drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 static int modparam_qos = 1;
  84 module_param_named(qos, modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
  92 module_param_named(verbose, b43_modparam_verbose, int, 0644);
  93 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
  94
  95
  96 static const struct ssb_device_id b43_ssb_tbl[] = {
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 100         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 106         SSB_DEVTABLE_END
 107 };
 108
 109 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 110
 111 /* Channel and ratetables are shared for all devices.
 112  * They can't be const, because ieee80211 puts some precalculated
 113  * data in there. This data is the same for all devices, so we don't
 114  * get concurrency issues */
 115 #define RATETAB_ENT(_rateid, _flags) \
 116         {                                                               \
 117                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 118                 .hw_value       = (_rateid),                            \
 119                 .flags          = (_flags),                             \
 120         }
 121
 122 /*
 123  * NOTE: When changing this, sync with xmit.c's
 124  *       b43_plcp_get_bitrate_idx_* functions!
 125  */
 126 static struct ieee80211_rate __b43_ratetable[] = {
 127         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 128         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 133         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 134         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 135         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 136         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 137         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 138         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 139 };
 140
 141 #define b43_a_ratetable         (__b43_ratetable + 4)
 142 #define b43_a_ratetable_size    8
 143 #define b43_b_ratetable         (__b43_ratetable + 0)
 144 #define b43_b_ratetable_size    4
 145 #define b43_g_ratetable         (__b43_ratetable + 0)
 146 #define b43_g_ratetable_size    12
 147
 148 #define CHAN4G(_channel, _freq, _flags) {                       \
 149         .band                   = IEEE80211_BAND_2GHZ,          \
 150         .center_freq            = (_freq),                      \
 151         .hw_value               = (_channel),                   \
 152         .flags                  = (_flags),                     \
 153         .max_antenna_gain       = 0,                            \
 154         .max_power              = 30,                           \
 155 }
 156 static struct ieee80211_channel b43_2ghz_chantable[] = {
 157         CHAN4G(1, 2412, 0),
 158         CHAN4G(2, 2417, 0),
 159         CHAN4G(3, 2422, 0),
 160         CHAN4G(4, 2427, 0),
 161         CHAN4G(5, 2432, 0),
 162         CHAN4G(6, 2437, 0),
 163         CHAN4G(7, 2442, 0),
 164         CHAN4G(8, 2447, 0),
 165         CHAN4G(9, 2452, 0),
 166         CHAN4G(10, 2457, 0),
 167         CHAN4G(11, 2462, 0),
 168         CHAN4G(12, 2467, 0),
 169         CHAN4G(13, 2472, 0),
 170         CHAN4G(14, 2484, 0),
 171 };
 172 #undef CHAN4G
 173
 174 #define CHAN5G(_channel, _flags) {                              \
 175         .band                   = IEEE80211_BAND_5GHZ,          \
 176         .center_freq            = 5000 + (5 * (_channel)),      \
 177         .hw_value               = (_channel),                   \
 178         .flags                  = (_flags),                     \
 179         .max_antenna_gain       = 0,                            \
 180         .max_power              = 30,                           \
 181 }
 182 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 183         CHAN5G(32, 0),          CHAN5G(34, 0),
 184         CHAN5G(36, 0),          CHAN5G(38, 0),
 185         CHAN5G(40, 0),          CHAN5G(42, 0),
 186         CHAN5G(44, 0),          CHAN5G(46, 0),
 187         CHAN5G(48, 0),          CHAN5G(50, 0),
 188         CHAN5G(52, 0),          CHAN5G(54, 0),
 189         CHAN5G(56, 0),          CHAN5G(58, 0),
 190         CHAN5G(60, 0),          CHAN5G(62, 0),
 191         CHAN5G(64, 0),          CHAN5G(66, 0),
 192         CHAN5G(68, 0),          CHAN5G(70, 0),
 193         CHAN5G(72, 0),          CHAN5G(74, 0),
 194         CHAN5G(76, 0),          CHAN5G(78, 0),
 195         CHAN5G(80, 0),          CHAN5G(82, 0),
 196         CHAN5G(84, 0),          CHAN5G(86, 0),
 197         CHAN5G(88, 0),          CHAN5G(90, 0),
 198         CHAN5G(92, 0),          CHAN5G(94, 0),
 199         CHAN5G(96, 0),          CHAN5G(98, 0),
 200         CHAN5G(100, 0),         CHAN5G(102, 0),
 201         CHAN5G(104, 0),         CHAN5G(106, 0),
 202         CHAN5G(108, 0),         CHAN5G(110, 0),
 203         CHAN5G(112, 0),         CHAN5G(114, 0),
 204         CHAN5G(116, 0),         CHAN5G(118, 0),
 205         CHAN5G(120, 0),         CHAN5G(122, 0),
 206         CHAN5G(124, 0),         CHAN5G(126, 0),
 207         CHAN5G(128, 0),         CHAN5G(130, 0),
 208         CHAN5G(132, 0),         CHAN5G(134, 0),
 209         CHAN5G(136, 0),         CHAN5G(138, 0),
 210         CHAN5G(140, 0),         CHAN5G(142, 0),
 211         CHAN5G(144, 0),         CHAN5G(145, 0),
 212         CHAN5G(146, 0),         CHAN5G(147, 0),
 213         CHAN5G(148, 0),         CHAN5G(149, 0),
 214         CHAN5G(150, 0),         CHAN5G(151, 0),
 215         CHAN5G(152, 0),         CHAN5G(153, 0),
 216         CHAN5G(154, 0),         CHAN5G(155, 0),
 217         CHAN5G(156, 0),         CHAN5G(157, 0),
 218         CHAN5G(158, 0),         CHAN5G(159, 0),
 219         CHAN5G(160, 0),         CHAN5G(161, 0),
 220         CHAN5G(162, 0),         CHAN5G(163, 0),
 221         CHAN5G(164, 0),         CHAN5G(165, 0),
 222         CHAN5G(166, 0),         CHAN5G(168, 0),
 223         CHAN5G(170, 0),         CHAN5G(172, 0),
 224         CHAN5G(174, 0),         CHAN5G(176, 0),
 225         CHAN5G(178, 0),         CHAN5G(180, 0),
 226         CHAN5G(182, 0),         CHAN5G(184, 0),
 227         CHAN5G(186, 0),         CHAN5G(188, 0),
 228         CHAN5G(190, 0),         CHAN5G(192, 0),
 229         CHAN5G(194, 0),         CHAN5G(196, 0),
 230         CHAN5G(198, 0),         CHAN5G(200, 0),
 231         CHAN5G(202, 0),         CHAN5G(204, 0),
 232         CHAN5G(206, 0),         CHAN5G(208, 0),
 233         CHAN5G(210, 0),         CHAN5G(212, 0),
 234         CHAN5G(214, 0),         CHAN5G(216, 0),
 235         CHAN5G(218, 0),         CHAN5G(220, 0),
 236         CHAN5G(222, 0),         CHAN5G(224, 0),
 237         CHAN5G(226, 0),         CHAN5G(228, 0),
 238 };
 239
 240 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 241         CHAN5G(34, 0),          CHAN5G(36, 0),
 242         CHAN5G(38, 0),          CHAN5G(40, 0),
 243         CHAN5G(42, 0),          CHAN5G(44, 0),
 244         CHAN5G(46, 0),          CHAN5G(48, 0),
 245         CHAN5G(52, 0),          CHAN5G(56, 0),
 246         CHAN5G(60, 0),          CHAN5G(64, 0),
 247         CHAN5G(100, 0),         CHAN5G(104, 0),
 248         CHAN5G(108, 0),         CHAN5G(112, 0),
 249         CHAN5G(116, 0),         CHAN5G(120, 0),
 250         CHAN5G(124, 0),         CHAN5G(128, 0),
 251         CHAN5G(132, 0),         CHAN5G(136, 0),
 252         CHAN5G(140, 0),         CHAN5G(149, 0),
 253         CHAN5G(153, 0),         CHAN5G(157, 0),
 254         CHAN5G(161, 0),         CHAN5G(165, 0),
 255         CHAN5G(184, 0),         CHAN5G(188, 0),
 256         CHAN5G(192, 0),         CHAN5G(196, 0),
 257         CHAN5G(200, 0),         CHAN5G(204, 0),
 258         CHAN5G(208, 0),         CHAN5G(212, 0),
 259         CHAN5G(216, 0),
 260 };
 261 #undef CHAN5G
 262
 263 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 264         .band           = IEEE80211_BAND_5GHZ,
 265         .channels       = b43_5ghz_nphy_chantable,
 266         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 267         .bitrates       = b43_a_ratetable,
 268         .n_bitrates     = b43_a_ratetable_size,
 269 };
 270
 271 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 272         .band           = IEEE80211_BAND_5GHZ,
 273         .channels       = b43_5ghz_aphy_chantable,
 274         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 275         .bitrates       = b43_a_ratetable,
 276         .n_bitrates     = b43_a_ratetable_size,
 277 };
 278
 279 static struct ieee80211_supported_band b43_band_2GHz = {
 280         .band           = IEEE80211_BAND_2GHZ,
 281         .channels       = b43_2ghz_chantable,
 282         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 283         .bitrates       = b43_g_ratetable,
 284         .n_bitrates     = b43_g_ratetable_size,
 285 };
 286
 287 static void b43_wireless_core_exit(struct b43_wldev *dev);
 288 static int b43_wireless_core_init(struct b43_wldev *dev);
 289 static void b43_wireless_core_stop(struct b43_wldev *dev);
 290 static int b43_wireless_core_start(struct b43_wldev *dev);
 291
 292 static int b43_ratelimit(struct b43_wl *wl)
 293 {
 294         if (!wl || !wl->current_dev)
 295                 return 1;
 296         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 297                 return 1;
 298         /* We are up and running.
 299          * Ratelimit the messages to avoid DoS over the net. */
 300         return net_ratelimit();
 301 }
 302
 303 void b43info(struct b43_wl *wl, const char *fmt, ...)
 304 {
 305         va_list args;
 306
 307         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 308                 return;
 309         if (!b43_ratelimit(wl))
 310                 return;
 311         va_start(args, fmt);
 312         printk(KERN_INFO "b43-%s: ",
 313                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 314         vprintk(fmt, args);
 315         va_end(args);
 316 }
 317
 318 void b43err(struct b43_wl *wl, const char *fmt, ...)
 319 {
 320         va_list args;
 321
 322         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 323                 return;
 324         if (!b43_ratelimit(wl))
 325                 return;
 326         va_start(args, fmt);
 327         printk(KERN_ERR "b43-%s ERROR: ",
 328                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 329         vprintk(fmt, args);
 330         va_end(args);
 331 }
 332
 333 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 334 {
 335         va_list args;
 336
 337         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 338                 return;
 339         if (!b43_ratelimit(wl))
 340                 return;
 341         va_start(args, fmt);
 342         printk(KERN_WARNING "b43-%s warning: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347
 348 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 349 {
 350         va_list args;
 351
 352         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 353                 return;
 354         va_start(args, fmt);
 355         printk(KERN_DEBUG "b43-%s debug: ",
 356                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 357         vprintk(fmt, args);
 358         va_end(args);
 359 }
 360
 361 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 362 {
 363         u32 macctl;
 364
 365         B43_WARN_ON(offset % 4 != 0);
 366
 367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 368         if (macctl & B43_MACCTL_BE)
 369                 val = swab32(val);
 370
 371         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 372         mmiowb();
 373         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 374 }
 375
 376 static inline void b43_shm_control_word(struct b43_wldev *dev,
 377                                         u16 routing, u16 offset)
 378 {
 379         u32 control;
 380
 381         /* "offset" is the WORD offset. */
 382         control = routing;
 383         control <<= 16;
 384         control |= offset;
 385         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 386 }
 387
 388 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 389 {
 390         u32 ret;
 391
 392         if (routing == B43_SHM_SHARED) {
 393                 B43_WARN_ON(offset & 0x0001);
 394                 if (offset & 0x0003) {
 395                         /* Unaligned access */
 396                         b43_shm_control_word(dev, routing, offset >> 2);
 397                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 398                         ret <<= 16;
 399                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 400                         ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
 401
 402                         goto out;
 403                 }
 404                 offset >>= 2;
 405         }
 406         b43_shm_control_word(dev, routing, offset);
 407         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 408 out:
 409         return ret;
 410 }
 411
 412 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 413 {
 414         struct b43_wl *wl = dev->wl;
 415         unsigned long flags;
 416         u32 ret;
 417
 418         spin_lock_irqsave(&wl->shm_lock, flags);
 419         ret = __b43_shm_read32(dev, routing, offset);
 420         spin_unlock_irqrestore(&wl->shm_lock, flags);
 421
 422         return ret;
 423 }
 424
 425 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 426 {
 427         u16 ret;
 428
 429         if (routing == B43_SHM_SHARED) {
 430                 B43_WARN_ON(offset & 0x0001);
 431                 if (offset & 0x0003) {
 432                         /* Unaligned access */
 433                         b43_shm_control_word(dev, routing, offset >> 2);
 434                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 435
 436                         goto out;
 437                 }
 438                 offset >>= 2;
 439         }
 440         b43_shm_control_word(dev, routing, offset);
 441         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 442 out:
 443         return ret;
 444 }
 445
 446 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 447 {
 448         struct b43_wl *wl = dev->wl;
 449         unsigned long flags;
 450         u16 ret;
 451
 452         spin_lock_irqsave(&wl->shm_lock, flags);
 453         ret = __b43_shm_read16(dev, routing, offset);
 454         spin_unlock_irqrestore(&wl->shm_lock, flags);
 455
 456         return ret;
 457 }
 458
 459 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 460 {
 461         if (routing == B43_SHM_SHARED) {
 462                 B43_WARN_ON(offset & 0x0001);
 463                 if (offset & 0x0003) {
 464                         /* Unaligned access */
 465                         b43_shm_control_word(dev, routing, offset >> 2);
 466                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 467                                     (value >> 16) & 0xffff);
 468                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 469                         b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
 470                         return;
 471                 }
 472                 offset >>= 2;
 473         }
 474         b43_shm_control_word(dev, routing, offset);
 475         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 476 }
 477
 478 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 479 {
 480         struct b43_wl *wl = dev->wl;
 481         unsigned long flags;
 482
 483         spin_lock_irqsave(&wl->shm_lock, flags);
 484         __b43_shm_write32(dev, routing, offset, value);
 485         spin_unlock_irqrestore(&wl->shm_lock, flags);
 486 }
 487
 488 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 496                         return;
 497                 }
 498                 offset >>= 2;
 499         }
 500         b43_shm_control_word(dev, routing, offset);
 501         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 502 }
 503
 504 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 505 {
 506         struct b43_wl *wl = dev->wl;
 507         unsigned long flags;
 508
 509         spin_lock_irqsave(&wl->shm_lock, flags);
 510         __b43_shm_write16(dev, routing, offset, value);
 511         spin_unlock_irqrestore(&wl->shm_lock, flags);
 512 }
 513
 514 /* Read HostFlags */
 515 u64 b43_hf_read(struct b43_wldev *dev)
 516 {
 517         u64 ret;
 518
 519         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 520         ret <<= 16;
 521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 522         ret <<= 16;
 523         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 524
 525         return ret;
 526 }
 527
 528 /* Write HostFlags */
 529 void b43_hf_write(struct b43_wldev *dev, u64 value)
 530 {
 531         u16 lo, mi, hi;
 532
 533         lo = (value & 0x00000000FFFFULL);
 534         mi = (value & 0x0000FFFF0000ULL) >> 16;
 535         hi = (value & 0xFFFF00000000ULL) >> 32;
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 538         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 539 }
 540
 541 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 542 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 543 {
 544         B43_WARN_ON(!dev->fw.opensource);
 545         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 546 }
 547
 548 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 549 {
 550         u32 low, high;
 551
 552         B43_WARN_ON(dev->dev->id.revision < 3);
 553
 554         /* The hardware guarantees us an atomic read, if we
 555          * read the low register first. */
 556         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 557         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 558
 559         *tsf = high;
 560         *tsf <<= 32;
 561         *tsf |= low;
 562 }
 563
 564 static void b43_time_lock(struct b43_wldev *dev)
 565 {
 566         u32 macctl;
 567
 568         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 569         macctl |= B43_MACCTL_TBTTHOLD;
 570         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 571         /* Commit the write */
 572         b43_read32(dev, B43_MMIO_MACCTL);
 573 }
 574
 575 static void b43_time_unlock(struct b43_wldev *dev)
 576 {
 577         u32 macctl;
 578
 579         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 580         macctl &= ~B43_MACCTL_TBTTHOLD;
 581         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 582         /* Commit the write */
 583         b43_read32(dev, B43_MMIO_MACCTL);
 584 }
 585
 586 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 587 {
 588         u32 low, high;
 589
 590         B43_WARN_ON(dev->dev->id.revision < 3);
 591
 592         low = tsf;
 593         high = (tsf >> 32);
 594         /* The hardware guarantees us an atomic write, if we
 595          * write the low register first. */
 596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 597         mmiowb();
 598         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 599         mmiowb();
 600 }
 601
 602 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 603 {
 604         b43_time_lock(dev);
 605         b43_tsf_write_locked(dev, tsf);
 606         b43_time_unlock(dev);
 607 }
 608
 609 static
 610 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 611 {
 612         static const u8 zero_addr[ETH_ALEN] = { 0 };
 613         u16 data;
 614
 615         if (!mac)
 616                 mac = zero_addr;
 617
 618         offset |= 0x0020;
 619         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 620
 621         data = mac[0];
 622         data |= mac[1] << 8;
 623         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 624         data = mac[2];
 625         data |= mac[3] << 8;
 626         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 627         data = mac[4];
 628         data |= mac[5] << 8;
 629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 630 }
 631
 632 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 633 {
 634         const u8 *mac;
 635         const u8 *bssid;
 636         u8 mac_bssid[ETH_ALEN * 2];
 637         int i;
 638         u32 tmp;
 639
 640         bssid = dev->wl->bssid;
 641         mac = dev->wl->mac_addr;
 642
 643         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 644
 645         memcpy(mac_bssid, mac, ETH_ALEN);
 646         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 647
 648         /* Write our MAC address and BSSID to template ram */
 649         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 650                 tmp = (u32) (mac_bssid[i + 0]);
 651                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 652                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 653                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 654                 b43_ram_write(dev, 0x20 + i, tmp);
 655         }
 656 }
 657
 658 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 659 {
 660         b43_write_mac_bssid_templates(dev);
 661         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 662 }
 663
 664 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 665 {
 666         /* slot_time is in usec. */
 667         if (dev->phy.type != B43_PHYTYPE_G)
 668                 return;
 669         b43_write16(dev, 0x684, 510 + slot_time);
 670         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 671 }
 672
 673 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 674 {
 675         b43_set_slot_time(dev, 9);
 676 }
 677
 678 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 20);
 681 }
 682
 683 /* Synchronize IRQ top- and bottom-half.
 684  * IRQs must be masked before calling this.
 685  * This must not be called with the irq_lock held.
