SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 static int modparam_qos = 1;
  84 module_param_named(qos, modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
  92 module_param_named(verbose, b43_modparam_verbose, int, 0644);
  93 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
  94
  95
  96 static const struct ssb_device_id b43_ssb_tbl[] = {
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 100         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 101         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 102         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 103         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 104         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 105         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 106         SSB_DEVTABLE_END
 107 };
 108
 109 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 110
 111 /* Channel and ratetables are shared for all devices.
 112  * They can't be const, because ieee80211 puts some precalculated
 113  * data in there. This data is the same for all devices, so we don't
 114  * get concurrency issues */
 115 #define RATETAB_ENT(_rateid, _flags) \
 116         {                                                               \
 117                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 118                 .hw_value       = (_rateid),                            \
 119                 .flags          = (_flags),                             \
 120         }
 121
 122 /*
 123  * NOTE: When changing this, sync with xmit.c's
 124  *       b43_plcp_get_bitrate_idx_* functions!
 125  */
 126 static struct ieee80211_rate __b43_ratetable[] = {
 127         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 128         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 133         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 134         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 135         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 136         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 137         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 138         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 139 };
 140
 141 #define b43_a_ratetable         (__b43_ratetable + 4)
 142 #define b43_a_ratetable_size    8
 143 #define b43_b_ratetable         (__b43_ratetable + 0)
 144 #define b43_b_ratetable_size    4
 145 #define b43_g_ratetable         (__b43_ratetable + 0)
 146 #define b43_g_ratetable_size    12
 147
 148 #define CHAN4G(_channel, _freq, _flags) {                       \
 149         .band                   = IEEE80211_BAND_2GHZ,          \
 150         .center_freq            = (_freq),                      \
 151         .hw_value               = (_channel),                   \
 152         .flags                  = (_flags),                     \
 153         .max_antenna_gain       = 0,                            \
 154         .max_power              = 30,                           \
 155 }
 156 static struct ieee80211_channel b43_2ghz_chantable[] = {
 157         CHAN4G(1, 2412, 0),
 158         CHAN4G(2, 2417, 0),
 159         CHAN4G(3, 2422, 0),
 160         CHAN4G(4, 2427, 0),
 161         CHAN4G(5, 2432, 0),
 162         CHAN4G(6, 2437, 0),
 163         CHAN4G(7, 2442, 0),
 164         CHAN4G(8, 2447, 0),
 165         CHAN4G(9, 2452, 0),
 166         CHAN4G(10, 2457, 0),
 167         CHAN4G(11, 2462, 0),
 168         CHAN4G(12, 2467, 0),
 169         CHAN4G(13, 2472, 0),
 170         CHAN4G(14, 2484, 0),
 171 };
 172 #undef CHAN4G
 173
 174 #define CHAN5G(_channel, _flags) {                              \
 175         .band                   = IEEE80211_BAND_5GHZ,          \
 176         .center_freq            = 5000 + (5 * (_channel)),      \
 177         .hw_value               = (_channel),                   \
 178         .flags                  = (_flags),                     \
 179         .max_antenna_gain       = 0,                            \
 180         .max_power              = 30,                           \
 181 }
 182 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 183         CHAN5G(32, 0),          CHAN5G(34, 0),
 184         CHAN5G(36, 0),          CHAN5G(38, 0),
 185         CHAN5G(40, 0),          CHAN5G(42, 0),
 186         CHAN5G(44, 0),          CHAN5G(46, 0),
 187         CHAN5G(48, 0),          CHAN5G(50, 0),
 188         CHAN5G(52, 0),          CHAN5G(54, 0),
 189         CHAN5G(56, 0),          CHAN5G(58, 0),
 190         CHAN5G(60, 0),          CHAN5G(62, 0),
 191         CHAN5G(64, 0),          CHAN5G(66, 0),
 192         CHAN5G(68, 0),          CHAN5G(70, 0),
 193         CHAN5G(72, 0),          CHAN5G(74, 0),
 194         CHAN5G(76, 0),          CHAN5G(78, 0),
 195         CHAN5G(80, 0),          CHAN5G(82, 0),
 196         CHAN5G(84, 0),          CHAN5G(86, 0),
 197         CHAN5G(88, 0),          CHAN5G(90, 0),
 198         CHAN5G(92, 0),          CHAN5G(94, 0),
 199         CHAN5G(96, 0),          CHAN5G(98, 0),
 200         CHAN5G(100, 0),         CHAN5G(102, 0),
 201         CHAN5G(104, 0),         CHAN5G(106, 0),
 202         CHAN5G(108, 0),         CHAN5G(110, 0),
 203         CHAN5G(112, 0),         CHAN5G(114, 0),
 204         CHAN5G(116, 0),         CHAN5G(118, 0),
 205         CHAN5G(120, 0),         CHAN5G(122, 0),
 206         CHAN5G(124, 0),         CHAN5G(126, 0),
 207         CHAN5G(128, 0),         CHAN5G(130, 0),
 208         CHAN5G(132, 0),         CHAN5G(134, 0),
 209         CHAN5G(136, 0),         CHAN5G(138, 0),
 210         CHAN5G(140, 0),         CHAN5G(142, 0),
 211         CHAN5G(144, 0),         CHAN5G(145, 0),
 212         CHAN5G(146, 0),         CHAN5G(147, 0),
 213         CHAN5G(148, 0),         CHAN5G(149, 0),
 214         CHAN5G(150, 0),         CHAN5G(151, 0),
 215         CHAN5G(152, 0),         CHAN5G(153, 0),
 216         CHAN5G(154, 0),         CHAN5G(155, 0),
 217         CHAN5G(156, 0),         CHAN5G(157, 0),
 218         CHAN5G(158, 0),         CHAN5G(159, 0),
 219         CHAN5G(160, 0),         CHAN5G(161, 0),
 220         CHAN5G(162, 0),         CHAN5G(163, 0),
 221         CHAN5G(164, 0),         CHAN5G(165, 0),
 222         CHAN5G(166, 0),         CHAN5G(168, 0),
 223         CHAN5G(170, 0),         CHAN5G(172, 0),
 224         CHAN5G(174, 0),         CHAN5G(176, 0),
 225         CHAN5G(178, 0),         CHAN5G(180, 0),
 226         CHAN5G(182, 0),         CHAN5G(184, 0),
 227         CHAN5G(186, 0),         CHAN5G(188, 0),
 228         CHAN5G(190, 0),         CHAN5G(192, 0),
 229         CHAN5G(194, 0),         CHAN5G(196, 0),
 230         CHAN5G(198, 0),         CHAN5G(200, 0),
 231         CHAN5G(202, 0),         CHAN5G(204, 0),
 232         CHAN5G(206, 0),         CHAN5G(208, 0),
 233         CHAN5G(210, 0),         CHAN5G(212, 0),
 234         CHAN5G(214, 0),         CHAN5G(216, 0),
 235         CHAN5G(218, 0),         CHAN5G(220, 0),
 236         CHAN5G(222, 0),         CHAN5G(224, 0),
 237         CHAN5G(226, 0),         CHAN5G(228, 0),
 238 };
 239
 240 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 241         CHAN5G(34, 0),          CHAN5G(36, 0),
 242         CHAN5G(38, 0),          CHAN5G(40, 0),
 243         CHAN5G(42, 0),          CHAN5G(44, 0),
 244         CHAN5G(46, 0),          CHAN5G(48, 0),
 245         CHAN5G(52, 0),          CHAN5G(56, 0),
 246         CHAN5G(60, 0),          CHAN5G(64, 0),
 247         CHAN5G(100, 0),         CHAN5G(104, 0),
 248         CHAN5G(108, 0),         CHAN5G(112, 0),
 249         CHAN5G(116, 0),         CHAN5G(120, 0),
 250         CHAN5G(124, 0),         CHAN5G(128, 0),
 251         CHAN5G(132, 0),         CHAN5G(136, 0),
 252         CHAN5G(140, 0),         CHAN5G(149, 0),
 253         CHAN5G(153, 0),         CHAN5G(157, 0),
 254         CHAN5G(161, 0),         CHAN5G(165, 0),
 255         CHAN5G(184, 0),         CHAN5G(188, 0),
 256         CHAN5G(192, 0),         CHAN5G(196, 0),
 257         CHAN5G(200, 0),         CHAN5G(204, 0),
 258         CHAN5G(208, 0),         CHAN5G(212, 0),
 259         CHAN5G(216, 0),
 260 };
 261 #undef CHAN5G
 262
 263 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 264         .band           = IEEE80211_BAND_5GHZ,
 265         .channels       = b43_5ghz_nphy_chantable,
 266         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 267         .bitrates       = b43_a_ratetable,
 268         .n_bitrates     = b43_a_ratetable_size,
 269 };
 270
 271 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 272         .band           = IEEE80211_BAND_5GHZ,
 273         .channels       = b43_5ghz_aphy_chantable,
 274         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 275         .bitrates       = b43_a_ratetable,
 276         .n_bitrates     = b43_a_ratetable_size,
 277 };
 278
 279 static struct ieee80211_supported_band b43_band_2GHz = {
 280         .band           = IEEE80211_BAND_2GHZ,
 281         .channels       = b43_2ghz_chantable,
 282         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 283         .bitrates       = b43_g_ratetable,
 284         .n_bitrates     = b43_g_ratetable_size,
 285 };
 286
 287 static void b43_wireless_core_exit(struct b43_wldev *dev);
 288 static int b43_wireless_core_init(struct b43_wldev *dev);
 289 static void b43_wireless_core_stop(struct b43_wldev *dev);
 290 static int b43_wireless_core_start(struct b43_wldev *dev);
 291
 292 static int b43_ratelimit(struct b43_wl *wl)
 293 {
 294         if (!wl || !wl->current_dev)
 295                 return 1;
 296         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 297                 return 1;
 298         /* We are up and running.
 299          * Ratelimit the messages to avoid DoS over the net. */
 300         return net_ratelimit();
 301 }
 302
 303 void b43info(struct b43_wl *wl, const char *fmt, ...)
 304 {
 305         va_list args;
 306
 307         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 308                 return;
 309         if (!b43_ratelimit(wl))
 310                 return;
 311         va_start(args, fmt);
 312         printk(KERN_INFO "b43-%s: ",
 313                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 314         vprintk(fmt, args);
 315         va_end(args);
 316 }
 317
 318 void b43err(struct b43_wl *wl, const char *fmt, ...)
 319 {
 320         va_list args;
 321
 322         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 323                 return;
 324         if (!b43_ratelimit(wl))
 325                 return;
 326         va_start(args, fmt);
 327         printk(KERN_ERR "b43-%s ERROR: ",
 328                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 329         vprintk(fmt, args);
 330         va_end(args);
 331 }
 332
 333 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 334 {
 335         va_list args;
 336
 337         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 338                 return;
 339         if (!b43_ratelimit(wl))
 340                 return;
 341         va_start(args, fmt);
 342         printk(KERN_WARNING "b43-%s warning: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347
 348 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 349 {
 350         va_list args;
 351
 352         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 353                 return;
 354         va_start(args, fmt);
 355         printk(KERN_DEBUG "b43-%s debug: ",
 356                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 357         vprintk(fmt, args);
 358         va_end(args);
 359 }
 360
 361 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 362 {
 363         u32 macctl;
 364
 365         B43_WARN_ON(offset % 4 != 0);
 366
 367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 368         if (macctl & B43_MACCTL_BE)
 369                 val = swab32(val);
 370
 371         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 372         mmiowb();
 373         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 374 }
 375
 376 static inline void b43_shm_control_word(struct b43_wldev *dev,
 377                                         u16 routing, u16 offset)
 378 {
 379         u32 control;
 380
 381         /* "offset" is the WORD offset. */
 382         control = routing;
 383         control <<= 16;
 384         control |= offset;
 385         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 386 }
 387
 388 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 389 {
 390         u32 ret;
 391
 392         if (routing == B43_SHM_SHARED) {
 393                 B43_WARN_ON(offset & 0x0001);
 394                 if (offset & 0x0003) {
 395                         /* Unaligned access */
 396                         b43_shm_control_word(dev, routing, offset >> 2);
 397                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 398                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 399                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 400
 401                         goto out;
 402                 }
 403                 offset >>= 2;
 404         }
 405         b43_shm_control_word(dev, routing, offset);
 406         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 407 out:
 408         return ret;
 409 }
 410
 411 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 412 {
 413         struct b43_wl *wl = dev->wl;
 414         unsigned long flags;
 415         u32 ret;
 416
 417         spin_lock_irqsave(&wl->shm_lock, flags);
 418         ret = __b43_shm_read32(dev, routing, offset);
 419         spin_unlock_irqrestore(&wl->shm_lock, flags);
 420
 421         return ret;
 422 }
 423
 424 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 425 {
 426         u16 ret;
 427
 428         if (routing == B43_SHM_SHARED) {
 429                 B43_WARN_ON(offset & 0x0001);
 430                 if (offset & 0x0003) {
 431                         /* Unaligned access */
 432                         b43_shm_control_word(dev, routing, offset >> 2);
 433                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 434
 435                         goto out;
 436                 }
 437                 offset >>= 2;
 438         }
 439         b43_shm_control_word(dev, routing, offset);
 440         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 441 out:
 442         return ret;
 443 }
 444
 445 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 446 {
 447         struct b43_wl *wl = dev->wl;
 448         unsigned long flags;
 449         u16 ret;
 450
 451         spin_lock_irqsave(&wl->shm_lock, flags);
 452         ret = __b43_shm_read16(dev, routing, offset);
 453         spin_unlock_irqrestore(&wl->shm_lock, flags);
 454
 455         return ret;
 456 }
 457
 458 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 459 {
 460         if (routing == B43_SHM_SHARED) {
 461                 B43_WARN_ON(offset & 0x0001);
 462                 if (offset & 0x0003) {
 463                         /* Unaligned access */
 464                         b43_shm_control_word(dev, routing, offset >> 2);
 465                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 466                                     value & 0xFFFF);
 467                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 468                         b43_write16(dev, B43_MMIO_SHM_DATA,
 469                                     (value >> 16) & 0xFFFF);
 470                         return;
 471                 }
 472                 offset >>= 2;
 473         }
 474         b43_shm_control_word(dev, routing, offset);
 475         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 476 }
 477
 478 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 479 {
 480         struct b43_wl *wl = dev->wl;
 481         unsigned long flags;
 482
 483         spin_lock_irqsave(&wl->shm_lock, flags);
 484         __b43_shm_write32(dev, routing, offset, value);
 485         spin_unlock_irqrestore(&wl->shm_lock, flags);
 486 }
 487
 488 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 496                         return;
 497                 }
 498                 offset >>= 2;
 499         }
 500         b43_shm_control_word(dev, routing, offset);
 501         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 502 }
 503
 504 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 505 {
 506         struct b43_wl *wl = dev->wl;
 507         unsigned long flags;
 508
 509         spin_lock_irqsave(&wl->shm_lock, flags);
 510         __b43_shm_write16(dev, routing, offset, value);
 511         spin_unlock_irqrestore(&wl->shm_lock, flags);
 512 }
 513
 514 /* Read HostFlags */
 515 u64 b43_hf_read(struct b43_wldev *dev)
 516 {
 517         u64 ret;
 518
 519         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 520         ret <<= 16;
 521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 522         ret <<= 16;
 523         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 524
 525         return ret;
 526 }
 527
 528 /* Write HostFlags */
 529 void b43_hf_write(struct b43_wldev *dev, u64 value)
 530 {
 531         u16 lo, mi, hi;
 532
 533         lo = (value & 0x00000000FFFFULL);
 534         mi = (value & 0x0000FFFF0000ULL) >> 16;
 535         hi = (value & 0xFFFF00000000ULL) >> 32;
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 537         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 538         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 539 }
 540
 541 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 542 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 543 {
 544         B43_WARN_ON(!dev->fw.opensource);
 545         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 546 }
 547
 548 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 549 {
 550         u32 low, high;
 551
 552         B43_WARN_ON(dev->dev->id.revision < 3);
 553
 554         /* The hardware guarantees us an atomic read, if we
 555          * read the low register first. */
 556         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 557         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 558
 559         *tsf = high;
 560         *tsf <<= 32;
 561         *tsf |= low;
 562 }
 563
 564 static void b43_time_lock(struct b43_wldev *dev)
 565 {
 566         u32 macctl;
 567
 568         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 569         macctl |= B43_MACCTL_TBTTHOLD;
 570         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 571         /* Commit the write */
 572         b43_read32(dev, B43_MMIO_MACCTL);
 573 }
 574
 575 static void b43_time_unlock(struct b43_wldev *dev)
 576 {
 577         u32 macctl;
 578
 579         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 580         macctl &= ~B43_MACCTL_TBTTHOLD;
 581         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 582         /* Commit the write */
 583         b43_read32(dev, B43_MMIO_MACCTL);
 584 }
 585
 586 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 587 {
 588         u32 low, high;
 589
 590         B43_WARN_ON(dev->dev->id.revision < 3);
 591
 592         low = tsf;
 593         high = (tsf >> 32);
 594         /* The hardware guarantees us an atomic write, if we
 595          * write the low register first. */
 596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 597         mmiowb();
 598         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 599         mmiowb();
 600 }
 601
 602 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 603 {
 604         b43_time_lock(dev);
 605         b43_tsf_write_locked(dev, tsf);
 606         b43_time_unlock(dev);
 607 }
 608
 609 static
 610 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 611 {
 612         static const u8 zero_addr[ETH_ALEN] = { 0 };
 613         u16 data;
 614
 615         if (!mac)
 616                 mac = zero_addr;
 617
 618         offset |= 0x0020;
 619         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 620
 621         data = mac[0];
 622         data |= mac[1] << 8;
 623         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 624         data = mac[2];
 625         data |= mac[3] << 8;
 626         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 627         data = mac[4];
 628         data |= mac[5] << 8;
 629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 630 }
 631
 632 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 633 {
 634         const u8 *mac;
 635         const u8 *bssid;
 636         u8 mac_bssid[ETH_ALEN * 2];
 637         int i;
 638         u32 tmp;
 639
 640         bssid = dev->wl->bssid;
 641         mac = dev->wl->mac_addr;
 642
 643         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 644
 645         memcpy(mac_bssid, mac, ETH_ALEN);
 646         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 647
 648         /* Write our MAC address and BSSID to template ram */
 649         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 650                 tmp = (u32) (mac_bssid[i + 0]);
 651                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 652                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 653                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 654                 b43_ram_write(dev, 0x20 + i, tmp);
 655         }
 656 }
 657
 658 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 659 {
 660         b43_write_mac_bssid_templates(dev);
 661         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 662 }
 663
 664 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 665 {
 666         /* slot_time is in usec. */
 667         if (dev->phy.type != B43_PHYTYPE_G)
 668                 return;
 669         b43_write16(dev, 0x684, 510 + slot_time);
 670         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 671 }
 672
 673 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 674 {
 675         b43_set_slot_time(dev, 9);
 676 }
 677
 678 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 20);
 681 }
 682
 683 /* Synchronize IRQ top- and bottom-half.
