drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1159 {
1160         struct ssb_device *sdev = dev->dev->sdev;
1161         u32 tmslow;
1162         u32 flags = 0;
1163
1164         if (gmode)
1165                 flags |= B43_TMSLOW_GMODE;
1166         flags |= B43_TMSLOW_PHYCLKEN;
1167         flags |= B43_TMSLOW_PHYRESET;
1168         if (dev->phy.type == B43_PHYTYPE_N)
1169                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1170         b43_device_enable(dev, flags);
1171         msleep(2);              /* Wait for the PLL to turn on. */
1172
1173         /* Now take the PHY out of Reset again */
1174         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1175         tmslow |= SSB_TMSLOW_FGC;
1176         tmslow &= ~B43_TMSLOW_PHYRESET;
1177         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1178         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1179         msleep(1);
1180         tmslow &= ~SSB_TMSLOW_FGC;
1181         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1182         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1183         msleep(1);
1184 }
1185
1186 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1187 {
1188         u32 macctl;
1189
1190         switch (dev->dev->bus_type) {
1191 #ifdef CONFIG_B43_SSB
1192         case B43_BUS_SSB:
1193                 b43_ssb_wireless_core_reset(dev, gmode);
1194                 break;
1195 #endif
1196         }
1197
1198         /* Turn Analog ON, but only if we already know the PHY-type.
1199          * This protects against very early setup where we don't know the
1200          * PHY-type, yet. wireless_core_reset will be called once again later,
1201          * when we know the PHY-type. */
1202         if (dev->phy.ops)
1203                 dev->phy.ops->switch_analog(dev, 1);
1204
1205         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1206         macctl &= ~B43_MACCTL_GMODE;
1207         if (gmode)
1208                 macctl |= B43_MACCTL_GMODE;
1209         macctl |= B43_MACCTL_IHR_ENABLED;
1210         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1211 }
1212
1213 static void handle_irq_transmit_status(struct b43_wldev *dev)
1214 {
1215         u32 v0, v1;
1216         u16 tmp;
1217         struct b43_txstatus stat;
1218
1219         while (1) {
1220                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1221                 if (!(v0 & 0x00000001))
1222                         break;
1223                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1224
1225                 stat.cookie = (v0 >> 16);
1226                 stat.seq = (v1 & 0x0000FFFF);
1227                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1228                 tmp = (v0 & 0x0000FFFF);
1229                 stat.frame_count = ((tmp & 0xF000) >> 12);
1230                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1231                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1232                 stat.pm_indicated = !!(tmp & 0x0080);
1233                 stat.intermediate = !!(tmp & 0x0040);
1234                 stat.for_ampdu = !!(tmp & 0x0020);
1235                 stat.acked = !!(tmp & 0x0002);
1236
1237                 b43_handle_txstatus(dev, &stat);
1238         }
1239 }
1240
1241 static void drain_txstatus_queue(struct b43_wldev *dev)
1242 {
1243         u32 dummy;
1244
1245         if (dev->dev->core_rev < 5)
1246                 return;
1247         /* Read all entries from the microcode TXstatus FIFO
1248          * and throw them away.
1249          */
1250         while (1) {
1251                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1252                 if (!(dummy & 0x00000001))
1253                         break;
1254                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1255         }
1256 }
1257
1258 static u32 b43_jssi_read(struct b43_wldev *dev)
1259 {
1260         u32 val = 0;
1261
1262         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1263         val <<= 16;
1264         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1265
1266         return val;
1267 }
1268
1269 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1270 {
1271         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1272         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1273 }
1274
1275 static void b43_generate_noise_sample(struct b43_wldev *dev)
1276 {
1277         b43_jssi_write(dev, 0x7F7F7F7F);
1278         b43_write32(dev, B43_MMIO_MACCMD,
1279                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1280 }
1281
1282 static void b43_calculate_link_quality(struct b43_wldev *dev)
1283 {
1284         /* Top half of Link Quality calculation. */
1285
1286         if (dev->phy.type != B43_PHYTYPE_G)
1287                 return;
1288         if (dev->noisecalc.calculation_running)
1289                 return;
1290         dev->noisecalc.calculation_running = 1;
1291         dev->noisecalc.nr_samples = 0;
1292
1293         b43_generate_noise_sample(dev);
1294 }
1295
1296 static void handle_irq_noise(struct b43_wldev *dev)
1297 {
1298         struct b43_phy_g *phy = dev->phy.g;
1299         u16 tmp;
1300         u8 noise[4];
1301         u8 i, j;
1302         s32 average;
1303
1304         /* Bottom half of Link Quality calculation. */
1305
1306         if (dev->phy.type != B43_PHYTYPE_G)
1307                 return;
1308
1309         /* Possible race condition: It might be possible that the user
1310          * changed to a different channel in the meantime since we
1311          * started the calculation. We ignore that fact, since it's
1312          * not really that much of a problem. The background noise is
1313          * an estimation only anyway. Slightly wrong results will get damped
1314          * by the averaging of the 8 sample rounds. Additionally the
1315          * value is shortlived. So it will be replaced by the next noise
1316          * calculation round soon. */
1317
1318         B43_WARN_ON(!dev->noisecalc.calculation_running);
1319         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1320         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1321             noise[2] == 0x7F || noise[3] == 0x7F)
1322                 goto generate_new;
1323
1324         /* Get the noise samples. */
1325         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1326         i = dev->noisecalc.nr_samples;
1327         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1328         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1329         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1330         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1331         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1332         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1333         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1334         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1335         dev->noisecalc.nr_samples++;
1336         if (dev->noisecalc.nr_samples == 8) {
1337                 /* Calculate the Link Quality by the noise samples. */
1338                 average = 0;
1339                 for (i = 0; i < 8; i++) {
1340                         for (j = 0; j < 4; j++)
1341                                 average += dev->noisecalc.samples[i][j];
1342                 }
1343                 average /= (8 * 4);
1344                 average *= 125;
1345                 average += 64;
1346                 average /= 128;
1347                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1348                 tmp = (tmp / 128) & 0x1F;
1349                 if (tmp >= 8)
1350                         average += 2;
1351                 else
1352                         average -= 25;
1353                 if (tmp == 8)
1354                         average -= 72;
1355                 else
1356                         average -= 48;
1357
1358                 dev->stats.link_noise = average;
1359                 dev->noisecalc.calculation_running = 0;
1360                 return;
1361         }
1362 generate_new:
1363         b43_generate_noise_sample(dev);
1364 }
1365
1366 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1367 {
1368         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1369                 ///TODO: PS TBTT
1370         } else {
1371                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1372                         b43_power_saving_ctl_bits(dev, 0);
1373         }
1374         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1375                 dev->dfq_valid = 1;
1376 }
1377
1378 static void handle_irq_atim_end(struct b43_wldev *dev)
1379 {
1380         if (dev->dfq_valid) {
1381                 b43_write32(dev, B43_MMIO_MACCMD,
1382                             b43_read32(dev, B43_MMIO_MACCMD)
1383                             | B43_MACCMD_DFQ_VALID);
1384                 dev->dfq_valid = 0;
1385         }
1386 }
1387
1388 static void handle_irq_pmq(struct b43_wldev *dev)
1389 {
1390         u32 tmp;
1391
1392         //TODO: AP mode.
1393
1394         while (1) {
1395                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1396                 if (!(tmp & 0x00000008))
1397                         break;
1398         }
1399         /* 16bit write is odd, but correct. */
1400         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1401 }
1402
1403 static void b43_write_template_common(struct b43_wldev *dev,
1404                                       const u8 *data, u16 size,
1405                                       u16 ram_offset,
1406                                       u16 shm_size_offset, u8 rate)
1407 {
1408         u32 i, tmp;
1409         struct b43_plcp_hdr4 plcp;
1410
1411         plcp.data = 0;
1412         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1413         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1414         ram_offset += sizeof(u32);
1415         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1416          * So leave the first two bytes of the next write blank.
1417          */
1418         tmp = (u32) (data[0]) << 16;
1419         tmp |= (u32) (data[1]) << 24;
1420         b43_ram_write(dev, ram_offset, tmp);
1421         ram_offset += sizeof(u32);
1422         for (i = 2; i < size; i += sizeof(u32)) {
1423                 tmp = (u32) (data[i + 0]);
1424                 if (i + 1 < size)
1425                         tmp |= (u32) (data[i + 1]) << 8;
1426                 if (i + 2 < size)
1427                         tmp |= (u32) (data[i + 2]) << 16;
1428                 if (i + 3 < size)
1429                         tmp |= (u32) (data[i + 3]) << 24;
1430                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1431         }
1432         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1433                         size + sizeof(struct b43_plcp_hdr6));
1434 }
1435
1436 /* Check if the use of the antenna that ieee80211 told us to
1437  * use is possible. This will fall back to DEFAULT.
1438  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1439 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1440                                   u8 antenna_nr)
1441 {
1442         u8 antenna_mask;
1443
1444         if (antenna_nr == 0) {
1445                 /* Zero means "use default antenna". That's always OK. */
1446                 return 0;
1447         }
1448
1449         /* Get the mask of available antennas. */
1450         if (dev->phy.gmode)
1451                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1452         else
1453                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1454
1455         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1456                 /* This antenna is not available. Fall back to default. */
1457                 return 0;
1458         }
1459
1460         return antenna_nr;
1461 }
1462
1463 /* Convert a b43 antenna number value to the PHY TX control value. */
1464 static u16 b43_antenna_to_phyctl(int antenna)
1465 {
1466         switch (antenna) {
1467         case B43_ANTENNA0:
1468                 return B43_TXH_PHY_ANT0;
1469         case B43_ANTENNA1:
1470                 return B43_TXH_PHY_ANT1;
1471         case B43_ANTENNA2:
1472                 return B43_TXH_PHY_ANT2;
1473         case B43_ANTENNA3:
1474                 return B43_TXH_PHY_ANT3;
1475         case B43_ANTENNA_AUTO0:
1476         case B43_ANTENNA_AUTO1:
1477                 return B43_TXH_PHY_ANT01AUTO;
1478         }
1479         B43_WARN_ON(1);
1480         return 0;
1481 }
1482
1483 static void b43_write_beacon_template(struct b43_wldev *dev,
1484                                       u16 ram_offset,
1485                                       u16 shm_size_offset)
1486 {
1487         unsigned int i, len, variable_len;
1488         const struct ieee80211_mgmt *bcn;
1489         const u8 *ie;
1490         bool tim_found = 0;
1491         unsigned int rate;
1492         u16 ctl;
1493         int antenna;
1494         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1495
1496         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1497         len = min((size_t) dev->wl->current_beacon->len,
1498                   0x200 - sizeof(struct b43_plcp_hdr6));
1499         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1500
1501         b43_write_template_common(dev, (const u8 *)bcn,
1502                                   len, ram_offset, shm_size_offset, rate);
1503
1504         /* Write the PHY TX control parameters. */
1505         antenna = B43_ANTENNA_DEFAULT;
1506         antenna = b43_antenna_to_phyctl(antenna);
1507         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1508         /* We can't send beacons with short preamble. Would get PHY errors. */
1509         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1510         ctl &= ~B43_TXH_PHY_ANT;
1511         ctl &= ~B43_TXH_PHY_ENC;
1512         ctl |= antenna;
1513         if (b43_is_cck_rate(rate))
1514                 ctl |= B43_TXH_PHY_ENC_CCK;
1515         else
1516                 ctl |= B43_TXH_PHY_ENC_OFDM;
1517         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1518
1519         /* Find the position of the TIM and the DTIM_period value
1520          * and write them to SHM. */
1521         ie = bcn->u.beacon.variable;
1522         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1523         for (i = 0; i < variable_len - 2; ) {
1524                 uint8_t ie_id, ie_len;
1525
1526                 ie_id = ie[i];
1527                 ie_len = ie[i + 1];
1528                 if (ie_id == 5) {
1529                         u16 tim_position;
1530                         u16 dtim_period;
1531                         /* This is the TIM Information Element */
1532
1533                         /* Check whether the ie_len is in the beacon data range. */
1534                         if (variable_len < ie_len + 2 + i)
1535                                 break;
1536                         /* A valid TIM is at least 4 bytes long. */
1537                         if (ie_len < 4)
1538                                 break;
1539                         tim_found = 1;
1540
1541                         tim_position = sizeof(struct b43_plcp_hdr6);
1542                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1543                         tim_position += i;
1544
1545                         dtim_period = ie[i + 3];
1546
1547                         b43_shm_write16(dev, B43_SHM_SHARED,
1548                                         B43_SHM_SH_TIMBPOS, tim_position);
1549                         b43_shm_write16(dev, B43_SHM_SHARED,
1550                                         B43_SHM_SH_DTIMPER, dtim_period);
1551                         break;
1552                 }
1553                 i += ie_len + 2;
1554         }
1555         if (!tim_found) {
1556                 /*
1557                  * If ucode wants to modify TIM do it behind the beacon, this
1558                  * will happen, for example, when doing mesh networking.
1559                  */
1560                 b43_shm_write16(dev, B43_SHM_SHARED,
1561                                 B43_SHM_SH_TIMBPOS,
1562                                 len + sizeof(struct b43_plcp_hdr6));
1563                 b43_shm_write16(dev, B43_SHM_SHARED,
1564                                 B43_SHM_SH_DTIMPER, 0);
1565         }
1566         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1567 }
1568
1569 static void b43_upload_beacon0(struct b43_wldev *dev)
1570 {
1571         struct b43_wl *wl = dev->wl;
1572
1573         if (wl->beacon0_uploaded)
1574                 return;
1575         b43_write_beacon_template(dev, 0x68, 0x18);
1576         wl->beacon0_uploaded = 1;
1577 }
1578
1579 static void b43_upload_beacon1(struct b43_wldev *dev)
1580 {
1581         struct b43_wl *wl = dev->wl;
1582
1583         if (wl->beacon1_uploaded)
1584                 return;
1585         b43_write_beacon_template(dev, 0x468, 0x1A);
1586         wl->beacon1_uploaded = 1;
1587 }
1588
1589 static void handle_irq_beacon(struct b43_wldev *dev)
1590 {
1591         struct b43_wl *wl = dev->wl;
1592         u32 cmd, beacon0_valid, beacon1_valid;
1593
1594         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1595             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1596                 return;
1597
1598         /* This is the bottom half of the asynchronous beacon update. */
1599
1600         /* Ignore interrupt in the future. */
1601         dev->irq_mask &= ~B43_IRQ_BEACON;
1602
1603         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1604         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1605         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1606
1607         /* Schedule interrupt manually, if busy. */
1608         if (beacon0_valid && beacon1_valid) {
1609                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1610                 dev->irq_mask |= B43_IRQ_BEACON;
1611                 return;
1612         }
1613
1614         if (unlikely(wl->beacon_templates_virgin)) {
1615                 /* We never uploaded a beacon before.
1616                  * Upload both templates now, but only mark one valid. */
1617                 wl->beacon_templates_virgin = 0;
1618                 b43_upload_beacon0(dev);
1619                 b43_upload_beacon1(dev);
1620                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1621                 cmd |= B43_MACCMD_BEACON0_VALID;
1622                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1623         } else {
1624                 if (!beacon0_valid) {
1625                         b43_upload_beacon0(dev);
1626                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1627                         cmd |= B43_MACCMD_BEACON0_VALID;
1628                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1629                 } else if (!beacon1_valid) {
1630                         b43_upload_beacon1(dev);
1631                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1632                         cmd |= B43_MACCMD_BEACON1_VALID;
1633                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1634                 }
1635         }
1636 }
1637
1638 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1639 {
1640         u32 old_irq_mask = dev->irq_mask;
1641
1642         /* update beacon right away or defer to irq */
1643         handle_irq_beacon(dev);
1644         if (old_irq_mask != dev->irq_mask) {
1645                 /* The handler updated the IRQ mask. */
1646                 B43_WARN_ON(!dev->irq_mask);
1647                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1648                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1649                 } else {
1650                         /* Device interrupts are currently disabled. That means
1651                          * we just ran the hardirq handler and scheduled the
1652                          * IRQ thread. The thread will write the IRQ mask when
1653                          * it finished, so there's nothing to do here. Writing
1654                          * the mask _here_ would incorrectly re-enable IRQs. */
1655                 }
1656         }
1657 }
1658
1659 static void b43_beacon_update_trigger_work(struct work_struct *work)
1660 {
1661         struct b43_wl *wl = container_of(work, struct b43_wl,
1662                                          beacon_update_trigger);
1663         struct b43_wldev *dev;
1664
1665         mutex_lock(&wl->mutex);
1666         dev = wl->current_dev;
1667         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1668                 if (b43_bus_host_is_sdio(dev->dev)) {
1669                         /* wl->mutex is enough. */
1670                         b43_do_beacon_update_trigger_work(dev);
1671                         mmiowb();
1672                 } else {
1673                         spin_lock_irq(&wl->hardirq_lock);
1674                         b43_do_beacon_update_trigger_work(dev);
1675                         mmiowb();
1676                         spin_unlock_irq(&wl->hardirq_lock);
1677                 }
1678         }
1679         mutex_unlock(&wl->mutex);
1680 }
1681
1682 /* Asynchronously update the packet templates in template RAM.