 686  */
 687 static void b43_synchronize_irq(struct b43_wldev *dev)
 688 {
 689         synchronize_irq(dev->dev->irq);
 690         tasklet_kill(&dev->isr_tasklet);
 691 }
 692
 693 /* DummyTransmission function, as documented on
 694  * http://bcm-specs.sipsolutions.net/DummyTransmission
 695  */
 696 void b43_dummy_transmission(struct b43_wldev *dev)
 697 {
 698         struct b43_wl *wl = dev->wl;
 699         struct b43_phy *phy = &dev->phy;
 700         unsigned int i, max_loop;
 701         u16 value;
 702         u32 buffer[5] = {
 703                 0x00000000,
 704                 0x00D40000,
 705                 0x00000000,
 706                 0x01000000,
 707                 0x00000000,
 708         };
 709
 710         switch (phy->type) {
 711         case B43_PHYTYPE_A:
 712                 max_loop = 0x1E;
 713                 buffer[0] = 0x000201CC;
 714                 break;
 715         case B43_PHYTYPE_B:
 716         case B43_PHYTYPE_G:
 717                 max_loop = 0xFA;
 718                 buffer[0] = 0x000B846E;
 719                 break;
 720         default:
 721                 B43_WARN_ON(1);
 722                 return;
 723         }
 724
 725         spin_lock_irq(&wl->irq_lock);
 726         write_lock(&wl->tx_lock);
 727
 728         for (i = 0; i < 5; i++)
 729                 b43_ram_write(dev, i * 4, buffer[i]);
 730
 731         /* Commit writes */
 732         b43_read32(dev, B43_MMIO_MACCTL);
 733
 734         b43_write16(dev, 0x0568, 0x0000);
 735         b43_write16(dev, 0x07C0, 0x0000);
 736         value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
 737         b43_write16(dev, 0x050C, value);
 738         b43_write16(dev, 0x0508, 0x0000);
 739         b43_write16(dev, 0x050A, 0x0000);
 740         b43_write16(dev, 0x054C, 0x0000);
 741         b43_write16(dev, 0x056A, 0x0014);
 742         b43_write16(dev, 0x0568, 0x0826);
 743         b43_write16(dev, 0x0500, 0x0000);
 744         b43_write16(dev, 0x0502, 0x0030);
 745
 746         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 747                 b43_radio_write16(dev, 0x0051, 0x0017);
 748         for (i = 0x00; i < max_loop; i++) {
 749                 value = b43_read16(dev, 0x050E);
 750                 if (value & 0x0080)
 751                         break;
 752                 udelay(10);
 753         }
 754         for (i = 0x00; i < 0x0A; i++) {
 755                 value = b43_read16(dev, 0x050E);
 756                 if (value & 0x0400)
 757                         break;
 758                 udelay(10);
 759         }
 760         for (i = 0x00; i < 0x19; i++) {
 761                 value = b43_read16(dev, 0x0690);
 762                 if (!(value & 0x0100))
 763                         break;
 764                 udelay(10);
 765         }
 766         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 767                 b43_radio_write16(dev, 0x0051, 0x0037);
 768
 769         write_unlock(&wl->tx_lock);
 770         spin_unlock_irq(&wl->irq_lock);
 771 }
 772
 773 static void key_write(struct b43_wldev *dev,
 774                       u8 index, u8 algorithm, const u8 *key)
 775 {
 776         unsigned int i;
 777         u32 offset;
 778         u16 value;
 779         u16 kidx;
 780
 781         /* Key index/algo block */
 782         kidx = b43_kidx_to_fw(dev, index);
 783         value = ((kidx << 4) | algorithm);
 784         b43_shm_write16(dev, B43_SHM_SHARED,
 785                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 786
 787         /* Write the key to the Key Table Pointer offset */
 788         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 789         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 790                 value = key[i];
 791                 value |= (u16) (key[i + 1]) << 8;
 792                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 793         }
 794 }
 795
 796 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 797 {
 798         u32 addrtmp[2] = { 0, 0, };
 799         u8 per_sta_keys_start = 8;
 800
 801         if (b43_new_kidx_api(dev))
 802                 per_sta_keys_start = 4;
 803
 804         B43_WARN_ON(index < per_sta_keys_start);
 805         /* We have two default TX keys and possibly two default RX keys.
 806          * Physical mac 0 is mapped to physical key 4 or 8, depending
 807          * on the firmware version.
 808          * So we must adjust the index here.
 809          */
 810         index -= per_sta_keys_start;
 811
 812         if (addr) {
 813                 addrtmp[0] = addr[0];
 814                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 815                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 816                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 817                 addrtmp[1] = addr[4];
 818                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 819         }
 820
 821         if (dev->dev->id.revision >= 5) {
 822                 /* Receive match transmitter address mechanism */
 823                 b43_shm_write32(dev, B43_SHM_RCMTA,
 824                                 (index * 2) + 0, addrtmp[0]);
 825                 b43_shm_write16(dev, B43_SHM_RCMTA,
 826                                 (index * 2) + 1, addrtmp[1]);
 827         } else {
 828                 /* RXE (Receive Engine) and
 829                  * PSM (Programmable State Machine) mechanism
 830                  */
 831                 if (index < 8) {
 832                         /* TODO write to RCM 16, 19, 22 and 25 */
 833                 } else {
 834                         b43_shm_write32(dev, B43_SHM_SHARED,
 835                                         B43_SHM_SH_PSM + (index * 6) + 0,
 836                                         addrtmp[0]);
 837                         b43_shm_write16(dev, B43_SHM_SHARED,
 838                                         B43_SHM_SH_PSM + (index * 6) + 4,
 839                                         addrtmp[1]);
 840                 }
 841         }
 842 }
 843
 844 static void do_key_write(struct b43_wldev *dev,
 845                          u8 index, u8 algorithm,
 846                          const u8 *key, size_t key_len, const u8 *mac_addr)
 847 {
 848         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 849         u8 per_sta_keys_start = 8;
 850
 851         if (b43_new_kidx_api(dev))
 852                 per_sta_keys_start = 4;
 853
 854         B43_WARN_ON(index >= dev->max_nr_keys);
 855         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 856
 857         if (index >= per_sta_keys_start)
 858                 keymac_write(dev, index, NULL); /* First zero out mac. */
 859         if (key)
 860                 memcpy(buf, key, key_len);
 861         key_write(dev, index, algorithm, buf);
 862         if (index >= per_sta_keys_start)
 863                 keymac_write(dev, index, mac_addr);
 864
 865         dev->key[index].algorithm = algorithm;
 866 }
 867
 868 static int b43_key_write(struct b43_wldev *dev,
 869                          int index, u8 algorithm,
 870                          const u8 *key, size_t key_len,
 871                          const u8 *mac_addr,
 872                          struct ieee80211_key_conf *keyconf)
 873 {
 874         int i;
 875         int sta_keys_start;
 876
 877         if (key_len > B43_SEC_KEYSIZE)
 878                 return -EINVAL;
 879         for (i = 0; i < dev->max_nr_keys; i++) {
 880                 /* Check that we don't already have this key. */
 881                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 882         }
 883         if (index < 0) {
 884                 /* Pairwise key. Get an empty slot for the key. */
 885                 if (b43_new_kidx_api(dev))
 886                         sta_keys_start = 4;
 887                 else
 888                         sta_keys_start = 8;
 889                 for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
 890                         if (!dev->key[i].keyconf) {
 891                                 /* found empty */
 892                                 index = i;
 893                                 break;
 894                         }
 895                 }
 896                 if (index < 0) {
 897                         b43warn(dev->wl, "Out of hardware key memory\n");
 898                         return -ENOSPC;
 899                 }
 900         } else
 901                 B43_WARN_ON(index > 3);
 902
 903         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 904         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 905                 /* Default RX key */
 906                 B43_WARN_ON(mac_addr);
 907                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 908         }
 909         keyconf->hw_key_idx = index;
 910         dev->key[index].keyconf = keyconf;
 911
 912         return 0;
 913 }
 914
 915 static int b43_key_clear(struct b43_wldev *dev, int index)
 916 {
 917         if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
 918                 return -EINVAL;
 919         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 920                      NULL, B43_SEC_KEYSIZE, NULL);
 921         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 922                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 923                              NULL, B43_SEC_KEYSIZE, NULL);
 924         }
 925         dev->key[index].keyconf = NULL;
 926
 927         return 0;
 928 }
 929
 930 static void b43_clear_keys(struct b43_wldev *dev)
 931 {
 932         int i;
 933
 934         for (i = 0; i < dev->max_nr_keys; i++)
 935                 b43_key_clear(dev, i);
 936 }
 937
 938 static void b43_dump_keymemory(struct b43_wldev *dev)
 939 {
 940         unsigned int i, index, offset;
 941         DECLARE_MAC_BUF(macbuf);
 942         u8 mac[ETH_ALEN];
 943         u16 algo;
 944         u32 rcmta0;
 945         u16 rcmta1;
 946         u64 hf;
 947         struct b43_key *key;
 948
 949         if (!b43_debug(dev, B43_DBG_KEYS))
 950                 return;
 951
 952         hf = b43_hf_read(dev);
 953         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
 954                !!(hf & B43_HF_USEDEFKEYS));
 955         for (index = 0; index < dev->max_nr_keys; index++) {
 956                 key = &(dev->key[index]);
 957                 printk(KERN_DEBUG "Key slot %02u: %s",
 958                        index, (key->keyconf == NULL) ? " " : "*");
 959                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 960                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 961                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
 962                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
 963                 }
 964
 965                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
 966                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
 967                 printk("   Algo: %04X/%02X", algo, key->algorithm);
 968
 969                 if (index >= 4) {
 970                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
 971                                                 ((index - 4) * 2) + 0);
 972                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
 973                                                 ((index - 4) * 2) + 1);
 974                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
 975                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
 976                         printk("   MAC: %s",
 977                                print_mac(macbuf, mac));
 978                 } else
 979                         printk("   DEFAULT KEY");
 980                 printk("\n");
 981         }
 982 }
 983
 984 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 985 {
 986         u32 macctl;
 987         u16 ucstat;
 988         bool hwps;
 989         bool awake;
 990         int i;
 991
 992         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
 993                     (ps_flags & B43_PS_DISABLED));
 994         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
 995
 996         if (ps_flags & B43_PS_ENABLED) {
 997                 hwps = 1;
 998         } else if (ps_flags & B43_PS_DISABLED) {
 999                 hwps = 0;
1000         } else {
1001                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1002                 //      and thus is not an AP and we are associated, set bit 25
1003         }
1004         if (ps_flags & B43_PS_AWAKE) {
1005                 awake = 1;
1006         } else if (ps_flags & B43_PS_ASLEEP) {
1007                 awake = 0;
1008         } else {
1009                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1010                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1011                 //      successful, set bit26
1012         }
1013
1014 /* FIXME: For now we force awake-on and hwps-off */
1015         hwps = 0;
1016         awake = 1;
1017
1018         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1019         if (hwps)
1020                 macctl |= B43_MACCTL_HWPS;
1021         else
1022                 macctl &= ~B43_MACCTL_HWPS;
1023         if (awake)
1024                 macctl |= B43_MACCTL_AWAKE;
1025         else
1026                 macctl &= ~B43_MACCTL_AWAKE;
1027         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1028         /* Commit write */
1029         b43_read32(dev, B43_MMIO_MACCTL);
1030         if (awake && dev->dev->id.revision >= 5) {
1031                 /* Wait for the microcode to wake up. */
1032                 for (i = 0; i < 100; i++) {
1033                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1034                                                 B43_SHM_SH_UCODESTAT);
1035                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1036                                 break;
1037                         udelay(10);
1038                 }
1039         }
1040 }
1041
1042 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1043 {
1044         u32 tmslow;
1045         u32 macctl;
1046
1047         flags |= B43_TMSLOW_PHYCLKEN;
1048         flags |= B43_TMSLOW_PHYRESET;
1049         ssb_device_enable(dev->dev, flags);
1050         msleep(2);              /* Wait for the PLL to turn on. */
1051
1052         /* Now take the PHY out of Reset again */
1053         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1054         tmslow |= SSB_TMSLOW_FGC;
1055         tmslow &= ~B43_TMSLOW_PHYRESET;
1056         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1057         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1058         msleep(1);
1059         tmslow &= ~SSB_TMSLOW_FGC;
1060         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1061         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1062         msleep(1);
1063
1064         /* Turn Analog ON, but only if we already know the PHY-type.
1065          * This protects against very early setup where we don't know the
1066          * PHY-type, yet. wireless_core_reset will be called once again later,
1067          * when we know the PHY-type. */
1068         if (dev->phy.ops)
1069                 dev->phy.ops->switch_analog(dev, 1);
1070
1071         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1072         macctl &= ~B43_MACCTL_GMODE;
1073         if (flags & B43_TMSLOW_GMODE)
1074                 macctl |= B43_MACCTL_GMODE;
1075         macctl |= B43_MACCTL_IHR_ENABLED;
1076         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1077 }
1078
1079 static void handle_irq_transmit_status(struct b43_wldev *dev)
1080 {
1081         u32 v0, v1;
1082         u16 tmp;
1083         struct b43_txstatus stat;
1084
1085         while (1) {
1086                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1087                 if (!(v0 & 0x00000001))
1088                         break;
1089                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1090
1091                 stat.cookie = (v0 >> 16);
1092                 stat.seq = (v1 & 0x0000FFFF);
1093                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1094                 tmp = (v0 & 0x0000FFFF);
1095                 stat.frame_count = ((tmp & 0xF000) >> 12);
1096                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1097                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1098                 stat.pm_indicated = !!(tmp & 0x0080);
1099                 stat.intermediate = !!(tmp & 0x0040);
1100                 stat.for_ampdu = !!(tmp & 0x0020);
1101                 stat.acked = !!(tmp & 0x0002);
1102
1103                 b43_handle_txstatus(dev, &stat);
1104         }
1105 }
1106
1107 static void drain_txstatus_queue(struct b43_wldev *dev)
1108 {
1109         u32 dummy;
1110
1111         if (dev->dev->id.revision < 5)
1112                 return;
1113         /* Read all entries from the microcode TXstatus FIFO
1114          * and throw them away.
1115          */
1116         while (1) {
1117                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1118                 if (!(dummy & 0x00000001))
1119                         break;
1120                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1121         }
1122 }
1123
1124 static u32 b43_jssi_read(struct b43_wldev *dev)
1125 {
1126         u32 val = 0;
1127
1128         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1129         val <<= 16;
1130         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1131
1132         return val;
1133 }
1134
1135 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1136 {
1137         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1138         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1139 }
1140
1141 static void b43_generate_noise_sample(struct b43_wldev *dev)
1142 {
1143         b43_jssi_write(dev, 0x7F7F7F7F);
1144         b43_write32(dev, B43_MMIO_MACCMD,
1145                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1146 }
1147
1148 static void b43_calculate_link_quality(struct b43_wldev *dev)
1149 {
1150         /* Top half of Link Quality calculation. */
1151
1152         if (dev->phy.type != B43_PHYTYPE_G)
1153                 return;
1154         if (dev->noisecalc.calculation_running)
1155                 return;
1156         dev->noisecalc.calculation_running = 1;
1157         dev->noisecalc.nr_samples = 0;
1158
1159         b43_generate_noise_sample(dev);
1160 }
1161
1162 static void handle_irq_noise(struct b43_wldev *dev)
1163 {
1164         struct b43_phy_g *phy = dev->phy.g;
1165         u16 tmp;
1166         u8 noise[4];
1167         u8 i, j;
1168         s32 average;
1169
1170         /* Bottom half of Link Quality calculation. */
1171
1172         if (dev->phy.type != B43_PHYTYPE_G)
1173                 return;
1174
1175         /* Possible race condition: It might be possible that the user
1176          * changed to a different channel in the meantime since we
1177          * started the calculation. We ignore that fact, since it's
1178          * not really that much of a problem. The background noise is
1179          * an estimation only anyway. Slightly wrong results will get damped
1180          * by the averaging of the 8 sample rounds. Additionally the
1181          * value is shortlived. So it will be replaced by the next noise
1182          * calculation round soon. */
1183
1184         B43_WARN_ON(!dev->noisecalc.calculation_running);
1185         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1186         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1187             noise[2] == 0x7F || noise[3] == 0x7F)
1188                 goto generate_new;
1189
1190         /* Get the noise samples. */
1191         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1192         i = dev->noisecalc.nr_samples;
1193         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1194         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1195         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1196         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1197         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1198         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1199         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1200         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1201         dev->noisecalc.nr_samples++;
1202         if (dev->noisecalc.nr_samples == 8) {
1203                 /* Calculate the Link Quality by the noise samples. */
1204                 average = 0;
1205                 for (i = 0; i < 8; i++) {
1206                         for (j = 0; j < 4; j++)
1207                                 average += dev->noisecalc.samples[i][j];
1208                 }
1209                 average /= (8 * 4);
1210                 average *= 125;
1211                 average += 64;
1212                 average /= 128;
1213                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1214                 tmp = (tmp / 128) & 0x1F;
1215                 if (tmp >= 8)
1216                         average += 2;
1217                 else
1218                         average -= 25;
1219                 if (tmp == 8)
1220                         average -= 72;
1221                 else
1222                         average -= 48;
1223
1224                 dev->stats.link_noise = average;
1225                 dev->noisecalc.calculation_running = 0;
1226                 return;
1227         }
1228 generate_new:
1229         b43_generate_noise_sample(dev);
1230 }
1231
1232 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1233 {
1234         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1235                 ///TODO: PS TBTT
1236         } else {
1237                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1238                         b43_power_saving_ctl_bits(dev, 0);
1239         }
1240         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1241                 dev->dfq_valid = 1;
1242 }
1243
1244 static void handle_irq_atim_end(struct b43_wldev *dev)
1245 {
1246         if (dev->dfq_valid) {
1247                 b43_write32(dev, B43_MMIO_MACCMD,
1248                             b43_read32(dev, B43_MMIO_MACCMD)
1249                             | B43_MACCMD_DFQ_VALID);
1250                 dev->dfq_valid = 0;
1251         }
1252 }
1253
1254 static void handle_irq_pmq(struct b43_wldev *dev)
1255 {
1256         u32 tmp;
1257
1258         //TODO: AP mode.
1259
1260         while (1) {
1261                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1262                 if (!(tmp & 0x00000008))
1263                         break;
1264         }
1265         /* 16bit write is odd, but correct. */
1266         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1267 }
1268
1269 static void b43_write_template_common(struct b43_wldev *dev,
1270                                       const u8 *data, u16 size,
1271                                       u16 ram_offset,
1272                                       u16 shm_size_offset, u8 rate)
1273 {
1274         u32 i, tmp;
1275         struct b43_plcp_hdr4 plcp;
1276
1277         plcp.data = 0;
1278         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1279         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1280         ram_offset += sizeof(u32);
1281         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1282          * So leave the first two bytes of the next write blank.
1283          */
1284         tmp = (u32) (data[0]) << 16;
1285         tmp |= (u32) (data[1]) << 24;
1286         b43_ram_write(dev, ram_offset, tmp);
1287         ram_offset += sizeof(u32);
1288         for (i = 2; i < size; i += sizeof(u32)) {
1289                 tmp = (u32) (data[i + 0]);
1290                 if (i + 1 < size)
1291                         tmp |= (u32) (data[i + 1]) << 8;
1292                 if (i + 2 < size)
1293                         tmp |= (u32) (data[i + 2]) << 16;
1294                 if (i + 3 < size)
1295                         tmp |= (u32) (data[i + 3]) << 24;
1296                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1297         }
1298         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1299                         size + sizeof(struct b43_plcp_hdr6));
1300 }
1301
1302 /* Check if the use of the antenna that ieee80211 told us to
1303  * use is possible. This will fall back to DEFAULT.
