SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/version.h>
  37 #include <linux/firmware.h>
  38 #include <linux/wireless.h>
  39 #include <linux/workqueue.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/io.h>
  42 #include <linux/dma-mapping.h>
  43 #include <asm/unaligned.h>
  44
  45 #include "b43.h"
  46 #include "main.h"
  47 #include "debugfs.h"
  48 #include "phy.h"
  49 #include "nphy.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 int b43_modparam_qos = 1;
  84 module_param_named(qos, b43_modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91
  92 static const struct ssb_device_id b43_ssb_tbl[] = {
  93         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  94         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  95         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
  96         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 100         SSB_DEVTABLE_END
 101 };
 102
 103 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 104
 105 /* Channel and ratetables are shared for all devices.
 106  * They can't be const, because ieee80211 puts some precalculated
 107  * data in there. This data is the same for all devices, so we don't
 108  * get concurrency issues */
 109 #define RATETAB_ENT(_rateid, _flags) \
 110         {                                                               \
 111                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 112                 .hw_value       = (_rateid),                            \
 113                 .flags          = (_flags),                             \
 114         }
 115
 116 /*
 117  * NOTE: When changing this, sync with xmit.c's
 118  *       b43_plcp_get_bitrate_idx_* functions!
 119  */
 120 static struct ieee80211_rate __b43_ratetable[] = {
 121         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 122         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 123         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 124         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 125         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 126         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 127         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 128         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 129         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 130         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 131         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 133 };
 134
 135 #define b43_a_ratetable         (__b43_ratetable + 4)
 136 #define b43_a_ratetable_size    8
 137 #define b43_b_ratetable         (__b43_ratetable + 0)
 138 #define b43_b_ratetable_size    4
 139 #define b43_g_ratetable         (__b43_ratetable + 0)
 140 #define b43_g_ratetable_size    12
 141
 142 #define CHAN4G(_channel, _freq, _flags) {                       \
 143         .band                   = IEEE80211_BAND_2GHZ,          \
 144         .center_freq            = (_freq),                      \
 145         .hw_value               = (_channel),                   \
 146         .flags                  = (_flags),                     \
 147         .max_antenna_gain       = 0,                            \
 148         .max_power              = 30,                           \
 149 }
 150 static struct ieee80211_channel b43_2ghz_chantable[] = {
 151         CHAN4G(1, 2412, 0),
 152         CHAN4G(2, 2417, 0),
 153         CHAN4G(3, 2422, 0),
 154         CHAN4G(4, 2427, 0),
 155         CHAN4G(5, 2432, 0),
 156         CHAN4G(6, 2437, 0),
 157         CHAN4G(7, 2442, 0),
 158         CHAN4G(8, 2447, 0),
 159         CHAN4G(9, 2452, 0),
 160         CHAN4G(10, 2457, 0),
 161         CHAN4G(11, 2462, 0),
 162         CHAN4G(12, 2467, 0),
 163         CHAN4G(13, 2472, 0),
 164         CHAN4G(14, 2484, 0),
 165 };
 166 #undef CHAN4G
 167
 168 #define CHAN5G(_channel, _flags) {                              \
 169         .band                   = IEEE80211_BAND_5GHZ,          \
 170         .center_freq            = 5000 + (5 * (_channel)),      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 177         CHAN5G(32, 0),          CHAN5G(34, 0),
 178         CHAN5G(36, 0),          CHAN5G(38, 0),
 179         CHAN5G(40, 0),          CHAN5G(42, 0),
 180         CHAN5G(44, 0),          CHAN5G(46, 0),
 181         CHAN5G(48, 0),          CHAN5G(50, 0),
 182         CHAN5G(52, 0),          CHAN5G(54, 0),
 183         CHAN5G(56, 0),          CHAN5G(58, 0),
 184         CHAN5G(60, 0),          CHAN5G(62, 0),
 185         CHAN5G(64, 0),          CHAN5G(66, 0),
 186         CHAN5G(68, 0),          CHAN5G(70, 0),
 187         CHAN5G(72, 0),          CHAN5G(74, 0),
 188         CHAN5G(76, 0),          CHAN5G(78, 0),
 189         CHAN5G(80, 0),          CHAN5G(82, 0),
 190         CHAN5G(84, 0),          CHAN5G(86, 0),
 191         CHAN5G(88, 0),          CHAN5G(90, 0),
 192         CHAN5G(92, 0),          CHAN5G(94, 0),
 193         CHAN5G(96, 0),          CHAN5G(98, 0),
 194         CHAN5G(100, 0),         CHAN5G(102, 0),
 195         CHAN5G(104, 0),         CHAN5G(106, 0),
 196         CHAN5G(108, 0),         CHAN5G(110, 0),
 197         CHAN5G(112, 0),         CHAN5G(114, 0),
 198         CHAN5G(116, 0),         CHAN5G(118, 0),
 199         CHAN5G(120, 0),         CHAN5G(122, 0),
 200         CHAN5G(124, 0),         CHAN5G(126, 0),
 201         CHAN5G(128, 0),         CHAN5G(130, 0),
 202         CHAN5G(132, 0),         CHAN5G(134, 0),
 203         CHAN5G(136, 0),         CHAN5G(138, 0),
 204         CHAN5G(140, 0),         CHAN5G(142, 0),
 205         CHAN5G(144, 0),         CHAN5G(145, 0),
 206         CHAN5G(146, 0),         CHAN5G(147, 0),
 207         CHAN5G(148, 0),         CHAN5G(149, 0),
 208         CHAN5G(150, 0),         CHAN5G(151, 0),
 209         CHAN5G(152, 0),         CHAN5G(153, 0),
 210         CHAN5G(154, 0),         CHAN5G(155, 0),
 211         CHAN5G(156, 0),         CHAN5G(157, 0),
 212         CHAN5G(158, 0),         CHAN5G(159, 0),
 213         CHAN5G(160, 0),         CHAN5G(161, 0),
 214         CHAN5G(162, 0),         CHAN5G(163, 0),
 215         CHAN5G(164, 0),         CHAN5G(165, 0),
 216         CHAN5G(166, 0),         CHAN5G(168, 0),
 217         CHAN5G(170, 0),         CHAN5G(172, 0),
 218         CHAN5G(174, 0),         CHAN5G(176, 0),
 219         CHAN5G(178, 0),         CHAN5G(180, 0),
 220         CHAN5G(182, 0),         CHAN5G(184, 0),
 221         CHAN5G(186, 0),         CHAN5G(188, 0),
 222         CHAN5G(190, 0),         CHAN5G(192, 0),
 223         CHAN5G(194, 0),         CHAN5G(196, 0),
 224         CHAN5G(198, 0),         CHAN5G(200, 0),
 225         CHAN5G(202, 0),         CHAN5G(204, 0),
 226         CHAN5G(206, 0),         CHAN5G(208, 0),
 227         CHAN5G(210, 0),         CHAN5G(212, 0),
 228         CHAN5G(214, 0),         CHAN5G(216, 0),
 229         CHAN5G(218, 0),         CHAN5G(220, 0),
 230         CHAN5G(222, 0),         CHAN5G(224, 0),
 231         CHAN5G(226, 0),         CHAN5G(228, 0),
 232 };
 233
 234 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 235         CHAN5G(34, 0),          CHAN5G(36, 0),
 236         CHAN5G(38, 0),          CHAN5G(40, 0),
 237         CHAN5G(42, 0),          CHAN5G(44, 0),
 238         CHAN5G(46, 0),          CHAN5G(48, 0),
 239         CHAN5G(52, 0),          CHAN5G(56, 0),
 240         CHAN5G(60, 0),          CHAN5G(64, 0),
 241         CHAN5G(100, 0),         CHAN5G(104, 0),
 242         CHAN5G(108, 0),         CHAN5G(112, 0),
 243         CHAN5G(116, 0),         CHAN5G(120, 0),
 244         CHAN5G(124, 0),         CHAN5G(128, 0),
 245         CHAN5G(132, 0),         CHAN5G(136, 0),
 246         CHAN5G(140, 0),         CHAN5G(149, 0),
 247         CHAN5G(153, 0),         CHAN5G(157, 0),
 248         CHAN5G(161, 0),         CHAN5G(165, 0),
 249         CHAN5G(184, 0),         CHAN5G(188, 0),
 250         CHAN5G(192, 0),         CHAN5G(196, 0),
 251         CHAN5G(200, 0),         CHAN5G(204, 0),
 252         CHAN5G(208, 0),         CHAN5G(212, 0),
 253         CHAN5G(216, 0),
 254 };
 255 #undef CHAN5G
 256
 257 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 258         .band           = IEEE80211_BAND_5GHZ,
 259         .channels       = b43_5ghz_nphy_chantable,
 260         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 261         .bitrates       = b43_a_ratetable,
 262         .n_bitrates     = b43_a_ratetable_size,
 263 };
 264
 265 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 266         .band           = IEEE80211_BAND_5GHZ,
 267         .channels       = b43_5ghz_aphy_chantable,
 268         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 269         .bitrates       = b43_a_ratetable,
 270         .n_bitrates     = b43_a_ratetable_size,
 271 };
 272
 273 static struct ieee80211_supported_band b43_band_2GHz = {
 274         .band           = IEEE80211_BAND_2GHZ,
 275         .channels       = b43_2ghz_chantable,
 276         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 277         .bitrates       = b43_g_ratetable,
 278         .n_bitrates     = b43_g_ratetable_size,
 279 };
 280
 281 static void b43_wireless_core_exit(struct b43_wldev *dev);
 282 static int b43_wireless_core_init(struct b43_wldev *dev);
 283 static void b43_wireless_core_stop(struct b43_wldev *dev);
 284 static int b43_wireless_core_start(struct b43_wldev *dev);
 285
 286 static int b43_ratelimit(struct b43_wl *wl)
 287 {
 288         if (!wl || !wl->current_dev)
 289                 return 1;
 290         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 291                 return 1;
 292         /* We are up and running.
 293          * Ratelimit the messages to avoid DoS over the net. */
 294         return net_ratelimit();
 295 }
 296
 297 void b43info(struct b43_wl *wl, const char *fmt, ...)
 298 {
 299         va_list args;
 300
 301         if (!b43_ratelimit(wl))
 302                 return;
 303         va_start(args, fmt);
 304         printk(KERN_INFO "b43-%s: ",
 305                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 306         vprintk(fmt, args);
 307         va_end(args);
 308 }
 309
 310 void b43err(struct b43_wl *wl, const char *fmt, ...)
 311 {
 312         va_list args;
 313
 314         if (!b43_ratelimit(wl))
 315                 return;
 316         va_start(args, fmt);
 317         printk(KERN_ERR "b43-%s ERROR: ",
 318                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 319         vprintk(fmt, args);
 320         va_end(args);
 321 }
 322
 323 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         va_list args;
 326
 327         if (!b43_ratelimit(wl))
 328                 return;
 329         va_start(args, fmt);
 330         printk(KERN_WARNING "b43-%s warning: ",
 331                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 332         vprintk(fmt, args);
 333         va_end(args);
 334 }
 335
 336 #if B43_DEBUG
 337 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 338 {
 339         va_list args;
 340
 341         va_start(args, fmt);
 342         printk(KERN_DEBUG "b43-%s debug: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347 #endif /* DEBUG */
 348
 349 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 350 {
 351         u32 macctl;
 352
 353         B43_WARN_ON(offset % 4 != 0);
 354
 355         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 356         if (macctl & B43_MACCTL_BE)
 357                 val = swab32(val);
 358
 359         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 360         mmiowb();
 361         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 362 }
 363
 364 static inline void b43_shm_control_word(struct b43_wldev *dev,
 365                                         u16 routing, u16 offset)
 366 {
 367         u32 control;
 368
 369         /* "offset" is the WORD offset. */
 370         control = routing;
 371         control <<= 16;
 372         control |= offset;
 373         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 374 }
 375
 376 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 377 {
 378         u32 ret;
 379
 380         if (routing == B43_SHM_SHARED) {
 381                 B43_WARN_ON(offset & 0x0001);
 382                 if (offset & 0x0003) {
 383                         /* Unaligned access */
 384                         b43_shm_control_word(dev, routing, offset >> 2);
 385                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 386                         ret <<= 16;
 387                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 388                         ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
 389
 390                         goto out;
 391                 }
 392                 offset >>= 2;
 393         }
 394         b43_shm_control_word(dev, routing, offset);
 395         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 396 out:
 397         return ret;
 398 }
 399
 400 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 401 {
 402         struct b43_wl *wl = dev->wl;
 403         unsigned long flags;
 404         u32 ret;
 405
 406         spin_lock_irqsave(&wl->shm_lock, flags);
 407         ret = __b43_shm_read32(dev, routing, offset);
 408         spin_unlock_irqrestore(&wl->shm_lock, flags);
 409
 410         return ret;
 411 }
 412
 413 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 414 {
 415         u16 ret;
 416
 417         if (routing == B43_SHM_SHARED) {
 418                 B43_WARN_ON(offset & 0x0001);
 419                 if (offset & 0x0003) {
 420                         /* Unaligned access */
 421                         b43_shm_control_word(dev, routing, offset >> 2);
 422                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 423
 424                         goto out;
 425                 }
 426                 offset >>= 2;
 427         }
 428         b43_shm_control_word(dev, routing, offset);
 429         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 430 out:
 431         return ret;
 432 }
 433
 434 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 435 {
 436         struct b43_wl *wl = dev->wl;
 437         unsigned long flags;
 438         u16 ret;
 439
 440         spin_lock_irqsave(&wl->shm_lock, flags);
 441         ret = __b43_shm_read16(dev, routing, offset);
 442         spin_unlock_irqrestore(&wl->shm_lock, flags);
 443
 444         return ret;
 445 }
 446
 447 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 448 {
 449         if (routing == B43_SHM_SHARED) {
 450                 B43_WARN_ON(offset & 0x0001);
 451                 if (offset & 0x0003) {
 452                         /* Unaligned access */
 453                         b43_shm_control_word(dev, routing, offset >> 2);
 454                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 455                                     (value >> 16) & 0xffff);
 456                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 457                         b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
 458                         return;
 459                 }
 460                 offset >>= 2;
 461         }
 462         b43_shm_control_word(dev, routing, offset);
 463         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 464 }
 465
 466 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 467 {
 468         struct b43_wl *wl = dev->wl;
 469         unsigned long flags;
 470
 471         spin_lock_irqsave(&wl->shm_lock, flags);
 472         __b43_shm_write32(dev, routing, offset, value);
 473         spin_unlock_irqrestore(&wl->shm_lock, flags);
 474 }
 475
 476 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 477 {
 478         if (routing == B43_SHM_SHARED) {
 479                 B43_WARN_ON(offset & 0x0001);
 480                 if (offset & 0x0003) {
 481                         /* Unaligned access */
 482                         b43_shm_control_word(dev, routing, offset >> 2);
 483                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 484                         return;
 485                 }
 486                 offset >>= 2;
 487         }
 488         b43_shm_control_word(dev, routing, offset);
 489         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 490 }
 491
 492 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 493 {
 494         struct b43_wl *wl = dev->wl;
 495         unsigned long flags;
 496
 497         spin_lock_irqsave(&wl->shm_lock, flags);
 498         __b43_shm_write16(dev, routing, offset, value);
 499         spin_unlock_irqrestore(&wl->shm_lock, flags);
 500 }
 501
 502 /* Read HostFlags */
 503 u64 b43_hf_read(struct b43_wldev * dev)
 504 {
 505         u64 ret;
 506
 507         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 508         ret <<= 16;
 509         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 510         ret <<= 16;
 511         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 512
 513         return ret;
 514 }
 515
 516 /* Write HostFlags */
 517 void b43_hf_write(struct b43_wldev *dev, u64 value)
 518 {
 519         u16 lo, mi, hi;
 520
 521         lo = (value & 0x00000000FFFFULL);
 522         mi = (value & 0x0000FFFF0000ULL) >> 16;
 523         hi = (value & 0xFFFF00000000ULL) >> 32;
 524         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 525         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 526         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 527 }
 528
 529 void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
 530 {
 531         /* We need to be careful. As we read the TSF from multiple
 532          * registers, we should take care of register overflows.
 533          * In theory, the whole tsf read process should be atomic.
 534          * We try to be atomic here, by restaring the read process,
 535          * if any of the high registers changed (overflew).
 536          */
 537         if (dev->dev->id.revision >= 3) {
 538                 u32 low, high, high2;
 539
 540                 do {
 541                         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 542                         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 543                         high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 544                 } while (unlikely(high != high2));
 545
 546                 *tsf = high;
 547                 *tsf <<= 32;
 548                 *tsf |= low;
 549         } else {
 550                 u64 tmp;
 551                 u16 v0, v1, v2, v3;
 552                 u16 test1, test2, test3;
 553
 554                 do {
 555                         v3 = b43_read16(dev, B43_MMIO_TSF_3);
 556                         v2 = b43_read16(dev, B43_MMIO_TSF_2);
 557                         v1 = b43_read16(dev, B43_MMIO_TSF_1);
 558                         v0 = b43_read16(dev, B43_MMIO_TSF_0);
 559
 560                         test3 = b43_read16(dev, B43_MMIO_TSF_3);
 561                         test2 = b43_read16(dev, B43_MMIO_TSF_2);
 562                         test1 = b43_read16(dev, B43_MMIO_TSF_1);
 563                 } while (v3 != test3 || v2 != test2 || v1 != test1);
 564
 565                 *tsf = v3;
 566                 *tsf <<= 48;
 567                 tmp = v2;
 568                 tmp <<= 32;
 569                 *tsf |= tmp;
 570                 tmp = v1;
 571                 tmp <<= 16;
 572                 *tsf |= tmp;
 573                 *tsf |= v0;
 574         }
 575 }
 576
 577 static void b43_time_lock(struct b43_wldev *dev)
 578 {
 579         u32 macctl;
 580
 581         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 582         macctl |= B43_MACCTL_TBTTHOLD;
 583         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 584         /* Commit the write */
 585         b43_read32(dev, B43_MMIO_MACCTL);
 586 }
 587
 588 static void b43_time_unlock(struct b43_wldev *dev)
 589 {
 590         u32 macctl;
 591
 592         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 593         macctl &= ~B43_MACCTL_TBTTHOLD;
 594         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 595         /* Commit the write */
 596         b43_read32(dev, B43_MMIO_MACCTL);
 597 }
 598
 599 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 600 {
 601         /* Be careful with the in-progress timer.
 602          * First zero out the low register, so we have a full
 603          * register-overflow duration to complete the operation.
