unsupported. "
2448                        "You must upgrade your firmware files.\n");
2449                 b43_print_fw_helptext(dev->wl, 1);
2450                 err = -EOPNOTSUPP;
2451                 goto error;
2452         }
2453         dev->fw.rev = fwrev;
2454         dev->fw.patch = fwpatch;
2455         dev->fw.opensource = (fwdate == 0xFFFF);
2456
2457         /* Default to use-all-queues. */
2458         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2459         dev->qos_enabled = !!modparam_qos;
2460         /* Default to firmware/hardware crypto acceleration. */
2461         dev->hwcrypto_enabled = 1;
2462
2463         if (dev->fw.opensource) {
2464                 u16 fwcapa;
2465
2466                 /* Patchlevel info is encoded in the "time" field. */
2467                 dev->fw.patch = fwtime;
2468                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2469                         dev->fw.rev, dev->fw.patch);
2470
2471                 fwcapa = b43_fwcapa_read(dev);
2472                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2473                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2474                         /* Disable hardware crypto and fall back to software crypto. */
2475                         dev->hwcrypto_enabled = 0;
2476                 }
2477                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2478                         b43info(dev->wl, "QoS not supported by firmware\n");
2479                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2480                          * ieee80211_unregister to make sure the networking core can
2481                          * properly free possible resources. */
2482                         dev->wl->hw->queues = 1;
2483                         dev->qos_enabled = 0;
2484                 }
2485         } else {
2486                 b43info(dev->wl, "Loading firmware version %u.%u "
2487                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2488                         fwrev, fwpatch,
2489                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2490                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2491                 if (dev->fw.pcm_request_failed) {
2492                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2493                                 "Hardware accelerated cryptography is disabled.\n");
2494                         b43_print_fw_helptext(dev->wl, 0);
2495                 }
2496         }
2497
2498         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2499                         dev->fw.rev, dev->fw.patch);
2500         wiphy->hw_version = dev->dev->core_id;
2501
2502         if (b43_is_old_txhdr_format(dev)) {
2503                 /* We're over the deadline, but we keep support for old fw
2504                  * until it turns out to be in major conflict with something new. */
2505                 b43warn(dev->wl, "You are using an old firmware image. "
2506                         "Support for old firmware will be removed soon "
2507                         "(official deadline was July 2008).\n");
2508                 b43_print_fw_helptext(dev->wl, 0);
2509         }
2510
2511         return 0;
2512
2513 error:
2514         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2515         macctl &= ~B43_MACCTL_PSM_RUN;
2516         macctl |= B43_MACCTL_PSM_JMP0;
2517         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2518
2519         return err;
2520 }
2521
2522 static int b43_write_initvals(struct b43_wldev *dev,
2523                               const struct b43_iv *ivals,
2524                               size_t count,
2525                               size_t array_size)
2526 {
2527         const struct b43_iv *iv;
2528         u16 offset;
2529         size_t i;
2530         bool bit32;
2531
2532         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2533         iv = ivals;
2534         for (i = 0; i < count; i++) {
2535                 if (array_size < sizeof(iv->offset_size))
2536                         goto err_format;
2537                 array_size -= sizeof(iv->offset_size);
2538                 offset = be16_to_cpu(iv->offset_size);
2539                 bit32 = !!(offset & B43_IV_32BIT);
2540                 offset &= B43_IV_OFFSET_MASK;
2541                 if (offset >= 0x1000)
2542                         goto err_format;
2543                 if (bit32) {
2544                         u32 value;
2545
2546                         if (array_size < sizeof(iv->data.d32))
2547                                 goto err_format;
2548                         array_size -= sizeof(iv->data.d32);
2549
2550                         value = get_unaligned_be32(&iv->data.d32);
2551                         b43_write32(dev, offset, value);
2552
2553                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2554                                                         sizeof(__be16) +
2555                                                         sizeof(__be32));
2556                 } else {
2557                         u16 value;
2558
2559                         if (array_size < sizeof(iv->data.d16))
2560                                 goto err_format;
2561                         array_size -= sizeof(iv->data.d16);
2562
2563                         value = be16_to_cpu(iv->data.d16);
2564                         b43_write16(dev, offset, value);
2565
2566                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2567                                                         sizeof(__be16) +
2568                                                         sizeof(__be16));
2569                 }
2570         }
2571         if (array_size)
2572                 goto err_format;
2573
2574         return 0;
2575
2576 err_format:
2577         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2578         b43_print_fw_helptext(dev->wl, 1);
2579
2580         return -EPROTO;
2581 }
2582
2583 static int b43_upload_initvals(struct b43_wldev *dev)
2584 {
2585         const size_t hdr_len = sizeof(struct b43_fw_header);
2586         const struct b43_fw_header *hdr;
2587         struct b43_firmware *fw = &dev->fw;
2588         const struct b43_iv *ivals;
2589         size_t count;
2590         int err;
2591
2592         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2593         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2594         count = be32_to_cpu(hdr->size);
2595         err = b43_write_initvals(dev, ivals, count,
2596                                  fw->initvals.data->size - hdr_len);
2597         if (err)
2598                 goto out;
2599         if (fw->initvals_band.data) {
2600                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2601                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2602                 count = be32_to_cpu(hdr->size);
2603                 err = b43_write_initvals(dev, ivals, count,
2604                                          fw->initvals_band.data->size - hdr_len);
2605                 if (err)
2606                         goto out;
2607         }
2608 out:
2609
2610         return err;
2611 }
2612
2613 /* Initialize the GPIOs
2614  * http://bcm-specs.sipsolutions.net/GPIO
2615  */
2616 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2617 {
2618         struct ssb_bus *bus = dev->dev->sdev->bus;
2619
2620 #ifdef CONFIG_SSB_DRIVER_PCICORE
2621         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2622 #else
2623         return bus->chipco.dev;
2624 #endif
2625 }
2626
2627 static int b43_gpio_init(struct b43_wldev *dev)
2628 {
2629         struct ssb_device *gpiodev;
2630         u32 mask, set;
2631
2632         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2633                     & ~B43_MACCTL_GPOUTSMSK);
2634
2635         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2636                     | 0x000F);
2637
2638         mask = 0x0000001F;
2639         set = 0x0000000F;
2640         if (dev->dev->chip_id == 0x4301) {
2641                 mask |= 0x0060;
2642                 set |= 0x0060;
2643         }
2644         if (0 /* FIXME: conditional unknown */ ) {
2645                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2646                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2647                             | 0x0100);
2648                 mask |= 0x0180;
2649                 set |= 0x0180;
2650         }
2651         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2652                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2653                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2654                             | 0x0200);
2655                 mask |= 0x0200;
2656                 set |= 0x0200;
2657         }
2658         if (dev->dev->core_rev >= 2)
2659                 mask |= 0x0010; /* FIXME: This is redundant. */
2660
2661         switch (dev->dev->bus_type) {
2662 #ifdef CONFIG_B43_BCMA
2663         case B43_BUS_BCMA:
2664                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2665                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2666                                         BCMA_CC_GPIOCTL) & mask) | set);
2667                 break;
2668 #endif
2669 #ifdef CONFIG_B43_SSB
2670         case B43_BUS_SSB:
2671                 gpiodev = b43_ssb_gpio_dev(dev);
2672                 if (gpiodev)
2673                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2674                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2675                                     & mask) | set);
2676                 break;
2677 #endif
2678         }
2679
2680         return 0;
2681 }
2682
2683 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2684 static void b43_gpio_cleanup(struct b43_wldev *dev)
2685 {
2686         struct ssb_device *gpiodev;
2687
2688         switch (dev->dev->bus_type) {
2689 #ifdef CONFIG_B43_BCMA
2690         case B43_BUS_BCMA:
2691                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2692                                 0);
2693                 break;
2694 #endif
2695 #ifdef CONFIG_B43_SSB
2696         case B43_BUS_SSB:
2697                 gpiodev = b43_ssb_gpio_dev(dev);
2698                 if (gpiodev)
2699                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2700                 break;
2701 #endif
2702         }
2703 }
2704
2705 /* http://bcm-specs.sipsolutions.net/EnableMac */
2706 void b43_mac_enable(struct b43_wldev *dev)
2707 {
2708         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2709                 u16 fwstate;
2710
2711                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2712                                          B43_SHM_SH_UCODESTAT);
2713                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2714                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2715                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2716                                "should be suspended, but current state is %u\n",
2717                                fwstate);
2718                 }
2719         }
2720
2721         dev->mac_suspended--;
2722         B43_WARN_ON(dev->mac_suspended < 0);
2723         if (dev->mac_suspended == 0) {
2724                 b43_write32(dev, B43_MMIO_MACCTL,
2725                             b43_read32(dev, B43_MMIO_MACCTL)
2726                             | B43_MACCTL_ENABLED);
2727                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2728                             B43_IRQ_MAC_SUSPENDED);
2729                 /* Commit writes */
2730                 b43_read32(dev, B43_MMIO_MACCTL);
2731                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2732                 b43_power_saving_ctl_bits(dev, 0);
2733         }
2734 }
2735
2736 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2737 void b43_mac_suspend(struct b43_wldev *dev)
2738 {
2739         int i;
2740         u32 tmp;
2741
2742         might_sleep();
2743         B43_WARN_ON(dev->mac_suspended < 0);
2744
2745         if (dev->mac_suspended == 0) {
2746                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2747                 b43_write32(dev, B43_MMIO_MACCTL,
2748                             b43_read32(dev, B43_MMIO_MACCTL)
2749                             & ~B43_MACCTL_ENABLED);
2750                 /* force pci to flush the write */
2751                 b43_read32(dev, B43_MMIO_MACCTL);
2752                 for (i = 35; i; i--) {
2753                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2754                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2755                                 goto out;
2756                         udelay(10);
2757                 }
2758                 /* Hm, it seems this will take some time. Use msleep(). */
2759                 for (i = 40; i; i--) {
2760                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2761                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2762                                 goto out;
2763                         msleep(1);
2764                 }
2765                 b43err(dev->wl, "MAC suspend failed\n");
2766         }
2767 out:
2768         dev->mac_suspended++;
2769 }
2770
2771 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2772 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2773 {
2774         u32 tmp;
2775
2776         switch (dev->dev->bus_type) {
2777 #ifdef CONFIG_B43_BCMA
2778         case B43_BUS_BCMA:
2779                 tmp = bcma_read32(dev->dev->bdev, BCMA_IOCTL);
2780                 if (on)
2781                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2782                 else
2783                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2784                 bcma_write32(dev->dev->bdev, BCMA_IOCTL, tmp);
2785                 break;
2786 #endif
2787 #ifdef CONFIG_B43_SSB
2788         case B43_BUS_SSB:
2789                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2790                 if (on)
2791                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2792                 else
2793                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2794                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2795                 break;
2796 #endif
2797         }
2798 }
2799
2800 static void b43_adjust_opmode(struct b43_wldev *dev)
2801 {
2802         struct b43_wl *wl = dev->wl;
2803         u32 ctl;
2804         u16 cfp_pretbtt;
2805
2806         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2807         /* Reset status to STA infrastructure mode. */
2808         ctl &= ~B43_MACCTL_AP;
2809         ctl &= ~B43_MACCTL_KEEP_CTL;
2810         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2811         ctl &= ~B43_MACCTL_KEEP_BAD;
2812         ctl &= ~B43_MACCTL_PROMISC;
2813         ctl &= ~B43_MACCTL_BEACPROMISC;
2814         ctl |= B43_MACCTL_INFRA;
2815
2816         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2817             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2818                 ctl |= B43_MACCTL_AP;
2819         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2820                 ctl &= ~B43_MACCTL_INFRA;
2821
2822         if (wl->filter_flags & FIF_CONTROL)
2823                 ctl |= B43_MACCTL_KEEP_CTL;
2824         if (wl->filter_flags & FIF_FCSFAIL)
2825                 ctl |= B43_MACCTL_KEEP_BAD;
2826         if (wl->filter_flags & FIF_PLCPFAIL)
2827                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2828         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2829                 ctl |= B43_MACCTL_PROMISC;
2830         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2831                 ctl |= B43_MACCTL_BEACPROMISC;
2832
2833         /* Workaround: On old hardware the HW-MAC-address-filter
2834          * doesn't work properly, so always run promisc in filter
2835          * it in software. */
2836         if (dev->dev->core_rev <= 4)
2837                 ctl |= B43_MACCTL_PROMISC;
2838
2839         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2840
2841         cfp_pretbtt = 2;
2842         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2843                 if (dev->dev->chip_id == 0x4306 &&
2844                     dev->dev->chip_rev == 3)
2845                         cfp_pretbtt = 100;
2846                 else
2847                         cfp_pretbtt = 50;
2848         }
2849         b43_write16(dev, 0x612, cfp_pretbtt);
2850
2851         /* FIXME: We don't currently implement the PMQ mechanism,
2852          *        so always disable it. If we want to implement PMQ,
2853          *        we need to enable it here (clear DISCPMQ) in AP mode.
