drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode5.fw");
  76 MODULE_FIRMWARE("b43/ucode9.fw");
  77
  78 static int modparam_bad_frames_preempt;
  79 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  80 MODULE_PARM_DESC(bad_frames_preempt,
  81                  "enable(1) / disable(0) Bad Frames Preemption");
  82
  83 static char modparam_fwpostfix[16];
  84 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  85 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  86
  87 static int modparam_hwpctl;
  88 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  89 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  90
  91 static int modparam_nohwcrypt;
  92 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  93 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  94
  95 static int modparam_hwtkip;
  96 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  97 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  98
  99 static int modparam_qos = 1;
 100 module_param_named(qos, modparam_qos, int, 0444);
 101 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 102
 103 static int modparam_btcoex = 1;
 104 module_param_named(btcoex, modparam_btcoex, int, 0444);
 105 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 106
 107 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 108 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 109 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 110
 111 int b43_modparam_pio = B43_PIO_DEFAULT;
 112 module_param_named(pio, b43_modparam_pio, int, 0644);
 113 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 114
 115 static const struct ssb_device_id b43_ssb_tbl[] = {
 116         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 117         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 118         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 119         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 120         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 121         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 122         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 123         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 124         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 125         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 126         SSB_DEVTABLE_END
 127 };
 128
 129 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 130
 131 /* Channel and ratetables are shared for all devices.
 132  * They can't be const, because ieee80211 puts some precalculated
 133  * data in there. This data is the same for all devices, so we don't
 134  * get concurrency issues */
 135 #define RATETAB_ENT(_rateid, _flags) \
 136         {                                                               \
 137                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 138                 .hw_value       = (_rateid),                            \
 139                 .flags          = (_flags),                             \
 140         }
 141
 142 /*
 143  * NOTE: When changing this, sync with xmit.c's
 144  *       b43_plcp_get_bitrate_idx_* functions!
 145  */
 146 static struct ieee80211_rate __b43_ratetable[] = {
 147         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 148         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 151         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 152         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 153         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 154         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 155         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 156         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 157         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 158         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 159 };
 160
 161 #define b43_a_ratetable         (__b43_ratetable + 4)
 162 #define b43_a_ratetable_size    8
 163 #define b43_b_ratetable         (__b43_ratetable + 0)
 164 #define b43_b_ratetable_size    4
 165 #define b43_g_ratetable         (__b43_ratetable + 0)
 166 #define b43_g_ratetable_size    12
 167
 168 #define CHAN4G(_channel, _freq, _flags) {                       \
 169         .band                   = IEEE80211_BAND_2GHZ,          \
 170         .center_freq            = (_freq),                      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_2ghz_chantable[] = {
 177         CHAN4G(1, 2412, 0),
 178         CHAN4G(2, 2417, 0),
 179         CHAN4G(3, 2422, 0),
 180         CHAN4G(4, 2427, 0),
 181         CHAN4G(5, 2432, 0),
 182         CHAN4G(6, 2437, 0),
 183         CHAN4G(7, 2442, 0),
 184         CHAN4G(8, 2447, 0),
 185         CHAN4G(9, 2452, 0),
 186         CHAN4G(10, 2457, 0),
 187         CHAN4G(11, 2462, 0),
 188         CHAN4G(12, 2467, 0),
 189         CHAN4G(13, 2472, 0),
 190         CHAN4G(14, 2484, 0),
 191 };
 192 #undef CHAN4G
 193
 194 #define CHAN5G(_channel, _flags) {                              \
 195         .band                   = IEEE80211_BAND_5GHZ,          \
 196         .center_freq            = 5000 + (5 * (_channel)),      \
 197         .hw_value               = (_channel),                   \
 198         .flags                  = (_flags),                     \
 199         .max_antenna_gain       = 0,                            \
 200         .max_power              = 30,                           \
 201 }
 202 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 203         CHAN5G(32, 0),          CHAN5G(34, 0),
 204         CHAN5G(36, 0),          CHAN5G(38, 0),
 205         CHAN5G(40, 0),          CHAN5G(42, 0),
 206         CHAN5G(44, 0),          CHAN5G(46, 0),
 207         CHAN5G(48, 0),          CHAN5G(50, 0),
 208         CHAN5G(52, 0),          CHAN5G(54, 0),
 209         CHAN5G(56, 0),          CHAN5G(58, 0),
 210         CHAN5G(60, 0),          CHAN5G(62, 0),
 211         CHAN5G(64, 0),          CHAN5G(66, 0),
 212         CHAN5G(68, 0),          CHAN5G(70, 0),
 213         CHAN5G(72, 0),          CHAN5G(74, 0),
 214         CHAN5G(76, 0),          CHAN5G(78, 0),
 215         CHAN5G(80, 0),          CHAN5G(82, 0),
 216         CHAN5G(84, 0),          CHAN5G(86, 0),
 217         CHAN5G(88, 0),          CHAN5G(90, 0),
 218         CHAN5G(92, 0),          CHAN5G(94, 0),
 219         CHAN5G(96, 0),          CHAN5G(98, 0),
 220         CHAN5G(100, 0),         CHAN5G(102, 0),
 221         CHAN5G(104, 0),         CHAN5G(106, 0),
 222         CHAN5G(108, 0),         CHAN5G(110, 0),
 223         CHAN5G(112, 0),         CHAN5G(114, 0),
 224         CHAN5G(116, 0),         CHAN5G(118, 0),
 225         CHAN5G(120, 0),         CHAN5G(122, 0),
 226         CHAN5G(124, 0),         CHAN5G(126, 0),
 227         CHAN5G(128, 0),         CHAN5G(130, 0),
 228         CHAN5G(132, 0),         CHAN5G(134, 0),
 229         CHAN5G(136, 0),         CHAN5G(138, 0),
 230         CHAN5G(140, 0),         CHAN5G(142, 0),
 231         CHAN5G(144, 0),         CHAN5G(145, 0),
 232         CHAN5G(146, 0),         CHAN5G(147, 0),
 233         CHAN5G(148, 0),         CHAN5G(149, 0),
 234         CHAN5G(150, 0),         CHAN5G(151, 0),
 235         CHAN5G(152, 0),         CHAN5G(153, 0),
 236         CHAN5G(154, 0),         CHAN5G(155, 0),
 237         CHAN5G(156, 0),         CHAN5G(157, 0),
 238         CHAN5G(158, 0),         CHAN5G(159, 0),
 239         CHAN5G(160, 0),         CHAN5G(161, 0),
 240         CHAN5G(162, 0),         CHAN5G(163, 0),
 241         CHAN5G(164, 0),         CHAN5G(165, 0),
 242         CHAN5G(166, 0),         CHAN5G(168, 0),
 243         CHAN5G(170, 0),         CHAN5G(172, 0),
 244         CHAN5G(174, 0),         CHAN5G(176, 0),
 245         CHAN5G(178, 0),         CHAN5G(180, 0),
 246         CHAN5G(182, 0),         CHAN5G(184, 0),
 247         CHAN5G(186, 0),         CHAN5G(188, 0),
 248         CHAN5G(190, 0),         CHAN5G(192, 0),
 249         CHAN5G(194, 0),         CHAN5G(196, 0),
 250         CHAN5G(198, 0),         CHAN5G(200, 0),
 251         CHAN5G(202, 0),         CHAN5G(204, 0),
 252         CHAN5G(206, 0),         CHAN5G(208, 0),
 253         CHAN5G(210, 0),         CHAN5G(212, 0),
 254         CHAN5G(214, 0),         CHAN5G(216, 0),
 255         CHAN5G(218, 0),         CHAN5G(220, 0),
 256         CHAN5G(222, 0),         CHAN5G(224, 0),
 257         CHAN5G(226, 0),         CHAN5G(228, 0),
 258 };
 259
 260 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 261         CHAN5G(34, 0),          CHAN5G(36, 0),
 262         CHAN5G(38, 0),          CHAN5G(40, 0),
 263         CHAN5G(42, 0),          CHAN5G(44, 0),
 264         CHAN5G(46, 0),          CHAN5G(48, 0),
 265         CHAN5G(52, 0),          CHAN5G(56, 0),
 266         CHAN5G(60, 0),          CHAN5G(64, 0),
 267         CHAN5G(100, 0),         CHAN5G(104, 0),
 268         CHAN5G(108, 0),         CHAN5G(112, 0),
 269         CHAN5G(116, 0),         CHAN5G(120, 0),
 270         CHAN5G(124, 0),         CHAN5G(128, 0),
 271         CHAN5G(132, 0),         CHAN5G(136, 0),
 272         CHAN5G(140, 0),         CHAN5G(149, 0),
 273         CHAN5G(153, 0),         CHAN5G(157, 0),
 274         CHAN5G(161, 0),         CHAN5G(165, 0),
 275         CHAN5G(184, 0),         CHAN5G(188, 0),
 276         CHAN5G(192, 0),         CHAN5G(196, 0),
 277         CHAN5G(200, 0),         CHAN5G(204, 0),
 278         CHAN5G(208, 0),         CHAN5G(212, 0),
 279         CHAN5G(216, 0),
 280 };
 281 #undef CHAN5G
 282
 283 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 284         .band           = IEEE80211_BAND_5GHZ,
 285         .channels       = b43_5ghz_nphy_chantable,
 286         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 287         .bitrates       = b43_a_ratetable,
 288         .n_bitrates     = b43_a_ratetable_size,
 289 };
 290
 291 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 292         .band           = IEEE80211_BAND_5GHZ,
 293         .channels       = b43_5ghz_aphy_chantable,
 294         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 295         .bitrates       = b43_a_ratetable,
 296         .n_bitrates     = b43_a_ratetable_size,
 297 };
 298
 299 static struct ieee80211_supported_band b43_band_2GHz = {
 300         .band           = IEEE80211_BAND_2GHZ,
 301         .channels       = b43_2ghz_chantable,
 302         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 303         .bitrates       = b43_g_ratetable,
 304         .n_bitrates     = b43_g_ratetable_size,
 305 };
 306
 307 static void b43_wireless_core_exit(struct b43_wldev *dev);
 308 static int b43_wireless_core_init(struct b43_wldev *dev);
 309 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 310 static int b43_wireless_core_start(struct b43_wldev *dev);
 311
 312 static int b43_ratelimit(struct b43_wl *wl)
 313 {
 314         if (!wl || !wl->current_dev)
 315                 return 1;
 316         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 317                 return 1;
 318         /* We are up and running.
 319          * Ratelimit the messages to avoid DoS over the net. */
 320         return net_ratelimit();
 321 }
 322
 323 void b43info(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         va_list args;
 326
 327         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 328                 return;
 329         if (!b43_ratelimit(wl))
 330                 return;
 331         va_start(args, fmt);
 332         printk(KERN_INFO "b43-%s: ",
 333                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 334         vprintk(fmt, args);
 335         va_end(args);
 336 }
 337
 338 void b43err(struct b43_wl *wl, const char *fmt, ...)
 339 {
 340         va_list args;
 341
 342         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 343                 return;
 344         if (!b43_ratelimit(wl))
 345                 return;
 346         va_start(args, fmt);
 347         printk(KERN_ERR "b43-%s ERROR: ",
 348                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 349         vprintk(fmt, args);
 350         va_end(args);
 351 }
 352
 353 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 354 {
 355         va_list args;
 356
 357         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 358                 return;
 359         if (!b43_ratelimit(wl))
 360                 return;
 361         va_start(args, fmt);
 362         printk(KERN_WARNING "b43-%s warning: ",
 363                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 364         vprintk(fmt, args);
 365         va_end(args);
 366 }
 367
 368 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 369 {
 370         va_list args;
 371
 372         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 373                 return;
 374         va_start(args, fmt);
 375         printk(KERN_DEBUG "b43-%s debug: ",
 376                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 377         vprintk(fmt, args);
 378         va_end(args);
 379 }
 380
 381 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 382 {
 383         u32 macctl;
 384
 385         B43_WARN_ON(offset % 4 != 0);
 386
 387         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 388         if (macctl & B43_MACCTL_BE)
 389                 val = swab32(val);
 390
 391         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 392         mmiowb();
 393         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 394 }
 395
 396 static inline void b43_shm_control_word(struct b43_wldev *dev,
 397                                         u16 routing, u16 offset)
 398 {
 399         u32 control;
 400
 401         /* "offset" is the WORD offset. */
 402         control = routing;
 403         control <<= 16;
 404         control |= offset;
 405         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 406 }
 407
 408 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 409 {
 410         u32 ret;
 411
 412         if (routing == B43_SHM_SHARED) {
 413                 B43_WARN_ON(offset & 0x0001);
 414                 if (offset & 0x0003) {
 415                         /* Unaligned access */
 416                         b43_shm_control_word(dev, routing, offset >> 2);
 417                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 418                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 419                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 420
 421                         goto out;
 422                 }
 423                 offset >>= 2;
 424         }
 425         b43_shm_control_word(dev, routing, offset);
 426         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 427 out:
 428         return ret;
 429 }
 430
 431 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 432 {
 433         u16 ret;
 434
 435         if (routing == B43_SHM_SHARED) {
 436                 B43_WARN_ON(offset & 0x0001);
 437                 if (offset & 0x0003) {
 438                         /* Unaligned access */
 439                         b43_shm_control_word(dev, routing, offset >> 2);
 440                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 441
 442                         goto out;
 443                 }
 444                 offset >>= 2;
 445         }
 446         b43_shm_control_word(dev, routing, offset);
 447         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 448 out:
 449         return ret;
 450 }
 451
 452 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 453 {
 454         if (routing == B43_SHM_SHARED) {
 455                 B43_WARN_ON(offset & 0x0001);
 456                 if (offset & 0x0003) {
 457                         /* Unaligned access */
 458                         b43_shm_control_word(dev, routing, offset >> 2);
 459                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 460                                     value & 0xFFFF);
 461                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 462                         b43_write16(dev, B43_MMIO_SHM_DATA,
 463                                     (value >> 16) & 0xFFFF);
 464                         return;
 465                 }
 466                 offset >>= 2;
 467         }
 468         b43_shm_control_word(dev, routing, offset);
 469         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 470 }
 471
 472 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 473 {
 474         if (routing == B43_SHM_SHARED) {
 475                 B43_WARN_ON(offset & 0x0001);
 476                 if (offset & 0x0003) {
 477                         /* Unaligned access */
 478                         b43_shm_control_word(dev, routing, offset >> 2);
 479                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 480                         return;
 481                 }
 482                 offset >>= 2;
 483         }
 484         b43_shm_control_word(dev, routing, offset);
 485         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 486 }
 487
 488 /* Read HostFlags */
 489 u64 b43_hf_read(struct b43_wldev *dev)
 490 {
 491         u64 ret;
 492
 493         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 494         ret <<= 16;
 495         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 496         ret <<= 16;
 497         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 498
 499         return ret;
 500 }
 501
 502 /* Write HostFlags */
 503 void b43_hf_write(struct b43_wldev *dev, u64 value)
 504 {
 505         u16 lo, mi, hi;
 506
 507         lo = (value & 0x00000000FFFFULL);
 508         mi = (value & 0x0000FFFF0000ULL) >> 16;
 509         hi = (value & 0xFFFF00000000ULL) >> 32;
 510         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 511         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 512         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 513 }
 514
 515 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 516 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 517 {
 518         B43_WARN_ON(!dev->fw.opensource);
 519         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 520 }
 521
 522 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 523 {
 524         u32 low, high;
 525
 526         B43_WARN_ON(dev->dev->id.revision < 3);
 527
 528         /* The hardware guarantees us an atomic read, if we
 529          * read the low register first. */
 530         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 531         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 532
 533         *tsf = high;
 534         *tsf <<= 32;
 535         *tsf |= low;
 536 }
 537
 538 static void b43_time_lock(struct b43_wldev *dev)
 539 {
 540         u32 macctl;
 541
 542         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 543         macctl |= B43_MACCTL_TBTTHOLD;
 544         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 545         /* Commit the write */
 546         b43_read32(dev, B43_MMIO_MACCTL);
 547 }
 548
 549 static void b43_time_unlock(struct b43_wldev *dev)
 550 {
 551         u32 macctl;
 552
 553         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 554         macctl &= ~B43_MACCTL_TBTTHOLD;
 555         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 556         /* Commit the write */
 557         b43_read32(dev, B43_MMIO_MACCTL);
 558 }
 559
 560 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 561 {
 562         u32 low, high;
 563
 564         B43_WARN_ON(dev->dev->id.revision < 3);
 565
 566         low = tsf;
 567         high = (tsf >> 32);
 568         /* The hardware guarantees us an atomic write, if we
 569          * write the low register first. */
 570         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 571         mmiowb();
 572         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 573         mmiowb();
 574 }
 575
 576 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 577 {
 578         b43_time_lock(dev);
 579         b43_tsf_write_locked(dev, tsf);
 580         b43_time_unlock(dev);
 581 }
 582
 583 static
 584 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 585 {
 586         static const u8 zero_addr[ETH_ALEN] = { 0 };
 587         u16 data;
 588
 589         if (!mac)
 590                 mac = zero_addr;
 591
 592         offset |= 0x0020;
 593         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 594
 595         data = mac[0];
 596         data |= mac[1] << 8;
 597         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 598         data = mac[2];
 599         data |= mac[3] << 8;
 600         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 601         data = mac[4];
 602         data |= mac[5] << 8;
 603         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 604 }
 605
 606 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 607 {
 608         const u8 *mac;
 609         const u8 *bssid;
 610         u8 mac_bssid[ETH_ALEN * 2];
 611         int i;
 612         u32 tmp;
 613
 614         bssid = dev->wl->bssid;
 615         mac = dev->wl->mac_addr;
 616
 617         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 618
 619         memcpy(mac_bssid, mac, ETH_ALEN);
 620         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 621
 622         /* Write our MAC address and BSSID to template ram */
 623         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 624                 tmp = (u32) (mac_bssid[i + 0]);
 625                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 626                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 627                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 628                 b43_ram_write(dev, 0x20 + i, tmp);
 629         }
 630 }
 631
 632 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 633 {
 634         b43_write_mac_bssid_templates(dev);
 635         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 636 }
 637
 638 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 639 {
 640         /* slot_time is in usec. */
 641         /* This test used to exit for all but a G PHY. */
 642         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 643                 return;
 644         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 645         /* Shared memory location 0x0010 is the slot time and should be
 646          * set to slot_time; however, this register is initially 0 and changing
 647          * the value adversely affects the transmit rate for BCM4311
 648          * devices. Until this behavior is unterstood, delete this step
 649          *
 650          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 651          */
 652 }
 653
 654 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 655 {
 656         b43_set_slot_time(dev, 9);
 657 }
 658
 659 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 660 {
 661         b43_set_slot_time(dev, 20);
 662 }
 663
 664 /* DummyTransmission function, as documented on
 665  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 666  */
 667 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 668 {
 669         struct b43_phy *phy = &dev->phy;
 670         unsigned int i, max_loop;
 671         u16 value;
 672         u32 buffer[5] = {
 673                 0x00000000,
 674                 0x00D40000,
 675                 0x00000000,
 676                 0x01000000,
 677                 0x00000000,
 678         };
 679
 680         if (ofdm) {
 681                 max_loop = 0x1E;
 682                 buffer[0] = 0x000201CC;
 683         } else {
 684                 max_loop = 0xFA;
 685                 buffer[0] = 0x000B846E;
 686         }
 687
 688         for (i = 0; i < 5; i++)
 689                 b43_ram_write(dev, i * 4, buffer[i]);
 690
 691         b43_write16(dev, 0x0568, 0x0000);
 692         if (dev->dev->id.revision < 11)
 693                 b43_write16(dev, 0x07C0, 0x0000);
 694         else
 695                 b43_write16(dev, 0x07C0, 0x0100);
 696         value = (ofdm ? 0x41 : 0x40);
 697         b43_write16(dev, 0x050C, value);
 698         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 699                 b43_write16(dev, 0x0514, 0x1A02);
 700         b43_write16(dev, 0x0508, 0x0000);
 701         b43_write16(dev, 0x050A, 0x0000);
 702         b43_write16(dev, 0x054C, 0x0000);
 703         b43_write16(dev, 0x056A, 0x0014);
 704         b43_write16(dev, 0x0568, 0x0826);
 705         b43_write16(dev, 0x0500, 0x0000);
 706         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 707                 //SPEC TODO
 708         }
 709
 710         switch (phy->type) {
 711         case B43_PHYTYPE_N:
 712                 b43_write16(dev, 0x0502, 0x00D0);
 713                 break;
 714         case B43_PHYTYPE_LP:
 715                 b43_write16(dev, 0x0502, 0x0050);
 716                 break;
 717         default:
 718                 b43_write16(dev, 0x0502, 0x0030);
 719         }
 720
 721         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 722                 b43_radio_write16(dev, 0x0051, 0x0017);
 723         for (i = 0x00; i < max_loop; i++) {
 724                 value = b43_read16(dev, 0x050E);
 725                 if (value & 0x0080)
 726                         break;
 727                 udelay(10);
 728         }
 729         for (i = 0x00; i < 0x0A; i++) {
 730                 value = b43_read16(dev, 0x050E);
 731                 if (value & 0x0400)
 732                         break;
 733                 udelay(10);
 734         }
 735         for (i = 0x00; i < 0x19; i++) {
 736                 value = b43_read16(dev, 0x0690);
 737                 if (!(value & 0x0100))
 738                         break;
 739                 udelay(10);
 740         }
 741         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 742                 b43_radio_write16(dev, 0x0051, 0x0037);
 743 }
 744
 745 static void key_write(struct b43_wldev *dev,
 746                       u8 index, u8 algorithm, const u8 *key)
 747 {
 748         unsigned int i;
 749         u32 offset;
 750         u16 value;
 751         u16 kidx;
 752
 753         /* Key index/algo block */
 754         kidx = b43_kidx_to_fw(dev, index);
 755         value = ((kidx << 4) | algorithm);
 756         b43_shm_write16(dev, B43_SHM_SHARED,
 757                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 758
 759         /* Write the key to the Key Table Pointer offset */
 760         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 761         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 762                 value = key[i];
 763                 value |= (u16) (key[i + 1]) << 8;
 764                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 765         }
 766 }
 767
 768 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 769 {
 770         u32 addrtmp[2] = { 0, 0, };
 771         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 772
 773         if (b43_new_kidx_api(dev))
 774                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 775
 776         B43_WARN_ON(index < pairwise_keys_start);
 777         /* We have four default TX keys and possibly four default RX keys.