 684  * IRQs must be masked before calling this.
 685  * This must not be called with the irq_lock held.
 686  */
 687 static void b43_synchronize_irq(struct b43_wldev *dev)
 688 {
 689         synchronize_irq(dev->dev->irq);
 690         tasklet_kill(&dev->isr_tasklet);
 691 }
 692
 693 /* DummyTransmission function, as documented on
 694  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 695  */
 696 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 697 {
 698         struct b43_wl *wl = dev->wl;
 699         struct b43_phy *phy = &dev->phy;
 700         unsigned int i, max_loop;
 701         u16 value;
 702         u32 buffer[5] = {
 703                 0x00000000,
 704                 0x00D40000,
 705                 0x00000000,
 706                 0x01000000,
 707                 0x00000000,
 708         };
 709
 710         if (ofdm) {
 711                 max_loop = 0x1E;
 712                 buffer[0] = 0x000201CC;
 713         } else {
 714                 max_loop = 0xFA;
 715                 buffer[0] = 0x000B846E;
 716         }
 717
 718         spin_lock_irq(&wl->irq_lock);
 719         write_lock(&wl->tx_lock);
 720
 721         for (i = 0; i < 5; i++)
 722                 b43_ram_write(dev, i * 4, buffer[i]);
 723
 724         b43_write16(dev, 0x0568, 0x0000);
 725         if (dev->dev->id.revision < 11)
 726                 b43_write16(dev, 0x07C0, 0x0000);
 727         else
 728                 b43_write16(dev, 0x07C0, 0x0100);
 729         value = (ofdm ? 0x41 : 0x40);
 730         b43_write16(dev, 0x050C, value);
 731         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 732                 b43_write16(dev, 0x0514, 0x1A02);
 733         b43_write16(dev, 0x0508, 0x0000);
 734         b43_write16(dev, 0x050A, 0x0000);
 735         b43_write16(dev, 0x054C, 0x0000);
 736         b43_write16(dev, 0x056A, 0x0014);
 737         b43_write16(dev, 0x0568, 0x0826);
 738         b43_write16(dev, 0x0500, 0x0000);
 739         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 740                 //SPEC TODO
 741         }
 742
 743         switch (phy->type) {
 744         case B43_PHYTYPE_N:
 745                 b43_write16(dev, 0x0502, 0x00D0);
 746                 break;
 747         case B43_PHYTYPE_LP:
 748                 b43_write16(dev, 0x0502, 0x0050);
 749                 break;
 750         default:
 751                 b43_write16(dev, 0x0502, 0x0030);
 752         }
 753
 754         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 755                 b43_radio_write16(dev, 0x0051, 0x0017);
 756         for (i = 0x00; i < max_loop; i++) {
 757                 value = b43_read16(dev, 0x050E);
 758                 if (value & 0x0080)
 759                         break;
 760                 udelay(10);
 761         }
 762         for (i = 0x00; i < 0x0A; i++) {
 763                 value = b43_read16(dev, 0x050E);
 764                 if (value & 0x0400)
 765                         break;
 766                 udelay(10);
 767         }
 768         for (i = 0x00; i < 0x19; i++) {
 769                 value = b43_read16(dev, 0x0690);
 770                 if (!(value & 0x0100))
 771                         break;
 772                 udelay(10);
 773         }
 774         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 775                 b43_radio_write16(dev, 0x0051, 0x0037);
 776
 777         write_unlock(&wl->tx_lock);
 778         spin_unlock_irq(&wl->irq_lock);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 static void do_key_write(struct b43_wldev *dev,
 838                          u8 index, u8 algorithm,
 839                          const u8 *key, size_t key_len, const u8 *mac_addr)
 840 {
 841         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 842         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 843
 844         if (b43_new_kidx_api(dev))
 845                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 846
 847         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 848         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 849
 850         if (index >= pairwise_keys_start)
 851                 keymac_write(dev, index, NULL); /* First zero out mac. */
 852         if (key)
 853                 memcpy(buf, key, key_len);
 854         key_write(dev, index, algorithm, buf);
 855         if (index >= pairwise_keys_start)
 856                 keymac_write(dev, index, mac_addr);
 857
 858         dev->key[index].algorithm = algorithm;
 859 }
 860
 861 static int b43_key_write(struct b43_wldev *dev,
 862                          int index, u8 algorithm,
 863                          const u8 *key, size_t key_len,
 864                          const u8 *mac_addr,
 865                          struct ieee80211_key_conf *keyconf)
 866 {
 867         int i;
 868         int pairwise_keys_start;
 869
 870         if (key_len > B43_SEC_KEYSIZE)
 871                 return -EINVAL;
 872         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 873                 /* Check that we don't already have this key. */
 874                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 875         }
 876         if (index < 0) {
 877                 /* Pairwise key. Get an empty slot for the key. */
 878                 if (b43_new_kidx_api(dev))
 879                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 880                 else
 881                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 882                 for (i = pairwise_keys_start;
 883                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 884                      i++) {
 885                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 886                         if (!dev->key[i].keyconf) {
 887                                 /* found empty */
 888                                 index = i;
 889                                 break;
 890                         }
 891                 }
 892                 if (index < 0) {
 893                         b43warn(dev->wl, "Out of hardware key memory\n");
 894                         return -ENOSPC;
 895                 }
 896         } else
 897                 B43_WARN_ON(index > 3);
 898
 899         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 900         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 901                 /* Default RX key */
 902                 B43_WARN_ON(mac_addr);
 903                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 904         }
 905         keyconf->hw_key_idx = index;
 906         dev->key[index].keyconf = keyconf;
 907
 908         return 0;
 909 }
 910
 911 static int b43_key_clear(struct b43_wldev *dev, int index)
 912 {
 913         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
 914                 return -EINVAL;
 915         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 916                      NULL, B43_SEC_KEYSIZE, NULL);
 917         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 918                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 919                              NULL, B43_SEC_KEYSIZE, NULL);
 920         }
 921         dev->key[index].keyconf = NULL;
 922
 923         return 0;
 924 }
 925
 926 static void b43_clear_keys(struct b43_wldev *dev)
 927 {
 928         int i, count;
 929
 930         if (b43_new_kidx_api(dev))
 931                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 932         else
 933                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 934         for (i = 0; i < count; i++)
 935                 b43_key_clear(dev, i);
 936 }
 937
 938 static void b43_dump_keymemory(struct b43_wldev *dev)
 939 {
 940         unsigned int i, index, count, offset, pairwise_keys_start;
 941         u8 mac[ETH_ALEN];
 942         u16 algo;
 943         u32 rcmta0;
 944         u16 rcmta1;
 945         u64 hf;
 946         struct b43_key *key;
 947
 948         if (!b43_debug(dev, B43_DBG_KEYS))
 949                 return;
 950
 951         hf = b43_hf_read(dev);
 952         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
 953                !!(hf & B43_HF_USEDEFKEYS));
 954         if (b43_new_kidx_api(dev)) {
 955                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 956                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
 957         } else {
 958                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 959                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
 960         }
 961         for (index = 0; index < count; index++) {
 962                 key = &(dev->key[index]);
 963                 printk(KERN_DEBUG "Key slot %02u: %s",
 964                        index, (key->keyconf == NULL) ? " " : "*");
 965                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 966                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 967                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
 968                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
 969                 }
 970
 971                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
 972                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
 973                 printk("   Algo: %04X/%02X", algo, key->algorithm);
 974
 975                 if (index >= pairwise_keys_start) {
 976                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
 977                                                 ((index - pairwise_keys_start) * 2) + 0);
 978                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
 979                                                 ((index - pairwise_keys_start) * 2) + 1);
 980                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
 981                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
 982                         printk("   MAC: %pM", mac);
 983                 } else
 984                         printk("   DEFAULT KEY");
 985                 printk("\n");
 986         }
 987 }
 988
 989 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 990 {
 991         u32 macctl;
 992         u16 ucstat;
 993         bool hwps;
 994         bool awake;
 995         int i;
 996
 997         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
 998                     (ps_flags & B43_PS_DISABLED));
 999         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1000
1001         if (ps_flags & B43_PS_ENABLED) {
1002                 hwps = 1;
1003         } else if (ps_flags & B43_PS_DISABLED) {
1004                 hwps = 0;
1005         } else {
1006                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1007                 //      and thus is not an AP and we are associated, set bit 25
1008         }
1009         if (ps_flags & B43_PS_AWAKE) {
1010                 awake = 1;
1011         } else if (ps_flags & B43_PS_ASLEEP) {
1012                 awake = 0;
1013         } else {
1014                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1015                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1016                 //      successful, set bit26
1017         }
1018
1019 /* FIXME: For now we force awake-on and hwps-off */
1020         hwps = 0;
1021         awake = 1;
1022
1023         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1024         if (hwps)
1025                 macctl |= B43_MACCTL_HWPS;
1026         else
1027                 macctl &= ~B43_MACCTL_HWPS;
1028         if (awake)
1029                 macctl |= B43_MACCTL_AWAKE;
1030         else
1031                 macctl &= ~B43_MACCTL_AWAKE;
1032         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1033         /* Commit write */
1034         b43_read32(dev, B43_MMIO_MACCTL);
1035         if (awake && dev->dev->id.revision >= 5) {
1036                 /* Wait for the microcode to wake up. */
1037                 for (i = 0; i < 100; i++) {
1038                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1039                                                 B43_SHM_SH_UCODESTAT);
1040                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1041                                 break;
1042                         udelay(10);
1043                 }
1044         }
1045 }
1046
1047 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1048 {
1049         u32 tmslow;
1050         u32 macctl;
1051
1052         flags |= B43_TMSLOW_PHYCLKEN;
1053         flags |= B43_TMSLOW_PHYRESET;
1054         ssb_device_enable(dev->dev, flags);
1055         msleep(2);              /* Wait for the PLL to turn on. */
1056
1057         /* Now take the PHY out of Reset again */
1058         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1059         tmslow |= SSB_TMSLOW_FGC;
1060         tmslow &= ~B43_TMSLOW_PHYRESET;
1061         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1062         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1063         msleep(1);
1064         tmslow &= ~SSB_TMSLOW_FGC;
1065         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1066         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1067         msleep(1);
1068
1069         /* Turn Analog ON, but only if we already know the PHY-type.
1070          * This protects against very early setup where we don't know the
1071          * PHY-type, yet. wireless_core_reset will be called once again later,
1072          * when we know the PHY-type. */
1073         if (dev->phy.ops)
1074                 dev->phy.ops->switch_analog(dev, 1);
1075
1076         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1077         macctl &= ~B43_MACCTL_GMODE;
1078         if (flags & B43_TMSLOW_GMODE)
1079                 macctl |= B43_MACCTL_GMODE;
1080         macctl |= B43_MACCTL_IHR_ENABLED;
1081         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1082 }
1083
1084 static void handle_irq_transmit_status(struct b43_wldev *dev)
1085 {
1086         u32 v0, v1;
1087         u16 tmp;
1088         struct b43_txstatus stat;
1089
1090         while (1) {
1091                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1092                 if (!(v0 & 0x00000001))
1093                         break;
1094                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1095
1096                 stat.cookie = (v0 >> 16);
1097                 stat.seq = (v1 & 0x0000FFFF);
1098                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1099                 tmp = (v0 & 0x0000FFFF);
1100                 stat.frame_count = ((tmp & 0xF000) >> 12);
1101                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1102                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1103                 stat.pm_indicated = !!(tmp & 0x0080);
1104                 stat.intermediate = !!(tmp & 0x0040);
1105                 stat.for_ampdu = !!(tmp & 0x0020);
1106                 stat.acked = !!(tmp & 0x0002);
1107
1108                 b43_handle_txstatus(dev, &stat);
1109         }
1110 }
1111
1112 static void drain_txstatus_queue(struct b43_wldev *dev)
1113 {
1114         u32 dummy;
1115
1116         if (dev->dev->id.revision < 5)
1117                 return;
1118         /* Read all entries from the microcode TXstatus FIFO
1119          * and throw them away.
1120          */
1121         while (1) {
1122                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1123                 if (!(dummy & 0x00000001))
1124                         break;
1125                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1126         }
1127 }
1128
1129 static u32 b43_jssi_read(struct b43_wldev *dev)
1130 {
1131         u32 val = 0;
1132
1133         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1134         val <<= 16;
1135         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1136
1137         return val;
1138 }
1139
1140 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1141 {
1142         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1143         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1144 }
1145
1146 static void b43_generate_noise_sample(struct b43_wldev *dev)
1147 {
1148         b43_jssi_write(dev, 0x7F7F7F7F);
1149         b43_write32(dev, B43_MMIO_MACCMD,
1150                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1151 }
1152
1153 static void b43_calculate_link_quality(struct b43_wldev *dev)
1154 {
1155         /* Top half of Link Quality calculation. */
1156
1157         if (dev->phy.type != B43_PHYTYPE_G)
1158                 return;
1159         if (dev->noisecalc.calculation_running)
1160                 return;
1161         dev->noisecalc.calculation_running = 1;
1162         dev->noisecalc.nr_samples = 0;
1163
1164         b43_generate_noise_sample(dev);
1165 }
1166
1167 static void handle_irq_noise(struct b43_wldev *dev)
1168 {
1169         struct b43_phy_g *phy = dev->phy.g;
1170         u16 tmp;
1171         u8 noise[4];
1172         u8 i, j;
1173         s32 average;
1174
1175         /* Bottom half of Link Quality calculation. */
1176
1177         if (dev->phy.type != B43_PHYTYPE_G)
1178                 return;
1179
1180         /* Possible race condition: It might be possible that the user
1181          * changed to a different channel in the meantime since we
1182          * started the calculation. We ignore that fact, since it's
1183          * not really that much of a problem. The background noise is
1184          * an estimation only anyway. Slightly wrong results will get damped
1185          * by the averaging of the 8 sample rounds. Additionally the
1186          * value is shortlived. So it will be replaced by the next noise
1187          * calculation round soon. */
1188
1189         B43_WARN_ON(!dev->noisecalc.calculation_running);
1190         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1191         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1192             noise[2] == 0x7F || noise[3] == 0x7F)
1193                 goto generate_new;
1194
1195         /* Get the noise samples. */
1196         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1197         i = dev->noisecalc.nr_samples;
1198         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1199         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1200         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1201         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1202         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1203         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1204         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1205         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1206         dev->noisecalc.nr_samples++;
1207         if (dev->noisecalc.nr_samples == 8) {
1208                 /* Calculate the Link Quality by the noise samples. */
1209                 average = 0;
1210                 for (i = 0; i < 8; i++) {
1211                         for (j = 0; j < 4; j++)
1212                                 average += dev->noisecalc.samples[i][j];
1213                 }
1214                 average /= (8 * 4);
1215                 average *= 125;
1216                 average += 64;
1217                 average /= 128;
1218                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1219                 tmp = (tmp / 128) & 0x1F;
1220                 if (tmp >= 8)
1221                         average += 2;
1222                 else
1223                         average -= 25;
1224                 if (tmp == 8)
1225                         average -= 72;
1226                 else
1227                         average -= 48;
1228
1229                 dev->stats.link_noise = average;
1230                 dev->noisecalc.calculation_running = 0;
1231                 return;
1232         }
1233 generate_new:
1234         b43_generate_noise_sample(dev);
1235 }
1236
1237 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1238 {
1239         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1240                 ///TODO: PS TBTT
1241         } else {
1242                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1243                         b43_power_saving_ctl_bits(dev, 0);
1244         }
1245         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1246                 dev->dfq_valid = 1;
1247 }
1248
1249 static void handle_irq_atim_end(struct b43_wldev *dev)
1250 {
1251         if (dev->dfq_valid) {
1252                 b43_write32(dev, B43_MMIO_MACCMD,
1253                             b43_read32(dev, B43_MMIO_MACCMD)
1254                             | B43_MACCMD_DFQ_VALID);
1255                 dev->dfq_valid = 0;
1256         }
1257 }
1258
1259 static void handle_irq_pmq(struct b43_wldev *dev)
1260 {
1261         u32 tmp;
1262
1263         //TODO: AP mode.
1264
1265         while (1) {
1266                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1267                 if (!(tmp & 0x00000008))
1268                         break;
1269         }
1270         /* 16bit write is odd, but correct. */
1271         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1272 }
1273
1274 static void b43_write_template_common(struct b43_wldev *dev,
1275                                       const u8 *data, u16 size,
1276                                       u16 ram_offset,
1277                                       u16 shm_size_offset, u8 rate)
1278 {
1279         u32 i, tmp;
1280         struct b43_plcp_hdr4 plcp;
1281
1282         plcp.data = 0;
1283         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1284         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1285         ram_offset += sizeof(u32);
1286         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1287          * So leave the first two bytes of the next write blank.
1288          */
1289         tmp = (u32) (data[0]) << 16;
1290         tmp |= (u32) (data[1]) << 24;
1291         b43_ram_write(dev, ram_offset, tmp);
1292         ram_offset += sizeof(u32);
1293         for (i = 2; i < size; i += sizeof(u32)) {
1294                 tmp = (u32) (data[i + 0]);
1295                 if (i + 1 < size)
1296                         tmp |= (u32) (data[i + 1]) << 8;
1297                 if (i + 2 < size)
1298                         tmp |= (u32) (data[i + 2]) << 16;
1299                 if (i + 3 < size)
1300                         tmp |= (u32) (data[i + 3]) << 24;
1301                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1302         }
1303         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1304                         size + sizeof(struct b43_plcp_hdr6));
1305 }
1306
1307 /* Check if the use of the antenna that ieee80211 told us to
1308  * use is possible. This will fall back to DEFAULT.
