drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_AUTHOR("Gábor Stefanik");
  62 MODULE_LICENSE("GPL");
  63
  64 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  65
  66
  67 static int modparam_bad_frames_preempt;
  68 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  69 MODULE_PARM_DESC(bad_frames_preempt,
  70                  "enable(1) / disable(0) Bad Frames Preemption");
  71
  72 static char modparam_fwpostfix[16];
  73 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  74 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  75
  76 static int modparam_hwpctl;
  77 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  78 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  79
  80 static int modparam_nohwcrypt;
  81 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  82 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  83
  84 static int modparam_hwtkip;
  85 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  86 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  87
  88 static int modparam_qos = 1;
  89 module_param_named(qos, modparam_qos, int, 0444);
  90 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  91
  92 static int modparam_btcoex = 1;
  93 module_param_named(btcoex, modparam_btcoex, int, 0444);
  94 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
  95
  96 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
  97 module_param_named(verbose, b43_modparam_verbose, int, 0644);
  98 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
  99
 100
 101 static const struct ssb_device_id b43_ssb_tbl[] = {
 102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 106         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 107         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 108         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 109         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 110         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 111         SSB_DEVTABLE_END
 112 };
 113
 114 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 115
 116 /* Channel and ratetables are shared for all devices.
 117  * They can't be const, because ieee80211 puts some precalculated
 118  * data in there. This data is the same for all devices, so we don't
 119  * get concurrency issues */
 120 #define RATETAB_ENT(_rateid, _flags) \
 121         {                                                               \
 122                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 123                 .hw_value       = (_rateid),                            \
 124                 .flags          = (_flags),                             \
 125         }
 126
 127 /*
 128  * NOTE: When changing this, sync with xmit.c's
 129  *       b43_plcp_get_bitrate_idx_* functions!
 130  */
 131 static struct ieee80211_rate __b43_ratetable[] = {
 132         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 133         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 134         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 135         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 136         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 137         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 138         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 139         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 140         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 141         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 142         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 143         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 144 };
 145
 146 #define b43_a_ratetable         (__b43_ratetable + 4)
 147 #define b43_a_ratetable_size    8
 148 #define b43_b_ratetable         (__b43_ratetable + 0)
 149 #define b43_b_ratetable_size    4
 150 #define b43_g_ratetable         (__b43_ratetable + 0)
 151 #define b43_g_ratetable_size    12
 152
 153 #define CHAN4G(_channel, _freq, _flags) {                       \
 154         .band                   = IEEE80211_BAND_2GHZ,          \
 155         .center_freq            = (_freq),                      \
 156         .hw_value               = (_channel),                   \
 157         .flags                  = (_flags),                     \
 158         .max_antenna_gain       = 0,                            \
 159         .max_power              = 30,                           \
 160 }
 161 static struct ieee80211_channel b43_2ghz_chantable[] = {
 162         CHAN4G(1, 2412, 0),
 163         CHAN4G(2, 2417, 0),
 164         CHAN4G(3, 2422, 0),
 165         CHAN4G(4, 2427, 0),
 166         CHAN4G(5, 2432, 0),
 167         CHAN4G(6, 2437, 0),
 168         CHAN4G(7, 2442, 0),
 169         CHAN4G(8, 2447, 0),
 170         CHAN4G(9, 2452, 0),
 171         CHAN4G(10, 2457, 0),
 172         CHAN4G(11, 2462, 0),
 173         CHAN4G(12, 2467, 0),
 174         CHAN4G(13, 2472, 0),
 175         CHAN4G(14, 2484, 0),
 176 };
 177 #undef CHAN4G
 178
 179 #define CHAN5G(_channel, _flags) {                              \
 180         .band                   = IEEE80211_BAND_5GHZ,          \
 181         .center_freq            = 5000 + (5 * (_channel)),      \
 182         .hw_value               = (_channel),                   \
 183         .flags                  = (_flags),                     \
 184         .max_antenna_gain       = 0,                            \
 185         .max_power              = 30,                           \
 186 }
 187 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 188         CHAN5G(32, 0),          CHAN5G(34, 0),
 189         CHAN5G(36, 0),          CHAN5G(38, 0),
 190         CHAN5G(40, 0),          CHAN5G(42, 0),
 191         CHAN5G(44, 0),          CHAN5G(46, 0),
 192         CHAN5G(48, 0),          CHAN5G(50, 0),
 193         CHAN5G(52, 0),          CHAN5G(54, 0),
 194         CHAN5G(56, 0),          CHAN5G(58, 0),
 195         CHAN5G(60, 0),          CHAN5G(62, 0),
 196         CHAN5G(64, 0),          CHAN5G(66, 0),
 197         CHAN5G(68, 0),          CHAN5G(70, 0),
 198         CHAN5G(72, 0),          CHAN5G(74, 0),
 199         CHAN5G(76, 0),          CHAN5G(78, 0),
 200         CHAN5G(80, 0),          CHAN5G(82, 0),
 201         CHAN5G(84, 0),          CHAN5G(86, 0),
 202         CHAN5G(88, 0),          CHAN5G(90, 0),
 203         CHAN5G(92, 0),          CHAN5G(94, 0),
 204         CHAN5G(96, 0),          CHAN5G(98, 0),
 205         CHAN5G(100, 0),         CHAN5G(102, 0),
 206         CHAN5G(104, 0),         CHAN5G(106, 0),
 207         CHAN5G(108, 0),         CHAN5G(110, 0),
 208         CHAN5G(112, 0),         CHAN5G(114, 0),
 209         CHAN5G(116, 0),         CHAN5G(118, 0),
 210         CHAN5G(120, 0),         CHAN5G(122, 0),
 211         CHAN5G(124, 0),         CHAN5G(126, 0),
 212         CHAN5G(128, 0),         CHAN5G(130, 0),
 213         CHAN5G(132, 0),         CHAN5G(134, 0),
 214         CHAN5G(136, 0),         CHAN5G(138, 0),
 215         CHAN5G(140, 0),         CHAN5G(142, 0),
 216         CHAN5G(144, 0),         CHAN5G(145, 0),
 217         CHAN5G(146, 0),         CHAN5G(147, 0),
 218         CHAN5G(148, 0),         CHAN5G(149, 0),
 219         CHAN5G(150, 0),         CHAN5G(151, 0),
 220         CHAN5G(152, 0),         CHAN5G(153, 0),
 221         CHAN5G(154, 0),         CHAN5G(155, 0),
 222         CHAN5G(156, 0),         CHAN5G(157, 0),
 223         CHAN5G(158, 0),         CHAN5G(159, 0),
 224         CHAN5G(160, 0),         CHAN5G(161, 0),
 225         CHAN5G(162, 0),         CHAN5G(163, 0),
 226         CHAN5G(164, 0),         CHAN5G(165, 0),
 227         CHAN5G(166, 0),         CHAN5G(168, 0),
 228         CHAN5G(170, 0),         CHAN5G(172, 0),
 229         CHAN5G(174, 0),         CHAN5G(176, 0),
 230         CHAN5G(178, 0),         CHAN5G(180, 0),
 231         CHAN5G(182, 0),         CHAN5G(184, 0),
 232         CHAN5G(186, 0),         CHAN5G(188, 0),
 233         CHAN5G(190, 0),         CHAN5G(192, 0),
 234         CHAN5G(194, 0),         CHAN5G(196, 0),
 235         CHAN5G(198, 0),         CHAN5G(200, 0),
 236         CHAN5G(202, 0),         CHAN5G(204, 0),
 237         CHAN5G(206, 0),         CHAN5G(208, 0),
 238         CHAN5G(210, 0),         CHAN5G(212, 0),
 239         CHAN5G(214, 0),         CHAN5G(216, 0),
 240         CHAN5G(218, 0),         CHAN5G(220, 0),
 241         CHAN5G(222, 0),         CHAN5G(224, 0),
 242         CHAN5G(226, 0),         CHAN5G(228, 0),
 243 };
 244
 245 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 246         CHAN5G(34, 0),          CHAN5G(36, 0),
 247         CHAN5G(38, 0),          CHAN5G(40, 0),
 248         CHAN5G(42, 0),          CHAN5G(44, 0),
 249         CHAN5G(46, 0),          CHAN5G(48, 0),
 250         CHAN5G(52, 0),          CHAN5G(56, 0),
 251         CHAN5G(60, 0),          CHAN5G(64, 0),
 252         CHAN5G(100, 0),         CHAN5G(104, 0),
 253         CHAN5G(108, 0),         CHAN5G(112, 0),
 254         CHAN5G(116, 0),         CHAN5G(120, 0),
 255         CHAN5G(124, 0),         CHAN5G(128, 0),
 256         CHAN5G(132, 0),         CHAN5G(136, 0),
 257         CHAN5G(140, 0),         CHAN5G(149, 0),
 258         CHAN5G(153, 0),         CHAN5G(157, 0),
 259         CHAN5G(161, 0),         CHAN5G(165, 0),
 260         CHAN5G(184, 0),         CHAN5G(188, 0),
 261         CHAN5G(192, 0),         CHAN5G(196, 0),
 262         CHAN5G(200, 0),         CHAN5G(204, 0),
 263         CHAN5G(208, 0),         CHAN5G(212, 0),
 264         CHAN5G(216, 0),
 265 };
 266 #undef CHAN5G
 267
 268 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 269         .band           = IEEE80211_BAND_5GHZ,
 270         .channels       = b43_5ghz_nphy_chantable,
 271         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 272         .bitrates       = b43_a_ratetable,
 273         .n_bitrates     = b43_a_ratetable_size,
 274 };
 275
 276 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 277         .band           = IEEE80211_BAND_5GHZ,
 278         .channels       = b43_5ghz_aphy_chantable,
 279         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 280         .bitrates       = b43_a_ratetable,
 281         .n_bitrates     = b43_a_ratetable_size,
 282 };
 283
 284 static struct ieee80211_supported_band b43_band_2GHz = {
 285         .band           = IEEE80211_BAND_2GHZ,
 286         .channels       = b43_2ghz_chantable,
 287         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 288         .bitrates       = b43_g_ratetable,
 289         .n_bitrates     = b43_g_ratetable_size,
 290 };
 291
 292 static void b43_wireless_core_exit(struct b43_wldev *dev);
 293 static int b43_wireless_core_init(struct b43_wldev *dev);
 294 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 295 static int b43_wireless_core_start(struct b43_wldev *dev);
 296
 297 static int b43_ratelimit(struct b43_wl *wl)
 298 {
 299         if (!wl || !wl->current_dev)
 300                 return 1;
 301         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 302                 return 1;
 303         /* We are up and running.
 304          * Ratelimit the messages to avoid DoS over the net. */
 305         return net_ratelimit();
 306 }
 307
 308 void b43info(struct b43_wl *wl, const char *fmt, ...)
 309 {
 310         va_list args;
 311
 312         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 313                 return;
 314         if (!b43_ratelimit(wl))
 315                 return;
 316         va_start(args, fmt);
 317         printk(KERN_INFO "b43-%s: ",
 318                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 319         vprintk(fmt, args);
 320         va_end(args);
 321 }
 322
 323 void b43err(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         va_list args;
 326
 327         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 328                 return;
 329         if (!b43_ratelimit(wl))
 330                 return;
 331         va_start(args, fmt);
 332         printk(KERN_ERR "b43-%s ERROR: ",
 333                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 334         vprintk(fmt, args);
 335         va_end(args);
 336 }
 337
 338 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 339 {
 340         va_list args;
 341
 342         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 343                 return;
 344         if (!b43_ratelimit(wl))
 345                 return;
 346         va_start(args, fmt);
 347         printk(KERN_WARNING "b43-%s warning: ",
 348                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 349         vprintk(fmt, args);
 350         va_end(args);
 351 }
 352
 353 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 354 {
 355         va_list args;
 356
 357         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 358                 return;
 359         va_start(args, fmt);
 360         printk(KERN_DEBUG "b43-%s debug: ",
 361                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 362         vprintk(fmt, args);
 363         va_end(args);
 364 }
 365
 366 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 367 {
 368         u32 macctl;
 369
 370         B43_WARN_ON(offset % 4 != 0);
 371
 372         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 373         if (macctl & B43_MACCTL_BE)
 374                 val = swab32(val);
 375
 376         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 377         mmiowb();
 378         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 379 }
 380
 381 static inline void b43_shm_control_word(struct b43_wldev *dev,
 382                                         u16 routing, u16 offset)
 383 {
 384         u32 control;
 385
 386         /* "offset" is the WORD offset. */
 387         control = routing;
 388         control <<= 16;
 389         control |= offset;
 390         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 391 }
 392
 393 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 394 {
 395         u32 ret;
 396
 397         if (routing == B43_SHM_SHARED) {
 398                 B43_WARN_ON(offset & 0x0001);
 399                 if (offset & 0x0003) {
 400                         /* Unaligned access */
 401                         b43_shm_control_word(dev, routing, offset >> 2);
 402                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 403                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 404                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 405
 406                         goto out;
 407                 }
 408                 offset >>= 2;
 409         }
 410         b43_shm_control_word(dev, routing, offset);
 411         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 412 out:
 413         return ret;
 414 }
 415
 416 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 417 {
 418         struct b43_wl *wl = dev->wl;
 419         unsigned long flags;
 420         u32 ret;
 421
 422         spin_lock_irqsave(&wl->shm_lock, flags);
 423         ret = __b43_shm_read32(dev, routing, offset);
 424         spin_unlock_irqrestore(&wl->shm_lock, flags);
 425
 426         return ret;
 427 }
 428
 429 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 430 {
 431         u16 ret;
 432
 433         if (routing == B43_SHM_SHARED) {
 434                 B43_WARN_ON(offset & 0x0001);
 435                 if (offset & 0x0003) {
 436                         /* Unaligned access */
 437                         b43_shm_control_word(dev, routing, offset >> 2);
 438                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 439
 440                         goto out;
 441                 }
 442                 offset >>= 2;
 443         }
 444         b43_shm_control_word(dev, routing, offset);
 445         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 446 out:
 447         return ret;
 448 }
 449
 450 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 451 {
 452         struct b43_wl *wl = dev->wl;
 453         unsigned long flags;
 454         u16 ret;
 455
 456         spin_lock_irqsave(&wl->shm_lock, flags);
 457         ret = __b43_shm_read16(dev, routing, offset);
 458         spin_unlock_irqrestore(&wl->shm_lock, flags);
 459
 460         return ret;
 461 }
 462
 463 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 464 {
 465         if (routing == B43_SHM_SHARED) {
 466                 B43_WARN_ON(offset & 0x0001);
 467                 if (offset & 0x0003) {
 468                         /* Unaligned access */
 469                         b43_shm_control_word(dev, routing, offset >> 2);
 470                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 471                                     value & 0xFFFF);
 472                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 473                         b43_write16(dev, B43_MMIO_SHM_DATA,
 474                                     (value >> 16) & 0xFFFF);
 475                         return;
 476                 }
 477                 offset >>= 2;
 478         }
 479         b43_shm_control_word(dev, routing, offset);
 480         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 481 }
 482
 483 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 484 {
 485         struct b43_wl *wl = dev->wl;
 486         unsigned long flags;
 487
 488         spin_lock_irqsave(&wl->shm_lock, flags);
 489         __b43_shm_write32(dev, routing, offset, value);
 490         spin_unlock_irqrestore(&wl->shm_lock, flags);
 491 }
 492
 493 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 494 {
 495         if (routing == B43_SHM_SHARED) {
 496                 B43_WARN_ON(offset & 0x0001);
 497                 if (offset & 0x0003) {
 498                         /* Unaligned access */
 499                         b43_shm_control_word(dev, routing, offset >> 2);
 500                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 501                         return;
 502                 }
 503                 offset >>= 2;
 504         }
 505         b43_shm_control_word(dev, routing, offset);
 506         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 507 }
 508
 509 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 510 {
 511         struct b43_wl *wl = dev->wl;
 512         unsigned long flags;
 513
 514         spin_lock_irqsave(&wl->shm_lock, flags);
 515         __b43_shm_write16(dev, routing, offset, value);
 516         spin_unlock_irqrestore(&wl->shm_lock, flags);
 517 }
 518
 519 /* Read HostFlags */
 520 u64 b43_hf_read(struct b43_wldev *dev)
 521 {
 522         u64 ret;
 523
 524         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 525         ret <<= 16;
 526         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 527         ret <<= 16;
 528         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 529
 530         return ret;
 531 }
 532
 533 /* Write HostFlags */
 534 void b43_hf_write(struct b43_wldev *dev, u64 value)
 535 {
 536         u16 lo, mi, hi;
 537
 538         lo = (value & 0x00000000FFFFULL);
 539         mi = (value & 0x0000FFFF0000ULL) >> 16;
 540         hi = (value & 0xFFFF00000000ULL) >> 32;
 541         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 542         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 543         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 544 }
 545
 546 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 547 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 548 {
 549         B43_WARN_ON(!dev->fw.opensource);
 550         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 551 }
 552
 553 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 554 {
 555         u32 low, high;
 556
 557         B43_WARN_ON(dev->dev->id.revision < 3);
 558
 559         /* The hardware guarantees us an atomic read, if we
 560          * read the low register first. */
 561         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 562         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 563
 564         *tsf = high;
 565         *tsf <<= 32;
 566         *tsf |= low;
 567 }
 568
 569 static void b43_time_lock(struct b43_wldev *dev)
 570 {
 571         u32 macctl;
 572
 573         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 574         macctl |= B43_MACCTL_TBTTHOLD;
 575         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 576         /* Commit the write */
 577         b43_read32(dev, B43_MMIO_MACCTL);
 578 }
 579
 580 static void b43_time_unlock(struct b43_wldev *dev)
 581 {
 582         u32 macctl;
 583
 584         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 585         macctl &= ~B43_MACCTL_TBTTHOLD;
 586         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 587         /* Commit the write */
 588         b43_read32(dev, B43_MMIO_MACCTL);
 589 }
 590
 591 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 592 {
 593         u32 low, high;
 594
 595         B43_WARN_ON(dev->dev->id.revision < 3);
 596
 597         low = tsf;
 598         high = (tsf >> 32);
 599         /* The hardware guarantees us an atomic write, if we
 600          * write the low register first. */
 601         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 602         mmiowb();
 603         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 604         mmiowb();
 605 }
 606
 607 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 608 {
 609         b43_time_lock(dev);
 610         b43_tsf_write_locked(dev, tsf);
 611         b43_time_unlock(dev);
 612 }
 613
 614 static
 615 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 616 {
 617         static const u8 zero_addr[ETH_ALEN] = { 0 };
 618         u16 data;
 619
 620         if (!mac)
 621                 mac = zero_addr;
 622
 623         offset |= 0x0020;
 624         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 625
 626         data = mac[0];
 627         data |= mac[1] << 8;
 628         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 629         data = mac[2];
 630         data |= mac[3] << 8;
 631         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 632         data = mac[4];
 633         data |= mac[5] << 8;
 634         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 635 }
 636
 637 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 638 {
 639         const u8 *mac;
 640         const u8 *bssid;
 641         u8 mac_bssid[ETH_ALEN * 2];
 642         int i;
 643         u32 tmp;
 644
 645         bssid = dev->wl->bssid;
 646         mac = dev->wl->mac_addr;
 647
 648         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 649
 650         memcpy(mac_bssid, mac, ETH_ALEN);
 651         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 652
 653         /* Write our MAC address and BSSID to template ram */
 654         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 655                 tmp = (u32) (mac_bssid[i + 0]);
 656                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 657                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 658                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 659                 b43_ram_write(dev, 0x20 + i, tmp);
 660         }
 661 }
 662
 663 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 664 {
 665         b43_write_mac_bssid_templates(dev);
 666         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 667 }
 668
 669 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 670 {
 671         /* slot_time is in usec. */
 672         if (dev->phy.type != B43_PHYTYPE_G)
 673                 return;
 674         b43_write16(dev, 0x684, 510 + slot_time);
 675         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 676 }
 677
 678 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 9);
 681 }
 682
 683 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 684 {
 685         b43_set_slot_time(dev, 20);
 686 }
 687
 688 /* DummyTransmission function, as documented on
 689  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 690  */
 691 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 692 {
 693         struct b43_wl *wl = dev->wl;
 694         struct b43_phy *phy = &dev->phy;
 695         unsigned int i, max_loop;
 696         u16 value;
 697         u32 buffer[5] = {
 698                 0x00000000,
 699                 0x00D40000,
 700                 0x00000000,
 701                 0x01000000,
 702                 0x00000000,
 703         };
 704
 705         if (ofdm) {
 706                 max_loop = 0x1E;
 707                 buffer[0] = 0x000201CC;
 708         } else {
 709                 max_loop = 0xFA;
 710                 buffer[0] = 0x000B846E;
 711         }
 712
 713         write_lock_irq(&wl->tx_lock);
 714
 715         for (i = 0; i < 5; i++)
 716                 b43_ram_write(dev, i * 4, buffer[i]);
 717
 718         b43_write16(dev, 0x0568, 0x0000);
 719         if (dev->dev->id.revision < 11)
 720                 b43_write16(dev, 0x07C0, 0x0000);
 721         else
 722                 b43_write16(dev, 0x07C0, 0x0100);
 723         value = (ofdm ? 0x41 : 0x40);
 724         b43_write16(dev, 0x050C, value);
 725         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 726                 b43_write16(dev, 0x0514, 0x1A02);
 727         b43_write16(dev, 0x0508, 0x0000);
 728         b43_write16(dev, 0x050A, 0x0000);
 729         b43_write16(dev, 0x054C, 0x0000);
 730         b43_write16(dev, 0x056A, 0x0014);
 731         b43_write16(dev, 0x0568, 0x0826);
 732         b43_write16(dev, 0x0500, 0x0000);
 733         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 734                 //SPEC TODO
 735         }
 736
 737         switch (phy->type) {
 738         case B43_PHYTYPE_N:
 739                 b43_write16(dev, 0x0502, 0x00D0);
 740                 break;
 741         case B43_PHYTYPE_LP:
 742                 b43_write16(dev, 0x0502, 0x0050);
 743                 break;
 744         default:
 745                 b43_write16(dev, 0x0502, 0x0030);
 746         }
 747
 748         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 749                 b43_radio_write16(dev, 0x0051, 0x0017);
 750         for (i = 0x00; i < max_loop; i++) {
 751                 value = b43_read16(dev, 0x050E);
 752                 if (value & 0x0080)
 753                         break;
 754                 udelay(10);
 755         }
 756         for (i = 0x00; i < 0x0A; i++) {
 757                 value = b43_read16(dev, 0x050E);
 758                 if (value & 0x0400)
 759                         break;
 760                 udelay(10);
 761         }
 762         for (i = 0x00; i < 0x19; i++) {
 763                 value = b43_read16(dev, 0x0690);
 764                 if (!(value & 0x0100))
 765                         break;
 766                 udelay(10);
 767         }
 768         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 769                 b43_radio_write16(dev, 0x0051, 0x0037);
 770
 771         write_unlock_irq(&wl->tx_lock);
 772 }
 773
 774 static void key_write(struct b43_wldev *dev,
 775                       u8 index, u8 algorithm, const u8 *key)
 776 {
 777         unsigned int i;
 778         u32 offset;
 779         u16 value;
 780         u16 kidx;
 781
 782         /* Key index/algo block */
 783         kidx = b43_kidx_to_fw(dev, index);
 784         value = ((kidx << 4) | algorithm);
 785         b43_shm_write16(dev, B43_SHM_SHARED,
 786                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 787
 788         /* Write the key to the Key Table Pointer offset */
 789         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 790         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 791                 value = key[i];
 792                 value |= (u16) (key[i + 1]) << 8;
 793                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 794         }
 795 }
 796
 797 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 798 {
 799         u32 addrtmp[2] = { 0, 0, };
 800         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 801
 802         if (b43_new_kidx_api(dev))
 803                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 804
 805         B43_WARN_ON(index < pairwise_keys_start);
 806         /* We have four default TX keys and possibly four default RX keys.