 604          */
 605         if (dev->dev->id.revision >= 3) {
 606                 u32 lo = (tsf & 0x00000000FFFFFFFFULL);
 607                 u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
 608
 609                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
 610                 mmiowb();
 611                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
 612                 mmiowb();
 613                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
 614         } else {
 615                 u16 v0 = (tsf & 0x000000000000FFFFULL);
 616                 u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
 617                 u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
 618                 u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
 619
 620                 b43_write16(dev, B43_MMIO_TSF_0, 0);
 621                 mmiowb();
 622                 b43_write16(dev, B43_MMIO_TSF_3, v3);
 623                 mmiowb();
 624                 b43_write16(dev, B43_MMIO_TSF_2, v2);
 625                 mmiowb();
 626                 b43_write16(dev, B43_MMIO_TSF_1, v1);
 627                 mmiowb();
 628                 b43_write16(dev, B43_MMIO_TSF_0, v0);
 629         }
 630 }
 631
 632 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 633 {
 634         b43_time_lock(dev);
 635         b43_tsf_write_locked(dev, tsf);
 636         b43_time_unlock(dev);
 637 }
 638
 639 static
 640 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
 641 {
 642         static const u8 zero_addr[ETH_ALEN] = { 0 };
 643         u16 data;
 644
 645         if (!mac)
 646                 mac = zero_addr;
 647
 648         offset |= 0x0020;
 649         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 650
 651         data = mac[0];
 652         data |= mac[1] << 8;
 653         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 654         data = mac[2];
 655         data |= mac[3] << 8;
 656         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 657         data = mac[4];
 658         data |= mac[5] << 8;
 659         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 660 }
 661
 662 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 663 {
 664         const u8 *mac;
 665         const u8 *bssid;
 666         u8 mac_bssid[ETH_ALEN * 2];
 667         int i;
 668         u32 tmp;
 669
 670         bssid = dev->wl->bssid;
 671         mac = dev->wl->mac_addr;
 672
 673         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 674
 675         memcpy(mac_bssid, mac, ETH_ALEN);
 676         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 677
 678         /* Write our MAC address and BSSID to template ram */
 679         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 680                 tmp = (u32) (mac_bssid[i + 0]);
 681                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 682                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 683                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 684                 b43_ram_write(dev, 0x20 + i, tmp);
 685         }
 686 }
 687
 688 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 689 {
 690         b43_write_mac_bssid_templates(dev);
 691         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 692 }
 693
 694 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 695 {
 696         /* slot_time is in usec. */
 697         if (dev->phy.type != B43_PHYTYPE_G)
 698                 return;
 699         b43_write16(dev, 0x684, 510 + slot_time);
 700         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 701 }
 702
 703 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 704 {
 705         b43_set_slot_time(dev, 9);
 706         dev->short_slot = 1;
 707 }
 708
 709 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 710 {
 711         b43_set_slot_time(dev, 20);
 712         dev->short_slot = 0;
 713 }
 714
 715 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
 716  * Returns the _previously_ enabled IRQ mask.
 717  */
 718 static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
 719 {
 720         u32 old_mask;
 721
 722         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 723         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
 724
 725         return old_mask;
 726 }
 727
 728 /* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
 729  * Returns the _previously_ enabled IRQ mask.
 730  */
 731 static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
 732 {
 733         u32 old_mask;
 734
 735         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 736         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
 737
 738         return old_mask;
 739 }
 740
 741 /* Synchronize IRQ top- and bottom-half.
 742  * IRQs must be masked before calling this.
 743  * This must not be called with the irq_lock held.
 744  */
 745 static void b43_synchronize_irq(struct b43_wldev *dev)
 746 {
 747         synchronize_irq(dev->dev->irq);
 748         tasklet_kill(&dev->isr_tasklet);
 749 }
 750
 751 /* DummyTransmission function, as documented on
 752  * http://bcm-specs.sipsolutions.net/DummyTransmission
 753  */
 754 void b43_dummy_transmission(struct b43_wldev *dev)
 755 {
 756         struct b43_wl *wl = dev->wl;
 757         struct b43_phy *phy = &dev->phy;
 758         unsigned int i, max_loop;
 759         u16 value;
 760         u32 buffer[5] = {
 761                 0x00000000,
 762                 0x00D40000,
 763                 0x00000000,
 764                 0x01000000,
 765                 0x00000000,
 766         };
 767
 768         switch (phy->type) {
 769         case B43_PHYTYPE_A:
 770                 max_loop = 0x1E;
 771                 buffer[0] = 0x000201CC;
 772                 break;
 773         case B43_PHYTYPE_B:
 774         case B43_PHYTYPE_G:
 775                 max_loop = 0xFA;
 776                 buffer[0] = 0x000B846E;
 777                 break;
 778         default:
 779                 B43_WARN_ON(1);
 780                 return;
 781         }
 782
 783         spin_lock_irq(&wl->irq_lock);
 784         write_lock(&wl->tx_lock);
 785
 786         for (i = 0; i < 5; i++)
 787                 b43_ram_write(dev, i * 4, buffer[i]);
 788
 789         /* Commit writes */
 790         b43_read32(dev, B43_MMIO_MACCTL);
 791
 792         b43_write16(dev, 0x0568, 0x0000);
 793         b43_write16(dev, 0x07C0, 0x0000);
 794         value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
 795         b43_write16(dev, 0x050C, value);
 796         b43_write16(dev, 0x0508, 0x0000);
 797         b43_write16(dev, 0x050A, 0x0000);
 798         b43_write16(dev, 0x054C, 0x0000);
 799         b43_write16(dev, 0x056A, 0x0014);
 800         b43_write16(dev, 0x0568, 0x0826);
 801         b43_write16(dev, 0x0500, 0x0000);
 802         b43_write16(dev, 0x0502, 0x0030);
 803
 804         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 805                 b43_radio_write16(dev, 0x0051, 0x0017);
 806         for (i = 0x00; i < max_loop; i++) {
 807                 value = b43_read16(dev, 0x050E);
 808                 if (value & 0x0080)
 809                         break;
 810                 udelay(10);
 811         }
 812         for (i = 0x00; i < 0x0A; i++) {
 813                 value = b43_read16(dev, 0x050E);
 814                 if (value & 0x0400)
 815                         break;
 816                 udelay(10);
 817         }
 818         for (i = 0x00; i < 0x0A; i++) {
 819                 value = b43_read16(dev, 0x0690);
 820                 if (!(value & 0x0100))
 821                         break;
 822                 udelay(10);
 823         }
 824         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 825                 b43_radio_write16(dev, 0x0051, 0x0037);
 826
 827         write_unlock(&wl->tx_lock);
 828         spin_unlock_irq(&wl->irq_lock);
 829 }
 830
 831 static void key_write(struct b43_wldev *dev,
 832                       u8 index, u8 algorithm, const u8 * key)
 833 {
 834         unsigned int i;
 835         u32 offset;
 836         u16 value;
 837         u16 kidx;
 838
 839         /* Key index/algo block */
 840         kidx = b43_kidx_to_fw(dev, index);
 841         value = ((kidx << 4) | algorithm);
 842         b43_shm_write16(dev, B43_SHM_SHARED,
 843                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 844
 845         /* Write the key to the Key Table Pointer offset */
 846         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 847         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 848                 value = key[i];
 849                 value |= (u16) (key[i + 1]) << 8;
 850                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 851         }
 852 }
 853
 854 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
 855 {
 856         u32 addrtmp[2] = { 0, 0, };
 857         u8 per_sta_keys_start = 8;
 858
 859         if (b43_new_kidx_api(dev))
 860                 per_sta_keys_start = 4;
 861
 862         B43_WARN_ON(index < per_sta_keys_start);
 863         /* We have two default TX keys and possibly two default RX keys.
 864          * Physical mac 0 is mapped to physical key 4 or 8, depending
 865          * on the firmware version.
 866          * So we must adjust the index here.
 867          */
 868         index -= per_sta_keys_start;
 869
 870         if (addr) {
 871                 addrtmp[0] = addr[0];
 872                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 873                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 874                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 875                 addrtmp[1] = addr[4];
 876                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 877         }
 878
 879         if (dev->dev->id.revision >= 5) {
 880                 /* Receive match transmitter address mechanism */
 881                 b43_shm_write32(dev, B43_SHM_RCMTA,
 882                                 (index * 2) + 0, addrtmp[0]);
 883                 b43_shm_write16(dev, B43_SHM_RCMTA,
 884                                 (index * 2) + 1, addrtmp[1]);
 885         } else {
 886                 /* RXE (Receive Engine) and
 887                  * PSM (Programmable State Machine) mechanism
 888                  */
 889                 if (index < 8) {
 890                         /* TODO write to RCM 16, 19, 22 and 25 */
 891                 } else {
 892                         b43_shm_write32(dev, B43_SHM_SHARED,
 893                                         B43_SHM_SH_PSM + (index * 6) + 0,
 894                                         addrtmp[0]);
 895                         b43_shm_write16(dev, B43_SHM_SHARED,
 896                                         B43_SHM_SH_PSM + (index * 6) + 4,
 897                                         addrtmp[1]);
 898                 }
 899         }
 900 }
 901
 902 static void do_key_write(struct b43_wldev *dev,
 903                          u8 index, u8 algorithm,
 904                          const u8 * key, size_t key_len, const u8 * mac_addr)
 905 {
 906         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 907         u8 per_sta_keys_start = 8;
 908
 909         if (b43_new_kidx_api(dev))
 910                 per_sta_keys_start = 4;
 911
 912         B43_WARN_ON(index >= dev->max_nr_keys);
 913         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 914
 915         if (index >= per_sta_keys_start)
 916                 keymac_write(dev, index, NULL); /* First zero out mac. */
 917         if (key)
 918                 memcpy(buf, key, key_len);
 919         key_write(dev, index, algorithm, buf);
 920         if (index >= per_sta_keys_start)
 921                 keymac_write(dev, index, mac_addr);
 922
 923         dev->key[index].algorithm = algorithm;
 924 }
 925
 926 static int b43_key_write(struct b43_wldev *dev,
 927                          int index, u8 algorithm,
 928                          const u8 * key, size_t key_len,
 929                          const u8 * mac_addr,
 930                          struct ieee80211_key_conf *keyconf)
 931 {
 932         int i;
 933         int sta_keys_start;
 934
 935         if (key_len > B43_SEC_KEYSIZE)
 936                 return -EINVAL;
 937         for (i = 0; i < dev->max_nr_keys; i++) {
 938                 /* Check that we don't already have this key. */
 939                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 940         }
 941         if (index < 0) {
 942                 /* Either pairwise key or address is 00:00:00:00:00:00
 943                  * for transmit-only keys. Search the index. */
 944                 if (b43_new_kidx_api(dev))
 945                         sta_keys_start = 4;
 946                 else
 947                         sta_keys_start = 8;
 948                 for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
 949                         if (!dev->key[i].keyconf) {
 950                                 /* found empty */
 951                                 index = i;
 952                                 break;
 953                         }
 954                 }
 955                 if (index < 0) {
 956                         b43err(dev->wl, "Out of hardware key memory\n");
 957                         return -ENOSPC;
 958                 }
 959         } else
 960                 B43_WARN_ON(index > 3);
 961
 962         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 963         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 964                 /* Default RX key */
 965                 B43_WARN_ON(mac_addr);
 966                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 967         }
 968         keyconf->hw_key_idx = index;
 969         dev->key[index].keyconf = keyconf;
 970
 971         return 0;
 972 }
 973
 974 static int b43_key_clear(struct b43_wldev *dev, int index)
 975 {
 976         if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
 977                 return -EINVAL;
 978         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 979                      NULL, B43_SEC_KEYSIZE, NULL);
 980         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 981                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 982                              NULL, B43_SEC_KEYSIZE, NULL);
 983         }
 984         dev->key[index].keyconf = NULL;
 985
 986         return 0;
 987 }
 988
 989 static void b43_clear_keys(struct b43_wldev *dev)
 990 {
 991         int i;
 992
 993         for (i = 0; i < dev->max_nr_keys; i++)
 994                 b43_key_clear(dev, i);
 995 }
 996
 997 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 998 {
 999         u32 macctl;
1000         u16 ucstat;
1001         bool hwps;
1002         bool awake;
1003         int i;
1004
1005         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1006                     (ps_flags & B43_PS_DISABLED));
1007         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1008
1009         if (ps_flags & B43_PS_ENABLED) {
1010                 hwps = 1;
1011         } else if (ps_flags & B43_PS_DISABLED) {
1012                 hwps = 0;
1013         } else {
1014                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1015                 //      and thus is not an AP and we are associated, set bit 25
1016         }
1017         if (ps_flags & B43_PS_AWAKE) {
1018                 awake = 1;
1019         } else if (ps_flags & B43_PS_ASLEEP) {
1020                 awake = 0;
1021         } else {
1022                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1023                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1024                 //      successful, set bit26
1025         }
1026
1027 /* FIXME: For now we force awake-on and hwps-off */
1028         hwps = 0;
1029         awake = 1;
1030
1031         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1032         if (hwps)
1033                 macctl |= B43_MACCTL_HWPS;
1034         else
1035                 macctl &= ~B43_MACCTL_HWPS;
1036         if (awake)
1037                 macctl |= B43_MACCTL_AWAKE;
1038         else
1039                 macctl &= ~B43_MACCTL_AWAKE;
1040         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1041         /* Commit write */
1042         b43_read32(dev, B43_MMIO_MACCTL);
1043         if (awake && dev->dev->id.revision >= 5) {
1044                 /* Wait for the microcode to wake up. */
1045                 for (i = 0; i < 100; i++) {
1046                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1047                                                 B43_SHM_SH_UCODESTAT);
1048                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1049                                 break;
1050                         udelay(10);
1051                 }
1052         }
1053 }
1054
1055 /* Turn the Analog ON/OFF */
1056 static void b43_switch_analog(struct b43_wldev *dev, int on)
1057 {
1058         switch (dev->phy.type) {
1059         case B43_PHYTYPE_A:
1060         case B43_PHYTYPE_G:
1061                 b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
1062                 break;
1063         case B43_PHYTYPE_N:
1064                 b43_phy_write(dev, B43_NPHY_AFECTL_OVER,
1065                               on ? 0 : 0x7FFF);
1066                 break;
1067         default:
1068                 B43_WARN_ON(1);
1069         }
1070 }
1071
1072 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1073 {
1074         u32 tmslow;
1075         u32 macctl;
1076
1077         flags |= B43_TMSLOW_PHYCLKEN;
1078         flags |= B43_TMSLOW_PHYRESET;
1079         ssb_device_enable(dev->dev, flags);
1080         msleep(2);              /* Wait for the PLL to turn on. */
1081
1082         /* Now take the PHY out of Reset again */
1083         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1084         tmslow |= SSB_TMSLOW_FGC;
1085         tmslow &= ~B43_TMSLOW_PHYRESET;
1086         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1087         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1088         msleep(1);
1089         tmslow &= ~SSB_TMSLOW_FGC;
1090         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1091         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1092         msleep(1);
1093
1094         /* Turn Analog ON */
1095         b43_switch_analog(dev, 1);
1096
1097         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1098         macctl &= ~B43_MACCTL_GMODE;
1099         if (flags & B43_TMSLOW_GMODE)
1100                 macctl |= B43_MACCTL_GMODE;
1101         macctl |= B43_MACCTL_IHR_ENABLED;
1102         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1103 }
1104
1105 static void handle_irq_transmit_status(struct b43_wldev *dev)
1106 {
1107         u32 v0, v1;
1108         u16 tmp;
1109         struct b43_txstatus stat;
1110
1111         while (1) {
1112                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1113                 if (!(v0 & 0x00000001))
1114                         break;
1115                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1116
1117                 stat.cookie = (v0 >> 16);
1118                 stat.seq = (v1 & 0x0000FFFF);
1119                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1120                 tmp = (v0 & 0x0000FFFF);
1121                 stat.frame_count = ((tmp & 0xF000) >> 12);
1122                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1123                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1124                 stat.pm_indicated = !!(tmp & 0x0080);
1125                 stat.intermediate = !!(tmp & 0x0040);
1126                 stat.for_ampdu = !!(tmp & 0x0020);
1127                 stat.acked = !!(tmp & 0x0002);
1128
1129                 b43_handle_txstatus(dev, &stat);
1130         }
1131 }
1132
1133 static void drain_txstatus_queue(struct b43_wldev *dev)
1134 {
1135         u32 dummy;
1136
1137         if (dev->dev->id.revision < 5)
1138                 return;
1139         /* Read all entries from the microcode TXstatus FIFO
1140          * and throw them away.
1141          */
1142         while (1) {
1143                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1144                 if (!(dummy & 0x00000001))
1145                         break;
1146                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1147         }
1148 }
1149
1150 static u32 b43_jssi_read(struct b43_wldev *dev)
1151 {
1152         u32 val = 0;
1153
1154         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1155         val <<= 16;
1156         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1157
1158         return val;
1159 }
1160
1161 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1162 {
1163         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1164         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1165 }
1166
1167 static void b43_generate_noise_sample(struct b43_wldev *dev)
1168 {
1169         b43_jssi_write(dev, 0x7F7F7F7F);
1170         b43_write32(dev, B43_MMIO_MACCMD,
1171                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1172 }
1173
1174 static void b43_calculate_link_quality(struct b43_wldev *dev)
1175 {
1176         /* Top half of Link Quality calculation. */
1177
1178         if (dev->noisecalc.calculation_running)
1179                 return;
1180         dev->noisecalc.calculation_running = 1;
1181         dev->noisecalc.nr_samples = 0;
1182
1183         b43_generate_noise_sample(dev);
1184 }
1185
1186 static void handle_irq_noise(struct b43_wldev *dev)
1187 {
1188         struct b43_phy *phy = &dev->phy;
1189         u16 tmp;
1190         u8 noise[4];
1191         u8 i, j;
1192         s32 average;
1193
1194         /* Bottom half of Link Quality calculation. */
1195
1196         /* Possible race condition: It might be possible that the user
1197          * changed to a different channel in the meantime since we
1198          * started the calculation. We ignore that fact, since it's
1199          * not really that much of a problem. The background noise is
1200          * an estimation only anyway. Slightly wrong results will get damped
1201          * by the averaging of the 8 sample rounds. Additionally the
1202          * value is shortlived. So it will be replaced by the next noise
1203          * calculation round soon. */
1204
1205         B43_WARN_ON(!dev->noisecalc.calculation_running);
1206         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1207         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1208             noise[2] == 0x7F || noise[3] == 0x7F)
1209                 goto generate_new;
1210
1211         /* Get the noise samples. */
1212         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1213         i = dev->noisecalc.nr_samples;
1214         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1215         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1216         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1217         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1218         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1219         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1220         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1221         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1222         dev->noisecalc.nr_samples++;
1223         if (dev->noisecalc.nr_samples == 8) {
1224                 /* Calculate the Link Quality by the noise samples. */
1225                 average = 0;
1226                 for (i = 0; i < 8; i++) {
1227                         for (j = 0; j < 4; j++)
1228                                 average += dev->noisecalc.samples[i][j];
1229                 }
1230                 average /= (8 * 4);
1231                 average *= 125;
1232                 average += 64;
1233                 average /= 128;
1234                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1235                 tmp = (tmp / 128) & 0x1F;
1236                 if (tmp >= 8)
1237                         average += 2;
1238                 else
1239                         average -= 25;
1240                 if (tmp == 8)
1241                         average -= 72;
1242                 else
1243                         average -= 48;
1244
1245                 dev->stats.link_noise = average;
1246                 dev->noisecalc.calculation_running = 0;
1247                 return;
1248         }
1249 generate_new:
1250         b43_generate_noise_sample(dev);
1251 }
1252
1253 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1254 {
1255         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP)) {
1256                 ///TODO: PS TBTT
1257         } else {
1258                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1259                         b43_power_saving_ctl_bits(dev, 0);
1260         }
1261         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
1262                 dev->dfq_valid = 1;
1263 }
1264
1265 static void handle_irq_atim_end(struct b43_wldev *dev)
1266 {
1267         if (dev->dfq_valid) {
1268                 b43_write32(dev, B43_MMIO_MACCMD,
1269                             b43_read32(dev, B43_MMIO_MACCMD)
1270                             | B43_MACCMD_DFQ_VALID);
1271                 dev->dfq_valid = 0;
1272         }
1273 }
1274
1275 static void handle_irq_pmq(struct b43_wldev *dev)
1276 {
1277         u32 tmp;
1278
1279         //TODO: AP mode.