1309  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1310 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1311                                   u8 antenna_nr)
1312 {
1313         u8 antenna_mask;
1314
1315         if (antenna_nr == 0) {
1316                 /* Zero means "use default antenna". That's always OK. */
1317                 return 0;
1318         }
1319
1320         /* Get the mask of available antennas. */
1321         if (dev->phy.gmode)
1322                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1323         else
1324                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1325
1326         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1327                 /* This antenna is not available. Fall back to default. */
1328                 return 0;
1329         }
1330
1331         return antenna_nr;
1332 }
1333
1334 /* Convert a b43 antenna number value to the PHY TX control value. */
1335 static u16 b43_antenna_to_phyctl(int antenna)
1336 {
1337         switch (antenna) {
1338         case B43_ANTENNA0:
1339                 return B43_TXH_PHY_ANT0;
1340         case B43_ANTENNA1:
1341                 return B43_TXH_PHY_ANT1;
1342         case B43_ANTENNA2:
1343                 return B43_TXH_PHY_ANT2;
1344         case B43_ANTENNA3:
1345                 return B43_TXH_PHY_ANT3;
1346         case B43_ANTENNA_AUTO:
1347                 return B43_TXH_PHY_ANT01AUTO;
1348         }
1349         B43_WARN_ON(1);
1350         return 0;
1351 }
1352
1353 static void b43_write_beacon_template(struct b43_wldev *dev,
1354                                       u16 ram_offset,
1355                                       u16 shm_size_offset)
1356 {
1357         unsigned int i, len, variable_len;
1358         const struct ieee80211_mgmt *bcn;
1359         const u8 *ie;
1360         bool tim_found = 0;
1361         unsigned int rate;
1362         u16 ctl;
1363         int antenna;
1364         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1365
1366         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1367         len = min((size_t) dev->wl->current_beacon->len,
1368                   0x200 - sizeof(struct b43_plcp_hdr6));
1369         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1370
1371         b43_write_template_common(dev, (const u8 *)bcn,
1372                                   len, ram_offset, shm_size_offset, rate);
1373
1374         /* Write the PHY TX control parameters. */
1375         antenna = B43_ANTENNA_DEFAULT;
1376         antenna = b43_antenna_to_phyctl(antenna);
1377         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1378         /* We can't send beacons with short preamble. Would get PHY errors. */
1379         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1380         ctl &= ~B43_TXH_PHY_ANT;
1381         ctl &= ~B43_TXH_PHY_ENC;
1382         ctl |= antenna;
1383         if (b43_is_cck_rate(rate))
1384                 ctl |= B43_TXH_PHY_ENC_CCK;
1385         else
1386                 ctl |= B43_TXH_PHY_ENC_OFDM;
1387         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1388
1389         /* Find the position of the TIM and the DTIM_period value
1390          * and write them to SHM. */
1391         ie = bcn->u.beacon.variable;
1392         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1393         for (i = 0; i < variable_len - 2; ) {
1394                 uint8_t ie_id, ie_len;
1395
1396                 ie_id = ie[i];
1397                 ie_len = ie[i + 1];
1398                 if (ie_id == 5) {
1399                         u16 tim_position;
1400                         u16 dtim_period;
1401                         /* This is the TIM Information Element */
1402
1403                         /* Check whether the ie_len is in the beacon data range. */
1404                         if (variable_len < ie_len + 2 + i)
1405                                 break;
1406                         /* A valid TIM is at least 4 bytes long. */
1407                         if (ie_len < 4)
1408                                 break;
1409                         tim_found = 1;
1410
1411                         tim_position = sizeof(struct b43_plcp_hdr6);
1412                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1413                         tim_position += i;
1414
1415                         dtim_period = ie[i + 3];
1416
1417                         b43_shm_write16(dev, B43_SHM_SHARED,
1418                                         B43_SHM_SH_TIMBPOS, tim_position);
1419                         b43_shm_write16(dev, B43_SHM_SHARED,
1420                                         B43_SHM_SH_DTIMPER, dtim_period);
1421                         break;
1422                 }
1423                 i += ie_len + 2;
1424         }
1425         if (!tim_found) {
1426                 /*
1427                  * If ucode wants to modify TIM do it behind the beacon, this
1428                  * will happen, for example, when doing mesh networking.
1429                  */
1430                 b43_shm_write16(dev, B43_SHM_SHARED,
1431                                 B43_SHM_SH_TIMBPOS,
1432                                 len + sizeof(struct b43_plcp_hdr6));
1433                 b43_shm_write16(dev, B43_SHM_SHARED,
1434                                 B43_SHM_SH_DTIMPER, 0);
1435         }
1436         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1437 }
1438
1439 static void b43_upload_beacon0(struct b43_wldev *dev)
1440 {
1441         struct b43_wl *wl = dev->wl;
1442
1443         if (wl->beacon0_uploaded)
1444                 return;
1445         b43_write_beacon_template(dev, 0x68, 0x18);
1446         wl->beacon0_uploaded = 1;
1447 }
1448
1449 static void b43_upload_beacon1(struct b43_wldev *dev)
1450 {
1451         struct b43_wl *wl = dev->wl;
1452
1453         if (wl->beacon1_uploaded)
1454                 return;
1455         b43_write_beacon_template(dev, 0x468, 0x1A);
1456         wl->beacon1_uploaded = 1;
1457 }
1458
1459 static void handle_irq_beacon(struct b43_wldev *dev)
1460 {
1461         struct b43_wl *wl = dev->wl;
1462         u32 cmd, beacon0_valid, beacon1_valid;
1463
1464         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1465             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1466                 return;
1467
1468         /* This is the bottom half of the asynchronous beacon update. */
1469
1470         /* Ignore interrupt in the future. */
1471         dev->irq_mask &= ~B43_IRQ_BEACON;
1472
1473         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1474         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1475         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1476
1477         /* Schedule interrupt manually, if busy. */
1478         if (beacon0_valid && beacon1_valid) {
1479                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1480                 dev->irq_mask |= B43_IRQ_BEACON;
1481                 return;
1482         }
1483
1484         if (unlikely(wl->beacon_templates_virgin)) {
1485                 /* We never uploaded a beacon before.
1486                  * Upload both templates now, but only mark one valid. */
1487                 wl->beacon_templates_virgin = 0;
1488                 b43_upload_beacon0(dev);
1489                 b43_upload_beacon1(dev);
1490                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1491                 cmd |= B43_MACCMD_BEACON0_VALID;
1492                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1493         } else {
1494                 if (!beacon0_valid) {
1495                         b43_upload_beacon0(dev);
1496                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1497                         cmd |= B43_MACCMD_BEACON0_VALID;
1498                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1499                 } else if (!beacon1_valid) {
1500                         b43_upload_beacon1(dev);
1501                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1502                         cmd |= B43_MACCMD_BEACON1_VALID;
1503                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1504                 }
1505         }
1506 }
1507
1508 static void b43_beacon_update_trigger_work(struct work_struct *work)
1509 {
1510         struct b43_wl *wl = container_of(work, struct b43_wl,
1511                                          beacon_update_trigger);
1512         struct b43_wldev *dev;
1513
1514         mutex_lock(&wl->mutex);
1515         dev = wl->current_dev;
1516         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1517                 spin_lock_irq(&wl->irq_lock);
1518                 /* update beacon right away or defer to irq */
1519                 handle_irq_beacon(dev);
1520                 /* The handler might have updated the IRQ mask. */
1521                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1522                 mmiowb();
1523                 spin_unlock_irq(&wl->irq_lock);
1524         }
1525         mutex_unlock(&wl->mutex);
1526 }
1527
1528 /* Asynchronously update the packet templates in template RAM.
1529  * Locking: Requires wl->irq_lock to be locked. */
1530 static void b43_update_templates(struct b43_wl *wl)
1531 {
1532         struct sk_buff *beacon;
1533
1534         /* This is the top half of the ansynchronous beacon update.
1535          * The bottom half is the beacon IRQ.
1536          * Beacon update must be asynchronous to avoid sending an
1537          * invalid beacon. This can happen for example, if the firmware
1538          * transmits a beacon while we are updating it. */
1539
1540         /* We could modify the existing beacon and set the aid bit in
1541          * the TIM field, but that would probably require resizing and
1542          * moving of data within the beacon template.
1543          * Simply request a new beacon and let mac80211 do the hard work. */
1544         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1545         if (unlikely(!beacon))
1546                 return;
1547
1548         if (wl->current_beacon)
1549                 dev_kfree_skb_any(wl->current_beacon);
1550         wl->current_beacon = beacon;
1551         wl->beacon0_uploaded = 0;
1552         wl->beacon1_uploaded = 0;
1553         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1554 }
1555
1556 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1557 {
1558         b43_time_lock(dev);
1559         if (dev->dev->id.revision >= 3) {
1560                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1561                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1562         } else {
1563                 b43_write16(dev, 0x606, (beacon_int >> 6));
1564                 b43_write16(dev, 0x610, beacon_int);
1565         }
1566         b43_time_unlock(dev);
1567         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1568 }
1569
1570 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1571 {
1572         u16 reason;
1573
1574         /* Read the register that contains the reason code for the panic. */
1575         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1576         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1577
1578         switch (reason) {
1579         default:
1580                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1581                 /* fallthrough */
1582         case B43_FWPANIC_DIE:
1583                 /* Do not restart the controller or firmware.
1584                  * The device is nonfunctional from now on.
1585                  * Restarting would result in this panic to trigger again,
1586                  * so we avoid that recursion. */
1587                 break;
1588         case B43_FWPANIC_RESTART:
1589                 b43_controller_restart(dev, "Microcode panic");
1590                 break;
1591         }
1592 }
1593
1594 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1595 {
1596         unsigned int i, cnt;
1597         u16 reason, marker_id, marker_line;
1598         __le16 *buf;
1599
1600         /* The proprietary firmware doesn't have this IRQ. */
1601         if (!dev->fw.opensource)
1602                 return;
1603
1604         /* Read the register that contains the reason code for this IRQ. */
1605         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1606
1607         switch (reason) {
1608         case B43_DEBUGIRQ_PANIC:
1609                 b43_handle_firmware_panic(dev);
1610                 break;
1611         case B43_DEBUGIRQ_DUMP_SHM:
1612                 if (!B43_DEBUG)
1613                         break; /* Only with driver debugging enabled. */
1614                 buf = kmalloc(4096, GFP_ATOMIC);
1615                 if (!buf) {
1616                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1617                         goto out;
1618                 }
1619                 for (i = 0; i < 4096; i += 2) {
1620                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1621                         buf[i / 2] = cpu_to_le16(tmp);
1622                 }
1623                 b43info(dev->wl, "Shared memory dump:\n");
1624                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1625                                16, 2, buf, 4096, 1);
1626                 kfree(buf);
1627                 break;
1628         case B43_DEBUGIRQ_DUMP_REGS:
1629                 if (!B43_DEBUG)
1630                         break; /* Only with driver debugging enabled. */
1631                 b43info(dev->wl, "Microcode register dump:\n");
1632                 for (i = 0, cnt = 0; i < 64; i++) {
1633                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1634                         if (cnt == 0)
1635                                 printk(KERN_INFO);
1636                         printk("r%02u: 0x%04X  ", i, tmp);
1637                         cnt++;
1638                         if (cnt == 6) {
1639                                 printk("\n");
1640                                 cnt = 0;
1641                         }
1642                 }
1643                 printk("\n");
1644                 break;
1645         case B43_DEBUGIRQ_MARKER:
1646                 if (!B43_DEBUG)
1647                         break; /* Only with driver debugging enabled. */
1648                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1649                                            B43_MARKER_ID_REG);
1650                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1651                                              B43_MARKER_LINE_REG);
1652                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1653                         "at line number %u\n",
1654                         marker_id, marker_line);
1655                 break;
1656         default:
1657                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1658                        reason);
1659         }
1660 out:
1661         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1662         b43_shm_write16(dev, B43_SHM_SCRATCH,
1663                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1664 }
1665
1666 /* Interrupt handler bottom-half */
1667 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1668 {
1669         u32 reason;
1670         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1671         u32 merged_dma_reason = 0;
1672         int i;
1673         unsigned long flags;
1674
1675         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1676
1677         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1678
1679         reason = dev->irq_reason;
1680         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1681                 dma_reason[i] = dev->dma_reason[i];
1682                 merged_dma_reason |= dma_reason[i];
1683         }
1684
1685         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1686                 b43err(dev->wl, "MAC transmission error\n");
1687
1688         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1689                 b43err(dev->wl, "PHY transmission error\n");
1690                 rmb();
1691                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1692                         atomic_set(&dev->phy.txerr_cnt,
1693                                    B43_PHY_TX_BADNESS_LIMIT);
1694                         b43err(dev->wl, "Too many PHY TX errors, "
1695                                         "restarting the controller\n");
1696                         b43_controller_restart(dev, "PHY TX errors");
1697                 }
1698         }
1699
1700         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1701                                           B43_DMAIRQ_NONFATALMASK))) {
1702                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1703                         b43err(dev->wl, "Fatal DMA error: "
1704                                "0x%08X, 0x%08X, 0x%08X, "
1705                                "0x%08X, 0x%08X, 0x%08X\n",
1706                                dma_reason[0], dma_reason[1],
1707                                dma_reason[2], dma_reason[3],
1708                                dma_reason[4], dma_reason[5]);
1709                         b43_controller_restart(dev, "DMA error");
1710                         mmiowb();
1711                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1712                         return;
1713                 }
1714                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1715                         b43err(dev->wl, "DMA error: "
1716                                "0x%08X, 0x%08X, 0x%08X, "
1717                                "0x%08X, 0x%08X, 0x%08X\n",
1718                                dma_reason[0], dma_reason[1],
1719                                dma_reason[2], dma_reason[3],
1720                                dma_reason[4], dma_reason[5]);
1721                 }
1722         }
1723
1724         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1725                 handle_irq_ucode_debug(dev);
1726         if (reason & B43_IRQ_TBTT_INDI)
1727                 handle_irq_tbtt_indication(dev);
1728         if (reason & B43_IRQ_ATIM_END)
1729                 handle_irq_atim_end(dev);
1730         if (reason & B43_IRQ_BEACON)
1731                 handle_irq_beacon(dev);
1732         if (reason & B43_IRQ_PMQ)
1733                 handle_irq_pmq(dev);
1734         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1735                 ;/* TODO */
1736         if (reason & B43_IRQ_NOISESAMPLE_OK)
1737                 handle_irq_noise(dev);
1738
1739         /* Check the DMA reason registers for received data. */
1740         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1741                 if (b43_using_pio_transfers(dev))
1742                         b43_pio_rx(dev->pio.rx_queue);
1743                 else
1744                         b43_dma_rx(dev->dma.rx_ring);
1745         }
1746         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1747         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1748         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1749         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1750         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1751
1752         if (reason & B43_IRQ_TX_OK)
1753                 handle_irq_transmit_status(dev);
1754
1755         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1756         mmiowb();
1757         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1758 }
1759
1760 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1761 {
1762         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1763
1764         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1765         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1766         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1767         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1768         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1769 /* Unused ring
1770         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1771 */
1772 }
1773
1774 /* Interrupt handler top-half */
1775 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1776 {
1777         irqreturn_t ret = IRQ_NONE;
1778         struct b43_wldev *dev = dev_id;
1779         u32 reason;
1780
1781         B43_WARN_ON(!dev);
1782
1783         spin_lock(&dev->wl->irq_lock);
1784
1785         if (unlikely(b43_status(dev) < B43_STAT_STARTED)) {
1786                 /* This can only happen on shared IRQ lines. */
1787                 goto out;
1788         }
1789         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1790         if (reason == 0xffffffff)       /* shared IRQ */
1791                 goto out;
1792         ret = IRQ_HANDLED;
1793         reason &= dev->irq_mask;
1794         if (!reason)
1795                 goto out;
1796
1797         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1798             & 0x0001DC00;
1799         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1800             & 0x0000DC00;
1801         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1802             & 0x0000DC00;
1803         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1804             & 0x0001DC00;
1805         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1806             & 0x0000DC00;
1807 /* Unused ring
1808         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1809             & 0x0000DC00;
1810 */
1811
1812         b43_interrupt_ack(dev, reason);
1813         /* disable all IRQs. They are enabled again in the bottom half. */
1814         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1815         /* save the reason code and call our bottom half. */
1816         dev->irq_reason = reason;
1817         tasklet_schedule(&dev->isr_tasklet);
1818 out:
1819         mmiowb();
1820         spin_unlock(&dev->wl->irq_lock);
1821
1822         return ret;
1823 }
1824
1825 void b43_do_release_fw(struct b43_firmware_file *fw)
1826 {
1827         release_firmware(fw->data);
1828         fw->data = NULL;
1829         fw->filename = NULL;
1830 }
1831
1832 static void b43_release_firmware(struct b43_wldev *dev)
1833 {
1834         b43_do_release_fw(&dev->fw.ucode);
1835         b43_do_release_fw(&dev->fw.pcm);
1836         b43_do_release_fw(&dev->fw.initvals);
1837         b43_do_release_fw(&dev->fw.initvals_band);
1838 }
1839
1840 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1841 {
1842         const char text[] =
1843                 "You must go to " \
1844                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
1845                 "and download the correct firmware for this driver version. " \
1846                 "Please carefully read all instructions on this website.\n";
1847
1848         if (error)
1849                 b43err(wl, text);
1850         else
1851                 b43warn(wl, text);
1852 }
1853
1854 int b43_do_request_fw(struct b43_request_fw_context *ctx,
1855                       const char *name,
1856                       struct b43_firmware_file *fw)
1857 {
1858         const struct firmware *blob;
1859         struct b43_fw_header *hdr;
1860         u32 size;
1861         int err;
1862
1863         if (!name) {
1864                 /* Don't fetch anything. Free possibly cached firmware. */
1865                 /* FIXME: We should probably keep it anyway, to save some headache
1866                  * on suspend/resume with multiband devices. */
1867                 b43_do_release_fw(fw);
1868                 return 0;
1869         }
1870         if (fw->filename) {
1871                 if ((fw->type == ctx->req_type) &&
1872                     (strcmp(fw->filename, name) == 0))
1873                         return 0; /* Already have this fw. */
1874                 /* Free the cached firmware first. */
1875                 /* FIXME: We should probably do this later after we successfully
1876                  * got the new fw. This could reduce headache with multiband devices.