2854          */
2855         if (0  /* ctl & B43_MACCTL_AP */) {
2856                 b43_write32(dev, B43_MMIO_MACCTL,
2857                             b43_read32(dev, B43_MMIO_MACCTL)
2858                             & ~B43_MACCTL_DISCPMQ);
2859         } else {
2860                 b43_write32(dev, B43_MMIO_MACCTL,
2861                             b43_read32(dev, B43_MMIO_MACCTL)
2862                             | B43_MACCTL_DISCPMQ);
2863         }
2864 }
2865
2866 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2867 {
2868         u16 offset;
2869
2870         if (is_ofdm) {
2871                 offset = 0x480;
2872                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2873         } else {
2874                 offset = 0x4C0;
2875                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2876         }
2877         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2878                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2879 }
2880
2881 static void b43_rate_memory_init(struct b43_wldev *dev)
2882 {
2883         switch (dev->phy.type) {
2884         case B43_PHYTYPE_A:
2885         case B43_PHYTYPE_G:
2886         case B43_PHYTYPE_N:
2887         case B43_PHYTYPE_LP:
2888                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2889                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2890                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2891                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2892                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2893                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2894                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2895                 if (dev->phy.type == B43_PHYTYPE_A)
2896                         break;
2897                 /* fallthrough */
2898         case B43_PHYTYPE_B:
2899                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2900                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2901                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2902                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2903                 break;
2904         default:
2905                 B43_WARN_ON(1);
2906         }
2907 }
2908
2909 /* Set the default values for the PHY TX Control Words. */
2910 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2911 {
2912         u16 ctl = 0;
2913
2914         ctl |= B43_TXH_PHY_ENC_CCK;
2915         ctl |= B43_TXH_PHY_ANT01AUTO;
2916         ctl |= B43_TXH_PHY_TXPWR;
2917
2918         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2919         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2920         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2921 }
2922
2923 /* Set the TX-Antenna for management frames sent by firmware. */
2924 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2925 {
2926         u16 ant;
2927         u16 tmp;
2928
2929         ant = b43_antenna_to_phyctl(antenna);
2930
2931         /* For ACK/CTS */
2932         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2933         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2934         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2935         /* For Probe Resposes */
2936         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2937         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2938         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2939 }
2940
2941 /* This is the opposite of b43_chip_init() */
2942 static void b43_chip_exit(struct b43_wldev *dev)
2943 {
2944         b43_phy_exit(dev);
2945         b43_gpio_cleanup(dev);
2946         /* firmware is released later */
2947 }
2948
2949 /* Initialize the chip
2950  * http://bcm-specs.sipsolutions.net/ChipInit
2951  */
2952 static int b43_chip_init(struct b43_wldev *dev)
2953 {
2954         struct b43_phy *phy = &dev->phy;
2955         int err;
2956         u32 macctl;
2957         u16 value16;
2958
2959         /* Initialize the MAC control */
2960         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2961         if (dev->phy.gmode)
2962                 macctl |= B43_MACCTL_GMODE;
2963         macctl |= B43_MACCTL_INFRA;
2964         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2965
2966         err = b43_request_firmware(dev);
2967         if (err)
2968                 goto out;
2969         err = b43_upload_microcode(dev);
2970         if (err)
2971                 goto out;       /* firmware is released later */
2972
2973         err = b43_gpio_init(dev);
2974         if (err)
2975                 goto out;       /* firmware is released later */
2976
2977         err = b43_upload_initvals(dev);
2978         if (err)
2979                 goto err_gpio_clean;
2980
2981         /* Turn the Analog on and initialize the PHY. */
2982         phy->ops->switch_analog(dev, 1);
2983         err = b43_phy_init(dev);
2984         if (err)
2985                 goto err_gpio_clean;
2986
2987         /* Disable Interference Mitigation. */
2988         if (phy->ops->interf_mitigation)
2989                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2990
2991         /* Select the antennae */
2992         if (phy->ops->set_rx_antenna)
2993                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2994         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2995
2996         if (phy->type == B43_PHYTYPE_B) {
2997                 value16 = b43_read16(dev, 0x005E);
2998                 value16 |= 0x0004;
2999                 b43_write16(dev, 0x005E, value16);
3000         }
3001         b43_write32(dev, 0x0100, 0x01000000);
3002         if (dev->dev->core_rev < 5)
3003                 b43_write32(dev, 0x010C, 0x01000000);
3004
3005         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3006                     & ~B43_MACCTL_INFRA);
3007         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3008                     | B43_MACCTL_INFRA);
3009
3010         /* Probe Response Timeout value */
3011         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3012         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3013
3014         /* Initially set the wireless operation mode. */
3015         b43_adjust_opmode(dev);
3016
3017         if (dev->dev->core_rev < 3) {
3018                 b43_write16(dev, 0x060E, 0x0000);
3019                 b43_write16(dev, 0x0610, 0x8000);
3020                 b43_write16(dev, 0x0604, 0x0000);
3021                 b43_write16(dev, 0x0606, 0x0200);
3022         } else {
3023                 b43_write32(dev, 0x0188, 0x80000000);
3024                 b43_write32(dev, 0x018C, 0x02000000);
3025         }
3026         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3027         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3028         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3029         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3030         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3031         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3032         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3033
3034         b43_mac_phy_clock_set(dev, true);
3035
3036         switch (dev->dev->bus_type) {
3037 #ifdef CONFIG_B43_BCMA
3038         case B43_BUS_BCMA:
3039                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3040                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3041                 break;
3042 #endif
3043 #ifdef CONFIG_B43_SSB
3044         case B43_BUS_SSB:
3045                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3046                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3047                 break;
3048 #endif
3049         }
3050
3051         err = 0;
3052         b43dbg(dev->wl, "Chip initialized\n");
3053 out:
3054         return err;
3055
3056 err_gpio_clean:
3057         b43_gpio_cleanup(dev);
3058         return err;
3059 }
3060
3061 static void b43_periodic_every60sec(struct b43_wldev *dev)
3062 {
3063         const struct b43_phy_operations *ops = dev->phy.ops;
3064
3065         if (ops->pwork_60sec)
3066                 ops->pwork_60sec(dev);
3067
3068         /* Force check the TX power emission now. */
3069         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3070 }
3071
3072 static void b43_periodic_every30sec(struct b43_wldev *dev)
3073 {
3074         /* Update device statistics. */
3075         b43_calculate_link_quality(dev);
3076 }
3077
3078 static void b43_periodic_every15sec(struct b43_wldev *dev)
3079 {
3080         struct b43_phy *phy = &dev->phy;
3081         u16 wdr;
3082
3083         if (dev->fw.opensource) {
3084                 /* Check if the firmware is still alive.
3085                  * It will reset the watchdog counter to 0 in its idle loop. */
3086                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3087                 if (unlikely(wdr)) {
3088                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3089                         b43_controller_restart(dev, "Firmware watchdog");
3090                         return;
3091                 } else {
3092                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3093                                         B43_WATCHDOG_REG, 1);
3094                 }
3095         }
3096
3097         if (phy->ops->pwork_15sec)
3098                 phy->ops->pwork_15sec(dev);
3099
3100         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3101         wmb();
3102
3103 #if B43_DEBUG
3104         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3105                 unsigned int i;
3106
3107                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3108                        dev->irq_count / 15,
3109                        dev->tx_count / 15,
3110                        dev->rx_count / 15);
3111                 dev->irq_count = 0;
3112                 dev->tx_count = 0;
3113                 dev->rx_count = 0;
3114                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3115                         if (dev->irq_bit_count[i]) {
3116                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3117                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3118                                 dev->irq_bit_count[i] = 0;
3119                         }
3120                 }
3121         }
3122 #endif
3123 }
3124
3125 static void do_periodic_work(struct b43_wldev *dev)
3126 {
3127         unsigned int state;
3128
3129         state = dev->periodic_state;
3130         if (state % 4 == 0)
3131                 b43_periodic_every60sec(dev);
3132         if (state % 2 == 0)
3133                 b43_periodic_every30sec(dev);
3134         b43_periodic_every15sec(dev);
3135 }
3136
3137 /* Periodic work locking policy:
3138  *      The whole periodic work handler is protected by
3139  *      wl->mutex. If another lock is needed somewhere in the
3140  *      pwork callchain, it's acquired in-place, where it's needed.
3141  */
3142 static void b43_periodic_work_handler(struct work_struct *work)
3143 {
3144         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3145                                              periodic_work.work);
3146         struct b43_wl *wl = dev->wl;
3147         unsigned long delay;
3148
3149         mutex_lock(&wl->mutex);
3150
3151         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3152                 goto out;
3153         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3154                 goto out_requeue;
3155
3156         do_periodic_work(dev);
3157
3158         dev->periodic_state++;
3159 out_requeue:
3160         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3161                 delay = msecs_to_jiffies(50);
3162         else
3163                 delay = round_jiffies_relative(HZ * 15);
3164         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3165 out:
3166         mutex_unlock(&wl->mutex);
3167 }
3168
3169 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3170 {
3171         struct delayed_work *work = &dev->periodic_work;
3172
3173         dev->periodic_state = 0;
3174         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3175         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3176 }
3177
3178 /* Check if communication with the device works correctly. */
3179 static int b43_validate_chipaccess(struct b43_wldev *dev)
3180 {
3181         u32 v, backup0, backup4;
3182
3183         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3184         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3185
3186         /* Check for read/write and endianness problems. */
3187         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3188         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3189                 goto error;
3190         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3191         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3192                 goto error;
3193
3194         /* Check if unaligned 32bit SHM_SHARED access works properly.
