drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1159 {
1160         struct ssb_device *sdev = dev->dev->sdev;
1161         u32 tmslow;
1162         u32 flags = 0;
1163
1164         if (gmode)
1165                 flags |= B43_TMSLOW_GMODE;
1166         flags |= B43_TMSLOW_PHYCLKEN;
1167         flags |= B43_TMSLOW_PHYRESET;
1168         if (dev->phy.type == B43_PHYTYPE_N)
1169                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1170         b43_device_enable(dev, flags);
1171         msleep(2);              /* Wait for the PLL to turn on. */
1172
1173         /* Now take the PHY out of Reset again */
1174         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1175         tmslow |= SSB_TMSLOW_FGC;
1176         tmslow &= ~B43_TMSLOW_PHYRESET;
1177         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1178         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1179         msleep(1);
1180         tmslow &= ~SSB_TMSLOW_FGC;
1181         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1182         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1183         msleep(1);
1184 }
1185
1186 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1187 {
1188         u32 macctl;
1189
1190         b43_ssb_wireless_core_reset(dev, gmode);
1191
1192         /* Turn Analog ON, but only if we already know the PHY-type.
1193          * This protects against very early setup where we don't know the
1194          * PHY-type, yet. wireless_core_reset will be called once again later,
1195          * when we know the PHY-type. */
1196         if (dev->phy.ops)
1197                 dev->phy.ops->switch_analog(dev, 1);
1198
1199         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1200         macctl &= ~B43_MACCTL_GMODE;
1201         if (gmode)
1202                 macctl |= B43_MACCTL_GMODE;
1203         macctl |= B43_MACCTL_IHR_ENABLED;
1204         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1205 }
1206
1207 static void handle_irq_transmit_status(struct b43_wldev *dev)
1208 {
1209         u32 v0, v1;
1210         u16 tmp;
1211         struct b43_txstatus stat;
1212
1213         while (1) {
1214                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1215                 if (!(v0 & 0x00000001))
1216                         break;
1217                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1218
1219                 stat.cookie = (v0 >> 16);
1220                 stat.seq = (v1 & 0x0000FFFF);
1221                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1222                 tmp = (v0 & 0x0000FFFF);
1223                 stat.frame_count = ((tmp & 0xF000) >> 12);
1224                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1225                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1226                 stat.pm_indicated = !!(tmp & 0x0080);
1227                 stat.intermediate = !!(tmp & 0x0040);
1228                 stat.for_ampdu = !!(tmp & 0x0020);
1229                 stat.acked = !!(tmp & 0x0002);
1230
1231                 b43_handle_txstatus(dev, &stat);
1232         }
1233 }
1234
1235 static void drain_txstatus_queue(struct b43_wldev *dev)
1236 {
1237         u32 dummy;
1238
1239         if (dev->dev->core_rev < 5)
1240                 return;
1241         /* Read all entries from the microcode TXstatus FIFO
1242          * and throw them away.
1243          */
1244         while (1) {
1245                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1246                 if (!(dummy & 0x00000001))
1247                         break;
1248                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1249         }
1250 }
1251
1252 static u32 b43_jssi_read(struct b43_wldev *dev)
1253 {
1254         u32 val = 0;
1255
1256         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1257         val <<= 16;
1258         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1259
1260         return val;
1261 }
1262
1263 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1264 {
1265         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1266         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1267 }
1268
1269 static void b43_generate_noise_sample(struct b43_wldev *dev)
1270 {
1271         b43_jssi_write(dev, 0x7F7F7F7F);
1272         b43_write32(dev, B43_MMIO_MACCMD,
1273                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1274 }
1275
1276 static void b43_calculate_link_quality(struct b43_wldev *dev)
1277 {
1278         /* Top half of Link Quality calculation. */
1279
1280         if (dev->phy.type != B43_PHYTYPE_G)
1281                 return;
1282         if (dev->noisecalc.calculation_running)
1283                 return;
1284         dev->noisecalc.calculation_running = 1;
1285         dev->noisecalc.nr_samples = 0;
1286
1287         b43_generate_noise_sample(dev);
1288 }
1289
1290 static void handle_irq_noise(struct b43_wldev *dev)
1291 {
1292         struct b43_phy_g *phy = dev->phy.g;
1293         u16 tmp;
1294         u8 noise[4];
1295         u8 i, j;
1296         s32 average;
1297
1298         /* Bottom half of Link Quality calculation. */
1299
1300         if (dev->phy.type != B43_PHYTYPE_G)
1301                 return;
1302
1303         /* Possible race condition: It might be possible that the user
1304          * changed to a different channel in the meantime since we
1305          * started the calculation. We ignore that fact, since it's
1306          * not really that much of a problem. The background noise is
1307          * an estimation only anyway. Slightly wrong results will get damped
1308          * by the averaging of the 8 sample rounds. Additionally the
1309          * value is shortlived. So it will be replaced by the next noise
1310          * calculation round soon. */
1311
1312         B43_WARN_ON(!dev->noisecalc.calculation_running);
1313         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1314         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1315             noise[2] == 0x7F || noise[3] == 0x7F)
1316                 goto generate_new;
1317
1318         /* Get the noise samples. */
1319         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1320         i = dev->noisecalc.nr_samples;
1321         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1322         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1323         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1324         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1325         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1326         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1327         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1328         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1329         dev->noisecalc.nr_samples++;
1330         if (dev->noisecalc.nr_samples == 8) {
1331                 /* Calculate the Link Quality by the noise samples. */
1332                 average = 0;
1333                 for (i = 0; i < 8; i++) {
1334                         for (j = 0; j < 4; j++)
1335                                 average += dev->noisecalc.samples[i][j];
1336                 }
1337                 average /= (8 * 4);
1338                 average *= 125;
1339                 average += 64;
1340                 average /= 128;
1341                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1342                 tmp = (tmp / 128) & 0x1F;
1343                 if (tmp >= 8)
1344                         average += 2;
1345                 else
1346                         average -= 25;
1347                 if (tmp == 8)
1348                         average -= 72;
1349                 else
1350                         average -= 48;
1351
1352                 dev->stats.link_noise = average;
1353                 dev->noisecalc.calculation_running = 0;
1354                 return;
1355         }
1356 generate_new:
1357         b43_generate_noise_sample(dev);
1358 }
1359
1360 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1361 {
1362         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1363                 ///TODO: PS TBTT
1364         } else {
1365                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1366                         b43_power_saving_ctl_bits(dev, 0);
1367         }
1368         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1369                 dev->dfq_valid = 1;
1370 }
1371
1372 static void handle_irq_atim_end(struct b43_wldev *dev)
1373 {
1374         if (dev->dfq_valid) {
1375                 b43_write32(dev, B43_MMIO_MACCMD,
1376                             b43_read32(dev, B43_MMIO_MACCMD)
1377                             | B43_MACCMD_DFQ_VALID);
1378                 dev->dfq_valid = 0;
1379         }
1380 }
1381
1382 static void handle_irq_pmq(struct b43_wldev *dev)
1383 {
1384         u32 tmp;
1385
1386         //TODO: AP mode.
1387
1388         while (1) {
1389                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1390                 if (!(tmp & 0x00000008))
1391                         break;
1392         }
1393         /* 16bit write is odd, but correct. */
1394         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1395 }
1396
1397 static void b43_write_template_common(struct b43_wldev *dev,
1398                                       const u8 *data, u16 size,
1399                                       u16 ram_offset,
1400                                       u16 shm_size_offset, u8 rate)
1401 {
1402         u32 i, tmp;
1403         struct b43_plcp_hdr4 plcp;
1404
1405         plcp.data = 0;
1406         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1407         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1408         ram_offset += sizeof(u32);
1409         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1410          * So leave the first two bytes of the next write blank.
1411          */
1412         tmp = (u32) (data[0]) << 16;
1413         tmp |= (u32) (data[1]) << 24;
1414         b43_ram_write(dev, ram_offset, tmp);
1415         ram_offset += sizeof(u32);
1416         for (i = 2; i < size; i += sizeof(u32)) {
1417                 tmp = (u32) (data[i + 0]);
1418                 if (i + 1 < size)
1419                         tmp |= (u32) (data[i + 1]) << 8;
1420                 if (i + 2 < size)
1421                         tmp |= (u32) (data[i + 2]) << 16;
1422                 if (i + 3 < size)
1423                         tmp |= (u32) (data[i + 3]) << 24;
1424                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1425         }
1426         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1427                         size + sizeof(struct b43_plcp_hdr6));
1428 }
1429
1430 /* Check if the use of the antenna that ieee80211 told us to
1431  * use is possible. This will fall back to DEFAULT.
1432  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1433 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1434                                   u8 antenna_nr)
1435 {
1436         u8 antenna_mask;
1437
1438         if (antenna_nr == 0) {
1439                 /* Zero means "use default antenna". That's always OK. */
1440                 return 0;
1441         }
1442
1443         /* Get the mask of available antennas. */
1444         if (dev->phy.gmode)
1445                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1446         else
1447                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1448
1449         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1450                 /* This antenna is not available. Fall back to default. */
1451                 return 0;
1452         }
1453
1454         return antenna_nr;
1455 }
1456
1457 /* Convert a b43 antenna number value to the PHY TX control value. */
1458 static u16 b43_antenna_to_phyctl(int antenna)
1459 {
1460         switch (antenna) {
1461         case B43_ANTENNA0:
1462                 return B43_TXH_PHY_ANT0;
1463         case B43_ANTENNA1:
1464                 return B43_TXH_PHY_ANT1;
1465         case B43_ANTENNA2:
1466                 return B43_TXH_PHY_ANT2;
1467         case B43_ANTENNA3:
1468                 return B43_TXH_PHY_ANT3;
1469         case B43_ANTENNA_AUTO0:
1470         case B43_ANTENNA_AUTO1:
1471                 return B43_TXH_PHY_ANT01AUTO;
1472         }
1473         B43_WARN_ON(1);
1474         return 0;
1475 }
1476
1477 static void b43_write_beacon_template(struct b43_wldev *dev,
1478                                       u16 ram_offset,
1479                                       u16 shm_size_offset)
1480 {
1481         unsigned int i, len, variable_len;
1482         const struct ieee80211_mgmt *bcn;
1483         const u8 *ie;
1484         bool tim_found = 0;
1485         unsigned int rate;
1486         u16 ctl;
1487         int antenna;
1488         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1489
1490         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1491         len = min((size_t) dev->wl->current_beacon->len,
1492                   0x200 - sizeof(struct b43_plcp_hdr6));
1493         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1494
1495         b43_write_template_common(dev, (const u8 *)bcn,
1496                                   len, ram_offset, shm_size_offset, rate);
1497
1498         /* Write the PHY TX control parameters. */
1499         antenna = B43_ANTENNA_DEFAULT;
1500         antenna = b43_antenna_to_phyctl(antenna);
1501         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1502         /* We can't send beacons with short preamble. Would get PHY errors. */
1503         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1504         ctl &= ~B43_TXH_PHY_ANT;
1505         ctl &= ~B43_TXH_PHY_ENC;
1506         ctl |= antenna;
1507         if (b43_is_cck_rate(rate))
1508                 ctl |= B43_TXH_PHY_ENC_CCK;
1509         else
1510                 ctl |= B43_TXH_PHY_ENC_OFDM;
1511         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1512
1513         /* Find the position of the TIM and the DTIM_period value
1514          * and write them to SHM. */
1515         ie = bcn->u.beacon.variable;
1516         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1517         for (i = 0; i < variable_len - 2; ) {
1518                 uint8_t ie_id, ie_len;
1519
1520                 ie_id = ie[i];
1521                 ie_len = ie[i + 1];
1522                 if (ie_id == 5) {
1523                         u16 tim_position;
1524                         u16 dtim_period;
1525                         /* This is the TIM Information Element */
1526
1527                         /* Check whether the ie_len is in the beacon data range. */
1528                         if (variable_len < ie_len + 2 + i)
1529                                 break;
1530                         /* A valid TIM is at least 4 bytes long. */
1531                         if (ie_len < 4)
1532                                 break;
1533                         tim_found = 1;
1534
1535                         tim_position = sizeof(struct b43_plcp_hdr6);
1536                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1537                         tim_position += i;
1538
1539                         dtim_period = ie[i + 3];
1540
1541                         b43_shm_write16(dev, B43_SHM_SHARED,
1542                                         B43_SHM_SH_TIMBPOS, tim_position);
1543                         b43_shm_write16(dev, B43_SHM_SHARED,
1544                                         B43_SHM_SH_DTIMPER, dtim_period);
1545                         break;
1546                 }
1547                 i += ie_len + 2;
1548         }
1549         if (!tim_found) {
1550                 /*
1551                  * If ucode wants to modify TIM do it behind the beacon, this
1552                  * will happen, for example, when doing mesh networking.
1553                  */
1554                 b43_shm_write16(dev, B43_SHM_SHARED,
1555                                 B43_SHM_SH_TIMBPOS,
1556                                 len + sizeof(struct b43_plcp_hdr6));
1557                 b43_shm_write16(dev, B43_SHM_SHARED,
1558                                 B43_SHM_SH_DTIMPER, 0);
1559         }
1560         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1561 }
1562
1563 static void b43_upload_beacon0(struct b43_wldev *dev)
1564 {
1565         struct b43_wl *wl = dev->wl;
1566
1567         if (wl->beacon0_uploaded)
1568                 return;
1569         b43_write_beacon_template(dev, 0x68, 0x18);
1570         wl->beacon0_uploaded = 1;
1571 }
1572
1573 static void b43_upload_beacon1(struct b43_wldev *dev)
1574 {
1575         struct b43_wl *wl = dev->wl;
1576
1577         if (wl->beacon1_uploaded)
1578                 return;
1579         b43_write_beacon_template(dev, 0x468, 0x1A);
1580         wl->beacon1_uploaded = 1;
1581 }
1582
1583 static void handle_irq_beacon(struct b43_wldev *dev)
1584 {
1585         struct b43_wl *wl = dev->wl;
1586         u32 cmd, beacon0_valid, beacon1_valid;
1587
1588         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1589             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1590                 return;
1591
1592         /* This is the bottom half of the asynchronous beacon update. */
1593
1594         /* Ignore interrupt in the future. */
1595         dev->irq_mask &= ~B43_IRQ_BEACON;
1596
1597         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1598         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1599         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1600
1601         /* Schedule interrupt manually, if busy. */
1602         if (beacon0_valid && beacon1_valid) {
1603                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1604                 dev->irq_mask |= B43_IRQ_BEACON;
1605                 return;
1606         }
1607
1608         if (unlikely(wl->beacon_templates_virgin)) {
1609                 /* We never uploaded a beacon before.
1610                  * Upload both templates now, but only mark one valid. */
1611                 wl->beacon_templates_virgin = 0;
1612                 b43_upload_beacon0(dev);
1613                 b43_upload_beacon1(dev);
1614                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1615                 cmd |= B43_MACCMD_BEACON0_VALID;
1616                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1617         } else {
1618                 if (!beacon0_valid) {
1619                         b43_upload_beacon0(dev);
1620                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1621                         cmd |= B43_MACCMD_BEACON0_VALID;
1622                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1623                 } else if (!beacon1_valid) {
1624                         b43_upload_beacon1(dev);
1625                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1626                         cmd |= B43_MACCMD_BEACON1_VALID;
1627                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1628                 }
1629         }
1630 }
1631
1632 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1633 {
1634         u32 old_irq_mask = dev->irq_mask;
1635
1636         /* update beacon right away or defer to irq */
1637         handle_irq_beacon(dev);
1638         if (old_irq_mask != dev->irq_mask) {
1639                 /* The handler updated the IRQ mask. */
1640                 B43_WARN_ON(!dev->irq_mask);
1641                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1642                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1643                 } else {
1644                         /* Device interrupts are currently disabled. That means
1645                          * we just ran the hardirq handler and scheduled the
1646                          * IRQ thread. The thread will write the IRQ mask when
1647                          * it finished, so there's nothing to do here. Writing
1648                          * the mask _here_ would incorrectly re-enable IRQs. */
1649                 }
1650         }
1651 }
1652
1653 static void b43_beacon_update_trigger_work(struct work_struct *work)
1654 {
1655         struct b43_wl *wl = container_of(work, struct b43_wl,
1656                                          beacon_update_trigger);
1657         struct b43_wldev *dev;
1658
1659         mutex_lock(&wl->mutex);
1660         dev = wl->current_dev;
1661         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1662                 if (b43_bus_host_is_sdio(dev->dev)) {
1663                         /* wl->mutex is enough. */
1664                         b43_do_beacon_update_trigger_work(dev);
1665                         mmiowb();
1666                 } else {
1667                         spin_lock_irq(&wl->hardirq_lock);
1668                         b43_do_beacon_update_trigger_work(dev);
1669                         mmiowb();
1670                         spin_unlock_irq(&wl->hardirq_lock);
1671                 }
1672         }
1673         mutex_unlock(&wl->mutex);
1674 }
1675
1676 /* Asynchronously update the packet templates in template RAM.
