drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 static const struct ssb_device_id b43_ssb_tbl[] = {
 117         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 118         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 119         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 120         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 121         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 122         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 123         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 124         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 125         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 126         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 127         SSB_DEVTABLE_END
 128 };
 129
 130 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 131
 132 /* Channel and ratetables are shared for all devices.
 133  * They can't be const, because ieee80211 puts some precalculated
 134  * data in there. This data is the same for all devices, so we don't
 135  * get concurrency issues */
 136 #define RATETAB_ENT(_rateid, _flags) \
 137         {                                                               \
 138                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 139                 .hw_value       = (_rateid),                            \
 140                 .flags          = (_flags),                             \
 141         }
 142
 143 /*
 144  * NOTE: When changing this, sync with xmit.c's
 145  *       b43_plcp_get_bitrate_idx_* functions!
 146  */
 147 static struct ieee80211_rate __b43_ratetable[] = {
 148         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 149         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 151         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 152         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 153         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 154         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 155         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 156         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 157         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 158         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 159         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 160 };
 161
 162 #define b43_a_ratetable         (__b43_ratetable + 4)
 163 #define b43_a_ratetable_size    8
 164 #define b43_b_ratetable         (__b43_ratetable + 0)
 165 #define b43_b_ratetable_size    4
 166 #define b43_g_ratetable         (__b43_ratetable + 0)
 167 #define b43_g_ratetable_size    12
 168
 169 #define CHAN4G(_channel, _freq, _flags) {                       \
 170         .band                   = IEEE80211_BAND_2GHZ,          \
 171         .center_freq            = (_freq),                      \
 172         .hw_value               = (_channel),                   \
 173         .flags                  = (_flags),                     \
 174         .max_antenna_gain       = 0,                            \
 175         .max_power              = 30,                           \
 176 }
 177 static struct ieee80211_channel b43_2ghz_chantable[] = {
 178         CHAN4G(1, 2412, 0),
 179         CHAN4G(2, 2417, 0),
 180         CHAN4G(3, 2422, 0),
 181         CHAN4G(4, 2427, 0),
 182         CHAN4G(5, 2432, 0),
 183         CHAN4G(6, 2437, 0),
 184         CHAN4G(7, 2442, 0),
 185         CHAN4G(8, 2447, 0),
 186         CHAN4G(9, 2452, 0),
 187         CHAN4G(10, 2457, 0),
 188         CHAN4G(11, 2462, 0),
 189         CHAN4G(12, 2467, 0),
 190         CHAN4G(13, 2472, 0),
 191         CHAN4G(14, 2484, 0),
 192 };
 193 #undef CHAN4G
 194
 195 #define CHAN5G(_channel, _flags) {                              \
 196         .band                   = IEEE80211_BAND_5GHZ,          \
 197         .center_freq            = 5000 + (5 * (_channel)),      \
 198         .hw_value               = (_channel),                   \
 199         .flags                  = (_flags),                     \
 200         .max_antenna_gain       = 0,                            \
 201         .max_power              = 30,                           \
 202 }
 203 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 204         CHAN5G(32, 0),          CHAN5G(34, 0),
 205         CHAN5G(36, 0),          CHAN5G(38, 0),
 206         CHAN5G(40, 0),          CHAN5G(42, 0),
 207         CHAN5G(44, 0),          CHAN5G(46, 0),
 208         CHAN5G(48, 0),          CHAN5G(50, 0),
 209         CHAN5G(52, 0),          CHAN5G(54, 0),
 210         CHAN5G(56, 0),          CHAN5G(58, 0),
 211         CHAN5G(60, 0),          CHAN5G(62, 0),
 212         CHAN5G(64, 0),          CHAN5G(66, 0),
 213         CHAN5G(68, 0),          CHAN5G(70, 0),
 214         CHAN5G(72, 0),          CHAN5G(74, 0),
 215         CHAN5G(76, 0),          CHAN5G(78, 0),
 216         CHAN5G(80, 0),          CHAN5G(82, 0),
 217         CHAN5G(84, 0),          CHAN5G(86, 0),
 218         CHAN5G(88, 0),          CHAN5G(90, 0),
 219         CHAN5G(92, 0),          CHAN5G(94, 0),
 220         CHAN5G(96, 0),          CHAN5G(98, 0),
 221         CHAN5G(100, 0),         CHAN5G(102, 0),
 222         CHAN5G(104, 0),         CHAN5G(106, 0),
 223         CHAN5G(108, 0),         CHAN5G(110, 0),
 224         CHAN5G(112, 0),         CHAN5G(114, 0),
 225         CHAN5G(116, 0),         CHAN5G(118, 0),
 226         CHAN5G(120, 0),         CHAN5G(122, 0),
 227         CHAN5G(124, 0),         CHAN5G(126, 0),
 228         CHAN5G(128, 0),         CHAN5G(130, 0),
 229         CHAN5G(132, 0),         CHAN5G(134, 0),
 230         CHAN5G(136, 0),         CHAN5G(138, 0),
 231         CHAN5G(140, 0),         CHAN5G(142, 0),
 232         CHAN5G(144, 0),         CHAN5G(145, 0),
 233         CHAN5G(146, 0),         CHAN5G(147, 0),
 234         CHAN5G(148, 0),         CHAN5G(149, 0),
 235         CHAN5G(150, 0),         CHAN5G(151, 0),
 236         CHAN5G(152, 0),         CHAN5G(153, 0),
 237         CHAN5G(154, 0),         CHAN5G(155, 0),
 238         CHAN5G(156, 0),         CHAN5G(157, 0),
 239         CHAN5G(158, 0),         CHAN5G(159, 0),
 240         CHAN5G(160, 0),         CHAN5G(161, 0),
 241         CHAN5G(162, 0),         CHAN5G(163, 0),
 242         CHAN5G(164, 0),         CHAN5G(165, 0),
 243         CHAN5G(166, 0),         CHAN5G(168, 0),
 244         CHAN5G(170, 0),         CHAN5G(172, 0),
 245         CHAN5G(174, 0),         CHAN5G(176, 0),
 246         CHAN5G(178, 0),         CHAN5G(180, 0),
 247         CHAN5G(182, 0),         CHAN5G(184, 0),
 248         CHAN5G(186, 0),         CHAN5G(188, 0),
 249         CHAN5G(190, 0),         CHAN5G(192, 0),
 250         CHAN5G(194, 0),         CHAN5G(196, 0),
 251         CHAN5G(198, 0),         CHAN5G(200, 0),
 252         CHAN5G(202, 0),         CHAN5G(204, 0),
 253         CHAN5G(206, 0),         CHAN5G(208, 0),
 254         CHAN5G(210, 0),         CHAN5G(212, 0),
 255         CHAN5G(214, 0),         CHAN5G(216, 0),
 256         CHAN5G(218, 0),         CHAN5G(220, 0),
 257         CHAN5G(222, 0),         CHAN5G(224, 0),
 258         CHAN5G(226, 0),         CHAN5G(228, 0),
 259 };
 260
 261 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 262         CHAN5G(34, 0),          CHAN5G(36, 0),
 263         CHAN5G(38, 0),          CHAN5G(40, 0),
 264         CHAN5G(42, 0),          CHAN5G(44, 0),
 265         CHAN5G(46, 0),          CHAN5G(48, 0),
 266         CHAN5G(52, 0),          CHAN5G(56, 0),
 267         CHAN5G(60, 0),          CHAN5G(64, 0),
 268         CHAN5G(100, 0),         CHAN5G(104, 0),
 269         CHAN5G(108, 0),         CHAN5G(112, 0),
 270         CHAN5G(116, 0),         CHAN5G(120, 0),
 271         CHAN5G(124, 0),         CHAN5G(128, 0),
 272         CHAN5G(132, 0),         CHAN5G(136, 0),
 273         CHAN5G(140, 0),         CHAN5G(149, 0),
 274         CHAN5G(153, 0),         CHAN5G(157, 0),
 275         CHAN5G(161, 0),         CHAN5G(165, 0),
 276         CHAN5G(184, 0),         CHAN5G(188, 0),
 277         CHAN5G(192, 0),         CHAN5G(196, 0),
 278         CHAN5G(200, 0),         CHAN5G(204, 0),
 279         CHAN5G(208, 0),         CHAN5G(212, 0),
 280         CHAN5G(216, 0),
 281 };
 282 #undef CHAN5G
 283
 284 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 285         .band           = IEEE80211_BAND_5GHZ,
 286         .channels       = b43_5ghz_nphy_chantable,
 287         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 288         .bitrates       = b43_a_ratetable,
 289         .n_bitrates     = b43_a_ratetable_size,
 290 };
 291
 292 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 293         .band           = IEEE80211_BAND_5GHZ,
 294         .channels       = b43_5ghz_aphy_chantable,
 295         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 296         .bitrates       = b43_a_ratetable,
 297         .n_bitrates     = b43_a_ratetable_size,
 298 };
 299
 300 static struct ieee80211_supported_band b43_band_2GHz = {
 301         .band           = IEEE80211_BAND_2GHZ,
 302         .channels       = b43_2ghz_chantable,
 303         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 304         .bitrates       = b43_g_ratetable,
 305         .n_bitrates     = b43_g_ratetable_size,
 306 };
 307
 308 static void b43_wireless_core_exit(struct b43_wldev *dev);
 309 static int b43_wireless_core_init(struct b43_wldev *dev);
 310 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 311 static int b43_wireless_core_start(struct b43_wldev *dev);
 312
 313 static int b43_ratelimit(struct b43_wl *wl)
 314 {
 315         if (!wl || !wl->current_dev)
 316                 return 1;
 317         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 318                 return 1;
 319         /* We are up and running.
 320          * Ratelimit the messages to avoid DoS over the net. */
 321         return net_ratelimit();
 322 }
 323
 324 void b43info(struct b43_wl *wl, const char *fmt, ...)
 325 {
 326         struct va_format vaf;
 327         va_list args;
 328
 329         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 330                 return;
 331         if (!b43_ratelimit(wl))
 332                 return;
 333
 334         va_start(args, fmt);
 335
 336         vaf.fmt = fmt;
 337         vaf.va = &args;
 338
 339         printk(KERN_INFO "b43-%s: %pV",
 340                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 341
 342         va_end(args);
 343 }
 344
 345 void b43err(struct b43_wl *wl, const char *fmt, ...)
 346 {
 347         struct va_format vaf;
 348         va_list args;
 349
 350         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 351                 return;
 352         if (!b43_ratelimit(wl))
 353                 return;
 354
 355         va_start(args, fmt);
 356
 357         vaf.fmt = fmt;
 358         vaf.va = &args;
 359
 360         printk(KERN_ERR "b43-%s ERROR: %pV",
 361                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 362
 363         va_end(args);
 364 }
 365
 366 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 367 {
 368         struct va_format vaf;
 369         va_list args;
 370
 371         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 372                 return;
 373         if (!b43_ratelimit(wl))
 374                 return;
 375
 376         va_start(args, fmt);
 377
 378         vaf.fmt = fmt;
 379         vaf.va = &args;
 380
 381         printk(KERN_WARNING "b43-%s warning: %pV",
 382                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 383
 384         va_end(args);
 385 }
 386
 387 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 388 {
 389         struct va_format vaf;
 390         va_list args;
 391
 392         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 393                 return;
 394
 395         va_start(args, fmt);
 396
 397         vaf.fmt = fmt;
 398         vaf.va = &args;
 399
 400         printk(KERN_DEBUG "b43-%s debug: %pV",
 401                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 402
 403         va_end(args);
 404 }
 405
 406 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 407 {
 408         u32 macctl;
 409
 410         B43_WARN_ON(offset % 4 != 0);
 411
 412         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 413         if (macctl & B43_MACCTL_BE)
 414                 val = swab32(val);
 415
 416         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 417         mmiowb();
 418         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 419 }
 420
 421 static inline void b43_shm_control_word(struct b43_wldev *dev,
 422                                         u16 routing, u16 offset)
 423 {
 424         u32 control;
 425
 426         /* "offset" is the WORD offset. */
 427         control = routing;
 428         control <<= 16;
 429         control |= offset;
 430         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 431 }
 432
 433 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 434 {
 435         u32 ret;
 436
 437         if (routing == B43_SHM_SHARED) {
 438                 B43_WARN_ON(offset & 0x0001);
 439                 if (offset & 0x0003) {
 440                         /* Unaligned access */
 441                         b43_shm_control_word(dev, routing, offset >> 2);
 442                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 443                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 444                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 445
 446                         goto out;
 447                 }
 448                 offset >>= 2;
 449         }
 450         b43_shm_control_word(dev, routing, offset);
 451         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 452 out:
 453         return ret;
 454 }
 455
 456 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 457 {
 458         u16 ret;
 459
 460         if (routing == B43_SHM_SHARED) {
 461                 B43_WARN_ON(offset & 0x0001);
 462                 if (offset & 0x0003) {
 463                         /* Unaligned access */
 464                         b43_shm_control_word(dev, routing, offset >> 2);
 465                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 466
 467                         goto out;
 468                 }
 469                 offset >>= 2;
 470         }
 471         b43_shm_control_word(dev, routing, offset);
 472         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 473 out:
 474         return ret;
 475 }
 476
 477 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 478 {
 479         if (routing == B43_SHM_SHARED) {
 480                 B43_WARN_ON(offset & 0x0001);
 481                 if (offset & 0x0003) {
 482                         /* Unaligned access */
 483                         b43_shm_control_word(dev, routing, offset >> 2);
 484                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 485                                     value & 0xFFFF);
 486                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 487                         b43_write16(dev, B43_MMIO_SHM_DATA,
 488                                     (value >> 16) & 0xFFFF);
 489                         return;
 490                 }
 491                 offset >>= 2;
 492         }
 493         b43_shm_control_word(dev, routing, offset);
 494         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 495 }
 496
 497 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 498 {
 499         if (routing == B43_SHM_SHARED) {
 500                 B43_WARN_ON(offset & 0x0001);
 501                 if (offset & 0x0003) {
 502                         /* Unaligned access */
 503                         b43_shm_control_word(dev, routing, offset >> 2);
 504                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 505                         return;
 506                 }
 507                 offset >>= 2;
 508         }
 509         b43_shm_control_word(dev, routing, offset);
 510         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 511 }
 512
 513 /* Read HostFlags */
 514 u64 b43_hf_read(struct b43_wldev *dev)
 515 {
 516         u64 ret;
 517
 518         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 519         ret <<= 16;
 520         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 521         ret <<= 16;
 522         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 523
 524         return ret;
 525 }
 526
 527 /* Write HostFlags */
 528 void b43_hf_write(struct b43_wldev *dev, u64 value)
 529 {
 530         u16 lo, mi, hi;
 531
 532         lo = (value & 0x00000000FFFFULL);
 533         mi = (value & 0x0000FFFF0000ULL) >> 16;
 534         hi = (value & 0xFFFF00000000ULL) >> 32;
 535         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 538 }
 539
 540 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 541 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 542 {
 543         B43_WARN_ON(!dev->fw.opensource);
 544         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 545 }
 546
 547 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 548 {
 549         u32 low, high;
 550
 551         B43_WARN_ON(dev->dev->core_rev < 3);
 552
 553         /* The hardware guarantees us an atomic read, if we
 554          * read the low register first. */
 555         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 556         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 557
 558         *tsf = high;
 559         *tsf <<= 32;
 560         *tsf |= low;
 561 }
 562
 563 static void b43_time_lock(struct b43_wldev *dev)
 564 {
 565         u32 macctl;
 566
 567         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 568         macctl |= B43_MACCTL_TBTTHOLD;
 569         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 570         /* Commit the write */
 571         b43_read32(dev, B43_MMIO_MACCTL);
 572 }
 573
 574 static void b43_time_unlock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl &= ~B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 586 {
 587         u32 low, high;
 588
 589         B43_WARN_ON(dev->dev->core_rev < 3);
 590
 591         low = tsf;
 592         high = (tsf >> 32);
 593         /* The hardware guarantees us an atomic write, if we
 594          * write the low register first. */
 595         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 596         mmiowb();
 597         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 598         mmiowb();
 599 }
 600
 601 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 602 {
 603         b43_time_lock(dev);
 604         b43_tsf_write_locked(dev, tsf);
 605         b43_time_unlock(dev);
 606 }
 607
 608 static
 609 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 610 {
 611         static const u8 zero_addr[ETH_ALEN] = { 0 };
 612         u16 data;
 613
 614         if (!mac)
 615                 mac = zero_addr;
 616
 617         offset |= 0x0020;
 618         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 619
 620         data = mac[0];
 621         data |= mac[1] << 8;
 622         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 623         data = mac[2];
 624         data |= mac[3] << 8;
 625         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 626         data = mac[4];
 627         data |= mac[5] << 8;
 628         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 629 }
 630
 631 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 632 {
 633         const u8 *mac;
 634         const u8 *bssid;
 635         u8 mac_bssid[ETH_ALEN * 2];
 636         int i;
 637         u32 tmp;
 638
 639         bssid = dev->wl->bssid;
 640         mac = dev->wl->mac_addr;
 641
 642         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 643
 644         memcpy(mac_bssid, mac, ETH_ALEN);
 645         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 646
 647         /* Write our MAC address and BSSID to template ram */
 648         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 649                 tmp = (u32) (mac_bssid[i + 0]);
 650                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 651                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 652                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 653                 b43_ram_write(dev, 0x20 + i, tmp);
 654         }
 655 }
 656
 657 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 658 {
 659         b43_write_mac_bssid_templates(dev);
 660         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 661 }
 662
 663 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 664 {
 665         /* slot_time is in usec. */
 666         /* This test used to exit for all but a G PHY. */
 667         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 668                 return;
 669         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 670         /* Shared memory location 0x0010 is the slot time and should be
 671          * set to slot_time; however, this register is initially 0 and changing
 672          * the value adversely affects the transmit rate for BCM4311
 673          * devices. Until this behavior is unterstood, delete this step
 674          *
 675          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 676          */
 677 }
 678
 679 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 680 {
 681         b43_set_slot_time(dev, 9);
 682 }
 683
 684 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 685 {
 686         b43_set_slot_time(dev, 20);
 687 }
 688
 689 /* DummyTransmission function, as documented on
 690  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 691  */
 692 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 693 {
 694         struct b43_phy *phy = &dev->phy;
 695         unsigned int i, max_loop;
 696         u16 value;
 697         u32 buffer[5] = {
 698                 0x00000000,
 699                 0x00D40000,
 700                 0x00000000,
 701                 0x01000000,
 702                 0x00000000,
 703         };
 704
 705         if (ofdm) {
 706                 max_loop = 0x1E;
 707                 buffer[0] = 0x000201CC;
 708         } else {
 709                 max_loop = 0xFA;
 710                 buffer[0] = 0x000B846E;
 711         }
 712
 713         for (i = 0; i < 5; i++)
 714                 b43_ram_write(dev, i * 4, buffer[i]);
 715
 716         b43_write16(dev, 0x0568, 0x0000);
 717         if (dev->dev->core_rev < 11)
 718                 b43_write16(dev, 0x07C0, 0x0000);
 719         else
 720                 b43_write16(dev, 0x07C0, 0x0100);
 721         value = (ofdm ? 0x41 : 0x40);
 722         b43_write16(dev, 0x050C, value);
 723         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 724                 b43_write16(dev, 0x0514, 0x1A02);
 725         b43_write16(dev, 0x0508, 0x0000);
 726         b43_write16(dev, 0x050A, 0x0000);
 727         b43_write16(dev, 0x054C, 0x0000);
 728         b43_write16(dev, 0x056A, 0x0014);
 729         b43_write16(dev, 0x0568, 0x0826);
 730         b43_write16(dev, 0x0500, 0x0000);
 731         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 732                 //SPEC TODO
 733         }
 734
 735         switch (phy->type) {
 736         case B43_PHYTYPE_N:
 737                 b43_write16(dev, 0x0502, 0x00D0);
 738                 break;
 739         case B43_PHYTYPE_LP:
 740                 b43_write16(dev, 0x0502, 0x0050);
 741                 break;
 742         default:
 743                 b43_write16(dev, 0x0502, 0x0030);
 744         }
 745
 746         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 747                 b43_radio_write16(dev, 0x0051, 0x0017);
 748         for (i = 0x00; i < max_loop; i++) {
 749                 value = b43_read16(dev, 0x050E);
 750                 if (value & 0x0080)
 751                         break;
 752                 udelay(10);
 753         }
 754         for (i = 0x00; i < 0x0A; i++) {
 755                 value = b43_read16(dev, 0x050E);
 756                 if (value & 0x0400)
 757                         break;
 758                 udelay(10);
 759         }
 760         for (i = 0x00; i < 0x19; i++) {
 761                 value = b43_read16(dev, 0x0690);
 762                 if (!(value & 0x0100))
 763                         break;
 764                 udelay(10);
 765         }
 766         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 767                 b43_radio_write16(dev, 0x0051, 0x0037);
 768 }
 769
 770 static void key_write(struct b43_wldev *dev,
 771                       u8 index, u8 algorithm, const u8 *key)
 772 {
 773         unsigned int i;
 774         u32 offset;
 775         u16 value;
 776         u16 kidx;
 777
 778         /* Key index/algo block */
 779         kidx = b43_kidx_to_fw(dev, index);
 780         value = ((kidx << 4) | algorithm);
 781         b43_shm_write16(dev, B43_SHM_SHARED,
 782                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 783
 784         /* Write the key to the Key Table Pointer offset */
 785         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 786         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 787                 value = key[i];
 788                 value |= (u16) (key[i + 1]) << 8;
 789                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 790         }
 791 }
 792
 793 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 794 {
 795         u32 addrtmp[2] = { 0, 0, };
 796         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 797
 798         if (b43_new_kidx_api(dev))
 799                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 800
 801         B43_WARN_ON(index < pairwise_keys_start);
 802         /* We have four default TX keys and possibly four default RX keys.