3195          * However, don't bail out on failure, because it's noncritical. */
3196         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3197         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3198         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3199         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3200         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3201                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3202         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3203         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3204             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3205             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3206             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3207                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3208
3209         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3210         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3211
3212         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3213                 /* The 32bit register shadows the two 16bit registers
3214                  * with update sideeffects. Validate this. */
3215                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3216                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3217                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3218                         goto error;
3219                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3220                         goto error;
3221         }
3222         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3223
3224         v = b43_read32(dev, B43_MMIO_MACCTL);
3225         v |= B43_MACCTL_GMODE;
3226         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3227                 goto error;
3228
3229         return 0;
3230 error:
3231         b43err(dev->wl, "Failed to validate the chipaccess\n");
3232         return -ENODEV;
3233 }
3234
3235 static void b43_security_init(struct b43_wldev *dev)
3236 {
3237         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3238         /* KTP is a word address, but we address SHM bytewise.
3239          * So multiply by two.
3240          */
3241         dev->ktp *= 2;
3242         /* Number of RCMTA address slots */
3243         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3244         /* Clear the key memory. */
3245         b43_clear_keys(dev);
3246 }
3247
3248 #ifdef CONFIG_B43_HWRNG
3249 static int b43_rng_read(struct hwrng *rng, u32 *data)
3250 {
3251         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3252         struct b43_wldev *dev;
3253         int count = -ENODEV;
3254
3255         mutex_lock(&wl->mutex);
3256         dev = wl->current_dev;
3257         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3258                 *data = b43_read16(dev, B43_MMIO_RNG);
3259                 count = sizeof(u16);
3260         }
3261         mutex_unlock(&wl->mutex);
3262
3263         return count;
3264 }
3265 #endif /* CONFIG_B43_HWRNG */
3266
3267 static void b43_rng_exit(struct b43_wl *wl)
3268 {
3269 #ifdef CONFIG_B43_HWRNG
3270         if (wl->rng_initialized)
3271                 hwrng_unregister(&wl->rng);
3272 #endif /* CONFIG_B43_HWRNG */
3273 }
3274
3275 static int b43_rng_init(struct b43_wl *wl)
3276 {
3277         int err = 0;
3278
3279 #ifdef CONFIG_B43_HWRNG
3280         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3281                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3282         wl->rng.name = wl->rng_name;
3283         wl->rng.data_read = b43_rng_read;
3284         wl->rng.priv = (unsigned long)wl;
3285         wl->rng_initialized = 1;
3286         err = hwrng_register(&wl->rng);
3287         if (err) {
3288                 wl->rng_initialized = 0;
3289                 b43err(wl, "Failed to register the random "
3290                        "number generator (%d)\n", err);
3291         }
3292 #endif /* CONFIG_B43_HWRNG */
3293
3294         return err;
3295 }
3296
3297 static void b43_tx_work(struct work_struct *work)
3298 {
3299         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3300         struct b43_wldev *dev;
3301         struct sk_buff *skb;
3302         int err = 0;
3303
3304         mutex_lock(&wl->mutex);
3305         dev = wl->current_dev;
3306         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3307                 mutex_unlock(&wl->mutex);
3308                 return;
3309         }
3310
3311         while (skb_queue_len(&wl->tx_queue)) {
3312                 skb = skb_dequeue(&wl->tx_queue);
3313
3314                 if (b43_using_pio_transfers(dev))
3315                         err = b43_pio_tx(dev, skb);
3316                 else
3317                         err = b43_dma_tx(dev, skb);
3318                 if (unlikely(err))
3319                         dev_kfree_skb(skb); /* Drop it */
3320         }
3321
3322 #if B43_DEBUG
3323         dev->tx_count++;
3324 #endif
3325         mutex_unlock(&wl->mutex);
3326 }
3327
3328 static void b43_op_tx(struct ieee80211_hw *hw,
3329                      struct sk_buff *skb)
3330 {
3331         struct b43_wl *wl = hw_to_b43_wl(hw);
3332
3333         if (unlikely(skb->len < 2 + 2 + 6)) {
3334                 /* Too short, this can't be a valid frame. */
3335                 dev_kfree_skb_any(skb);
3336                 return;
3337         }
3338         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3339
3340         skb_queue_tail(&wl->tx_queue, skb);
3341         ieee80211_queue_work(wl->hw, &wl->tx_work);
3342 }
3343
3344 static void b43_qos_params_upload(struct b43_wldev *dev,
3345                                   const struct ieee80211_tx_queue_params *p,
3346                                   u16 shm_offset)
3347 {
3348         u16 params[B43_NR_QOSPARAMS];
3349         int bslots, tmp;
3350         unsigned int i;
3351
3352         if (!dev->qos_enabled)
3353                 return;
3354
3355         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3356
3357         memset(&params, 0, sizeof(params));
3358
3359         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3360         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3361         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3362         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3363         params[B43_QOSPARAM_AIFS] = p->aifs;
3364         params[B43_QOSPARAM_BSLOTS] = bslots;
3365         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3366
3367         for (i = 0; i < ARRAY_SIZE(params); i++) {
3368                 if (i == B43_QOSPARAM_STATUS) {
3369                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3370                                              shm_offset + (i * 2));
3371                         /* Mark the parameters as updated. */
3372                         tmp |= 0x100;
3373                         b43_shm_write16(dev, B43_SHM_SHARED,
3374                                         shm_offset + (i * 2),
3375                                         tmp);
3376                 } else {
3377                         b43_shm_write16(dev, B43_SHM_SHARED,
3378                                         shm_offset + (i * 2),
3379                                         params[i]);
3380                 }
3381         }
3382 }
3383
3384 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3385 static const u16 b43_qos_shm_offsets[] = {
3386         /* [mac80211-queue-nr] = SHM_OFFSET, */
3387         [0] = B43_QOS_VOICE,
3388         [1] = B43_QOS_VIDEO,
3389         [2] = B43_QOS_BESTEFFORT,
3390         [3] = B43_QOS_BACKGROUND,
3391 };
3392
3393 /* Update all QOS parameters in hardware. */
3394 static void b43_qos_upload_all(struct b43_wldev *dev)
3395 {
3396         struct b43_wl *wl = dev->wl;
3397         struct b43_qos_params *params;
3398         unsigned int i;
3399
3400         if (!dev->qos_enabled)
3401                 return;
3402
3403         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3404                      ARRAY_SIZE(wl->qos_params));
3405
3406         b43_mac_suspend(dev);
3407         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3408                 params = &(wl->qos_params[i]);
3409                 b43_qos_params_upload(dev, &(params->p),
3410                                       b43_qos_shm_offsets[i]);
3411         }
3412         b43_mac_enable(dev);
3413 }
3414
3415 static void b43_qos_clear(struct b43_wl *wl)
3416 {
3417         struct b43_qos_params *params;
3418         unsigned int i;
3419
3420         /* Initialize QoS parameters to sane defaults. */
3421
3422         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3423                      ARRAY_SIZE(wl->qos_params));
3424
3425         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3426                 params = &(wl->qos_params[i]);
3427
3428                 switch (b43_qos_shm_offsets[i]) {
3429                 case B43_QOS_VOICE:
3430                         params->p.txop = 0;
3431                         params->p.aifs = 2;
3432                         params->p.cw_min = 0x0001;
3433                         params->p.cw_max = 0x0001;
3434                         break;
3435                 case B43_QOS_VIDEO:
3436                         params->p.txop = 0;
3437                         params->p.aifs = 2;
3438                         params->p.cw_min = 0x0001;
3439                         params->p.cw_max = 0x0001;
3440                         break;
3441                 case B43_QOS_BESTEFFORT:
3442                         params->p.txop = 0;
3443                         params->p.aifs = 3;
3444                         params->p.cw_min = 0x0001;
3445                         params->p.cw_max = 0x03FF;
3446                         break;
3447                 case B43_QOS_BACKGROUND:
3448                         params->p.txop = 0;
3449                         params->p.aifs = 7;
3450                         params->p.cw_min = 0x0001;
3451                         params->p.cw_max = 0x03FF;
3452                         break;
3453                 default:
3454                         B43_WARN_ON(1);
3455                 }
3456         }
3457 }
3458
3459 /* Initialize the core's QOS capabilities */
3460 static void b43_qos_init(struct b43_wldev *dev)
3461 {
3462         if (!dev->qos_enabled) {
3463                 /* Disable QOS support. */
3464                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3465                 b43_write16(dev, B43_MMIO_IFSCTL,
3466                             b43_read16(dev, B43_MMIO_IFSCTL)
3467                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3468                 b43dbg(dev->wl, "QoS disabled\n");
3469                 return;
3470         }
3471
3472         /* Upload the current QOS parameters. */
3473         b43_qos_upload_all(dev);
3474
3475         /* Enable QOS support. */
3476         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3477         b43_write16(dev, B43_MMIO_IFSCTL,
3478                     b43_read16(dev, B43_MMIO_IFSCTL)
3479                     | B43_MMIO_IFSCTL_USE_EDCF);
3480         b43dbg(dev->wl, "QoS enabled\n");
3481 }
3482
3483 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3484                           const struct ieee80211_tx_queue_params *params)
3485 {
3486         struct b43_wl *wl = hw_to_b43_wl(hw);
3487         struct b43_wldev *dev;
3488         unsigned int queue = (unsigned int)_queue;
3489         int err = -ENODEV;
3490
3491         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3492                 /* Queue not available or don't support setting
3493                  * params on this queue. Return success to not
3494                  * confuse mac80211. */
3495                 return 0;
3496         }
3497         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3498                      ARRAY_SIZE(wl->qos_params));
3499
3500         mutex_lock(&wl->mutex);
3501         dev = wl->current_dev;
3502         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3503                 goto out_unlock;
3504
3505         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3506         b43_mac_suspend(dev);
3507         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3508                               b43_qos_shm_offsets[queue]);
3509         b43_mac_enable(dev);
3510         err = 0;
3511
3512 out_unlock:
3513         mutex_unlock(&wl->mutex);
3514
3515         return err;
3516 }
3517
3518 static int b43_op_get_stats(struct ieee80211_hw *hw,
3519                             struct ieee80211_low_level_stats *stats)
3520 {
3521         struct b43_wl *wl = hw_to_b43_wl(hw);
3522
3523         mutex_lock(&wl->mutex);
3524         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3525         mutex_unlock(&wl->mutex);
3526
3527         return 0;
3528 }
3529
3530 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3531 {
3532         struct b43_wl *wl = hw_to_b43_wl(hw);
3533         struct b43_wldev *dev;
3534         u64 tsf;
3535
3536         mutex_lock(&wl->mutex);
3537         dev = wl->current_dev;
3538
3539         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3540                 b43_tsf_read(dev, &tsf);
3541         else
3542                 tsf = 0;
3543
3544         mutex_unlock(&wl->mutex);
3545
3546         return tsf;
3547 }
3548
3549 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3550 {
3551         struct b43_wl *wl = hw_to_b43_wl(hw);
3552         struct b43_wldev *dev;
3553
3554         mutex_lock(&wl->mutex);
3555         dev = wl->current_dev;
3556
3557         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3558                 b43_tsf_write(dev, tsf);
3559
3560         mutex_unlock(&wl->mutex);
3561 }
3562
3563 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3564 {
3565         u32 tmp;
3566
3567         switch (dev->dev->bus_type) {
3568 #ifdef CONFIG_B43_BCMA
3569         case B43_BUS_BCMA:
3570                 b43err(dev->wl,