1280
1281         while (1) {
1282                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1283                 if (!(tmp & 0x00000008))
1284                         break;
1285         }
1286         /* 16bit write is odd, but correct. */
1287         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1288 }
1289
1290 static void b43_write_template_common(struct b43_wldev *dev,
1291                                       const u8 * data, u16 size,
1292                                       u16 ram_offset,
1293                                       u16 shm_size_offset, u8 rate)
1294 {
1295         u32 i, tmp;
1296         struct b43_plcp_hdr4 plcp;
1297
1298         plcp.data = 0;
1299         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1300         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1301         ram_offset += sizeof(u32);
1302         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1303          * So leave the first two bytes of the next write blank.
1304          */
1305         tmp = (u32) (data[0]) << 16;
1306         tmp |= (u32) (data[1]) << 24;
1307         b43_ram_write(dev, ram_offset, tmp);
1308         ram_offset += sizeof(u32);
1309         for (i = 2; i < size; i += sizeof(u32)) {
1310                 tmp = (u32) (data[i + 0]);
1311                 if (i + 1 < size)
1312                         tmp |= (u32) (data[i + 1]) << 8;
1313                 if (i + 2 < size)
1314                         tmp |= (u32) (data[i + 2]) << 16;
1315                 if (i + 3 < size)
1316                         tmp |= (u32) (data[i + 3]) << 24;
1317                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1318         }
1319         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1320                         size + sizeof(struct b43_plcp_hdr6));
1321 }
1322
1323 /* Check if the use of the antenna that ieee80211 told us to
1324  * use is possible. This will fall back to DEFAULT.
1325  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1326 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1327                                   u8 antenna_nr)
1328 {
1329         u8 antenna_mask;
1330
1331         if (antenna_nr == 0) {
1332                 /* Zero means "use default antenna". That's always OK. */
1333                 return 0;
1334         }
1335
1336         /* Get the mask of available antennas. */
1337         if (dev->phy.gmode)
1338                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1339         else
1340                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1341
1342         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1343                 /* This antenna is not available. Fall back to default. */
1344                 return 0;
1345         }
1346
1347         return antenna_nr;
1348 }
1349
1350 static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
1351 {
1352         antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
1353         switch (antenna) {
1354         case 0:         /* default/diversity */
1355                 return B43_ANTENNA_DEFAULT;
1356         case 1:         /* Antenna 0 */
1357                 return B43_ANTENNA0;
1358         case 2:         /* Antenna 1 */
1359                 return B43_ANTENNA1;
1360         case 3:         /* Antenna 2 */
1361                 return B43_ANTENNA2;
1362         case 4:         /* Antenna 3 */
1363                 return B43_ANTENNA3;
1364         default:
1365                 return B43_ANTENNA_DEFAULT;
1366         }
1367 }
1368
1369 /* Convert a b43 antenna number value to the PHY TX control value. */
1370 static u16 b43_antenna_to_phyctl(int antenna)
1371 {
1372         switch (antenna) {
1373         case B43_ANTENNA0:
1374                 return B43_TXH_PHY_ANT0;
1375         case B43_ANTENNA1:
1376                 return B43_TXH_PHY_ANT1;
1377         case B43_ANTENNA2:
1378                 return B43_TXH_PHY_ANT2;
1379         case B43_ANTENNA3:
1380                 return B43_TXH_PHY_ANT3;
1381         case B43_ANTENNA_AUTO:
1382                 return B43_TXH_PHY_ANT01AUTO;
1383         }
1384         B43_WARN_ON(1);
1385         return 0;
1386 }
1387
1388 static void b43_write_beacon_template(struct b43_wldev *dev,
1389                                       u16 ram_offset,
1390                                       u16 shm_size_offset)
1391 {
1392         unsigned int i, len, variable_len;
1393         const struct ieee80211_mgmt *bcn;
1394         const u8 *ie;
1395         bool tim_found = 0;
1396         unsigned int rate;
1397         u16 ctl;
1398         int antenna;
1399         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1400
1401         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1402         len = min((size_t) dev->wl->current_beacon->len,
1403                   0x200 - sizeof(struct b43_plcp_hdr6));
1404         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1405
1406         b43_write_template_common(dev, (const u8 *)bcn,
1407                                   len, ram_offset, shm_size_offset, rate);
1408
1409         /* Write the PHY TX control parameters. */
1410         antenna = b43_antenna_from_ieee80211(dev, info->antenna_sel_tx);
1411         antenna = b43_antenna_to_phyctl(antenna);
1412         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1413         /* We can't send beacons with short preamble. Would get PHY errors. */
1414         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1415         ctl &= ~B43_TXH_PHY_ANT;
1416         ctl &= ~B43_TXH_PHY_ENC;
1417         ctl |= antenna;
1418         if (b43_is_cck_rate(rate))
1419                 ctl |= B43_TXH_PHY_ENC_CCK;
1420         else
1421                 ctl |= B43_TXH_PHY_ENC_OFDM;
1422         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1423
1424         /* Find the position of the TIM and the DTIM_period value
1425          * and write them to SHM. */
1426         ie = bcn->u.beacon.variable;
1427         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1428         for (i = 0; i < variable_len - 2; ) {
1429                 uint8_t ie_id, ie_len;
1430
1431                 ie_id = ie[i];
1432                 ie_len = ie[i + 1];
1433                 if (ie_id == 5) {
1434                         u16 tim_position;
1435                         u16 dtim_period;
1436                         /* This is the TIM Information Element */
1437
1438                         /* Check whether the ie_len is in the beacon data range. */
1439                         if (variable_len < ie_len + 2 + i)
1440                                 break;
1441                         /* A valid TIM is at least 4 bytes long. */
1442                         if (ie_len < 4)
1443                                 break;
1444                         tim_found = 1;
1445
1446                         tim_position = sizeof(struct b43_plcp_hdr6);
1447                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1448                         tim_position += i;
1449
1450                         dtim_period = ie[i + 3];
1451
1452                         b43_shm_write16(dev, B43_SHM_SHARED,
1453                                         B43_SHM_SH_TIMBPOS, tim_position);
1454                         b43_shm_write16(dev, B43_SHM_SHARED,
1455                                         B43_SHM_SH_DTIMPER, dtim_period);
1456                         break;
1457                 }
1458                 i += ie_len + 2;
1459         }
1460         if (!tim_found) {
1461                 /*
1462                  * If ucode wants to modify TIM do it behind the beacon, this
1463                  * will happen, for example, when doing mesh networking.
1464                  */
1465                 b43_shm_write16(dev, B43_SHM_SHARED,
1466                                 B43_SHM_SH_TIMBPOS,
1467                                 len + sizeof(struct b43_plcp_hdr6));
1468                 b43_shm_write16(dev, B43_SHM_SHARED,
1469                                 B43_SHM_SH_DTIMPER, 0);
1470         }
1471         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1472 }
1473
1474 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1475                                       u16 shm_offset, u16 size,
1476                                       struct ieee80211_rate *rate)
1477 {
1478         struct b43_plcp_hdr4 plcp;
1479         u32 tmp;
1480         __le16 dur;
1481
1482         plcp.data = 0;
1483         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1484         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1485                                                dev->wl->vif, size,
1486                                                rate);
1487         /* Write PLCP in two parts and timing for packet transfer */
1488         tmp = le32_to_cpu(plcp.data);
1489         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1490         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1491         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1492 }
1493
1494 /* Instead of using custom probe response template, this function
1495  * just patches custom beacon template by:
1496  * 1) Changing packet type
1497  * 2) Patching duration field
1498  * 3) Stripping TIM
1499  */
1500 static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1501                                           u16 *dest_size,
1502                                           struct ieee80211_rate *rate)
1503 {
1504         const u8 *src_data;
1505         u8 *dest_data;
1506         u16 src_size, elem_size, src_pos, dest_pos;
1507         __le16 dur;
1508         struct ieee80211_hdr *hdr;
1509         size_t ie_start;
1510
1511         src_size = dev->wl->current_beacon->len;
1512         src_data = (const u8 *)dev->wl->current_beacon->data;
1513
1514         /* Get the start offset of the variable IEs in the packet. */
1515         ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1516         B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1517
1518         if (B43_WARN_ON(src_size < ie_start))
1519                 return NULL;
1520
1521         dest_data = kmalloc(src_size, GFP_ATOMIC);
1522         if (unlikely(!dest_data))
1523                 return NULL;
1524
1525         /* Copy the static data and all Information Elements, except the TIM. */
1526         memcpy(dest_data, src_data, ie_start);
1527         src_pos = ie_start;
1528         dest_pos = ie_start;
1529         for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1530                 elem_size = src_data[src_pos + 1] + 2;
1531                 if (src_data[src_pos] == 5) {
1532                         /* This is the TIM. */
1533                         continue;
1534                 }
1535                 memcpy(dest_data + dest_pos, src_data + src_pos,
1536                        elem_size);
1537                 dest_pos += elem_size;
1538         }
1539         *dest_size = dest_pos;
1540         hdr = (struct ieee80211_hdr *)dest_data;
1541
1542         /* Set the frame control. */
1543         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1544                                          IEEE80211_STYPE_PROBE_RESP);
1545         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1546                                                dev->wl->vif, *dest_size,
1547                                                rate);
1548         hdr->duration_id = dur;
1549
1550         return dest_data;
1551 }
1552
1553 static void b43_write_probe_resp_template(struct b43_wldev *dev,
1554                                           u16 ram_offset,
1555                                           u16 shm_size_offset,
1556                                           struct ieee80211_rate *rate)
1557 {
1558         const u8 *probe_resp_data;
1559         u16 size;
1560
1561         size = dev->wl->current_beacon->len;
1562         probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1563         if (unlikely(!probe_resp_data))
1564                 return;
1565
1566         /* Looks like PLCP headers plus packet timings are stored for
1567          * all possible basic rates
1568          */
1569         b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1570         b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1571         b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1572         b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1573
1574         size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1575         b43_write_template_common(dev, probe_resp_data,
1576                                   size, ram_offset, shm_size_offset,
1577                                   rate->hw_value);
1578         kfree(probe_resp_data);
1579 }
1580
1581 static void b43_upload_beacon0(struct b43_wldev *dev)
1582 {
1583         struct b43_wl *wl = dev->wl;
1584
1585         if (wl->beacon0_uploaded)
1586                 return;
1587         b43_write_beacon_template(dev, 0x68, 0x18);
1588         /* FIXME: Probe resp upload doesn't really belong here,
1589          *        but we don't use that feature anyway. */
1590         b43_write_probe_resp_template(dev, 0x268, 0x4A,
1591                                       &__b43_ratetable[3]);
1592         wl->beacon0_uploaded = 1;
1593 }
1594
1595 static void b43_upload_beacon1(struct b43_wldev *dev)
1596 {
1597         struct b43_wl *wl = dev->wl;
1598
1599         if (wl->beacon1_uploaded)
1600                 return;
1601         b43_write_beacon_template(dev, 0x468, 0x1A);
1602         wl->beacon1_uploaded = 1;
1603 }
1604
1605 static void handle_irq_beacon(struct b43_wldev *dev)
1606 {
1607         struct b43_wl *wl = dev->wl;
1608         u32 cmd, beacon0_valid, beacon1_valid;
1609
1610         if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP) &&
1611             !b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
1612                 return;
1613
1614         /* This is the bottom half of the asynchronous beacon update. */
1615
1616         /* Ignore interrupt in the future. */
1617         dev->irq_savedstate &= ~B43_IRQ_BEACON;
1618
1619         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1620         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1621         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1622
1623         /* Schedule interrupt manually, if busy. */
1624         if (beacon0_valid && beacon1_valid) {
1625                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1626                 dev->irq_savedstate |= B43_IRQ_BEACON;
1627                 return;
1628         }
1629
1630         if (unlikely(wl->beacon_templates_virgin)) {
1631                 /* We never uploaded a beacon before.
1632                  * Upload both templates now, but only mark one valid. */
1633                 wl->beacon_templates_virgin = 0;
1634                 b43_upload_beacon0(dev);
1635                 b43_upload_beacon1(dev);
1636                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1637                 cmd |= B43_MACCMD_BEACON0_VALID;
1638                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1639         } else {
1640                 if (!beacon0_valid) {
1641                         b43_upload_beacon0(dev);
1642                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1643                         cmd |= B43_MACCMD_BEACON0_VALID;
1644                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1645                 } else if (!beacon1_valid) {
1646                         b43_upload_beacon1(dev);
1647                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1648                         cmd |= B43_MACCMD_BEACON1_VALID;
1649                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1650                 }
1651         }
1652 }
1653
1654 static void b43_beacon_update_trigger_work(struct work_struct *work)
1655 {
1656         struct b43_wl *wl = container_of(work, struct b43_wl,
1657                                          beacon_update_trigger);
1658         struct b43_wldev *dev;
1659
1660         mutex_lock(&wl->mutex);
1661         dev = wl->current_dev;
1662         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1663                 spin_lock_irq(&wl->irq_lock);
1664                 /* update beacon right away or defer to irq */
1665                 dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1666                 handle_irq_beacon(dev);
1667                 /* The handler might have updated the IRQ mask. */
1668                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1669                             dev->irq_savedstate);
1670                 mmiowb();
1671                 spin_unlock_irq(&wl->irq_lock);
1672         }
1673         mutex_unlock(&wl->mutex);
1674 }
1675
1676 /* Asynchronously update the packet templates in template RAM.
1677  * Locking: Requires wl->irq_lock to be locked. */
1678 static void b43_update_templates(struct b43_wl *wl, struct sk_buff *beacon)
1679 {
1680         /* This is the top half of the ansynchronous beacon update.
1681          * The bottom half is the beacon IRQ.
1682          * Beacon update must be asynchronous to avoid sending an
1683          * invalid beacon. This can happen for example, if the firmware
1684          * transmits a beacon while we are updating it. */
1685
1686         if (wl->current_beacon)
1687                 dev_kfree_skb_any(wl->current_beacon);
1688         wl->current_beacon = beacon;
1689         wl->beacon0_uploaded = 0;
1690         wl->beacon1_uploaded = 0;
1691         queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1692 }
1693
1694 static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
1695 {
1696         u32 tmp;
1697         u16 i, len;
1698
1699         len = min((u16) ssid_len, (u16) 0x100);
1700         for (i = 0; i < len; i += sizeof(u32)) {
1701                 tmp = (u32) (ssid[i + 0]);
1702                 if (i + 1 < len)
1703                         tmp |= (u32) (ssid[i + 1]) << 8;
1704                 if (i + 2 < len)
1705                         tmp |= (u32) (ssid[i + 2]) << 16;
1706                 if (i + 3 < len)
1707                         tmp |= (u32) (ssid[i + 3]) << 24;
1708                 b43_shm_write32(dev, B43_SHM_SHARED, 0x380 + i, tmp);
1709         }
1710         b43_shm_write16(dev, B43_SHM_SHARED, 0x48, len);
1711 }
1712
1713 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1714 {
1715         b43_time_lock(dev);
1716         if (dev->dev->id.revision >= 3) {
1717                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1718                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1719         } else {
1720                 b43_write16(dev, 0x606, (beacon_int >> 6));
1721                 b43_write16(dev, 0x610, beacon_int);
1722         }
1723         b43_time_unlock(dev);
1724         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1725 }
1726
1727 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1728 {
1729         u16 reason;
1730
1731         /* Read the register that contains the reason code for the panic. */
1732         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1733         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1734
1735         switch (reason) {
1736         default:
1737                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1738                 /* fallthrough */
1739         case B43_FWPANIC_DIE:
1740                 /* Do not restart the controller or firmware.
1741                  * The device is nonfunctional from now on.