 803          * Physical mac 0 is mapped to physical key 4 or 8, depending
 804          * on the firmware version.
 805          * So we must adjust the index here.
 806          */
 807         index -= pairwise_keys_start;
 808         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 809
 810         if (addr) {
 811                 addrtmp[0] = addr[0];
 812                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 813                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 814                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 815                 addrtmp[1] = addr[4];
 816                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 817         }
 818
 819         /* Receive match transmitter address (RCMTA) mechanism */
 820         b43_shm_write32(dev, B43_SHM_RCMTA,
 821                         (index * 2) + 0, addrtmp[0]);
 822         b43_shm_write16(dev, B43_SHM_RCMTA,
 823                         (index * 2) + 1, addrtmp[1]);
 824 }
 825
 826 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 827  * When a packet is received, the iv32 is checked.
 828  * - if it doesn't the packet is returned without modification (and software
 829  *   decryption can be done). That's what happen when iv16 wrap.
 830  * - if it does, the rc4 key is computed, and decryption is tried.
 831  *   Either it will success and B43_RX_MAC_DEC is returned,
 832  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 833  *   and the packet is not usable (it got modified by the ucode).
 834  * So in order to never have B43_RX_MAC_DECERR, we should provide
 835  * a iv32 and phase1key that match. Because we drop packets in case of
 836  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 837  * packets will be lost without higher layer knowing (ie no resync possible
 838  * until next wrap).
 839  *
 840  * NOTE : this should support 50 key like RCMTA because
 841  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 842  */
 843 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 844                 u16 *phase1key)
 845 {
 846         unsigned int i;
 847         u32 offset;
 848         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 849
 850         if (!modparam_hwtkip)
 851                 return;
 852
 853         if (b43_new_kidx_api(dev))
 854                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 855
 856         B43_WARN_ON(index < pairwise_keys_start);
 857         /* We have four default TX keys and possibly four default RX keys.
 858          * Physical mac 0 is mapped to physical key 4 or 8, depending
 859          * on the firmware version.
 860          * So we must adjust the index here.
 861          */
 862         index -= pairwise_keys_start;
 863         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 864
 865         if (b43_debug(dev, B43_DBG_KEYS)) {
 866                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 867                                 index, iv32);
 868         }
 869         /* Write the key to the  RX tkip shared mem */
 870         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 871         for (i = 0; i < 10; i += 2) {
 872                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 873                                 phase1key ? phase1key[i / 2] : 0);
 874         }
 875         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 876         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 877 }
 878
 879 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 880                                    struct ieee80211_vif *vif,
 881                                    struct ieee80211_key_conf *keyconf,
 882                                    struct ieee80211_sta *sta,
 883                                    u32 iv32, u16 *phase1key)
 884 {
 885         struct b43_wl *wl = hw_to_b43_wl(hw);
 886         struct b43_wldev *dev;
 887         int index = keyconf->hw_key_idx;
 888
 889         if (B43_WARN_ON(!modparam_hwtkip))
 890                 return;
 891
 892         /* This is only called from the RX path through mac80211, where
 893          * our mutex is already locked. */
 894         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 895         dev = wl->current_dev;
 896         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 897
 898         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 899
 900         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 901         /* only pairwise TKIP keys are supported right now */
 902         if (WARN_ON(!sta))
 903                 return;
 904         keymac_write(dev, index, sta->addr);
 905 }
 906
 907 static void do_key_write(struct b43_wldev *dev,
 908                          u8 index, u8 algorithm,
 909                          const u8 *key, size_t key_len, const u8 *mac_addr)
 910 {
 911         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 912         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 913
 914         if (b43_new_kidx_api(dev))
 915                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 916
 917         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 918         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 919
 920         if (index >= pairwise_keys_start)
 921                 keymac_write(dev, index, NULL); /* First zero out mac. */
 922         if (algorithm == B43_SEC_ALGO_TKIP) {
 923                 /*
 924                  * We should provide an initial iv32, phase1key pair.
 925                  * We could start with iv32=0 and compute the corresponding
 926                  * phase1key, but this means calling ieee80211_get_tkip_key
 927                  * with a fake skb (or export other tkip function).
 928                  * Because we are lazy we hope iv32 won't start with
 929                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 930                  * correct pair.
 931                  */
 932                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 933         } else if (index >= pairwise_keys_start) /* clear it */
 934                 rx_tkip_phase1_write(dev, index, 0, NULL);
 935         if (key)
 936                 memcpy(buf, key, key_len);
 937         key_write(dev, index, algorithm, buf);
 938         if (index >= pairwise_keys_start)
 939                 keymac_write(dev, index, mac_addr);
 940
 941         dev->key[index].algorithm = algorithm;
 942 }
 943
 944 static int b43_key_write(struct b43_wldev *dev,
 945                          int index, u8 algorithm,
 946                          const u8 *key, size_t key_len,
 947                          const u8 *mac_addr,
 948                          struct ieee80211_key_conf *keyconf)
 949 {
 950         int i;
 951         int pairwise_keys_start;
 952
 953         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 954          *      - Temporal Encryption Key (128 bits)
 955          *      - Temporal Authenticator Tx MIC Key (64 bits)
 956          *      - Temporal Authenticator Rx MIC Key (64 bits)
 957          *
 958          *      Hardware only store TEK
 959          */
 960         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 961                 key_len = 16;
 962         if (key_len > B43_SEC_KEYSIZE)
 963                 return -EINVAL;
 964         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 965                 /* Check that we don't already have this key. */
 966                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 967         }
 968         if (index < 0) {
 969                 /* Pairwise key. Get an empty slot for the key. */
 970                 if (b43_new_kidx_api(dev))
 971                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 972                 else
 973                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 974                 for (i = pairwise_keys_start;
 975                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 976                      i++) {
 977                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 978                         if (!dev->key[i].keyconf) {
 979                                 /* found empty */
 980                                 index = i;
 981                                 break;
 982                         }
 983                 }
 984                 if (index < 0) {
 985                         b43warn(dev->wl, "Out of hardware key memory\n");
 986                         return -ENOSPC;
 987                 }
 988         } else
 989                 B43_WARN_ON(index > 3);
 990
 991         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 992         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 993                 /* Default RX key */
 994                 B43_WARN_ON(mac_addr);
 995                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 996         }
 997         keyconf->hw_key_idx = index;
 998         dev->key[index].keyconf = keyconf;
 999
1000         return 0;
1001 }
1002
1003 static int b43_key_clear(struct b43_wldev *dev, int index)
1004 {
1005         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1006                 return -EINVAL;
1007         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1008                      NULL, B43_SEC_KEYSIZE, NULL);
1009         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1010                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1011                              NULL, B43_SEC_KEYSIZE, NULL);
1012         }
1013         dev->key[index].keyconf = NULL;
1014
1015         return 0;
1016 }
1017
1018 static void b43_clear_keys(struct b43_wldev *dev)
1019 {
1020         int i, count;
1021
1022         if (b43_new_kidx_api(dev))
1023                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1024         else
1025                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1026         for (i = 0; i < count; i++)
1027                 b43_key_clear(dev, i);
1028 }
1029
1030 static void b43_dump_keymemory(struct b43_wldev *dev)
1031 {
1032         unsigned int i, index, count, offset, pairwise_keys_start;
1033         u8 mac[ETH_ALEN];
1034         u16 algo;
1035         u32 rcmta0;
1036         u16 rcmta1;
1037         u64 hf;
1038         struct b43_key *key;
1039
1040         if (!b43_debug(dev, B43_DBG_KEYS))
1041                 return;
1042
1043         hf = b43_hf_read(dev);
1044         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1045                !!(hf & B43_HF_USEDEFKEYS));
1046         if (b43_new_kidx_api(dev)) {
1047                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1048                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1049         } else {
1050                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1051                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1052         }
1053         for (index = 0; index < count; index++) {
1054                 key = &(dev->key[index]);
1055                 printk(KERN_DEBUG "Key slot %02u: %s",
1056                        index, (key->keyconf == NULL) ? " " : "*");
1057                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1058                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1059                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1060                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1061                 }
1062
1063                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1064                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1065                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1066
1067                 if (index >= pairwise_keys_start) {
1068                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1069                                 printk("   TKIP: ");
1070                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1071                                 for (i = 0; i < 14; i += 2) {
1072                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1073                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1074                                 }
1075                         }
1076                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1077                                                 ((index - pairwise_keys_start) * 2) + 0);
1078                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1079                                                 ((index - pairwise_keys_start) * 2) + 1);
1080                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1081                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1082                         printk("   MAC: %pM", mac);
1083                 } else
1084                         printk("   DEFAULT KEY");
1085                 printk("\n");
1086         }
1087 }
1088
1089 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1090 {
1091         u32 macctl;
1092         u16 ucstat;
1093         bool hwps;
1094         bool awake;
1095         int i;
1096
1097         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1098                     (ps_flags & B43_PS_DISABLED));
1099         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1100
1101         if (ps_flags & B43_PS_ENABLED) {
1102                 hwps = 1;
1103         } else if (ps_flags & B43_PS_DISABLED) {
1104                 hwps = 0;
1105         } else {
1106                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1107                 //      and thus is not an AP and we are associated, set bit 25
1108         }
1109         if (ps_flags & B43_PS_AWAKE) {
1110                 awake = 1;
1111         } else if (ps_flags & B43_PS_ASLEEP) {
1112                 awake = 0;
1113         } else {
1114                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1115                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1116                 //      successful, set bit26
1117         }
1118
1119 /* FIXME: For now we force awake-on and hwps-off */
1120         hwps = 0;
1121         awake = 1;
1122
1123         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1124         if (hwps)
1125                 macctl |= B43_MACCTL_HWPS;
1126         else
1127                 macctl &= ~B43_MACCTL_HWPS;
1128         if (awake)
1129                 macctl |= B43_MACCTL_AWAKE;
1130         else
1131                 macctl &= ~B43_MACCTL_AWAKE;
1132         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1133         /* Commit write */
1134         b43_read32(dev, B43_MMIO_MACCTL);
1135         if (awake && dev->dev->core_rev >= 5) {
1136                 /* Wait for the microcode to wake up. */
1137                 for (i = 0; i < 100; i++) {
1138                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1139                                                 B43_SHM_SH_UCODESTAT);
1140                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1141                                 break;
1142                         udelay(10);
1143                 }
1144         }
1145 }
1146
1147 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1148 {
1149         struct ssb_device *sdev = dev->dev->sdev;
1150         u32 tmslow;
1151
1152         flags |= B43_TMSLOW_PHYCLKEN;
1153         flags |= B43_TMSLOW_PHYRESET;
1154         if (dev->phy.type == B43_PHYTYPE_N)
1155                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1156         b43_device_enable(dev, flags);
1157         msleep(2);              /* Wait for the PLL to turn on. */
1158
1159         /* Now take the PHY out of Reset again */
1160         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1161         tmslow |= SSB_TMSLOW_FGC;
1162         tmslow &= ~B43_TMSLOW_PHYRESET;
1163         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1164         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1165         msleep(1);
1166         tmslow &= ~SSB_TMSLOW_FGC;
1167         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1168         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1169         msleep(1);
1170 }
1171
1172 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1173 {
1174         u32 macctl;
1175
1176         b43_ssb_wireless_core_reset(dev, flags);
1177
1178         /* Turn Analog ON, but only if we already know the PHY-type.
1179          * This protects against very early setup where we don't know the
1180          * PHY-type, yet. wireless_core_reset will be called once again later,
1181          * when we know the PHY-type. */
1182         if (dev->phy.ops)
1183                 dev->phy.ops->switch_analog(dev, 1);
1184
1185         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1186         macctl &= ~B43_MACCTL_GMODE;
1187         if (flags & B43_TMSLOW_GMODE)
1188                 macctl |= B43_MACCTL_GMODE;
1189         macctl |= B43_MACCTL_IHR_ENABLED;
1190         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1191 }
1192
1193 static void handle_irq_transmit_status(struct b43_wldev *dev)
1194 {
1195         u32 v0, v1;
1196         u16 tmp;
1197         struct b43_txstatus stat;
1198
1199         while (1) {
1200                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1201                 if (!(v0 & 0x00000001))
1202                         break;
1203                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1204
1205                 stat.cookie = (v0 >> 16);
1206                 stat.seq = (v1 & 0x0000FFFF);
1207                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1208                 tmp = (v0 & 0x0000FFFF);
1209                 stat.frame_count = ((tmp & 0xF000) >> 12);
1210                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1211                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1212                 stat.pm_indicated = !!(tmp & 0x0080);
1213                 stat.intermediate = !!(tmp & 0x0040);
1214                 stat.for_ampdu = !!(tmp & 0x0020);
1215                 stat.acked = !!(tmp & 0x0002);
1216
1217                 b43_handle_txstatus(dev, &stat);
1218         }
1219 }
1220
1221 static void drain_txstatus_queue(struct b43_wldev *dev)
1222 {
1223         u32 dummy;
1224
1225         if (dev->dev->core_rev < 5)
1226                 return;
1227         /* Read all entries from the microcode TXstatus FIFO
1228          * and throw them away.
1229          */
1230         while (1) {
1231                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1232                 if (!(dummy & 0x00000001))
1233                         break;
1234                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1235         }
1236 }
1237
1238 static u32 b43_jssi_read(struct b43_wldev *dev)
1239 {
1240         u32 val = 0;
1241
1242         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1243         val <<= 16;
1244         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1245
1246         return val;
1247 }
1248
1249 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1250 {
1251         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1252         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1253 }
1254
1255 static void b43_generate_noise_sample(struct b43_wldev *dev)
1256 {
1257         b43_jssi_write(dev, 0x7F7F7F7F);
1258         b43_write32(dev, B43_MMIO_MACCMD,
1259                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1260 }
1261
1262 static void b43_calculate_link_quality(struct b43_wldev *dev)
1263 {
1264         /* Top half of Link Quality calculation. */
1265
1266         if (dev->phy.type != B43_PHYTYPE_G)
1267                 return;
1268         if (dev->noisecalc.calculation_running)
1269                 return;
1270         dev->noisecalc.calculation_running = 1;
1271         dev->noisecalc.nr_samples = 0;
1272
1273         b43_generate_noise_sample(dev);
1274 }
1275
1276 static void handle_irq_noise(struct b43_wldev *dev)
1277 {
1278         struct b43_phy_g *phy = dev->phy.g;
1279         u16 tmp;
1280         u8 noise[4];
1281         u8 i, j;
1282         s32 average;
1283
1284         /* Bottom half of Link Quality calculation. */
1285
1286         if (dev->phy.type != B43_PHYTYPE_G)
1287                 return;
1288
1289         /* Possible race condition: It might be possible that the user
1290          * changed to a different channel in the meantime since we
1291          * started the calculation. We ignore that fact, since it's
1292          * not really that much of a problem. The background noise is
1293          * an estimation only anyway. Slightly wrong results will get damped
1294          * by the averaging of the 8 sample rounds. Additionally the
1295          * value is shortlived. So it will be replaced by the next noise
1296          * calculation round soon. */
1297
1298         B43_WARN_ON(!dev->noisecalc.calculation_running);
1299         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1300         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1301             noise[2] == 0x7F || noise[3] == 0x7F)
1302                 goto generate_new;
1303
1304         /* Get the noise samples. */
1305         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1306         i = dev->noisecalc.nr_samples;
1307         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1308         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1309         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1310         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1311         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1312         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1313         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1314         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1315         dev->noisecalc.nr_samples++;
1316         if (dev->noisecalc.nr_samples == 8) {
1317                 /* Calculate the Link Quality by the noise samples. */
1318                 average = 0;
1319                 for (i = 0; i < 8; i++) {
1320                         for (j = 0; j < 4; j++)
1321                                 average += dev->noisecalc.samples[i][j];
1322                 }
1323                 average /= (8 * 4);
1324                 average *= 125;
1325                 average += 64;
1326                 average /= 128;
1327                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1328                 tmp = (tmp / 128) & 0x1F;
1329                 if (tmp >= 8)
1330                         average += 2;
1331                 else
1332                         average -= 25;
1333                 if (tmp == 8)
1334                         average -= 72;
1335                 else
1336                         average -= 48;
1337
1338                 dev->stats.link_noise = average;
1339                 dev->noisecalc.calculation_running = 0;
1340                 return;
1341         }
1342 generate_new:
1343         b43_generate_noise_sample(dev);
1344 }
1345
1346 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1347 {
1348         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1349                 ///TODO: PS TBTT
1350         } else {
1351                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1352                         b43_power_saving_ctl_bits(dev, 0);
1353         }
1354         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1355                 dev->dfq_valid = 1;
1356 }
1357
1358 static void handle_irq_atim_end(struct b43_wldev *dev)
1359 {
1360         if (dev->dfq_valid) {
1361                 b43_write32(dev, B43_MMIO_MACCMD,
1362                             b43_read32(dev, B43_MMIO_MACCMD)
1363                             | B43_MACCMD_DFQ_VALID);
1364                 dev->dfq_valid = 0;
1365         }
1366 }
1367
1368 static void handle_irq_pmq(struct b43_wldev *dev)
1369 {
1370         u32 tmp;
1371
1372         //TODO: AP mode.