3571                        "Putting PHY into reset not supported on BCMA\n");
3572                 break;
3573 #endif
3574 #ifdef CONFIG_B43_SSB
3575         case B43_BUS_SSB:
3576                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3577                 tmp &= ~B43_TMSLOW_GMODE;
3578                 tmp |= B43_TMSLOW_PHYRESET;
3579                 tmp |= SSB_TMSLOW_FGC;
3580                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3581                 msleep(1);
3582
3583                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3584                 tmp &= ~SSB_TMSLOW_FGC;
3585                 tmp |= B43_TMSLOW_PHYRESET;
3586                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3587                 msleep(1);
3588
3589                 break;
3590 #endif
3591         }
3592 }
3593
3594 static const char *band_to_string(enum ieee80211_band band)
3595 {
3596         switch (band) {
3597         case IEEE80211_BAND_5GHZ:
3598                 return "5";
3599         case IEEE80211_BAND_2GHZ:
3600                 return "2.4";
3601         default:
3602                 break;
3603         }
3604         B43_WARN_ON(1);
3605         return "";
3606 }
3607
3608 /* Expects wl->mutex locked */
3609 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3610 {
3611         struct b43_wldev *up_dev = NULL;
3612         struct b43_wldev *down_dev;
3613         struct b43_wldev *d;
3614         int err;
3615         bool uninitialized_var(gmode);
3616         int prev_status;
3617
3618         /* Find a device and PHY which supports the band. */
3619         list_for_each_entry(d, &wl->devlist, list) {
3620                 switch (chan->band) {
3621                 case IEEE80211_BAND_5GHZ:
3622                         if (d->phy.supports_5ghz) {
3623                                 up_dev = d;
3624                                 gmode = 0;
3625                         }
3626                         break;
3627                 case IEEE80211_BAND_2GHZ:
3628                         if (d->phy.supports_2ghz) {
3629                                 up_dev = d;
3630                                 gmode = 1;
3631                         }
3632                         break;
3633                 default:
3634                         B43_WARN_ON(1);
3635                         return -EINVAL;
3636                 }
3637                 if (up_dev)
3638                         break;
3639         }
3640         if (!up_dev) {
3641                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3642                        band_to_string(chan->band));
3643                 return -ENODEV;
3644         }
3645         if ((up_dev == wl->current_dev) &&
3646             (!!wl->current_dev->phy.gmode == !!gmode)) {
3647                 /* This device is already running. */
3648                 return 0;
3649         }
3650         b43dbg(wl, "Switching to %s-GHz band\n",
3651                band_to_string(chan->band));
3652         down_dev = wl->current_dev;
3653
3654         prev_status = b43_status(down_dev);
3655         /* Shutdown the currently running core. */
3656         if (prev_status >= B43_STAT_STARTED)
3657                 down_dev = b43_wireless_core_stop(down_dev);
3658         if (prev_status >= B43_STAT_INITIALIZED)
3659                 b43_wireless_core_exit(down_dev);
3660
3661         if (down_dev != up_dev) {
3662                 /* We switch to a different core, so we put PHY into
3663                  * RESET on the old core. */
3664                 b43_put_phy_into_reset(down_dev);
3665         }
3666
3667         /* Now start the new core. */
3668         up_dev->phy.gmode = gmode;
3669         if (prev_status >= B43_STAT_INITIALIZED) {
3670                 err = b43_wireless_core_init(up_dev);
3671                 if (err) {
3672                         b43err(wl, "Fatal: Could not initialize device for "
3673                                "selected %s-GHz band\n",
3674                                band_to_string(chan->band));
3675                         goto init_failure;
3676                 }
3677         }
3678         if (prev_status >= B43_STAT_STARTED) {
3679                 err = b43_wireless_core_start(up_dev);
3680                 if (err) {
3681                         b43err(wl, "Fatal: Coult not start device for "
3682                                "selected %s-GHz band\n",
3683                                band_to_string(chan->band));
3684                         b43_wireless_core_exit(up_dev);
3685                         goto init_failure;
3686                 }
3687         }
3688         B43_WARN_ON(b43_status(up_dev) != prev_status);
3689
3690         wl->current_dev = up_dev;
3691
3692         return 0;
3693 init_failure:
3694         /* Whoops, failed to init the new core. No core is operating now. */
3695         wl->current_dev = NULL;
3696         return err;
3697 }
3698
3699 /* Write the short and long frame retry limit values. */
3700 static void b43_set_retry_limits(struct b43_wldev *dev,
3701                                  unsigned int short_retry,
3702                                  unsigned int long_retry)
3703 {
3704         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3705          * the chip-internal counter. */
3706         short_retry = min(short_retry, (unsigned int)0xF);
3707         long_retry = min(long_retry, (unsigned int)0xF);
3708
3709         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3710                         short_retry);
3711         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3712                         long_retry);
3713 }
3714
3715 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3716 {
3717         struct b43_wl *wl = hw_to_b43_wl(hw);
3718         struct b43_wldev *dev;
3719         struct b43_phy *phy;
3720         struct ieee80211_conf *conf = &hw->conf;
3721         int antenna;
3722         int err = 0;
3723
3724         mutex_lock(&wl->mutex);
3725
3726         /* Switch the band (if necessary). This might change the active core. */
3727         err = b43_switch_band(wl, conf->channel);
3728         if (err)
3729                 goto out_unlock_mutex;
3730         dev = wl->current_dev;
3731         phy = &dev->phy;
3732
3733         if (conf_is_ht(conf))
3734                 phy->is_40mhz =
3735                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3736         else
3737                 phy->is_40mhz = false;
3738
3739         b43_mac_suspend(dev);
3740
3741         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3742                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3743                                           conf->long_frame_max_tx_count);
3744         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3745         if (!changed)
3746                 goto out_mac_enable;
3747
3748         /* Switch to the requested channel.
3749          * The firmware takes care of races with the TX handler. */
3750         if (conf->channel->hw_value != phy->channel)
3751                 b43_switch_channel(dev, conf->channel->hw_value);
3752
3753         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3754
3755         /* Adjust the desired TX power level. */
3756         if (conf->power_level != 0) {
3757                 if (conf->power_level != phy->desired_txpower) {
3758                         phy->desired_txpower = conf->power_level;
3759                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3760                                                    B43_TXPWR_IGNORE_TSSI);
3761                 }
3762         }
3763
3764         /* Antennas for RX and management frame TX. */
3765         antenna = B43_ANTENNA_DEFAULT;
3766         b43_mgmtframe_txantenna(dev, antenna);
3767         antenna = B43_ANTENNA_DEFAULT;
3768         if (phy->ops->set_rx_antenna)
3769                 phy->ops->set_rx_antenna(dev, antenna);
3770
3771         if (wl->radio_enabled != phy->radio_on) {
3772                 if (wl->radio_enabled) {
3773                         b43_software_rfkill(dev, false);
3774                         b43info(dev->wl, "Radio turned on by software\n");
3775                         if (!dev->radio_hw_enable) {
3776                                 b43info(dev->wl, "The hardware RF-kill button "
3777                                         "still turns the radio physically off. "
3778                                         "Press the button to turn it on.\n");
3779                         }
3780                 } else {
3781                         b43_software_rfkill(dev, true);
3782                         b43info(dev->wl, "Radio turned off by software\n");
3783                 }
3784         }
3785
3786 out_mac_enable:
3787         b43_mac_enable(dev);
3788 out_unlock_mutex:
3789         mutex_unlock(&wl->mutex);
3790
3791         return err;
3792 }
3793
3794 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3795 {
3796         struct ieee80211_supported_band *sband =
3797                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3798         struct ieee80211_rate *rate;
3799         int i;
3800         u16 basic, direct, offset, basic_offset, rateptr;
3801
3802         for (i = 0; i < sband->n_bitrates; i++) {
3803                 rate = &sband->bitrates[i];
3804
3805                 if (b43_is_cck_rate(rate->hw_value)) {
3806                         direct = B43_SHM_SH_CCKDIRECT;
3807                         basic = B43_SHM_SH_CCKBASIC;
3808                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3809                         offset &= 0xF;
3810                 } else {
3811                         direct = B43_SHM_SH_OFDMDIRECT;
3812                         basic = B43_SHM_SH_OFDMBASIC;
3813                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3814                         offset &= 0xF;
3815                 }
3816
3817                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3818
3819                 if (b43_is_cck_rate(rate->hw_value)) {
3820                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3821                         basic_offset &= 0xF;
3822                 } else {
3823                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3824                         basic_offset &= 0xF;
3825                 }
3826
3827                 /*
3828                  * Get the pointer that we need to point to
3829                  * from the direct map
3830                  */
3831                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3832                                          direct + 2 * basic_offset);
3833                 /* and write it to the basic map */
3834                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3835                                 rateptr);
3836         }
3837 }
3838
3839 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3840                                     struct ieee80211_vif *vif,
3841                                     struct ieee80211_bss_conf *conf,
3842                                     u32 changed)
3843 {
3844         struct b43_wl *wl = hw_to_b43_wl(hw);
3845         struct b43_wldev *dev;
3846
3847         mutex_lock(&wl->mutex);
3848
3849         dev = wl->current_dev;
3850         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3851                 goto out_unlock_mutex;
3852
3853         B43_WARN_ON(wl->vif != vif);
3854
3855         if (changed & BSS_CHANGED_BSSID) {
3856                 if (conf->bssid)
3857                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3858                 else
3859                         memset(wl->bssid, 0, ETH_ALEN);
3860         }
3861
3862         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3863                 if (changed & BSS_CHANGED_BEACON &&
3864                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3865                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3866                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3867                         b43_update_templates(wl);
3868
3869                 if (changed & BSS_CHANGED_BSSID)
3870                         b43_write_mac_bssid_templates(dev);
3871         }
3872
3873         b43_mac_suspend(dev);
3874
3875         /* Update templates for AP/mesh mode. */
3876         if (changed & BSS_CHANGED_BEACON_INT &&
3877             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3878              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3879              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3880                 b43_set_beacon_int(dev, conf->beacon_int);
3881
3882         if (changed & BSS_CHANGED_BASIC_RATES)
3883                 b43_update_basic_rates(dev, conf->basic_rates);
3884
3885         if (changed & BSS_CHANGED_ERP_SLOT) {
3886                 if (conf->use_short_slot)
3887                         b43_short_slot_timing_enable(dev);
3888                 else
3889                         b43_short_slot_timing_disable(dev);
3890         }
3891
3892         b43_mac_enable(dev);
3893 out_unlock_mutex:
3894         mutex_unlock(&wl->mutex);
3895 }
3896
3897 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3898                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3899                           struct ieee80211_key_conf *key)
3900 {
3901         struct b43_wl *wl = hw_to_b43_wl(hw);
3902         struct b43_wldev *dev;
3903         u8 algorithm;
3904         u8 index;
3905         int err;
3906         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3907
3908         if (modparam_nohwcrypt)
3909                 return -ENOSPC; /* User disabled HW-crypto */
3910
3911         mutex_lock(&wl->mutex);
3912
3913         dev = wl->current_dev;
3914         err = -ENODEV;
3915         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3916                 goto out_unlock;
3917
3918         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3919                 /* We don't have firmware for the crypto engine.