1677  * Locking: Requires wl->mutex to be locked. */
1678 static void b43_update_templates(struct b43_wl *wl)
1679 {
1680         struct sk_buff *beacon;
1681
1682         /* This is the top half of the ansynchronous beacon update.
1683          * The bottom half is the beacon IRQ.
1684          * Beacon update must be asynchronous to avoid sending an
1685          * invalid beacon. This can happen for example, if the firmware
1686          * transmits a beacon while we are updating it. */
1687
1688         /* We could modify the existing beacon and set the aid bit in
1689          * the TIM field, but that would probably require resizing and
1690          * moving of data within the beacon template.
1691          * Simply request a new beacon and let mac80211 do the hard work. */
1692         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1693         if (unlikely(!beacon))
1694                 return;
1695
1696         if (wl->current_beacon)
1697                 dev_kfree_skb_any(wl->current_beacon);
1698         wl->current_beacon = beacon;
1699         wl->beacon0_uploaded = 0;
1700         wl->beacon1_uploaded = 0;
1701         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1702 }
1703
1704 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1705 {
1706         b43_time_lock(dev);
1707         if (dev->dev->core_rev >= 3) {
1708                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1709                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1710         } else {
1711                 b43_write16(dev, 0x606, (beacon_int >> 6));
1712                 b43_write16(dev, 0x610, beacon_int);
1713         }
1714         b43_time_unlock(dev);
1715         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1716 }
1717
1718 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1719 {
1720         u16 reason;
1721
1722         /* Read the register that contains the reason code for the panic. */
1723         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1724         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1725
1726         switch (reason) {
1727         default:
1728                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1729                 /* fallthrough */
1730         case B43_FWPANIC_DIE:
1731                 /* Do not restart the controller or firmware.
1732                  * The device is nonfunctional from now on.
1733                  * Restarting would result in this panic to trigger again,
1734                  * so we avoid that recursion. */
1735                 break;
1736         case B43_FWPANIC_RESTART:
1737                 b43_controller_restart(dev, "Microcode panic");
1738                 break;
1739         }
1740 }
1741
1742 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1743 {
1744         unsigned int i, cnt;
1745         u16 reason, marker_id, marker_line;
1746         __le16 *buf;
1747
1748         /* The proprietary firmware doesn't have this IRQ. */
1749         if (!dev->fw.opensource)
1750                 return;
1751
1752         /* Read the register that contains the reason code for this IRQ. */
1753         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1754
1755         switch (reason) {
1756         case B43_DEBUGIRQ_PANIC:
1757                 b43_handle_firmware_panic(dev);
1758                 break;
1759         case B43_DEBUGIRQ_DUMP_SHM:
1760                 if (!B43_DEBUG)
1761                         break; /* Only with driver debugging enabled. */
1762                 buf = kmalloc(4096, GFP_ATOMIC);
1763                 if (!buf) {
1764                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1765                         goto out;
1766                 }
1767                 for (i = 0; i < 4096; i += 2) {
1768                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1769                         buf[i / 2] = cpu_to_le16(tmp);
1770                 }
1771                 b43info(dev->wl, "Shared memory dump:\n");
1772                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1773                                16, 2, buf, 4096, 1);
1774                 kfree(buf);
1775                 break;
1776         case B43_DEBUGIRQ_DUMP_REGS:
1777                 if (!B43_DEBUG)
1778                         break; /* Only with driver debugging enabled. */
1779                 b43info(dev->wl, "Microcode register dump:\n");
1780                 for (i = 0, cnt = 0; i < 64; i++) {
1781                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1782                         if (cnt == 0)
1783                                 printk(KERN_INFO);
1784                         printk("r%02u: 0x%04X  ", i, tmp);
1785                         cnt++;
1786                         if (cnt == 6) {
1787                                 printk("\n");
1788                                 cnt = 0;
1789                         }
1790                 }
1791                 printk("\n");
1792                 break;
1793         case B43_DEBUGIRQ_MARKER:
1794                 if (!B43_DEBUG)
1795                         break; /* Only with driver debugging enabled. */
1796                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1797                                            B43_MARKER_ID_REG);
1798                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1799                                              B43_MARKER_LINE_REG);
1800                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1801                         "at line number %u\n",
1802                         marker_id, marker_line);
1803                 break;
1804         default:
1805                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1806                        reason);
1807         }
1808 out:
1809         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1810         b43_shm_write16(dev, B43_SHM_SCRATCH,
1811                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1812 }
1813
1814 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1815 {
1816         u32 reason;
1817         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1818         u32 merged_dma_reason = 0;
1819         int i;
1820
1821         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1822                 return;
1823
1824         reason = dev->irq_reason;
1825         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1826                 dma_reason[i] = dev->dma_reason[i];
1827                 merged_dma_reason |= dma_reason[i];
1828         }
1829
1830         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1831                 b43err(dev->wl, "MAC transmission error\n");
1832
1833         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1834                 b43err(dev->wl, "PHY transmission error\n");
1835                 rmb();
1836                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1837                         atomic_set(&dev->phy.txerr_cnt,
1838                                    B43_PHY_TX_BADNESS_LIMIT);
1839                         b43err(dev->wl, "Too many PHY TX errors, "
1840                                         "restarting the controller\n");
1841                         b43_controller_restart(dev, "PHY TX errors");
1842                 }
1843         }
1844
1845         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1846                                           B43_DMAIRQ_NONFATALMASK))) {
1847                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1848                         b43err(dev->wl, "Fatal DMA error: "
1849                                "0x%08X, 0x%08X, 0x%08X, "
1850                                "0x%08X, 0x%08X, 0x%08X\n",
1851                                dma_reason[0], dma_reason[1],
1852                                dma_reason[2], dma_reason[3],
1853                                dma_reason[4], dma_reason[5]);
1854                         b43err(dev->wl, "This device does not support DMA "
1855                                "on your system. It will now be switched to PIO.\n");
1856                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1857                         dev->use_pio = 1;
1858                         b43_controller_restart(dev, "DMA error");
1859                         return;
1860                 }
1861                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1862                         b43err(dev->wl, "DMA error: "
1863                                "0x%08X, 0x%08X, 0x%08X, "
1864                                "0x%08X, 0x%08X, 0x%08X\n",
1865                                dma_reason[0], dma_reason[1],
1866                                dma_reason[2], dma_reason[3],
1867                                dma_reason[4], dma_reason[5]);
1868                 }
1869         }
1870
1871         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1872                 handle_irq_ucode_debug(dev);
1873         if (reason & B43_IRQ_TBTT_INDI)
1874                 handle_irq_tbtt_indication(dev);
1875         if (reason & B43_IRQ_ATIM_END)
1876                 handle_irq_atim_end(dev);
1877         if (reason & B43_IRQ_BEACON)
1878                 handle_irq_beacon(dev);
1879         if (reason & B43_IRQ_PMQ)
1880                 handle_irq_pmq(dev);
1881         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1882                 ;/* TODO */
1883         if (reason & B43_IRQ_NOISESAMPLE_OK)
1884                 handle_irq_noise(dev);
1885
1886         /* Check the DMA reason registers for received data. */
1887         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1888                 if (b43_using_pio_transfers(dev))
1889                         b43_pio_rx(dev->pio.rx_queue);
1890                 else
1891                         b43_dma_rx(dev->dma.rx_ring);
1892         }
1893         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1894         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1895         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1896         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1897         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1898
1899         if (reason & B43_IRQ_TX_OK)
1900                 handle_irq_transmit_status(dev);
1901
1902         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1903         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1904
1905 #if B43_DEBUG
1906         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1907                 dev->irq_count++;
1908                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1909                         if (reason & (1 << i))
1910                                 dev->irq_bit_count[i]++;
1911                 }
1912         }
1913 #endif
1914 }
1915
1916 /* Interrupt thread handler. Handles device interrupts in thread context. */
1917 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1918 {
1919         struct b43_wldev *dev = dev_id;
1920
1921         mutex_lock(&dev->wl->mutex);
1922         b43_do_interrupt_thread(dev);
1923         mmiowb();
1924         mutex_unlock(&dev->wl->mutex);
1925
1926         return IRQ_HANDLED;
1927 }
1928
1929 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1930 {
1931         u32 reason;
1932
1933         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1934          * On SDIO, this runs under wl->mutex. */
1935
1936         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1937         if (reason == 0xffffffff)       /* shared IRQ */
1938                 return IRQ_NONE;
1939         reason &= dev->irq_mask;
1940         if (!reason)
1941                 return IRQ_HANDLED;
1942
1943         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1944             & 0x0001DC00;
1945         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1946             & 0x0000DC00;
1947         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1948             & 0x0000DC00;
1949         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1950             & 0x0001DC00;
1951         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1952             & 0x0000DC00;
1953 /* Unused ring
1954         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1955             & 0x0000DC00;
1956 */
1957
1958         /* ACK the interrupt. */
1959         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1960         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1961         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1962         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1963         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1964         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1965 /* Unused ring
1966         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1967 */
1968
1969         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1970         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1971         /* Save the reason bitmasks for the IRQ thread handler. */
1972         dev->irq_reason = reason;
1973
1974         return IRQ_WAKE_THREAD;
1975 }
1976
1977 /* Interrupt handler top-half. This runs with interrupts disabled. */
1978 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1979 {
1980         struct b43_wldev *dev = dev_id;
1981         irqreturn_t ret;
1982
1983         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1984                 return IRQ_NONE;
1985
1986         spin_lock(&dev->wl->hardirq_lock);
1987         ret = b43_do_interrupt(dev);
1988         mmiowb();
1989         spin_unlock(&dev->wl->hardirq_lock);
1990
1991         return ret;
1992 }
1993
1994 /* SDIO interrupt handler. This runs in process context. */
1995 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
1996 {
1997         struct b43_wl *wl = dev->wl;
1998         irqreturn_t ret;
1999
2000         mutex_lock(&wl->mutex);
2001
2002         ret = b43_do_interrupt(dev);
2003         if (ret == IRQ_WAKE_THREAD)
2004                 b43_do_interrupt_thread(dev);
2005
2006         mutex_unlock(&wl->mutex);
2007 }
2008
2009 void b43_do_release_fw(struct b43_firmware_file *fw)
2010 {
2011         release_firmware(fw->data);
2012         fw->data = NULL;
2013         fw->filename = NULL;
2014 }
2015
2016 static void b43_release_firmware(struct b43_wldev *dev)
2017 {
2018         b43_do_release_fw(&dev->fw.ucode);
2019         b43_do_release_fw(&dev->fw.pcm);
2020         b43_do_release_fw(&dev->fw.initvals);
2021         b43_do_release_fw(&dev->fw.initvals_band);
2022 }
2023
2024 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2025 {
2026         const char text[] =
2027                 "You must go to " \
2028                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2029                 "and download the correct firmware for this driver version. " \
2030                 "Please carefully read all instructions on this website.\n";
2031
2032         if (error)
2033                 b43err(wl, text);
2034         else
2035                 b43warn(wl, text);
2036 }
2037
2038 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2039                       const char *name,
2040                       struct b43_firmware_file *fw)
2041 {
2042         const struct firmware *blob;
2043         struct b43_fw_header *hdr;
2044         u32 size;
2045         int err;
2046
2047         if (!name) {
2048                 /* Don't fetch anything. Free possibly cached firmware. */
2049                 /* FIXME: We should probably keep it anyway, to save some headache
2050                  * on suspend/resume with multiband devices. */
2051                 b43_do_release_fw(fw);
2052                 return 0;
2053         }
2054         if (fw->filename) {
2055                 if ((fw->type == ctx->req_type) &&
2056                     (strcmp(fw->filename, name) == 0))
2057                         return 0; /* Already have this fw. */
2058                 /* Free the cached firmware first. */
2059                 /* FIXME: We should probably do this later after we successfully
2060                  * got the new fw. This could reduce headache with multiband devices.