1373
1374         while (1) {
1375                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1376                 if (!(tmp & 0x00000008))
1377                         break;
1378         }
1379         /* 16bit write is odd, but correct. */
1380         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1381 }
1382
1383 static void b43_write_template_common(struct b43_wldev *dev,
1384                                       const u8 *data, u16 size,
1385                                       u16 ram_offset,
1386                                       u16 shm_size_offset, u8 rate)
1387 {
1388         u32 i, tmp;
1389         struct b43_plcp_hdr4 plcp;
1390
1391         plcp.data = 0;
1392         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1393         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1394         ram_offset += sizeof(u32);
1395         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1396          * So leave the first two bytes of the next write blank.
1397          */
1398         tmp = (u32) (data[0]) << 16;
1399         tmp |= (u32) (data[1]) << 24;
1400         b43_ram_write(dev, ram_offset, tmp);
1401         ram_offset += sizeof(u32);
1402         for (i = 2; i < size; i += sizeof(u32)) {
1403                 tmp = (u32) (data[i + 0]);
1404                 if (i + 1 < size)
1405                         tmp |= (u32) (data[i + 1]) << 8;
1406                 if (i + 2 < size)
1407                         tmp |= (u32) (data[i + 2]) << 16;
1408                 if (i + 3 < size)
1409                         tmp |= (u32) (data[i + 3]) << 24;
1410                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1411         }
1412         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1413                         size + sizeof(struct b43_plcp_hdr6));
1414 }
1415
1416 /* Check if the use of the antenna that ieee80211 told us to
1417  * use is possible. This will fall back to DEFAULT.
1418  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1419 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1420                                   u8 antenna_nr)
1421 {
1422         u8 antenna_mask;
1423
1424         if (antenna_nr == 0) {
1425                 /* Zero means "use default antenna". That's always OK. */
1426                 return 0;
1427         }
1428
1429         /* Get the mask of available antennas. */
1430         if (dev->phy.gmode)
1431                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1432         else
1433                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1434
1435         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1436                 /* This antenna is not available. Fall back to default. */
1437                 return 0;
1438         }
1439
1440         return antenna_nr;
1441 }
1442
1443 /* Convert a b43 antenna number value to the PHY TX control value. */
1444 static u16 b43_antenna_to_phyctl(int antenna)
1445 {
1446         switch (antenna) {
1447         case B43_ANTENNA0:
1448                 return B43_TXH_PHY_ANT0;
1449         case B43_ANTENNA1:
1450                 return B43_TXH_PHY_ANT1;
1451         case B43_ANTENNA2:
1452                 return B43_TXH_PHY_ANT2;
1453         case B43_ANTENNA3:
1454                 return B43_TXH_PHY_ANT3;
1455         case B43_ANTENNA_AUTO0:
1456         case B43_ANTENNA_AUTO1:
1457                 return B43_TXH_PHY_ANT01AUTO;
1458         }
1459         B43_WARN_ON(1);
1460         return 0;
1461 }
1462
1463 static void b43_write_beacon_template(struct b43_wldev *dev,
1464                                       u16 ram_offset,
1465                                       u16 shm_size_offset)
1466 {
1467         unsigned int i, len, variable_len;
1468         const struct ieee80211_mgmt *bcn;
1469         const u8 *ie;
1470         bool tim_found = 0;
1471         unsigned int rate;
1472         u16 ctl;
1473         int antenna;
1474         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1475
1476         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1477         len = min((size_t) dev->wl->current_beacon->len,
1478                   0x200 - sizeof(struct b43_plcp_hdr6));
1479         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1480
1481         b43_write_template_common(dev, (const u8 *)bcn,
1482                                   len, ram_offset, shm_size_offset, rate);
1483
1484         /* Write the PHY TX control parameters. */
1485         antenna = B43_ANTENNA_DEFAULT;
1486         antenna = b43_antenna_to_phyctl(antenna);
1487         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1488         /* We can't send beacons with short preamble. Would get PHY errors. */
1489         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1490         ctl &= ~B43_TXH_PHY_ANT;
1491         ctl &= ~B43_TXH_PHY_ENC;
1492         ctl |= antenna;
1493         if (b43_is_cck_rate(rate))
1494                 ctl |= B43_TXH_PHY_ENC_CCK;
1495         else
1496                 ctl |= B43_TXH_PHY_ENC_OFDM;
1497         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1498
1499         /* Find the position of the TIM and the DTIM_period value
1500          * and write them to SHM. */
1501         ie = bcn->u.beacon.variable;
1502         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1503         for (i = 0; i < variable_len - 2; ) {
1504                 uint8_t ie_id, ie_len;
1505
1506                 ie_id = ie[i];
1507                 ie_len = ie[i + 1];
1508                 if (ie_id == 5) {
1509                         u16 tim_position;
1510                         u16 dtim_period;
1511                         /* This is the TIM Information Element */
1512
1513                         /* Check whether the ie_len is in the beacon data range. */
1514                         if (variable_len < ie_len + 2 + i)
1515                                 break;
1516                         /* A valid TIM is at least 4 bytes long. */
1517                         if (ie_len < 4)
1518                                 break;
1519                         tim_found = 1;
1520
1521                         tim_position = sizeof(struct b43_plcp_hdr6);
1522                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1523                         tim_position += i;
1524
1525                         dtim_period = ie[i + 3];
1526
1527                         b43_shm_write16(dev, B43_SHM_SHARED,
1528                                         B43_SHM_SH_TIMBPOS, tim_position);
1529                         b43_shm_write16(dev, B43_SHM_SHARED,
1530                                         B43_SHM_SH_DTIMPER, dtim_period);
1531                         break;
1532                 }
1533                 i += ie_len + 2;
1534         }
1535         if (!tim_found) {
1536                 /*
1537                  * If ucode wants to modify TIM do it behind the beacon, this
1538                  * will happen, for example, when doing mesh networking.
1539                  */
1540                 b43_shm_write16(dev, B43_SHM_SHARED,
1541                                 B43_SHM_SH_TIMBPOS,
1542                                 len + sizeof(struct b43_plcp_hdr6));
1543                 b43_shm_write16(dev, B43_SHM_SHARED,
1544                                 B43_SHM_SH_DTIMPER, 0);
1545         }
1546         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1547 }
1548
1549 static void b43_upload_beacon0(struct b43_wldev *dev)
1550 {
1551         struct b43_wl *wl = dev->wl;
1552
1553         if (wl->beacon0_uploaded)
1554                 return;
1555         b43_write_beacon_template(dev, 0x68, 0x18);
1556         wl->beacon0_uploaded = 1;
1557 }
1558
1559 static void b43_upload_beacon1(struct b43_wldev *dev)
1560 {
1561         struct b43_wl *wl = dev->wl;
1562
1563         if (wl->beacon1_uploaded)
1564                 return;
1565         b43_write_beacon_template(dev, 0x468, 0x1A);
1566         wl->beacon1_uploaded = 1;
1567 }
1568
1569 static void handle_irq_beacon(struct b43_wldev *dev)
1570 {
1571         struct b43_wl *wl = dev->wl;
1572         u32 cmd, beacon0_valid, beacon1_valid;
1573
1574         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1575             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1576                 return;
1577
1578         /* This is the bottom half of the asynchronous beacon update. */
1579
1580         /* Ignore interrupt in the future. */
1581         dev->irq_mask &= ~B43_IRQ_BEACON;
1582
1583         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1584         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1585         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1586
1587         /* Schedule interrupt manually, if busy. */
1588         if (beacon0_valid && beacon1_valid) {
1589                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1590                 dev->irq_mask |= B43_IRQ_BEACON;
1591                 return;
1592         }
1593
1594         if (unlikely(wl->beacon_templates_virgin)) {
1595                 /* We never uploaded a beacon before.
1596                  * Upload both templates now, but only mark one valid. */
1597                 wl->beacon_templates_virgin = 0;
1598                 b43_upload_beacon0(dev);
1599                 b43_upload_beacon1(dev);
1600                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1601                 cmd |= B43_MACCMD_BEACON0_VALID;
1602                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1603         } else {
1604                 if (!beacon0_valid) {
1605                         b43_upload_beacon0(dev);
1606                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1607                         cmd |= B43_MACCMD_BEACON0_VALID;
1608                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1609                 } else if (!beacon1_valid) {
1610                         b43_upload_beacon1(dev);
1611                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1612                         cmd |= B43_MACCMD_BEACON1_VALID;
1613                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1614                 }
1615         }
1616 }
1617
1618 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1619 {
1620         u32 old_irq_mask = dev->irq_mask;
1621
1622         /* update beacon right away or defer to irq */
1623         handle_irq_beacon(dev);
1624         if (old_irq_mask != dev->irq_mask) {
1625                 /* The handler updated the IRQ mask. */
1626                 B43_WARN_ON(!dev->irq_mask);
1627                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1628                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1629                 } else {
1630                         /* Device interrupts are currently disabled. That means
1631                          * we just ran the hardirq handler and scheduled the
1632                          * IRQ thread. The thread will write the IRQ mask when
1633                          * it finished, so there's nothing to do here. Writing
1634                          * the mask _here_ would incorrectly re-enable IRQs. */
1635                 }
1636         }
1637 }
1638
1639 static void b43_beacon_update_trigger_work(struct work_struct *work)
1640 {
1641         struct b43_wl *wl = container_of(work, struct b43_wl,
1642                                          beacon_update_trigger);
1643         struct b43_wldev *dev;
1644
1645         mutex_lock(&wl->mutex);
1646         dev = wl->current_dev;
1647         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1648                 if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
1649                         /* wl->mutex is enough. */
1650                         b43_do_beacon_update_trigger_work(dev);
1651                         mmiowb();
1652                 } else {
1653                         spin_lock_irq(&wl->hardirq_lock);
1654                         b43_do_beacon_update_trigger_work(dev);
1655                         mmiowb();
1656                         spin_unlock_irq(&wl->hardirq_lock);
1657                 }
1658         }
1659         mutex_unlock(&wl->mutex);
1660 }
1661
1662 /* Asynchronously update the packet templates in template RAM.
1663  * Locking: Requires wl->mutex to be locked. */
1664 static void b43_update_templates(struct b43_wl *wl)
1665 {
1666         struct sk_buff *beacon;
1667
1668         /* This is the top half of the ansynchronous beacon update.
1669          * The bottom half is the beacon IRQ.
1670          * Beacon update must be asynchronous to avoid sending an
1671          * invalid beacon. This can happen for example, if the firmware
1672          * transmits a beacon while we are updating it. */
1673
1674         /* We could modify the existing beacon and set the aid bit in
1675          * the TIM field, but that would probably require resizing and
1676          * moving of data within the beacon template.
1677          * Simply request a new beacon and let mac80211 do the hard work. */
1678         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1679         if (unlikely(!beacon))
1680                 return;
1681
1682         if (wl->current_beacon)
1683                 dev_kfree_skb_any(wl->current_beacon);
1684         wl->current_beacon = beacon;
1685         wl->beacon0_uploaded = 0;
1686         wl->beacon1_uploaded = 0;
1687         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1688 }
1689
1690 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1691 {
1692         b43_time_lock(dev);
1693         if (dev->dev->core_rev >= 3) {
1694                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1695                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1696         } else {
1697                 b43_write16(dev, 0x606, (beacon_int >> 6));
1698                 b43_write16(dev, 0x610, beacon_int);
1699         }
1700         b43_time_unlock(dev);
1701         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1702 }
1703
1704 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1705 {
1706         u16 reason;
1707
1708         /* Read the register that contains the reason code for the panic. */
1709         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1710         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1711
1712         switch (reason) {
1713         default:
1714                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1715                 /* fallthrough */
1716         case B43_FWPANIC_DIE:
1717                 /* Do not restart the controller or firmware.
1718                  * The device is nonfunctional from now on.
1719                  * Restarting would result in this panic to trigger again,
1720                  * so we avoid that recursion. */
1721                 break;
1722         case B43_FWPANIC_RESTART:
1723                 b43_controller_restart(dev, "Microcode panic");
1724                 break;
1725         }
1726 }
1727
1728 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1729 {
1730         unsigned int i, cnt;
1731         u16 reason, marker_id, marker_line;
1732         __le16 *buf;
1733
1734         /* The proprietary firmware doesn't have this IRQ. */
1735         if (!dev->fw.opensource)
1736                 return;
1737
1738         /* Read the register that contains the reason code for this IRQ. */
1739         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1740
1741         switch (reason) {
1742         case B43_DEBUGIRQ_PANIC:
1743                 b43_handle_firmware_panic(dev);
1744                 break;
1745         case B43_DEBUGIRQ_DUMP_SHM:
1746                 if (!B43_DEBUG)
1747                         break; /* Only with driver debugging enabled. */
1748                 buf = kmalloc(4096, GFP_ATOMIC);
1749                 if (!buf) {
1750                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1751                         goto out;
1752                 }
1753                 for (i = 0; i < 4096; i += 2) {
1754                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1755                         buf[i / 2] = cpu_to_le16(tmp);
1756                 }
1757                 b43info(dev->wl, "Shared memory dump:\n");
1758                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1759                                16, 2, buf, 4096, 1);
1760                 kfree(buf);
1761                 break;
1762         case B43_DEBUGIRQ_DUMP_REGS:
1763                 if (!B43_DEBUG)
1764                         break; /* Only with driver debugging enabled. */
1765                 b43info(dev->wl, "Microcode register dump:\n");
1766                 for (i = 0, cnt = 0; i < 64; i++) {
1767                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1768                         if (cnt == 0)
1769                                 printk(KERN_INFO);
1770                         printk("r%02u: 0x%04X  ", i, tmp);
1771                         cnt++;
1772                         if (cnt == 6) {
1773                                 printk("\n");
1774                                 cnt = 0;
1775                         }
1776                 }
1777                 printk("\n");
1778                 break;
1779         case B43_DEBUGIRQ_MARKER:
1780                 if (!B43_DEBUG)
1781                         break; /* Only with driver debugging enabled. */
1782                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1783                                            B43_MARKER_ID_REG);
1784                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1785                                              B43_MARKER_LINE_REG);
1786                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1787                         "at line number %u\n",
1788                         marker_id, marker_line);
1789                 break;
1790         default:
1791                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1792                        reason);
1793         }
1794 out:
1795         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1796         b43_shm_write16(dev, B43_SHM_SCRATCH,
1797                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1798 }
1799
1800 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1801 {
1802         u32 reason;
1803         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1804         u32 merged_dma_reason = 0;
1805         int i;
1806
1807         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1808                 return;
1809
1810         reason = dev->irq_reason;
1811         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1812                 dma_reason[i] = dev->dma_reason[i];
1813                 merged_dma_reason |= dma_reason[i];
1814         }
1815
1816         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1817                 b43err(dev->wl, "MAC transmission error\n");
1818
1819         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1820                 b43err(dev->wl, "PHY transmission error\n");
1821                 rmb();
1822                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1823                         atomic_set(&dev->phy.txerr_cnt,
1824                                    B43_PHY_TX_BADNESS_LIMIT);
1825                         b43err(dev->wl, "Too many PHY TX errors, "
1826                                         "restarting the controller\n");
1827                         b43_controller_restart(dev, "PHY TX errors");
1828                 }
1829         }
1830
1831         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1832                                           B43_DMAIRQ_NONFATALMASK))) {
1833                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1834                         b43err(dev->wl, "Fatal DMA error: "
1835                                "0x%08X, 0x%08X, 0x%08X, "
1836                                "0x%08X, 0x%08X, 0x%08X\n",
1837                                dma_reason[0], dma_reason[1],
1838                                dma_reason[2], dma_reason[3],
1839                                dma_reason[4], dma_reason[5]);
1840                         b43err(dev->wl, "This device does not support DMA "
1841                                "on your system. It will now be switched to PIO.\n");
1842                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1843                         dev->use_pio = 1;
1844                         b43_controller_restart(dev, "DMA error");
1845                         return;
1846                 }
1847                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1848                         b43err(dev->wl, "DMA error: "
1849                                "0x%08X, 0x%08X, 0x%08X, "
1850                                "0x%08X, 0x%08X, 0x%08X\n",
1851                                dma_reason[0], dma_reason[1],
1852                                dma_reason[2], dma_reason[3],
1853                                dma_reason[4], dma_reason[5]);
1854                 }
1855         }
1856
1857         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1858                 handle_irq_ucode_debug(dev);
1859         if (reason & B43_IRQ_TBTT_INDI)
1860                 handle_irq_tbtt_indication(dev);
1861         if (reason & B43_IRQ_ATIM_END)
1862                 handle_irq_atim_end(dev);
1863         if (reason & B43_IRQ_BEACON)
1864                 handle_irq_beacon(dev);
1865         if (reason & B43_IRQ_PMQ)
1866                 handle_irq_pmq(dev);
1867         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1868                 ;/* TODO */
1869         if (reason & B43_IRQ_NOISESAMPLE_OK)
1870                 handle_irq_noise(dev);
1871
1872         /* Check the DMA reason registers for received data. */
1873         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1874                 if (b43_using_pio_transfers(dev))
1875                         b43_pio_rx(dev->pio.rx_queue);
1876                 else
1877                         b43_dma_rx(dev->dma.rx_ring);
1878         }
1879         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1880         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1881         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1882         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1883         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1884
1885         if (reason & B43_IRQ_TX_OK)
1886                 handle_irq_transmit_status(dev);
1887
1888         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1889         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1890
1891 #if B43_DEBUG
1892         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1893                 dev->irq_count++;
1894                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1895                         if (reason & (1 << i))
1896                                 dev->irq_bit_count[i]++;
1897                 }
1898         }
1899 #endif
1900 }
1901
1902 /* Interrupt thread handler. Handles device interrupts in thread context. */
1903 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1904 {
1905         struct b43_wldev *dev = dev_id;
1906
1907         mutex_lock(&dev->wl->mutex);
1908         b43_do_interrupt_thread(dev);
1909         mmiowb();
1910         mutex_unlock(&dev->wl->mutex);
1911
1912         return IRQ_HANDLED;
1913 }
1914
1915 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1916 {
1917         u32 reason;
1918
1919         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1920          * On SDIO, this runs under wl->mutex. */
1921
1922         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1923         if (reason == 0xffffffff)       /* shared IRQ */
1924                 return IRQ_NONE;
1925         reason &= dev->irq_mask;
1926         if (!reason)
1927                 return IRQ_HANDLED;
1928
1929         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1930             & 0x0001DC00;
1931         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1932             & 0x0000DC00;
1933         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1934             & 0x0000DC00;
1935         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1936             & 0x0001DC00;
1937         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1938             & 0x0000DC00;
1939 /* Unused ring
1940         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1941             & 0x0000DC00;
1942 */
1943
1944         /* ACK the interrupt. */
1945         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1946         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1947         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1948         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1949         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1950         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1951 /* Unused ring
1952         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1953 */
1954
1955         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1956         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1957         /* Save the reason bitmasks for the IRQ thread handler. */
1958         dev->irq_reason = reason;
1959
1960         return IRQ_WAKE_THREAD;
1961 }
1962
1963 /* Interrupt handler top-half. This runs with interrupts disabled. */
1964 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1965 {
1966         struct b43_wldev *dev = dev_id;
1967         irqreturn_t ret;
1968
1969         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1970                 return IRQ_NONE;
1971
1972         spin_lock(&dev->wl->hardirq_lock);
1973         ret = b43_do_interrupt(dev);
1974         mmiowb();
1975         spin_unlock(&dev->wl->hardirq_lock);
1976
1977         return ret;
1978 }
1979
1980 /* SDIO interrupt handler. This runs in process context. */
1981 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
1982 {
1983         struct b43_wl *wl = dev->wl;
1984         irqreturn_t ret;
1985
1986         mutex_lock(&wl->mutex);
1987
1988         ret = b43_do_interrupt(dev);
1989         if (ret == IRQ_WAKE_THREAD)
1990                 b43_do_interrupt_thread(dev);
1991
1992         mutex_unlock(&wl->mutex);
1993 }
1994
1995 void b43_do_release_fw(struct b43_firmware_file *fw)
1996 {
1997         release_firmware(fw->data);
1998         fw->data = NULL;
1999         fw->filename = NULL;
2000 }
2001
2002 static void b43_release_firmware(struct b43_wldev *dev)
2003 {
2004         b43_do_release_fw(&dev->fw.ucode);
2005         b43_do_release_fw(&dev->fw.pcm);
2006         b43_do_release_fw(&dev->fw.initvals);
2007         b43_do_release_fw(&dev->fw.initvals_band);
2008 }
2009
2010 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2011 {
2012         const char text[] =
2013                 "You must go to " \
2014                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2015                 "and download the correct firmware for this driver version. " \
2016                 "Please carefully read all instructions on this website.\n";
2017
2018         if (error)
2019                 b43err(wl, text);
2020         else
2021                 b43warn(wl, text);
2022 }
2023
2024 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2025                       const char *name,
2026                       struct b43_firmware_file *fw)
2027 {
2028         const struct firmware *blob;
2029         struct b43_fw_header *hdr;
2030         u32 size;
2031         int err;
2032
2033         if (!name) {
2034                 /* Don't fetch anything. Free possibly cached firmware. */
2035                 /* FIXME: We should probably keep it anyway, to save some headache
2036                  * on suspend/resume with multiband devices. */
2037                 b43_do_release_fw(fw);
2038                 return 0;
2039         }
2040         if (fw->filename) {
2041                 if ((fw->type == ctx->req_type) &&
2042                     (strcmp(fw->filename, name) == 0))
2043                         return 0; /* Already have this fw. */
2044                 /* Free the cached firmware first. */
2045                 /* FIXME: We should probably do this later after we successfully
2046                  * got the new fw. This could reduce headache with multiband devices.