1304  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1305 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1306                                   u8 antenna_nr)
1307 {
1308         u8 antenna_mask;
1309
1310         if (antenna_nr == 0) {
1311                 /* Zero means "use default antenna". That's always OK. */
1312                 return 0;
1313         }
1314
1315         /* Get the mask of available antennas. */
1316         if (dev->phy.gmode)
1317                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1318         else
1319                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1320
1321         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1322                 /* This antenna is not available. Fall back to default. */
1323                 return 0;
1324         }
1325
1326         return antenna_nr;
1327 }
1328
1329 /* Convert a b43 antenna number value to the PHY TX control value. */
1330 static u16 b43_antenna_to_phyctl(int antenna)
1331 {
1332         switch (antenna) {
1333         case B43_ANTENNA0:
1334                 return B43_TXH_PHY_ANT0;
1335         case B43_ANTENNA1:
1336                 return B43_TXH_PHY_ANT1;
1337         case B43_ANTENNA2:
1338                 return B43_TXH_PHY_ANT2;
1339         case B43_ANTENNA3:
1340                 return B43_TXH_PHY_ANT3;
1341         case B43_ANTENNA_AUTO:
1342                 return B43_TXH_PHY_ANT01AUTO;
1343         }
1344         B43_WARN_ON(1);
1345         return 0;
1346 }
1347
1348 static void b43_write_beacon_template(struct b43_wldev *dev,
1349                                       u16 ram_offset,
1350                                       u16 shm_size_offset)
1351 {
1352         unsigned int i, len, variable_len;
1353         const struct ieee80211_mgmt *bcn;
1354         const u8 *ie;
1355         bool tim_found = 0;
1356         unsigned int rate;
1357         u16 ctl;
1358         int antenna;
1359         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1360
1361         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1362         len = min((size_t) dev->wl->current_beacon->len,
1363                   0x200 - sizeof(struct b43_plcp_hdr6));
1364         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1365
1366         b43_write_template_common(dev, (const u8 *)bcn,
1367                                   len, ram_offset, shm_size_offset, rate);
1368
1369         /* Write the PHY TX control parameters. */
1370         antenna = B43_ANTENNA_DEFAULT;
1371         antenna = b43_antenna_to_phyctl(antenna);
1372         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1373         /* We can't send beacons with short preamble. Would get PHY errors. */
1374         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1375         ctl &= ~B43_TXH_PHY_ANT;
1376         ctl &= ~B43_TXH_PHY_ENC;
1377         ctl |= antenna;
1378         if (b43_is_cck_rate(rate))
1379                 ctl |= B43_TXH_PHY_ENC_CCK;
1380         else
1381                 ctl |= B43_TXH_PHY_ENC_OFDM;
1382         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1383
1384         /* Find the position of the TIM and the DTIM_period value
1385          * and write them to SHM. */
1386         ie = bcn->u.beacon.variable;
1387         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1388         for (i = 0; i < variable_len - 2; ) {
1389                 uint8_t ie_id, ie_len;
1390
1391                 ie_id = ie[i];
1392                 ie_len = ie[i + 1];
1393                 if (ie_id == 5) {
1394                         u16 tim_position;
1395                         u16 dtim_period;
1396                         /* This is the TIM Information Element */
1397
1398                         /* Check whether the ie_len is in the beacon data range. */
1399                         if (variable_len < ie_len + 2 + i)
1400                                 break;
1401                         /* A valid TIM is at least 4 bytes long. */
1402                         if (ie_len < 4)
1403                                 break;
1404                         tim_found = 1;
1405
1406                         tim_position = sizeof(struct b43_plcp_hdr6);
1407                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1408                         tim_position += i;
1409
1410                         dtim_period = ie[i + 3];
1411
1412                         b43_shm_write16(dev, B43_SHM_SHARED,
1413                                         B43_SHM_SH_TIMBPOS, tim_position);
1414                         b43_shm_write16(dev, B43_SHM_SHARED,
1415                                         B43_SHM_SH_DTIMPER, dtim_period);
1416                         break;
1417                 }
1418                 i += ie_len + 2;
1419         }
1420         if (!tim_found) {
1421                 /*
1422                  * If ucode wants to modify TIM do it behind the beacon, this
1423                  * will happen, for example, when doing mesh networking.
1424                  */
1425                 b43_shm_write16(dev, B43_SHM_SHARED,
1426                                 B43_SHM_SH_TIMBPOS,
1427                                 len + sizeof(struct b43_plcp_hdr6));
1428                 b43_shm_write16(dev, B43_SHM_SHARED,
1429                                 B43_SHM_SH_DTIMPER, 0);
1430         }
1431         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1432 }
1433
1434 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1435                                       u16 shm_offset, u16 size,
1436                                       struct ieee80211_rate *rate)
1437 {
1438         struct b43_plcp_hdr4 plcp;
1439         u32 tmp;
1440         __le16 dur;
1441
1442         plcp.data = 0;
1443         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1444         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1445                                                dev->wl->vif, size,
1446                                                rate);
1447         /* Write PLCP in two parts and timing for packet transfer */
1448         tmp = le32_to_cpu(plcp.data);
1449         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1450         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1451         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1452 }
1453
1454 /* Instead of using custom probe response template, this function
1455  * just patches custom beacon template by:
1456  * 1) Changing packet type
1457  * 2) Patching duration field
1458  * 3) Stripping TIM
1459  */
1460 static const u8 *b43_generate_probe_resp(struct b43_wldev *dev,
1461                                          u16 *dest_size,
1462                                          struct ieee80211_rate *rate)
1463 {
1464         const u8 *src_data;
1465         u8 *dest_data;
1466         u16 src_size, elem_size, src_pos, dest_pos;
1467         __le16 dur;
1468         struct ieee80211_hdr *hdr;
1469         size_t ie_start;
1470
1471         src_size = dev->wl->current_beacon->len;
1472         src_data = (const u8 *)dev->wl->current_beacon->data;
1473
1474         /* Get the start offset of the variable IEs in the packet. */
1475         ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1476         B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1477
1478         if (B43_WARN_ON(src_size < ie_start))
1479                 return NULL;
1480
1481         dest_data = kmalloc(src_size, GFP_ATOMIC);
1482         if (unlikely(!dest_data))
1483                 return NULL;
1484
1485         /* Copy the static data and all Information Elements, except the TIM. */
1486         memcpy(dest_data, src_data, ie_start);
1487         src_pos = ie_start;
1488         dest_pos = ie_start;
1489         for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1490                 elem_size = src_data[src_pos + 1] + 2;
1491                 if (src_data[src_pos] == 5) {
1492                         /* This is the TIM. */
1493                         continue;
1494                 }
1495                 memcpy(dest_data + dest_pos, src_data + src_pos,
1496                        elem_size);
1497                 dest_pos += elem_size;
1498         }
1499         *dest_size = dest_pos;
1500         hdr = (struct ieee80211_hdr *)dest_data;
1501
1502         /* Set the frame control. */
1503         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1504                                          IEEE80211_STYPE_PROBE_RESP);
1505         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1506                                                dev->wl->vif, *dest_size,
1507                                                rate);
1508         hdr->duration_id = dur;
1509
1510         return dest_data;
1511 }
1512
1513 static void b43_write_probe_resp_template(struct b43_wldev *dev,
1514                                           u16 ram_offset,
1515                                           u16 shm_size_offset,
1516                                           struct ieee80211_rate *rate)
1517 {
1518         const u8 *probe_resp_data;
1519         u16 size;
1520
1521         size = dev->wl->current_beacon->len;
1522         probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1523         if (unlikely(!probe_resp_data))
1524                 return;
1525
1526         /* Looks like PLCP headers plus packet timings are stored for
1527          * all possible basic rates
1528          */
1529         b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1530         b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1531         b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1532         b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1533
1534         size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1535         b43_write_template_common(dev, probe_resp_data,
1536                                   size, ram_offset, shm_size_offset,
1537                                   rate->hw_value);
1538         kfree(probe_resp_data);
1539 }
1540
1541 static void b43_upload_beacon0(struct b43_wldev *dev)
1542 {
1543         struct b43_wl *wl = dev->wl;
1544
1545         if (wl->beacon0_uploaded)
1546                 return;
1547         b43_write_beacon_template(dev, 0x68, 0x18);
1548         /* FIXME: Probe resp upload doesn't really belong here,
1549          *        but we don't use that feature anyway. */
1550         b43_write_probe_resp_template(dev, 0x268, 0x4A,
1551                                       &__b43_ratetable[3]);
1552         wl->beacon0_uploaded = 1;
1553 }
1554
1555 static void b43_upload_beacon1(struct b43_wldev *dev)
1556 {
1557         struct b43_wl *wl = dev->wl;
1558
1559         if (wl->beacon1_uploaded)
1560                 return;
1561         b43_write_beacon_template(dev, 0x468, 0x1A);
1562         wl->beacon1_uploaded = 1;
1563 }
1564
1565 static void handle_irq_beacon(struct b43_wldev *dev)
1566 {
1567         struct b43_wl *wl = dev->wl;
1568         u32 cmd, beacon0_valid, beacon1_valid;
1569
1570         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1571             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1572                 return;
1573
1574         /* This is the bottom half of the asynchronous beacon update. */
1575
1576         /* Ignore interrupt in the future. */
1577         dev->irq_mask &= ~B43_IRQ_BEACON;
1578
1579         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1580         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1581         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1582
1583         /* Schedule interrupt manually, if busy. */
1584         if (beacon0_valid && beacon1_valid) {
1585                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1586                 dev->irq_mask |= B43_IRQ_BEACON;
1587                 return;
1588         }
1589
1590         if (unlikely(wl->beacon_templates_virgin)) {
1591                 /* We never uploaded a beacon before.
1592                  * Upload both templates now, but only mark one valid. */
1593                 wl->beacon_templates_virgin = 0;
1594                 b43_upload_beacon0(dev);
1595                 b43_upload_beacon1(dev);
1596                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1597                 cmd |= B43_MACCMD_BEACON0_VALID;
1598                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1599         } else {
1600                 if (!beacon0_valid) {
1601                         b43_upload_beacon0(dev);
1602                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1603                         cmd |= B43_MACCMD_BEACON0_VALID;
1604                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1605                 } else if (!beacon1_valid) {
1606                         b43_upload_beacon1(dev);
1607                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1608                         cmd |= B43_MACCMD_BEACON1_VALID;
1609                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1610                 }
1611         }
1612 }
1613
1614 static void b43_beacon_update_trigger_work(struct work_struct *work)
1615 {
1616         struct b43_wl *wl = container_of(work, struct b43_wl,
1617                                          beacon_update_trigger);
1618         struct b43_wldev *dev;
1619
1620         mutex_lock(&wl->mutex);
1621         dev = wl->current_dev;
1622         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1623                 spin_lock_irq(&wl->irq_lock);
1624                 /* update beacon right away or defer to irq */
1625                 handle_irq_beacon(dev);
1626                 /* The handler might have updated the IRQ mask. */
1627                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1628                 mmiowb();
1629                 spin_unlock_irq(&wl->irq_lock);
1630         }
1631         mutex_unlock(&wl->mutex);
1632 }
1633
1634 /* Asynchronously update the packet templates in template RAM.
1635  * Locking: Requires wl->irq_lock to be locked. */
1636 static void b43_update_templates(struct b43_wl *wl)
1637 {
1638         struct sk_buff *beacon;
1639
1640         /* This is the top half of the ansynchronous beacon update.
1641          * The bottom half is the beacon IRQ.
1642          * Beacon update must be asynchronous to avoid sending an
1643          * invalid beacon. This can happen for example, if the firmware
1644          * transmits a beacon while we are updating it. */
1645
1646         /* We could modify the existing beacon and set the aid bit in
1647          * the TIM field, but that would probably require resizing and
1648          * moving of data within the beacon template.
1649          * Simply request a new beacon and let mac80211 do the hard work. */
1650         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1651         if (unlikely(!beacon))
1652                 return;
1653
1654         if (wl->current_beacon)
1655                 dev_kfree_skb_any(wl->current_beacon);
1656         wl->current_beacon = beacon;
1657         wl->beacon0_uploaded = 0;
1658         wl->beacon1_uploaded = 0;
1659         queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1660 }
1661
1662 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1663 {
1664         b43_time_lock(dev);
1665         if (dev->dev->id.revision >= 3) {
1666                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1667                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1668         } else {
1669                 b43_write16(dev, 0x606, (beacon_int >> 6));
1670                 b43_write16(dev, 0x610, beacon_int);
1671         }
1672         b43_time_unlock(dev);
1673         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1674 }
1675
1676 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1677 {
1678         u16 reason;
1679
1680         /* Read the register that contains the reason code for the panic. */
1681         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1682         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1683
1684         switch (reason) {
1685         default:
1686                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1687                 /* fallthrough */
1688         case B43_FWPANIC_DIE:
1689                 /* Do not restart the controller or firmware.
1690                  * The device is nonfunctional from now on.
1691                  * Restarting would result in this panic to trigger again,
1692                  * so we avoid that recursion. */
1693                 break;
1694         case B43_FWPANIC_RESTART:
1695                 b43_controller_restart(dev, "Microcode panic");
1696                 break;
1697         }
1698 }
1699
1700 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1701 {
1702         unsigned int i, cnt;
1703         u16 reason, marker_id, marker_line;
1704         __le16 *buf;
1705
1706         /* The proprietary firmware doesn't have this IRQ. */
1707         if (!dev->fw.opensource)
1708                 return;
1709
1710         /* Read the register that contains the reason code for this IRQ. */
1711         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1712
1713         switch (reason) {
1714         case B43_DEBUGIRQ_PANIC:
1715                 b43_handle_firmware_panic(dev);
1716                 break;
1717         case B43_DEBUGIRQ_DUMP_SHM:
1718                 if (!B43_DEBUG)
1719                         break; /* Only with driver debugging enabled. */
1720                 buf = kmalloc(4096, GFP_ATOMIC);
1721                 if (!buf) {
1722                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1723                         goto out;
1724                 }
1725                 for (i = 0; i < 4096; i += 2) {
1726                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1727                         buf[i / 2] = cpu_to_le16(tmp);
1728                 }
1729                 b43info(dev->wl, "Shared memory dump:\n");
1730                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1731                                16, 2, buf, 4096, 1);
1732                 kfree(buf);
1733                 break;
1734         case B43_DEBUGIRQ_DUMP_REGS:
1735                 if (!B43_DEBUG)
1736                         break; /* Only with driver debugging enabled. */
1737                 b43info(dev->wl, "Microcode register dump:\n");
1738                 for (i = 0, cnt = 0; i < 64; i++) {
1739                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1740                         if (cnt == 0)
1741                                 printk(KERN_INFO);
1742                         printk("r%02u: 0x%04X  ", i, tmp);
1743                         cnt++;
1744                         if (cnt == 6) {
1745                                 printk("\n");
1746                                 cnt = 0;
1747                         }
1748                 }
1749                 printk("\n");
1750                 break;
1751         case B43_DEBUGIRQ_MARKER:
1752                 if (!B43_DEBUG)
1753                         break; /* Only with driver debugging enabled. */
1754                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1755                                            B43_MARKER_ID_REG);
1756                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1757                                              B43_MARKER_LINE_REG);
1758                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1759                         "at line number %u\n",
1760                         marker_id, marker_line);
1761                 break;
1762         default:
1763                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1764                        reason);
1765         }
1766 out:
1767         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1768         b43_shm_write16(dev, B43_SHM_SCRATCH,
1769                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1770 }
1771
1772 /* Interrupt handler bottom-half */
1773 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1774 {
1775         u32 reason;
1776         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1777         u32 merged_dma_reason = 0;
1778         int i;
1779         unsigned long flags;
1780
1781         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1782
1783         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1784
1785         reason = dev->irq_reason;
1786         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1787                 dma_reason[i] = dev->dma_reason[i];
1788                 merged_dma_reason |= dma_reason[i];
1789         }
1790
1791         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1792                 b43err(dev->wl, "MAC transmission error\n");
1793
1794         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1795                 b43err(dev->wl, "PHY transmission error\n");
1796                 rmb();
1797                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1798                         atomic_set(&dev->phy.txerr_cnt,
1799                                    B43_PHY_TX_BADNESS_LIMIT);
1800                         b43err(dev->wl, "Too many PHY TX errors, "
1801                                         "restarting the controller\n");
1802                         b43_controller_restart(dev, "PHY TX errors");
1803                 }
1804         }
1805
1806         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1807                                           B43_DMAIRQ_NONFATALMASK))) {
1808                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1809                         b43err(dev->wl, "Fatal DMA error: "
1810                                "0x%08X, 0x%08X, 0x%08X, "
1811                                "0x%08X, 0x%08X, 0x%08X\n",
1812                                dma_reason[0], dma_reason[1],
1813                                dma_reason[2], dma_reason[3],
1814                                dma_reason[4], dma_reason[5]);
1815                         b43_controller_restart(dev, "DMA error");
1816                         mmiowb();
1817                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1818                         return;
1819                 }
1820                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1821                         b43err(dev->wl, "DMA error: "
1822                                "0x%08X, 0x%08X, 0x%08X, "
1823                                "0x%08X, 0x%08X, 0x%08X\n",
1824                                dma_reason[0], dma_reason[1],
1825                                dma_reason[2], dma_reason[3],
1826                                dma_reason[4], dma_reason[5]);
1827                 }
1828         }
1829
1830         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1831                 handle_irq_ucode_debug(dev);
1832         if (reason & B43_IRQ_TBTT_INDI)
1833                 handle_irq_tbtt_indication(dev);
1834         if (reason & B43_IRQ_ATIM_END)
1835                 handle_irq_atim_end(dev);
1836         if (reason & B43_IRQ_BEACON)
1837                 handle_irq_beacon(dev);
1838         if (reason & B43_IRQ_PMQ)
1839                 handle_irq_pmq(dev);
1840         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1841                 ;/* TODO */
1842         if (reason & B43_IRQ_NOISESAMPLE_OK)
1843                 handle_irq_noise(dev);
1844
1845         /* Check the DMA reason registers for received data. */
1846         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1847                 if (b43_using_pio_transfers(dev))
1848                         b43_pio_rx(dev->pio.rx_queue);
1849                 else
1850                         b43_dma_rx(dev->dma.rx_ring);
1851         }
1852         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1853         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1854         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1855         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1856         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1857
1858         if (reason & B43_IRQ_TX_OK)
1859                 handle_irq_transmit_status(dev);
1860
1861         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1862         mmiowb();
1863         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1864 }
1865
1866 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1867 {
1868         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1869
1870         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1871         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1872         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1873         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1874         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1875 /* Unused ring
1876         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1877 */
1878 }
1879
1880 /* Interrupt handler top-half */
1881 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1882 {
1883         irqreturn_t ret = IRQ_NONE;
1884         struct b43_wldev *dev = dev_id;
1885         u32 reason;
1886
1887         B43_WARN_ON(!dev);
1888
1889         spin_lock(&dev->wl->irq_lock);
1890
1891         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1892                 /* This can only happen on shared IRQ lines. */
1893                 goto out;
1894         }
1895         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1896         if (reason == 0xffffffff)       /* shared IRQ */
1897                 goto out;
1898         ret = IRQ_HANDLED;
1899         reason &= dev->irq_mask;
1900         if (!reason)
1901                 goto out;
1902
1903         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1904             & 0x0001DC00;
1905         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1906             & 0x0000DC00;
1907         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1908             & 0x0000DC00;
1909         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1910             & 0x0001DC00;
1911         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1912             & 0x0000DC00;
1913 /* Unused ring
1914         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1915             & 0x0000DC00;
1916 */
1917
1918         b43_interrupt_ack(dev, reason);
1919         /* disable all IRQs. They are enabled again in the bottom half. */
1920         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1921         /* save the reason code and call our bottom half. */
1922         dev->irq_reason = reason;
1923         tasklet_schedule(&dev->isr_tasklet);
1924 out:
1925         mmiowb();
1926         spin_unlock(&dev->wl->irq_lock);
1927
1928         return ret;
1929 }
1930
1931 void b43_do_release_fw(struct b43_firmware_file *fw)
1932 {
1933         release_firmware(fw->data);
1934         fw->data = NULL;
1935         fw->filename = NULL;
1936 }
1937
1938 static void b43_release_firmware(struct b43_wldev *dev)
1939 {
1940         b43_do_release_fw(&dev->fw.ucode);
1941         b43_do_release_fw(&dev->fw.pcm);
1942         b43_do_release_fw(&dev->fw.initvals);
1943         b43_do_release_fw(&dev->fw.initvals_band);
1944 }
1945
1946 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1947 {
1948         const char text[] =
1949                 "You must go to " \
1950                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1951                 "and download the correct firmware for this driver version. " \
1952                 "Please carefully read all instructions on this website.\n";
1953
1954         if (error)
1955                 b43err(wl, text);
1956         else
1957                 b43warn(wl, text);
1958 }
1959
1960 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1961                       const char *name,
1962                       struct b43_firmware_file *fw)
1963 {
1964         const struct firmware *blob;
1965         struct b43_fw_header *hdr;
1966         u32 size;
1967         int err;
1968
1969         if (!name) {
1970                 /* Don't fetch anything. Free possibly cached firmware. */
1971                 /* FIXME: We should probably keep it anyway, to save some headache
1972                  * on suspend/resume with multiband devices. */
1973                 b43_do_release_fw(fw);
1974                 return 0;
1975         }
1976         if (fw->filename) {
1977                 if ((fw->type == ctx->req_type) &&
1978                     (strcmp(fw->filename, name) == 0))
1979                         return 0; /* Already have this fw. */
1980                 /* Free the cached firmware first. */
1981                 /* FIXME: We should probably do this later after we successfully
1982                  * got the new fw. This could reduce headache with multiband devices.
