drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 #ifdef CONFIG_B43_BCMA
1159 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1160 {
1161         u32 flags = 0;
1162
1163         if (gmode)
1164                 flags = B43_BCMA_IOCTL_GMODE;
1165         flags |= B43_BCMA_IOCTL_PHY_CLKEN;
1166         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1167         b43_device_enable(dev, flags);
1168
1169         /* TODO: reset PHY */
1170 }
1171 #endif
1172
1173 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1174 {
1175         struct ssb_device *sdev = dev->dev->sdev;
1176         u32 tmslow;
1177         u32 flags = 0;
1178
1179         if (gmode)
1180                 flags |= B43_TMSLOW_GMODE;
1181         flags |= B43_TMSLOW_PHYCLKEN;
1182         flags |= B43_TMSLOW_PHYRESET;
1183         if (dev->phy.type == B43_PHYTYPE_N)
1184                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1185         b43_device_enable(dev, flags);
1186         msleep(2);              /* Wait for the PLL to turn on. */
1187
1188         /* Now take the PHY out of Reset again */
1189         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1190         tmslow |= SSB_TMSLOW_FGC;
1191         tmslow &= ~B43_TMSLOW_PHYRESET;
1192         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1193         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1194         msleep(1);
1195         tmslow &= ~SSB_TMSLOW_FGC;
1196         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1197         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1198         msleep(1);
1199 }
1200
1201 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1202 {
1203         u32 macctl;
1204
1205         switch (dev->dev->bus_type) {
1206 #ifdef CONFIG_B43_BCMA
1207         case B43_BUS_BCMA:
1208                 b43_bcma_wireless_core_reset(dev, gmode);
1209                 break;
1210 #endif
1211 #ifdef CONFIG_B43_SSB
1212         case B43_BUS_SSB:
1213                 b43_ssb_wireless_core_reset(dev, gmode);
1214                 break;
1215 #endif
1216         }
1217
1218         /* Turn Analog ON, but only if we already know the PHY-type.
1219          * This protects against very early setup where we don't know the
1220          * PHY-type, yet. wireless_core_reset will be called once again later,
1221          * when we know the PHY-type. */
1222         if (dev->phy.ops)
1223                 dev->phy.ops->switch_analog(dev, 1);
1224
1225         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1226         macctl &= ~B43_MACCTL_GMODE;
1227         if (gmode)
1228                 macctl |= B43_MACCTL_GMODE;
1229         macctl |= B43_MACCTL_IHR_ENABLED;
1230         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1231 }
1232
1233 static void handle_irq_transmit_status(struct b43_wldev *dev)
1234 {
1235         u32 v0, v1;
1236         u16 tmp;
1237         struct b43_txstatus stat;
1238
1239         while (1) {
1240                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1241                 if (!(v0 & 0x00000001))
1242                         break;
1243                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1244
1245                 stat.cookie = (v0 >> 16);
1246                 stat.seq = (v1 & 0x0000FFFF);
1247                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1248                 tmp = (v0 & 0x0000FFFF);
1249                 stat.frame_count = ((tmp & 0xF000) >> 12);
1250                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1251                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1252                 stat.pm_indicated = !!(tmp & 0x0080);
1253                 stat.intermediate = !!(tmp & 0x0040);
1254                 stat.for_ampdu = !!(tmp & 0x0020);
1255                 stat.acked = !!(tmp & 0x0002);
1256
1257                 b43_handle_txstatus(dev, &stat);
1258         }
1259 }
1260
1261 static void drain_txstatus_queue(struct b43_wldev *dev)
1262 {
1263         u32 dummy;
1264
1265         if (dev->dev->core_rev < 5)
1266                 return;
1267         /* Read all entries from the microcode TXstatus FIFO
1268          * and throw them away.
1269          */
1270         while (1) {
1271                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1272                 if (!(dummy & 0x00000001))
1273                         break;
1274                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1275         }
1276 }
1277
1278 static u32 b43_jssi_read(struct b43_wldev *dev)
1279 {
1280         u32 val = 0;
1281
1282         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1283         val <<= 16;
1284         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1285
1286         return val;
1287 }
1288
1289 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1290 {
1291         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1292         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1293 }
1294
1295 static void b43_generate_noise_sample(struct b43_wldev *dev)
1296 {
1297         b43_jssi_write(dev, 0x7F7F7F7F);
1298         b43_write32(dev, B43_MMIO_MACCMD,
1299                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1300 }
1301
1302 static void b43_calculate_link_quality(struct b43_wldev *dev)
1303 {
1304         /* Top half of Link Quality calculation. */
1305
1306         if (dev->phy.type != B43_PHYTYPE_G)
1307                 return;
1308         if (dev->noisecalc.calculation_running)
1309                 return;
1310         dev->noisecalc.calculation_running = 1;
1311         dev->noisecalc.nr_samples = 0;
1312
1313         b43_generate_noise_sample(dev);
1314 }
1315
1316 static void handle_irq_noise(struct b43_wldev *dev)
1317 {
1318         struct b43_phy_g *phy = dev->phy.g;
1319         u16 tmp;
1320         u8 noise[4];
1321         u8 i, j;
1322         s32 average;
1323
1324         /* Bottom half of Link Quality calculation. */
1325
1326         if (dev->phy.type != B43_PHYTYPE_G)
1327                 return;
1328
1329         /* Possible race condition: It might be possible that the user
1330          * changed to a different channel in the meantime since we
1331          * started the calculation. We ignore that fact, since it's
1332          * not really that much of a problem. The background noise is
1333          * an estimation only anyway. Slightly wrong results will get damped
1334          * by the averaging of the 8 sample rounds. Additionally the
1335          * value is shortlived. So it will be replaced by the next noise
1336          * calculation round soon. */
1337
1338         B43_WARN_ON(!dev->noisecalc.calculation_running);
1339         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1340         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1341             noise[2] == 0x7F || noise[3] == 0x7F)
1342                 goto generate_new;
1343
1344         /* Get the noise samples. */
1345         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1346         i = dev->noisecalc.nr_samples;
1347         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1348         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1349         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1350         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1351         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1352         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1353         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1354         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1355         dev->noisecalc.nr_samples++;
1356         if (dev->noisecalc.nr_samples == 8) {
1357                 /* Calculate the Link Quality by the noise samples. */
1358                 average = 0;
1359                 for (i = 0; i < 8; i++) {
1360                         for (j = 0; j < 4; j++)
1361                                 average += dev->noisecalc.samples[i][j];
1362                 }
1363                 average /= (8 * 4);
1364                 average *= 125;
1365                 average += 64;
1366                 average /= 128;
1367                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1368                 tmp = (tmp / 128) & 0x1F;
1369                 if (tmp >= 8)
1370                         average += 2;
1371                 else
1372                         average -= 25;
1373                 if (tmp == 8)
1374                         average -= 72;
1375                 else
1376                         average -= 48;
1377
1378                 dev->stats.link_noise = average;
1379                 dev->noisecalc.calculation_running = 0;
1380                 return;
1381         }
1382 generate_new:
1383         b43_generate_noise_sample(dev);
1384 }
1385
1386 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1387 {
1388         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1389                 ///TODO: PS TBTT
1390         } else {
1391                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1392                         b43_power_saving_ctl_bits(dev, 0);
1393         }
1394         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1395                 dev->dfq_valid = 1;
1396 }
1397
1398 static void handle_irq_atim_end(struct b43_wldev *dev)
1399 {
1400         if (dev->dfq_valid) {
1401                 b43_write32(dev, B43_MMIO_MACCMD,
1402                             b43_read32(dev, B43_MMIO_MACCMD)
1403                             | B43_MACCMD_DFQ_VALID);
1404                 dev->dfq_valid = 0;
1405         }
1406 }
1407
1408 static void handle_irq_pmq(struct b43_wldev *dev)
1409 {
1410         u32 tmp;
1411
1412         //TODO: AP mode.
1413
1414         while (1) {
1415                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1416                 if (!(tmp & 0x00000008))
1417                         break;
1418         }
1419         /* 16bit write is odd, but correct. */
1420         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1421 }
1422
1423 static void b43_write_template_common(struct b43_wldev *dev,
1424                                       const u8 *data, u16 size,
1425                                       u16 ram_offset,
1426                                       u16 shm_size_offset, u8 rate)
1427 {
1428         u32 i, tmp;
1429         struct b43_plcp_hdr4 plcp;
1430
1431         plcp.data = 0;
1432         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1433         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1434         ram_offset += sizeof(u32);
1435         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1436          * So leave the first two bytes of the next write blank.
1437          */
1438         tmp = (u32) (data[0]) << 16;
1439         tmp |= (u32) (data[1]) << 24;
1440         b43_ram_write(dev, ram_offset, tmp);
1441         ram_offset += sizeof(u32);
1442         for (i = 2; i < size; i += sizeof(u32)) {
1443                 tmp = (u32) (data[i + 0]);
1444                 if (i + 1 < size)
1445                         tmp |= (u32) (data[i + 1]) << 8;
1446                 if (i + 2 < size)
1447                         tmp |= (u32) (data[i + 2]) << 16;
1448                 if (i + 3 < size)
1449                         tmp |= (u32) (data[i + 3]) << 24;
1450                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1451         }
1452         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1453                         size + sizeof(struct b43_plcp_hdr6));
1454 }
1455
1456 /* Check if the use of the antenna that ieee80211 told us to
1457  * use is possible. This will fall back to DEFAULT.
1458  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1459 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1460                                   u8 antenna_nr)
1461 {
1462         u8 antenna_mask;
1463
1464         if (antenna_nr == 0) {
1465                 /* Zero means "use default antenna". That's always OK. */
1466                 return 0;
1467         }
1468
1469         /* Get the mask of available antennas. */
1470         if (dev->phy.gmode)
1471                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1472         else
1473                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1474
1475         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1476                 /* This antenna is not available. Fall back to default. */
1477                 return 0;
1478         }
1479
1480         return antenna_nr;
1481 }
1482
1483 /* Convert a b43 antenna number value to the PHY TX control value. */
1484 static u16 b43_antenna_to_phyctl(int antenna)
1485 {
1486         switch (antenna) {
1487         case B43_ANTENNA0:
1488                 return B43_TXH_PHY_ANT0;
1489         case B43_ANTENNA1:
1490                 return B43_TXH_PHY_ANT1;
1491         case B43_ANTENNA2:
1492                 return B43_TXH_PHY_ANT2;
1493         case B43_ANTENNA3:
1494                 return B43_TXH_PHY_ANT3;
1495         case B43_ANTENNA_AUTO0:
1496         case B43_ANTENNA_AUTO1:
1497                 return B43_TXH_PHY_ANT01AUTO;
1498         }
1499         B43_WARN_ON(1);
1500         return 0;
1501 }
1502
1503 static void b43_write_beacon_template(struct b43_wldev *dev,
1504                                       u16 ram_offset,
1505                                       u16 shm_size_offset)
1506 {
1507         unsigned int i, len, variable_len;
1508         const struct ieee80211_mgmt *bcn;
1509         const u8 *ie;
1510         bool tim_found = 0;
1511         unsigned int rate;
1512         u16 ctl;
1513         int antenna;
1514         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1515
1516         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1517         len = min((size_t) dev->wl->current_beacon->len,
1518                   0x200 - sizeof(struct b43_plcp_hdr6));
1519         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1520
1521         b43_write_template_common(dev, (const u8 *)bcn,
1522                                   len, ram_offset, shm_size_offset, rate);
1523
1524         /* Write the PHY TX control parameters. */
1525         antenna = B43_ANTENNA_DEFAULT;
1526         antenna = b43_antenna_to_phyctl(antenna);
1527         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1528         /* We can't send beacons with short preamble. Would get PHY errors. */
1529         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1530         ctl &= ~B43_TXH_PHY_ANT;
1531         ctl &= ~B43_TXH_PHY_ENC;
1532         ctl |= antenna;
1533         if (b43_is_cck_rate(rate))
1534                 ctl |= B43_TXH_PHY_ENC_CCK;
1535         else
1536                 ctl |= B43_TXH_PHY_ENC_OFDM;
1537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1538
1539         /* Find the position of the TIM and the DTIM_period value
1540          * and write them to SHM. */
1541         ie = bcn->u.beacon.variable;
1542         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1543         for (i = 0; i < variable_len - 2; ) {
1544                 uint8_t ie_id, ie_len;
1545
1546                 ie_id = ie[i];
1547                 ie_len = ie[i + 1];
1548                 if (ie_id == 5) {
1549                         u16 tim_position;
1550                         u16 dtim_period;
1551                         /* This is the TIM Information Element */
1552
1553                         /* Check whether the ie_len is in the beacon data range. */
1554                         if (variable_len < ie_len + 2 + i)
1555                                 break;
1556                         /* A valid TIM is at least 4 bytes long. */
1557                         if (ie_len < 4)
1558                                 break;
1559                         tim_found = 1;
1560
1561                         tim_position = sizeof(struct b43_plcp_hdr6);
1562                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1563                         tim_position += i;
1564
1565                         dtim_period = ie[i + 3];
1566
1567                         b43_shm_write16(dev, B43_SHM_SHARED,
1568                                         B43_SHM_SH_TIMBPOS, tim_position);
1569                         b43_shm_write16(dev, B43_SHM_SHARED,
1570                                         B43_SHM_SH_DTIMPER, dtim_period);
1571                         break;
1572                 }
1573                 i += ie_len + 2;
1574         }
1575         if (!tim_found) {
1576                 /*
1577                  * If ucode wants to modify TIM do it behind the beacon, this
1578                  * will happen, for example, when doing mesh networking.
1579                  */
1580                 b43_shm_write16(dev, B43_SHM_SHARED,
1581                                 B43_SHM_SH_TIMBPOS,
1582                                 len + sizeof(struct b43_plcp_hdr6));
1583                 b43_shm_write16(dev, B43_SHM_SHARED,
1584                                 B43_SHM_SH_DTIMPER, 0);
1585         }
1586         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1587 }
1588
1589 static void b43_upload_beacon0(struct b43_wldev *dev)
1590 {
1591         struct b43_wl *wl = dev->wl;
1592
1593         if (wl->beacon0_uploaded)
1594                 return;
1595         b43_write_beacon_template(dev, 0x68, 0x18);
1596         wl->beacon0_uploaded = 1;
1597 }
1598
1599 static void b43_upload_beacon1(struct b43_wldev *dev)
1600 {
1601         struct b43_wl *wl = dev->wl;
1602
1603         if (wl->beacon1_uploaded)
1604                 return;
1605         b43_write_beacon_template(dev, 0x468, 0x1A);
1606         wl->beacon1_uploaded = 1;
1607 }
1608
1609 static void handle_irq_beacon(struct b43_wldev *dev)
1610 {
1611         struct b43_wl *wl = dev->wl;
1612         u32 cmd, beacon0_valid, beacon1_valid;
1613
1614         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1615             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1616                 return;
1617
1618         /* This is the bottom half of the asynchronous beacon update. */
1619
1620         /* Ignore interrupt in the future. */
1621         dev->irq_mask &= ~B43_IRQ_BEACON;
1622
1623         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1624         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1625         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1626
1627         /* Schedule interrupt manually, if busy. */
1628         if (beacon0_valid && beacon1_valid) {
1629                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1630                 dev->irq_mask |= B43_IRQ_BEACON;
1631                 return;
1632         }
1633
1634         if (unlikely(wl->beacon_templates_virgin)) {
1635                 /* We never uploaded a beacon before.
1636                  * Upload both templates now, but only mark one valid. */
1637                 wl->beacon_templates_virgin = 0;
1638                 b43_upload_beacon0(dev);
1639                 b43_upload_beacon1(dev);
1640                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1641                 cmd |= B43_MACCMD_BEACON0_VALID;
1642                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1643         } else {
1644                 if (!beacon0_valid) {
1645                         b43_upload_beacon0(dev);
1646                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1647                         cmd |= B43_MACCMD_BEACON0_VALID;
1648                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1649                 } else if (!beacon1_valid) {
1650                         b43_upload_beacon1(dev);
1651                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1652                         cmd |= B43_MACCMD_BEACON1_VALID;
1653                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1654                 }
1655         }
1656 }
1657
1658 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1659 {
1660         u32 old_irq_mask = dev->irq_mask;
1661
1662         /* update beacon right away or defer to irq */
1663         handle_irq_beacon(dev);
1664         if (old_irq_mask != dev->irq_mask) {
1665                 /* The handler updated the IRQ mask. */
1666                 B43_WARN_ON(!dev->irq_mask);
1667                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1668                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1669                 } else {
1670                         /* Device interrupts are currently disabled. That means
1671                          * we just ran the hardirq handler and scheduled the
1672                          * IRQ thread. The thread will write the IRQ mask when
1673                          * it finished, so there's nothing to do here. Writing
1674                          * the mask _here_ would incorrectly re-enable IRQs. */
1675                 }
1676         }
1677 }
1678
1679 static void b43_beacon_update_trigger_work(struct work_struct *work)
1680 {
1681         struct b43_wl *wl = container_of(work, struct b43_wl,
1682                                          beacon_update_trigger);
1683         struct b43_wldev *dev;
1684
1685         mutex_lock(&wl->mutex);
1686         dev = wl->current_dev;
1687         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1688                 if (b43_bus_host_is_sdio(dev->dev)) {
1689                         /* wl->mutex is enough. */
1690                         b43_do_beacon_update_trigger_work(dev);
1691                         mmiowb();
1692                 } else {
1693                         spin_lock_irq(&wl->hardirq_lock);
1694                         b43_do_beacon_update_trigger_work(dev);
1695                         mmiowb();
1696                         spin_unlock_irq(&wl->hardirq_lock);
1697                 }
1698         }
1699         mutex_unlock(&wl->mutex);
1700 }
1701
1702 /* Asynchronously update the packet templates in template RAM.