 807          * Physical mac 0 is mapped to physical key 4 or 8, depending
 808          * on the firmware version.
 809          * So we must adjust the index here.
 810          */
 811         index -= pairwise_keys_start;
 812         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 813
 814         if (addr) {
 815                 addrtmp[0] = addr[0];
 816                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 817                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 818                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 819                 addrtmp[1] = addr[4];
 820                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 821         }
 822
 823         /* Receive match transmitter address (RCMTA) mechanism */
 824         b43_shm_write32(dev, B43_SHM_RCMTA,
 825                         (index * 2) + 0, addrtmp[0]);
 826         b43_shm_write16(dev, B43_SHM_RCMTA,
 827                         (index * 2) + 1, addrtmp[1]);
 828 }
 829
 830 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 831  * When a packet is received, the iv32 is checked.
 832  * - if it doesn't the packet is returned without modification (and software
 833  *   decryption can be done). That's what happen when iv16 wrap.
 834  * - if it does, the rc4 key is computed, and decryption is tried.
 835  *   Either it will success and B43_RX_MAC_DEC is returned,
 836  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 837  *   and the packet is not usable (it got modified by the ucode).
 838  * So in order to never have B43_RX_MAC_DECERR, we should provide
 839  * a iv32 and phase1key that match. Because we drop packets in case of
 840  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 841  * packets will be lost without higher layer knowing (ie no resync possible
 842  * until next wrap).
 843  *
 844  * NOTE : this should support 50 key like RCMTA because
 845  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 846  */
 847 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 848                 u16 *phase1key)
 849 {
 850         unsigned int i;
 851         u32 offset;
 852         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 853
 854         if (!modparam_hwtkip)
 855                 return;
 856
 857         if (b43_new_kidx_api(dev))
 858                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 859
 860         B43_WARN_ON(index < pairwise_keys_start);
 861         /* We have four default TX keys and possibly four default RX keys.
 862          * Physical mac 0 is mapped to physical key 4 or 8, depending
 863          * on the firmware version.
 864          * So we must adjust the index here.
 865          */
 866         index -= pairwise_keys_start;
 867         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 868
 869         if (b43_debug(dev, B43_DBG_KEYS)) {
 870                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 871                                 index, iv32);
 872         }
 873         /* Write the key to the  RX tkip shared mem */
 874         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 875         for (i = 0; i < 10; i += 2) {
 876                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 877                                 phase1key ? phase1key[i / 2] : 0);
 878         }
 879         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 880         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 881 }
 882
 883 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 884                         struct ieee80211_key_conf *keyconf, const u8 *addr,
 885                         u32 iv32, u16 *phase1key)
 886 {
 887         struct b43_wl *wl = hw_to_b43_wl(hw);
 888         struct b43_wldev *dev;
 889         int index = keyconf->hw_key_idx;
 890
 891         if (B43_WARN_ON(!modparam_hwtkip))
 892                 return;
 893
 894         mutex_lock(&wl->mutex);
 895
 896         dev = wl->current_dev;
 897         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
 898                 goto out_unlock;
 899
 900         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 901
 902         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 903         keymac_write(dev, index, addr);
 904
 905 out_unlock:
 906         mutex_unlock(&wl->mutex);
 907 }
 908
 909 static void do_key_write(struct b43_wldev *dev,
 910                          u8 index, u8 algorithm,
 911                          const u8 *key, size_t key_len, const u8 *mac_addr)
 912 {
 913         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 914         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 915
 916         if (b43_new_kidx_api(dev))
 917                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 918
 919         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 920         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 921
 922         if (index >= pairwise_keys_start)
 923                 keymac_write(dev, index, NULL); /* First zero out mac. */
 924         if (algorithm == B43_SEC_ALGO_TKIP) {
 925                 /*
 926                  * We should provide an initial iv32, phase1key pair.
 927                  * We could start with iv32=0 and compute the corresponding
 928                  * phase1key, but this means calling ieee80211_get_tkip_key
 929                  * with a fake skb (or export other tkip function).
 930                  * Because we are lazy we hope iv32 won't start with
 931                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 932                  * correct pair.
 933                  */
 934                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 935         } else if (index >= pairwise_keys_start) /* clear it */
 936                 rx_tkip_phase1_write(dev, index, 0, NULL);
 937         if (key)
 938                 memcpy(buf, key, key_len);
 939         key_write(dev, index, algorithm, buf);
 940         if (index >= pairwise_keys_start)
 941                 keymac_write(dev, index, mac_addr);
 942
 943         dev->key[index].algorithm = algorithm;
 944 }
 945
 946 static int b43_key_write(struct b43_wldev *dev,
 947                          int index, u8 algorithm,
 948                          const u8 *key, size_t key_len,
 949                          const u8 *mac_addr,
 950                          struct ieee80211_key_conf *keyconf)
 951 {
 952         int i;
 953         int pairwise_keys_start;
 954
 955         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 956          *      - Temporal Encryption Key (128 bits)
 957          *      - Temporal Authenticator Tx MIC Key (64 bits)
 958          *      - Temporal Authenticator Rx MIC Key (64 bits)
 959          *
 960          *      Hardware only store TEK
 961          */
 962         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 963                 key_len = 16;
 964         if (key_len > B43_SEC_KEYSIZE)
 965                 return -EINVAL;
 966         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 967                 /* Check that we don't already have this key. */
 968                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 969         }
 970         if (index < 0) {
 971                 /* Pairwise key. Get an empty slot for the key. */
 972                 if (b43_new_kidx_api(dev))
 973                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 974                 else
 975                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 976                 for (i = pairwise_keys_start;
 977                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 978                      i++) {
 979                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 980                         if (!dev->key[i].keyconf) {
 981                                 /* found empty */
 982                                 index = i;
 983                                 break;
 984                         }
 985                 }
 986                 if (index < 0) {
 987                         b43warn(dev->wl, "Out of hardware key memory\n");
 988                         return -ENOSPC;
 989                 }
 990         } else
 991                 B43_WARN_ON(index > 3);
 992
 993         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 994         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 995                 /* Default RX key */
 996                 B43_WARN_ON(mac_addr);
 997                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 998         }
 999         keyconf->hw_key_idx = index;
1000         dev->key[index].keyconf = keyconf;
1001
1002         return 0;
1003 }
1004
1005 static int b43_key_clear(struct b43_wldev *dev, int index)
1006 {
1007         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1008                 return -EINVAL;
1009         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1010                      NULL, B43_SEC_KEYSIZE, NULL);
1011         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1012                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1013                              NULL, B43_SEC_KEYSIZE, NULL);
1014         }
1015         dev->key[index].keyconf = NULL;
1016
1017         return 0;
1018 }
1019
1020 static void b43_clear_keys(struct b43_wldev *dev)
1021 {
1022         int i, count;
1023
1024         if (b43_new_kidx_api(dev))
1025                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1026         else
1027                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1028         for (i = 0; i < count; i++)
1029                 b43_key_clear(dev, i);
1030 }
1031
1032 static void b43_dump_keymemory(struct b43_wldev *dev)
1033 {
1034         unsigned int i, index, count, offset, pairwise_keys_start;
1035         u8 mac[ETH_ALEN];
1036         u16 algo;
1037         u32 rcmta0;
1038         u16 rcmta1;
1039         u64 hf;
1040         struct b43_key *key;
1041
1042         if (!b43_debug(dev, B43_DBG_KEYS))
1043                 return;
1044
1045         hf = b43_hf_read(dev);
1046         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1047                !!(hf & B43_HF_USEDEFKEYS));
1048         if (b43_new_kidx_api(dev)) {
1049                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1050                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1051         } else {
1052                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1053                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1054         }
1055         for (index = 0; index < count; index++) {
1056                 key = &(dev->key[index]);
1057                 printk(KERN_DEBUG "Key slot %02u: %s",
1058                        index, (key->keyconf == NULL) ? " " : "*");
1059                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1060                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1061                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1062                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1063                 }
1064
1065                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1066                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1067                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1068
1069                 if (index >= pairwise_keys_start) {
1070                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1071                                 printk("   TKIP: ");
1072                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1073                                 for (i = 0; i < 14; i += 2) {
1074                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1075                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1076                                 }
1077                         }
1078                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1079                                                 ((index - pairwise_keys_start) * 2) + 0);
1080                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1081                                                 ((index - pairwise_keys_start) * 2) + 1);
1082                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1083                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1084                         printk("   MAC: %pM", mac);
1085                 } else
1086                         printk("   DEFAULT KEY");
1087                 printk("\n");
1088         }
1089 }
1090
1091 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1092 {
1093         u32 macctl;
1094         u16 ucstat;
1095         bool hwps;
1096         bool awake;
1097         int i;
1098
1099         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1100                     (ps_flags & B43_PS_DISABLED));
1101         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1102
1103         if (ps_flags & B43_PS_ENABLED) {
1104                 hwps = 1;
1105         } else if (ps_flags & B43_PS_DISABLED) {
1106                 hwps = 0;
1107         } else {
1108                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1109                 //      and thus is not an AP and we are associated, set bit 25
1110         }
1111         if (ps_flags & B43_PS_AWAKE) {
1112                 awake = 1;
1113         } else if (ps_flags & B43_PS_ASLEEP) {
1114                 awake = 0;
1115         } else {
1116                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1117                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1118                 //      successful, set bit26
1119         }
1120
1121 /* FIXME: For now we force awake-on and hwps-off */
1122         hwps = 0;
1123         awake = 1;
1124
1125         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1126         if (hwps)
1127                 macctl |= B43_MACCTL_HWPS;
1128         else
1129                 macctl &= ~B43_MACCTL_HWPS;
1130         if (awake)
1131                 macctl |= B43_MACCTL_AWAKE;
1132         else
1133                 macctl &= ~B43_MACCTL_AWAKE;
1134         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1135         /* Commit write */
1136         b43_read32(dev, B43_MMIO_MACCTL);
1137         if (awake && dev->dev->id.revision >= 5) {
1138                 /* Wait for the microcode to wake up. */
1139                 for (i = 0; i < 100; i++) {
1140                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1141                                                 B43_SHM_SH_UCODESTAT);
1142                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1143                                 break;
1144                         udelay(10);
1145                 }
1146         }
1147 }
1148
1149 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1150 {
1151         u32 tmslow;
1152         u32 macctl;
1153
1154         flags |= B43_TMSLOW_PHYCLKEN;
1155         flags |= B43_TMSLOW_PHYRESET;
1156         ssb_device_enable(dev->dev, flags);
1157         msleep(2);              /* Wait for the PLL to turn on. */
1158
1159         /* Now take the PHY out of Reset again */
1160         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1161         tmslow |= SSB_TMSLOW_FGC;
1162         tmslow &= ~B43_TMSLOW_PHYRESET;
1163         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1164         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1165         msleep(1);
1166         tmslow &= ~SSB_TMSLOW_FGC;
1167         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1168         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1169         msleep(1);
1170
1171         /* Turn Analog ON, but only if we already know the PHY-type.
1172          * This protects against very early setup where we don't know the
1173          * PHY-type, yet. wireless_core_reset will be called once again later,
1174          * when we know the PHY-type. */
1175         if (dev->phy.ops)
1176                 dev->phy.ops->switch_analog(dev, 1);
1177
1178         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1179         macctl &= ~B43_MACCTL_GMODE;
1180         if (flags & B43_TMSLOW_GMODE)
1181                 macctl |= B43_MACCTL_GMODE;
1182         macctl |= B43_MACCTL_IHR_ENABLED;
1183         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1184 }
1185
1186 static void handle_irq_transmit_status(struct b43_wldev *dev)
1187 {
1188         u32 v0, v1;
1189         u16 tmp;
1190         struct b43_txstatus stat;
1191
1192         while (1) {
1193                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1194                 if (!(v0 & 0x00000001))
1195                         break;
1196                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1197
1198                 stat.cookie = (v0 >> 16);
1199                 stat.seq = (v1 & 0x0000FFFF);
1200                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1201                 tmp = (v0 & 0x0000FFFF);
1202                 stat.frame_count = ((tmp & 0xF000) >> 12);
1203                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1204                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1205                 stat.pm_indicated = !!(tmp & 0x0080);
1206                 stat.intermediate = !!(tmp & 0x0040);
1207                 stat.for_ampdu = !!(tmp & 0x0020);
1208                 stat.acked = !!(tmp & 0x0002);
1209
1210                 b43_handle_txstatus(dev, &stat);
1211         }
1212 }
1213
1214 static void drain_txstatus_queue(struct b43_wldev *dev)
1215 {
1216         u32 dummy;
1217
1218         if (dev->dev->id.revision < 5)
1219                 return;
1220         /* Read all entries from the microcode TXstatus FIFO
1221          * and throw them away.
1222          */
1223         while (1) {
1224                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1225                 if (!(dummy & 0x00000001))
1226                         break;
1227                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1228         }
1229 }
1230
1231 static u32 b43_jssi_read(struct b43_wldev *dev)
1232 {
1233         u32 val = 0;
1234
1235         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1236         val <<= 16;
1237         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1238
1239         return val;
1240 }
1241
1242 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1243 {
1244         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1245         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1246 }
1247
1248 static void b43_generate_noise_sample(struct b43_wldev *dev)
1249 {
1250         b43_jssi_write(dev, 0x7F7F7F7F);
1251         b43_write32(dev, B43_MMIO_MACCMD,
1252                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1253 }
1254
1255 static void b43_calculate_link_quality(struct b43_wldev *dev)
1256 {
1257         /* Top half of Link Quality calculation. */
1258
1259         if (dev->phy.type != B43_PHYTYPE_G)
1260                 return;
1261         if (dev->noisecalc.calculation_running)
1262                 return;
1263         dev->noisecalc.calculation_running = 1;
1264         dev->noisecalc.nr_samples = 0;
1265
1266         b43_generate_noise_sample(dev);
1267 }
1268
1269 static void handle_irq_noise(struct b43_wldev *dev)
1270 {
1271         struct b43_phy_g *phy = dev->phy.g;
1272         u16 tmp;
1273         u8 noise[4];
1274         u8 i, j;
1275         s32 average;
1276
1277         /* Bottom half of Link Quality calculation. */
1278
1279         if (dev->phy.type != B43_PHYTYPE_G)
1280                 return;
1281
1282         /* Possible race condition: It might be possible that the user
1283          * changed to a different channel in the meantime since we
1284          * started the calculation. We ignore that fact, since it's
1285          * not really that much of a problem. The background noise is
1286          * an estimation only anyway. Slightly wrong results will get damped
1287          * by the averaging of the 8 sample rounds. Additionally the
1288          * value is shortlived. So it will be replaced by the next noise
1289          * calculation round soon. */
1290
1291         B43_WARN_ON(!dev->noisecalc.calculation_running);
1292         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1293         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1294             noise[2] == 0x7F || noise[3] == 0x7F)
1295                 goto generate_new;
1296
1297         /* Get the noise samples. */
1298         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1299         i = dev->noisecalc.nr_samples;
1300         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1301         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1302         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1303         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1304         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1305         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1306         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1307         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1308         dev->noisecalc.nr_samples++;
1309         if (dev->noisecalc.nr_samples == 8) {
1310                 /* Calculate the Link Quality by the noise samples. */
1311                 average = 0;
1312                 for (i = 0; i < 8; i++) {
1313                         for (j = 0; j < 4; j++)
1314                                 average += dev->noisecalc.samples[i][j];
1315                 }
1316                 average /= (8 * 4);
1317                 average *= 125;
1318                 average += 64;
1319                 average /= 128;
1320                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1321                 tmp = (tmp / 128) & 0x1F;
1322                 if (tmp >= 8)
1323                         average += 2;
1324                 else
1325                         average -= 25;
1326                 if (tmp == 8)
1327                         average -= 72;
1328                 else
1329                         average -= 48;
1330
1331                 dev->stats.link_noise = average;
1332                 dev->noisecalc.calculation_running = 0;
1333                 return;
1334         }
1335 generate_new:
1336         b43_generate_noise_sample(dev);
1337 }
1338
1339 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1340 {
1341         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1342                 ///TODO: PS TBTT
1343         } else {
1344                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1345                         b43_power_saving_ctl_bits(dev, 0);
1346         }
1347         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1348                 dev->dfq_valid = 1;
1349 }
1350
1351 static void handle_irq_atim_end(struct b43_wldev *dev)
1352 {
1353         if (dev->dfq_valid) {
1354                 b43_write32(dev, B43_MMIO_MACCMD,
1355                             b43_read32(dev, B43_MMIO_MACCMD)
1356                             | B43_MACCMD_DFQ_VALID);
1357                 dev->dfq_valid = 0;
1358         }
1359 }
1360
1361 static void handle_irq_pmq(struct b43_wldev *dev)
1362 {
1363         u32 tmp;
1364
1365         //TODO: AP mode.