2061                  * We could also redesign this to cache the firmware for all possible
2062                  * bands all the time. */
2063                 b43_do_release_fw(fw);
2064         }
2065
2066         switch (ctx->req_type) {
2067         case B43_FWTYPE_PROPRIETARY:
2068                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2069                          "b43%s/%s.fw",
2070                          modparam_fwpostfix, name);
2071                 break;
2072         case B43_FWTYPE_OPENSOURCE:
2073                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2074                          "b43-open%s/%s.fw",
2075                          modparam_fwpostfix, name);
2076                 break;
2077         default:
2078                 B43_WARN_ON(1);
2079                 return -ENOSYS;
2080         }
2081         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2082         if (err == -ENOENT) {
2083                 snprintf(ctx->errors[ctx->req_type],
2084                          sizeof(ctx->errors[ctx->req_type]),
2085                          "Firmware file \"%s\" not found\n", ctx->fwname);
2086                 return err;
2087         } else if (err) {
2088                 snprintf(ctx->errors[ctx->req_type],
2089                          sizeof(ctx->errors[ctx->req_type]),
2090                          "Firmware file \"%s\" request failed (err=%d)\n",
2091                          ctx->fwname, err);
2092                 return err;
2093         }
2094         if (blob->size < sizeof(struct b43_fw_header))
2095                 goto err_format;
2096         hdr = (struct b43_fw_header *)(blob->data);
2097         switch (hdr->type) {
2098         case B43_FW_TYPE_UCODE:
2099         case B43_FW_TYPE_PCM:
2100                 size = be32_to_cpu(hdr->size);
2101                 if (size != blob->size - sizeof(struct b43_fw_header))
2102                         goto err_format;
2103                 /* fallthrough */
2104         case B43_FW_TYPE_IV:
2105                 if (hdr->ver != 1)
2106                         goto err_format;
2107                 break;
2108         default:
2109                 goto err_format;
2110         }
2111
2112         fw->data = blob;
2113         fw->filename = name;
2114         fw->type = ctx->req_type;
2115
2116         return 0;
2117
2118 err_format:
2119         snprintf(ctx->errors[ctx->req_type],
2120                  sizeof(ctx->errors[ctx->req_type]),
2121                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2122         release_firmware(blob);
2123
2124         return -EPROTO;
2125 }
2126
2127 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2128 {
2129         struct b43_wldev *dev = ctx->dev;
2130         struct b43_firmware *fw = &ctx->dev->fw;
2131         const u8 rev = ctx->dev->dev->core_rev;
2132         const char *filename;
2133         u32 tmshigh;
2134         int err;
2135
2136         /* Get microcode */
2137         if ((rev >= 5) && (rev <= 10))
2138                 filename = "ucode5";
2139         else if ((rev >= 11) && (rev <= 12))
2140                 filename = "ucode11";
2141         else if (rev == 13)
2142                 filename = "ucode13";
2143         else if (rev == 14)
2144                 filename = "ucode14";
2145         else if (rev == 15)
2146                 filename = "ucode15";
2147         else if ((rev >= 16) && (rev <= 20))
2148                 filename = "ucode16_mimo";
2149         else
2150                 goto err_no_ucode;
2151         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2152         if (err)
2153                 goto err_load;
2154
2155         /* Get PCM code */
2156         if ((rev >= 5) && (rev <= 10))
2157                 filename = "pcm5";
2158         else if (rev >= 11)
2159                 filename = NULL;
2160         else
2161                 goto err_no_pcm;
2162         fw->pcm_request_failed = 0;
2163         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2164         if (err == -ENOENT) {
2165                 /* We did not find a PCM file? Not fatal, but
2166                  * core rev <= 10 must do without hwcrypto then. */
2167                 fw->pcm_request_failed = 1;
2168         } else if (err)
2169                 goto err_load;
2170
2171         /* Get initvals */
2172         switch (dev->phy.type) {
2173         case B43_PHYTYPE_A:
2174                 if ((rev >= 5) && (rev <= 10)) {
2175                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2176                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2177                                 filename = "a0g1initvals5";
2178                         else
2179                                 filename = "a0g0initvals5";
2180                 } else
2181                         goto err_no_initvals;
2182                 break;
2183         case B43_PHYTYPE_G:
2184                 if ((rev >= 5) && (rev <= 10))
2185                         filename = "b0g0initvals5";
2186                 else if (rev >= 13)
2187                         filename = "b0g0initvals13";
2188                 else
2189                         goto err_no_initvals;
2190                 break;
2191         case B43_PHYTYPE_N:
2192                 if (rev >= 16)
2193                         filename = "n0initvals16";
2194                 else if ((rev >= 11) && (rev <= 12))
2195                         filename = "n0initvals11";
2196                 else
2197                         goto err_no_initvals;
2198                 break;
2199         case B43_PHYTYPE_LP:
2200                 if (rev == 13)
2201                         filename = "lp0initvals13";
2202                 else if (rev == 14)
2203                         filename = "lp0initvals14";
2204                 else if (rev >= 15)
2205                         filename = "lp0initvals15";
2206                 else
2207                         goto err_no_initvals;
2208                 break;
2209         default:
2210                 goto err_no_initvals;
2211         }
2212         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2213         if (err)
2214                 goto err_load;
2215
2216         /* Get bandswitch initvals */
2217         switch (dev->phy.type) {
2218         case B43_PHYTYPE_A:
2219                 if ((rev >= 5) && (rev <= 10)) {
2220                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2221                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2222                                 filename = "a0g1bsinitvals5";
2223                         else
2224                                 filename = "a0g0bsinitvals5";
2225                 } else if (rev >= 11)
2226                         filename = NULL;
2227                 else
2228                         goto err_no_initvals;
2229                 break;
2230         case B43_PHYTYPE_G:
2231                 if ((rev >= 5) && (rev <= 10))
2232                         filename = "b0g0bsinitvals5";
2233                 else if (rev >= 11)
2234                         filename = NULL;
2235                 else
2236                         goto err_no_initvals;
2237                 break;
2238         case B43_PHYTYPE_N:
2239                 if (rev >= 16)
2240                         filename = "n0bsinitvals16";
2241                 else if ((rev >= 11) && (rev <= 12))
2242                         filename = "n0bsinitvals11";
2243                 else
2244                         goto err_no_initvals;
2245                 break;
2246         case B43_PHYTYPE_LP:
2247                 if (rev == 13)
2248                         filename = "lp0bsinitvals13";
2249                 else if (rev == 14)
2250                         filename = "lp0bsinitvals14";
2251                 else if (rev >= 15)
2252                         filename = "lp0bsinitvals15";
2253                 else
2254                         goto err_no_initvals;
2255                 break;
2256         default:
2257                 goto err_no_initvals;
2258         }
2259         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2260         if (err)
2261                 goto err_load;
2262
2263         return 0;
2264
2265 err_no_ucode:
2266         err = ctx->fatal_failure = -EOPNOTSUPP;
2267         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2268                "is required for your device (wl-core rev %u)\n", rev);
2269         goto error;
2270
2271 err_no_pcm:
2272         err = ctx->fatal_failure = -EOPNOTSUPP;
2273         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2274                "is required for your device (wl-core rev %u)\n", rev);
2275         goto error;
2276
2277 err_no_initvals:
2278         err = ctx->fatal_failure = -EOPNOTSUPP;
2279         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2280                "is required for your device (wl-core rev %u)\n", rev);
2281         goto error;
2282
2283 err_load:
2284         /* We failed to load this firmware image. The error message
2285          * already is in ctx->errors. Return and let our caller decide
2286          * what to do. */
2287         goto error;
2288
2289 error:
2290         b43_release_firmware(dev);
2291         return err;
2292 }
2293
2294 static int b43_request_firmware(struct b43_wldev *dev)
2295 {
2296         struct b43_request_fw_context *ctx;
2297         unsigned int i;
2298         int err;
2299         const char *errmsg;
2300
2301         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2302         if (!ctx)
2303                 return -ENOMEM;
2304         ctx->dev = dev;
2305
2306         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2307         err = b43_try_request_fw(ctx);
2308         if (!err)
2309                 goto out; /* Successfully loaded it. */
2310         err = ctx->fatal_failure;
2311         if (err)
2312                 goto out;
2313
2314         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2315         err = b43_try_request_fw(ctx);
2316         if (!err)
2317                 goto out; /* Successfully loaded it. */
2318         err = ctx->fatal_failure;
2319         if (err)
2320                 goto out;
2321
2322         /* Could not find a usable firmware. Print the errors. */
2323         for (i = 0; i < B43_NR_FWTYPES; i++) {
2324                 errmsg = ctx->errors[i];
2325                 if (strlen(errmsg))
2326                         b43err(dev->wl, errmsg);
2327         }
2328         b43_print_fw_helptext(dev->wl, 1);
2329         err = -ENOENT;
2330
2331 out:
2332         kfree(ctx);
2333         return err;
2334 }
2335
2336 static int b43_upload_microcode(struct b43_wldev *dev)
2337 {
2338         struct wiphy *wiphy = dev->wl->hw->wiphy;
2339         const size_t hdr_len = sizeof(struct b43_fw_header);
2340         const __be32 *data;
2341         unsigned int i, len;
2342         u16 fwrev, fwpatch, fwdate, fwtime;
2343         u32 tmp, macctl;
2344         int err = 0;
2345
2346         /* Jump the microcode PSM to offset 0 */
2347         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2348         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2349         macctl |= B43_MACCTL_PSM_JMP0;
2350         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2351         /* Zero out all microcode PSM registers and shared memory. */
2352         for (i = 0; i < 64; i++)
2353                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2354         for (i = 0; i < 4096; i += 2)
2355                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2356
2357         /* Upload Microcode. */
2358         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2359         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2360         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2361         for (i = 0; i < len; i++) {
2362                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2363                 udelay(10);
2364         }
2365
2366         if (dev->fw.pcm.data) {
2367                 /* Upload PCM data. */
2368                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2369                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2370                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2371                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2372                 /* No need for autoinc bit in SHM_HW */
2373                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2374                 for (i = 0; i < len; i++) {
2375                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2376                         udelay(10);
2377                 }
2378         }
2379
2380         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2381
2382         /* Start the microcode PSM */
2383         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2384         macctl &= ~B43_MACCTL_PSM_JMP0;
2385         macctl |= B43_MACCTL_PSM_RUN;
2386         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2387
2388         /* Wait for the microcode to load and respond */
2389         i = 0;
2390         while (1) {
2391                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2392                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2393                         break;
2394                 i++;
2395                 if (i >= 20) {
2396                         b43err(dev->wl, "Microcode not responding\n");
2397                         b43_print_fw_helptext(dev->wl, 1);
2398                         err = -ENODEV;
2399                         goto error;
2400                 }
2401                 msleep(50);
2402         }
2403         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2404
2405         /* Get and check the revisions. */
2406         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2407         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2408         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2409         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2410
2411         if (fwrev <= 0x128) {
2412                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2413                        "binary drivers older than version 4.x is unsupported. "
2414                        "You must upgrade your firmware files.\n");
2415                 b43_print_fw_helptext(dev->wl, 1);
2416                 err = -EOPNOTSUPP;
2417                 goto error;
2418         }
2419         dev->fw.rev = fwrev;
2420         dev->fw.patch = fwpatch;
2421         dev->fw.opensource = (fwdate == 0xFFFF);
2422
2423         /* Default to use-all-queues. */
2424         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2425         dev->qos_enabled = !!modparam_qos;
2426         /* Default to firmware/hardware crypto acceleration. */
2427         dev->hwcrypto_enabled = 1;
2428
2429         if (dev->fw.opensource) {
2430                 u16 fwcapa;
2431
2432                 /* Patchlevel info is encoded in the "time" field. */
2433                 dev->fw.patch = fwtime;
2434                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2435                         dev->fw.rev, dev->fw.patch);
2436
2437                 fwcapa = b43_fwcapa_read(dev);
2438                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2439                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2440                         /* Disable hardware crypto and fall back to software crypto. */
2441                         dev->hwcrypto_enabled = 0;
2442                 }
2443                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2444                         b43info(dev->wl, "QoS not supported by firmware\n");
2445                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2446                          * ieee80211_unregister to make sure the networking core can
2447                          * properly free possible resources. */
2448                         dev->wl->hw->queues = 1;
2449                         dev->qos_enabled = 0;
2450                 }
2451         } else {
2452                 b43info(dev->wl, "Loading firmware version %u.%u "
2453                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2454                         fwrev, fwpatch,
2455                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2456                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2457                 if (dev->fw.pcm_request_failed) {
2458                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2459                                 "Hardware accelerated cryptography is disabled.\n");
2460                         b43_print_fw_helptext(dev->wl, 0);
2461                 }
2462         }
2463
2464         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2465                         dev->fw.rev, dev->fw.patch);
2466         wiphy->hw_version = dev->dev->core_id;
2467
2468         if (b43_is_old_txhdr_format(dev)) {
2469                 /* We're over the deadline, but we keep support for old fw
2470                  * until it turns out to be in major conflict with something new. */
2471                 b43warn(dev->wl, "You are using an old firmware image. "
2472                         "Support for old firmware will be removed soon "
2473                         "(official deadline was July 2008).\n");
2474                 b43_print_fw_helptext(dev->wl, 0);
2475         }
2476
2477         return 0;
2478
2479 error:
2480         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2481         macctl &= ~B43_MACCTL_PSM_RUN;
2482         macctl |= B43_MACCTL_PSM_JMP0;
2483         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2484
2485         return err;
2486 }
2487
2488 static int b43_write_initvals(struct b43_wldev *dev,
2489                               const struct b43_iv *ivals,
2490                               size_t count,
2491                               size_t array_size)
2492 {
2493         const struct b43_iv *iv;
2494         u16 offset;
2495         size_t i;
2496         bool bit32;
2497
2498         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2499         iv = ivals;
2500         for (i = 0; i < count; i++) {
2501                 if (array_size < sizeof(iv->offset_size))
2502                         goto err_format;
2503                 array_size -= sizeof(iv->offset_size);
2504                 offset = be16_to_cpu(iv->offset_size);
2505                 bit32 = !!(offset & B43_IV_32BIT);
2506                 offset &= B43_IV_OFFSET_MASK;
2507                 if (offset >= 0x1000)
2508                         goto err_format;
2509                 if (bit32) {
2510                         u32 value;
2511
2512                         if (array_size < sizeof(iv->data.d32))
2513                                 goto err_format;
2514                         array_size -= sizeof(iv->data.d32);
2515
2516                         value = get_unaligned_be32(&iv->data.d32);
2517                         b43_write32(dev, offset, value);
2518
2519                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2520                                                         sizeof(__be16) +
2521                                                         sizeof(__be32));
2522                 } else {
2523                         u16 value;
2524
2525                         if (array_size < sizeof(iv->data.d16))
2526                                 goto err_format;
2527                         array_size -= sizeof(iv->data.d16);
2528
2529                         value = be16_to_cpu(iv->data.d16);
2530                         b43_write16(dev, offset, value);
2531
2532                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2533                                                         sizeof(__be16) +
2534                                                         sizeof(__be16));
2535                 }
2536         }
2537         if (array_size)
2538                 goto err_format;
2539
2540         return 0;
2541
2542 err_format:
2543         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2544         b43_print_fw_helptext(dev->wl, 1);
2545
2546         return -EPROTO;
2547 }
2548
2549 static int b43_upload_initvals(struct b43_wldev *dev)
2550 {
2551         const size_t hdr_len = sizeof(struct b43_fw_header);
2552         const struct b43_fw_header *hdr;
2553         struct b43_firmware *fw = &dev->fw;
2554         const struct b43_iv *ivals;
2555         size_t count;
2556         int err;
2557
2558         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2559         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2560         count = be32_to_cpu(hdr->size);
2561         err = b43_write_initvals(dev, ivals, count,
2562                                  fw->initvals.data->size - hdr_len);
2563         if (err)
2564                 goto out;
2565         if (fw->initvals_band.data) {
2566                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2567                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2568                 count = be32_to_cpu(hdr->size);
2569                 err = b43_write_initvals(dev, ivals, count,
2570                                          fw->initvals_band.data->size - hdr_len);
2571                 if (err)
2572                         goto out;
2573         }
2574 out:
2575
2576         return err;
2577 }
2578
2579 /* Initialize the GPIOs
2580  * http://bcm-specs.sipsolutions.net/GPIO
2581  */
2582 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2583 {
2584         struct ssb_bus *bus = dev->dev->sdev->bus;
2585
2586 #ifdef CONFIG_SSB_DRIVER_PCICORE
2587         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2588 #else
2589         return bus->chipco.dev;
2590 #endif
2591 }
2592
2593 static int b43_gpio_init(struct b43_wldev *dev)
2594 {
2595         struct ssb_device *gpiodev;
2596         u32 mask, set;
2597
2598         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2599                     & ~B43_MACCTL_GPOUTSMSK);
2600
2601         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2602                     | 0x000F);
2603
2604         mask = 0x0000001F;
2605         set = 0x0000000F;
2606         if (dev->dev->chip_id == 0x4301) {
2607                 mask |= 0x0060;
2608                 set |= 0x0060;
2609         }
2610         if (0 /* FIXME: conditional unknown */ ) {
2611                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2612                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2613                             | 0x0100);
2614                 mask |= 0x0180;
2615                 set |= 0x0180;
2616         }
2617         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2618                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2619                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2620                             | 0x0200);
2621                 mask |= 0x0200;
2622                 set |= 0x0200;
2623         }
2624         if (dev->dev->core_rev >= 2)
2625                 mask |= 0x0010; /* FIXME: This is redundant. */
2626
2627         gpiodev = b43_ssb_gpio_dev(dev);
2628         if (gpiodev)
2629                 ssb_write32(gpiodev, B43_GPIO_CONTROL,
2630                             (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2631                              & mask) | set);
2632
2633         return 0;
2634 }
2635
2636 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2637 static void b43_gpio_cleanup(struct b43_wldev *dev)
2638 {
2639         struct ssb_device *gpiodev;
2640
2641         gpiodev = b43_ssb_gpio_dev(dev);
2642         if (gpiodev)
2643                 ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2644 }
2645
2646 /* http://bcm-specs.sipsolutions.net/EnableMac */
2647 void b43_mac_enable(struct b43_wldev *dev)
2648 {
2649         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2650                 u16 fwstate;
2651
2652                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2653                                          B43_SHM_SH_UCODESTAT);
2654                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2655                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2656                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2657                                "should be suspended, but current state is %u\n",
2658                                fwstate);
2659                 }
2660         }
2661
2662         dev->mac_suspended--;
2663         B43_WARN_ON(dev->mac_suspended < 0);
2664         if (dev->mac_suspended == 0) {
2665                 b43_write32(dev, B43_MMIO_MACCTL,
2666                             b43_read32(dev, B43_MMIO_MACCTL)
2667                             | B43_MACCTL_ENABLED);
2668                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2669                             B43_IRQ_MAC_SUSPENDED);
2670                 /* Commit writes */
2671                 b43_read32(dev, B43_MMIO_MACCTL);
2672                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2673                 b43_power_saving_ctl_bits(dev, 0);
2674         }
2675 }
2676
2677 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2678 void b43_mac_suspend(struct b43_wldev *dev)
2679 {
2680         int i;
2681         u32 tmp;
2682
2683         might_sleep();
2684         B43_WARN_ON(dev->mac_suspended < 0);
2685
2686         if (dev->mac_suspended == 0) {
2687                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2688                 b43_write32(dev, B43_MMIO_MACCTL,
2689                             b43_read32(dev, B43_MMIO_MACCTL)
2690                             & ~B43_MACCTL_ENABLED);
2691                 /* force pci to flush the write */
2692                 b43_read32(dev, B43_MMIO_MACCTL);
2693                 for (i = 35; i; i--) {
2694                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2695                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2696                                 goto out;
2697                         udelay(10);
2698                 }
2699                 /* Hm, it seems this will take some time. Use msleep(). */
2700                 for (i = 40; i; i--) {
2701                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2702                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2703                                 goto out;
2704                         msleep(1);
2705                 }
2706                 b43err(dev->wl, "MAC suspend failed\n");
2707         }
2708 out:
2709         dev->mac_suspended++;
2710 }
2711
2712 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2713 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2714 {
2715         u32 tmslow = ssb_read32(dev->sdev, SSB_TMSLOW);
2716         if (on)
2717                 tmslow |= B43_TMSLOW_MACPHYCLKEN;
2718         else
2719                 tmslow &= ~B43_TMSLOW_MACPHYCLKEN;
2720         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
2721 }
2722
2723 static void b43_adjust_opmode(struct b43_wldev *dev)
2724 {
2725         struct b43_wl *wl = dev->wl;
2726         u32 ctl;
2727         u16 cfp_pretbtt;
2728
2729         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2730         /* Reset status to STA infrastructure mode. */
2731         ctl &= ~B43_MACCTL_AP;
2732         ctl &= ~B43_MACCTL_KEEP_CTL;
2733         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2734         ctl &= ~B43_MACCTL_KEEP_BAD;
2735         ctl &= ~B43_MACCTL_PROMISC;
2736         ctl &= ~B43_MACCTL_BEACPROMISC;
2737         ctl |= B43_MACCTL_INFRA;
2738
2739         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2740             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2741                 ctl |= B43_MACCTL_AP;
2742         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2743                 ctl &= ~B43_MACCTL_INFRA;
2744
2745         if (wl->filter_flags & FIF_CONTROL)
2746                 ctl |= B43_MACCTL_KEEP_CTL;
2747         if (wl->filter_flags & FIF_FCSFAIL)
2748                 ctl |= B43_MACCTL_KEEP_BAD;
2749         if (wl->filter_flags & FIF_PLCPFAIL)
2750                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2751         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2752                 ctl |= B43_MACCTL_PROMISC;
2753         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2754                 ctl |= B43_MACCTL_BEACPROMISC;
2755
2756         /* Workaround: On old hardware the HW-MAC-address-filter
2757          * doesn't work properly, so always run promisc in filter
2758          * it in software. */
2759         if (dev->dev->core_rev <= 4)
2760                 ctl |= B43_MACCTL_PROMISC;
2761
2762         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2763
2764         cfp_pretbtt = 2;
2765         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2766                 if (dev->dev->chip_id == 0x4306 &&
2767                     dev->dev->chip_rev == 3)
2768                         cfp_pretbtt = 100;
2769                 else
2770                         cfp_pretbtt = 50;
2771         }
2772         b43_write16(dev, 0x612, cfp_pretbtt);
2773
2774         /* FIXME: We don't currently implement the PMQ mechanism,
2775          *        so always disable it. If we want to implement PMQ,
2776          *        we need to enable it here (clear DISCPMQ) in AP mode.