1703  * Locking: Requires wl->mutex to be locked. */
1704 static void b43_update_templates(struct b43_wl *wl)
1705 {
1706         struct sk_buff *beacon;
1707
1708         /* This is the top half of the ansynchronous beacon update.
1709          * The bottom half is the beacon IRQ.
1710          * Beacon update must be asynchronous to avoid sending an
1711          * invalid beacon. This can happen for example, if the firmware
1712          * transmits a beacon while we are updating it. */
1713
1714         /* We could modify the existing beacon and set the aid bit in
1715          * the TIM field, but that would probably require resizing and
1716          * moving of data within the beacon template.
1717          * Simply request a new beacon and let mac80211 do the hard work. */
1718         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1719         if (unlikely(!beacon))
1720                 return;
1721
1722         if (wl->current_beacon)
1723                 dev_kfree_skb_any(wl->current_beacon);
1724         wl->current_beacon = beacon;
1725         wl->beacon0_uploaded = 0;
1726         wl->beacon1_uploaded = 0;
1727         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1728 }
1729
1730 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1731 {
1732         b43_time_lock(dev);
1733         if (dev->dev->core_rev >= 3) {
1734                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1735                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1736         } else {
1737                 b43_write16(dev, 0x606, (beacon_int >> 6));
1738                 b43_write16(dev, 0x610, beacon_int);
1739         }
1740         b43_time_unlock(dev);
1741         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1742 }
1743
1744 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1745 {
1746         u16 reason;
1747
1748         /* Read the register that contains the reason code for the panic. */
1749         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1750         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1751
1752         switch (reason) {
1753         default:
1754                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1755                 /* fallthrough */
1756         case B43_FWPANIC_DIE:
1757                 /* Do not restart the controller or firmware.
1758                  * The device is nonfunctional from now on.
1759                  * Restarting would result in this panic to trigger again,
1760                  * so we avoid that recursion. */
1761                 break;
1762         case B43_FWPANIC_RESTART:
1763                 b43_controller_restart(dev, "Microcode panic");
1764                 break;
1765         }
1766 }
1767
1768 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1769 {
1770         unsigned int i, cnt;
1771         u16 reason, marker_id, marker_line;
1772         __le16 *buf;
1773
1774         /* The proprietary firmware doesn't have this IRQ. */
1775         if (!dev->fw.opensource)
1776                 return;
1777
1778         /* Read the register that contains the reason code for this IRQ. */
1779         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1780
1781         switch (reason) {
1782         case B43_DEBUGIRQ_PANIC:
1783                 b43_handle_firmware_panic(dev);
1784                 break;
1785         case B43_DEBUGIRQ_DUMP_SHM:
1786                 if (!B43_DEBUG)
1787                         break; /* Only with driver debugging enabled. */
1788                 buf = kmalloc(4096, GFP_ATOMIC);
1789                 if (!buf) {
1790                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1791                         goto out;
1792                 }
1793                 for (i = 0; i < 4096; i += 2) {
1794                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1795                         buf[i / 2] = cpu_to_le16(tmp);
1796                 }
1797                 b43info(dev->wl, "Shared memory dump:\n");
1798                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1799                                16, 2, buf, 4096, 1);
1800                 kfree(buf);
1801                 break;
1802         case B43_DEBUGIRQ_DUMP_REGS:
1803                 if (!B43_DEBUG)
1804                         break; /* Only with driver debugging enabled. */
1805                 b43info(dev->wl, "Microcode register dump:\n");
1806                 for (i = 0, cnt = 0; i < 64; i++) {
1807                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1808                         if (cnt == 0)
1809                                 printk(KERN_INFO);
1810                         printk("r%02u: 0x%04X  ", i, tmp);
1811                         cnt++;
1812                         if (cnt == 6) {
1813                                 printk("\n");
1814                                 cnt = 0;
1815                         }
1816                 }
1817                 printk("\n");
1818                 break;
1819         case B43_DEBUGIRQ_MARKER:
1820                 if (!B43_DEBUG)
1821                         break; /* Only with driver debugging enabled. */
1822                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1823                                            B43_MARKER_ID_REG);
1824                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1825                                              B43_MARKER_LINE_REG);
1826                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1827                         "at line number %u\n",
1828                         marker_id, marker_line);
1829                 break;
1830         default:
1831                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1832                        reason);
1833         }
1834 out:
1835         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1836         b43_shm_write16(dev, B43_SHM_SCRATCH,
1837                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1838 }
1839
1840 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1841 {
1842         u32 reason;
1843         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1844         u32 merged_dma_reason = 0;
1845         int i;
1846
1847         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1848                 return;
1849
1850         reason = dev->irq_reason;
1851         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1852                 dma_reason[i] = dev->dma_reason[i];
1853                 merged_dma_reason |= dma_reason[i];
1854         }
1855
1856         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1857                 b43err(dev->wl, "MAC transmission error\n");
1858
1859         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1860                 b43err(dev->wl, "PHY transmission error\n");
1861                 rmb();
1862                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1863                         atomic_set(&dev->phy.txerr_cnt,
1864                                    B43_PHY_TX_BADNESS_LIMIT);
1865                         b43err(dev->wl, "Too many PHY TX errors, "
1866                                         "restarting the controller\n");
1867                         b43_controller_restart(dev, "PHY TX errors");
1868                 }
1869         }
1870
1871         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1872                                           B43_DMAIRQ_NONFATALMASK))) {
1873                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1874                         b43err(dev->wl, "Fatal DMA error: "
1875                                "0x%08X, 0x%08X, 0x%08X, "
1876                                "0x%08X, 0x%08X, 0x%08X\n",
1877                                dma_reason[0], dma_reason[1],
1878                                dma_reason[2], dma_reason[3],
1879                                dma_reason[4], dma_reason[5]);
1880                         b43err(dev->wl, "This device does not support DMA "
1881                                "on your system. It will now be switched to PIO.\n");
1882                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1883                         dev->use_pio = 1;
1884                         b43_controller_restart(dev, "DMA error");
1885                         return;
1886                 }
1887                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1888                         b43err(dev->wl, "DMA error: "
1889                                "0x%08X, 0x%08X, 0x%08X, "
1890                                "0x%08X, 0x%08X, 0x%08X\n",
1891                                dma_reason[0], dma_reason[1],
1892                                dma_reason[2], dma_reason[3],
1893                                dma_reason[4], dma_reason[5]);
1894                 }
1895         }
1896
1897         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1898                 handle_irq_ucode_debug(dev);
1899         if (reason & B43_IRQ_TBTT_INDI)
1900                 handle_irq_tbtt_indication(dev);
1901         if (reason & B43_IRQ_ATIM_END)
1902                 handle_irq_atim_end(dev);
1903         if (reason & B43_IRQ_BEACON)
1904                 handle_irq_beacon(dev);
1905         if (reason & B43_IRQ_PMQ)
1906                 handle_irq_pmq(dev);
1907         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1908                 ;/* TODO */
1909         if (reason & B43_IRQ_NOISESAMPLE_OK)
1910                 handle_irq_noise(dev);
1911
1912         /* Check the DMA reason registers for received data. */
1913         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1914                 if (b43_using_pio_transfers(dev))
1915                         b43_pio_rx(dev->pio.rx_queue);
1916                 else
1917                         b43_dma_rx(dev->dma.rx_ring);
1918         }
1919         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1920         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1921         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1922         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1923         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1924
1925         if (reason & B43_IRQ_TX_OK)
1926                 handle_irq_transmit_status(dev);
1927
1928         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1929         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1930
1931 #if B43_DEBUG
1932         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1933                 dev->irq_count++;
1934                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1935                         if (reason & (1 << i))
1936                                 dev->irq_bit_count[i]++;
1937                 }
1938         }
1939 #endif
1940 }
1941
1942 /* Interrupt thread handler. Handles device interrupts in thread context. */
1943 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1944 {
1945         struct b43_wldev *dev = dev_id;
1946
1947         mutex_lock(&dev->wl->mutex);
1948         b43_do_interrupt_thread(dev);
1949         mmiowb();
1950         mutex_unlock(&dev->wl->mutex);
1951
1952         return IRQ_HANDLED;
1953 }
1954
1955 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1956 {
1957         u32 reason;
1958
1959         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1960          * On SDIO, this runs under wl->mutex. */
1961
1962         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1963         if (reason == 0xffffffff)       /* shared IRQ */
1964                 return IRQ_NONE;
1965         reason &= dev->irq_mask;
1966         if (!reason)
1967                 return IRQ_NONE;
1968
1969         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1970             & 0x0001DC00;
1971         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1972             & 0x0000DC00;
1973         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1974             & 0x0000DC00;
1975         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1976             & 0x0001DC00;
1977         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1978             & 0x0000DC00;
1979 /* Unused ring
1980         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1981             & 0x0000DC00;
1982 */
1983
1984         /* ACK the interrupt. */
1985         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1986         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1987         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1988         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1989         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1990         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1991 /* Unused ring
1992         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1993 */
1994
1995         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1996         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1997         /* Save the reason bitmasks for the IRQ thread handler. */
1998         dev->irq_reason = reason;
1999
2000         return IRQ_WAKE_THREAD;
2001 }
2002
2003 /* Interrupt handler top-half. This runs with interrupts disabled. */
2004 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2005 {
2006         struct b43_wldev *dev = dev_id;
2007         irqreturn_t ret;
2008
2009         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2010                 return IRQ_NONE;
2011
2012         spin_lock(&dev->wl->hardirq_lock);
2013         ret = b43_do_interrupt(dev);
2014         mmiowb();
2015         spin_unlock(&dev->wl->hardirq_lock);
2016
2017         return ret;
2018 }
2019
2020 /* SDIO interrupt handler. This runs in process context. */
2021 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2022 {
2023         struct b43_wl *wl = dev->wl;
2024         irqreturn_t ret;
2025
2026         mutex_lock(&wl->mutex);
2027
2028         ret = b43_do_interrupt(dev);
2029         if (ret == IRQ_WAKE_THREAD)
2030                 b43_do_interrupt_thread(dev);
2031
2032         mutex_unlock(&wl->mutex);
2033 }
2034
2035 void b43_do_release_fw(struct b43_firmware_file *fw)
2036 {
2037         release_firmware(fw->data);
2038         fw->data = NULL;
2039         fw->filename = NULL;
2040 }
2041
2042 static void b43_release_firmware(struct b43_wldev *dev)
2043 {
2044         b43_do_release_fw(&dev->fw.ucode);
2045         b43_do_release_fw(&dev->fw.pcm);
2046         b43_do_release_fw(&dev->fw.initvals);
2047         b43_do_release_fw(&dev->fw.initvals_band);
2048 }
2049
2050 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2051 {
2052         const char text[] =
2053                 "You must go to " \
2054                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2055                 "and download the correct firmware for this driver version. " \
2056                 "Please carefully read all instructions on this website.\n";
2057
2058         if (error)
2059                 b43err(wl, text);
2060         else
2061                 b43warn(wl, text);
2062 }
2063
2064 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2065                       const char *name,
2066                       struct b43_firmware_file *fw)
2067 {
2068         const struct firmware *blob;
2069         struct b43_fw_header *hdr;
2070         u32 size;
2071         int err;
2072
2073         if (!name) {
2074                 /* Don't fetch anything. Free possibly cached firmware. */
2075                 /* FIXME: We should probably keep it anyway, to save some headache
2076                  * on suspend/resume with multiband devices. */
2077                 b43_do_release_fw(fw);
2078                 return 0;
2079         }
2080         if (fw->filename) {
2081                 if ((fw->type == ctx->req_type) &&
2082                     (strcmp(fw->filename, name) == 0))
2083                         return 0; /* Already have this fw. */
2084                 /* Free the cached firmware first. */
2085                 /* FIXME: We should probably do this later after we successfully
2086                  * got the new fw. This could reduce headache with multiband devices.