1683  * Locking: Requires wl->mutex to be locked. */
1684 static void b43_update_templates(struct b43_wl *wl)
1685 {
1686         struct sk_buff *beacon;
1687
1688         /* This is the top half of the ansynchronous beacon update.
1689          * The bottom half is the beacon IRQ.
1690          * Beacon update must be asynchronous to avoid sending an
1691          * invalid beacon. This can happen for example, if the firmware
1692          * transmits a beacon while we are updating it. */
1693
1694         /* We could modify the existing beacon and set the aid bit in
1695          * the TIM field, but that would probably require resizing and
1696          * moving of data within the beacon template.
1697          * Simply request a new beacon and let mac80211 do the hard work. */
1698         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1699         if (unlikely(!beacon))
1700                 return;
1701
1702         if (wl->current_beacon)
1703                 dev_kfree_skb_any(wl->current_beacon);
1704         wl->current_beacon = beacon;
1705         wl->beacon0_uploaded = 0;
1706         wl->beacon1_uploaded = 0;
1707         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1708 }
1709
1710 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1711 {
1712         b43_time_lock(dev);
1713         if (dev->dev->core_rev >= 3) {
1714                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1715                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1716         } else {
1717                 b43_write16(dev, 0x606, (beacon_int >> 6));
1718                 b43_write16(dev, 0x610, beacon_int);
1719         }
1720         b43_time_unlock(dev);
1721         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1722 }
1723
1724 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1725 {
1726         u16 reason;
1727
1728         /* Read the register that contains the reason code for the panic. */
1729         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1730         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1731
1732         switch (reason) {
1733         default:
1734                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1735                 /* fallthrough */
1736         case B43_FWPANIC_DIE:
1737                 /* Do not restart the controller or firmware.
1738                  * The device is nonfunctional from now on.
1739                  * Restarting would result in this panic to trigger again,
1740                  * so we avoid that recursion. */
1741                 break;
1742         case B43_FWPANIC_RESTART:
1743                 b43_controller_restart(dev, "Microcode panic");
1744                 break;
1745         }
1746 }
1747
1748 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1749 {
1750         unsigned int i, cnt;
1751         u16 reason, marker_id, marker_line;
1752         __le16 *buf;
1753
1754         /* The proprietary firmware doesn't have this IRQ. */
1755         if (!dev->fw.opensource)
1756                 return;
1757
1758         /* Read the register that contains the reason code for this IRQ. */
1759         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1760
1761         switch (reason) {
1762         case B43_DEBUGIRQ_PANIC:
1763                 b43_handle_firmware_panic(dev);
1764                 break;
1765         case B43_DEBUGIRQ_DUMP_SHM:
1766                 if (!B43_DEBUG)
1767                         break; /* Only with driver debugging enabled. */
1768                 buf = kmalloc(4096, GFP_ATOMIC);
1769                 if (!buf) {
1770                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1771                         goto out;
1772                 }
1773                 for (i = 0; i < 4096; i += 2) {
1774                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1775                         buf[i / 2] = cpu_to_le16(tmp);
1776                 }
1777                 b43info(dev->wl, "Shared memory dump:\n");
1778                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1779                                16, 2, buf, 4096, 1);
1780                 kfree(buf);
1781                 break;
1782         case B43_DEBUGIRQ_DUMP_REGS:
1783                 if (!B43_DEBUG)
1784                         break; /* Only with driver debugging enabled. */
1785                 b43info(dev->wl, "Microcode register dump:\n");
1786                 for (i = 0, cnt = 0; i < 64; i++) {
1787                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1788                         if (cnt == 0)
1789                                 printk(KERN_INFO);
1790                         printk("r%02u: 0x%04X  ", i, tmp);
1791                         cnt++;
1792                         if (cnt == 6) {
1793                                 printk("\n");
1794                                 cnt = 0;
1795                         }
1796                 }
1797                 printk("\n");
1798                 break;
1799         case B43_DEBUGIRQ_MARKER:
1800                 if (!B43_DEBUG)
1801                         break; /* Only with driver debugging enabled. */
1802                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1803                                            B43_MARKER_ID_REG);
1804                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1805                                              B43_MARKER_LINE_REG);
1806                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1807                         "at line number %u\n",
1808                         marker_id, marker_line);
1809                 break;
1810         default:
1811                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1812                        reason);
1813         }
1814 out:
1815         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1816         b43_shm_write16(dev, B43_SHM_SCRATCH,
1817                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1818 }
1819
1820 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1821 {
1822         u32 reason;
1823         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1824         u32 merged_dma_reason = 0;
1825         int i;
1826
1827         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1828                 return;
1829
1830         reason = dev->irq_reason;
1831         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1832                 dma_reason[i] = dev->dma_reason[i];
1833                 merged_dma_reason |= dma_reason[i];
1834         }
1835
1836         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1837                 b43err(dev->wl, "MAC transmission error\n");
1838
1839         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1840                 b43err(dev->wl, "PHY transmission error\n");
1841                 rmb();
1842                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1843                         atomic_set(&dev->phy.txerr_cnt,
1844                                    B43_PHY_TX_BADNESS_LIMIT);
1845                         b43err(dev->wl, "Too many PHY TX errors, "
1846                                         "restarting the controller\n");
1847                         b43_controller_restart(dev, "PHY TX errors");
1848                 }
1849         }
1850
1851         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1852                                           B43_DMAIRQ_NONFATALMASK))) {
1853                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1854                         b43err(dev->wl, "Fatal DMA error: "
1855                                "0x%08X, 0x%08X, 0x%08X, "
1856                                "0x%08X, 0x%08X, 0x%08X\n",
1857                                dma_reason[0], dma_reason[1],
1858                                dma_reason[2], dma_reason[3],
1859                                dma_reason[4], dma_reason[5]);
1860                         b43err(dev->wl, "This device does not support DMA "
1861                                "on your system. It will now be switched to PIO.\n");
1862                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1863                         dev->use_pio = 1;
1864                         b43_controller_restart(dev, "DMA error");
1865                         return;
1866                 }
1867                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1868                         b43err(dev->wl, "DMA error: "
1869                                "0x%08X, 0x%08X, 0x%08X, "
1870                                "0x%08X, 0x%08X, 0x%08X\n",
1871                                dma_reason[0], dma_reason[1],
1872                                dma_reason[2], dma_reason[3],
1873                                dma_reason[4], dma_reason[5]);
1874                 }
1875         }
1876
1877         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1878                 handle_irq_ucode_debug(dev);
1879         if (reason & B43_IRQ_TBTT_INDI)
1880                 handle_irq_tbtt_indication(dev);
1881         if (reason & B43_IRQ_ATIM_END)
1882                 handle_irq_atim_end(dev);
1883         if (reason & B43_IRQ_BEACON)
1884                 handle_irq_beacon(dev);
1885         if (reason & B43_IRQ_PMQ)
1886                 handle_irq_pmq(dev);
1887         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1888                 ;/* TODO */
1889         if (reason & B43_IRQ_NOISESAMPLE_OK)
1890                 handle_irq_noise(dev);
1891
1892         /* Check the DMA reason registers for received data. */
1893         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1894                 if (b43_using_pio_transfers(dev))
1895                         b43_pio_rx(dev->pio.rx_queue);
1896                 else
1897                         b43_dma_rx(dev->dma.rx_ring);
1898         }
1899         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1900         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1901         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1902         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1903         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1904
1905         if (reason & B43_IRQ_TX_OK)
1906                 handle_irq_transmit_status(dev);
1907
1908         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1909         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1910
1911 #if B43_DEBUG
1912         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1913                 dev->irq_count++;
1914                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1915                         if (reason & (1 << i))
1916                                 dev->irq_bit_count[i]++;
1917                 }
1918         }
1919 #endif
1920 }
1921
1922 /* Interrupt thread handler. Handles device interrupts in thread context. */
1923 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1924 {
1925         struct b43_wldev *dev = dev_id;
1926
1927         mutex_lock(&dev->wl->mutex);
1928         b43_do_interrupt_thread(dev);
1929         mmiowb();
1930         mutex_unlock(&dev->wl->mutex);
1931
1932         return IRQ_HANDLED;
1933 }
1934
1935 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1936 {
1937         u32 reason;
1938
1939         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1940          * On SDIO, this runs under wl->mutex. */
1941
1942         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1943         if (reason == 0xffffffff)       /* shared IRQ */
1944                 return IRQ_NONE;
1945         reason &= dev->irq_mask;
1946         if (!reason)
1947                 return IRQ_HANDLED;
1948
1949         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1950             & 0x0001DC00;
1951         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1952             & 0x0000DC00;
1953         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1954             & 0x0000DC00;
1955         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1956             & 0x0001DC00;
1957         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1958             & 0x0000DC00;
1959 /* Unused ring
1960         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1961             & 0x0000DC00;
1962 */
1963
1964         /* ACK the interrupt. */
1965         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1966         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1967         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1968         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1969         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1970         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1971 /* Unused ring
1972         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1973 */
1974
1975         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1976         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1977         /* Save the reason bitmasks for the IRQ thread handler. */
1978         dev->irq_reason = reason;
1979
1980         return IRQ_WAKE_THREAD;
1981 }
1982
1983 /* Interrupt handler top-half. This runs with interrupts disabled. */
1984 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1985 {
1986         struct b43_wldev *dev = dev_id;
1987         irqreturn_t ret;
1988
1989         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1990                 return IRQ_NONE;
1991
1992         spin_lock(&dev->wl->hardirq_lock);
1993         ret = b43_do_interrupt(dev);
1994         mmiowb();
1995         spin_unlock(&dev->wl->hardirq_lock);
1996
1997         return ret;
1998 }
1999
2000 /* SDIO interrupt handler. This runs in process context. */
2001 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2002 {
2003         struct b43_wl *wl = dev->wl;
2004         irqreturn_t ret;
2005
2006         mutex_lock(&wl->mutex);
2007
2008         ret = b43_do_interrupt(dev);
2009         if (ret == IRQ_WAKE_THREAD)
2010                 b43_do_interrupt_thread(dev);
2011
2012         mutex_unlock(&wl->mutex);
2013 }
2014
2015 void b43_do_release_fw(struct b43_firmware_file *fw)
2016 {
2017         release_firmware(fw->data);
2018         fw->data = NULL;
2019         fw->filename = NULL;
2020 }
2021
2022 static void b43_release_firmware(struct b43_wldev *dev)
2023 {
2024         b43_do_release_fw(&dev->fw.ucode);
2025         b43_do_release_fw(&dev->fw.pcm);
2026         b43_do_release_fw(&dev->fw.initvals);
2027         b43_do_release_fw(&dev->fw.initvals_band);
2028 }
2029
2030 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2031 {
2032         const char text[] =
2033                 "You must go to " \
2034                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2035                 "and download the correct firmware for this driver version. " \
2036                 "Please carefully read all instructions on this website.\n";
2037
2038         if (error)
2039                 b43err(wl, text);
2040         else
2041                 b43warn(wl, text);
2042 }
2043
2044 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2045                       const char *name,
2046                       struct b43_firmware_file *fw)
2047 {
2048         const struct firmware *blob;
2049         struct b43_fw_header *hdr;
2050         u32 size;
2051         int err;
2052
2053         if (!name) {
2054                 /* Don't fetch anything. Free possibly cached firmware. */
2055                 /* FIXME: We should probably keep it anyway, to save some headache
2056                  * on suspend/resume with multiband devices. */
2057                 b43_do_release_fw(fw);
2058                 return 0;
2059         }
2060         if (fw->filename) {
2061                 if ((fw->type == ctx->req_type) &&
2062                     (strcmp(fw->filename, name) == 0))
2063                         return 0; /* Already have this fw. */
2064                 /* Free the cached firmware first. */
2065                 /* FIXME: We should probably do this later after we successfully
2066                  * got the new fw. This could reduce headache with multiband devices.