1366
1367         while (1) {
1368                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1369                 if (!(tmp & 0x00000008))
1370                         break;
1371         }
1372         /* 16bit write is odd, but correct. */
1373         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1374 }
1375
1376 static void b43_write_template_common(struct b43_wldev *dev,
1377                                       const u8 *data, u16 size,
1378                                       u16 ram_offset,
1379                                       u16 shm_size_offset, u8 rate)
1380 {
1381         u32 i, tmp;
1382         struct b43_plcp_hdr4 plcp;
1383
1384         plcp.data = 0;
1385         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1386         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1387         ram_offset += sizeof(u32);
1388         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1389          * So leave the first two bytes of the next write blank.
1390          */
1391         tmp = (u32) (data[0]) << 16;
1392         tmp |= (u32) (data[1]) << 24;
1393         b43_ram_write(dev, ram_offset, tmp);
1394         ram_offset += sizeof(u32);
1395         for (i = 2; i < size; i += sizeof(u32)) {
1396                 tmp = (u32) (data[i + 0]);
1397                 if (i + 1 < size)
1398                         tmp |= (u32) (data[i + 1]) << 8;
1399                 if (i + 2 < size)
1400                         tmp |= (u32) (data[i + 2]) << 16;
1401                 if (i + 3 < size)
1402                         tmp |= (u32) (data[i + 3]) << 24;
1403                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1404         }
1405         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1406                         size + sizeof(struct b43_plcp_hdr6));
1407 }
1408
1409 /* Check if the use of the antenna that ieee80211 told us to
1410  * use is possible. This will fall back to DEFAULT.
1411  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1412 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1413                                   u8 antenna_nr)
1414 {
1415         u8 antenna_mask;
1416
1417         if (antenna_nr == 0) {
1418                 /* Zero means "use default antenna". That's always OK. */
1419                 return 0;
1420         }
1421
1422         /* Get the mask of available antennas. */
1423         if (dev->phy.gmode)
1424                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1425         else
1426                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1427
1428         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1429                 /* This antenna is not available. Fall back to default. */
1430                 return 0;
1431         }
1432
1433         return antenna_nr;
1434 }
1435
1436 /* Convert a b43 antenna number value to the PHY TX control value. */
1437 static u16 b43_antenna_to_phyctl(int antenna)
1438 {
1439         switch (antenna) {
1440         case B43_ANTENNA0:
1441                 return B43_TXH_PHY_ANT0;
1442         case B43_ANTENNA1:
1443                 return B43_TXH_PHY_ANT1;
1444         case B43_ANTENNA2:
1445                 return B43_TXH_PHY_ANT2;
1446         case B43_ANTENNA3:
1447                 return B43_TXH_PHY_ANT3;
1448         case B43_ANTENNA_AUTO0:
1449         case B43_ANTENNA_AUTO1:
1450                 return B43_TXH_PHY_ANT01AUTO;
1451         }
1452         B43_WARN_ON(1);
1453         return 0;
1454 }
1455
1456 static void b43_write_beacon_template(struct b43_wldev *dev,
1457                                       u16 ram_offset,
1458                                       u16 shm_size_offset)
1459 {
1460         unsigned int i, len, variable_len;
1461         const struct ieee80211_mgmt *bcn;
1462         const u8 *ie;
1463         bool tim_found = 0;
1464         unsigned int rate;
1465         u16 ctl;
1466         int antenna;
1467         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1468
1469         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1470         len = min((size_t) dev->wl->current_beacon->len,
1471                   0x200 - sizeof(struct b43_plcp_hdr6));
1472         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1473
1474         b43_write_template_common(dev, (const u8 *)bcn,
1475                                   len, ram_offset, shm_size_offset, rate);
1476
1477         /* Write the PHY TX control parameters. */
1478         antenna = B43_ANTENNA_DEFAULT;
1479         antenna = b43_antenna_to_phyctl(antenna);
1480         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1481         /* We can't send beacons with short preamble. Would get PHY errors. */
1482         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1483         ctl &= ~B43_TXH_PHY_ANT;
1484         ctl &= ~B43_TXH_PHY_ENC;
1485         ctl |= antenna;
1486         if (b43_is_cck_rate(rate))
1487                 ctl |= B43_TXH_PHY_ENC_CCK;
1488         else
1489                 ctl |= B43_TXH_PHY_ENC_OFDM;
1490         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1491
1492         /* Find the position of the TIM and the DTIM_period value
1493          * and write them to SHM. */
1494         ie = bcn->u.beacon.variable;
1495         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1496         for (i = 0; i < variable_len - 2; ) {
1497                 uint8_t ie_id, ie_len;
1498
1499                 ie_id = ie[i];
1500                 ie_len = ie[i + 1];
1501                 if (ie_id == 5) {
1502                         u16 tim_position;
1503                         u16 dtim_period;
1504                         /* This is the TIM Information Element */
1505
1506                         /* Check whether the ie_len is in the beacon data range. */
1507                         if (variable_len < ie_len + 2 + i)
1508                                 break;
1509                         /* A valid TIM is at least 4 bytes long. */
1510                         if (ie_len < 4)
1511                                 break;
1512                         tim_found = 1;
1513
1514                         tim_position = sizeof(struct b43_plcp_hdr6);
1515                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1516                         tim_position += i;
1517
1518                         dtim_period = ie[i + 3];
1519
1520                         b43_shm_write16(dev, B43_SHM_SHARED,
1521                                         B43_SHM_SH_TIMBPOS, tim_position);
1522                         b43_shm_write16(dev, B43_SHM_SHARED,
1523                                         B43_SHM_SH_DTIMPER, dtim_period);
1524                         break;
1525                 }
1526                 i += ie_len + 2;
1527         }
1528         if (!tim_found) {
1529                 /*
1530                  * If ucode wants to modify TIM do it behind the beacon, this
1531                  * will happen, for example, when doing mesh networking.
1532                  */
1533                 b43_shm_write16(dev, B43_SHM_SHARED,
1534                                 B43_SHM_SH_TIMBPOS,
1535                                 len + sizeof(struct b43_plcp_hdr6));
1536                 b43_shm_write16(dev, B43_SHM_SHARED,
1537                                 B43_SHM_SH_DTIMPER, 0);
1538         }
1539         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1540 }
1541
1542 static void b43_upload_beacon0(struct b43_wldev *dev)
1543 {
1544         struct b43_wl *wl = dev->wl;
1545
1546         if (wl->beacon0_uploaded)
1547                 return;
1548         b43_write_beacon_template(dev, 0x68, 0x18);
1549         wl->beacon0_uploaded = 1;
1550 }
1551
1552 static void b43_upload_beacon1(struct b43_wldev *dev)
1553 {
1554         struct b43_wl *wl = dev->wl;
1555
1556         if (wl->beacon1_uploaded)
1557                 return;
1558         b43_write_beacon_template(dev, 0x468, 0x1A);
1559         wl->beacon1_uploaded = 1;
1560 }
1561
1562 static void handle_irq_beacon(struct b43_wldev *dev)
1563 {
1564         struct b43_wl *wl = dev->wl;
1565         u32 cmd, beacon0_valid, beacon1_valid;
1566
1567         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1568             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1569                 return;
1570
1571         /* This is the bottom half of the asynchronous beacon update. */
1572
1573         /* Ignore interrupt in the future. */
1574         dev->irq_mask &= ~B43_IRQ_BEACON;
1575
1576         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1577         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1578         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1579
1580         /* Schedule interrupt manually, if busy. */
1581         if (beacon0_valid && beacon1_valid) {
1582                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1583                 dev->irq_mask |= B43_IRQ_BEACON;
1584                 return;
1585         }
1586
1587         if (unlikely(wl->beacon_templates_virgin)) {
1588                 /* We never uploaded a beacon before.
1589                  * Upload both templates now, but only mark one valid. */
1590                 wl->beacon_templates_virgin = 0;
1591                 b43_upload_beacon0(dev);
1592                 b43_upload_beacon1(dev);
1593                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1594                 cmd |= B43_MACCMD_BEACON0_VALID;
1595                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1596         } else {
1597                 if (!beacon0_valid) {
1598                         b43_upload_beacon0(dev);
1599                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1600                         cmd |= B43_MACCMD_BEACON0_VALID;
1601                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1602                 } else if (!beacon1_valid) {
1603                         b43_upload_beacon1(dev);
1604                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1605                         cmd |= B43_MACCMD_BEACON1_VALID;
1606                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1607                 }
1608         }
1609 }
1610
1611 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1612 {
1613         u32 old_irq_mask = dev->irq_mask;
1614
1615         /* update beacon right away or defer to irq */
1616         handle_irq_beacon(dev);
1617         if (old_irq_mask != dev->irq_mask) {
1618                 /* The handler updated the IRQ mask. */
1619                 B43_WARN_ON(!dev->irq_mask);
1620                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1621                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1622                 } else {
1623                         /* Device interrupts are currently disabled. That means
1624                          * we just ran the hardirq handler and scheduled the
1625                          * IRQ thread. The thread will write the IRQ mask when
1626                          * it finished, so there's nothing to do here. Writing
1627                          * the mask _here_ would incorrectly re-enable IRQs. */
1628                 }
1629         }
1630 }
1631
1632 static void b43_beacon_update_trigger_work(struct work_struct *work)
1633 {
1634         struct b43_wl *wl = container_of(work, struct b43_wl,
1635                                          beacon_update_trigger);
1636         struct b43_wldev *dev;
1637
1638         mutex_lock(&wl->mutex);
1639         dev = wl->current_dev;
1640         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1641                 if (0 /*FIXME dev->dev->bus->bustype == SSB_BUSTYPE_SDIO*/) {
1642                         /* wl->mutex is enough. */
1643                         b43_do_beacon_update_trigger_work(dev);
1644                         mmiowb();
1645                 } else {
1646                         spin_lock_irq(&wl->hardirq_lock);
1647                         b43_do_beacon_update_trigger_work(dev);
1648                         mmiowb();
1649                         spin_unlock_irq(&wl->hardirq_lock);
1650                 }
1651         }
1652         mutex_unlock(&wl->mutex);
1653 }
1654
1655 /* Asynchronously update the packet templates in template RAM.
1656  * Locking: Requires wl->mutex to be locked. */
1657 static void b43_update_templates(struct b43_wl *wl)
1658 {
1659         struct sk_buff *beacon;
1660
1661         /* This is the top half of the ansynchronous beacon update.
1662          * The bottom half is the beacon IRQ.
1663          * Beacon update must be asynchronous to avoid sending an
1664          * invalid beacon. This can happen for example, if the firmware
1665          * transmits a beacon while we are updating it. */
1666
1667         /* We could modify the existing beacon and set the aid bit in
1668          * the TIM field, but that would probably require resizing and
1669          * moving of data within the beacon template.
1670          * Simply request a new beacon and let mac80211 do the hard work. */
1671         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1672         if (unlikely(!beacon))
1673                 return;
1674
1675         if (wl->current_beacon)
1676                 dev_kfree_skb_any(wl->current_beacon);
1677         wl->current_beacon = beacon;
1678         wl->beacon0_uploaded = 0;
1679         wl->beacon1_uploaded = 0;
1680         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1681 }
1682
1683 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1684 {
1685         b43_time_lock(dev);
1686         if (dev->dev->id.revision >= 3) {
1687                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1688                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1689         } else {
1690                 b43_write16(dev, 0x606, (beacon_int >> 6));
1691                 b43_write16(dev, 0x610, beacon_int);
1692         }
1693         b43_time_unlock(dev);
1694         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1695 }
1696
1697 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1698 {
1699         u16 reason;
1700
1701         /* Read the register that contains the reason code for the panic. */
1702         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1703         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1704
1705         switch (reason) {
1706         default:
1707                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1708                 /* fallthrough */
1709         case B43_FWPANIC_DIE:
1710                 /* Do not restart the controller or firmware.
1711                  * The device is nonfunctional from now on.
1712                  * Restarting would result in this panic to trigger again,
1713                  * so we avoid that recursion. */
1714                 break;
1715         case B43_FWPANIC_RESTART:
1716                 b43_controller_restart(dev, "Microcode panic");
1717                 break;
1718         }
1719 }
1720
1721 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1722 {
1723         unsigned int i, cnt;
1724         u16 reason, marker_id, marker_line;
1725         __le16 *buf;
1726
1727         /* The proprietary firmware doesn't have this IRQ. */
1728         if (!dev->fw.opensource)
1729                 return;
1730
1731         /* Read the register that contains the reason code for this IRQ. */
1732         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1733
1734         switch (reason) {
1735         case B43_DEBUGIRQ_PANIC:
1736                 b43_handle_firmware_panic(dev);
1737                 break;
1738         case B43_DEBUGIRQ_DUMP_SHM:
1739                 if (!B43_DEBUG)
1740                         break; /* Only with driver debugging enabled. */
1741                 buf = kmalloc(4096, GFP_ATOMIC);
1742                 if (!buf) {
1743                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1744                         goto out;
1745                 }
1746                 for (i = 0; i < 4096; i += 2) {
1747                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1748                         buf[i / 2] = cpu_to_le16(tmp);
1749                 }
1750                 b43info(dev->wl, "Shared memory dump:\n");
1751                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1752                                16, 2, buf, 4096, 1);
1753                 kfree(buf);
1754                 break;
1755         case B43_DEBUGIRQ_DUMP_REGS:
1756                 if (!B43_DEBUG)
1757                         break; /* Only with driver debugging enabled. */
1758                 b43info(dev->wl, "Microcode register dump:\n");
1759                 for (i = 0, cnt = 0; i < 64; i++) {
1760                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1761                         if (cnt == 0)
1762                                 printk(KERN_INFO);
1763                         printk("r%02u: 0x%04X  ", i, tmp);
1764                         cnt++;
1765                         if (cnt == 6) {
1766                                 printk("\n");
1767                                 cnt = 0;
1768                         }
1769                 }
1770                 printk("\n");
1771                 break;
1772         case B43_DEBUGIRQ_MARKER:
1773                 if (!B43_DEBUG)
1774                         break; /* Only with driver debugging enabled. */
1775                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1776                                            B43_MARKER_ID_REG);
1777                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1778                                              B43_MARKER_LINE_REG);
1779                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1780                         "at line number %u\n",
1781                         marker_id, marker_line);
1782                 break;
1783         default:
1784                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1785                        reason);
1786         }
1787 out:
1788         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1789         b43_shm_write16(dev, B43_SHM_SCRATCH,
1790                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1791 }
1792
1793 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1794 {
1795         u32 reason;
1796         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1797         u32 merged_dma_reason = 0;
1798         int i;
1799
1800         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1801                 return;
1802
1803         reason = dev->irq_reason;
1804         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1805                 dma_reason[i] = dev->dma_reason[i];
1806                 merged_dma_reason |= dma_reason[i];
1807         }
1808
1809         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1810                 b43err(dev->wl, "MAC transmission error\n");
1811
1812         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1813                 b43err(dev->wl, "PHY transmission error\n");
1814                 rmb();
1815                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1816                         atomic_set(&dev->phy.txerr_cnt,
1817                                    B43_PHY_TX_BADNESS_LIMIT);
1818                         b43err(dev->wl, "Too many PHY TX errors, "
1819                                         "restarting the controller\n");
1820                         b43_controller_restart(dev, "PHY TX errors");
1821                 }
1822         }
1823
1824         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1825                                           B43_DMAIRQ_NONFATALMASK))) {
1826                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1827                         b43err(dev->wl, "Fatal DMA error: "
1828                                "0x%08X, 0x%08X, 0x%08X, "
1829                                "0x%08X, 0x%08X, 0x%08X\n",
1830                                dma_reason[0], dma_reason[1],
1831                                dma_reason[2], dma_reason[3],
1832                                dma_reason[4], dma_reason[5]);
1833                         b43_controller_restart(dev, "DMA error");
1834                         return;
1835                 }
1836                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1837                         b43err(dev->wl, "DMA error: "
1838                                "0x%08X, 0x%08X, 0x%08X, "
1839                                "0x%08X, 0x%08X, 0x%08X\n",
1840                                dma_reason[0], dma_reason[1],
1841                                dma_reason[2], dma_reason[3],
1842                                dma_reason[4], dma_reason[5]);
1843                 }
1844         }
1845
1846         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1847                 handle_irq_ucode_debug(dev);
1848         if (reason & B43_IRQ_TBTT_INDI)
1849                 handle_irq_tbtt_indication(dev);
1850         if (reason & B43_IRQ_ATIM_END)
1851                 handle_irq_atim_end(dev);
1852         if (reason & B43_IRQ_BEACON)
1853                 handle_irq_beacon(dev);
1854         if (reason & B43_IRQ_PMQ)
1855                 handle_irq_pmq(dev);
1856         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1857                 ;/* TODO */
1858         if (reason & B43_IRQ_NOISESAMPLE_OK)
1859                 handle_irq_noise(dev);
1860
1861         /* Check the DMA reason registers for received data. */
1862         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1863                 if (b43_using_pio_transfers(dev))
1864                         b43_pio_rx(dev->pio.rx_queue);
1865                 else
1866                         b43_dma_rx(dev->dma.rx_ring);
1867         }
1868         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1869         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1870         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1871         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1872         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1873
1874         if (reason & B43_IRQ_TX_OK)
1875                 handle_irq_transmit_status(dev);
1876
1877         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1878         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1879 }
1880
1881 /* Interrupt thread handler. Handles device interrupts in thread context. */
1882 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1883 {
1884         struct b43_wldev *dev = dev_id;
1885
1886         mutex_lock(&dev->wl->mutex);
1887         b43_do_interrupt_thread(dev);
1888         mmiowb();
1889         mutex_unlock(&dev->wl->mutex);
1890
1891         return IRQ_HANDLED;
1892 }
1893
1894 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1895 {
1896         u32 reason;
1897
1898         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1899          * On SDIO, this runs under wl->mutex. */
1900
1901         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1902         if (reason == 0xffffffff)       /* shared IRQ */
1903                 return IRQ_NONE;
1904         reason &= dev->irq_mask;
1905         if (!reason)
1906                 return IRQ_HANDLED;
1907
1908         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1909             & 0x0001DC00;
1910         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1911             & 0x0000DC00;
1912         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1913             & 0x0000DC00;
1914         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1915             & 0x0001DC00;
1916         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1917             & 0x0000DC00;
1918 /* Unused ring
1919         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1920             & 0x0000DC00;
1921 */
1922
1923         /* ACK the interrupt. */
1924         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1925         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1926         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1927         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1928         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1929         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1930 /* Unused ring
1931         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1932 */
1933
1934         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1935         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1936         /* Save the reason bitmasks for the IRQ thread handler. */
1937         dev->irq_reason = reason;
1938
1939         return IRQ_WAKE_THREAD;
1940 }
1941
1942 /* Interrupt handler top-half. This runs with interrupts disabled. */
1943 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1944 {
1945         struct b43_wldev *dev = dev_id;
1946         irqreturn_t ret;
1947
1948         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1949                 return IRQ_NONE;
1950
1951         spin_lock(&dev->wl->hardirq_lock);
1952         ret = b43_do_interrupt(dev);
1953         mmiowb();
1954         spin_unlock(&dev->wl->hardirq_lock);
1955
1956         return ret;
1957 }
1958
1959 void b43_do_release_fw(struct b43_firmware_file *fw)
1960 {
1961         release_firmware(fw->data);
1962         fw->data = NULL;
1963         fw->filename = NULL;
1964 }
1965
1966 static void b43_release_firmware(struct b43_wldev *dev)
1967 {
1968         b43_do_release_fw(&dev->fw.ucode);
1969         b43_do_release_fw(&dev->fw.pcm);
1970         b43_do_release_fw(&dev->fw.initvals);
1971         b43_do_release_fw(&dev->fw.initvals_band);
1972 }
1973
1974 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1975 {
1976         const char text[] =
1977                 "You must go to " \
1978                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1979                 "and download the correct firmware for this driver version. " \
1980                 "Please carefully read all instructions on this website.\n";
1981
1982         if (error)
1983                 b43err(wl, text);
1984         else
1985                 b43warn(wl, text);
1986 }
1987
1988 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1989                       const char *name,
1990                       struct b43_firmware_file *fw)
1991 {
1992         const struct firmware *blob;
1993         struct b43_fw_header *hdr;
1994         u32 size;
1995         int err;
1996
1997         if (!name) {
1998                 /* Don't fetch anything. Free possibly cached firmware. */
1999                 /* FIXME: We should probably keep it anyway, to save some headache
2000                  * on suspend/resume with multiband devices. */
2001                 b43_do_release_fw(fw);
2002                 return 0;
2003         }
2004         if (fw->filename) {
2005                 if ((fw->type == ctx->req_type) &&
2006                     (strcmp(fw->filename, name) == 0))
2007                         return 0; /* Already have this fw. */
2008                 /* Free the cached firmware first. */
2009                 /* FIXME: We should probably do this later after we successfully
2010                  * got the new fw. This could reduce headache with multiband devices.