2087                  * We could also redesign this to cache the firmware for all possible
2088                  * bands all the time. */
2089                 b43_do_release_fw(fw);
2090         }
2091
2092         switch (ctx->req_type) {
2093         case B43_FWTYPE_PROPRIETARY:
2094                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2095                          "b43%s/%s.fw",
2096                          modparam_fwpostfix, name);
2097                 break;
2098         case B43_FWTYPE_OPENSOURCE:
2099                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2100                          "b43-open%s/%s.fw",
2101                          modparam_fwpostfix, name);
2102                 break;
2103         default:
2104                 B43_WARN_ON(1);
2105                 return -ENOSYS;
2106         }
2107         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2108         if (err == -ENOENT) {
2109                 snprintf(ctx->errors[ctx->req_type],
2110                          sizeof(ctx->errors[ctx->req_type]),
2111                          "Firmware file \"%s\" not found\n", ctx->fwname);
2112                 return err;
2113         } else if (err) {
2114                 snprintf(ctx->errors[ctx->req_type],
2115                          sizeof(ctx->errors[ctx->req_type]),
2116                          "Firmware file \"%s\" request failed (err=%d)\n",
2117                          ctx->fwname, err);
2118                 return err;
2119         }
2120         if (blob->size < sizeof(struct b43_fw_header))
2121                 goto err_format;
2122         hdr = (struct b43_fw_header *)(blob->data);
2123         switch (hdr->type) {
2124         case B43_FW_TYPE_UCODE:
2125         case B43_FW_TYPE_PCM:
2126                 size = be32_to_cpu(hdr->size);
2127                 if (size != blob->size - sizeof(struct b43_fw_header))
2128                         goto err_format;
2129                 /* fallthrough */
2130         case B43_FW_TYPE_IV:
2131                 if (hdr->ver != 1)
2132                         goto err_format;
2133                 break;
2134         default:
2135                 goto err_format;
2136         }
2137
2138         fw->data = blob;
2139         fw->filename = name;
2140         fw->type = ctx->req_type;
2141
2142         return 0;
2143
2144 err_format:
2145         snprintf(ctx->errors[ctx->req_type],
2146                  sizeof(ctx->errors[ctx->req_type]),
2147                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2148         release_firmware(blob);
2149
2150         return -EPROTO;
2151 }
2152
2153 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2154 {
2155         struct b43_wldev *dev = ctx->dev;
2156         struct b43_firmware *fw = &ctx->dev->fw;
2157         const u8 rev = ctx->dev->dev->core_rev;
2158         const char *filename;
2159         u32 tmshigh;
2160         int err;
2161
2162         /* Files for HT and LCN were found by trying one by one */
2163
2164         /* Get microcode */
2165         if ((rev >= 5) && (rev <= 10)) {
2166                 filename = "ucode5";
2167         } else if ((rev >= 11) && (rev <= 12)) {
2168                 filename = "ucode11";
2169         } else if (rev == 13) {
2170                 filename = "ucode13";
2171         } else if (rev == 14) {
2172                 filename = "ucode14";
2173         } else if (rev == 15) {
2174                 filename = "ucode15";
2175         } else {
2176                 switch (dev->phy.type) {
2177                 case B43_PHYTYPE_N:
2178                         if (rev >= 16)
2179                                 filename = "ucode16_mimo";
2180                         else
2181                                 goto err_no_ucode;
2182                         break;
2183                 case B43_PHYTYPE_HT:
2184                         if (rev == 29)
2185                                 filename = "ucode29_mimo";
2186                         else
2187                                 goto err_no_ucode;
2188                         break;
2189                 case B43_PHYTYPE_LCN:
2190                         if (rev == 24)
2191                                 filename = "ucode24_mimo";
2192                         else
2193                                 goto err_no_ucode;
2194                         break;
2195                 default:
2196                         goto err_no_ucode;
2197                 }
2198         }
2199         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2200         if (err)
2201                 goto err_load;
2202
2203         /* Get PCM code */
2204         if ((rev >= 5) && (rev <= 10))
2205                 filename = "pcm5";
2206         else if (rev >= 11)
2207                 filename = NULL;
2208         else
2209                 goto err_no_pcm;
2210         fw->pcm_request_failed = 0;
2211         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2212         if (err == -ENOENT) {
2213                 /* We did not find a PCM file? Not fatal, but
2214                  * core rev <= 10 must do without hwcrypto then. */
2215                 fw->pcm_request_failed = 1;
2216         } else if (err)
2217                 goto err_load;
2218
2219         /* Get initvals */
2220         switch (dev->phy.type) {
2221         case B43_PHYTYPE_A:
2222                 if ((rev >= 5) && (rev <= 10)) {
2223                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2224                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2225                                 filename = "a0g1initvals5";
2226                         else
2227                                 filename = "a0g0initvals5";
2228                 } else
2229                         goto err_no_initvals;
2230                 break;
2231         case B43_PHYTYPE_G:
2232                 if ((rev >= 5) && (rev <= 10))
2233                         filename = "b0g0initvals5";
2234                 else if (rev >= 13)
2235                         filename = "b0g0initvals13";
2236                 else
2237                         goto err_no_initvals;
2238                 break;
2239         case B43_PHYTYPE_N:
2240                 if (rev >= 16)
2241                         filename = "n0initvals16";
2242                 else if ((rev >= 11) && (rev <= 12))
2243                         filename = "n0initvals11";
2244                 else
2245                         goto err_no_initvals;
2246                 break;
2247         case B43_PHYTYPE_LP:
2248                 if (rev == 13)
2249                         filename = "lp0initvals13";
2250                 else if (rev == 14)
2251                         filename = "lp0initvals14";
2252                 else if (rev >= 15)
2253                         filename = "lp0initvals15";
2254                 else
2255                         goto err_no_initvals;
2256                 break;
2257         case B43_PHYTYPE_HT:
2258                 if (rev == 29)
2259                         filename = "ht0initvals29";
2260                 else
2261                         goto err_no_initvals;
2262                 break;
2263         case B43_PHYTYPE_LCN:
2264                 if (rev == 24)
2265                         filename = "lcn0initvals24";
2266                 else
2267                         goto err_no_initvals;
2268                 break;
2269         default:
2270                 goto err_no_initvals;
2271         }
2272         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2273         if (err)
2274                 goto err_load;
2275
2276         /* Get bandswitch initvals */
2277         switch (dev->phy.type) {
2278         case B43_PHYTYPE_A:
2279                 if ((rev >= 5) && (rev <= 10)) {
2280                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2281                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2282                                 filename = "a0g1bsinitvals5";
2283                         else
2284                                 filename = "a0g0bsinitvals5";
2285                 } else if (rev >= 11)
2286                         filename = NULL;
2287                 else
2288                         goto err_no_initvals;
2289                 break;
2290         case B43_PHYTYPE_G:
2291                 if ((rev >= 5) && (rev <= 10))
2292                         filename = "b0g0bsinitvals5";
2293                 else if (rev >= 11)
2294                         filename = NULL;
2295                 else
2296                         goto err_no_initvals;
2297                 break;
2298         case B43_PHYTYPE_N:
2299                 if (rev >= 16)
2300                         filename = "n0bsinitvals16";
2301                 else if ((rev >= 11) && (rev <= 12))
2302                         filename = "n0bsinitvals11";
2303                 else
2304                         goto err_no_initvals;
2305                 break;
2306         case B43_PHYTYPE_LP:
2307                 if (rev == 13)
2308                         filename = "lp0bsinitvals13";
2309                 else if (rev == 14)
2310                         filename = "lp0bsinitvals14";
2311                 else if (rev >= 15)
2312                         filename = "lp0bsinitvals15";
2313                 else
2314                         goto err_no_initvals;
2315                 break;
2316         case B43_PHYTYPE_HT:
2317                 if (rev == 29)
2318                         filename = "ht0bsinitvals29";
2319                 else
2320                         goto err_no_initvals;
2321                 break;
2322         case B43_PHYTYPE_LCN:
2323                 if (rev == 24)
2324                         filename = "lcn0bsinitvals24";
2325                 else
2326                         goto err_no_initvals;
2327                 break;
2328         default:
2329                 goto err_no_initvals;
2330         }
2331         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2332         if (err)
2333                 goto err_load;
2334
2335         return 0;
2336
2337 err_no_ucode:
2338         err = ctx->fatal_failure = -EOPNOTSUPP;
2339         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2340                "is required for your device (wl-core rev %u)\n", rev);
2341         goto error;
2342
2343 err_no_pcm:
2344         err = ctx->fatal_failure = -EOPNOTSUPP;
2345         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2346                "is required for your device (wl-core rev %u)\n", rev);
2347         goto error;
2348
2349 err_no_initvals:
2350         err = ctx->fatal_failure = -EOPNOTSUPP;
2351         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2352                "is required for your device (wl-core rev %u)\n", rev);
2353         goto error;
2354
2355 err_load:
2356         /* We failed to load this firmware image. The error message
2357          * already is in ctx->errors. Return and let our caller decide
2358          * what to do. */
2359         goto error;
2360
2361 error:
2362         b43_release_firmware(dev);
2363         return err;
2364 }
2365
2366 static int b43_request_firmware(struct b43_wldev *dev)
2367 {
2368         struct b43_request_fw_context *ctx;
2369         unsigned int i;
2370         int err;
2371         const char *errmsg;
2372
2373         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2374         if (!ctx)
2375                 return -ENOMEM;
2376         ctx->dev = dev;
2377
2378         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2379         err = b43_try_request_fw(ctx);
2380         if (!err)
2381                 goto out; /* Successfully loaded it. */
2382         err = ctx->fatal_failure;
2383         if (err)
2384                 goto out;
2385
2386         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2387         err = b43_try_request_fw(ctx);
2388         if (!err)
2389                 goto out; /* Successfully loaded it. */
2390         err = ctx->fatal_failure;
2391         if (err)
2392                 goto out;
2393
2394         /* Could not find a usable firmware. Print the errors. */
2395         for (i = 0; i < B43_NR_FWTYPES; i++) {
2396                 errmsg = ctx->errors[i];
2397                 if (strlen(errmsg))
2398                         b43err(dev->wl, errmsg);
2399         }
2400         b43_print_fw_helptext(dev->wl, 1);
2401         err = -ENOENT;
2402
2403 out:
2404         kfree(ctx);
2405         return err;
2406 }
2407
2408 static int b43_upload_microcode(struct b43_wldev *dev)
2409 {
2410         struct wiphy *wiphy = dev->wl->hw->wiphy;
2411         const size_t hdr_len = sizeof(struct b43_fw_header);
2412         const __be32 *data;
2413         unsigned int i, len;
2414         u16 fwrev, fwpatch, fwdate, fwtime;
2415         u32 tmp, macctl;
2416         int err = 0;
2417
2418         /* Jump the microcode PSM to offset 0 */
2419         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2420         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2421         macctl |= B43_MACCTL_PSM_JMP0;
2422         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2423         /* Zero out all microcode PSM registers and shared memory. */
2424         for (i = 0; i < 64; i++)
2425                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2426         for (i = 0; i < 4096; i += 2)
2427                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2428
2429         /* Upload Microcode. */
2430         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2431         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2432         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2433         for (i = 0; i < len; i++) {
2434                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2435                 udelay(10);
2436         }
2437
2438         if (dev->fw.pcm.data) {
2439                 /* Upload PCM data. */
2440                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2441                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2442                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2443                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2444                 /* No need for autoinc bit in SHM_HW */
2445                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2446                 for (i = 0; i < len; i++) {
2447                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2448                         udelay(10);
2449                 }
2450         }
2451
2452         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2453
2454         /* Start the microcode PSM */
2455         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2456         macctl &= ~B43_MACCTL_PSM_JMP0;
2457         macctl |= B43_MACCTL_PSM_RUN;
2458         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2459
2460         /* Wait for the microcode to load and respond */
2461         i = 0;
2462         while (1) {
2463                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2464                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2465                         break;
2466                 i++;
2467                 if (i >= 20) {
2468                         b43err(dev->wl, "Microcode not responding\n");
2469                         b43_print_fw_helptext(dev->wl, 1);
2470                         err = -ENODEV;
2471                         goto error;
2472                 }
2473                 msleep(50);
2474         }
2475         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2476
2477         /* Get and check the revisions. */
2478         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2479         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2480         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2481         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2482
2483         if (fwrev <= 0x128) {
2484                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2485                        "binary drivers older than version 4.x is unsupported. "
2486                        "You must upgrade your firmware files.\n");
2487                 b43_print_fw_helptext(dev->wl, 1);
2488                 err = -EOPNOTSUPP;
2489                 goto error;
2490         }
2491         dev->fw.rev = fwrev;
2492         dev->fw.patch = fwpatch;
2493         dev->fw.opensource = (fwdate == 0xFFFF);
2494
2495         /* Default to use-all-queues. */
2496         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2497         dev->qos_enabled = !!modparam_qos;
2498         /* Default to firmware/hardware crypto acceleration. */
2499         dev->hwcrypto_enabled = 1;
2500
2501         if (dev->fw.opensource) {
2502                 u16 fwcapa;
2503
2504                 /* Patchlevel info is encoded in the "time" field. */
2505                 dev->fw.patch = fwtime;
2506                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2507                         dev->fw.rev, dev->fw.patch);
2508
2509                 fwcapa = b43_fwcapa_read(dev);
2510                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2511                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2512                         /* Disable hardware crypto and fall back to software crypto. */
2513                         dev->hwcrypto_enabled = 0;
2514                 }
2515                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2516                         b43info(dev->wl, "QoS not supported by firmware\n");
2517                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2518                          * ieee80211_unregister to make sure the networking core can
2519                          * properly free possible resources. */
2520                         dev->wl->hw->queues = 1;
2521                         dev->qos_enabled = 0;
2522                 }
2523         } else {
2524                 b43info(dev->wl, "Loading firmware version %u.%u "
2525                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2526                         fwrev, fwpatch,
2527                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2528                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2529                 if (dev->fw.pcm_request_failed) {
2530                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2531                                 "Hardware accelerated cryptography is disabled.\n");
2532                         b43_print_fw_helptext(dev->wl, 0);
2533                 }
2534         }
2535
2536         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2537                         dev->fw.rev, dev->fw.patch);
2538         wiphy->hw_version = dev->dev->core_id;
2539
2540         if (b43_is_old_txhdr_format(dev)) {
2541                 /* We're over the deadline, but we keep support for old fw
2542                  * until it turns out to be in major conflict with something new. */
2543                 b43warn(dev->wl, "You are using an old firmware image. "
2544                         "Support for old firmware will be removed soon "
2545                         "(official deadline was July 2008).\n");
2546                 b43_print_fw_helptext(dev->wl, 0);
2547         }
2548
2549         return 0;
2550
2551 error:
2552         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2553         macctl &= ~B43_MACCTL_PSM_RUN;
2554         macctl |= B43_MACCTL_PSM_JMP0;
2555         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2556
2557         return err;
2558 }
2559
2560 static int b43_write_initvals(struct b43_wldev *dev,
2561                               const struct b43_iv *ivals,
2562                               size_t count,
2563                               size_t array_size)
2564 {
2565         const struct b43_iv *iv;
2566         u16 offset;
2567         size_t i;
2568         bool bit32;
2569
2570         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2571         iv = ivals;
2572         for (i = 0; i < count; i++) {
2573                 if (array_size < sizeof(iv->offset_size))
2574                         goto err_format;
2575                 array_size -= sizeof(iv->offset_size);
2576                 offset = be16_to_cpu(iv->offset_size);
2577                 bit32 = !!(offset & B43_IV_32BIT);
2578                 offset &= B43_IV_OFFSET_MASK;
2579                 if (offset >= 0x1000)
2580                         goto err_format;
2581                 if (bit32) {
2582                         u32 value;
2583
2584                         if (array_size < sizeof(iv->data.d32))
2585                                 goto err_format;
2586                         array_size -= sizeof(iv->data.d32);
2587
2588                         value = get_unaligned_be32(&iv->data.d32);
2589                         b43_write32(dev, offset, value);
2590
2591                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2592                                                         sizeof(__be16) +
2593                                                         sizeof(__be32));
2594                 } else {
2595                         u16 value;
2596
2597                         if (array_size < sizeof(iv->data.d16))
2598                                 goto err_format;
2599                         array_size -= sizeof(iv->data.d16);
2600
2601                         value = be16_to_cpu(iv->data.d16);
2602                         b43_write16(dev, offset, value);
2603
2604                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2605                                                         sizeof(__be16) +
2606                                                         sizeof(__be16));
2607                 }
2608         }
2609         if (array_size)
2610                 goto err_format;
2611
2612         return 0;
2613
2614 err_format:
2615         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2616         b43_print_fw_helptext(dev->wl, 1);
2617
2618         return -EPROTO;
2619 }
2620
2621 static int b43_upload_initvals(struct b43_wldev *dev)
2622 {
2623         const size_t hdr_len = sizeof(struct b43_fw_header);
2624         const struct b43_fw_header *hdr;
2625         struct b43_firmware *fw = &dev->fw;
2626         const struct b43_iv *ivals;
2627         size_t count;
2628         int err;
2629
2630         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2631         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2632         count = be32_to_cpu(hdr->size);
2633         err = b43_write_initvals(dev, ivals, count,
2634                                  fw->initvals.data->size - hdr_len);
2635         if (err)
2636                 goto out;
2637         if (fw->initvals_band.data) {
2638                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2639                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2640                 count = be32_to_cpu(hdr->size);
2641                 err = b43_write_initvals(dev, ivals, count,
2642                                          fw->initvals_band.data->size - hdr_len);
2643                 if (err)
2644                         goto out;
2645         }
2646 out:
2647
2648         return err;
2649 }
2650
2651 /* Initialize the GPIOs
2652  * http://bcm-specs.sipsolutions.net/GPIO
2653  */
2654 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2655 {
2656         struct ssb_bus *bus = dev->dev->sdev->bus;
2657
2658 #ifdef CONFIG_SSB_DRIVER_PCICORE
2659         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2660 #else
2661         return bus->chipco.dev;
2662 #endif
2663 }
2664
2665 static int b43_gpio_init(struct b43_wldev *dev)
2666 {
2667         struct ssb_device *gpiodev;
2668         u32 mask, set;
2669
2670         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2671                     & ~B43_MACCTL_GPOUTSMSK);
2672
2673         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2674                     | 0x000F);
2675
2676         mask = 0x0000001F;
2677         set = 0x0000000F;
2678         if (dev->dev->chip_id == 0x4301) {
2679                 mask |= 0x0060;
2680                 set |= 0x0060;
2681         }
2682         if (0 /* FIXME: conditional unknown */ ) {
2683                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2684                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2685                             | 0x0100);
2686                 mask |= 0x0180;
2687                 set |= 0x0180;
2688         }
2689         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2690                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2691                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2692                             | 0x0200);
2693                 mask |= 0x0200;
2694                 set |= 0x0200;
2695         }
2696         if (dev->dev->core_rev >= 2)
2697                 mask |= 0x0010; /* FIXME: This is redundant. */
2698
2699         switch (dev->dev->bus_type) {
2700 #ifdef CONFIG_B43_BCMA
2701         case B43_BUS_BCMA:
2702                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2703                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2704                                         BCMA_CC_GPIOCTL) & mask) | set);
2705                 break;
2706 #endif
2707 #ifdef CONFIG_B43_SSB
2708         case B43_BUS_SSB:
2709                 gpiodev = b43_ssb_gpio_dev(dev);
2710                 if (gpiodev)
2711                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2712                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2713                                     & mask) | set);
2714                 break;
2715 #endif
2716         }
2717
2718         return 0;
2719 }
2720
2721 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2722 static void b43_gpio_cleanup(struct b43_wldev *dev)
2723 {
2724         struct ssb_device *gpiodev;
2725
2726         switch (dev->dev->bus_type) {
2727 #ifdef CONFIG_B43_BCMA
2728         case B43_BUS_BCMA:
2729                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2730                                 0);
2731                 break;
2732 #endif
2733 #ifdef CONFIG_B43_SSB
2734         case B43_BUS_SSB:
2735                 gpiodev = b43_ssb_gpio_dev(dev);
2736                 if (gpiodev)
2737                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2738                 break;
2739 #endif
2740         }
2741 }
2742
2743 /* http://bcm-specs.sipsolutions.net/EnableMac */
2744 void b43_mac_enable(struct b43_wldev *dev)
2745 {
2746         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2747                 u16 fwstate;
2748
2749                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2750                                          B43_SHM_SH_UCODESTAT);
2751                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2752                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2753                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2754                                "should be suspended, but current state is %u\n",
2755                                fwstate);
2756                 }
2757         }
2758
2759         dev->mac_suspended--;
2760         B43_WARN_ON(dev->mac_suspended < 0);
2761         if (dev->mac_suspended == 0) {
2762                 b43_write32(dev, B43_MMIO_MACCTL,
2763                             b43_read32(dev, B43_MMIO_MACCTL)
2764                             | B43_MACCTL_ENABLED);
2765                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2766                             B43_IRQ_MAC_SUSPENDED);
2767                 /* Commit writes */
2768                 b43_read32(dev, B43_MMIO_MACCTL);
2769                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2770                 b43_power_saving_ctl_bits(dev, 0);
2771         }
2772 }
2773
2774 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2775 void b43_mac_suspend(struct b43_wldev *dev)
2776 {
2777         int i;
2778         u32 tmp;
2779
2780         might_sleep();
2781         B43_WARN_ON(dev->mac_suspended < 0);
2782
2783         if (dev->mac_suspended == 0) {
2784                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2785                 b43_write32(dev, B43_MMIO_MACCTL,
2786                             b43_read32(dev, B43_MMIO_MACCTL)
2787                             & ~B43_MACCTL_ENABLED);
2788                 /* force pci to flush the write */
2789                 b43_read32(dev, B43_MMIO_MACCTL);
2790                 for (i = 35; i; i--) {
2791                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2792                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2793                                 goto out;
2794                         udelay(10);
2795                 }
2796                 /* Hm, it seems this will take some time. Use msleep(). */
2797                 for (i = 40; i; i--) {
2798                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2799                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2800                                 goto out;
2801                         msleep(1);
2802                 }
2803                 b43err(dev->wl, "MAC suspend failed\n");
2804         }
2805 out:
2806         dev->mac_suspended++;
2807 }
2808
2809 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2810 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2811 {
2812         u32 tmp;
2813
2814         switch (dev->dev->bus_type) {
2815 #ifdef CONFIG_B43_BCMA
2816         case B43_BUS_BCMA:
2817                 tmp = bcma_read32(dev->dev->bdev, BCMA_IOCTL);
2818                 if (on)
2819                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2820                 else
2821                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2822                 bcma_write32(dev->dev->bdev, BCMA_IOCTL, tmp);
2823                 break;
2824 #endif
2825 #ifdef CONFIG_B43_SSB
2826         case B43_BUS_SSB:
2827                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2828                 if (on)
2829                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2830                 else
2831                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2832                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2833                 break;
2834 #endif
2835         }
2836 }
2837
2838 static void b43_adjust_opmode(struct b43_wldev *dev)
2839 {
2840         struct b43_wl *wl = dev->wl;
2841         u32 ctl;
2842         u16 cfp_pretbtt;
2843
2844         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2845         /* Reset status to STA infrastructure mode. */
2846         ctl &= ~B43_MACCTL_AP;
2847         ctl &= ~B43_MACCTL_KEEP_CTL;
2848         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2849         ctl &= ~B43_MACCTL_KEEP_BAD;
2850         ctl &= ~B43_MACCTL_PROMISC;
2851         ctl &= ~B43_MACCTL_BEACPROMISC;
2852         ctl |= B43_MACCTL_INFRA;
2853
2854         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2855             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2856                 ctl |= B43_MACCTL_AP;
2857         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2858                 ctl &= ~B43_MACCTL_INFRA;
2859
2860         if (wl->filter_flags & FIF_CONTROL)
2861                 ctl |= B43_MACCTL_KEEP_CTL;
2862         if (wl->filter_flags & FIF_FCSFAIL)
2863                 ctl |= B43_MACCTL_KEEP_BAD;
2864         if (wl->filter_flags & FIF_PLCPFAIL)
2865                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2866         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2867                 ctl |= B43_MACCTL_PROMISC;
2868         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2869                 ctl |= B43_MACCTL_BEACPROMISC;
2870
2871         /* Workaround: On old hardware the HW-MAC-address-filter
2872          * doesn't work properly, so always run promisc in filter
2873          * it in software. */
2874         if (dev->dev->core_rev <= 4)
2875                 ctl |= B43_MACCTL_PROMISC;
2876
2877         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2878
2879         cfp_pretbtt = 2;
2880         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2881                 if (dev->dev->chip_id == 0x4306 &&
2882                     dev->dev->chip_rev == 3)
2883                         cfp_pretbtt = 100;
2884                 else
2885                         cfp_pretbtt = 50;
2886         }
2887         b43_write16(dev, 0x612, cfp_pretbtt);
2888
2889         /* FIXME: We don't currently implement the PMQ mechanism,
2890          *        so always disable it. If we want to implement PMQ,
2891          *        we need to enable it here (clear DISCPMQ) in AP mode.