2067                  * We could also redesign this to cache the firmware for all possible
2068                  * bands all the time. */
2069                 b43_do_release_fw(fw);
2070         }
2071
2072         switch (ctx->req_type) {
2073         case B43_FWTYPE_PROPRIETARY:
2074                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2075                          "b43%s/%s.fw",
2076                          modparam_fwpostfix, name);
2077                 break;
2078         case B43_FWTYPE_OPENSOURCE:
2079                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2080                          "b43-open%s/%s.fw",
2081                          modparam_fwpostfix, name);
2082                 break;
2083         default:
2084                 B43_WARN_ON(1);
2085                 return -ENOSYS;
2086         }
2087         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2088         if (err == -ENOENT) {
2089                 snprintf(ctx->errors[ctx->req_type],
2090                          sizeof(ctx->errors[ctx->req_type]),
2091                          "Firmware file \"%s\" not found\n", ctx->fwname);
2092                 return err;
2093         } else if (err) {
2094                 snprintf(ctx->errors[ctx->req_type],
2095                          sizeof(ctx->errors[ctx->req_type]),
2096                          "Firmware file \"%s\" request failed (err=%d)\n",
2097                          ctx->fwname, err);
2098                 return err;
2099         }
2100         if (blob->size < sizeof(struct b43_fw_header))
2101                 goto err_format;
2102         hdr = (struct b43_fw_header *)(blob->data);
2103         switch (hdr->type) {
2104         case B43_FW_TYPE_UCODE:
2105         case B43_FW_TYPE_PCM:
2106                 size = be32_to_cpu(hdr->size);
2107                 if (size != blob->size - sizeof(struct b43_fw_header))
2108                         goto err_format;
2109                 /* fallthrough */
2110         case B43_FW_TYPE_IV:
2111                 if (hdr->ver != 1)
2112                         goto err_format;
2113                 break;
2114         default:
2115                 goto err_format;
2116         }
2117
2118         fw->data = blob;
2119         fw->filename = name;
2120         fw->type = ctx->req_type;
2121
2122         return 0;
2123
2124 err_format:
2125         snprintf(ctx->errors[ctx->req_type],
2126                  sizeof(ctx->errors[ctx->req_type]),
2127                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2128         release_firmware(blob);
2129
2130         return -EPROTO;
2131 }
2132
2133 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2134 {
2135         struct b43_wldev *dev = ctx->dev;
2136         struct b43_firmware *fw = &ctx->dev->fw;
2137         const u8 rev = ctx->dev->dev->core_rev;
2138         const char *filename;
2139         u32 tmshigh;
2140         int err;
2141
2142         /* Get microcode */
2143         if ((rev >= 5) && (rev <= 10))
2144                 filename = "ucode5";
2145         else if ((rev >= 11) && (rev <= 12))
2146                 filename = "ucode11";
2147         else if (rev == 13)
2148                 filename = "ucode13";
2149         else if (rev == 14)
2150                 filename = "ucode14";
2151         else if (rev == 15)
2152                 filename = "ucode15";
2153         else if ((rev >= 16) && (rev <= 20))
2154                 filename = "ucode16_mimo";
2155         else
2156                 goto err_no_ucode;
2157         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2158         if (err)
2159                 goto err_load;
2160
2161         /* Get PCM code */
2162         if ((rev >= 5) && (rev <= 10))
2163                 filename = "pcm5";
2164         else if (rev >= 11)
2165                 filename = NULL;
2166         else
2167                 goto err_no_pcm;
2168         fw->pcm_request_failed = 0;
2169         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2170         if (err == -ENOENT) {
2171                 /* We did not find a PCM file? Not fatal, but
2172                  * core rev <= 10 must do without hwcrypto then. */
2173                 fw->pcm_request_failed = 1;
2174         } else if (err)
2175                 goto err_load;
2176
2177         /* Get initvals */
2178         switch (dev->phy.type) {
2179         case B43_PHYTYPE_A:
2180                 if ((rev >= 5) && (rev <= 10)) {
2181                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2182                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2183                                 filename = "a0g1initvals5";
2184                         else
2185                                 filename = "a0g0initvals5";
2186                 } else
2187                         goto err_no_initvals;
2188                 break;
2189         case B43_PHYTYPE_G:
2190                 if ((rev >= 5) && (rev <= 10))
2191                         filename = "b0g0initvals5";
2192                 else if (rev >= 13)
2193                         filename = "b0g0initvals13";
2194                 else
2195                         goto err_no_initvals;
2196                 break;
2197         case B43_PHYTYPE_N:
2198                 if (rev >= 16)
2199                         filename = "n0initvals16";
2200                 else if ((rev >= 11) && (rev <= 12))
2201                         filename = "n0initvals11";
2202                 else
2203                         goto err_no_initvals;
2204                 break;
2205         case B43_PHYTYPE_LP:
2206                 if (rev == 13)
2207                         filename = "lp0initvals13";
2208                 else if (rev == 14)
2209                         filename = "lp0initvals14";
2210                 else if (rev >= 15)
2211                         filename = "lp0initvals15";
2212                 else
2213                         goto err_no_initvals;
2214                 break;
2215         default:
2216                 goto err_no_initvals;
2217         }
2218         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2219         if (err)
2220                 goto err_load;
2221
2222         /* Get bandswitch initvals */
2223         switch (dev->phy.type) {
2224         case B43_PHYTYPE_A:
2225                 if ((rev >= 5) && (rev <= 10)) {
2226                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2227                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2228                                 filename = "a0g1bsinitvals5";
2229                         else
2230                                 filename = "a0g0bsinitvals5";
2231                 } else if (rev >= 11)
2232                         filename = NULL;
2233                 else
2234                         goto err_no_initvals;
2235                 break;
2236         case B43_PHYTYPE_G:
2237                 if ((rev >= 5) && (rev <= 10))
2238                         filename = "b0g0bsinitvals5";
2239                 else if (rev >= 11)
2240                         filename = NULL;
2241                 else
2242                         goto err_no_initvals;
2243                 break;
2244         case B43_PHYTYPE_N:
2245                 if (rev >= 16)
2246                         filename = "n0bsinitvals16";
2247                 else if ((rev >= 11) && (rev <= 12))
2248                         filename = "n0bsinitvals11";
2249                 else
2250                         goto err_no_initvals;
2251                 break;
2252         case B43_PHYTYPE_LP:
2253                 if (rev == 13)
2254                         filename = "lp0bsinitvals13";
2255                 else if (rev == 14)
2256                         filename = "lp0bsinitvals14";
2257                 else if (rev >= 15)
2258                         filename = "lp0bsinitvals15";
2259                 else
2260                         goto err_no_initvals;
2261                 break;
2262         default:
2263                 goto err_no_initvals;
2264         }
2265         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2266         if (err)
2267                 goto err_load;
2268
2269         return 0;
2270
2271 err_no_ucode:
2272         err = ctx->fatal_failure = -EOPNOTSUPP;
2273         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2274                "is required for your device (wl-core rev %u)\n", rev);
2275         goto error;
2276
2277 err_no_pcm:
2278         err = ctx->fatal_failure = -EOPNOTSUPP;
2279         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2280                "is required for your device (wl-core rev %u)\n", rev);
2281         goto error;
2282
2283 err_no_initvals:
2284         err = ctx->fatal_failure = -EOPNOTSUPP;
2285         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2286                "is required for your device (wl-core rev %u)\n", rev);
2287         goto error;
2288
2289 err_load:
2290         /* We failed to load this firmware image. The error message
2291          * already is in ctx->errors. Return and let our caller decide
2292          * what to do. */
2293         goto error;
2294
2295 error:
2296         b43_release_firmware(dev);
2297         return err;
2298 }
2299
2300 static int b43_request_firmware(struct b43_wldev *dev)
2301 {
2302         struct b43_request_fw_context *ctx;
2303         unsigned int i;
2304         int err;
2305         const char *errmsg;
2306
2307         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2308         if (!ctx)
2309                 return -ENOMEM;
2310         ctx->dev = dev;
2311
2312         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2313         err = b43_try_request_fw(ctx);
2314         if (!err)
2315                 goto out; /* Successfully loaded it. */
2316         err = ctx->fatal_failure;
2317         if (err)
2318                 goto out;
2319
2320         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2321         err = b43_try_request_fw(ctx);
2322         if (!err)
2323                 goto out; /* Successfully loaded it. */
2324         err = ctx->fatal_failure;
2325         if (err)
2326                 goto out;
2327
2328         /* Could not find a usable firmware. Print the errors. */
2329         for (i = 0; i < B43_NR_FWTYPES; i++) {
2330                 errmsg = ctx->errors[i];
2331                 if (strlen(errmsg))
2332                         b43err(dev->wl, errmsg);
2333         }
2334         b43_print_fw_helptext(dev->wl, 1);
2335         err = -ENOENT;
2336
2337 out:
2338         kfree(ctx);
2339         return err;
2340 }
2341
2342 static int b43_upload_microcode(struct b43_wldev *dev)
2343 {
2344         struct wiphy *wiphy = dev->wl->hw->wiphy;
2345         const size_t hdr_len = sizeof(struct b43_fw_header);
2346         const __be32 *data;
2347         unsigned int i, len;
2348         u16 fwrev, fwpatch, fwdate, fwtime;
2349         u32 tmp, macctl;
2350         int err = 0;
2351
2352         /* Jump the microcode PSM to offset 0 */
2353         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2354         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2355         macctl |= B43_MACCTL_PSM_JMP0;
2356         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2357         /* Zero out all microcode PSM registers and shared memory. */
2358         for (i = 0; i < 64; i++)
2359                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2360         for (i = 0; i < 4096; i += 2)
2361                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2362
2363         /* Upload Microcode. */
2364         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2365         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2366         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2367         for (i = 0; i < len; i++) {
2368                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2369                 udelay(10);
2370         }
2371
2372         if (dev->fw.pcm.data) {
2373                 /* Upload PCM data. */
2374                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2375                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2376                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2377                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2378                 /* No need for autoinc bit in SHM_HW */
2379                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2380                 for (i = 0; i < len; i++) {
2381                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2382                         udelay(10);
2383                 }
2384         }
2385
2386         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2387
2388         /* Start the microcode PSM */
2389         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2390         macctl &= ~B43_MACCTL_PSM_JMP0;
2391         macctl |= B43_MACCTL_PSM_RUN;
2392         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2393
2394         /* Wait for the microcode to load and respond */
2395         i = 0;
2396         while (1) {
2397                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2398                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2399                         break;
2400                 i++;
2401                 if (i >= 20) {
2402                         b43err(dev->wl, "Microcode not responding\n");
2403                         b43_print_fw_helptext(dev->wl, 1);
2404                         err = -ENODEV;
2405                         goto error;
2406                 }
2407                 msleep(50);
2408         }
2409         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2410
2411         /* Get and check the revisions. */
2412         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2413         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2414         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2415         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2416
2417         if (fwrev <= 0x128) {
2418                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2419                        "binary drivers older than version 4.x is unsupported. "
2420                        "You must upgrade your firmware files.\n");
2421                 b43_print_fw_helptext(dev->wl, 1);
2422                 err = -EOPNOTSUPP;
2423                 goto error;
2424         }
2425         dev->fw.rev = fwrev;
2426         dev->fw.patch = fwpatch;
2427         dev->fw.opensource = (fwdate == 0xFFFF);
2428
2429         /* Default to use-all-queues. */
2430         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2431         dev->qos_enabled = !!modparam_qos;
2432         /* Default to firmware/hardware crypto acceleration. */
2433         dev->hwcrypto_enabled = 1;
2434
2435         if (dev->fw.opensource) {
2436                 u16 fwcapa;
2437
2438                 /* Patchlevel info is encoded in the "time" field. */
2439                 dev->fw.patch = fwtime;
2440                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2441                         dev->fw.rev, dev->fw.patch);
2442
2443                 fwcapa = b43_fwcapa_read(dev);
2444                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2445                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2446                         /* Disable hardware crypto and fall back to software crypto. */
2447                         dev->hwcrypto_enabled = 0;
2448                 }
2449                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2450                         b43info(dev->wl, "QoS not supported by firmware\n");
2451                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2452                          * ieee80211_unregister to make sure the networking core can
2453                          * properly free possible resources. */
2454                         dev->wl->hw->queues = 1;
2455                         dev->qos_enabled = 0;
2456                 }
2457         } else {
2458                 b43info(dev->wl, "Loading firmware version %u.%u "
2459                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2460                         fwrev, fwpatch,
2461                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2462                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2463                 if (dev->fw.pcm_request_failed) {
2464                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2465                                 "Hardware accelerated cryptography is disabled.\n");
2466                         b43_print_fw_helptext(dev->wl, 0);
2467                 }
2468         }
2469
2470         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2471                         dev->fw.rev, dev->fw.patch);
2472         wiphy->hw_version = dev->dev->core_id;
2473
2474         if (b43_is_old_txhdr_format(dev)) {
2475                 /* We're over the deadline, but we keep support for old fw
2476                  * until it turns out to be in major conflict with something new. */
2477                 b43warn(dev->wl, "You are using an old firmware image. "
2478                         "Support for old firmware will be removed soon "
2479                         "(official deadline was July 2008).\n");
2480                 b43_print_fw_helptext(dev->wl, 0);
2481         }
2482
2483         return 0;
2484
2485 error:
2486         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2487         macctl &= ~B43_MACCTL_PSM_RUN;
2488         macctl |= B43_MACCTL_PSM_JMP0;
2489         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2490
2491         return err;
2492 }
2493
2494 static int b43_write_initvals(struct b43_wldev *dev,
2495                               const struct b43_iv *ivals,
2496                               size_t count,
2497                               size_t array_size)
2498 {
2499         const struct b43_iv *iv;
2500         u16 offset;
2501         size_t i;
2502         bool bit32;
2503
2504         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2505         iv = ivals;
2506         for (i = 0; i < count; i++) {
2507                 if (array_size < sizeof(iv->offset_size))
2508                         goto err_format;
2509                 array_size -= sizeof(iv->offset_size);
2510                 offset = be16_to_cpu(iv->offset_size);
2511                 bit32 = !!(offset & B43_IV_32BIT);
2512                 offset &= B43_IV_OFFSET_MASK;
2513                 if (offset >= 0x1000)
2514                         goto err_format;
2515                 if (bit32) {
2516                         u32 value;
2517
2518                         if (array_size < sizeof(iv->data.d32))
2519                                 goto err_format;
2520                         array_size -= sizeof(iv->data.d32);
2521
2522                         value = get_unaligned_be32(&iv->data.d32);
2523                         b43_write32(dev, offset, value);
2524
2525                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2526                                                         sizeof(__be16) +
2527                                                         sizeof(__be32));
2528                 } else {
2529                         u16 value;
2530
2531                         if (array_size < sizeof(iv->data.d16))
2532                                 goto err_format;
2533                         array_size -= sizeof(iv->data.d16);
2534
2535                         value = be16_to_cpu(iv->data.d16);
2536                         b43_write16(dev, offset, value);
2537
2538                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2539                                                         sizeof(__be16) +
2540                                                         sizeof(__be16));
2541                 }
2542         }
2543         if (array_size)
2544                 goto err_format;
2545
2546         return 0;
2547
2548 err_format:
2549         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2550         b43_print_fw_helptext(dev->wl, 1);
2551
2552         return -EPROTO;
2553 }
2554
2555 static int b43_upload_initvals(struct b43_wldev *dev)
2556 {
2557         const size_t hdr_len = sizeof(struct b43_fw_header);
2558         const struct b43_fw_header *hdr;
2559         struct b43_firmware *fw = &dev->fw;
2560         const struct b43_iv *ivals;
2561         size_t count;
2562         int err;
2563
2564         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2565         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2566         count = be32_to_cpu(hdr->size);
2567         err = b43_write_initvals(dev, ivals, count,
2568                                  fw->initvals.data->size - hdr_len);
2569         if (err)
2570                 goto out;
2571         if (fw->initvals_band.data) {
2572                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2573                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2574                 count = be32_to_cpu(hdr->size);
2575                 err = b43_write_initvals(dev, ivals, count,
2576                                          fw->initvals_band.data->size - hdr_len);
2577                 if (err)
2578                         goto out;
2579         }
2580 out:
2581
2582         return err;
2583 }
2584
2585 /* Initialize the GPIOs
2586  * http://bcm-specs.sipsolutions.net/GPIO
2587  */
2588 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2589 {
2590         struct ssb_bus *bus = dev->dev->sdev->bus;
2591
2592 #ifdef CONFIG_SSB_DRIVER_PCICORE
2593         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2594 #else
2595         return bus->chipco.dev;
2596 #endif
2597 }
2598
2599 static int b43_gpio_init(struct b43_wldev *dev)
2600 {
2601         struct ssb_device *gpiodev;
2602         u32 mask, set;
2603
2604         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2605                     & ~B43_MACCTL_GPOUTSMSK);
2606
2607         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2608                     | 0x000F);
2609
2610         mask = 0x0000001F;
2611         set = 0x0000000F;
2612         if (dev->dev->chip_id == 0x4301) {
2613                 mask |= 0x0060;
2614                 set |= 0x0060;
2615         }
2616         if (0 /* FIXME: conditional unknown */ ) {
2617                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2618                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2619                             | 0x0100);
2620                 mask |= 0x0180;
2621                 set |= 0x0180;
2622         }
2623         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2624                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2625                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2626                             | 0x0200);
2627                 mask |= 0x0200;
2628                 set |= 0x0200;
2629         }
2630         if (dev->dev->core_rev >= 2)
2631                 mask |= 0x0010; /* FIXME: This is redundant. */
2632
2633         switch (dev->dev->bus_type) {
2634 #ifdef CONFIG_B43_SSB
2635         case B43_BUS_SSB:
2636                 gpiodev = b43_ssb_gpio_dev(dev);
2637                 if (gpiodev)
2638                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2639                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2640                                     & mask) | set);
2641                 break;
2642 #endif
2643         }
2644
2645         return 0;
2646 }
2647
2648 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2649 static void b43_gpio_cleanup(struct b43_wldev *dev)
2650 {
2651         struct ssb_device *gpiodev;
2652
2653         switch (dev->dev->bus_type) {
2654 #ifdef CONFIG_B43_SSB
2655         case B43_BUS_SSB:
2656                 gpiodev = b43_ssb_gpio_dev(dev);
2657                 if (gpiodev)
2658                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2659                 break;
2660 #endif
2661         }
2662 }
2663
2664 /* http://bcm-specs.sipsolutions.net/EnableMac */
2665 void b43_mac_enable(struct b43_wldev *dev)
2666 {
2667         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2668                 u16 fwstate;
2669
2670                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2671                                          B43_SHM_SH_UCODESTAT);
2672                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2673                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2674                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2675                                "should be suspended, but current state is %u\n",
2676                                fwstate);
2677                 }
2678         }
2679
2680         dev->mac_suspended--;
2681         B43_WARN_ON(dev->mac_suspended < 0);
2682         if (dev->mac_suspended == 0) {
2683                 b43_write32(dev, B43_MMIO_MACCTL,
2684                             b43_read32(dev, B43_MMIO_MACCTL)
2685                             | B43_MACCTL_ENABLED);
2686                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2687                             B43_IRQ_MAC_SUSPENDED);
2688                 /* Commit writes */
2689                 b43_read32(dev, B43_MMIO_MACCTL);
2690                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2691                 b43_power_saving_ctl_bits(dev, 0);
2692         }
2693 }
2694
2695 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2696 void b43_mac_suspend(struct b43_wldev *dev)
2697 {
2698         int i;
2699         u32 tmp;
2700
2701         might_sleep();
2702         B43_WARN_ON(dev->mac_suspended < 0);
2703
2704         if (dev->mac_suspended == 0) {
2705                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2706                 b43_write32(dev, B43_MMIO_MACCTL,
2707                             b43_read32(dev, B43_MMIO_MACCTL)
2708                             & ~B43_MACCTL_ENABLED);
2709                 /* force pci to flush the write */
2710                 b43_read32(dev, B43_MMIO_MACCTL);
2711                 for (i = 35; i; i--) {
2712                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2713                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2714                                 goto out;
2715                         udelay(10);
2716                 }
2717                 /* Hm, it seems this will take some time. Use msleep(). */
2718                 for (i = 40; i; i--) {
2719                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2720                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2721                                 goto out;
2722                         msleep(1);
2723                 }
2724                 b43err(dev->wl, "MAC suspend failed\n");
2725         }
2726 out:
2727         dev->mac_suspended++;
2728 }
2729
2730 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2731 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2732 {
2733         u32 tmp;
2734
2735         switch (dev->dev->bus_type) {
2736 #ifdef CONFIG_B43_SSB
2737         case B43_BUS_SSB:
2738                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2739                 if (on)
2740                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2741                 else
2742                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2743                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2744                 break;
2745 #endif
2746         }
2747 }
2748
2749 static void b43_adjust_opmode(struct b43_wldev *dev)
2750 {
2751         struct b43_wl *wl = dev->wl;
2752         u32 ctl;
2753         u16 cfp_pretbtt;
2754
2755         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2756         /* Reset status to STA infrastructure mode. */
2757         ctl &= ~B43_MACCTL_AP;
2758         ctl &= ~B43_MACCTL_KEEP_CTL;
2759         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2760         ctl &= ~B43_MACCTL_KEEP_BAD;
2761         ctl &= ~B43_MACCTL_PROMISC;
2762         ctl &= ~B43_MACCTL_BEACPROMISC;
2763         ctl |= B43_MACCTL_INFRA;
2764
2765         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2766             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2767                 ctl |= B43_MACCTL_AP;
2768         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2769                 ctl &= ~B43_MACCTL_INFRA;
2770
2771         if (wl->filter_flags & FIF_CONTROL)
2772                 ctl |= B43_MACCTL_KEEP_CTL;
2773         if (wl->filter_flags & FIF_FCSFAIL)
2774                 ctl |= B43_MACCTL_KEEP_BAD;
2775         if (wl->filter_flags & FIF_PLCPFAIL)
2776                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2777         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2778                 ctl |= B43_MACCTL_PROMISC;
2779         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2780                 ctl |= B43_MACCTL_BEACPROMISC;
2781
2782         /* Workaround: On old hardware the HW-MAC-address-filter
2783          * doesn't work properly, so always run promisc in filter
2784          * it in software. */
2785         if (dev->dev->core_rev <= 4)
2786                 ctl |= B43_MACCTL_PROMISC;
2787
2788         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2789
2790         cfp_pretbtt = 2;
2791         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2792                 if (dev->dev->chip_id == 0x4306 &&
2793                     dev->dev->chip_rev == 3)
2794                         cfp_pretbtt = 100;
2795                 else
2796                         cfp_pretbtt = 50;
2797         }
2798         b43_write16(dev, 0x612, cfp_pretbtt);
2799
2800         /* FIXME: We don't currently implement the PMQ mechanism,
2801          *        so always disable it. If we want to implement PMQ,
2802          *        we need to enable it here (clear DISCPMQ) in AP mode.