3920                  * Must use software-crypto. */
3921                 err = -EOPNOTSUPP;
3922                 goto out_unlock;
3923         }
3924
3925         err = -EINVAL;
3926         switch (key->cipher) {
3927         case WLAN_CIPHER_SUITE_WEP40:
3928                 algorithm = B43_SEC_ALGO_WEP40;
3929                 break;
3930         case WLAN_CIPHER_SUITE_WEP104:
3931                 algorithm = B43_SEC_ALGO_WEP104;
3932                 break;
3933         case WLAN_CIPHER_SUITE_TKIP:
3934                 algorithm = B43_SEC_ALGO_TKIP;
3935                 break;
3936         case WLAN_CIPHER_SUITE_CCMP:
3937                 algorithm = B43_SEC_ALGO_AES;
3938                 break;
3939         default:
3940                 B43_WARN_ON(1);
3941                 goto out_unlock;
3942         }
3943         index = (u8) (key->keyidx);
3944         if (index > 3)
3945                 goto out_unlock;
3946
3947         switch (cmd) {
3948         case SET_KEY:
3949                 if (algorithm == B43_SEC_ALGO_TKIP &&
3950                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3951                     !modparam_hwtkip)) {
3952                         /* We support only pairwise key */
3953                         err = -EOPNOTSUPP;
3954                         goto out_unlock;
3955                 }
3956
3957                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3958                         if (WARN_ON(!sta)) {
3959                                 err = -EOPNOTSUPP;
3960                                 goto out_unlock;
3961                         }
3962                         /* Pairwise key with an assigned MAC address. */
3963                         err = b43_key_write(dev, -1, algorithm,
3964                                             key->key, key->keylen,
3965                                             sta->addr, key);
3966                 } else {
3967                         /* Group key */
3968                         err = b43_key_write(dev, index, algorithm,
3969                                             key->key, key->keylen, NULL, key);
3970                 }
3971                 if (err)
3972                         goto out_unlock;
3973
3974                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3975                     algorithm == B43_SEC_ALGO_WEP104) {
3976                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3977                 } else {
3978                         b43_hf_write(dev,
3979                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3980                 }
3981                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3982                 if (algorithm == B43_SEC_ALGO_TKIP)
3983                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3984                 break;
3985         case DISABLE_KEY: {
3986                 err = b43_key_clear(dev, key->hw_key_idx);
3987                 if (err)
3988                         goto out_unlock;
3989                 break;
3990         }
3991         default:
3992                 B43_WARN_ON(1);
3993         }
3994
3995 out_unlock:
3996         if (!err) {
3997                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3998                        "mac: %pM\n",
3999                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4000                        sta ? sta->addr : bcast_addr);
4001                 b43_dump_keymemory(dev);
4002         }
4003         mutex_unlock(&wl->mutex);
4004
4005         return err;
4006 }
4007
4008 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4009                                     unsigned int changed, unsigned int *fflags,
4010                                     u64 multicast)
4011 {
4012         struct b43_wl *wl = hw_to_b43_wl(hw);
4013         struct b43_wldev *dev;
4014
4015         mutex_lock(&wl->mutex);
4016         dev = wl->current_dev;
4017         if (!dev) {
4018                 *fflags = 0;
4019                 goto out_unlock;
4020         }
4021
4022         *fflags &= FIF_PROMISC_IN_BSS |
4023                   FIF_ALLMULTI |
4024                   FIF_FCSFAIL |
4025                   FIF_PLCPFAIL |
4026                   FIF_CONTROL |
4027                   FIF_OTHER_BSS |
4028                   FIF_BCN_PRBRESP_PROMISC;
4029
4030         changed &= FIF_PROMISC_IN_BSS |
4031                    FIF_ALLMULTI |
4032                    FIF_FCSFAIL |
4033                    FIF_PLCPFAIL |
4034                    FIF_CONTROL |
4035                    FIF_OTHER_BSS |
4036                    FIF_BCN_PRBRESP_PROMISC;
4037
4038         wl->filter_flags = *fflags;
4039
4040         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4041                 b43_adjust_opmode(dev);
4042
4043 out_unlock:
4044         mutex_unlock(&wl->mutex);
4045 }
4046
4047 /* Locking: wl->mutex
4048  * Returns the current dev. This might be different from the passed in dev,
4049  * because the core might be gone away while we unlocked the mutex. */
4050 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4051 {
4052         struct b43_wl *wl = dev->wl;
4053         struct b43_wldev *orig_dev;
4054         u32 mask;
4055
4056 redo:
4057         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4058                 return dev;
4059
4060         /* Cancel work. Unlock to avoid deadlocks. */
4061         mutex_unlock(&wl->mutex);
4062         cancel_delayed_work_sync(&dev->periodic_work);
4063         cancel_work_sync(&wl->tx_work);
4064         mutex_lock(&wl->mutex);
4065         dev = wl->current_dev;
4066         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4067                 /* Whoops, aliens ate up the device while we were unlocked. */
4068                 return dev;
4069         }
4070
4071         /* Disable interrupts on the device. */
4072         b43_set_status(dev, B43_STAT_INITIALIZED);
4073         if (b43_bus_host_is_sdio(dev->dev)) {
4074                 /* wl->mutex is locked. That is enough. */
4075                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4076                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4077         } else {
4078                 spin_lock_irq(&wl->hardirq_lock);
4079                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4080                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4081                 spin_unlock_irq(&wl->hardirq_lock);
4082         }
4083         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4084         orig_dev = dev;
4085         mutex_unlock(&wl->mutex);
4086         if (b43_bus_host_is_sdio(dev->dev)) {
4087                 b43_sdio_free_irq(dev);
4088         } else {
4089                 synchronize_irq(dev->dev->irq);
4090                 free_irq(dev->dev->irq, dev);
4091         }
4092         mutex_lock(&wl->mutex);
4093         dev = wl->current_dev;
4094         if (!dev)
4095                 return dev;
4096         if (dev != orig_dev) {
4097                 if (b43_status(dev) >= B43_STAT_STARTED)
4098                         goto redo;
4099                 return dev;
4100         }
4101         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4102         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4103
4104         /* Drain the TX queue */
4105         while (skb_queue_len(&wl->tx_queue))
4106                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4107
4108         b43_mac_suspend(dev);
4109         b43_leds_exit(dev);
4110         b43dbg(wl, "Wireless interface stopped\n");
4111
4112         return dev;
4113 }
4114
4115 /* Locking: wl->mutex */
4116 static int b43_wireless_core_start(struct b43_wldev *dev)
4117 {
4118         int err;
4119
4120         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4121
4122         drain_txstatus_queue(dev);
4123         if (b43_bus_host_is_sdio(dev->dev)) {
4124                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4125                 if (err) {
4126                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4127                         goto out;
4128                 }
4129         } else {
4130                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4131                                            b43_interrupt_thread_handler,
4132                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4133                 if (err) {
4134                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4135                                dev->dev->irq);
4136                         goto out;
4137                 }
4138         }
4139
4140         /* We are ready to run. */
4141         ieee80211_wake_queues(dev->wl->hw);
4142         b43_set_status(dev, B43_STAT_STARTED);
4143
4144         /* Start data flow (TX/RX). */
4145         b43_mac_enable(dev);
4146         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4147
4148         /* Start maintenance work */
4149         b43_periodic_tasks_setup(dev);
4150
4151         b43_leds_init(dev);
4152
4153         b43dbg(dev->wl, "Wireless interface started\n");
4154 out:
4155         return err;
4156 }
4157
4158 /* Get PHY and RADIO versioning numbers */
4159 static int b43_phy_versioning(struct b43_wldev *dev)
4160 {
4161         struct b43_phy *phy = &dev->phy;
4162         u32 tmp;
4163         u8 analog_type;
4164         u8 phy_type;
4165         u8 phy_rev;
4166         u16 radio_manuf;
4167         u16 radio_ver;
4168         u16 radio_rev;
4169         int unsupported = 0;
4170
4171         /* Get PHY versioning */
4172         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4173         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4174         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4175         phy_rev = (tmp & B43_PHYVER_VERSION);
4176         switch (phy_type) {
4177         case B43_PHYTYPE_A:
4178                 if (phy_rev >= 4)
4179                         unsupported = 1;
4180                 break;
4181         case B43_PHYTYPE_B:
4182                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4183                     && phy_rev != 7)
4184                         unsupported = 1;
4185                 break;
4186         case B43_PHYTYPE_G:
4187                 if (phy_rev > 9)
4188                         unsupported = 1;
4189                 break;
4190 #ifdef CONFIG_B43_PHY_N
4191         case B43_PHYTYPE_N:
4192                 if (phy_rev > 9)
4193                         unsupported = 1;
4194                 break;
4195 #endif
4196 #ifdef CONFIG_B43_PHY_LP
4197         case B43_PHYTYPE_LP:
4198                 if (phy_rev > 2)
4199                         unsupported = 1;
4200                 break;
4201 #endif
4202 #ifdef CONFIG_B43_PHY_HT
4203         case B43_PHYTYPE_HT:
4204                 if (phy_rev > 1)
4205                         unsupported = 1;
4206                 break;
4207 #endif
4208 #ifdef CONFIG_B43_PHY_LCN
4209         case B43_PHYTYPE_LCN:
4210                 if (phy_rev > 1)
4211                         unsupported = 1;
4212                 break;
4213 #endif
4214         default:
4215                 unsupported = 1;
4216         };
4217         if (unsupported) {
4218                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4219                        "(Analog %u, Type %u, Revision %u)\n",
4220                        analog_type, phy_type, phy_rev);
4221                 return -EOPNOTSUPP;
4222         }
4223         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4224                analog_type, phy_type, phy_rev);
4225
4226         /* Get RADIO versioning */
4227         if (dev->dev->core_rev >= 24) {
4228                 u16 radio24[3];
4229
4230                 for (tmp = 0; tmp < 3; tmp++) {
4231                         b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4232                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4233                 }
4234
4235                 /* Broadcom uses "id" for our "ver" and has separated "ver" */
4236                 /* radio_ver = (radio24[0] & 0xF0) >> 4; */
4237
4238                 radio_manuf = 0x17F;
4239                 radio_ver = (radio24[2] << 8) | radio24[1];
4240                 radio_rev = (radio24[0] & 0xF);
4241         } else {
4242                 if (dev->dev->chip_id == 0x4317) {
4243                         if (dev->dev->chip_rev == 0)
4244                                 tmp = 0x3205017F;
4245                         else if (dev->dev->chip_rev == 1)
4246                                 tmp = 0x4205017F;
4247                         else
4248                                 tmp = 0x5205017F;
4249                 } else {
4250                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4251                                     B43_RADIOCTL_ID);
4252                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4253                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4254                                     B43_RADIOCTL_ID);
4255                         tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4256                                 << 16;
4257                 }
4258                 radio_manuf = (tmp & 0x00000FFF);
4259                 radio_ver = (tmp & 0x0FFFF000) >> 12;
4260                 radio_rev = (tmp & 0xF0000000) >> 28;
4261         }
4262
4263         if (radio_manuf != 0x17F /* Broadcom */)
4264                 unsupported = 1;
4265         switch (phy_type) {
4266         case B43_PHYTYPE_A:
4267                 if (radio_ver != 0x2060)
4268                         unsupported = 1;
4269                 if (radio_rev != 1)
4270                         unsupported = 1;
4271                 if (radio_manuf != 0x17F)
4272                         unsupported = 1;
4273                 break;