2892          */
2893         if (0  /* ctl & B43_MACCTL_AP */) {
2894                 b43_write32(dev, B43_MMIO_MACCTL,
2895                             b43_read32(dev, B43_MMIO_MACCTL)
2896                             & ~B43_MACCTL_DISCPMQ);
2897         } else {
2898                 b43_write32(dev, B43_MMIO_MACCTL,
2899                             b43_read32(dev, B43_MMIO_MACCTL)
2900                             | B43_MACCTL_DISCPMQ);
2901         }
2902 }
2903
2904 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2905 {
2906         u16 offset;
2907
2908         if (is_ofdm) {
2909                 offset = 0x480;
2910                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2911         } else {
2912                 offset = 0x4C0;
2913                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2914         }
2915         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2916                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2917 }
2918
2919 static void b43_rate_memory_init(struct b43_wldev *dev)
2920 {
2921         switch (dev->phy.type) {
2922         case B43_PHYTYPE_A:
2923         case B43_PHYTYPE_G:
2924         case B43_PHYTYPE_N:
2925         case B43_PHYTYPE_LP:
2926                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2927                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2928                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2929                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2930                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2931                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2932                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2933                 if (dev->phy.type == B43_PHYTYPE_A)
2934                         break;
2935                 /* fallthrough */
2936         case B43_PHYTYPE_B:
2937                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2938                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2939                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2940                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2941                 break;
2942         default:
2943                 B43_WARN_ON(1);
2944         }
2945 }
2946
2947 /* Set the default values for the PHY TX Control Words. */
2948 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2949 {
2950         u16 ctl = 0;
2951
2952         ctl |= B43_TXH_PHY_ENC_CCK;
2953         ctl |= B43_TXH_PHY_ANT01AUTO;
2954         ctl |= B43_TXH_PHY_TXPWR;
2955
2956         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2957         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2958         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2959 }
2960
2961 /* Set the TX-Antenna for management frames sent by firmware. */
2962 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2963 {
2964         u16 ant;
2965         u16 tmp;
2966
2967         ant = b43_antenna_to_phyctl(antenna);
2968
2969         /* For ACK/CTS */
2970         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2971         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2972         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2973         /* For Probe Resposes */
2974         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2975         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2976         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2977 }
2978
2979 /* This is the opposite of b43_chip_init() */
2980 static void b43_chip_exit(struct b43_wldev *dev)
2981 {
2982         b43_phy_exit(dev);
2983         b43_gpio_cleanup(dev);
2984         /* firmware is released later */
2985 }
2986
2987 /* Initialize the chip
2988  * http://bcm-specs.sipsolutions.net/ChipInit
2989  */
2990 static int b43_chip_init(struct b43_wldev *dev)
2991 {
2992         struct b43_phy *phy = &dev->phy;
2993         int err;
2994         u32 macctl;
2995         u16 value16;
2996
2997         /* Initialize the MAC control */
2998         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2999         if (dev->phy.gmode)
3000                 macctl |= B43_MACCTL_GMODE;
3001         macctl |= B43_MACCTL_INFRA;
3002         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3003
3004         err = b43_request_firmware(dev);
3005         if (err)
3006                 goto out;
3007         err = b43_upload_microcode(dev);
3008         if (err)
3009                 goto out;       /* firmware is released later */
3010
3011         err = b43_gpio_init(dev);
3012         if (err)
3013                 goto out;       /* firmware is released later */
3014
3015         err = b43_upload_initvals(dev);
3016         if (err)
3017                 goto err_gpio_clean;
3018
3019         /* Turn the Analog on and initialize the PHY. */
3020         phy->ops->switch_analog(dev, 1);
3021         err = b43_phy_init(dev);
3022         if (err)
3023                 goto err_gpio_clean;
3024
3025         /* Disable Interference Mitigation. */
3026         if (phy->ops->interf_mitigation)
3027                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3028
3029         /* Select the antennae */
3030         if (phy->ops->set_rx_antenna)
3031                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3032         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3033
3034         if (phy->type == B43_PHYTYPE_B) {
3035                 value16 = b43_read16(dev, 0x005E);
3036                 value16 |= 0x0004;
3037                 b43_write16(dev, 0x005E, value16);
3038         }
3039         b43_write32(dev, 0x0100, 0x01000000);
3040         if (dev->dev->core_rev < 5)
3041                 b43_write32(dev, 0x010C, 0x01000000);
3042
3043         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3044                     & ~B43_MACCTL_INFRA);
3045         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3046                     | B43_MACCTL_INFRA);
3047
3048         /* Probe Response Timeout value */
3049         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3050         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3051
3052         /* Initially set the wireless operation mode. */
3053         b43_adjust_opmode(dev);
3054
3055         if (dev->dev->core_rev < 3) {
3056                 b43_write16(dev, 0x060E, 0x0000);
3057                 b43_write16(dev, 0x0610, 0x8000);
3058                 b43_write16(dev, 0x0604, 0x0000);
3059                 b43_write16(dev, 0x0606, 0x0200);
3060         } else {
3061                 b43_write32(dev, 0x0188, 0x80000000);
3062                 b43_write32(dev, 0x018C, 0x02000000);
3063         }
3064         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3065         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3066         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3067         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3068         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3069         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3070         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3071
3072         b43_mac_phy_clock_set(dev, true);
3073
3074         switch (dev->dev->bus_type) {
3075 #ifdef CONFIG_B43_BCMA
3076         case B43_BUS_BCMA:
3077                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3078                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3079                 break;
3080 #endif
3081 #ifdef CONFIG_B43_SSB
3082         case B43_BUS_SSB:
3083                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3084                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3085                 break;
3086 #endif
3087         }
3088
3089         err = 0;
3090         b43dbg(dev->wl, "Chip initialized\n");
3091 out:
3092         return err;
3093
3094 err_gpio_clean:
3095         b43_gpio_cleanup(dev);
3096         return err;
3097 }
3098
3099 static void b43_periodic_every60sec(struct b43_wldev *dev)
3100 {
3101         const struct b43_phy_operations *ops = dev->phy.ops;
3102
3103         if (ops->pwork_60sec)
3104                 ops->pwork_60sec(dev);
3105
3106         /* Force check the TX power emission now. */
3107         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3108 }
3109
3110 static void b43_periodic_every30sec(struct b43_wldev *dev)
3111 {
3112         /* Update device statistics. */
3113         b43_calculate_link_quality(dev);
3114 }
3115
3116 static void b43_periodic_every15sec(struct b43_wldev *dev)
3117 {
3118         struct b43_phy *phy = &dev->phy;
3119         u16 wdr;
3120
3121         if (dev->fw.opensource) {
3122                 /* Check if the firmware is still alive.
3123                  * It will reset the watchdog counter to 0 in its idle loop. */
3124                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3125                 if (unlikely(wdr)) {
3126                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3127                         b43_controller_restart(dev, "Firmware watchdog");
3128                         return;
3129                 } else {
3130                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3131                                         B43_WATCHDOG_REG, 1);
3132                 }
3133         }
3134
3135         if (phy->ops->pwork_15sec)
3136                 phy->ops->pwork_15sec(dev);
3137
3138         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3139         wmb();
3140
3141 #if B43_DEBUG
3142         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3143                 unsigned int i;
3144
3145                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3146                        dev->irq_count / 15,
3147                        dev->tx_count / 15,
3148                        dev->rx_count / 15);
3149                 dev->irq_count = 0;
3150                 dev->tx_count = 0;
3151                 dev->rx_count = 0;
3152                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3153                         if (dev->irq_bit_count[i]) {
3154                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3155                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3156                                 dev->irq_bit_count[i] = 0;
3157                         }
3158                 }
3159         }
3160 #endif
3161 }
3162
3163 static void do_periodic_work(struct b43_wldev *dev)
3164 {
3165         unsigned int state;
3166
3167         state = dev->periodic_state;
3168         if (state % 4 == 0)
3169                 b43_periodic_every60sec(dev);
3170         if (state % 2 == 0)
3171                 b43_periodic_every30sec(dev);
3172         b43_periodic_every15sec(dev);
3173 }
3174
3175 /* Periodic work locking policy:
3176  *      The whole periodic work handler is protected by
3177  *      wl->mutex. If another lock is needed somewhere in the
3178  *      pwork callchain, it's acquired in-place, where it's needed.
3179  */
3180 static void b43_periodic_work_handler(struct work_struct *work)
3181 {
3182         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3183                                              periodic_work.work);
3184         struct b43_wl *wl = dev->wl;
3185         unsigned long delay;
3186
3187         mutex_lock(&wl->mutex);
3188
3189         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3190                 goto out;
3191         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3192                 goto out_requeue;
3193
3194         do_periodic_work(dev);
3195
3196         dev->periodic_state++;
3197 out_requeue:
3198         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3199                 delay = msecs_to_jiffies(50);
3200         else
3201                 delay = round_jiffies_relative(HZ * 15);
3202         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3203 out:
3204         mutex_unlock(&wl->mutex);
3205 }
3206
3207 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3208 {
3209         struct delayed_work *work = &dev->periodic_work;
3210
3211         dev->periodic_state = 0;
3212         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3213         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3214 }
3215
3216 /* Check if communication with the device works correctly. */
3217 static int b43_validate_chipaccess(struct b43_wldev *dev)
3218 {
3219         u32 v, backup0, backup4;
3220
3221         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3222         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3223
3224         /* Check for read/write and endianness problems. */
3225         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3226         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3227                 goto error;
3228         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3229         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3230                 goto error;
3231
3232         /* Check if unaligned 32bit SHM_SHARED access works properly.
3233          * However, don't bail out on failure, because it's noncritical. */
3234         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3235         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3236         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3237         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3238         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3239                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3240         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3241         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3242             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3243             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3244             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3245                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3246
3247         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3248         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3249
3250         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3251                 /* The 32bit register shadows the two 16bit registers
3252                  * with update sideeffects. Validate this. */
3253                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3254                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3255                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3256                         goto error;
3257                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3258                         goto error;
3259         }
3260         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3261
3262         v = b43_read32(dev, B43_MMIO_MACCTL);
3263         v |= B43_MACCTL_GMODE;
3264         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3265                 goto error;
3266
3267         return 0;
3268 error:
3269         b43err(dev->wl, "Failed to validate the chipaccess\n");
3270         return -ENODEV;
3271 }
3272
3273 static void b43_security_init(struct b43_wldev *dev)
3274 {
3275         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3276         /* KTP is a word address, but we address SHM bytewise.
3277          * So multiply by two.