 778          * Physical mac 0 is mapped to physical key 4 or 8, depending
 779          * on the firmware version.
 780          * So we must adjust the index here.
 781          */
 782         index -= pairwise_keys_start;
 783         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 784
 785         if (addr) {
 786                 addrtmp[0] = addr[0];
 787                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 788                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 789                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 790                 addrtmp[1] = addr[4];
 791                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 792         }
 793
 794         /* Receive match transmitter address (RCMTA) mechanism */
 795         b43_shm_write32(dev, B43_SHM_RCMTA,
 796                         (index * 2) + 0, addrtmp[0]);
 797         b43_shm_write16(dev, B43_SHM_RCMTA,
 798                         (index * 2) + 1, addrtmp[1]);
 799 }
 800
 801 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 802  * When a packet is received, the iv32 is checked.
 803  * - if it doesn't the packet is returned without modification (and software
 804  *   decryption can be done). That's what happen when iv16 wrap.
 805  * - if it does, the rc4 key is computed, and decryption is tried.
 806  *   Either it will success and B43_RX_MAC_DEC is returned,
 807  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 808  *   and the packet is not usable (it got modified by the ucode).
 809  * So in order to never have B43_RX_MAC_DECERR, we should provide
 810  * a iv32 and phase1key that match. Because we drop packets in case of
 811  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 812  * packets will be lost without higher layer knowing (ie no resync possible
 813  * until next wrap).
 814  *
 815  * NOTE : this should support 50 key like RCMTA because
 816  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 817  */
 818 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 819                 u16 *phase1key)
 820 {
 821         unsigned int i;
 822         u32 offset;
 823         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 824
 825         if (!modparam_hwtkip)
 826                 return;
 827
 828         if (b43_new_kidx_api(dev))
 829                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 830
 831         B43_WARN_ON(index < pairwise_keys_start);
 832         /* We have four default TX keys and possibly four default RX keys.
 833          * Physical mac 0 is mapped to physical key 4 or 8, depending
 834          * on the firmware version.
 835          * So we must adjust the index here.
 836          */
 837         index -= pairwise_keys_start;
 838         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 839
 840         if (b43_debug(dev, B43_DBG_KEYS)) {
 841                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 842                                 index, iv32);
 843         }
 844         /* Write the key to the  RX tkip shared mem */
 845         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 846         for (i = 0; i < 10; i += 2) {
 847                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 848                                 phase1key ? phase1key[i / 2] : 0);
 849         }
 850         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 851         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 852 }
 853
 854 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 855                                    struct ieee80211_vif *vif,
 856                                    struct ieee80211_key_conf *keyconf,
 857                                    struct ieee80211_sta *sta,
 858                                    u32 iv32, u16 *phase1key)
 859 {
 860         struct b43_wl *wl = hw_to_b43_wl(hw);
 861         struct b43_wldev *dev;
 862         int index = keyconf->hw_key_idx;
 863
 864         if (B43_WARN_ON(!modparam_hwtkip))
 865                 return;
 866
 867         /* This is only called from the RX path through mac80211, where
 868          * our mutex is already locked. */
 869         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 870         dev = wl->current_dev;
 871         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 872
 873         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 874
 875         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 876         /* only pairwise TKIP keys are supported right now */
 877         if (WARN_ON(!sta))
 878                 return;
 879         keymac_write(dev, index, sta->addr);
 880 }
 881
 882 static void do_key_write(struct b43_wldev *dev,
 883                          u8 index, u8 algorithm,
 884                          const u8 *key, size_t key_len, const u8 *mac_addr)
 885 {
 886         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 887         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 888
 889         if (b43_new_kidx_api(dev))
 890                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 891
 892         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 893         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 894
 895         if (index >= pairwise_keys_start)
 896                 keymac_write(dev, index, NULL); /* First zero out mac. */
 897         if (algorithm == B43_SEC_ALGO_TKIP) {
 898                 /*
 899                  * We should provide an initial iv32, phase1key pair.
 900                  * We could start with iv32=0 and compute the corresponding
 901                  * phase1key, but this means calling ieee80211_get_tkip_key
 902                  * with a fake skb (or export other tkip function).
 903                  * Because we are lazy we hope iv32 won't start with
 904                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 905                  * correct pair.
 906                  */
 907                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 908         } else if (index >= pairwise_keys_start) /* clear it */
 909                 rx_tkip_phase1_write(dev, index, 0, NULL);
 910         if (key)
 911                 memcpy(buf, key, key_len);
 912         key_write(dev, index, algorithm, buf);
 913         if (index >= pairwise_keys_start)
 914                 keymac_write(dev, index, mac_addr);
 915
 916         dev->key[index].algorithm = algorithm;
 917 }
 918
 919 static int b43_key_write(struct b43_wldev *dev,
 920                          int index, u8 algorithm,
 921                          const u8 *key, size_t key_len,
 922                          const u8 *mac_addr,
 923                          struct ieee80211_key_conf *keyconf)
 924 {
 925         int i;
 926         int pairwise_keys_start;
 927
 928         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 929          *      - Temporal Encryption Key (128 bits)
 930          *      - Temporal Authenticator Tx MIC Key (64 bits)
 931          *      - Temporal Authenticator Rx MIC Key (64 bits)
 932          *
 933          *      Hardware only store TEK
 934          */
 935         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 936                 key_len = 16;
 937         if (key_len > B43_SEC_KEYSIZE)
 938                 return -EINVAL;
 939         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 940                 /* Check that we don't already have this key. */
 941                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 942         }
 943         if (index < 0) {
 944                 /* Pairwise key. Get an empty slot for the key. */
 945                 if (b43_new_kidx_api(dev))
 946                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 947                 else
 948                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 949                 for (i = pairwise_keys_start;
 950                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 951                      i++) {
 952                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 953                         if (!dev->key[i].keyconf) {
 954                                 /* found empty */
 955                                 index = i;
 956                                 break;
 957                         }
 958                 }
 959                 if (index < 0) {
 960                         b43warn(dev->wl, "Out of hardware key memory\n");
 961                         return -ENOSPC;
 962                 }
 963         } else
 964                 B43_WARN_ON(index > 3);
 965
 966         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 967         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 968                 /* Default RX key */
 969                 B43_WARN_ON(mac_addr);
 970                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 971         }
 972         keyconf->hw_key_idx = index;
 973         dev->key[index].keyconf = keyconf;
 974
 975         return 0;
 976 }
 977
 978 static int b43_key_clear(struct b43_wldev *dev, int index)
 979 {
 980         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
 981                 return -EINVAL;
 982         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 983                      NULL, B43_SEC_KEYSIZE, NULL);
 984         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 985                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 986                              NULL, B43_SEC_KEYSIZE, NULL);
 987         }
 988         dev->key[index].keyconf = NULL;
 989
 990         return 0;
 991 }
 992
 993 static void b43_clear_keys(struct b43_wldev *dev)
 994 {
 995         int i, count;
 996
 997         if (b43_new_kidx_api(dev))
 998                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 999         else
1000                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1001         for (i = 0; i < count; i++)
1002                 b43_key_clear(dev, i);
1003 }
1004
1005 static void b43_dump_keymemory(struct b43_wldev *dev)
1006 {
1007         unsigned int i, index, count, offset, pairwise_keys_start;
1008         u8 mac[ETH_ALEN];
1009         u16 algo;
1010         u32 rcmta0;
1011         u16 rcmta1;
1012         u64 hf;
1013         struct b43_key *key;
1014
1015         if (!b43_debug(dev, B43_DBG_KEYS))
1016                 return;
1017
1018         hf = b43_hf_read(dev);
1019         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1020                !!(hf & B43_HF_USEDEFKEYS));
1021         if (b43_new_kidx_api(dev)) {
1022                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1023                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1024         } else {
1025                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1026                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1027         }
1028         for (index = 0; index < count; index++) {
1029                 key = &(dev->key[index]);
1030                 printk(KERN_DEBUG "Key slot %02u: %s",
1031                        index, (key->keyconf == NULL) ? " " : "*");
1032                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1033                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1034                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1035                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1036                 }
1037
1038                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1039                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1040                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1041
1042                 if (index >= pairwise_keys_start) {
1043                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1044                                 printk("   TKIP: ");
1045                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1046                                 for (i = 0; i < 14; i += 2) {
1047                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1048                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1049                                 }
1050                         }
1051                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1052                                                 ((index - pairwise_keys_start) * 2) + 0);
1053                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1054                                                 ((index - pairwise_keys_start) * 2) + 1);
1055                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1056                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1057                         printk("   MAC: %pM", mac);
1058                 } else
1059                         printk("   DEFAULT KEY");
1060                 printk("\n");
1061         }
1062 }
1063
1064 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1065 {
1066         u32 macctl;
1067         u16 ucstat;
1068         bool hwps;
1069         bool awake;
1070         int i;
1071
1072         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1073                     (ps_flags & B43_PS_DISABLED));
1074         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1075
1076         if (ps_flags & B43_PS_ENABLED) {
1077                 hwps = 1;
1078         } else if (ps_flags & B43_PS_DISABLED) {
1079                 hwps = 0;
1080         } else {
1081                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1082                 //      and thus is not an AP and we are associated, set bit 25
1083         }
1084         if (ps_flags & B43_PS_AWAKE) {
1085                 awake = 1;
1086         } else if (ps_flags & B43_PS_ASLEEP) {
1087                 awake = 0;
1088         } else {
1089                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1090                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1091                 //      successful, set bit26
1092         }
1093
1094 /* FIXME: For now we force awake-on and hwps-off */
1095         hwps = 0;
1096         awake = 1;
1097
1098         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1099         if (hwps)
1100                 macctl |= B43_MACCTL_HWPS;
1101         else
1102                 macctl &= ~B43_MACCTL_HWPS;
1103         if (awake)
1104                 macctl |= B43_MACCTL_AWAKE;
1105         else
1106                 macctl &= ~B43_MACCTL_AWAKE;
1107         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1108         /* Commit write */
1109         b43_read32(dev, B43_MMIO_MACCTL);
1110         if (awake && dev->dev->id.revision >= 5) {
1111                 /* Wait for the microcode to wake up. */
1112                 for (i = 0; i < 100; i++) {
1113                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1114                                                 B43_SHM_SH_UCODESTAT);
1115                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1116                                 break;
1117                         udelay(10);
1118                 }
1119         }
1120 }
1121
1122 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1123 {
1124         u32 tmslow;
1125         u32 macctl;
1126
1127         flags |= B43_TMSLOW_PHYCLKEN;
1128         flags |= B43_TMSLOW_PHYRESET;
1129         ssb_device_enable(dev->dev, flags);
1130         msleep(2);              /* Wait for the PLL to turn on. */
1131
1132         /* Now take the PHY out of Reset again */
1133         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1134         tmslow |= SSB_TMSLOW_FGC;
1135         tmslow &= ~B43_TMSLOW_PHYRESET;
1136         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1137         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1138         msleep(1);
1139         tmslow &= ~SSB_TMSLOW_FGC;
1140         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1141         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1142         msleep(1);
1143
1144         /* Turn Analog ON, but only if we already know the PHY-type.
1145          * This protects against very early setup where we don't know the
1146          * PHY-type, yet. wireless_core_reset will be called once again later,
1147          * when we know the PHY-type. */
1148         if (dev->phy.ops)
1149                 dev->phy.ops->switch_analog(dev, 1);
1150
1151         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1152         macctl &= ~B43_MACCTL_GMODE;
1153         if (flags & B43_TMSLOW_GMODE)
1154                 macctl |= B43_MACCTL_GMODE;
1155         macctl |= B43_MACCTL_IHR_ENABLED;
1156         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1157 }
1158
1159 static void handle_irq_transmit_status(struct b43_wldev *dev)
1160 {
1161         u32 v0, v1;
1162         u16 tmp;
1163         struct b43_txstatus stat;
1164
1165         while (1) {
1166                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1167                 if (!(v0 & 0x00000001))
1168                         break;
1169                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1170
1171                 stat.cookie = (v0 >> 16);
1172                 stat.seq = (v1 & 0x0000FFFF);
1173                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1174                 tmp = (v0 & 0x0000FFFF);
1175                 stat.frame_count = ((tmp & 0xF000) >> 12);
1176                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1177                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1178                 stat.pm_indicated = !!(tmp & 0x0080);
1179                 stat.intermediate = !!(tmp & 0x0040);
1180                 stat.for_ampdu = !!(tmp & 0x0020);
1181                 stat.acked = !!(tmp & 0x0002);
1182
1183                 b43_handle_txstatus(dev, &stat);
1184         }
1185 }
1186
1187 static void drain_txstatus_queue(struct b43_wldev *dev)
1188 {
1189         u32 dummy;
1190
1191         if (dev->dev->id.revision < 5)
1192                 return;
1193         /* Read all entries from the microcode TXstatus FIFO
1194          * and throw them away.
1195          */
1196         while (1) {
1197                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1198                 if (!(dummy & 0x00000001))
1199                         break;
1200                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1201         }
1202 }
1203
1204 static u32 b43_jssi_read(struct b43_wldev *dev)
1205 {
1206         u32 val = 0;
1207
1208         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1209         val <<= 16;
1210         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1211
1212         return val;
1213 }
1214
1215 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1216 {
1217         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1218         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1219 }
1220
1221 static void b43_generate_noise_sample(struct b43_wldev *dev)
1222 {
1223         b43_jssi_write(dev, 0x7F7F7F7F);
1224         b43_write32(dev, B43_MMIO_MACCMD,
1225                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1226 }
1227
1228 static void b43_calculate_link_quality(struct b43_wldev *dev)
1229 {
1230         /* Top half of Link Quality calculation. */
1231
1232         if (dev->phy.type != B43_PHYTYPE_G)
1233                 return;
1234         if (dev->noisecalc.calculation_running)
1235                 return;
1236         dev->noisecalc.calculation_running = 1;
1237         dev->noisecalc.nr_samples = 0;
1238
1239         b43_generate_noise_sample(dev);
1240 }
1241
1242 static void handle_irq_noise(struct b43_wldev *dev)
1243 {
1244         struct b43_phy_g *phy = dev->phy.g;
1245         u16 tmp;
1246         u8 noise[4];
1247         u8 i, j;
1248         s32 average;
1249
1250         /* Bottom half of Link Quality calculation. */
1251
1252         if (dev->phy.type != B43_PHYTYPE_G)
1253                 return;
1254
1255         /* Possible race condition: It might be possible that the user
1256          * changed to a different channel in the meantime since we
1257          * started the calculation. We ignore that fact, since it's
1258          * not really that much of a problem. The background noise is
1259          * an estimation only anyway. Slightly wrong results will get damped
1260          * by the averaging of the 8 sample rounds. Additionally the
1261          * value is shortlived. So it will be replaced by the next noise
1262          * calculation round soon. */
1263
1264         B43_WARN_ON(!dev->noisecalc.calculation_running);
1265         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1266         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1267             noise[2] == 0x7F || noise[3] == 0x7F)
1268                 goto generate_new;
1269
1270         /* Get the noise samples. */
1271         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1272         i = dev->noisecalc.nr_samples;
1273         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1274         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1275         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1276         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1277         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1278         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1279         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1280         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1281         dev->noisecalc.nr_samples++;
1282         if (dev->noisecalc.nr_samples == 8) {
1283                 /* Calculate the Link Quality by the noise samples. */
1284                 average = 0;
1285                 for (i = 0; i < 8; i++) {
1286                         for (j = 0; j < 4; j++)
1287                                 average += dev->noisecalc.samples[i][j];
1288                 }
1289                 average /= (8 * 4);
1290                 average *= 125;
1291                 average += 64;
1292                 average /= 128;
1293                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1294                 tmp = (tmp / 128) & 0x1F;
1295                 if (tmp >= 8)
1296                         average += 2;
1297                 else
1298                         average -= 25;
1299                 if (tmp == 8)
1300                         average -= 72;
1301                 else
1302                         average -= 48;
1303
1304                 dev->stats.link_noise = average;
1305                 dev->noisecalc.calculation_running = 0;
1306                 return;
1307         }
1308 generate_new:
1309         b43_generate_noise_sample(dev);
1310 }
1311
1312 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1313 {
1314         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1315                 ///TODO: PS TBTT
1316         } else {
1317                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1318                         b43_power_saving_ctl_bits(dev, 0);
1319         }
1320         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1321                 dev->dfq_valid = 1;
1322 }
1323
1324 static void handle_irq_atim_end(struct b43_wldev *dev)
1325 {
1326         if (dev->dfq_valid) {
1327                 b43_write32(dev, B43_MMIO_MACCMD,
1328                             b43_read32(dev, B43_MMIO_MACCMD)
1329                             | B43_MACCMD_DFQ_VALID);
1330                 dev->dfq_valid = 0;
1331         }
1332 }
1333
1334 static void handle_irq_pmq(struct b43_wldev *dev)
1335 {
1336         u32 tmp;
1337
1338         //TODO: AP mode.