2047                  * We could also redesign this to cache the firmware for all possible
2048                  * bands all the time. */
2049                 b43_do_release_fw(fw);
2050         }
2051
2052         switch (ctx->req_type) {
2053         case B43_FWTYPE_PROPRIETARY:
2054                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2055                          "b43%s/%s.fw",
2056                          modparam_fwpostfix, name);
2057                 break;
2058         case B43_FWTYPE_OPENSOURCE:
2059                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2060                          "b43-open%s/%s.fw",
2061                          modparam_fwpostfix, name);
2062                 break;
2063         default:
2064                 B43_WARN_ON(1);
2065                 return -ENOSYS;
2066         }
2067         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2068         if (err == -ENOENT) {
2069                 snprintf(ctx->errors[ctx->req_type],
2070                          sizeof(ctx->errors[ctx->req_type]),
2071                          "Firmware file \"%s\" not found\n", ctx->fwname);
2072                 return err;
2073         } else if (err) {
2074                 snprintf(ctx->errors[ctx->req_type],
2075                          sizeof(ctx->errors[ctx->req_type]),
2076                          "Firmware file \"%s\" request failed (err=%d)\n",
2077                          ctx->fwname, err);
2078                 return err;
2079         }
2080         if (blob->size < sizeof(struct b43_fw_header))
2081                 goto err_format;
2082         hdr = (struct b43_fw_header *)(blob->data);
2083         switch (hdr->type) {
2084         case B43_FW_TYPE_UCODE:
2085         case B43_FW_TYPE_PCM:
2086                 size = be32_to_cpu(hdr->size);
2087                 if (size != blob->size - sizeof(struct b43_fw_header))
2088                         goto err_format;
2089                 /* fallthrough */
2090         case B43_FW_TYPE_IV:
2091                 if (hdr->ver != 1)
2092                         goto err_format;
2093                 break;
2094         default:
2095                 goto err_format;
2096         }
2097
2098         fw->data = blob;
2099         fw->filename = name;
2100         fw->type = ctx->req_type;
2101
2102         return 0;
2103
2104 err_format:
2105         snprintf(ctx->errors[ctx->req_type],
2106                  sizeof(ctx->errors[ctx->req_type]),
2107                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2108         release_firmware(blob);
2109
2110         return -EPROTO;
2111 }
2112
2113 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2114 {
2115         struct b43_wldev *dev = ctx->dev;
2116         struct b43_firmware *fw = &ctx->dev->fw;
2117         const u8 rev = ctx->dev->dev->core_rev;
2118         const char *filename;
2119         u32 tmshigh;
2120         int err;
2121
2122         /* Get microcode */
2123         if ((rev >= 5) && (rev <= 10))
2124                 filename = "ucode5";
2125         else if ((rev >= 11) && (rev <= 12))
2126                 filename = "ucode11";
2127         else if (rev == 13)
2128                 filename = "ucode13";
2129         else if (rev == 14)
2130                 filename = "ucode14";
2131         else if (rev == 15)
2132                 filename = "ucode15";
2133         else if ((rev >= 16) && (rev <= 20))
2134                 filename = "ucode16_mimo";
2135         else
2136                 goto err_no_ucode;
2137         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2138         if (err)
2139                 goto err_load;
2140
2141         /* Get PCM code */
2142         if ((rev >= 5) && (rev <= 10))
2143                 filename = "pcm5";
2144         else if (rev >= 11)
2145                 filename = NULL;
2146         else
2147                 goto err_no_pcm;
2148         fw->pcm_request_failed = 0;
2149         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2150         if (err == -ENOENT) {
2151                 /* We did not find a PCM file? Not fatal, but
2152                  * core rev <= 10 must do without hwcrypto then. */
2153                 fw->pcm_request_failed = 1;
2154         } else if (err)
2155                 goto err_load;
2156
2157         /* Get initvals */
2158         switch (dev->phy.type) {
2159         case B43_PHYTYPE_A:
2160                 if ((rev >= 5) && (rev <= 10)) {
2161                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2162                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2163                                 filename = "a0g1initvals5";
2164                         else
2165                                 filename = "a0g0initvals5";
2166                 } else
2167                         goto err_no_initvals;
2168                 break;
2169         case B43_PHYTYPE_G:
2170                 if ((rev >= 5) && (rev <= 10))
2171                         filename = "b0g0initvals5";
2172                 else if (rev >= 13)
2173                         filename = "b0g0initvals13";
2174                 else
2175                         goto err_no_initvals;
2176                 break;
2177         case B43_PHYTYPE_N:
2178                 if (rev >= 16)
2179                         filename = "n0initvals16";
2180                 else if ((rev >= 11) && (rev <= 12))
2181                         filename = "n0initvals11";
2182                 else
2183                         goto err_no_initvals;
2184                 break;
2185         case B43_PHYTYPE_LP:
2186                 if (rev == 13)
2187                         filename = "lp0initvals13";
2188                 else if (rev == 14)
2189                         filename = "lp0initvals14";
2190                 else if (rev >= 15)
2191                         filename = "lp0initvals15";
2192                 else
2193                         goto err_no_initvals;
2194                 break;
2195         default:
2196                 goto err_no_initvals;
2197         }
2198         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2199         if (err)
2200                 goto err_load;
2201
2202         /* Get bandswitch initvals */
2203         switch (dev->phy.type) {
2204         case B43_PHYTYPE_A:
2205                 if ((rev >= 5) && (rev <= 10)) {
2206                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2207                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2208                                 filename = "a0g1bsinitvals5";
2209                         else
2210                                 filename = "a0g0bsinitvals5";
2211                 } else if (rev >= 11)
2212                         filename = NULL;
2213                 else
2214                         goto err_no_initvals;
2215                 break;
2216         case B43_PHYTYPE_G:
2217                 if ((rev >= 5) && (rev <= 10))
2218                         filename = "b0g0bsinitvals5";
2219                 else if (rev >= 11)
2220                         filename = NULL;
2221                 else
2222                         goto err_no_initvals;
2223                 break;
2224         case B43_PHYTYPE_N:
2225                 if (rev >= 16)
2226                         filename = "n0bsinitvals16";
2227                 else if ((rev >= 11) && (rev <= 12))
2228                         filename = "n0bsinitvals11";
2229                 else
2230                         goto err_no_initvals;
2231                 break;
2232         case B43_PHYTYPE_LP:
2233                 if (rev == 13)
2234                         filename = "lp0bsinitvals13";
2235                 else if (rev == 14)
2236                         filename = "lp0bsinitvals14";
2237                 else if (rev >= 15)
2238                         filename = "lp0bsinitvals15";
2239                 else
2240                         goto err_no_initvals;
2241                 break;
2242         default:
2243                 goto err_no_initvals;
2244         }
2245         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2246         if (err)
2247                 goto err_load;
2248
2249         return 0;
2250
2251 err_no_ucode:
2252         err = ctx->fatal_failure = -EOPNOTSUPP;
2253         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2254                "is required for your device (wl-core rev %u)\n", rev);
2255         goto error;
2256
2257 err_no_pcm:
2258         err = ctx->fatal_failure = -EOPNOTSUPP;
2259         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2260                "is required for your device (wl-core rev %u)\n", rev);
2261         goto error;
2262
2263 err_no_initvals:
2264         err = ctx->fatal_failure = -EOPNOTSUPP;
2265         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2266                "is required for your device (wl-core rev %u)\n", rev);
2267         goto error;
2268
2269 err_load:
2270         /* We failed to load this firmware image. The error message
2271          * already is in ctx->errors. Return and let our caller decide
2272          * what to do. */
2273         goto error;
2274
2275 error:
2276         b43_release_firmware(dev);
2277         return err;
2278 }
2279
2280 static int b43_request_firmware(struct b43_wldev *dev)
2281 {
2282         struct b43_request_fw_context *ctx;
2283         unsigned int i;
2284         int err;
2285         const char *errmsg;
2286
2287         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2288         if (!ctx)
2289                 return -ENOMEM;
2290         ctx->dev = dev;
2291
2292         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2293         err = b43_try_request_fw(ctx);
2294         if (!err)
2295                 goto out; /* Successfully loaded it. */
2296         err = ctx->fatal_failure;
2297         if (err)
2298                 goto out;
2299
2300         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2301         err = b43_try_request_fw(ctx);
2302         if (!err)
2303                 goto out; /* Successfully loaded it. */
2304         err = ctx->fatal_failure;
2305         if (err)
2306                 goto out;
2307
2308         /* Could not find a usable firmware. Print the errors. */
2309         for (i = 0; i < B43_NR_FWTYPES; i++) {
2310                 errmsg = ctx->errors[i];
2311                 if (strlen(errmsg))
2312                         b43err(dev->wl, errmsg);
2313         }
2314         b43_print_fw_helptext(dev->wl, 1);
2315         err = -ENOENT;
2316
2317 out:
2318         kfree(ctx);
2319         return err;
2320 }
2321
2322 static int b43_upload_microcode(struct b43_wldev *dev)
2323 {
2324         struct wiphy *wiphy = dev->wl->hw->wiphy;
2325         const size_t hdr_len = sizeof(struct b43_fw_header);
2326         const __be32 *data;
2327         unsigned int i, len;
2328         u16 fwrev, fwpatch, fwdate, fwtime;
2329         u32 tmp, macctl;
2330         int err = 0;
2331
2332         /* Jump the microcode PSM to offset 0 */
2333         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2334         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2335         macctl |= B43_MACCTL_PSM_JMP0;
2336         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2337         /* Zero out all microcode PSM registers and shared memory. */
2338         for (i = 0; i < 64; i++)
2339                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2340         for (i = 0; i < 4096; i += 2)
2341                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2342
2343         /* Upload Microcode. */
2344         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2345         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2346         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2347         for (i = 0; i < len; i++) {
2348                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2349                 udelay(10);
2350         }
2351
2352         if (dev->fw.pcm.data) {
2353                 /* Upload PCM data. */
2354                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2355                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2356                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2357                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2358                 /* No need for autoinc bit in SHM_HW */
2359                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2360                 for (i = 0; i < len; i++) {
2361                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2362                         udelay(10);
2363                 }
2364         }
2365
2366         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2367
2368         /* Start the microcode PSM */
2369         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2370         macctl &= ~B43_MACCTL_PSM_JMP0;
2371         macctl |= B43_MACCTL_PSM_RUN;
2372         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2373
2374         /* Wait for the microcode to load and respond */
2375         i = 0;
2376         while (1) {
2377                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2378                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2379                         break;
2380                 i++;
2381                 if (i >= 20) {
2382                         b43err(dev->wl, "Microcode not responding\n");
2383                         b43_print_fw_helptext(dev->wl, 1);
2384                         err = -ENODEV;
2385                         goto error;
2386                 }
2387                 msleep(50);
2388         }
2389         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2390
2391         /* Get and check the revisions. */
2392         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2393         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2394         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2395         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2396
2397         if (fwrev <= 0x128) {
2398                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2399                        "binary drivers older than version 4.x is unsupported. "
2400                        "You must upgrade your firmware files.\n");
2401                 b43_print_fw_helptext(dev->wl, 1);
2402                 err = -EOPNOTSUPP;
2403                 goto error;
2404         }
2405         dev->fw.rev = fwrev;
2406         dev->fw.patch = fwpatch;
2407         dev->fw.opensource = (fwdate == 0xFFFF);
2408
2409         /* Default to use-all-queues. */
2410         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2411         dev->qos_enabled = !!modparam_qos;
2412         /* Default to firmware/hardware crypto acceleration. */
2413         dev->hwcrypto_enabled = 1;
2414
2415         if (dev->fw.opensource) {
2416                 u16 fwcapa;
2417
2418                 /* Patchlevel info is encoded in the "time" field. */
2419                 dev->fw.patch = fwtime;
2420                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2421                         dev->fw.rev, dev->fw.patch);
2422
2423                 fwcapa = b43_fwcapa_read(dev);
2424                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2425                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2426                         /* Disable hardware crypto and fall back to software crypto. */
2427                         dev->hwcrypto_enabled = 0;
2428                 }
2429                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2430                         b43info(dev->wl, "QoS not supported by firmware\n");
2431                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2432                          * ieee80211_unregister to make sure the networking core can
2433                          * properly free possible resources. */
2434                         dev->wl->hw->queues = 1;
2435                         dev->qos_enabled = 0;
2436                 }
2437         } else {
2438                 b43info(dev->wl, "Loading firmware version %u.%u "
2439                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2440                         fwrev, fwpatch,
2441                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2442                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2443                 if (dev->fw.pcm_request_failed) {
2444                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2445                                 "Hardware accelerated cryptography is disabled.\n");
2446                         b43_print_fw_helptext(dev->wl, 0);
2447                 }
2448         }
2449
2450         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2451                         dev->fw.rev, dev->fw.patch);
2452         wiphy->hw_version = dev->dev->core_id;
2453
2454         if (b43_is_old_txhdr_format(dev)) {
2455                 /* We're over the deadline, but we keep support for old fw
2456                  * until it turns out to be in major conflict with something new. */
2457                 b43warn(dev->wl, "You are using an old firmware image. "
2458                         "Support for old firmware will be removed soon "
2459                         "(official deadline was July 2008).\n");
2460                 b43_print_fw_helptext(dev->wl, 0);
2461         }
2462
2463         return 0;
2464
2465 error:
2466         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2467         macctl &= ~B43_MACCTL_PSM_RUN;
2468         macctl |= B43_MACCTL_PSM_JMP0;
2469         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2470
2471         return err;
2472 }
2473
2474 static int b43_write_initvals(struct b43_wldev *dev,
2475                               const struct b43_iv *ivals,
2476                               size_t count,
2477                               size_t array_size)
2478 {
2479         const struct b43_iv *iv;
2480         u16 offset;
2481         size_t i;
2482         bool bit32;
2483
2484         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2485         iv = ivals;
2486         for (i = 0; i < count; i++) {
2487                 if (array_size < sizeof(iv->offset_size))
2488                         goto err_format;
2489                 array_size -= sizeof(iv->offset_size);
2490                 offset = be16_to_cpu(iv->offset_size);
2491                 bit32 = !!(offset & B43_IV_32BIT);
2492                 offset &= B43_IV_OFFSET_MASK;
2493                 if (offset >= 0x1000)
2494                         goto err_format;
2495                 if (bit32) {
2496                         u32 value;
2497
2498                         if (array_size < sizeof(iv->data.d32))
2499                                 goto err_format;
2500                         array_size -= sizeof(iv->data.d32);
2501
2502                         value = get_unaligned_be32(&iv->data.d32);
2503                         b43_write32(dev, offset, value);
2504
2505                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2506                                                         sizeof(__be16) +
2507                                                         sizeof(__be32));
2508                 } else {
2509                         u16 value;
2510
2511                         if (array_size < sizeof(iv->data.d16))
2512                                 goto err_format;
2513                         array_size -= sizeof(iv->data.d16);
2514
2515                         value = be16_to_cpu(iv->data.d16);
2516                         b43_write16(dev, offset, value);
2517
2518                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2519                                                         sizeof(__be16) +
2520                                                         sizeof(__be16));
2521                 }
2522         }
2523         if (array_size)
2524                 goto err_format;
2525
2526         return 0;
2527
2528 err_format:
2529         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2530         b43_print_fw_helptext(dev->wl, 1);
2531
2532         return -EPROTO;
2533 }
2534
2535 static int b43_upload_initvals(struct b43_wldev *dev)
2536 {
2537         const size_t hdr_len = sizeof(struct b43_fw_header);
2538         const struct b43_fw_header *hdr;
2539         struct b43_firmware *fw = &dev->fw;
2540         const struct b43_iv *ivals;
2541         size_t count;
2542         int err;
2543
2544         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2545         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2546         count = be32_to_cpu(hdr->size);
2547         err = b43_write_initvals(dev, ivals, count,
2548                                  fw->initvals.data->size - hdr_len);
2549         if (err)
2550                 goto out;
2551         if (fw->initvals_band.data) {
2552                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2553                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2554                 count = be32_to_cpu(hdr->size);
2555                 err = b43_write_initvals(dev, ivals, count,
2556                                          fw->initvals_band.data->size - hdr_len);
2557                 if (err)
2558                         goto out;
2559         }
2560 out:
2561
2562         return err;
2563 }
2564
2565 /* Initialize the GPIOs
2566  * http://bcm-specs.sipsolutions.net/GPIO
2567  */
2568 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2569 {
2570         struct ssb_bus *bus = dev->dev->sdev->bus;
2571
2572 #ifdef CONFIG_SSB_DRIVER_PCICORE
2573         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2574 #else
2575         return bus->chipco.dev;
2576 #endif
2577 }
2578
2579 static int b43_gpio_init(struct b43_wldev *dev)
2580 {
2581         struct ssb_device *gpiodev;
2582         u32 mask, set;
2583
2584         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2585                     & ~B43_MACCTL_GPOUTSMSK);
2586
2587         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2588                     | 0x000F);
2589
2590         mask = 0x0000001F;
2591         set = 0x0000000F;
2592         if (dev->dev->chip_id == 0x4301) {
2593                 mask |= 0x0060;
2594                 set |= 0x0060;
2595         }
2596         if (0 /* FIXME: conditional unknown */ ) {
2597                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2598                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2599                             | 0x0100);
2600                 mask |= 0x0180;
2601                 set |= 0x0180;
2602         }
2603         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2604                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2605                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2606                             | 0x0200);
2607                 mask |= 0x0200;
2608                 set |= 0x0200;
2609         }
2610         if (dev->dev->core_rev >= 2)
2611                 mask |= 0x0010; /* FIXME: This is redundant. */
2612
2613         gpiodev = b43_ssb_gpio_dev(dev);
2614         if (gpiodev)
2615                 ssb_write32(gpiodev, B43_GPIO_CONTROL,
2616                             (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2617                              & mask) | set);
2618
2619         return 0;
2620 }
2621
2622 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2623 static void b43_gpio_cleanup(struct b43_wldev *dev)
2624 {
2625         struct ssb_device *gpiodev;
2626
2627         gpiodev = b43_ssb_gpio_dev(dev);
2628         if (gpiodev)
2629                 ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2630 }
2631
2632 /* http://bcm-specs.sipsolutions.net/EnableMac */
2633 void b43_mac_enable(struct b43_wldev *dev)
2634 {
2635         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2636                 u16 fwstate;
2637
2638                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2639                                          B43_SHM_SH_UCODESTAT);
2640                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2641                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2642                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2643                                "should be suspended, but current state is %u\n",
2644                                fwstate);
2645                 }
2646         }
2647
2648         dev->mac_suspended--;
2649         B43_WARN_ON(dev->mac_suspended < 0);
2650         if (dev->mac_suspended == 0) {
2651                 b43_write32(dev, B43_MMIO_MACCTL,
2652                             b43_read32(dev, B43_MMIO_MACCTL)
2653                             | B43_MACCTL_ENABLED);
2654                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2655                             B43_IRQ_MAC_SUSPENDED);
2656                 /* Commit writes */
2657                 b43_read32(dev, B43_MMIO_MACCTL);
2658                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2659                 b43_power_saving_ctl_bits(dev, 0);
2660         }
2661 }
2662
2663 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2664 void b43_mac_suspend(struct b43_wldev *dev)
2665 {
2666         int i;
2667         u32 tmp;
2668
2669         might_sleep();
2670         B43_WARN_ON(dev->mac_suspended < 0);
2671
2672         if (dev->mac_suspended == 0) {
2673                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2674                 b43_write32(dev, B43_MMIO_MACCTL,
2675                             b43_read32(dev, B43_MMIO_MACCTL)
2676                             & ~B43_MACCTL_ENABLED);
2677                 /* force pci to flush the write */
2678                 b43_read32(dev, B43_MMIO_MACCTL);
2679                 for (i = 35; i; i--) {
2680                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2681                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2682                                 goto out;
2683                         udelay(10);
2684                 }
2685                 /* Hm, it seems this will take some time. Use msleep(). */
2686                 for (i = 40; i; i--) {
2687                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2688                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2689                                 goto out;
2690                         msleep(1);
2691                 }
2692                 b43err(dev->wl, "MAC suspend failed\n");
2693         }
2694 out:
2695         dev->mac_suspended++;
2696 }
2697
2698 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2699 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2700 {
2701         u32 tmslow = ssb_read32(dev->sdev, SSB_TMSLOW);
2702         if (on)
2703                 tmslow |= B43_TMSLOW_MACPHYCLKEN;
2704         else
2705                 tmslow &= ~B43_TMSLOW_MACPHYCLKEN;
2706         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
2707 }
2708
2709 static void b43_adjust_opmode(struct b43_wldev *dev)
2710 {
2711         struct b43_wl *wl = dev->wl;
2712         u32 ctl;
2713         u16 cfp_pretbtt;
2714
2715         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2716         /* Reset status to STA infrastructure mode. */
2717         ctl &= ~B43_MACCTL_AP;
2718         ctl &= ~B43_MACCTL_KEEP_CTL;
2719         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2720         ctl &= ~B43_MACCTL_KEEP_BAD;
2721         ctl &= ~B43_MACCTL_PROMISC;
2722         ctl &= ~B43_MACCTL_BEACPROMISC;
2723         ctl |= B43_MACCTL_INFRA;
2724
2725         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2726             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2727                 ctl |= B43_MACCTL_AP;
2728         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2729                 ctl &= ~B43_MACCTL_INFRA;
2730
2731         if (wl->filter_flags & FIF_CONTROL)
2732                 ctl |= B43_MACCTL_KEEP_CTL;
2733         if (wl->filter_flags & FIF_FCSFAIL)
2734                 ctl |= B43_MACCTL_KEEP_BAD;
2735         if (wl->filter_flags & FIF_PLCPFAIL)
2736                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2737         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2738                 ctl |= B43_MACCTL_PROMISC;
2739         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2740                 ctl |= B43_MACCTL_BEACPROMISC;
2741
2742         /* Workaround: On old hardware the HW-MAC-address-filter
2743          * doesn't work properly, so always run promisc in filter
2744          * it in software. */
2745         if (dev->dev->core_rev <= 4)
2746                 ctl |= B43_MACCTL_PROMISC;
2747
2748         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2749
2750         cfp_pretbtt = 2;
2751         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2752                 if (dev->dev->chip_id == 0x4306 &&
2753                     dev->dev->chip_rev == 3)
2754                         cfp_pretbtt = 100;
2755                 else
2756                         cfp_pretbtt = 50;
2757         }
2758         b43_write16(dev, 0x612, cfp_pretbtt);
2759
2760         /* FIXME: We don't currently implement the PMQ mechanism,
2761          *        so always disable it. If we want to implement PMQ,
2762          *        we need to enable it here (clear DISCPMQ) in AP mode.