4274         case B43_PHYTYPE_B:
4275                 if ((radio_ver & 0xFFF0) != 0x2050)
4276                         unsupported = 1;
4277                 break;
4278         case B43_PHYTYPE_G:
4279                 if (radio_ver != 0x2050)
4280                         unsupported = 1;
4281                 break;
4282         case B43_PHYTYPE_N:
4283                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4284                         unsupported = 1;
4285                 break;
4286         case B43_PHYTYPE_LP:
4287                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4288                         unsupported = 1;
4289                 break;
4290         case B43_PHYTYPE_HT:
4291                 if (radio_ver != 0x2059)
4292                         unsupported = 1;
4293                 break;
4294         case B43_PHYTYPE_LCN:
4295                 if (radio_ver != 0x2064)
4296                         unsupported = 1;
4297                 break;
4298         default:
4299                 B43_WARN_ON(1);
4300         }
4301         if (unsupported) {
4302                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4303                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4304                        radio_manuf, radio_ver, radio_rev);
4305                 return -EOPNOTSUPP;
4306         }
4307         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4308                radio_manuf, radio_ver, radio_rev);
4309
4310         phy->radio_manuf = radio_manuf;
4311         phy->radio_ver = radio_ver;
4312         phy->radio_rev = radio_rev;
4313
4314         phy->analog = analog_type;
4315         phy->type = phy_type;
4316         phy->rev = phy_rev;
4317
4318         return 0;
4319 }
4320
4321 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4322                                       struct b43_phy *phy)
4323 {
4324         phy->hardware_power_control = !!modparam_hwpctl;
4325         phy->next_txpwr_check_time = jiffies;
4326         /* PHY TX errors counter. */
4327         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4328
4329 #if B43_DEBUG
4330         phy->phy_locked = 0;
4331         phy->radio_locked = 0;
4332 #endif
4333 }
4334
4335 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4336 {
4337         dev->dfq_valid = 0;
4338
4339         /* Assume the radio is enabled. If it's not enabled, the state will
4340          * immediately get fixed on the first periodic work run. */
4341         dev->radio_hw_enable = 1;
4342
4343         /* Stats */
4344         memset(&dev->stats, 0, sizeof(dev->stats));
4345
4346         setup_struct_phy_for_init(dev, &dev->phy);
4347
4348         /* IRQ related flags */
4349         dev->irq_reason = 0;
4350         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4351         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4352         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4353                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4354
4355         dev->mac_suspended = 1;
4356
4357         /* Noise calculation context */
4358         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4359 }
4360
4361 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4362 {
4363         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4364         u64 hf;
4365
4366         if (!modparam_btcoex)
4367                 return;
4368         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4369                 return;
4370         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4371                 return;
4372
4373         hf = b43_hf_read(dev);
4374         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4375                 hf |= B43_HF_BTCOEXALT;
4376         else
4377                 hf |= B43_HF_BTCOEX;
4378         b43_hf_write(dev, hf);
4379 }
4380
4381 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4382 {
4383         if (!modparam_btcoex)
4384                 return;
4385         //TODO
4386 }
4387
4388 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4389 {
4390         struct ssb_bus *bus;
4391         u32 tmp;
4392
4393         if (dev->dev->bus_type != B43_BUS_SSB)
4394                 return;
4395
4396         bus = dev->dev->sdev->bus;
4397
4398         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4399             (bus->chip_id == 0x4312)) {
4400                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4401                 tmp &= ~SSB_IMCFGLO_REQTO;
4402                 tmp &= ~SSB_IMCFGLO_SERTO;
4403                 tmp |= 0x3;
4404                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4405                 ssb_commit_settings(bus);
4406         }
4407 }
4408
4409 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4410 {
4411         u16 pu_delay;
4412
4413         /* The time value is in microseconds. */
4414         if (dev->phy.type == B43_PHYTYPE_A)
4415                 pu_delay = 3700;
4416         else
4417                 pu_delay = 1050;
4418         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4419                 pu_delay = 500;
4420         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4421                 pu_delay = max(pu_delay, (u16)2400);
4422
4423         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4424 }
4425
4426 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4427 static void b43_set_pretbtt(struct b43_wldev *dev)
4428 {
4429         u16 pretbtt;
4430
4431         /* The time value is in microseconds. */
4432         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4433                 pretbtt = 2;
4434         } else {
4435                 if (dev->phy.type == B43_PHYTYPE_A)
4436                         pretbtt = 120;
4437                 else
4438                         pretbtt = 250;
4439         }
4440         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4441         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4442 }
4443
4444 /* Shutdown a wireless core */
4445 /* Locking: wl->mutex */
4446 static void b43_wireless_core_exit(struct b43_wldev *dev)
4447 {
4448         u32 macctl;
4449
4450         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4451         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4452                 return;
4453
4454         /* Unregister HW RNG driver */
4455         b43_rng_exit(dev->wl);
4456
4457         b43_set_status(dev, B43_STAT_UNINIT);
4458
4459         /* Stop the microcode PSM. */
4460         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4461         macctl &= ~B43_MACCTL_PSM_RUN;
4462         macctl |= B43_MACCTL_PSM_JMP0;
4463         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4464
4465         b43_dma_free(dev);
4466         b43_pio_free(dev);
4467         b43_chip_exit(dev);
4468         dev->phy.ops->switch_analog(dev, 0);
4469         if (dev->wl->current_beacon) {
4470                 dev_kfree_skb_any(dev->wl->current_beacon);
4471                 dev->wl->current_beacon = NULL;
4472         }
4473
4474         b43_device_disable(dev, 0);
4475         b43_bus_may_powerdown(dev);
4476 }
4477
4478 /* Initialize a wireless core */
4479 static int b43_wireless_core_init(struct b43_wldev *dev)
4480 {
4481         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4482         struct b43_phy *phy = &dev->phy;
4483         int err;
4484         u64 hf;
4485
4486         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4487
4488         err = b43_bus_powerup(dev, 0);
4489         if (err)
4490                 goto out;
4491         if (!b43_device_is_enabled(dev))
4492                 b43_wireless_core_reset(dev, phy->gmode);
4493
4494         /* Reset all data structures. */
4495         setup_struct_wldev_for_init(dev);
4496         phy->ops->prepare_structs(dev);
4497
4498         /* Enable IRQ routing to this device. */
4499         switch (dev->dev->bus_type) {
4500 #ifdef CONFIG_B43_BCMA
4501         case B43_BUS_BCMA:
4502                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
4503                                       dev->dev->bdev, true);
4504                 break;
4505 #endif
4506 #ifdef CONFIG_B43_SSB
4507         case B43_BUS_SSB:
4508                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4509                                                dev->dev->sdev);
4510                 break;
4511 #endif
4512         }
4513
4514         b43_imcfglo_timeouts_workaround(dev);
4515         b43_bluetooth_coext_disable(dev);
4516         if (phy->ops->prepare_hardware) {
4517                 err = phy->ops->prepare_hardware(dev);
4518                 if (err)
4519                         goto err_busdown;
4520         }
4521         err = b43_chip_init(dev);
4522         if (err)
4523                 goto err_busdown;
4524         b43_shm_write16(dev, B43_SHM_SHARED,
4525                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4526         hf = b43_hf_read(dev);
4527         if (phy->type == B43_PHYTYPE_G) {
4528                 hf |= B43_HF_SYMW;
4529                 if (phy->rev == 1)
4530                         hf |= B43_HF_GDCW;
4531                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4532                         hf |= B43_HF_OFDMPABOOST;
4533         }
4534         if (phy->radio_ver == 0x2050) {
4535                 if (phy->radio_rev == 6)
4536                         hf |= B43_HF_4318TSSI;
4537                 if (phy->radio_rev < 6)
4538                         hf |= B43_HF_VCORECALC;
4539         }
4540         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4541                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4542 #ifdef CONFIG_SSB_DRIVER_PCICORE
4543         if (dev->dev->bus_type == B43_BUS_SSB &&
4544             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4545             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4546                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4547 #endif
4548         hf &= ~B43_HF_SKCFPUP;
4549         b43_hf_write(dev, hf);
4550
4551         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4552                              B43_DEFAULT_LONG_RETRY_LIMIT);
4553         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4554         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4555
4556         /* Disable sending probe responses from firmware.
4557          * Setting the MaxTime to one usec will always trigger
4558          * a timeout, so we never send any probe resp.
4559          * A timeout of zero is infinite. */
4560         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4561
4562         b43_rate_memory_init(dev);
4563         b43_set_phytxctl_defaults(dev);
4564
4565         /* Minimum Contention Window */
4566         if (phy->type == B43_PHYTYPE_B)
4567                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4568         else
4569                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4570         /* Maximum Contention Window */
4571         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4572
4573         if (b43_bus_host_is_pcmcia(dev->dev) ||
4574             b43_bus_host_is_sdio(dev->dev) ||
4575             dev->use_pio) {
4576                 dev->__using_pio_transfers = 1;
4577                 err = b43_pio_init(dev);
4578         } else {
4579                 dev->__using_pio_transfers = 0;
4580                 err = b43_dma_init(dev);
4581         }
4582         if (err)
4583                 goto err_chip_exit;
4584         b43_qos_init(dev);
4585         b43_set_synth_pu_delay(dev, 1);
4586         b43_bluetooth_coext_enable(dev);
4587
4588         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4589         b43_upload_card_macaddress(dev);
4590         b43_security_init(dev);
4591
4592         ieee80211_wake_queues(dev->wl->hw);
4593
4594         b43_set_status(dev, B43_STAT_INITIALIZED);
4595
4596         /* Register HW RNG driver */
4597         b43_rng_init(dev->wl);
4598
4599 out:
4600         return err;
4601
4602 err_chip_exit:
4603         b43_chip_exit(dev);
4604 err_busdown:
4605         b43_bus_may_powerdown(dev);
4606         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4607         return err;
4608 }
4609
4610 static int b43_op_add_interface(struct ieee80211_hw *hw,
4611                                 struct ieee80211_vif *vif)
4612 {
4613         struct b43_wl *wl = hw_to_b43_wl(hw);
4614         struct b43_wldev *dev;
4615         int err = -EOPNOTSUPP;
4616
4617         /* TODO: allow WDS/AP devices to coexist */
4618
4619         if (vif->type != NL80211_IFTYPE_AP &&
4620             vif->type != NL80211_IFTYPE_MESH_POINT &&
4621             vif->type != NL80211_IFTYPE_STATION &&
4622             vif->type != NL80211_IFTYPE_WDS &&
4623             vif->type != NL80211_IFTYPE_ADHOC)
4624                 return -EOPNOTSUPP;
4625
4626         mutex_lock(&wl->mutex);
4627         if (wl->operating)
4628                 goto out_mutex_unlock;
4629
4630         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4631
4632         dev = wl->current_dev;
4633         wl->operating = 1;
4634         wl->vif = vif;
4635         wl->if_type = vif->type;
4636         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4637
4638         b43_adjust_opmode(dev);
4639         b43_set_pretbtt(dev);
4640         b43_set_synth_pu_delay(dev, 0);
4641         b43_upload_card_macaddress(dev);
4642
4643         err = 0;
4644  out_mutex_unlock:
4645         mutex_unlock(&wl->mutex);
4646
4647         return err;
4648 }
4649
4650 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4651                                     struct ieee80211_vif *vif)
4652 {
4653         struct b43_wl *wl = hw_to_b43_wl(hw);
4654         struct b43_wldev *dev = wl->current_dev;