2803          */
2804         if (0  /* ctl & B43_MACCTL_AP */) {
2805                 b43_write32(dev, B43_MMIO_MACCTL,
2806                             b43_read32(dev, B43_MMIO_MACCTL)
2807                             & ~B43_MACCTL_DISCPMQ);
2808         } else {
2809                 b43_write32(dev, B43_MMIO_MACCTL,
2810                             b43_read32(dev, B43_MMIO_MACCTL)
2811                             | B43_MACCTL_DISCPMQ);
2812         }
2813 }
2814
2815 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2816 {
2817         u16 offset;
2818
2819         if (is_ofdm) {
2820                 offset = 0x480;
2821                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2822         } else {
2823                 offset = 0x4C0;
2824                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2825         }
2826         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2827                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2828 }
2829
2830 static void b43_rate_memory_init(struct b43_wldev *dev)
2831 {
2832         switch (dev->phy.type) {
2833         case B43_PHYTYPE_A:
2834         case B43_PHYTYPE_G:
2835         case B43_PHYTYPE_N:
2836         case B43_PHYTYPE_LP:
2837                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2838                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2839                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2840                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2841                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2842                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2843                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2844                 if (dev->phy.type == B43_PHYTYPE_A)
2845                         break;
2846                 /* fallthrough */
2847         case B43_PHYTYPE_B:
2848                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2849                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2850                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2851                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2852                 break;
2853         default:
2854                 B43_WARN_ON(1);
2855         }
2856 }
2857
2858 /* Set the default values for the PHY TX Control Words. */
2859 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2860 {
2861         u16 ctl = 0;
2862
2863         ctl |= B43_TXH_PHY_ENC_CCK;
2864         ctl |= B43_TXH_PHY_ANT01AUTO;
2865         ctl |= B43_TXH_PHY_TXPWR;
2866
2867         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2868         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2869         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2870 }
2871
2872 /* Set the TX-Antenna for management frames sent by firmware. */
2873 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2874 {
2875         u16 ant;
2876         u16 tmp;
2877
2878         ant = b43_antenna_to_phyctl(antenna);
2879
2880         /* For ACK/CTS */
2881         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2882         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2883         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2884         /* For Probe Resposes */
2885         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2886         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2887         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2888 }
2889
2890 /* This is the opposite of b43_chip_init() */
2891 static void b43_chip_exit(struct b43_wldev *dev)
2892 {
2893         b43_phy_exit(dev);
2894         b43_gpio_cleanup(dev);
2895         /* firmware is released later */
2896 }
2897
2898 /* Initialize the chip
2899  * http://bcm-specs.sipsolutions.net/ChipInit
2900  */
2901 static int b43_chip_init(struct b43_wldev *dev)
2902 {
2903         struct b43_phy *phy = &dev->phy;
2904         int err;
2905         u32 macctl;
2906         u16 value16;
2907
2908         /* Initialize the MAC control */
2909         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2910         if (dev->phy.gmode)
2911                 macctl |= B43_MACCTL_GMODE;
2912         macctl |= B43_MACCTL_INFRA;
2913         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2914
2915         err = b43_request_firmware(dev);
2916         if (err)
2917                 goto out;
2918         err = b43_upload_microcode(dev);
2919         if (err)
2920                 goto out;       /* firmware is released later */
2921
2922         err = b43_gpio_init(dev);
2923         if (err)
2924                 goto out;       /* firmware is released later */
2925
2926         err = b43_upload_initvals(dev);
2927         if (err)
2928                 goto err_gpio_clean;
2929
2930         /* Turn the Analog on and initialize the PHY. */
2931         phy->ops->switch_analog(dev, 1);
2932         err = b43_phy_init(dev);
2933         if (err)
2934                 goto err_gpio_clean;
2935
2936         /* Disable Interference Mitigation. */
2937         if (phy->ops->interf_mitigation)
2938                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2939
2940         /* Select the antennae */
2941         if (phy->ops->set_rx_antenna)
2942                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2943         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2944
2945         if (phy->type == B43_PHYTYPE_B) {
2946                 value16 = b43_read16(dev, 0x005E);
2947                 value16 |= 0x0004;
2948                 b43_write16(dev, 0x005E, value16);
2949         }
2950         b43_write32(dev, 0x0100, 0x01000000);
2951         if (dev->dev->core_rev < 5)
2952                 b43_write32(dev, 0x010C, 0x01000000);
2953
2954         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2955                     & ~B43_MACCTL_INFRA);
2956         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2957                     | B43_MACCTL_INFRA);
2958
2959         /* Probe Response Timeout value */
2960         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2961         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2962
2963         /* Initially set the wireless operation mode. */
2964         b43_adjust_opmode(dev);
2965
2966         if (dev->dev->core_rev < 3) {
2967                 b43_write16(dev, 0x060E, 0x0000);
2968                 b43_write16(dev, 0x0610, 0x8000);
2969                 b43_write16(dev, 0x0604, 0x0000);
2970                 b43_write16(dev, 0x0606, 0x0200);
2971         } else {
2972                 b43_write32(dev, 0x0188, 0x80000000);
2973                 b43_write32(dev, 0x018C, 0x02000000);
2974         }
2975         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2976         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2977         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2978         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2979         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2980         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2981         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2982
2983         b43_mac_phy_clock_set(dev, true);
2984
2985         switch (dev->dev->bus_type) {
2986 #ifdef CONFIG_B43_SSB
2987         case B43_BUS_SSB:
2988                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2989                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
2990                 break;
2991 #endif
2992         }
2993
2994         err = 0;
2995         b43dbg(dev->wl, "Chip initialized\n");
2996 out:
2997         return err;
2998
2999 err_gpio_clean:
3000         b43_gpio_cleanup(dev);
3001         return err;
3002 }
3003
3004 static void b43_periodic_every60sec(struct b43_wldev *dev)
3005 {
3006         const struct b43_phy_operations *ops = dev->phy.ops;
3007
3008         if (ops->pwork_60sec)
3009                 ops->pwork_60sec(dev);
3010
3011         /* Force check the TX power emission now. */
3012         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3013 }
3014
3015 static void b43_periodic_every30sec(struct b43_wldev *dev)
3016 {
3017         /* Update device statistics. */
3018         b43_calculate_link_quality(dev);
3019 }
3020
3021 static void b43_periodic_every15sec(struct b43_wldev *dev)
3022 {
3023         struct b43_phy *phy = &dev->phy;
3024         u16 wdr;
3025
3026         if (dev->fw.opensource) {
3027                 /* Check if the firmware is still alive.
3028                  * It will reset the watchdog counter to 0 in its idle loop. */
3029                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3030                 if (unlikely(wdr)) {
3031                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3032                         b43_controller_restart(dev, "Firmware watchdog");
3033                         return;
3034                 } else {
3035                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3036                                         B43_WATCHDOG_REG, 1);
3037                 }
3038         }
3039
3040         if (phy->ops->pwork_15sec)
3041                 phy->ops->pwork_15sec(dev);
3042
3043         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3044         wmb();
3045
3046 #if B43_DEBUG
3047         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3048                 unsigned int i;
3049
3050                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3051                        dev->irq_count / 15,
3052                        dev->tx_count / 15,
3053                        dev->rx_count / 15);
3054                 dev->irq_count = 0;
3055                 dev->tx_count = 0;
3056                 dev->rx_count = 0;
3057                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3058                         if (dev->irq_bit_count[i]) {
3059                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3060                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3061                                 dev->irq_bit_count[i] = 0;
3062                         }
3063                 }
3064         }
3065 #endif
3066 }
3067
3068 static void do_periodic_work(struct b43_wldev *dev)
3069 {
3070         unsigned int state;
3071
3072         state = dev->periodic_state;
3073         if (state % 4 == 0)
3074                 b43_periodic_every60sec(dev);
3075         if (state % 2 == 0)
3076                 b43_periodic_every30sec(dev);
3077         b43_periodic_every15sec(dev);
3078 }
3079
3080 /* Periodic work locking policy:
3081  *      The whole periodic work handler is protected by
3082  *      wl->mutex. If another lock is needed somewhere in the
3083  *      pwork callchain, it's acquired in-place, where it's needed.
3084  */
3085 static void b43_periodic_work_handler(struct work_struct *work)
3086 {
3087         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3088                                              periodic_work.work);
3089         struct b43_wl *wl = dev->wl;
3090         unsigned long delay;
3091
3092         mutex_lock(&wl->mutex);
3093
3094         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3095                 goto out;
3096         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3097                 goto out_requeue;
3098
3099         do_periodic_work(dev);
3100
3101         dev->periodic_state++;
3102 out_requeue:
3103         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3104                 delay = msecs_to_jiffies(50);
3105         else
3106                 delay = round_jiffies_relative(HZ * 15);
3107         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3108 out:
3109         mutex_unlock(&wl->mutex);
3110 }
3111
3112 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3113 {
3114         struct delayed_work *work = &dev->periodic_work;
3115
3116         dev->periodic_state = 0;
3117         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3118         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3119 }
3120
3121 /* Check if communication with the device works correctly. */
3122 static int b43_validate_chipaccess(struct b43_wldev *dev)
3123 {
3124         u32 v, backup0, backup4;
3125
3126         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3127         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3128
3129         /* Check for read/write and endianness problems. */
3130         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3131         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3132                 goto error;
3133         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3134         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3135                 goto error;
3136
3137         /* Check if unaligned 32bit SHM_SHARED access works properly.
3138          * However, don't bail out on failure, because it's noncritical. */
3139         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3140         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3141         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3142         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3143         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3144                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3145         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3146         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3147             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3148             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3149             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3150                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3151
3152         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3153         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3154
3155         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3156                 /* The 32bit register shadows the two 16bit registers
3157                  * with update sideeffects. Validate this. */
3158                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3159                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3160                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3161                         goto error;
3162                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3163                         goto error;
3164         }
3165         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3166
3167         v = b43_read32(dev, B43_MMIO_MACCTL);
3168         v |= B43_MACCTL_GMODE;
3169         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3170                 goto error;
3171
3172         return 0;
3173 error:
3174         b43err(dev->wl, "Failed to validate the chipaccess\n");
3175         return -ENODEV;
3176 }
3177
3178 static void b43_security_init(struct b43_wldev *dev)
3179 {
3180         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3181         /* KTP is a word address, but we address SHM bytewise.
3182          * So multiply by two.