1877                  * We could also redesign this to cache the firmware for all possible
1878                  * bands all the time. */
1879                 b43_do_release_fw(fw);
1880         }
1881
1882         switch (ctx->req_type) {
1883         case B43_FWTYPE_PROPRIETARY:
1884                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1885                          "b43%s/%s.fw",
1886                          modparam_fwpostfix, name);
1887                 break;
1888         case B43_FWTYPE_OPENSOURCE:
1889                 snprintf(ctx->fwname, sizeof(ctx->fwname),
1890                          "b43-open%s/%s.fw",
1891                          modparam_fwpostfix, name);
1892                 break;
1893         default:
1894                 B43_WARN_ON(1);
1895                 return -ENOSYS;
1896         }
1897         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
1898         if (err == -ENOENT) {
1899                 snprintf(ctx->errors[ctx->req_type],
1900                          sizeof(ctx->errors[ctx->req_type]),
1901                          "Firmware file \"%s\" not found\n", ctx->fwname);
1902                 return err;
1903         } else if (err) {
1904                 snprintf(ctx->errors[ctx->req_type],
1905                          sizeof(ctx->errors[ctx->req_type]),
1906                          "Firmware file \"%s\" request failed (err=%d)\n",
1907                          ctx->fwname, err);
1908                 return err;
1909         }
1910         if (blob->size < sizeof(struct b43_fw_header))
1911                 goto err_format;
1912         hdr = (struct b43_fw_header *)(blob->data);
1913         switch (hdr->type) {
1914         case B43_FW_TYPE_UCODE:
1915         case B43_FW_TYPE_PCM:
1916                 size = be32_to_cpu(hdr->size);
1917                 if (size != blob->size - sizeof(struct b43_fw_header))
1918                         goto err_format;
1919                 /* fallthrough */
1920         case B43_FW_TYPE_IV:
1921                 if (hdr->ver != 1)
1922                         goto err_format;
1923                 break;
1924         default:
1925                 goto err_format;
1926         }
1927
1928         fw->data = blob;
1929         fw->filename = name;
1930         fw->type = ctx->req_type;
1931
1932         return 0;
1933
1934 err_format:
1935         snprintf(ctx->errors[ctx->req_type],
1936                  sizeof(ctx->errors[ctx->req_type]),
1937                  "Firmware file \"%s\" format error.\n", ctx->fwname);
1938         release_firmware(blob);
1939
1940         return -EPROTO;
1941 }
1942
1943 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
1944 {
1945         struct b43_wldev *dev = ctx->dev;
1946         struct b43_firmware *fw = &ctx->dev->fw;
1947         const u8 rev = ctx->dev->dev->id.revision;
1948         const char *filename;
1949         u32 tmshigh;
1950         int err;
1951
1952         /* Get microcode */
1953         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
1954         if ((rev >= 5) && (rev <= 10))
1955                 filename = "ucode5";
1956         else if ((rev >= 11) && (rev <= 12))
1957                 filename = "ucode11";
1958         else if (rev >= 13)
1959                 filename = "ucode13";
1960         else
1961                 goto err_no_ucode;
1962         err = b43_do_request_fw(ctx, filename, &fw->ucode);
1963         if (err)
1964                 goto err_load;
1965
1966         /* Get PCM code */
1967         if ((rev >= 5) && (rev <= 10))
1968                 filename = "pcm5";
1969         else if (rev >= 11)
1970                 filename = NULL;
1971         else
1972                 goto err_no_pcm;
1973         fw->pcm_request_failed = 0;
1974         err = b43_do_request_fw(ctx, filename, &fw->pcm);
1975         if (err == -ENOENT) {
1976                 /* We did not find a PCM file? Not fatal, but
1977                  * core rev <= 10 must do without hwcrypto then. */
1978                 fw->pcm_request_failed = 1;
1979         } else if (err)
1980                 goto err_load;
1981
1982         /* Get initvals */
1983         switch (dev->phy.type) {
1984         case B43_PHYTYPE_A:
1985                 if ((rev >= 5) && (rev <= 10)) {
1986                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
1987                                 filename = "a0g1initvals5";
1988                         else
1989                                 filename = "a0g0initvals5";
1990                 } else
1991                         goto err_no_initvals;
1992                 break;
1993         case B43_PHYTYPE_G:
1994                 if ((rev >= 5) && (rev <= 10))
1995                         filename = "b0g0initvals5";
1996                 else if (rev >= 13)
1997                         filename = "b0g0initvals13";
1998                 else
1999                         goto err_no_initvals;
2000                 break;
2001         case B43_PHYTYPE_N:
2002                 if ((rev >= 11) && (rev <= 12))
2003                         filename = "n0initvals11";
2004                 else
2005                         goto err_no_initvals;
2006                 break;
2007         default:
2008                 goto err_no_initvals;
2009         }
2010         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2011         if (err)
2012                 goto err_load;
2013
2014         /* Get bandswitch initvals */
2015         switch (dev->phy.type) {
2016         case B43_PHYTYPE_A:
2017                 if ((rev >= 5) && (rev <= 10)) {
2018                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2019                                 filename = "a0g1bsinitvals5";
2020                         else
2021                                 filename = "a0g0bsinitvals5";
2022                 } else if (rev >= 11)
2023                         filename = NULL;
2024                 else
2025                         goto err_no_initvals;
2026                 break;
2027         case B43_PHYTYPE_G:
2028                 if ((rev >= 5) && (rev <= 10))
2029                         filename = "b0g0bsinitvals5";
2030                 else if (rev >= 11)
2031                         filename = NULL;
2032                 else
2033                         goto err_no_initvals;
2034                 break;
2035         case B43_PHYTYPE_N:
2036                 if ((rev >= 11) && (rev <= 12))
2037                         filename = "n0bsinitvals11";
2038                 else
2039                         goto err_no_initvals;
2040                 break;
2041         default:
2042                 goto err_no_initvals;
2043         }
2044         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2045         if (err)
2046                 goto err_load;
2047
2048         return 0;
2049
2050 err_no_ucode:
2051         err = ctx->fatal_failure = -EOPNOTSUPP;
2052         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2053                "is required for your device (wl-core rev %u)\n", rev);
2054         goto error;
2055
2056 err_no_pcm:
2057         err = ctx->fatal_failure = -EOPNOTSUPP;
2058         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2059                "is required for your device (wl-core rev %u)\n", rev);
2060         goto error;
2061
2062 err_no_initvals:
2063         err = ctx->fatal_failure = -EOPNOTSUPP;
2064         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2065                "is required for your device (wl-core rev %u)\n", rev);
2066         goto error;
2067
2068 err_load:
2069         /* We failed to load this firmware image. The error message
2070          * already is in ctx->errors. Return and let our caller decide
2071          * what to do. */
2072         goto error;
2073
2074 error:
2075         b43_release_firmware(dev);
2076         return err;
2077 }
2078
2079 static int b43_request_firmware(struct b43_wldev *dev)
2080 {
2081         struct b43_request_fw_context *ctx;
2082         unsigned int i;
2083         int err;
2084         const char *errmsg;
2085
2086         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2087         if (!ctx)
2088                 return -ENOMEM;
2089         ctx->dev = dev;
2090
2091         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2092         err = b43_try_request_fw(ctx);
2093         if (!err)
2094                 goto out; /* Successfully loaded it. */
2095         err = ctx->fatal_failure;
2096         if (err)
2097                 goto out;
2098
2099         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2100         err = b43_try_request_fw(ctx);
2101         if (!err)
2102                 goto out; /* Successfully loaded it. */
2103         err = ctx->fatal_failure;
2104         if (err)
2105                 goto out;
2106
2107         /* Could not find a usable firmware. Print the errors. */
2108         for (i = 0; i < B43_NR_FWTYPES; i++) {
2109                 errmsg = ctx->errors[i];
2110                 if (strlen(errmsg))
2111                         b43err(dev->wl, errmsg);
2112         }
2113         b43_print_fw_helptext(dev->wl, 1);
2114         err = -ENOENT;
2115
2116 out:
2117         kfree(ctx);
2118         return err;
2119 }
2120
2121 static int b43_upload_microcode(struct b43_wldev *dev)
2122 {
2123         const size_t hdr_len = sizeof(struct b43_fw_header);
2124         const __be32 *data;
2125         unsigned int i, len;
2126         u16 fwrev, fwpatch, fwdate, fwtime;
2127         u32 tmp, macctl;
2128         int err = 0;
2129
2130         /* Jump the microcode PSM to offset 0 */
2131         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2132         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2133         macctl |= B43_MACCTL_PSM_JMP0;
2134         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2135         /* Zero out all microcode PSM registers and shared memory. */
2136         for (i = 0; i < 64; i++)
2137                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2138         for (i = 0; i < 4096; i += 2)
2139                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2140
2141         /* Upload Microcode. */
2142         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2143         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2144         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2145         for (i = 0; i < len; i++) {
2146                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2147                 udelay(10);
2148         }
2149
2150         if (dev->fw.pcm.data) {
2151                 /* Upload PCM data. */
2152                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2153                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2154                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2155                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2156                 /* No need for autoinc bit in SHM_HW */
2157                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2158                 for (i = 0; i < len; i++) {
2159                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2160                         udelay(10);
2161                 }
2162         }
2163
2164         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2165
2166         /* Start the microcode PSM */
2167         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2168         macctl &= ~B43_MACCTL_PSM_JMP0;
2169         macctl |= B43_MACCTL_PSM_RUN;
2170         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2171
2172         /* Wait for the microcode to load and respond */
2173         i = 0;
2174         while (1) {
2175                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2176                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2177                         break;
2178                 i++;
2179                 if (i >= 20) {
2180                         b43err(dev->wl, "Microcode not responding\n");
2181                         b43_print_fw_helptext(dev->wl, 1);
2182                         err = -ENODEV;
2183                         goto error;
2184                 }
2185                 msleep_interruptible(50);
2186                 if (signal_pending(current)) {
2187                         err = -EINTR;
2188                         goto error;
2189                 }
2190         }
2191         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2192
2193         /* Get and check the revisions. */
2194         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2195         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2196         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2197         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2198
2199         if (fwrev <= 0x128) {
2200                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2201                        "binary drivers older than version 4.x is unsupported. "
2202                        "You must upgrade your firmware files.\n");
2203                 b43_print_fw_helptext(dev->wl, 1);
2204                 err = -EOPNOTSUPP;
2205                 goto error;
2206         }
2207         dev->fw.rev = fwrev;
2208         dev->fw.patch = fwpatch;
2209         dev->fw.opensource = (fwdate == 0xFFFF);
2210
2211         /* Default to use-all-queues. */
2212         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2213         dev->qos_enabled = !!modparam_qos;
2214         /* Default to firmware/hardware crypto acceleration. */
2215         dev->hwcrypto_enabled = 1;
2216
2217         if (dev->fw.opensource) {
2218                 u16 fwcapa;
2219
2220                 /* Patchlevel info is encoded in the "time" field. */
2221                 dev->fw.patch = fwtime;
2222                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2223                         dev->fw.rev, dev->fw.patch);
2224
2225                 fwcapa = b43_fwcapa_read(dev);
2226                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2227                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2228                         /* Disable hardware crypto and fall back to software crypto. */
2229                         dev->hwcrypto_enabled = 0;
2230                 }
2231                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2232                         b43info(dev->wl, "QoS not supported by firmware\n");
2233                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2234                          * ieee80211_unregister to make sure the networking core can
2235                          * properly free possible resources. */
2236                         dev->wl->hw->queues = 1;
2237                         dev->qos_enabled = 0;
2238                 }
2239         } else {
2240                 b43info(dev->wl, "Loading firmware version %u.%u "
2241                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2242                         fwrev, fwpatch,
2243                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2244                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2245                 if (dev->fw.pcm_request_failed) {
2246                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2247                                 "Hardware accelerated cryptography is disabled.\n");
2248                         b43_print_fw_helptext(dev->wl, 0);
2249                 }
2250         }
2251
2252         if (b43_is_old_txhdr_format(dev)) {
2253                 /* We're over the deadline, but we keep support for old fw
2254                  * until it turns out to be in major conflict with something new. */
2255                 b43warn(dev->wl, "You are using an old firmware image. "
2256                         "Support for old firmware will be removed soon "
2257                         "(official deadline was July 2008).\n");
2258                 b43_print_fw_helptext(dev->wl, 0);
2259         }
2260
2261         return 0;
2262
2263 error:
2264         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2265         macctl &= ~B43_MACCTL_PSM_RUN;
2266         macctl |= B43_MACCTL_PSM_JMP0;
2267         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2268
2269         return err;
2270 }
2271
2272 static int b43_write_initvals(struct b43_wldev *dev,
2273                               const struct b43_iv *ivals,
2274                               size_t count,
2275                               size_t array_size)
2276 {
2277         const struct b43_iv *iv;
2278         u16 offset;
2279         size_t i;
2280         bool bit32;
2281
2282         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2283         iv = ivals;
2284         for (i = 0; i < count; i++) {
2285                 if (array_size < sizeof(iv->offset_size))
2286                         goto err_format;
2287                 array_size -= sizeof(iv->offset_size);
2288                 offset = be16_to_cpu(iv->offset_size);
2289                 bit32 = !!(offset & B43_IV_32BIT);
2290                 offset &= B43_IV_OFFSET_MASK;
2291                 if (offset >= 0x1000)
2292                         goto err_format;
2293                 if (bit32) {
2294                         u32 value;
2295
2296                         if (array_size < sizeof(iv->data.d32))
2297                                 goto err_format;
2298                         array_size -= sizeof(iv->data.d32);
2299
2300                         value = get_unaligned_be32(&iv->data.d32);
2301                         b43_write32(dev, offset, value);
2302
2303                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2304                                                         sizeof(__be16) +
2305                                                         sizeof(__be32));
2306                 } else {
2307                         u16 value;
2308
2309                         if (array_size < sizeof(iv->data.d16))
2310                                 goto err_format;
2311                         array_size -= sizeof(iv->data.d16);
2312
2313                         value = be16_to_cpu(iv->data.d16);
2314                         b43_write16(dev, offset, value);
2315
2316                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2317                                                         sizeof(__be16) +
2318                                                         sizeof(__be16));
2319                 }
2320         }
2321         if (array_size)
2322                 goto err_format;
2323
2324         return 0;
2325
2326 err_format:
2327         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2328         b43_print_fw_helptext(dev->wl, 1);
2329
2330         return -EPROTO;
2331 }
2332
2333 static int b43_upload_initvals(struct b43_wldev *dev)
2334 {
2335         const size_t hdr_len = sizeof(struct b43_fw_header);
2336         const struct b43_fw_header *hdr;
2337         struct b43_firmware *fw = &dev->fw;
2338         const struct b43_iv *ivals;
2339         size_t count;
2340         int err;
2341
2342         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2343         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2344         count = be32_to_cpu(hdr->size);
2345         err = b43_write_initvals(dev, ivals, count,
2346                                  fw->initvals.data->size - hdr_len);
2347         if (err)
2348                 goto out;
2349         if (fw->initvals_band.data) {
2350                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2351                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2352                 count = be32_to_cpu(hdr->size);
2353                 err = b43_write_initvals(dev, ivals, count,
2354                                          fw->initvals_band.data->size - hdr_len);
2355                 if (err)
2356                         goto out;
2357         }
2358 out:
2359
2360         return err;
2361 }
2362
2363 /* Initialize the GPIOs
2364  * http://bcm-specs.sipsolutions.net/GPIO
2365  */
2366 static int b43_gpio_init(struct b43_wldev *dev)
2367 {
2368         struct ssb_bus *bus = dev->dev->bus;
2369         struct ssb_device *gpiodev, *pcidev = NULL;
2370         u32 mask, set;
2371
2372         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2373                     & ~B43_MACCTL_GPOUTSMSK);
2374
2375         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2376                     | 0x000F);
2377
2378         mask = 0x0000001F;
2379         set = 0x0000000F;
2380         if (dev->dev->bus->chip_id == 0x4301) {
2381                 mask |= 0x0060;
2382                 set |= 0x0060;
2383         }
2384         if (0 /* FIXME: conditional unknown */ ) {
2385                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2386                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2387                             | 0x0100);
2388                 mask |= 0x0180;
2389                 set |= 0x0180;
2390         }
2391         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2392                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2393                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2394                             | 0x0200);
2395                 mask |= 0x0200;
2396                 set |= 0x0200;
2397         }
2398         if (dev->dev->id.revision >= 2)
2399                 mask |= 0x0010; /* FIXME: This is redundant. */
2400
2401 #ifdef CONFIG_SSB_DRIVER_PCICORE
2402         pcidev = bus->pcicore.dev;
2403 #endif
2404         gpiodev = bus->chipco.dev ? : pcidev;
2405         if (!gpiodev)
2406                 return 0;
2407         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2408                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2409                      & mask) | set);
2410
2411         return 0;
2412 }
2413
2414 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2415 static void b43_gpio_cleanup(struct b43_wldev *dev)
2416 {
2417         struct ssb_bus *bus = dev->dev->bus;
2418         struct ssb_device *gpiodev, *pcidev = NULL;
2419
2420 #ifdef CONFIG_SSB_DRIVER_PCICORE
2421         pcidev = bus->pcicore.dev;
2422 #endif
2423         gpiodev = bus->chipco.dev ? : pcidev;
2424         if (!gpiodev)
2425                 return;
2426         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2427 }
2428
2429 /* http://bcm-specs.sipsolutions.net/EnableMac */
2430 void b43_mac_enable(struct b43_wldev *dev)
2431 {
2432         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2433                 u16 fwstate;
2434
2435                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2436                                          B43_SHM_SH_UCODESTAT);
2437                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2438                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2439                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2440                                "should be suspended, but current state is %u\n",
2441                                fwstate);
2442                 }
2443         }
2444
2445         dev->mac_suspended--;
2446         B43_WARN_ON(dev->mac_suspended < 0);
2447         if (dev->mac_suspended == 0) {
2448                 b43_write32(dev, B43_MMIO_MACCTL,
2449                             b43_read32(dev, B43_MMIO_MACCTL)
2450                             | B43_MACCTL_ENABLED);
2451                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2452                             B43_IRQ_MAC_SUSPENDED);
2453                 /* Commit writes */
2454                 b43_read32(dev, B43_MMIO_MACCTL);
2455                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2456                 b43_power_saving_ctl_bits(dev, 0);
2457         }
2458 }
2459
2460 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2461 void b43_mac_suspend(struct b43_wldev *dev)
2462 {
2463         int i;
2464         u32 tmp;
2465
2466         might_sleep();
2467         B43_WARN_ON(dev->mac_suspended < 0);
2468
2469         if (dev->mac_suspended == 0) {
2470                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2471                 b43_write32(dev, B43_MMIO_MACCTL,
2472                             b43_read32(dev, B43_MMIO_MACCTL)
2473                             & ~B43_MACCTL_ENABLED);
2474                 /* force pci to flush the write */