2763          */
2764         if (0  /* ctl & B43_MACCTL_AP */) {
2765                 b43_write32(dev, B43_MMIO_MACCTL,
2766                             b43_read32(dev, B43_MMIO_MACCTL)
2767                             & ~B43_MACCTL_DISCPMQ);
2768         } else {
2769                 b43_write32(dev, B43_MMIO_MACCTL,
2770                             b43_read32(dev, B43_MMIO_MACCTL)
2771                             | B43_MACCTL_DISCPMQ);
2772         }
2773 }
2774
2775 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2776 {
2777         u16 offset;
2778
2779         if (is_ofdm) {
2780                 offset = 0x480;
2781                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2782         } else {
2783                 offset = 0x4C0;
2784                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2785         }
2786         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2787                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2788 }
2789
2790 static void b43_rate_memory_init(struct b43_wldev *dev)
2791 {
2792         switch (dev->phy.type) {
2793         case B43_PHYTYPE_A:
2794         case B43_PHYTYPE_G:
2795         case B43_PHYTYPE_N:
2796         case B43_PHYTYPE_LP:
2797                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2798                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2799                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2800                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2801                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2802                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2803                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2804                 if (dev->phy.type == B43_PHYTYPE_A)
2805                         break;
2806                 /* fallthrough */
2807         case B43_PHYTYPE_B:
2808                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2809                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2810                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2811                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2812                 break;
2813         default:
2814                 B43_WARN_ON(1);
2815         }
2816 }
2817
2818 /* Set the default values for the PHY TX Control Words. */
2819 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2820 {
2821         u16 ctl = 0;
2822
2823         ctl |= B43_TXH_PHY_ENC_CCK;
2824         ctl |= B43_TXH_PHY_ANT01AUTO;
2825         ctl |= B43_TXH_PHY_TXPWR;
2826
2827         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2828         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2829         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2830 }
2831
2832 /* Set the TX-Antenna for management frames sent by firmware. */
2833 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2834 {
2835         u16 ant;
2836         u16 tmp;
2837
2838         ant = b43_antenna_to_phyctl(antenna);
2839
2840         /* For ACK/CTS */
2841         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2842         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2843         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2844         /* For Probe Resposes */
2845         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2846         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2847         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2848 }
2849
2850 /* This is the opposite of b43_chip_init() */
2851 static void b43_chip_exit(struct b43_wldev *dev)
2852 {
2853         b43_phy_exit(dev);
2854         b43_gpio_cleanup(dev);
2855         /* firmware is released later */
2856 }
2857
2858 /* Initialize the chip
2859  * http://bcm-specs.sipsolutions.net/ChipInit
2860  */
2861 static int b43_chip_init(struct b43_wldev *dev)
2862 {
2863         struct b43_phy *phy = &dev->phy;
2864         int err;
2865         u32 macctl;
2866         u16 value16;
2867
2868         /* Initialize the MAC control */
2869         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2870         if (dev->phy.gmode)
2871                 macctl |= B43_MACCTL_GMODE;
2872         macctl |= B43_MACCTL_INFRA;
2873         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2874
2875         err = b43_request_firmware(dev);
2876         if (err)
2877                 goto out;
2878         err = b43_upload_microcode(dev);
2879         if (err)
2880                 goto out;       /* firmware is released later */
2881
2882         err = b43_gpio_init(dev);
2883         if (err)
2884                 goto out;       /* firmware is released later */
2885
2886         err = b43_upload_initvals(dev);
2887         if (err)
2888                 goto err_gpio_clean;
2889
2890         /* Turn the Analog on and initialize the PHY. */
2891         phy->ops->switch_analog(dev, 1);
2892         err = b43_phy_init(dev);
2893         if (err)
2894                 goto err_gpio_clean;
2895
2896         /* Disable Interference Mitigation. */
2897         if (phy->ops->interf_mitigation)
2898                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2899
2900         /* Select the antennae */
2901         if (phy->ops->set_rx_antenna)
2902                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2903         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2904
2905         if (phy->type == B43_PHYTYPE_B) {
2906                 value16 = b43_read16(dev, 0x005E);
2907                 value16 |= 0x0004;
2908                 b43_write16(dev, 0x005E, value16);
2909         }
2910         b43_write32(dev, 0x0100, 0x01000000);
2911         if (dev->dev->core_rev < 5)
2912                 b43_write32(dev, 0x010C, 0x01000000);
2913
2914         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2915                     & ~B43_MACCTL_INFRA);
2916         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2917                     | B43_MACCTL_INFRA);
2918
2919         /* Probe Response Timeout value */
2920         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2921         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2922
2923         /* Initially set the wireless operation mode. */
2924         b43_adjust_opmode(dev);
2925
2926         if (dev->dev->core_rev < 3) {
2927                 b43_write16(dev, 0x060E, 0x0000);
2928                 b43_write16(dev, 0x0610, 0x8000);
2929                 b43_write16(dev, 0x0604, 0x0000);
2930                 b43_write16(dev, 0x0606, 0x0200);
2931         } else {
2932                 b43_write32(dev, 0x0188, 0x80000000);
2933                 b43_write32(dev, 0x018C, 0x02000000);
2934         }
2935         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2936         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2937         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2938         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2939         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2940         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2941         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2942
2943         b43_mac_phy_clock_set(dev, true);
2944
2945         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2946                     dev->sdev->bus->chipco.fast_pwrup_delay);
2947
2948         err = 0;
2949         b43dbg(dev->wl, "Chip initialized\n");
2950 out:
2951         return err;
2952
2953 err_gpio_clean:
2954         b43_gpio_cleanup(dev);
2955         return err;
2956 }
2957
2958 static void b43_periodic_every60sec(struct b43_wldev *dev)
2959 {
2960         const struct b43_phy_operations *ops = dev->phy.ops;
2961
2962         if (ops->pwork_60sec)
2963                 ops->pwork_60sec(dev);
2964
2965         /* Force check the TX power emission now. */
2966         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2967 }
2968
2969 static void b43_periodic_every30sec(struct b43_wldev *dev)
2970 {
2971         /* Update device statistics. */
2972         b43_calculate_link_quality(dev);
2973 }
2974
2975 static void b43_periodic_every15sec(struct b43_wldev *dev)
2976 {
2977         struct b43_phy *phy = &dev->phy;
2978         u16 wdr;
2979
2980         if (dev->fw.opensource) {
2981                 /* Check if the firmware is still alive.
2982                  * It will reset the watchdog counter to 0 in its idle loop. */
2983                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2984                 if (unlikely(wdr)) {
2985                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2986                         b43_controller_restart(dev, "Firmware watchdog");
2987                         return;
2988                 } else {
2989                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2990                                         B43_WATCHDOG_REG, 1);
2991                 }
2992         }
2993
2994         if (phy->ops->pwork_15sec)
2995                 phy->ops->pwork_15sec(dev);
2996
2997         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2998         wmb();
2999
3000 #if B43_DEBUG
3001         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3002                 unsigned int i;
3003
3004                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3005                        dev->irq_count / 15,
3006                        dev->tx_count / 15,
3007                        dev->rx_count / 15);
3008                 dev->irq_count = 0;
3009                 dev->tx_count = 0;
3010                 dev->rx_count = 0;
3011                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3012                         if (dev->irq_bit_count[i]) {
3013                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3014                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3015                                 dev->irq_bit_count[i] = 0;
3016                         }
3017                 }
3018         }
3019 #endif
3020 }
3021
3022 static void do_periodic_work(struct b43_wldev *dev)
3023 {
3024         unsigned int state;
3025
3026         state = dev->periodic_state;
3027         if (state % 4 == 0)
3028                 b43_periodic_every60sec(dev);
3029         if (state % 2 == 0)
3030                 b43_periodic_every30sec(dev);
3031         b43_periodic_every15sec(dev);
3032 }
3033
3034 /* Periodic work locking policy:
3035  *      The whole periodic work handler is protected by
3036  *      wl->mutex. If another lock is needed somewhere in the
3037  *      pwork callchain, it's acquired in-place, where it's needed.
3038  */
3039 static void b43_periodic_work_handler(struct work_struct *work)
3040 {
3041         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3042                                              periodic_work.work);
3043         struct b43_wl *wl = dev->wl;
3044         unsigned long delay;
3045
3046         mutex_lock(&wl->mutex);
3047
3048         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3049                 goto out;
3050         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3051                 goto out_requeue;
3052
3053         do_periodic_work(dev);
3054
3055         dev->periodic_state++;
3056 out_requeue:
3057         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3058                 delay = msecs_to_jiffies(50);
3059         else
3060                 delay = round_jiffies_relative(HZ * 15);
3061         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3062 out:
3063         mutex_unlock(&wl->mutex);
3064 }
3065
3066 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3067 {
3068         struct delayed_work *work = &dev->periodic_work;
3069
3070         dev->periodic_state = 0;
3071         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3072         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3073 }
3074
3075 /* Check if communication with the device works correctly. */
3076 static int b43_validate_chipaccess(struct b43_wldev *dev)
3077 {
3078         u32 v, backup0, backup4;
3079
3080         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3081         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3082
3083         /* Check for read/write and endianness problems. */
3084         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3085         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3086                 goto error;
3087         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3088         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3089                 goto error;
3090
3091         /* Check if unaligned 32bit SHM_SHARED access works properly.
3092          * However, don't bail out on failure, because it's noncritical. */
3093         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3094         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3095         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3096         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3097         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3098                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3099         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3100         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3101             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3102             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3103             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3104                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3105
3106         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3107         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3108
3109         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3110                 /* The 32bit register shadows the two 16bit registers
3111                  * with update sideeffects. Validate this. */
3112                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3113                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3114                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3115                         goto error;
3116                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3117                         goto error;
3118         }
3119         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3120
3121         v = b43_read32(dev, B43_MMIO_MACCTL);
3122         v |= B43_MACCTL_GMODE;
3123         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3124                 goto error;
3125
3126         return 0;
3127 error:
3128         b43err(dev->wl, "Failed to validate the chipaccess\n");
3129         return -ENODEV;
3130 }
3131
3132 static void b43_security_init(struct b43_wldev *dev)
3133 {
3134         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3135         /* KTP is a word address, but we address SHM bytewise.
3136          * So multiply by two.