1339
1340         while (1) {
1341                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1342                 if (!(tmp & 0x00000008))
1343                         break;
1344         }
1345         /* 16bit write is odd, but correct. */
1346         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1347 }
1348
1349 static void b43_write_template_common(struct b43_wldev *dev,
1350                                       const u8 *data, u16 size,
1351                                       u16 ram_offset,
1352                                       u16 shm_size_offset, u8 rate)
1353 {
1354         u32 i, tmp;
1355         struct b43_plcp_hdr4 plcp;
1356
1357         plcp.data = 0;
1358         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1359         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1360         ram_offset += sizeof(u32);
1361         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1362          * So leave the first two bytes of the next write blank.
1363          */
1364         tmp = (u32) (data[0]) << 16;
1365         tmp |= (u32) (data[1]) << 24;
1366         b43_ram_write(dev, ram_offset, tmp);
1367         ram_offset += sizeof(u32);
1368         for (i = 2; i < size; i += sizeof(u32)) {
1369                 tmp = (u32) (data[i + 0]);
1370                 if (i + 1 < size)
1371                         tmp |= (u32) (data[i + 1]) << 8;
1372                 if (i + 2 < size)
1373                         tmp |= (u32) (data[i + 2]) << 16;
1374                 if (i + 3 < size)
1375                         tmp |= (u32) (data[i + 3]) << 24;
1376                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1377         }
1378         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1379                         size + sizeof(struct b43_plcp_hdr6));
1380 }
1381
1382 /* Check if the use of the antenna that ieee80211 told us to
1383  * use is possible. This will fall back to DEFAULT.
1384  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1385 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1386                                   u8 antenna_nr)
1387 {
1388         u8 antenna_mask;
1389
1390         if (antenna_nr == 0) {
1391                 /* Zero means "use default antenna". That's always OK. */
1392                 return 0;
1393         }
1394
1395         /* Get the mask of available antennas. */
1396         if (dev->phy.gmode)
1397                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1398         else
1399                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1400
1401         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1402                 /* This antenna is not available. Fall back to default. */
1403                 return 0;
1404         }
1405
1406         return antenna_nr;
1407 }
1408
1409 /* Convert a b43 antenna number value to the PHY TX control value. */
1410 static u16 b43_antenna_to_phyctl(int antenna)
1411 {
1412         switch (antenna) {
1413         case B43_ANTENNA0:
1414                 return B43_TXH_PHY_ANT0;
1415         case B43_ANTENNA1:
1416                 return B43_TXH_PHY_ANT1;
1417         case B43_ANTENNA2:
1418                 return B43_TXH_PHY_ANT2;
1419         case B43_ANTENNA3:
1420                 return B43_TXH_PHY_ANT3;
1421         case B43_ANTENNA_AUTO0:
1422         case B43_ANTENNA_AUTO1:
1423                 return B43_TXH_PHY_ANT01AUTO;
1424         }
1425         B43_WARN_ON(1);
1426         return 0;
1427 }
1428
1429 static void b43_write_beacon_template(struct b43_wldev *dev,
1430                                       u16 ram_offset,
1431                                       u16 shm_size_offset)
1432 {
1433         unsigned int i, len, variable_len;
1434         const struct ieee80211_mgmt *bcn;
1435         const u8 *ie;
1436         bool tim_found = 0;
1437         unsigned int rate;
1438         u16 ctl;
1439         int antenna;
1440         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1441
1442         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1443         len = min((size_t) dev->wl->current_beacon->len,
1444                   0x200 - sizeof(struct b43_plcp_hdr6));
1445         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1446
1447         b43_write_template_common(dev, (const u8 *)bcn,
1448                                   len, ram_offset, shm_size_offset, rate);
1449
1450         /* Write the PHY TX control parameters. */
1451         antenna = B43_ANTENNA_DEFAULT;
1452         antenna = b43_antenna_to_phyctl(antenna);
1453         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1454         /* We can't send beacons with short preamble. Would get PHY errors. */
1455         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1456         ctl &= ~B43_TXH_PHY_ANT;
1457         ctl &= ~B43_TXH_PHY_ENC;
1458         ctl |= antenna;
1459         if (b43_is_cck_rate(rate))
1460                 ctl |= B43_TXH_PHY_ENC_CCK;
1461         else
1462                 ctl |= B43_TXH_PHY_ENC_OFDM;
1463         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1464
1465         /* Find the position of the TIM and the DTIM_period value
1466          * and write them to SHM. */
1467         ie = bcn->u.beacon.variable;
1468         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1469         for (i = 0; i < variable_len - 2; ) {
1470                 uint8_t ie_id, ie_len;
1471
1472                 ie_id = ie[i];
1473                 ie_len = ie[i + 1];
1474                 if (ie_id == 5) {
1475                         u16 tim_position;
1476                         u16 dtim_period;
1477                         /* This is the TIM Information Element */
1478
1479                         /* Check whether the ie_len is in the beacon data range. */
1480                         if (variable_len < ie_len + 2 + i)
1481                                 break;
1482                         /* A valid TIM is at least 4 bytes long. */
1483                         if (ie_len < 4)
1484                                 break;
1485                         tim_found = 1;
1486
1487                         tim_position = sizeof(struct b43_plcp_hdr6);
1488                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1489                         tim_position += i;
1490
1491                         dtim_period = ie[i + 3];
1492
1493                         b43_shm_write16(dev, B43_SHM_SHARED,
1494                                         B43_SHM_SH_TIMBPOS, tim_position);
1495                         b43_shm_write16(dev, B43_SHM_SHARED,
1496                                         B43_SHM_SH_DTIMPER, dtim_period);
1497                         break;
1498                 }
1499                 i += ie_len + 2;
1500         }
1501         if (!tim_found) {
1502                 /*
1503                  * If ucode wants to modify TIM do it behind the beacon, this
1504                  * will happen, for example, when doing mesh networking.
1505                  */
1506                 b43_shm_write16(dev, B43_SHM_SHARED,
1507                                 B43_SHM_SH_TIMBPOS,
1508                                 len + sizeof(struct b43_plcp_hdr6));
1509                 b43_shm_write16(dev, B43_SHM_SHARED,
1510                                 B43_SHM_SH_DTIMPER, 0);
1511         }
1512         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1513 }
1514
1515 static void b43_upload_beacon0(struct b43_wldev *dev)
1516 {
1517         struct b43_wl *wl = dev->wl;
1518
1519         if (wl->beacon0_uploaded)
1520                 return;
1521         b43_write_beacon_template(dev, 0x68, 0x18);
1522         wl->beacon0_uploaded = 1;
1523 }
1524
1525 static void b43_upload_beacon1(struct b43_wldev *dev)
1526 {
1527         struct b43_wl *wl = dev->wl;
1528
1529         if (wl->beacon1_uploaded)
1530                 return;
1531         b43_write_beacon_template(dev, 0x468, 0x1A);
1532         wl->beacon1_uploaded = 1;
1533 }
1534
1535 static void handle_irq_beacon(struct b43_wldev *dev)
1536 {
1537         struct b43_wl *wl = dev->wl;
1538         u32 cmd, beacon0_valid, beacon1_valid;
1539
1540         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1541             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1542                 return;
1543
1544         /* This is the bottom half of the asynchronous beacon update. */
1545
1546         /* Ignore interrupt in the future. */
1547         dev->irq_mask &= ~B43_IRQ_BEACON;
1548
1549         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1550         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1551         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1552
1553         /* Schedule interrupt manually, if busy. */
1554         if (beacon0_valid && beacon1_valid) {
1555                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1556                 dev->irq_mask |= B43_IRQ_BEACON;
1557                 return;
1558         }
1559
1560         if (unlikely(wl->beacon_templates_virgin)) {
1561                 /* We never uploaded a beacon before.
1562                  * Upload both templates now, but only mark one valid. */
1563                 wl->beacon_templates_virgin = 0;
1564                 b43_upload_beacon0(dev);
1565                 b43_upload_beacon1(dev);
1566                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1567                 cmd |= B43_MACCMD_BEACON0_VALID;
1568                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1569         } else {
1570                 if (!beacon0_valid) {
1571                         b43_upload_beacon0(dev);
1572                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1573                         cmd |= B43_MACCMD_BEACON0_VALID;
1574                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1575                 } else if (!beacon1_valid) {
1576                         b43_upload_beacon1(dev);
1577                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1578                         cmd |= B43_MACCMD_BEACON1_VALID;
1579                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1580                 }
1581         }
1582 }
1583
1584 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1585 {
1586         u32 old_irq_mask = dev->irq_mask;
1587
1588         /* update beacon right away or defer to irq */
1589         handle_irq_beacon(dev);
1590         if (old_irq_mask != dev->irq_mask) {
1591                 /* The handler updated the IRQ mask. */
1592                 B43_WARN_ON(!dev->irq_mask);
1593                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1594                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1595                 } else {
1596                         /* Device interrupts are currently disabled. That means
1597                          * we just ran the hardirq handler and scheduled the
1598                          * IRQ thread. The thread will write the IRQ mask when
1599                          * it finished, so there's nothing to do here. Writing
1600                          * the mask _here_ would incorrectly re-enable IRQs. */
1601                 }
1602         }
1603 }
1604
1605 static void b43_beacon_update_trigger_work(struct work_struct *work)
1606 {
1607         struct b43_wl *wl = container_of(work, struct b43_wl,
1608                                          beacon_update_trigger);
1609         struct b43_wldev *dev;
1610
1611         mutex_lock(&wl->mutex);
1612         dev = wl->current_dev;
1613         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1614                 if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
1615                         /* wl->mutex is enough. */
1616                         b43_do_beacon_update_trigger_work(dev);
1617                         mmiowb();
1618                 } else {
1619                         spin_lock_irq(&wl->hardirq_lock);
1620                         b43_do_beacon_update_trigger_work(dev);
1621                         mmiowb();
1622                         spin_unlock_irq(&wl->hardirq_lock);
1623                 }
1624         }
1625         mutex_unlock(&wl->mutex);
1626 }
1627
1628 /* Asynchronously update the packet templates in template RAM.
1629  * Locking: Requires wl->mutex to be locked. */
1630 static void b43_update_templates(struct b43_wl *wl)
1631 {
1632         struct sk_buff *beacon;
1633
1634         /* This is the top half of the ansynchronous beacon update.
1635          * The bottom half is the beacon IRQ.
1636          * Beacon update must be asynchronous to avoid sending an
1637          * invalid beacon. This can happen for example, if the firmware
1638          * transmits a beacon while we are updating it. */
1639
1640         /* We could modify the existing beacon and set the aid bit in
1641          * the TIM field, but that would probably require resizing and
1642          * moving of data within the beacon template.
1643          * Simply request a new beacon and let mac80211 do the hard work. */
1644         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1645         if (unlikely(!beacon))
1646                 return;
1647
1648         if (wl->current_beacon)
1649                 dev_kfree_skb_any(wl->current_beacon);
1650         wl->current_beacon = beacon;
1651         wl->beacon0_uploaded = 0;
1652         wl->beacon1_uploaded = 0;
1653         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1654 }
1655
1656 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1657 {
1658         b43_time_lock(dev);
1659         if (dev->dev->id.revision >= 3) {
1660                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1661                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1662         } else {
1663                 b43_write16(dev, 0x606, (beacon_int >> 6));
1664                 b43_write16(dev, 0x610, beacon_int);
1665         }
1666         b43_time_unlock(dev);
1667         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1668 }
1669
1670 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1671 {
1672         u16 reason;
1673
1674         /* Read the register that contains the reason code for the panic. */
1675         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1676         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1677
1678         switch (reason) {
1679         default:
1680                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1681                 /* fallthrough */
1682         case B43_FWPANIC_DIE:
1683                 /* Do not restart the controller or firmware.
1684                  * The device is nonfunctional from now on.
1685                  * Restarting would result in this panic to trigger again,
1686                  * so we avoid that recursion. */
1687                 break;
1688         case B43_FWPANIC_RESTART:
1689                 b43_controller_restart(dev, "Microcode panic");
1690                 break;
1691         }
1692 }
1693
1694 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1695 {
1696         unsigned int i, cnt;
1697         u16 reason, marker_id, marker_line;
1698         __le16 *buf;
1699
1700         /* The proprietary firmware doesn't have this IRQ. */
1701         if (!dev->fw.opensource)
1702                 return;
1703
1704         /* Read the register that contains the reason code for this IRQ. */
1705         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1706
1707         switch (reason) {
1708         case B43_DEBUGIRQ_PANIC:
1709                 b43_handle_firmware_panic(dev);
1710                 break;
1711         case B43_DEBUGIRQ_DUMP_SHM:
1712                 if (!B43_DEBUG)
1713                         break; /* Only with driver debugging enabled. */
1714                 buf = kmalloc(4096, GFP_ATOMIC);
1715                 if (!buf) {
1716                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1717                         goto out;
1718                 }
1719                 for (i = 0; i < 4096; i += 2) {
1720                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1721                         buf[i / 2] = cpu_to_le16(tmp);
1722                 }
1723                 b43info(dev->wl, "Shared memory dump:\n");
1724                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1725                                16, 2, buf, 4096, 1);
1726                 kfree(buf);
1727                 break;
1728         case B43_DEBUGIRQ_DUMP_REGS:
1729                 if (!B43_DEBUG)
1730                         break; /* Only with driver debugging enabled. */
1731                 b43info(dev->wl, "Microcode register dump:\n");
1732                 for (i = 0, cnt = 0; i < 64; i++) {
1733                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1734                         if (cnt == 0)
1735                                 printk(KERN_INFO);
1736                         printk("r%02u: 0x%04X  ", i, tmp);
1737                         cnt++;
1738                         if (cnt == 6) {
1739                                 printk("\n");
1740                                 cnt = 0;
1741                         }
1742                 }
1743                 printk("\n");
1744                 break;
1745         case B43_DEBUGIRQ_MARKER:
1746                 if (!B43_DEBUG)
1747                         break; /* Only with driver debugging enabled. */
1748                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1749                                            B43_MARKER_ID_REG);
1750                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1751                                              B43_MARKER_LINE_REG);
1752                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1753                         "at line number %u\n",
1754                         marker_id, marker_line);
1755                 break;
1756         default:
1757                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1758                        reason);
1759         }
1760 out:
1761         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1762         b43_shm_write16(dev, B43_SHM_SCRATCH,
1763                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1764 }
1765
1766 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1767 {
1768         u32 reason;
1769         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1770         u32 merged_dma_reason = 0;
1771         int i;
1772
1773         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1774                 return;
1775
1776         reason = dev->irq_reason;
1777         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1778                 dma_reason[i] = dev->dma_reason[i];
1779                 merged_dma_reason |= dma_reason[i];
1780         }
1781
1782         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1783                 b43err(dev->wl, "MAC transmission error\n");
1784
1785         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1786                 b43err(dev->wl, "PHY transmission error\n");
1787                 rmb();
1788                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1789                         atomic_set(&dev->phy.txerr_cnt,
1790                                    B43_PHY_TX_BADNESS_LIMIT);
1791                         b43err(dev->wl, "Too many PHY TX errors, "
1792                                         "restarting the controller\n");
1793                         b43_controller_restart(dev, "PHY TX errors");
1794                 }
1795         }
1796
1797         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1798                                           B43_DMAIRQ_NONFATALMASK))) {
1799                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1800                         b43err(dev->wl, "Fatal DMA error: "
1801                                "0x%08X, 0x%08X, 0x%08X, "
1802                                "0x%08X, 0x%08X, 0x%08X\n",
1803                                dma_reason[0], dma_reason[1],
1804                                dma_reason[2], dma_reason[3],
1805                                dma_reason[4], dma_reason[5]);
1806                         b43err(dev->wl, "This device does not support DMA "
1807                                "on your system. Please use PIO instead.\n");
1808                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1809                         dev->use_pio = 1;
1810                         b43_controller_restart(dev, "DMA error");
1811                         return;
1812                 }
1813                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1814                         b43err(dev->wl, "DMA error: "
1815                                "0x%08X, 0x%08X, 0x%08X, "
1816                                "0x%08X, 0x%08X, 0x%08X\n",
1817                                dma_reason[0], dma_reason[1],
1818                                dma_reason[2], dma_reason[3],
1819                                dma_reason[4], dma_reason[5]);
1820                 }
1821         }
1822
1823         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1824                 handle_irq_ucode_debug(dev);
1825         if (reason & B43_IRQ_TBTT_INDI)
1826                 handle_irq_tbtt_indication(dev);
1827         if (reason & B43_IRQ_ATIM_END)
1828                 handle_irq_atim_end(dev);
1829         if (reason & B43_IRQ_BEACON)
1830                 handle_irq_beacon(dev);
1831         if (reason & B43_IRQ_PMQ)
1832                 handle_irq_pmq(dev);
1833         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1834                 ;/* TODO */
1835         if (reason & B43_IRQ_NOISESAMPLE_OK)
1836                 handle_irq_noise(dev);
1837
1838         /* Check the DMA reason registers for received data. */
1839         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1840                 if (b43_using_pio_transfers(dev))
1841                         b43_pio_rx(dev->pio.rx_queue);
1842                 else
1843                         b43_dma_rx(dev->dma.rx_ring);
1844         }
1845         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1846         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1847         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1848         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1849         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1850
1851         if (reason & B43_IRQ_TX_OK)
1852                 handle_irq_transmit_status(dev);
1853
1854         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1855         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1856
1857 #if B43_DEBUG
1858         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1859                 dev->irq_count++;
1860                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1861                         if (reason & (1 << i))
1862                                 dev->irq_bit_count[i]++;
1863                 }
1864         }
1865 #endif
1866 }
1867
1868 /* Interrupt thread handler. Handles device interrupts in thread context. */
1869 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1870 {
1871         struct b43_wldev *dev = dev_id;
1872
1873         mutex_lock(&dev->wl->mutex);
1874         b43_do_interrupt_thread(dev);
1875         mmiowb();
1876         mutex_unlock(&dev->wl->mutex);
1877
1878         return IRQ_HANDLED;
1879 }
1880
1881 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1882 {
1883         u32 reason;
1884
1885         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1886          * On SDIO, this runs under wl->mutex. */
1887
1888         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1889         if (reason == 0xffffffff)       /* shared IRQ */
1890                 return IRQ_NONE;
1891         reason &= dev->irq_mask;
1892         if (!reason)
1893                 return IRQ_HANDLED;
1894
1895         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1896             & 0x0001DC00;
1897         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1898             & 0x0000DC00;
1899         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1900             & 0x0000DC00;
1901         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1902             & 0x0001DC00;
1903         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1904             & 0x0000DC00;
1905 /* Unused ring
1906         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1907             & 0x0000DC00;
1908 */
1909
1910         /* ACK the interrupt. */
1911         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1912         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1913         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1914         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1915         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1916         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1917 /* Unused ring
1918         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1919 */
1920
1921         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1922         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1923         /* Save the reason bitmasks for the IRQ thread handler. */
1924         dev->irq_reason = reason;
1925
1926         return IRQ_WAKE_THREAD;
1927 }
1928
1929 /* Interrupt handler top-half. This runs with interrupts disabled. */
1930 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1931 {
1932         struct b43_wldev *dev = dev_id;
1933         irqreturn_t ret;
1934
1935         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1936                 return IRQ_NONE;
1937
1938         spin_lock(&dev->wl->hardirq_lock);
1939         ret = b43_do_interrupt(dev);
1940         mmiowb();
1941         spin_unlock(&dev->wl->hardirq_lock);
1942
1943         return ret;
1944 }
1945
1946 /* SDIO interrupt handler. This runs in process context. */
1947 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
1948 {
1949         struct b43_wl *wl = dev->wl;
1950         irqreturn_t ret;
1951
1952         mutex_lock(&wl->mutex);
1953
1954         ret = b43_do_interrupt(dev);
1955         if (ret == IRQ_WAKE_THREAD)
1956                 b43_do_interrupt_thread(dev);
1957
1958         mutex_unlock(&wl->mutex);
1959 }
1960
1961 void b43_do_release_fw(struct b43_firmware_file *fw)
1962 {
1963         release_firmware(fw->data);
1964         fw->data = NULL;
1965         fw->filename = NULL;
1966 }
1967
1968 static void b43_release_firmware(struct b43_wldev *dev)
1969 {
1970         b43_do_release_fw(&dev->fw.ucode);
1971         b43_do_release_fw(&dev->fw.pcm);
1972         b43_do_release_fw(&dev->fw.initvals);
1973         b43_do_release_fw(&dev->fw.initvals_band);
1974 }
1975
1976 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1977 {
1978         const char text[] =
1979                 "You must go to " \
1980                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1981                 "and download the correct firmware for this driver version. " \
1982                 "Please carefully read all instructions on this website.\n";
1983
1984         if (error)
1985                 b43err(wl, text);
1986         else
1987                 b43warn(wl, text);
1988 }
1989
1990 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1991                       const char *name,
1992                       struct b43_firmware_file *fw)
1993 {
1994         const struct firmware *blob;
1995         struct b43_fw_header *hdr;
1996         u32 size;
1997         int err;
1998
1999         if (!name) {
2000                 /* Don't fetch anything. Free possibly cached firmware. */
2001                 /* FIXME: We should probably keep it anyway, to save some headache
2002                  * on suspend/resume with multiband devices. */
2003                 b43_do_release_fw(fw);
2004                 return 0;
2005         }
2006         if (fw->filename) {
2007                 if ((fw->type == ctx->req_type) &&
2008                     (strcmp(fw->filename, name) == 0))
2009                         return 0; /* Already have this fw. */
2010                 /* Free the cached firmware first. */
2011                 /* FIXME: We should probably do this later after we successfully
2012                  * got the new fw. This could reduce headache with multiband devices.