2475                 b43_read32(dev, B43_MMIO_MACCTL);
2476                 for (i = 35; i; i--) {
2477                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2478                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2479                                 goto out;
2480                         udelay(10);
2481                 }
2482                 /* Hm, it seems this will take some time. Use msleep(). */
2483                 for (i = 40; i; i--) {
2484                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2485                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2486                                 goto out;
2487                         msleep(1);
2488                 }
2489                 b43err(dev->wl, "MAC suspend failed\n");
2490         }
2491 out:
2492         dev->mac_suspended++;
2493 }
2494
2495 static void b43_adjust_opmode(struct b43_wldev *dev)
2496 {
2497         struct b43_wl *wl = dev->wl;
2498         u32 ctl;
2499         u16 cfp_pretbtt;
2500
2501         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2502         /* Reset status to STA infrastructure mode. */
2503         ctl &= ~B43_MACCTL_AP;
2504         ctl &= ~B43_MACCTL_KEEP_CTL;
2505         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2506         ctl &= ~B43_MACCTL_KEEP_BAD;
2507         ctl &= ~B43_MACCTL_PROMISC;
2508         ctl &= ~B43_MACCTL_BEACPROMISC;
2509         ctl |= B43_MACCTL_INFRA;
2510
2511         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2512             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2513                 ctl |= B43_MACCTL_AP;
2514         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2515                 ctl &= ~B43_MACCTL_INFRA;
2516
2517         if (wl->filter_flags & FIF_CONTROL)
2518                 ctl |= B43_MACCTL_KEEP_CTL;
2519         if (wl->filter_flags & FIF_FCSFAIL)
2520                 ctl |= B43_MACCTL_KEEP_BAD;
2521         if (wl->filter_flags & FIF_PLCPFAIL)
2522                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2523         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2524                 ctl |= B43_MACCTL_PROMISC;
2525         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2526                 ctl |= B43_MACCTL_BEACPROMISC;
2527
2528         /* Workaround: On old hardware the HW-MAC-address-filter
2529          * doesn't work properly, so always run promisc in filter
2530          * it in software. */
2531         if (dev->dev->id.revision <= 4)
2532                 ctl |= B43_MACCTL_PROMISC;
2533
2534         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2535
2536         cfp_pretbtt = 2;
2537         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2538                 if (dev->dev->bus->chip_id == 0x4306 &&
2539                     dev->dev->bus->chip_rev == 3)
2540                         cfp_pretbtt = 100;
2541                 else
2542                         cfp_pretbtt = 50;
2543         }
2544         b43_write16(dev, 0x612, cfp_pretbtt);
2545 }
2546
2547 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2548 {
2549         u16 offset;
2550
2551         if (is_ofdm) {
2552                 offset = 0x480;
2553                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2554         } else {
2555                 offset = 0x4C0;
2556                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2557         }
2558         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2559                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2560 }
2561
2562 static void b43_rate_memory_init(struct b43_wldev *dev)
2563 {
2564         switch (dev->phy.type) {
2565         case B43_PHYTYPE_A:
2566         case B43_PHYTYPE_G:
2567         case B43_PHYTYPE_N:
2568                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2569                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2570                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2571                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2572                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2573                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2574                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2575                 if (dev->phy.type == B43_PHYTYPE_A)
2576                         break;
2577                 /* fallthrough */
2578         case B43_PHYTYPE_B:
2579                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2580                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2581                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2582                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2583                 break;
2584         default:
2585                 B43_WARN_ON(1);
2586         }
2587 }
2588
2589 /* Set the default values for the PHY TX Control Words. */
2590 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2591 {
2592         u16 ctl = 0;
2593
2594         ctl |= B43_TXH_PHY_ENC_CCK;
2595         ctl |= B43_TXH_PHY_ANT01AUTO;
2596         ctl |= B43_TXH_PHY_TXPWR;
2597
2598         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2599         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2600         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2601 }
2602
2603 /* Set the TX-Antenna for management frames sent by firmware. */
2604 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2605 {
2606         u16 ant;
2607         u16 tmp;
2608
2609         ant = b43_antenna_to_phyctl(antenna);
2610
2611         /* For ACK/CTS */
2612         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2613         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2614         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2615         /* For Probe Resposes */
2616         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2617         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2618         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2619 }
2620
2621 /* This is the opposite of b43_chip_init() */
2622 static void b43_chip_exit(struct b43_wldev *dev)
2623 {
2624         b43_phy_exit(dev);
2625         b43_gpio_cleanup(dev);
2626         /* firmware is released later */
2627 }
2628
2629 /* Initialize the chip
2630  * http://bcm-specs.sipsolutions.net/ChipInit
2631  */
2632 static int b43_chip_init(struct b43_wldev *dev)
2633 {
2634         struct b43_phy *phy = &dev->phy;
2635         int err;
2636         u32 value32, macctl;
2637         u16 value16;
2638
2639         /* Initialize the MAC control */
2640         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2641         if (dev->phy.gmode)
2642                 macctl |= B43_MACCTL_GMODE;
2643         macctl |= B43_MACCTL_INFRA;
2644         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2645
2646         err = b43_request_firmware(dev);
2647         if (err)
2648                 goto out;
2649         err = b43_upload_microcode(dev);
2650         if (err)
2651                 goto out;       /* firmware is released later */
2652
2653         err = b43_gpio_init(dev);
2654         if (err)
2655                 goto out;       /* firmware is released later */
2656
2657         err = b43_upload_initvals(dev);
2658         if (err)
2659                 goto err_gpio_clean;
2660
2661         /* Turn the Analog on and initialize the PHY. */
2662         phy->ops->switch_analog(dev, 1);
2663         err = b43_phy_init(dev);
2664         if (err)
2665                 goto err_gpio_clean;
2666
2667         /* Disable Interference Mitigation. */
2668         if (phy->ops->interf_mitigation)
2669                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2670
2671         /* Select the antennae */
2672         if (phy->ops->set_rx_antenna)
2673                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2674         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2675
2676         if (phy->type == B43_PHYTYPE_B) {
2677                 value16 = b43_read16(dev, 0x005E);
2678                 value16 |= 0x0004;
2679                 b43_write16(dev, 0x005E, value16);
2680         }
2681         b43_write32(dev, 0x0100, 0x01000000);
2682         if (dev->dev->id.revision < 5)
2683                 b43_write32(dev, 0x010C, 0x01000000);
2684
2685         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2686                     & ~B43_MACCTL_INFRA);
2687         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2688                     | B43_MACCTL_INFRA);
2689
2690         /* Probe Response Timeout value */
2691         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2692         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2693
2694         /* Initially set the wireless operation mode. */
2695         b43_adjust_opmode(dev);
2696
2697         if (dev->dev->id.revision < 3) {
2698                 b43_write16(dev, 0x060E, 0x0000);
2699                 b43_write16(dev, 0x0610, 0x8000);
2700                 b43_write16(dev, 0x0604, 0x0000);
2701                 b43_write16(dev, 0x0606, 0x0200);
2702         } else {
2703                 b43_write32(dev, 0x0188, 0x80000000);
2704                 b43_write32(dev, 0x018C, 0x02000000);
2705         }
2706         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2707         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2708         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2709         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2710         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2711         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2712         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2713
2714         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2715         value32 |= 0x00100000;
2716         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2717
2718         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2719                     dev->dev->bus->chipco.fast_pwrup_delay);
2720
2721         err = 0;
2722         b43dbg(dev->wl, "Chip initialized\n");
2723 out:
2724         return err;
2725
2726 err_gpio_clean:
2727         b43_gpio_cleanup(dev);
2728         return err;
2729 }
2730
2731 static void b43_periodic_every60sec(struct b43_wldev *dev)
2732 {
2733         const struct b43_phy_operations *ops = dev->phy.ops;
2734
2735         if (ops->pwork_60sec)
2736                 ops->pwork_60sec(dev);
2737
2738         /* Force check the TX power emission now. */
2739         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2740 }
2741
2742 static void b43_periodic_every30sec(struct b43_wldev *dev)
2743 {
2744         /* Update device statistics. */
2745         b43_calculate_link_quality(dev);
2746 }
2747
2748 static void b43_periodic_every15sec(struct b43_wldev *dev)
2749 {
2750         struct b43_phy *phy = &dev->phy;
2751         u16 wdr;
2752
2753         if (dev->fw.opensource) {
2754                 /* Check if the firmware is still alive.
2755                  * It will reset the watchdog counter to 0 in its idle loop. */
2756                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2757                 if (unlikely(wdr)) {
2758                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2759                         b43_controller_restart(dev, "Firmware watchdog");
2760                         return;
2761                 } else {
2762                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2763                                         B43_WATCHDOG_REG, 1);
2764                 }
2765         }
2766
2767         if (phy->ops->pwork_15sec)
2768                 phy->ops->pwork_15sec(dev);
2769
2770         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2771         wmb();
2772 }
2773
2774 static void do_periodic_work(struct b43_wldev *dev)
2775 {
2776         unsigned int state;
2777
2778         state = dev->periodic_state;
2779         if (state % 4 == 0)
2780                 b43_periodic_every60sec(dev);
2781         if (state % 2 == 0)
2782                 b43_periodic_every30sec(dev);
2783         b43_periodic_every15sec(dev);
2784 }
2785
2786 /* Periodic work locking policy:
2787  *      The whole periodic work handler is protected by
2788  *      wl->mutex. If another lock is needed somewhere in the
2789  *      pwork callchain, it's aquired in-place, where it's needed.
2790  */
2791 static void b43_periodic_work_handler(struct work_struct *work)
2792 {
2793         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2794                                              periodic_work.work);
2795         struct b43_wl *wl = dev->wl;
2796         unsigned long delay;
2797
2798         mutex_lock(&wl->mutex);
2799
2800         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2801                 goto out;
2802         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2803                 goto out_requeue;
2804
2805         do_periodic_work(dev);
2806
2807         dev->periodic_state++;
2808 out_requeue:
2809         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2810                 delay = msecs_to_jiffies(50);
2811         else
2812                 delay = round_jiffies_relative(HZ * 15);
2813         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2814 out:
2815         mutex_unlock(&wl->mutex);
2816 }
2817
2818 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2819 {
2820         struct delayed_work *work = &dev->periodic_work;
2821
2822         dev->periodic_state = 0;
2823         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2824         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2825 }
2826
2827 /* Check if communication with the device works correctly. */
2828 static int b43_validate_chipaccess(struct b43_wldev *dev)
2829 {
2830         u32 v, backup0, backup4;
2831
2832         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2833         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
2834
2835         /* Check for read/write and endianness problems. */
2836         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2837         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2838                 goto error;
2839         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2840         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2841                 goto error;
2842
2843         /* Check if unaligned 32bit SHM_SHARED access works properly.
2844          * However, don't bail out on failure, because it's noncritical. */
2845         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
2846         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
2847         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
2848         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
2849         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
2850                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
2851         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
2852         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
2853             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
2854             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
2855             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
2856                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
2857
2858         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
2859         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
2860
2861         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2862                 /* The 32bit register shadows the two 16bit registers
2863                  * with update sideeffects. Validate this. */
2864                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2865                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2866                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2867                         goto error;
2868                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2869                         goto error;
2870         }
2871         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2872
2873         v = b43_read32(dev, B43_MMIO_MACCTL);
2874         v |= B43_MACCTL_GMODE;
2875         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2876                 goto error;
2877
2878         return 0;
2879 error:
2880         b43err(dev->wl, "Failed to validate the chipaccess\n");
2881         return -ENODEV;
2882 }
2883
2884 static void b43_security_init(struct b43_wldev *dev)
2885 {
2886         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2887         /* KTP is a word address, but we address SHM bytewise.
2888          * So multiply by two.
2889          */
2890         dev->ktp *= 2;
2891         /* Number of RCMTA address slots */
2892         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
2893         /* Clear the key memory. */
2894         b43_clear_keys(dev);
2895 }
2896
2897 #ifdef CONFIG_B43_HWRNG
2898 static int b43_rng_read(struct hwrng *rng, u32 *data)
2899 {
2900         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2901         unsigned long flags;
2902
2903         /* Don't take wl->mutex here, as it could deadlock with
2904          * hwrng internal locking. It's not needed to take
2905          * wl->mutex here, anyway. */
2906
2907         spin_lock_irqsave(&wl->irq_lock, flags);
2908         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2909         spin_unlock_irqrestore(&wl->irq_lock, flags);
2910
2911         return (sizeof(u16));
2912 }
2913 #endif /* CONFIG_B43_HWRNG */
2914
2915 static void b43_rng_exit(struct b43_wl *wl)
2916 {
2917 #ifdef CONFIG_B43_HWRNG
2918         if (wl->rng_initialized)
2919                 hwrng_unregister(&wl->rng);
2920 #endif /* CONFIG_B43_HWRNG */
2921 }
2922
2923 static int b43_rng_init(struct b43_wl *wl)
2924 {
2925         int err = 0;
2926
2927 #ifdef CONFIG_B43_HWRNG
2928         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2929                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2930         wl->rng.name = wl->rng_name;
2931         wl->rng.data_read = b43_rng_read;
2932         wl->rng.priv = (unsigned long)wl;
2933         wl->rng_initialized = 1;
2934         err = hwrng_register(&wl->rng);
2935         if (err) {
2936                 wl->rng_initialized = 0;
2937                 b43err(wl, "Failed to register the random "
2938                        "number generator (%d)\n", err);
2939         }
2940 #endif /* CONFIG_B43_HWRNG */
2941
2942         return err;
2943 }
2944
2945 static int b43_op_tx(struct ieee80211_hw *hw,
2946                      struct sk_buff *skb)
2947 {
2948         struct b43_wl *wl = hw_to_b43_wl(hw);
2949         struct b43_wldev *dev = wl->current_dev;
2950         unsigned long flags;
2951         int err;
2952
2953         if (unlikely(skb->len < 2 + 2 + 6)) {
2954                 /* Too short, this can't be a valid frame. */
2955                 goto drop_packet;
2956         }
2957         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2958         if (unlikely(!dev))
2959                 goto drop_packet;
2960
2961         /* Transmissions on seperate queues can run concurrently. */
2962         read_lock_irqsave(&wl->tx_lock, flags);
2963
2964         err = -ENODEV;
2965         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2966                 if (b43_using_pio_transfers(dev))
2967                         err = b43_pio_tx(dev, skb);
2968                 else
2969                         err = b43_dma_tx(dev, skb);
2970         }
2971
2972         read_unlock_irqrestore(&wl->tx_lock, flags);
2973
2974         if (unlikely(err))
2975                 goto drop_packet;
2976         return NETDEV_TX_OK;
2977
2978 drop_packet:
2979         /* We can not transmit this packet. Drop it. */
2980         dev_kfree_skb_any(skb);
2981         return NETDEV_TX_OK;
2982 }
2983
2984 /* Locking: wl->irq_lock */
2985 static void b43_qos_params_upload(struct b43_wldev *dev,
2986                                   const struct ieee80211_tx_queue_params *p,
2987                                   u16 shm_offset)
2988 {
2989         u16 params[B43_NR_QOSPARAMS];
2990         int bslots, tmp;
2991         unsigned int i;
2992
2993         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
2994
2995         memset(&params, 0, sizeof(params));
2996
2997         params[B43_QOSPARAM_TXOP] = p->txop * 32;
2998         params[B43_QOSPARAM_CWMIN] = p->cw_min;
2999         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3000         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3001         params[B43_QOSPARAM_AIFS] = p->aifs;
3002         params[B43_QOSPARAM_BSLOTS] = bslots;
3003         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3004
3005         for (i = 0; i < ARRAY_SIZE(params); i++) {
3006                 if (i == B43_QOSPARAM_STATUS) {
3007                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3008                                              shm_offset + (i * 2));
3009                         /* Mark the parameters as updated. */
3010                         tmp |= 0x100;
3011                         b43_shm_write16(dev, B43_SHM_SHARED,
3012                                         shm_offset + (i * 2),
3013                                         tmp);
3014                 } else {
3015                         b43_shm_write16(dev, B43_SHM_SHARED,
3016                                         shm_offset + (i * 2),
3017                                         params[i]);
3018                 }
3019         }
3020 }
3021
3022 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3023 static const u16 b43_qos_shm_offsets[] = {
3024         /* [mac80211-queue-nr] = SHM_OFFSET, */
3025         [0] = B43_QOS_VOICE,
3026         [1] = B43_QOS_VIDEO,
3027         [2] = B43_QOS_BESTEFFORT,
3028         [3] = B43_QOS_BACKGROUND,
3029 };
3030
3031 /* Update all QOS parameters in hardware. */
3032 static void b43_qos_upload_all(struct b43_wldev *dev)
3033 {
3034         struct b43_wl *wl = dev->wl;
3035         struct b43_qos_params *params;
3036         unsigned int i;
3037
3038         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3039                      ARRAY_SIZE(wl->qos_params));
3040
3041         b43_mac_suspend(dev);
3042         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3043                 params = &(wl->qos_params[i]);
3044                 b43_qos_params_upload(dev, &(params->p),
3045                                       b43_qos_shm_offsets[i]);
3046         }
3047         b43_mac_enable(dev);
3048 }
3049
3050 static void b43_qos_clear(struct b43_wl *wl)
3051 {
3052         struct b43_qos_params *params;
3053         unsigned int i;
3054
3055         /* Initialize QoS parameters to sane defaults. */
3056
3057         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3058                      ARRAY_SIZE(wl->qos_params));
3059
3060         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3061                 params = &(wl->qos_params[i]);
3062
3063                 switch (b43_qos_shm_offsets[i]) {
3064                 case B43_QOS_VOICE:
3065                         params->p.txop = 0;
3066                         params->p.aifs = 2;
3067                         params->p.cw_min = 0x0001;
3068                         params->p.cw_max = 0x0001;
3069                         break;
3070                 case B43_QOS_VIDEO:
3071                         params->p.txop = 0;
3072                         params->p.aifs = 2;
3073                         params->p.cw_min = 0x0001;
3074                         params->p.cw_max = 0x0001;
3075                         break;
3076                 case B43_QOS_BESTEFFORT:
3077                         params->p.txop = 0;
3078                         params->p.aifs = 3;
3079                         params->p.cw_min = 0x0001;
3080                         params->p.cw_max = 0x03FF;
3081                         break;
3082                 case B43_QOS_BACKGROUND:
3083                         params->p.txop = 0;
3084                         params->p.aifs = 7;
3085                         params->p.cw_min = 0x0001;
3086                         params->p.cw_max = 0x03FF;
3087                         break;
3088                 default:
3089                         B43_WARN_ON(1);