2777          */
2778         if (0  /* ctl & B43_MACCTL_AP */) {
2779                 b43_write32(dev, B43_MMIO_MACCTL,
2780                             b43_read32(dev, B43_MMIO_MACCTL)
2781                             & ~B43_MACCTL_DISCPMQ);
2782         } else {
2783                 b43_write32(dev, B43_MMIO_MACCTL,
2784                             b43_read32(dev, B43_MMIO_MACCTL)
2785                             | B43_MACCTL_DISCPMQ);
2786         }
2787 }
2788
2789 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2790 {
2791         u16 offset;
2792
2793         if (is_ofdm) {
2794                 offset = 0x480;
2795                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2796         } else {
2797                 offset = 0x4C0;
2798                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2799         }
2800         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2801                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2802 }
2803
2804 static void b43_rate_memory_init(struct b43_wldev *dev)
2805 {
2806         switch (dev->phy.type) {
2807         case B43_PHYTYPE_A:
2808         case B43_PHYTYPE_G:
2809         case B43_PHYTYPE_N:
2810         case B43_PHYTYPE_LP:
2811                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2812                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2813                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2814                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2815                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2816                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2817                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2818                 if (dev->phy.type == B43_PHYTYPE_A)
2819                         break;
2820                 /* fallthrough */
2821         case B43_PHYTYPE_B:
2822                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2823                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2824                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2825                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2826                 break;
2827         default:
2828                 B43_WARN_ON(1);
2829         }
2830 }
2831
2832 /* Set the default values for the PHY TX Control Words. */
2833 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2834 {
2835         u16 ctl = 0;
2836
2837         ctl |= B43_TXH_PHY_ENC_CCK;
2838         ctl |= B43_TXH_PHY_ANT01AUTO;
2839         ctl |= B43_TXH_PHY_TXPWR;
2840
2841         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2842         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2843         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2844 }
2845
2846 /* Set the TX-Antenna for management frames sent by firmware. */
2847 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2848 {
2849         u16 ant;
2850         u16 tmp;
2851
2852         ant = b43_antenna_to_phyctl(antenna);
2853
2854         /* For ACK/CTS */
2855         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2856         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2857         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2858         /* For Probe Resposes */
2859         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2860         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2861         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2862 }
2863
2864 /* This is the opposite of b43_chip_init() */
2865 static void b43_chip_exit(struct b43_wldev *dev)
2866 {
2867         b43_phy_exit(dev);
2868         b43_gpio_cleanup(dev);
2869         /* firmware is released later */
2870 }
2871
2872 /* Initialize the chip
2873  * http://bcm-specs.sipsolutions.net/ChipInit
2874  */
2875 static int b43_chip_init(struct b43_wldev *dev)
2876 {
2877         struct b43_phy *phy = &dev->phy;
2878         int err;
2879         u32 macctl;
2880         u16 value16;
2881
2882         /* Initialize the MAC control */
2883         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2884         if (dev->phy.gmode)
2885                 macctl |= B43_MACCTL_GMODE;
2886         macctl |= B43_MACCTL_INFRA;
2887         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2888
2889         err = b43_request_firmware(dev);
2890         if (err)
2891                 goto out;
2892         err = b43_upload_microcode(dev);
2893         if (err)
2894                 goto out;       /* firmware is released later */
2895
2896         err = b43_gpio_init(dev);
2897         if (err)
2898                 goto out;       /* firmware is released later */
2899
2900         err = b43_upload_initvals(dev);
2901         if (err)
2902                 goto err_gpio_clean;
2903
2904         /* Turn the Analog on and initialize the PHY. */
2905         phy->ops->switch_analog(dev, 1);
2906         err = b43_phy_init(dev);
2907         if (err)
2908                 goto err_gpio_clean;
2909
2910         /* Disable Interference Mitigation. */
2911         if (phy->ops->interf_mitigation)
2912                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2913
2914         /* Select the antennae */
2915         if (phy->ops->set_rx_antenna)
2916                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2917         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2918
2919         if (phy->type == B43_PHYTYPE_B) {
2920                 value16 = b43_read16(dev, 0x005E);
2921                 value16 |= 0x0004;
2922                 b43_write16(dev, 0x005E, value16);
2923         }
2924         b43_write32(dev, 0x0100, 0x01000000);
2925         if (dev->dev->core_rev < 5)
2926                 b43_write32(dev, 0x010C, 0x01000000);
2927
2928         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2929                     & ~B43_MACCTL_INFRA);
2930         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2931                     | B43_MACCTL_INFRA);
2932
2933         /* Probe Response Timeout value */
2934         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2935         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2936
2937         /* Initially set the wireless operation mode. */
2938         b43_adjust_opmode(dev);
2939
2940         if (dev->dev->core_rev < 3) {
2941                 b43_write16(dev, 0x060E, 0x0000);
2942                 b43_write16(dev, 0x0610, 0x8000);
2943                 b43_write16(dev, 0x0604, 0x0000);
2944                 b43_write16(dev, 0x0606, 0x0200);
2945         } else {
2946                 b43_write32(dev, 0x0188, 0x80000000);
2947                 b43_write32(dev, 0x018C, 0x02000000);
2948         }
2949         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2950         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2951         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2952         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2953         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2954         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2955         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2956
2957         b43_mac_phy_clock_set(dev, true);
2958
2959         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2960                     dev->sdev->bus->chipco.fast_pwrup_delay);
2961
2962         err = 0;
2963         b43dbg(dev->wl, "Chip initialized\n");
2964 out:
2965         return err;
2966
2967 err_gpio_clean:
2968         b43_gpio_cleanup(dev);
2969         return err;
2970 }
2971
2972 static void b43_periodic_every60sec(struct b43_wldev *dev)
2973 {
2974         const struct b43_phy_operations *ops = dev->phy.ops;
2975
2976         if (ops->pwork_60sec)
2977                 ops->pwork_60sec(dev);
2978
2979         /* Force check the TX power emission now. */
2980         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2981 }
2982
2983 static void b43_periodic_every30sec(struct b43_wldev *dev)
2984 {
2985         /* Update device statistics. */
2986         b43_calculate_link_quality(dev);
2987 }
2988
2989 static void b43_periodic_every15sec(struct b43_wldev *dev)
2990 {
2991         struct b43_phy *phy = &dev->phy;
2992         u16 wdr;
2993
2994         if (dev->fw.opensource) {
2995                 /* Check if the firmware is still alive.
2996                  * It will reset the watchdog counter to 0 in its idle loop. */
2997                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2998                 if (unlikely(wdr)) {
2999                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3000                         b43_controller_restart(dev, "Firmware watchdog");
3001                         return;
3002                 } else {
3003                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3004                                         B43_WATCHDOG_REG, 1);
3005                 }
3006         }
3007
3008         if (phy->ops->pwork_15sec)
3009                 phy->ops->pwork_15sec(dev);
3010
3011         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3012         wmb();
3013
3014 #if B43_DEBUG
3015         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3016                 unsigned int i;
3017
3018                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3019                        dev->irq_count / 15,
3020                        dev->tx_count / 15,
3021                        dev->rx_count / 15);
3022                 dev->irq_count = 0;
3023                 dev->tx_count = 0;
3024                 dev->rx_count = 0;
3025                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3026                         if (dev->irq_bit_count[i]) {
3027                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3028                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3029                                 dev->irq_bit_count[i] = 0;
3030                         }
3031                 }
3032         }
3033 #endif
3034 }
3035
3036 static void do_periodic_work(struct b43_wldev *dev)
3037 {
3038         unsigned int state;
3039
3040         state = dev->periodic_state;
3041         if (state % 4 == 0)
3042                 b43_periodic_every60sec(dev);
3043         if (state % 2 == 0)
3044                 b43_periodic_every30sec(dev);
3045         b43_periodic_every15sec(dev);
3046 }
3047
3048 /* Periodic work locking policy:
3049  *      The whole periodic work handler is protected by
3050  *      wl->mutex. If another lock is needed somewhere in the
3051  *      pwork callchain, it's acquired in-place, where it's needed.
3052  */
3053 static void b43_periodic_work_handler(struct work_struct *work)
3054 {
3055         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3056                                              periodic_work.work);
3057         struct b43_wl *wl = dev->wl;
3058         unsigned long delay;
3059
3060         mutex_lock(&wl->mutex);
3061
3062         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3063                 goto out;
3064         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3065                 goto out_requeue;
3066
3067         do_periodic_work(dev);
3068
3069         dev->periodic_state++;
3070 out_requeue:
3071         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3072                 delay = msecs_to_jiffies(50);
3073         else
3074                 delay = round_jiffies_relative(HZ * 15);
3075         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3076 out:
3077         mutex_unlock(&wl->mutex);
3078 }
3079
3080 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3081 {
3082         struct delayed_work *work = &dev->periodic_work;
3083
3084         dev->periodic_state = 0;
3085         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3086         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3087 }
3088
3089 /* Check if communication with the device works correctly. */
3090 static int b43_validate_chipaccess(struct b43_wldev *dev)
3091 {
3092         u32 v, backup0, backup4;
3093
3094         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3095         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3096
3097         /* Check for read/write and endianness problems. */
3098         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3099         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3100                 goto error;
3101         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3102         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3103                 goto error;
3104
3105         /* Check if unaligned 32bit SHM_SHARED access works properly.
3106          * However, don't bail out on failure, because it's noncritical. */
3107         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3108         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3109         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3110         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3111         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3112                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3113         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3114         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3115             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3116             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3117             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3118                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3119
3120         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3121         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3122
3123         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3124                 /* The 32bit register shadows the two 16bit registers
3125                  * with update sideeffects. Validate this. */
3126                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3127                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3128                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3129                         goto error;
3130                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3131                         goto error;
3132         }
3133         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3134
3135         v = b43_read32(dev, B43_MMIO_MACCTL);
3136         v |= B43_MACCTL_GMODE;
3137         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3138                 goto error;
3139
3140         return 0;
3141 error:
3142         b43err(dev->wl, "Failed to validate the chipaccess\n");
3143         return -ENODEV;
3144 }
3145
3146 static void b43_security_init(struct b43_wldev *dev)
3147 {
3148         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3149         /* KTP is a word address, but we address SHM bytewise.
3150          * So multiply by two.