2011                  * We could also redesign this to cache the firmware for all possible
2012                  * bands all the time. */
2013                 b43_do_release_fw(fw);
2014         }
2015
2016         switch (ctx->req_type) {
2017         case B43_FWTYPE_PROPRIETARY:
2018                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2019                          "b43%s/%s.fw",
2020                          modparam_fwpostfix, name);
2021                 break;
2022         case B43_FWTYPE_OPENSOURCE:
2023                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2024                          "b43-open%s/%s.fw",
2025                          modparam_fwpostfix, name);
2026                 break;
2027         default:
2028                 B43_WARN_ON(1);
2029                 return -ENOSYS;
2030         }
2031         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2032         if (err == -ENOENT) {
2033                 snprintf(ctx->errors[ctx->req_type],
2034                          sizeof(ctx->errors[ctx->req_type]),
2035                          "Firmware file \"%s\" not found\n", ctx->fwname);
2036                 return err;
2037         } else if (err) {
2038                 snprintf(ctx->errors[ctx->req_type],
2039                          sizeof(ctx->errors[ctx->req_type]),
2040                          "Firmware file \"%s\" request failed (err=%d)\n",
2041                          ctx->fwname, err);
2042                 return err;
2043         }
2044         if (blob->size < sizeof(struct b43_fw_header))
2045                 goto err_format;
2046         hdr = (struct b43_fw_header *)(blob->data);
2047         switch (hdr->type) {
2048         case B43_FW_TYPE_UCODE:
2049         case B43_FW_TYPE_PCM:
2050                 size = be32_to_cpu(hdr->size);
2051                 if (size != blob->size - sizeof(struct b43_fw_header))
2052                         goto err_format;
2053                 /* fallthrough */
2054         case B43_FW_TYPE_IV:
2055                 if (hdr->ver != 1)
2056                         goto err_format;
2057                 break;
2058         default:
2059                 goto err_format;
2060         }
2061
2062         fw->data = blob;
2063         fw->filename = name;
2064         fw->type = ctx->req_type;
2065
2066         return 0;
2067
2068 err_format:
2069         snprintf(ctx->errors[ctx->req_type],
2070                  sizeof(ctx->errors[ctx->req_type]),
2071                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2072         release_firmware(blob);
2073
2074         return -EPROTO;
2075 }
2076
2077 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2078 {
2079         struct b43_wldev *dev = ctx->dev;
2080         struct b43_firmware *fw = &ctx->dev->fw;
2081         const u8 rev = ctx->dev->dev->id.revision;
2082         const char *filename;
2083         u32 tmshigh;
2084         int err;
2085
2086         /* Get microcode */
2087         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2088         if ((rev >= 5) && (rev <= 10))
2089                 filename = "ucode5";
2090         else if ((rev >= 11) && (rev <= 12))
2091                 filename = "ucode11";
2092         else if (rev == 13)
2093                 filename = "ucode13";
2094         else if (rev == 14)
2095                 filename = "ucode14";
2096         else if (rev >= 15)
2097                 filename = "ucode15";
2098         else
2099                 goto err_no_ucode;
2100         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2101         if (err)
2102                 goto err_load;
2103
2104         /* Get PCM code */
2105         if ((rev >= 5) && (rev <= 10))
2106                 filename = "pcm5";
2107         else if (rev >= 11)
2108                 filename = NULL;
2109         else
2110                 goto err_no_pcm;
2111         fw->pcm_request_failed = 0;
2112         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2113         if (err == -ENOENT) {
2114                 /* We did not find a PCM file? Not fatal, but
2115                  * core rev <= 10 must do without hwcrypto then. */
2116                 fw->pcm_request_failed = 1;
2117         } else if (err)
2118                 goto err_load;
2119
2120         /* Get initvals */
2121         switch (dev->phy.type) {
2122         case B43_PHYTYPE_A:
2123                 if ((rev >= 5) && (rev <= 10)) {
2124                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2125                                 filename = "a0g1initvals5";
2126                         else
2127                                 filename = "a0g0initvals5";
2128                 } else
2129                         goto err_no_initvals;
2130                 break;
2131         case B43_PHYTYPE_G:
2132                 if ((rev >= 5) && (rev <= 10))
2133                         filename = "b0g0initvals5";
2134                 else if (rev >= 13)
2135                         filename = "b0g0initvals13";
2136                 else
2137                         goto err_no_initvals;
2138                 break;
2139         case B43_PHYTYPE_N:
2140                 if ((rev >= 11) && (rev <= 12))
2141                         filename = "n0initvals11";
2142                 else
2143                         goto err_no_initvals;
2144                 break;
2145         case B43_PHYTYPE_LP:
2146                 if (rev == 13)
2147                         filename = "lp0initvals13";
2148                 else if (rev == 14)
2149                         filename = "lp0initvals14";
2150                 else if (rev >= 15)
2151                         filename = "lp0initvals15";
2152                 else
2153                         goto err_no_initvals;
2154                 break;
2155         default:
2156                 goto err_no_initvals;
2157         }
2158         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2159         if (err)
2160                 goto err_load;
2161
2162         /* Get bandswitch initvals */
2163         switch (dev->phy.type) {
2164         case B43_PHYTYPE_A:
2165                 if ((rev >= 5) && (rev <= 10)) {
2166                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2167                                 filename = "a0g1bsinitvals5";
2168                         else
2169                                 filename = "a0g0bsinitvals5";
2170                 } else if (rev >= 11)
2171                         filename = NULL;
2172                 else
2173                         goto err_no_initvals;
2174                 break;
2175         case B43_PHYTYPE_G:
2176                 if ((rev >= 5) && (rev <= 10))
2177                         filename = "b0g0bsinitvals5";
2178                 else if (rev >= 11)
2179                         filename = NULL;
2180                 else
2181                         goto err_no_initvals;
2182                 break;
2183         case B43_PHYTYPE_N:
2184                 if ((rev >= 11) && (rev <= 12))
2185                         filename = "n0bsinitvals11";
2186                 else
2187                         goto err_no_initvals;
2188                 break;
2189         case B43_PHYTYPE_LP:
2190                 if (rev == 13)
2191                         filename = "lp0bsinitvals13";
2192                 else if (rev == 14)
2193                         filename = "lp0bsinitvals14";
2194                 else if (rev >= 15)
2195                         filename = "lp0bsinitvals15";
2196                 else
2197                         goto err_no_initvals;
2198                 break;
2199         default:
2200                 goto err_no_initvals;
2201         }
2202         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2203         if (err)
2204                 goto err_load;
2205
2206         return 0;
2207
2208 err_no_ucode:
2209         err = ctx->fatal_failure = -EOPNOTSUPP;
2210         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2211                "is required for your device (wl-core rev %u)\n", rev);
2212         goto error;
2213
2214 err_no_pcm:
2215         err = ctx->fatal_failure = -EOPNOTSUPP;
2216         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2217                "is required for your device (wl-core rev %u)\n", rev);
2218         goto error;
2219
2220 err_no_initvals:
2221         err = ctx->fatal_failure = -EOPNOTSUPP;
2222         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2223                "is required for your device (wl-core rev %u)\n", rev);
2224         goto error;
2225
2226 err_load:
2227         /* We failed to load this firmware image. The error message
2228          * already is in ctx->errors. Return and let our caller decide
2229          * what to do. */
2230         goto error;
2231
2232 error:
2233         b43_release_firmware(dev);
2234         return err;
2235 }
2236
2237 static int b43_request_firmware(struct b43_wldev *dev)
2238 {
2239         struct b43_request_fw_context *ctx;
2240         unsigned int i;
2241         int err;
2242         const char *errmsg;
2243
2244         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2245         if (!ctx)
2246                 return -ENOMEM;
2247         ctx->dev = dev;
2248
2249         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2250         err = b43_try_request_fw(ctx);
2251         if (!err)
2252                 goto out; /* Successfully loaded it. */
2253         err = ctx->fatal_failure;
2254         if (err)
2255                 goto out;
2256
2257         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2258         err = b43_try_request_fw(ctx);
2259         if (!err)
2260                 goto out; /* Successfully loaded it. */
2261         err = ctx->fatal_failure;
2262         if (err)
2263                 goto out;
2264
2265         /* Could not find a usable firmware. Print the errors. */
2266         for (i = 0; i < B43_NR_FWTYPES; i++) {
2267                 errmsg = ctx->errors[i];
2268                 if (strlen(errmsg))
2269                         b43err(dev->wl, errmsg);
2270         }
2271         b43_print_fw_helptext(dev->wl, 1);
2272         err = -ENOENT;
2273
2274 out:
2275         kfree(ctx);
2276         return err;
2277 }
2278
2279 static int b43_upload_microcode(struct b43_wldev *dev)
2280 {
2281         const size_t hdr_len = sizeof(struct b43_fw_header);
2282         const __be32 *data;
2283         unsigned int i, len;
2284         u16 fwrev, fwpatch, fwdate, fwtime;
2285         u32 tmp, macctl;
2286         int err = 0;
2287
2288         /* Jump the microcode PSM to offset 0 */
2289         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2290         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2291         macctl |= B43_MACCTL_PSM_JMP0;
2292         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2293         /* Zero out all microcode PSM registers and shared memory. */
2294         for (i = 0; i < 64; i++)
2295                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2296         for (i = 0; i < 4096; i += 2)
2297                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2298
2299         /* Upload Microcode. */
2300         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2301         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2302         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2303         for (i = 0; i < len; i++) {
2304                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2305                 udelay(10);
2306         }
2307
2308         if (dev->fw.pcm.data) {
2309                 /* Upload PCM data. */
2310                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2311                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2312                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2313                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2314                 /* No need for autoinc bit in SHM_HW */
2315                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2316                 for (i = 0; i < len; i++) {
2317                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2318                         udelay(10);
2319                 }
2320         }
2321
2322         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2323
2324         /* Start the microcode PSM */
2325         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2326         macctl &= ~B43_MACCTL_PSM_JMP0;
2327         macctl |= B43_MACCTL_PSM_RUN;
2328         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2329
2330         /* Wait for the microcode to load and respond */
2331         i = 0;
2332         while (1) {
2333                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2334                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2335                         break;
2336                 i++;
2337                 if (i >= 20) {
2338                         b43err(dev->wl, "Microcode not responding\n");
2339                         b43_print_fw_helptext(dev->wl, 1);
2340                         err = -ENODEV;
2341                         goto error;
2342                 }
2343                 msleep_interruptible(50);
2344                 if (signal_pending(current)) {
2345                         err = -EINTR;
2346                         goto error;
2347                 }
2348         }
2349         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2350
2351         /* Get and check the revisions. */
2352         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2353         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2354         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2355         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2356
2357         if (fwrev <= 0x128) {
2358                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2359                        "binary drivers older than version 4.x is unsupported. "
2360                        "You must upgrade your firmware files.\n");
2361                 b43_print_fw_helptext(dev->wl, 1);
2362                 err = -EOPNOTSUPP;
2363                 goto error;
2364         }
2365         dev->fw.rev = fwrev;
2366         dev->fw.patch = fwpatch;
2367         dev->fw.opensource = (fwdate == 0xFFFF);
2368
2369         /* Default to use-all-queues. */
2370         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2371         dev->qos_enabled = !!modparam_qos;
2372         /* Default to firmware/hardware crypto acceleration. */
2373         dev->hwcrypto_enabled = 1;
2374
2375         if (dev->fw.opensource) {
2376                 u16 fwcapa;
2377
2378                 /* Patchlevel info is encoded in the "time" field. */
2379                 dev->fw.patch = fwtime;
2380                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2381                         dev->fw.rev, dev->fw.patch);
2382
2383                 fwcapa = b43_fwcapa_read(dev);
2384                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2385                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2386                         /* Disable hardware crypto and fall back to software crypto. */
2387                         dev->hwcrypto_enabled = 0;
2388                 }
2389                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2390                         b43info(dev->wl, "QoS not supported by firmware\n");
2391                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2392                          * ieee80211_unregister to make sure the networking core can
2393                          * properly free possible resources. */
2394                         dev->wl->hw->queues = 1;
2395                         dev->qos_enabled = 0;
2396                 }
2397         } else {
2398                 b43info(dev->wl, "Loading firmware version %u.%u "
2399                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2400                         fwrev, fwpatch,
2401                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2402                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2403                 if (dev->fw.pcm_request_failed) {
2404                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2405                                 "Hardware accelerated cryptography is disabled.\n");
2406                         b43_print_fw_helptext(dev->wl, 0);
2407                 }
2408         }
2409
2410         if (b43_is_old_txhdr_format(dev)) {
2411                 /* We're over the deadline, but we keep support for old fw
2412                  * until it turns out to be in major conflict with something new. */
2413                 b43warn(dev->wl, "You are using an old firmware image. "
2414                         "Support for old firmware will be removed soon "
2415                         "(official deadline was July 2008).\n");
2416                 b43_print_fw_helptext(dev->wl, 0);
2417         }
2418
2419         return 0;
2420
2421 error:
2422         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2423         macctl &= ~B43_MACCTL_PSM_RUN;
2424         macctl |= B43_MACCTL_PSM_JMP0;
2425         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2426
2427         return err;
2428 }
2429
2430 static int b43_write_initvals(struct b43_wldev *dev,
2431                               const struct b43_iv *ivals,
2432                               size_t count,
2433                               size_t array_size)
2434 {
2435         const struct b43_iv *iv;
2436         u16 offset;
2437         size_t i;
2438         bool bit32;
2439
2440         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2441         iv = ivals;
2442         for (i = 0; i < count; i++) {
2443                 if (array_size < sizeof(iv->offset_size))
2444                         goto err_format;
2445                 array_size -= sizeof(iv->offset_size);
2446                 offset = be16_to_cpu(iv->offset_size);
2447                 bit32 = !!(offset & B43_IV_32BIT);
2448                 offset &= B43_IV_OFFSET_MASK;
2449                 if (offset >= 0x1000)
2450                         goto err_format;
2451                 if (bit32) {
2452                         u32 value;
2453
2454                         if (array_size < sizeof(iv->data.d32))
2455                                 goto err_format;
2456                         array_size -= sizeof(iv->data.d32);
2457
2458                         value = get_unaligned_be32(&iv->data.d32);
2459                         b43_write32(dev, offset, value);
2460
2461                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2462                                                         sizeof(__be16) +
2463                                                         sizeof(__be32));
2464                 } else {
2465                         u16 value;
2466
2467                         if (array_size < sizeof(iv->data.d16))
2468                                 goto err_format;
2469                         array_size -= sizeof(iv->data.d16);
2470
2471                         value = be16_to_cpu(iv->data.d16);
2472                         b43_write16(dev, offset, value);
2473
2474                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2475                                                         sizeof(__be16) +
2476                                                         sizeof(__be16));
2477                 }
2478         }
2479         if (array_size)
2480                 goto err_format;
2481
2482         return 0;
2483
2484 err_format:
2485         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2486         b43_print_fw_helptext(dev->wl, 1);
2487
2488         return -EPROTO;
2489 }
2490
2491 static int b43_upload_initvals(struct b43_wldev *dev)
2492 {
2493         const size_t hdr_len = sizeof(struct b43_fw_header);
2494         const struct b43_fw_header *hdr;
2495         struct b43_firmware *fw = &dev->fw;
2496         const struct b43_iv *ivals;
2497         size_t count;
2498         int err;
2499
2500         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2501         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2502         count = be32_to_cpu(hdr->size);
2503         err = b43_write_initvals(dev, ivals, count,
2504                                  fw->initvals.data->size - hdr_len);
2505         if (err)
2506                 goto out;
2507         if (fw->initvals_band.data) {
2508                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2509                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2510                 count = be32_to_cpu(hdr->size);
2511                 err = b43_write_initvals(dev, ivals, count,
2512                                          fw->initvals_band.data->size - hdr_len);
2513                 if (err)
2514                         goto out;
2515         }
2516 out:
2517
2518         return err;
2519 }
2520
2521 /* Initialize the GPIOs
2522  * http://bcm-specs.sipsolutions.net/GPIO
2523  */
2524 static int b43_gpio_init(struct b43_wldev *dev)
2525 {