3278          */
3279         dev->ktp *= 2;
3280         /* Number of RCMTA address slots */
3281         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3282         /* Clear the key memory. */
3283         b43_clear_keys(dev);
3284 }
3285
3286 #ifdef CONFIG_B43_HWRNG
3287 static int b43_rng_read(struct hwrng *rng, u32 *data)
3288 {
3289         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3290         struct b43_wldev *dev;
3291         int count = -ENODEV;
3292
3293         mutex_lock(&wl->mutex);
3294         dev = wl->current_dev;
3295         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3296                 *data = b43_read16(dev, B43_MMIO_RNG);
3297                 count = sizeof(u16);
3298         }
3299         mutex_unlock(&wl->mutex);
3300
3301         return count;
3302 }
3303 #endif /* CONFIG_B43_HWRNG */
3304
3305 static void b43_rng_exit(struct b43_wl *wl)
3306 {
3307 #ifdef CONFIG_B43_HWRNG
3308         if (wl->rng_initialized)
3309                 hwrng_unregister(&wl->rng);
3310 #endif /* CONFIG_B43_HWRNG */
3311 }
3312
3313 static int b43_rng_init(struct b43_wl *wl)
3314 {
3315         int err = 0;
3316
3317 #ifdef CONFIG_B43_HWRNG
3318         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3319                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3320         wl->rng.name = wl->rng_name;
3321         wl->rng.data_read = b43_rng_read;
3322         wl->rng.priv = (unsigned long)wl;
3323         wl->rng_initialized = 1;
3324         err = hwrng_register(&wl->rng);
3325         if (err) {
3326                 wl->rng_initialized = 0;
3327                 b43err(wl, "Failed to register the random "
3328                        "number generator (%d)\n", err);
3329         }
3330 #endif /* CONFIG_B43_HWRNG */
3331
3332         return err;
3333 }
3334
3335 static void b43_tx_work(struct work_struct *work)
3336 {
3337         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3338         struct b43_wldev *dev;
3339         struct sk_buff *skb;
3340         int err = 0;
3341
3342         mutex_lock(&wl->mutex);
3343         dev = wl->current_dev;
3344         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3345                 mutex_unlock(&wl->mutex);
3346                 return;
3347         }
3348
3349         while (skb_queue_len(&wl->tx_queue)) {
3350                 skb = skb_dequeue(&wl->tx_queue);
3351
3352                 if (b43_using_pio_transfers(dev))
3353                         err = b43_pio_tx(dev, skb);
3354                 else
3355                         err = b43_dma_tx(dev, skb);
3356                 if (unlikely(err))
3357                         dev_kfree_skb(skb); /* Drop it */
3358         }
3359
3360 #if B43_DEBUG
3361         dev->tx_count++;
3362 #endif
3363         mutex_unlock(&wl->mutex);
3364 }
3365
3366 static void b43_op_tx(struct ieee80211_hw *hw,
3367                      struct sk_buff *skb)
3368 {
3369         struct b43_wl *wl = hw_to_b43_wl(hw);
3370
3371         if (unlikely(skb->len < 2 + 2 + 6)) {
3372                 /* Too short, this can't be a valid frame. */
3373                 dev_kfree_skb_any(skb);
3374                 return;
3375         }
3376         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3377
3378         skb_queue_tail(&wl->tx_queue, skb);
3379         ieee80211_queue_work(wl->hw, &wl->tx_work);
3380 }
3381
3382 static void b43_qos_params_upload(struct b43_wldev *dev,
3383                                   const struct ieee80211_tx_queue_params *p,
3384                                   u16 shm_offset)
3385 {
3386         u16 params[B43_NR_QOSPARAMS];
3387         int bslots, tmp;
3388         unsigned int i;
3389
3390         if (!dev->qos_enabled)
3391                 return;
3392
3393         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3394
3395         memset(&params, 0, sizeof(params));
3396
3397         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3398         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3399         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3400         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3401         params[B43_QOSPARAM_AIFS] = p->aifs;
3402         params[B43_QOSPARAM_BSLOTS] = bslots;
3403         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3404
3405         for (i = 0; i < ARRAY_SIZE(params); i++) {
3406                 if (i == B43_QOSPARAM_STATUS) {
3407                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3408                                              shm_offset + (i * 2));
3409                         /* Mark the parameters as updated. */
3410                         tmp |= 0x100;
3411                         b43_shm_write16(dev, B43_SHM_SHARED,
3412                                         shm_offset + (i * 2),
3413                                         tmp);
3414                 } else {
3415                         b43_shm_write16(dev, B43_SHM_SHARED,
3416                                         shm_offset + (i * 2),
3417                                         params[i]);
3418                 }
3419         }
3420 }
3421
3422 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3423 static const u16 b43_qos_shm_offsets[] = {
3424         /* [mac80211-queue-nr] = SHM_OFFSET, */
3425         [0] = B43_QOS_VOICE,
3426         [1] = B43_QOS_VIDEO,
3427         [2] = B43_QOS_BESTEFFORT,
3428         [3] = B43_QOS_BACKGROUND,
3429 };
3430
3431 /* Update all QOS parameters in hardware. */
3432 static void b43_qos_upload_all(struct b43_wldev *dev)
3433 {
3434         struct b43_wl *wl = dev->wl;
3435         struct b43_qos_params *params;
3436         unsigned int i;
3437
3438         if (!dev->qos_enabled)
3439                 return;
3440
3441         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3442                      ARRAY_SIZE(wl->qos_params));
3443
3444         b43_mac_suspend(dev);
3445         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3446                 params = &(wl->qos_params[i]);
3447                 b43_qos_params_upload(dev, &(params->p),
3448                                       b43_qos_shm_offsets[i]);
3449         }
3450         b43_mac_enable(dev);
3451 }
3452
3453 static void b43_qos_clear(struct b43_wl *wl)
3454 {
3455         struct b43_qos_params *params;
3456         unsigned int i;
3457
3458         /* Initialize QoS parameters to sane defaults. */
3459
3460         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3461                      ARRAY_SIZE(wl->qos_params));
3462
3463         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3464                 params = &(wl->qos_params[i]);
3465
3466                 switch (b43_qos_shm_offsets[i]) {
3467                 case B43_QOS_VOICE:
3468                         params->p.txop = 0;
3469                         params->p.aifs = 2;
3470                         params->p.cw_min = 0x0001;
3471                         params->p.cw_max = 0x0001;
3472                         break;
3473                 case B43_QOS_VIDEO:
3474                         params->p.txop = 0;
3475                         params->p.aifs = 2;
3476                         params->p.cw_min = 0x0001;
3477                         params->p.cw_max = 0x0001;
3478                         break;
3479                 case B43_QOS_BESTEFFORT:
3480                         params->p.txop = 0;
3481                         params->p.aifs = 3;
3482                         params->p.cw_min = 0x0001;
3483                         params->p.cw_max = 0x03FF;
3484                         break;
3485                 case B43_QOS_BACKGROUND:
3486                         params->p.txop = 0;
3487                         params->p.aifs = 7;
3488                         params->p.cw_min = 0x0001;
3489                         params->p.cw_max = 0x03FF;
3490                         break;
3491                 default:
3492                         B43_WARN_ON(1);
3493                 }
3494         }
3495 }
3496
3497 /* Initialize the core's QOS capabilities */
3498 static void b43_qos_init(struct b43_wldev *dev)
3499 {
3500         if (!dev->qos_enabled) {
3501                 /* Disable QOS support. */
3502                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3503                 b43_write16(dev, B43_MMIO_IFSCTL,
3504                             b43_read16(dev, B43_MMIO_IFSCTL)
3505                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3506                 b43dbg(dev->wl, "QoS disabled\n");
3507                 return;
3508         }
3509
3510         /* Upload the current QOS parameters. */
3511         b43_qos_upload_all(dev);
3512
3513         /* Enable QOS support. */
3514         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3515         b43_write16(dev, B43_MMIO_IFSCTL,
3516                     b43_read16(dev, B43_MMIO_IFSCTL)
3517                     | B43_MMIO_IFSCTL_USE_EDCF);
3518         b43dbg(dev->wl, "QoS enabled\n");
3519 }
3520
3521 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3522                           const struct ieee80211_tx_queue_params *params)
3523 {
3524         struct b43_wl *wl = hw_to_b43_wl(hw);
3525         struct b43_wldev *dev;
3526         unsigned int queue = (unsigned int)_queue;
3527         int err = -ENODEV;
3528
3529         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3530                 /* Queue not available or don't support setting
3531                  * params on this queue. Return success to not
3532                  * confuse mac80211. */
3533                 return 0;
3534         }
3535         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3536                      ARRAY_SIZE(wl->qos_params));
3537
3538         mutex_lock(&wl->mutex);
3539         dev = wl->current_dev;
3540         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3541                 goto out_unlock;
3542
3543         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3544         b43_mac_suspend(dev);
3545         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3546                               b43_qos_shm_offsets[queue]);
3547         b43_mac_enable(dev);
3548         err = 0;
3549
3550 out_unlock:
3551         mutex_unlock(&wl->mutex);
3552
3553         return err;
3554 }
3555
3556 static int b43_op_get_stats(struct ieee80211_hw *hw,
3557                             struct ieee80211_low_level_stats *stats)
3558 {
3559         struct b43_wl *wl = hw_to_b43_wl(hw);
3560
3561         mutex_lock(&wl->mutex);
3562         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3563         mutex_unlock(&wl->mutex);
3564
3565         return 0;
3566 }
3567
3568 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3569 {
3570         struct b43_wl *wl = hw_to_b43_wl(hw);
3571         struct b43_wldev *dev;
3572         u64 tsf;
3573
3574         mutex_lock(&wl->mutex);
3575         dev = wl->current_dev;
3576
3577         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3578                 b43_tsf_read(dev, &tsf);
3579         else
3580                 tsf = 0;
3581
3582         mutex_unlock(&wl->mutex);
3583
3584         return tsf;
3585 }
3586
3587 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3588 {
3589         struct b43_wl *wl = hw_to_b43_wl(hw);
3590         struct b43_wldev *dev;
3591
3592         mutex_lock(&wl->mutex);
3593         dev = wl->current_dev;
3594
3595         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3596                 b43_tsf_write(dev, tsf);
3597
3598         mutex_unlock(&wl->mutex);
3599 }
3600
3601 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3602 {
3603         u32 tmp;
3604
3605         switch (dev->dev->bus_type) {
3606 #ifdef CONFIG_B43_BCMA
3607         case B43_BUS_BCMA:
3608                 b43err(dev->wl,
3609                        "Putting PHY into reset not supported on BCMA\n");
3610                 break;
3611 #endif
3612 #ifdef CONFIG_B43_SSB
3613         case B43_BUS_SSB:
3614                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3615                 tmp &= ~B43_TMSLOW_GMODE;
3616                 tmp |= B43_TMSLOW_PHYRESET;
3617                 tmp |= SSB_TMSLOW_FGC;
3618                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3619                 msleep(1);
3620
3621                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3622                 tmp &= ~SSB_TMSLOW_FGC;
3623                 tmp |= B43_TMSLOW_PHYRESET;
3624                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3625                 msleep(1);
3626
3627                 break;
3628 #endif
3629         }
3630 }
3631
3632 static const char *band_to_string(enum ieee80211_band band)
3633 {
3634         switch (band) {
3635         case IEEE80211_BAND_5GHZ:
3636                 return "5";
3637         case IEEE80211_BAND_2GHZ:
3638                 return "2.4";
3639         default:
3640                 break;
3641         }
3642         B43_WARN_ON(1);
3643         return "";
3644 }
3645
3646 /* Expects wl->mutex locked */
3647 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3648 {
3649         struct b43_wldev *up_dev = NULL;
3650         struct b43_wldev *down_dev;
3651         struct b43_wldev *d;
3652         int err;
3653         bool uninitialized_var(gmode);
3654         int prev_status;
3655
3656         /* Find a device and PHY which supports the band. */
3657         list_for_each_entry(d, &wl->devlist, list) {
3658                 switch (chan->band) {
3659                 case IEEE80211_BAND_5GHZ:
3660                         if (d->phy.supports_5ghz) {
3661                                 up_dev = d;
3662                                 gmode = 0;
3663                         }
3664                         break;
3665                 case IEEE80211_BAND_2GHZ:
3666                         if (d->phy.supports_2ghz) {
3667                                 up_dev = d;
3668                                 gmode = 1;
3669                         }
3670                         break;
3671                 default:
3672                         B43_WARN_ON(1);
3673                         return -EINVAL;
3674                 }
3675                 if (up_dev)
3676                         break;
3677         }
3678         if (!up_dev) {
3679                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3680                        band_to_string(chan->band));
3681                 return -ENODEV;
3682         }
3683         if ((up_dev == wl->current_dev) &&
3684             (!!wl->current_dev->phy.gmode == !!gmode)) {
3685                 /* This device is already running. */
3686                 return 0;
3687         }
3688         b43dbg(wl, "Switching to %s-GHz band\n",
3689                band_to_string(chan->band));
3690         down_dev = wl->current_dev;
3691
3692         prev_status = b43_status(down_dev);
3693         /* Shutdown the currently running core. */
3694         if (prev_status >= B43_STAT_STARTED)
3695                 down_dev = b43_wireless_core_stop(down_dev);
3696         if (prev_status >= B43_STAT_INITIALIZED)
3697                 b43_wireless_core_exit(down_dev);
3698
3699         if (down_dev != up_dev) {
3700                 /* We switch to a different core, so we put PHY into
3701                  * RESET on the old core. */
3702                 b43_put_phy_into_reset(down_dev);
3703         }
3704
3705         /* Now start the new core. */
3706         up_dev->phy.gmode = gmode;
3707         if (prev_status >= B43_STAT_INITIALIZED) {
3708                 err = b43_wireless_core_init(up_dev);
3709                 if (err) {
3710                         b43err(wl, "Fatal: Could not initialize device for "
3711                                "selected %s-GHz band\n",
3712                                band_to_string(chan->band));
3713                         goto init_failure;
3714                 }
3715         }
3716         if (prev_status >= B43_STAT_STARTED) {
3717                 err = b43_wireless_core_start(up_dev);
3718                 if (err) {
3719                         b43err(wl, "Fatal: Coult not start device for "
3720                                "selected %s-GHz band\n",
3721                                band_to_string(chan->band));
3722                         b43_wireless_core_exit(up_dev);
3723                         goto init_failure;
3724                 }
3725         }
3726         B43_WARN_ON(b43_status(up_dev) != prev_status);
3727
3728         wl->current_dev = up_dev;
3729
3730         return 0;
3731 init_failure:
3732         /* Whoops, failed to init the new core. No core is operating now. */
3733         wl->current_dev = NULL;
3734         return err;
3735 }
3736
3737 /* Write the short and long frame retry limit values. */
3738 static void b43_set_retry_limits(struct b43_wldev *dev,
3739                                  unsigned int short_retry,
3740                                  unsigned int long_retry)
3741 {
3742         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3743          * the chip-internal counter. */
3744         short_retry = min(short_retry, (unsigned int)0xF);
3745         long_retry = min(long_retry, (unsigned int)0xF);
3746
3747         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3748                         short_retry);
3749         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3750                         long_retry);
3751 }
3752
3753 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3754 {
3755         struct b43_wl *wl = hw_to_b43_wl(hw);
3756         struct b43_wldev *dev;
3757         struct b43_phy *phy;
3758         struct ieee80211_conf *conf = &hw->conf;
3759         int antenna;
3760         int err = 0;
3761
3762         mutex_lock(&wl->mutex);
3763
3764         /* Switch the band (if necessary). This might change the active core. */
3765         err = b43_switch_band(wl, conf->channel);
3766         if (err)
3767                 goto out_unlock_mutex;
3768         dev = wl->current_dev;
3769         phy = &dev->phy;
3770
3771         if (conf_is_ht(conf))
3772                 phy->is_40mhz =
3773                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3774         else
3775                 phy->is_40mhz = false;
3776
3777         b43_mac_suspend(dev);
3778
3779         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3780                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3781                                           conf->long_frame_max_tx_count);
3782         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3783         if (!changed)
3784                 goto out_mac_enable;
3785
3786         /* Switch to the requested channel.