1983                  * We could also redesign this to cache the firmware for all possible
1984                  * bands all the time. */
1985                 b43_do_release_fw(fw);
1986         }
1987
1988         switch (ctx->req_type) {
1989         case B43_FWTYPE_PROPRIETARY:
1990                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1991                          "b43%s/%s.fw",
1992                          modparam_fwpostfix, name);
1993                 break;
1994         case B43_FWTYPE_OPENSOURCE:
1995                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1996                          "b43-open%s/%s.fw",
1997                          modparam_fwpostfix, name);
1998                 break;
1999         default:
2000                 B43_WARN_ON(1);
2001                 return -ENOSYS;
2002         }
2003         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2004         if (err == -ENOENT) {
2005                 snprintf(ctx->errors[ctx->req_type],
2006                          sizeof(ctx->errors[ctx->req_type]),
2007                          "Firmware file \"%s\" not found\n", ctx->fwname);
2008                 return err;
2009         } else if (err) {
2010                 snprintf(ctx->errors[ctx->req_type],
2011                          sizeof(ctx->errors[ctx->req_type]),
2012                          "Firmware file \"%s\" request failed (err=%d)\n",
2013                          ctx->fwname, err);
2014                 return err;
2015         }
2016         if (blob->size < sizeof(struct b43_fw_header))
2017                 goto err_format;
2018         hdr = (struct b43_fw_header *)(blob->data);
2019         switch (hdr->type) {
2020         case B43_FW_TYPE_UCODE:
2021         case B43_FW_TYPE_PCM:
2022                 size = be32_to_cpu(hdr->size);
2023                 if (size != blob->size - sizeof(struct b43_fw_header))
2024                         goto err_format;
2025                 /* fallthrough */
2026         case B43_FW_TYPE_IV:
2027                 if (hdr->ver != 1)
2028                         goto err_format;
2029                 break;
2030         default:
2031                 goto err_format;
2032         }
2033
2034         fw->data = blob;
2035         fw->filename = name;
2036         fw->type = ctx->req_type;
2037
2038         return 0;
2039
2040 err_format:
2041         snprintf(ctx->errors[ctx->req_type],
2042                  sizeof(ctx->errors[ctx->req_type]),
2043                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2044         release_firmware(blob);
2045
2046         return -EPROTO;
2047 }
2048
2049 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2050 {
2051         struct b43_wldev *dev = ctx->dev;
2052         struct b43_firmware *fw = &ctx->dev->fw;
2053         const u8 rev = ctx->dev->dev->id.revision;
2054         const char *filename;
2055         u32 tmshigh;
2056         int err;
2057
2058         /* Get microcode */
2059         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2060         if ((rev >= 5) && (rev <= 10))
2061                 filename = "ucode5";
2062         else if ((rev >= 11) && (rev <= 12))
2063                 filename = "ucode11";
2064         else if (rev >= 13)
2065                 filename = "ucode13";
2066         else
2067                 goto err_no_ucode;
2068         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2069         if (err)
2070                 goto err_load;
2071
2072         /* Get PCM code */
2073         if ((rev >= 5) && (rev <= 10))
2074                 filename = "pcm5";
2075         else if (rev >= 11)
2076                 filename = NULL;
2077         else
2078                 goto err_no_pcm;
2079         fw->pcm_request_failed = 0;
2080         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2081         if (err == -ENOENT) {
2082                 /* We did not find a PCM file? Not fatal, but
2083                  * core rev <= 10 must do without hwcrypto then. */
2084                 fw->pcm_request_failed = 1;
2085         } else if (err)
2086                 goto err_load;
2087
2088         /* Get initvals */
2089         switch (dev->phy.type) {
2090         case B43_PHYTYPE_A:
2091                 if ((rev >= 5) && (rev <= 10)) {
2092                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2093                                 filename = "a0g1initvals5";
2094                         else
2095                                 filename = "a0g0initvals5";
2096                 } else
2097                         goto err_no_initvals;
2098                 break;
2099         case B43_PHYTYPE_G:
2100                 if ((rev >= 5) && (rev <= 10))
2101                         filename = "b0g0initvals5";
2102                 else if (rev >= 13)
2103                         filename = "b0g0initvals13";
2104                 else
2105                         goto err_no_initvals;
2106                 break;
2107         case B43_PHYTYPE_N:
2108                 if ((rev >= 11) && (rev <= 12))
2109                         filename = "n0initvals11";
2110                 else
2111                         goto err_no_initvals;
2112                 break;
2113         default:
2114                 goto err_no_initvals;
2115         }
2116         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2117         if (err)
2118                 goto err_load;
2119
2120         /* Get bandswitch initvals */
2121         switch (dev->phy.type) {
2122         case B43_PHYTYPE_A:
2123                 if ((rev >= 5) && (rev <= 10)) {
2124                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2125                                 filename = "a0g1bsinitvals5";
2126                         else
2127                                 filename = "a0g0bsinitvals5";
2128                 } else if (rev >= 11)
2129                         filename = NULL;
2130                 else
2131                         goto err_no_initvals;
2132                 break;
2133         case B43_PHYTYPE_G:
2134                 if ((rev >= 5) && (rev <= 10))
2135                         filename = "b0g0bsinitvals5";
2136                 else if (rev >= 11)
2137                         filename = NULL;
2138                 else
2139                         goto err_no_initvals;
2140                 break;
2141         case B43_PHYTYPE_N:
2142                 if ((rev >= 11) && (rev <= 12))
2143                         filename = "n0bsinitvals11";
2144                 else
2145                         goto err_no_initvals;
2146                 break;
2147         default:
2148                 goto err_no_initvals;
2149         }
2150         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2151         if (err)
2152                 goto err_load;
2153
2154         return 0;
2155
2156 err_no_ucode:
2157         err = ctx->fatal_failure = -EOPNOTSUPP;
2158         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2159                "is required for your device (wl-core rev %u)\n", rev);
2160         goto error;
2161
2162 err_no_pcm:
2163         err = ctx->fatal_failure = -EOPNOTSUPP;
2164         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2165                "is required for your device (wl-core rev %u)\n", rev);
2166         goto error;
2167
2168 err_no_initvals:
2169         err = ctx->fatal_failure = -EOPNOTSUPP;
2170         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2171                "is required for your device (wl-core rev %u)\n", rev);
2172         goto error;
2173
2174 err_load:
2175         /* We failed to load this firmware image. The error message
2176          * already is in ctx->errors. Return and let our caller decide
2177          * what to do. */
2178         goto error;
2179
2180 error:
2181         b43_release_firmware(dev);
2182         return err;
2183 }
2184
2185 static int b43_request_firmware(struct b43_wldev *dev)
2186 {
2187         struct b43_request_fw_context *ctx;
2188         unsigned int i;
2189         int err;
2190         const char *errmsg;
2191
2192         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2193         if (!ctx)
2194                 return -ENOMEM;
2195         ctx->dev = dev;
2196
2197         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2198         err = b43_try_request_fw(ctx);
2199         if (!err)
2200                 goto out; /* Successfully loaded it. */
2201         err = ctx->fatal_failure;
2202         if (err)
2203                 goto out;
2204
2205         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2206         err = b43_try_request_fw(ctx);
2207         if (!err)
2208                 goto out; /* Successfully loaded it. */
2209         err = ctx->fatal_failure;
2210         if (err)
2211                 goto out;
2212
2213         /* Could not find a usable firmware. Print the errors. */
2214         for (i = 0; i < B43_NR_FWTYPES; i++) {
2215                 errmsg = ctx->errors[i];
2216                 if (strlen(errmsg))
2217                         b43err(dev->wl, errmsg);
2218         }
2219         b43_print_fw_helptext(dev->wl, 1);
2220         err = -ENOENT;
2221
2222 out:
2223         kfree(ctx);
2224         return err;
2225 }
2226
2227 static int b43_upload_microcode(struct b43_wldev *dev)
2228 {
2229         const size_t hdr_len = sizeof(struct b43_fw_header);
2230         const __be32 *data;
2231         unsigned int i, len;
2232         u16 fwrev, fwpatch, fwdate, fwtime;
2233         u32 tmp, macctl;
2234         int err = 0;
2235
2236         /* Jump the microcode PSM to offset 0 */
2237         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2238         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2239         macctl |= B43_MACCTL_PSM_JMP0;
2240         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2241         /* Zero out all microcode PSM registers and shared memory. */
2242         for (i = 0; i < 64; i++)
2243                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2244         for (i = 0; i < 4096; i += 2)
2245                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2246
2247         /* Upload Microcode. */
2248         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2249         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2250         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2251         for (i = 0; i < len; i++) {
2252                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2253                 udelay(10);
2254         }
2255
2256         if (dev->fw.pcm.data) {
2257                 /* Upload PCM data. */
2258                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2259                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2260                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2261                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2262                 /* No need for autoinc bit in SHM_HW */
2263                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2264                 for (i = 0; i < len; i++) {
2265                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2266                         udelay(10);
2267                 }
2268         }
2269
2270         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2271
2272         /* Start the microcode PSM */
2273         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2274         macctl &= ~B43_MACCTL_PSM_JMP0;
2275         macctl |= B43_MACCTL_PSM_RUN;
2276         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2277
2278         /* Wait for the microcode to load and respond */
2279         i = 0;
2280         while (1) {
2281                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2282                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2283                         break;
2284                 i++;
2285                 if (i >= 20) {
2286                         b43err(dev->wl, "Microcode not responding\n");
2287                         b43_print_fw_helptext(dev->wl, 1);
2288                         err = -ENODEV;
2289                         goto error;
2290                 }
2291                 msleep_interruptible(50);
2292                 if (signal_pending(current)) {
2293                         err = -EINTR;
2294                         goto error;
2295                 }
2296         }
2297         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2298
2299         /* Get and check the revisions. */
2300         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2301         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2302         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2303         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2304
2305         if (fwrev <= 0x128) {
2306                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2307                        "binary drivers older than version 4.x is unsupported. "
2308                        "You must upgrade your firmware files.\n");
2309                 b43_print_fw_helptext(dev->wl, 1);
2310                 err = -EOPNOTSUPP;
2311                 goto error;
2312         }
2313         dev->fw.rev = fwrev;
2314         dev->fw.patch = fwpatch;
2315         dev->fw.opensource = (fwdate == 0xFFFF);
2316
2317         /* Default to use-all-queues. */
2318         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2319         dev->qos_enabled = !!modparam_qos;
2320         /* Default to firmware/hardware crypto acceleration. */
2321         dev->hwcrypto_enabled = 1;
2322
2323         if (dev->fw.opensource) {
2324                 u16 fwcapa;
2325
2326                 /* Patchlevel info is encoded in the "time" field. */
2327                 dev->fw.patch = fwtime;
2328                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2329                         dev->fw.rev, dev->fw.patch);
2330
2331                 fwcapa = b43_fwcapa_read(dev);
2332                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2333                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2334                         /* Disable hardware crypto and fall back to software crypto. */
2335                         dev->hwcrypto_enabled = 0;
2336                 }
2337                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2338                         b43info(dev->wl, "QoS not supported by firmware\n");
2339                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2340                          * ieee80211_unregister to make sure the networking core can
2341                          * properly free possible resources. */
2342                         dev->wl->hw->queues = 1;
2343                         dev->qos_enabled = 0;
2344                 }
2345         } else {
2346                 b43info(dev->wl, "Loading firmware version %u.%u "
2347                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2348                         fwrev, fwpatch,
2349                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2350                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2351                 if (dev->fw.pcm_request_failed) {
2352                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2353                                 "Hardware accelerated cryptography is disabled.\n");
2354                         b43_print_fw_helptext(dev->wl, 0);
2355                 }
2356         }
2357
2358         if (b43_is_old_txhdr_format(dev)) {
2359                 /* We're over the deadline, but we keep support for old fw
2360                  * until it turns out to be in major conflict with something new. */
2361                 b43warn(dev->wl, "You are using an old firmware image. "
2362                         "Support for old firmware will be removed soon "
2363                         "(official deadline was July 2008).\n");
2364                 b43_print_fw_helptext(dev->wl, 0);
2365         }
2366
2367         return 0;
2368
2369 error:
2370         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2371         macctl &= ~B43_MACCTL_PSM_RUN;
2372         macctl |= B43_MACCTL_PSM_JMP0;
2373         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2374
2375         return err;
2376 }
2377
2378 static int b43_write_initvals(struct b43_wldev *dev,
2379                               const struct b43_iv *ivals,
2380                               size_t count,
2381                               size_t array_size)
2382 {
2383         const struct b43_iv *iv;
2384         u16 offset;
2385         size_t i;
2386         bool bit32;
2387
2388         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2389         iv = ivals;
2390         for (i = 0; i < count; i++) {
2391                 if (array_size < sizeof(iv->offset_size))
2392                         goto err_format;
2393                 array_size -= sizeof(iv->offset_size);
2394                 offset = be16_to_cpu(iv->offset_size);
2395                 bit32 = !!(offset & B43_IV_32BIT);
2396                 offset &= B43_IV_OFFSET_MASK;
2397                 if (offset >= 0x1000)
2398                         goto err_format;
2399                 if (bit32) {
2400                         u32 value;
2401
2402                         if (array_size < sizeof(iv->data.d32))
2403                                 goto err_format;
2404                         array_size -= sizeof(iv->data.d32);
2405
2406                         value = get_unaligned_be32(&iv->data.d32);
2407                         b43_write32(dev, offset, value);
2408
2409                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2410                                                         sizeof(__be16) +
2411                                                         sizeof(__be32));
2412                 } else {
2413                         u16 value;
2414
2415                         if (array_size < sizeof(iv->data.d16))
2416                                 goto err_format;
2417                         array_size -= sizeof(iv->data.d16);
2418
2419                         value = be16_to_cpu(iv->data.d16);
2420                         b43_write16(dev, offset, value);
2421
2422                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2423                                                         sizeof(__be16) +
2424                                                         sizeof(__be16));
2425                 }
2426         }
2427         if (array_size)
2428                 goto err_format;
2429
2430         return 0;
2431
2432 err_format:
2433         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2434         b43_print_fw_helptext(dev->wl, 1);
2435
2436         return -EPROTO;
2437 }
2438
2439 static int b43_upload_initvals(struct b43_wldev *dev)
2440 {
2441         const size_t hdr_len = sizeof(struct b43_fw_header);
2442         const struct b43_fw_header *hdr;
2443         struct b43_firmware *fw = &dev->fw;
2444         const struct b43_iv *ivals;
2445         size_t count;
2446         int err;
2447
2448         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2449         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2450         count = be32_to_cpu(hdr->size);
2451         err = b43_write_initvals(dev, ivals, count,
2452                                  fw->initvals.data->size - hdr_len);
2453         if (err)
2454                 goto out;
2455         if (fw->initvals_band.data) {
2456                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2457                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2458                 count = be32_to_cpu(hdr->size);
2459                 err = b43_write_initvals(dev, ivals, count,
2460                                          fw->initvals_band.data->size - hdr_len);
2461                 if (err)
2462                         goto out;
2463         }
2464 out:
2465
2466         return err;
2467 }
2468
2469 /* Initialize the GPIOs
2470  * http://bcm-specs.sipsolutions.net/GPIO
2471  */
2472 static int b43_gpio_init(struct b43_wldev *dev)
2473 {
2474         struct ssb_bus *bus = dev->dev->bus;
2475         struct ssb_device *gpiodev, *pcidev = NULL;
2476         u32 mask, set;
2477
2478         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2479                     & ~B43_MACCTL_GPOUTSMSK);
2480
2481         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2482                     | 0x000F);
2483
2484         mask = 0x0000001F;
2485         set = 0x0000000F;
2486         if (dev->dev->bus->chip_id == 0x4301) {
2487                 mask |= 0x0060;
2488                 set |= 0x0060;
2489         }
2490         if (0 /* FIXME: conditional unknown */ ) {
2491                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2492                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2493                             | 0x0100);
2494                 mask |= 0x0180;
2495                 set |= 0x0180;
2496         }
2497         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2498                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2499                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2500                             | 0x0200);
2501                 mask |= 0x0200;
2502                 set |= 0x0200;
2503         }
2504         if (dev->dev->id.revision >= 2)
2505                 mask |= 0x0010; /* FIXME: This is redundant. */
2506
2507 #ifdef CONFIG_SSB_DRIVER_PCICORE
2508         pcidev = bus->pcicore.dev;
2509 #endif
2510         gpiodev = bus->chipco.dev ? : pcidev;
2511         if (!gpiodev)
2512                 return 0;
2513         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2514                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2515                      & mask) | set);
2516
2517         return 0;
2518 }
2519
2520 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2521 static void b43_gpio_cleanup(struct b43_wldev *dev)
2522 {
2523         struct ssb_bus *bus = dev->dev->bus;
2524         struct ssb_device *gpiodev, *pcidev = NULL;
2525
2526 #ifdef CONFIG_SSB_DRIVER_PCICORE
2527         pcidev = bus->pcicore.dev;
2528 #endif
2529         gpiodev = bus->chipco.dev ? : pcidev;
2530         if (!gpiodev)
2531                 return;
2532         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2533 }
2534
2535 /* http://bcm-specs.sipsolutions.net/EnableMac */
2536 void b43_mac_enable(struct b43_wldev *dev)
2537 {
2538         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2539                 u16 fwstate;
2540
2541                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2542                                          B43_SHM_SH_UCODESTAT);
2543                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2544                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2545                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2546                                "should be suspended, but current state is %u\n",
2547                                fwstate);
2548                 }
2549         }
2550
2551         dev->mac_suspended--;
2552         B43_WARN_ON(dev->mac_suspended < 0);
2553         if (dev->mac_suspended == 0) {
2554                 b43_write32(dev, B43_MMIO_MACCTL,
2555                             b43_read32(dev, B43_MMIO_MACCTL)
2556                             | B43_MACCTL_ENABLED);
2557                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2558                             B43_IRQ_MAC_SUSPENDED);
2559                 /* Commit writes */
2560                 b43_read32(dev, B43_MMIO_MACCTL);
2561                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2562                 b43_power_saving_ctl_bits(dev, 0);
2563         }
2564 }
2565
2566 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2567 void b43_mac_suspend(struct b43_wldev *dev)
2568 {
2569         int i;
2570         u32 tmp;
2571
2572         might_sleep();
2573         B43_WARN_ON(dev->mac_suspended < 0);
2574
2575         if (dev->mac_suspended == 0) {