3183          */
3184         dev->ktp *= 2;
3185         /* Number of RCMTA address slots */
3186         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3187         /* Clear the key memory. */
3188         b43_clear_keys(dev);
3189 }
3190
3191 #ifdef CONFIG_B43_HWRNG
3192 static int b43_rng_read(struct hwrng *rng, u32 *data)
3193 {
3194         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3195         struct b43_wldev *dev;
3196         int count = -ENODEV;
3197
3198         mutex_lock(&wl->mutex);
3199         dev = wl->current_dev;
3200         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3201                 *data = b43_read16(dev, B43_MMIO_RNG);
3202                 count = sizeof(u16);
3203         }
3204         mutex_unlock(&wl->mutex);
3205
3206         return count;
3207 }
3208 #endif /* CONFIG_B43_HWRNG */
3209
3210 static void b43_rng_exit(struct b43_wl *wl)
3211 {
3212 #ifdef CONFIG_B43_HWRNG
3213         if (wl->rng_initialized)
3214                 hwrng_unregister(&wl->rng);
3215 #endif /* CONFIG_B43_HWRNG */
3216 }
3217
3218 static int b43_rng_init(struct b43_wl *wl)
3219 {
3220         int err = 0;
3221
3222 #ifdef CONFIG_B43_HWRNG
3223         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3224                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3225         wl->rng.name = wl->rng_name;
3226         wl->rng.data_read = b43_rng_read;
3227         wl->rng.priv = (unsigned long)wl;
3228         wl->rng_initialized = 1;
3229         err = hwrng_register(&wl->rng);
3230         if (err) {
3231                 wl->rng_initialized = 0;
3232                 b43err(wl, "Failed to register the random "
3233                        "number generator (%d)\n", err);
3234         }
3235 #endif /* CONFIG_B43_HWRNG */
3236
3237         return err;
3238 }
3239
3240 static void b43_tx_work(struct work_struct *work)
3241 {
3242         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3243         struct b43_wldev *dev;
3244         struct sk_buff *skb;
3245         int err = 0;
3246
3247         mutex_lock(&wl->mutex);
3248         dev = wl->current_dev;
3249         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3250                 mutex_unlock(&wl->mutex);
3251                 return;
3252         }
3253
3254         while (skb_queue_len(&wl->tx_queue)) {
3255                 skb = skb_dequeue(&wl->tx_queue);
3256
3257                 if (b43_using_pio_transfers(dev))
3258                         err = b43_pio_tx(dev, skb);
3259                 else
3260                         err = b43_dma_tx(dev, skb);
3261                 if (unlikely(err))
3262                         dev_kfree_skb(skb); /* Drop it */
3263         }
3264
3265 #if B43_DEBUG
3266         dev->tx_count++;
3267 #endif
3268         mutex_unlock(&wl->mutex);
3269 }
3270
3271 static void b43_op_tx(struct ieee80211_hw *hw,
3272                      struct sk_buff *skb)
3273 {
3274         struct b43_wl *wl = hw_to_b43_wl(hw);
3275
3276         if (unlikely(skb->len < 2 + 2 + 6)) {
3277                 /* Too short, this can't be a valid frame. */
3278                 dev_kfree_skb_any(skb);
3279                 return;
3280         }
3281         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3282
3283         skb_queue_tail(&wl->tx_queue, skb);
3284         ieee80211_queue_work(wl->hw, &wl->tx_work);
3285 }
3286
3287 static void b43_qos_params_upload(struct b43_wldev *dev,
3288                                   const struct ieee80211_tx_queue_params *p,
3289                                   u16 shm_offset)
3290 {
3291         u16 params[B43_NR_QOSPARAMS];
3292         int bslots, tmp;
3293         unsigned int i;
3294
3295         if (!dev->qos_enabled)
3296                 return;
3297
3298         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3299
3300         memset(&params, 0, sizeof(params));
3301
3302         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3303         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3304         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3305         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3306         params[B43_QOSPARAM_AIFS] = p->aifs;
3307         params[B43_QOSPARAM_BSLOTS] = bslots;
3308         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3309
3310         for (i = 0; i < ARRAY_SIZE(params); i++) {
3311                 if (i == B43_QOSPARAM_STATUS) {
3312                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3313                                              shm_offset + (i * 2));
3314                         /* Mark the parameters as updated. */
3315                         tmp |= 0x100;
3316                         b43_shm_write16(dev, B43_SHM_SHARED,
3317                                         shm_offset + (i * 2),
3318                                         tmp);
3319                 } else {
3320                         b43_shm_write16(dev, B43_SHM_SHARED,
3321                                         shm_offset + (i * 2),
3322                                         params[i]);
3323                 }
3324         }
3325 }
3326
3327 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3328 static const u16 b43_qos_shm_offsets[] = {
3329         /* [mac80211-queue-nr] = SHM_OFFSET, */
3330         [0] = B43_QOS_VOICE,
3331         [1] = B43_QOS_VIDEO,
3332         [2] = B43_QOS_BESTEFFORT,
3333         [3] = B43_QOS_BACKGROUND,
3334 };
3335
3336 /* Update all QOS parameters in hardware. */
3337 static void b43_qos_upload_all(struct b43_wldev *dev)
3338 {
3339         struct b43_wl *wl = dev->wl;
3340         struct b43_qos_params *params;
3341         unsigned int i;
3342
3343         if (!dev->qos_enabled)
3344                 return;
3345
3346         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3347                      ARRAY_SIZE(wl->qos_params));
3348
3349         b43_mac_suspend(dev);
3350         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3351                 params = &(wl->qos_params[i]);
3352                 b43_qos_params_upload(dev, &(params->p),
3353                                       b43_qos_shm_offsets[i]);
3354         }
3355         b43_mac_enable(dev);
3356 }
3357
3358 static void b43_qos_clear(struct b43_wl *wl)
3359 {
3360         struct b43_qos_params *params;
3361         unsigned int i;
3362
3363         /* Initialize QoS parameters to sane defaults. */
3364
3365         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3366                      ARRAY_SIZE(wl->qos_params));
3367
3368         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3369                 params = &(wl->qos_params[i]);
3370
3371                 switch (b43_qos_shm_offsets[i]) {
3372                 case B43_QOS_VOICE:
3373                         params->p.txop = 0;
3374                         params->p.aifs = 2;
3375                         params->p.cw_min = 0x0001;
3376                         params->p.cw_max = 0x0001;
3377                         break;
3378                 case B43_QOS_VIDEO:
3379                         params->p.txop = 0;
3380                         params->p.aifs = 2;
3381                         params->p.cw_min = 0x0001;
3382                         params->p.cw_max = 0x0001;
3383                         break;
3384                 case B43_QOS_BESTEFFORT:
3385                         params->p.txop = 0;
3386                         params->p.aifs = 3;
3387                         params->p.cw_min = 0x0001;
3388                         params->p.cw_max = 0x03FF;
3389                         break;
3390                 case B43_QOS_BACKGROUND:
3391                         params->p.txop = 0;
3392                         params->p.aifs = 7;
3393                         params->p.cw_min = 0x0001;
3394                         params->p.cw_max = 0x03FF;
3395                         break;
3396                 default:
3397                         B43_WARN_ON(1);
3398                 }
3399         }
3400 }
3401
3402 /* Initialize the core's QOS capabilities */
3403 static void b43_qos_init(struct b43_wldev *dev)
3404 {
3405         if (!dev->qos_enabled) {
3406                 /* Disable QOS support. */
3407                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3408                 b43_write16(dev, B43_MMIO_IFSCTL,
3409                             b43_read16(dev, B43_MMIO_IFSCTL)
3410                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3411                 b43dbg(dev->wl, "QoS disabled\n");
3412                 return;
3413         }
3414
3415         /* Upload the current QOS parameters. */
3416         b43_qos_upload_all(dev);
3417
3418         /* Enable QOS support. */
3419         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3420         b43_write16(dev, B43_MMIO_IFSCTL,
3421                     b43_read16(dev, B43_MMIO_IFSCTL)
3422                     | B43_MMIO_IFSCTL_USE_EDCF);
3423         b43dbg(dev->wl, "QoS enabled\n");
3424 }
3425
3426 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3427                           const struct ieee80211_tx_queue_params *params)
3428 {
3429         struct b43_wl *wl = hw_to_b43_wl(hw);
3430         struct b43_wldev *dev;
3431         unsigned int queue = (unsigned int)_queue;
3432         int err = -ENODEV;
3433
3434         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3435                 /* Queue not available or don't support setting
3436                  * params on this queue. Return success to not
3437                  * confuse mac80211. */
3438                 return 0;
3439         }
3440         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3441                      ARRAY_SIZE(wl->qos_params));
3442
3443         mutex_lock(&wl->mutex);
3444         dev = wl->current_dev;
3445         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3446                 goto out_unlock;
3447
3448         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3449         b43_mac_suspend(dev);
3450         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3451                               b43_qos_shm_offsets[queue]);
3452         b43_mac_enable(dev);
3453         err = 0;
3454
3455 out_unlock:
3456         mutex_unlock(&wl->mutex);
3457
3458         return err;
3459 }
3460
3461 static int b43_op_get_stats(struct ieee80211_hw *hw,
3462                             struct ieee80211_low_level_stats *stats)
3463 {
3464         struct b43_wl *wl = hw_to_b43_wl(hw);
3465
3466         mutex_lock(&wl->mutex);
3467         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3468         mutex_unlock(&wl->mutex);
3469
3470         return 0;
3471 }
3472
3473 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3474 {
3475         struct b43_wl *wl = hw_to_b43_wl(hw);
3476         struct b43_wldev *dev;
3477         u64 tsf;
3478
3479         mutex_lock(&wl->mutex);
3480         dev = wl->current_dev;
3481
3482         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3483                 b43_tsf_read(dev, &tsf);
3484         else
3485                 tsf = 0;
3486
3487         mutex_unlock(&wl->mutex);
3488
3489         return tsf;
3490 }
3491
3492 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3493 {
3494         struct b43_wl *wl = hw_to_b43_wl(hw);
3495         struct b43_wldev *dev;
3496
3497         mutex_lock(&wl->mutex);
3498         dev = wl->current_dev;
3499
3500         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3501                 b43_tsf_write(dev, tsf);
3502
3503         mutex_unlock(&wl->mutex);
3504 }
3505
3506 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3507 {
3508         u32 tmp;
3509
3510         switch (dev->dev->bus_type) {
3511 #ifdef CONFIG_B43_SSB
3512         case B43_BUS_SSB:
3513                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3514                 tmp &= ~B43_TMSLOW_GMODE;
3515                 tmp |= B43_TMSLOW_PHYRESET;
3516                 tmp |= SSB_TMSLOW_FGC;
3517                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3518                 msleep(1);
3519
3520                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3521                 tmp &= ~SSB_TMSLOW_FGC;
3522                 tmp |= B43_TMSLOW_PHYRESET;
3523                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3524                 msleep(1);
3525
3526                 break;
3527 #endif
3528         }
3529 }
3530
3531 static const char *band_to_string(enum ieee80211_band band)
3532 {
3533         switch (band) {
3534         case IEEE80211_BAND_5GHZ:
3535                 return "5";
3536         case IEEE80211_BAND_2GHZ:
3537                 return "2.4";
3538         default:
3539                 break;
3540         }
3541         B43_WARN_ON(1);
3542         return "";
3543 }
3544
3545 /* Expects wl->mutex locked */
3546 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3547 {
3548         struct b43_wldev *up_dev = NULL;
3549         struct b43_wldev *down_dev;
3550         struct b43_wldev *d;
3551         int err;
3552         bool uninitialized_var(gmode);
3553         int prev_status;
3554
3555         /* Find a device and PHY which supports the band. */
3556         list_for_each_entry(d, &wl->devlist, list) {
3557                 switch (chan->band) {
3558                 case IEEE80211_BAND_5GHZ:
3559                         if (d->phy.supports_5ghz) {
3560                                 up_dev = d;
3561                                 gmode = 0;
3562                         }
3563                         break;
3564                 case IEEE80211_BAND_2GHZ:
3565                         if (d->phy.supports_2ghz) {
3566                                 up_dev = d;
3567                                 gmode = 1;
3568                         }
3569                         break;
3570                 default:
3571                         B43_WARN_ON(1);
3572                         return -EINVAL;
3573                 }
3574                 if (up_dev)
3575                         break;
3576         }
3577         if (!up_dev) {
3578                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3579                        band_to_string(chan->band));
3580                 return -ENODEV;
3581         }
3582         if ((up_dev == wl->current_dev) &&
3583             (!!wl->current_dev->phy.gmode == !!gmode)) {
3584                 /* This device is already running. */
3585                 return 0;
3586         }
3587         b43dbg(wl, "Switching to %s-GHz band\n",
3588                band_to_string(chan->band));
3589         down_dev = wl->current_dev;
3590
3591         prev_status = b43_status(down_dev);
3592         /* Shutdown the currently running core. */
3593         if (prev_status >= B43_STAT_STARTED)
3594                 down_dev = b43_wireless_core_stop(down_dev);
3595         if (prev_status >= B43_STAT_INITIALIZED)
3596                 b43_wireless_core_exit(down_dev);
3597
3598         if (down_dev != up_dev) {
3599                 /* We switch to a different core, so we put PHY into
3600                  * RESET on the old core. */
3601                 b43_put_phy_into_reset(down_dev);
3602         }
3603
3604         /* Now start the new core. */
3605         up_dev->phy.gmode = gmode;
3606         if (prev_status >= B43_STAT_INITIALIZED) {
3607                 err = b43_wireless_core_init(up_dev);
3608                 if (err) {
3609                         b43err(wl, "Fatal: Could not initialize device for "
3610                                "selected %s-GHz band\n",
3611                                band_to_string(chan->band));
3612                         goto init_failure;
3613                 }
3614         }
3615         if (prev_status >= B43_STAT_STARTED) {
3616                 err = b43_wireless_core_start(up_dev);
3617                 if (err) {
3618                         b43err(wl, "Fatal: Coult not start device for "
3619                                "selected %s-GHz band\n",
3620                                band_to_string(chan->band));
3621                         b43_wireless_core_exit(up_dev);
3622                         goto init_failure;
3623                 }
3624         }
3625         B43_WARN_ON(b43_status(up_dev) != prev_status);
3626
3627         wl->current_dev = up_dev;
3628
3629         return 0;
3630 init_failure:
3631         /* Whoops, failed to init the new core. No core is operating now. */
3632         wl->current_dev = NULL;
3633         return err;
3634 }
3635
3636 /* Write the short and long frame retry limit values. */
3637 static void b43_set_retry_limits(struct b43_wldev *dev,
3638                                  unsigned int short_retry,
3639                                  unsigned int long_retry)
3640 {
3641         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3642          * the chip-internal counter. */
3643         short_retry = min(short_retry, (unsigned int)0xF);
3644         long_retry = min(long_retry, (unsigned int)0xF);
3645
3646         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3647                         short_retry);
3648         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3649                         long_retry);
3650 }
3651
3652 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3653 {
3654         struct b43_wl *wl = hw_to_b43_wl(hw);
3655         struct b43_wldev *dev;
3656         struct b43_phy *phy;
3657         struct ieee80211_conf *conf = &hw->conf;
3658         int antenna;
3659         int err = 0;
3660
3661         mutex_lock(&wl->mutex);
3662
3663         /* Switch the band (if necessary). This might change the active core. */
3664         err = b43_switch_band(wl, conf->channel);
3665         if (err)
3666                 goto out_unlock_mutex;
3667         dev = wl->current_dev;
3668         phy = &dev->phy;
3669
3670         if (conf_is_ht(conf))
3671                 phy->is_40mhz =
3672                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3673         else
3674                 phy->is_40mhz = false;
3675
3676         b43_mac_suspend(dev);
3677
3678         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3679                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3680                                           conf->long_frame_max_tx_count);
3681         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3682         if (!changed)
3683                 goto out_mac_enable;
3684
3685         /* Switch to the requested channel.