3151          */
3152         dev->ktp *= 2;
3153         /* Number of RCMTA address slots */
3154         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3155         /* Clear the key memory. */
3156         b43_clear_keys(dev);
3157 }
3158
3159 #ifdef CONFIG_B43_HWRNG
3160 static int b43_rng_read(struct hwrng *rng, u32 *data)
3161 {
3162         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3163         struct b43_wldev *dev;
3164         int count = -ENODEV;
3165
3166         mutex_lock(&wl->mutex);
3167         dev = wl->current_dev;
3168         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3169                 *data = b43_read16(dev, B43_MMIO_RNG);
3170                 count = sizeof(u16);
3171         }
3172         mutex_unlock(&wl->mutex);
3173
3174         return count;
3175 }
3176 #endif /* CONFIG_B43_HWRNG */
3177
3178 static void b43_rng_exit(struct b43_wl *wl)
3179 {
3180 #ifdef CONFIG_B43_HWRNG
3181         if (wl->rng_initialized)
3182                 hwrng_unregister(&wl->rng);
3183 #endif /* CONFIG_B43_HWRNG */
3184 }
3185
3186 static int b43_rng_init(struct b43_wl *wl)
3187 {
3188         int err = 0;
3189
3190 #ifdef CONFIG_B43_HWRNG
3191         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3192                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3193         wl->rng.name = wl->rng_name;
3194         wl->rng.data_read = b43_rng_read;
3195         wl->rng.priv = (unsigned long)wl;
3196         wl->rng_initialized = 1;
3197         err = hwrng_register(&wl->rng);
3198         if (err) {
3199                 wl->rng_initialized = 0;
3200                 b43err(wl, "Failed to register the random "
3201                        "number generator (%d)\n", err);
3202         }
3203 #endif /* CONFIG_B43_HWRNG */
3204
3205         return err;
3206 }
3207
3208 static void b43_tx_work(struct work_struct *work)
3209 {
3210         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3211         struct b43_wldev *dev;
3212         struct sk_buff *skb;
3213         int err = 0;
3214
3215         mutex_lock(&wl->mutex);
3216         dev = wl->current_dev;
3217         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3218                 mutex_unlock(&wl->mutex);
3219                 return;
3220         }
3221
3222         while (skb_queue_len(&wl->tx_queue)) {
3223                 skb = skb_dequeue(&wl->tx_queue);
3224
3225                 if (b43_using_pio_transfers(dev))
3226                         err = b43_pio_tx(dev, skb);
3227                 else
3228                         err = b43_dma_tx(dev, skb);
3229                 if (unlikely(err))
3230                         dev_kfree_skb(skb); /* Drop it */
3231         }
3232
3233 #if B43_DEBUG
3234         dev->tx_count++;
3235 #endif
3236         mutex_unlock(&wl->mutex);
3237 }
3238
3239 static void b43_op_tx(struct ieee80211_hw *hw,
3240                      struct sk_buff *skb)
3241 {
3242         struct b43_wl *wl = hw_to_b43_wl(hw);
3243
3244         if (unlikely(skb->len < 2 + 2 + 6)) {
3245                 /* Too short, this can't be a valid frame. */
3246                 dev_kfree_skb_any(skb);
3247                 return;
3248         }
3249         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3250
3251         skb_queue_tail(&wl->tx_queue, skb);
3252         ieee80211_queue_work(wl->hw, &wl->tx_work);
3253 }
3254
3255 static void b43_qos_params_upload(struct b43_wldev *dev,
3256                                   const struct ieee80211_tx_queue_params *p,
3257                                   u16 shm_offset)
3258 {
3259         u16 params[B43_NR_QOSPARAMS];
3260         int bslots, tmp;
3261         unsigned int i;
3262
3263         if (!dev->qos_enabled)
3264                 return;
3265
3266         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3267
3268         memset(&params, 0, sizeof(params));
3269
3270         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3271         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3272         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3273         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3274         params[B43_QOSPARAM_AIFS] = p->aifs;
3275         params[B43_QOSPARAM_BSLOTS] = bslots;
3276         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3277
3278         for (i = 0; i < ARRAY_SIZE(params); i++) {
3279                 if (i == B43_QOSPARAM_STATUS) {
3280                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3281                                              shm_offset + (i * 2));
3282                         /* Mark the parameters as updated. */
3283                         tmp |= 0x100;
3284                         b43_shm_write16(dev, B43_SHM_SHARED,
3285                                         shm_offset + (i * 2),
3286                                         tmp);
3287                 } else {
3288                         b43_shm_write16(dev, B43_SHM_SHARED,
3289                                         shm_offset + (i * 2),
3290                                         params[i]);
3291                 }
3292         }
3293 }
3294
3295 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3296 static const u16 b43_qos_shm_offsets[] = {
3297         /* [mac80211-queue-nr] = SHM_OFFSET, */
3298         [0] = B43_QOS_VOICE,
3299         [1] = B43_QOS_VIDEO,
3300         [2] = B43_QOS_BESTEFFORT,
3301         [3] = B43_QOS_BACKGROUND,
3302 };
3303
3304 /* Update all QOS parameters in hardware. */
3305 static void b43_qos_upload_all(struct b43_wldev *dev)
3306 {
3307         struct b43_wl *wl = dev->wl;
3308         struct b43_qos_params *params;
3309         unsigned int i;
3310
3311         if (!dev->qos_enabled)
3312                 return;
3313
3314         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3315                      ARRAY_SIZE(wl->qos_params));
3316
3317         b43_mac_suspend(dev);
3318         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3319                 params = &(wl->qos_params[i]);
3320                 b43_qos_params_upload(dev, &(params->p),
3321                                       b43_qos_shm_offsets[i]);
3322         }
3323         b43_mac_enable(dev);
3324 }
3325
3326 static void b43_qos_clear(struct b43_wl *wl)
3327 {
3328         struct b43_qos_params *params;
3329         unsigned int i;
3330
3331         /* Initialize QoS parameters to sane defaults. */
3332
3333         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3334                      ARRAY_SIZE(wl->qos_params));
3335
3336         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3337                 params = &(wl->qos_params[i]);
3338
3339                 switch (b43_qos_shm_offsets[i]) {
3340                 case B43_QOS_VOICE:
3341                         params->p.txop = 0;
3342                         params->p.aifs = 2;
3343                         params->p.cw_min = 0x0001;
3344                         params->p.cw_max = 0x0001;
3345                         break;
3346                 case B43_QOS_VIDEO:
3347                         params->p.txop = 0;
3348                         params->p.aifs = 2;
3349                         params->p.cw_min = 0x0001;
3350                         params->p.cw_max = 0x0001;
3351                         break;
3352                 case B43_QOS_BESTEFFORT:
3353                         params->p.txop = 0;
3354                         params->p.aifs = 3;
3355                         params->p.cw_min = 0x0001;
3356                         params->p.cw_max = 0x03FF;
3357                         break;
3358                 case B43_QOS_BACKGROUND:
3359                         params->p.txop = 0;
3360                         params->p.aifs = 7;
3361                         params->p.cw_min = 0x0001;
3362                         params->p.cw_max = 0x03FF;
3363                         break;
3364                 default:
3365                         B43_WARN_ON(1);
3366                 }
3367         }
3368 }
3369
3370 /* Initialize the core's QOS capabilities */
3371 static void b43_qos_init(struct b43_wldev *dev)
3372 {
3373         if (!dev->qos_enabled) {
3374                 /* Disable QOS support. */
3375                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3376                 b43_write16(dev, B43_MMIO_IFSCTL,
3377                             b43_read16(dev, B43_MMIO_IFSCTL)
3378                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3379                 b43dbg(dev->wl, "QoS disabled\n");
3380                 return;
3381         }
3382
3383         /* Upload the current QOS parameters. */
3384         b43_qos_upload_all(dev);
3385
3386         /* Enable QOS support. */
3387         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3388         b43_write16(dev, B43_MMIO_IFSCTL,
3389                     b43_read16(dev, B43_MMIO_IFSCTL)
3390                     | B43_MMIO_IFSCTL_USE_EDCF);
3391         b43dbg(dev->wl, "QoS enabled\n");
3392 }
3393
3394 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3395                           const struct ieee80211_tx_queue_params *params)
3396 {
3397         struct b43_wl *wl = hw_to_b43_wl(hw);
3398         struct b43_wldev *dev;
3399         unsigned int queue = (unsigned int)_queue;
3400         int err = -ENODEV;
3401
3402         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3403                 /* Queue not available or don't support setting
3404                  * params on this queue. Return success to not
3405                  * confuse mac80211. */
3406                 return 0;
3407         }
3408         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3409                      ARRAY_SIZE(wl->qos_params));
3410
3411         mutex_lock(&wl->mutex);
3412         dev = wl->current_dev;
3413         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3414                 goto out_unlock;
3415
3416         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3417         b43_mac_suspend(dev);
3418         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3419                               b43_qos_shm_offsets[queue]);
3420         b43_mac_enable(dev);
3421         err = 0;
3422
3423 out_unlock:
3424         mutex_unlock(&wl->mutex);
3425
3426         return err;
3427 }
3428
3429 static int b43_op_get_stats(struct ieee80211_hw *hw,
3430                             struct ieee80211_low_level_stats *stats)
3431 {
3432         struct b43_wl *wl = hw_to_b43_wl(hw);
3433
3434         mutex_lock(&wl->mutex);
3435         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3436         mutex_unlock(&wl->mutex);
3437
3438         return 0;
3439 }
3440
3441 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3442 {
3443         struct b43_wl *wl = hw_to_b43_wl(hw);
3444         struct b43_wldev *dev;
3445         u64 tsf;
3446
3447         mutex_lock(&wl->mutex);
3448         dev = wl->current_dev;
3449
3450         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3451                 b43_tsf_read(dev, &tsf);
3452         else
3453                 tsf = 0;
3454
3455         mutex_unlock(&wl->mutex);
3456
3457         return tsf;
3458 }
3459
3460 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3461 {
3462         struct b43_wl *wl = hw_to_b43_wl(hw);
3463         struct b43_wldev *dev;
3464
3465         mutex_lock(&wl->mutex);
3466         dev = wl->current_dev;
3467
3468         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3469                 b43_tsf_write(dev, tsf);
3470
3471         mutex_unlock(&wl->mutex);
3472 }
3473
3474 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3475 {
3476         struct ssb_device *sdev = dev->sdev;
3477         u32 tmslow;
3478
3479         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3480         tmslow &= ~B43_TMSLOW_GMODE;
3481         tmslow |= B43_TMSLOW_PHYRESET;
3482         tmslow |= SSB_TMSLOW_FGC;
3483         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3484         msleep(1);
3485
3486         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3487         tmslow &= ~SSB_TMSLOW_FGC;
3488         tmslow |= B43_TMSLOW_PHYRESET;
3489         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3490         msleep(1);
3491 }
3492
3493 static const char *band_to_string(enum ieee80211_band band)
3494 {
3495         switch (band) {
3496         case IEEE80211_BAND_5GHZ:
3497                 return "5";
3498         case IEEE80211_BAND_2GHZ:
3499                 return "2.4";
3500         default:
3501                 break;
3502         }
3503         B43_WARN_ON(1);
3504         return "";
3505 }
3506
3507 /* Expects wl->mutex locked */
3508 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3509 {
3510         struct b43_wldev *up_dev = NULL;
3511         struct b43_wldev *down_dev;
3512         struct b43_wldev *d;
3513         int err;
3514         bool uninitialized_var(gmode);
3515         int prev_status;
3516
3517         /* Find a device and PHY which supports the band. */
3518         list_for_each_entry(d, &wl->devlist, list) {
3519                 switch (chan->band) {
3520                 case IEEE80211_BAND_5GHZ:
3521                         if (d->phy.supports_5ghz) {
3522                                 up_dev = d;
3523                                 gmode = 0;
3524                         }
3525                         break;
3526                 case IEEE80211_BAND_2GHZ:
3527                         if (d->phy.supports_2ghz) {
3528                                 up_dev = d;
3529                                 gmode = 1;
3530                         }
3531                         break;
3532                 default:
3533                         B43_WARN_ON(1);
3534                         return -EINVAL;
3535                 }
3536                 if (up_dev)
3537                         break;
3538         }
3539         if (!up_dev) {
3540                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3541                        band_to_string(chan->band));
3542                 return -ENODEV;
3543         }
3544         if ((up_dev == wl->current_dev) &&
3545             (!!wl->current_dev->phy.gmode == !!gmode)) {
3546                 /* This device is already running. */
3547                 return 0;
3548         }
3549         b43dbg(wl, "Switching to %s-GHz band\n",
3550                band_to_string(chan->band));
3551         down_dev = wl->current_dev;
3552
3553         prev_status = b43_status(down_dev);
3554         /* Shutdown the currently running core. */
3555         if (prev_status >= B43_STAT_STARTED)
3556                 down_dev = b43_wireless_core_stop(down_dev);
3557         if (prev_status >= B43_STAT_INITIALIZED)
3558                 b43_wireless_core_exit(down_dev);
3559
3560         if (down_dev != up_dev) {
3561                 /* We switch to a different core, so we put PHY into
3562                  * RESET on the old core. */
3563                 b43_put_phy_into_reset(down_dev);
3564         }
3565
3566         /* Now start the new core. */
3567         up_dev->phy.gmode = gmode;
3568         if (prev_status >= B43_STAT_INITIALIZED) {
3569                 err = b43_wireless_core_init(up_dev);
3570                 if (err) {
3571                         b43err(wl, "Fatal: Could not initialize device for "
3572                                "selected %s-GHz band\n",
3573                                band_to_string(chan->band));
3574                         goto init_failure;
3575                 }
3576         }
3577         if (prev_status >= B43_STAT_STARTED) {
3578                 err = b43_wireless_core_start(up_dev);
3579                 if (err) {
3580                         b43err(wl, "Fatal: Coult not start device for "
3581                                "selected %s-GHz band\n",
3582                                band_to_string(chan->band));
3583                         b43_wireless_core_exit(up_dev);
3584                         goto init_failure;
3585                 }
3586         }
3587         B43_WARN_ON(b43_status(up_dev) != prev_status);
3588
3589         wl->current_dev = up_dev;
3590
3591         return 0;
3592 init_failure:
3593         /* Whoops, failed to init the new core. No core is operating now. */
3594         wl->current_dev = NULL;
3595         return err;
3596 }
3597
3598 /* Write the short and long frame retry limit values. */
3599 static void b43_set_retry_limits(struct b43_wldev *dev,
3600                                  unsigned int short_retry,
3601                                  unsigned int long_retry)
3602 {
3603         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3604          * the chip-internal counter. */
3605         short_retry = min(short_retry, (unsigned int)0xF);
3606         long_retry = min(long_retry, (unsigned int)0xF);
3607
3608         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3609                         short_retry);
3610         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3611                         long_retry);
3612 }
3613
3614 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3615 {
3616         struct b43_wl *wl = hw_to_b43_wl(hw);
3617         struct b43_wldev *dev;
3618         struct b43_phy *phy;
3619         struct ieee80211_conf *conf = &hw->conf;
3620         int antenna;
3621         int err = 0;
3622
3623         mutex_lock(&wl->mutex);
3624
3625         /* Switch the band (if necessary). This might change the active core. */
3626         err = b43_switch_band(wl, conf->channel);
3627         if (err)
3628                 goto out_unlock_mutex;
3629         dev = wl->current_dev;
3630         phy = &dev->phy;
3631
3632         if (conf_is_ht(conf))
3633                 phy->is_40mhz =
3634                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3635         else
3636                 phy->is_40mhz = false;
3637
3638         b43_mac_suspend(dev);
3639
3640         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3641                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3642                                           conf->long_frame_max_tx_count);
3643         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3644         if (!changed)
3645                 goto out_mac_enable;
3646
3647         /* Switch to the requested channel.