2013                  * We could also redesign this to cache the firmware for all possible
2014                  * bands all the time. */
2015                 b43_do_release_fw(fw);
2016         }
2017
2018         switch (ctx->req_type) {
2019         case B43_FWTYPE_PROPRIETARY:
2020                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2021                          "b43%s/%s.fw",
2022                          modparam_fwpostfix, name);
2023                 break;
2024         case B43_FWTYPE_OPENSOURCE:
2025                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2026                          "b43-open%s/%s.fw",
2027                          modparam_fwpostfix, name);
2028                 break;
2029         default:
2030                 B43_WARN_ON(1);
2031                 return -ENOSYS;
2032         }
2033         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2034         if (err == -ENOENT) {
2035                 snprintf(ctx->errors[ctx->req_type],
2036                          sizeof(ctx->errors[ctx->req_type]),
2037                          "Firmware file \"%s\" not found\n", ctx->fwname);
2038                 return err;
2039         } else if (err) {
2040                 snprintf(ctx->errors[ctx->req_type],
2041                          sizeof(ctx->errors[ctx->req_type]),
2042                          "Firmware file \"%s\" request failed (err=%d)\n",
2043                          ctx->fwname, err);
2044                 return err;
2045         }
2046         if (blob->size < sizeof(struct b43_fw_header))
2047                 goto err_format;
2048         hdr = (struct b43_fw_header *)(blob->data);
2049         switch (hdr->type) {
2050         case B43_FW_TYPE_UCODE:
2051         case B43_FW_TYPE_PCM:
2052                 size = be32_to_cpu(hdr->size);
2053                 if (size != blob->size - sizeof(struct b43_fw_header))
2054                         goto err_format;
2055                 /* fallthrough */
2056         case B43_FW_TYPE_IV:
2057                 if (hdr->ver != 1)
2058                         goto err_format;
2059                 break;
2060         default:
2061                 goto err_format;
2062         }
2063
2064         fw->data = blob;
2065         fw->filename = name;
2066         fw->type = ctx->req_type;
2067
2068         return 0;
2069
2070 err_format:
2071         snprintf(ctx->errors[ctx->req_type],
2072                  sizeof(ctx->errors[ctx->req_type]),
2073                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2074         release_firmware(blob);
2075
2076         return -EPROTO;
2077 }
2078
2079 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2080 {
2081         struct b43_wldev *dev = ctx->dev;
2082         struct b43_firmware *fw = &ctx->dev->fw;
2083         const u8 rev = ctx->dev->dev->id.revision;
2084         const char *filename;
2085         u32 tmshigh;
2086         int err;
2087
2088         /* Get microcode */
2089         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2090         if ((rev >= 5) && (rev <= 10))
2091                 filename = "ucode5";
2092         else if ((rev >= 11) && (rev <= 12))
2093                 filename = "ucode11";
2094         else if (rev == 13)
2095                 filename = "ucode13";
2096         else if (rev == 14)
2097                 filename = "ucode14";
2098         else if (rev >= 15)
2099                 filename = "ucode15";
2100         else
2101                 goto err_no_ucode;
2102         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2103         if (err)
2104                 goto err_load;
2105
2106         /* Get PCM code */
2107         if ((rev >= 5) && (rev <= 10))
2108                 filename = "pcm5";
2109         else if (rev >= 11)
2110                 filename = NULL;
2111         else
2112                 goto err_no_pcm;
2113         fw->pcm_request_failed = 0;
2114         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2115         if (err == -ENOENT) {
2116                 /* We did not find a PCM file? Not fatal, but
2117                  * core rev <= 10 must do without hwcrypto then. */
2118                 fw->pcm_request_failed = 1;
2119         } else if (err)
2120                 goto err_load;
2121
2122         /* Get initvals */
2123         switch (dev->phy.type) {
2124         case B43_PHYTYPE_A:
2125                 if ((rev >= 5) && (rev <= 10)) {
2126                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2127                                 filename = "a0g1initvals5";
2128                         else
2129                                 filename = "a0g0initvals5";
2130                 } else
2131                         goto err_no_initvals;
2132                 break;
2133         case B43_PHYTYPE_G:
2134                 if ((rev >= 5) && (rev <= 10))
2135                         filename = "b0g0initvals5";
2136                 else if (rev >= 13)
2137                         filename = "b0g0initvals13";
2138                 else
2139                         goto err_no_initvals;
2140                 break;
2141         case B43_PHYTYPE_N:
2142                 if ((rev >= 11) && (rev <= 12))
2143                         filename = "n0initvals11";
2144                 else
2145                         goto err_no_initvals;
2146                 break;
2147         case B43_PHYTYPE_LP:
2148                 if (rev == 13)
2149                         filename = "lp0initvals13";
2150                 else if (rev == 14)
2151                         filename = "lp0initvals14";
2152                 else if (rev >= 15)
2153                         filename = "lp0initvals15";
2154                 else
2155                         goto err_no_initvals;
2156                 break;
2157         default:
2158                 goto err_no_initvals;
2159         }
2160         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2161         if (err)
2162                 goto err_load;
2163
2164         /* Get bandswitch initvals */
2165         switch (dev->phy.type) {
2166         case B43_PHYTYPE_A:
2167                 if ((rev >= 5) && (rev <= 10)) {
2168                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2169                                 filename = "a0g1bsinitvals5";
2170                         else
2171                                 filename = "a0g0bsinitvals5";
2172                 } else if (rev >= 11)
2173                         filename = NULL;
2174                 else
2175                         goto err_no_initvals;
2176                 break;
2177         case B43_PHYTYPE_G:
2178                 if ((rev >= 5) && (rev <= 10))
2179                         filename = "b0g0bsinitvals5";
2180                 else if (rev >= 11)
2181                         filename = NULL;
2182                 else
2183                         goto err_no_initvals;
2184                 break;
2185         case B43_PHYTYPE_N:
2186                 if ((rev >= 11) && (rev <= 12))
2187                         filename = "n0bsinitvals11";
2188                 else
2189                         goto err_no_initvals;
2190                 break;
2191         case B43_PHYTYPE_LP:
2192                 if (rev == 13)
2193                         filename = "lp0bsinitvals13";
2194                 else if (rev == 14)
2195                         filename = "lp0bsinitvals14";
2196                 else if (rev >= 15)
2197                         filename = "lp0bsinitvals15";
2198                 else
2199                         goto err_no_initvals;
2200                 break;
2201         default:
2202                 goto err_no_initvals;
2203         }
2204         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2205         if (err)
2206                 goto err_load;
2207
2208         return 0;
2209
2210 err_no_ucode:
2211         err = ctx->fatal_failure = -EOPNOTSUPP;
2212         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2213                "is required for your device (wl-core rev %u)\n", rev);
2214         goto error;
2215
2216 err_no_pcm:
2217         err = ctx->fatal_failure = -EOPNOTSUPP;
2218         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2219                "is required for your device (wl-core rev %u)\n", rev);
2220         goto error;
2221
2222 err_no_initvals:
2223         err = ctx->fatal_failure = -EOPNOTSUPP;
2224         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2225                "is required for your device (wl-core rev %u)\n", rev);
2226         goto error;
2227
2228 err_load:
2229         /* We failed to load this firmware image. The error message
2230          * already is in ctx->errors. Return and let our caller decide
2231          * what to do. */
2232         goto error;
2233
2234 error:
2235         b43_release_firmware(dev);
2236         return err;
2237 }
2238
2239 static int b43_request_firmware(struct b43_wldev *dev)
2240 {
2241         struct b43_request_fw_context *ctx;
2242         unsigned int i;
2243         int err;
2244         const char *errmsg;
2245
2246         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2247         if (!ctx)
2248                 return -ENOMEM;
2249         ctx->dev = dev;
2250
2251         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2252         err = b43_try_request_fw(ctx);
2253         if (!err)
2254                 goto out; /* Successfully loaded it. */
2255         err = ctx->fatal_failure;
2256         if (err)
2257                 goto out;
2258
2259         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2260         err = b43_try_request_fw(ctx);
2261         if (!err)
2262                 goto out; /* Successfully loaded it. */
2263         err = ctx->fatal_failure;
2264         if (err)
2265                 goto out;
2266
2267         /* Could not find a usable firmware. Print the errors. */
2268         for (i = 0; i < B43_NR_FWTYPES; i++) {
2269                 errmsg = ctx->errors[i];
2270                 if (strlen(errmsg))
2271                         b43err(dev->wl, errmsg);
2272         }
2273         b43_print_fw_helptext(dev->wl, 1);
2274         err = -ENOENT;
2275
2276 out:
2277         kfree(ctx);
2278         return err;
2279 }
2280
2281 static int b43_upload_microcode(struct b43_wldev *dev)
2282 {
2283         const size_t hdr_len = sizeof(struct b43_fw_header);
2284         const __be32 *data;
2285         unsigned int i, len;
2286         u16 fwrev, fwpatch, fwdate, fwtime;
2287         u32 tmp, macctl;
2288         int err = 0;
2289
2290         /* Jump the microcode PSM to offset 0 */
2291         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2292         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2293         macctl |= B43_MACCTL_PSM_JMP0;
2294         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2295         /* Zero out all microcode PSM registers and shared memory. */
2296         for (i = 0; i < 64; i++)
2297                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2298         for (i = 0; i < 4096; i += 2)
2299                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2300
2301         /* Upload Microcode. */
2302         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2303         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2304         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2305         for (i = 0; i < len; i++) {
2306                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2307                 udelay(10);
2308         }
2309
2310         if (dev->fw.pcm.data) {
2311                 /* Upload PCM data. */
2312                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2313                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2314                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2315                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2316                 /* No need for autoinc bit in SHM_HW */
2317                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2318                 for (i = 0; i < len; i++) {
2319                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2320                         udelay(10);
2321                 }
2322         }
2323
2324         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2325
2326         /* Start the microcode PSM */
2327         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2328         macctl &= ~B43_MACCTL_PSM_JMP0;
2329         macctl |= B43_MACCTL_PSM_RUN;
2330         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2331
2332         /* Wait for the microcode to load and respond */
2333         i = 0;
2334         while (1) {
2335                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2336                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2337                         break;
2338                 i++;
2339                 if (i >= 20) {
2340                         b43err(dev->wl, "Microcode not responding\n");
2341                         b43_print_fw_helptext(dev->wl, 1);
2342                         err = -ENODEV;
2343                         goto error;
2344                 }
2345                 msleep(50);
2346         }
2347         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2348
2349         /* Get and check the revisions. */
2350         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2351         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2352         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2353         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2354
2355         if (fwrev <= 0x128) {
2356                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2357                        "binary drivers older than version 4.x is unsupported. "
2358                        "You must upgrade your firmware files.\n");
2359                 b43_print_fw_helptext(dev->wl, 1);
2360                 err = -EOPNOTSUPP;
2361                 goto error;
2362         }
2363         dev->fw.rev = fwrev;
2364         dev->fw.patch = fwpatch;
2365         dev->fw.opensource = (fwdate == 0xFFFF);
2366
2367         /* Default to use-all-queues. */
2368         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2369         dev->qos_enabled = !!modparam_qos;
2370         /* Default to firmware/hardware crypto acceleration. */
2371         dev->hwcrypto_enabled = 1;
2372
2373         if (dev->fw.opensource) {
2374                 u16 fwcapa;
2375
2376                 /* Patchlevel info is encoded in the "time" field. */
2377                 dev->fw.patch = fwtime;
2378                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2379                         dev->fw.rev, dev->fw.patch);
2380
2381                 fwcapa = b43_fwcapa_read(dev);
2382                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2383                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2384                         /* Disable hardware crypto and fall back to software crypto. */
2385                         dev->hwcrypto_enabled = 0;
2386                 }
2387                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2388                         b43info(dev->wl, "QoS not supported by firmware\n");
2389                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2390                          * ieee80211_unregister to make sure the networking core can
2391                          * properly free possible resources. */
2392                         dev->wl->hw->queues = 1;
2393                         dev->qos_enabled = 0;
2394                 }
2395         } else {
2396                 b43info(dev->wl, "Loading firmware version %u.%u "
2397                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2398                         fwrev, fwpatch,
2399                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2400                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2401                 if (dev->fw.pcm_request_failed) {
2402                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2403                                 "Hardware accelerated cryptography is disabled.\n");
2404                         b43_print_fw_helptext(dev->wl, 0);
2405                 }
2406         }
2407
2408         if (b43_is_old_txhdr_format(dev)) {
2409                 /* We're over the deadline, but we keep support for old fw
2410                  * until it turns out to be in major conflict with something new. */
2411                 b43warn(dev->wl, "You are using an old firmware image. "
2412                         "Support for old firmware will be removed soon "
2413                         "(official deadline was July 2008).\n");
2414                 b43_print_fw_helptext(dev->wl, 0);
2415         }
2416
2417         return 0;
2418
2419 error:
2420         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2421         macctl &= ~B43_MACCTL_PSM_RUN;
2422         macctl |= B43_MACCTL_PSM_JMP0;
2423         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2424
2425         return err;
2426 }
2427
2428 static int b43_write_initvals(struct b43_wldev *dev,
2429                               const struct b43_iv *ivals,
2430                               size_t count,
2431                               size_t array_size)
2432 {
2433         const struct b43_iv *iv;
2434         u16 offset;
2435         size_t i;
2436         bool bit32;
2437
2438         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2439         iv = ivals;
2440         for (i = 0; i < count; i++) {
2441                 if (array_size < sizeof(iv->offset_size))
2442                         goto err_format;
2443                 array_size -= sizeof(iv->offset_size);
2444                 offset = be16_to_cpu(iv->offset_size);
2445                 bit32 = !!(offset & B43_IV_32BIT);
2446                 offset &= B43_IV_OFFSET_MASK;
2447                 if (offset >= 0x1000)
2448                         goto err_format;
2449                 if (bit32) {
2450                         u32 value;
2451
2452                         if (array_size < sizeof(iv->data.d32))
2453                                 goto err_format;
2454                         array_size -= sizeof(iv->data.d32);
2455
2456                         value = get_unaligned_be32(&iv->data.d32);
2457                         b43_write32(dev, offset, value);
2458
2459                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2460                                                         sizeof(__be16) +
2461                                                         sizeof(__be32));
2462                 } else {
2463                         u16 value;
2464
2465                         if (array_size < sizeof(iv->data.d16))
2466                                 goto err_format;
2467                         array_size -= sizeof(iv->data.d16);
2468
2469                         value = be16_to_cpu(iv->data.d16);
2470                         b43_write16(dev, offset, value);
2471
2472                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2473                                                         sizeof(__be16) +
2474                                                         sizeof(__be16));
2475                 }
2476         }
2477         if (array_size)
2478                 goto err_format;
2479
2480         return 0;
2481
2482 err_format:
2483         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2484         b43_print_fw_helptext(dev->wl, 1);
2485
2486         return -EPROTO;
2487 }
2488
2489 static int b43_upload_initvals(struct b43_wldev *dev)
2490 {
2491         const size_t hdr_len = sizeof(struct b43_fw_header);
2492         const struct b43_fw_header *hdr;
2493         struct b43_firmware *fw = &dev->fw;
2494         const struct b43_iv *ivals;
2495         size_t count;
2496         int err;
2497
2498         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2499         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2500         count = be32_to_cpu(hdr->size);
2501         err = b43_write_initvals(dev, ivals, count,
2502                                  fw->initvals.data->size - hdr_len);
2503         if (err)
2504                 goto out;
2505         if (fw->initvals_band.data) {
2506                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2507                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2508                 count = be32_to_cpu(hdr->size);
2509                 err = b43_write_initvals(dev, ivals, count,
2510                                          fw->initvals_band.data->size - hdr_len);
2511                 if (err)
2512                         goto out;
2513         }
2514 out:
2515
2516         return err;
2517 }
2518
2519 /* Initialize the GPIOs
2520  * http://bcm-specs.sipsolutions.net/GPIO
2521  */
2522 static int b43_gpio_init(struct b43_wldev *dev)
2523 {
2524         struct ssb_bus *bus = dev->dev->bus;
2525         struct ssb_device *gpiodev, *pcidev = NULL;
2526         u32 mask, set;
2527
2528         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2529                     & ~B43_MACCTL_GPOUTSMSK);
2530
2531         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2532                     | 0x000F);
2533
2534         mask = 0x0000001F;
2535         set = 0x0000000F;
2536         if (dev->dev->bus->chip_id == 0x4301) {
2537                 mask |= 0x0060;
2538                 set |= 0x0060;
2539         }
2540         if (0 /* FIXME: conditional unknown */ ) {
2541                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2542                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2543                             | 0x0100);
2544                 mask |= 0x0180;
2545                 set |= 0x0180;
2546         }
2547         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2548                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2549                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2550                             | 0x0200);
2551                 mask |= 0x0200;
2552                 set |= 0x0200;
2553         }
2554         if (dev->dev->id.revision >= 2)
2555                 mask |= 0x0010; /* FIXME: This is redundant. */
2556
2557 #ifdef CONFIG_SSB_DRIVER_PCICORE
2558         pcidev = bus->pcicore.dev;
2559 #endif
2560         gpiodev = bus->chipco.dev ? : pcidev;
2561         if (!gpiodev)
2562                 return 0;
2563         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2564                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2565                      & mask) | set);
2566
2567         return 0;
2568 }
2569
2570 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2571 static void b43_gpio_cleanup(struct b43_wldev *dev)
2572 {
2573         struct ssb_bus *bus = dev->dev->bus;
2574         struct ssb_device *gpiodev, *pcidev = NULL;
2575
2576 #ifdef CONFIG_SSB_DRIVER_PCICORE
2577         pcidev = bus->pcicore.dev;
2578 #endif
2579         gpiodev = bus->chipco.dev ? : pcidev;
2580         if (!gpiodev)
2581                 return;
2582         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2583 }
2584
2585 /* http://bcm-specs.sipsolutions.net/EnableMac */
2586 void b43_mac_enable(struct b43_wldev *dev)
2587 {
2588         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2589                 u16 fwstate;
2590
2591                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2592                                          B43_SHM_SH_UCODESTAT);
2593                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2594                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2595                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2596                                "should be suspended, but current state is %u\n",
2597                                fwstate);
2598                 }
2599         }
2600
2601         dev->mac_suspended--;
2602         B43_WARN_ON(dev->mac_suspended < 0);
2603         if (dev->mac_suspended == 0) {
2604                 b43_write32(dev, B43_MMIO_MACCTL,
2605                             b43_read32(dev, B43_MMIO_MACCTL)
2606                             | B43_MACCTL_ENABLED);
2607                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2608                             B43_IRQ_MAC_SUSPENDED);
2609                 /* Commit writes */
2610                 b43_read32(dev, B43_MMIO_MACCTL);
2611                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2612                 b43_power_saving_ctl_bits(dev, 0);
2613         }
2614 }
2615
2616 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2617 void b43_mac_suspend(struct b43_wldev *dev)
2618 {
2619         int i;
2620         u32 tmp;
2621
2622         might_sleep();
2623         B43_WARN_ON(dev->mac_suspended < 0);
2624
2625         if (dev->mac_suspended == 0) {
2626                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2627                 b43_write32(dev, B43_MMIO_MACCTL,
2628                             b43_read32(dev, B43_MMIO_MACCTL)
2629                             & ~B43_MACCTL_ENABLED);
2630                 /* force pci to flush the write */
2631                 b43_read32(dev, B43_MMIO_MACCTL);
2632                 for (i = 35; i; i--) {
2633                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2634                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2635                                 goto out;
2636                         udelay(10);
2637                 }
2638                 /* Hm, it seems this will take some time. Use msleep(). */
2639                 for (i = 40; i; i--) {
2640                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2641                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2642                                 goto out;
2643                         msleep(1);
2644                 }
2645                 b43err(dev->wl, "MAC suspend failed\n");
2646         }
2647 out:
2648         dev->mac_suspended++;
2649 }
2650
2651 static void b43_adjust_opmode(struct b43_wldev *dev)
2652 {
2653         struct b43_wl *wl = dev->wl;
2654         u32 ctl;
2655         u16 cfp_pretbtt;
2656
2657         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2658         /* Reset status to STA infrastructure mode. */
2659         ctl &= ~B43_MACCTL_AP;
2660         ctl &= ~B43_MACCTL_KEEP_CTL;
2661         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2662         ctl &= ~B43_MACCTL_KEEP_BAD;
2663         ctl &= ~B43_MACCTL_PROMISC;
2664         ctl &= ~B43_MACCTL_BEACPROMISC;
2665         ctl |= B43_MACCTL_INFRA;
2666
2667         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2668             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2669                 ctl |= B43_MACCTL_AP;
2670         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2671                 ctl &= ~B43_MACCTL_INFRA;
2672
2673         if (wl->filter_flags & FIF_CONTROL)
2674                 ctl |= B43_MACCTL_KEEP_CTL;
2675         if (wl->filter_flags & FIF_FCSFAIL)
2676                 ctl |= B43_MACCTL_KEEP_BAD;
2677         if (wl->filter_flags & FIF_PLCPFAIL)
2678                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2679         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2680                 ctl |= B43_MACCTL_PROMISC;
2681         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2682                 ctl |= B43_MACCTL_BEACPROMISC;
2683
2684         /* Workaround: On old hardware the HW-MAC-address-filter
2685          * doesn't work properly, so always run promisc in filter
2686          * it in software. */
2687         if (dev->dev->id.revision <= 4)
2688                 ctl |= B43_MACCTL_PROMISC;
2689
2690         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2691
2692         cfp_pretbtt = 2;
2693         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2694                 if (dev->dev->bus->chip_id == 0x4306 &&
2695                     dev->dev->bus->chip_rev == 3)
2696                         cfp_pretbtt = 100;
2697                 else
2698                         cfp_pretbtt = 50;
2699         }
2700         b43_write16(dev, 0x612, cfp_pretbtt);
2701
2702         /* FIXME: We don't currently implement the PMQ mechanism,
2703          *        so always disable it. If we want to implement PMQ,
2704          *        we need to enable it here (clear DISCPMQ) in AP mode.