3787          * The firmware takes care of races with the TX handler. */
3788         if (conf->channel->hw_value != phy->channel)
3789                 b43_switch_channel(dev, conf->channel->hw_value);
3790
3791         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3792
3793         /* Adjust the desired TX power level. */
3794         if (conf->power_level != 0) {
3795                 if (conf->power_level != phy->desired_txpower) {
3796                         phy->desired_txpower = conf->power_level;
3797                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3798                                                    B43_TXPWR_IGNORE_TSSI);
3799                 }
3800         }
3801
3802         /* Antennas for RX and management frame TX. */
3803         antenna = B43_ANTENNA_DEFAULT;
3804         b43_mgmtframe_txantenna(dev, antenna);
3805         antenna = B43_ANTENNA_DEFAULT;
3806         if (phy->ops->set_rx_antenna)
3807                 phy->ops->set_rx_antenna(dev, antenna);
3808
3809         if (wl->radio_enabled != phy->radio_on) {
3810                 if (wl->radio_enabled) {
3811                         b43_software_rfkill(dev, false);
3812                         b43info(dev->wl, "Radio turned on by software\n");
3813                         if (!dev->radio_hw_enable) {
3814                                 b43info(dev->wl, "The hardware RF-kill button "
3815                                         "still turns the radio physically off. "
3816                                         "Press the button to turn it on.\n");
3817                         }
3818                 } else {
3819                         b43_software_rfkill(dev, true);
3820                         b43info(dev->wl, "Radio turned off by software\n");
3821                 }
3822         }
3823
3824 out_mac_enable:
3825         b43_mac_enable(dev);
3826 out_unlock_mutex:
3827         mutex_unlock(&wl->mutex);
3828
3829         return err;
3830 }
3831
3832 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3833 {
3834         struct ieee80211_supported_band *sband =
3835                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3836         struct ieee80211_rate *rate;
3837         int i;
3838         u16 basic, direct, offset, basic_offset, rateptr;
3839
3840         for (i = 0; i < sband->n_bitrates; i++) {
3841                 rate = &sband->bitrates[i];
3842
3843                 if (b43_is_cck_rate(rate->hw_value)) {
3844                         direct = B43_SHM_SH_CCKDIRECT;
3845                         basic = B43_SHM_SH_CCKBASIC;
3846                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3847                         offset &= 0xF;
3848                 } else {
3849                         direct = B43_SHM_SH_OFDMDIRECT;
3850                         basic = B43_SHM_SH_OFDMBASIC;
3851                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3852                         offset &= 0xF;
3853                 }
3854
3855                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3856
3857                 if (b43_is_cck_rate(rate->hw_value)) {
3858                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3859                         basic_offset &= 0xF;
3860                 } else {
3861                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3862                         basic_offset &= 0xF;
3863                 }
3864
3865                 /*
3866                  * Get the pointer that we need to point to
3867                  * from the direct map
3868                  */
3869                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3870                                          direct + 2 * basic_offset);
3871                 /* and write it to the basic map */
3872                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3873                                 rateptr);
3874         }
3875 }
3876
3877 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3878                                     struct ieee80211_vif *vif,
3879                                     struct ieee80211_bss_conf *conf,
3880                                     u32 changed)
3881 {
3882         struct b43_wl *wl = hw_to_b43_wl(hw);
3883         struct b43_wldev *dev;
3884
3885         mutex_lock(&wl->mutex);
3886
3887         dev = wl->current_dev;
3888         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3889                 goto out_unlock_mutex;
3890
3891         B43_WARN_ON(wl->vif != vif);
3892
3893         if (changed & BSS_CHANGED_BSSID) {
3894                 if (conf->bssid)
3895                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3896                 else
3897                         memset(wl->bssid, 0, ETH_ALEN);
3898         }
3899
3900         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3901                 if (changed & BSS_CHANGED_BEACON &&
3902                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3903                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3904                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3905                         b43_update_templates(wl);
3906
3907                 if (changed & BSS_CHANGED_BSSID)
3908                         b43_write_mac_bssid_templates(dev);
3909         }
3910
3911         b43_mac_suspend(dev);
3912
3913         /* Update templates for AP/mesh mode. */
3914         if (changed & BSS_CHANGED_BEACON_INT &&
3915             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3916              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3917              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3918                 b43_set_beacon_int(dev, conf->beacon_int);
3919
3920         if (changed & BSS_CHANGED_BASIC_RATES)
3921                 b43_update_basic_rates(dev, conf->basic_rates);
3922
3923         if (changed & BSS_CHANGED_ERP_SLOT) {
3924                 if (conf->use_short_slot)
3925                         b43_short_slot_timing_enable(dev);
3926                 else
3927                         b43_short_slot_timing_disable(dev);
3928         }
3929
3930         b43_mac_enable(dev);
3931 out_unlock_mutex:
3932         mutex_unlock(&wl->mutex);
3933 }
3934
3935 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3936                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3937                           struct ieee80211_key_conf *key)
3938 {
3939         struct b43_wl *wl = hw_to_b43_wl(hw);
3940         struct b43_wldev *dev;
3941         u8 algorithm;
3942         u8 index;
3943         int err;
3944         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3945
3946         if (modparam_nohwcrypt)
3947                 return -ENOSPC; /* User disabled HW-crypto */
3948
3949         mutex_lock(&wl->mutex);
3950
3951         dev = wl->current_dev;
3952         err = -ENODEV;
3953         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3954                 goto out_unlock;
3955
3956         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3957                 /* We don't have firmware for the crypto engine.
3958                  * Must use software-crypto. */
3959                 err = -EOPNOTSUPP;
3960                 goto out_unlock;
3961         }
3962
3963         err = -EINVAL;
3964         switch (key->cipher) {
3965         case WLAN_CIPHER_SUITE_WEP40:
3966                 algorithm = B43_SEC_ALGO_WEP40;
3967                 break;
3968         case WLAN_CIPHER_SUITE_WEP104:
3969                 algorithm = B43_SEC_ALGO_WEP104;
3970                 break;
3971         case WLAN_CIPHER_SUITE_TKIP:
3972                 algorithm = B43_SEC_ALGO_TKIP;
3973                 break;
3974         case WLAN_CIPHER_SUITE_CCMP:
3975                 algorithm = B43_SEC_ALGO_AES;
3976                 break;
3977         default:
3978                 B43_WARN_ON(1);
3979                 goto out_unlock;
3980         }
3981         index = (u8) (key->keyidx);
3982         if (index > 3)
3983                 goto out_unlock;
3984
3985         switch (cmd) {
3986         case SET_KEY:
3987                 if (algorithm == B43_SEC_ALGO_TKIP &&
3988                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3989                     !modparam_hwtkip)) {
3990                         /* We support only pairwise key */
3991                         err = -EOPNOTSUPP;
3992                         goto out_unlock;
3993                 }
3994
3995                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3996                         if (WARN_ON(!sta)) {
3997                                 err = -EOPNOTSUPP;
3998                                 goto out_unlock;
3999                         }
4000                         /* Pairwise key with an assigned MAC address. */
4001                         err = b43_key_write(dev, -1, algorithm,
4002                                             key->key, key->keylen,
4003                                             sta->addr, key);
4004                 } else {
4005                         /* Group key */
4006                         err = b43_key_write(dev, index, algorithm,
4007                                             key->key, key->keylen, NULL, key);
4008                 }
4009                 if (err)
4010                         goto out_unlock;
4011
4012                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4013                     algorithm == B43_SEC_ALGO_WEP104) {
4014                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4015                 } else {
4016                         b43_hf_write(dev,
4017                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4018                 }
4019                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4020                 if (algorithm == B43_SEC_ALGO_TKIP)
4021                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4022                 break;
4023         case DISABLE_KEY: {
4024                 err = b43_key_clear(dev, key->hw_key_idx);
4025                 if (err)
4026                         goto out_unlock;
4027                 break;
4028         }
4029         default:
4030                 B43_WARN_ON(1);
4031         }
4032
4033 out_unlock:
4034         if (!err) {
4035                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4036                        "mac: %pM\n",
4037                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4038                        sta ? sta->addr : bcast_addr);
4039                 b43_dump_keymemory(dev);
4040         }
4041         mutex_unlock(&wl->mutex);
4042
4043         return err;
4044 }
4045
4046 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4047                                     unsigned int changed, unsigned int *fflags,
4048                                     u64 multicast)
4049 {
4050         struct b43_wl *wl = hw_to_b43_wl(hw);
4051         struct b43_wldev *dev;
4052
4053         mutex_lock(&wl->mutex);
4054         dev = wl->current_dev;
4055         if (!dev) {
4056                 *fflags = 0;
4057                 goto out_unlock;
4058         }
4059
4060         *fflags &= FIF_PROMISC_IN_BSS |
4061                   FIF_ALLMULTI |
4062                   FIF_FCSFAIL |
4063                   FIF_PLCPFAIL |
4064                   FIF_CONTROL |
4065                   FIF_OTHER_BSS |
4066                   FIF_BCN_PRBRESP_PROMISC;
4067
4068         changed &= FIF_PROMISC_IN_BSS |
4069                    FIF_ALLMULTI |
4070                    FIF_FCSFAIL |
4071                    FIF_PLCPFAIL |
4072                    FIF_CONTROL |
4073                    FIF_OTHER_BSS |
4074                    FIF_BCN_PRBRESP_PROMISC;
4075
4076         wl->filter_flags = *fflags;
4077
4078         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4079                 b43_adjust_opmode(dev);
4080
4081 out_unlock:
4082         mutex_unlock(&wl->mutex);
4083 }
4084
4085 /* Locking: wl->mutex
4086  * Returns the current dev. This might be different from the passed in dev,
4087  * because the core might be gone away while we unlocked the mutex. */
4088 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4089 {
4090         struct b43_wl *wl = dev->wl;
4091         struct b43_wldev *orig_dev;
4092         u32 mask;
4093
4094 redo:
4095         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4096                 return dev;
4097
4098         /* Cancel work. Unlock to avoid deadlocks. */
4099         mutex_unlock(&wl->mutex);
4100         cancel_delayed_work_sync(&dev->periodic_work);
4101         cancel_work_sync(&wl->tx_work);
4102         mutex_lock(&wl->mutex);
4103         dev = wl->current_dev;
4104         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4105                 /* Whoops, aliens ate up the device while we were unlocked. */
4106                 return dev;
4107         }
4108
4109         /* Disable interrupts on the device. */
4110         b43_set_status(dev, B43_STAT_INITIALIZED);
4111         if (b43_bus_host_is_sdio(dev->dev)) {
4112                 /* wl->mutex is locked. That is enough. */
4113                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4114                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4115         } else {
4116                 spin_lock_irq(&wl->hardirq_lock);
4117                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4118                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4119                 spin_unlock_irq(&wl->hardirq_lock);
4120         }
4121         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4122         orig_dev = dev;
4123         mutex_unlock(&wl->mutex);
4124         if (b43_bus_host_is_sdio(dev->dev)) {
4125                 b43_sdio_free_irq(dev);
4126         } else {
4127                 synchronize_irq(dev->dev->irq);
4128                 free_irq(dev->dev->irq, dev);
4129         }
4130         mutex_lock(&wl->mutex);
4131         dev = wl->current_dev;
4132         if (!dev)
4133                 return dev;
4134         if (dev != orig_dev) {
4135                 if (b43_status(dev) >= B43_STAT_STARTED)
4136                         goto redo;
4137                 return dev;
4138         }
4139         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4140         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4141
4142         /* Drain the TX queue */
4143         while (skb_queue_len(&wl->tx_queue))
4144                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4145
4146         b43_mac_suspend(dev);
4147         b43_leds_exit(dev);
4148         b43dbg(wl, "Wireless interface stopped\n");
4149
4150         return dev;
4151 }
4152
4153 /* Locking: wl->mutex */
4154 static int b43_wireless_core_start(struct b43_wldev *dev)
4155 {
4156         int err;
4157
4158         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4159
4160         drain_txstatus_queue(dev);
4161         if (b43_bus_host_is_sdio(dev->dev)) {
4162                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4163                 if (err) {
4164                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4165                         goto out;
4166                 }
4167         } else {
4168                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4169                                            b43_interrupt_thread_handler,
4170                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4171                 if (err) {
4172                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4173                                dev->dev->irq);
4174                         goto out;
4175                 }
4176         }
4177
4178         /* We are ready to run. */
4179         ieee80211_wake_queues(dev->wl->hw);
4180         b43_set_status(dev, B43_STAT_STARTED);
4181
4182         /* Start data flow (TX/RX). */
4183         b43_mac_enable(dev);
4184         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4185
4186         /* Start maintenance work */
4187         b43_periodic_tasks_setup(dev);
4188
4189         b43_leds_init(dev);
4190
4191         b43dbg(dev->wl, "Wireless interface started\n");
4192 out:
4193         return err;
4194 }
4195
4196 /* Get PHY and RADIO versioning numbers */
4197 static int b43_phy_versioning(struct b43_wldev *dev)
4198 {
4199         struct b43_phy *phy = &dev->phy;
4200         u32 tmp;
4201         u8 analog_type;
4202         u8 phy_type;
4203         u8 phy_rev;
4204         u16 radio_manuf;
4205         u16 radio_ver;
4206         u16 radio_rev;
4207         int unsupported = 0;
4208
4209         /* Get PHY versioning */
4210         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4211         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4212         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4213         phy_rev = (tmp & B43_PHYVER_VERSION);
4214         switch (phy_type) {
4215         case B43_PHYTYPE_A:
4216                 if (phy_rev >= 4)
4217                         unsupported = 1;
4218                 break;
4219         case B43_PHYTYPE_B:
4220                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4221                     && phy_rev != 7)
4222                         unsupported = 1;
4223                 break;
4224         case B43_PHYTYPE_G:
4225                 if (phy_rev > 9)
4226                         unsupported = 1;
4227                 break;
4228 #ifdef CONFIG_B43_PHY_N
4229         case B43_PHYTYPE_N:
4230                 if (phy_rev > 9)
4231                         unsupported = 1;
4232                 break;
4233 #endif
4234 #ifdef CONFIG_B43_PHY_LP
4235         case B43_PHYTYPE_LP:
4236                 if (phy_rev > 2)
4237                         unsupported = 1;
4238                 break;
4239 #endif
4240 #ifdef CONFIG_B43_PHY_HT
4241         case B43_PHYTYPE_HT:
4242                 if (phy_rev > 1)
4243                         unsupported = 1;
4244                 break;
4245 #endif
4246 #ifdef CONFIG_B43_PHY_LCN
4247         case B43_PHYTYPE_LCN:
4248                 if (phy_rev > 1)
4249                         unsupported = 1;
4250                 break;
4251 #endif
4252         default:
4253                 unsupported = 1;
4254         }
4255         if (unsupported) {
4256                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4257                        "(Analog %u, Type %u, Revision %u)\n",
4258                        analog_type, phy_type, phy_rev);
4259                 return -EOPNOTSUPP;
4260         }
4261         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4262                analog_type, phy_type, phy_rev);
4263
4264         /* Get RADIO versioning */
4265         if (dev->dev->core_rev >= 24) {
4266                 u16 radio24[3];
4267
4268                 for (tmp = 0; tmp < 3; tmp++) {
4269                         b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4270                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4271                 }
4272
4273                 /* Broadcom uses "id" for our "ver" and has separated "ver" */
4274                 /* radio_ver = (radio24[0] & 0xF0) >> 4; */
4275
4276                 radio_manuf = 0x17F;
4277                 radio_ver = (radio24[2] << 8) | radio24[1];
4278                 radio_rev = (radio24[0] & 0xF);
4279         } else {
4280                 if (dev->dev->chip_id == 0x4317) {
4281                         if (dev->dev->chip_rev == 0)
4282                                 tmp = 0x3205017F;
4283                         else if (dev->dev->chip_rev == 1)
4284                                 tmp = 0x4205017F;
4285                         else
4286                                 tmp = 0x5205017F;
4287                 } else {
4288                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4289                                     B43_RADIOCTL_ID);
4290                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4291                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4292                                     B43_RADIOCTL_ID);
4293                         tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4294                                 << 16;
4295                 }
4296                 radio_manuf = (tmp & 0x00000FFF);
4297                 radio_ver = (tmp & 0x0FFFF000) >> 12;
4298                 radio_rev = (tmp & 0xF0000000) >> 28;
4299         }
4300
4301         if (radio_manuf != 0x17F /* Broadcom */)