3648          * The firmware takes care of races with the TX handler. */
3649         if (conf->channel->hw_value != phy->channel)
3650                 b43_switch_channel(dev, conf->channel->hw_value);
3651
3652         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3653
3654         /* Adjust the desired TX power level. */
3655         if (conf->power_level != 0) {
3656                 if (conf->power_level != phy->desired_txpower) {
3657                         phy->desired_txpower = conf->power_level;
3658                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3659                                                    B43_TXPWR_IGNORE_TSSI);
3660                 }
3661         }
3662
3663         /* Antennas for RX and management frame TX. */
3664         antenna = B43_ANTENNA_DEFAULT;
3665         b43_mgmtframe_txantenna(dev, antenna);
3666         antenna = B43_ANTENNA_DEFAULT;
3667         if (phy->ops->set_rx_antenna)
3668                 phy->ops->set_rx_antenna(dev, antenna);
3669
3670         if (wl->radio_enabled != phy->radio_on) {
3671                 if (wl->radio_enabled) {
3672                         b43_software_rfkill(dev, false);
3673                         b43info(dev->wl, "Radio turned on by software\n");
3674                         if (!dev->radio_hw_enable) {
3675                                 b43info(dev->wl, "The hardware RF-kill button "
3676                                         "still turns the radio physically off. "
3677                                         "Press the button to turn it on.\n");
3678                         }
3679                 } else {
3680                         b43_software_rfkill(dev, true);
3681                         b43info(dev->wl, "Radio turned off by software\n");
3682                 }
3683         }
3684
3685 out_mac_enable:
3686         b43_mac_enable(dev);
3687 out_unlock_mutex:
3688         mutex_unlock(&wl->mutex);
3689
3690         return err;
3691 }
3692
3693 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3694 {
3695         struct ieee80211_supported_band *sband =
3696                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3697         struct ieee80211_rate *rate;
3698         int i;
3699         u16 basic, direct, offset, basic_offset, rateptr;
3700
3701         for (i = 0; i < sband->n_bitrates; i++) {
3702                 rate = &sband->bitrates[i];
3703
3704                 if (b43_is_cck_rate(rate->hw_value)) {
3705                         direct = B43_SHM_SH_CCKDIRECT;
3706                         basic = B43_SHM_SH_CCKBASIC;
3707                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3708                         offset &= 0xF;
3709                 } else {
3710                         direct = B43_SHM_SH_OFDMDIRECT;
3711                         basic = B43_SHM_SH_OFDMBASIC;
3712                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3713                         offset &= 0xF;
3714                 }
3715
3716                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3717
3718                 if (b43_is_cck_rate(rate->hw_value)) {
3719                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3720                         basic_offset &= 0xF;
3721                 } else {
3722                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3723                         basic_offset &= 0xF;
3724                 }
3725
3726                 /*
3727                  * Get the pointer that we need to point to
3728                  * from the direct map
3729                  */
3730                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3731                                          direct + 2 * basic_offset);
3732                 /* and write it to the basic map */
3733                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3734                                 rateptr);
3735         }
3736 }
3737
3738 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3739                                     struct ieee80211_vif *vif,
3740                                     struct ieee80211_bss_conf *conf,
3741                                     u32 changed)
3742 {
3743         struct b43_wl *wl = hw_to_b43_wl(hw);
3744         struct b43_wldev *dev;
3745
3746         mutex_lock(&wl->mutex);
3747
3748         dev = wl->current_dev;
3749         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3750                 goto out_unlock_mutex;
3751
3752         B43_WARN_ON(wl->vif != vif);
3753
3754         if (changed & BSS_CHANGED_BSSID) {
3755                 if (conf->bssid)
3756                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3757                 else
3758                         memset(wl->bssid, 0, ETH_ALEN);
3759         }
3760
3761         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3762                 if (changed & BSS_CHANGED_BEACON &&
3763                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3764                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3765                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3766                         b43_update_templates(wl);
3767
3768                 if (changed & BSS_CHANGED_BSSID)
3769                         b43_write_mac_bssid_templates(dev);
3770         }
3771
3772         b43_mac_suspend(dev);
3773
3774         /* Update templates for AP/mesh mode. */
3775         if (changed & BSS_CHANGED_BEACON_INT &&
3776             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3777              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3778              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3779                 b43_set_beacon_int(dev, conf->beacon_int);
3780
3781         if (changed & BSS_CHANGED_BASIC_RATES)
3782                 b43_update_basic_rates(dev, conf->basic_rates);
3783
3784         if (changed & BSS_CHANGED_ERP_SLOT) {
3785                 if (conf->use_short_slot)
3786                         b43_short_slot_timing_enable(dev);
3787                 else
3788                         b43_short_slot_timing_disable(dev);
3789         }
3790
3791         b43_mac_enable(dev);
3792 out_unlock_mutex:
3793         mutex_unlock(&wl->mutex);
3794 }
3795
3796 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3797                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3798                           struct ieee80211_key_conf *key)
3799 {
3800         struct b43_wl *wl = hw_to_b43_wl(hw);
3801         struct b43_wldev *dev;
3802         u8 algorithm;
3803         u8 index;
3804         int err;
3805         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3806
3807         if (modparam_nohwcrypt)
3808                 return -ENOSPC; /* User disabled HW-crypto */
3809
3810         mutex_lock(&wl->mutex);
3811
3812         dev = wl->current_dev;
3813         err = -ENODEV;
3814         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3815                 goto out_unlock;
3816
3817         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3818                 /* We don't have firmware for the crypto engine.
3819                  * Must use software-crypto. */
3820                 err = -EOPNOTSUPP;
3821                 goto out_unlock;
3822         }
3823
3824         err = -EINVAL;
3825         switch (key->cipher) {
3826         case WLAN_CIPHER_SUITE_WEP40:
3827                 algorithm = B43_SEC_ALGO_WEP40;
3828                 break;
3829         case WLAN_CIPHER_SUITE_WEP104:
3830                 algorithm = B43_SEC_ALGO_WEP104;
3831                 break;
3832         case WLAN_CIPHER_SUITE_TKIP:
3833                 algorithm = B43_SEC_ALGO_TKIP;
3834                 break;
3835         case WLAN_CIPHER_SUITE_CCMP:
3836                 algorithm = B43_SEC_ALGO_AES;
3837                 break;
3838         default:
3839                 B43_WARN_ON(1);
3840                 goto out_unlock;
3841         }
3842         index = (u8) (key->keyidx);
3843         if (index > 3)
3844                 goto out_unlock;
3845
3846         switch (cmd) {
3847         case SET_KEY:
3848                 if (algorithm == B43_SEC_ALGO_TKIP &&
3849                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3850                     !modparam_hwtkip)) {
3851                         /* We support only pairwise key */
3852                         err = -EOPNOTSUPP;
3853                         goto out_unlock;
3854                 }
3855
3856                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3857                         if (WARN_ON(!sta)) {
3858                                 err = -EOPNOTSUPP;
3859                                 goto out_unlock;
3860                         }
3861                         /* Pairwise key with an assigned MAC address. */
3862                         err = b43_key_write(dev, -1, algorithm,
3863                                             key->key, key->keylen,
3864                                             sta->addr, key);
3865                 } else {
3866                         /* Group key */
3867                         err = b43_key_write(dev, index, algorithm,
3868                                             key->key, key->keylen, NULL, key);
3869                 }
3870                 if (err)
3871                         goto out_unlock;
3872
3873                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3874                     algorithm == B43_SEC_ALGO_WEP104) {
3875                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3876                 } else {
3877                         b43_hf_write(dev,
3878                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3879                 }
3880                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3881                 if (algorithm == B43_SEC_ALGO_TKIP)
3882                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3883                 break;
3884         case DISABLE_KEY: {
3885                 err = b43_key_clear(dev, key->hw_key_idx);
3886                 if (err)
3887                         goto out_unlock;
3888                 break;
3889         }
3890         default:
3891                 B43_WARN_ON(1);
3892         }
3893
3894 out_unlock:
3895         if (!err) {
3896                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3897                        "mac: %pM\n",
3898                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3899                        sta ? sta->addr : bcast_addr);
3900                 b43_dump_keymemory(dev);
3901         }
3902         mutex_unlock(&wl->mutex);
3903
3904         return err;
3905 }
3906
3907 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3908                                     unsigned int changed, unsigned int *fflags,
3909                                     u64 multicast)
3910 {
3911         struct b43_wl *wl = hw_to_b43_wl(hw);
3912         struct b43_wldev *dev;
3913
3914         mutex_lock(&wl->mutex);
3915         dev = wl->current_dev;
3916         if (!dev) {
3917                 *fflags = 0;
3918                 goto out_unlock;
3919         }
3920
3921         *fflags &= FIF_PROMISC_IN_BSS |
3922                   FIF_ALLMULTI |
3923                   FIF_FCSFAIL |
3924                   FIF_PLCPFAIL |
3925                   FIF_CONTROL |
3926                   FIF_OTHER_BSS |
3927                   FIF_BCN_PRBRESP_PROMISC;
3928
3929         changed &= FIF_PROMISC_IN_BSS |
3930                    FIF_ALLMULTI |
3931                    FIF_FCSFAIL |
3932                    FIF_PLCPFAIL |
3933                    FIF_CONTROL |
3934                    FIF_OTHER_BSS |
3935                    FIF_BCN_PRBRESP_PROMISC;
3936
3937         wl->filter_flags = *fflags;
3938
3939         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3940                 b43_adjust_opmode(dev);
3941
3942 out_unlock:
3943         mutex_unlock(&wl->mutex);
3944 }
3945
3946 /* Locking: wl->mutex
3947  * Returns the current dev. This might be different from the passed in dev,
3948  * because the core might be gone away while we unlocked the mutex. */
3949 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3950 {
3951         struct b43_wl *wl = dev->wl;
3952         struct b43_wldev *orig_dev;
3953         u32 mask;
3954
3955 redo:
3956         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3957                 return dev;
3958
3959         /* Cancel work. Unlock to avoid deadlocks. */
3960         mutex_unlock(&wl->mutex);
3961         cancel_delayed_work_sync(&dev->periodic_work);
3962         cancel_work_sync(&wl->tx_work);
3963         mutex_lock(&wl->mutex);
3964         dev = wl->current_dev;
3965         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
3966                 /* Whoops, aliens ate up the device while we were unlocked. */
3967                 return dev;
3968         }
3969
3970         /* Disable interrupts on the device. */
3971         b43_set_status(dev, B43_STAT_INITIALIZED);
3972         if (b43_bus_host_is_sdio(dev->dev)) {
3973                 /* wl->mutex is locked. That is enough. */
3974                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3975                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3976         } else {
3977                 spin_lock_irq(&wl->hardirq_lock);
3978                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3979                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3980                 spin_unlock_irq(&wl->hardirq_lock);
3981         }
3982         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
3983         orig_dev = dev;
3984         mutex_unlock(&wl->mutex);
3985         if (b43_bus_host_is_sdio(dev->dev)) {
3986                 b43_sdio_free_irq(dev);
3987         } else {
3988                 synchronize_irq(dev->dev->irq);
3989                 free_irq(dev->dev->irq, dev);
3990         }
3991         mutex_lock(&wl->mutex);
3992         dev = wl->current_dev;
3993         if (!dev)
3994                 return dev;
3995         if (dev != orig_dev) {
3996                 if (b43_status(dev) >= B43_STAT_STARTED)
3997                         goto redo;
3998                 return dev;
3999         }
4000         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4001         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4002
4003         /* Drain the TX queue */
4004         while (skb_queue_len(&wl->tx_queue))
4005                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4006
4007         b43_mac_suspend(dev);
4008         b43_leds_exit(dev);
4009         b43dbg(wl, "Wireless interface stopped\n");
4010
4011         return dev;
4012 }
4013
4014 /* Locking: wl->mutex */
4015 static int b43_wireless_core_start(struct b43_wldev *dev)
4016 {
4017         int err;
4018
4019         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4020
4021         drain_txstatus_queue(dev);
4022         if (b43_bus_host_is_sdio(dev->dev)) {
4023                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4024                 if (err) {
4025                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4026                         goto out;
4027                 }
4028         } else {
4029                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4030                                            b43_interrupt_thread_handler,
4031                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4032                 if (err) {
4033                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4034                                dev->dev->irq);
4035                         goto out;
4036                 }
4037         }
4038
4039         /* We are ready to run. */
4040         ieee80211_wake_queues(dev->wl->hw);
4041         b43_set_status(dev, B43_STAT_STARTED);
4042
4043         /* Start data flow (TX/RX). */
4044         b43_mac_enable(dev);
4045         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4046
4047         /* Start maintenance work */
4048         b43_periodic_tasks_setup(dev);
4049
4050         b43_leds_init(dev);
4051
4052         b43dbg(dev->wl, "Wireless interface started\n");
4053 out:
4054         return err;
4055 }
4056
4057 /* Get PHY and RADIO versioning numbers */
4058 static int b43_phy_versioning(struct b43_wldev *dev)
4059 {
4060         struct b43_phy *phy = &dev->phy;
4061         u32 tmp;
4062         u8 analog_type;
4063         u8 phy_type;
4064         u8 phy_rev;
4065         u16 radio_manuf;
4066         u16 radio_ver;
4067         u16 radio_rev;
4068         int unsupported = 0;
4069
4070         /* Get PHY versioning */
4071         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4072         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4073         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4074         phy_rev = (tmp & B43_PHYVER_VERSION);
4075         switch (phy_type) {
4076         case B43_PHYTYPE_A:
4077                 if (phy_rev >= 4)
4078                         unsupported = 1;
4079                 break;
4080         case B43_PHYTYPE_B:
4081                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4082                     && phy_rev != 7)
4083                         unsupported = 1;
4084                 break;
4085         case B43_PHYTYPE_G:
4086                 if (phy_rev > 9)
4087                         unsupported = 1;
4088                 break;
4089 #ifdef CONFIG_B43_PHY_N
4090         case B43_PHYTYPE_N:
4091                 if (phy_rev > 9)
4092                         unsupported = 1;
4093                 break;
4094 #endif
4095 #ifdef CONFIG_B43_PHY_LP
4096         case B43_PHYTYPE_LP:
4097                 if (phy_rev > 2)
4098                         unsupported = 1;
4099                 break;
4100 #endif
4101 #ifdef CONFIG_B43_PHY_HT
4102         case B43_PHYTYPE_HT:
4103                 if (phy_rev > 1)
4104                         unsupported = 1;
4105                 break;
4106 #endif
4107         default:
4108                 unsupported = 1;
4109         };
4110         if (unsupported) {
4111                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4112                        "(Analog %u, Type %u, Revision %u)\n",
4113                        analog_type, phy_type, phy_rev);
4114                 return -EOPNOTSUPP;
4115         }
4116         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4117                analog_type, phy_type, phy_rev);
4118
4119         /* Get RADIO versioning */
4120         if (dev->dev->chip_id == 0x4317) {
4121                 if (dev->dev->chip_rev == 0)
4122                         tmp = 0x3205017F;
4123                 else if (dev->dev->chip_rev == 1)
4124                         tmp = 0x4205017F;
4125                 else
4126                         tmp = 0x5205017F;
4127         } else {
4128                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4129                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4130                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4131                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4132         }
4133         radio_manuf = (tmp & 0x00000FFF);
4134         radio_ver = (tmp & 0x0FFFF000) >> 12;
4135         radio_rev = (tmp & 0xF0000000) >> 28;
4136         if (radio_manuf != 0x17F /* Broadcom */)
4137                 unsupported = 1;
4138         switch (phy_type) {
4139         case B43_PHYTYPE_A:
4140                 if (radio_ver != 0x2060)
4141                         unsupported = 1;
4142                 if (radio_rev != 1)