2705          */
2706         if (0  /* ctl & B43_MACCTL_AP */) {
2707                 b43_write32(dev, B43_MMIO_MACCTL,
2708                             b43_read32(dev, B43_MMIO_MACCTL)
2709                             & ~B43_MACCTL_DISCPMQ);
2710         } else {
2711                 b43_write32(dev, B43_MMIO_MACCTL,
2712                             b43_read32(dev, B43_MMIO_MACCTL)
2713                             | B43_MACCTL_DISCPMQ);
2714         }
2715 }
2716
2717 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2718 {
2719         u16 offset;
2720
2721         if (is_ofdm) {
2722                 offset = 0x480;
2723                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2724         } else {
2725                 offset = 0x4C0;
2726                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2727         }
2728         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2729                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2730 }
2731
2732 static void b43_rate_memory_init(struct b43_wldev *dev)
2733 {
2734         switch (dev->phy.type) {
2735         case B43_PHYTYPE_A:
2736         case B43_PHYTYPE_G:
2737         case B43_PHYTYPE_N:
2738         case B43_PHYTYPE_LP:
2739                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2740                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2741                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2742                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2743                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2744                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2745                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2746                 if (dev->phy.type == B43_PHYTYPE_A)
2747                         break;
2748                 /* fallthrough */
2749         case B43_PHYTYPE_B:
2750                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2751                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2752                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2753                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2754                 break;
2755         default:
2756                 B43_WARN_ON(1);
2757         }
2758 }
2759
2760 /* Set the default values for the PHY TX Control Words. */
2761 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2762 {
2763         u16 ctl = 0;
2764
2765         ctl |= B43_TXH_PHY_ENC_CCK;
2766         ctl |= B43_TXH_PHY_ANT01AUTO;
2767         ctl |= B43_TXH_PHY_TXPWR;
2768
2769         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2770         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2771         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2772 }
2773
2774 /* Set the TX-Antenna for management frames sent by firmware. */
2775 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2776 {
2777         u16 ant;
2778         u16 tmp;
2779
2780         ant = b43_antenna_to_phyctl(antenna);
2781
2782         /* For ACK/CTS */
2783         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2784         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2785         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2786         /* For Probe Resposes */
2787         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2788         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2789         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2790 }
2791
2792 /* This is the opposite of b43_chip_init() */
2793 static void b43_chip_exit(struct b43_wldev *dev)
2794 {
2795         b43_phy_exit(dev);
2796         b43_gpio_cleanup(dev);
2797         /* firmware is released later */
2798 }
2799
2800 /* Initialize the chip
2801  * http://bcm-specs.sipsolutions.net/ChipInit
2802  */
2803 static int b43_chip_init(struct b43_wldev *dev)
2804 {
2805         struct b43_phy *phy = &dev->phy;
2806         int err;
2807         u32 value32, macctl;
2808         u16 value16;
2809
2810         /* Initialize the MAC control */
2811         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2812         if (dev->phy.gmode)
2813                 macctl |= B43_MACCTL_GMODE;
2814         macctl |= B43_MACCTL_INFRA;
2815         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2816
2817         err = b43_request_firmware(dev);
2818         if (err)
2819                 goto out;
2820         err = b43_upload_microcode(dev);
2821         if (err)
2822                 goto out;       /* firmware is released later */
2823
2824         err = b43_gpio_init(dev);
2825         if (err)
2826                 goto out;       /* firmware is released later */
2827
2828         err = b43_upload_initvals(dev);
2829         if (err)
2830                 goto err_gpio_clean;
2831
2832         /* Turn the Analog on and initialize the PHY. */
2833         phy->ops->switch_analog(dev, 1);
2834         err = b43_phy_init(dev);
2835         if (err)
2836                 goto err_gpio_clean;
2837
2838         /* Disable Interference Mitigation. */
2839         if (phy->ops->interf_mitigation)
2840                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2841
2842         /* Select the antennae */
2843         if (phy->ops->set_rx_antenna)
2844                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2845         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2846
2847         if (phy->type == B43_PHYTYPE_B) {
2848                 value16 = b43_read16(dev, 0x005E);
2849                 value16 |= 0x0004;
2850                 b43_write16(dev, 0x005E, value16);
2851         }
2852         b43_write32(dev, 0x0100, 0x01000000);
2853         if (dev->dev->id.revision < 5)
2854                 b43_write32(dev, 0x010C, 0x01000000);
2855
2856         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2857                     & ~B43_MACCTL_INFRA);
2858         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2859                     | B43_MACCTL_INFRA);
2860
2861         /* Probe Response Timeout value */
2862         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2863         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2864
2865         /* Initially set the wireless operation mode. */
2866         b43_adjust_opmode(dev);
2867
2868         if (dev->dev->id.revision < 3) {
2869                 b43_write16(dev, 0x060E, 0x0000);
2870                 b43_write16(dev, 0x0610, 0x8000);
2871                 b43_write16(dev, 0x0604, 0x0000);
2872                 b43_write16(dev, 0x0606, 0x0200);
2873         } else {
2874                 b43_write32(dev, 0x0188, 0x80000000);
2875                 b43_write32(dev, 0x018C, 0x02000000);
2876         }
2877         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2878         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2879         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2880         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2881         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2882         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2883         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2884
2885         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2886         value32 |= 0x00100000;
2887         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2888
2889         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2890                     dev->dev->bus->chipco.fast_pwrup_delay);
2891
2892         err = 0;
2893         b43dbg(dev->wl, "Chip initialized\n");
2894 out:
2895         return err;
2896
2897 err_gpio_clean:
2898         b43_gpio_cleanup(dev);
2899         return err;
2900 }
2901
2902 static void b43_periodic_every60sec(struct b43_wldev *dev)
2903 {
2904         const struct b43_phy_operations *ops = dev->phy.ops;
2905
2906         if (ops->pwork_60sec)
2907                 ops->pwork_60sec(dev);
2908
2909         /* Force check the TX power emission now. */
2910         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2911 }
2912
2913 static void b43_periodic_every30sec(struct b43_wldev *dev)
2914 {
2915         /* Update device statistics. */
2916         b43_calculate_link_quality(dev);
2917 }
2918
2919 static void b43_periodic_every15sec(struct b43_wldev *dev)
2920 {
2921         struct b43_phy *phy = &dev->phy;
2922         u16 wdr;
2923
2924         if (dev->fw.opensource) {
2925                 /* Check if the firmware is still alive.
2926                  * It will reset the watchdog counter to 0 in its idle loop. */
2927                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2928                 if (unlikely(wdr)) {
2929                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2930                         b43_controller_restart(dev, "Firmware watchdog");
2931                         return;
2932                 } else {
2933                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2934                                         B43_WATCHDOG_REG, 1);
2935                 }
2936         }
2937
2938         if (phy->ops->pwork_15sec)
2939                 phy->ops->pwork_15sec(dev);
2940
2941         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2942         wmb();
2943
2944 #if B43_DEBUG
2945         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2946                 unsigned int i;
2947
2948                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
2949                        dev->irq_count / 15,
2950                        dev->tx_count / 15,
2951                        dev->rx_count / 15);
2952                 dev->irq_count = 0;
2953                 dev->tx_count = 0;
2954                 dev->rx_count = 0;
2955                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2956                         if (dev->irq_bit_count[i]) {
2957                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
2958                                        dev->irq_bit_count[i] / 15, i, (1 << i));
2959                                 dev->irq_bit_count[i] = 0;
2960                         }
2961                 }
2962         }
2963 #endif
2964 }
2965
2966 static void do_periodic_work(struct b43_wldev *dev)
2967 {
2968         unsigned int state;
2969
2970         state = dev->periodic_state;
2971         if (state % 4 == 0)
2972                 b43_periodic_every60sec(dev);
2973         if (state % 2 == 0)
2974                 b43_periodic_every30sec(dev);
2975         b43_periodic_every15sec(dev);
2976 }
2977
2978 /* Periodic work locking policy:
2979  *      The whole periodic work handler is protected by
2980  *      wl->mutex. If another lock is needed somewhere in the
2981  *      pwork callchain, it's acquired in-place, where it's needed.
2982  */
2983 static void b43_periodic_work_handler(struct work_struct *work)
2984 {
2985         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2986                                              periodic_work.work);
2987         struct b43_wl *wl = dev->wl;
2988         unsigned long delay;
2989
2990         mutex_lock(&wl->mutex);
2991
2992         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2993                 goto out;
2994         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2995                 goto out_requeue;
2996
2997         do_periodic_work(dev);
2998
2999         dev->periodic_state++;
3000 out_requeue:
3001         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3002                 delay = msecs_to_jiffies(50);
3003         else
3004                 delay = round_jiffies_relative(HZ * 15);
3005         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3006 out:
3007         mutex_unlock(&wl->mutex);
3008 }
3009
3010 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3011 {
3012         struct delayed_work *work = &dev->periodic_work;
3013
3014         dev->periodic_state = 0;
3015         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3016         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3017 }
3018
3019 /* Check if communication with the device works correctly. */
3020 static int b43_validate_chipaccess(struct b43_wldev *dev)
3021 {
3022         u32 v, backup0, backup4;
3023
3024         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3025         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3026
3027         /* Check for read/write and endianness problems. */
3028         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3029         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3030                 goto error;
3031         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3032         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3033                 goto error;
3034
3035         /* Check if unaligned 32bit SHM_SHARED access works properly.
3036          * However, don't bail out on failure, because it's noncritical. */
3037         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3038         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3039         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3040         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3041         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3042                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3043         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3044         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3045             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3046             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3047             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3048                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3049
3050         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3051         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3052
3053         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
3054                 /* The 32bit register shadows the two 16bit registers
3055                  * with update sideeffects. Validate this. */
3056                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3057                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3058                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3059                         goto error;
3060                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3061                         goto error;
3062         }
3063         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3064
3065         v = b43_read32(dev, B43_MMIO_MACCTL);
3066         v |= B43_MACCTL_GMODE;
3067         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3068                 goto error;
3069
3070         return 0;
3071 error:
3072         b43err(dev->wl, "Failed to validate the chipaccess\n");
3073         return -ENODEV;
3074 }
3075
3076 static void b43_security_init(struct b43_wldev *dev)
3077 {
3078         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3079         /* KTP is a word address, but we address SHM bytewise.
3080          * So multiply by two.