4302                 unsupported = 1;
4303         switch (phy_type) {
4304         case B43_PHYTYPE_A:
4305                 if (radio_ver != 0x2060)
4306                         unsupported = 1;
4307                 if (radio_rev != 1)
4308                         unsupported = 1;
4309                 if (radio_manuf != 0x17F)
4310                         unsupported = 1;
4311                 break;
4312         case B43_PHYTYPE_B:
4313                 if ((radio_ver & 0xFFF0) != 0x2050)
4314                         unsupported = 1;
4315                 break;
4316         case B43_PHYTYPE_G:
4317                 if (radio_ver != 0x2050)
4318                         unsupported = 1;
4319                 break;
4320         case B43_PHYTYPE_N:
4321                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4322                         unsupported = 1;
4323                 break;
4324         case B43_PHYTYPE_LP:
4325                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4326                         unsupported = 1;
4327                 break;
4328         case B43_PHYTYPE_HT:
4329                 if (radio_ver != 0x2059)
4330                         unsupported = 1;
4331                 break;
4332         case B43_PHYTYPE_LCN:
4333                 if (radio_ver != 0x2064)
4334                         unsupported = 1;
4335                 break;
4336         default:
4337                 B43_WARN_ON(1);
4338         }
4339         if (unsupported) {
4340                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4341                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4342                        radio_manuf, radio_ver, radio_rev);
4343                 return -EOPNOTSUPP;
4344         }
4345         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4346                radio_manuf, radio_ver, radio_rev);
4347
4348         phy->radio_manuf = radio_manuf;
4349         phy->radio_ver = radio_ver;
4350         phy->radio_rev = radio_rev;
4351
4352         phy->analog = analog_type;
4353         phy->type = phy_type;
4354         phy->rev = phy_rev;
4355
4356         return 0;
4357 }
4358
4359 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4360                                       struct b43_phy *phy)
4361 {
4362         phy->hardware_power_control = !!modparam_hwpctl;
4363         phy->next_txpwr_check_time = jiffies;
4364         /* PHY TX errors counter. */
4365         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4366
4367 #if B43_DEBUG
4368         phy->phy_locked = 0;
4369         phy->radio_locked = 0;
4370 #endif
4371 }
4372
4373 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4374 {
4375         dev->dfq_valid = 0;
4376
4377         /* Assume the radio is enabled. If it's not enabled, the state will
4378          * immediately get fixed on the first periodic work run. */
4379         dev->radio_hw_enable = 1;
4380
4381         /* Stats */
4382         memset(&dev->stats, 0, sizeof(dev->stats));
4383
4384         setup_struct_phy_for_init(dev, &dev->phy);
4385
4386         /* IRQ related flags */
4387         dev->irq_reason = 0;
4388         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4389         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4390         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4391                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4392
4393         dev->mac_suspended = 1;
4394
4395         /* Noise calculation context */
4396         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4397 }
4398
4399 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4400 {
4401         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4402         u64 hf;
4403
4404         if (!modparam_btcoex)
4405                 return;
4406         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4407                 return;
4408         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4409                 return;
4410
4411         hf = b43_hf_read(dev);
4412         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4413                 hf |= B43_HF_BTCOEXALT;
4414         else
4415                 hf |= B43_HF_BTCOEX;
4416         b43_hf_write(dev, hf);
4417 }
4418
4419 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4420 {
4421         if (!modparam_btcoex)
4422                 return;
4423         //TODO
4424 }
4425
4426 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4427 {
4428         struct ssb_bus *bus;
4429         u32 tmp;
4430
4431         if (dev->dev->bus_type != B43_BUS_SSB)
4432                 return;
4433
4434         bus = dev->dev->sdev->bus;
4435
4436         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4437             (bus->chip_id == 0x4312)) {
4438                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4439                 tmp &= ~SSB_IMCFGLO_REQTO;
4440                 tmp &= ~SSB_IMCFGLO_SERTO;
4441                 tmp |= 0x3;
4442                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4443                 ssb_commit_settings(bus);
4444         }
4445 }
4446
4447 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4448 {
4449         u16 pu_delay;
4450
4451         /* The time value is in microseconds. */
4452         if (dev->phy.type == B43_PHYTYPE_A)
4453                 pu_delay = 3700;
4454         else
4455                 pu_delay = 1050;
4456         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4457                 pu_delay = 500;
4458         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4459                 pu_delay = max(pu_delay, (u16)2400);
4460
4461         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4462 }
4463
4464 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4465 static void b43_set_pretbtt(struct b43_wldev *dev)
4466 {
4467         u16 pretbtt;
4468
4469         /* The time value is in microseconds. */
4470         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4471                 pretbtt = 2;
4472         } else {
4473                 if (dev->phy.type == B43_PHYTYPE_A)
4474                         pretbtt = 120;
4475                 else
4476                         pretbtt = 250;
4477         }
4478         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4479         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4480 }
4481
4482 /* Shutdown a wireless core */
4483 /* Locking: wl->mutex */
4484 static void b43_wireless_core_exit(struct b43_wldev *dev)
4485 {
4486         u32 macctl;
4487
4488         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4489         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4490                 return;
4491
4492         /* Unregister HW RNG driver */
4493         b43_rng_exit(dev->wl);
4494
4495         b43_set_status(dev, B43_STAT_UNINIT);
4496
4497         /* Stop the microcode PSM. */
4498         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4499         macctl &= ~B43_MACCTL_PSM_RUN;
4500         macctl |= B43_MACCTL_PSM_JMP0;
4501         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4502
4503         b43_dma_free(dev);
4504         b43_pio_free(dev);
4505         b43_chip_exit(dev);
4506         dev->phy.ops->switch_analog(dev, 0);
4507         if (dev->wl->current_beacon) {
4508                 dev_kfree_skb_any(dev->wl->current_beacon);
4509                 dev->wl->current_beacon = NULL;
4510         }
4511
4512         b43_device_disable(dev, 0);
4513         b43_bus_may_powerdown(dev);
4514 }
4515
4516 /* Initialize a wireless core */
4517 static int b43_wireless_core_init(struct b43_wldev *dev)
4518 {
4519         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4520         struct b43_phy *phy = &dev->phy;
4521         int err;
4522         u64 hf;
4523
4524         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4525
4526         err = b43_bus_powerup(dev, 0);
4527         if (err)
4528                 goto out;
4529         if (!b43_device_is_enabled(dev))
4530                 b43_wireless_core_reset(dev, phy->gmode);
4531
4532         /* Reset all data structures. */
4533         setup_struct_wldev_for_init(dev);
4534         phy->ops->prepare_structs(dev);
4535
4536         /* Enable IRQ routing to this device. */
4537         switch (dev->dev->bus_type) {
4538 #ifdef CONFIG_B43_BCMA
4539         case B43_BUS_BCMA:
4540                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
4541                                       dev->dev->bdev, true);
4542                 break;
4543 #endif
4544 #ifdef CONFIG_B43_SSB
4545         case B43_BUS_SSB:
4546                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4547                                                dev->dev->sdev);
4548                 break;
4549 #endif
4550         }
4551
4552         b43_imcfglo_timeouts_workaround(dev);
4553         b43_bluetooth_coext_disable(dev);
4554         if (phy->ops->prepare_hardware) {
4555                 err = phy->ops->prepare_hardware(dev);
4556                 if (err)
4557                         goto err_busdown;
4558         }
4559         err = b43_chip_init(dev);
4560         if (err)
4561                 goto err_busdown;
4562         b43_shm_write16(dev, B43_SHM_SHARED,
4563                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4564         hf = b43_hf_read(dev);
4565         if (phy->type == B43_PHYTYPE_G) {
4566                 hf |= B43_HF_SYMW;
4567                 if (phy->rev == 1)
4568                         hf |= B43_HF_GDCW;
4569                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4570                         hf |= B43_HF_OFDMPABOOST;
4571         }
4572         if (phy->radio_ver == 0x2050) {
4573                 if (phy->radio_rev == 6)
4574                         hf |= B43_HF_4318TSSI;
4575                 if (phy->radio_rev < 6)
4576                         hf |= B43_HF_VCORECALC;
4577         }
4578         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4579                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4580 #ifdef CONFIG_SSB_DRIVER_PCICORE
4581         if (dev->dev->bus_type == B43_BUS_SSB &&
4582             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4583             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4584                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4585 #endif
4586         hf &= ~B43_HF_SKCFPUP;
4587         b43_hf_write(dev, hf);
4588
4589         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4590                              B43_DEFAULT_LONG_RETRY_LIMIT);
4591         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4592         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4593
4594         /* Disable sending probe responses from firmware.
4595          * Setting the MaxTime to one usec will always trigger
4596          * a timeout, so we never send any probe resp.
4597          * A timeout of zero is infinite. */
4598         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4599
4600         b43_rate_memory_init(dev);
4601         b43_set_phytxctl_defaults(dev);
4602
4603         /* Minimum Contention Window */
4604         if (phy->type == B43_PHYTYPE_B)
4605                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4606         else
4607                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4608         /* Maximum Contention Window */
4609         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4610
4611         if (b43_bus_host_is_pcmcia(dev->dev) ||
4612             b43_bus_host_is_sdio(dev->dev) ||
4613             dev->use_pio) {
4614                 dev->__using_pio_transfers = 1;
4615                 err = b43_pio_init(dev);
4616         } else {
4617                 dev->__using_pio_transfers = 0;
4618                 err = b43_dma_init(dev);
4619         }
4620         if (err)
4621                 goto err_chip_exit;
4622         b43_qos_init(dev);
4623         b43_set_synth_pu_delay(dev, 1);
4624         b43_bluetooth_coext_enable(dev);
4625
4626         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4627         b43_upload_card_macaddress(dev);
4628         b43_security_init(dev);
4629
4630         ieee80211_wake_queues(dev->wl->hw);
4631
4632         b43_set_status(dev, B43_STAT_INITIALIZED);
4633
4634         /* Register HW RNG driver */
4635         b43_rng_init(dev->wl);
4636
4637 out:
4638         return err;
4639
4640 err_chip_exit:
4641         b43_chip_exit(dev);
4642 err_busdown:
4643         b43_bus_may_powerdown(dev);
4644         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4645         return err;
4646 }
4647
4648 static int b43_op_add_interface(struct ieee80211_hw *hw,
4649                                 struct ieee80211_vif *vif)
4650 {
4651         struct b43_wl *wl = hw_to_b43_wl(hw);
4652         struct b43_wldev *dev;
4653         int err = -EOPNOTSUPP;
4654
4655         /* TODO: allow WDS/AP devices to coexist */
4656
4657         if (vif->type != NL80211_IFTYPE_AP &&
4658             vif->type != NL80211_IFTYPE_MESH_POINT &&
4659             vif->type != NL80211_IFTYPE_STATION &&
4660             vif->type != NL80211_IFTYPE_WDS &&
4661             vif->type != NL80211_IFTYPE_ADHOC)
4662                 return -EOPNOTSUPP;
4663
4664         mutex_lock(&wl->mutex);
4665         if (wl->operating)
4666                 goto out_mutex_unlock;
4667
4668         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4669
4670         dev = wl->current_dev;
4671         wl->operating = 1;
4672         wl->vif = vif;
4673         wl->if_type = vif->type;
4674         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4675
4676         b43_adjust_opmode(dev);
4677         b43_set_pretbtt(dev);
4678         b43_set_synth_pu_delay(dev, 0);
4679         b43_upload_card_macaddress(dev);
4680
4681         err = 0;
4682  out_mutex_unlock:
4683         mutex_unlock(&wl->mutex);
4684
4685         return err;
4686 }
4687
4688 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4689                                     struct ieee80211_vif *vif)
4690 {
4691         struct b43_wl *wl = hw_to_b43_wl(hw);
4692         struct b43_wldev *dev = wl->current_dev;
4693
4694         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4695
4696         mutex_lock(&wl->mutex);
4697
4698         B43_WARN_ON(!wl->operating);
4699         B43_WARN_ON(wl->vif != vif);
4700         wl->vif = NULL;
4701
4702         wl->operating = 0;
4703
4704         b43_adjust_opmode(dev);
4705         memset(wl->mac_addr, 0, ETH_ALEN);
4706         b43_upload_card_macaddress(dev);
4707
4708         mutex_unlock(&wl->mutex);
4709 }
4710
4711 static int b43_op_start(struct ieee80211_hw *hw)
4712 {
4713         struct b43_wl *wl = hw_to_b43_wl(hw);
4714         struct b43_wldev *dev = wl->current_dev;
4715         int did_init = 0;
4716         int err = 0;
4717
4718         /* Kill all old instance specific information to make sure
4719          * the card won't use it in the short timeframe between start
4720          * and mac80211 reconfiguring it. */
4721         memset(wl->bssid, 0, ETH_ALEN);
4722         memset(wl->mac_addr, 0, ETH_ALEN);
4723         wl->filter_flags = 0;
4724         wl->radiotap_enabled = 0;
4725         b43_qos_clear(wl);
4726         wl->beacon0_uploaded = 0;
4727         wl->beacon1_uploaded = 0;
4728         wl->beacon_templates_virgin = 1;
4729         wl->radio_enabled = 1;
4730
4731         mutex_lock(&wl->mutex);
4732
4733         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4734                 err = b43_wireless_core_init(dev);
4735                 if (err)
4736                         goto out_mutex_unlock;
4737                 did_init = 1;
4738         }
4739
4740         if (b43_status(dev) < B43_STAT_STARTED) {
4741                 err = b43_wireless_core_start(dev);
4742                 if (err) {
4743                         if (did_init)
4744                                 b43_wireless_core_exit(dev);
4745                         goto out_mutex_unlock;
4746                 }
4747         }
4748
4749         /* XXX: only do if device doesn't support rfkill irq */
4750         wiphy_rfkill_start_polling(hw->wiphy);
4751
4752  out_mutex_unlock:
4753         mutex_unlock(&wl->mutex);
4754
4755         return err;
4756 }
4757
4758 static void b43_op_stop(struct ieee80211_hw *hw)
4759 {
4760         struct b43_wl *wl = hw_to_b43_wl(hw);
4761         struct b43_wldev *dev = wl->current_dev;
4762
4763         cancel_work_sync(&(wl->beacon_update_trigger));
4764
4765         mutex_lock(&wl->mutex);
4766         if (b43_status(dev) >= B43_STAT_STARTED) {
4767                 dev = b43_wireless_core_stop(dev);
4768                 if (!dev)
4769                         goto out_unlock;
4770         }
4771         b43_wireless_core_exit(dev);
4772         wl->radio_enabled = 0;
4773
4774 out_unlock:
4775         mutex_unlock(&wl->mutex);
4776
4777         cancel_work_sync(&(wl->txpower_adjust_work));
4778 }
4779
4780 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4781                                  struct ieee80211_sta *sta, bool set)
4782 {
4783         struct b43_wl *wl = hw_to_b43_wl(hw);
4784
4785         /* FIXME: add locking */
4786         b43_update_templates(wl);
4787
4788         return 0;
4789 }
4790
4791 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4792                               struct ieee80211_vif *vif,
4793                               enum sta_notify_cmd notify_cmd,
4794                               struct ieee80211_sta *sta)
4795 {
4796         struct b43_wl *wl = hw_to_b43_wl(hw);
4797
4798         B43_WARN_ON(!vif || wl->vif != vif);
4799 }
4800
4801 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4802 {
4803         struct b43_wl *wl = hw_to_b43_wl(hw);
4804         struct b43_wldev *dev;
4805
4806         mutex_lock(&wl->mutex);
4807         dev = wl->current_dev;
4808         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4809                 /* Disable CFP update during scan on other channels. */
4810                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4811         }
4812         mutex_unlock(&wl->mutex);
4813 }
4814
4815 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4816 {
4817         struct b43_wl *wl = hw_to_b43_wl(hw);
4818         struct b43_wldev *dev;
4819
4820         mutex_lock(&wl->mutex);
4821         dev = wl->current_dev;
4822         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4823                 /* Re-enable CFP update. */
4824                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4825         }
4826         mutex_unlock(&wl->mutex);
4827 }
4828
4829 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4830                              struct survey_info *survey)
4831 {
4832         struct b43_wl *wl = hw_to_b43_wl(hw);
4833         struct b43_wldev *dev = wl->current_dev;
4834         struct ieee80211_conf *conf = &hw->conf;
4835
4836         if (idx != 0)
4837                 return -ENOENT;
4838
4839         survey->channel = conf->channel;
4840         survey->filled = SURVEY_INFO_NOISE_DBM;
4841         survey->noise = dev->stats.link_noise;
4842
4843         return 0;
4844 }
4845
4846 static const struct ieee80211_ops b43_hw_ops = {
4847         .tx                     = b43_op_tx,
4848         .conf_tx                = b43_op_conf_tx,
4849         .add_interface          = b43_op_add_interface,
4850         .remove_interface       = b43_op_remove_interface,
4851         .config                 = b43_op_config,
4852         .bss_info_changed       = b43_op_bss_info_changed,
4853         .configure_filter       = b43_op_configure_filter,
4854         .set_key                = b43_op_set_key,
4855         .update_tkip_key        = b43_op_update_tkip_key,
4856         .get_stats              = b43_op_get_stats,
4857         .get_tsf                = b43_op_get_tsf,
4858         .set_tsf                = b43_op_set_tsf,
4859         .start                  = b43_op_start,
4860         .stop                   = b43_op_stop,
4861         .set_tim                = b43_op_beacon_set_tim,
4862         .sta_notify             = b43_op_sta_notify,
4863         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4864         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4865         .get_survey             = b43_op_get_survey,
4866         .rfkill_poll            = b43_rfkill_poll,
4867 };
4868
4869 /* Hard-reset the chip. Do not call this directly.