2576                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2577                 b43_write32(dev, B43_MMIO_MACCTL,
2578                             b43_read32(dev, B43_MMIO_MACCTL)
2579                             & ~B43_MACCTL_ENABLED);
2580                 /* force pci to flush the write */
2581                 b43_read32(dev, B43_MMIO_MACCTL);
2582                 for (i = 35; i; i--) {
2583                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2584                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2585                                 goto out;
2586                         udelay(10);
2587                 }
2588                 /* Hm, it seems this will take some time. Use msleep(). */
2589                 for (i = 40; i; i--) {
2590                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2591                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2592                                 goto out;
2593                         msleep(1);
2594                 }
2595                 b43err(dev->wl, "MAC suspend failed\n");
2596         }
2597 out:
2598         dev->mac_suspended++;
2599 }
2600
2601 static void b43_adjust_opmode(struct b43_wldev *dev)
2602 {
2603         struct b43_wl *wl = dev->wl;
2604         u32 ctl;
2605         u16 cfp_pretbtt;
2606
2607         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2608         /* Reset status to STA infrastructure mode. */
2609         ctl &= ~B43_MACCTL_AP;
2610         ctl &= ~B43_MACCTL_KEEP_CTL;
2611         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2612         ctl &= ~B43_MACCTL_KEEP_BAD;
2613         ctl &= ~B43_MACCTL_PROMISC;
2614         ctl &= ~B43_MACCTL_BEACPROMISC;
2615         ctl |= B43_MACCTL_INFRA;
2616
2617         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2618             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2619                 ctl |= B43_MACCTL_AP;
2620         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2621                 ctl &= ~B43_MACCTL_INFRA;
2622
2623         if (wl->filter_flags & FIF_CONTROL)
2624                 ctl |= B43_MACCTL_KEEP_CTL;
2625         if (wl->filter_flags & FIF_FCSFAIL)
2626                 ctl |= B43_MACCTL_KEEP_BAD;
2627         if (wl->filter_flags & FIF_PLCPFAIL)
2628                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2629         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2630                 ctl |= B43_MACCTL_PROMISC;
2631         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2632                 ctl |= B43_MACCTL_BEACPROMISC;
2633
2634         /* Workaround: On old hardware the HW-MAC-address-filter
2635          * doesn't work properly, so always run promisc in filter
2636          * it in software. */
2637         if (dev->dev->id.revision <= 4)
2638                 ctl |= B43_MACCTL_PROMISC;
2639
2640         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2641
2642         cfp_pretbtt = 2;
2643         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2644                 if (dev->dev->bus->chip_id == 0x4306 &&
2645                     dev->dev->bus->chip_rev == 3)
2646                         cfp_pretbtt = 100;
2647                 else
2648                         cfp_pretbtt = 50;
2649         }
2650         b43_write16(dev, 0x612, cfp_pretbtt);
2651 }
2652
2653 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2654 {
2655         u16 offset;
2656
2657         if (is_ofdm) {
2658                 offset = 0x480;
2659                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2660         } else {
2661                 offset = 0x4C0;
2662                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2663         }
2664         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2665                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2666 }
2667
2668 static void b43_rate_memory_init(struct b43_wldev *dev)
2669 {
2670         switch (dev->phy.type) {
2671         case B43_PHYTYPE_A:
2672         case B43_PHYTYPE_G:
2673         case B43_PHYTYPE_N:
2674                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2675                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2676                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2677                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2678                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2679                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2680                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2681                 if (dev->phy.type == B43_PHYTYPE_A)
2682                         break;
2683                 /* fallthrough */
2684         case B43_PHYTYPE_B:
2685                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2686                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2687                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2688                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2689                 break;
2690         default:
2691                 B43_WARN_ON(1);
2692         }
2693 }
2694
2695 /* Set the default values for the PHY TX Control Words. */
2696 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2697 {
2698         u16 ctl = 0;
2699
2700         ctl |= B43_TXH_PHY_ENC_CCK;
2701         ctl |= B43_TXH_PHY_ANT01AUTO;
2702         ctl |= B43_TXH_PHY_TXPWR;
2703
2704         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2705         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2706         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2707 }
2708
2709 /* Set the TX-Antenna for management frames sent by firmware. */
2710 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2711 {
2712         u16 ant;
2713         u16 tmp;
2714
2715         ant = b43_antenna_to_phyctl(antenna);
2716
2717         /* For ACK/CTS */
2718         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2719         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2720         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2721         /* For Probe Resposes */
2722         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2723         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2724         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2725 }
2726
2727 /* This is the opposite of b43_chip_init() */
2728 static void b43_chip_exit(struct b43_wldev *dev)
2729 {
2730         b43_phy_exit(dev);
2731         b43_gpio_cleanup(dev);
2732         /* firmware is released later */
2733 }
2734
2735 /* Initialize the chip
2736  * http://bcm-specs.sipsolutions.net/ChipInit
2737  */
2738 static int b43_chip_init(struct b43_wldev *dev)
2739 {
2740         struct b43_phy *phy = &dev->phy;
2741         int err;
2742         u32 value32, macctl;
2743         u16 value16;
2744
2745         /* Initialize the MAC control */
2746         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2747         if (dev->phy.gmode)
2748                 macctl |= B43_MACCTL_GMODE;
2749         macctl |= B43_MACCTL_INFRA;
2750         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2751
2752         err = b43_request_firmware(dev);
2753         if (err)
2754                 goto out;
2755         err = b43_upload_microcode(dev);
2756         if (err)
2757                 goto out;       /* firmware is released later */
2758
2759         err = b43_gpio_init(dev);
2760         if (err)
2761                 goto out;       /* firmware is released later */
2762
2763         err = b43_upload_initvals(dev);
2764         if (err)
2765                 goto err_gpio_clean;
2766
2767         /* Turn the Analog on and initialize the PHY. */
2768         phy->ops->switch_analog(dev, 1);
2769         err = b43_phy_init(dev);
2770         if (err)
2771                 goto err_gpio_clean;
2772
2773         /* Disable Interference Mitigation. */
2774         if (phy->ops->interf_mitigation)
2775                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2776
2777         /* Select the antennae */
2778         if (phy->ops->set_rx_antenna)
2779                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2780         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2781
2782         if (phy->type == B43_PHYTYPE_B) {
2783                 value16 = b43_read16(dev, 0x005E);
2784                 value16 |= 0x0004;
2785                 b43_write16(dev, 0x005E, value16);
2786         }
2787         b43_write32(dev, 0x0100, 0x01000000);
2788         if (dev->dev->id.revision < 5)
2789                 b43_write32(dev, 0x010C, 0x01000000);
2790
2791         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2792                     & ~B43_MACCTL_INFRA);
2793         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2794                     | B43_MACCTL_INFRA);
2795
2796         /* Probe Response Timeout value */
2797         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2798         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2799
2800         /* Initially set the wireless operation mode. */
2801         b43_adjust_opmode(dev);
2802
2803         if (dev->dev->id.revision < 3) {
2804                 b43_write16(dev, 0x060E, 0x0000);
2805                 b43_write16(dev, 0x0610, 0x8000);
2806                 b43_write16(dev, 0x0604, 0x0000);
2807                 b43_write16(dev, 0x0606, 0x0200);
2808         } else {
2809                 b43_write32(dev, 0x0188, 0x80000000);
2810                 b43_write32(dev, 0x018C, 0x02000000);
2811         }
2812         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2813         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2814         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2815         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2816         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2817         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2818         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2819
2820         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2821         value32 |= 0x00100000;
2822         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2823
2824         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2825                     dev->dev->bus->chipco.fast_pwrup_delay);
2826
2827         err = 0;
2828         b43dbg(dev->wl, "Chip initialized\n");
2829 out:
2830         return err;
2831
2832 err_gpio_clean:
2833         b43_gpio_cleanup(dev);
2834         return err;
2835 }
2836
2837 static void b43_periodic_every60sec(struct b43_wldev *dev)
2838 {
2839         const struct b43_phy_operations *ops = dev->phy.ops;
2840
2841         if (ops->pwork_60sec)
2842                 ops->pwork_60sec(dev);
2843
2844         /* Force check the TX power emission now. */
2845         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2846 }
2847
2848 static void b43_periodic_every30sec(struct b43_wldev *dev)
2849 {
2850         /* Update device statistics. */
2851         b43_calculate_link_quality(dev);
2852 }
2853
2854 static void b43_periodic_every15sec(struct b43_wldev *dev)
2855 {
2856         struct b43_phy *phy = &dev->phy;
2857         u16 wdr;
2858
2859         if (dev->fw.opensource) {
2860                 /* Check if the firmware is still alive.
2861                  * It will reset the watchdog counter to 0 in its idle loop. */
2862                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2863                 if (unlikely(wdr)) {
2864                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2865                         b43_controller_restart(dev, "Firmware watchdog");
2866                         return;
2867                 } else {
2868                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2869                                         B43_WATCHDOG_REG, 1);
2870                 }
2871         }
2872
2873         if (phy->ops->pwork_15sec)
2874                 phy->ops->pwork_15sec(dev);
2875
2876         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2877         wmb();
2878 }
2879
2880 static void do_periodic_work(struct b43_wldev *dev)
2881 {
2882         unsigned int state;
2883
2884         state = dev->periodic_state;
2885         if (state % 4 == 0)
2886                 b43_periodic_every60sec(dev);
2887         if (state % 2 == 0)
2888                 b43_periodic_every30sec(dev);
2889         b43_periodic_every15sec(dev);
2890 }
2891
2892 /* Periodic work locking policy:
2893  *      The whole periodic work handler is protected by
2894  *      wl->mutex. If another lock is needed somewhere in the
2895  *      pwork callchain, it's aquired in-place, where it's needed.
2896  */
2897 static void b43_periodic_work_handler(struct work_struct *work)
2898 {
2899         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2900                                              periodic_work.work);
2901         struct b43_wl *wl = dev->wl;
2902         unsigned long delay;
2903
2904         mutex_lock(&wl->mutex);
2905
2906         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2907                 goto out;
2908         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2909                 goto out_requeue;
2910
2911         do_periodic_work(dev);
2912
2913         dev->periodic_state++;
2914 out_requeue:
2915         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2916                 delay = msecs_to_jiffies(50);
2917         else
2918                 delay = round_jiffies_relative(HZ * 15);
2919         queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2920 out:
2921         mutex_unlock(&wl->mutex);
2922 }
2923
2924 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2925 {
2926         struct delayed_work *work = &dev->periodic_work;
2927
2928         dev->periodic_state = 0;
2929         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2930         queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2931 }
2932
2933 /* Check if communication with the device works correctly. */
2934 static int b43_validate_chipaccess(struct b43_wldev *dev)
2935 {
2936         u32 v, backup;
2937
2938         backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2939
2940         /* Check for read/write and endianness problems. */
2941         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2942         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2943                 goto error;
2944         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2945         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2946                 goto error;
2947
2948         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2949
2950         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2951                 /* The 32bit register shadows the two 16bit registers
2952                  * with update sideeffects. Validate this. */
2953                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2954                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2955                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2956                         goto error;
2957                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2958                         goto error;
2959         }
2960         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2961
2962         v = b43_read32(dev, B43_MMIO_MACCTL);
2963         v |= B43_MACCTL_GMODE;
2964         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2965                 goto error;
2966
2967         return 0;
2968 error:
2969         b43err(dev->wl, "Failed to validate the chipaccess\n");
2970         return -ENODEV;
2971 }
2972
2973 static void b43_security_init(struct b43_wldev *dev)
2974 {
2975         dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2976         B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2977         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2978         /* KTP is a word address, but we address SHM bytewise.
2979          * So multiply by two.
2980          */
2981         dev->ktp *= 2;
2982         if (dev->dev->id.revision >= 5) {
2983                 /* Number of RCMTA address slots */
2984                 b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2985         }
2986         b43_clear_keys(dev);
2987 }
2988
2989 #ifdef CONFIG_B43_HWRNG
2990 static int b43_rng_read(struct hwrng *rng, u32 *data)
2991 {
2992         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2993         unsigned long flags;
2994
2995         /* Don't take wl->mutex here, as it could deadlock with
2996          * hwrng internal locking. It's not needed to take
2997          * wl->mutex here, anyway. */
2998
2999         spin_lock_irqsave(&wl->irq_lock, flags);
3000         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
3001         spin_unlock_irqrestore(&wl->irq_lock, flags);
3002
3003         return (sizeof(u16));
3004 }
3005 #endif /* CONFIG_B43_HWRNG */
3006
3007 static void b43_rng_exit(struct b43_wl *wl)
3008 {
3009 #ifdef CONFIG_B43_HWRNG
3010         if (wl->rng_initialized)
3011                 hwrng_unregister(&wl->rng);
3012 #endif /* CONFIG_B43_HWRNG */
3013 }
3014
3015 static int b43_rng_init(struct b43_wl *wl)
3016 {
3017         int err = 0;
3018
3019 #ifdef CONFIG_B43_HWRNG
3020         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3021                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3022         wl->rng.name = wl->rng_name;
3023         wl->rng.data_read = b43_rng_read;
3024         wl->rng.priv = (unsigned long)wl;
3025         wl->rng_initialized = 1;
3026         err = hwrng_register(&wl->rng);
3027         if (err) {
3028                 wl->rng_initialized = 0;
3029                 b43err(wl, "Failed to register the random "
3030                        "number generator (%d)\n", err);
3031         }
3032 #endif /* CONFIG_B43_HWRNG */
3033
3034         return err;
3035 }
3036
3037 static int b43_op_tx(struct ieee80211_hw *hw,
3038                      struct sk_buff *skb)
3039 {
3040         struct b43_wl *wl = hw_to_b43_wl(hw);
3041         struct b43_wldev *dev = wl->current_dev;
3042         unsigned long flags;
3043         int err;
3044
3045         if (unlikely(skb->len < 2 + 2 + 6)) {
3046                 /* Too short, this can't be a valid frame. */
3047                 goto drop_packet;
3048         }
3049         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3050         if (unlikely(!dev))
3051                 goto drop_packet;
3052
3053         /* Transmissions on seperate queues can run concurrently. */
3054         read_lock_irqsave(&wl->tx_lock, flags);
3055
3056         err = -ENODEV;
3057         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3058                 if (b43_using_pio_transfers(dev))
3059                         err = b43_pio_tx(dev, skb);
3060                 else
3061                         err = b43_dma_tx(dev, skb);
3062         }
3063
3064         read_unlock_irqrestore(&wl->tx_lock, flags);
3065
3066         if (unlikely(err))
3067                 goto drop_packet;
3068         return NETDEV_TX_OK;
3069
3070 drop_packet:
3071         /* We can not transmit this packet. Drop it. */
3072         dev_kfree_skb_any(skb);
3073         return NETDEV_TX_OK;
3074 }
3075
3076 /* Locking: wl->irq_lock */
3077 static void b43_qos_params_upload(struct b43_wldev *dev,
3078                                   const struct ieee80211_tx_queue_params *p,
3079                                   u16 shm_offset)
3080 {
3081         u16 params[B43_NR_QOSPARAMS];
3082         int bslots, tmp;
3083         unsigned int i;
3084
3085         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3086
3087         memset(&params, 0, sizeof(params));
3088
3089         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3090         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3091         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3092         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3093         params[B43_QOSPARAM_AIFS] = p->aifs;
3094         params[B43_QOSPARAM_BSLOTS] = bslots;
3095         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3096
3097         for (i = 0; i < ARRAY_SIZE(params); i++) {
3098                 if (i == B43_QOSPARAM_STATUS) {
3099                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3100                                              shm_offset + (i * 2));
3101                         /* Mark the parameters as updated. */
3102                         tmp |= 0x100;
3103                         b43_shm_write16(dev, B43_SHM_SHARED,
3104                                         shm_offset + (i * 2),
3105                                         tmp);
3106                 } else {
3107                         b43_shm_write16(dev, B43_SHM_SHARED,
3108                                         shm_offset + (i * 2),
3109                                         params[i]);
3110                 }
3111         }
3112 }
3113
3114 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3115 static const u16 b43_qos_shm_offsets[] = {
3116         /* [mac80211-queue-nr] = SHM_OFFSET, */
3117         [0] = B43_QOS_VOICE,
3118         [1] = B43_QOS_VIDEO,
3119         [2] = B43_QOS_BESTEFFORT,
3120         [3] = B43_QOS_BACKGROUND,
3121 };
3122
3123 /* Update all QOS parameters in hardware. */
3124 static void b43_qos_upload_all(struct b43_wldev *dev)
3125 {
3126         struct b43_wl *wl = dev->wl;
3127         struct b43_qos_params *params;
3128         unsigned int i;
3129
3130         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3131                      ARRAY_SIZE(wl->qos_params));
3132
3133         b43_mac_suspend(dev);
3134         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3135                 params = &(wl->qos_params[i]);
3136                 b43_qos_params_upload(dev, &(params->p),
3137                                       b43_qos_shm_offsets[i]);
3138         }
3139         b43_mac_enable(dev);
3140 }
3141
3142 static void b43_qos_clear(struct b43_wl *wl)
3143 {
3144         struct b43_qos_params *params;
3145         unsigned int i;
3146
3147         /* Initialize QoS parameters to sane defaults. */
3148
3149         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3150                      ARRAY_SIZE(wl->qos_params));
3151
3152         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3153                 params = &(wl->qos_params[i]);
3154
3155                 switch (b43_qos_shm_offsets[i]) {
3156                 case B43_QOS_VOICE:
3157                         params->p.txop = 0;
3158                         params->p.aifs = 2;
3159                         params->p.cw_min = 0x0001;
3160                         params->p.cw_max = 0x0001;
3161                         break;
3162                 case B43_QOS_VIDEO:
3163                         params->p.txop = 0;
3164                         params->p.aifs = 2;
3165                         params->p.cw_min = 0x0001;
3166                         params->p.cw_max = 0x0001;
3167                         break;
3168                 case B43_QOS_BESTEFFORT:
3169                         params->p.txop = 0;
3170                         params->p.aifs = 3;
3171                         params->p.cw_min = 0x0001;
3172                         params->p.cw_max = 0x03FF;
3173                         break;
3174                 case B43_QOS_BACKGROUND:
3175                         params->p.txop = 0;
3176                         params->p.aifs = 7;
3177                         params->p.cw_min = 0x0001;
3178                         params->p.cw_max = 0x03FF;
3179                         break;
3180                 default:
3181                         B43_WARN_ON(1);
3182                 }
3183         }
3184 }
3185
3186 /* Initialize the core's QOS capabilities */
3187 static void b43_qos_init(struct b43_wldev *dev)
3188 {
3189         /* Upload the current QOS parameters. */
3190         b43_qos_upload_all(dev);
3191
3192         /* Enable QOS support. */