2526         struct ssb_bus *bus = dev->dev->bus;
2527         struct ssb_device *gpiodev, *pcidev = NULL;
2528         u32 mask, set;
2529
2530         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2531                     & ~B43_MACCTL_GPOUTSMSK);
2532
2533         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2534                     | 0x000F);
2535
2536         mask = 0x0000001F;
2537         set = 0x0000000F;
2538         if (dev->dev->bus->chip_id == 0x4301) {
2539                 mask |= 0x0060;
2540                 set |= 0x0060;
2541         }
2542         if (0 /* FIXME: conditional unknown */ ) {
2543                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2544                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2545                             | 0x0100);
2546                 mask |= 0x0180;
2547                 set |= 0x0180;
2548         }
2549         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2550                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2551                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2552                             | 0x0200);
2553                 mask |= 0x0200;
2554                 set |= 0x0200;
2555         }
2556         if (dev->dev->id.revision >= 2)
2557                 mask |= 0x0010; /* FIXME: This is redundant. */
2558
2559 #ifdef CONFIG_SSB_DRIVER_PCICORE
2560         pcidev = bus->pcicore.dev;
2561 #endif
2562         gpiodev = bus->chipco.dev ? : pcidev;
2563         if (!gpiodev)
2564                 return 0;
2565         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2566                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2567                      & mask) | set);
2568
2569         return 0;
2570 }
2571
2572 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2573 static void b43_gpio_cleanup(struct b43_wldev *dev)
2574 {
2575         struct ssb_bus *bus = dev->dev->bus;
2576         struct ssb_device *gpiodev, *pcidev = NULL;
2577
2578 #ifdef CONFIG_SSB_DRIVER_PCICORE
2579         pcidev = bus->pcicore.dev;
2580 #endif
2581         gpiodev = bus->chipco.dev ? : pcidev;
2582         if (!gpiodev)
2583                 return;
2584         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2585 }
2586
2587 /* http://bcm-specs.sipsolutions.net/EnableMac */
2588 void b43_mac_enable(struct b43_wldev *dev)
2589 {
2590         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2591                 u16 fwstate;
2592
2593                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2594                                          B43_SHM_SH_UCODESTAT);
2595                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2596                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2597                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2598                                "should be suspended, but current state is %u\n",
2599                                fwstate);
2600                 }
2601         }
2602
2603         dev->mac_suspended--;
2604         B43_WARN_ON(dev->mac_suspended < 0);
2605         if (dev->mac_suspended == 0) {
2606                 b43_write32(dev, B43_MMIO_MACCTL,
2607                             b43_read32(dev, B43_MMIO_MACCTL)
2608                             | B43_MACCTL_ENABLED);
2609                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2610                             B43_IRQ_MAC_SUSPENDED);
2611                 /* Commit writes */
2612                 b43_read32(dev, B43_MMIO_MACCTL);
2613                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2614                 b43_power_saving_ctl_bits(dev, 0);
2615         }
2616 }
2617
2618 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2619 void b43_mac_suspend(struct b43_wldev *dev)
2620 {
2621         int i;
2622         u32 tmp;
2623
2624         might_sleep();
2625         B43_WARN_ON(dev->mac_suspended < 0);
2626
2627         if (dev->mac_suspended == 0) {
2628                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2629                 b43_write32(dev, B43_MMIO_MACCTL,
2630                             b43_read32(dev, B43_MMIO_MACCTL)
2631                             & ~B43_MACCTL_ENABLED);
2632                 /* force pci to flush the write */
2633                 b43_read32(dev, B43_MMIO_MACCTL);
2634                 for (i = 35; i; i--) {
2635                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2636                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2637                                 goto out;
2638                         udelay(10);
2639                 }
2640                 /* Hm, it seems this will take some time. Use msleep(). */
2641                 for (i = 40; i; i--) {
2642                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2643                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2644                                 goto out;
2645                         msleep(1);
2646                 }
2647                 b43err(dev->wl, "MAC suspend failed\n");
2648         }
2649 out:
2650         dev->mac_suspended++;
2651 }
2652
2653 static void b43_adjust_opmode(struct b43_wldev *dev)
2654 {
2655         struct b43_wl *wl = dev->wl;
2656         u32 ctl;
2657         u16 cfp_pretbtt;
2658
2659         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2660         /* Reset status to STA infrastructure mode. */
2661         ctl &= ~B43_MACCTL_AP;
2662         ctl &= ~B43_MACCTL_KEEP_CTL;
2663         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2664         ctl &= ~B43_MACCTL_KEEP_BAD;
2665         ctl &= ~B43_MACCTL_PROMISC;
2666         ctl &= ~B43_MACCTL_BEACPROMISC;
2667         ctl |= B43_MACCTL_INFRA;
2668
2669         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2670             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2671                 ctl |= B43_MACCTL_AP;
2672         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2673                 ctl &= ~B43_MACCTL_INFRA;
2674
2675         if (wl->filter_flags & FIF_CONTROL)
2676                 ctl |= B43_MACCTL_KEEP_CTL;
2677         if (wl->filter_flags & FIF_FCSFAIL)
2678                 ctl |= B43_MACCTL_KEEP_BAD;
2679         if (wl->filter_flags & FIF_PLCPFAIL)
2680                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2681         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2682                 ctl |= B43_MACCTL_PROMISC;
2683         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2684                 ctl |= B43_MACCTL_BEACPROMISC;
2685
2686         /* Workaround: On old hardware the HW-MAC-address-filter
2687          * doesn't work properly, so always run promisc in filter
2688          * it in software. */
2689         if (dev->dev->id.revision <= 4)
2690                 ctl |= B43_MACCTL_PROMISC;
2691
2692         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2693
2694         cfp_pretbtt = 2;
2695         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2696                 if (dev->dev->bus->chip_id == 0x4306 &&
2697                     dev->dev->bus->chip_rev == 3)
2698                         cfp_pretbtt = 100;
2699                 else
2700                         cfp_pretbtt = 50;
2701         }
2702         b43_write16(dev, 0x612, cfp_pretbtt);
2703 }
2704
2705 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2706 {
2707         u16 offset;
2708
2709         if (is_ofdm) {
2710                 offset = 0x480;
2711                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2712         } else {
2713                 offset = 0x4C0;
2714                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2715         }
2716         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2717                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2718 }
2719
2720 static void b43_rate_memory_init(struct b43_wldev *dev)
2721 {
2722         switch (dev->phy.type) {
2723         case B43_PHYTYPE_A:
2724         case B43_PHYTYPE_G:
2725         case B43_PHYTYPE_N:
2726         case B43_PHYTYPE_LP:
2727                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2728                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2729                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2730                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2731                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2732                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2733                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2734                 if (dev->phy.type == B43_PHYTYPE_A)
2735                         break;
2736                 /* fallthrough */
2737         case B43_PHYTYPE_B:
2738                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2739                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2740                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2741                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2742                 break;
2743         default:
2744                 B43_WARN_ON(1);
2745         }
2746 }
2747
2748 /* Set the default values for the PHY TX Control Words. */
2749 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2750 {
2751         u16 ctl = 0;
2752
2753         ctl |= B43_TXH_PHY_ENC_CCK;
2754         ctl |= B43_TXH_PHY_ANT01AUTO;
2755         ctl |= B43_TXH_PHY_TXPWR;
2756
2757         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2758         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2759         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2760 }
2761
2762 /* Set the TX-Antenna for management frames sent by firmware. */
2763 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2764 {
2765         u16 ant;
2766         u16 tmp;
2767
2768         ant = b43_antenna_to_phyctl(antenna);
2769
2770         /* For ACK/CTS */
2771         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2772         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2773         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2774         /* For Probe Resposes */
2775         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2776         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2777         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2778 }
2779
2780 /* This is the opposite of b43_chip_init() */
2781 static void b43_chip_exit(struct b43_wldev *dev)
2782 {
2783         b43_phy_exit(dev);
2784         b43_gpio_cleanup(dev);
2785         /* firmware is released later */
2786 }
2787
2788 /* Initialize the chip
2789  * http://bcm-specs.sipsolutions.net/ChipInit
2790  */
2791 static int b43_chip_init(struct b43_wldev *dev)
2792 {
2793         struct b43_phy *phy = &dev->phy;
2794         int err;
2795         u32 value32, macctl;
2796         u16 value16;
2797
2798         /* Initialize the MAC control */
2799         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2800         if (dev->phy.gmode)
2801                 macctl |= B43_MACCTL_GMODE;
2802         macctl |= B43_MACCTL_INFRA;
2803         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2804
2805         err = b43_request_firmware(dev);
2806         if (err)
2807                 goto out;
2808         err = b43_upload_microcode(dev);
2809         if (err)
2810                 goto out;       /* firmware is released later */
2811
2812         err = b43_gpio_init(dev);
2813         if (err)
2814                 goto out;       /* firmware is released later */
2815
2816         err = b43_upload_initvals(dev);
2817         if (err)
2818                 goto err_gpio_clean;
2819
2820         /* Turn the Analog on and initialize the PHY. */
2821         phy->ops->switch_analog(dev, 1);
2822         err = b43_phy_init(dev);
2823         if (err)
2824                 goto err_gpio_clean;
2825
2826         /* Disable Interference Mitigation. */
2827         if (phy->ops->interf_mitigation)
2828                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2829
2830         /* Select the antennae */
2831         if (phy->ops->set_rx_antenna)
2832                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2833         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2834
2835         if (phy->type == B43_PHYTYPE_B) {
2836                 value16 = b43_read16(dev, 0x005E);
2837                 value16 |= 0x0004;
2838                 b43_write16(dev, 0x005E, value16);
2839         }
2840         b43_write32(dev, 0x0100, 0x01000000);
2841         if (dev->dev->id.revision < 5)
2842                 b43_write32(dev, 0x010C, 0x01000000);
2843
2844         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2845                     & ~B43_MACCTL_INFRA);
2846         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2847                     | B43_MACCTL_INFRA);
2848
2849         /* Probe Response Timeout value */
2850         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2851         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2852
2853         /* Initially set the wireless operation mode. */
2854         b43_adjust_opmode(dev);
2855
2856         if (dev->dev->id.revision < 3) {
2857                 b43_write16(dev, 0x060E, 0x0000);
2858                 b43_write16(dev, 0x0610, 0x8000);
2859                 b43_write16(dev, 0x0604, 0x0000);
2860                 b43_write16(dev, 0x0606, 0x0200);
2861         } else {
2862                 b43_write32(dev, 0x0188, 0x80000000);
2863                 b43_write32(dev, 0x018C, 0x02000000);
2864         }
2865         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2866         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2867         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2868         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2869         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2870         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2871         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2872
2873         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2874         value32 |= 0x00100000;
2875         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2876
2877         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2878                     dev->dev->bus->chipco.fast_pwrup_delay);
2879
2880         err = 0;
2881         b43dbg(dev->wl, "Chip initialized\n");
2882 out:
2883         return err;
2884
2885 err_gpio_clean:
2886         b43_gpio_cleanup(dev);
2887         return err;
2888 }
2889
2890 static void b43_periodic_every60sec(struct b43_wldev *dev)
2891 {
2892         const struct b43_phy_operations *ops = dev->phy.ops;
2893
2894         if (ops->pwork_60sec)
2895                 ops->pwork_60sec(dev);
2896
2897         /* Force check the TX power emission now. */
2898         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2899 }
2900
2901 static void b43_periodic_every30sec(struct b43_wldev *dev)
2902 {
2903         /* Update device statistics. */
2904         b43_calculate_link_quality(dev);
2905 }
2906
2907 static void b43_periodic_every15sec(struct b43_wldev *dev)
2908 {
2909         struct b43_phy *phy = &dev->phy;
2910         u16 wdr;
2911
2912         if (dev->fw.opensource) {
2913                 /* Check if the firmware is still alive.
2914                  * It will reset the watchdog counter to 0 in its idle loop. */
2915                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2916                 if (unlikely(wdr)) {
2917                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2918                         b43_controller_restart(dev, "Firmware watchdog");
2919                         return;
2920                 } else {
2921                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2922                                         B43_WATCHDOG_REG, 1);
2923                 }
2924         }
2925
2926         if (phy->ops->pwork_15sec)
2927                 phy->ops->pwork_15sec(dev);
2928
2929         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2930         wmb();
2931 }
2932
2933 static void do_periodic_work(struct b43_wldev *dev)
2934 {
2935         unsigned int state;
2936
2937         state = dev->periodic_state;
2938         if (state % 4 == 0)
2939                 b43_periodic_every60sec(dev);
2940         if (state % 2 == 0)
2941                 b43_periodic_every30sec(dev);
2942         b43_periodic_every15sec(dev);
2943 }
2944
2945 /* Periodic work locking policy:
2946  *      The whole periodic work handler is protected by
2947  *      wl->mutex. If another lock is needed somewhere in the
2948  *      pwork callchain, it's aquired in-place, where it's needed.
2949  */
2950 static void b43_periodic_work_handler(struct work_struct *work)
2951 {
2952         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2953                                              periodic_work.work);
2954         struct b43_wl *wl = dev->wl;
2955         unsigned long delay;
2956
2957         mutex_lock(&wl->mutex);
2958
2959         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2960                 goto out;
2961         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2962                 goto out_requeue;
2963
2964         do_periodic_work(dev);
2965
2966         dev->periodic_state++;
2967 out_requeue:
2968         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2969                 delay = msecs_to_jiffies(50);
2970         else
2971                 delay = round_jiffies_relative(HZ * 15);
2972         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2973 out:
2974         mutex_unlock(&wl->mutex);
2975 }
2976
2977 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2978 {
2979         struct delayed_work *work = &dev->periodic_work;
2980
2981         dev->periodic_state = 0;
2982         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2983         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2984 }
2985
2986 /* Check if communication with the device works correctly. */
2987 static int b43_validate_chipaccess(struct b43_wldev *dev)
2988 {
2989         u32 v, backup0, backup4;
2990
2991         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2992         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2993
2994         /* Check for read/write and endianness problems. */
2995         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2996         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2997                 goto error;
2998         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2999         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3000                 goto error;
3001
3002         /* Check if unaligned 32bit SHM_SHARED access works properly.
3003          * However, don't bail out on failure, because it's noncritical. */
3004         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3005         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3006         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3007         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3008         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3009                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3010         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3011         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3012             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3013             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3014             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3015                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3016
3017         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3018         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3019
3020         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
3021                 /* The 32bit register shadows the two 16bit registers
3022                  * with update sideeffects. Validate this. */
3023                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3024                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3025                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3026                         goto error;
3027                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3028                         goto error;
3029         }
3030         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3031
3032         v = b43_read32(dev, B43_MMIO_MACCTL);
3033         v |= B43_MACCTL_GMODE;
3034         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3035                 goto error;
3036
3037         return 0;
3038 error:
3039         b43err(dev->wl, "Failed to validate the chipaccess\n");
3040         return -ENODEV;
3041 }
3042
3043 static void b43_security_init(struct b43_wldev *dev)
3044 {
3045         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3046         /* KTP is a word address, but we address SHM bytewise.
3047          * So multiply by two.