3686          * The firmware takes care of races with the TX handler. */
3687         if (conf->channel->hw_value != phy->channel)
3688                 b43_switch_channel(dev, conf->channel->hw_value);
3689
3690         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3691
3692         /* Adjust the desired TX power level. */
3693         if (conf->power_level != 0) {
3694                 if (conf->power_level != phy->desired_txpower) {
3695                         phy->desired_txpower = conf->power_level;
3696                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3697                                                    B43_TXPWR_IGNORE_TSSI);
3698                 }
3699         }
3700
3701         /* Antennas for RX and management frame TX. */
3702         antenna = B43_ANTENNA_DEFAULT;
3703         b43_mgmtframe_txantenna(dev, antenna);
3704         antenna = B43_ANTENNA_DEFAULT;
3705         if (phy->ops->set_rx_antenna)
3706                 phy->ops->set_rx_antenna(dev, antenna);
3707
3708         if (wl->radio_enabled != phy->radio_on) {
3709                 if (wl->radio_enabled) {
3710                         b43_software_rfkill(dev, false);
3711                         b43info(dev->wl, "Radio turned on by software\n");
3712                         if (!dev->radio_hw_enable) {
3713                                 b43info(dev->wl, "The hardware RF-kill button "
3714                                         "still turns the radio physically off. "
3715                                         "Press the button to turn it on.\n");
3716                         }
3717                 } else {
3718                         b43_software_rfkill(dev, true);
3719                         b43info(dev->wl, "Radio turned off by software\n");
3720                 }
3721         }
3722
3723 out_mac_enable:
3724         b43_mac_enable(dev);
3725 out_unlock_mutex:
3726         mutex_unlock(&wl->mutex);
3727
3728         return err;
3729 }
3730
3731 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3732 {
3733         struct ieee80211_supported_band *sband =
3734                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3735         struct ieee80211_rate *rate;
3736         int i;
3737         u16 basic, direct, offset, basic_offset, rateptr;
3738
3739         for (i = 0; i < sband->n_bitrates; i++) {
3740                 rate = &sband->bitrates[i];
3741
3742                 if (b43_is_cck_rate(rate->hw_value)) {
3743                         direct = B43_SHM_SH_CCKDIRECT;
3744                         basic = B43_SHM_SH_CCKBASIC;
3745                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3746                         offset &= 0xF;
3747                 } else {
3748                         direct = B43_SHM_SH_OFDMDIRECT;
3749                         basic = B43_SHM_SH_OFDMBASIC;
3750                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3751                         offset &= 0xF;
3752                 }
3753
3754                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3755
3756                 if (b43_is_cck_rate(rate->hw_value)) {
3757                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3758                         basic_offset &= 0xF;
3759                 } else {
3760                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3761                         basic_offset &= 0xF;
3762                 }
3763
3764                 /*
3765                  * Get the pointer that we need to point to
3766                  * from the direct map
3767                  */
3768                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3769                                          direct + 2 * basic_offset);
3770                 /* and write it to the basic map */
3771                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3772                                 rateptr);
3773         }
3774 }
3775
3776 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3777                                     struct ieee80211_vif *vif,
3778                                     struct ieee80211_bss_conf *conf,
3779                                     u32 changed)
3780 {
3781         struct b43_wl *wl = hw_to_b43_wl(hw);
3782         struct b43_wldev *dev;
3783
3784         mutex_lock(&wl->mutex);
3785
3786         dev = wl->current_dev;
3787         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3788                 goto out_unlock_mutex;
3789
3790         B43_WARN_ON(wl->vif != vif);
3791
3792         if (changed & BSS_CHANGED_BSSID) {
3793                 if (conf->bssid)
3794                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3795                 else
3796                         memset(wl->bssid, 0, ETH_ALEN);
3797         }
3798
3799         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3800                 if (changed & BSS_CHANGED_BEACON &&
3801                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3802                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3803                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3804                         b43_update_templates(wl);
3805
3806                 if (changed & BSS_CHANGED_BSSID)
3807                         b43_write_mac_bssid_templates(dev);
3808         }
3809
3810         b43_mac_suspend(dev);
3811
3812         /* Update templates for AP/mesh mode. */
3813         if (changed & BSS_CHANGED_BEACON_INT &&
3814             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3815              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3816              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3817                 b43_set_beacon_int(dev, conf->beacon_int);
3818
3819         if (changed & BSS_CHANGED_BASIC_RATES)
3820                 b43_update_basic_rates(dev, conf->basic_rates);
3821
3822         if (changed & BSS_CHANGED_ERP_SLOT) {
3823                 if (conf->use_short_slot)
3824                         b43_short_slot_timing_enable(dev);
3825                 else
3826                         b43_short_slot_timing_disable(dev);
3827         }
3828
3829         b43_mac_enable(dev);
3830 out_unlock_mutex:
3831         mutex_unlock(&wl->mutex);
3832 }
3833
3834 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3835                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3836                           struct ieee80211_key_conf *key)
3837 {
3838         struct b43_wl *wl = hw_to_b43_wl(hw);
3839         struct b43_wldev *dev;
3840         u8 algorithm;
3841         u8 index;
3842         int err;
3843         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3844
3845         if (modparam_nohwcrypt)
3846                 return -ENOSPC; /* User disabled HW-crypto */
3847
3848         mutex_lock(&wl->mutex);
3849
3850         dev = wl->current_dev;
3851         err = -ENODEV;
3852         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3853                 goto out_unlock;
3854
3855         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3856                 /* We don't have firmware for the crypto engine.
3857                  * Must use software-crypto. */
3858                 err = -EOPNOTSUPP;
3859                 goto out_unlock;
3860         }
3861
3862         err = -EINVAL;
3863         switch (key->cipher) {
3864         case WLAN_CIPHER_SUITE_WEP40:
3865                 algorithm = B43_SEC_ALGO_WEP40;
3866                 break;
3867         case WLAN_CIPHER_SUITE_WEP104:
3868                 algorithm = B43_SEC_ALGO_WEP104;
3869                 break;
3870         case WLAN_CIPHER_SUITE_TKIP:
3871                 algorithm = B43_SEC_ALGO_TKIP;
3872                 break;
3873         case WLAN_CIPHER_SUITE_CCMP:
3874                 algorithm = B43_SEC_ALGO_AES;
3875                 break;
3876         default:
3877                 B43_WARN_ON(1);
3878                 goto out_unlock;
3879         }
3880         index = (u8) (key->keyidx);
3881         if (index > 3)
3882                 goto out_unlock;
3883
3884         switch (cmd) {
3885         case SET_KEY:
3886                 if (algorithm == B43_SEC_ALGO_TKIP &&
3887                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3888                     !modparam_hwtkip)) {
3889                         /* We support only pairwise key */
3890                         err = -EOPNOTSUPP;
3891                         goto out_unlock;
3892                 }
3893
3894                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3895                         if (WARN_ON(!sta)) {
3896                                 err = -EOPNOTSUPP;
3897                                 goto out_unlock;
3898                         }
3899                         /* Pairwise key with an assigned MAC address. */
3900                         err = b43_key_write(dev, -1, algorithm,
3901                                             key->key, key->keylen,
3902                                             sta->addr, key);
3903                 } else {
3904                         /* Group key */
3905                         err = b43_key_write(dev, index, algorithm,
3906                                             key->key, key->keylen, NULL, key);
3907                 }
3908                 if (err)
3909                         goto out_unlock;
3910
3911                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3912                     algorithm == B43_SEC_ALGO_WEP104) {
3913                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3914                 } else {
3915                         b43_hf_write(dev,
3916                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3917                 }
3918                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3919                 if (algorithm == B43_SEC_ALGO_TKIP)
3920                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3921                 break;
3922         case DISABLE_KEY: {
3923                 err = b43_key_clear(dev, key->hw_key_idx);
3924                 if (err)
3925                         goto out_unlock;
3926                 break;
3927         }
3928         default:
3929                 B43_WARN_ON(1);
3930         }
3931
3932 out_unlock:
3933         if (!err) {
3934                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3935                        "mac: %pM\n",
3936                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3937                        sta ? sta->addr : bcast_addr);
3938                 b43_dump_keymemory(dev);
3939         }
3940         mutex_unlock(&wl->mutex);
3941
3942         return err;
3943 }
3944
3945 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3946                                     unsigned int changed, unsigned int *fflags,
3947                                     u64 multicast)
3948 {
3949         struct b43_wl *wl = hw_to_b43_wl(hw);
3950         struct b43_wldev *dev;
3951
3952         mutex_lock(&wl->mutex);
3953         dev = wl->current_dev;
3954         if (!dev) {
3955                 *fflags = 0;
3956                 goto out_unlock;
3957         }
3958
3959         *fflags &= FIF_PROMISC_IN_BSS |
3960                   FIF_ALLMULTI |
3961                   FIF_FCSFAIL |
3962                   FIF_PLCPFAIL |
3963                   FIF_CONTROL |
3964                   FIF_OTHER_BSS |
3965                   FIF_BCN_PRBRESP_PROMISC;
3966
3967         changed &= FIF_PROMISC_IN_BSS |
3968                    FIF_ALLMULTI |
3969                    FIF_FCSFAIL |
3970                    FIF_PLCPFAIL |
3971                    FIF_CONTROL |
3972                    FIF_OTHER_BSS |
3973                    FIF_BCN_PRBRESP_PROMISC;
3974
3975         wl->filter_flags = *fflags;
3976
3977         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3978                 b43_adjust_opmode(dev);
3979
3980 out_unlock:
3981         mutex_unlock(&wl->mutex);
3982 }
3983
3984 /* Locking: wl->mutex
3985  * Returns the current dev. This might be different from the passed in dev,
3986  * because the core might be gone away while we unlocked the mutex. */
3987 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3988 {
3989         struct b43_wl *wl = dev->wl;
3990         struct b43_wldev *orig_dev;
3991         u32 mask;
3992
3993 redo:
3994         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3995                 return dev;
3996
3997         /* Cancel work. Unlock to avoid deadlocks. */
3998         mutex_unlock(&wl->mutex);
3999         cancel_delayed_work_sync(&dev->periodic_work);
4000         cancel_work_sync(&wl->tx_work);
4001         mutex_lock(&wl->mutex);
4002         dev = wl->current_dev;
4003         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4004                 /* Whoops, aliens ate up the device while we were unlocked. */
4005                 return dev;
4006         }
4007
4008         /* Disable interrupts on the device. */
4009         b43_set_status(dev, B43_STAT_INITIALIZED);
4010         if (b43_bus_host_is_sdio(dev->dev)) {
4011                 /* wl->mutex is locked. That is enough. */
4012                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4013                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4014         } else {
4015                 spin_lock_irq(&wl->hardirq_lock);
4016                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4017                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4018                 spin_unlock_irq(&wl->hardirq_lock);
4019         }
4020         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4021         orig_dev = dev;
4022         mutex_unlock(&wl->mutex);
4023         if (b43_bus_host_is_sdio(dev->dev)) {
4024                 b43_sdio_free_irq(dev);
4025         } else {
4026                 synchronize_irq(dev->dev->irq);
4027                 free_irq(dev->dev->irq, dev);
4028         }
4029         mutex_lock(&wl->mutex);
4030         dev = wl->current_dev;
4031         if (!dev)
4032                 return dev;
4033         if (dev != orig_dev) {
4034                 if (b43_status(dev) >= B43_STAT_STARTED)
4035                         goto redo;
4036                 return dev;
4037         }
4038         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4039         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4040
4041         /* Drain the TX queue */
4042         while (skb_queue_len(&wl->tx_queue))
4043                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4044
4045         b43_mac_suspend(dev);
4046         b43_leds_exit(dev);
4047         b43dbg(wl, "Wireless interface stopped\n");
4048
4049         return dev;
4050 }
4051
4052 /* Locking: wl->mutex */
4053 static int b43_wireless_core_start(struct b43_wldev *dev)
4054 {
4055         int err;
4056
4057         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4058
4059         drain_txstatus_queue(dev);
4060         if (b43_bus_host_is_sdio(dev->dev)) {
4061                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4062                 if (err) {
4063                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4064                         goto out;
4065                 }
4066         } else {
4067                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4068                                            b43_interrupt_thread_handler,
4069                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4070                 if (err) {
4071                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4072                                dev->dev->irq);
4073                         goto out;
4074                 }
4075         }
4076
4077         /* We are ready to run. */
4078         ieee80211_wake_queues(dev->wl->hw);
4079         b43_set_status(dev, B43_STAT_STARTED);
4080
4081         /* Start data flow (TX/RX). */
4082         b43_mac_enable(dev);
4083         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4084
4085         /* Start maintenance work */
4086         b43_periodic_tasks_setup(dev);
4087
4088         b43_leds_init(dev);
4089
4090         b43dbg(dev->wl, "Wireless interface started\n");
4091 out:
4092         return err;
4093 }
4094
4095 /* Get PHY and RADIO versioning numbers */
4096 static int b43_phy_versioning(struct b43_wldev *dev)
4097 {
4098         struct b43_phy *phy = &dev->phy;
4099         u32 tmp;
4100         u8 analog_type;
4101         u8 phy_type;
4102         u8 phy_rev;
4103         u16 radio_manuf;
4104         u16 radio_ver;
4105         u16 radio_rev;
4106         int unsupported = 0;
4107
4108         /* Get PHY versioning */
4109         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4110         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4111         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4112         phy_rev = (tmp & B43_PHYVER_VERSION);
4113         switch (phy_type) {
4114         case B43_PHYTYPE_A:
4115                 if (phy_rev >= 4)
4116                         unsupported = 1;
4117                 break;
4118         case B43_PHYTYPE_B:
4119                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4120                     && phy_rev != 7)
4121                         unsupported = 1;
4122                 break;
4123         case B43_PHYTYPE_G:
4124                 if (phy_rev > 9)
4125                         unsupported = 1;
4126                 break;
4127 #ifdef CONFIG_B43_PHY_N
4128         case B43_PHYTYPE_N:
4129                 if (phy_rev > 9)
4130                         unsupported = 1;
4131                 break;
4132 #endif
4133 #ifdef CONFIG_B43_PHY_LP
4134         case B43_PHYTYPE_LP:
4135                 if (phy_rev > 2)
4136                         unsupported = 1;
4137                 break;
4138 #endif
4139 #ifdef CONFIG_B43_PHY_HT
4140         case B43_PHYTYPE_HT:
4141                 if (phy_rev > 1)
4142                         unsupported = 1;
4143                 break;
4144 #endif
4145         default:
4146                 unsupported = 1;
4147         };
4148         if (unsupported) {
4149                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4150                        "(Analog %u, Type %u, Revision %u)\n",
4151                        analog_type, phy_type, phy_rev);
4152                 return -EOPNOTSUPP;
4153         }
4154         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4155                analog_type, phy_type, phy_rev);
4156
4157         /* Get RADIO versioning */
4158         if (dev->dev->chip_id == 0x4317) {
4159                 if (dev->dev->chip_rev == 0)
4160                         tmp = 0x3205017F;
4161                 else if (dev->dev->chip_rev == 1)
4162                         tmp = 0x4205017F;
4163                 else
4164                         tmp = 0x5205017F;
4165         } else {
4166                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4167                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4168                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4169                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4170         }
4171         radio_manuf = (tmp & 0x00000FFF);
4172         radio_ver = (tmp & 0x0FFFF000) >> 12;
4173         radio_rev = (tmp & 0xF0000000) >> 28;
4174         if (radio_manuf != 0x17F /* Broadcom */)
4175                 unsupported = 1;
4176         switch (phy_type) {
4177         case B43_PHYTYPE_A:
4178                 if (radio_ver != 0x2060)
4179                         unsupported = 1;
4180                 if (radio_rev != 1)
4181                         unsupported = 1;
4182                 if (radio_manuf != 0x17F)
4183                         unsupported = 1;