3090                 }
3091         }
3092 }
3093
3094 /* Initialize the core's QOS capabilities */
3095 static void b43_qos_init(struct b43_wldev *dev)
3096 {
3097         /* Upload the current QOS parameters. */
3098         b43_qos_upload_all(dev);
3099
3100         /* Enable QOS support. */
3101         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3102         b43_write16(dev, B43_MMIO_IFSCTL,
3103                     b43_read16(dev, B43_MMIO_IFSCTL)
3104                     | B43_MMIO_IFSCTL_USE_EDCF);
3105 }
3106
3107 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3108                           const struct ieee80211_tx_queue_params *params)
3109 {
3110         struct b43_wl *wl = hw_to_b43_wl(hw);
3111         struct b43_wldev *dev;
3112         unsigned int queue = (unsigned int)_queue;
3113         int err = -ENODEV;
3114
3115         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3116                 /* Queue not available or don't support setting
3117                  * params on this queue. Return success to not
3118                  * confuse mac80211. */
3119                 return 0;
3120         }
3121         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3122                      ARRAY_SIZE(wl->qos_params));
3123
3124         mutex_lock(&wl->mutex);
3125         dev = wl->current_dev;
3126         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3127                 goto out_unlock;
3128
3129         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3130         b43_mac_suspend(dev);
3131         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3132                               b43_qos_shm_offsets[queue]);
3133         b43_mac_enable(dev);
3134         err = 0;
3135
3136 out_unlock:
3137         mutex_unlock(&wl->mutex);
3138
3139         return err;
3140 }
3141
3142 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3143                                struct ieee80211_tx_queue_stats *stats)
3144 {
3145         struct b43_wl *wl = hw_to_b43_wl(hw);
3146         struct b43_wldev *dev = wl->current_dev;
3147         unsigned long flags;
3148         int err = -ENODEV;
3149
3150         if (!dev)
3151                 goto out;
3152         spin_lock_irqsave(&wl->irq_lock, flags);
3153         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3154                 if (b43_using_pio_transfers(dev))
3155                         b43_pio_get_tx_stats(dev, stats);
3156                 else
3157                         b43_dma_get_tx_stats(dev, stats);
3158                 err = 0;
3159         }
3160         spin_unlock_irqrestore(&wl->irq_lock, flags);
3161 out:
3162         return err;
3163 }
3164
3165 static int b43_op_get_stats(struct ieee80211_hw *hw,
3166                             struct ieee80211_low_level_stats *stats)
3167 {
3168         struct b43_wl *wl = hw_to_b43_wl(hw);
3169         unsigned long flags;
3170
3171         spin_lock_irqsave(&wl->irq_lock, flags);
3172         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3173         spin_unlock_irqrestore(&wl->irq_lock, flags);
3174
3175         return 0;
3176 }
3177
3178 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3179 {
3180         struct b43_wl *wl = hw_to_b43_wl(hw);
3181         struct b43_wldev *dev;
3182         u64 tsf;
3183
3184         mutex_lock(&wl->mutex);
3185         spin_lock_irq(&wl->irq_lock);
3186         dev = wl->current_dev;
3187
3188         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3189                 b43_tsf_read(dev, &tsf);
3190         else
3191                 tsf = 0;
3192
3193         spin_unlock_irq(&wl->irq_lock);
3194         mutex_unlock(&wl->mutex);
3195
3196         return tsf;
3197 }
3198
3199 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3200 {
3201         struct b43_wl *wl = hw_to_b43_wl(hw);
3202         struct b43_wldev *dev;
3203
3204         mutex_lock(&wl->mutex);
3205         spin_lock_irq(&wl->irq_lock);
3206         dev = wl->current_dev;
3207
3208         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3209                 b43_tsf_write(dev, tsf);
3210
3211         spin_unlock_irq(&wl->irq_lock);
3212         mutex_unlock(&wl->mutex);
3213 }
3214
3215 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3216 {
3217         struct ssb_device *sdev = dev->dev;
3218         u32 tmslow;
3219
3220         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3221         tmslow &= ~B43_TMSLOW_GMODE;
3222         tmslow |= B43_TMSLOW_PHYRESET;
3223         tmslow |= SSB_TMSLOW_FGC;
3224         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3225         msleep(1);
3226
3227         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3228         tmslow &= ~SSB_TMSLOW_FGC;
3229         tmslow |= B43_TMSLOW_PHYRESET;
3230         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3231         msleep(1);
3232 }
3233
3234 static const char *band_to_string(enum ieee80211_band band)
3235 {
3236         switch (band) {
3237         case IEEE80211_BAND_5GHZ:
3238                 return "5";
3239         case IEEE80211_BAND_2GHZ:
3240                 return "2.4";
3241         default:
3242                 break;
3243         }
3244         B43_WARN_ON(1);
3245         return "";
3246 }
3247
3248 /* Expects wl->mutex locked */
3249 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3250 {
3251         struct b43_wldev *up_dev = NULL;
3252         struct b43_wldev *down_dev;
3253         struct b43_wldev *d;
3254         int err;
3255         bool uninitialized_var(gmode);
3256         int prev_status;
3257
3258         /* Find a device and PHY which supports the band. */
3259         list_for_each_entry(d, &wl->devlist, list) {
3260                 switch (chan->band) {
3261                 case IEEE80211_BAND_5GHZ:
3262                         if (d->phy.supports_5ghz) {
3263                                 up_dev = d;
3264                                 gmode = 0;
3265                         }
3266                         break;
3267                 case IEEE80211_BAND_2GHZ:
3268                         if (d->phy.supports_2ghz) {
3269                                 up_dev = d;
3270                                 gmode = 1;
3271                         }
3272                         break;
3273                 default:
3274                         B43_WARN_ON(1);
3275                         return -EINVAL;
3276                 }
3277                 if (up_dev)
3278                         break;
3279         }
3280         if (!up_dev) {
3281                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3282                        band_to_string(chan->band));
3283                 return -ENODEV;
3284         }
3285         if ((up_dev == wl->current_dev) &&
3286             (!!wl->current_dev->phy.gmode == !!gmode)) {
3287                 /* This device is already running. */
3288                 return 0;
3289         }
3290         b43dbg(wl, "Switching to %s-GHz band\n",
3291                band_to_string(chan->band));
3292         down_dev = wl->current_dev;
3293
3294         prev_status = b43_status(down_dev);
3295         /* Shutdown the currently running core. */
3296         if (prev_status >= B43_STAT_STARTED)
3297                 b43_wireless_core_stop(down_dev);
3298         if (prev_status >= B43_STAT_INITIALIZED)
3299                 b43_wireless_core_exit(down_dev);
3300
3301         if (down_dev != up_dev) {
3302                 /* We switch to a different core, so we put PHY into
3303                  * RESET on the old core. */
3304                 b43_put_phy_into_reset(down_dev);
3305         }
3306
3307         /* Now start the new core. */
3308         up_dev->phy.gmode = gmode;
3309         if (prev_status >= B43_STAT_INITIALIZED) {
3310                 err = b43_wireless_core_init(up_dev);
3311                 if (err) {
3312                         b43err(wl, "Fatal: Could not initialize device for "
3313                                "selected %s-GHz band\n",
3314                                band_to_string(chan->band));
3315                         goto init_failure;
3316                 }
3317         }
3318         if (prev_status >= B43_STAT_STARTED) {
3319                 err = b43_wireless_core_start(up_dev);
3320                 if (err) {
3321                         b43err(wl, "Fatal: Coult not start device for "
3322                                "selected %s-GHz band\n",
3323                                band_to_string(chan->band));
3324                         b43_wireless_core_exit(up_dev);
3325                         goto init_failure;
3326                 }
3327         }
3328         B43_WARN_ON(b43_status(up_dev) != prev_status);
3329
3330         wl->current_dev = up_dev;
3331
3332         return 0;
3333 init_failure:
3334         /* Whoops, failed to init the new core. No core is operating now. */
3335         wl->current_dev = NULL;
3336         return err;
3337 }
3338
3339 /* Write the short and long frame retry limit values. */
3340 static void b43_set_retry_limits(struct b43_wldev *dev,
3341                                  unsigned int short_retry,
3342                                  unsigned int long_retry)
3343 {
3344         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3345          * the chip-internal counter. */
3346         short_retry = min(short_retry, (unsigned int)0xF);
3347         long_retry = min(long_retry, (unsigned int)0xF);
3348
3349         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3350                         short_retry);
3351         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3352                         long_retry);
3353 }
3354
3355 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3356 {
3357         struct b43_wl *wl = hw_to_b43_wl(hw);
3358         struct b43_wldev *dev;
3359         struct b43_phy *phy;
3360         struct ieee80211_conf *conf = &hw->conf;
3361         unsigned long flags;
3362         int antenna;
3363         int err = 0;
3364
3365         mutex_lock(&wl->mutex);
3366
3367         /* Switch the band (if necessary). This might change the active core. */
3368         err = b43_switch_band(wl, conf->channel);
3369         if (err)
3370                 goto out_unlock_mutex;
3371         dev = wl->current_dev;
3372         phy = &dev->phy;
3373
3374         b43_mac_suspend(dev);
3375
3376         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3377                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3378                                           conf->long_frame_max_tx_count);
3379         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3380         if (!changed)
3381                 goto out_mac_enable;
3382
3383         /* Switch to the requested channel.
3384          * The firmware takes care of races with the TX handler. */
3385         if (conf->channel->hw_value != phy->channel)
3386                 b43_switch_channel(dev, conf->channel->hw_value);
3387
3388         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3389
3390         /* Adjust the desired TX power level. */
3391         if (conf->power_level != 0) {
3392                 spin_lock_irqsave(&wl->irq_lock, flags);
3393                 if (conf->power_level != phy->desired_txpower) {
3394                         phy->desired_txpower = conf->power_level;
3395                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3396                                                    B43_TXPWR_IGNORE_TSSI);
3397                 }
3398                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3399         }
3400
3401         /* Antennas for RX and management frame TX. */
3402         antenna = B43_ANTENNA_DEFAULT;
3403         b43_mgmtframe_txantenna(dev, antenna);
3404         antenna = B43_ANTENNA_DEFAULT;
3405         if (phy->ops->set_rx_antenna)
3406                 phy->ops->set_rx_antenna(dev, antenna);
3407
3408         if (wl->radio_enabled != phy->radio_on) {
3409                 if (wl->radio_enabled) {
3410                         b43_software_rfkill(dev, false);
3411                         b43info(dev->wl, "Radio turned on by software\n");
3412                         if (!dev->radio_hw_enable) {
3413                                 b43info(dev->wl, "The hardware RF-kill button "
3414                                         "still turns the radio physically off. "
3415                                         "Press the button to turn it on.\n");
3416                         }
3417                 } else {
3418                         b43_software_rfkill(dev, true);
3419                         b43info(dev->wl, "Radio turned off by software\n");
3420                 }
3421         }
3422
3423 out_mac_enable:
3424         b43_mac_enable(dev);
3425 out_unlock_mutex:
3426         mutex_unlock(&wl->mutex);
3427
3428         return err;
3429 }
3430
3431 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3432 {
3433         struct ieee80211_supported_band *sband =
3434                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3435         struct ieee80211_rate *rate;
3436         int i;
3437         u16 basic, direct, offset, basic_offset, rateptr;
3438
3439         for (i = 0; i < sband->n_bitrates; i++) {
3440                 rate = &sband->bitrates[i];
3441
3442                 if (b43_is_cck_rate(rate->hw_value)) {
3443                         direct = B43_SHM_SH_CCKDIRECT;
3444                         basic = B43_SHM_SH_CCKBASIC;
3445                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3446                         offset &= 0xF;
3447                 } else {
3448                         direct = B43_SHM_SH_OFDMDIRECT;
3449                         basic = B43_SHM_SH_OFDMBASIC;
3450                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3451                         offset &= 0xF;
3452                 }
3453
3454                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3455
3456                 if (b43_is_cck_rate(rate->hw_value)) {
3457                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3458                         basic_offset &= 0xF;
3459                 } else {
3460                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3461                         basic_offset &= 0xF;
3462                 }
3463
3464                 /*
3465                  * Get the pointer that we need to point to
3466                  * from the direct map
3467                  */
3468                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3469                                          direct + 2 * basic_offset);
3470                 /* and write it to the basic map */
3471                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3472                                 rateptr);
3473         }
3474 }
3475
3476 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3477                                     struct ieee80211_vif *vif,
3478                                     struct ieee80211_bss_conf *conf,
3479                                     u32 changed)
3480 {
3481         struct b43_wl *wl = hw_to_b43_wl(hw);
3482         struct b43_wldev *dev;
3483         unsigned long flags;
3484
3485         mutex_lock(&wl->mutex);
3486
3487         dev = wl->current_dev;
3488         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3489                 goto out_unlock_mutex;
3490
3491         B43_WARN_ON(wl->vif != vif);
3492
3493         spin_lock_irqsave(&wl->irq_lock, flags);
3494         if (changed & BSS_CHANGED_BSSID) {
3495                 if (conf->bssid)
3496                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3497                 else
3498                         memset(wl->bssid, 0, ETH_ALEN);
3499         }
3500
3501         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3502                 if (changed & BSS_CHANGED_BEACON &&
3503                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3504                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3505                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3506                         b43_update_templates(wl);
3507
3508                 if (changed & BSS_CHANGED_BSSID)
3509                         b43_write_mac_bssid_templates(dev);
3510         }
3511         spin_unlock_irqrestore(&wl->irq_lock, flags);
3512
3513         b43_mac_suspend(dev);
3514
3515         /* Update templates for AP/mesh mode. */
3516         if (changed & BSS_CHANGED_BEACON_INT &&
3517             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3518              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3519              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3520                 b43_set_beacon_int(dev, conf->beacon_int);
3521
3522         if (changed & BSS_CHANGED_BASIC_RATES)
3523                 b43_update_basic_rates(dev, conf->basic_rates);
3524
3525         if (changed & BSS_CHANGED_ERP_SLOT) {
3526                 if (conf->use_short_slot)
3527                         b43_short_slot_timing_enable(dev);
3528                 else
3529                         b43_short_slot_timing_disable(dev);
3530         }
3531
3532         b43_mac_enable(dev);
3533 out_unlock_mutex:
3534         mutex_unlock(&wl->mutex);
3535 }
3536
3537 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3538                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3539                           struct ieee80211_key_conf *key)
3540 {
3541         struct b43_wl *wl = hw_to_b43_wl(hw);
3542         struct b43_wldev *dev;
3543         u8 algorithm;
3544         u8 index;
3545         int err;
3546         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3547
3548         if (modparam_nohwcrypt)
3549                 return -ENOSPC; /* User disabled HW-crypto */
3550
3551         mutex_lock(&wl->mutex);
3552         spin_lock_irq(&wl->irq_lock);
3553         write_lock(&wl->tx_lock);
3554         /* Why do we need all this locking here?
3555          * mutex     -> Every config operation must take it.
3556          * irq_lock  -> We modify the dev->key array, which is accessed
3557          *              in the IRQ handlers.
3558          * tx_lock   -> We modify the dev->key array, which is accessed
3559          *              in the TX handler.
3560          */
3561
3562         dev = wl->current_dev;
3563         err = -ENODEV;
3564         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3565                 goto out_unlock;
3566
3567         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3568                 /* We don't have firmware for the crypto engine.
3569                  * Must use software-crypto. */
3570                 err = -EOPNOTSUPP;
3571                 goto out_unlock;
3572         }
3573
3574         err = -EINVAL;
3575         switch (key->alg) {
3576         case ALG_WEP:
3577                 if (key->keylen == WLAN_KEY_LEN_WEP40)
3578                         algorithm = B43_SEC_ALGO_WEP40;
3579                 else
3580                         algorithm = B43_SEC_ALGO_WEP104;
3581                 break;
3582         case ALG_TKIP:
3583                 algorithm = B43_SEC_ALGO_TKIP;
3584                 break;
3585         case ALG_CCMP:
3586                 algorithm = B43_SEC_ALGO_AES;
3587                 break;
3588         default:
3589                 B43_WARN_ON(1);
3590                 goto out_unlock;
3591         }
3592         index = (u8) (key->keyidx);
3593         if (index > 3)
3594                 goto out_unlock;
3595
3596         switch (cmd) {
3597         case SET_KEY:
3598                 if (algorithm == B43_SEC_ALGO_TKIP) {
3599                         /* FIXME: No TKIP hardware encryption for now. */
3600                         err = -EOPNOTSUPP;
3601                         goto out_unlock;
3602                 }
3603
3604                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3605                         if (WARN_ON(!sta)) {
3606                                 err = -EOPNOTSUPP;
3607                                 goto out_unlock;
3608                         }
3609                         /* Pairwise key with an assigned MAC address. */
3610                         err = b43_key_write(dev, -1, algorithm,
3611                                             key->key, key->keylen,
3612                                             sta->addr, key);
3613                 } else {
3614                         /* Group key */
3615                         err = b43_key_write(dev, index, algorithm,
3616                                             key->key, key->keylen, NULL, key);
3617                 }
3618                 if (err)
3619                         goto out_unlock;
3620
3621                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3622                     algorithm == B43_SEC_ALGO_WEP104) {
3623                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3624                 } else {
3625                         b43_hf_write(dev,
3626                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3627                 }
3628                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3629                 break;
3630         case DISABLE_KEY: {
3631                 err = b43_key_clear(dev, key->hw_key_idx);
3632                 if (err)
3633                         goto out_unlock;
3634                 break;
3635         }
3636         default:
3637                 B43_WARN_ON(1);
3638         }
3639
3640 out_unlock:
3641         if (!err) {
3642                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3643                        "mac: %pM\n",
3644                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3645                        sta ? sta->addr : bcast_addr);
3646                 b43_dump_keymemory(dev);
3647         }
3648         write_unlock(&wl->tx_lock);
3649         spin_unlock_irq(&wl->irq_lock);
3650         mutex_unlock(&wl->mutex);
3651
3652         return err;
3653 }
3654
3655 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3656                                     unsigned int changed, unsigned int *fflags,
3657                                     int mc_count, struct dev_addr_list *mc_list)
3658 {
3659         struct b43_wl *wl = hw_to_b43_wl(hw);
3660         struct b43_wldev *dev = wl->current_dev;
3661         unsigned long flags;
3662
3663         if (!dev) {
3664                 *fflags = 0;
3665                 return;
3666         }
3667
3668         spin_lock_irqsave(&wl->irq_lock, flags);
3669         *fflags &= FIF_PROMISC_IN_BSS |
3670                   FIF_ALLMULTI |
3671                   FIF_FCSFAIL |
3672                   FIF_PLCPFAIL |
3673                   FIF_CONTROL |
3674                   FIF_OTHER_BSS |
3675                   FIF_BCN_PRBRESP_PROMISC;
3676
3677         changed &= FIF_PROMISC_IN_BSS |
3678                    FIF_ALLMULTI |
3679                    FIF_FCSFAIL |
3680                    FIF_PLCPFAIL |
3681                    FIF_CONTROL |
3682                    FIF_OTHER_BSS |
3683                    FIF_BCN_PRBRESP_PROMISC;
3684
3685         wl->filter_flags = *fflags;
3686
3687         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3688                 b43_adjust_opmode(dev);
3689         spin_unlock_irqrestore(&wl->irq_lock, flags);
3690 }
3691
3692 /* Locking: wl->mutex */
3693 static void b43_wireless_core_stop(struct b43_wldev *dev)
3694 {
3695         struct b43_wl *wl = dev->wl;
3696         unsigned long flags;
3697
3698         if (b43_status(dev) < B43_STAT_STARTED)
3699                 return;
3700
3701         /* Disable and sync interrupts. We must do this before than
3702          * setting the status to INITIALIZED, as the interrupt handler
3703          * won't care about IRQs then. */
3704         spin_lock_irqsave(&wl->irq_lock, flags);
3705         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3706         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3707         spin_unlock_irqrestore(&wl->irq_lock, flags);
3708         b43_synchronize_irq(dev);
3709
3710         write_lock_irqsave(&wl->tx_lock, flags);
3711         b43_set_status(dev, B43_STAT_INITIALIZED);
3712         write_unlock_irqrestore(&wl->tx_lock, flags);
3713
3714         b43_pio_stop(dev);
3715         mutex_unlock(&wl->mutex);
3716         /* Must unlock as it would otherwise deadlock. No races here.