3137          */
3138         dev->ktp *= 2;
3139         /* Number of RCMTA address slots */
3140         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3141         /* Clear the key memory. */
3142         b43_clear_keys(dev);
3143 }
3144
3145 #ifdef CONFIG_B43_HWRNG
3146 static int b43_rng_read(struct hwrng *rng, u32 *data)
3147 {
3148         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3149         struct b43_wldev *dev;
3150         int count = -ENODEV;
3151
3152         mutex_lock(&wl->mutex);
3153         dev = wl->current_dev;
3154         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3155                 *data = b43_read16(dev, B43_MMIO_RNG);
3156                 count = sizeof(u16);
3157         }
3158         mutex_unlock(&wl->mutex);
3159
3160         return count;
3161 }
3162 #endif /* CONFIG_B43_HWRNG */
3163
3164 static void b43_rng_exit(struct b43_wl *wl)
3165 {
3166 #ifdef CONFIG_B43_HWRNG
3167         if (wl->rng_initialized)
3168                 hwrng_unregister(&wl->rng);
3169 #endif /* CONFIG_B43_HWRNG */
3170 }
3171
3172 static int b43_rng_init(struct b43_wl *wl)
3173 {
3174         int err = 0;
3175
3176 #ifdef CONFIG_B43_HWRNG
3177         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3178                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3179         wl->rng.name = wl->rng_name;
3180         wl->rng.data_read = b43_rng_read;
3181         wl->rng.priv = (unsigned long)wl;
3182         wl->rng_initialized = 1;
3183         err = hwrng_register(&wl->rng);
3184         if (err) {
3185                 wl->rng_initialized = 0;
3186                 b43err(wl, "Failed to register the random "
3187                        "number generator (%d)\n", err);
3188         }
3189 #endif /* CONFIG_B43_HWRNG */
3190
3191         return err;
3192 }
3193
3194 static void b43_tx_work(struct work_struct *work)
3195 {
3196         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3197         struct b43_wldev *dev;
3198         struct sk_buff *skb;
3199         int err = 0;
3200
3201         mutex_lock(&wl->mutex);
3202         dev = wl->current_dev;
3203         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3204                 mutex_unlock(&wl->mutex);
3205                 return;
3206         }
3207
3208         while (skb_queue_len(&wl->tx_queue)) {
3209                 skb = skb_dequeue(&wl->tx_queue);
3210
3211                 if (b43_using_pio_transfers(dev))
3212                         err = b43_pio_tx(dev, skb);
3213                 else
3214                         err = b43_dma_tx(dev, skb);
3215                 if (unlikely(err))
3216                         dev_kfree_skb(skb); /* Drop it */
3217         }
3218
3219 #if B43_DEBUG
3220         dev->tx_count++;
3221 #endif
3222         mutex_unlock(&wl->mutex);
3223 }
3224
3225 static void b43_op_tx(struct ieee80211_hw *hw,
3226                      struct sk_buff *skb)
3227 {
3228         struct b43_wl *wl = hw_to_b43_wl(hw);
3229
3230         if (unlikely(skb->len < 2 + 2 + 6)) {
3231                 /* Too short, this can't be a valid frame. */
3232                 dev_kfree_skb_any(skb);
3233                 return;
3234         }
3235         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3236
3237         skb_queue_tail(&wl->tx_queue, skb);
3238         ieee80211_queue_work(wl->hw, &wl->tx_work);
3239 }
3240
3241 static void b43_qos_params_upload(struct b43_wldev *dev,
3242                                   const struct ieee80211_tx_queue_params *p,
3243                                   u16 shm_offset)
3244 {
3245         u16 params[B43_NR_QOSPARAMS];
3246         int bslots, tmp;
3247         unsigned int i;
3248
3249         if (!dev->qos_enabled)
3250                 return;
3251
3252         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3253
3254         memset(&params, 0, sizeof(params));
3255
3256         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3257         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3258         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3259         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3260         params[B43_QOSPARAM_AIFS] = p->aifs;
3261         params[B43_QOSPARAM_BSLOTS] = bslots;
3262         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3263
3264         for (i = 0; i < ARRAY_SIZE(params); i++) {
3265                 if (i == B43_QOSPARAM_STATUS) {
3266                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3267                                              shm_offset + (i * 2));
3268                         /* Mark the parameters as updated. */
3269                         tmp |= 0x100;
3270                         b43_shm_write16(dev, B43_SHM_SHARED,
3271                                         shm_offset + (i * 2),
3272                                         tmp);
3273                 } else {
3274                         b43_shm_write16(dev, B43_SHM_SHARED,
3275                                         shm_offset + (i * 2),
3276                                         params[i]);
3277                 }
3278         }
3279 }
3280
3281 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3282 static const u16 b43_qos_shm_offsets[] = {
3283         /* [mac80211-queue-nr] = SHM_OFFSET, */
3284         [0] = B43_QOS_VOICE,
3285         [1] = B43_QOS_VIDEO,
3286         [2] = B43_QOS_BESTEFFORT,
3287         [3] = B43_QOS_BACKGROUND,
3288 };
3289
3290 /* Update all QOS parameters in hardware. */
3291 static void b43_qos_upload_all(struct b43_wldev *dev)
3292 {
3293         struct b43_wl *wl = dev->wl;
3294         struct b43_qos_params *params;
3295         unsigned int i;
3296
3297         if (!dev->qos_enabled)
3298                 return;
3299
3300         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3301                      ARRAY_SIZE(wl->qos_params));
3302
3303         b43_mac_suspend(dev);
3304         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3305                 params = &(wl->qos_params[i]);
3306                 b43_qos_params_upload(dev, &(params->p),
3307                                       b43_qos_shm_offsets[i]);
3308         }
3309         b43_mac_enable(dev);
3310 }
3311
3312 static void b43_qos_clear(struct b43_wl *wl)
3313 {
3314         struct b43_qos_params *params;
3315         unsigned int i;
3316
3317         /* Initialize QoS parameters to sane defaults. */
3318
3319         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3320                      ARRAY_SIZE(wl->qos_params));
3321
3322         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3323                 params = &(wl->qos_params[i]);
3324
3325                 switch (b43_qos_shm_offsets[i]) {
3326                 case B43_QOS_VOICE:
3327                         params->p.txop = 0;
3328                         params->p.aifs = 2;
3329                         params->p.cw_min = 0x0001;
3330                         params->p.cw_max = 0x0001;
3331                         break;
3332                 case B43_QOS_VIDEO:
3333                         params->p.txop = 0;
3334                         params->p.aifs = 2;
3335                         params->p.cw_min = 0x0001;
3336                         params->p.cw_max = 0x0001;
3337                         break;
3338                 case B43_QOS_BESTEFFORT:
3339                         params->p.txop = 0;
3340                         params->p.aifs = 3;
3341                         params->p.cw_min = 0x0001;
3342                         params->p.cw_max = 0x03FF;
3343                         break;
3344                 case B43_QOS_BACKGROUND:
3345                         params->p.txop = 0;
3346                         params->p.aifs = 7;
3347                         params->p.cw_min = 0x0001;
3348                         params->p.cw_max = 0x03FF;
3349                         break;
3350                 default:
3351                         B43_WARN_ON(1);
3352                 }
3353         }
3354 }
3355
3356 /* Initialize the core's QOS capabilities */
3357 static void b43_qos_init(struct b43_wldev *dev)
3358 {
3359         if (!dev->qos_enabled) {
3360                 /* Disable QOS support. */
3361                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3362                 b43_write16(dev, B43_MMIO_IFSCTL,
3363                             b43_read16(dev, B43_MMIO_IFSCTL)
3364                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3365                 b43dbg(dev->wl, "QoS disabled\n");
3366                 return;
3367         }
3368
3369         /* Upload the current QOS parameters. */
3370         b43_qos_upload_all(dev);
3371
3372         /* Enable QOS support. */
3373         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3374         b43_write16(dev, B43_MMIO_IFSCTL,
3375                     b43_read16(dev, B43_MMIO_IFSCTL)
3376                     | B43_MMIO_IFSCTL_USE_EDCF);
3377         b43dbg(dev->wl, "QoS enabled\n");
3378 }
3379
3380 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3381                           const struct ieee80211_tx_queue_params *params)
3382 {
3383         struct b43_wl *wl = hw_to_b43_wl(hw);
3384         struct b43_wldev *dev;
3385         unsigned int queue = (unsigned int)_queue;
3386         int err = -ENODEV;
3387
3388         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3389                 /* Queue not available or don't support setting
3390                  * params on this queue. Return success to not
3391                  * confuse mac80211. */
3392                 return 0;
3393         }
3394         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3395                      ARRAY_SIZE(wl->qos_params));
3396
3397         mutex_lock(&wl->mutex);
3398         dev = wl->current_dev;
3399         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3400                 goto out_unlock;
3401
3402         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3403         b43_mac_suspend(dev);
3404         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3405                               b43_qos_shm_offsets[queue]);
3406         b43_mac_enable(dev);
3407         err = 0;
3408
3409 out_unlock:
3410         mutex_unlock(&wl->mutex);
3411
3412         return err;
3413 }
3414
3415 static int b43_op_get_stats(struct ieee80211_hw *hw,
3416                             struct ieee80211_low_level_stats *stats)
3417 {
3418         struct b43_wl *wl = hw_to_b43_wl(hw);
3419
3420         mutex_lock(&wl->mutex);
3421         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3422         mutex_unlock(&wl->mutex);
3423
3424         return 0;
3425 }
3426
3427 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3428 {
3429         struct b43_wl *wl = hw_to_b43_wl(hw);
3430         struct b43_wldev *dev;
3431         u64 tsf;
3432
3433         mutex_lock(&wl->mutex);
3434         dev = wl->current_dev;
3435
3436         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3437                 b43_tsf_read(dev, &tsf);
3438         else
3439                 tsf = 0;
3440
3441         mutex_unlock(&wl->mutex);
3442
3443         return tsf;
3444 }
3445
3446 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3447 {
3448         struct b43_wl *wl = hw_to_b43_wl(hw);
3449         struct b43_wldev *dev;
3450
3451         mutex_lock(&wl->mutex);
3452         dev = wl->current_dev;
3453
3454         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3455                 b43_tsf_write(dev, tsf);
3456
3457         mutex_unlock(&wl->mutex);
3458 }
3459
3460 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3461 {
3462         struct ssb_device *sdev = dev->sdev;
3463         u32 tmslow;
3464
3465         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3466         tmslow &= ~B43_TMSLOW_GMODE;
3467         tmslow |= B43_TMSLOW_PHYRESET;
3468         tmslow |= SSB_TMSLOW_FGC;
3469         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3470         msleep(1);
3471
3472         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3473         tmslow &= ~SSB_TMSLOW_FGC;
3474         tmslow |= B43_TMSLOW_PHYRESET;
3475         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3476         msleep(1);
3477 }
3478
3479 static const char *band_to_string(enum ieee80211_band band)
3480 {
3481         switch (band) {
3482         case IEEE80211_BAND_5GHZ:
3483                 return "5";
3484         case IEEE80211_BAND_2GHZ:
3485                 return "2.4";
3486         default:
3487                 break;
3488         }
3489         B43_WARN_ON(1);
3490         return "";
3491 }
3492
3493 /* Expects wl->mutex locked */
3494 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3495 {
3496         struct b43_wldev *up_dev = NULL;
3497         struct b43_wldev *down_dev;
3498         struct b43_wldev *d;
3499         int err;
3500         bool uninitialized_var(gmode);
3501         int prev_status;
3502
3503         /* Find a device and PHY which supports the band. */
3504         list_for_each_entry(d, &wl->devlist, list) {
3505                 switch (chan->band) {
3506                 case IEEE80211_BAND_5GHZ:
3507                         if (d->phy.supports_5ghz) {
3508                                 up_dev = d;
3509                                 gmode = 0;
3510                         }
3511                         break;
3512                 case IEEE80211_BAND_2GHZ:
3513                         if (d->phy.supports_2ghz) {
3514                                 up_dev = d;
3515                                 gmode = 1;
3516                         }
3517                         break;
3518                 default:
3519                         B43_WARN_ON(1);
3520                         return -EINVAL;
3521                 }
3522                 if (up_dev)
3523                         break;
3524         }
3525         if (!up_dev) {
3526                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3527                        band_to_string(chan->band));
3528                 return -ENODEV;
3529         }
3530         if ((up_dev == wl->current_dev) &&
3531             (!!wl->current_dev->phy.gmode == !!gmode)) {
3532                 /* This device is already running. */
3533                 return 0;
3534         }
3535         b43dbg(wl, "Switching to %s-GHz band\n",
3536                band_to_string(chan->band));
3537         down_dev = wl->current_dev;
3538
3539         prev_status = b43_status(down_dev);
3540         /* Shutdown the currently running core. */
3541         if (prev_status >= B43_STAT_STARTED)
3542                 down_dev = b43_wireless_core_stop(down_dev);
3543         if (prev_status >= B43_STAT_INITIALIZED)
3544                 b43_wireless_core_exit(down_dev);
3545
3546         if (down_dev != up_dev) {
3547                 /* We switch to a different core, so we put PHY into
3548                  * RESET on the old core. */
3549                 b43_put_phy_into_reset(down_dev);
3550         }
3551
3552         /* Now start the new core. */
3553         up_dev->phy.gmode = gmode;
3554         if (prev_status >= B43_STAT_INITIALIZED) {
3555                 err = b43_wireless_core_init(up_dev);
3556                 if (err) {
3557                         b43err(wl, "Fatal: Could not initialize device for "
3558                                "selected %s-GHz band\n",
3559                                band_to_string(chan->band));
3560                         goto init_failure;
3561                 }
3562         }
3563         if (prev_status >= B43_STAT_STARTED) {
3564                 err = b43_wireless_core_start(up_dev);
3565                 if (err) {
3566                         b43err(wl, "Fatal: Coult not start device for "
3567                                "selected %s-GHz band\n",
3568                                band_to_string(chan->band));
3569                         b43_wireless_core_exit(up_dev);
3570                         goto init_failure;
3571                 }
3572         }
3573         B43_WARN_ON(b43_status(up_dev) != prev_status);
3574
3575         wl->current_dev = up_dev;
3576
3577         return 0;
3578 init_failure:
3579         /* Whoops, failed to init the new core. No core is operating now. */
3580         wl->current_dev = NULL;
3581         return err;
3582 }
3583
3584 /* Write the short and long frame retry limit values. */
3585 static void b43_set_retry_limits(struct b43_wldev *dev,
3586                                  unsigned int short_retry,
3587                                  unsigned int long_retry)
3588 {
3589         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3590          * the chip-internal counter. */
3591         short_retry = min(short_retry, (unsigned int)0xF);
3592         long_retry = min(long_retry, (unsigned int)0xF);
3593
3594         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3595                         short_retry);
3596         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3597                         long_retry);
3598 }
3599
3600 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3601 {
3602         struct b43_wl *wl = hw_to_b43_wl(hw);
3603         struct b43_wldev *dev;
3604         struct b43_phy *phy;
3605         struct ieee80211_conf *conf = &hw->conf;
3606         int antenna;
3607         int err = 0;
3608
3609         mutex_lock(&wl->mutex);
3610
3611         /* Switch the band (if necessary). This might change the active core. */
3612         err = b43_switch_band(wl, conf->channel);
3613         if (err)
3614                 goto out_unlock_mutex;
3615         dev = wl->current_dev;
3616         phy = &dev->phy;
3617
3618         if (conf_is_ht(conf))
3619                 phy->is_40mhz =
3620                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3621         else
3622                 phy->is_40mhz = false;
3623
3624         b43_mac_suspend(dev);
3625
3626         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3627                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3628                                           conf->long_frame_max_tx_count);
3629         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3630         if (!changed)
3631                 goto out_mac_enable;
3632
3633         /* Switch to the requested channel.
3634          * The firmware takes care of races with the TX handler. */
3635         if (conf->channel->hw_value != phy->channel)
3636                 b43_switch_channel(dev, conf->channel->hw_value);
3637
3638         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3639
3640         /* Adjust the desired TX power level. */
3641         if (conf->power_level != 0) {
3642                 if (conf->power_level != phy->desired_txpower) {
3643                         phy->desired_txpower = conf->power_level;
3644                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3645                                                    B43_TXPWR_IGNORE_TSSI);
3646                 }
3647         }
3648
3649         /* Antennas for RX and management frame TX. */
3650         antenna = B43_ANTENNA_DEFAULT;
3651         b43_mgmtframe_txantenna(dev, antenna);
3652         antenna = B43_ANTENNA_DEFAULT;
3653         if (phy->ops->set_rx_antenna)
3654                 phy->ops->set_rx_antenna(dev, antenna);
3655
3656         if (wl->radio_enabled != phy->radio_on) {
3657                 if (wl->radio_enabled) {
3658                         b43_software_rfkill(dev, false);
3659                         b43info(dev->wl, "Radio turned on by software\n");
3660                         if (!dev->radio_hw_enable) {
3661                                 b43info(dev->wl, "The hardware RF-kill button "
3662                                         "still turns the radio physically off. "
3663                                         "Press the button to turn it on.\n");
3664                         }
3665                 } else {
3666                         b43_software_rfkill(dev, true);
3667                         b43info(dev->wl, "Radio turned off by software\n");
3668                 }
3669         }
3670
3671 out_mac_enable:
3672         b43_mac_enable(dev);
3673 out_unlock_mutex:
3674         mutex_unlock(&wl->mutex);
3675
3676         return err;
3677 }
3678
3679 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3680 {
3681         struct ieee80211_supported_band *sband =
3682                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3683         struct ieee80211_rate *rate;
3684         int i;
3685         u16 basic, direct, offset, basic_offset, rateptr;
3686
3687         for (i = 0; i < sband->n_bitrates; i++) {
3688                 rate = &sband->bitrates[i];
3689
3690                 if (b43_is_cck_rate(rate->hw_value)) {
3691                         direct = B43_SHM_SH_CCKDIRECT;
3692                         basic = B43_SHM_SH_CCKBASIC;
3693                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3694                         offset &= 0xF;
3695                 } else {
3696                         direct = B43_SHM_SH_OFDMDIRECT;
3697                         basic = B43_SHM_SH_OFDMBASIC;
3698                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3699                         offset &= 0xF;
3700                 }
3701
3702                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3703
3704                 if (b43_is_cck_rate(rate->hw_value)) {
3705                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3706                         basic_offset &= 0xF;
3707                 } else {
3708                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3709                         basic_offset &= 0xF;
3710                 }
3711
3712                 /*
3713                  * Get the pointer that we need to point to
3714                  * from the direct map
3715                  */
3716                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3717                                          direct + 2 * basic_offset);
3718                 /* and write it to the basic map */
3719                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3720                                 rateptr);
3721         }
3722 }
3723
3724 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3725                                     struct ieee80211_vif *vif,
3726                                     struct ieee80211_bss_conf *conf,
3727                                     u32 changed)
3728 {
3729         struct b43_wl *wl = hw_to_b43_wl(hw);
3730         struct b43_wldev *dev;
3731
3732         mutex_lock(&wl->mutex);
3733
3734         dev = wl->current_dev;
3735         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3736                 goto out_unlock_mutex;
3737
3738         B43_WARN_ON(wl->vif != vif);
3739
3740         if (changed & BSS_CHANGED_BSSID) {
3741                 if (conf->bssid)
3742                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3743                 else
3744                         memset(wl->bssid, 0, ETH_ALEN);
3745         }
3746
3747         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3748                 if (changed & BSS_CHANGED_BEACON &&
3749                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3750                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3751                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3752                         b43_update_templates(wl);
3753
3754                 if (changed & BSS_CHANGED_BSSID)
3755                         b43_write_mac_bssid_templates(dev);
3756         }
3757
3758         b43_mac_suspend(dev);
3759
3760         /* Update templates for AP/mesh mode. */
3761         if (changed & BSS_CHANGED_BEACON_INT &&
3762             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3763              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3764              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3765                 b43_set_beacon_int(dev, conf->beacon_int);
3766
3767         if (changed & BSS_CHANGED_BASIC_RATES)
3768                 b43_update_basic_rates(dev, conf->basic_rates);
3769
3770         if (changed & BSS_CHANGED_ERP_SLOT) {
3771                 if (conf->use_short_slot)
3772                         b43_short_slot_timing_enable(dev);
3773                 else
3774                         b43_short_slot_timing_disable(dev);
3775         }
3776
3777         b43_mac_enable(dev);
3778 out_unlock_mutex:
3779         mutex_unlock(&wl->mutex);
3780 }
3781
3782 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3783                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3784                           struct ieee80211_key_conf *key)
3785 {
3786         struct b43_wl *wl = hw_to_b43_wl(hw);
3787         struct b43_wldev *dev;
3788         u8 algorithm;
3789         u8 index;
3790         int err;
3791         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3792
3793         if (modparam_nohwcrypt)
3794                 return -ENOSPC; /* User disabled HW-crypto */
3795
3796         mutex_lock(&wl->mutex);
3797
3798         dev = wl->current_dev;
3799         err = -ENODEV;
3800         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3801                 goto out_unlock;
3802
3803         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3804                 /* We don't have firmware for the crypto engine.