4870  * Use b43_controller_restart()
4871  */
4872 static void b43_chip_reset(struct work_struct *work)
4873 {
4874         struct b43_wldev *dev =
4875             container_of(work, struct b43_wldev, restart_work);
4876         struct b43_wl *wl = dev->wl;
4877         int err = 0;
4878         int prev_status;
4879
4880         mutex_lock(&wl->mutex);
4881
4882         prev_status = b43_status(dev);
4883         /* Bring the device down... */
4884         if (prev_status >= B43_STAT_STARTED) {
4885                 dev = b43_wireless_core_stop(dev);
4886                 if (!dev) {
4887                         err = -ENODEV;
4888                         goto out;
4889                 }
4890         }
4891         if (prev_status >= B43_STAT_INITIALIZED)
4892                 b43_wireless_core_exit(dev);
4893
4894         /* ...and up again. */
4895         if (prev_status >= B43_STAT_INITIALIZED) {
4896                 err = b43_wireless_core_init(dev);
4897                 if (err)
4898                         goto out;
4899         }
4900         if (prev_status >= B43_STAT_STARTED) {
4901                 err = b43_wireless_core_start(dev);
4902                 if (err) {
4903                         b43_wireless_core_exit(dev);
4904                         goto out;
4905                 }
4906         }
4907 out:
4908         if (err)
4909                 wl->current_dev = NULL; /* Failed to init the dev. */
4910         mutex_unlock(&wl->mutex);
4911         if (err)
4912                 b43err(wl, "Controller restart FAILED\n");
4913         else
4914                 b43info(wl, "Controller restarted\n");
4915 }
4916
4917 static int b43_setup_bands(struct b43_wldev *dev,
4918                            bool have_2ghz_phy, bool have_5ghz_phy)
4919 {
4920         struct ieee80211_hw *hw = dev->wl->hw;
4921
4922         if (have_2ghz_phy)
4923                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4924         if (dev->phy.type == B43_PHYTYPE_N) {
4925                 if (have_5ghz_phy)
4926                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4927         } else {
4928                 if (have_5ghz_phy)
4929                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4930         }
4931
4932         dev->phy.supports_2ghz = have_2ghz_phy;
4933         dev->phy.supports_5ghz = have_5ghz_phy;
4934
4935         return 0;
4936 }
4937
4938 static void b43_wireless_core_detach(struct b43_wldev *dev)
4939 {
4940         /* We release firmware that late to not be required to re-request
4941          * is all the time when we reinit the core. */
4942         b43_release_firmware(dev);
4943         b43_phy_free(dev);
4944 }
4945
4946 static int b43_wireless_core_attach(struct b43_wldev *dev)
4947 {
4948         struct b43_wl *wl = dev->wl;
4949         struct pci_dev *pdev = NULL;
4950         int err;
4951         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4952
4953         /* Do NOT do any device initialization here.
4954          * Do it in wireless_core_init() instead.
4955          * This function is for gathering basic information about the HW, only.
4956          * Also some structs may be set up here. But most likely you want to have
4957          * that in core_init(), too.
4958          */
4959
4960 #ifdef CONFIG_B43_SSB
4961         if (dev->dev->bus_type == B43_BUS_SSB &&
4962             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
4963                 pdev = dev->dev->sdev->bus->host_pci;
4964 #endif
4965
4966         err = b43_bus_powerup(dev, 0);
4967         if (err) {
4968                 b43err(wl, "Bus powerup failed\n");
4969                 goto out;
4970         }
4971
4972         /* Get the PHY type. */
4973         switch (dev->dev->bus_type) {
4974 #ifdef CONFIG_B43_BCMA
4975         case B43_BUS_BCMA:
4976                 /* FIXME */
4977                 have_2ghz_phy = 1;
4978                 have_5ghz_phy = 0;
4979                 break;
4980 #endif
4981 #ifdef CONFIG_B43_SSB
4982         case B43_BUS_SSB:
4983                 if (dev->dev->core_rev >= 5) {
4984                         u32 tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
4985                         have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4986                         have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4987                 } else
4988                         B43_WARN_ON(1);
4989                 break;
4990 #endif
4991         }
4992
4993         dev->phy.gmode = have_2ghz_phy;
4994         dev->phy.radio_on = 1;
4995         b43_wireless_core_reset(dev, dev->phy.gmode);
4996
4997         err = b43_phy_versioning(dev);
4998         if (err)
4999                 goto err_powerdown;
5000         /* Check if this device supports multiband. */
5001         if (!pdev ||
5002             (pdev->device != 0x4312 &&
5003              pdev->device != 0x4319 && pdev->device != 0x4324)) {
5004                 /* No multiband support. */
5005                 have_2ghz_phy = 0;
5006                 have_5ghz_phy = 0;
5007                 switch (dev->phy.type) {
5008                 case B43_PHYTYPE_A:
5009                         have_5ghz_phy = 1;
5010                         break;
5011                 case B43_PHYTYPE_LP: //FIXME not always!
5012 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
5013                         have_5ghz_phy = 1;
5014 #endif
5015                 case B43_PHYTYPE_G:
5016                 case B43_PHYTYPE_N:
5017                 case B43_PHYTYPE_HT:
5018                 case B43_PHYTYPE_LCN:
5019                         have_2ghz_phy = 1;
5020                         break;
5021                 default:
5022                         B43_WARN_ON(1);
5023                 }
5024         }
5025         if (dev->phy.type == B43_PHYTYPE_A) {
5026                 /* FIXME */
5027                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
5028                 err = -EOPNOTSUPP;
5029                 goto err_powerdown;
5030         }
5031         if (1 /* disable A-PHY */) {
5032                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
5033                 if (dev->phy.type != B43_PHYTYPE_N &&
5034                     dev->phy.type != B43_PHYTYPE_LP) {
5035                         have_2ghz_phy = 1;
5036                         have_5ghz_phy = 0;
5037                 }
5038         }
5039
5040         err = b43_phy_allocate(dev);
5041         if (err)
5042                 goto err_powerdown;
5043
5044         dev->phy.gmode = have_2ghz_phy;
5045         b43_wireless_core_reset(dev, dev->phy.gmode);
5046
5047         err = b43_validate_chipaccess(dev);
5048         if (err)
5049                 goto err_phy_free;
5050         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5051         if (err)
5052                 goto err_phy_free;
5053
5054         /* Now set some default "current_dev" */
5055         if (!wl->current_dev)
5056                 wl->current_dev = dev;
5057         INIT_WORK(&dev->restart_work, b43_chip_reset);
5058
5059         dev->phy.ops->switch_analog(dev, 0);
5060         b43_device_disable(dev, 0);
5061         b43_bus_may_powerdown(dev);
5062
5063 out:
5064         return err;
5065
5066 err_phy_free:
5067         b43_phy_free(dev);
5068 err_powerdown:
5069         b43_bus_may_powerdown(dev);
5070         return err;
5071 }
5072
5073 static void b43_one_core_detach(struct b43_bus_dev *dev)
5074 {
5075         struct b43_wldev *wldev;
5076         struct b43_wl *wl;
5077
5078         /* Do not cancel ieee80211-workqueue based work here.
5079          * See comment in b43_remove(). */
5080
5081         wldev = b43_bus_get_wldev(dev);
5082         wl = wldev->wl;
5083         b43_debugfs_remove_device(wldev);
5084         b43_wireless_core_detach(wldev);
5085         list_del(&wldev->list);
5086         wl->nr_devs--;
5087         b43_bus_set_wldev(dev, NULL);
5088         kfree(wldev);
5089 }
5090
5091 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5092 {
5093         struct b43_wldev *wldev;
5094         int err = -ENOMEM;
5095
5096         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5097         if (!wldev)
5098                 goto out;
5099
5100         wldev->use_pio = b43_modparam_pio;
5101         wldev->dev = dev;
5102         wldev->wl = wl;
5103         b43_set_status(wldev, B43_STAT_UNINIT);
5104         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5105         INIT_LIST_HEAD(&wldev->list);
5106
5107         err = b43_wireless_core_attach(wldev);
5108         if (err)
5109                 goto err_kfree_wldev;
5110
5111         list_add(&wldev->list, &wl->devlist);
5112         wl->nr_devs++;
5113         b43_bus_set_wldev(dev, wldev);
5114         b43_debugfs_add_device(wldev);
5115
5116       out:
5117         return err;
5118
5119       err_kfree_wldev:
5120         kfree(wldev);
5121         return err;
5122 }
5123
5124 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5125         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5126         (pdev->device == _device) &&                                    \
5127         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5128         (pdev->subsystem_device == _subdevice)                          )
5129
5130 static void b43_sprom_fixup(struct ssb_bus *bus)
5131 {
5132         struct pci_dev *pdev;
5133
5134         /* boardflags workarounds */
5135         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5136             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
5137                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5138         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5139             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
5140                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5141         if (bus->bustype == SSB_BUSTYPE_PCI) {
5142                 pdev = bus->host_pci;
5143                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5144                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5145                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5146                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5147                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5148                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5149                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5150                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5151         }
5152 }
5153
5154 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5155 {
5156         struct ieee80211_hw *hw = wl->hw;
5157
5158         ssb_set_devtypedata(dev->sdev, NULL);
5159         ieee80211_free_hw(hw);
5160 }
5161
5162 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5163 {
5164         struct ssb_sprom *sprom = dev->bus_sprom;
5165         struct ieee80211_hw *hw;
5166         struct b43_wl *wl;
5167
5168         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5169         if (!hw) {
5170                 b43err(NULL, "Could not allocate ieee80211 device\n");
5171                 return ERR_PTR(-ENOMEM);
5172         }
5173         wl = hw_to_b43_wl(hw);
5174
5175         /* fill hw info */
5176         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5177                     IEEE80211_HW_SIGNAL_DBM;
5178
5179         hw->wiphy->interface_modes =
5180                 BIT(NL80211_IFTYPE_AP) |
5181                 BIT(NL80211_IFTYPE_MESH_POINT) |
5182                 BIT(NL80211_IFTYPE_STATION) |
5183                 BIT(NL80211_IFTYPE_WDS) |
5184                 BIT(NL80211_IFTYPE_ADHOC);
5185
5186         hw->queues = modparam_qos ? 4 : 1;
5187         wl->mac80211_initially_registered_queues = hw->queues;
5188         hw->max_rates = 2;
5189         SET_IEEE80211_DEV(hw, dev->dev);
5190         if (is_valid_ether_addr(sprom->et1mac))
5191                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5192         else
5193                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5194
5195         /* Initialize struct b43_wl */
5196         wl->hw = hw;
5197         mutex_init(&wl->mutex);
5198         spin_lock_init(&wl->hardirq_lock);
5199         INIT_LIST_HEAD(&wl->devlist);
5200         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5201         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5202         INIT_WORK(&wl->tx_work, b43_tx_work);
5203         skb_queue_head_init(&wl->tx_queue);
5204
5205         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
5206                 dev->chip_id, dev->core_rev);
5207         return wl;
5208 }
5209
5210 #ifdef CONFIG_B43_BCMA
5211 static int b43_bcma_probe(struct bcma_device *core)
5212 {
5213         struct b43_bus_dev *dev;
5214
5215         dev = b43_bus_dev_bcma_init(core);
5216         if (!dev)
5217                 return -ENODEV;
5218
5219         b43err(NULL, "BCMA is not supported yet!");
5220         kfree(dev);
5221         return -EOPNOTSUPP;
5222 }
5223
5224 static void b43_bcma_remove(struct bcma_device *core)
5225 {
5226         /* TODO */
5227 }
5228
5229 static struct bcma_driver b43_bcma_driver = {
5230         .name           = KBUILD_MODNAME,
5231         .id_table       = b43_bcma_tbl,
5232         .probe          = b43_bcma_probe,
5233         .remove         = b43_bcma_remove,
5234 };
5235 #endif
5236
5237 #ifdef CONFIG_B43_SSB
5238 static
5239 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5240 {
5241         struct b43_bus_dev *dev;
5242         struct b43_wl *wl;
5243         int err;
5244         int first = 0;
5245
5246         dev = b43_bus_dev_ssb_init(sdev);
5247         if (!dev)
5248                 return -ENOMEM;
5249
5250         wl = ssb_get_devtypedata(sdev);
5251         if (!wl) {
5252                 /* Probing the first core. Must setup common struct b43_wl */
5253                 first = 1;
5254                 b43_sprom_fixup(sdev->bus);
5255                 wl = b43_wireless_init(dev);
5256                 if (IS_ERR(wl)) {
5257                         err = PTR_ERR(wl);
5258                         goto out;
5259                 }
5260                 ssb_set_devtypedata(sdev, wl);
5261                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5262         }
5263         err = b43_one_core_attach(dev, wl);
5264         if (err)
5265                 goto err_wireless_exit;
5266
5267         if (first) {
5268                 err = ieee80211_register_hw(wl->hw);
5269                 if (err)
5270                         goto err_one_core_detach;
5271                 b43_leds_register(wl->current_dev);
5272         }
5273
5274       out:
5275         return err;
5276
5277       err_one_core_detach:
5278         b43_one_core_detach(dev);
5279       err_wireless_exit:
5280         if (first)
5281                 b43_wireless_exit(dev, wl);
5282         return err;
5283 }
5284
5285 static void b43_ssb_remove(struct ssb_device *sdev)
5286 {
5287         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5288         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5289
5290         /* We must cancel any work here before unregistering from ieee80211,
5291          * as the ieee80211 unreg will destroy the workqueue. */
5292         cancel_work_sync(&wldev->restart_work);
5293
5294         B43_WARN_ON(!wl);
5295         if (wl->current_dev == wldev) {
5296                 /* Restore the queues count before unregistering, because firmware detect
5297                  * might have modified it. Restoring is important, so the networking
5298                  * stack can properly free resources. */
5299                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5300                 b43_leds_stop(wldev);
5301                 ieee80211_unregister_hw(wl->hw);
5302         }
5303
5304         b43_one_core_detach(wldev->dev);
5305
5306         if (list_empty(&wl->devlist)) {
5307                 b43_leds_unregister(wl);
5308                 /* Last core on the chip unregistered.
5309                  * We can destroy common struct b43_wl.
5310                  */
5311                 b43_wireless_exit(wldev->dev, wl);
5312         }
5313 }
5314
5315 static struct ssb_driver b43_ssb_driver = {
5316         .name           = KBUILD_MODNAME,
5317         .id_table       = b43_ssb_tbl,
5318         .probe          = b43_ssb_probe,
5319         .remove         = b43_ssb_remove,
5320 };
5321 #endif /* CONFIG_B43_SSB */
5322
5323 /* Perform a hardware reset. This can be called from any context. */
5324 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5325 {
5326         /* Must avoid requeueing, if we are in shutdown. */
5327         if (b43_status(dev) < B43_STAT_INITIALIZED)
5328                 return;
5329         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5330         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5331 }
5332
5333 static void b43_print_driverinfo(void)
5334 {
5335         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5336                    *feat_leds = "", *feat_sdio = "";
5337
5338 #ifdef CONFIG_B43_PCI_AUTOSELECT
5339         feat_pci = "P";
5340 #endif
5341 #ifdef CONFIG_B43_PCMCIA
5342         feat_pcmcia = "M";
5343 #endif
5344 #ifdef CONFIG_B43_PHY_N
5345         feat_nphy = "N";
5346 #endif
5347 #ifdef CONFIG_B43_LEDS
5348         feat_leds = "L";
5349 #endif
5350 #ifdef CONFIG_B43_SDIO
5351         feat_sdio = "S";
5352 #endif
5353         printk(KERN_INFO "Broadcom 43xx driver loaded "
5354                "[ Features: %s%s%s%s%s, Firmware-ID: "
5355                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5356                feat_pci, feat_pcmcia, feat_nphy,
5357                feat_leds, feat_sdio);
5358 }
5359
5360 static int __init b43_init(void)
5361 {
5362         int err;
5363
5364         b43_debugfs_init();
5365         err = b43_pcmcia_init();
5366         if (err)
5367                 goto err_dfs_exit;
5368         err = b43_sdio_init();
5369         if (err)
5370                 goto err_pcmcia_exit;
5371 #ifdef CONFIG_B43_BCMA
5372         err = bcma_driver_register(&b43_bcma_driver);
5373         if (err)
5374                 goto err_sdio_exit;
5375 #endif
5376 #ifdef CONFIG_B43_SSB
5377         err = ssb_driver_register(&b43_ssb_driver);
5378         if (err)
5379                 goto err_bcma_driver_exit;
5380 #endif
5381         b43_print_driverinfo();
5382
5383         return err;
5384
5385 #ifdef CONFIG_B43_SSB
5386 err_bcma_driver_exit:
5387 #endif
5388 #ifdef CONFIG_B43_BCMA
5389         bcma_driver_unregister(&b43_bcma_driver);
5390 err_sdio_exit:
5391 #endif
5392         b43_sdio_exit();
5393 err_pcmcia_exit:
5394         b43_pcmcia_exit();
5395 err_dfs_exit:
5396         b43_debugfs_exit();
5397         return err;
5398 }
5399
5400 static void __exit b43_exit(void)
5401 {
5402 #ifdef CONFIG_B43_SSB
5403         ssb_driver_unregister(&b43_ssb_driver);
5404 #endif
5405 #ifdef CONFIG_B43_BCMA
5406         bcma_driver_unregister(&b43_bcma_driver);
5407 #endif
5408         b43_sdio_exit();
5409         b43_pcmcia_exit();
5410         b43_debugfs_exit();
5411 }
5412
5413 module_init(b43_init)
5414 module_exit(b43_exit)