3717          * Cancel the possibly running self-rearming periodic work. */
3718         cancel_delayed_work_sync(&dev->periodic_work);
3719         mutex_lock(&wl->mutex);
3720
3721         b43_mac_suspend(dev);
3722         free_irq(dev->dev->irq, dev);
3723         b43dbg(wl, "Wireless interface stopped\n");
3724 }
3725
3726 /* Locking: wl->mutex */
3727 static int b43_wireless_core_start(struct b43_wldev *dev)
3728 {
3729         int err;
3730
3731         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3732
3733         drain_txstatus_queue(dev);
3734         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3735                           IRQF_SHARED, KBUILD_MODNAME, dev);
3736         if (err) {
3737                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3738                 goto out;
3739         }
3740
3741         /* We are ready to run. */
3742         b43_set_status(dev, B43_STAT_STARTED);
3743
3744         /* Start data flow (TX/RX). */
3745         b43_mac_enable(dev);
3746         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
3747
3748         /* Start maintainance work */
3749         b43_periodic_tasks_setup(dev);
3750
3751         b43dbg(dev->wl, "Wireless interface started\n");
3752       out:
3753         return err;
3754 }
3755
3756 /* Get PHY and RADIO versioning numbers */
3757 static int b43_phy_versioning(struct b43_wldev *dev)
3758 {
3759         struct b43_phy *phy = &dev->phy;
3760         u32 tmp;
3761         u8 analog_type;
3762         u8 phy_type;
3763         u8 phy_rev;
3764         u16 radio_manuf;
3765         u16 radio_ver;
3766         u16 radio_rev;
3767         int unsupported = 0;
3768
3769         /* Get PHY versioning */
3770         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3771         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3772         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3773         phy_rev = (tmp & B43_PHYVER_VERSION);
3774         switch (phy_type) {
3775         case B43_PHYTYPE_A:
3776                 if (phy_rev >= 4)
3777                         unsupported = 1;
3778                 break;
3779         case B43_PHYTYPE_B:
3780                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3781                     && phy_rev != 7)
3782                         unsupported = 1;
3783                 break;
3784         case B43_PHYTYPE_G:
3785                 if (phy_rev > 9)
3786                         unsupported = 1;
3787                 break;
3788 #ifdef CONFIG_B43_NPHY
3789         case B43_PHYTYPE_N:
3790                 if (phy_rev > 4)
3791                         unsupported = 1;
3792                 break;
3793 #endif
3794 #ifdef CONFIG_B43_PHY_LP
3795         case B43_PHYTYPE_LP:
3796                 if (phy_rev > 1)
3797                         unsupported = 1;
3798                 break;
3799 #endif
3800         default:
3801                 unsupported = 1;
3802         };
3803         if (unsupported) {
3804                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3805                        "(Analog %u, Type %u, Revision %u)\n",
3806                        analog_type, phy_type, phy_rev);
3807                 return -EOPNOTSUPP;
3808         }
3809         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3810                analog_type, phy_type, phy_rev);
3811
3812         /* Get RADIO versioning */
3813         if (dev->dev->bus->chip_id == 0x4317) {
3814                 if (dev->dev->bus->chip_rev == 0)
3815                         tmp = 0x3205017F;
3816                 else if (dev->dev->bus->chip_rev == 1)
3817                         tmp = 0x4205017F;
3818                 else
3819                         tmp = 0x5205017F;
3820         } else {
3821                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3822                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3823                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3824                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3825         }
3826         radio_manuf = (tmp & 0x00000FFF);
3827         radio_ver = (tmp & 0x0FFFF000) >> 12;
3828         radio_rev = (tmp & 0xF0000000) >> 28;
3829         if (radio_manuf != 0x17F /* Broadcom */)
3830                 unsupported = 1;
3831         switch (phy_type) {
3832         case B43_PHYTYPE_A:
3833                 if (radio_ver != 0x2060)
3834                         unsupported = 1;
3835                 if (radio_rev != 1)
3836                         unsupported = 1;
3837                 if (radio_manuf != 0x17F)
3838                         unsupported = 1;
3839                 break;
3840         case B43_PHYTYPE_B:
3841                 if ((radio_ver & 0xFFF0) != 0x2050)
3842                         unsupported = 1;
3843                 break;
3844         case B43_PHYTYPE_G:
3845                 if (radio_ver != 0x2050)
3846                         unsupported = 1;
3847                 break;
3848         case B43_PHYTYPE_N:
3849                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
3850                         unsupported = 1;
3851                 break;
3852         case B43_PHYTYPE_LP:
3853                 if (radio_ver != 0x2062)
3854                         unsupported = 1;
3855                 break;
3856         default:
3857                 B43_WARN_ON(1);
3858         }
3859         if (unsupported) {
3860                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3861                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3862                        radio_manuf, radio_ver, radio_rev);
3863                 return -EOPNOTSUPP;
3864         }
3865         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3866                radio_manuf, radio_ver, radio_rev);
3867
3868         phy->radio_manuf = radio_manuf;
3869         phy->radio_ver = radio_ver;
3870         phy->radio_rev = radio_rev;
3871
3872         phy->analog = analog_type;
3873         phy->type = phy_type;
3874         phy->rev = phy_rev;
3875
3876         return 0;
3877 }
3878
3879 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3880                                       struct b43_phy *phy)
3881 {
3882         phy->hardware_power_control = !!modparam_hwpctl;
3883         phy->next_txpwr_check_time = jiffies;
3884         /* PHY TX errors counter. */
3885         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3886
3887 #if B43_DEBUG
3888         phy->phy_locked = 0;
3889         phy->radio_locked = 0;
3890 #endif
3891 }
3892
3893 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3894 {
3895         dev->dfq_valid = 0;
3896
3897         /* Assume the radio is enabled. If it's not enabled, the state will
3898          * immediately get fixed on the first periodic work run. */
3899         dev->radio_hw_enable = 1;
3900
3901         /* Stats */
3902         memset(&dev->stats, 0, sizeof(dev->stats));
3903
3904         setup_struct_phy_for_init(dev, &dev->phy);
3905
3906         /* IRQ related flags */
3907         dev->irq_reason = 0;
3908         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3909         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
3910         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
3911                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
3912
3913         dev->mac_suspended = 1;
3914
3915         /* Noise calculation context */
3916         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3917 }
3918
3919 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3920 {
3921         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3922         u64 hf;
3923
3924         if (!modparam_btcoex)
3925                 return;
3926         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3927                 return;
3928         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3929                 return;
3930
3931         hf = b43_hf_read(dev);
3932         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3933                 hf |= B43_HF_BTCOEXALT;
3934         else
3935                 hf |= B43_HF_BTCOEX;
3936         b43_hf_write(dev, hf);
3937 }
3938
3939 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3940 {
3941         if (!modparam_btcoex)
3942                 return;
3943         //TODO
3944 }
3945
3946 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3947 {
3948 #ifdef CONFIG_SSB_DRIVER_PCICORE
3949         struct ssb_bus *bus = dev->dev->bus;
3950         u32 tmp;
3951
3952         if (bus->pcicore.dev &&
3953             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3954             bus->pcicore.dev->id.revision <= 5) {
3955                 /* IMCFGLO timeouts workaround. */
3956                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3957                 tmp &= ~SSB_IMCFGLO_REQTO;
3958                 tmp &= ~SSB_IMCFGLO_SERTO;
3959                 switch (bus->bustype) {
3960                 case SSB_BUSTYPE_PCI:
3961                 case SSB_BUSTYPE_PCMCIA:
3962                         tmp |= 0x32;
3963                         break;
3964                 case SSB_BUSTYPE_SSB:
3965                         tmp |= 0x53;
3966                         break;
3967                 }
3968                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3969         }
3970 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3971 }
3972
3973 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3974 {
3975         u16 pu_delay;
3976
3977         /* The time value is in microseconds. */
3978         if (dev->phy.type == B43_PHYTYPE_A)
3979                 pu_delay = 3700;
3980         else
3981                 pu_delay = 1050;
3982         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3983                 pu_delay = 500;
3984         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3985                 pu_delay = max(pu_delay, (u16)2400);
3986
3987         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3988 }
3989
3990 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3991 static void b43_set_pretbtt(struct b43_wldev *dev)
3992 {
3993         u16 pretbtt;
3994
3995         /* The time value is in microseconds. */
3996         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
3997                 pretbtt = 2;
3998         } else {
3999                 if (dev->phy.type == B43_PHYTYPE_A)
4000                         pretbtt = 120;
4001                 else
4002                         pretbtt = 250;
4003         }
4004         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4005         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4006 }
4007
4008 /* Shutdown a wireless core */
4009 /* Locking: wl->mutex */
4010 static void b43_wireless_core_exit(struct b43_wldev *dev)
4011 {
4012         u32 macctl;
4013
4014         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4015         if (b43_status(dev) != B43_STAT_INITIALIZED)
4016                 return;
4017         b43_set_status(dev, B43_STAT_UNINIT);
4018
4019         /* Stop the microcode PSM. */
4020         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4021         macctl &= ~B43_MACCTL_PSM_RUN;
4022         macctl |= B43_MACCTL_PSM_JMP0;
4023         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4024
4025         if (!dev->suspend_in_progress) {
4026                 b43_leds_exit(dev);
4027                 b43_rng_exit(dev->wl);
4028         }
4029         b43_dma_free(dev);
4030         b43_pio_free(dev);
4031         b43_chip_exit(dev);
4032         dev->phy.ops->switch_analog(dev, 0);
4033         if (dev->wl->current_beacon) {
4034                 dev_kfree_skb_any(dev->wl->current_beacon);
4035                 dev->wl->current_beacon = NULL;
4036         }
4037
4038         ssb_device_disable(dev->dev, 0);
4039         ssb_bus_may_powerdown(dev->dev->bus);
4040 }
4041
4042 /* Initialize a wireless core */
4043 static int b43_wireless_core_init(struct b43_wldev *dev)
4044 {
4045         struct b43_wl *wl = dev->wl;
4046         struct ssb_bus *bus = dev->dev->bus;
4047         struct ssb_sprom *sprom = &bus->sprom;
4048         struct b43_phy *phy = &dev->phy;
4049         int err;
4050         u64 hf;
4051         u32 tmp;
4052
4053         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4054
4055         err = ssb_bus_powerup(bus, 0);
4056         if (err)
4057                 goto out;
4058         if (!ssb_device_is_enabled(dev->dev)) {
4059                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4060                 b43_wireless_core_reset(dev, tmp);
4061         }
4062
4063         /* Reset all data structures. */
4064         setup_struct_wldev_for_init(dev);
4065         phy->ops->prepare_structs(dev);
4066
4067         /* Enable IRQ routing to this device. */
4068         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4069
4070         b43_imcfglo_timeouts_workaround(dev);
4071         b43_bluetooth_coext_disable(dev);
4072         if (phy->ops->prepare_hardware) {
4073                 err = phy->ops->prepare_hardware(dev);
4074                 if (err)
4075                         goto err_busdown;
4076         }
4077         err = b43_chip_init(dev);
4078         if (err)
4079                 goto err_busdown;
4080         b43_shm_write16(dev, B43_SHM_SHARED,
4081                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4082         hf = b43_hf_read(dev);
4083         if (phy->type == B43_PHYTYPE_G) {
4084                 hf |= B43_HF_SYMW;
4085                 if (phy->rev == 1)
4086                         hf |= B43_HF_GDCW;
4087                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4088                         hf |= B43_HF_OFDMPABOOST;
4089         }
4090         if (phy->radio_ver == 0x2050) {
4091                 if (phy->radio_rev == 6)
4092                         hf |= B43_HF_4318TSSI;
4093                 if (phy->radio_rev < 6)
4094                         hf |= B43_HF_VCORECALC;
4095         }
4096         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4097                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4098 #ifdef CONFIG_SSB_DRIVER_PCICORE
4099         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4100             (bus->pcicore.dev->id.revision <= 10))
4101                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4102 #endif
4103         hf &= ~B43_HF_SKCFPUP;
4104         b43_hf_write(dev, hf);
4105
4106         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4107                              B43_DEFAULT_LONG_RETRY_LIMIT);
4108         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4109         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4110
4111         /* Disable sending probe responses from firmware.
4112          * Setting the MaxTime to one usec will always trigger
4113          * a timeout, so we never send any probe resp.
4114          * A timeout of zero is infinite. */
4115         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4116
4117         b43_rate_memory_init(dev);
4118         b43_set_phytxctl_defaults(dev);
4119
4120         /* Minimum Contention Window */
4121         if (phy->type == B43_PHYTYPE_B) {
4122                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4123         } else {
4124                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4125         }
4126         /* Maximum Contention Window */
4127         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4128
4129         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4130                 dev->__using_pio_transfers = 1;
4131                 err = b43_pio_init(dev);
4132         } else {
4133                 dev->__using_pio_transfers = 0;
4134                 err = b43_dma_init(dev);
4135         }
4136         if (err)
4137                 goto err_chip_exit;
4138         b43_qos_init(dev);
4139         b43_set_synth_pu_delay(dev, 1);
4140         b43_bluetooth_coext_enable(dev);
4141
4142         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4143         b43_upload_card_macaddress(dev);
4144         b43_security_init(dev);
4145         if (!dev->suspend_in_progress)
4146                 b43_rng_init(wl);
4147
4148         b43_set_status(dev, B43_STAT_INITIALIZED);
4149
4150         if (!dev->suspend_in_progress)
4151                 b43_leds_init(dev);
4152 out:
4153         return err;
4154
4155 err_chip_exit:
4156         b43_chip_exit(dev);
4157 err_busdown:
4158         ssb_bus_may_powerdown(bus);
4159         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4160         return err;
4161 }
4162
4163 static int b43_op_add_interface(struct ieee80211_hw *hw,
4164                                 struct ieee80211_if_init_conf *conf)
4165 {
4166         struct b43_wl *wl = hw_to_b43_wl(hw);
4167         struct b43_wldev *dev;
4168         unsigned long flags;
4169         int err = -EOPNOTSUPP;
4170
4171         /* TODO: allow WDS/AP devices to coexist */
4172
4173         if (conf->type != NL80211_IFTYPE_AP &&
4174             conf->type != NL80211_IFTYPE_MESH_POINT &&
4175             conf->type != NL80211_IFTYPE_STATION &&
4176             conf->type != NL80211_IFTYPE_WDS &&
4177             conf->type != NL80211_IFTYPE_ADHOC)
4178                 return -EOPNOTSUPP;
4179
4180         mutex_lock(&wl->mutex);
4181         if (wl->operating)
4182                 goto out_mutex_unlock;
4183
4184         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4185
4186         dev = wl->current_dev;
4187         wl->operating = 1;
4188         wl->vif = conf->vif;
4189         wl->if_type = conf->type;
4190         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4191
4192         spin_lock_irqsave(&wl->irq_lock, flags);
4193         b43_adjust_opmode(dev);
4194         b43_set_pretbtt(dev);
4195         b43_set_synth_pu_delay(dev, 0);
4196         b43_upload_card_macaddress(dev);
4197         spin_unlock_irqrestore(&wl->irq_lock, flags);
4198
4199         err = 0;
4200  out_mutex_unlock:
4201         mutex_unlock(&wl->mutex);
4202
4203         return err;
4204 }
4205
4206 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4207                                     struct ieee80211_if_init_conf *conf)
4208 {
4209         struct b43_wl *wl = hw_to_b43_wl(hw);
4210         struct b43_wldev *dev = wl->current_dev;
4211         unsigned long flags;
4212
4213         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4214
4215         mutex_lock(&wl->mutex);
4216
4217         B43_WARN_ON(!wl->operating);
4218         B43_WARN_ON(wl->vif != conf->vif);
4219         wl->vif = NULL;
4220
4221         wl->operating = 0;
4222
4223         spin_lock_irqsave(&wl->irq_lock, flags);
4224         b43_adjust_opmode(dev);
4225         memset(wl->mac_addr, 0, ETH_ALEN);
4226         b43_upload_card_macaddress(dev);
4227         spin_unlock_irqrestore(&wl->irq_lock, flags);
4228
4229         mutex_unlock(&wl->mutex);
4230 }
4231
4232 static int b43_op_start(struct ieee80211_hw *hw)
4233 {
4234         struct b43_wl *wl = hw_to_b43_wl(hw);
4235         struct b43_wldev *dev = wl->current_dev;
4236         int did_init = 0;
4237         int err = 0;
4238
4239         /* Kill all old instance specific information to make sure
4240          * the card won't use it in the short timeframe between start
4241          * and mac80211 reconfiguring it. */
4242         memset(wl->bssid, 0, ETH_ALEN);
4243         memset(wl->mac_addr, 0, ETH_ALEN);
4244         wl->filter_flags = 0;
4245         wl->radiotap_enabled = 0;
4246         b43_qos_clear(wl);
4247         wl->beacon0_uploaded = 0;
4248         wl->beacon1_uploaded = 0;
4249         wl->beacon_templates_virgin = 1;
4250         wl->radio_enabled = 1;
4251
4252         mutex_lock(&wl->mutex);
4253
4254         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4255                 err = b43_wireless_core_init(dev);
4256                 if (err)
4257                         goto out_mutex_unlock;
4258                 did_init = 1;
4259         }
4260
4261         if (b43_status(dev) < B43_STAT_STARTED) {
4262                 err = b43_wireless_core_start(dev);
4263                 if (err) {
4264                         if (did_init)
4265                                 b43_wireless_core_exit(dev);
4266                         goto out_mutex_unlock;
4267                 }
4268         }
4269
4270         /* XXX: only do if device doesn't support rfkill irq */
4271         wiphy_rfkill_start_polling(hw->wiphy);
4272
4273  out_mutex_unlock:
4274         mutex_unlock(&wl->mutex);
4275
4276         return err;
4277 }
4278
4279 static void b43_op_stop(struct ieee80211_hw *hw)
4280 {
4281         struct b43_wl *wl = hw_to_b43_wl(hw);
4282         struct b43_wldev *dev = wl->current_dev;
4283
4284         cancel_work_sync(&(wl->beacon_update_trigger));
4285
4286         mutex_lock(&wl->mutex);
4287         if (b43_status(dev) >= B43_STAT_STARTED)
4288                 b43_wireless_core_stop(dev);
4289         b43_wireless_core_exit(dev);
4290         wl->radio_enabled = 0;
4291         mutex_unlock(&wl->mutex);
4292
4293         cancel_work_sync(&(wl->txpower_adjust_work));
4294 }
4295
4296 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4297                                  struct ieee80211_sta *sta, bool set)
4298 {
4299         struct b43_wl *wl = hw_to_b43_wl(hw);
4300         unsigned long flags;
4301
4302         spin_lock_irqsave(&wl->irq_lock, flags);
4303         b43_update_templates(wl);
4304         spin_unlock_irqrestore(&wl->irq_lock, flags);
4305
4306         return 0;
4307 }
4308
4309 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4310                               struct ieee80211_vif *vif,
4311                               enum sta_notify_cmd notify_cmd,
4312                               struct ieee80211_sta *sta)
4313 {
4314         struct b43_wl *wl = hw_to_b43_wl(hw);
4315
4316         B43_WARN_ON(!vif || wl->vif != vif);
4317 }
4318
4319 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4320 {
4321         struct b43_wl *wl = hw_to_b43_wl(hw);
4322         struct b43_wldev *dev;
4323
4324         mutex_lock(&wl->mutex);
4325         dev = wl->current_dev;
4326         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4327                 /* Disable CFP update during scan on other channels. */
4328                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4329         }
4330         mutex_unlock(&wl->mutex);
4331 }
4332
4333 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4334 {
4335         struct b43_wl *wl = hw_to_b43_wl(hw);
4336         struct b43_wldev *dev;
4337
4338         mutex_lock(&wl->mutex);
4339         dev = wl->current_dev;
4340         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4341                 /* Re-enable CFP update. */
4342                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4343         }
4344         mutex_unlock(&wl->mutex);
4345 }
4346
4347 static const struct ieee80211_ops b43_hw_ops = {
4348         .tx                     = b43_op_tx,
4349         .conf_tx                = b43_op_conf_tx,
4350         .add_interface          = b43_op_add_interface,
4351         .remove_interface       = b43_op_remove_interface,
4352         .config                 = b43_op_config,
4353         .bss_info_changed       = b43_op_bss_info_changed,
4354         .configure_filter       = b43_op_configure_filter,
4355         .set_key                = b43_op_set_key,
4356         .get_stats              = b43_op_get_stats,
4357         .get_tx_stats           = b43_op_get_tx_stats,
4358         .get_tsf                = b43_op_get_tsf,
4359         .set_tsf                = b43_op_set_tsf,
4360         .start                  = b43_op_start,
4361         .stop                   = b43_op_stop,
4362         .set_tim                = b43_op_beacon_set_tim,
4363         .sta_notify             = b43_op_sta_notify,
4364         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4365         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4366         .rfkill_poll            = b43_rfkill_poll,
4367 };
4368
4369 /* Hard-reset the chip. Do not call this directly.