4655
4656         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4657
4658         mutex_lock(&wl->mutex);
4659
4660         B43_WARN_ON(!wl->operating);
4661         B43_WARN_ON(wl->vif != vif);
4662         wl->vif = NULL;
4663
4664         wl->operating = 0;
4665
4666         b43_adjust_opmode(dev);
4667         memset(wl->mac_addr, 0, ETH_ALEN);
4668         b43_upload_card_macaddress(dev);
4669
4670         mutex_unlock(&wl->mutex);
4671 }
4672
4673 static int b43_op_start(struct ieee80211_hw *hw)
4674 {
4675         struct b43_wl *wl = hw_to_b43_wl(hw);
4676         struct b43_wldev *dev = wl->current_dev;
4677         int did_init = 0;
4678         int err = 0;
4679
4680         /* Kill all old instance specific information to make sure
4681          * the card won't use it in the short timeframe between start
4682          * and mac80211 reconfiguring it. */
4683         memset(wl->bssid, 0, ETH_ALEN);
4684         memset(wl->mac_addr, 0, ETH_ALEN);
4685         wl->filter_flags = 0;
4686         wl->radiotap_enabled = 0;
4687         b43_qos_clear(wl);
4688         wl->beacon0_uploaded = 0;
4689         wl->beacon1_uploaded = 0;
4690         wl->beacon_templates_virgin = 1;
4691         wl->radio_enabled = 1;
4692
4693         mutex_lock(&wl->mutex);
4694
4695         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4696                 err = b43_wireless_core_init(dev);
4697                 if (err)
4698                         goto out_mutex_unlock;
4699                 did_init = 1;
4700         }
4701
4702         if (b43_status(dev) < B43_STAT_STARTED) {
4703                 err = b43_wireless_core_start(dev);
4704                 if (err) {
4705                         if (did_init)
4706                                 b43_wireless_core_exit(dev);
4707                         goto out_mutex_unlock;
4708                 }
4709         }
4710
4711         /* XXX: only do if device doesn't support rfkill irq */
4712         wiphy_rfkill_start_polling(hw->wiphy);
4713
4714  out_mutex_unlock:
4715         mutex_unlock(&wl->mutex);
4716
4717         return err;
4718 }
4719
4720 static void b43_op_stop(struct ieee80211_hw *hw)
4721 {
4722         struct b43_wl *wl = hw_to_b43_wl(hw);
4723         struct b43_wldev *dev = wl->current_dev;
4724
4725         cancel_work_sync(&(wl->beacon_update_trigger));
4726
4727         mutex_lock(&wl->mutex);
4728         if (b43_status(dev) >= B43_STAT_STARTED) {
4729                 dev = b43_wireless_core_stop(dev);
4730                 if (!dev)
4731                         goto out_unlock;
4732         }
4733         b43_wireless_core_exit(dev);
4734         wl->radio_enabled = 0;
4735
4736 out_unlock:
4737         mutex_unlock(&wl->mutex);
4738
4739         cancel_work_sync(&(wl->txpower_adjust_work));
4740 }
4741
4742 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4743                                  struct ieee80211_sta *sta, bool set)
4744 {
4745         struct b43_wl *wl = hw_to_b43_wl(hw);
4746
4747         /* FIXME: add locking */
4748         b43_update_templates(wl);
4749
4750         return 0;
4751 }
4752
4753 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4754                               struct ieee80211_vif *vif,
4755                               enum sta_notify_cmd notify_cmd,
4756                               struct ieee80211_sta *sta)
4757 {
4758         struct b43_wl *wl = hw_to_b43_wl(hw);
4759
4760         B43_WARN_ON(!vif || wl->vif != vif);
4761 }
4762
4763 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4764 {
4765         struct b43_wl *wl = hw_to_b43_wl(hw);
4766         struct b43_wldev *dev;
4767
4768         mutex_lock(&wl->mutex);
4769         dev = wl->current_dev;
4770         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4771                 /* Disable CFP update during scan on other channels. */
4772                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4773         }
4774         mutex_unlock(&wl->mutex);
4775 }
4776
4777 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4778 {
4779         struct b43_wl *wl = hw_to_b43_wl(hw);
4780         struct b43_wldev *dev;
4781
4782         mutex_lock(&wl->mutex);
4783         dev = wl->current_dev;
4784         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4785                 /* Re-enable CFP update. */
4786                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4787         }
4788         mutex_unlock(&wl->mutex);
4789 }
4790
4791 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4792                              struct survey_info *survey)
4793 {
4794         struct b43_wl *wl = hw_to_b43_wl(hw);
4795         struct b43_wldev *dev = wl->current_dev;
4796         struct ieee80211_conf *conf = &hw->conf;
4797
4798         if (idx != 0)
4799                 return -ENOENT;
4800
4801         survey->channel = conf->channel;
4802         survey->filled = SURVEY_INFO_NOISE_DBM;
4803         survey->noise = dev->stats.link_noise;
4804
4805         return 0;
4806 }
4807
4808 static const struct ieee80211_ops b43_hw_ops = {
4809         .tx                     = b43_op_tx,
4810         .conf_tx                = b43_op_conf_tx,
4811         .add_interface          = b43_op_add_interface,
4812         .remove_interface       = b43_op_remove_interface,
4813         .config                 = b43_op_config,
4814         .bss_info_changed       = b43_op_bss_info_changed,
4815         .configure_filter       = b43_op_configure_filter,
4816         .set_key                = b43_op_set_key,
4817         .update_tkip_key        = b43_op_update_tkip_key,
4818         .get_stats              = b43_op_get_stats,
4819         .get_tsf                = b43_op_get_tsf,
4820         .set_tsf                = b43_op_set_tsf,
4821         .start                  = b43_op_start,
4822         .stop                   = b43_op_stop,
4823         .set_tim                = b43_op_beacon_set_tim,
4824         .sta_notify             = b43_op_sta_notify,
4825         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4826         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4827         .get_survey             = b43_op_get_survey,
4828         .rfkill_poll            = b43_rfkill_poll,
4829 };
4830
4831 /* Hard-reset the chip. Do not call this directly.
4832  * Use b43_controller_restart()
4833  */
4834 static void b43_chip_reset(struct work_struct *work)
4835 {
4836         struct b43_wldev *dev =
4837             container_of(work, struct b43_wldev, restart_work);
4838         struct b43_wl *wl = dev->wl;
4839         int err = 0;
4840         int prev_status;
4841
4842         mutex_lock(&wl->mutex);
4843
4844         prev_status = b43_status(dev);
4845         /* Bring the device down... */
4846         if (prev_status >= B43_STAT_STARTED) {
4847                 dev = b43_wireless_core_stop(dev);
4848                 if (!dev) {
4849                         err = -ENODEV;
4850                         goto out;
4851                 }
4852         }
4853         if (prev_status >= B43_STAT_INITIALIZED)
4854                 b43_wireless_core_exit(dev);
4855
4856         /* ...and up again. */
4857         if (prev_status >= B43_STAT_INITIALIZED) {
4858                 err = b43_wireless_core_init(dev);
4859                 if (err)
4860                         goto out;
4861         }
4862         if (prev_status >= B43_STAT_STARTED) {
4863                 err = b43_wireless_core_start(dev);
4864                 if (err) {
4865                         b43_wireless_core_exit(dev);
4866                         goto out;
4867                 }
4868         }
4869 out:
4870         if (err)
4871                 wl->current_dev = NULL; /* Failed to init the dev. */
4872         mutex_unlock(&wl->mutex);
4873         if (err)
4874                 b43err(wl, "Controller restart FAILED\n");
4875         else
4876                 b43info(wl, "Controller restarted\n");
4877 }
4878
4879 static int b43_setup_bands(struct b43_wldev *dev,
4880                            bool have_2ghz_phy, bool have_5ghz_phy)
4881 {
4882         struct ieee80211_hw *hw = dev->wl->hw;
4883
4884         if (have_2ghz_phy)
4885                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4886         if (dev->phy.type == B43_PHYTYPE_N) {
4887                 if (have_5ghz_phy)
4888                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4889         } else {
4890                 if (have_5ghz_phy)
4891                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4892         }
4893
4894         dev->phy.supports_2ghz = have_2ghz_phy;
4895         dev->phy.supports_5ghz = have_5ghz_phy;
4896
4897         return 0;
4898 }
4899
4900 static void b43_wireless_core_detach(struct b43_wldev *dev)
4901 {
4902         /* We release firmware that late to not be required to re-request
4903          * is all the time when we reinit the core. */
4904         b43_release_firmware(dev);
4905         b43_phy_free(dev);
4906 }
4907
4908 static int b43_wireless_core_attach(struct b43_wldev *dev)
4909 {
4910         struct b43_wl *wl = dev->wl;
4911         struct pci_dev *pdev = NULL;
4912         int err;
4913         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4914
4915         /* Do NOT do any device initialization here.
4916          * Do it in wireless_core_init() instead.
4917          * This function is for gathering basic information about the HW, only.
4918          * Also some structs may be set up here. But most likely you want to have
4919          * that in core_init(), too.
4920          */
4921
4922 #ifdef CONFIG_B43_SSB
4923         if (dev->dev->bus_type == B43_BUS_SSB &&
4924             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
4925                 pdev = dev->dev->sdev->bus->host_pci;
4926 #endif
4927
4928         err = b43_bus_powerup(dev, 0);
4929         if (err) {
4930                 b43err(wl, "Bus powerup failed\n");
4931                 goto out;
4932         }
4933
4934         /* Get the PHY type. */
4935         switch (dev->dev->bus_type) {
4936 #ifdef CONFIG_B43_BCMA
4937         case B43_BUS_BCMA:
4938                 /* FIXME */
4939                 have_2ghz_phy = 1;
4940                 have_5ghz_phy = 0;
4941                 break;
4942 #endif
4943 #ifdef CONFIG_B43_SSB
4944         case B43_BUS_SSB:
4945                 if (dev->dev->core_rev >= 5) {
4946                         u32 tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
4947                         have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4948                         have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4949                 } else
4950                         B43_WARN_ON(1);
4951                 break;
4952 #endif
4953         }
4954
4955         dev->phy.gmode = have_2ghz_phy;
4956         dev->phy.radio_on = 1;
4957         b43_wireless_core_reset(dev, dev->phy.gmode);
4958
4959         err = b43_phy_versioning(dev);
4960         if (err)
4961                 goto err_powerdown;
4962         /* Check if this device supports multiband. */
4963         if (!pdev ||
4964             (pdev->device != 0x4312 &&
4965              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4966                 /* No multiband support. */
4967                 have_2ghz_phy = 0;
4968                 have_5ghz_phy = 0;
4969                 switch (dev->phy.type) {
4970                 case B43_PHYTYPE_A:
4971                         have_5ghz_phy = 1;
4972                         break;
4973                 case B43_PHYTYPE_LP: //FIXME not always!
4974 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4975                         have_5ghz_phy = 1;
4976 #endif
4977                 case B43_PHYTYPE_G:
4978                 case B43_PHYTYPE_N:
4979                         have_2ghz_phy = 1;
4980                         break;
4981                 default:
4982                         B43_WARN_ON(1);
4983                 }
4984         }
4985         if (dev->phy.type == B43_PHYTYPE_A) {
4986                 /* FIXME */
4987                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4988                 err = -EOPNOTSUPP;
4989                 goto err_powerdown;
4990         }
4991         if (1 /* disable A-PHY */) {
4992                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4993                 if (dev->phy.type != B43_PHYTYPE_N &&
4994                     dev->phy.type != B43_PHYTYPE_LP) {
4995                         have_2ghz_phy = 1;
4996                         have_5ghz_phy = 0;
4997                 }
4998         }
4999
5000         err = b43_phy_allocate(dev);
5001         if (err)
5002                 goto err_powerdown;
5003
5004         dev->phy.gmode = have_2ghz_phy;
5005         b43_wireless_core_reset(dev, dev->phy.gmode);
5006
5007         err = b43_validate_chipaccess(dev);
5008         if (err)
5009                 goto err_phy_free;
5010         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5011         if (err)
5012                 goto err_phy_free;
5013
5014         /* Now set some default "current_dev" */
5015         if (!wl->current_dev)
5016                 wl->current_dev = dev;
5017         INIT_WORK(&dev->restart_work, b43_chip_reset);
5018
5019         dev->phy.ops->switch_analog(dev, 0);
5020         b43_device_disable(dev, 0);
5021         b43_bus_may_powerdown(dev);
5022
5023 out:
5024         return err;
5025
5026 err_phy_free:
5027         b43_phy_free(dev);
5028 err_powerdown:
5029         b43_bus_may_powerdown(dev);
5030         return err;
5031 }
5032
5033 static void b43_one_core_detach(struct b43_bus_dev *dev)
5034 {
5035         struct b43_wldev *wldev;
5036         struct b43_wl *wl;
5037
5038         /* Do not cancel ieee80211-workqueue based work here.