3048          */
3049         dev->ktp *= 2;
3050         /* Number of RCMTA address slots */
3051         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3052         /* Clear the key memory. */
3053         b43_clear_keys(dev);
3054 }
3055
3056 #ifdef CONFIG_B43_HWRNG
3057 static int b43_rng_read(struct hwrng *rng, u32 *data)
3058 {
3059         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3060
3061         /* FIXME: We need to take wl->mutex here to make sure the device
3062          * is not going away from under our ass. However it could deadlock
3063          * with hwrng internal locking. */
3064
3065         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
3066
3067         return (sizeof(u16));
3068 }
3069 #endif /* CONFIG_B43_HWRNG */
3070
3071 static void b43_rng_exit(struct b43_wl *wl)
3072 {
3073 #ifdef CONFIG_B43_HWRNG
3074         if (wl->rng_initialized)
3075                 hwrng_unregister(&wl->rng);
3076 #endif /* CONFIG_B43_HWRNG */
3077 }
3078
3079 static int b43_rng_init(struct b43_wl *wl)
3080 {
3081         int err = 0;
3082
3083 #ifdef CONFIG_B43_HWRNG
3084         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3085                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3086         wl->rng.name = wl->rng_name;
3087         wl->rng.data_read = b43_rng_read;
3088         wl->rng.priv = (unsigned long)wl;
3089         wl->rng_initialized = 1;
3090         err = hwrng_register(&wl->rng);
3091         if (err) {
3092                 wl->rng_initialized = 0;
3093                 b43err(wl, "Failed to register the random "
3094                        "number generator (%d)\n", err);
3095         }
3096 #endif /* CONFIG_B43_HWRNG */
3097
3098         return err;
3099 }
3100
3101 static int b43_op_tx(struct ieee80211_hw *hw,
3102                      struct sk_buff *skb)
3103 {
3104         struct b43_wl *wl = hw_to_b43_wl(hw);
3105         struct b43_wldev *dev = wl->current_dev;
3106         unsigned long flags;
3107         int err;
3108
3109         if (unlikely(skb->len < 2 + 2 + 6)) {
3110                 /* Too short, this can't be a valid frame. */
3111                 goto drop_packet;
3112         }
3113         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3114         if (unlikely(!dev))
3115                 goto drop_packet;
3116
3117         /* Transmissions on seperate queues can run concurrently. */
3118         read_lock_irqsave(&wl->tx_lock, flags);
3119
3120         err = -ENODEV;
3121         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3122                 if (b43_using_pio_transfers(dev))
3123                         err = b43_pio_tx(dev, skb);
3124                 else
3125                         err = b43_dma_tx(dev, skb);
3126         }
3127
3128         read_unlock_irqrestore(&wl->tx_lock, flags);
3129
3130         if (unlikely(err))
3131                 goto drop_packet;
3132         return NETDEV_TX_OK;
3133
3134 drop_packet:
3135         /* We can not transmit this packet. Drop it. */
3136         dev_kfree_skb_any(skb);
3137         return NETDEV_TX_OK;
3138 }
3139
3140 /* Locking: wl->irq_lock */
3141 static void b43_qos_params_upload(struct b43_wldev *dev,
3142                                   const struct ieee80211_tx_queue_params *p,
3143                                   u16 shm_offset)
3144 {
3145         u16 params[B43_NR_QOSPARAMS];
3146         int bslots, tmp;
3147         unsigned int i;
3148
3149         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3150
3151         memset(&params, 0, sizeof(params));
3152
3153         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3154         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3155         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3156         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3157         params[B43_QOSPARAM_AIFS] = p->aifs;
3158         params[B43_QOSPARAM_BSLOTS] = bslots;
3159         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3160
3161         for (i = 0; i < ARRAY_SIZE(params); i++) {
3162                 if (i == B43_QOSPARAM_STATUS) {
3163                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3164                                              shm_offset + (i * 2));
3165                         /* Mark the parameters as updated. */
3166                         tmp |= 0x100;
3167                         b43_shm_write16(dev, B43_SHM_SHARED,
3168                                         shm_offset + (i * 2),
3169                                         tmp);
3170                 } else {
3171                         b43_shm_write16(dev, B43_SHM_SHARED,
3172                                         shm_offset + (i * 2),
3173                                         params[i]);
3174                 }
3175         }
3176 }
3177
3178 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3179 static const u16 b43_qos_shm_offsets[] = {
3180         /* [mac80211-queue-nr] = SHM_OFFSET, */
3181         [0] = B43_QOS_VOICE,
3182         [1] = B43_QOS_VIDEO,
3183         [2] = B43_QOS_BESTEFFORT,
3184         [3] = B43_QOS_BACKGROUND,
3185 };
3186
3187 /* Update all QOS parameters in hardware. */
3188 static void b43_qos_upload_all(struct b43_wldev *dev)
3189 {
3190         struct b43_wl *wl = dev->wl;
3191         struct b43_qos_params *params;
3192         unsigned int i;
3193
3194         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3195                      ARRAY_SIZE(wl->qos_params));
3196
3197         b43_mac_suspend(dev);
3198         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3199                 params = &(wl->qos_params[i]);
3200                 b43_qos_params_upload(dev, &(params->p),
3201                                       b43_qos_shm_offsets[i]);
3202         }
3203         b43_mac_enable(dev);
3204 }
3205
3206 static void b43_qos_clear(struct b43_wl *wl)
3207 {
3208         struct b43_qos_params *params;
3209         unsigned int i;
3210
3211         /* Initialize QoS parameters to sane defaults. */
3212
3213         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3214                      ARRAY_SIZE(wl->qos_params));
3215
3216         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3217                 params = &(wl->qos_params[i]);
3218
3219                 switch (b43_qos_shm_offsets[i]) {
3220                 case B43_QOS_VOICE:
3221                         params->p.txop = 0;
3222                         params->p.aifs = 2;
3223                         params->p.cw_min = 0x0001;
3224                         params->p.cw_max = 0x0001;
3225                         break;
3226                 case B43_QOS_VIDEO:
3227                         params->p.txop = 0;
3228                         params->p.aifs = 2;
3229                         params->p.cw_min = 0x0001;
3230                         params->p.cw_max = 0x0001;
3231                         break;
3232                 case B43_QOS_BESTEFFORT:
3233                         params->p.txop = 0;
3234                         params->p.aifs = 3;
3235                         params->p.cw_min = 0x0001;
3236                         params->p.cw_max = 0x03FF;
3237                         break;
3238                 case B43_QOS_BACKGROUND:
3239                         params->p.txop = 0;
3240                         params->p.aifs = 7;
3241                         params->p.cw_min = 0x0001;
3242                         params->p.cw_max = 0x03FF;
3243                         break;
3244                 default:
3245                         B43_WARN_ON(1);
3246                 }
3247         }
3248 }
3249
3250 /* Initialize the core's QOS capabilities */
3251 static void b43_qos_init(struct b43_wldev *dev)
3252 {
3253         /* Upload the current QOS parameters. */
3254         b43_qos_upload_all(dev);
3255
3256         /* Enable QOS support. */
3257         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3258         b43_write16(dev, B43_MMIO_IFSCTL,
3259                     b43_read16(dev, B43_MMIO_IFSCTL)
3260                     | B43_MMIO_IFSCTL_USE_EDCF);
3261 }
3262
3263 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3264                           const struct ieee80211_tx_queue_params *params)
3265 {
3266         struct b43_wl *wl = hw_to_b43_wl(hw);
3267         struct b43_wldev *dev;
3268         unsigned int queue = (unsigned int)_queue;
3269         int err = -ENODEV;
3270
3271         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3272                 /* Queue not available or don't support setting
3273                  * params on this queue. Return success to not
3274                  * confuse mac80211. */
3275                 return 0;
3276         }
3277         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3278                      ARRAY_SIZE(wl->qos_params));
3279
3280         mutex_lock(&wl->mutex);
3281         dev = wl->current_dev;
3282         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3283                 goto out_unlock;
3284
3285         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3286         b43_mac_suspend(dev);
3287         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3288                               b43_qos_shm_offsets[queue]);
3289         b43_mac_enable(dev);
3290         err = 0;
3291
3292 out_unlock:
3293         mutex_unlock(&wl->mutex);
3294
3295         return err;
3296 }
3297
3298 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3299                                struct ieee80211_tx_queue_stats *stats)
3300 {
3301         struct b43_wl *wl = hw_to_b43_wl(hw);
3302         struct b43_wldev *dev;
3303         int err = -ENODEV;
3304
3305         mutex_lock(&wl->mutex);
3306         dev = wl->current_dev;
3307         if (dev && b43_status(dev) >= B43_STAT_STARTED) {
3308                 if (b43_using_pio_transfers(dev))
3309                         b43_pio_get_tx_stats(dev, stats);
3310                 else
3311                         b43_dma_get_tx_stats(dev, stats);
3312                 err = 0;
3313         }
3314         mutex_unlock(&wl->mutex);
3315
3316         return err;
3317 }
3318
3319 static int b43_op_get_stats(struct ieee80211_hw *hw,
3320                             struct ieee80211_low_level_stats *stats)
3321 {
3322         struct b43_wl *wl = hw_to_b43_wl(hw);
3323
3324         mutex_lock(&wl->mutex);
3325         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3326         mutex_unlock(&wl->mutex);
3327
3328         return 0;
3329 }
3330
3331 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3332 {
3333         struct b43_wl *wl = hw_to_b43_wl(hw);
3334         struct b43_wldev *dev;
3335         u64 tsf;
3336
3337         mutex_lock(&wl->mutex);
3338         dev = wl->current_dev;
3339
3340         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3341                 b43_tsf_read(dev, &tsf);
3342         else
3343                 tsf = 0;
3344
3345         mutex_unlock(&wl->mutex);
3346
3347         return tsf;
3348 }
3349
3350 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3351 {
3352         struct b43_wl *wl = hw_to_b43_wl(hw);
3353         struct b43_wldev *dev;
3354
3355         mutex_lock(&wl->mutex);
3356         dev = wl->current_dev;
3357
3358         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3359                 b43_tsf_write(dev, tsf);
3360
3361         mutex_unlock(&wl->mutex);
3362 }
3363
3364 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3365 {
3366         struct ssb_device *sdev = dev->dev;
3367         u32 tmslow;
3368
3369         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3370         tmslow &= ~B43_TMSLOW_GMODE;
3371         tmslow |= B43_TMSLOW_PHYRESET;
3372         tmslow |= SSB_TMSLOW_FGC;
3373         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3374         msleep(1);
3375
3376         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3377         tmslow &= ~SSB_TMSLOW_FGC;
3378         tmslow |= B43_TMSLOW_PHYRESET;
3379         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3380         msleep(1);
3381 }
3382
3383 static const char *band_to_string(enum ieee80211_band band)
3384 {
3385         switch (band) {
3386         case IEEE80211_BAND_5GHZ:
3387                 return "5";
3388         case IEEE80211_BAND_2GHZ:
3389                 return "2.4";
3390         default:
3391                 break;
3392         }
3393         B43_WARN_ON(1);
3394         return "";
3395 }
3396
3397 /* Expects wl->mutex locked */
3398 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3399 {
3400         struct b43_wldev *up_dev = NULL;
3401         struct b43_wldev *down_dev;
3402         struct b43_wldev *d;
3403         int err;
3404         bool uninitialized_var(gmode);
3405         int prev_status;
3406
3407         /* Find a device and PHY which supports the band. */
3408         list_for_each_entry(d, &wl->devlist, list) {
3409                 switch (chan->band) {
3410                 case IEEE80211_BAND_5GHZ:
3411                         if (d->phy.supports_5ghz) {
3412                                 up_dev = d;
3413                                 gmode = 0;
3414                         }
3415                         break;
3416                 case IEEE80211_BAND_2GHZ:
3417                         if (d->phy.supports_2ghz) {
3418                                 up_dev = d;
3419                                 gmode = 1;
3420                         }
3421                         break;
3422                 default:
3423                         B43_WARN_ON(1);
3424                         return -EINVAL;
3425                 }
3426                 if (up_dev)
3427                         break;
3428         }
3429         if (!up_dev) {
3430                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3431                        band_to_string(chan->band));
3432                 return -ENODEV;
3433         }
3434         if ((up_dev == wl->current_dev) &&
3435             (!!wl->current_dev->phy.gmode == !!gmode)) {
3436                 /* This device is already running. */
3437                 return 0;
3438         }
3439         b43dbg(wl, "Switching to %s-GHz band\n",
3440                band_to_string(chan->band));
3441         down_dev = wl->current_dev;
3442
3443         prev_status = b43_status(down_dev);
3444         /* Shutdown the currently running core. */
3445         if (prev_status >= B43_STAT_STARTED)
3446                 down_dev = b43_wireless_core_stop(down_dev);
3447         if (prev_status >= B43_STAT_INITIALIZED)
3448                 b43_wireless_core_exit(down_dev);
3449
3450         if (down_dev != up_dev) {
3451                 /* We switch to a different core, so we put PHY into
3452                  * RESET on the old core. */
3453                 b43_put_phy_into_reset(down_dev);
3454         }
3455
3456         /* Now start the new core. */
3457         up_dev->phy.gmode = gmode;
3458         if (prev_status >= B43_STAT_INITIALIZED) {
3459                 err = b43_wireless_core_init(up_dev);
3460                 if (err) {
3461                         b43err(wl, "Fatal: Could not initialize device for "
3462                                "selected %s-GHz band\n",
3463                                band_to_string(chan->band));
3464                         goto init_failure;
3465                 }
3466         }
3467         if (prev_status >= B43_STAT_STARTED) {
3468                 err = b43_wireless_core_start(up_dev);
3469                 if (err) {
3470                         b43err(wl, "Fatal: Coult not start device for "
3471                                "selected %s-GHz band\n",
3472                                band_to_string(chan->band));
3473                         b43_wireless_core_exit(up_dev);
3474                         goto init_failure;
3475                 }
3476         }
3477         B43_WARN_ON(b43_status(up_dev) != prev_status);
3478
3479         wl->current_dev = up_dev;
3480
3481         return 0;
3482 init_failure:
3483         /* Whoops, failed to init the new core. No core is operating now. */
3484         wl->current_dev = NULL;
3485         return err;
3486 }
3487
3488 /* Write the short and long frame retry limit values. */
3489 static void b43_set_retry_limits(struct b43_wldev *dev,
3490                                  unsigned int short_retry,
3491                                  unsigned int long_retry)
3492 {
3493         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3494          * the chip-internal counter. */
3495         short_retry = min(short_retry, (unsigned int)0xF);
3496         long_retry = min(long_retry, (unsigned int)0xF);
3497
3498         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3499                         short_retry);
3500         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3501                         long_retry);
3502 }
3503
3504 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3505 {
3506         struct b43_wl *wl = hw_to_b43_wl(hw);
3507         struct b43_wldev *dev;
3508         struct b43_phy *phy;
3509         struct ieee80211_conf *conf = &hw->conf;
3510         int antenna;
3511         int err = 0;
3512
3513         mutex_lock(&wl->mutex);
3514
3515         /* Switch the band (if necessary). This might change the active core. */
3516         err = b43_switch_band(wl, conf->channel);
3517         if (err)
3518                 goto out_unlock_mutex;
3519         dev = wl->current_dev;
3520         phy = &dev->phy;
3521
3522         b43_mac_suspend(dev);
3523
3524         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3525                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3526                                           conf->long_frame_max_tx_count);
3527         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3528         if (!changed)
3529                 goto out_mac_enable;
3530
3531         /* Switch to the requested channel.
3532          * The firmware takes care of races with the TX handler. */
3533         if (conf->channel->hw_value != phy->channel)
3534                 b43_switch_channel(dev, conf->channel->hw_value);
3535
3536         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3537
3538         /* Adjust the desired TX power level. */
3539         if (conf->power_level != 0) {
3540                 if (conf->power_level != phy->desired_txpower) {
3541                         phy->desired_txpower = conf->power_level;
3542                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3543                                                    B43_TXPWR_IGNORE_TSSI);
3544                 }
3545         }
3546
3547         /* Antennas for RX and management frame TX. */
3548         antenna = B43_ANTENNA_DEFAULT;
3549         b43_mgmtframe_txantenna(dev, antenna);
3550         antenna = B43_ANTENNA_DEFAULT;
3551         if (phy->ops->set_rx_antenna)
3552                 phy->ops->set_rx_antenna(dev, antenna);
3553
3554         if (wl->radio_enabled != phy->radio_on) {
3555                 if (wl->radio_enabled) {
3556                         b43_software_rfkill(dev, false);
3557                         b43info(dev->wl, "Radio turned on by software\n");
3558                         if (!dev->radio_hw_enable) {
3559                                 b43info(dev->wl, "The hardware RF-kill button "
3560                                         "still turns the radio physically off. "
3561                                         "Press the button to turn it on.\n");
3562                         }
3563                 } else {
3564                         b43_software_rfkill(dev, true);
3565                         b43info(dev->wl, "Radio turned off by software\n");
3566                 }
3567         }
3568
3569 out_mac_enable:
3570         b43_mac_enable(dev);
3571 out_unlock_mutex:
3572         mutex_unlock(&wl->mutex);
3573
3574         return err;
3575 }
3576
3577 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3578 {
3579         struct ieee80211_supported_band *sband =
3580                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3581         struct ieee80211_rate *rate;
3582         int i;
3583         u16 basic, direct, offset, basic_offset, rateptr;
3584
3585         for (i = 0; i < sband->n_bitrates; i++) {
3586                 rate = &sband->bitrates[i];
3587
3588                 if (b43_is_cck_rate(rate->hw_value)) {
3589                         direct = B43_SHM_SH_CCKDIRECT;
3590                         basic = B43_SHM_SH_CCKBASIC;
3591                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3592                         offset &= 0xF;
3593                 } else {
3594                         direct = B43_SHM_SH_OFDMDIRECT;
3595                         basic = B43_SHM_SH_OFDMBASIC;
3596                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3597                         offset &= 0xF;
3598                 }
3599
3600                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3601
3602                 if (b43_is_cck_rate(rate->hw_value)) {
3603                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3604                         basic_offset &= 0xF;
3605                 } else {
3606                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3607                         basic_offset &= 0xF;
3608                 }
3609
3610                 /*
3611                  * Get the pointer that we need to point to
3612                  * from the direct map
3613                  */
3614                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3615                                          direct + 2 * basic_offset);
3616                 /* and write it to the basic map */
3617                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3618                                 rateptr);
3619         }
3620 }
3621
3622 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3623                                     struct ieee80211_vif *vif,
3624                                     struct ieee80211_bss_conf *conf,
3625                                     u32 changed)
3626 {
3627         struct b43_wl *wl = hw_to_b43_wl(hw);
3628         struct b43_wldev *dev;
3629
3630         mutex_lock(&wl->mutex);
3631
3632         dev = wl->current_dev;
3633         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3634                 goto out_unlock_mutex;
3635
3636         B43_WARN_ON(wl->vif != vif);
3637
3638         if (changed & BSS_CHANGED_BSSID) {
3639                 if (conf->bssid)
3640                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3641                 else
3642                         memset(wl->bssid, 0, ETH_ALEN);
3643         }
3644
3645         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3646                 if (changed & BSS_CHANGED_BEACON &&
3647                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3648                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3649                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3650                         b43_update_templates(wl);
3651
3652                 if (changed & BSS_CHANGED_BSSID)
3653                         b43_write_mac_bssid_templates(dev);
3654         }
3655
3656         b43_mac_suspend(dev);
3657
3658         /* Update templates for AP/mesh mode. */
3659         if (changed & BSS_CHANGED_BEACON_INT &&
3660             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3661              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3662              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3663                 b43_set_beacon_int(dev, conf->beacon_int);
3664
3665         if (changed & BSS_CHANGED_BASIC_RATES)
3666                 b43_update_basic_rates(dev, conf->basic_rates);
3667
3668         if (changed & BSS_CHANGED_ERP_SLOT) {
3669                 if (conf->use_short_slot)
3670                         b43_short_slot_timing_enable(dev);
3671                 else
3672                         b43_short_slot_timing_disable(dev);
3673         }
3674
3675         b43_mac_enable(dev);
3676 out_unlock_mutex:
3677         mutex_unlock(&wl->mutex);
3678 }
3679
3680 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3681                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3682                           struct ieee80211_key_conf *key)
3683 {
3684         struct b43_wl *wl = hw_to_b43_wl(hw);
3685         struct b43_wldev *dev;
3686         u8 algorithm;
3687         u8 index;
3688         int err;
3689         unsigned long flags;
3690         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3691
3692         if (modparam_nohwcrypt)
3693                 return -ENOSPC; /* User disabled HW-crypto */
3694
3695         mutex_lock(&wl->mutex);
3696         write_lock_irqsave(&wl->tx_lock, flags);
3697         /* mutex     -> Every config operation must take it.
3698          * tx_lock   -> We modify the dev->key array, which is accessed
3699          *              in the TX handler.
3700          */
3701
3702         dev = wl->current_dev;
3703         err = -ENODEV;
3704         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3705                 goto out_unlock;
3706
3707         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3708                 /* We don't have firmware for the crypto engine.