3081          */
3082         dev->ktp *= 2;
3083         /* Number of RCMTA address slots */
3084         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3085         /* Clear the key memory. */
3086         b43_clear_keys(dev);
3087 }
3088
3089 #ifdef CONFIG_B43_HWRNG
3090 static int b43_rng_read(struct hwrng *rng, u32 *data)
3091 {
3092         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3093         struct b43_wldev *dev;
3094         int count = -ENODEV;
3095
3096         mutex_lock(&wl->mutex);
3097         dev = wl->current_dev;
3098         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3099                 *data = b43_read16(dev, B43_MMIO_RNG);
3100                 count = sizeof(u16);
3101         }
3102         mutex_unlock(&wl->mutex);
3103
3104         return count;
3105 }
3106 #endif /* CONFIG_B43_HWRNG */
3107
3108 static void b43_rng_exit(struct b43_wl *wl)
3109 {
3110 #ifdef CONFIG_B43_HWRNG
3111         if (wl->rng_initialized)
3112                 hwrng_unregister(&wl->rng);
3113 #endif /* CONFIG_B43_HWRNG */
3114 }
3115
3116 static int b43_rng_init(struct b43_wl *wl)
3117 {
3118         int err = 0;
3119
3120 #ifdef CONFIG_B43_HWRNG
3121         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3122                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3123         wl->rng.name = wl->rng_name;
3124         wl->rng.data_read = b43_rng_read;
3125         wl->rng.priv = (unsigned long)wl;
3126         wl->rng_initialized = 1;
3127         err = hwrng_register(&wl->rng);
3128         if (err) {
3129                 wl->rng_initialized = 0;
3130                 b43err(wl, "Failed to register the random "
3131                        "number generator (%d)\n", err);
3132         }
3133 #endif /* CONFIG_B43_HWRNG */
3134
3135         return err;
3136 }
3137
3138 static void b43_tx_work(struct work_struct *work)
3139 {
3140         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3141         struct b43_wldev *dev;
3142         struct sk_buff *skb;
3143         int err = 0;
3144
3145         mutex_lock(&wl->mutex);
3146         dev = wl->current_dev;
3147         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3148                 mutex_unlock(&wl->mutex);
3149                 return;
3150         }
3151
3152         while (skb_queue_len(&wl->tx_queue)) {
3153                 skb = skb_dequeue(&wl->tx_queue);
3154
3155                 if (b43_using_pio_transfers(dev))
3156                         err = b43_pio_tx(dev, skb);
3157                 else
3158                         err = b43_dma_tx(dev, skb);
3159                 if (unlikely(err))
3160                         dev_kfree_skb(skb); /* Drop it */
3161         }
3162
3163 #if B43_DEBUG
3164         dev->tx_count++;
3165 #endif
3166         mutex_unlock(&wl->mutex);
3167 }
3168
3169 static int b43_op_tx(struct ieee80211_hw *hw,
3170                      struct sk_buff *skb)
3171 {
3172         struct b43_wl *wl = hw_to_b43_wl(hw);
3173
3174         if (unlikely(skb->len < 2 + 2 + 6)) {
3175                 /* Too short, this can't be a valid frame. */
3176                 dev_kfree_skb_any(skb);
3177                 return NETDEV_TX_OK;
3178         }
3179         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3180
3181         skb_queue_tail(&wl->tx_queue, skb);
3182         ieee80211_queue_work(wl->hw, &wl->tx_work);
3183
3184         return NETDEV_TX_OK;
3185 }
3186
3187 static void b43_qos_params_upload(struct b43_wldev *dev,
3188                                   const struct ieee80211_tx_queue_params *p,
3189                                   u16 shm_offset)
3190 {
3191         u16 params[B43_NR_QOSPARAMS];
3192         int bslots, tmp;
3193         unsigned int i;
3194
3195         if (!dev->qos_enabled)
3196                 return;
3197
3198         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3199
3200         memset(&params, 0, sizeof(params));
3201
3202         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3203         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3204         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3205         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3206         params[B43_QOSPARAM_AIFS] = p->aifs;
3207         params[B43_QOSPARAM_BSLOTS] = bslots;
3208         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3209
3210         for (i = 0; i < ARRAY_SIZE(params); i++) {
3211                 if (i == B43_QOSPARAM_STATUS) {
3212                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3213                                              shm_offset + (i * 2));
3214                         /* Mark the parameters as updated. */
3215                         tmp |= 0x100;
3216                         b43_shm_write16(dev, B43_SHM_SHARED,
3217                                         shm_offset + (i * 2),
3218                                         tmp);
3219                 } else {
3220                         b43_shm_write16(dev, B43_SHM_SHARED,
3221                                         shm_offset + (i * 2),
3222                                         params[i]);
3223                 }
3224         }
3225 }
3226
3227 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3228 static const u16 b43_qos_shm_offsets[] = {
3229         /* [mac80211-queue-nr] = SHM_OFFSET, */
3230         [0] = B43_QOS_VOICE,
3231         [1] = B43_QOS_VIDEO,
3232         [2] = B43_QOS_BESTEFFORT,
3233         [3] = B43_QOS_BACKGROUND,
3234 };
3235
3236 /* Update all QOS parameters in hardware. */
3237 static void b43_qos_upload_all(struct b43_wldev *dev)
3238 {
3239         struct b43_wl *wl = dev->wl;
3240         struct b43_qos_params *params;
3241         unsigned int i;
3242
3243         if (!dev->qos_enabled)
3244                 return;
3245
3246         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3247                      ARRAY_SIZE(wl->qos_params));
3248
3249         b43_mac_suspend(dev);
3250         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3251                 params = &(wl->qos_params[i]);
3252                 b43_qos_params_upload(dev, &(params->p),
3253                                       b43_qos_shm_offsets[i]);
3254         }
3255         b43_mac_enable(dev);
3256 }
3257
3258 static void b43_qos_clear(struct b43_wl *wl)
3259 {
3260         struct b43_qos_params *params;
3261         unsigned int i;
3262
3263         /* Initialize QoS parameters to sane defaults. */
3264
3265         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3266                      ARRAY_SIZE(wl->qos_params));
3267
3268         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3269                 params = &(wl->qos_params[i]);
3270
3271                 switch (b43_qos_shm_offsets[i]) {
3272                 case B43_QOS_VOICE:
3273                         params->p.txop = 0;
3274                         params->p.aifs = 2;
3275                         params->p.cw_min = 0x0001;
3276                         params->p.cw_max = 0x0001;
3277                         break;
3278                 case B43_QOS_VIDEO:
3279                         params->p.txop = 0;
3280                         params->p.aifs = 2;
3281                         params->p.cw_min = 0x0001;
3282                         params->p.cw_max = 0x0001;
3283                         break;
3284                 case B43_QOS_BESTEFFORT:
3285                         params->p.txop = 0;
3286                         params->p.aifs = 3;
3287                         params->p.cw_min = 0x0001;
3288                         params->p.cw_max = 0x03FF;
3289                         break;
3290                 case B43_QOS_BACKGROUND:
3291                         params->p.txop = 0;
3292                         params->p.aifs = 7;
3293                         params->p.cw_min = 0x0001;
3294                         params->p.cw_max = 0x03FF;
3295                         break;
3296                 default:
3297                         B43_WARN_ON(1);
3298                 }
3299         }
3300 }
3301
3302 /* Initialize the core's QOS capabilities */
3303 static void b43_qos_init(struct b43_wldev *dev)
3304 {
3305         if (!dev->qos_enabled) {
3306                 /* Disable QOS support. */
3307                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3308                 b43_write16(dev, B43_MMIO_IFSCTL,
3309                             b43_read16(dev, B43_MMIO_IFSCTL)
3310                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3311                 b43dbg(dev->wl, "QoS disabled\n");
3312                 return;
3313         }
3314
3315         /* Upload the current QOS parameters. */
3316         b43_qos_upload_all(dev);
3317
3318         /* Enable QOS support. */
3319         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3320         b43_write16(dev, B43_MMIO_IFSCTL,
3321                     b43_read16(dev, B43_MMIO_IFSCTL)
3322                     | B43_MMIO_IFSCTL_USE_EDCF);
3323         b43dbg(dev->wl, "QoS enabled\n");
3324 }
3325
3326 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3327                           const struct ieee80211_tx_queue_params *params)
3328 {
3329         struct b43_wl *wl = hw_to_b43_wl(hw);
3330         struct b43_wldev *dev;
3331         unsigned int queue = (unsigned int)_queue;
3332         int err = -ENODEV;
3333
3334         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3335                 /* Queue not available or don't support setting
3336                  * params on this queue. Return success to not
3337                  * confuse mac80211. */
3338                 return 0;
3339         }
3340         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3341                      ARRAY_SIZE(wl->qos_params));
3342
3343         mutex_lock(&wl->mutex);
3344         dev = wl->current_dev;
3345         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3346                 goto out_unlock;
3347
3348         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3349         b43_mac_suspend(dev);
3350         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3351                               b43_qos_shm_offsets[queue]);
3352         b43_mac_enable(dev);
3353         err = 0;
3354
3355 out_unlock:
3356         mutex_unlock(&wl->mutex);
3357
3358         return err;
3359 }
3360
3361 static int b43_op_get_stats(struct ieee80211_hw *hw,
3362                             struct ieee80211_low_level_stats *stats)
3363 {
3364         struct b43_wl *wl = hw_to_b43_wl(hw);
3365
3366         mutex_lock(&wl->mutex);
3367         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3368         mutex_unlock(&wl->mutex);
3369
3370         return 0;
3371 }
3372
3373 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3374 {
3375         struct b43_wl *wl = hw_to_b43_wl(hw);
3376         struct b43_wldev *dev;
3377         u64 tsf;
3378
3379         mutex_lock(&wl->mutex);
3380         dev = wl->current_dev;
3381
3382         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3383                 b43_tsf_read(dev, &tsf);
3384         else
3385                 tsf = 0;
3386
3387         mutex_unlock(&wl->mutex);
3388
3389         return tsf;
3390 }
3391
3392 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3393 {
3394         struct b43_wl *wl = hw_to_b43_wl(hw);
3395         struct b43_wldev *dev;
3396
3397         mutex_lock(&wl->mutex);
3398         dev = wl->current_dev;
3399
3400         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3401                 b43_tsf_write(dev, tsf);
3402
3403         mutex_unlock(&wl->mutex);
3404 }
3405
3406 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3407 {
3408         struct ssb_device *sdev = dev->dev;
3409         u32 tmslow;
3410
3411         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3412         tmslow &= ~B43_TMSLOW_GMODE;
3413         tmslow |= B43_TMSLOW_PHYRESET;
3414         tmslow |= SSB_TMSLOW_FGC;
3415         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3416         msleep(1);
3417
3418         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3419         tmslow &= ~SSB_TMSLOW_FGC;
3420         tmslow |= B43_TMSLOW_PHYRESET;
3421         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3422         msleep(1);
3423 }
3424
3425 static const char *band_to_string(enum ieee80211_band band)
3426 {
3427         switch (band) {
3428         case IEEE80211_BAND_5GHZ:
3429                 return "5";
3430         case IEEE80211_BAND_2GHZ:
3431                 return "2.4";
3432         default:
3433                 break;
3434         }
3435         B43_WARN_ON(1);
3436         return "";
3437 }
3438
3439 /* Expects wl->mutex locked */
3440 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3441 {
3442         struct b43_wldev *up_dev = NULL;
3443         struct b43_wldev *down_dev;
3444         struct b43_wldev *d;
3445         int err;
3446         bool uninitialized_var(gmode);
3447         int prev_status;
3448
3449         /* Find a device and PHY which supports the band. */
3450         list_for_each_entry(d, &wl->devlist, list) {
3451                 switch (chan->band) {
3452                 case IEEE80211_BAND_5GHZ:
3453                         if (d->phy.supports_5ghz) {
3454                                 up_dev = d;
3455                                 gmode = 0;
3456                         }
3457                         break;
3458                 case IEEE80211_BAND_2GHZ:
3459                         if (d->phy.supports_2ghz) {
3460                                 up_dev = d;
3461                                 gmode = 1;
3462                         }
3463                         break;
3464                 default:
3465                         B43_WARN_ON(1);
3466                         return -EINVAL;
3467                 }
3468                 if (up_dev)
3469                         break;
3470         }
3471         if (!up_dev) {
3472                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3473                        band_to_string(chan->band));
3474                 return -ENODEV;
3475         }
3476         if ((up_dev == wl->current_dev) &&
3477             (!!wl->current_dev->phy.gmode == !!gmode)) {
3478                 /* This device is already running. */
3479                 return 0;
3480         }
3481         b43dbg(wl, "Switching to %s-GHz band\n",
3482                band_to_string(chan->band));
3483         down_dev = wl->current_dev;
3484
3485         prev_status = b43_status(down_dev);
3486         /* Shutdown the currently running core. */
3487         if (prev_status >= B43_STAT_STARTED)
3488                 down_dev = b43_wireless_core_stop(down_dev);
3489         if (prev_status >= B43_STAT_INITIALIZED)
3490                 b43_wireless_core_exit(down_dev);
3491
3492         if (down_dev != up_dev) {
3493                 /* We switch to a different core, so we put PHY into
3494                  * RESET on the old core. */
3495                 b43_put_phy_into_reset(down_dev);
3496         }
3497
3498         /* Now start the new core. */
3499         up_dev->phy.gmode = gmode;
3500         if (prev_status >= B43_STAT_INITIALIZED) {
3501                 err = b43_wireless_core_init(up_dev);
3502                 if (err) {
3503                         b43err(wl, "Fatal: Could not initialize device for "
3504                                "selected %s-GHz band\n",
3505                                band_to_string(chan->band));
3506                         goto init_failure;
3507                 }
3508         }
3509         if (prev_status >= B43_STAT_STARTED) {
3510                 err = b43_wireless_core_start(up_dev);
3511                 if (err) {
3512                         b43err(wl, "Fatal: Coult not start device for "
3513                                "selected %s-GHz band\n",
3514                                band_to_string(chan->band));
3515                         b43_wireless_core_exit(up_dev);
3516                         goto init_failure;
3517                 }
3518         }
3519         B43_WARN_ON(b43_status(up_dev) != prev_status);
3520
3521         wl->current_dev = up_dev;
3522
3523         return 0;
3524 init_failure:
3525         /* Whoops, failed to init the new core. No core is operating now. */
3526         wl->current_dev = NULL;
3527         return err;
3528 }
3529
3530 /* Write the short and long frame retry limit values. */
3531 static void b43_set_retry_limits(struct b43_wldev *dev,
3532                                  unsigned int short_retry,
3533                                  unsigned int long_retry)
3534 {
3535         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3536          * the chip-internal counter. */
3537         short_retry = min(short_retry, (unsigned int)0xF);
3538         long_retry = min(long_retry, (unsigned int)0xF);
3539
3540         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3541                         short_retry);
3542         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3543                         long_retry);
3544 }
3545
3546 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3547 {
3548         struct b43_wl *wl = hw_to_b43_wl(hw);
3549         struct b43_wldev *dev;
3550         struct b43_phy *phy;
3551         struct ieee80211_conf *conf = &hw->conf;
3552         int antenna;
3553         int err = 0;
3554
3555         mutex_lock(&wl->mutex);
3556
3557         /* Switch the band (if necessary). This might change the active core. */
3558         err = b43_switch_band(wl, conf->channel);
3559         if (err)
3560                 goto out_unlock_mutex;
3561         dev = wl->current_dev;
3562         phy = &dev->phy;
3563
3564         if (conf_is_ht(conf))
3565                 phy->is_40mhz =
3566                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3567         else
3568                 phy->is_40mhz = false;
3569
3570         b43_mac_suspend(dev);
3571
3572         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3573                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3574                                           conf->long_frame_max_tx_count);
3575         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3576         if (!changed)
3577                 goto out_mac_enable;
3578
3579         /* Switch to the requested channel.
3580          * The firmware takes care of races with the TX handler. */
3581         if (conf->channel->hw_value != phy->channel)
3582                 b43_switch_channel(dev, conf->channel->hw_value);
3583
3584         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3585
3586         /* Adjust the desired TX power level. */
3587         if (conf->power_level != 0) {
3588                 if (conf->power_level != phy->desired_txpower) {
3589                         phy->desired_txpower = conf->power_level;
3590                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3591                                                    B43_TXPWR_IGNORE_TSSI);
3592                 }
3593         }
3594
3595         /* Antennas for RX and management frame TX. */
3596         antenna = B43_ANTENNA_DEFAULT;
3597         b43_mgmtframe_txantenna(dev, antenna);
3598         antenna = B43_ANTENNA_DEFAULT;
3599         if (phy->ops->set_rx_antenna)
3600                 phy->ops->set_rx_antenna(dev, antenna);
3601
3602         if (wl->radio_enabled != phy->radio_on) {
3603                 if (wl->radio_enabled) {
3604                         b43_software_rfkill(dev, false);
3605                         b43info(dev->wl, "Radio turned on by software\n");
3606                         if (!dev->radio_hw_enable) {
3607                                 b43info(dev->wl, "The hardware RF-kill button "
3608                                         "still turns the radio physically off. "
3609                                         "Press the button to turn it on.\n");
3610                         }
3611                 } else {
3612                         b43_software_rfkill(dev, true);
3613                         b43info(dev->wl, "Radio turned off by software\n");
3614                 }
3615         }
3616
3617 out_mac_enable:
3618         b43_mac_enable(dev);
3619 out_unlock_mutex:
3620         mutex_unlock(&wl->mutex);
3621
3622         return err;
3623 }
3624
3625 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3626 {
3627         struct ieee80211_supported_band *sband =
3628                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3629         struct ieee80211_rate *rate;
3630         int i;
3631         u16 basic, direct, offset, basic_offset, rateptr;
3632
3633         for (i = 0; i < sband->n_bitrates; i++) {
3634                 rate = &sband->bitrates[i];
3635
3636                 if (b43_is_cck_rate(rate->hw_value)) {
3637                         direct = B43_SHM_SH_CCKDIRECT;
3638                         basic = B43_SHM_SH_CCKBASIC;
3639                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3640                         offset &= 0xF;
3641                 } else {
3642                         direct = B43_SHM_SH_OFDMDIRECT;
3643                         basic = B43_SHM_SH_OFDMBASIC;
3644                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3645                         offset &= 0xF;
3646                 }
3647
3648                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3649
3650                 if (b43_is_cck_rate(rate->hw_value)) {
3651                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3652                         basic_offset &= 0xF;
3653                 } else {
3654                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3655                         basic_offset &= 0xF;
3656                 }
3657
3658                 /*
3659                  * Get the pointer that we need to point to
3660                  * from the direct map
3661                  */
3662                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3663                                          direct + 2 * basic_offset);
3664                 /* and write it to the basic map */
3665                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3666                                 rateptr);
3667         }
3668 }
3669
3670 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3671                                     struct ieee80211_vif *vif,
3672                                     struct ieee80211_bss_conf *conf,
3673                                     u32 changed)
3674 {
3675         struct b43_wl *wl = hw_to_b43_wl(hw);
3676         struct b43_wldev *dev;
3677
3678         mutex_lock(&wl->mutex);
3679
3680         dev = wl->current_dev;
3681         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3682                 goto out_unlock_mutex;
3683
3684         B43_WARN_ON(wl->vif != vif);
3685
3686         if (changed & BSS_CHANGED_BSSID) {
3687                 if (conf->bssid)
3688                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3689                 else
3690                         memset(wl->bssid, 0, ETH_ALEN);
3691         }
3692
3693         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3694                 if (changed & BSS_CHANGED_BEACON &&
3695                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3696                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3697                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3698                         b43_update_templates(wl);
3699
3700                 if (changed & BSS_CHANGED_BSSID)
3701                         b43_write_mac_bssid_templates(dev);
3702         }
3703
3704         b43_mac_suspend(dev);
3705
3706         /* Update templates for AP/mesh mode. */
3707         if (changed & BSS_CHANGED_BEACON_INT &&
3708             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3709              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3710              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3711                 b43_set_beacon_int(dev, conf->beacon_int);
3712
3713         if (changed & BSS_CHANGED_BASIC_RATES)
3714                 b43_update_basic_rates(dev, conf->basic_rates);
3715
3716         if (changed & BSS_CHANGED_ERP_SLOT) {
3717                 if (conf->use_short_slot)
3718                         b43_short_slot_timing_enable(dev);
3719                 else
3720                         b43_short_slot_timing_disable(dev);
3721         }
3722
3723         b43_mac_enable(dev);
3724 out_unlock_mutex:
3725         mutex_unlock(&wl->mutex);
3726 }
3727
3728 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3729                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3730                           struct ieee80211_key_conf *key)
3731 {
3732         struct b43_wl *wl = hw_to_b43_wl(hw);
3733         struct b43_wldev *dev;
3734         u8 algorithm;
3735         u8 index;
3736         int err;
3737         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3738
3739         if (modparam_nohwcrypt)
3740                 return -ENOSPC; /* User disabled HW-crypto */
3741
3742         mutex_lock(&wl->mutex);
3743
3744         dev = wl->current_dev;
3745         err = -ENODEV;
3746         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3747                 goto out_unlock;
3748
3749         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3750                 /* We don't have firmware for the crypto engine.