4370  * Use b43_controller_restart()
4371  */
4372 static void b43_chip_reset(struct work_struct *work)
4373 {
4374         struct b43_wldev *dev =
4375             container_of(work, struct b43_wldev, restart_work);
4376         struct b43_wl *wl = dev->wl;
4377         int err = 0;
4378         int prev_status;
4379
4380         mutex_lock(&wl->mutex);
4381
4382         prev_status = b43_status(dev);
4383         /* Bring the device down... */
4384         if (prev_status >= B43_STAT_STARTED)
4385                 b43_wireless_core_stop(dev);
4386         if (prev_status >= B43_STAT_INITIALIZED)
4387                 b43_wireless_core_exit(dev);
4388
4389         /* ...and up again. */
4390         if (prev_status >= B43_STAT_INITIALIZED) {
4391                 err = b43_wireless_core_init(dev);
4392                 if (err)
4393                         goto out;
4394         }
4395         if (prev_status >= B43_STAT_STARTED) {
4396                 err = b43_wireless_core_start(dev);
4397                 if (err) {
4398                         b43_wireless_core_exit(dev);
4399                         goto out;
4400                 }
4401         }
4402 out:
4403         if (err)
4404                 wl->current_dev = NULL; /* Failed to init the dev. */
4405         mutex_unlock(&wl->mutex);
4406         if (err)
4407                 b43err(wl, "Controller restart FAILED\n");
4408         else
4409                 b43info(wl, "Controller restarted\n");
4410 }
4411
4412 static int b43_setup_bands(struct b43_wldev *dev,
4413                            bool have_2ghz_phy, bool have_5ghz_phy)
4414 {
4415         struct ieee80211_hw *hw = dev->wl->hw;
4416
4417         if (have_2ghz_phy)
4418                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4419         if (dev->phy.type == B43_PHYTYPE_N) {
4420                 if (have_5ghz_phy)
4421                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4422         } else {
4423                 if (have_5ghz_phy)
4424                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4425         }
4426
4427         dev->phy.supports_2ghz = have_2ghz_phy;
4428         dev->phy.supports_5ghz = have_5ghz_phy;
4429
4430         return 0;
4431 }
4432
4433 static void b43_wireless_core_detach(struct b43_wldev *dev)
4434 {
4435         /* We release firmware that late to not be required to re-request
4436          * is all the time when we reinit the core. */
4437         b43_release_firmware(dev);
4438         b43_phy_free(dev);
4439 }
4440
4441 static int b43_wireless_core_attach(struct b43_wldev *dev)
4442 {
4443         struct b43_wl *wl = dev->wl;
4444         struct ssb_bus *bus = dev->dev->bus;
4445         struct pci_dev *pdev = bus->host_pci;
4446         int err;
4447         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4448         u32 tmp;
4449
4450         /* Do NOT do any device initialization here.
4451          * Do it in wireless_core_init() instead.
4452          * This function is for gathering basic information about the HW, only.
4453          * Also some structs may be set up here. But most likely you want to have
4454          * that in core_init(), too.
4455          */
4456
4457         err = ssb_bus_powerup(bus, 0);
4458         if (err) {
4459                 b43err(wl, "Bus powerup failed\n");
4460                 goto out;
4461         }
4462         /* Get the PHY type. */
4463         if (dev->dev->id.revision >= 5) {
4464                 u32 tmshigh;
4465
4466                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4467                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4468                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4469         } else
4470                 B43_WARN_ON(1);
4471
4472         dev->phy.gmode = have_2ghz_phy;
4473         dev->phy.radio_on = 1;
4474         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4475         b43_wireless_core_reset(dev, tmp);
4476
4477         err = b43_phy_versioning(dev);
4478         if (err)
4479                 goto err_powerdown;
4480         /* Check if this device supports multiband. */
4481         if (!pdev ||
4482             (pdev->device != 0x4312 &&
4483              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4484                 /* No multiband support. */
4485                 have_2ghz_phy = 0;
4486                 have_5ghz_phy = 0;
4487                 switch (dev->phy.type) {
4488                 case B43_PHYTYPE_A:
4489                         have_5ghz_phy = 1;
4490                         break;
4491                 case B43_PHYTYPE_G:
4492                 case B43_PHYTYPE_N:
4493                 case B43_PHYTYPE_LP:
4494                         have_2ghz_phy = 1;
4495                         break;
4496                 default:
4497                         B43_WARN_ON(1);
4498                 }
4499         }
4500         if (dev->phy.type == B43_PHYTYPE_A) {
4501                 /* FIXME */
4502                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4503                 err = -EOPNOTSUPP;
4504                 goto err_powerdown;
4505         }
4506         if (1 /* disable A-PHY */) {
4507                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4508                 if (dev->phy.type != B43_PHYTYPE_N) {
4509                         have_2ghz_phy = 1;
4510                         have_5ghz_phy = 0;
4511                 }
4512         }
4513
4514         err = b43_phy_allocate(dev);
4515         if (err)
4516                 goto err_powerdown;
4517
4518         dev->phy.gmode = have_2ghz_phy;
4519         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4520         b43_wireless_core_reset(dev, tmp);
4521
4522         err = b43_validate_chipaccess(dev);
4523         if (err)
4524                 goto err_phy_free;
4525         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4526         if (err)
4527                 goto err_phy_free;
4528
4529         /* Now set some default "current_dev" */
4530         if (!wl->current_dev)
4531                 wl->current_dev = dev;
4532         INIT_WORK(&dev->restart_work, b43_chip_reset);
4533
4534         dev->phy.ops->switch_analog(dev, 0);
4535         ssb_device_disable(dev->dev, 0);
4536         ssb_bus_may_powerdown(bus);
4537
4538 out:
4539         return err;
4540
4541 err_phy_free:
4542         b43_phy_free(dev);
4543 err_powerdown:
4544         ssb_bus_may_powerdown(bus);
4545         return err;
4546 }
4547
4548 static void b43_one_core_detach(struct ssb_device *dev)
4549 {
4550         struct b43_wldev *wldev;
4551         struct b43_wl *wl;
4552
4553         /* Do not cancel ieee80211-workqueue based work here.
4554          * See comment in b43_remove(). */
4555
4556         wldev = ssb_get_drvdata(dev);
4557         wl = wldev->wl;
4558         b43_debugfs_remove_device(wldev);
4559         b43_wireless_core_detach(wldev);
4560         list_del(&wldev->list);
4561         wl->nr_devs--;
4562         ssb_set_drvdata(dev, NULL);
4563         kfree(wldev);
4564 }
4565
4566 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4567 {
4568         struct b43_wldev *wldev;
4569         struct pci_dev *pdev;
4570         int err = -ENOMEM;
4571
4572         if (!list_empty(&wl->devlist)) {
4573                 /* We are not the first core on this chip. */
4574                 pdev = dev->bus->host_pci;
4575                 /* Only special chips support more than one wireless
4576                  * core, although some of the other chips have more than
4577                  * one wireless core as well. Check for this and
4578                  * bail out early.
4579                  */
4580                 if (!pdev ||
4581                     ((pdev->device != 0x4321) &&
4582                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4583                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4584                         return -ENODEV;
4585                 }
4586         }
4587
4588         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4589         if (!wldev)
4590                 goto out;
4591
4592         wldev->dev = dev;
4593         wldev->wl = wl;
4594         b43_set_status(wldev, B43_STAT_UNINIT);
4595         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4596         tasklet_init(&wldev->isr_tasklet,
4597                      (void (*)(unsigned long))b43_interrupt_tasklet,
4598                      (unsigned long)wldev);
4599         INIT_LIST_HEAD(&wldev->list);
4600
4601         err = b43_wireless_core_attach(wldev);
4602         if (err)
4603                 goto err_kfree_wldev;
4604
4605         list_add(&wldev->list, &wl->devlist);
4606         wl->nr_devs++;
4607         ssb_set_drvdata(dev, wldev);
4608         b43_debugfs_add_device(wldev);
4609
4610       out:
4611         return err;
4612
4613       err_kfree_wldev:
4614         kfree(wldev);
4615         return err;
4616 }
4617
4618 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4619         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4620         (pdev->device == _device) &&                                    \
4621         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4622         (pdev->subsystem_device == _subdevice)                          )
4623
4624 static void b43_sprom_fixup(struct ssb_bus *bus)
4625 {
4626         struct pci_dev *pdev;
4627
4628         /* boardflags workarounds */
4629         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4630             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4631                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4632         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4633             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4634                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4635         if (bus->bustype == SSB_BUSTYPE_PCI) {
4636                 pdev = bus->host_pci;
4637                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4638                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4639                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4640                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4641                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4642                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4643                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4644                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4645         }
4646 }
4647
4648 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4649 {
4650         struct ieee80211_hw *hw = wl->hw;
4651
4652         ssb_set_devtypedata(dev, NULL);
4653         ieee80211_free_hw(hw);
4654 }
4655
4656 static int b43_wireless_init(struct ssb_device *dev)
4657 {
4658         struct ssb_sprom *sprom = &dev->bus->sprom;
4659         struct ieee80211_hw *hw;
4660         struct b43_wl *wl;
4661         int err = -ENOMEM;
4662
4663         b43_sprom_fixup(dev->bus);
4664
4665         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4666         if (!hw) {
4667                 b43err(NULL, "Could not allocate ieee80211 device\n");
4668                 goto out;
4669         }
4670         wl = hw_to_b43_wl(hw);
4671
4672         /* fill hw info */
4673         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4674                     IEEE80211_HW_SIGNAL_DBM |
4675                     IEEE80211_HW_NOISE_DBM;
4676
4677         hw->wiphy->interface_modes =
4678                 BIT(NL80211_IFTYPE_AP) |
4679                 BIT(NL80211_IFTYPE_MESH_POINT) |
4680                 BIT(NL80211_IFTYPE_STATION) |
4681                 BIT(NL80211_IFTYPE_WDS) |
4682                 BIT(NL80211_IFTYPE_ADHOC);
4683
4684         hw->queues = modparam_qos ? 4 : 1;
4685         wl->mac80211_initially_registered_queues = hw->queues;
4686         hw->max_rates = 2;
4687         SET_IEEE80211_DEV(hw, dev->dev);
4688         if (is_valid_ether_addr(sprom->et1mac))
4689                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4690         else
4691                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4692
4693         /* Initialize struct b43_wl */
4694         wl->hw = hw;
4695         spin_lock_init(&wl->irq_lock);
4696         rwlock_init(&wl->tx_lock);
4697         spin_lock_init(&wl->leds_lock);
4698         spin_lock_init(&wl->shm_lock);
4699         mutex_init(&wl->mutex);
4700         INIT_LIST_HEAD(&wl->devlist);
4701         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4702         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4703
4704         ssb_set_devtypedata(dev, wl);
4705         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4706                 dev->bus->chip_id, dev->id.revision);
4707         err = 0;
4708 out:
4709         return err;
4710 }
4711
4712 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4713 {
4714         struct b43_wl *wl;
4715         int err;
4716         int first = 0;
4717
4718         wl = ssb_get_devtypedata(dev);
4719         if (!wl) {
4720                 /* Probing the first core. Must setup common struct b43_wl */
4721                 first = 1;
4722                 err = b43_wireless_init(dev);
4723                 if (err)
4724                         goto out;
4725                 wl = ssb_get_devtypedata(dev);
4726                 B43_WARN_ON(!wl);
4727         }
4728         err = b43_one_core_attach(dev, wl);
4729         if (err)
4730                 goto err_wireless_exit;
4731
4732         if (first) {
4733                 err = ieee80211_register_hw(wl->hw);
4734                 if (err)
4735                         goto err_one_core_detach;
4736         }
4737
4738       out:
4739         return err;
4740
4741       err_one_core_detach:
4742         b43_one_core_detach(dev);
4743       err_wireless_exit:
4744         if (first)
4745                 b43_wireless_exit(dev, wl);
4746         return err;
4747 }
4748
4749 static void b43_remove(struct ssb_device *dev)
4750 {
4751         struct b43_wl *wl = ssb_get_devtypedata(dev);
4752         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4753
4754         /* We must cancel any work here before unregistering from ieee80211,
4755          * as the ieee80211 unreg will destroy the workqueue. */
4756         cancel_work_sync(&wldev->restart_work);
4757
4758         B43_WARN_ON(!wl);
4759         if (wl->current_dev == wldev) {
4760                 /* Restore the queues count before unregistering, because firmware detect
4761                  * might have modified it. Restoring is important, so the networking
4762                  * stack can properly free resources. */
4763                 wl->hw->queues = wl->mac80211_initially_registered_queues;
4764                 ieee80211_unregister_hw(wl->hw);
4765         }
4766
4767         b43_one_core_detach(dev);
4768
4769         if (list_empty(&wl->devlist)) {
4770                 /* Last core on the chip unregistered.
4771                  * We can destroy common struct b43_wl.
4772                  */
4773                 b43_wireless_exit(dev, wl);
4774         }
4775 }
4776
4777 /* Perform a hardware reset. This can be called from any context. */
4778 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4779 {
4780         /* Must avoid requeueing, if we are in shutdown. */
4781         if (b43_status(dev) < B43_STAT_INITIALIZED)
4782                 return;
4783         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4784         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
4785 }
4786
4787 #ifdef CONFIG_PM
4788
4789 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4790 {
4791         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4792         struct b43_wl *wl = wldev->wl;
4793
4794         b43dbg(wl, "Suspending...\n");
4795
4796         mutex_lock(&wl->mutex);
4797         wldev->suspend_in_progress = true;
4798         wldev->suspend_init_status = b43_status(wldev);
4799         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4800                 b43_wireless_core_stop(wldev);
4801         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4802                 b43_wireless_core_exit(wldev);
4803         mutex_unlock(&wl->mutex);
4804
4805         b43dbg(wl, "Device suspended.\n");
4806
4807         return 0;
4808 }
4809
4810 static int b43_resume(struct ssb_device *dev)
4811 {
4812         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4813         struct b43_wl *wl = wldev->wl;
4814         int err = 0;
4815
4816         b43dbg(wl, "Resuming...\n");
4817
4818         mutex_lock(&wl->mutex);
4819         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4820                 err = b43_wireless_core_init(wldev);
4821                 if (err) {
4822                         b43err(wl, "Resume failed at core init\n");
4823                         goto out;
4824                 }
4825         }
4826         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4827                 err = b43_wireless_core_start(wldev);
4828                 if (err) {
4829                         b43_leds_exit(wldev);
4830                         b43_rng_exit(wldev->wl);
4831                         b43_wireless_core_exit(wldev);
4832                         b43err(wl, "Resume failed at core start\n");
4833                         goto out;
4834                 }
4835         }
4836         b43dbg(wl, "Device resumed.\n");
4837  out:
4838         wldev->suspend_in_progress = false;
4839         mutex_unlock(&wl->mutex);
4840         return err;
4841 }
4842
4843 #else /* CONFIG_PM */
4844 # define b43_suspend    NULL
4845 # define b43_resume     NULL
4846 #endif /* CONFIG_PM */
4847
4848 static struct ssb_driver b43_ssb_driver = {
4849         .name           = KBUILD_MODNAME,
4850         .id_table       = b43_ssb_tbl,
4851         .probe          = b43_probe,
4852         .remove         = b43_remove,
4853         .suspend        = b43_suspend,
4854         .resume         = b43_resume,
4855 };
4856
4857 static void b43_print_driverinfo(void)
4858 {
4859         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4860                    *feat_leds = "";
4861
4862 #ifdef CONFIG_B43_PCI_AUTOSELECT
4863         feat_pci = "P";
4864 #endif
4865 #ifdef CONFIG_B43_PCMCIA
4866         feat_pcmcia = "M";
4867 #endif
4868 #ifdef CONFIG_B43_NPHY
4869         feat_nphy = "N";
4870 #endif
4871 #ifdef CONFIG_B43_LEDS
4872         feat_leds = "L";
4873 #endif
4874         printk(KERN_INFO "Broadcom 43xx driver loaded "
4875                "[ Features: %s%s%s%s, Firmware-ID: "
4876                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4877                feat_pci, feat_pcmcia, feat_nphy,
4878                feat_leds);
4879 }
4880
4881 static int __init b43_init(void)
4882 {
4883         int err;
4884
4885         b43_debugfs_init();
4886         err = b43_pcmcia_init();
4887         if (err)
4888                 goto err_dfs_exit;
4889         err = ssb_driver_register(&b43_ssb_driver);
4890         if (err)
4891                 goto err_pcmcia_exit;
4892         b43_print_driverinfo();
4893
4894         return err;
4895
4896 err_pcmcia_exit:
4897         b43_pcmcia_exit();
4898 err_dfs_exit:
4899         b43_debugfs_exit();
4900         return err;
4901 }
4902
4903 static void __exit b43_exit(void)
4904 {
4905         ssb_driver_unregister(&b43_ssb_driver);
4906         b43_pcmcia_exit();
4907         b43_debugfs_exit();
4908 }
4909
4910 module_init(b43_init)
4911 module_exit(b43_exit)