3709                  * Must use software-crypto. */
3710                 err = -EOPNOTSUPP;
3711                 goto out_unlock;
3712         }
3713
3714         err = -EINVAL;
3715         switch (key->alg) {
3716         case ALG_WEP:
3717                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3718                         algorithm = B43_SEC_ALGO_WEP40;
3719                 else
3720                         algorithm = B43_SEC_ALGO_WEP104;
3721                 break;
3722         case ALG_TKIP:
3723                 algorithm = B43_SEC_ALGO_TKIP;
3724                 break;
3725         case ALG_CCMP:
3726                 algorithm = B43_SEC_ALGO_AES;
3727                 break;
3728         default:
3729                 B43_WARN_ON(1);
3730                 goto out_unlock;
3731         }
3732         index = (u8) (key->keyidx);
3733         if (index > 3)
3734                 goto out_unlock;
3735
3736         switch (cmd) {
3737         case SET_KEY:
3738                 if (algorithm == B43_SEC_ALGO_TKIP &&
3739                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3740                     !modparam_hwtkip)) {
3741                         /* We support only pairwise key */
3742                         err = -EOPNOTSUPP;
3743                         goto out_unlock;
3744                 }
3745
3746                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3747                         if (WARN_ON(!sta)) {
3748                                 err = -EOPNOTSUPP;
3749                                 goto out_unlock;
3750                         }
3751                         /* Pairwise key with an assigned MAC address. */
3752                         err = b43_key_write(dev, -1, algorithm,
3753                                             key->key, key->keylen,
3754                                             sta->addr, key);
3755                 } else {
3756                         /* Group key */
3757                         err = b43_key_write(dev, index, algorithm,
3758                                             key->key, key->keylen, NULL, key);
3759                 }
3760                 if (err)
3761                         goto out_unlock;
3762
3763                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3764                     algorithm == B43_SEC_ALGO_WEP104) {
3765                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3766                 } else {
3767                         b43_hf_write(dev,
3768                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3769                 }
3770                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3771                 if (algorithm == B43_SEC_ALGO_TKIP)
3772                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3773                 break;
3774         case DISABLE_KEY: {
3775                 err = b43_key_clear(dev, key->hw_key_idx);
3776                 if (err)
3777                         goto out_unlock;
3778                 break;
3779         }
3780         default:
3781                 B43_WARN_ON(1);
3782         }
3783
3784 out_unlock:
3785         if (!err) {
3786                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3787                        "mac: %pM\n",
3788                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3789                        sta ? sta->addr : bcast_addr);
3790                 b43_dump_keymemory(dev);
3791         }
3792         write_unlock_irqrestore(&wl->tx_lock, flags);
3793         mutex_unlock(&wl->mutex);
3794
3795         return err;
3796 }
3797
3798 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3799                                     unsigned int changed, unsigned int *fflags,
3800                                     u64 multicast)
3801 {
3802         struct b43_wl *wl = hw_to_b43_wl(hw);
3803         struct b43_wldev *dev;
3804
3805         mutex_lock(&wl->mutex);
3806         dev = wl->current_dev;
3807         if (!dev) {
3808                 *fflags = 0;
3809                 goto out_unlock;
3810         }
3811
3812         *fflags &= FIF_PROMISC_IN_BSS |
3813                   FIF_ALLMULTI |
3814                   FIF_FCSFAIL |
3815                   FIF_PLCPFAIL |
3816                   FIF_CONTROL |
3817                   FIF_OTHER_BSS |
3818                   FIF_BCN_PRBRESP_PROMISC;
3819
3820         changed &= FIF_PROMISC_IN_BSS |
3821                    FIF_ALLMULTI |
3822                    FIF_FCSFAIL |
3823                    FIF_PLCPFAIL |
3824                    FIF_CONTROL |
3825                    FIF_OTHER_BSS |
3826                    FIF_BCN_PRBRESP_PROMISC;
3827
3828         wl->filter_flags = *fflags;
3829
3830         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3831                 b43_adjust_opmode(dev);
3832
3833 out_unlock:
3834         mutex_unlock(&wl->mutex);
3835 }
3836
3837 /* Locking: wl->mutex
3838  * Returns the current dev. This might be different from the passed in dev,
3839  * because the core might be gone away while we unlocked the mutex. */
3840 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3841 {
3842         struct b43_wl *wl = dev->wl;
3843         struct b43_wldev *orig_dev;
3844
3845 redo:
3846         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3847                 return dev;
3848
3849         /* Disable periodic work. Unlock to avoid deadlocks. */
3850         mutex_unlock(&wl->mutex);
3851         cancel_delayed_work_sync(&dev->periodic_work);
3852         mutex_lock(&wl->mutex);
3853         dev = wl->current_dev;
3854         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
3855                 /* Whoops, aliens ate up the device while we were unlocked. */
3856                 return dev;
3857         }
3858
3859         /* Disable interrupts on the device. */
3860         b43_set_status(dev, B43_STAT_INITIALIZED);
3861         if (0 /*FIXME dev->dev->bus->bustype == SSB_BUSTYPE_SDIO*/) {
3862                 /* wl->mutex is locked. That is enough. */
3863                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3864                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3865         } else {
3866                 spin_lock_irq(&wl->hardirq_lock);
3867                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3868                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3869                 spin_unlock_irq(&wl->hardirq_lock);
3870         }
3871         /* Synchronize the interrupt handlers. Unlock to avoid deadlocks. */
3872         orig_dev = dev;
3873         mutex_unlock(&wl->mutex);
3874         synchronize_irq(dev->dev->irq);
3875         mutex_lock(&wl->mutex);
3876         dev = wl->current_dev;
3877         if (!dev)
3878                 return dev;
3879         if (dev != orig_dev) {
3880                 if (b43_status(dev) >= B43_STAT_STARTED)
3881                         goto redo;
3882                 return dev;
3883         }
3884         B43_WARN_ON(b43_read32(dev, B43_MMIO_GEN_IRQ_MASK));
3885
3886         b43_pio_stop(dev);
3887         b43_mac_suspend(dev);
3888         free_irq(dev->dev->irq, dev);
3889         b43dbg(wl, "Wireless interface stopped\n");
3890
3891         return dev;
3892 }
3893
3894 /* Locking: wl->mutex */
3895 static int b43_wireless_core_start(struct b43_wldev *dev)
3896 {
3897         int err;
3898
3899         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3900
3901         drain_txstatus_queue(dev);
3902         err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
3903                                    b43_interrupt_thread_handler,
3904                                    IRQF_SHARED, KBUILD_MODNAME, dev);
3905         if (err) {
3906                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3907                 goto out;
3908         }
3909
3910         /* We are ready to run. */
3911         b43_set_status(dev, B43_STAT_STARTED);
3912
3913         /* Start data flow (TX/RX). */
3914         b43_mac_enable(dev);
3915         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3916
3917         /* Start maintainance work */
3918         b43_periodic_tasks_setup(dev);
3919
3920         b43dbg(dev->wl, "Wireless interface started\n");
3921       out:
3922         return err;
3923 }
3924
3925 /* Get PHY and RADIO versioning numbers */
3926 static int b43_phy_versioning(struct b43_wldev *dev)
3927 {
3928         struct b43_phy *phy = &dev->phy;
3929         u32 tmp;
3930         u8 analog_type;
3931         u8 phy_type;
3932         u8 phy_rev;
3933         u16 radio_manuf;
3934         u16 radio_ver;
3935         u16 radio_rev;
3936         int unsupported = 0;
3937
3938         /* Get PHY versioning */
3939         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3940         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3941         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3942         phy_rev = (tmp & B43_PHYVER_VERSION);
3943         switch (phy_type) {
3944         case B43_PHYTYPE_A:
3945                 if (phy_rev >= 4)
3946                         unsupported = 1;
3947                 break;
3948         case B43_PHYTYPE_B:
3949                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3950                     && phy_rev != 7)
3951                         unsupported = 1;
3952                 break;
3953         case B43_PHYTYPE_G:
3954                 if (phy_rev > 9)
3955                         unsupported = 1;
3956                 break;
3957 #ifdef CONFIG_B43_NPHY
3958         case B43_PHYTYPE_N:
3959                 if (phy_rev > 4)
3960                         unsupported = 1;
3961                 break;
3962 #endif
3963 #ifdef CONFIG_B43_PHY_LP
3964         case B43_PHYTYPE_LP:
3965                 if (phy_rev > 2)
3966                         unsupported = 1;
3967                 break;
3968 #endif
3969         default:
3970                 unsupported = 1;
3971         };
3972         if (unsupported) {
3973                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3974                        "(Analog %u, Type %u, Revision %u)\n",
3975                        analog_type, phy_type, phy_rev);
3976                 return -EOPNOTSUPP;
3977         }
3978         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3979                analog_type, phy_type, phy_rev);
3980
3981         /* Get RADIO versioning */
3982         if (dev->dev->bus->chip_id == 0x4317) {
3983                 if (dev->dev->bus->chip_rev == 0)
3984                         tmp = 0x3205017F;
3985                 else if (dev->dev->bus->chip_rev == 1)
3986                         tmp = 0x4205017F;
3987                 else
3988                         tmp = 0x5205017F;
3989         } else {
3990                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3991                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3992                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3993                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3994         }
3995         radio_manuf = (tmp & 0x00000FFF);
3996         radio_ver = (tmp & 0x0FFFF000) >> 12;
3997         radio_rev = (tmp & 0xF0000000) >> 28;
3998         if (radio_manuf != 0x17F /* Broadcom */)
3999                 unsupported = 1;
4000         switch (phy_type) {
4001         case B43_PHYTYPE_A:
4002                 if (radio_ver != 0x2060)
4003                         unsupported = 1;
4004                 if (radio_rev != 1)
4005                         unsupported = 1;
4006                 if (radio_manuf != 0x17F)
4007                         unsupported = 1;
4008                 break;
4009         case B43_PHYTYPE_B:
4010                 if ((radio_ver & 0xFFF0) != 0x2050)
4011                         unsupported = 1;
4012                 break;
4013         case B43_PHYTYPE_G:
4014                 if (radio_ver != 0x2050)
4015                         unsupported = 1;
4016                 break;
4017         case B43_PHYTYPE_N:
4018                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4019                         unsupported = 1;
4020                 break;
4021         case B43_PHYTYPE_LP:
4022                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4023                         unsupported = 1;
4024                 break;
4025         default:
4026                 B43_WARN_ON(1);
4027         }
4028         if (unsupported) {
4029                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4030                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4031                        radio_manuf, radio_ver, radio_rev);
4032                 return -EOPNOTSUPP;
4033         }
4034         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4035                radio_manuf, radio_ver, radio_rev);
4036
4037         phy->radio_manuf = radio_manuf;
4038         phy->radio_ver = radio_ver;
4039         phy->radio_rev = radio_rev;
4040
4041         phy->analog = analog_type;
4042         phy->type = phy_type;
4043         phy->rev = phy_rev;
4044
4045         return 0;
4046 }
4047
4048 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4049                                       struct b43_phy *phy)
4050 {
4051         phy->hardware_power_control = !!modparam_hwpctl;
4052         phy->next_txpwr_check_time = jiffies;
4053         /* PHY TX errors counter. */
4054         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4055
4056 #if B43_DEBUG
4057         phy->phy_locked = 0;
4058         phy->radio_locked = 0;
4059 #endif
4060 }
4061
4062 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4063 {
4064         dev->dfq_valid = 0;
4065
4066         /* Assume the radio is enabled. If it's not enabled, the state will
4067          * immediately get fixed on the first periodic work run. */
4068         dev->radio_hw_enable = 1;
4069
4070         /* Stats */
4071         memset(&dev->stats, 0, sizeof(dev->stats));
4072
4073         setup_struct_phy_for_init(dev, &dev->phy);
4074
4075         /* IRQ related flags */
4076         dev->irq_reason = 0;
4077         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4078         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4079         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4080                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4081
4082         dev->mac_suspended = 1;
4083
4084         /* Noise calculation context */
4085         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4086 }
4087
4088 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4089 {
4090         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
4091         u64 hf;
4092
4093         if (!modparam_btcoex)
4094                 return;
4095         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4096                 return;
4097         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4098                 return;
4099
4100         hf = b43_hf_read(dev);
4101         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4102                 hf |= B43_HF_BTCOEXALT;
4103         else
4104                 hf |= B43_HF_BTCOEX;
4105         b43_hf_write(dev, hf);
4106 }
4107
4108 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4109 {
4110         if (!modparam_btcoex)
4111                 return;
4112         //TODO
4113 }
4114
4115 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4116 {
4117 #ifdef CONFIG_SSB_DRIVER_PCICORE
4118         struct ssb_bus *bus = dev->dev->bus;
4119         u32 tmp;
4120
4121         if (bus->pcicore.dev &&
4122             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
4123             bus->pcicore.dev->id.revision <= 5) {
4124                 /* IMCFGLO timeouts workaround. */
4125                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
4126                 tmp &= ~SSB_IMCFGLO_REQTO;
4127                 tmp &= ~SSB_IMCFGLO_SERTO;
4128                 switch (bus->bustype) {
4129                 case SSB_BUSTYPE_PCI:
4130                 case SSB_BUSTYPE_PCMCIA:
4131                         tmp |= 0x32;
4132                         break;
4133                 case SSB_BUSTYPE_SSB:
4134                         tmp |= 0x53;
4135                         break;
4136                 }
4137                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
4138         }
4139 #endif /* CONFIG_SSB_DRIVER_PCICORE */
4140 }
4141
4142 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4143 {
4144         u16 pu_delay;
4145
4146         /* The time value is in microseconds. */
4147         if (dev->phy.type == B43_PHYTYPE_A)
4148                 pu_delay = 3700;
4149         else
4150                 pu_delay = 1050;
4151         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4152                 pu_delay = 500;
4153         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4154                 pu_delay = max(pu_delay, (u16)2400);
4155
4156         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4157 }
4158
4159 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4160 static void b43_set_pretbtt(struct b43_wldev *dev)
4161 {
4162         u16 pretbtt;
4163
4164         /* The time value is in microseconds. */
4165         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4166                 pretbtt = 2;
4167         } else {
4168                 if (dev->phy.type == B43_PHYTYPE_A)
4169                         pretbtt = 120;
4170                 else
4171                         pretbtt = 250;
4172         }
4173         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4174         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4175 }
4176
4177 /* Shutdown a wireless core */
4178 /* Locking: wl->mutex */
4179 static void b43_wireless_core_exit(struct b43_wldev *dev)
4180 {
4181         u32 macctl;
4182
4183         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4184         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4185                 return;
4186         b43_set_status(dev, B43_STAT_UNINIT);
4187
4188         /* Stop the microcode PSM. */
4189         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4190         macctl &= ~B43_MACCTL_PSM_RUN;
4191         macctl |= B43_MACCTL_PSM_JMP0;
4192         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4193
4194         if (!dev->suspend_in_progress) {
4195                 b43_leds_exit(dev);
4196                 b43_rng_exit(dev->wl);
4197         }
4198         b43_dma_free(dev);
4199         b43_pio_free(dev);
4200         b43_chip_exit(dev);
4201         dev->phy.ops->switch_analog(dev, 0);
4202         if (dev->wl->current_beacon) {
4203                 dev_kfree_skb_any(dev->wl->current_beacon);
4204                 dev->wl->current_beacon = NULL;
4205         }
4206
4207         ssb_device_disable(dev->dev, 0);
4208         ssb_bus_may_powerdown(dev->dev->bus);
4209 }
4210
4211 /* Initialize a wireless core */
4212 static int b43_wireless_core_init(struct b43_wldev *dev)
4213 {
4214         struct b43_wl *wl = dev->wl;
4215         struct ssb_bus *bus = dev->dev->bus;
4216         struct ssb_sprom *sprom = &bus->sprom;
4217         struct b43_phy *phy = &dev->phy;
4218         int err;
4219         u64 hf;
4220         u32 tmp;
4221
4222         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4223
4224         err = ssb_bus_powerup(bus, 0);
4225         if (err)
4226                 goto out;
4227         if (!ssb_device_is_enabled(dev->dev)) {
4228                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4229                 b43_wireless_core_reset(dev, tmp);
4230         }
4231
4232         /* Reset all data structures. */
4233         setup_struct_wldev_for_init(dev);
4234         phy->ops->prepare_structs(dev);
4235
4236         /* Enable IRQ routing to this device. */
4237         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4238
4239         b43_imcfglo_timeouts_workaround(dev);
4240         b43_bluetooth_coext_disable(dev);
4241         if (phy->ops->prepare_hardware) {
4242                 err = phy->ops->prepare_hardware(dev);
4243                 if (err)
4244                         goto err_busdown;
4245         }
4246         err = b43_chip_init(dev);
4247         if (err)
4248                 goto err_busdown;
4249         b43_shm_write16(dev, B43_SHM_SHARED,
4250                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4251         hf = b43_hf_read(dev);
4252         if (phy->type == B43_PHYTYPE_G) {
4253                 hf |= B43_HF_SYMW;
4254                 if (phy->rev == 1)
4255                         hf |= B43_HF_GDCW;
4256                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4257                         hf |= B43_HF_OFDMPABOOST;
4258         }
4259         if (phy->radio_ver == 0x2050) {
4260                 if (phy->radio_rev == 6)
4261                         hf |= B43_HF_4318TSSI;
4262                 if (phy->radio_rev < 6)
4263                         hf |= B43_HF_VCORECALC;
4264         }
4265         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4266                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4267 #ifdef CONFIG_SSB_DRIVER_PCICORE
4268         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4269             (bus->pcicore.dev->id.revision <= 10))
4270                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4271 #endif
4272         hf &= ~B43_HF_SKCFPUP;
4273         b43_hf_write(dev, hf);
4274
4275         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4276                              B43_DEFAULT_LONG_RETRY_LIMIT);
4277         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4278         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4279
4280         /* Disable sending probe responses from firmware.
4281          * Setting the MaxTime to one usec will always trigger
4282          * a timeout, so we never send any probe resp.
4283          * A timeout of zero is infinite. */
4284         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4285
4286         b43_rate_memory_init(dev);
4287         b43_set_phytxctl_defaults(dev);
4288
4289         /* Minimum Contention Window */
4290         if (phy->type == B43_PHYTYPE_B) {
4291                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4292         } else {
4293                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4294         }
4295         /* Maximum Contention Window */
4296         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4297
4298         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4299                 dev->__using_pio_transfers = 1;
4300                 err = b43_pio_init(dev);
4301         } else {
4302                 dev->__using_pio_transfers = 0;
4303                 err = b43_dma_init(dev);
4304         }
4305         if (err)
4306                 goto err_chip_exit;
4307         b43_qos_init(dev);
4308         b43_set_synth_pu_delay(dev, 1);
4309         b43_bluetooth_coext_enable(dev);
4310
4311         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4312         b43_upload_card_macaddress(dev);
4313         b43_security_init(dev);
4314         if (!dev->suspend_in_progress)
4315                 b43_rng_init(wl);
4316
4317         b43_set_status(dev, B43_STAT_INITIALIZED);
4318
4319         if (!dev->suspend_in_progress)
4320                 b43_leds_init(dev);
4321 out:
4322         return err;
4323
4324 err_chip_exit:
4325         b43_chip_exit(dev);
4326 err_busdown:
4327         ssb_bus_may_powerdown(bus);
4328         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4329         return err;
4330 }
4331
4332 static int b43_op_add_interface(struct ieee80211_hw *hw,
4333                                 struct ieee80211_if_init_conf *conf)
4334 {
4335         struct b43_wl *wl = hw_to_b43_wl(hw);
4336         struct b43_wldev *dev;
4337         int err = -EOPNOTSUPP;
4338
4339         /* TODO: allow WDS/AP devices to coexist */
4340
4341         if (conf->type != NL80211_IFTYPE_AP &&
4342             conf->type != NL80211_IFTYPE_MESH_POINT &&
4343             conf->type != NL80211_IFTYPE_STATION &&
4344             conf->type != NL80211_IFTYPE_WDS &&
4345             conf->type != NL80211_IFTYPE_ADHOC)
4346                 return -EOPNOTSUPP;
4347
4348         mutex_lock(&wl->mutex);
4349         if (wl->operating)
4350                 goto out_mutex_unlock;
4351
4352         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4353
4354         dev = wl->current_dev;
4355         wl->operating = 1;
4356         wl->vif = conf->vif;
4357         wl->if_type = conf->type;
4358         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4359
4360         b43_adjust_opmode(dev);
4361         b43_set_pretbtt(dev);
4362         b43_set_synth_pu_delay(dev, 0);
4363         b43_upload_card_macaddress(dev);
4364
4365         err = 0;
4366  out_mutex_unlock:
4367         mutex_unlock(&wl->mutex);
4368
4369         return err;
4370 }
4371
4372 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4373                                     struct ieee80211_if_init_conf *conf)
4374 {
4375         struct b43_wl *wl = hw_to_b43_wl(hw);
4376         struct b43_wldev *dev = wl->current_dev;
4377
4378         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4379
4380         mutex_lock(&wl->mutex);
4381
4382         B43_WARN_ON(!wl->operating);
4383         B43_WARN_ON(wl->vif != conf->vif);
4384         wl->vif = NULL;
4385
4386         wl->operating = 0;
4387
4388         b43_adjust_opmode(dev);
4389         memset(wl->mac_addr, 0, ETH_ALEN);
4390         b43_upload_card_macaddress(dev);
4391
4392         mutex_unlock(&wl->mutex);
4393 }
4394
4395 static int b43_op_start(struct ieee80211_hw *hw)
4396 {
4397         struct b43_wl *wl = hw_to_b43_wl(hw);
4398         struct b43_wldev *dev = wl->current_dev;
4399         int did_init = 0;
4400         int err = 0;
4401
4402         /* Kill all old instance specific information to make sure
4403          * the card won't use it in the short timeframe between start
4404          * and mac80211 reconfiguring it. */
4405         memset(wl->bssid, 0, ETH_ALEN);
4406         memset(wl->mac_addr, 0, ETH_ALEN);
4407         wl->filter_flags = 0;
4408         wl->radiotap_enabled = 0;
4409         b43_qos_clear(wl);
4410         wl->beacon0_uploaded = 0;
4411         wl->beacon1_uploaded = 0;
4412         wl->beacon_templates_virgin = 1;
4413         wl->radio_enabled = 1;
4414
4415         mutex_lock(&wl->mutex);
4416
4417         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4418                 err = b43_wireless_core_init(dev);
4419                 if (err)
4420                         goto out_mutex_unlock;
4421                 did_init = 1;
4422         }
4423
4424         if (b43_status(dev) < B43_STAT_STARTED) {
4425                 err = b43_wireless_core_start(dev);
4426                 if (err) {
4427                         if (did_init)
4428                                 b43_wireless_core_exit(dev);
4429                         goto out_mutex_unlock;
4430                 }
4431         }
4432
4433         /* XXX: only do if device doesn't support rfkill irq */
4434         wiphy_rfkill_start_polling(hw->wiphy);
4435
4436  out_mutex_unlock:
4437         mutex_unlock(&wl->mutex);
4438
4439         return err;
4440 }
4441
4442 static void b43_op_stop(struct ieee80211_hw *hw)
4443 {
4444         struct b43_wl *wl = hw_to_b43_wl(hw);
4445         struct b43_wldev *dev = wl->current_dev;
4446
4447         cancel_work_sync(&(wl->beacon_update_trigger));
4448
4449         mutex_lock(&wl->mutex);
4450         if (b43_status(dev) >= B43_STAT_STARTED) {
4451                 dev = b43_wireless_core_stop(dev);
4452                 if (!dev)
4453                         goto out_unlock;
4454         }
4455         b43_wireless_core_exit(dev);
4456         wl->radio_enabled = 0;
4457
4458 out_unlock:
4459         mutex_unlock(&wl->mutex);
4460
4461         cancel_work_sync(&(wl->txpower_adjust_work));
4462 }
4463
4464 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4465                                  struct ieee80211_sta *sta, bool set)
4466 {
4467         struct b43_wl *wl = hw_to_b43_wl(hw);
4468
4469         mutex_lock(&wl->mutex);
4470         b43_update_templates(wl);
4471         mutex_unlock(&wl->mutex);
4472
4473         return 0;
4474 }
4475
4476 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4477                               struct ieee80211_vif *vif,
4478                               enum sta_notify_cmd notify_cmd,
4479                               struct ieee80211_sta *sta)
4480 {
4481         struct b43_wl *wl = hw_to_b43_wl(hw);
4482
4483         B43_WARN_ON(!vif || wl->vif != vif);
4484 }
4485
4486 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4487 {
4488         struct b43_wl *wl = hw_to_b43_wl(hw);
4489         struct b43_wldev *dev;
4490
4491         mutex_lock(&wl->mutex);
4492         dev = wl->current_dev;
4493         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4494                 /* Disable CFP update during scan on other channels. */
4495                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4496         }
4497         mutex_unlock(&wl->mutex);
4498 }
4499
4500 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4501 {
4502         struct b43_wl *wl = hw_to_b43_wl(hw);
4503         struct b43_wldev *dev;
4504
4505         mutex_lock(&wl->mutex);
4506         dev = wl->current_dev;
4507         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4508                 /* Re-enable CFP update. */
4509                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4510         }
4511         mutex_unlock(&wl->mutex);
4512 }
4513
4514 static const struct ieee80211_ops b43_hw_ops = {
4515         .tx                     = b43_op_tx,
4516         .conf_tx                = b43_op_conf_tx,
4517         .add_interface          = b43_op_add_interface,
4518         .remove_interface       = b43_op_remove_interface,
4519         .config                 = b43_op_config,
4520         .bss_info_changed       = b43_op_bss_info_changed,
4521         .configure_filter       = b43_op_configure_filter,
4522         .set_key                = b43_op_set_key,
4523         .update_tkip_key        = b43_op_update_tkip_key,
4524         .get_stats              = b43_op_get_stats,
4525         .get_tx_stats           = b43_op_get_tx_stats,
4526         .get_tsf                = b43_op_get_tsf,
4527         .set_tsf                = b43_op_set_tsf,
4528         .start                  = b43_op_start,
4529         .stop                   = b43_op_stop,
4530         .set_tim                = b43_op_beacon_set_tim,
4531         .sta_notify             = b43_op_sta_notify,
4532         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4533         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4534         .rfkill_poll            = b43_rfkill_poll,
4535 };
4536
4537 /* Hard-reset the chip. Do not call this directly.