1742                  * Restarting would result in this panic to trigger again,
1743                  * so we avoid that recursion. */
1744                 break;
1745         case B43_FWPANIC_RESTART:
1746                 b43_controller_restart(dev, "Microcode panic");
1747                 break;
1748         }
1749 }
1750
1751 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1752 {
1753         unsigned int i, cnt;
1754         u16 reason, marker_id, marker_line;
1755         __le16 *buf;
1756
1757         /* The proprietary firmware doesn't have this IRQ. */
1758         if (!dev->fw.opensource)
1759                 return;
1760
1761         /* Read the register that contains the reason code for this IRQ. */
1762         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1763
1764         switch (reason) {
1765         case B43_DEBUGIRQ_PANIC:
1766                 b43_handle_firmware_panic(dev);
1767                 break;
1768         case B43_DEBUGIRQ_DUMP_SHM:
1769                 if (!B43_DEBUG)
1770                         break; /* Only with driver debugging enabled. */
1771                 buf = kmalloc(4096, GFP_ATOMIC);
1772                 if (!buf) {
1773                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1774                         goto out;
1775                 }
1776                 for (i = 0; i < 4096; i += 2) {
1777                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1778                         buf[i / 2] = cpu_to_le16(tmp);
1779                 }
1780                 b43info(dev->wl, "Shared memory dump:\n");
1781                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1782                                16, 2, buf, 4096, 1);
1783                 kfree(buf);
1784                 break;
1785         case B43_DEBUGIRQ_DUMP_REGS:
1786                 if (!B43_DEBUG)
1787                         break; /* Only with driver debugging enabled. */
1788                 b43info(dev->wl, "Microcode register dump:\n");
1789                 for (i = 0, cnt = 0; i < 64; i++) {
1790                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1791                         if (cnt == 0)
1792                                 printk(KERN_INFO);
1793                         printk("r%02u: 0x%04X  ", i, tmp);
1794                         cnt++;
1795                         if (cnt == 6) {
1796                                 printk("\n");
1797                                 cnt = 0;
1798                         }
1799                 }
1800                 printk("\n");
1801                 break;
1802         case B43_DEBUGIRQ_MARKER:
1803                 if (!B43_DEBUG)
1804                         break; /* Only with driver debugging enabled. */
1805                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1806                                            B43_MARKER_ID_REG);
1807                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1808                                              B43_MARKER_LINE_REG);
1809                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1810                         "at line number %u\n",
1811                         marker_id, marker_line);
1812                 break;
1813         default:
1814                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1815                        reason);
1816         }
1817 out:
1818         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1819         b43_shm_write16(dev, B43_SHM_SCRATCH,
1820                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1821 }
1822
1823 /* Interrupt handler bottom-half */
1824 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1825 {
1826         u32 reason;
1827         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1828         u32 merged_dma_reason = 0;
1829         int i;
1830         unsigned long flags;
1831
1832         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1833
1834         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1835
1836         reason = dev->irq_reason;
1837         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1838                 dma_reason[i] = dev->dma_reason[i];
1839                 merged_dma_reason |= dma_reason[i];
1840         }
1841
1842         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1843                 b43err(dev->wl, "MAC transmission error\n");
1844
1845         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1846                 b43err(dev->wl, "PHY transmission error\n");
1847                 rmb();
1848                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1849                         atomic_set(&dev->phy.txerr_cnt,
1850                                    B43_PHY_TX_BADNESS_LIMIT);
1851                         b43err(dev->wl, "Too many PHY TX errors, "
1852                                         "restarting the controller\n");
1853                         b43_controller_restart(dev, "PHY TX errors");
1854                 }
1855         }
1856
1857         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1858                                           B43_DMAIRQ_NONFATALMASK))) {
1859                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1860                         b43err(dev->wl, "Fatal DMA error: "
1861                                "0x%08X, 0x%08X, 0x%08X, "
1862                                "0x%08X, 0x%08X, 0x%08X\n",
1863                                dma_reason[0], dma_reason[1],
1864                                dma_reason[2], dma_reason[3],
1865                                dma_reason[4], dma_reason[5]);
1866                         b43_controller_restart(dev, "DMA error");
1867                         mmiowb();
1868                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1869                         return;
1870                 }
1871                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1872                         b43err(dev->wl, "DMA error: "
1873                                "0x%08X, 0x%08X, 0x%08X, "
1874                                "0x%08X, 0x%08X, 0x%08X\n",
1875                                dma_reason[0], dma_reason[1],
1876                                dma_reason[2], dma_reason[3],
1877                                dma_reason[4], dma_reason[5]);
1878                 }
1879         }
1880
1881         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1882                 handle_irq_ucode_debug(dev);
1883         if (reason & B43_IRQ_TBTT_INDI)
1884                 handle_irq_tbtt_indication(dev);
1885         if (reason & B43_IRQ_ATIM_END)
1886                 handle_irq_atim_end(dev);
1887         if (reason & B43_IRQ_BEACON)
1888                 handle_irq_beacon(dev);
1889         if (reason & B43_IRQ_PMQ)
1890                 handle_irq_pmq(dev);
1891         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1892                 ;/* TODO */
1893         if (reason & B43_IRQ_NOISESAMPLE_OK)
1894                 handle_irq_noise(dev);
1895
1896         /* Check the DMA reason registers for received data. */
1897         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1898                 if (b43_using_pio_transfers(dev))
1899                         b43_pio_rx(dev->pio.rx_queue);
1900                 else
1901                         b43_dma_rx(dev->dma.rx_ring);
1902         }
1903         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1904         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1905         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1906         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1907         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1908
1909         if (reason & B43_IRQ_TX_OK)
1910                 handle_irq_transmit_status(dev);
1911
1912         b43_interrupt_enable(dev, dev->irq_savedstate);
1913         mmiowb();
1914         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1915 }
1916
1917 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1918 {
1919         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1920
1921         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1922         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1923         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1924         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1925         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1926         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1927 }
1928
1929 /* Interrupt handler top-half */
1930 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1931 {
1932         irqreturn_t ret = IRQ_NONE;
1933         struct b43_wldev *dev = dev_id;
1934         u32 reason;
1935
1936         if (!dev)
1937                 return IRQ_NONE;
1938
1939         spin_lock(&dev->wl->irq_lock);
1940
1941         if (b43_status(dev) < B43_STAT_STARTED)
1942                 goto out;
1943         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1944         if (reason == 0xffffffff)       /* shared IRQ */
1945                 goto out;
1946         ret = IRQ_HANDLED;
1947         reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1948         if (!reason)
1949                 goto out;
1950
1951         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1952             & 0x0001DC00;
1953         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1954             & 0x0000DC00;
1955         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1956             & 0x0000DC00;
1957         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1958             & 0x0001DC00;
1959         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1960             & 0x0000DC00;
1961         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1962             & 0x0000DC00;
1963
1964         b43_interrupt_ack(dev, reason);
1965         /* disable all IRQs. They are enabled again in the bottom half. */
1966         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1967         /* save the reason code and call our bottom half. */
1968         dev->irq_reason = reason;
1969         tasklet_schedule(&dev->isr_tasklet);
1970       out:
1971         mmiowb();
1972         spin_unlock(&dev->wl->irq_lock);
1973
1974         return ret;
1975 }
1976
1977 static void do_release_fw(struct b43_firmware_file *fw)
1978 {
1979         release_firmware(fw->data);
1980         fw->data = NULL;
1981         fw->filename = NULL;
1982 }
1983
1984 static void b43_release_firmware(struct b43_wldev *dev)
1985 {
1986         do_release_fw(&dev->fw.ucode);
1987         do_release_fw(&dev->fw.pcm);
1988         do_release_fw(&dev->fw.initvals);
1989         do_release_fw(&dev->fw.initvals_band);
1990 }
1991
1992 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1993 {
1994         const char *text;
1995
1996         text = "You must go to "
1997                "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1998                "and download the latest firmware (version 4).\n";
1999         if (error)
2000                 b43err(wl, text);
2001         else
2002                 b43warn(wl, text);
2003 }
2004
2005 static int do_request_fw(struct b43_wldev *dev,
2006                          const char *name,
2007                          struct b43_firmware_file *fw,
2008                          bool silent)
2009 {
2010         char path[sizeof(modparam_fwpostfix) + 32];
2011         const struct firmware *blob;
2012         struct b43_fw_header *hdr;
2013         u32 size;
2014         int err;
2015
2016         if (!name) {
2017                 /* Don't fetch anything. Free possibly cached firmware. */
2018                 do_release_fw(fw);
2019                 return 0;
2020         }
2021         if (fw->filename) {
2022                 if (strcmp(fw->filename, name) == 0)
2023                         return 0; /* Already have this fw. */
2024                 /* Free the cached firmware first. */
2025                 do_release_fw(fw);
2026         }
2027
2028         snprintf(path, ARRAY_SIZE(path),
2029                  "b43%s/%s.fw",
2030                  modparam_fwpostfix, name);
2031         err = request_firmware(&blob, path, dev->dev->dev);
2032         if (err == -ENOENT) {
2033                 if (!silent) {
2034                         b43err(dev->wl, "Firmware file \"%s\" not found\n",
2035                                path);
2036                 }
2037                 return err;
2038         } else if (err) {
2039                 b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
2040                        path, err);
2041                 return err;
2042         }
2043         if (blob->size < sizeof(struct b43_fw_header))
2044                 goto err_format;
2045         hdr = (struct b43_fw_header *)(blob->data);
2046         switch (hdr->type) {
2047         case B43_FW_TYPE_UCODE:
2048         case B43_FW_TYPE_PCM:
2049                 size = be32_to_cpu(hdr->size);
2050                 if (size != blob->size - sizeof(struct b43_fw_header))
2051                         goto err_format;
2052                 /* fallthrough */
2053         case B43_FW_TYPE_IV:
2054                 if (hdr->ver != 1)
2055                         goto err_format;
2056                 break;
2057         default:
2058                 goto err_format;
2059         }
2060
2061         fw->data = blob;
2062         fw->filename = name;
2063
2064         return 0;
2065
2066 err_format:
2067         b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2068         release_firmware(blob);
2069
2070         return -EPROTO;
2071 }
2072
2073 static int b43_request_firmware(struct b43_wldev *dev)
2074 {
2075         struct b43_firmware *fw = &dev->fw;
2076         const u8 rev = dev->dev->id.revision;
2077         const char *filename;
2078         u32 tmshigh;
2079         int err;
2080
2081         /* Get microcode */
2082         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2083         if ((rev >= 5) && (rev <= 10))
2084                 filename = "ucode5";
2085         else if ((rev >= 11) && (rev <= 12))
2086                 filename = "ucode11";
2087         else if (rev >= 13)
2088                 filename = "ucode13";
2089         else
2090                 goto err_no_ucode;
2091         err = do_request_fw(dev, filename, &fw->ucode, 0);
2092         if (err)
2093                 goto err_load;
2094
2095         /* Get PCM code */
2096         if ((rev >= 5) && (rev <= 10))
2097                 filename = "pcm5";
2098         else if (rev >= 11)
2099                 filename = NULL;
2100         else
2101                 goto err_no_pcm;
2102         fw->pcm_request_failed = 0;
2103         err = do_request_fw(dev, filename, &fw->pcm, 1);
2104         if (err == -ENOENT) {
2105                 /* We did not find a PCM file? Not fatal, but
2106                  * core rev <= 10 must do without hwcrypto then. */
2107                 fw->pcm_request_failed = 1;
2108         } else if (err)
2109                 goto err_load;
2110
2111         /* Get initvals */
2112         switch (dev->phy.type) {
2113         case B43_PHYTYPE_A:
2114                 if ((rev >= 5) && (rev <= 10)) {
2115                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2116                                 filename = "a0g1initvals5";
2117                         else
2118                                 filename = "a0g0initvals5";
2119                 } else
2120                         goto err_no_initvals;
2121                 break;
2122         case B43_PHYTYPE_G:
2123                 if ((rev >= 5) && (rev <= 10))
2124                         filename = "b0g0initvals5";
2125                 else if (rev >= 13)
2126                         filename = "b0g0initvals13";
2127                 else
2128                         goto err_no_initvals;
2129                 break;
2130         case B43_PHYTYPE_N:
2131                 if ((rev >= 11) && (rev <= 12))
2132                         filename = "n0initvals11";
2133                 else
2134                         goto err_no_initvals;
2135                 break;
2136         default:
2137                 goto err_no_initvals;
2138         }
2139         err = do_request_fw(dev, filename, &fw->initvals, 0);
2140         if (err)
2141                 goto err_load;
2142
2143         /* Get bandswitch initvals */
2144         switch (dev->phy.type) {
2145         case B43_PHYTYPE_A:
2146                 if ((rev >= 5) && (rev <= 10)) {
2147                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2148                                 filename = "a0g1bsinitvals5";
2149                         else
2150                                 filename = "a0g0bsinitvals5";
2151                 } else if (rev >= 11)
2152                         filename = NULL;
2153                 else
2154                         goto err_no_initvals;
2155                 break;
2156         case B43_PHYTYPE_G:
2157                 if ((rev >= 5) && (rev <= 10))
2158                         filename = "b0g0bsinitvals5";
2159                 else if (rev >= 11)
2160                         filename = NULL;
2161                 else
2162                         goto err_no_initvals;
2163                 break;
2164         case B43_PHYTYPE_N:
2165                 if ((rev >= 11) && (rev <= 12))
2166                         filename = "n0bsinitvals11";
2167                 else
2168                         goto err_no_initvals;
2169                 break;
2170         default:
2171                 goto err_no_initvals;
2172         }
2173         err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2174         if (err)
2175                 goto err_load;
2176
2177         return 0;
2178
2179 err_load:
2180         b43_print_fw_helptext(dev->wl, 1);
2181         goto error;
2182
2183 err_no_ucode:
2184         err = -ENODEV;
2185         b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2186         goto error;
2187
2188 err_no_pcm:
2189         err = -ENODEV;
2190         b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2191         goto error;
2192
2193 err_no_initvals:
2194         err = -ENODEV;
2195         b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2196                "core rev %u\n", dev->phy.type, rev);
2197         goto error;
2198
2199 error:
2200         b43_release_firmware(dev);
2201         return err;
2202 }
2203
2204 static int b43_upload_microcode(struct b43_wldev *dev)
2205 {
2206         const size_t hdr_len = sizeof(struct b43_fw_header);
2207         const __be32 *data;
2208         unsigned int i, len;
2209         u16 fwrev, fwpatch, fwdate, fwtime;
2210         u32 tmp, macctl;
2211         int err = 0;
2212
2213         /* Jump the microcode PSM to offset 0 */
2214         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2215         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2216         macctl |= B43_MACCTL_PSM_JMP0;
2217         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2218         /* Zero out all microcode PSM registers and shared memory. */
2219         for (i = 0; i < 64; i++)
2220                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2221         for (i = 0; i < 4096; i += 2)
2222                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2223
2224         /* Upload Microcode. */
2225         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2226         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2227         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2228         for (i = 0; i < len; i++) {
2229                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2230                 udelay(10);
2231         }
2232
2233         if (dev->fw.pcm.data) {
2234                 /* Upload PCM data. */
2235                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2236                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2237                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2238                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2239                 /* No need for autoinc bit in SHM_HW */
2240                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2241                 for (i = 0; i < len; i++) {
2242                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2243                         udelay(10);
2244                 }
2245         }
2246
2247         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2248
2249         /* Start the microcode PSM */
2250         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2251         macctl &= ~B43_MACCTL_PSM_JMP0;
2252         macctl |= B43_MACCTL_PSM_RUN;
2253         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2254
2255         /* Wait for the microcode to load and respond */
2256         i = 0;
2257         while (1) {
2258                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2259                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2260                         break;
2261                 i++;
2262                 if (i >= 20) {
2263                         b43err(dev->wl, "Microcode not responding\n");
2264                         b43_print_fw_helptext(dev->wl, 1);
2265                         err = -ENODEV;
2266                         goto error;
2267                 }
2268                 msleep_interruptible(50);
2269                 if (signal_pending(current)) {
2270                         err = -EINTR;
2271                         goto error;
2272                 }
2273         }
2274         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2275
2276         /* Get and check the revisions. */
2277         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2278         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2279         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2280         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2281
2282         if (fwrev <= 0x128) {
2283                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2284                        "binary drivers older than version 4.x is unsupported. "
2285                        "You must upgrade your firmware files.\n");
2286                 b43_print_fw_helptext(dev->wl, 1);
2287                 err = -EOPNOTSUPP;
2288                 goto error;
2289         }
2290         dev->fw.rev = fwrev;
2291         dev->fw.patch = fwpatch;
2292         dev->fw.opensource = (fwdate == 0xFFFF);
2293
2294         if (dev->fw.opensource) {
2295                 /* Patchlevel info is encoded in the "time" field. */
2296                 dev->fw.patch = fwtime;
2297                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2298                         dev->fw.rev, dev->fw.patch,
2299                         dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2300         } else {
2301                 b43info(dev->wl, "Loading firmware version %u.%u "
2302                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2303                         fwrev, fwpatch,
2304                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2305                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2306                 if (dev->fw.pcm_request_failed) {
2307                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2308                                 "Hardware accelerated cryptography is disabled.\n");
2309                         b43_print_fw_helptext(dev->wl, 0);
2310                 }
2311         }
2312
2313         if (b43_is_old_txhdr_format(dev)) {
2314                 b43warn(dev->wl, "You are using an old firmware image. "
2315                         "Support for old firmware will be removed in July 2008.\n");
2316                 b43_print_fw_helptext(dev->wl, 0);
2317         }
2318
2319         return 0;
2320
2321 error:
2322         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2323         macctl &= ~B43_MACCTL_PSM_RUN;
2324         macctl |= B43_MACCTL_PSM_JMP0;
2325         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2326
2327         return err;
2328 }
2329
2330 static int b43_write_initvals(struct b43_wldev *dev,
2331                               const struct b43_iv *ivals,
2332                               size_t count,
2333                               size_t array_size)
2334 {
2335         const struct b43_iv *iv;
2336         u16 offset;
2337         size_t i;
2338         bool bit32;
2339
2340         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2341         iv = ivals;
2342         for (i = 0; i < count; i++) {
2343                 if (array_size < sizeof(iv->offset_size))
2344                         goto err_format;
2345                 array_size -= sizeof(iv->offset_size);
2346                 offset = be16_to_cpu(iv->offset_size);
2347                 bit32 = !!(offset & B43_IV_32BIT);
2348                 offset &= B43_IV_OFFSET_MASK;
2349                 if (offset >= 0x1000)
2350                         goto err_format;