4143                         unsupported = 1;
4144                 if (radio_manuf != 0x17F)
4145                         unsupported = 1;
4146                 break;
4147         case B43_PHYTYPE_B:
4148                 if ((radio_ver & 0xFFF0) != 0x2050)
4149                         unsupported = 1;
4150                 break;
4151         case B43_PHYTYPE_G:
4152                 if (radio_ver != 0x2050)
4153                         unsupported = 1;
4154                 break;
4155         case B43_PHYTYPE_N:
4156                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4157                         unsupported = 1;
4158                 break;
4159         case B43_PHYTYPE_LP:
4160                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4161                         unsupported = 1;
4162                 break;
4163         case B43_PHYTYPE_HT:
4164                 if (radio_ver != 0x2059)
4165                         unsupported = 1;
4166                 break;
4167         default:
4168                 B43_WARN_ON(1);
4169         }
4170         if (unsupported) {
4171                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4172                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4173                        radio_manuf, radio_ver, radio_rev);
4174                 return -EOPNOTSUPP;
4175         }
4176         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4177                radio_manuf, radio_ver, radio_rev);
4178
4179         phy->radio_manuf = radio_manuf;
4180         phy->radio_ver = radio_ver;
4181         phy->radio_rev = radio_rev;
4182
4183         phy->analog = analog_type;
4184         phy->type = phy_type;
4185         phy->rev = phy_rev;
4186
4187         return 0;
4188 }
4189
4190 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4191                                       struct b43_phy *phy)
4192 {
4193         phy->hardware_power_control = !!modparam_hwpctl;
4194         phy->next_txpwr_check_time = jiffies;
4195         /* PHY TX errors counter. */
4196         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4197
4198 #if B43_DEBUG
4199         phy->phy_locked = 0;
4200         phy->radio_locked = 0;
4201 #endif
4202 }
4203
4204 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4205 {
4206         dev->dfq_valid = 0;
4207
4208         /* Assume the radio is enabled. If it's not enabled, the state will
4209          * immediately get fixed on the first periodic work run. */
4210         dev->radio_hw_enable = 1;
4211
4212         /* Stats */
4213         memset(&dev->stats, 0, sizeof(dev->stats));
4214
4215         setup_struct_phy_for_init(dev, &dev->phy);
4216
4217         /* IRQ related flags */
4218         dev->irq_reason = 0;
4219         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4220         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4221         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4222                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4223
4224         dev->mac_suspended = 1;
4225
4226         /* Noise calculation context */
4227         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4228 }
4229
4230 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4231 {
4232         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4233         u64 hf;
4234
4235         if (!modparam_btcoex)
4236                 return;
4237         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4238                 return;
4239         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4240                 return;
4241
4242         hf = b43_hf_read(dev);
4243         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4244                 hf |= B43_HF_BTCOEXALT;
4245         else
4246                 hf |= B43_HF_BTCOEX;
4247         b43_hf_write(dev, hf);
4248 }
4249
4250 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4251 {
4252         if (!modparam_btcoex)
4253                 return;
4254         //TODO
4255 }
4256
4257 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4258 {
4259         struct ssb_bus *bus;
4260         u32 tmp;
4261
4262         if (dev->dev->bus_type != B43_BUS_SSB)
4263                 return;
4264
4265         bus = dev->dev->sdev->bus;
4266
4267         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4268             (bus->chip_id == 0x4312)) {
4269                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4270                 tmp &= ~SSB_IMCFGLO_REQTO;
4271                 tmp &= ~SSB_IMCFGLO_SERTO;
4272                 tmp |= 0x3;
4273                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4274                 ssb_commit_settings(bus);
4275         }
4276 }
4277
4278 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4279 {
4280         u16 pu_delay;
4281
4282         /* The time value is in microseconds. */
4283         if (dev->phy.type == B43_PHYTYPE_A)
4284                 pu_delay = 3700;
4285         else
4286                 pu_delay = 1050;
4287         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4288                 pu_delay = 500;
4289         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4290                 pu_delay = max(pu_delay, (u16)2400);
4291
4292         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4293 }
4294
4295 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4296 static void b43_set_pretbtt(struct b43_wldev *dev)
4297 {
4298         u16 pretbtt;
4299
4300         /* The time value is in microseconds. */
4301         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4302                 pretbtt = 2;
4303         } else {
4304                 if (dev->phy.type == B43_PHYTYPE_A)
4305                         pretbtt = 120;
4306                 else
4307                         pretbtt = 250;
4308         }
4309         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4310         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4311 }
4312
4313 /* Shutdown a wireless core */
4314 /* Locking: wl->mutex */
4315 static void b43_wireless_core_exit(struct b43_wldev *dev)
4316 {
4317         u32 macctl;
4318
4319         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4320         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4321                 return;
4322
4323         /* Unregister HW RNG driver */
4324         b43_rng_exit(dev->wl);
4325
4326         b43_set_status(dev, B43_STAT_UNINIT);
4327
4328         /* Stop the microcode PSM. */
4329         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4330         macctl &= ~B43_MACCTL_PSM_RUN;
4331         macctl |= B43_MACCTL_PSM_JMP0;
4332         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4333
4334         b43_dma_free(dev);
4335         b43_pio_free(dev);
4336         b43_chip_exit(dev);
4337         dev->phy.ops->switch_analog(dev, 0);
4338         if (dev->wl->current_beacon) {
4339                 dev_kfree_skb_any(dev->wl->current_beacon);
4340                 dev->wl->current_beacon = NULL;
4341         }
4342
4343         b43_device_disable(dev, 0);
4344         b43_bus_may_powerdown(dev);
4345 }
4346
4347 /* Initialize a wireless core */
4348 static int b43_wireless_core_init(struct b43_wldev *dev)
4349 {
4350         struct ssb_bus *bus = dev->sdev->bus;
4351         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4352         struct b43_phy *phy = &dev->phy;
4353         int err;
4354         u64 hf;
4355
4356         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4357
4358         err = b43_bus_powerup(dev, 0);
4359         if (err)
4360                 goto out;
4361         if (!b43_device_is_enabled(dev))
4362                 b43_wireless_core_reset(dev, phy->gmode);
4363
4364         /* Reset all data structures. */
4365         setup_struct_wldev_for_init(dev);
4366         phy->ops->prepare_structs(dev);
4367
4368         /* Enable IRQ routing to this device. */
4369         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->sdev);
4370
4371         b43_imcfglo_timeouts_workaround(dev);
4372         b43_bluetooth_coext_disable(dev);
4373         if (phy->ops->prepare_hardware) {
4374                 err = phy->ops->prepare_hardware(dev);
4375                 if (err)
4376                         goto err_busdown;
4377         }
4378         err = b43_chip_init(dev);
4379         if (err)
4380                 goto err_busdown;
4381         b43_shm_write16(dev, B43_SHM_SHARED,
4382                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4383         hf = b43_hf_read(dev);
4384         if (phy->type == B43_PHYTYPE_G) {
4385                 hf |= B43_HF_SYMW;
4386                 if (phy->rev == 1)
4387                         hf |= B43_HF_GDCW;
4388                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4389                         hf |= B43_HF_OFDMPABOOST;
4390         }
4391         if (phy->radio_ver == 0x2050) {
4392                 if (phy->radio_rev == 6)
4393                         hf |= B43_HF_4318TSSI;
4394                 if (phy->radio_rev < 6)
4395                         hf |= B43_HF_VCORECALC;
4396         }
4397         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4398                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4399 #ifdef CONFIG_SSB_DRIVER_PCICORE
4400         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4401             (bus->pcicore.dev->id.revision <= 10))
4402                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4403 #endif
4404         hf &= ~B43_HF_SKCFPUP;
4405         b43_hf_write(dev, hf);
4406
4407         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4408                              B43_DEFAULT_LONG_RETRY_LIMIT);
4409         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4410         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4411
4412         /* Disable sending probe responses from firmware.
4413          * Setting the MaxTime to one usec will always trigger
4414          * a timeout, so we never send any probe resp.
4415          * A timeout of zero is infinite. */
4416         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4417
4418         b43_rate_memory_init(dev);
4419         b43_set_phytxctl_defaults(dev);
4420
4421         /* Minimum Contention Window */
4422         if (phy->type == B43_PHYTYPE_B)
4423                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4424         else
4425                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4426         /* Maximum Contention Window */
4427         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4428
4429         if (b43_bus_host_is_pcmcia(dev->dev) ||
4430             b43_bus_host_is_sdio(dev->dev) ||
4431             dev->use_pio) {
4432                 dev->__using_pio_transfers = 1;
4433                 err = b43_pio_init(dev);
4434         } else {
4435                 dev->__using_pio_transfers = 0;
4436                 err = b43_dma_init(dev);
4437         }
4438         if (err)
4439                 goto err_chip_exit;
4440         b43_qos_init(dev);
4441         b43_set_synth_pu_delay(dev, 1);
4442         b43_bluetooth_coext_enable(dev);
4443
4444         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4445         b43_upload_card_macaddress(dev);
4446         b43_security_init(dev);
4447
4448         ieee80211_wake_queues(dev->wl->hw);
4449
4450         b43_set_status(dev, B43_STAT_INITIALIZED);
4451
4452         /* Register HW RNG driver */
4453         b43_rng_init(dev->wl);
4454
4455 out:
4456         return err;
4457
4458 err_chip_exit:
4459         b43_chip_exit(dev);
4460 err_busdown:
4461         b43_bus_may_powerdown(dev);
4462         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4463         return err;
4464 }
4465
4466 static int b43_op_add_interface(struct ieee80211_hw *hw,
4467                                 struct ieee80211_vif *vif)
4468 {
4469         struct b43_wl *wl = hw_to_b43_wl(hw);
4470         struct b43_wldev *dev;
4471         int err = -EOPNOTSUPP;
4472
4473         /* TODO: allow WDS/AP devices to coexist */
4474
4475         if (vif->type != NL80211_IFTYPE_AP &&
4476             vif->type != NL80211_IFTYPE_MESH_POINT &&
4477             vif->type != NL80211_IFTYPE_STATION &&
4478             vif->type != NL80211_IFTYPE_WDS &&
4479             vif->type != NL80211_IFTYPE_ADHOC)
4480                 return -EOPNOTSUPP;
4481
4482         mutex_lock(&wl->mutex);
4483         if (wl->operating)
4484                 goto out_mutex_unlock;
4485
4486         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4487
4488         dev = wl->current_dev;
4489         wl->operating = 1;
4490         wl->vif = vif;
4491         wl->if_type = vif->type;
4492         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4493
4494         b43_adjust_opmode(dev);
4495         b43_set_pretbtt(dev);
4496         b43_set_synth_pu_delay(dev, 0);
4497         b43_upload_card_macaddress(dev);
4498
4499         err = 0;
4500  out_mutex_unlock:
4501         mutex_unlock(&wl->mutex);
4502
4503         return err;
4504 }
4505
4506 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4507                                     struct ieee80211_vif *vif)
4508 {
4509         struct b43_wl *wl = hw_to_b43_wl(hw);
4510         struct b43_wldev *dev = wl->current_dev;
4511
4512         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4513
4514         mutex_lock(&wl->mutex);
4515
4516         B43_WARN_ON(!wl->operating);
4517         B43_WARN_ON(wl->vif != vif);
4518         wl->vif = NULL;
4519
4520         wl->operating = 0;
4521
4522         b43_adjust_opmode(dev);
4523         memset(wl->mac_addr, 0, ETH_ALEN);
4524         b43_upload_card_macaddress(dev);
4525
4526         mutex_unlock(&wl->mutex);
4527 }
4528
4529 static int b43_op_start(struct ieee80211_hw *hw)
4530 {
4531         struct b43_wl *wl = hw_to_b43_wl(hw);
4532         struct b43_wldev *dev = wl->current_dev;
4533         int did_init = 0;
4534         int err = 0;
4535
4536         /* Kill all old instance specific information to make sure
4537          * the card won't use it in the short timeframe between start
4538          * and mac80211 reconfiguring it. */
4539         memset(wl->bssid, 0, ETH_ALEN);
4540         memset(wl->mac_addr, 0, ETH_ALEN);
4541         wl->filter_flags = 0;
4542         wl->radiotap_enabled = 0;
4543         b43_qos_clear(wl);
4544         wl->beacon0_uploaded = 0;
4545         wl->beacon1_uploaded = 0;
4546         wl->beacon_templates_virgin = 1;
4547         wl->radio_enabled = 1;
4548
4549         mutex_lock(&wl->mutex);
4550
4551         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4552                 err = b43_wireless_core_init(dev);
4553                 if (err)
4554                         goto out_mutex_unlock;
4555                 did_init = 1;
4556         }
4557
4558         if (b43_status(dev) < B43_STAT_STARTED) {
4559                 err = b43_wireless_core_start(dev);
4560                 if (err) {
4561                         if (did_init)
4562                                 b43_wireless_core_exit(dev);
4563                         goto out_mutex_unlock;
4564                 }
4565         }
4566
4567         /* XXX: only do if device doesn't support rfkill irq */
4568         wiphy_rfkill_start_polling(hw->wiphy);
4569
4570  out_mutex_unlock:
4571         mutex_unlock(&wl->mutex);
4572
4573         return err;
4574 }
4575
4576 static void b43_op_stop(struct ieee80211_hw *hw)
4577 {
4578         struct b43_wl *wl = hw_to_b43_wl(hw);
4579         struct b43_wldev *dev = wl->current_dev;
4580
4581         cancel_work_sync(&(wl->beacon_update_trigger));
4582
4583         mutex_lock(&wl->mutex);
4584         if (b43_status(dev) >= B43_STAT_STARTED) {
4585                 dev = b43_wireless_core_stop(dev);
4586                 if (!dev)
4587                         goto out_unlock;
4588         }
4589         b43_wireless_core_exit(dev);
4590         wl->radio_enabled = 0;
4591
4592 out_unlock:
4593         mutex_unlock(&wl->mutex);
4594
4595         cancel_work_sync(&(wl->txpower_adjust_work));
4596 }
4597
4598 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4599                                  struct ieee80211_sta *sta, bool set)
4600 {
4601         struct b43_wl *wl = hw_to_b43_wl(hw);
4602
4603         /* FIXME: add locking */
4604         b43_update_templates(wl);
4605
4606         return 0;
4607 }
4608
4609 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4610                               struct ieee80211_vif *vif,
4611                               enum sta_notify_cmd notify_cmd,
4612                               struct ieee80211_sta *sta)
4613 {
4614         struct b43_wl *wl = hw_to_b43_wl(hw);
4615
4616         B43_WARN_ON(!vif || wl->vif != vif);
4617 }
4618
4619 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4620 {
4621         struct b43_wl *wl = hw_to_b43_wl(hw);
4622         struct b43_wldev *dev;
4623
4624         mutex_lock(&wl->mutex);
4625         dev = wl->current_dev;
4626         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4627                 /* Disable CFP update during scan on other channels. */
4628                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4629         }
4630         mutex_unlock(&wl->mutex);
4631 }
4632
4633 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4634 {
4635         struct b43_wl *wl = hw_to_b43_wl(hw);
4636         struct b43_wldev *dev;
4637
4638         mutex_lock(&wl->mutex);
4639         dev = wl->current_dev;
4640         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4641                 /* Re-enable CFP update. */
4642                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4643         }
4644         mutex_unlock(&wl->mutex);
4645 }
4646
4647 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4648                              struct survey_info *survey)
4649 {
4650         struct b43_wl *wl = hw_to_b43_wl(hw);
4651         struct b43_wldev *dev = wl->current_dev;
4652         struct ieee80211_conf *conf = &hw->conf;
4653
4654         if (idx != 0)
4655                 return -ENOENT;
4656
4657         survey->channel = conf->channel;
4658         survey->filled = SURVEY_INFO_NOISE_DBM;
4659         survey->noise = dev->stats.link_noise;
4660
4661         return 0;
4662 }
4663
4664 static const struct ieee80211_ops b43_hw_ops = {
4665         .tx                     = b43_op_tx,
4666         .conf_tx                = b43_op_conf_tx,
4667         .add_interface          = b43_op_add_interface,
4668         .remove_interface       = b43_op_remove_interface,
4669         .config                 = b43_op_config,
4670         .bss_info_changed       = b43_op_bss_info_changed,
4671         .configure_filter       = b43_op_configure_filter,
4672         .set_key                = b43_op_set_key,
4673         .update_tkip_key        = b43_op_update_tkip_key,
4674         .get_stats              = b43_op_get_stats,
4675         .get_tsf                = b43_op_get_tsf,
4676         .set_tsf                = b43_op_set_tsf,
4677         .start                  = b43_op_start,
4678         .stop                   = b43_op_stop,
4679         .set_tim                = b43_op_beacon_set_tim,
4680         .sta_notify             = b43_op_sta_notify,
4681         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4682         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4683         .get_survey             = b43_op_get_survey,
4684         .rfkill_poll            = b43_rfkill_poll,
4685 };
4686
4687 /* Hard-reset the chip. Do not call this directly.