4538  * Use b43_controller_restart()
4539  */
4540 static void b43_chip_reset(struct work_struct *work)
4541 {
4542         struct b43_wldev *dev =
4543             container_of(work, struct b43_wldev, restart_work);
4544         struct b43_wl *wl = dev->wl;
4545         int err = 0;
4546         int prev_status;
4547
4548         mutex_lock(&wl->mutex);
4549
4550         prev_status = b43_status(dev);
4551         /* Bring the device down... */
4552         if (prev_status >= B43_STAT_STARTED) {
4553                 dev = b43_wireless_core_stop(dev);
4554                 if (!dev) {
4555                         err = -ENODEV;
4556                         goto out;
4557                 }
4558         }
4559         if (prev_status >= B43_STAT_INITIALIZED)
4560                 b43_wireless_core_exit(dev);
4561
4562         /* ...and up again. */
4563         if (prev_status >= B43_STAT_INITIALIZED) {
4564                 err = b43_wireless_core_init(dev);
4565                 if (err)
4566                         goto out;
4567         }
4568         if (prev_status >= B43_STAT_STARTED) {
4569                 err = b43_wireless_core_start(dev);
4570                 if (err) {
4571                         b43_wireless_core_exit(dev);
4572                         goto out;
4573                 }
4574         }
4575 out:
4576         if (err)
4577                 wl->current_dev = NULL; /* Failed to init the dev. */
4578         mutex_unlock(&wl->mutex);
4579         if (err)
4580                 b43err(wl, "Controller restart FAILED\n");
4581         else
4582                 b43info(wl, "Controller restarted\n");
4583 }
4584
4585 static int b43_setup_bands(struct b43_wldev *dev,
4586                            bool have_2ghz_phy, bool have_5ghz_phy)
4587 {
4588         struct ieee80211_hw *hw = dev->wl->hw;
4589
4590         if (have_2ghz_phy)
4591                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4592         if (dev->phy.type == B43_PHYTYPE_N) {
4593                 if (have_5ghz_phy)
4594                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4595         } else {
4596                 if (have_5ghz_phy)
4597                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4598         }
4599
4600         dev->phy.supports_2ghz = have_2ghz_phy;
4601         dev->phy.supports_5ghz = have_5ghz_phy;
4602
4603         return 0;
4604 }
4605
4606 static void b43_wireless_core_detach(struct b43_wldev *dev)
4607 {
4608         /* We release firmware that late to not be required to re-request
4609          * is all the time when we reinit the core. */
4610         b43_release_firmware(dev);
4611         b43_phy_free(dev);
4612 }
4613
4614 static int b43_wireless_core_attach(struct b43_wldev *dev)
4615 {
4616         struct b43_wl *wl = dev->wl;
4617         struct ssb_bus *bus = dev->dev->bus;
4618         struct pci_dev *pdev = bus->host_pci;
4619         int err;
4620         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4621         u32 tmp;
4622
4623         /* Do NOT do any device initialization here.
4624          * Do it in wireless_core_init() instead.
4625          * This function is for gathering basic information about the HW, only.
4626          * Also some structs may be set up here. But most likely you want to have
4627          * that in core_init(), too.
4628          */
4629
4630         err = ssb_bus_powerup(bus, 0);
4631         if (err) {
4632                 b43err(wl, "Bus powerup failed\n");
4633                 goto out;
4634         }
4635         /* Get the PHY type. */
4636         if (dev->dev->id.revision >= 5) {
4637                 u32 tmshigh;
4638
4639                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4640                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4641                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4642         } else
4643                 B43_WARN_ON(1);
4644
4645         dev->phy.gmode = have_2ghz_phy;
4646         dev->phy.radio_on = 1;
4647         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4648         b43_wireless_core_reset(dev, tmp);
4649
4650         err = b43_phy_versioning(dev);
4651         if (err)
4652                 goto err_powerdown;
4653         /* Check if this device supports multiband. */
4654         if (!pdev ||
4655             (pdev->device != 0x4312 &&
4656              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4657                 /* No multiband support. */
4658                 have_2ghz_phy = 0;
4659                 have_5ghz_phy = 0;
4660                 switch (dev->phy.type) {
4661                 case B43_PHYTYPE_A:
4662                         have_5ghz_phy = 1;
4663                         break;
4664                 case B43_PHYTYPE_LP: //FIXME not always!
4665 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4666                         have_5ghz_phy = 1;
4667 #endif
4668                 case B43_PHYTYPE_G:
4669                 case B43_PHYTYPE_N:
4670                         have_2ghz_phy = 1;
4671                         break;
4672                 default:
4673                         B43_WARN_ON(1);
4674                 }
4675         }
4676         if (dev->phy.type == B43_PHYTYPE_A) {
4677                 /* FIXME */
4678                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4679                 err = -EOPNOTSUPP;
4680                 goto err_powerdown;
4681         }
4682         if (1 /* disable A-PHY */) {
4683                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4684                 if (dev->phy.type != B43_PHYTYPE_N &&
4685                     dev->phy.type != B43_PHYTYPE_LP) {
4686                         have_2ghz_phy = 1;
4687                         have_5ghz_phy = 0;
4688                 }
4689         }
4690
4691         err = b43_phy_allocate(dev);
4692         if (err)
4693                 goto err_powerdown;
4694
4695         dev->phy.gmode = have_2ghz_phy;
4696         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4697         b43_wireless_core_reset(dev, tmp);
4698
4699         err = b43_validate_chipaccess(dev);
4700         if (err)
4701                 goto err_phy_free;
4702         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4703         if (err)
4704                 goto err_phy_free;
4705
4706         /* Now set some default "current_dev" */
4707         if (!wl->current_dev)
4708                 wl->current_dev = dev;
4709         INIT_WORK(&dev->restart_work, b43_chip_reset);
4710
4711         dev->phy.ops->switch_analog(dev, 0);
4712         ssb_device_disable(dev->dev, 0);
4713         ssb_bus_may_powerdown(bus);
4714
4715 out:
4716         return err;
4717
4718 err_phy_free:
4719         b43_phy_free(dev);
4720 err_powerdown:
4721         ssb_bus_may_powerdown(bus);
4722         return err;
4723 }
4724
4725 static void b43_one_core_detach(struct ssb_device *dev)
4726 {
4727         struct b43_wldev *wldev;
4728         struct b43_wl *wl;
4729
4730         /* Do not cancel ieee80211-workqueue based work here.
4731          * See comment in b43_remove(). */
4732
4733         wldev = ssb_get_drvdata(dev);
4734         wl = wldev->wl;
4735         b43_debugfs_remove_device(wldev);
4736         b43_wireless_core_detach(wldev);
4737         list_del(&wldev->list);
4738         wl->nr_devs--;
4739         ssb_set_drvdata(dev, NULL);
4740         kfree(wldev);
4741 }
4742
4743 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4744 {
4745         struct b43_wldev *wldev;
4746         struct pci_dev *pdev;
4747         int err = -ENOMEM;
4748
4749         if (!list_empty(&wl->devlist)) {
4750                 /* We are not the first core on this chip. */
4751                 pdev = dev->bus->host_pci;
4752                 /* Only special chips support more than one wireless
4753                  * core, although some of the other chips have more than
4754                  * one wireless core as well. Check for this and
4755                  * bail out early.
4756                  */
4757                 if (!pdev ||
4758                     ((pdev->device != 0x4321) &&
4759                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4760                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4761                         return -ENODEV;
4762                 }
4763         }
4764
4765         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4766         if (!wldev)
4767                 goto out;
4768
4769         wldev->dev = dev;
4770         wldev->wl = wl;
4771         b43_set_status(wldev, B43_STAT_UNINIT);
4772         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4773         INIT_LIST_HEAD(&wldev->list);
4774
4775         err = b43_wireless_core_attach(wldev);
4776         if (err)
4777                 goto err_kfree_wldev;
4778
4779         list_add(&wldev->list, &wl->devlist);
4780         wl->nr_devs++;
4781         ssb_set_drvdata(dev, wldev);
4782         b43_debugfs_add_device(wldev);
4783
4784       out:
4785         return err;
4786
4787       err_kfree_wldev:
4788         kfree(wldev);
4789         return err;
4790 }
4791
4792 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4793         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4794         (pdev->device == _device) &&                                    \
4795         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4796         (pdev->subsystem_device == _subdevice)                          )
4797
4798 static void b43_sprom_fixup(struct ssb_bus *bus)
4799 {
4800         struct pci_dev *pdev;
4801
4802         /* boardflags workarounds */
4803         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4804             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4805                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4806         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4807             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4808                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4809         if (bus->bustype == SSB_BUSTYPE_PCI) {
4810                 pdev = bus->host_pci;
4811                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4812                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4813                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4814                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4815                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4816                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4817                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4818                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4819         }
4820 }
4821
4822 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4823 {
4824         struct ieee80211_hw *hw = wl->hw;
4825
4826         ssb_set_devtypedata(dev, NULL);
4827         ieee80211_free_hw(hw);
4828 }
4829
4830 static int b43_wireless_init(struct ssb_device *dev)
4831 {
4832         struct ssb_sprom *sprom = &dev->bus->sprom;
4833         struct ieee80211_hw *hw;
4834         struct b43_wl *wl;
4835         int err = -ENOMEM;
4836
4837         b43_sprom_fixup(dev->bus);
4838
4839         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4840         if (!hw) {
4841                 b43err(NULL, "Could not allocate ieee80211 device\n");
4842                 goto out;
4843         }
4844         wl = hw_to_b43_wl(hw);
4845
4846         /* fill hw info */
4847         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4848                     IEEE80211_HW_SIGNAL_DBM |
4849                     IEEE80211_HW_NOISE_DBM;
4850
4851         hw->wiphy->interface_modes =
4852                 BIT(NL80211_IFTYPE_AP) |
4853                 BIT(NL80211_IFTYPE_MESH_POINT) |
4854                 BIT(NL80211_IFTYPE_STATION) |
4855                 BIT(NL80211_IFTYPE_WDS) |
4856                 BIT(NL80211_IFTYPE_ADHOC);
4857
4858         hw->queues = modparam_qos ? 4 : 1;
4859         wl->mac80211_initially_registered_queues = hw->queues;
4860         hw->max_rates = 2;
4861         SET_IEEE80211_DEV(hw, dev->dev);
4862         if (is_valid_ether_addr(sprom->et1mac))
4863                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4864         else
4865                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4866
4867         /* Initialize struct b43_wl */
4868         wl->hw = hw;
4869         rwlock_init(&wl->tx_lock);
4870         spin_lock_init(&wl->leds_lock);
4871         spin_lock_init(&wl->shm_lock);
4872         mutex_init(&wl->mutex);
4873         spin_lock_init(&wl->hardirq_lock);
4874         INIT_LIST_HEAD(&wl->devlist);
4875         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4876         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4877
4878         ssb_set_devtypedata(dev, wl);
4879         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4880                 dev->bus->chip_id, dev->id.revision);
4881         err = 0;
4882 out:
4883         return err;
4884 }
4885
4886 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4887 {
4888         struct b43_wl *wl;
4889         int err;
4890         int first = 0;
4891
4892         wl = ssb_get_devtypedata(dev);
4893         if (!wl) {
4894                 /* Probing the first core. Must setup common struct b43_wl */
4895                 first = 1;
4896                 err = b43_wireless_init(dev);
4897                 if (err)
4898                         goto out;
4899                 wl = ssb_get_devtypedata(dev);
4900                 B43_WARN_ON(!wl);
4901         }
4902         err = b43_one_core_attach(dev, wl);
4903         if (err)
4904                 goto err_wireless_exit;
4905
4906         if (first) {
4907                 err = ieee80211_register_hw(wl->hw);
4908                 if (err)
4909                         goto err_one_core_detach;
4910         }
4911
4912       out:
4913         return err;
4914
4915       err_one_core_detach:
4916         b43_one_core_detach(dev);
4917       err_wireless_exit:
4918         if (first)
4919                 b43_wireless_exit(dev, wl);
4920         return err;
4921 }
4922
4923 static void b43_remove(struct ssb_device *dev)
4924 {
4925         struct b43_wl *wl = ssb_get_devtypedata(dev);
4926         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4927
4928         /* We must cancel any work here before unregistering from ieee80211,
4929          * as the ieee80211 unreg will destroy the workqueue. */
4930         cancel_work_sync(&wldev->restart_work);
4931
4932         B43_WARN_ON(!wl);
4933         if (wl->current_dev == wldev) {
4934                 /* Restore the queues count before unregistering, because firmware detect
4935                  * might have modified it. Restoring is important, so the networking
4936                  * stack can properly free resources. */
4937                 wl->hw->queues = wl->mac80211_initially_registered_queues;
4938                 ieee80211_unregister_hw(wl->hw);
4939         }
4940
4941         b43_one_core_detach(dev);
4942
4943         if (list_empty(&wl->devlist)) {
4944                 /* Last core on the chip unregistered.
4945                  * We can destroy common struct b43_wl.
4946                  */
4947                 b43_wireless_exit(dev, wl);
4948         }
4949 }
4950
4951 /* Perform a hardware reset. This can be called from any context. */
4952 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4953 {
4954         /* Must avoid requeueing, if we are in shutdown. */
4955         if (b43_status(dev) < B43_STAT_INITIALIZED)
4956                 return;
4957         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4958         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
4959 }
4960
4961 #ifdef CONFIG_PM
4962
4963 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4964 {
4965         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4966         struct b43_wl *wl = wldev->wl;
4967
4968         b43dbg(wl, "Suspending...\n");
4969
4970         mutex_lock(&wl->mutex);
4971         wldev->suspend_in_progress = true;
4972         wldev->suspend_init_status = b43_status(wldev);
4973         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4974                 wldev = b43_wireless_core_stop(wldev);
4975         if (wldev && wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4976                 b43_wireless_core_exit(wldev);
4977         mutex_unlock(&wl->mutex);
4978
4979         b43dbg(wl, "Device suspended.\n");
4980
4981         return 0;
4982 }
4983
4984 static int b43_resume(struct ssb_device *dev)
4985 {
4986         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4987         struct b43_wl *wl = wldev->wl;
4988         int err = 0;
4989
4990         b43dbg(wl, "Resuming...\n");
4991
4992         mutex_lock(&wl->mutex);
4993         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4994                 err = b43_wireless_core_init(wldev);
4995                 if (err) {
4996                         b43err(wl, "Resume failed at core init\n");
4997                         goto out;
4998                 }
4999         }
5000         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
5001                 err = b43_wireless_core_start(wldev);
5002                 if (err) {
5003                         b43_leds_exit(wldev);
5004                         b43_rng_exit(wldev->wl);
5005                         b43_wireless_core_exit(wldev);
5006                         b43err(wl, "Resume failed at core start\n");
5007                         goto out;
5008                 }
5009         }
5010         b43dbg(wl, "Device resumed.\n");
5011  out:
5012         wldev->suspend_in_progress = false;
5013         mutex_unlock(&wl->mutex);
5014         return err;
5015 }
5016
5017 #else /* CONFIG_PM */
5018 # define b43_suspend    NULL
5019 # define b43_resume     NULL
5020 #endif /* CONFIG_PM */
5021
5022 static struct ssb_driver b43_ssb_driver = {
5023         .name           = KBUILD_MODNAME,
5024         .id_table       = b43_ssb_tbl,
5025         .probe          = b43_probe,
5026         .remove         = b43_remove,
5027         .suspend        = b43_suspend,
5028         .resume         = b43_resume,
5029 };
5030
5031 static void b43_print_driverinfo(void)
5032 {
5033         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5034                    *feat_leds = "";
5035
5036 #ifdef CONFIG_B43_PCI_AUTOSELECT
5037         feat_pci = "P";
5038 #endif
5039 #ifdef CONFIG_B43_PCMCIA
5040         feat_pcmcia = "M";
5041 #endif
5042 #ifdef CONFIG_B43_NPHY
5043         feat_nphy = "N";
5044 #endif
5045 #ifdef CONFIG_B43_LEDS
5046         feat_leds = "L";
5047 #endif
5048         printk(KERN_INFO "Broadcom 43xx driver loaded "
5049                "[ Features: %s%s%s%s, Firmware-ID: "
5050                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5051                feat_pci, feat_pcmcia, feat_nphy,
5052                feat_leds);
5053 }
5054
5055 static int __init b43_init(void)
5056 {
5057         int err;
5058
5059         b43_debugfs_init();
5060         err = b43_pcmcia_init();
5061         if (err)
5062                 goto err_dfs_exit;
5063         err = ssb_driver_register(&b43_ssb_driver);
5064         if (err)
5065                 goto err_pcmcia_exit;
5066         b43_print_driverinfo();
5067
5068         return err;
5069
5070 err_pcmcia_exit:
5071         b43_pcmcia_exit();
5072 err_dfs_exit:
5073         b43_debugfs_exit();
5074         return err;
5075 }
5076
5077 static void __exit b43_exit(void)
5078 {
5079         ssb_driver_unregister(&b43_ssb_driver);
5080         b43_pcmcia_exit();
5081         b43_debugfs_exit();
5082 }
5083
5084 module_init(b43_init)
5085 module_exit(b43_exit)