4184                 break;
4185         case B43_PHYTYPE_B:
4186                 if ((radio_ver & 0xFFF0) != 0x2050)
4187                         unsupported = 1;
4188                 break;
4189         case B43_PHYTYPE_G:
4190                 if (radio_ver != 0x2050)
4191                         unsupported = 1;
4192                 break;
4193         case B43_PHYTYPE_N:
4194                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4195                         unsupported = 1;
4196                 break;
4197         case B43_PHYTYPE_LP:
4198                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4199                         unsupported = 1;
4200                 break;
4201         case B43_PHYTYPE_HT:
4202                 if (radio_ver != 0x2059)
4203                         unsupported = 1;
4204                 break;
4205         default:
4206                 B43_WARN_ON(1);
4207         }
4208         if (unsupported) {
4209                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4210                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4211                        radio_manuf, radio_ver, radio_rev);
4212                 return -EOPNOTSUPP;
4213         }
4214         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4215                radio_manuf, radio_ver, radio_rev);
4216
4217         phy->radio_manuf = radio_manuf;
4218         phy->radio_ver = radio_ver;
4219         phy->radio_rev = radio_rev;
4220
4221         phy->analog = analog_type;
4222         phy->type = phy_type;
4223         phy->rev = phy_rev;
4224
4225         return 0;
4226 }
4227
4228 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4229                                       struct b43_phy *phy)
4230 {
4231         phy->hardware_power_control = !!modparam_hwpctl;
4232         phy->next_txpwr_check_time = jiffies;
4233         /* PHY TX errors counter. */
4234         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4235
4236 #if B43_DEBUG
4237         phy->phy_locked = 0;
4238         phy->radio_locked = 0;
4239 #endif
4240 }
4241
4242 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4243 {
4244         dev->dfq_valid = 0;
4245
4246         /* Assume the radio is enabled. If it's not enabled, the state will
4247          * immediately get fixed on the first periodic work run. */
4248         dev->radio_hw_enable = 1;
4249
4250         /* Stats */
4251         memset(&dev->stats, 0, sizeof(dev->stats));
4252
4253         setup_struct_phy_for_init(dev, &dev->phy);
4254
4255         /* IRQ related flags */
4256         dev->irq_reason = 0;
4257         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4258         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4259         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4260                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4261
4262         dev->mac_suspended = 1;
4263
4264         /* Noise calculation context */
4265         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4266 }
4267
4268 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4269 {
4270         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4271         u64 hf;
4272
4273         if (!modparam_btcoex)
4274                 return;
4275         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4276                 return;
4277         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4278                 return;
4279
4280         hf = b43_hf_read(dev);
4281         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4282                 hf |= B43_HF_BTCOEXALT;
4283         else
4284                 hf |= B43_HF_BTCOEX;
4285         b43_hf_write(dev, hf);
4286 }
4287
4288 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4289 {
4290         if (!modparam_btcoex)
4291                 return;
4292         //TODO
4293 }
4294
4295 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4296 {
4297         struct ssb_bus *bus;
4298         u32 tmp;
4299
4300         if (dev->dev->bus_type != B43_BUS_SSB)
4301                 return;
4302
4303         bus = dev->dev->sdev->bus;
4304
4305         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4306             (bus->chip_id == 0x4312)) {
4307                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4308                 tmp &= ~SSB_IMCFGLO_REQTO;
4309                 tmp &= ~SSB_IMCFGLO_SERTO;
4310                 tmp |= 0x3;
4311                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4312                 ssb_commit_settings(bus);
4313         }
4314 }
4315
4316 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4317 {
4318         u16 pu_delay;
4319
4320         /* The time value is in microseconds. */
4321         if (dev->phy.type == B43_PHYTYPE_A)
4322                 pu_delay = 3700;
4323         else
4324                 pu_delay = 1050;
4325         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4326                 pu_delay = 500;
4327         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4328                 pu_delay = max(pu_delay, (u16)2400);
4329
4330         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4331 }
4332
4333 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4334 static void b43_set_pretbtt(struct b43_wldev *dev)
4335 {
4336         u16 pretbtt;
4337
4338         /* The time value is in microseconds. */
4339         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4340                 pretbtt = 2;
4341         } else {
4342                 if (dev->phy.type == B43_PHYTYPE_A)
4343                         pretbtt = 120;
4344                 else
4345                         pretbtt = 250;
4346         }
4347         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4348         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4349 }
4350
4351 /* Shutdown a wireless core */
4352 /* Locking: wl->mutex */
4353 static void b43_wireless_core_exit(struct b43_wldev *dev)
4354 {
4355         u32 macctl;
4356
4357         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4358         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4359                 return;
4360
4361         /* Unregister HW RNG driver */
4362         b43_rng_exit(dev->wl);
4363
4364         b43_set_status(dev, B43_STAT_UNINIT);
4365
4366         /* Stop the microcode PSM. */
4367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4368         macctl &= ~B43_MACCTL_PSM_RUN;
4369         macctl |= B43_MACCTL_PSM_JMP0;
4370         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4371
4372         b43_dma_free(dev);
4373         b43_pio_free(dev);
4374         b43_chip_exit(dev);
4375         dev->phy.ops->switch_analog(dev, 0);
4376         if (dev->wl->current_beacon) {
4377                 dev_kfree_skb_any(dev->wl->current_beacon);
4378                 dev->wl->current_beacon = NULL;
4379         }
4380
4381         b43_device_disable(dev, 0);
4382         b43_bus_may_powerdown(dev);
4383 }
4384
4385 /* Initialize a wireless core */
4386 static int b43_wireless_core_init(struct b43_wldev *dev)
4387 {
4388         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4389         struct b43_phy *phy = &dev->phy;
4390         int err;
4391         u64 hf;
4392
4393         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4394
4395         err = b43_bus_powerup(dev, 0);
4396         if (err)
4397                 goto out;
4398         if (!b43_device_is_enabled(dev))
4399                 b43_wireless_core_reset(dev, phy->gmode);
4400
4401         /* Reset all data structures. */
4402         setup_struct_wldev_for_init(dev);
4403         phy->ops->prepare_structs(dev);
4404
4405         /* Enable IRQ routing to this device. */
4406         switch (dev->dev->bus_type) {
4407 #ifdef CONFIG_B43_SSB
4408         case B43_BUS_SSB:
4409                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4410                                                dev->dev->sdev);
4411                 break;
4412 #endif
4413         }
4414
4415         b43_imcfglo_timeouts_workaround(dev);
4416         b43_bluetooth_coext_disable(dev);
4417         if (phy->ops->prepare_hardware) {
4418                 err = phy->ops->prepare_hardware(dev);
4419                 if (err)
4420                         goto err_busdown;
4421         }
4422         err = b43_chip_init(dev);
4423         if (err)
4424                 goto err_busdown;
4425         b43_shm_write16(dev, B43_SHM_SHARED,
4426                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4427         hf = b43_hf_read(dev);
4428         if (phy->type == B43_PHYTYPE_G) {
4429                 hf |= B43_HF_SYMW;
4430                 if (phy->rev == 1)
4431                         hf |= B43_HF_GDCW;
4432                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4433                         hf |= B43_HF_OFDMPABOOST;
4434         }
4435         if (phy->radio_ver == 0x2050) {
4436                 if (phy->radio_rev == 6)
4437                         hf |= B43_HF_4318TSSI;
4438                 if (phy->radio_rev < 6)
4439                         hf |= B43_HF_VCORECALC;
4440         }
4441         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4442                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4443 #ifdef CONFIG_SSB_DRIVER_PCICORE
4444         if (dev->dev->bus_type == B43_BUS_SSB &&
4445             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4446             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4447                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4448 #endif
4449         hf &= ~B43_HF_SKCFPUP;
4450         b43_hf_write(dev, hf);
4451
4452         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4453                              B43_DEFAULT_LONG_RETRY_LIMIT);
4454         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4455         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4456
4457         /* Disable sending probe responses from firmware.
4458          * Setting the MaxTime to one usec will always trigger
4459          * a timeout, so we never send any probe resp.
4460          * A timeout of zero is infinite. */
4461         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4462
4463         b43_rate_memory_init(dev);
4464         b43_set_phytxctl_defaults(dev);
4465
4466         /* Minimum Contention Window */
4467         if (phy->type == B43_PHYTYPE_B)
4468                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4469         else
4470                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4471         /* Maximum Contention Window */
4472         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4473
4474         if (b43_bus_host_is_pcmcia(dev->dev) ||
4475             b43_bus_host_is_sdio(dev->dev) ||
4476             dev->use_pio) {
4477                 dev->__using_pio_transfers = 1;
4478                 err = b43_pio_init(dev);
4479         } else {
4480                 dev->__using_pio_transfers = 0;
4481                 err = b43_dma_init(dev);
4482         }
4483         if (err)
4484                 goto err_chip_exit;
4485         b43_qos_init(dev);
4486         b43_set_synth_pu_delay(dev, 1);
4487         b43_bluetooth_coext_enable(dev);
4488
4489         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4490         b43_upload_card_macaddress(dev);
4491         b43_security_init(dev);
4492
4493         ieee80211_wake_queues(dev->wl->hw);
4494
4495         b43_set_status(dev, B43_STAT_INITIALIZED);
4496
4497         /* Register HW RNG driver */
4498         b43_rng_init(dev->wl);
4499
4500 out:
4501         return err;
4502
4503 err_chip_exit:
4504         b43_chip_exit(dev);
4505 err_busdown:
4506         b43_bus_may_powerdown(dev);
4507         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4508         return err;
4509 }
4510
4511 static int b43_op_add_interface(struct ieee80211_hw *hw,
4512                                 struct ieee80211_vif *vif)
4513 {
4514         struct b43_wl *wl = hw_to_b43_wl(hw);
4515         struct b43_wldev *dev;
4516         int err = -EOPNOTSUPP;
4517
4518         /* TODO: allow WDS/AP devices to coexist */
4519
4520         if (vif->type != NL80211_IFTYPE_AP &&
4521             vif->type != NL80211_IFTYPE_MESH_POINT &&
4522             vif->type != NL80211_IFTYPE_STATION &&
4523             vif->type != NL80211_IFTYPE_WDS &&
4524             vif->type != NL80211_IFTYPE_ADHOC)
4525                 return -EOPNOTSUPP;
4526
4527         mutex_lock(&wl->mutex);
4528         if (wl->operating)
4529                 goto out_mutex_unlock;
4530
4531         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4532
4533         dev = wl->current_dev;
4534         wl->operating = 1;
4535         wl->vif = vif;
4536         wl->if_type = vif->type;
4537         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4538
4539         b43_adjust_opmode(dev);
4540         b43_set_pretbtt(dev);
4541         b43_set_synth_pu_delay(dev, 0);
4542         b43_upload_card_macaddress(dev);
4543
4544         err = 0;
4545  out_mutex_unlock:
4546         mutex_unlock(&wl->mutex);
4547
4548         return err;
4549 }
4550
4551 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4552                                     struct ieee80211_vif *vif)
4553 {
4554         struct b43_wl *wl = hw_to_b43_wl(hw);
4555         struct b43_wldev *dev = wl->current_dev;
4556
4557         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4558
4559         mutex_lock(&wl->mutex);
4560
4561         B43_WARN_ON(!wl->operating);
4562         B43_WARN_ON(wl->vif != vif);
4563         wl->vif = NULL;
4564
4565         wl->operating = 0;
4566
4567         b43_adjust_opmode(dev);
4568         memset(wl->mac_addr, 0, ETH_ALEN);
4569         b43_upload_card_macaddress(dev);
4570
4571         mutex_unlock(&wl->mutex);
4572 }
4573
4574 static int b43_op_start(struct ieee80211_hw *hw)
4575 {
4576         struct b43_wl *wl = hw_to_b43_wl(hw);
4577         struct b43_wldev *dev = wl->current_dev;
4578         int did_init = 0;
4579         int err = 0;
4580
4581         /* Kill all old instance specific information to make sure
4582          * the card won't use it in the short timeframe between start
4583          * and mac80211 reconfiguring it. */
4584         memset(wl->bssid, 0, ETH_ALEN);
4585         memset(wl->mac_addr, 0, ETH_ALEN);
4586         wl->filter_flags = 0;
4587         wl->radiotap_enabled = 0;
4588         b43_qos_clear(wl);
4589         wl->beacon0_uploaded = 0;
4590         wl->beacon1_uploaded = 0;
4591         wl->beacon_templates_virgin = 1;
4592         wl->radio_enabled = 1;
4593
4594         mutex_lock(&wl->mutex);
4595
4596         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4597                 err = b43_wireless_core_init(dev);
4598                 if (err)
4599                         goto out_mutex_unlock;
4600                 did_init = 1;
4601         }
4602
4603         if (b43_status(dev) < B43_STAT_STARTED) {
4604                 err = b43_wireless_core_start(dev);
4605                 if (err) {
4606                         if (did_init)
4607                                 b43_wireless_core_exit(dev);
4608                         goto out_mutex_unlock;
4609                 }
4610         }
4611
4612         /* XXX: only do if device doesn't support rfkill irq */
4613         wiphy_rfkill_start_polling(hw->wiphy);
4614
4615  out_mutex_unlock:
4616         mutex_unlock(&wl->mutex);
4617
4618         return err;
4619 }
4620
4621 static void b43_op_stop(struct ieee80211_hw *hw)
4622 {
4623         struct b43_wl *wl = hw_to_b43_wl(hw);
4624         struct b43_wldev *dev = wl->current_dev;
4625
4626         cancel_work_sync(&(wl->beacon_update_trigger));
4627
4628         mutex_lock(&wl->mutex);
4629         if (b43_status(dev) >= B43_STAT_STARTED) {
4630                 dev = b43_wireless_core_stop(dev);
4631                 if (!dev)
4632                         goto out_unlock;
4633         }
4634         b43_wireless_core_exit(dev);
4635         wl->radio_enabled = 0;
4636
4637 out_unlock:
4638         mutex_unlock(&wl->mutex);
4639
4640         cancel_work_sync(&(wl->txpower_adjust_work));
4641 }
4642
4643 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4644                                  struct ieee80211_sta *sta, bool set)
4645 {
4646         struct b43_wl *wl = hw_to_b43_wl(hw);
4647
4648         /* FIXME: add locking */
4649         b43_update_templates(wl);
4650
4651         return 0;
4652 }
4653
4654 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4655                               struct ieee80211_vif *vif,
4656                               enum sta_notify_cmd notify_cmd,
4657                               struct ieee80211_sta *sta)
4658 {
4659         struct b43_wl *wl = hw_to_b43_wl(hw);
4660
4661         B43_WARN_ON(!vif || wl->vif != vif);
4662 }
4663
4664 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4665 {
4666         struct b43_wl *wl = hw_to_b43_wl(hw);
4667         struct b43_wldev *dev;
4668
4669         mutex_lock(&wl->mutex);
4670         dev = wl->current_dev;
4671         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4672                 /* Disable CFP update during scan on other channels. */
4673                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4674         }
4675         mutex_unlock(&wl->mutex);
4676 }
4677
4678 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4679 {
4680         struct b43_wl *wl = hw_to_b43_wl(hw);
4681         struct b43_wldev *dev;
4682
4683         mutex_lock(&wl->mutex);
4684         dev = wl->current_dev;
4685         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4686                 /* Re-enable CFP update. */
4687                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4688         }
4689         mutex_unlock(&wl->mutex);
4690 }
4691
4692 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4693                              struct survey_info *survey)
4694 {
4695         struct b43_wl *wl = hw_to_b43_wl(hw);
4696         struct b43_wldev *dev = wl->current_dev;
4697         struct ieee80211_conf *conf = &hw->conf;
4698
4699         if (idx != 0)
4700                 return -ENOENT;
4701
4702         survey->channel = conf->channel;
4703         survey->filled = SURVEY_INFO_NOISE_DBM;
4704         survey->noise = dev->stats.link_noise;
4705
4706         return 0;
4707 }
4708
4709 static const struct ieee80211_ops b43_hw_ops = {
4710         .tx                     = b43_op_tx,
4711         .conf_tx                = b43_op_conf_tx,
4712         .add_interface          = b43_op_add_interface,
4713         .remove_interface       = b43_op_remove_interface,
4714         .config                 = b43_op_config,
4715         .bss_info_changed       = b43_op_bss_info_changed,
4716         .configure_filter       = b43_op_configure_filter,
4717         .set_key                = b43_op_set_key,
4718         .update_tkip_key        = b43_op_update_tkip_key,
4719         .get_stats              = b43_op_get_stats,
4720         .get_tsf                = b43_op_get_tsf,
4721         .set_tsf                = b43_op_set_tsf,
4722         .start                  = b43_op_start,
4723         .stop                   = b43_op_stop,
4724         .set_tim                = b43_op_beacon_set_tim,
4725         .sta_notify             = b43_op_sta_notify,
4726         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4727         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4728         .get_survey             = b43_op_get_survey,
4729         .rfkill_poll            = b43_rfkill_poll,
4730 };
4731
4732 /* Hard-reset the chip. Do not call this directly.