3805                  * Must use software-crypto. */
3806                 err = -EOPNOTSUPP;
3807                 goto out_unlock;
3808         }
3809
3810         err = -EINVAL;
3811         switch (key->cipher) {
3812         case WLAN_CIPHER_SUITE_WEP40:
3813                 algorithm = B43_SEC_ALGO_WEP40;
3814                 break;
3815         case WLAN_CIPHER_SUITE_WEP104:
3816                 algorithm = B43_SEC_ALGO_WEP104;
3817                 break;
3818         case WLAN_CIPHER_SUITE_TKIP:
3819                 algorithm = B43_SEC_ALGO_TKIP;
3820                 break;
3821         case WLAN_CIPHER_SUITE_CCMP:
3822                 algorithm = B43_SEC_ALGO_AES;
3823                 break;
3824         default:
3825                 B43_WARN_ON(1);
3826                 goto out_unlock;
3827         }
3828         index = (u8) (key->keyidx);
3829         if (index > 3)
3830                 goto out_unlock;
3831
3832         switch (cmd) {
3833         case SET_KEY:
3834                 if (algorithm == B43_SEC_ALGO_TKIP &&
3835                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3836                     !modparam_hwtkip)) {
3837                         /* We support only pairwise key */
3838                         err = -EOPNOTSUPP;
3839                         goto out_unlock;
3840                 }
3841
3842                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3843                         if (WARN_ON(!sta)) {
3844                                 err = -EOPNOTSUPP;
3845                                 goto out_unlock;
3846                         }
3847                         /* Pairwise key with an assigned MAC address. */
3848                         err = b43_key_write(dev, -1, algorithm,
3849                                             key->key, key->keylen,
3850                                             sta->addr, key);
3851                 } else {
3852                         /* Group key */
3853                         err = b43_key_write(dev, index, algorithm,
3854                                             key->key, key->keylen, NULL, key);
3855                 }
3856                 if (err)
3857                         goto out_unlock;
3858
3859                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3860                     algorithm == B43_SEC_ALGO_WEP104) {
3861                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3862                 } else {
3863                         b43_hf_write(dev,
3864                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3865                 }
3866                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3867                 if (algorithm == B43_SEC_ALGO_TKIP)
3868                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3869                 break;
3870         case DISABLE_KEY: {
3871                 err = b43_key_clear(dev, key->hw_key_idx);
3872                 if (err)
3873                         goto out_unlock;
3874                 break;
3875         }
3876         default:
3877                 B43_WARN_ON(1);
3878         }
3879
3880 out_unlock:
3881         if (!err) {
3882                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3883                        "mac: %pM\n",
3884                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3885                        sta ? sta->addr : bcast_addr);
3886                 b43_dump_keymemory(dev);
3887         }
3888         mutex_unlock(&wl->mutex);
3889
3890         return err;
3891 }
3892
3893 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3894                                     unsigned int changed, unsigned int *fflags,
3895                                     u64 multicast)
3896 {
3897         struct b43_wl *wl = hw_to_b43_wl(hw);
3898         struct b43_wldev *dev;
3899
3900         mutex_lock(&wl->mutex);
3901         dev = wl->current_dev;
3902         if (!dev) {
3903                 *fflags = 0;
3904                 goto out_unlock;
3905         }
3906
3907         *fflags &= FIF_PROMISC_IN_BSS |
3908                   FIF_ALLMULTI |
3909                   FIF_FCSFAIL |
3910                   FIF_PLCPFAIL |
3911                   FIF_CONTROL |
3912                   FIF_OTHER_BSS |
3913                   FIF_BCN_PRBRESP_PROMISC;
3914
3915         changed &= FIF_PROMISC_IN_BSS |
3916                    FIF_ALLMULTI |
3917                    FIF_FCSFAIL |
3918                    FIF_PLCPFAIL |
3919                    FIF_CONTROL |
3920                    FIF_OTHER_BSS |
3921                    FIF_BCN_PRBRESP_PROMISC;
3922
3923         wl->filter_flags = *fflags;
3924
3925         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3926                 b43_adjust_opmode(dev);
3927
3928 out_unlock:
3929         mutex_unlock(&wl->mutex);
3930 }
3931
3932 /* Locking: wl->mutex
3933  * Returns the current dev. This might be different from the passed in dev,
3934  * because the core might be gone away while we unlocked the mutex. */
3935 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3936 {
3937         struct b43_wl *wl = dev->wl;
3938         struct b43_wldev *orig_dev;
3939         u32 mask;
3940
3941 redo:
3942         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3943                 return dev;
3944
3945         /* Cancel work. Unlock to avoid deadlocks. */
3946         mutex_unlock(&wl->mutex);
3947         cancel_delayed_work_sync(&dev->periodic_work);
3948         cancel_work_sync(&wl->tx_work);
3949         mutex_lock(&wl->mutex);
3950         dev = wl->current_dev;
3951         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
3952                 /* Whoops, aliens ate up the device while we were unlocked. */
3953                 return dev;
3954         }
3955
3956         /* Disable interrupts on the device. */
3957         b43_set_status(dev, B43_STAT_INITIALIZED);
3958         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
3959                 /* wl->mutex is locked. That is enough. */
3960                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3961                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3962         } else {
3963                 spin_lock_irq(&wl->hardirq_lock);
3964                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3965                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3966                 spin_unlock_irq(&wl->hardirq_lock);
3967         }
3968         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
3969         orig_dev = dev;
3970         mutex_unlock(&wl->mutex);
3971         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
3972                 b43_sdio_free_irq(dev);
3973         } else {
3974                 synchronize_irq(dev->dev->irq);
3975                 free_irq(dev->dev->irq, dev);
3976         }
3977         mutex_lock(&wl->mutex);
3978         dev = wl->current_dev;
3979         if (!dev)
3980                 return dev;
3981         if (dev != orig_dev) {
3982                 if (b43_status(dev) >= B43_STAT_STARTED)
3983                         goto redo;
3984                 return dev;
3985         }
3986         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
3987         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
3988
3989         /* Drain the TX queue */
3990         while (skb_queue_len(&wl->tx_queue))
3991                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
3992
3993         b43_mac_suspend(dev);
3994         b43_leds_exit(dev);
3995         b43dbg(wl, "Wireless interface stopped\n");
3996
3997         return dev;
3998 }
3999
4000 /* Locking: wl->mutex */
4001 static int b43_wireless_core_start(struct b43_wldev *dev)
4002 {
4003         int err;
4004
4005         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4006
4007         drain_txstatus_queue(dev);
4008         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
4009                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4010                 if (err) {
4011                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4012                         goto out;
4013                 }
4014         } else {
4015                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4016                                            b43_interrupt_thread_handler,
4017                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4018                 if (err) {
4019                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4020                                dev->dev->irq);
4021                         goto out;
4022                 }
4023         }
4024
4025         /* We are ready to run. */
4026         ieee80211_wake_queues(dev->wl->hw);
4027         b43_set_status(dev, B43_STAT_STARTED);
4028
4029         /* Start data flow (TX/RX). */
4030         b43_mac_enable(dev);
4031         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4032
4033         /* Start maintenance work */
4034         b43_periodic_tasks_setup(dev);
4035
4036         b43_leds_init(dev);
4037
4038         b43dbg(dev->wl, "Wireless interface started\n");
4039 out:
4040         return err;
4041 }
4042
4043 /* Get PHY and RADIO versioning numbers */
4044 static int b43_phy_versioning(struct b43_wldev *dev)
4045 {
4046         struct b43_phy *phy = &dev->phy;
4047         u32 tmp;
4048         u8 analog_type;
4049         u8 phy_type;
4050         u8 phy_rev;
4051         u16 radio_manuf;
4052         u16 radio_ver;
4053         u16 radio_rev;
4054         int unsupported = 0;
4055
4056         /* Get PHY versioning */
4057         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4058         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4059         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4060         phy_rev = (tmp & B43_PHYVER_VERSION);
4061         switch (phy_type) {
4062         case B43_PHYTYPE_A:
4063                 if (phy_rev >= 4)
4064                         unsupported = 1;
4065                 break;
4066         case B43_PHYTYPE_B:
4067                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4068                     && phy_rev != 7)
4069                         unsupported = 1;
4070                 break;
4071         case B43_PHYTYPE_G:
4072                 if (phy_rev > 9)
4073                         unsupported = 1;
4074                 break;
4075 #ifdef CONFIG_B43_PHY_N
4076         case B43_PHYTYPE_N:
4077                 if (phy_rev > 9)
4078                         unsupported = 1;
4079                 break;
4080 #endif
4081 #ifdef CONFIG_B43_PHY_LP
4082         case B43_PHYTYPE_LP:
4083                 if (phy_rev > 2)
4084                         unsupported = 1;
4085                 break;
4086 #endif
4087         default:
4088                 unsupported = 1;
4089         };
4090         if (unsupported) {
4091                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4092                        "(Analog %u, Type %u, Revision %u)\n",
4093                        analog_type, phy_type, phy_rev);
4094                 return -EOPNOTSUPP;
4095         }
4096         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4097                analog_type, phy_type, phy_rev);
4098
4099         /* Get RADIO versioning */
4100         if (dev->dev->chip_id == 0x4317) {
4101                 if (dev->dev->chip_rev == 0)
4102                         tmp = 0x3205017F;
4103                 else if (dev->dev->chip_rev == 1)
4104                         tmp = 0x4205017F;
4105                 else
4106                         tmp = 0x5205017F;
4107         } else {
4108                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4109                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4110                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4111                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4112         }
4113         radio_manuf = (tmp & 0x00000FFF);
4114         radio_ver = (tmp & 0x0FFFF000) >> 12;
4115         radio_rev = (tmp & 0xF0000000) >> 28;
4116         if (radio_manuf != 0x17F /* Broadcom */)
4117                 unsupported = 1;
4118         switch (phy_type) {
4119         case B43_PHYTYPE_A:
4120                 if (radio_ver != 0x2060)
4121                         unsupported = 1;
4122                 if (radio_rev != 1)
4123                         unsupported = 1;
4124                 if (radio_manuf != 0x17F)
4125                         unsupported = 1;
4126                 break;
4127         case B43_PHYTYPE_B:
4128                 if ((radio_ver & 0xFFF0) != 0x2050)
4129                         unsupported = 1;
4130                 break;
4131         case B43_PHYTYPE_G:
4132                 if (radio_ver != 0x2050)
4133                         unsupported = 1;
4134                 break;
4135         case B43_PHYTYPE_N:
4136                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4137                         unsupported = 1;
4138                 break;
4139         case B43_PHYTYPE_LP:
4140                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4141                         unsupported = 1;
4142                 break;
4143         default:
4144                 B43_WARN_ON(1);
4145         }
4146         if (unsupported) {
4147                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4148                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4149                        radio_manuf, radio_ver, radio_rev);
4150                 return -EOPNOTSUPP;
4151         }
4152         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4153                radio_manuf, radio_ver, radio_rev);
4154
4155         phy->radio_manuf = radio_manuf;
4156         phy->radio_ver = radio_ver;
4157         phy->radio_rev = radio_rev;
4158
4159         phy->analog = analog_type;
4160         phy->type = phy_type;
4161         phy->rev = phy_rev;
4162
4163         return 0;
4164 }
4165
4166 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4167                                       struct b43_phy *phy)
4168 {
4169         phy->hardware_power_control = !!modparam_hwpctl;
4170         phy->next_txpwr_check_time = jiffies;
4171         /* PHY TX errors counter. */
4172         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4173
4174 #if B43_DEBUG
4175         phy->phy_locked = 0;
4176         phy->radio_locked = 0;
4177 #endif
4178 }
4179
4180 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4181 {
4182         dev->dfq_valid = 0;
4183
4184         /* Assume the radio is enabled. If it's not enabled, the state will
4185          * immediately get fixed on the first periodic work run. */
4186         dev->radio_hw_enable = 1;
4187
4188         /* Stats */
4189         memset(&dev->stats, 0, sizeof(dev->stats));
4190
4191         setup_struct_phy_for_init(dev, &dev->phy);
4192
4193         /* IRQ related flags */
4194         dev->irq_reason = 0;
4195         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4196         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4197         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4198                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4199
4200         dev->mac_suspended = 1;
4201
4202         /* Noise calculation context */
4203         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4204 }
4205
4206 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4207 {
4208         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4209         u64 hf;
4210
4211         if (!modparam_btcoex)
4212                 return;
4213         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4214                 return;
4215         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4216                 return;
4217
4218         hf = b43_hf_read(dev);
4219         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4220                 hf |= B43_HF_BTCOEXALT;
4221         else
4222                 hf |= B43_HF_BTCOEX;
4223         b43_hf_write(dev, hf);
4224 }
4225
4226 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4227 {
4228         if (!modparam_btcoex)
4229                 return;
4230         //TODO
4231 }
4232
4233 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4234 {
4235         struct ssb_bus *bus;
4236         u32 tmp;
4237
4238         if (dev->dev->bus_type != B43_BUS_SSB)
4239                 return;
4240
4241         bus = dev->dev->sdev->bus;
4242
4243         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4244             (bus->chip_id == 0x4312)) {
4245                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4246                 tmp &= ~SSB_IMCFGLO_REQTO;
4247                 tmp &= ~SSB_IMCFGLO_SERTO;
4248                 tmp |= 0x3;
4249                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4250                 ssb_commit_settings(bus);
4251         }
4252 }
4253
4254 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4255 {
4256         u16 pu_delay;
4257
4258         /* The time value is in microseconds. */
4259         if (dev->phy.type == B43_PHYTYPE_A)
4260                 pu_delay = 3700;
4261         else
4262                 pu_delay = 1050;
4263         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4264                 pu_delay = 500;
4265         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4266                 pu_delay = max(pu_delay, (u16)2400);
4267
4268         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4269 }
4270
4271 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4272 static void b43_set_pretbtt(struct b43_wldev *dev)
4273 {
4274         u16 pretbtt;
4275
4276         /* The time value is in microseconds. */
4277         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4278                 pretbtt = 2;
4279         } else {
4280                 if (dev->phy.type == B43_PHYTYPE_A)
4281                         pretbtt = 120;
4282                 else
4283                         pretbtt = 250;
4284         }
4285         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4286         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4287 }
4288
4289 /* Shutdown a wireless core */
4290 /* Locking: wl->mutex */
4291 static void b43_wireless_core_exit(struct b43_wldev *dev)
4292 {
4293         u32 macctl;
4294
4295         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4296         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4297                 return;
4298
4299         /* Unregister HW RNG driver */
4300         b43_rng_exit(dev->wl);
4301
4302         b43_set_status(dev, B43_STAT_UNINIT);
4303
4304         /* Stop the microcode PSM. */
4305         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4306         macctl &= ~B43_MACCTL_PSM_RUN;
4307         macctl |= B43_MACCTL_PSM_JMP0;
4308         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4309
4310         b43_dma_free(dev);
4311         b43_pio_free(dev);
4312         b43_chip_exit(dev);
4313         dev->phy.ops->switch_analog(dev, 0);
4314         if (dev->wl->current_beacon) {
4315                 dev_kfree_skb_any(dev->wl->current_beacon);
4316                 dev->wl->current_beacon = NULL;
4317         }
4318
4319         b43_device_disable(dev, 0);
4320         b43_bus_may_powerdown(dev);
4321 }
4322
4323 /* Initialize a wireless core */
4324 static int b43_wireless_core_init(struct b43_wldev *dev)
4325 {
4326         struct ssb_bus *bus = dev->sdev->bus;
4327         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4328         struct b43_phy *phy = &dev->phy;
4329         int err;
4330         u64 hf;
4331         u32 tmp;
4332
4333         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4334
4335         err = b43_bus_powerup(dev, 0);
4336         if (err)
4337                 goto out;
4338         if (!b43_device_is_enabled(dev)) {
4339                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4340                 b43_wireless_core_reset(dev, tmp);
4341         }
4342
4343         /* Reset all data structures. */
4344         setup_struct_wldev_for_init(dev);
4345         phy->ops->prepare_structs(dev);
4346
4347         /* Enable IRQ routing to this device. */
4348         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->sdev);
4349
4350         b43_imcfglo_timeouts_workaround(dev);
4351         b43_bluetooth_coext_disable(dev);
4352         if (phy->ops->prepare_hardware) {
4353                 err = phy->ops->prepare_hardware(dev);
4354                 if (err)
4355                         goto err_busdown;
4356         }
4357         err = b43_chip_init(dev);
4358         if (err)
4359                 goto err_busdown;
4360         b43_shm_write16(dev, B43_SHM_SHARED,
4361                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4362         hf = b43_hf_read(dev);
4363         if (phy->type == B43_PHYTYPE_G) {
4364                 hf |= B43_HF_SYMW;
4365                 if (phy->rev == 1)
4366                         hf |= B43_HF_GDCW;
4367                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4368                         hf |= B43_HF_OFDMPABOOST;
4369         }
4370         if (phy->radio_ver == 0x2050) {
4371                 if (phy->radio_rev == 6)
4372                         hf |= B43_HF_4318TSSI;
4373                 if (phy->radio_rev < 6)
4374                         hf |= B43_HF_VCORECALC;
4375         }
4376         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4377                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4378 #ifdef CONFIG_SSB_DRIVER_PCICORE
4379         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4380             (bus->pcicore.dev->id.revision <= 10))
4381                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4382 #endif
4383         hf &= ~B43_HF_SKCFPUP;
4384         b43_hf_write(dev, hf);
4385
4386         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4387                              B43_DEFAULT_LONG_RETRY_LIMIT);
4388         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4389         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4390
4391         /* Disable sending probe responses from firmware.
4392          * Setting the MaxTime to one usec will always trigger
4393          * a timeout, so we never send any probe resp.
4394          * A timeout of zero is infinite. */
4395         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4396
4397         b43_rate_memory_init(dev);
4398         b43_set_phytxctl_defaults(dev);
4399
4400         /* Minimum Contention Window */
4401         if (phy->type == B43_PHYTYPE_B)
4402                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4403         else
4404                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4405         /* Maximum Contention Window */
4406         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4407
4408         if ((dev->sdev->bus->bustype == SSB_BUSTYPE_PCMCIA) ||
4409             (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) ||
4410             dev->use_pio) {
4411                 dev->__using_pio_transfers = 1;
4412                 err = b43_pio_init(dev);
4413         } else {
4414                 dev->__using_pio_transfers = 0;
4415                 err = b43_dma_init(dev);
4416         }
4417         if (err)
4418                 goto err_chip_exit;
4419         b43_qos_init(dev);
4420         b43_set_synth_pu_delay(dev, 1);
4421         b43_bluetooth_coext_enable(dev);
4422
4423         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4424         b43_upload_card_macaddress(dev);
4425         b43_security_init(dev);
4426
4427         ieee80211_wake_queues(dev->wl->hw);
4428
4429         b43_set_status(dev, B43_STAT_INITIALIZED);
4430
4431         /* Register HW RNG driver */
4432         b43_rng_init(dev->wl);
4433
4434 out:
4435         return err;
4436
4437 err_chip_exit:
4438         b43_chip_exit(dev);
4439 err_busdown:
4440         b43_bus_may_powerdown(dev);
4441         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4442         return err;
4443 }
4444
4445 static int b43_op_add_interface(struct ieee80211_hw *hw,
4446                                 struct ieee80211_vif *vif)
4447 {
4448         struct b43_wl *wl = hw_to_b43_wl(hw);
4449         struct b43_wldev *dev;
4450         int err = -EOPNOTSUPP;
4451
4452         /* TODO: allow WDS/AP devices to coexist */
4453
4454         if (vif->type != NL80211_IFTYPE_AP &&
4455             vif->type != NL80211_IFTYPE_MESH_POINT &&
4456             vif->type != NL80211_IFTYPE_STATION &&
4457             vif->type != NL80211_IFTYPE_WDS &&
4458             vif->type != NL80211_IFTYPE_ADHOC)
4459                 return -EOPNOTSUPP;
4460
4461         mutex_lock(&wl->mutex);
4462         if (wl->operating)
4463                 goto out_mutex_unlock;
4464
4465         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4466
4467         dev = wl->current_dev;
4468         wl->operating = 1;
4469         wl->vif = vif;
4470         wl->if_type = vif->type;
4471         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4472
4473         b43_adjust_opmode(dev);
4474         b43_set_pretbtt(dev);
4475         b43_set_synth_pu_delay(dev, 0);
4476         b43_upload_card_macaddress(dev);
4477
4478         err = 0;
4479  out_mutex_unlock:
4480         mutex_unlock(&wl->mutex);
4481
4482         return err;
4483 }
4484
4485 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4486                                     struct ieee80211_vif *vif)
4487 {
4488         struct b43_wl *wl = hw_to_b43_wl(hw);
4489         struct b43_wldev *dev = wl->current_dev;
4490
4491         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4492
4493         mutex_lock(&wl->mutex);
4494
4495         B43_WARN_ON(!wl->operating);
4496         B43_WARN_ON(wl->vif != vif);
4497         wl->vif = NULL;
4498
4499         wl->operating = 0;
4500
4501         b43_adjust_opmode(dev);
4502         memset(wl->mac_addr, 0, ETH_ALEN);
4503         b43_upload_card_macaddress(dev);
4504
4505         mutex_unlock(&wl->mutex);
4506 }
4507
4508 static int b43_op_start(struct ieee80211_hw *hw)
4509 {
4510         struct b43_wl *wl = hw_to_b43_wl(hw);
4511         struct b43_wldev *dev = wl->current_dev;
4512         int did_init = 0;
4513         int err = 0;
4514
4515         /* Kill all old instance specific information to make sure
4516          * the card won't use it in the short timeframe between start
4517          * and mac80211 reconfiguring it. */
4518         memset(wl->bssid, 0, ETH_ALEN);
4519         memset(wl->mac_addr, 0, ETH_ALEN);
4520         wl->filter_flags = 0;
4521         wl->radiotap_enabled = 0;
4522         b43_qos_clear(wl);
4523         wl->beacon0_uploaded = 0;
4524         wl->beacon1_uploaded = 0;
4525         wl->beacon_templates_virgin = 1;
4526         wl->radio_enabled = 1;
4527
4528         mutex_lock(&wl->mutex);
4529
4530         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4531                 err = b43_wireless_core_init(dev);
4532                 if (err)
4533                         goto out_mutex_unlock;
4534                 did_init = 1;
4535         }
4536
4537         if (b43_status(dev) < B43_STAT_STARTED) {
4538                 err = b43_wireless_core_start(dev);
4539                 if (err) {
4540                         if (did_init)
4541                                 b43_wireless_core_exit(dev);
4542                         goto out_mutex_unlock;
4543                 }
4544         }
4545
4546         /* XXX: only do if device doesn't support rfkill irq */
4547         wiphy_rfkill_start_polling(hw->wiphy);
4548
4549  out_mutex_unlock:
4550         mutex_unlock(&wl->mutex);
4551
4552         return err;
4553 }
4554
4555 static void b43_op_stop(struct ieee80211_hw *hw)
4556 {
4557         struct b43_wl *wl = hw_to_b43_wl(hw);
4558         struct b43_wldev *dev = wl->current_dev;
4559
4560         cancel_work_sync(&(wl->beacon_update_trigger));
4561
4562         mutex_lock(&wl->mutex);
4563         if (b43_status(dev) >= B43_STAT_STARTED) {
4564                 dev = b43_wireless_core_stop(dev);
4565                 if (!dev)
4566                         goto out_unlock;
4567         }
4568         b43_wireless_core_exit(dev);
4569         wl->radio_enabled = 0;
4570
4571 out_unlock:
4572         mutex_unlock(&wl->mutex);
4573
4574         cancel_work_sync(&(wl->txpower_adjust_work));
4575 }
4576
4577 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4578                                  struct ieee80211_sta *sta, bool set)
4579 {
4580         struct b43_wl *wl = hw_to_b43_wl(hw);
4581
4582         /* FIXME: add locking */
4583         b43_update_templates(wl);
4584
4585         return 0;
4586 }
4587
4588 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4589                               struct ieee80211_vif *vif,
4590                               enum sta_notify_cmd notify_cmd,
4591                               struct ieee80211_sta *sta)
4592 {
4593         struct b43_wl *wl = hw_to_b43_wl(hw);
4594
4595         B43_WARN_ON(!vif || wl->vif != vif);
4596 }
4597
4598 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4599 {
4600         struct b43_wl *wl = hw_to_b43_wl(hw);
4601         struct b43_wldev *dev;
4602
4603         mutex_lock(&wl->mutex);
4604         dev = wl->current_dev;
4605         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4606                 /* Disable CFP update during scan on other channels. */
4607                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4608         }
4609         mutex_unlock(&wl->mutex);
4610 }
4611
4612 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4613 {
4614         struct b43_wl *wl = hw_to_b43_wl(hw);
4615         struct b43_wldev *dev;
4616
4617         mutex_lock(&wl->mutex);
4618         dev = wl->current_dev;
4619         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4620                 /* Re-enable CFP update. */
4621                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4622         }
4623         mutex_unlock(&wl->mutex);
4624 }
4625
4626 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4627                              struct survey_info *survey)
4628 {
4629         struct b43_wl *wl = hw_to_b43_wl(hw);
4630         struct b43_wldev *dev = wl->current_dev;
4631         struct ieee80211_conf *conf = &hw->conf;
4632
4633         if (idx != 0)
4634                 return -ENOENT;
4635
4636         survey->channel = conf->channel;
4637         survey->filled = SURVEY_INFO_NOISE_DBM;
4638         survey->noise = dev->stats.link_noise;
4639
4640         return 0;
4641 }
4642
4643 static const struct ieee80211_ops b43_hw_ops = {
4644         .tx                     = b43_op_tx,
4645         .conf_tx                = b43_op_conf_tx,
4646         .add_interface          = b43_op_add_interface,
4647         .remove_interface       = b43_op_remove_interface,
4648         .config                 = b43_op_config,
4649         .bss_info_changed       = b43_op_bss_info_changed,
4650         .configure_filter       = b43_op_configure_filter,
4651         .set_key                = b43_op_set_key,
4652         .update_tkip_key        = b43_op_update_tkip_key,
4653         .get_stats              = b43_op_get_stats,
4654         .get_tsf                = b43_op_get_tsf,
4655         .set_tsf                = b43_op_set_tsf,
4656         .start                  = b43_op_start,
4657         .stop                   = b43_op_stop,
4658         .set_tim                = b43_op_beacon_set_tim,
4659         .sta_notify             = b43_op_sta_notify,
4660         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4661         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4662         .get_survey             = b43_op_get_survey,
4663         .rfkill_poll            = b43_rfkill_poll,
4664 };
4665
4666 /* Hard-reset the chip. Do not call this directly.