3751                  * Must use software-crypto. */
3752                 err = -EOPNOTSUPP;
3753                 goto out_unlock;
3754         }
3755
3756         err = -EINVAL;
3757         switch (key->alg) {
3758         case ALG_WEP:
3759                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3760                         algorithm = B43_SEC_ALGO_WEP40;
3761                 else
3762                         algorithm = B43_SEC_ALGO_WEP104;
3763                 break;
3764         case ALG_TKIP:
3765                 algorithm = B43_SEC_ALGO_TKIP;
3766                 break;
3767         case ALG_CCMP:
3768                 algorithm = B43_SEC_ALGO_AES;
3769                 break;
3770         default:
3771                 B43_WARN_ON(1);
3772                 goto out_unlock;
3773         }
3774         index = (u8) (key->keyidx);
3775         if (index > 3)
3776                 goto out_unlock;
3777
3778         switch (cmd) {
3779         case SET_KEY:
3780                 if (algorithm == B43_SEC_ALGO_TKIP &&
3781                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3782                     !modparam_hwtkip)) {
3783                         /* We support only pairwise key */
3784                         err = -EOPNOTSUPP;
3785                         goto out_unlock;
3786                 }
3787
3788                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3789                         if (WARN_ON(!sta)) {
3790                                 err = -EOPNOTSUPP;
3791                                 goto out_unlock;
3792                         }
3793                         /* Pairwise key with an assigned MAC address. */
3794                         err = b43_key_write(dev, -1, algorithm,
3795                                             key->key, key->keylen,
3796                                             sta->addr, key);
3797                 } else {
3798                         /* Group key */
3799                         err = b43_key_write(dev, index, algorithm,
3800                                             key->key, key->keylen, NULL, key);
3801                 }
3802                 if (err)
3803                         goto out_unlock;
3804
3805                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3806                     algorithm == B43_SEC_ALGO_WEP104) {
3807                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3808                 } else {
3809                         b43_hf_write(dev,
3810                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3811                 }
3812                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3813                 if (algorithm == B43_SEC_ALGO_TKIP)
3814                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3815                 break;
3816         case DISABLE_KEY: {
3817                 err = b43_key_clear(dev, key->hw_key_idx);
3818                 if (err)
3819                         goto out_unlock;
3820                 break;
3821         }
3822         default:
3823                 B43_WARN_ON(1);
3824         }
3825
3826 out_unlock:
3827         if (!err) {
3828                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3829                        "mac: %pM\n",
3830                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3831                        sta ? sta->addr : bcast_addr);
3832                 b43_dump_keymemory(dev);
3833         }
3834         mutex_unlock(&wl->mutex);
3835
3836         return err;
3837 }
3838
3839 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3840                                     unsigned int changed, unsigned int *fflags,
3841                                     u64 multicast)
3842 {
3843         struct b43_wl *wl = hw_to_b43_wl(hw);
3844         struct b43_wldev *dev;
3845
3846         mutex_lock(&wl->mutex);
3847         dev = wl->current_dev;
3848         if (!dev) {
3849                 *fflags = 0;
3850                 goto out_unlock;
3851         }
3852
3853         *fflags &= FIF_PROMISC_IN_BSS |
3854                   FIF_ALLMULTI |
3855                   FIF_FCSFAIL |
3856                   FIF_PLCPFAIL |
3857                   FIF_CONTROL |
3858                   FIF_OTHER_BSS |
3859                   FIF_BCN_PRBRESP_PROMISC;
3860
3861         changed &= FIF_PROMISC_IN_BSS |
3862                    FIF_ALLMULTI |
3863                    FIF_FCSFAIL |
3864                    FIF_PLCPFAIL |
3865                    FIF_CONTROL |
3866                    FIF_OTHER_BSS |
3867                    FIF_BCN_PRBRESP_PROMISC;
3868
3869         wl->filter_flags = *fflags;
3870
3871         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3872                 b43_adjust_opmode(dev);
3873
3874 out_unlock:
3875         mutex_unlock(&wl->mutex);
3876 }
3877
3878 /* Locking: wl->mutex
3879  * Returns the current dev. This might be different from the passed in dev,
3880  * because the core might be gone away while we unlocked the mutex. */
3881 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3882 {
3883         struct b43_wl *wl = dev->wl;
3884         struct b43_wldev *orig_dev;
3885         u32 mask;
3886
3887 redo:
3888         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3889                 return dev;
3890
3891         /* Cancel work. Unlock to avoid deadlocks. */
3892         mutex_unlock(&wl->mutex);
3893         cancel_delayed_work_sync(&dev->periodic_work);
3894         cancel_work_sync(&wl->tx_work);
3895         mutex_lock(&wl->mutex);
3896         dev = wl->current_dev;
3897         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
3898                 /* Whoops, aliens ate up the device while we were unlocked. */
3899                 return dev;
3900         }
3901
3902         /* Disable interrupts on the device. */
3903         b43_set_status(dev, B43_STAT_INITIALIZED);
3904         if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
3905                 /* wl->mutex is locked. That is enough. */
3906                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3907                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3908         } else {
3909                 spin_lock_irq(&wl->hardirq_lock);
3910                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3911                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3912                 spin_unlock_irq(&wl->hardirq_lock);
3913         }
3914         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
3915         orig_dev = dev;
3916         mutex_unlock(&wl->mutex);
3917         if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
3918                 b43_sdio_free_irq(dev);
3919         } else {
3920                 synchronize_irq(dev->dev->irq);
3921                 free_irq(dev->dev->irq, dev);
3922         }
3923         mutex_lock(&wl->mutex);
3924         dev = wl->current_dev;
3925         if (!dev)
3926                 return dev;
3927         if (dev != orig_dev) {
3928                 if (b43_status(dev) >= B43_STAT_STARTED)
3929                         goto redo;
3930                 return dev;
3931         }
3932         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
3933         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
3934
3935         /* Drain the TX queue */
3936         while (skb_queue_len(&wl->tx_queue))
3937                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
3938
3939         b43_mac_suspend(dev);
3940         b43_leds_exit(dev);
3941         b43dbg(wl, "Wireless interface stopped\n");
3942
3943         return dev;
3944 }
3945
3946 /* Locking: wl->mutex */
3947 static int b43_wireless_core_start(struct b43_wldev *dev)
3948 {
3949         int err;
3950
3951         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3952
3953         drain_txstatus_queue(dev);
3954         if (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) {
3955                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
3956                 if (err) {
3957                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
3958                         goto out;
3959                 }
3960         } else {
3961                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
3962                                            b43_interrupt_thread_handler,
3963                                            IRQF_SHARED, KBUILD_MODNAME, dev);
3964                 if (err) {
3965                         b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3966                         goto out;
3967                 }
3968         }
3969
3970         /* We are ready to run. */
3971         ieee80211_wake_queues(dev->wl->hw);
3972         b43_set_status(dev, B43_STAT_STARTED);
3973
3974         /* Start data flow (TX/RX). */
3975         b43_mac_enable(dev);
3976         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3977
3978         /* Start maintainance work */
3979         b43_periodic_tasks_setup(dev);
3980
3981         b43_leds_init(dev);
3982
3983         b43dbg(dev->wl, "Wireless interface started\n");
3984 out:
3985         return err;
3986 }
3987
3988 /* Get PHY and RADIO versioning numbers */
3989 static int b43_phy_versioning(struct b43_wldev *dev)
3990 {
3991         struct b43_phy *phy = &dev->phy;
3992         u32 tmp;
3993         u8 analog_type;
3994         u8 phy_type;
3995         u8 phy_rev;
3996         u16 radio_manuf;
3997         u16 radio_ver;
3998         u16 radio_rev;
3999         int unsupported = 0;
4000
4001         /* Get PHY versioning */
4002         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4003         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4004         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4005         phy_rev = (tmp & B43_PHYVER_VERSION);
4006         switch (phy_type) {
4007         case B43_PHYTYPE_A:
4008                 if (phy_rev >= 4)
4009                         unsupported = 1;
4010                 break;
4011         case B43_PHYTYPE_B:
4012                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4013                     && phy_rev != 7)
4014                         unsupported = 1;
4015                 break;
4016         case B43_PHYTYPE_G:
4017                 if (phy_rev > 9)
4018                         unsupported = 1;
4019                 break;
4020 #ifdef CONFIG_B43_NPHY
4021         case B43_PHYTYPE_N:
4022                 if (phy_rev > 4)
4023                         unsupported = 1;
4024                 break;
4025 #endif
4026 #ifdef CONFIG_B43_PHY_LP
4027         case B43_PHYTYPE_LP:
4028                 if (phy_rev > 2)
4029                         unsupported = 1;
4030                 break;
4031 #endif
4032         default:
4033                 unsupported = 1;
4034         };
4035         if (unsupported) {
4036                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4037                        "(Analog %u, Type %u, Revision %u)\n",
4038                        analog_type, phy_type, phy_rev);
4039                 return -EOPNOTSUPP;
4040         }
4041         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4042                analog_type, phy_type, phy_rev);
4043
4044         /* Get RADIO versioning */
4045         if (dev->dev->bus->chip_id == 0x4317) {
4046                 if (dev->dev->bus->chip_rev == 0)
4047                         tmp = 0x3205017F;
4048                 else if (dev->dev->bus->chip_rev == 1)
4049                         tmp = 0x4205017F;
4050                 else
4051                         tmp = 0x5205017F;
4052         } else {
4053                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4054                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4055                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4056                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4057         }
4058         radio_manuf = (tmp & 0x00000FFF);
4059         radio_ver = (tmp & 0x0FFFF000) >> 12;
4060         radio_rev = (tmp & 0xF0000000) >> 28;
4061         if (radio_manuf != 0x17F /* Broadcom */)
4062                 unsupported = 1;
4063         switch (phy_type) {
4064         case B43_PHYTYPE_A:
4065                 if (radio_ver != 0x2060)
4066                         unsupported = 1;
4067                 if (radio_rev != 1)
4068                         unsupported = 1;
4069                 if (radio_manuf != 0x17F)
4070                         unsupported = 1;
4071                 break;
4072         case B43_PHYTYPE_B:
4073                 if ((radio_ver & 0xFFF0) != 0x2050)
4074                         unsupported = 1;
4075                 break;
4076         case B43_PHYTYPE_G:
4077                 if (radio_ver != 0x2050)
4078                         unsupported = 1;
4079                 break;
4080         case B43_PHYTYPE_N:
4081                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4082                         unsupported = 1;
4083                 break;
4084         case B43_PHYTYPE_LP:
4085                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4086                         unsupported = 1;
4087                 break;
4088         default:
4089                 B43_WARN_ON(1);
4090         }
4091         if (unsupported) {
4092                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4093                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4094                        radio_manuf, radio_ver, radio_rev);
4095                 return -EOPNOTSUPP;
4096         }
4097         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4098                radio_manuf, radio_ver, radio_rev);
4099
4100         phy->radio_manuf = radio_manuf;
4101         phy->radio_ver = radio_ver;
4102         phy->radio_rev = radio_rev;
4103
4104         phy->analog = analog_type;
4105         phy->type = phy_type;
4106         phy->rev = phy_rev;
4107
4108         return 0;
4109 }
4110
4111 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4112                                       struct b43_phy *phy)
4113 {
4114         phy->hardware_power_control = !!modparam_hwpctl;
4115         phy->next_txpwr_check_time = jiffies;
4116         /* PHY TX errors counter. */
4117         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4118
4119 #if B43_DEBUG
4120         phy->phy_locked = 0;
4121         phy->radio_locked = 0;
4122 #endif
4123 }
4124
4125 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4126 {
4127         dev->dfq_valid = 0;
4128
4129         /* Assume the radio is enabled. If it's not enabled, the state will
4130          * immediately get fixed on the first periodic work run. */
4131         dev->radio_hw_enable = 1;
4132
4133         /* Stats */
4134         memset(&dev->stats, 0, sizeof(dev->stats));
4135
4136         setup_struct_phy_for_init(dev, &dev->phy);
4137
4138         /* IRQ related flags */
4139         dev->irq_reason = 0;
4140         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4141         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4142         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4143                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4144
4145         dev->mac_suspended = 1;
4146
4147         /* Noise calculation context */
4148         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4149 }
4150
4151 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4152 {
4153         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
4154         u64 hf;
4155
4156         if (!modparam_btcoex)
4157                 return;
4158         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4159                 return;
4160         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4161                 return;
4162
4163         hf = b43_hf_read(dev);
4164         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4165                 hf |= B43_HF_BTCOEXALT;
4166         else
4167                 hf |= B43_HF_BTCOEX;
4168         b43_hf_write(dev, hf);
4169 }
4170
4171 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4172 {
4173         if (!modparam_btcoex)
4174                 return;
4175         //TODO
4176 }
4177
4178 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4179 {
4180 #ifdef CONFIG_SSB_DRIVER_PCICORE
4181         struct ssb_bus *bus = dev->dev->bus;
4182         u32 tmp;
4183
4184         if (bus->pcicore.dev &&
4185             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
4186             bus->pcicore.dev->id.revision <= 5) {
4187                 /* IMCFGLO timeouts workaround. */
4188                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
4189                 switch (bus->bustype) {
4190                 case SSB_BUSTYPE_PCI:
4191                 case SSB_BUSTYPE_PCMCIA:
4192                         tmp &= ~SSB_IMCFGLO_REQTO;
4193                         tmp &= ~SSB_IMCFGLO_SERTO;
4194                         tmp |= 0x32;
4195                         break;
4196                 case SSB_BUSTYPE_SSB:
4197                         tmp &= ~SSB_IMCFGLO_REQTO;
4198                         tmp &= ~SSB_IMCFGLO_SERTO;
4199                         tmp |= 0x53;
4200                         break;
4201                 default:
4202                         break;
4203                 }
4204                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
4205         }
4206 #endif /* CONFIG_SSB_DRIVER_PCICORE */
4207 }
4208
4209 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4210 {
4211         u16 pu_delay;
4212
4213         /* The time value is in microseconds. */
4214         if (dev->phy.type == B43_PHYTYPE_A)
4215                 pu_delay = 3700;
4216         else
4217                 pu_delay = 1050;
4218         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4219                 pu_delay = 500;
4220         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4221                 pu_delay = max(pu_delay, (u16)2400);
4222
4223         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4224 }
4225
4226 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4227 static void b43_set_pretbtt(struct b43_wldev *dev)
4228 {
4229         u16 pretbtt;
4230
4231         /* The time value is in microseconds. */
4232         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4233                 pretbtt = 2;
4234         } else {
4235                 if (dev->phy.type == B43_PHYTYPE_A)
4236                         pretbtt = 120;
4237                 else
4238                         pretbtt = 250;
4239         }
4240         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4241         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4242 }
4243
4244 /* Shutdown a wireless core */
4245 /* Locking: wl->mutex */
4246 static void b43_wireless_core_exit(struct b43_wldev *dev)
4247 {
4248         u32 macctl;
4249
4250         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4251         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4252                 return;
4253         b43_set_status(dev, B43_STAT_UNINIT);
4254
4255         /* Stop the microcode PSM. */
4256         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4257         macctl &= ~B43_MACCTL_PSM_RUN;
4258         macctl |= B43_MACCTL_PSM_JMP0;
4259         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4260
4261         b43_dma_free(dev);
4262         b43_pio_free(dev);
4263         b43_chip_exit(dev);
4264         dev->phy.ops->switch_analog(dev, 0);
4265         if (dev->wl->current_beacon) {
4266                 dev_kfree_skb_any(dev->wl->current_beacon);
4267                 dev->wl->current_beacon = NULL;
4268         }
4269
4270         ssb_device_disable(dev->dev, 0);
4271         ssb_bus_may_powerdown(dev->dev->bus);
4272 }
4273
4274 /* Initialize a wireless core */
4275 static int b43_wireless_core_init(struct b43_wldev *dev)
4276 {
4277         struct ssb_bus *bus = dev->dev->bus;
4278         struct ssb_sprom *sprom = &bus->sprom;
4279         struct b43_phy *phy = &dev->phy;
4280         int err;
4281         u64 hf;
4282         u32 tmp;
4283
4284         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4285
4286         err = ssb_bus_powerup(bus, 0);
4287         if (err)
4288                 goto out;
4289         if (!ssb_device_is_enabled(dev->dev)) {
4290                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4291                 b43_wireless_core_reset(dev, tmp);
4292         }
4293
4294         /* Reset all data structures. */
4295         setup_struct_wldev_for_init(dev);
4296         phy->ops->prepare_structs(dev);
4297
4298         /* Enable IRQ routing to this device. */
4299         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4300
4301         b43_imcfglo_timeouts_workaround(dev);
4302         b43_bluetooth_coext_disable(dev);
4303         if (phy->ops->prepare_hardware) {
4304                 err = phy->ops->prepare_hardware(dev);
4305                 if (err)
4306                         goto err_busdown;
4307         }
4308         err = b43_chip_init(dev);
4309         if (err)
4310                 goto err_busdown;
4311         b43_shm_write16(dev, B43_SHM_SHARED,
4312                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4313         hf = b43_hf_read(dev);
4314         if (phy->type == B43_PHYTYPE_G) {
4315                 hf |= B43_HF_SYMW;
4316                 if (phy->rev == 1)
4317                         hf |= B43_HF_GDCW;
4318                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4319                         hf |= B43_HF_OFDMPABOOST;
4320         }
4321         if (phy->radio_ver == 0x2050) {
4322                 if (phy->radio_rev == 6)
4323                         hf |= B43_HF_4318TSSI;
4324                 if (phy->radio_rev < 6)
4325                         hf |= B43_HF_VCORECALC;
4326         }
4327         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4328                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4329 #ifdef CONFIG_SSB_DRIVER_PCICORE
4330         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4331             (bus->pcicore.dev->id.revision <= 10))
4332                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4333 #endif
4334         hf &= ~B43_HF_SKCFPUP;
4335         b43_hf_write(dev, hf);
4336
4337         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4338                              B43_DEFAULT_LONG_RETRY_LIMIT);
4339         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4340         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4341
4342         /* Disable sending probe responses from firmware.
4343          * Setting the MaxTime to one usec will always trigger
4344          * a timeout, so we never send any probe resp.
4345          * A timeout of zero is infinite. */
4346         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4347
4348         b43_rate_memory_init(dev);
4349         b43_set_phytxctl_defaults(dev);
4350
4351         /* Minimum Contention Window */
4352         if (phy->type == B43_PHYTYPE_B) {
4353                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4354         } else {
4355                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4356         }
4357         /* Maximum Contention Window */
4358         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4359
4360         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) ||
4361             (dev->dev->bus->bustype == SSB_BUSTYPE_SDIO) ||
4362             dev->use_pio) {
4363                 dev->__using_pio_transfers = 1;
4364                 err = b43_pio_init(dev);
4365         } else {
4366                 dev->__using_pio_transfers = 0;
4367                 err = b43_dma_init(dev);
4368         }
4369         if (err)
4370                 goto err_chip_exit;
4371         b43_qos_init(dev);
4372         b43_set_synth_pu_delay(dev, 1);
4373         b43_bluetooth_coext_enable(dev);
4374
4375         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4376         b43_upload_card_macaddress(dev);
4377         b43_security_init(dev);
4378
4379         ieee80211_wake_queues(dev->wl->hw);
4380
4381         b43_set_status(dev, B43_STAT_INITIALIZED);
4382
4383 out:
4384         return err;
4385
4386 err_chip_exit:
4387         b43_chip_exit(dev);
4388 err_busdown:
4389         ssb_bus_may_powerdown(bus);
4390         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4391         return err;
4392 }
4393
4394 static int b43_op_add_interface(struct ieee80211_hw *hw,
4395                                 struct ieee80211_vif *vif)
4396 {
4397         struct b43_wl *wl = hw_to_b43_wl(hw);
4398         struct b43_wldev *dev;
4399         int err = -EOPNOTSUPP;
4400
4401         /* TODO: allow WDS/AP devices to coexist */
4402
4403         if (vif->type != NL80211_IFTYPE_AP &&
4404             vif->type != NL80211_IFTYPE_MESH_POINT &&
4405             vif->type != NL80211_IFTYPE_STATION &&
4406             vif->type != NL80211_IFTYPE_WDS &&
4407             vif->type != NL80211_IFTYPE_ADHOC)
4408                 return -EOPNOTSUPP;
4409
4410         mutex_lock(&wl->mutex);
4411         if (wl->operating)
4412                 goto out_mutex_unlock;
4413
4414         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4415
4416         dev = wl->current_dev;
4417         wl->operating = 1;
4418         wl->vif = vif;
4419         wl->if_type = vif->type;
4420         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4421
4422         b43_adjust_opmode(dev);
4423         b43_set_pretbtt(dev);
4424         b43_set_synth_pu_delay(dev, 0);
4425         b43_upload_card_macaddress(dev);
4426
4427         err = 0;
4428  out_mutex_unlock:
4429         mutex_unlock(&wl->mutex);
4430
4431         return err;
4432 }
4433
4434 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4435                                     struct ieee80211_vif *vif)
4436 {
4437         struct b43_wl *wl = hw_to_b43_wl(hw);
4438         struct b43_wldev *dev = wl->current_dev;
4439
4440         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4441
4442         mutex_lock(&wl->mutex);
4443
4444         B43_WARN_ON(!wl->operating);
4445         B43_WARN_ON(wl->vif != vif);
4446         wl->vif = NULL;
4447
4448         wl->operating = 0;
4449
4450         b43_adjust_opmode(dev);
4451         memset(wl->mac_addr, 0, ETH_ALEN);
4452         b43_upload_card_macaddress(dev);
4453
4454         mutex_unlock(&wl->mutex);
4455 }
4456
4457 static int b43_op_start(struct ieee80211_hw *hw)
4458 {
4459         struct b43_wl *wl = hw_to_b43_wl(hw);
4460         struct b43_wldev *dev = wl->current_dev;
4461         int did_init = 0;
4462         int err = 0;
4463
4464         /* Kill all old instance specific information to make sure
4465          * the card won't use it in the short timeframe between start
4466          * and mac80211 reconfiguring it. */
4467         memset(wl->bssid, 0, ETH_ALEN);
4468         memset(wl->mac_addr, 0, ETH_ALEN);
4469         wl->filter_flags = 0;
4470         wl->radiotap_enabled = 0;
4471         b43_qos_clear(wl);
4472         wl->beacon0_uploaded = 0;
4473         wl->beacon1_uploaded = 0;
4474         wl->beacon_templates_virgin = 1;
4475         wl->radio_enabled = 1;
4476
4477         mutex_lock(&wl->mutex);
4478
4479         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4480                 err = b43_wireless_core_init(dev);
4481                 if (err)
4482                         goto out_mutex_unlock;
4483                 did_init = 1;
4484         }
4485
4486         if (b43_status(dev) < B43_STAT_STARTED) {
4487                 err = b43_wireless_core_start(dev);
4488                 if (err) {
4489                         if (did_init)
4490                                 b43_wireless_core_exit(dev);
4491                         goto out_mutex_unlock;
4492                 }
4493         }
4494
4495         /* XXX: only do if device doesn't support rfkill irq */
4496         wiphy_rfkill_start_polling(hw->wiphy);
4497
4498  out_mutex_unlock:
4499         mutex_unlock(&wl->mutex);
4500
4501         return err;
4502 }
4503
4504 static void b43_op_stop(struct ieee80211_hw *hw)
4505 {
4506         struct b43_wl *wl = hw_to_b43_wl(hw);
4507         struct b43_wldev *dev = wl->current_dev;
4508
4509         cancel_work_sync(&(wl->beacon_update_trigger));
4510
4511         mutex_lock(&wl->mutex);
4512         if (b43_status(dev) >= B43_STAT_STARTED) {
4513                 dev = b43_wireless_core_stop(dev);
4514                 if (!dev)
4515                         goto out_unlock;
4516         }
4517         b43_wireless_core_exit(dev);
4518         wl->radio_enabled = 0;
4519
4520 out_unlock:
4521         mutex_unlock(&wl->mutex);
4522
4523         cancel_work_sync(&(wl->txpower_adjust_work));
4524 }
4525
4526 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4527                                  struct ieee80211_sta *sta, bool set)
4528 {
4529         struct b43_wl *wl = hw_to_b43_wl(hw);
4530
4531         /* FIXME: add locking */
4532         b43_update_templates(wl);
4533
4534         return 0;
4535 }
4536
4537 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4538                               struct ieee80211_vif *vif,
4539                               enum sta_notify_cmd notify_cmd,
4540                               struct ieee80211_sta *sta)
4541 {
4542         struct b43_wl *wl = hw_to_b43_wl(hw);
4543
4544         B43_WARN_ON(!vif || wl->vif != vif);
4545 }
4546
4547 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4548 {
4549         struct b43_wl *wl = hw_to_b43_wl(hw);
4550         struct b43_wldev *dev;
4551
4552         mutex_lock(&wl->mutex);
4553         dev = wl->current_dev;
4554         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4555                 /* Disable CFP update during scan on other channels. */
4556                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4557         }
4558         mutex_unlock(&wl->mutex);
4559 }
4560
4561 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4562 {
4563         struct b43_wl *wl = hw_to_b43_wl(hw);
4564         struct b43_wldev *dev;
4565
4566         mutex_lock(&wl->mutex);
4567         dev = wl->current_dev;
4568         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4569                 /* Re-enable CFP update. */
4570                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4571         }
4572         mutex_unlock(&wl->mutex);
4573 }
4574
4575 static const struct ieee80211_ops b43_hw_ops = {
4576         .tx                     = b43_op_tx,
4577         .conf_tx                = b43_op_conf_tx,
4578         .add_interface          = b43_op_add_interface,
4579         .remove_interface       = b43_op_remove_interface,
4580         .config                 = b43_op_config,
4581         .bss_info_changed       = b43_op_bss_info_changed,
4582         .configure_filter       = b43_op_configure_filter,
4583         .set_key                = b43_op_set_key,
4584         .update_tkip_key        = b43_op_update_tkip_key,
4585         .get_stats              = b43_op_get_stats,
4586         .get_tsf                = b43_op_get_tsf,
4587         .set_tsf                = b43_op_set_tsf,
4588         .start                  = b43_op_start,
4589         .stop                   = b43_op_stop,
4590         .set_tim                = b43_op_beacon_set_tim,
4591         .sta_notify             = b43_op_sta_notify,
4592         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4593         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4594         .rfkill_poll            = b43_rfkill_poll,
4595 };
4596
4597 /* Hard-reset the chip. Do not call this directly.