3193         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3194         b43_write16(dev, B43_MMIO_IFSCTL,
3195                     b43_read16(dev, B43_MMIO_IFSCTL)
3196                     | B43_MMIO_IFSCTL_USE_EDCF);
3197 }
3198
3199 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3200                           const struct ieee80211_tx_queue_params *params)
3201 {
3202         struct b43_wl *wl = hw_to_b43_wl(hw);
3203         struct b43_wldev *dev;
3204         unsigned int queue = (unsigned int)_queue;
3205         int err = -ENODEV;
3206
3207         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3208                 /* Queue not available or don't support setting
3209                  * params on this queue. Return success to not
3210                  * confuse mac80211. */
3211                 return 0;
3212         }
3213         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3214                      ARRAY_SIZE(wl->qos_params));
3215
3216         mutex_lock(&wl->mutex);
3217         dev = wl->current_dev;
3218         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3219                 goto out_unlock;
3220
3221         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3222         b43_mac_suspend(dev);
3223         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3224                               b43_qos_shm_offsets[queue]);
3225         b43_mac_enable(dev);
3226         err = 0;
3227
3228 out_unlock:
3229         mutex_unlock(&wl->mutex);
3230
3231         return err;
3232 }
3233
3234 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3235                                struct ieee80211_tx_queue_stats *stats)
3236 {
3237         struct b43_wl *wl = hw_to_b43_wl(hw);
3238         struct b43_wldev *dev = wl->current_dev;
3239         unsigned long flags;
3240         int err = -ENODEV;
3241
3242         if (!dev)
3243                 goto out;
3244         spin_lock_irqsave(&wl->irq_lock, flags);
3245         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3246                 if (b43_using_pio_transfers(dev))
3247                         b43_pio_get_tx_stats(dev, stats);
3248                 else
3249                         b43_dma_get_tx_stats(dev, stats);
3250                 err = 0;
3251         }
3252         spin_unlock_irqrestore(&wl->irq_lock, flags);
3253 out:
3254         return err;
3255 }
3256
3257 static int b43_op_get_stats(struct ieee80211_hw *hw,
3258                             struct ieee80211_low_level_stats *stats)
3259 {
3260         struct b43_wl *wl = hw_to_b43_wl(hw);
3261         unsigned long flags;
3262
3263         spin_lock_irqsave(&wl->irq_lock, flags);
3264         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3265         spin_unlock_irqrestore(&wl->irq_lock, flags);
3266
3267         return 0;
3268 }
3269
3270 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3271 {
3272         struct b43_wl *wl = hw_to_b43_wl(hw);
3273         struct b43_wldev *dev;
3274         u64 tsf;
3275
3276         mutex_lock(&wl->mutex);
3277         spin_lock_irq(&wl->irq_lock);
3278         dev = wl->current_dev;
3279
3280         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3281                 b43_tsf_read(dev, &tsf);
3282         else
3283                 tsf = 0;
3284
3285         spin_unlock_irq(&wl->irq_lock);
3286         mutex_unlock(&wl->mutex);
3287
3288         return tsf;
3289 }
3290
3291 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3292 {
3293         struct b43_wl *wl = hw_to_b43_wl(hw);
3294         struct b43_wldev *dev;
3295
3296         mutex_lock(&wl->mutex);
3297         spin_lock_irq(&wl->irq_lock);
3298         dev = wl->current_dev;
3299
3300         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3301                 b43_tsf_write(dev, tsf);
3302
3303         spin_unlock_irq(&wl->irq_lock);
3304         mutex_unlock(&wl->mutex);
3305 }
3306
3307 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3308 {
3309         struct ssb_device *sdev = dev->dev;
3310         u32 tmslow;
3311
3312         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3313         tmslow &= ~B43_TMSLOW_GMODE;
3314         tmslow |= B43_TMSLOW_PHYRESET;
3315         tmslow |= SSB_TMSLOW_FGC;
3316         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3317         msleep(1);
3318
3319         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3320         tmslow &= ~SSB_TMSLOW_FGC;
3321         tmslow |= B43_TMSLOW_PHYRESET;
3322         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3323         msleep(1);
3324 }
3325
3326 static const char *band_to_string(enum ieee80211_band band)
3327 {
3328         switch (band) {
3329         case IEEE80211_BAND_5GHZ:
3330                 return "5";
3331         case IEEE80211_BAND_2GHZ:
3332                 return "2.4";
3333         default:
3334                 break;
3335         }
3336         B43_WARN_ON(1);
3337         return "";
3338 }
3339
3340 /* Expects wl->mutex locked */
3341 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3342 {
3343         struct b43_wldev *up_dev = NULL;
3344         struct b43_wldev *down_dev;
3345         struct b43_wldev *d;
3346         int err;
3347         bool uninitialized_var(gmode);
3348         int prev_status;
3349
3350         /* Find a device and PHY which supports the band. */
3351         list_for_each_entry(d, &wl->devlist, list) {
3352                 switch (chan->band) {
3353                 case IEEE80211_BAND_5GHZ:
3354                         if (d->phy.supports_5ghz) {
3355                                 up_dev = d;
3356                                 gmode = 0;
3357                         }
3358                         break;
3359                 case IEEE80211_BAND_2GHZ:
3360                         if (d->phy.supports_2ghz) {
3361                                 up_dev = d;
3362                                 gmode = 1;
3363                         }
3364                         break;
3365                 default:
3366                         B43_WARN_ON(1);
3367                         return -EINVAL;
3368                 }
3369                 if (up_dev)
3370                         break;
3371         }
3372         if (!up_dev) {
3373                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3374                        band_to_string(chan->band));
3375                 return -ENODEV;
3376         }
3377         if ((up_dev == wl->current_dev) &&
3378             (!!wl->current_dev->phy.gmode == !!gmode)) {
3379                 /* This device is already running. */
3380                 return 0;
3381         }
3382         b43dbg(wl, "Switching to %s-GHz band\n",
3383                band_to_string(chan->band));
3384         down_dev = wl->current_dev;
3385
3386         prev_status = b43_status(down_dev);
3387         /* Shutdown the currently running core. */
3388         if (prev_status >= B43_STAT_STARTED)
3389                 b43_wireless_core_stop(down_dev);
3390         if (prev_status >= B43_STAT_INITIALIZED)
3391                 b43_wireless_core_exit(down_dev);
3392
3393         if (down_dev != up_dev) {
3394                 /* We switch to a different core, so we put PHY into
3395                  * RESET on the old core. */
3396                 b43_put_phy_into_reset(down_dev);
3397         }
3398
3399         /* Now start the new core. */
3400         up_dev->phy.gmode = gmode;
3401         if (prev_status >= B43_STAT_INITIALIZED) {
3402                 err = b43_wireless_core_init(up_dev);
3403                 if (err) {
3404                         b43err(wl, "Fatal: Could not initialize device for "
3405                                "selected %s-GHz band\n",
3406                                band_to_string(chan->band));
3407                         goto init_failure;
3408                 }
3409         }
3410         if (prev_status >= B43_STAT_STARTED) {
3411                 err = b43_wireless_core_start(up_dev);
3412                 if (err) {
3413                         b43err(wl, "Fatal: Coult not start device for "
3414                                "selected %s-GHz band\n",
3415                                band_to_string(chan->band));
3416                         b43_wireless_core_exit(up_dev);
3417                         goto init_failure;
3418                 }
3419         }
3420         B43_WARN_ON(b43_status(up_dev) != prev_status);
3421
3422         wl->current_dev = up_dev;
3423
3424         return 0;
3425 init_failure:
3426         /* Whoops, failed to init the new core. No core is operating now. */
3427         wl->current_dev = NULL;
3428         return err;
3429 }
3430
3431 /* Write the short and long frame retry limit values. */
3432 static void b43_set_retry_limits(struct b43_wldev *dev,
3433                                  unsigned int short_retry,
3434                                  unsigned int long_retry)
3435 {
3436         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3437          * the chip-internal counter. */
3438         short_retry = min(short_retry, (unsigned int)0xF);
3439         long_retry = min(long_retry, (unsigned int)0xF);
3440
3441         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3442                         short_retry);
3443         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3444                         long_retry);
3445 }
3446
3447 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3448 {
3449         struct b43_wl *wl = hw_to_b43_wl(hw);
3450         struct b43_wldev *dev;
3451         struct b43_phy *phy;
3452         struct ieee80211_conf *conf = &hw->conf;
3453         unsigned long flags;
3454         int antenna;
3455         int err = 0;
3456
3457         mutex_lock(&wl->mutex);
3458
3459         /* Switch the band (if necessary). This might change the active core. */
3460         err = b43_switch_band(wl, conf->channel);
3461         if (err)
3462                 goto out_unlock_mutex;
3463         dev = wl->current_dev;
3464         phy = &dev->phy;
3465
3466         b43_mac_suspend(dev);
3467
3468         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3469                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3470                                           conf->long_frame_max_tx_count);
3471         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3472         if (!changed)
3473                 goto out_mac_enable;
3474
3475         /* Switch to the requested channel.
3476          * The firmware takes care of races with the TX handler. */
3477         if (conf->channel->hw_value != phy->channel)
3478                 b43_switch_channel(dev, conf->channel->hw_value);
3479
3480         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3481
3482         /* Adjust the desired TX power level. */
3483         if (conf->power_level != 0) {
3484                 spin_lock_irqsave(&wl->irq_lock, flags);
3485                 if (conf->power_level != phy->desired_txpower) {
3486                         phy->desired_txpower = conf->power_level;
3487                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3488                                                    B43_TXPWR_IGNORE_TSSI);
3489                 }
3490                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3491         }
3492
3493         /* Antennas for RX and management frame TX. */
3494         antenna = B43_ANTENNA_DEFAULT;
3495         b43_mgmtframe_txantenna(dev, antenna);
3496         antenna = B43_ANTENNA_DEFAULT;
3497         if (phy->ops->set_rx_antenna)
3498                 phy->ops->set_rx_antenna(dev, antenna);
3499
3500         if (wl->radio_enabled != phy->radio_on) {
3501                 if (wl->radio_enabled) {
3502                         b43_software_rfkill(dev, false);
3503                         b43info(dev->wl, "Radio turned on by software\n");
3504                         if (!dev->radio_hw_enable) {
3505                                 b43info(dev->wl, "The hardware RF-kill button "
3506                                         "still turns the radio physically off. "
3507                                         "Press the button to turn it on.\n");
3508                         }
3509                 } else {
3510                         b43_software_rfkill(dev, true);
3511                         b43info(dev->wl, "Radio turned off by software\n");
3512                 }
3513         }
3514
3515 out_mac_enable:
3516         b43_mac_enable(dev);
3517 out_unlock_mutex:
3518         mutex_unlock(&wl->mutex);
3519
3520         return err;
3521 }
3522
3523 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3524 {
3525         struct ieee80211_supported_band *sband =
3526                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3527         struct ieee80211_rate *rate;
3528         int i;
3529         u16 basic, direct, offset, basic_offset, rateptr;
3530
3531         for (i = 0; i < sband->n_bitrates; i++) {
3532                 rate = &sband->bitrates[i];
3533
3534                 if (b43_is_cck_rate(rate->hw_value)) {
3535                         direct = B43_SHM_SH_CCKDIRECT;
3536                         basic = B43_SHM_SH_CCKBASIC;
3537                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3538                         offset &= 0xF;
3539                 } else {
3540                         direct = B43_SHM_SH_OFDMDIRECT;
3541                         basic = B43_SHM_SH_OFDMBASIC;
3542                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3543                         offset &= 0xF;
3544                 }
3545
3546                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3547
3548                 if (b43_is_cck_rate(rate->hw_value)) {
3549                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3550                         basic_offset &= 0xF;
3551                 } else {
3552                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3553                         basic_offset &= 0xF;
3554                 }
3555
3556                 /*
3557                  * Get the pointer that we need to point to
3558                  * from the direct map
3559                  */
3560                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3561                                          direct + 2 * basic_offset);
3562                 /* and write it to the basic map */
3563                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3564                                 rateptr);
3565         }
3566 }
3567
3568 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3569                                     struct ieee80211_vif *vif,
3570                                     struct ieee80211_bss_conf *conf,
3571                                     u32 changed)
3572 {
3573         struct b43_wl *wl = hw_to_b43_wl(hw);
3574         struct b43_wldev *dev;
3575         unsigned long flags;
3576
3577         mutex_lock(&wl->mutex);
3578
3579         dev = wl->current_dev;
3580         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3581                 goto out_unlock_mutex;
3582
3583         B43_WARN_ON(wl->vif != vif);
3584
3585         spin_lock_irqsave(&wl->irq_lock, flags);
3586         if (changed & BSS_CHANGED_BSSID) {
3587                 if (conf->bssid)
3588                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3589                 else
3590                         memset(wl->bssid, 0, ETH_ALEN);
3591         }
3592
3593         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3594                 if (changed & BSS_CHANGED_BEACON &&
3595                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3596                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3597                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3598                         b43_update_templates(wl);
3599
3600                 if (changed & BSS_CHANGED_BSSID)
3601                         b43_write_mac_bssid_templates(dev);
3602         }
3603         spin_unlock_irqrestore(&wl->irq_lock, flags);
3604
3605         b43_mac_suspend(dev);
3606
3607         /* Update templates for AP/mesh mode. */
3608         if (changed & BSS_CHANGED_BEACON_INT &&
3609             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3610              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3611              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3612                 b43_set_beacon_int(dev, conf->beacon_int);
3613
3614         if (changed & BSS_CHANGED_BASIC_RATES)
3615                 b43_update_basic_rates(dev, conf->basic_rates);
3616
3617         if (changed & BSS_CHANGED_ERP_SLOT) {
3618                 if (conf->use_short_slot)
3619                         b43_short_slot_timing_enable(dev);
3620                 else
3621                         b43_short_slot_timing_disable(dev);
3622         }
3623
3624         b43_mac_enable(dev);
3625 out_unlock_mutex:
3626         mutex_unlock(&wl->mutex);
3627 }
3628
3629 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3630                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3631                           struct ieee80211_key_conf *key)
3632 {
3633         struct b43_wl *wl = hw_to_b43_wl(hw);
3634         struct b43_wldev *dev;
3635         u8 algorithm;
3636         u8 index;
3637         int err;
3638         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3639
3640         if (modparam_nohwcrypt)
3641                 return -ENOSPC; /* User disabled HW-crypto */
3642
3643         mutex_lock(&wl->mutex);
3644         spin_lock_irq(&wl->irq_lock);
3645         write_lock(&wl->tx_lock);
3646         /* Why do we need all this locking here?
3647          * mutex     -> Every config operation must take it.
3648          * irq_lock  -> We modify the dev->key array, which is accessed
3649          *              in the IRQ handlers.
3650          * tx_lock   -> We modify the dev->key array, which is accessed
3651          *              in the TX handler.
3652          */
3653
3654         dev = wl->current_dev;
3655         err = -ENODEV;
3656         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3657                 goto out_unlock;
3658
3659         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3660                 /* We don't have firmware for the crypto engine.
3661                  * Must use software-crypto. */
3662                 err = -EOPNOTSUPP;
3663                 goto out_unlock;
3664         }
3665
3666         err = -EINVAL;
3667         switch (key->alg) {
3668         case ALG_WEP:
3669                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3670                         algorithm = B43_SEC_ALGO_WEP40;
3671                 else
3672                         algorithm = B43_SEC_ALGO_WEP104;
3673                 break;
3674         case ALG_TKIP:
3675                 algorithm = B43_SEC_ALGO_TKIP;
3676                 break;
3677         case ALG_CCMP:
3678                 algorithm = B43_SEC_ALGO_AES;
3679                 break;
3680         default:
3681                 B43_WARN_ON(1);
3682                 goto out_unlock;
3683         }
3684         index = (u8) (key->keyidx);
3685         if (index > 3)
3686                 goto out_unlock;
3687
3688         switch (cmd) {
3689         case SET_KEY:
3690                 if (algorithm == B43_SEC_ALGO_TKIP) {
3691                         /* FIXME: No TKIP hardware encryption for now. */
3692                         err = -EOPNOTSUPP;
3693                         goto out_unlock;
3694                 }
3695
3696                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3697                         if (WARN_ON(!sta)) {
3698                                 err = -EOPNOTSUPP;
3699                                 goto out_unlock;
3700                         }
3701                         /* Pairwise key with an assigned MAC address. */
3702                         err = b43_key_write(dev, -1, algorithm,
3703                                             key->key, key->keylen,
3704                                             sta->addr, key);
3705                 } else {
3706                         /* Group key */
3707                         err = b43_key_write(dev, index, algorithm,
3708                                             key->key, key->keylen, NULL, key);
3709                 }
3710                 if (err)
3711                         goto out_unlock;
3712
3713                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3714                     algorithm == B43_SEC_ALGO_WEP104) {
3715                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3716                 } else {
3717                         b43_hf_write(dev,
3718                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3719                 }
3720                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3721                 break;
3722         case DISABLE_KEY: {
3723                 err = b43_key_clear(dev, key->hw_key_idx);
3724                 if (err)
3725                         goto out_unlock;
3726                 break;
3727         }
3728         default:
3729                 B43_WARN_ON(1);
3730         }
3731
3732 out_unlock:
3733         if (!err) {
3734                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3735                        "mac: %pM\n",
3736                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3737                        sta ? sta->addr : bcast_addr);
3738                 b43_dump_keymemory(dev);
3739         }
3740         write_unlock(&wl->tx_lock);
3741         spin_unlock_irq(&wl->irq_lock);
3742         mutex_unlock(&wl->mutex);
3743
3744         return err;
3745 }
3746
3747 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3748                                     unsigned int changed, unsigned int *fflags,
3749                                     int mc_count, struct dev_addr_list *mc_list)
3750 {
3751         struct b43_wl *wl = hw_to_b43_wl(hw);
3752         struct b43_wldev *dev = wl->current_dev;
3753         unsigned long flags;
3754
3755         if (!dev) {
3756                 *fflags = 0;
3757                 return;
3758         }
3759
3760         spin_lock_irqsave(&wl->irq_lock, flags);
3761         *fflags &= FIF_PROMISC_IN_BSS |
3762                   FIF_ALLMULTI |
3763                   FIF_FCSFAIL |
3764                   FIF_PLCPFAIL |
3765                   FIF_CONTROL |
3766                   FIF_OTHER_BSS |
3767                   FIF_BCN_PRBRESP_PROMISC;
3768
3769         changed &= FIF_PROMISC_IN_BSS |
3770                    FIF_ALLMULTI |
3771                    FIF_FCSFAIL |
3772                    FIF_PLCPFAIL |
3773                    FIF_CONTROL |
3774                    FIF_OTHER_BSS |
3775                    FIF_BCN_PRBRESP_PROMISC;
3776
3777         wl->filter_flags = *fflags;
3778
3779         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3780                 b43_adjust_opmode(dev);
3781         spin_unlock_irqrestore(&wl->irq_lock, flags);
3782 }
3783
3784 /* Locking: wl->mutex */
3785 static void b43_wireless_core_stop(struct b43_wldev *dev)
3786 {
3787         struct b43_wl *wl = dev->wl;
3788         unsigned long flags;
3789
3790         if (b43_status(dev) < B43_STAT_STARTED)
3791                 return;
3792
3793         /* Disable and sync interrupts. We must do this before than
3794          * setting the status to INITIALIZED, as the interrupt handler
3795          * won't care about IRQs then. */
3796         spin_lock_irqsave(&wl->irq_lock, flags);
3797         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3798         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3799         spin_unlock_irqrestore(&wl->irq_lock, flags);
3800         b43_synchronize_irq(dev);
3801
3802         write_lock_irqsave(&wl->tx_lock, flags);
3803         b43_set_status(dev, B43_STAT_INITIALIZED);
3804         write_unlock_irqrestore(&wl->tx_lock, flags);
3805
3806         b43_pio_stop(dev);
3807         mutex_unlock(&wl->mutex);
3808         /* Must unlock as it would otherwise deadlock. No races here.