2351                 if (bit32) {
2352                         u32 value;
2353
2354                         if (array_size < sizeof(iv->data.d32))
2355                                 goto err_format;
2356                         array_size -= sizeof(iv->data.d32);
2357
2358                         value = get_unaligned_be32(&iv->data.d32);
2359                         b43_write32(dev, offset, value);
2360
2361                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2362                                                         sizeof(__be16) +
2363                                                         sizeof(__be32));
2364                 } else {
2365                         u16 value;
2366
2367                         if (array_size < sizeof(iv->data.d16))
2368                                 goto err_format;
2369                         array_size -= sizeof(iv->data.d16);
2370
2371                         value = be16_to_cpu(iv->data.d16);
2372                         b43_write16(dev, offset, value);
2373
2374                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2375                                                         sizeof(__be16) +
2376                                                         sizeof(__be16));
2377                 }
2378         }
2379         if (array_size)
2380                 goto err_format;
2381
2382         return 0;
2383
2384 err_format:
2385         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2386         b43_print_fw_helptext(dev->wl, 1);
2387
2388         return -EPROTO;
2389 }
2390
2391 static int b43_upload_initvals(struct b43_wldev *dev)
2392 {
2393         const size_t hdr_len = sizeof(struct b43_fw_header);
2394         const struct b43_fw_header *hdr;
2395         struct b43_firmware *fw = &dev->fw;
2396         const struct b43_iv *ivals;
2397         size_t count;
2398         int err;
2399
2400         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2401         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2402         count = be32_to_cpu(hdr->size);
2403         err = b43_write_initvals(dev, ivals, count,
2404                                  fw->initvals.data->size - hdr_len);
2405         if (err)
2406                 goto out;
2407         if (fw->initvals_band.data) {
2408                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2409                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2410                 count = be32_to_cpu(hdr->size);
2411                 err = b43_write_initvals(dev, ivals, count,
2412                                          fw->initvals_band.data->size - hdr_len);
2413                 if (err)
2414                         goto out;
2415         }
2416 out:
2417
2418         return err;
2419 }
2420
2421 /* Initialize the GPIOs
2422  * http://bcm-specs.sipsolutions.net/GPIO
2423  */
2424 static int b43_gpio_init(struct b43_wldev *dev)
2425 {
2426         struct ssb_bus *bus = dev->dev->bus;
2427         struct ssb_device *gpiodev, *pcidev = NULL;
2428         u32 mask, set;
2429
2430         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2431                     & ~B43_MACCTL_GPOUTSMSK);
2432
2433         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2434                     | 0x000F);
2435
2436         mask = 0x0000001F;
2437         set = 0x0000000F;
2438         if (dev->dev->bus->chip_id == 0x4301) {
2439                 mask |= 0x0060;
2440                 set |= 0x0060;
2441         }
2442         if (0 /* FIXME: conditional unknown */ ) {
2443                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2444                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2445                             | 0x0100);
2446                 mask |= 0x0180;
2447                 set |= 0x0180;
2448         }
2449         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2450                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2451                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2452                             | 0x0200);
2453                 mask |= 0x0200;
2454                 set |= 0x0200;
2455         }
2456         if (dev->dev->id.revision >= 2)
2457                 mask |= 0x0010; /* FIXME: This is redundant. */
2458
2459 #ifdef CONFIG_SSB_DRIVER_PCICORE
2460         pcidev = bus->pcicore.dev;
2461 #endif
2462         gpiodev = bus->chipco.dev ? : pcidev;
2463         if (!gpiodev)
2464                 return 0;
2465         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2466                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2467                      & mask) | set);
2468
2469         return 0;
2470 }
2471
2472 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2473 static void b43_gpio_cleanup(struct b43_wldev *dev)
2474 {
2475         struct ssb_bus *bus = dev->dev->bus;
2476         struct ssb_device *gpiodev, *pcidev = NULL;
2477
2478 #ifdef CONFIG_SSB_DRIVER_PCICORE
2479         pcidev = bus->pcicore.dev;
2480 #endif
2481         gpiodev = bus->chipco.dev ? : pcidev;
2482         if (!gpiodev)
2483                 return;
2484         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2485 }
2486
2487 /* http://bcm-specs.sipsolutions.net/EnableMac */
2488 void b43_mac_enable(struct b43_wldev *dev)
2489 {
2490         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2491                 u16 fwstate;
2492
2493                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2494                                          B43_SHM_SH_UCODESTAT);
2495                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2496                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2497                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2498                                "should be suspended, but current state is %u\n",
2499                                fwstate);
2500                 }
2501         }
2502
2503         dev->mac_suspended--;
2504         B43_WARN_ON(dev->mac_suspended < 0);
2505         if (dev->mac_suspended == 0) {
2506                 b43_write32(dev, B43_MMIO_MACCTL,
2507                             b43_read32(dev, B43_MMIO_MACCTL)
2508                             | B43_MACCTL_ENABLED);
2509                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2510                             B43_IRQ_MAC_SUSPENDED);
2511                 /* Commit writes */
2512                 b43_read32(dev, B43_MMIO_MACCTL);
2513                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2514                 b43_power_saving_ctl_bits(dev, 0);
2515         }
2516 }
2517
2518 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2519 void b43_mac_suspend(struct b43_wldev *dev)
2520 {
2521         int i;
2522         u32 tmp;
2523
2524         might_sleep();
2525         B43_WARN_ON(dev->mac_suspended < 0);
2526
2527         if (dev->mac_suspended == 0) {
2528                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2529                 b43_write32(dev, B43_MMIO_MACCTL,
2530                             b43_read32(dev, B43_MMIO_MACCTL)
2531                             & ~B43_MACCTL_ENABLED);
2532                 /* force pci to flush the write */
2533                 b43_read32(dev, B43_MMIO_MACCTL);
2534                 for (i = 35; i; i--) {
2535                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2536                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2537                                 goto out;
2538                         udelay(10);
2539                 }
2540                 /* Hm, it seems this will take some time. Use msleep(). */
2541                 for (i = 40; i; i--) {
2542                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2543                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2544                                 goto out;
2545                         msleep(1);
2546                 }
2547                 b43err(dev->wl, "MAC suspend failed\n");
2548         }
2549 out:
2550         dev->mac_suspended++;
2551 }
2552
2553 static void b43_adjust_opmode(struct b43_wldev *dev)
2554 {
2555         struct b43_wl *wl = dev->wl;
2556         u32 ctl;
2557         u16 cfp_pretbtt;
2558
2559         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2560         /* Reset status to STA infrastructure mode. */
2561         ctl &= ~B43_MACCTL_AP;
2562         ctl &= ~B43_MACCTL_KEEP_CTL;
2563         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2564         ctl &= ~B43_MACCTL_KEEP_BAD;
2565         ctl &= ~B43_MACCTL_PROMISC;
2566         ctl &= ~B43_MACCTL_BEACPROMISC;
2567         ctl |= B43_MACCTL_INFRA;
2568
2569         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
2570             b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
2571                 ctl |= B43_MACCTL_AP;
2572         else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS))
2573                 ctl &= ~B43_MACCTL_INFRA;
2574
2575         if (wl->filter_flags & FIF_CONTROL)
2576                 ctl |= B43_MACCTL_KEEP_CTL;
2577         if (wl->filter_flags & FIF_FCSFAIL)
2578                 ctl |= B43_MACCTL_KEEP_BAD;
2579         if (wl->filter_flags & FIF_PLCPFAIL)
2580                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2581         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2582                 ctl |= B43_MACCTL_PROMISC;
2583         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2584                 ctl |= B43_MACCTL_BEACPROMISC;
2585
2586         /* Workaround: On old hardware the HW-MAC-address-filter
2587          * doesn't work properly, so always run promisc in filter
2588          * it in software. */
2589         if (dev->dev->id.revision <= 4)
2590                 ctl |= B43_MACCTL_PROMISC;
2591
2592         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2593
2594         cfp_pretbtt = 2;
2595         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2596                 if (dev->dev->bus->chip_id == 0x4306 &&
2597                     dev->dev->bus->chip_rev == 3)
2598                         cfp_pretbtt = 100;
2599                 else
2600                         cfp_pretbtt = 50;
2601         }
2602         b43_write16(dev, 0x612, cfp_pretbtt);
2603 }
2604
2605 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2606 {
2607         u16 offset;
2608
2609         if (is_ofdm) {
2610                 offset = 0x480;
2611                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2612         } else {
2613                 offset = 0x4C0;
2614                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2615         }
2616         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2617                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2618 }
2619
2620 static void b43_rate_memory_init(struct b43_wldev *dev)
2621 {
2622         switch (dev->phy.type) {
2623         case B43_PHYTYPE_A:
2624         case B43_PHYTYPE_G:
2625         case B43_PHYTYPE_N:
2626                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2627                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2628                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2629                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2630                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2631                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2632                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2633                 if (dev->phy.type == B43_PHYTYPE_A)
2634                         break;
2635                 /* fallthrough */
2636         case B43_PHYTYPE_B:
2637                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2638                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2639                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2640                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2641                 break;
2642         default:
2643                 B43_WARN_ON(1);
2644         }
2645 }
2646
2647 /* Set the default values for the PHY TX Control Words. */
2648 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2649 {
2650         u16 ctl = 0;
2651
2652         ctl |= B43_TXH_PHY_ENC_CCK;
2653         ctl |= B43_TXH_PHY_ANT01AUTO;
2654         ctl |= B43_TXH_PHY_TXPWR;
2655
2656         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2657         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2658         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2659 }
2660
2661 /* Set the TX-Antenna for management frames sent by firmware. */
2662 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2663 {
2664         u16 ant;
2665         u16 tmp;
2666
2667         ant = b43_antenna_to_phyctl(antenna);
2668
2669         /* For ACK/CTS */
2670         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2671         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2672         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2673         /* For Probe Resposes */
2674         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2675         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2676         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2677 }
2678
2679 /* This is the opposite of b43_chip_init() */
2680 static void b43_chip_exit(struct b43_wldev *dev)
2681 {
2682         b43_radio_turn_off(dev, 1);
2683         b43_gpio_cleanup(dev);
2684         b43_lo_g_cleanup(dev);
2685         /* firmware is released later */
2686 }
2687
2688 /* Initialize the chip
2689  * http://bcm-specs.sipsolutions.net/ChipInit
2690  */
2691 static int b43_chip_init(struct b43_wldev *dev)
2692 {
2693         struct b43_phy *phy = &dev->phy;
2694         int err, tmp;
2695         u32 value32, macctl;
2696         u16 value16;
2697
2698         /* Initialize the MAC control */
2699         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2700         if (dev->phy.gmode)
2701                 macctl |= B43_MACCTL_GMODE;
2702         macctl |= B43_MACCTL_INFRA;
2703         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2704
2705         err = b43_request_firmware(dev);
2706         if (err)
2707                 goto out;
2708         err = b43_upload_microcode(dev);
2709         if (err)
2710                 goto out;       /* firmware is released later */
2711
2712         err = b43_gpio_init(dev);
2713         if (err)
2714                 goto out;       /* firmware is released later */
2715
2716         err = b43_upload_initvals(dev);
2717         if (err)
2718                 goto err_gpio_clean;
2719         b43_radio_turn_on(dev);
2720
2721         b43_write16(dev, 0x03E6, 0x0000);
2722         err = b43_phy_init(dev);
2723         if (err)
2724                 goto err_radio_off;
2725
2726         /* Select initial Interference Mitigation. */
2727         tmp = phy->interfmode;
2728         phy->interfmode = B43_INTERFMODE_NONE;
2729         b43_radio_set_interference_mitigation(dev, tmp);
2730
2731         b43_set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2732         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2733
2734         if (phy->type == B43_PHYTYPE_B) {
2735                 value16 = b43_read16(dev, 0x005E);
2736                 value16 |= 0x0004;
2737                 b43_write16(dev, 0x005E, value16);
2738         }
2739         b43_write32(dev, 0x0100, 0x01000000);
2740         if (dev->dev->id.revision < 5)
2741                 b43_write32(dev, 0x010C, 0x01000000);
2742
2743         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2744                     & ~B43_MACCTL_INFRA);
2745         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2746                     | B43_MACCTL_INFRA);
2747
2748         /* Probe Response Timeout value */
2749         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2750         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2751
2752         /* Initially set the wireless operation mode. */
2753         b43_adjust_opmode(dev);
2754
2755         if (dev->dev->id.revision < 3) {
2756                 b43_write16(dev, 0x060E, 0x0000);
2757                 b43_write16(dev, 0x0610, 0x8000);
2758                 b43_write16(dev, 0x0604, 0x0000);
2759                 b43_write16(dev, 0x0606, 0x0200);
2760         } else {
2761                 b43_write32(dev, 0x0188, 0x80000000);
2762                 b43_write32(dev, 0x018C, 0x02000000);
2763         }
2764         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2765         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2766         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2767         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2768         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2769         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2770         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2771
2772         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2773         value32 |= 0x00100000;
2774         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2775
2776         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2777                     dev->dev->bus->chipco.fast_pwrup_delay);
2778
2779         err = 0;
2780         b43dbg(dev->wl, "Chip initialized\n");
2781 out:
2782         return err;
2783
2784 err_radio_off:
2785         b43_radio_turn_off(dev, 1);
2786 err_gpio_clean:
2787         b43_gpio_cleanup(dev);
2788         return err;
2789 }
2790
2791 static void b43_periodic_every60sec(struct b43_wldev *dev)
2792 {
2793         struct b43_phy *phy = &dev->phy;
2794
2795         if (phy->type != B43_PHYTYPE_G)
2796                 return;
2797         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_RSSI) {
2798                 b43_mac_suspend(dev);
2799                 b43_calc_nrssi_slope(dev);
2800                 if ((phy->radio_ver == 0x2050) && (phy->radio_rev == 8)) {
2801                         u8 old_chan = phy->channel;
2802
2803                         /* VCO Calibration */
2804                         if (old_chan >= 8)
2805                                 b43_radio_selectchannel(dev, 1, 0);
2806                         else
2807                                 b43_radio_selectchannel(dev, 13, 0);
2808                         b43_radio_selectchannel(dev, old_chan, 0);
2809                 }
2810                 b43_mac_enable(dev);
2811         }
2812 }
2813
2814 static void b43_periodic_every30sec(struct b43_wldev *dev)
2815 {
2816         /* Update device statistics. */
2817         b43_calculate_link_quality(dev);
2818 }
2819
2820 static void b43_periodic_every15sec(struct b43_wldev *dev)
2821 {
2822         struct b43_phy *phy = &dev->phy;
2823         u16 wdr;
2824
2825         if (dev->fw.opensource) {
2826                 /* Check if the firmware is still alive.
2827                  * It will reset the watchdog counter to 0 in its idle loop. */
2828                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2829                 if (unlikely(wdr)) {
2830                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2831                         b43_controller_restart(dev, "Firmware watchdog");
2832                         return;
2833                 } else {
2834                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2835                                         B43_WATCHDOG_REG, 1);
2836                 }
2837         }
2838
2839         if (phy->type == B43_PHYTYPE_G) {
2840                 //TODO: update_aci_moving_average
2841                 if (phy->aci_enable && phy->aci_wlan_automatic) {
2842                         b43_mac_suspend(dev);
2843                         if (!phy->aci_enable && 1 /*TODO: not scanning? */ ) {
2844                                 if (0 /*TODO: bunch of conditions */ ) {
2845                                         b43_radio_set_interference_mitigation
2846                                             (dev, B43_INTERFMODE_MANUALWLAN);
2847                                 }
2848                         } else if (1 /*TODO*/) {
2849                                 /*
2850                                    if ((aci_average > 1000) && !(b43_radio_aci_scan(dev))) {
2851                                    b43_radio_set_interference_mitigation(dev,
2852                                    B43_INTERFMODE_NONE);
2853                                    }
2854                                  */
2855                         }
2856                         b43_mac_enable(dev);
2857                 } else if (phy->interfmode == B43_INTERFMODE_NONWLAN &&
2858                            phy->rev == 1) {
2859                         //TODO: implement rev1 workaround
2860                 }
2861         }
2862         b43_phy_xmitpower(dev); //FIXME: unless scanning?
2863         b43_lo_g_maintanance_work(dev);
2864         //TODO for APHY (temperature?)
2865
2866         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2867         wmb();
2868 }
2869
2870 static void do_periodic_work(struct b43_wldev *dev)
2871 {
2872         unsigned int state;
2873
2874         state = dev->periodic_state;
2875         if (state % 4 == 0)
2876                 b43_periodic_every60sec(dev);
2877         if (state % 2 == 0)
2878                 b43_periodic_every30sec(dev);
2879         b43_periodic_every15sec(dev);
2880 }
2881
2882 /* Periodic work locking policy:
2883  *      The whole periodic work handler is protected by
2884  *      wl->mutex. If another lock is needed somewhere in the
2885  *      pwork callchain, it's aquired in-place, where it's needed.
2886  */
2887 static void b43_periodic_work_handler(struct work_struct *work)
2888 {
2889         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2890                                              periodic_work.work);
2891         struct b43_wl *wl = dev->wl;
2892         unsigned long delay;
2893
2894         mutex_lock(&wl->mutex);
2895
2896         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2897                 goto out;
2898         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2899                 goto out_requeue;
2900
2901         do_periodic_work(dev);
2902
2903         dev->periodic_state++;
2904 out_requeue:
2905         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2906                 delay = msecs_to_jiffies(50);
2907         else
2908                 delay = round_jiffies_relative(HZ * 15);
2909         queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2910 out:
2911         mutex_unlock(&wl->mutex);
2912 }
2913
2914 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2915 {
2916         struct delayed_work *work = &dev->periodic_work;
2917
2918         dev->periodic_state = 0;
2919         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2920         queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2921 }
2922
2923 /* Check if communication with the device works correctly. */
2924 static int b43_validate_chipaccess(struct b43_wldev *dev)
2925 {
2926         u32 v, backup;
2927
2928         backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2929
2930         /* Check for read/write and endianness problems. */
2931         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2932         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2933                 goto error;
2934         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2935         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2936                 goto error;
2937
2938         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2939
2940         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2941                 /* The 32bit register shadows the two 16bit registers
2942                  * with update sideeffects. Validate this. */
2943                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2944                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2945                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2946                         goto error;
2947                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2948                         goto error;
2949         }
2950         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2951
2952         v = b43_read32(dev, B43_MMIO_MACCTL);
2953         v |= B43_MACCTL_GMODE;
2954         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2955                 goto error;
2956
2957         return 0;
2958 error:
2959         b43err(dev->wl, "Failed to validate the chipaccess\n");
2960         return -ENODEV;
2961 }
2962
2963 static void b43_security_init(struct b43_wldev *dev)
2964 {
2965         dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2966         B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2967         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2968         /* KTP is a word address, but we address SHM bytewise.
2969          * So multiply by two.