4667  * Use b43_controller_restart()
4668  */
4669 static void b43_chip_reset(struct work_struct *work)
4670 {
4671         struct b43_wldev *dev =
4672             container_of(work, struct b43_wldev, restart_work);
4673         struct b43_wl *wl = dev->wl;
4674         int err = 0;
4675         int prev_status;
4676
4677         mutex_lock(&wl->mutex);
4678
4679         prev_status = b43_status(dev);
4680         /* Bring the device down... */
4681         if (prev_status >= B43_STAT_STARTED) {
4682                 dev = b43_wireless_core_stop(dev);
4683                 if (!dev) {
4684                         err = -ENODEV;
4685                         goto out;
4686                 }
4687         }
4688         if (prev_status >= B43_STAT_INITIALIZED)
4689                 b43_wireless_core_exit(dev);
4690
4691         /* ...and up again. */
4692         if (prev_status >= B43_STAT_INITIALIZED) {
4693                 err = b43_wireless_core_init(dev);
4694                 if (err)
4695                         goto out;
4696         }
4697         if (prev_status >= B43_STAT_STARTED) {
4698                 err = b43_wireless_core_start(dev);
4699                 if (err) {
4700                         b43_wireless_core_exit(dev);
4701                         goto out;
4702                 }
4703         }
4704 out:
4705         if (err)
4706                 wl->current_dev = NULL; /* Failed to init the dev. */
4707         mutex_unlock(&wl->mutex);
4708         if (err)
4709                 b43err(wl, "Controller restart FAILED\n");
4710         else
4711                 b43info(wl, "Controller restarted\n");
4712 }
4713
4714 static int b43_setup_bands(struct b43_wldev *dev,
4715                            bool have_2ghz_phy, bool have_5ghz_phy)
4716 {
4717         struct ieee80211_hw *hw = dev->wl->hw;
4718
4719         if (have_2ghz_phy)
4720                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4721         if (dev->phy.type == B43_PHYTYPE_N) {
4722                 if (have_5ghz_phy)
4723                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4724         } else {
4725                 if (have_5ghz_phy)
4726                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4727         }
4728
4729         dev->phy.supports_2ghz = have_2ghz_phy;
4730         dev->phy.supports_5ghz = have_5ghz_phy;
4731
4732         return 0;
4733 }
4734
4735 static void b43_wireless_core_detach(struct b43_wldev *dev)
4736 {
4737         /* We release firmware that late to not be required to re-request
4738          * is all the time when we reinit the core. */
4739         b43_release_firmware(dev);
4740         b43_phy_free(dev);
4741 }
4742
4743 static int b43_wireless_core_attach(struct b43_wldev *dev)
4744 {
4745         struct b43_wl *wl = dev->wl;
4746         struct ssb_bus *bus = dev->sdev->bus;
4747         struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
4748         int err;
4749         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4750         u32 tmp;
4751
4752         /* Do NOT do any device initialization here.
4753          * Do it in wireless_core_init() instead.
4754          * This function is for gathering basic information about the HW, only.
4755          * Also some structs may be set up here. But most likely you want to have
4756          * that in core_init(), too.
4757          */
4758
4759         err = b43_bus_powerup(dev, 0);
4760         if (err) {
4761                 b43err(wl, "Bus powerup failed\n");
4762                 goto out;
4763         }
4764         /* Get the PHY type. */
4765         if (dev->dev->core_rev >= 5) {
4766                 u32 tmshigh;
4767
4768                 tmshigh = ssb_read32(dev->sdev, SSB_TMSHIGH);
4769                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4770                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4771         } else
4772                 B43_WARN_ON(1);
4773
4774         dev->phy.gmode = have_2ghz_phy;
4775         dev->phy.radio_on = 1;
4776         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4777         b43_wireless_core_reset(dev, tmp);
4778
4779         err = b43_phy_versioning(dev);
4780         if (err)
4781                 goto err_powerdown;
4782         /* Check if this device supports multiband. */
4783         if (!pdev ||
4784             (pdev->device != 0x4312 &&
4785              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4786                 /* No multiband support. */
4787                 have_2ghz_phy = 0;
4788                 have_5ghz_phy = 0;
4789                 switch (dev->phy.type) {
4790                 case B43_PHYTYPE_A:
4791                         have_5ghz_phy = 1;
4792                         break;
4793                 case B43_PHYTYPE_LP: //FIXME not always!
4794 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4795                         have_5ghz_phy = 1;
4796 #endif
4797                 case B43_PHYTYPE_G:
4798                 case B43_PHYTYPE_N:
4799                         have_2ghz_phy = 1;
4800                         break;
4801                 default:
4802                         B43_WARN_ON(1);
4803                 }
4804         }
4805         if (dev->phy.type == B43_PHYTYPE_A) {
4806                 /* FIXME */
4807                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4808                 err = -EOPNOTSUPP;
4809                 goto err_powerdown;
4810         }
4811         if (1 /* disable A-PHY */) {
4812                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4813                 if (dev->phy.type != B43_PHYTYPE_N &&
4814                     dev->phy.type != B43_PHYTYPE_LP) {
4815                         have_2ghz_phy = 1;
4816                         have_5ghz_phy = 0;
4817                 }
4818         }
4819
4820         err = b43_phy_allocate(dev);
4821         if (err)
4822                 goto err_powerdown;
4823
4824         dev->phy.gmode = have_2ghz_phy;
4825         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4826         b43_wireless_core_reset(dev, tmp);
4827
4828         err = b43_validate_chipaccess(dev);
4829         if (err)
4830                 goto err_phy_free;
4831         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4832         if (err)
4833                 goto err_phy_free;
4834
4835         /* Now set some default "current_dev" */
4836         if (!wl->current_dev)
4837                 wl->current_dev = dev;
4838         INIT_WORK(&dev->restart_work, b43_chip_reset);
4839
4840         dev->phy.ops->switch_analog(dev, 0);
4841         b43_device_disable(dev, 0);
4842         b43_bus_may_powerdown(dev);
4843
4844 out:
4845         return err;
4846
4847 err_phy_free:
4848         b43_phy_free(dev);
4849 err_powerdown:
4850         b43_bus_may_powerdown(dev);
4851         return err;
4852 }
4853
4854 static void b43_one_core_detach(struct b43_bus_dev *dev)
4855 {
4856         struct b43_wldev *wldev;
4857         struct b43_wl *wl;
4858
4859         /* Do not cancel ieee80211-workqueue based work here.
4860          * See comment in b43_remove(). */
4861
4862         wldev = ssb_get_drvdata(dev->sdev);
4863         wl = wldev->wl;
4864         b43_debugfs_remove_device(wldev);
4865         b43_wireless_core_detach(wldev);
4866         list_del(&wldev->list);
4867         wl->nr_devs--;
4868         ssb_set_drvdata(dev->sdev, NULL);
4869         kfree(wldev);
4870 }
4871
4872 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
4873 {
4874         struct b43_wldev *wldev;
4875         int err = -ENOMEM;
4876
4877         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4878         if (!wldev)
4879                 goto out;
4880
4881         wldev->use_pio = b43_modparam_pio;
4882         wldev->dev = dev;
4883         wldev->sdev = dev->sdev; /* TODO: Remove when not needed */
4884         wldev->wl = wl;
4885         b43_set_status(wldev, B43_STAT_UNINIT);
4886         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4887         INIT_LIST_HEAD(&wldev->list);
4888
4889         err = b43_wireless_core_attach(wldev);
4890         if (err)
4891                 goto err_kfree_wldev;
4892
4893         list_add(&wldev->list, &wl->devlist);
4894         wl->nr_devs++;
4895         ssb_set_drvdata(dev->sdev, wldev);
4896         b43_debugfs_add_device(wldev);
4897
4898       out:
4899         return err;
4900
4901       err_kfree_wldev:
4902         kfree(wldev);
4903         return err;
4904 }
4905
4906 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4907         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4908         (pdev->device == _device) &&                                    \
4909         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4910         (pdev->subsystem_device == _subdevice)                          )
4911
4912 static void b43_sprom_fixup(struct ssb_bus *bus)
4913 {
4914         struct pci_dev *pdev;
4915
4916         /* boardflags workarounds */
4917         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4918             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4919                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4920         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4921             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4922                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4923         if (bus->bustype == SSB_BUSTYPE_PCI) {
4924                 pdev = bus->host_pci;
4925                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4926                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4927                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4928                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4929                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4930                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4931                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4932                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4933         }
4934 }
4935
4936 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
4937 {
4938         struct ieee80211_hw *hw = wl->hw;
4939
4940         ssb_set_devtypedata(dev->sdev, NULL);
4941         ieee80211_free_hw(hw);
4942 }
4943
4944 static struct b43_wl *b43_wireless_init(struct ssb_device *dev)
4945 {
4946         struct ssb_sprom *sprom = &dev->bus->sprom;
4947         struct ieee80211_hw *hw;
4948         struct b43_wl *wl;
4949
4950         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4951         if (!hw) {
4952                 b43err(NULL, "Could not allocate ieee80211 device\n");
4953                 return ERR_PTR(-ENOMEM);
4954         }
4955         wl = hw_to_b43_wl(hw);
4956
4957         /* fill hw info */
4958         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4959                     IEEE80211_HW_SIGNAL_DBM;
4960
4961         hw->wiphy->interface_modes =
4962                 BIT(NL80211_IFTYPE_AP) |
4963                 BIT(NL80211_IFTYPE_MESH_POINT) |
4964                 BIT(NL80211_IFTYPE_STATION) |
4965                 BIT(NL80211_IFTYPE_WDS) |
4966                 BIT(NL80211_IFTYPE_ADHOC);
4967
4968         hw->queues = modparam_qos ? 4 : 1;
4969         wl->mac80211_initially_registered_queues = hw->queues;
4970         hw->max_rates = 2;
4971         SET_IEEE80211_DEV(hw, dev->dev);
4972         if (is_valid_ether_addr(sprom->et1mac))
4973                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4974         else
4975                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4976
4977         /* Initialize struct b43_wl */
4978         wl->hw = hw;
4979         mutex_init(&wl->mutex);
4980         spin_lock_init(&wl->hardirq_lock);
4981         INIT_LIST_HEAD(&wl->devlist);
4982         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4983         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4984         INIT_WORK(&wl->tx_work, b43_tx_work);
4985         skb_queue_head_init(&wl->tx_queue);
4986
4987         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4988                 dev->bus->chip_id, dev->id.revision);
4989         return wl;
4990 }
4991
4992 static
4993 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
4994 {
4995         struct b43_bus_dev *dev;
4996         struct b43_wl *wl;
4997         int err;
4998         int first = 0;
4999
5000         dev = b43_bus_dev_ssb_init(sdev);
5001
5002         wl = ssb_get_devtypedata(sdev);
5003         if (!wl) {
5004                 /* Probing the first core. Must setup common struct b43_wl */
5005                 first = 1;
5006                 b43_sprom_fixup(sdev->bus);
5007                 wl = b43_wireless_init(sdev);
5008                 if (IS_ERR(wl)) {
5009                         err = PTR_ERR(wl);
5010                         goto out;
5011                 }
5012                 ssb_set_devtypedata(sdev, wl);
5013                 B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5014         }
5015         err = b43_one_core_attach(dev, wl);
5016         if (err)
5017                 goto err_wireless_exit;
5018
5019         if (first) {
5020                 err = ieee80211_register_hw(wl->hw);
5021                 if (err)
5022                         goto err_one_core_detach;
5023                 b43_leds_register(wl->current_dev);
5024         }
5025
5026       out:
5027         return err;
5028
5029       err_one_core_detach:
5030         b43_one_core_detach(dev);
5031       err_wireless_exit:
5032         if (first)
5033                 b43_wireless_exit(dev, wl);
5034         return err;
5035 }
5036
5037 static void b43_ssb_remove(struct ssb_device *sdev)
5038 {
5039         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5040         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5041
5042         /* We must cancel any work here before unregistering from ieee80211,
5043          * as the ieee80211 unreg will destroy the workqueue. */
5044         cancel_work_sync(&wldev->restart_work);
5045
5046         B43_WARN_ON(!wl);
5047         if (wl->current_dev == wldev) {
5048                 /* Restore the queues count before unregistering, because firmware detect
5049                  * might have modified it. Restoring is important, so the networking
5050                  * stack can properly free resources. */
5051                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5052                 b43_leds_stop(wldev);
5053                 ieee80211_unregister_hw(wl->hw);
5054         }
5055
5056         b43_one_core_detach(wldev->dev);
5057
5058         if (list_empty(&wl->devlist)) {
5059                 b43_leds_unregister(wl);
5060                 /* Last core on the chip unregistered.
5061                  * We can destroy common struct b43_wl.
5062                  */
5063                 b43_wireless_exit(wldev->dev, wl);
5064         }
5065 }
5066
5067 /* Perform a hardware reset. This can be called from any context. */
5068 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5069 {
5070         /* Must avoid requeueing, if we are in shutdown. */
5071         if (b43_status(dev) < B43_STAT_INITIALIZED)
5072                 return;
5073         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5074         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5075 }
5076
5077 static struct ssb_driver b43_ssb_driver = {
5078         .name           = KBUILD_MODNAME,
5079         .id_table       = b43_ssb_tbl,
5080         .probe          = b43_ssb_probe,
5081         .remove         = b43_ssb_remove,
5082 };
5083
5084 static void b43_print_driverinfo(void)
5085 {
5086         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5087                    *feat_leds = "", *feat_sdio = "";
5088
5089 #ifdef CONFIG_B43_PCI_AUTOSELECT
5090         feat_pci = "P";
5091 #endif
5092 #ifdef CONFIG_B43_PCMCIA
5093         feat_pcmcia = "M";
5094 #endif
5095 #ifdef CONFIG_B43_PHY_N
5096         feat_nphy = "N";
5097 #endif
5098 #ifdef CONFIG_B43_LEDS
5099         feat_leds = "L";
5100 #endif
5101 #ifdef CONFIG_B43_SDIO
5102         feat_sdio = "S";
5103 #endif
5104         printk(KERN_INFO "Broadcom 43xx driver loaded "
5105                "[ Features: %s%s%s%s%s, Firmware-ID: "
5106                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5107                feat_pci, feat_pcmcia, feat_nphy,
5108                feat_leds, feat_sdio);
5109 }
5110
5111 static int __init b43_init(void)
5112 {
5113         int err;
5114
5115         b43_debugfs_init();
5116         err = b43_pcmcia_init();
5117         if (err)
5118                 goto err_dfs_exit;
5119         err = b43_sdio_init();
5120         if (err)
5121                 goto err_pcmcia_exit;
5122         err = ssb_driver_register(&b43_ssb_driver);
5123         if (err)
5124                 goto err_sdio_exit;
5125         b43_print_driverinfo();
5126
5127         return err;
5128
5129 err_sdio_exit:
5130         b43_sdio_exit();
5131 err_pcmcia_exit:
5132         b43_pcmcia_exit();
5133 err_dfs_exit:
5134         b43_debugfs_exit();
5135         return err;
5136 }
5137
5138 static void __exit b43_exit(void)
5139 {
5140         ssb_driver_unregister(&b43_ssb_driver);
5141         b43_sdio_exit();
5142         b43_pcmcia_exit();
5143         b43_debugfs_exit();
5144 }
5145
5146 module_init(b43_init)
5147 module_exit(b43_exit)