4688  * Use b43_controller_restart()
4689  */
4690 static void b43_chip_reset(struct work_struct *work)
4691 {
4692         struct b43_wldev *dev =
4693             container_of(work, struct b43_wldev, restart_work);
4694         struct b43_wl *wl = dev->wl;
4695         int err = 0;
4696         int prev_status;
4697
4698         mutex_lock(&wl->mutex);
4699
4700         prev_status = b43_status(dev);
4701         /* Bring the device down... */
4702         if (prev_status >= B43_STAT_STARTED) {
4703                 dev = b43_wireless_core_stop(dev);
4704                 if (!dev) {
4705                         err = -ENODEV;
4706                         goto out;
4707                 }
4708         }
4709         if (prev_status >= B43_STAT_INITIALIZED)
4710                 b43_wireless_core_exit(dev);
4711
4712         /* ...and up again. */
4713         if (prev_status >= B43_STAT_INITIALIZED) {
4714                 err = b43_wireless_core_init(dev);
4715                 if (err)
4716                         goto out;
4717         }
4718         if (prev_status >= B43_STAT_STARTED) {
4719                 err = b43_wireless_core_start(dev);
4720                 if (err) {
4721                         b43_wireless_core_exit(dev);
4722                         goto out;
4723                 }
4724         }
4725 out:
4726         if (err)
4727                 wl->current_dev = NULL; /* Failed to init the dev. */
4728         mutex_unlock(&wl->mutex);
4729         if (err)
4730                 b43err(wl, "Controller restart FAILED\n");
4731         else
4732                 b43info(wl, "Controller restarted\n");
4733 }
4734
4735 static int b43_setup_bands(struct b43_wldev *dev,
4736                            bool have_2ghz_phy, bool have_5ghz_phy)
4737 {
4738         struct ieee80211_hw *hw = dev->wl->hw;
4739
4740         if (have_2ghz_phy)
4741                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4742         if (dev->phy.type == B43_PHYTYPE_N) {
4743                 if (have_5ghz_phy)
4744                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4745         } else {
4746                 if (have_5ghz_phy)
4747                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4748         }
4749
4750         dev->phy.supports_2ghz = have_2ghz_phy;
4751         dev->phy.supports_5ghz = have_5ghz_phy;
4752
4753         return 0;
4754 }
4755
4756 static void b43_wireless_core_detach(struct b43_wldev *dev)
4757 {
4758         /* We release firmware that late to not be required to re-request
4759          * is all the time when we reinit the core. */
4760         b43_release_firmware(dev);
4761         b43_phy_free(dev);
4762 }
4763
4764 static int b43_wireless_core_attach(struct b43_wldev *dev)
4765 {
4766         struct b43_wl *wl = dev->wl;
4767         struct ssb_bus *bus = dev->sdev->bus;
4768         struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
4769         int err;
4770         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4771
4772         /* Do NOT do any device initialization here.
4773          * Do it in wireless_core_init() instead.
4774          * This function is for gathering basic information about the HW, only.
4775          * Also some structs may be set up here. But most likely you want to have
4776          * that in core_init(), too.
4777          */
4778
4779         err = b43_bus_powerup(dev, 0);
4780         if (err) {
4781                 b43err(wl, "Bus powerup failed\n");
4782                 goto out;
4783         }
4784         /* Get the PHY type. */
4785         if (dev->dev->core_rev >= 5) {
4786                 u32 tmshigh;
4787
4788                 tmshigh = ssb_read32(dev->sdev, SSB_TMSHIGH);
4789                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4790                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4791         } else
4792                 B43_WARN_ON(1);
4793
4794         dev->phy.gmode = have_2ghz_phy;
4795         dev->phy.radio_on = 1;
4796         b43_wireless_core_reset(dev, dev->phy.gmode);
4797
4798         err = b43_phy_versioning(dev);
4799         if (err)
4800                 goto err_powerdown;
4801         /* Check if this device supports multiband. */
4802         if (!pdev ||
4803             (pdev->device != 0x4312 &&
4804              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4805                 /* No multiband support. */
4806                 have_2ghz_phy = 0;
4807                 have_5ghz_phy = 0;
4808                 switch (dev->phy.type) {
4809                 case B43_PHYTYPE_A:
4810                         have_5ghz_phy = 1;
4811                         break;
4812                 case B43_PHYTYPE_LP: //FIXME not always!
4813 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4814                         have_5ghz_phy = 1;
4815 #endif
4816                 case B43_PHYTYPE_G:
4817                 case B43_PHYTYPE_N:
4818                         have_2ghz_phy = 1;
4819                         break;
4820                 default:
4821                         B43_WARN_ON(1);
4822                 }
4823         }
4824         if (dev->phy.type == B43_PHYTYPE_A) {
4825                 /* FIXME */
4826                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4827                 err = -EOPNOTSUPP;
4828                 goto err_powerdown;
4829         }
4830         if (1 /* disable A-PHY */) {
4831                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4832                 if (dev->phy.type != B43_PHYTYPE_N &&
4833                     dev->phy.type != B43_PHYTYPE_LP) {
4834                         have_2ghz_phy = 1;
4835                         have_5ghz_phy = 0;
4836                 }
4837         }
4838
4839         err = b43_phy_allocate(dev);
4840         if (err)
4841                 goto err_powerdown;
4842
4843         dev->phy.gmode = have_2ghz_phy;
4844         b43_wireless_core_reset(dev, dev->phy.gmode);
4845
4846         err = b43_validate_chipaccess(dev);
4847         if (err)
4848                 goto err_phy_free;
4849         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4850         if (err)
4851                 goto err_phy_free;
4852
4853         /* Now set some default "current_dev" */
4854         if (!wl->current_dev)
4855                 wl->current_dev = dev;
4856         INIT_WORK(&dev->restart_work, b43_chip_reset);
4857
4858         dev->phy.ops->switch_analog(dev, 0);
4859         b43_device_disable(dev, 0);
4860         b43_bus_may_powerdown(dev);
4861
4862 out:
4863         return err;
4864
4865 err_phy_free:
4866         b43_phy_free(dev);
4867 err_powerdown:
4868         b43_bus_may_powerdown(dev);
4869         return err;
4870 }
4871
4872 static void b43_one_core_detach(struct b43_bus_dev *dev)
4873 {
4874         struct b43_wldev *wldev;
4875         struct b43_wl *wl;
4876
4877         /* Do not cancel ieee80211-workqueue based work here.
4878          * See comment in b43_remove(). */
4879
4880         wldev = ssb_get_drvdata(dev->sdev);
4881         wl = wldev->wl;
4882         b43_debugfs_remove_device(wldev);
4883         b43_wireless_core_detach(wldev);
4884         list_del(&wldev->list);
4885         wl->nr_devs--;
4886         ssb_set_drvdata(dev->sdev, NULL);
4887         kfree(wldev);
4888 }
4889
4890 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
4891 {
4892         struct b43_wldev *wldev;
4893         int err = -ENOMEM;
4894
4895         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4896         if (!wldev)
4897                 goto out;
4898
4899         wldev->use_pio = b43_modparam_pio;
4900         wldev->dev = dev;
4901         wldev->sdev = dev->sdev; /* TODO: Remove when not needed */
4902         wldev->wl = wl;
4903         b43_set_status(wldev, B43_STAT_UNINIT);
4904         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4905         INIT_LIST_HEAD(&wldev->list);
4906
4907         err = b43_wireless_core_attach(wldev);
4908         if (err)
4909                 goto err_kfree_wldev;
4910
4911         list_add(&wldev->list, &wl->devlist);
4912         wl->nr_devs++;
4913         ssb_set_drvdata(dev->sdev, wldev);
4914         b43_debugfs_add_device(wldev);
4915
4916       out:
4917         return err;
4918
4919       err_kfree_wldev:
4920         kfree(wldev);
4921         return err;
4922 }
4923
4924 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4925         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4926         (pdev->device == _device) &&                                    \
4927         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4928         (pdev->subsystem_device == _subdevice)                          )
4929
4930 static void b43_sprom_fixup(struct ssb_bus *bus)
4931 {
4932         struct pci_dev *pdev;
4933
4934         /* boardflags workarounds */
4935         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4936             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4937                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4938         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4939             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4940                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4941         if (bus->bustype == SSB_BUSTYPE_PCI) {
4942                 pdev = bus->host_pci;
4943                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4944                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4945                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4946                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4947                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4948                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4949                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4950                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4951         }
4952 }
4953
4954 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
4955 {
4956         struct ieee80211_hw *hw = wl->hw;
4957
4958         ssb_set_devtypedata(dev->sdev, NULL);
4959         ieee80211_free_hw(hw);
4960 }
4961
4962 static struct b43_wl *b43_wireless_init(struct ssb_device *dev)
4963 {
4964         struct ssb_sprom *sprom = &dev->bus->sprom;
4965         struct ieee80211_hw *hw;
4966         struct b43_wl *wl;
4967
4968         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4969         if (!hw) {
4970                 b43err(NULL, "Could not allocate ieee80211 device\n");
4971                 return ERR_PTR(-ENOMEM);
4972         }
4973         wl = hw_to_b43_wl(hw);
4974
4975         /* fill hw info */
4976         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4977                     IEEE80211_HW_SIGNAL_DBM;
4978
4979         hw->wiphy->interface_modes =
4980                 BIT(NL80211_IFTYPE_AP) |
4981                 BIT(NL80211_IFTYPE_MESH_POINT) |
4982                 BIT(NL80211_IFTYPE_STATION) |
4983                 BIT(NL80211_IFTYPE_WDS) |
4984                 BIT(NL80211_IFTYPE_ADHOC);
4985
4986         hw->queues = modparam_qos ? 4 : 1;
4987         wl->mac80211_initially_registered_queues = hw->queues;
4988         hw->max_rates = 2;
4989         SET_IEEE80211_DEV(hw, dev->dev);
4990         if (is_valid_ether_addr(sprom->et1mac))
4991                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4992         else
4993                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4994
4995         /* Initialize struct b43_wl */
4996         wl->hw = hw;
4997         mutex_init(&wl->mutex);
4998         spin_lock_init(&wl->hardirq_lock);
4999         INIT_LIST_HEAD(&wl->devlist);
5000         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5001         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5002         INIT_WORK(&wl->tx_work, b43_tx_work);
5003         skb_queue_head_init(&wl->tx_queue);
5004
5005         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
5006                 dev->bus->chip_id, dev->id.revision);
5007         return wl;
5008 }
5009
5010 #ifdef CONFIG_B43_BCMA
5011 static int b43_bcma_probe(struct bcma_device *core)
5012 {
5013         b43err(NULL, "BCMA is not supported yet!");
5014         return -EOPNOTSUPP;
5015 }
5016
5017 static void b43_bcma_remove(struct bcma_device *core)
5018 {
5019         /* TODO */
5020 }
5021
5022 static struct bcma_driver b43_bcma_driver = {
5023         .name           = KBUILD_MODNAME,
5024         .id_table       = b43_bcma_tbl,
5025         .probe          = b43_bcma_probe,
5026         .remove         = b43_bcma_remove,
5027 };
5028 #endif
5029
5030 #ifdef CONFIG_B43_SSB
5031 static
5032 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5033 {
5034         struct b43_bus_dev *dev;
5035         struct b43_wl *wl;
5036         int err;
5037         int first = 0;
5038
5039         dev = b43_bus_dev_ssb_init(sdev);
5040         if (!dev)
5041                 return -ENOMEM;
5042
5043         wl = ssb_get_devtypedata(sdev);
5044         if (!wl) {
5045                 /* Probing the first core. Must setup common struct b43_wl */
5046                 first = 1;
5047                 b43_sprom_fixup(sdev->bus);
5048                 wl = b43_wireless_init(sdev);
5049                 if (IS_ERR(wl)) {
5050                         err = PTR_ERR(wl);
5051                         goto out;
5052                 }
5053                 ssb_set_devtypedata(sdev, wl);
5054                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5055         }
5056         err = b43_one_core_attach(dev, wl);
5057         if (err)
5058                 goto err_wireless_exit;
5059
5060         if (first) {
5061                 err = ieee80211_register_hw(wl->hw);
5062                 if (err)
5063                         goto err_one_core_detach;
5064                 b43_leds_register(wl->current_dev);
5065         }
5066
5067       out:
5068         return err;
5069
5070       err_one_core_detach:
5071         b43_one_core_detach(dev);
5072       err_wireless_exit:
5073         if (first)
5074                 b43_wireless_exit(dev, wl);
5075         return err;
5076 }
5077
5078 static void b43_ssb_remove(struct ssb_device *sdev)
5079 {
5080         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5081         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5082
5083         /* We must cancel any work here before unregistering from ieee80211,
5084          * as the ieee80211 unreg will destroy the workqueue. */
5085         cancel_work_sync(&wldev->restart_work);
5086
5087         B43_WARN_ON(!wl);
5088         if (wl->current_dev == wldev) {
5089                 /* Restore the queues count before unregistering, because firmware detect
5090                  * might have modified it. Restoring is important, so the networking
5091                  * stack can properly free resources. */
5092                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5093                 b43_leds_stop(wldev);
5094                 ieee80211_unregister_hw(wl->hw);
5095         }
5096
5097         b43_one_core_detach(wldev->dev);
5098
5099         if (list_empty(&wl->devlist)) {
5100                 b43_leds_unregister(wl);
5101                 /* Last core on the chip unregistered.
5102                  * We can destroy common struct b43_wl.
5103                  */
5104                 b43_wireless_exit(wldev->dev, wl);
5105         }
5106 }
5107
5108 static struct ssb_driver b43_ssb_driver = {
5109         .name           = KBUILD_MODNAME,
5110         .id_table       = b43_ssb_tbl,
5111         .probe          = b43_ssb_probe,
5112         .remove         = b43_ssb_remove,
5113 };
5114 #endif /* CONFIG_B43_SSB */
5115
5116 /* Perform a hardware reset. This can be called from any context. */
5117 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5118 {
5119         /* Must avoid requeueing, if we are in shutdown. */
5120         if (b43_status(dev) < B43_STAT_INITIALIZED)
5121                 return;
5122         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5123         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5124 }
5125
5126 static void b43_print_driverinfo(void)
5127 {
5128         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5129                    *feat_leds = "", *feat_sdio = "";
5130
5131 #ifdef CONFIG_B43_PCI_AUTOSELECT
5132         feat_pci = "P";
5133 #endif
5134 #ifdef CONFIG_B43_PCMCIA
5135         feat_pcmcia = "M";
5136 #endif
5137 #ifdef CONFIG_B43_PHY_N
5138         feat_nphy = "N";
5139 #endif
5140 #ifdef CONFIG_B43_LEDS
5141         feat_leds = "L";
5142 #endif
5143 #ifdef CONFIG_B43_SDIO
5144         feat_sdio = "S";
5145 #endif
5146         printk(KERN_INFO "Broadcom 43xx driver loaded "
5147                "[ Features: %s%s%s%s%s, Firmware-ID: "
5148                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5149                feat_pci, feat_pcmcia, feat_nphy,
5150                feat_leds, feat_sdio);
5151 }
5152
5153 static int __init b43_init(void)
5154 {
5155         int err;
5156
5157         b43_debugfs_init();
5158         err = b43_pcmcia_init();
5159         if (err)
5160                 goto err_dfs_exit;
5161         err = b43_sdio_init();
5162         if (err)
5163                 goto err_pcmcia_exit;
5164 #ifdef CONFIG_B43_BCMA
5165         err = bcma_driver_register(&b43_bcma_driver);
5166         if (err)
5167                 goto err_sdio_exit;
5168 #endif
5169 #ifdef CONFIG_B43_SSB
5170         err = ssb_driver_register(&b43_ssb_driver);
5171         if (err)
5172                 goto err_bcma_driver_exit;
5173 #endif
5174         b43_print_driverinfo();
5175
5176         return err;
5177
5178 #ifdef CONFIG_B43_SSB
5179 err_bcma_driver_exit:
5180 #endif
5181 #ifdef CONFIG_B43_BCMA
5182         bcma_driver_unregister(&b43_bcma_driver);
5183 err_sdio_exit:
5184 #endif
5185         b43_sdio_exit();
5186 err_pcmcia_exit:
5187         b43_pcmcia_exit();
5188 err_dfs_exit:
5189         b43_debugfs_exit();
5190         return err;
5191 }
5192
5193 static void __exit b43_exit(void)
5194 {
5195 #ifdef CONFIG_B43_SSB
5196         ssb_driver_unregister(&b43_ssb_driver);
5197 #endif
5198 #ifdef CONFIG_B43_BCMA
5199         bcma_driver_unregister(&b43_bcma_driver);
5200 #endif
5201         b43_sdio_exit();
5202         b43_pcmcia_exit();
5203         b43_debugfs_exit();
5204 }
5205
5206 module_init(b43_init)
5207 module_exit(b43_exit)