2970          */
2971         dev->ktp *= 2;
2972         if (dev->dev->id.revision >= 5) {
2973                 /* Number of RCMTA address slots */
2974                 b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2975         }
2976         b43_clear_keys(dev);
2977 }
2978
2979 static int b43_rng_read(struct hwrng *rng, u32 * data)
2980 {
2981         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2982         unsigned long flags;
2983
2984         /* Don't take wl->mutex here, as it could deadlock with
2985          * hwrng internal locking. It's not needed to take
2986          * wl->mutex here, anyway. */
2987
2988         spin_lock_irqsave(&wl->irq_lock, flags);
2989         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2990         spin_unlock_irqrestore(&wl->irq_lock, flags);
2991
2992         return (sizeof(u16));
2993 }
2994
2995 static void b43_rng_exit(struct b43_wl *wl)
2996 {
2997         if (wl->rng_initialized)
2998                 hwrng_unregister(&wl->rng);
2999 }
3000
3001 static int b43_rng_init(struct b43_wl *wl)
3002 {
3003         int err;
3004
3005         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3006                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3007         wl->rng.name = wl->rng_name;
3008         wl->rng.data_read = b43_rng_read;
3009         wl->rng.priv = (unsigned long)wl;
3010         wl->rng_initialized = 1;
3011         err = hwrng_register(&wl->rng);
3012         if (err) {
3013                 wl->rng_initialized = 0;
3014                 b43err(wl, "Failed to register the random "
3015                        "number generator (%d)\n", err);
3016         }
3017
3018         return err;
3019 }
3020
3021 static int b43_op_tx(struct ieee80211_hw *hw,
3022                      struct sk_buff *skb)
3023 {
3024         struct b43_wl *wl = hw_to_b43_wl(hw);
3025         struct b43_wldev *dev = wl->current_dev;
3026         unsigned long flags;
3027         int err;
3028
3029         if (unlikely(skb->len < 2 + 2 + 6)) {
3030                 /* Too short, this can't be a valid frame. */
3031                 goto drop_packet;
3032         }
3033         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3034         if (unlikely(!dev))
3035                 goto drop_packet;
3036
3037         /* Transmissions on seperate queues can run concurrently. */
3038         read_lock_irqsave(&wl->tx_lock, flags);
3039
3040         err = -ENODEV;
3041         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3042                 if (b43_using_pio_transfers(dev))
3043                         err = b43_pio_tx(dev, skb);
3044                 else
3045                         err = b43_dma_tx(dev, skb);
3046         }
3047
3048         read_unlock_irqrestore(&wl->tx_lock, flags);
3049
3050         if (unlikely(err))
3051                 goto drop_packet;
3052         return NETDEV_TX_OK;
3053
3054 drop_packet:
3055         /* We can not transmit this packet. Drop it. */
3056         dev_kfree_skb_any(skb);
3057         return NETDEV_TX_OK;
3058 }
3059
3060 /* Locking: wl->irq_lock */
3061 static void b43_qos_params_upload(struct b43_wldev *dev,
3062                                   const struct ieee80211_tx_queue_params *p,
3063                                   u16 shm_offset)
3064 {
3065         u16 params[B43_NR_QOSPARAMS];
3066         int cw_min, cw_max, aifs, bslots, tmp;
3067         unsigned int i;
3068
3069         const u16 aCWmin = 0x0001;
3070         const u16 aCWmax = 0x03FF;
3071
3072         /* Calculate the default values for the parameters, if needed. */
3073         switch (shm_offset) {
3074         case B43_QOS_VOICE:
3075                 aifs = (p->aifs == -1) ? 2 : p->aifs;
3076                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 4 - 1) : p->cw_min;
3077                 cw_max = (p->cw_max == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_max;
3078                 break;
3079         case B43_QOS_VIDEO:
3080                 aifs = (p->aifs == -1) ? 2 : p->aifs;
3081                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_min;
3082                 cw_max = (p->cw_max == 0) ? aCWmin : p->cw_max;
3083                 break;
3084         case B43_QOS_BESTEFFORT:
3085                 aifs = (p->aifs == -1) ? 3 : p->aifs;
3086                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
3087                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
3088                 break;
3089         case B43_QOS_BACKGROUND:
3090                 aifs = (p->aifs == -1) ? 7 : p->aifs;
3091                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
3092                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
3093                 break;
3094         default:
3095                 B43_WARN_ON(1);
3096                 return;
3097         }
3098         if (cw_min <= 0)
3099                 cw_min = aCWmin;
3100         if (cw_max <= 0)
3101                 cw_max = aCWmin;
3102         bslots = b43_read16(dev, B43_MMIO_RNG) % cw_min;
3103
3104         memset(&params, 0, sizeof(params));
3105
3106         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3107         params[B43_QOSPARAM_CWMIN] = cw_min;
3108         params[B43_QOSPARAM_CWMAX] = cw_max;
3109         params[B43_QOSPARAM_CWCUR] = cw_min;
3110         params[B43_QOSPARAM_AIFS] = aifs;
3111         params[B43_QOSPARAM_BSLOTS] = bslots;
3112         params[B43_QOSPARAM_REGGAP] = bslots + aifs;
3113
3114         for (i = 0; i < ARRAY_SIZE(params); i++) {
3115                 if (i == B43_QOSPARAM_STATUS) {
3116                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3117                                              shm_offset + (i * 2));
3118                         /* Mark the parameters as updated. */
3119                         tmp |= 0x100;
3120                         b43_shm_write16(dev, B43_SHM_SHARED,
3121                                         shm_offset + (i * 2),
3122                                         tmp);
3123                 } else {
3124                         b43_shm_write16(dev, B43_SHM_SHARED,
3125                                         shm_offset + (i * 2),
3126                                         params[i]);
3127                 }
3128         }
3129 }
3130
3131 /* Update the QOS parameters in hardware. */
3132 static void b43_qos_update(struct b43_wldev *dev)
3133 {
3134         struct b43_wl *wl = dev->wl;
3135         struct b43_qos_params *params;
3136         unsigned long flags;
3137         unsigned int i;
3138
3139         /* Mapping of mac80211 queues to b43 SHM offsets. */
3140         static const u16 qos_shm_offsets[] = {
3141                 [0] = B43_QOS_VOICE,
3142                 [1] = B43_QOS_VIDEO,
3143                 [2] = B43_QOS_BESTEFFORT,
3144                 [3] = B43_QOS_BACKGROUND,
3145         };
3146         BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
3147
3148         b43_mac_suspend(dev);
3149         spin_lock_irqsave(&wl->irq_lock, flags);
3150
3151         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3152                 params = &(wl->qos_params[i]);
3153                 if (params->need_hw_update) {
3154                         b43_qos_params_upload(dev, &(params->p),
3155                                               qos_shm_offsets[i]);
3156                         params->need_hw_update = 0;
3157                 }
3158         }
3159
3160         spin_unlock_irqrestore(&wl->irq_lock, flags);
3161         b43_mac_enable(dev);
3162 }
3163
3164 static void b43_qos_clear(struct b43_wl *wl)
3165 {
3166         struct b43_qos_params *params;
3167         unsigned int i;
3168
3169         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3170                 params = &(wl->qos_params[i]);
3171
3172                 memset(&(params->p), 0, sizeof(params->p));
3173                 params->p.aifs = -1;
3174                 params->need_hw_update = 1;
3175         }
3176 }
3177
3178 /* Initialize the core's QOS capabilities */
3179 static void b43_qos_init(struct b43_wldev *dev)
3180 {
3181         struct b43_wl *wl = dev->wl;
3182         unsigned int i;
3183
3184         /* Upload the current QOS parameters. */
3185         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
3186                 wl->qos_params[i].need_hw_update = 1;
3187         b43_qos_update(dev);
3188
3189         /* Enable QOS support. */
3190         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3191         b43_write16(dev, B43_MMIO_IFSCTL,
3192                     b43_read16(dev, B43_MMIO_IFSCTL)
3193                     | B43_MMIO_IFSCTL_USE_EDCF);
3194 }
3195
3196 static void b43_qos_update_work(struct work_struct *work)
3197 {
3198         struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
3199         struct b43_wldev *dev;
3200
3201         mutex_lock(&wl->mutex);
3202         dev = wl->current_dev;
3203         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
3204                 b43_qos_update(dev);
3205         mutex_unlock(&wl->mutex);
3206 }
3207
3208 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3209                           const struct ieee80211_tx_queue_params *params)
3210 {
3211         struct b43_wl *wl = hw_to_b43_wl(hw);
3212         unsigned long flags;
3213         unsigned int queue = (unsigned int)_queue;
3214         struct b43_qos_params *p;
3215
3216         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3217                 /* Queue not available or don't support setting
3218                  * params on this queue. Return success to not
3219                  * confuse mac80211. */
3220                 return 0;
3221         }
3222
3223         spin_lock_irqsave(&wl->irq_lock, flags);
3224         p = &(wl->qos_params[queue]);
3225         memcpy(&(p->p), params, sizeof(p->p));
3226         p->need_hw_update = 1;
3227         spin_unlock_irqrestore(&wl->irq_lock, flags);
3228
3229         queue_work(hw->workqueue, &wl->qos_update_work);
3230
3231         return 0;
3232 }
3233
3234 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3235                                struct ieee80211_tx_queue_stats *stats)
3236 {
3237         struct b43_wl *wl = hw_to_b43_wl(hw);
3238         struct b43_wldev *dev = wl->current_dev;
3239         unsigned long flags;
3240         int err = -ENODEV;
3241
3242         if (!dev)
3243                 goto out;
3244         spin_lock_irqsave(&wl->irq_lock, flags);
3245         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3246                 if (b43_using_pio_transfers(dev))
3247                         b43_pio_get_tx_stats(dev, stats);
3248                 else
3249                         b43_dma_get_tx_stats(dev, stats);
3250                 err = 0;
3251         }
3252         spin_unlock_irqrestore(&wl->irq_lock, flags);
3253 out:
3254         return err;
3255 }
3256
3257 static int b43_op_get_stats(struct ieee80211_hw *hw,
3258                             struct ieee80211_low_level_stats *stats)
3259 {
3260         struct b43_wl *wl = hw_to_b43_wl(hw);
3261         unsigned long flags;
3262
3263         spin_lock_irqsave(&wl->irq_lock, flags);
3264         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3265         spin_unlock_irqrestore(&wl->irq_lock, flags);
3266
3267         return 0;
3268 }
3269
3270 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3271 {
3272         struct ssb_device *sdev = dev->dev;
3273         u32 tmslow;
3274
3275         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3276         tmslow &= ~B43_TMSLOW_GMODE;
3277         tmslow |= B43_TMSLOW_PHYRESET;
3278         tmslow |= SSB_TMSLOW_FGC;
3279         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3280         msleep(1);
3281
3282         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3283         tmslow &= ~SSB_TMSLOW_FGC;
3284         tmslow |= B43_TMSLOW_PHYRESET;
3285         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3286         msleep(1);
3287 }
3288
3289 static const char * band_to_string(enum ieee80211_band band)
3290 {
3291         switch (band) {
3292         case IEEE80211_BAND_5GHZ:
3293                 return "5";
3294         case IEEE80211_BAND_2GHZ:
3295                 return "2.4";
3296         default:
3297                 break;
3298         }
3299         B43_WARN_ON(1);
3300         return "";
3301 }
3302
3303 /* Expects wl->mutex locked */
3304 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3305 {
3306         struct b43_wldev *up_dev = NULL;
3307         struct b43_wldev *down_dev;
3308         struct b43_wldev *d;
3309         int err;
3310         bool gmode;
3311         int prev_status;
3312
3313         /* Find a device and PHY which supports the band. */
3314         list_for_each_entry(d, &wl->devlist, list) {
3315                 switch (chan->band) {
3316                 case IEEE80211_BAND_5GHZ:
3317                         if (d->phy.supports_5ghz) {
3318                                 up_dev = d;
3319                                 gmode = 0;
3320                         }
3321                         break;
3322                 case IEEE80211_BAND_2GHZ:
3323                         if (d->phy.supports_2ghz) {
3324                                 up_dev = d;
3325                                 gmode = 1;
3326                         }
3327                         break;
3328                 default:
3329                         B43_WARN_ON(1);
3330                         return -EINVAL;
3331                 }
3332                 if (up_dev)
3333                         break;
3334         }
3335         if (!up_dev) {
3336                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3337                        band_to_string(chan->band));
3338                 return -ENODEV;
3339         }
3340         if ((up_dev == wl->current_dev) &&
3341             (!!wl->current_dev->phy.gmode == !!gmode)) {
3342                 /* This device is already running. */
3343                 return 0;
3344         }
3345         b43dbg(wl, "Switching to %s-GHz band\n",
3346                band_to_string(chan->band));
3347         down_dev = wl->current_dev;
3348
3349         prev_status = b43_status(down_dev);
3350         /* Shutdown the currently running core. */
3351         if (prev_status >= B43_STAT_STARTED)
3352                 b43_wireless_core_stop(down_dev);
3353         if (prev_status >= B43_STAT_INITIALIZED)
3354                 b43_wireless_core_exit(down_dev);
3355
3356         if (down_dev != up_dev) {
3357                 /* We switch to a different core, so we put PHY into
3358                  * RESET on the old core. */
3359                 b43_put_phy_into_reset(down_dev);
3360         }
3361
3362         /* Now start the new core. */
3363         up_dev->phy.gmode = gmode;
3364         if (prev_status >= B43_STAT_INITIALIZED) {
3365                 err = b43_wireless_core_init(up_dev);
3366                 if (err) {
3367                         b43err(wl, "Fatal: Could not initialize device for "
3368                                "selected %s-GHz band\n",
3369                                band_to_string(chan->band));
3370                         goto init_failure;
3371                 }
3372         }
3373         if (prev_status >= B43_STAT_STARTED) {
3374                 err = b43_wireless_core_start(up_dev);
3375                 if (err) {
3376                         b43err(wl, "Fatal: Coult not start device for "
3377                                "selected %s-GHz band\n",
3378                                band_to_string(chan->band));
3379                         b43_wireless_core_exit(up_dev);
3380                         goto init_failure;
3381                 }
3382         }
3383         B43_WARN_ON(b43_status(up_dev) != prev_status);
3384
3385         wl->current_dev = up_dev;
3386
3387         return 0;
3388 init_failure:
3389         /* Whoops, failed to init the new core. No core is operating now. */
3390         wl->current_dev = NULL;
3391         return err;
3392 }
3393
3394 static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
3395 {
3396         struct b43_wl *wl = hw_to_b43_wl(hw);
3397         struct b43_wldev *dev;
3398         struct b43_phy *phy;
3399         unsigned long flags;
3400         int antenna;
3401         int err = 0;
3402         u32 savedirqs;
3403
3404         mutex_lock(&wl->mutex);
3405
3406         /* Switch the band (if necessary). This might change the active core. */
3407         err = b43_switch_band(wl, conf->channel);
3408         if (err)
3409                 goto out_unlock_mutex;
3410         dev = wl->current_dev;
3411         phy = &dev->phy;
3412
3413         /* Disable IRQs while reconfiguring the device.
3414          * This makes it possible to drop the spinlock throughout
3415          * the reconfiguration process. */
3416         spin_lock_irqsave(&wl->irq_lock, flags);
3417         if (b43_status(dev) < B43_STAT_STARTED) {
3418                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3419                 goto out_unlock_mutex;
3420         }
3421         savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3422         spin_unlock_irqrestore(&wl->irq_lock, flags);
3423         b43_synchronize_irq(dev);
3424
3425         /* Switch to the requested channel.
3426          * The firmware takes care of races with the TX handler. */
3427         if (conf->channel->hw_value != phy->channel)
3428                 b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
3429
3430         /* Enable/Disable ShortSlot timing. */
3431         if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
3432             dev->short_slot) {
3433                 B43_WARN_ON(phy->type != B43_PHYTYPE_G);
3434                 if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)
3435                         b43_short_slot_timing_enable(dev);
3436                 else
3437                         b43_short_slot_timing_disable(dev);
3438         }
3439
3440         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3441
3442         /* Adjust the desired TX power level. */
3443         if (conf->power_level != 0) {
3444                 if (conf->power_level != phy->power_level) {
3445                         phy->power_level = conf->power_level;
3446                         b43_phy_xmitpower(dev);
3447                 }
3448         }
3449
3450         /* Antennas for RX and management frame TX. */
3451         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
3452         b43_mgmtframe_txantenna(dev, antenna);
3453         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
3454         b43_set_rx_antenna(dev, antenna);
3455
3456         /* Update templates for AP/mesh mode. */
3457         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3458             b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
3459                 b43_set_beacon_int(dev, conf->beacon_int);
3460
3461         if (!!conf->radio_enabled != phy->radio_on) {
3462                 if (conf->radio_enabled) {
3463                         b43_radio_turn_on(dev);
3464                         b43info(dev->wl, "Radio turned on by software\n");
3465                         if (!dev->radio_hw_enable) {
3466                                 b43info(dev->wl, "The hardware RF-kill button "
3467                                         "still turns the radio physically off. "
3468                                         "Press the button to turn it on.\n");
3469                         }
3470                 } else {
3471                         b43_radio_turn_off(dev, 0);
3472                         b43info(dev->wl, "Radio turned off by software\n");
3473                 }
3474         }
3475
3476         spin_lock_irqsave(&wl->irq_lock, flags);
3477         b43_interrupt_enable(dev, savedirqs);
3478         mmiowb();
3479         spin_unlock_irqrestore(&wl->irq_lock, flags);
3480       out_unlock_mutex:
3481         mutex_unlock(&wl->mutex);
3482
3483         return err;
3484 }
3485
3486 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3487                            const u8 *local_addr, const u8 *addr,
3488                            struct ieee80211_key_conf *key)
3489 {
3490         struct b43_wl *wl = hw_to_b43_wl(hw);
3491         struct b43_wldev *dev;
3492         unsigned long flags;
3493         u8 algorithm;
3494         u8 index;
3495         int err;
3496         DECLARE_MAC_BUF(mac);
3497
3498         if (modparam_nohwcrypt)
3499                 return -ENOSPC; /* User disabled HW-crypto */
3500
3501         mutex_lock(&wl->mutex);
3502         spin_lock_irqsave(&wl->irq_lock, flags);
3503
3504         dev = wl->current_dev;
3505         err = -ENODEV;
3506         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3507                 goto out_unlock;
3508
3509         if (dev->fw.pcm_request_failed) {
3510                 /* We don't have firmware for the crypto engine.
3511                  * Must use software-crypto. */
3512                 err = -EOPNOTSUPP;
3513                 goto out_unlock;
3514         }
3515
3516         err = -EINVAL;
3517         switch (key->alg) {
3518         case ALG_WEP:
3519                 if (key->keylen == 5)
3520                         algorithm = B43_SEC_ALGO_WEP40;
3521                 else
3522                         algorithm = B43_SEC_ALGO_WEP104;
3523                 break;
3524         case ALG_TKIP:
3525                 algorithm = B43_SEC_ALGO_TKIP;
3526                 break;
3527         case ALG_CCMP:
3528                 algorithm = B43_SEC_ALGO_AES;
3529                 break;
3530         default:
3531                 B43_WARN_ON(1);
3532                 goto out_unlock;
3533         }
3534         index = (u8) (key->keyidx);
3535         if (index > 3)
3536                 goto out_unlock;
3537
3538         switch (cmd) {
3539         case SET_KEY:
3540                 if (algorithm == B43_SEC_ALGO_TKIP) {
3541                         /* FIXME: No TKIP hardware encryption for now. */
3542                         err = -EOPNOTSUPP;
3543                         goto out_unlock;
3544                 }
3545
3546                 if (is_broadcast_ether_addr(addr)) {
3547                         /* addr is FF:FF:FF:FF:FF:FF for default keys */
3548                         err = b43_key_write(dev, index, algorithm,
3549                                             key->key, key->keylen, NULL, key);
3550                 } else {
3551                         /*
3552                          * either pairwise key or address is 00:00:00:00:00:00
3553                          * for transmit-only keys
3554                          */
3555                         err = b43_key_write(dev, -1, algorithm,
3556                                             key->key, key->keylen, addr, key);
3557                 }
3558                 if (err)
3559                         goto out_unlock;
3560
3561                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3562                     algorithm == B43_SEC_ALGO_WEP104) {
3563                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3564                 } else {
3565                         b43_hf_write(dev,
3566                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3567                 }
3568                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3569                 break;
3570         case DISABLE_KEY: {
3571                 err = b43_key_clear(dev, key->hw_key_idx);
3572                 if (err)
3573                         goto out_unlock;
3574                 break;
3575         }
3576         default:
3577                 B43_WARN_ON(1);
3578         }
3579 out_unlock:
3580         spin_unlock_irqrestore(&wl->irq_lock, flags);
3581         mutex_unlock(&wl->mutex);
3582         if (!err) {
3583                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3584                        "mac: %s\n",
3585                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3586                        print_mac(mac, addr));
3587         }
3588         return err;
3589 }
3590
3591 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3592                                     unsigned int changed, unsigned int *fflags,
3593                                     int mc_count, struct dev_addr_list *mc_list)
3594 {
3595         struct b43_wl *wl = hw_to_b43_wl(hw);
3596         struct b43_wldev *dev = wl->current_dev;
3597         unsigned long flags;
3598
3599         if (!dev) {
3600                 *fflags = 0;
3601                 return;
3602         }
3603
3604         spin_lock_irqsave(&wl->irq_lock, flags);
3605         *fflags &= FIF_PROMISC_IN_BSS |
3606                   FIF_ALLMULTI |
3607                   FIF_FCSFAIL |
3608                   FIF_PLCPFAIL |
3609                   FIF_CONTROL |
3610                   FIF_OTHER_BSS |
3611                   FIF_BCN_PRBRESP_PROMISC;
3612
3613         changed &= FIF_PROMISC_IN_BSS |
3614                    FIF_ALLMULTI |
3615                    FIF_FCSFAIL |
3616                    FIF_PLCPFAIL |
3617                    FIF_CONTROL |
3618                    FIF_OTHER_BSS |
3619                    FIF_BCN_PRBRESP_PROMISC;
3620
3621         wl->filter_flags = *fflags;
3622
3623         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3624                 b43_adjust_opmode(dev);
3625         spin_unlock_irqrestore(&wl->irq_lock, flags);
3626 }
3627
3628 static int b43_op_config_interface(struct ieee80211_hw *hw,
3629                                    struct ieee80211_vif *vif,
3630                                    struct ieee80211_if_conf *conf)
3631 {
3632         struct b43_wl *wl = hw_to_b43_wl(hw);
3633         struct b43_wldev *dev = wl->current_dev;
3634         unsigned long flags;
3635
3636         if (!dev)
3637                 return -ENODEV;
3638         mutex_lock(&wl->mutex);
3639         spin_lock_irqsave(&wl->irq_lock, flags);
3640         B43_WARN_ON(wl->vif != vif);
3641         if (conf->bssid)
3642                 memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3643         else
3644                 memset(wl->bssid, 0, ETH_ALEN);
3645         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3646                 if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3647                     b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT)) {
3648                         B43_WARN_ON(conf->type != wl->if_type);
3649                         b43_set_ssid(dev, conf->ssid, conf->ssid_len);
3650                         if (conf->beacon)
3651                                 b43_update_templates(wl, conf->beacon);
3652                 }
3653                 b43_write_mac_bssid_templates(dev);
3654         }
3655         spin_unlock_irqrestore(&wl->irq_lock, flags);
3656         mutex_unlock(&wl->mutex);
3657
3658         return 0;
3659 }
3660
3661 /* Locking: wl->mutex */
3662 static void b43_wireless_core_stop(struct b43_wldev *dev)
3663 {
3664         struct b43_wl *wl = dev->wl;
3665         unsigned long flags;
3666
3667         if (b43_status(dev) < B43_STAT_STARTED)
3668                 return;
3669
3670         /* Disable and sync interrupts. We must do this before than
3671          * setting the status to INITIALIZED, as the interrupt handler
3672          * won't care about IRQs then. */
3673         spin_lock_irqsave(&wl->irq_lock, flags);
3674         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3675         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3676         spin_unlock_irqrestore(&wl->irq_lock, flags);
3677         b43_synchronize_irq(dev);
3678
3679         write_lock_irqsave(&wl->tx_lock, flags);
3680         b43_set_status(dev, B43_STAT_INITIALIZED);
3681         write_unlock_irqrestore(&wl->tx_lock, flags);
3682
3683         b43_pio_stop(dev);
3684         mutex_unlock(&wl->mutex);
3685         /* Must unlock as it would otherwise deadlock. No races here.