5039          * See comment in b43_remove(). */
5040
5041         wldev = b43_bus_get_wldev(dev);
5042         wl = wldev->wl;
5043         b43_debugfs_remove_device(wldev);
5044         b43_wireless_core_detach(wldev);
5045         list_del(&wldev->list);
5046         wl->nr_devs--;
5047         b43_bus_set_wldev(dev, NULL);
5048         kfree(wldev);
5049 }
5050
5051 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5052 {
5053         struct b43_wldev *wldev;
5054         int err = -ENOMEM;
5055
5056         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5057         if (!wldev)
5058                 goto out;
5059
5060         wldev->use_pio = b43_modparam_pio;
5061         wldev->dev = dev;
5062         wldev->wl = wl;
5063         b43_set_status(wldev, B43_STAT_UNINIT);
5064         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5065         INIT_LIST_HEAD(&wldev->list);
5066
5067         err = b43_wireless_core_attach(wldev);
5068         if (err)
5069                 goto err_kfree_wldev;
5070
5071         list_add(&wldev->list, &wl->devlist);
5072         wl->nr_devs++;
5073         b43_bus_set_wldev(dev, wldev);
5074         b43_debugfs_add_device(wldev);
5075
5076       out:
5077         return err;
5078
5079       err_kfree_wldev:
5080         kfree(wldev);
5081         return err;
5082 }
5083
5084 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5085         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5086         (pdev->device == _device) &&                                    \
5087         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5088         (pdev->subsystem_device == _subdevice)                          )
5089
5090 static void b43_sprom_fixup(struct ssb_bus *bus)
5091 {
5092         struct pci_dev *pdev;
5093
5094         /* boardflags workarounds */
5095         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5096             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
5097                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5098         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5099             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
5100                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5101         if (bus->bustype == SSB_BUSTYPE_PCI) {
5102                 pdev = bus->host_pci;
5103                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5104                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5105                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5106                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5107                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5108                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5109                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5110                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5111         }
5112 }
5113
5114 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5115 {
5116         struct ieee80211_hw *hw = wl->hw;
5117
5118         ssb_set_devtypedata(dev->sdev, NULL);
5119         ieee80211_free_hw(hw);
5120 }
5121
5122 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5123 {
5124         struct ssb_sprom *sprom = dev->bus_sprom;
5125         struct ieee80211_hw *hw;
5126         struct b43_wl *wl;
5127
5128         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5129         if (!hw) {
5130                 b43err(NULL, "Could not allocate ieee80211 device\n");
5131                 return ERR_PTR(-ENOMEM);
5132         }
5133         wl = hw_to_b43_wl(hw);
5134
5135         /* fill hw info */
5136         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5137                     IEEE80211_HW_SIGNAL_DBM;
5138
5139         hw->wiphy->interface_modes =
5140                 BIT(NL80211_IFTYPE_AP) |
5141                 BIT(NL80211_IFTYPE_MESH_POINT) |
5142                 BIT(NL80211_IFTYPE_STATION) |
5143                 BIT(NL80211_IFTYPE_WDS) |
5144                 BIT(NL80211_IFTYPE_ADHOC);
5145
5146         hw->queues = modparam_qos ? 4 : 1;
5147         wl->mac80211_initially_registered_queues = hw->queues;
5148         hw->max_rates = 2;
5149         SET_IEEE80211_DEV(hw, dev->dev);
5150         if (is_valid_ether_addr(sprom->et1mac))
5151                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5152         else
5153                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5154
5155         /* Initialize struct b43_wl */
5156         wl->hw = hw;
5157         mutex_init(&wl->mutex);
5158         spin_lock_init(&wl->hardirq_lock);
5159         INIT_LIST_HEAD(&wl->devlist);
5160         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5161         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5162         INIT_WORK(&wl->tx_work, b43_tx_work);
5163         skb_queue_head_init(&wl->tx_queue);
5164
5165         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
5166                 dev->chip_id, dev->core_rev);
5167         return wl;
5168 }
5169
5170 #ifdef CONFIG_B43_BCMA
5171 static int b43_bcma_probe(struct bcma_device *core)
5172 {
5173         struct b43_bus_dev *dev;
5174
5175         dev = b43_bus_dev_bcma_init(core);
5176         if (!dev)
5177                 return -ENODEV;
5178
5179         b43err(NULL, "BCMA is not supported yet!");
5180         kfree(dev);
5181         return -EOPNOTSUPP;
5182 }
5183
5184 static void b43_bcma_remove(struct bcma_device *core)
5185 {
5186         /* TODO */
5187 }
5188
5189 static struct bcma_driver b43_bcma_driver = {
5190         .name           = KBUILD_MODNAME,
5191         .id_table       = b43_bcma_tbl,
5192         .probe          = b43_bcma_probe,
5193         .remove         = b43_bcma_remove,
5194 };
5195 #endif
5196
5197 #ifdef CONFIG_B43_SSB
5198 static
5199 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5200 {
5201         struct b43_bus_dev *dev;
5202         struct b43_wl *wl;
5203         int err;
5204         int first = 0;
5205
5206         dev = b43_bus_dev_ssb_init(sdev);
5207         if (!dev)
5208                 return -ENOMEM;
5209
5210         wl = ssb_get_devtypedata(sdev);
5211         if (!wl) {
5212                 /* Probing the first core. Must setup common struct b43_wl */
5213                 first = 1;
5214                 b43_sprom_fixup(sdev->bus);
5215                 wl = b43_wireless_init(dev);
5216                 if (IS_ERR(wl)) {
5217                         err = PTR_ERR(wl);
5218                         goto out;
5219                 }
5220                 ssb_set_devtypedata(sdev, wl);
5221                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5222         }
5223         err = b43_one_core_attach(dev, wl);
5224         if (err)
5225                 goto err_wireless_exit;
5226
5227         if (first) {
5228                 err = ieee80211_register_hw(wl->hw);
5229                 if (err)
5230                         goto err_one_core_detach;
5231                 b43_leds_register(wl->current_dev);
5232         }
5233
5234       out:
5235         return err;
5236
5237       err_one_core_detach:
5238         b43_one_core_detach(dev);
5239       err_wireless_exit:
5240         if (first)
5241                 b43_wireless_exit(dev, wl);
5242         return err;
5243 }
5244
5245 static void b43_ssb_remove(struct ssb_device *sdev)
5246 {
5247         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5248         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5249
5250         /* We must cancel any work here before unregistering from ieee80211,
5251          * as the ieee80211 unreg will destroy the workqueue. */
5252         cancel_work_sync(&wldev->restart_work);
5253
5254         B43_WARN_ON(!wl);
5255         if (wl->current_dev == wldev) {
5256                 /* Restore the queues count before unregistering, because firmware detect
5257                  * might have modified it. Restoring is important, so the networking
5258                  * stack can properly free resources. */
5259                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5260                 b43_leds_stop(wldev);
5261                 ieee80211_unregister_hw(wl->hw);
5262         }
5263
5264         b43_one_core_detach(wldev->dev);
5265
5266         if (list_empty(&wl->devlist)) {
5267                 b43_leds_unregister(wl);
5268                 /* Last core on the chip unregistered.
5269                  * We can destroy common struct b43_wl.
5270                  */
5271                 b43_wireless_exit(wldev->dev, wl);
5272         }
5273 }
5274
5275 static struct ssb_driver b43_ssb_driver = {
5276         .name           = KBUILD_MODNAME,
5277         .id_table       = b43_ssb_tbl,
5278         .probe          = b43_ssb_probe,
5279         .remove         = b43_ssb_remove,
5280 };
5281 #endif /* CONFIG_B43_SSB */
5282
5283 /* Perform a hardware reset. This can be called from any context. */
5284 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5285 {
5286         /* Must avoid requeueing, if we are in shutdown. */
5287         if (b43_status(dev) < B43_STAT_INITIALIZED)
5288                 return;
5289         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5290         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5291 }
5292
5293 static void b43_print_driverinfo(void)
5294 {
5295         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5296                    *feat_leds = "", *feat_sdio = "";
5297
5298 #ifdef CONFIG_B43_PCI_AUTOSELECT
5299         feat_pci = "P";
5300 #endif
5301 #ifdef CONFIG_B43_PCMCIA
5302         feat_pcmcia = "M";
5303 #endif
5304 #ifdef CONFIG_B43_PHY_N
5305         feat_nphy = "N";
5306 #endif
5307 #ifdef CONFIG_B43_LEDS
5308         feat_leds = "L";
5309 #endif
5310 #ifdef CONFIG_B43_SDIO
5311         feat_sdio = "S";
5312 #endif
5313         printk(KERN_INFO "Broadcom 43xx driver loaded "
5314                "[ Features: %s%s%s%s%s, Firmware-ID: "
5315                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5316                feat_pci, feat_pcmcia, feat_nphy,
5317                feat_leds, feat_sdio);
5318 }
5319
5320 static int __init b43_init(void)
5321 {
5322         int err;
5323
5324         b43_debugfs_init();
5325         err = b43_pcmcia_init();
5326         if (err)
5327                 goto err_dfs_exit;
5328         err = b43_sdio_init();
5329         if (err)
5330                 goto err_pcmcia_exit;
5331 #ifdef CONFIG_B43_BCMA
5332         err = bcma_driver_register(&b43_bcma_driver);
5333         if (err)
5334                 goto err_sdio_exit;
5335 #endif
5336 #ifdef CONFIG_B43_SSB
5337         err = ssb_driver_register(&b43_ssb_driver);
5338         if (err)
5339                 goto err_bcma_driver_exit;
5340 #endif
5341         b43_print_driverinfo();
5342
5343         return err;
5344
5345 #ifdef CONFIG_B43_SSB
5346 err_bcma_driver_exit:
5347 #endif
5348 #ifdef CONFIG_B43_BCMA
5349         bcma_driver_unregister(&b43_bcma_driver);
5350 err_sdio_exit:
5351 #endif
5352         b43_sdio_exit();
5353 err_pcmcia_exit:
5354         b43_pcmcia_exit();
5355 err_dfs_exit:
5356         b43_debugfs_exit();
5357         return err;
5358 }
5359
5360 static void __exit b43_exit(void)
5361 {
5362 #ifdef CONFIG_B43_SSB
5363         ssb_driver_unregister(&b43_ssb_driver);
5364 #endif
5365 #ifdef CONFIG_B43_BCMA
5366         bcma_driver_unregister(&b43_bcma_driver);
5367 #endif
5368         b43_sdio_exit();
5369         b43_pcmcia_exit();
5370         b43_debugfs_exit();
5371 }
5372
5373 module_init(b43_init)
5374 module_exit(b43_exit)