3809          * Cancel the possibly running self-rearming periodic work. */
3810         cancel_delayed_work_sync(&dev->periodic_work);
3811         mutex_lock(&wl->mutex);
3812
3813         b43_mac_suspend(dev);
3814         free_irq(dev->dev->irq, dev);
3815         b43dbg(wl, "Wireless interface stopped\n");
3816 }
3817
3818 /* Locking: wl->mutex */
3819 static int b43_wireless_core_start(struct b43_wldev *dev)
3820 {
3821         int err;
3822
3823         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3824
3825         drain_txstatus_queue(dev);
3826         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3827                           IRQF_SHARED, KBUILD_MODNAME, dev);
3828         if (err) {
3829                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3830                 goto out;
3831         }
3832
3833         /* We are ready to run. */
3834         b43_set_status(dev, B43_STAT_STARTED);
3835
3836         /* Start data flow (TX/RX). */
3837         b43_mac_enable(dev);
3838         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3839
3840         /* Start maintainance work */
3841         b43_periodic_tasks_setup(dev);
3842
3843         b43dbg(dev->wl, "Wireless interface started\n");
3844       out:
3845         return err;
3846 }
3847
3848 /* Get PHY and RADIO versioning numbers */
3849 static int b43_phy_versioning(struct b43_wldev *dev)
3850 {
3851         struct b43_phy *phy = &dev->phy;
3852         u32 tmp;
3853         u8 analog_type;
3854         u8 phy_type;
3855         u8 phy_rev;
3856         u16 radio_manuf;
3857         u16 radio_ver;
3858         u16 radio_rev;
3859         int unsupported = 0;
3860
3861         /* Get PHY versioning */
3862         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3863         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3864         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3865         phy_rev = (tmp & B43_PHYVER_VERSION);
3866         switch (phy_type) {
3867         case B43_PHYTYPE_A:
3868                 if (phy_rev >= 4)
3869                         unsupported = 1;
3870                 break;
3871         case B43_PHYTYPE_B:
3872                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3873                     && phy_rev != 7)
3874                         unsupported = 1;
3875                 break;
3876         case B43_PHYTYPE_G:
3877                 if (phy_rev > 9)
3878                         unsupported = 1;
3879                 break;
3880 #ifdef CONFIG_B43_NPHY
3881         case B43_PHYTYPE_N:
3882                 if (phy_rev > 4)
3883                         unsupported = 1;
3884                 break;
3885 #endif
3886 #ifdef CONFIG_B43_PHY_LP
3887         case B43_PHYTYPE_LP:
3888                 if (phy_rev > 1)
3889                         unsupported = 1;
3890                 break;
3891 #endif
3892         default:
3893                 unsupported = 1;
3894         };
3895         if (unsupported) {
3896                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3897                        "(Analog %u, Type %u, Revision %u)\n",
3898                        analog_type, phy_type, phy_rev);
3899                 return -EOPNOTSUPP;
3900         }
3901         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3902                analog_type, phy_type, phy_rev);
3903
3904         /* Get RADIO versioning */
3905         if (dev->dev->bus->chip_id == 0x4317) {
3906                 if (dev->dev->bus->chip_rev == 0)
3907                         tmp = 0x3205017F;
3908                 else if (dev->dev->bus->chip_rev == 1)
3909                         tmp = 0x4205017F;
3910                 else
3911                         tmp = 0x5205017F;
3912         } else {
3913                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3914                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3915                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3916                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3917         }
3918         radio_manuf = (tmp & 0x00000FFF);
3919         radio_ver = (tmp & 0x0FFFF000) >> 12;
3920         radio_rev = (tmp & 0xF0000000) >> 28;
3921         if (radio_manuf != 0x17F /* Broadcom */)
3922                 unsupported = 1;
3923         switch (phy_type) {
3924         case B43_PHYTYPE_A:
3925                 if (radio_ver != 0x2060)
3926                         unsupported = 1;
3927                 if (radio_rev != 1)
3928                         unsupported = 1;
3929                 if (radio_manuf != 0x17F)
3930                         unsupported = 1;
3931                 break;
3932         case B43_PHYTYPE_B:
3933                 if ((radio_ver & 0xFFF0) != 0x2050)
3934                         unsupported = 1;
3935                 break;
3936         case B43_PHYTYPE_G:
3937                 if (radio_ver != 0x2050)
3938                         unsupported = 1;
3939                 break;
3940         case B43_PHYTYPE_N:
3941                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
3942                         unsupported = 1;
3943                 break;
3944         case B43_PHYTYPE_LP:
3945                 if (radio_ver != 0x2062)
3946                         unsupported = 1;
3947                 break;
3948         default:
3949                 B43_WARN_ON(1);
3950         }
3951         if (unsupported) {
3952                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3953                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3954                        radio_manuf, radio_ver, radio_rev);
3955                 return -EOPNOTSUPP;
3956         }
3957         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3958                radio_manuf, radio_ver, radio_rev);
3959
3960         phy->radio_manuf = radio_manuf;
3961         phy->radio_ver = radio_ver;
3962         phy->radio_rev = radio_rev;
3963
3964         phy->analog = analog_type;
3965         phy->type = phy_type;
3966         phy->rev = phy_rev;
3967
3968         return 0;
3969 }
3970
3971 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3972                                       struct b43_phy *phy)
3973 {
3974         phy->hardware_power_control = !!modparam_hwpctl;
3975         phy->next_txpwr_check_time = jiffies;
3976         /* PHY TX errors counter. */
3977         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3978
3979 #if B43_DEBUG
3980         phy->phy_locked = 0;
3981         phy->radio_locked = 0;
3982 #endif
3983 }
3984
3985 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3986 {
3987         dev->dfq_valid = 0;
3988
3989         /* Assume the radio is enabled. If it's not enabled, the state will
3990          * immediately get fixed on the first periodic work run. */
3991         dev->radio_hw_enable = 1;
3992
3993         /* Stats */
3994         memset(&dev->stats, 0, sizeof(dev->stats));
3995
3996         setup_struct_phy_for_init(dev, &dev->phy);
3997
3998         /* IRQ related flags */
3999         dev->irq_reason = 0;
4000         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4001         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4002         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4003                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4004
4005         dev->mac_suspended = 1;
4006
4007         /* Noise calculation context */
4008         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4009 }
4010
4011 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4012 {
4013         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
4014         u64 hf;
4015
4016         if (!modparam_btcoex)
4017                 return;
4018         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4019                 return;
4020         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4021                 return;
4022
4023         hf = b43_hf_read(dev);
4024         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4025                 hf |= B43_HF_BTCOEXALT;
4026         else
4027                 hf |= B43_HF_BTCOEX;
4028         b43_hf_write(dev, hf);
4029 }
4030
4031 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4032 {
4033         if (!modparam_btcoex)
4034                 return;
4035         //TODO
4036 }
4037
4038 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4039 {
4040 #ifdef CONFIG_SSB_DRIVER_PCICORE
4041         struct ssb_bus *bus = dev->dev->bus;
4042         u32 tmp;
4043
4044         if (bus->pcicore.dev &&
4045             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
4046             bus->pcicore.dev->id.revision <= 5) {
4047                 /* IMCFGLO timeouts workaround. */
4048                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
4049                 tmp &= ~SSB_IMCFGLO_REQTO;
4050                 tmp &= ~SSB_IMCFGLO_SERTO;
4051                 switch (bus->bustype) {
4052                 case SSB_BUSTYPE_PCI:
4053                 case SSB_BUSTYPE_PCMCIA:
4054                         tmp |= 0x32;
4055                         break;
4056                 case SSB_BUSTYPE_SSB:
4057                         tmp |= 0x53;
4058                         break;
4059                 }
4060                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
4061         }
4062 #endif /* CONFIG_SSB_DRIVER_PCICORE */
4063 }
4064
4065 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4066 {
4067         u16 pu_delay;
4068
4069         /* The time value is in microseconds. */
4070         if (dev->phy.type == B43_PHYTYPE_A)
4071                 pu_delay = 3700;
4072         else
4073                 pu_delay = 1050;
4074         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4075                 pu_delay = 500;
4076         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4077                 pu_delay = max(pu_delay, (u16)2400);
4078
4079         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4080 }
4081
4082 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4083 static void b43_set_pretbtt(struct b43_wldev *dev)
4084 {
4085         u16 pretbtt;
4086
4087         /* The time value is in microseconds. */
4088         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4089                 pretbtt = 2;
4090         } else {
4091                 if (dev->phy.type == B43_PHYTYPE_A)
4092                         pretbtt = 120;
4093                 else
4094                         pretbtt = 250;
4095         }
4096         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4097         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4098 }
4099
4100 /* Shutdown a wireless core */
4101 /* Locking: wl->mutex */
4102 static void b43_wireless_core_exit(struct b43_wldev *dev)
4103 {
4104         u32 macctl;
4105
4106         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4107         if (b43_status(dev) != B43_STAT_INITIALIZED)
4108                 return;
4109         b43_set_status(dev, B43_STAT_UNINIT);
4110
4111         /* Stop the microcode PSM. */
4112         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4113         macctl &= ~B43_MACCTL_PSM_RUN;
4114         macctl |= B43_MACCTL_PSM_JMP0;
4115         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4116
4117         if (!dev->suspend_in_progress) {
4118                 b43_leds_exit(dev);
4119                 b43_rng_exit(dev->wl);
4120         }
4121         b43_dma_free(dev);
4122         b43_pio_free(dev);
4123         b43_chip_exit(dev);
4124         dev->phy.ops->switch_analog(dev, 0);
4125         if (dev->wl->current_beacon) {
4126                 dev_kfree_skb_any(dev->wl->current_beacon);
4127                 dev->wl->current_beacon = NULL;
4128         }
4129
4130         ssb_device_disable(dev->dev, 0);
4131         ssb_bus_may_powerdown(dev->dev->bus);
4132 }
4133
4134 /* Initialize a wireless core */
4135 static int b43_wireless_core_init(struct b43_wldev *dev)
4136 {
4137         struct b43_wl *wl = dev->wl;
4138         struct ssb_bus *bus = dev->dev->bus;
4139         struct ssb_sprom *sprom = &bus->sprom;
4140         struct b43_phy *phy = &dev->phy;
4141         int err;
4142         u64 hf;
4143         u32 tmp;
4144
4145         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4146
4147         err = ssb_bus_powerup(bus, 0);
4148         if (err)
4149                 goto out;
4150         if (!ssb_device_is_enabled(dev->dev)) {
4151                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4152                 b43_wireless_core_reset(dev, tmp);
4153         }
4154
4155         /* Reset all data structures. */
4156         setup_struct_wldev_for_init(dev);
4157         phy->ops->prepare_structs(dev);
4158
4159         /* Enable IRQ routing to this device. */
4160         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4161
4162         b43_imcfglo_timeouts_workaround(dev);
4163         b43_bluetooth_coext_disable(dev);
4164         if (phy->ops->prepare_hardware) {
4165                 err = phy->ops->prepare_hardware(dev);
4166                 if (err)
4167                         goto err_busdown;
4168         }
4169         err = b43_chip_init(dev);
4170         if (err)
4171                 goto err_busdown;
4172         b43_shm_write16(dev, B43_SHM_SHARED,
4173                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4174         hf = b43_hf_read(dev);
4175         if (phy->type == B43_PHYTYPE_G) {
4176                 hf |= B43_HF_SYMW;
4177                 if (phy->rev == 1)
4178                         hf |= B43_HF_GDCW;
4179                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4180                         hf |= B43_HF_OFDMPABOOST;
4181         }
4182         if (phy->radio_ver == 0x2050) {
4183                 if (phy->radio_rev == 6)
4184                         hf |= B43_HF_4318TSSI;
4185                 if (phy->radio_rev < 6)
4186                         hf |= B43_HF_VCORECALC;
4187         }
4188         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4189                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4190 #ifdef CONFIG_SSB_DRIVER_PCICORE
4191         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4192             (bus->pcicore.dev->id.revision <= 10))
4193                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4194 #endif
4195         hf &= ~B43_HF_SKCFPUP;
4196         b43_hf_write(dev, hf);
4197
4198         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4199                              B43_DEFAULT_LONG_RETRY_LIMIT);
4200         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4201         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4202
4203         /* Disable sending probe responses from firmware.
4204          * Setting the MaxTime to one usec will always trigger
4205          * a timeout, so we never send any probe resp.
4206          * A timeout of zero is infinite. */
4207         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4208
4209         b43_rate_memory_init(dev);
4210         b43_set_phytxctl_defaults(dev);
4211
4212         /* Minimum Contention Window */
4213         if (phy->type == B43_PHYTYPE_B) {
4214                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4215         } else {
4216                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4217         }
4218         /* Maximum Contention Window */
4219         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4220
4221         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4222                 dev->__using_pio_transfers = 1;
4223                 err = b43_pio_init(dev);
4224         } else {
4225                 dev->__using_pio_transfers = 0;
4226                 err = b43_dma_init(dev);
4227         }
4228         if (err)
4229                 goto err_chip_exit;
4230         b43_qos_init(dev);
4231         b43_set_synth_pu_delay(dev, 1);
4232         b43_bluetooth_coext_enable(dev);
4233
4234         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4235         b43_upload_card_macaddress(dev);
4236         b43_security_init(dev);
4237         if (!dev->suspend_in_progress)
4238                 b43_rng_init(wl);
4239
4240         b43_set_status(dev, B43_STAT_INITIALIZED);
4241
4242         if (!dev->suspend_in_progress)
4243                 b43_leds_init(dev);
4244 out:
4245         return err;
4246
4247 err_chip_exit:
4248         b43_chip_exit(dev);
4249 err_busdown:
4250         ssb_bus_may_powerdown(bus);
4251         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4252         return err;
4253 }
4254
4255 static int b43_op_add_interface(struct ieee80211_hw *hw,
4256                                 struct ieee80211_if_init_conf *conf)
4257 {
4258         struct b43_wl *wl = hw_to_b43_wl(hw);
4259         struct b43_wldev *dev;
4260         unsigned long flags;
4261         int err = -EOPNOTSUPP;
4262
4263         /* TODO: allow WDS/AP devices to coexist */
4264
4265         if (conf->type != NL80211_IFTYPE_AP &&
4266             conf->type != NL80211_IFTYPE_MESH_POINT &&
4267             conf->type != NL80211_IFTYPE_STATION &&
4268             conf->type != NL80211_IFTYPE_WDS &&
4269             conf->type != NL80211_IFTYPE_ADHOC)
4270                 return -EOPNOTSUPP;
4271
4272         mutex_lock(&wl->mutex);
4273         if (wl->operating)
4274                 goto out_mutex_unlock;
4275
4276         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4277
4278         dev = wl->current_dev;
4279         wl->operating = 1;
4280         wl->vif = conf->vif;
4281         wl->if_type = conf->type;
4282         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4283
4284         spin_lock_irqsave(&wl->irq_lock, flags);
4285         b43_adjust_opmode(dev);
4286         b43_set_pretbtt(dev);
4287         b43_set_synth_pu_delay(dev, 0);
4288         b43_upload_card_macaddress(dev);
4289         spin_unlock_irqrestore(&wl->irq_lock, flags);
4290
4291         err = 0;
4292  out_mutex_unlock:
4293         mutex_unlock(&wl->mutex);
4294
4295         return err;
4296 }
4297
4298 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4299                                     struct ieee80211_if_init_conf *conf)
4300 {
4301         struct b43_wl *wl = hw_to_b43_wl(hw);
4302         struct b43_wldev *dev = wl->current_dev;
4303         unsigned long flags;
4304
4305         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4306
4307         mutex_lock(&wl->mutex);
4308
4309         B43_WARN_ON(!wl->operating);
4310         B43_WARN_ON(wl->vif != conf->vif);
4311         wl->vif = NULL;
4312
4313         wl->operating = 0;
4314
4315         spin_lock_irqsave(&wl->irq_lock, flags);
4316         b43_adjust_opmode(dev);
4317         memset(wl->mac_addr, 0, ETH_ALEN);
4318         b43_upload_card_macaddress(dev);
4319         spin_unlock_irqrestore(&wl->irq_lock, flags);
4320
4321         mutex_unlock(&wl->mutex);
4322 }
4323
4324 static int b43_op_start(struct ieee80211_hw *hw)
4325 {
4326         struct b43_wl *wl = hw_to_b43_wl(hw);
4327         struct b43_wldev *dev = wl->current_dev;
4328         int did_init = 0;
4329         int err = 0;
4330
4331         /* Kill all old instance specific information to make sure
4332          * the card won't use it in the short timeframe between start
4333          * and mac80211 reconfiguring it. */
4334         memset(wl->bssid, 0, ETH_ALEN);
4335         memset(wl->mac_addr, 0, ETH_ALEN);
4336         wl->filter_flags = 0;
4337         wl->radiotap_enabled = 0;
4338         b43_qos_clear(wl);
4339         wl->beacon0_uploaded = 0;
4340         wl->beacon1_uploaded = 0;
4341         wl->beacon_templates_virgin = 1;
4342         wl->radio_enabled = 1;
4343
4344         mutex_lock(&wl->mutex);
4345
4346         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4347                 err = b43_wireless_core_init(dev);
4348                 if (err)
4349                         goto out_mutex_unlock;
4350                 did_init = 1;
4351         }
4352
4353         if (b43_status(dev) < B43_STAT_STARTED) {
4354                 err = b43_wireless_core_start(dev);
4355                 if (err) {
4356                         if (did_init)
4357                                 b43_wireless_core_exit(dev);
4358                         goto out_mutex_unlock;
4359                 }
4360         }
4361
4362         /* XXX: only do if device doesn't support rfkill irq */
4363         wiphy_rfkill_start_polling(hw->wiphy);
4364
4365  out_mutex_unlock:
4366         mutex_unlock(&wl->mutex);
4367
4368         return err;
4369 }
4370
4371 static void b43_op_stop(struct ieee80211_hw *hw)
4372 {
4373         struct b43_wl *wl = hw_to_b43_wl(hw);
4374         struct b43_wldev *dev = wl->current_dev;
4375
4376         cancel_work_sync(&(wl->beacon_update_trigger));
4377
4378         mutex_lock(&wl->mutex);
4379         if (b43_status(dev) >= B43_STAT_STARTED)
4380                 b43_wireless_core_stop(dev);
4381         b43_wireless_core_exit(dev);
4382         wl->radio_enabled = 0;
4383         mutex_unlock(&wl->mutex);
4384
4385         cancel_work_sync(&(wl->txpower_adjust_work));
4386 }
4387
4388 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4389                                  struct ieee80211_sta *sta, bool set)
4390 {
4391         struct b43_wl *wl = hw_to_b43_wl(hw);
4392         unsigned long flags;
4393
4394         spin_lock_irqsave(&wl->irq_lock, flags);
4395         b43_update_templates(wl);
4396         spin_unlock_irqrestore(&wl->irq_lock, flags);
4397
4398         return 0;
4399 }
4400
4401 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4402                               struct ieee80211_vif *vif,
4403                               enum sta_notify_cmd notify_cmd,
4404                               struct ieee80211_sta *sta)
4405 {
4406         struct b43_wl *wl = hw_to_b43_wl(hw);
4407
4408         B43_WARN_ON(!vif || wl->vif != vif);
4409 }
4410
4411 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4412 {
4413         struct b43_wl *wl = hw_to_b43_wl(hw);
4414         struct b43_wldev *dev;
4415
4416         mutex_lock(&wl->mutex);
4417         dev = wl->current_dev;
4418         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4419                 /* Disable CFP update during scan on other channels. */
4420                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4421         }
4422         mutex_unlock(&wl->mutex);
4423 }
4424
4425 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4426 {
4427         struct b43_wl *wl = hw_to_b43_wl(hw);
4428         struct b43_wldev *dev;
4429
4430         mutex_lock(&wl->mutex);
4431         dev = wl->current_dev;
4432         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4433                 /* Re-enable CFP update. */
4434                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4435         }
4436         mutex_unlock(&wl->mutex);
4437 }
4438
4439 static const struct ieee80211_ops b43_hw_ops = {
4440         .tx                     = b43_op_tx,
4441         .conf_tx                = b43_op_conf_tx,
4442         .add_interface          = b43_op_add_interface,
4443         .remove_interface       = b43_op_remove_interface,
4444         .config                 = b43_op_config,
4445         .bss_info_changed       = b43_op_bss_info_changed,
4446         .configure_filter       = b43_op_configure_filter,
4447         .set_key                = b43_op_set_key,
4448         .get_stats              = b43_op_get_stats,
4449         .get_tx_stats           = b43_op_get_tx_stats,
4450         .get_tsf                = b43_op_get_tsf,
4451         .set_tsf                = b43_op_set_tsf,
4452         .start                  = b43_op_start,
4453         .stop                   = b43_op_stop,
4454         .set_tim                = b43_op_beacon_set_tim,
4455         .sta_notify             = b43_op_sta_notify,
4456         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4457         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4458         .rfkill_poll            = b43_rfkill_poll,
4459 };
4460
4461 /* Hard-reset the chip. Do not call this directly.