4733  * Use b43_controller_restart()
4734  */
4735 static void b43_chip_reset(struct work_struct *work)
4736 {
4737         struct b43_wldev *dev =
4738             container_of(work, struct b43_wldev, restart_work);
4739         struct b43_wl *wl = dev->wl;
4740         int err = 0;
4741         int prev_status;
4742
4743         mutex_lock(&wl->mutex);
4744
4745         prev_status = b43_status(dev);
4746         /* Bring the device down... */
4747         if (prev_status >= B43_STAT_STARTED) {
4748                 dev = b43_wireless_core_stop(dev);
4749                 if (!dev) {
4750                         err = -ENODEV;
4751                         goto out;
4752                 }
4753         }
4754         if (prev_status >= B43_STAT_INITIALIZED)
4755                 b43_wireless_core_exit(dev);
4756
4757         /* ...and up again. */
4758         if (prev_status >= B43_STAT_INITIALIZED) {
4759                 err = b43_wireless_core_init(dev);
4760                 if (err)
4761                         goto out;
4762         }
4763         if (prev_status >= B43_STAT_STARTED) {
4764                 err = b43_wireless_core_start(dev);
4765                 if (err) {
4766                         b43_wireless_core_exit(dev);
4767                         goto out;
4768                 }
4769         }
4770 out:
4771         if (err)
4772                 wl->current_dev = NULL; /* Failed to init the dev. */
4773         mutex_unlock(&wl->mutex);
4774         if (err)
4775                 b43err(wl, "Controller restart FAILED\n");
4776         else
4777                 b43info(wl, "Controller restarted\n");
4778 }
4779
4780 static int b43_setup_bands(struct b43_wldev *dev,
4781                            bool have_2ghz_phy, bool have_5ghz_phy)
4782 {
4783         struct ieee80211_hw *hw = dev->wl->hw;
4784
4785         if (have_2ghz_phy)
4786                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4787         if (dev->phy.type == B43_PHYTYPE_N) {
4788                 if (have_5ghz_phy)
4789                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4790         } else {
4791                 if (have_5ghz_phy)
4792                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4793         }
4794
4795         dev->phy.supports_2ghz = have_2ghz_phy;
4796         dev->phy.supports_5ghz = have_5ghz_phy;
4797
4798         return 0;
4799 }
4800
4801 static void b43_wireless_core_detach(struct b43_wldev *dev)
4802 {
4803         /* We release firmware that late to not be required to re-request
4804          * is all the time when we reinit the core. */
4805         b43_release_firmware(dev);
4806         b43_phy_free(dev);
4807 }
4808
4809 static int b43_wireless_core_attach(struct b43_wldev *dev)
4810 {
4811         struct b43_wl *wl = dev->wl;
4812         struct pci_dev *pdev = NULL;
4813         int err;
4814         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4815
4816         /* Do NOT do any device initialization here.
4817          * Do it in wireless_core_init() instead.
4818          * This function is for gathering basic information about the HW, only.
4819          * Also some structs may be set up here. But most likely you want to have
4820          * that in core_init(), too.
4821          */
4822
4823 #ifdef CONFIG_B43_SSB
4824         if (dev->dev->bus_type == B43_BUS_SSB &&
4825             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
4826                 pdev = dev->dev->sdev->bus->host_pci;
4827 #endif
4828
4829         err = b43_bus_powerup(dev, 0);
4830         if (err) {
4831                 b43err(wl, "Bus powerup failed\n");
4832                 goto out;
4833         }
4834
4835         /* Get the PHY type. */
4836         switch (dev->dev->bus_type) {
4837 #ifdef CONFIG_B43_SSB
4838         case B43_BUS_SSB:
4839                 if (dev->dev->core_rev >= 5) {
4840                         u32 tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
4841                         have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4842                         have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4843                 } else
4844                         B43_WARN_ON(1);
4845                 break;
4846 #endif
4847         }
4848
4849         dev->phy.gmode = have_2ghz_phy;
4850         dev->phy.radio_on = 1;
4851         b43_wireless_core_reset(dev, dev->phy.gmode);
4852
4853         err = b43_phy_versioning(dev);
4854         if (err)
4855                 goto err_powerdown;
4856         /* Check if this device supports multiband. */
4857         if (!pdev ||
4858             (pdev->device != 0x4312 &&
4859              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4860                 /* No multiband support. */
4861                 have_2ghz_phy = 0;
4862                 have_5ghz_phy = 0;
4863                 switch (dev->phy.type) {
4864                 case B43_PHYTYPE_A:
4865                         have_5ghz_phy = 1;
4866                         break;
4867                 case B43_PHYTYPE_LP: //FIXME not always!
4868 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4869                         have_5ghz_phy = 1;
4870 #endif
4871                 case B43_PHYTYPE_G:
4872                 case B43_PHYTYPE_N:
4873                         have_2ghz_phy = 1;
4874                         break;
4875                 default:
4876                         B43_WARN_ON(1);
4877                 }
4878         }
4879         if (dev->phy.type == B43_PHYTYPE_A) {
4880                 /* FIXME */
4881                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4882                 err = -EOPNOTSUPP;
4883                 goto err_powerdown;
4884         }
4885         if (1 /* disable A-PHY */) {
4886                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4887                 if (dev->phy.type != B43_PHYTYPE_N &&
4888                     dev->phy.type != B43_PHYTYPE_LP) {
4889                         have_2ghz_phy = 1;
4890                         have_5ghz_phy = 0;
4891                 }
4892         }
4893
4894         err = b43_phy_allocate(dev);
4895         if (err)
4896                 goto err_powerdown;
4897
4898         dev->phy.gmode = have_2ghz_phy;
4899         b43_wireless_core_reset(dev, dev->phy.gmode);
4900
4901         err = b43_validate_chipaccess(dev);
4902         if (err)
4903                 goto err_phy_free;
4904         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4905         if (err)
4906                 goto err_phy_free;
4907
4908         /* Now set some default "current_dev" */
4909         if (!wl->current_dev)
4910                 wl->current_dev = dev;
4911         INIT_WORK(&dev->restart_work, b43_chip_reset);
4912
4913         dev->phy.ops->switch_analog(dev, 0);
4914         b43_device_disable(dev, 0);
4915         b43_bus_may_powerdown(dev);
4916
4917 out:
4918         return err;
4919
4920 err_phy_free:
4921         b43_phy_free(dev);
4922 err_powerdown:
4923         b43_bus_may_powerdown(dev);
4924         return err;
4925 }
4926
4927 static void b43_one_core_detach(struct b43_bus_dev *dev)
4928 {
4929         struct b43_wldev *wldev;
4930         struct b43_wl *wl;
4931
4932         /* Do not cancel ieee80211-workqueue based work here.
4933          * See comment in b43_remove(). */
4934
4935         wldev = ssb_get_drvdata(dev->sdev);
4936         wl = wldev->wl;
4937         b43_debugfs_remove_device(wldev);
4938         b43_wireless_core_detach(wldev);
4939         list_del(&wldev->list);
4940         wl->nr_devs--;
4941         ssb_set_drvdata(dev->sdev, NULL);
4942         kfree(wldev);
4943 }
4944
4945 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
4946 {
4947         struct b43_wldev *wldev;
4948         int err = -ENOMEM;
4949
4950         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4951         if (!wldev)
4952                 goto out;
4953
4954         wldev->use_pio = b43_modparam_pio;
4955         wldev->dev = dev;
4956         wldev->wl = wl;
4957         b43_set_status(wldev, B43_STAT_UNINIT);
4958         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4959         INIT_LIST_HEAD(&wldev->list);
4960
4961         err = b43_wireless_core_attach(wldev);
4962         if (err)
4963                 goto err_kfree_wldev;
4964
4965         list_add(&wldev->list, &wl->devlist);
4966         wl->nr_devs++;
4967         ssb_set_drvdata(dev->sdev, wldev);
4968         b43_debugfs_add_device(wldev);
4969
4970       out:
4971         return err;
4972
4973       err_kfree_wldev:
4974         kfree(wldev);
4975         return err;
4976 }
4977
4978 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4979         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4980         (pdev->device == _device) &&                                    \
4981         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4982         (pdev->subsystem_device == _subdevice)                          )
4983
4984 static void b43_sprom_fixup(struct ssb_bus *bus)
4985 {
4986         struct pci_dev *pdev;
4987
4988         /* boardflags workarounds */
4989         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4990             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4991                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4992         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4993             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4994                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4995         if (bus->bustype == SSB_BUSTYPE_PCI) {
4996                 pdev = bus->host_pci;
4997                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4998                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4999                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5000                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5001                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5002                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5003                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5004                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5005         }
5006 }
5007
5008 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5009 {
5010         struct ieee80211_hw *hw = wl->hw;
5011
5012         ssb_set_devtypedata(dev->sdev, NULL);
5013         ieee80211_free_hw(hw);
5014 }
5015
5016 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5017 {
5018         struct ssb_sprom *sprom = dev->bus_sprom;
5019         struct ieee80211_hw *hw;
5020         struct b43_wl *wl;
5021
5022         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5023         if (!hw) {
5024                 b43err(NULL, "Could not allocate ieee80211 device\n");
5025                 return ERR_PTR(-ENOMEM);
5026         }
5027         wl = hw_to_b43_wl(hw);
5028
5029         /* fill hw info */
5030         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5031                     IEEE80211_HW_SIGNAL_DBM;
5032
5033         hw->wiphy->interface_modes =
5034                 BIT(NL80211_IFTYPE_AP) |
5035                 BIT(NL80211_IFTYPE_MESH_POINT) |
5036                 BIT(NL80211_IFTYPE_STATION) |
5037                 BIT(NL80211_IFTYPE_WDS) |
5038                 BIT(NL80211_IFTYPE_ADHOC);
5039
5040         hw->queues = modparam_qos ? 4 : 1;
5041         wl->mac80211_initially_registered_queues = hw->queues;
5042         hw->max_rates = 2;
5043         SET_IEEE80211_DEV(hw, dev->dev);
5044         if (is_valid_ether_addr(sprom->et1mac))
5045                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5046         else
5047                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5048
5049         /* Initialize struct b43_wl */
5050         wl->hw = hw;
5051         mutex_init(&wl->mutex);
5052         spin_lock_init(&wl->hardirq_lock);
5053         INIT_LIST_HEAD(&wl->devlist);
5054         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5055         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5056         INIT_WORK(&wl->tx_work, b43_tx_work);
5057         skb_queue_head_init(&wl->tx_queue);
5058
5059         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
5060                 dev->chip_id, dev->core_rev);
5061         return wl;
5062 }
5063
5064 #ifdef CONFIG_B43_BCMA
5065 static int b43_bcma_probe(struct bcma_device *core)
5066 {
5067         struct b43_bus_dev *dev;
5068
5069         dev = b43_bus_dev_bcma_init(core);
5070         if (!dev)
5071                 return -ENODEV;
5072
5073         b43err(NULL, "BCMA is not supported yet!");
5074         kfree(dev);
5075         return -EOPNOTSUPP;
5076 }
5077
5078 static void b43_bcma_remove(struct bcma_device *core)
5079 {
5080         /* TODO */
5081 }
5082
5083 static struct bcma_driver b43_bcma_driver = {
5084         .name           = KBUILD_MODNAME,
5085         .id_table       = b43_bcma_tbl,
5086         .probe          = b43_bcma_probe,
5087         .remove         = b43_bcma_remove,
5088 };
5089 #endif
5090
5091 #ifdef CONFIG_B43_SSB
5092 static
5093 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5094 {
5095         struct b43_bus_dev *dev;
5096         struct b43_wl *wl;
5097         int err;
5098         int first = 0;
5099
5100         dev = b43_bus_dev_ssb_init(sdev);
5101         if (!dev)
5102                 return -ENOMEM;
5103
5104         wl = ssb_get_devtypedata(sdev);
5105         if (!wl) {
5106                 /* Probing the first core. Must setup common struct b43_wl */
5107                 first = 1;
5108                 b43_sprom_fixup(sdev->bus);
5109                 wl = b43_wireless_init(dev);
5110                 if (IS_ERR(wl)) {
5111                         err = PTR_ERR(wl);
5112                         goto out;
5113                 }
5114                 ssb_set_devtypedata(sdev, wl);
5115                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5116         }
5117         err = b43_one_core_attach(dev, wl);
5118         if (err)
5119                 goto err_wireless_exit;
5120
5121         if (first) {
5122                 err = ieee80211_register_hw(wl->hw);
5123                 if (err)
5124                         goto err_one_core_detach;
5125                 b43_leds_register(wl->current_dev);
5126         }
5127
5128       out:
5129         return err;
5130
5131       err_one_core_detach:
5132         b43_one_core_detach(dev);
5133       err_wireless_exit:
5134         if (first)
5135                 b43_wireless_exit(dev, wl);
5136         return err;
5137 }
5138
5139 static void b43_ssb_remove(struct ssb_device *sdev)
5140 {
5141         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5142         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5143
5144         /* We must cancel any work here before unregistering from ieee80211,
5145          * as the ieee80211 unreg will destroy the workqueue. */
5146         cancel_work_sync(&wldev->restart_work);
5147
5148         B43_WARN_ON(!wl);
5149         if (wl->current_dev == wldev) {
5150                 /* Restore the queues count before unregistering, because firmware detect
5151                  * might have modified it. Restoring is important, so the networking
5152                  * stack can properly free resources. */
5153                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5154                 b43_leds_stop(wldev);
5155                 ieee80211_unregister_hw(wl->hw);
5156         }
5157
5158         b43_one_core_detach(wldev->dev);
5159
5160         if (list_empty(&wl->devlist)) {
5161                 b43_leds_unregister(wl);
5162                 /* Last core on the chip unregistered.
5163                  * We can destroy common struct b43_wl.
5164                  */
5165                 b43_wireless_exit(wldev->dev, wl);
5166         }
5167 }
5168
5169 static struct ssb_driver b43_ssb_driver = {
5170         .name           = KBUILD_MODNAME,
5171         .id_table       = b43_ssb_tbl,
5172         .probe          = b43_ssb_probe,
5173         .remove         = b43_ssb_remove,
5174 };
5175 #endif /* CONFIG_B43_SSB */
5176
5177 /* Perform a hardware reset. This can be called from any context. */
5178 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5179 {
5180         /* Must avoid requeueing, if we are in shutdown. */
5181         if (b43_status(dev) < B43_STAT_INITIALIZED)
5182                 return;
5183         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5184         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5185 }
5186
5187 static void b43_print_driverinfo(void)
5188 {
5189         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5190                    *feat_leds = "", *feat_sdio = "";
5191
5192 #ifdef CONFIG_B43_PCI_AUTOSELECT
5193         feat_pci = "P";
5194 #endif
5195 #ifdef CONFIG_B43_PCMCIA
5196         feat_pcmcia = "M";
5197 #endif
5198 #ifdef CONFIG_B43_PHY_N
5199         feat_nphy = "N";
5200 #endif
5201 #ifdef CONFIG_B43_LEDS
5202         feat_leds = "L";
5203 #endif
5204 #ifdef CONFIG_B43_SDIO
5205         feat_sdio = "S";
5206 #endif
5207         printk(KERN_INFO "Broadcom 43xx driver loaded "
5208                "[ Features: %s%s%s%s%s, Firmware-ID: "
5209                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5210                feat_pci, feat_pcmcia, feat_nphy,
5211                feat_leds, feat_sdio);
5212 }
5213
5214 static int __init b43_init(void)
5215 {
5216         int err;
5217
5218         b43_debugfs_init();
5219         err = b43_pcmcia_init();
5220         if (err)
5221                 goto err_dfs_exit;
5222         err = b43_sdio_init();
5223         if (err)
5224                 goto err_pcmcia_exit;
5225 #ifdef CONFIG_B43_BCMA
5226         err = bcma_driver_register(&b43_bcma_driver);
5227         if (err)
5228                 goto err_sdio_exit;
5229 #endif
5230 #ifdef CONFIG_B43_SSB
5231         err = ssb_driver_register(&b43_ssb_driver);
5232         if (err)
5233                 goto err_bcma_driver_exit;
5234 #endif
5235         b43_print_driverinfo();
5236
5237         return err;
5238
5239 #ifdef CONFIG_B43_SSB
5240 err_bcma_driver_exit:
5241 #endif
5242 #ifdef CONFIG_B43_BCMA
5243         bcma_driver_unregister(&b43_bcma_driver);
5244 err_sdio_exit:
5245 #endif
5246         b43_sdio_exit();
5247 err_pcmcia_exit:
5248         b43_pcmcia_exit();
5249 err_dfs_exit:
5250         b43_debugfs_exit();
5251         return err;
5252 }
5253
5254 static void __exit b43_exit(void)
5255 {
5256 #ifdef CONFIG_B43_SSB
5257         ssb_driver_unregister(&b43_ssb_driver);
5258 #endif
5259 #ifdef CONFIG_B43_BCMA
5260         bcma_driver_unregister(&b43_bcma_driver);
5261 #endif
5262         b43_sdio_exit();
5263         b43_pcmcia_exit();
5264         b43_debugfs_exit();
5265 }
5266
5267 module_init(b43_init)
5268 module_exit(b43_exit)