4598  * Use b43_controller_restart()
4599  */
4600 static void b43_chip_reset(struct work_struct *work)
4601 {
4602         struct b43_wldev *dev =
4603             container_of(work, struct b43_wldev, restart_work);
4604         struct b43_wl *wl = dev->wl;
4605         int err = 0;
4606         int prev_status;
4607
4608         mutex_lock(&wl->mutex);
4609
4610         prev_status = b43_status(dev);
4611         /* Bring the device down... */
4612         if (prev_status >= B43_STAT_STARTED) {
4613                 dev = b43_wireless_core_stop(dev);
4614                 if (!dev) {
4615                         err = -ENODEV;
4616                         goto out;
4617                 }
4618         }
4619         if (prev_status >= B43_STAT_INITIALIZED)
4620                 b43_wireless_core_exit(dev);
4621
4622         /* ...and up again. */
4623         if (prev_status >= B43_STAT_INITIALIZED) {
4624                 err = b43_wireless_core_init(dev);
4625                 if (err)
4626                         goto out;
4627         }
4628         if (prev_status >= B43_STAT_STARTED) {
4629                 err = b43_wireless_core_start(dev);
4630                 if (err) {
4631                         b43_wireless_core_exit(dev);
4632                         goto out;
4633                 }
4634         }
4635 out:
4636         if (err)
4637                 wl->current_dev = NULL; /* Failed to init the dev. */
4638         mutex_unlock(&wl->mutex);
4639         if (err)
4640                 b43err(wl, "Controller restart FAILED\n");
4641         else
4642                 b43info(wl, "Controller restarted\n");
4643 }
4644
4645 static int b43_setup_bands(struct b43_wldev *dev,
4646                            bool have_2ghz_phy, bool have_5ghz_phy)
4647 {
4648         struct ieee80211_hw *hw = dev->wl->hw;
4649
4650         if (have_2ghz_phy)
4651                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4652         if (dev->phy.type == B43_PHYTYPE_N) {
4653                 if (have_5ghz_phy)
4654                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4655         } else {
4656                 if (have_5ghz_phy)
4657                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4658         }
4659
4660         dev->phy.supports_2ghz = have_2ghz_phy;
4661         dev->phy.supports_5ghz = have_5ghz_phy;
4662
4663         return 0;
4664 }
4665
4666 static void b43_wireless_core_detach(struct b43_wldev *dev)
4667 {
4668         /* We release firmware that late to not be required to re-request
4669          * is all the time when we reinit the core. */
4670         b43_release_firmware(dev);
4671         b43_phy_free(dev);
4672 }
4673
4674 static int b43_wireless_core_attach(struct b43_wldev *dev)
4675 {
4676         struct b43_wl *wl = dev->wl;
4677         struct ssb_bus *bus = dev->dev->bus;
4678         struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
4679         int err;
4680         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4681         u32 tmp;
4682
4683         /* Do NOT do any device initialization here.
4684          * Do it in wireless_core_init() instead.
4685          * This function is for gathering basic information about the HW, only.
4686          * Also some structs may be set up here. But most likely you want to have
4687          * that in core_init(), too.
4688          */
4689
4690         err = ssb_bus_powerup(bus, 0);
4691         if (err) {
4692                 b43err(wl, "Bus powerup failed\n");
4693                 goto out;
4694         }
4695         /* Get the PHY type. */
4696         if (dev->dev->id.revision >= 5) {
4697                 u32 tmshigh;
4698
4699                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4700                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4701                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4702         } else
4703                 B43_WARN_ON(1);
4704
4705         dev->phy.gmode = have_2ghz_phy;
4706         dev->phy.radio_on = 1;
4707         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4708         b43_wireless_core_reset(dev, tmp);
4709
4710         err = b43_phy_versioning(dev);
4711         if (err)
4712                 goto err_powerdown;
4713         /* Check if this device supports multiband. */
4714         if (!pdev ||
4715             (pdev->device != 0x4312 &&
4716              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4717                 /* No multiband support. */
4718                 have_2ghz_phy = 0;
4719                 have_5ghz_phy = 0;
4720                 switch (dev->phy.type) {
4721                 case B43_PHYTYPE_A:
4722                         have_5ghz_phy = 1;
4723                         break;
4724                 case B43_PHYTYPE_LP: //FIXME not always!
4725 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4726                         have_5ghz_phy = 1;
4727 #endif
4728                 case B43_PHYTYPE_G:
4729                 case B43_PHYTYPE_N:
4730                         have_2ghz_phy = 1;
4731                         break;
4732                 default:
4733                         B43_WARN_ON(1);
4734                 }
4735         }
4736         if (dev->phy.type == B43_PHYTYPE_A) {
4737                 /* FIXME */
4738                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4739                 err = -EOPNOTSUPP;
4740                 goto err_powerdown;
4741         }
4742         if (1 /* disable A-PHY */) {
4743                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4744                 if (dev->phy.type != B43_PHYTYPE_N &&
4745                     dev->phy.type != B43_PHYTYPE_LP) {
4746                         have_2ghz_phy = 1;
4747                         have_5ghz_phy = 0;
4748                 }
4749         }
4750
4751         err = b43_phy_allocate(dev);
4752         if (err)
4753                 goto err_powerdown;
4754
4755         dev->phy.gmode = have_2ghz_phy;
4756         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4757         b43_wireless_core_reset(dev, tmp);
4758
4759         err = b43_validate_chipaccess(dev);
4760         if (err)
4761                 goto err_phy_free;
4762         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4763         if (err)
4764                 goto err_phy_free;
4765
4766         /* Now set some default "current_dev" */
4767         if (!wl->current_dev)
4768                 wl->current_dev = dev;
4769         INIT_WORK(&dev->restart_work, b43_chip_reset);
4770
4771         dev->phy.ops->switch_analog(dev, 0);
4772         ssb_device_disable(dev->dev, 0);
4773         ssb_bus_may_powerdown(bus);
4774
4775 out:
4776         return err;
4777
4778 err_phy_free:
4779         b43_phy_free(dev);
4780 err_powerdown:
4781         ssb_bus_may_powerdown(bus);
4782         return err;
4783 }
4784
4785 static void b43_one_core_detach(struct ssb_device *dev)
4786 {
4787         struct b43_wldev *wldev;
4788         struct b43_wl *wl;
4789
4790         /* Do not cancel ieee80211-workqueue based work here.
4791          * See comment in b43_remove(). */
4792
4793         wldev = ssb_get_drvdata(dev);
4794         wl = wldev->wl;
4795         b43_debugfs_remove_device(wldev);
4796         b43_wireless_core_detach(wldev);
4797         list_del(&wldev->list);
4798         wl->nr_devs--;
4799         ssb_set_drvdata(dev, NULL);
4800         kfree(wldev);
4801 }
4802
4803 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4804 {
4805         struct b43_wldev *wldev;
4806         struct pci_dev *pdev;
4807         int err = -ENOMEM;
4808
4809         if (!list_empty(&wl->devlist)) {
4810                 /* We are not the first core on this chip. */
4811                 pdev = (dev->bus->bustype == SSB_BUSTYPE_PCI) ? dev->bus->host_pci : NULL;
4812                 /* Only special chips support more than one wireless
4813                  * core, although some of the other chips have more than
4814                  * one wireless core as well. Check for this and
4815                  * bail out early.
4816                  */
4817                 if (!pdev ||
4818                     ((pdev->device != 0x4321) &&
4819                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4820                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4821                         return -ENODEV;
4822                 }
4823         }
4824
4825         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4826         if (!wldev)
4827                 goto out;
4828
4829         wldev->use_pio = b43_modparam_pio;
4830         wldev->dev = dev;
4831         wldev->wl = wl;
4832         b43_set_status(wldev, B43_STAT_UNINIT);
4833         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4834         INIT_LIST_HEAD(&wldev->list);
4835
4836         err = b43_wireless_core_attach(wldev);
4837         if (err)
4838                 goto err_kfree_wldev;
4839
4840         list_add(&wldev->list, &wl->devlist);
4841         wl->nr_devs++;
4842         ssb_set_drvdata(dev, wldev);
4843         b43_debugfs_add_device(wldev);
4844
4845       out:
4846         return err;
4847
4848       err_kfree_wldev:
4849         kfree(wldev);
4850         return err;
4851 }
4852
4853 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4854         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4855         (pdev->device == _device) &&                                    \
4856         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4857         (pdev->subsystem_device == _subdevice)                          )
4858
4859 static void b43_sprom_fixup(struct ssb_bus *bus)
4860 {
4861         struct pci_dev *pdev;
4862
4863         /* boardflags workarounds */
4864         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4865             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4866                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4867         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4868             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4869                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4870         if (bus->bustype == SSB_BUSTYPE_PCI) {
4871                 pdev = bus->host_pci;
4872                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4873                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4874                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4875                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4876                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4877                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4878                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4879                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4880         }
4881 }
4882
4883 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4884 {
4885         struct ieee80211_hw *hw = wl->hw;
4886
4887         ssb_set_devtypedata(dev, NULL);
4888         ieee80211_free_hw(hw);
4889 }
4890
4891 static int b43_wireless_init(struct ssb_device *dev)
4892 {
4893         struct ssb_sprom *sprom = &dev->bus->sprom;
4894         struct ieee80211_hw *hw;
4895         struct b43_wl *wl;
4896         int err = -ENOMEM;
4897
4898         b43_sprom_fixup(dev->bus);
4899
4900         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4901         if (!hw) {
4902                 b43err(NULL, "Could not allocate ieee80211 device\n");
4903                 goto out;
4904         }
4905         wl = hw_to_b43_wl(hw);
4906
4907         /* fill hw info */
4908         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4909                     IEEE80211_HW_SIGNAL_DBM |
4910                     IEEE80211_HW_NOISE_DBM;
4911
4912         hw->wiphy->interface_modes =
4913                 BIT(NL80211_IFTYPE_AP) |
4914                 BIT(NL80211_IFTYPE_MESH_POINT) |
4915                 BIT(NL80211_IFTYPE_STATION) |
4916                 BIT(NL80211_IFTYPE_WDS) |
4917                 BIT(NL80211_IFTYPE_ADHOC);
4918
4919         hw->queues = modparam_qos ? 4 : 1;
4920         wl->mac80211_initially_registered_queues = hw->queues;
4921         hw->max_rates = 2;
4922         SET_IEEE80211_DEV(hw, dev->dev);
4923         if (is_valid_ether_addr(sprom->et1mac))
4924                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4925         else
4926                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4927
4928         /* Initialize struct b43_wl */
4929         wl->hw = hw;
4930         mutex_init(&wl->mutex);
4931         spin_lock_init(&wl->hardirq_lock);
4932         INIT_LIST_HEAD(&wl->devlist);
4933         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4934         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4935         INIT_WORK(&wl->tx_work, b43_tx_work);
4936         skb_queue_head_init(&wl->tx_queue);
4937
4938         ssb_set_devtypedata(dev, wl);
4939         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4940                 dev->bus->chip_id, dev->id.revision);
4941         err = 0;
4942 out:
4943         return err;
4944 }
4945
4946 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4947 {
4948         struct b43_wl *wl;
4949         int err;
4950         int first = 0;
4951
4952         wl = ssb_get_devtypedata(dev);
4953         if (!wl) {
4954                 /* Probing the first core. Must setup common struct b43_wl */
4955                 first = 1;
4956                 err = b43_wireless_init(dev);
4957                 if (err)
4958                         goto out;
4959                 wl = ssb_get_devtypedata(dev);
4960                 B43_WARN_ON(!wl);
4961         }
4962         err = b43_one_core_attach(dev, wl);
4963         if (err)
4964                 goto err_wireless_exit;
4965
4966         if (first) {
4967                 err = ieee80211_register_hw(wl->hw);
4968                 if (err)
4969                         goto err_one_core_detach;
4970                 b43_leds_register(wl->current_dev);
4971                 b43_rng_init(wl);
4972         }
4973
4974       out:
4975         return err;
4976
4977       err_one_core_detach:
4978         b43_one_core_detach(dev);
4979       err_wireless_exit:
4980         if (first)
4981                 b43_wireless_exit(dev, wl);
4982         return err;
4983 }
4984
4985 static void b43_remove(struct ssb_device *dev)
4986 {
4987         struct b43_wl *wl = ssb_get_devtypedata(dev);
4988         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4989
4990         /* We must cancel any work here before unregistering from ieee80211,
4991          * as the ieee80211 unreg will destroy the workqueue. */
4992         cancel_work_sync(&wldev->restart_work);
4993
4994         B43_WARN_ON(!wl);
4995         if (wl->current_dev == wldev) {
4996                 /* Restore the queues count before unregistering, because firmware detect
4997                  * might have modified it. Restoring is important, so the networking
4998                  * stack can properly free resources. */
4999                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5000                 b43_leds_stop(wldev);
5001                 ieee80211_unregister_hw(wl->hw);
5002         }
5003
5004         b43_one_core_detach(dev);
5005
5006         if (list_empty(&wl->devlist)) {
5007                 b43_rng_exit(wl);
5008                 b43_leds_unregister(wl);
5009                 /* Last core on the chip unregistered.
5010                  * We can destroy common struct b43_wl.
5011                  */
5012                 b43_wireless_exit(dev, wl);
5013         }
5014 }
5015
5016 /* Perform a hardware reset. This can be called from any context. */
5017 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5018 {
5019         /* Must avoid requeueing, if we are in shutdown. */
5020         if (b43_status(dev) < B43_STAT_INITIALIZED)
5021                 return;
5022         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5023         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5024 }
5025
5026 static struct ssb_driver b43_ssb_driver = {
5027         .name           = KBUILD_MODNAME,
5028         .id_table       = b43_ssb_tbl,
5029         .probe          = b43_probe,
5030         .remove         = b43_remove,
5031 };
5032
5033 static void b43_print_driverinfo(void)
5034 {
5035         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5036                    *feat_leds = "", *feat_sdio = "";
5037
5038 #ifdef CONFIG_B43_PCI_AUTOSELECT
5039         feat_pci = "P";
5040 #endif
5041 #ifdef CONFIG_B43_PCMCIA
5042         feat_pcmcia = "M";
5043 #endif
5044 #ifdef CONFIG_B43_NPHY
5045         feat_nphy = "N";
5046 #endif
5047 #ifdef CONFIG_B43_LEDS
5048         feat_leds = "L";
5049 #endif
5050 #ifdef CONFIG_B43_SDIO
5051         feat_sdio = "S";
5052 #endif
5053         printk(KERN_INFO "Broadcom 43xx driver loaded "
5054                "[ Features: %s%s%s%s%s, Firmware-ID: "
5055                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5056                feat_pci, feat_pcmcia, feat_nphy,
5057                feat_leds, feat_sdio);
5058 }
5059
5060 static int __init b43_init(void)
5061 {
5062         int err;
5063
5064         b43_debugfs_init();
5065         err = b43_pcmcia_init();
5066         if (err)
5067                 goto err_dfs_exit;
5068         err = b43_sdio_init();
5069         if (err)
5070                 goto err_pcmcia_exit;
5071         err = ssb_driver_register(&b43_ssb_driver);
5072         if (err)
5073                 goto err_sdio_exit;
5074         b43_print_driverinfo();
5075
5076         return err;
5077
5078 err_sdio_exit:
5079         b43_sdio_exit();
5080 err_pcmcia_exit:
5081         b43_pcmcia_exit();
5082 err_dfs_exit:
5083         b43_debugfs_exit();
5084         return err;
5085 }
5086
5087 static void __exit b43_exit(void)
5088 {
5089         ssb_driver_unregister(&b43_ssb_driver);
5090         b43_sdio_exit();
5091         b43_pcmcia_exit();
5092         b43_debugfs_exit();
5093 }
5094
5095 module_init(b43_init)
5096 module_exit(b43_exit)