4462  * Use b43_controller_restart()
4463  */
4464 static void b43_chip_reset(struct work_struct *work)
4465 {
4466         struct b43_wldev *dev =
4467             container_of(work, struct b43_wldev, restart_work);
4468         struct b43_wl *wl = dev->wl;
4469         int err = 0;
4470         int prev_status;
4471
4472         mutex_lock(&wl->mutex);
4473
4474         prev_status = b43_status(dev);
4475         /* Bring the device down... */
4476         if (prev_status >= B43_STAT_STARTED)
4477                 b43_wireless_core_stop(dev);
4478         if (prev_status >= B43_STAT_INITIALIZED)
4479                 b43_wireless_core_exit(dev);
4480
4481         /* ...and up again. */
4482         if (prev_status >= B43_STAT_INITIALIZED) {
4483                 err = b43_wireless_core_init(dev);
4484                 if (err)
4485                         goto out;
4486         }
4487         if (prev_status >= B43_STAT_STARTED) {
4488                 err = b43_wireless_core_start(dev);
4489                 if (err) {
4490                         b43_wireless_core_exit(dev);
4491                         goto out;
4492                 }
4493         }
4494 out:
4495         if (err)
4496                 wl->current_dev = NULL; /* Failed to init the dev. */
4497         mutex_unlock(&wl->mutex);
4498         if (err)
4499                 b43err(wl, "Controller restart FAILED\n");
4500         else
4501                 b43info(wl, "Controller restarted\n");
4502 }
4503
4504 static int b43_setup_bands(struct b43_wldev *dev,
4505                            bool have_2ghz_phy, bool have_5ghz_phy)
4506 {
4507         struct ieee80211_hw *hw = dev->wl->hw;
4508
4509         if (have_2ghz_phy)
4510                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4511         if (dev->phy.type == B43_PHYTYPE_N) {
4512                 if (have_5ghz_phy)
4513                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4514         } else {
4515                 if (have_5ghz_phy)
4516                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4517         }
4518
4519         dev->phy.supports_2ghz = have_2ghz_phy;
4520         dev->phy.supports_5ghz = have_5ghz_phy;
4521
4522         return 0;
4523 }
4524
4525 static void b43_wireless_core_detach(struct b43_wldev *dev)
4526 {
4527         /* We release firmware that late to not be required to re-request
4528          * is all the time when we reinit the core. */
4529         b43_release_firmware(dev);
4530         b43_phy_free(dev);
4531 }
4532
4533 static int b43_wireless_core_attach(struct b43_wldev *dev)
4534 {
4535         struct b43_wl *wl = dev->wl;
4536         struct ssb_bus *bus = dev->dev->bus;
4537         struct pci_dev *pdev = bus->host_pci;
4538         int err;
4539         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4540         u32 tmp;
4541
4542         /* Do NOT do any device initialization here.
4543          * Do it in wireless_core_init() instead.
4544          * This function is for gathering basic information about the HW, only.
4545          * Also some structs may be set up here. But most likely you want to have
4546          * that in core_init(), too.
4547          */
4548
4549         err = ssb_bus_powerup(bus, 0);
4550         if (err) {
4551                 b43err(wl, "Bus powerup failed\n");
4552                 goto out;
4553         }
4554         /* Get the PHY type. */
4555         if (dev->dev->id.revision >= 5) {
4556                 u32 tmshigh;
4557
4558                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4559                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4560                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4561         } else
4562                 B43_WARN_ON(1);
4563
4564         dev->phy.gmode = have_2ghz_phy;
4565         dev->phy.radio_on = 1;
4566         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4567         b43_wireless_core_reset(dev, tmp);
4568
4569         err = b43_phy_versioning(dev);
4570         if (err)
4571                 goto err_powerdown;
4572         /* Check if this device supports multiband. */
4573         if (!pdev ||
4574             (pdev->device != 0x4312 &&
4575              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4576                 /* No multiband support. */
4577                 have_2ghz_phy = 0;
4578                 have_5ghz_phy = 0;
4579                 switch (dev->phy.type) {
4580                 case B43_PHYTYPE_A:
4581                         have_5ghz_phy = 1;
4582                         break;
4583                 case B43_PHYTYPE_G:
4584                 case B43_PHYTYPE_N:
4585                 case B43_PHYTYPE_LP:
4586                         have_2ghz_phy = 1;
4587                         break;
4588                 default:
4589                         B43_WARN_ON(1);
4590                 }
4591         }
4592         if (dev->phy.type == B43_PHYTYPE_A) {
4593                 /* FIXME */
4594                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4595                 err = -EOPNOTSUPP;
4596                 goto err_powerdown;
4597         }
4598         if (1 /* disable A-PHY */) {
4599                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4600                 if (dev->phy.type != B43_PHYTYPE_N) {
4601                         have_2ghz_phy = 1;
4602                         have_5ghz_phy = 0;
4603                 }
4604         }
4605
4606         err = b43_phy_allocate(dev);
4607         if (err)
4608                 goto err_powerdown;
4609
4610         dev->phy.gmode = have_2ghz_phy;
4611         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4612         b43_wireless_core_reset(dev, tmp);
4613
4614         err = b43_validate_chipaccess(dev);
4615         if (err)
4616                 goto err_phy_free;
4617         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4618         if (err)
4619                 goto err_phy_free;
4620
4621         /* Now set some default "current_dev" */
4622         if (!wl->current_dev)
4623                 wl->current_dev = dev;
4624         INIT_WORK(&dev->restart_work, b43_chip_reset);
4625
4626         dev->phy.ops->switch_analog(dev, 0);
4627         ssb_device_disable(dev->dev, 0);
4628         ssb_bus_may_powerdown(bus);
4629
4630 out:
4631         return err;
4632
4633 err_phy_free:
4634         b43_phy_free(dev);
4635 err_powerdown:
4636         ssb_bus_may_powerdown(bus);
4637         return err;
4638 }
4639
4640 static void b43_one_core_detach(struct ssb_device *dev)
4641 {
4642         struct b43_wldev *wldev;
4643         struct b43_wl *wl;
4644
4645         /* Do not cancel ieee80211-workqueue based work here.
4646          * See comment in b43_remove(). */
4647
4648         wldev = ssb_get_drvdata(dev);
4649         wl = wldev->wl;
4650         b43_debugfs_remove_device(wldev);
4651         b43_wireless_core_detach(wldev);
4652         list_del(&wldev->list);
4653         wl->nr_devs--;
4654         ssb_set_drvdata(dev, NULL);
4655         kfree(wldev);
4656 }
4657
4658 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4659 {
4660         struct b43_wldev *wldev;
4661         struct pci_dev *pdev;
4662         int err = -ENOMEM;
4663
4664         if (!list_empty(&wl->devlist)) {
4665                 /* We are not the first core on this chip. */
4666                 pdev = dev->bus->host_pci;
4667                 /* Only special chips support more than one wireless
4668                  * core, although some of the other chips have more than
4669                  * one wireless core as well. Check for this and
4670                  * bail out early.
4671                  */
4672                 if (!pdev ||
4673                     ((pdev->device != 0x4321) &&
4674                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4675                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4676                         return -ENODEV;
4677                 }
4678         }
4679
4680         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4681         if (!wldev)
4682                 goto out;
4683
4684         wldev->dev = dev;
4685         wldev->wl = wl;
4686         b43_set_status(wldev, B43_STAT_UNINIT);
4687         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4688         tasklet_init(&wldev->isr_tasklet,
4689                      (void (*)(unsigned long))b43_interrupt_tasklet,
4690                      (unsigned long)wldev);
4691         INIT_LIST_HEAD(&wldev->list);
4692
4693         err = b43_wireless_core_attach(wldev);
4694         if (err)
4695                 goto err_kfree_wldev;
4696
4697         list_add(&wldev->list, &wl->devlist);
4698         wl->nr_devs++;
4699         ssb_set_drvdata(dev, wldev);
4700         b43_debugfs_add_device(wldev);
4701
4702       out:
4703         return err;
4704
4705       err_kfree_wldev:
4706         kfree(wldev);
4707         return err;
4708 }
4709
4710 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4711         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4712         (pdev->device == _device) &&                                    \
4713         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4714         (pdev->subsystem_device == _subdevice)                          )
4715
4716 static void b43_sprom_fixup(struct ssb_bus *bus)
4717 {
4718         struct pci_dev *pdev;
4719
4720         /* boardflags workarounds */
4721         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4722             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4723                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4724         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4725             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4726                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4727         if (bus->bustype == SSB_BUSTYPE_PCI) {
4728                 pdev = bus->host_pci;
4729                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4730                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4731                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4732                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4733                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4734                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4735                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4736                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4737         }
4738 }
4739
4740 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4741 {
4742         struct ieee80211_hw *hw = wl->hw;
4743
4744         ssb_set_devtypedata(dev, NULL);
4745         ieee80211_free_hw(hw);
4746 }
4747
4748 static int b43_wireless_init(struct ssb_device *dev)
4749 {
4750         struct ssb_sprom *sprom = &dev->bus->sprom;
4751         struct ieee80211_hw *hw;
4752         struct b43_wl *wl;
4753         int err = -ENOMEM;
4754
4755         b43_sprom_fixup(dev->bus);
4756
4757         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4758         if (!hw) {
4759                 b43err(NULL, "Could not allocate ieee80211 device\n");
4760                 goto out;
4761         }
4762         wl = hw_to_b43_wl(hw);
4763
4764         /* fill hw info */
4765         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4766                     IEEE80211_HW_SIGNAL_DBM |
4767                     IEEE80211_HW_NOISE_DBM;
4768
4769         hw->wiphy->interface_modes =
4770                 BIT(NL80211_IFTYPE_AP) |
4771                 BIT(NL80211_IFTYPE_MESH_POINT) |
4772                 BIT(NL80211_IFTYPE_STATION) |
4773                 BIT(NL80211_IFTYPE_WDS) |
4774                 BIT(NL80211_IFTYPE_ADHOC);
4775
4776         hw->queues = modparam_qos ? 4 : 1;
4777         wl->mac80211_initially_registered_queues = hw->queues;
4778         hw->max_rates = 2;
4779         SET_IEEE80211_DEV(hw, dev->dev);
4780         if (is_valid_ether_addr(sprom->et1mac))
4781                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4782         else
4783                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4784
4785         /* Initialize struct b43_wl */
4786         wl->hw = hw;
4787         spin_lock_init(&wl->irq_lock);
4788         rwlock_init(&wl->tx_lock);
4789         spin_lock_init(&wl->leds_lock);
4790         spin_lock_init(&wl->shm_lock);
4791         mutex_init(&wl->mutex);
4792         INIT_LIST_HEAD(&wl->devlist);
4793         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4794         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4795
4796         ssb_set_devtypedata(dev, wl);
4797         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4798                 dev->bus->chip_id, dev->id.revision);
4799         err = 0;
4800 out:
4801         return err;
4802 }
4803
4804 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4805 {
4806         struct b43_wl *wl;
4807         int err;
4808         int first = 0;
4809
4810         wl = ssb_get_devtypedata(dev);
4811         if (!wl) {
4812                 /* Probing the first core. Must setup common struct b43_wl */
4813                 first = 1;
4814                 err = b43_wireless_init(dev);
4815                 if (err)
4816                         goto out;
4817                 wl = ssb_get_devtypedata(dev);
4818                 B43_WARN_ON(!wl);
4819         }
4820         err = b43_one_core_attach(dev, wl);
4821         if (err)
4822                 goto err_wireless_exit;
4823
4824         if (first) {
4825                 err = ieee80211_register_hw(wl->hw);
4826                 if (err)
4827                         goto err_one_core_detach;
4828         }
4829
4830       out:
4831         return err;
4832
4833       err_one_core_detach:
4834         b43_one_core_detach(dev);
4835       err_wireless_exit:
4836         if (first)
4837                 b43_wireless_exit(dev, wl);
4838         return err;
4839 }
4840
4841 static void b43_remove(struct ssb_device *dev)
4842 {
4843         struct b43_wl *wl = ssb_get_devtypedata(dev);
4844         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4845
4846         /* We must cancel any work here before unregistering from ieee80211,
4847          * as the ieee80211 unreg will destroy the workqueue. */
4848         cancel_work_sync(&wldev->restart_work);
4849
4850         B43_WARN_ON(!wl);
4851         if (wl->current_dev == wldev) {
4852                 /* Restore the queues count before unregistering, because firmware detect
4853                  * might have modified it. Restoring is important, so the networking
4854                  * stack can properly free resources. */
4855                 wl->hw->queues = wl->mac80211_initially_registered_queues;
4856                 ieee80211_unregister_hw(wl->hw);
4857         }
4858
4859         b43_one_core_detach(dev);
4860
4861         if (list_empty(&wl->devlist)) {
4862                 /* Last core on the chip unregistered.
4863                  * We can destroy common struct b43_wl.
4864                  */
4865                 b43_wireless_exit(dev, wl);
4866         }
4867 }
4868
4869 /* Perform a hardware reset. This can be called from any context. */
4870 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4871 {
4872         /* Must avoid requeueing, if we are in shutdown. */
4873         if (b43_status(dev) < B43_STAT_INITIALIZED)
4874                 return;
4875         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4876         queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4877 }
4878
4879 #ifdef CONFIG_PM
4880
4881 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4882 {
4883         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4884         struct b43_wl *wl = wldev->wl;
4885
4886         b43dbg(wl, "Suspending...\n");
4887
4888         mutex_lock(&wl->mutex);
4889         wldev->suspend_in_progress = true;
4890         wldev->suspend_init_status = b43_status(wldev);
4891         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4892                 b43_wireless_core_stop(wldev);
4893         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4894                 b43_wireless_core_exit(wldev);
4895         mutex_unlock(&wl->mutex);
4896
4897         b43dbg(wl, "Device suspended.\n");
4898
4899         return 0;
4900 }
4901
4902 static int b43_resume(struct ssb_device *dev)
4903 {
4904         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4905         struct b43_wl *wl = wldev->wl;
4906         int err = 0;
4907
4908         b43dbg(wl, "Resuming...\n");
4909
4910         mutex_lock(&wl->mutex);
4911         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4912                 err = b43_wireless_core_init(wldev);
4913                 if (err) {
4914                         b43err(wl, "Resume failed at core init\n");
4915                         goto out;
4916                 }
4917         }
4918         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4919                 err = b43_wireless_core_start(wldev);
4920                 if (err) {
4921                         b43_leds_exit(wldev);
4922                         b43_rng_exit(wldev->wl);
4923                         b43_wireless_core_exit(wldev);
4924                         b43err(wl, "Resume failed at core start\n");
4925                         goto out;
4926                 }
4927         }
4928         b43dbg(wl, "Device resumed.\n");
4929  out:
4930         wldev->suspend_in_progress = false;
4931         mutex_unlock(&wl->mutex);
4932         return err;
4933 }
4934
4935 #else /* CONFIG_PM */
4936 # define b43_suspend    NULL
4937 # define b43_resume     NULL
4938 #endif /* CONFIG_PM */
4939
4940 static struct ssb_driver b43_ssb_driver = {
4941         .name           = KBUILD_MODNAME,
4942         .id_table       = b43_ssb_tbl,
4943         .probe          = b43_probe,
4944         .remove         = b43_remove,
4945         .suspend        = b43_suspend,
4946         .resume         = b43_resume,
4947 };
4948
4949 static void b43_print_driverinfo(void)
4950 {
4951         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4952                    *feat_leds = "";
4953
4954 #ifdef CONFIG_B43_PCI_AUTOSELECT
4955         feat_pci = "P";
4956 #endif
4957 #ifdef CONFIG_B43_PCMCIA
4958         feat_pcmcia = "M";
4959 #endif
4960 #ifdef CONFIG_B43_NPHY
4961         feat_nphy = "N";
4962 #endif
4963 #ifdef CONFIG_B43_LEDS
4964         feat_leds = "L";
4965 #endif
4966         printk(KERN_INFO "Broadcom 43xx driver loaded "
4967                "[ Features: %s%s%s%s, Firmware-ID: "
4968                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4969                feat_pci, feat_pcmcia, feat_nphy,
4970                feat_leds);
4971 }
4972
4973 static int __init b43_init(void)
4974 {
4975         int err;
4976
4977         b43_debugfs_init();
4978         err = b43_pcmcia_init();
4979         if (err)
4980                 goto err_dfs_exit;
4981         err = ssb_driver_register(&b43_ssb_driver);
4982         if (err)
4983                 goto err_pcmcia_exit;
4984         b43_print_driverinfo();
4985
4986         return err;
4987
4988 err_pcmcia_exit:
4989         b43_pcmcia_exit();
4990 err_dfs_exit:
4991         b43_debugfs_exit();
4992         return err;
4993 }
4994
4995 static void __exit b43_exit(void)
4996 {
4997         ssb_driver_unregister(&b43_ssb_driver);
4998         b43_pcmcia_exit();
4999         b43_debugfs_exit();
5000 }
5001
5002 module_init(b43_init)
5003 module_exit(b43_exit)