3686          * Cancel the possibly running self-rearming periodic work. */
3687         cancel_delayed_work_sync(&dev->periodic_work);
3688         mutex_lock(&wl->mutex);
3689
3690         b43_mac_suspend(dev);
3691         free_irq(dev->dev->irq, dev);
3692         b43dbg(wl, "Wireless interface stopped\n");
3693 }
3694
3695 /* Locking: wl->mutex */
3696 static int b43_wireless_core_start(struct b43_wldev *dev)
3697 {
3698         int err;
3699
3700         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3701
3702         drain_txstatus_queue(dev);
3703         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3704                           IRQF_SHARED, KBUILD_MODNAME, dev);
3705         if (err) {
3706                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3707                 goto out;
3708         }
3709
3710         /* We are ready to run. */
3711         b43_set_status(dev, B43_STAT_STARTED);
3712
3713         /* Start data flow (TX/RX). */
3714         b43_mac_enable(dev);
3715         b43_interrupt_enable(dev, dev->irq_savedstate);
3716
3717         /* Start maintainance work */
3718         b43_periodic_tasks_setup(dev);
3719
3720         b43dbg(dev->wl, "Wireless interface started\n");
3721       out:
3722         return err;
3723 }
3724
3725 /* Get PHY and RADIO versioning numbers */
3726 static int b43_phy_versioning(struct b43_wldev *dev)
3727 {
3728         struct b43_phy *phy = &dev->phy;
3729         u32 tmp;
3730         u8 analog_type;
3731         u8 phy_type;
3732         u8 phy_rev;
3733         u16 radio_manuf;
3734         u16 radio_ver;
3735         u16 radio_rev;
3736         int unsupported = 0;
3737
3738         /* Get PHY versioning */
3739         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3740         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3741         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3742         phy_rev = (tmp & B43_PHYVER_VERSION);
3743         switch (phy_type) {
3744         case B43_PHYTYPE_A:
3745                 if (phy_rev >= 4)
3746                         unsupported = 1;
3747                 break;
3748         case B43_PHYTYPE_B:
3749                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3750                     && phy_rev != 7)
3751                         unsupported = 1;
3752                 break;
3753         case B43_PHYTYPE_G:
3754                 if (phy_rev > 9)
3755                         unsupported = 1;
3756                 break;
3757 #ifdef CONFIG_B43_NPHY
3758         case B43_PHYTYPE_N:
3759                 if (phy_rev > 1)
3760                         unsupported = 1;
3761                 break;
3762 #endif
3763         default:
3764                 unsupported = 1;
3765         };
3766         if (unsupported) {
3767                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3768                        "(Analog %u, Type %u, Revision %u)\n",
3769                        analog_type, phy_type, phy_rev);
3770                 return -EOPNOTSUPP;
3771         }
3772         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3773                analog_type, phy_type, phy_rev);
3774
3775         /* Get RADIO versioning */
3776         if (dev->dev->bus->chip_id == 0x4317) {
3777                 if (dev->dev->bus->chip_rev == 0)
3778                         tmp = 0x3205017F;
3779                 else if (dev->dev->bus->chip_rev == 1)
3780                         tmp = 0x4205017F;
3781                 else
3782                         tmp = 0x5205017F;
3783         } else {
3784                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3785                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3786                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3787                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3788         }
3789         radio_manuf = (tmp & 0x00000FFF);
3790         radio_ver = (tmp & 0x0FFFF000) >> 12;
3791         radio_rev = (tmp & 0xF0000000) >> 28;
3792         if (radio_manuf != 0x17F /* Broadcom */)
3793                 unsupported = 1;
3794         switch (phy_type) {
3795         case B43_PHYTYPE_A:
3796                 if (radio_ver != 0x2060)
3797                         unsupported = 1;
3798                 if (radio_rev != 1)
3799                         unsupported = 1;
3800                 if (radio_manuf != 0x17F)
3801                         unsupported = 1;
3802                 break;
3803         case B43_PHYTYPE_B:
3804                 if ((radio_ver & 0xFFF0) != 0x2050)
3805                         unsupported = 1;
3806                 break;
3807         case B43_PHYTYPE_G:
3808                 if (radio_ver != 0x2050)
3809                         unsupported = 1;
3810                 break;
3811         case B43_PHYTYPE_N:
3812                 if (radio_ver != 0x2055)
3813                         unsupported = 1;
3814                 break;
3815         default:
3816                 B43_WARN_ON(1);
3817         }
3818         if (unsupported) {
3819                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3820                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3821                        radio_manuf, radio_ver, radio_rev);
3822                 return -EOPNOTSUPP;
3823         }
3824         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3825                radio_manuf, radio_ver, radio_rev);
3826
3827         phy->radio_manuf = radio_manuf;
3828         phy->radio_ver = radio_ver;
3829         phy->radio_rev = radio_rev;
3830
3831         phy->analog = analog_type;
3832         phy->type = phy_type;
3833         phy->rev = phy_rev;
3834
3835         return 0;
3836 }
3837
3838 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3839                                       struct b43_phy *phy)
3840 {
3841         struct b43_txpower_lo_control *lo;
3842         int i;
3843
3844         memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3845         memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3846
3847         phy->aci_enable = 0;
3848         phy->aci_wlan_automatic = 0;
3849         phy->aci_hw_rssi = 0;
3850
3851         phy->radio_off_context.valid = 0;
3852
3853         lo = phy->lo_control;
3854         if (lo) {
3855                 memset(lo, 0, sizeof(*(phy->lo_control)));
3856                 lo->tx_bias = 0xFF;
3857                 INIT_LIST_HEAD(&lo->calib_list);
3858         }
3859         phy->max_lb_gain = 0;
3860         phy->trsw_rx_gain = 0;
3861         phy->txpwr_offset = 0;
3862
3863         /* NRSSI */
3864         phy->nrssislope = 0;
3865         for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3866                 phy->nrssi[i] = -1000;
3867         for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3868                 phy->nrssi_lt[i] = i;
3869
3870         phy->lofcal = 0xFFFF;
3871         phy->initval = 0xFFFF;
3872
3873         phy->interfmode = B43_INTERFMODE_NONE;
3874         phy->channel = 0xFF;
3875
3876         phy->hardware_power_control = !!modparam_hwpctl;
3877
3878         /* PHY TX errors counter. */
3879         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3880
3881         /* OFDM-table address caching. */
3882         phy->ofdmtab_addr_direction = B43_OFDMTAB_DIRECTION_UNKNOWN;
3883 }
3884
3885 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3886 {
3887         dev->dfq_valid = 0;
3888
3889         /* Assume the radio is enabled. If it's not enabled, the state will
3890          * immediately get fixed on the first periodic work run. */
3891         dev->radio_hw_enable = 1;
3892
3893         /* Stats */
3894         memset(&dev->stats, 0, sizeof(dev->stats));
3895
3896         setup_struct_phy_for_init(dev, &dev->phy);
3897
3898         /* IRQ related flags */
3899         dev->irq_reason = 0;
3900         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3901         dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3902
3903         dev->mac_suspended = 1;
3904
3905         /* Noise calculation context */
3906         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3907 }
3908
3909 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3910 {
3911         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3912         u64 hf;
3913
3914         if (!modparam_btcoex)
3915                 return;
3916         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3917                 return;
3918         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3919                 return;
3920
3921         hf = b43_hf_read(dev);
3922         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3923                 hf |= B43_HF_BTCOEXALT;
3924         else
3925                 hf |= B43_HF_BTCOEX;
3926         b43_hf_write(dev, hf);
3927 }
3928
3929 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3930 {
3931         if (!modparam_btcoex)
3932                 return;
3933         //TODO
3934 }
3935
3936 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3937 {
3938 #ifdef CONFIG_SSB_DRIVER_PCICORE
3939         struct ssb_bus *bus = dev->dev->bus;
3940         u32 tmp;
3941
3942         if (bus->pcicore.dev &&
3943             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3944             bus->pcicore.dev->id.revision <= 5) {
3945                 /* IMCFGLO timeouts workaround. */
3946                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3947                 tmp &= ~SSB_IMCFGLO_REQTO;
3948                 tmp &= ~SSB_IMCFGLO_SERTO;
3949                 switch (bus->bustype) {
3950                 case SSB_BUSTYPE_PCI:
3951                 case SSB_BUSTYPE_PCMCIA:
3952                         tmp |= 0x32;
3953                         break;
3954                 case SSB_BUSTYPE_SSB:
3955                         tmp |= 0x53;
3956                         break;
3957                 }
3958                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3959         }
3960 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3961 }
3962
3963 /* Write the short and long frame retry limit values. */
3964 static void b43_set_retry_limits(struct b43_wldev *dev,
3965                                  unsigned int short_retry,
3966                                  unsigned int long_retry)
3967 {
3968         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3969          * the chip-internal counter. */
3970         short_retry = min(short_retry, (unsigned int)0xF);
3971         long_retry = min(long_retry, (unsigned int)0xF);
3972
3973         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3974                         short_retry);
3975         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3976                         long_retry);
3977 }
3978
3979 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3980 {
3981         u16 pu_delay;
3982
3983         /* The time value is in microseconds. */
3984         if (dev->phy.type == B43_PHYTYPE_A)
3985                 pu_delay = 3700;
3986         else
3987                 pu_delay = 1050;
3988         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS) || idle)
3989                 pu_delay = 500;
3990         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3991                 pu_delay = max(pu_delay, (u16)2400);
3992
3993         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3994 }
3995
3996 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3997 static void b43_set_pretbtt(struct b43_wldev *dev)
3998 {
3999         u16 pretbtt;
4000
4001         /* The time value is in microseconds. */
4002         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS)) {
4003                 pretbtt = 2;
4004         } else {
4005                 if (dev->phy.type == B43_PHYTYPE_A)
4006                         pretbtt = 120;
4007                 else
4008                         pretbtt = 250;
4009         }
4010         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4011         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4012 }
4013
4014 /* Shutdown a wireless core */
4015 /* Locking: wl->mutex */
4016 static void b43_wireless_core_exit(struct b43_wldev *dev)
4017 {
4018         struct b43_phy *phy = &dev->phy;
4019         u32 macctl;
4020
4021         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4022         if (b43_status(dev) != B43_STAT_INITIALIZED)
4023                 return;
4024         b43_set_status(dev, B43_STAT_UNINIT);
4025
4026         /* Stop the microcode PSM. */
4027         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4028         macctl &= ~B43_MACCTL_PSM_RUN;
4029         macctl |= B43_MACCTL_PSM_JMP0;
4030         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4031
4032         if (!dev->suspend_in_progress) {
4033                 b43_leds_exit(dev);
4034                 b43_rng_exit(dev->wl);
4035         }
4036         b43_dma_free(dev);
4037         b43_pio_free(dev);
4038         b43_chip_exit(dev);
4039         b43_radio_turn_off(dev, 1);
4040         b43_switch_analog(dev, 0);
4041         if (phy->dyn_tssi_tbl)
4042                 kfree(phy->tssi2dbm);
4043         kfree(phy->lo_control);
4044         phy->lo_control = NULL;
4045         if (dev->wl->current_beacon) {
4046                 dev_kfree_skb_any(dev->wl->current_beacon);
4047                 dev->wl->current_beacon = NULL;
4048         }
4049
4050         ssb_device_disable(dev->dev, 0);
4051         ssb_bus_may_powerdown(dev->dev->bus);
4052 }
4053
4054 /* Initialize a wireless core */
4055 static int b43_wireless_core_init(struct b43_wldev *dev)
4056 {
4057         struct b43_wl *wl = dev->wl;
4058         struct ssb_bus *bus = dev->dev->bus;
4059         struct ssb_sprom *sprom = &bus->sprom;
4060         struct b43_phy *phy = &dev->phy;
4061         int err;
4062         u64 hf;
4063         u32 tmp;
4064
4065         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4066
4067         err = ssb_bus_powerup(bus, 0);
4068         if (err)
4069                 goto out;
4070         if (!ssb_device_is_enabled(dev->dev)) {
4071                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4072                 b43_wireless_core_reset(dev, tmp);
4073         }
4074
4075         if ((phy->type == B43_PHYTYPE_B) || (phy->type == B43_PHYTYPE_G)) {
4076                 phy->lo_control =
4077                     kzalloc(sizeof(*(phy->lo_control)), GFP_KERNEL);
4078                 if (!phy->lo_control) {
4079                         err = -ENOMEM;
4080                         goto err_busdown;
4081                 }
4082         }
4083         setup_struct_wldev_for_init(dev);
4084
4085         err = b43_phy_init_tssi2dbm_table(dev);
4086         if (err)
4087                 goto err_kfree_lo_control;
4088
4089         /* Enable IRQ routing to this device. */
4090         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4091
4092         b43_imcfglo_timeouts_workaround(dev);
4093         b43_bluetooth_coext_disable(dev);
4094         b43_phy_early_init(dev);
4095         err = b43_chip_init(dev);
4096         if (err)
4097                 goto err_kfree_tssitbl;
4098         b43_shm_write16(dev, B43_SHM_SHARED,
4099                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4100         hf = b43_hf_read(dev);
4101         if (phy->type == B43_PHYTYPE_G) {
4102                 hf |= B43_HF_SYMW;
4103                 if (phy->rev == 1)
4104                         hf |= B43_HF_GDCW;
4105                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4106                         hf |= B43_HF_OFDMPABOOST;
4107         } else if (phy->type == B43_PHYTYPE_B) {
4108                 hf |= B43_HF_SYMW;
4109                 if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4110                         hf &= ~B43_HF_GDCW;
4111         }
4112         b43_hf_write(dev, hf);
4113
4114         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4115                              B43_DEFAULT_LONG_RETRY_LIMIT);
4116         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4117         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4118
4119         /* Disable sending probe responses from firmware.
4120          * Setting the MaxTime to one usec will always trigger
4121          * a timeout, so we never send any probe resp.
4122          * A timeout of zero is infinite. */
4123         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4124
4125         b43_rate_memory_init(dev);
4126         b43_set_phytxctl_defaults(dev);
4127
4128         /* Minimum Contention Window */
4129         if (phy->type == B43_PHYTYPE_B) {
4130                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4131         } else {
4132                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4133         }
4134         /* Maximum Contention Window */
4135         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4136
4137         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4138                 dev->__using_pio_transfers = 1;
4139                 err = b43_pio_init(dev);
4140         } else {
4141                 dev->__using_pio_transfers = 0;
4142                 err = b43_dma_init(dev);
4143         }
4144         if (err)
4145                 goto err_chip_exit;
4146         b43_qos_init(dev);
4147         b43_set_synth_pu_delay(dev, 1);
4148         b43_bluetooth_coext_enable(dev);
4149
4150         ssb_bus_powerup(bus, 1);        /* Enable dynamic PCTL */
4151         b43_upload_card_macaddress(dev);
4152         b43_security_init(dev);
4153         if (!dev->suspend_in_progress)
4154                 b43_rng_init(wl);
4155
4156         b43_set_status(dev, B43_STAT_INITIALIZED);
4157
4158         if (!dev->suspend_in_progress)
4159                 b43_leds_init(dev);
4160 out:
4161         return err;
4162
4163       err_chip_exit:
4164         b43_chip_exit(dev);
4165       err_kfree_tssitbl:
4166         if (phy->dyn_tssi_tbl)
4167                 kfree(phy->tssi2dbm);
4168       err_kfree_lo_control:
4169         kfree(phy->lo_control);
4170         phy->lo_control = NULL;
4171       err_busdown:
4172         ssb_bus_may_powerdown(bus);
4173         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4174         return err;
4175 }
4176
4177 static int b43_op_add_interface(struct ieee80211_hw *hw,
4178                                 struct ieee80211_if_init_conf *conf)
4179 {
4180         struct b43_wl *wl = hw_to_b43_wl(hw);
4181         struct b43_wldev *dev;
4182         unsigned long flags;
4183         int err = -EOPNOTSUPP;
4184
4185         /* TODO: allow WDS/AP devices to coexist */
4186
4187         if (conf->type != IEEE80211_IF_TYPE_AP &&
4188             conf->type != IEEE80211_IF_TYPE_MESH_POINT &&
4189             conf->type != IEEE80211_IF_TYPE_STA &&
4190             conf->type != IEEE80211_IF_TYPE_WDS &&
4191             conf->type != IEEE80211_IF_TYPE_IBSS)
4192                 return -EOPNOTSUPP;
4193
4194         mutex_lock(&wl->mutex);
4195         if (wl->operating)
4196                 goto out_mutex_unlock;
4197
4198         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4199
4200         dev = wl->current_dev;
4201         wl->operating = 1;
4202         wl->vif = conf->vif;
4203         wl->if_type = conf->type;
4204         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4205
4206         spin_lock_irqsave(&wl->irq_lock, flags);
4207         b43_adjust_opmode(dev);
4208         b43_set_pretbtt(dev);
4209         b43_set_synth_pu_delay(dev, 0);
4210         b43_upload_card_macaddress(dev);
4211         spin_unlock_irqrestore(&wl->irq_lock, flags);
4212
4213         err = 0;
4214  out_mutex_unlock:
4215         mutex_unlock(&wl->mutex);
4216
4217         return err;
4218 }
4219
4220 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4221                                     struct ieee80211_if_init_conf *conf)
4222 {
4223         struct b43_wl *wl = hw_to_b43_wl(hw);
4224         struct b43_wldev *dev = wl->current_dev;
4225         unsigned long flags;
4226
4227         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4228
4229         mutex_lock(&wl->mutex);
4230
4231         B43_WARN_ON(!wl->operating);
4232         B43_WARN_ON(wl->vif != conf->vif);
4233         wl->vif = NULL;
4234
4235         wl->operating = 0;
4236
4237         spin_lock_irqsave(&wl->irq_lock, flags);
4238         b43_adjust_opmode(dev);
4239         memset(wl->mac_addr, 0, ETH_ALEN);
4240         b43_upload_card_macaddress(dev);
4241         spin_unlock_irqrestore(&wl->irq_lock, flags);
4242
4243         mutex_unlock(&wl->mutex);
4244 }
4245
4246 static int b43_op_start(struct ieee80211_hw *hw)
4247 {
4248         struct b43_wl *wl = hw_to_b43_wl(hw);
4249         struct b43_wldev *dev = wl->current_dev;
4250         int did_init = 0;
4251         int err = 0;
4252         bool do_rfkill_exit = 0;
4253
4254         /* Kill all old instance specific information to make sure
4255          * the card won't use it in the short timeframe between start
4256          * and mac80211 reconfiguring it. */
4257         memset(wl->bssid, 0, ETH_ALEN);
4258         memset(wl->mac_addr, 0, ETH_ALEN);
4259         wl->filter_flags = 0;
4260         wl->radiotap_enabled = 0;
4261         b43_qos_clear(wl);
4262         wl->beacon0_uploaded = 0;
4263         wl->beacon1_uploaded = 0;
4264         wl->beacon_templates_virgin = 1;
4265
4266         /* First register RFkill.
4267          * LEDs that are registered later depend on it. */
4268         b43_rfkill_init(dev);
4269
4270         mutex_lock(&wl->mutex);
4271
4272         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4273                 err = b43_wireless_core_init(dev);
4274                 if (err) {
4275                         do_rfkill_exit = 1;
4276                         goto out_mutex_unlock;
4277                 }
4278                 did_init = 1;
4279         }
4280
4281         if (b43_status(dev) < B43_STAT_STARTED) {
4282                 err = b43_wireless_core_start(dev);
4283                 if (err) {
4284                         if (did_init)
4285                                 b43_wireless_core_exit(dev);
4286                         do_rfkill_exit = 1;
4287                         goto out_mutex_unlock;
4288                 }
4289         }
4290
4291  out_mutex_unlock:
4292         mutex_unlock(&wl->mutex);
4293
4294         if (do_rfkill_exit)
4295                 b43_rfkill_exit(dev);
4296
4297         return err;
4298 }
4299
4300 static void b43_op_stop(struct ieee80211_hw *hw)
4301 {
4302         struct b43_wl *wl = hw_to_b43_wl(hw);
4303         struct b43_wldev *dev = wl->current_dev;
4304
4305         b43_rfkill_exit(dev);
4306         cancel_work_sync(&(wl->qos_update_work));
4307         cancel_work_sync(&(wl->beacon_update_trigger));
4308
4309         mutex_lock(&wl->mutex);
4310         if (b43_status(dev) >= B43_STAT_STARTED)
4311                 b43_wireless_core_stop(dev);
4312         b43_wireless_core_exit(dev);
4313         mutex_unlock(&wl->mutex);
4314 }
4315
4316 static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
4317                                   u32 short_retry_limit, u32 long_retry_limit)
4318 {
4319         struct b43_wl *wl = hw_to_b43_wl(hw);
4320         struct b43_wldev *dev;
4321         int err = 0;
4322
4323         mutex_lock(&wl->mutex);
4324         dev = wl->current_dev;
4325         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
4326                 err = -ENODEV;
4327                 goto out_unlock;
4328         }
4329         b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
4330 out_unlock:
4331         mutex_unlock(&wl->mutex);
4332
4333         return err;
4334 }
4335
4336 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
4337 {
4338         struct b43_wl *wl = hw_to_b43_wl(hw);
4339         struct sk_buff *beacon;
4340         unsigned long flags;
4341
4342         /* We could modify the existing beacon and set the aid bit in
4343          * the TIM field, but that would probably require resizing and
4344          * moving of data within the beacon template.
4345          * Simply request a new beacon and let mac80211 do the hard work. */
4346         beacon = ieee80211_beacon_get(hw, wl->vif);
4347         if (unlikely(!beacon))
4348                 return -ENOMEM;
4349         spin_lock_irqsave(&wl->irq_lock, flags);
4350         b43_update_templates(wl, beacon);
4351         spin_unlock_irqrestore(&wl->irq_lock, flags);
4352
4353         return 0;
4354 }
4355
4356 static int b43_op_ibss_beacon_update(struct ieee80211_hw *hw,
4357                                      struct sk_buff *beacon)
4358 {
4359         struct b43_wl *wl = hw_to_b43_wl(hw);
4360         unsigned long flags;
4361
4362         spin_lock_irqsave(&wl->irq_lock, flags);
4363         b43_update_templates(wl, beacon);
4364         spin_unlock_irqrestore(&wl->irq_lock, flags);
4365
4366         return 0;
4367 }
4368
4369 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4370                               struct ieee80211_vif *vif,
4371                               enum sta_notify_cmd notify_cmd,
4372                               const u8 *addr)
4373 {
4374         struct b43_wl *wl = hw_to_b43_wl(hw);
4375
4376         B43_WARN_ON(!vif || wl->vif != vif);
4377 }
4378
4379 static const struct ieee80211_ops b43_hw_ops = {
4380         .tx                     = b43_op_tx,
4381         .conf_tx                = b43_op_conf_tx,
4382         .add_interface          = b43_op_add_interface,
4383         .remove_interface       = b43_op_remove_interface,
4384         .config                 = b43_op_config,
4385         .config_interface       = b43_op_config_interface,
4386         .configure_filter       = b43_op_configure_filter,
4387         .set_key                = b43_op_set_key,
4388         .get_stats              = b43_op_get_stats,
4389         .get_tx_stats           = b43_op_get_tx_stats,
4390         .start                  = b43_op_start,
4391         .stop                   = b43_op_stop,
4392         .set_retry_limit        = b43_op_set_retry_limit,
4393         .set_tim                = b43_op_beacon_set_tim,
4394         .beacon_update          = b43_op_ibss_beacon_update,
4395         .sta_notify             = b43_op_sta_notify,
4396 };
4397
4398 /* Hard-reset the chip. Do not call this directly.
4399  * Use b43_controller_restart()
4400  */
4401 static void b43_chip_reset(struct work_struct *work)
4402 {
4403         struct b43_wldev *dev =
4404             container_of(work, struct b43_wldev, restart_work);
4405         struct b43_wl *wl = dev->wl;
4406         int err = 0;
4407         int prev_status;
4408
4409         mutex_lock(&wl->mutex);
4410
4411         prev_status = b43_status(dev);
4412         /* Bring the device down... */
4413         if (prev_status >= B43_STAT_STARTED)
4414                 b43_wireless_core_stop(dev);
4415         if (prev_status >= B43_STAT_INITIALIZED)
4416                 b43_wireless_core_exit(dev);
4417
4418         /* ...and up again. */
4419         if (prev_status >= B43_STAT_INITIALIZED) {
4420                 err = b43_wireless_core_init(dev);
4421                 if (err)
4422                         goto out;
4423         }
4424         if (prev_status >= B43_STAT_STARTED) {
4425                 err = b43_wireless_core_start(dev);
4426                 if (err) {
4427                         b43_wireless_core_exit(dev);
4428                         goto out;
4429                 }
4430         }
4431 out:
4432         if (err)
4433                 wl->current_dev = NULL; /* Failed to init the dev. */
4434         mutex_unlock(&wl->mutex);
4435         if (err)
4436                 b43err(wl, "Controller restart FAILED\n");
4437         else
4438                 b43info(wl, "Controller restarted\n");
4439 }
4440
4441 static int b43_setup_bands(struct b43_wldev *dev,
4442                            bool have_2ghz_phy, bool have_5ghz_phy)
4443 {
4444         struct ieee80211_hw *hw = dev->wl->hw;
4445
4446         if (have_2ghz_phy)
4447                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4448         if (dev->phy.type == B43_PHYTYPE_N) {
4449                 if (have_5ghz_phy)
4450                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4451         } else {
4452                 if (have_5ghz_phy)
4453                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4454         }
4455
4456         dev->phy.supports_2ghz = have_2ghz_phy;
4457         dev->phy.supports_5ghz = have_5ghz_phy;
4458
4459         return 0;
4460 }
4461
4462 static void b43_wireless_core_detach(struct b43_wldev *dev)
4463 {
4464         /* We release firmware that late to not be required to re-request
4465          * is all the time when we reinit the core. */
4466         b43_release_firmware(dev);
4467 }
4468
4469 static int b43_wireless_core_attach(struct b43_wldev *dev)
4470 {
4471         struct b43_wl *wl = dev->wl;
4472         struct ssb_bus *bus = dev->dev->bus;
4473         struct pci_dev *pdev = bus->host_pci;
4474         int err;
4475         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4476         u32 tmp;
4477
4478         /* Do NOT do any device initialization here.
4479          * Do it in wireless_core_init() instead.
4480          * This function is for gathering basic information about the HW, only.
4481          * Also some structs may be set up here. But most likely you want to have
4482          * that in core_init(), too.
4483          */
4484
4485         err = ssb_bus_powerup(bus, 0);
4486         if (err) {
4487                 b43err(wl, "Bus powerup failed\n");
4488                 goto out;
4489         }
4490         /* Get the PHY type. */
4491         if (dev->dev->id.revision >= 5) {
4492                 u32 tmshigh;
4493
4494                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4495                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4496                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4497         } else
4498                 B43_WARN_ON(1);
4499
4500         dev->phy.gmode = have_2ghz_phy;
4501         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4502         b43_wireless_core_reset(dev, tmp);
4503
4504         err = b43_phy_versioning(dev);
4505         if (err)
4506                 goto err_powerdown;
4507         /* Check if this device supports multiband. */
4508         if (!pdev ||
4509             (pdev->device != 0x4312 &&
4510              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4511                 /* No multiband support. */
4512                 have_2ghz_phy = 0;
4513                 have_5ghz_phy = 0;
4514                 switch (dev->phy.type) {
4515                 case B43_PHYTYPE_A:
4516                         have_5ghz_phy = 1;
4517                         break;
4518                 case B43_PHYTYPE_G:
4519                 case B43_PHYTYPE_N:
4520                         have_2ghz_phy = 1;
4521                         break;
4522                 default:
4523                         B43_WARN_ON(1);
4524                 }
4525         }
4526         if (dev->phy.type == B43_PHYTYPE_A) {
4527                 /* FIXME */
4528                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4529                 err = -EOPNOTSUPP;
4530                 goto err_powerdown;
4531         }
4532         if (1 /* disable A-PHY */) {
4533                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4534                 if (dev->phy.type != B43_PHYTYPE_N) {
4535                         have_2ghz_phy = 1;
4536                         have_5ghz_phy = 0;
4537                 }
4538         }
4539
4540         dev->phy.gmode = have_2ghz_phy;
4541         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4542         b43_wireless_core_reset(dev, tmp);
4543
4544         err = b43_validate_chipaccess(dev);
4545         if (err)
4546                 goto err_powerdown;
4547         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4548         if (err)
4549                 goto err_powerdown;
4550
4551         /* Now set some default "current_dev" */
4552         if (!wl->current_dev)
4553                 wl->current_dev = dev;
4554         INIT_WORK(&dev->restart_work, b43_chip_reset);
4555
4556         b43_radio_turn_off(dev, 1);
4557         b43_switch_analog(dev, 0);
4558         ssb_device_disable(dev->dev, 0);
4559         ssb_bus_may_powerdown(bus);
4560
4561 out:
4562         return err;
4563
4564 err_powerdown:
4565         ssb_bus_may_powerdown(bus);
4566         return err;
4567 }
4568
4569 static void b43_one_core_detach(struct ssb_device *dev)
4570 {
4571         struct b43_wldev *wldev;
4572         struct b43_wl *wl;
4573
4574         /* Do not cancel ieee80211-workqueue based work here.
4575          * See comment in b43_remove(). */
4576
4577         wldev = ssb_get_drvdata(dev);
4578         wl = wldev->wl;
4579         b43_debugfs_remove_device(wldev);
4580         b43_wireless_core_detach(wldev);
4581         list_del(&wldev->list);
4582         wl->nr_devs--;
4583         ssb_set_drvdata(dev, NULL);
4584         kfree(wldev);
4585 }
4586
4587 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4588 {
4589         struct b43_wldev *wldev;
4590         struct pci_dev *pdev;
4591         int err = -ENOMEM;
4592
4593         if (!list_empty(&wl->devlist)) {
4594                 /* We are not the first core on this chip. */
4595                 pdev = dev->bus->host_pci;
4596                 /* Only special chips support more than one wireless
4597                  * core, although some of the other chips have more than
4598                  * one wireless core as well. Check for this and
4599                  * bail out early.
4600                  */
4601                 if (!pdev ||
4602                     ((pdev->device != 0x4321) &&
4603                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4604                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4605                         return -ENODEV;
4606                 }
4607         }
4608
4609         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4610         if (!wldev)
4611                 goto out;
4612
4613         wldev->dev = dev;
4614         wldev->wl = wl;
4615         b43_set_status(wldev, B43_STAT_UNINIT);
4616         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4617         tasklet_init(&wldev->isr_tasklet,
4618                      (void (*)(unsigned long))b43_interrupt_tasklet,
4619                      (unsigned long)wldev);
4620         INIT_LIST_HEAD(&wldev->list);
4621
4622         err = b43_wireless_core_attach(wldev);
4623         if (err)
4624                 goto err_kfree_wldev;
4625
4626         list_add(&wldev->list, &wl->devlist);
4627         wl->nr_devs++;
4628         ssb_set_drvdata(dev, wldev);
4629         b43_debugfs_add_device(wldev);
4630
4631       out:
4632         return err;
4633
4634       err_kfree_wldev:
4635         kfree(wldev);
4636         return err;
4637 }
4638
4639 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4640         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4641         (pdev->device == _device) &&                                    \
4642         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4643         (pdev->subsystem_device == _subdevice)                          )
4644
4645 static void b43_sprom_fixup(struct ssb_bus *bus)
4646 {
4647         struct pci_dev *pdev;
4648
4649         /* boardflags workarounds */
4650         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4651             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4652                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4653         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4654             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4655                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4656         if (bus->bustype == SSB_BUSTYPE_PCI) {
4657                 pdev = bus->host_pci;
4658                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4659                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4660                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
4661                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4662         }
4663 }
4664
4665 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4666 {
4667         struct ieee80211_hw *hw = wl->hw;
4668
4669         ssb_set_devtypedata(dev, NULL);
4670         ieee80211_free_hw(hw);
4671 }
4672
4673 static int b43_wireless_init(struct ssb_device *dev)
4674 {
4675         struct ssb_sprom *sprom = &dev->bus->sprom;
4676         struct ieee80211_hw *hw;
4677         struct b43_wl *wl;
4678         int err = -ENOMEM;
4679
4680         b43_sprom_fixup(dev->bus);
4681
4682         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4683         if (!hw) {
4684                 b43err(NULL, "Could not allocate ieee80211 device\n");
4685                 goto out;
4686         }
4687
4688         /* fill hw info */
4689         hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
4690                     IEEE80211_HW_RX_INCLUDES_FCS |
4691                     IEEE80211_HW_SIGNAL_DBM |
4692                     IEEE80211_HW_NOISE_DBM;
4693
4694         hw->queues = b43_modparam_qos ? 4 : 1;
4695         SET_IEEE80211_DEV(hw, dev->dev);
4696         if (is_valid_ether_addr(sprom->et1mac))
4697                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4698         else
4699                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4700
4701         /* Get and initialize struct b43_wl */
4702         wl = hw_to_b43_wl(hw);
4703         memset(wl, 0, sizeof(*wl));
4704         wl->hw = hw;
4705         spin_lock_init(&wl->irq_lock);
4706         rwlock_init(&wl->tx_lock);
4707         spin_lock_init(&wl->leds_lock);
4708         spin_lock_init(&wl->shm_lock);
4709         mutex_init(&wl->mutex);
4710         INIT_LIST_HEAD(&wl->devlist);
4711         INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
4712         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4713
4714         ssb_set_devtypedata(dev, wl);
4715         b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4716         err = 0;
4717       out:
4718         return err;
4719 }
4720
4721 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4722 {
4723         struct b43_wl *wl;
4724         int err;
4725         int first = 0;
4726
4727         wl = ssb_get_devtypedata(dev);
4728         if (!wl) {
4729                 /* Probing the first core. Must setup common struct b43_wl */
4730                 first = 1;
4731                 err = b43_wireless_init(dev);
4732                 if (err)
4733                         goto out;
4734                 wl = ssb_get_devtypedata(dev);
4735                 B43_WARN_ON(!wl);
4736         }
4737         err = b43_one_core_attach(dev, wl);
4738         if (err)
4739                 goto err_wireless_exit;
4740
4741         if (first) {
4742                 err = ieee80211_register_hw(wl->hw);
4743                 if (err)
4744                         goto err_one_core_detach;
4745         }
4746
4747       out:
4748         return err;
4749
4750       err_one_core_detach:
4751         b43_one_core_detach(dev);
4752       err_wireless_exit:
4753         if (first)
4754                 b43_wireless_exit(dev, wl);
4755         return err;
4756 }
4757
4758 static void b43_remove(struct ssb_device *dev)
4759 {
4760         struct b43_wl *wl = ssb_get_devtypedata(dev);
4761         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4762
4763         /* We must cancel any work here before unregistering from ieee80211,
4764          * as the ieee80211 unreg will destroy the workqueue. */
4765         cancel_work_sync(&wldev->restart_work);
4766
4767         B43_WARN_ON(!wl);
4768         if (wl->current_dev == wldev)
4769                 ieee80211_unregister_hw(wl->hw);
4770
4771         b43_one_core_detach(dev);
4772
4773         if (list_empty(&wl->devlist)) {
4774                 /* Last core on the chip unregistered.
4775                  * We can destroy common struct b43_wl.
4776                  */
4777                 b43_wireless_exit(dev, wl);
4778         }
4779 }
4780
4781 /* Perform a hardware reset. This can be called from any context. */
4782 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4783 {
4784         /* Must avoid requeueing, if we are in shutdown. */
4785         if (b43_status(dev) < B43_STAT_INITIALIZED)
4786                 return;
4787         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4788         queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4789 }
4790
4791 #ifdef CONFIG_PM
4792
4793 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4794 {
4795         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4796         struct b43_wl *wl = wldev->wl;
4797
4798         b43dbg(wl, "Suspending...\n");
4799
4800         mutex_lock(&wl->mutex);
4801         wldev->suspend_in_progress = true;
4802         wldev->suspend_init_status = b43_status(wldev);
4803         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4804                 b43_wireless_core_stop(wldev);
4805         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4806                 b43_wireless_core_exit(wldev);
4807         mutex_unlock(&wl->mutex);
4808
4809         b43dbg(wl, "Device suspended.\n");
4810
4811         return 0;
4812 }
4813
4814 static int b43_resume(struct ssb_device *dev)
4815 {
4816         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4817         struct b43_wl *wl = wldev->wl;
4818         int err = 0;
4819
4820         b43dbg(wl, "Resuming...\n");
4821
4822         mutex_lock(&wl->mutex);
4823         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4824                 err = b43_wireless_core_init(wldev);
4825                 if (err) {
4826                         b43err(wl, "Resume failed at core init\n");
4827                         goto out;
4828                 }
4829         }
4830         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4831                 err = b43_wireless_core_start(wldev);
4832                 if (err) {
4833                         b43_leds_exit(wldev);
4834                         b43_rng_exit(wldev->wl);
4835                         b43_wireless_core_exit(wldev);
4836                         b43err(wl, "Resume failed at core start\n");
4837                         goto out;
4838                 }
4839         }
4840         b43dbg(wl, "Device resumed.\n");
4841  out:
4842         wldev->suspend_in_progress = false;
4843         mutex_unlock(&wl->mutex);
4844         return err;
4845 }
4846
4847 #else /* CONFIG_PM */
4848 # define b43_suspend    NULL
4849 # define b43_resume     NULL
4850 #endif /* CONFIG_PM */
4851
4852 static struct ssb_driver b43_ssb_driver = {
4853         .name           = KBUILD_MODNAME,
4854         .id_table       = b43_ssb_tbl,
4855         .probe          = b43_probe,
4856         .remove         = b43_remove,
4857         .suspend        = b43_suspend,
4858         .resume         = b43_resume,
4859 };
4860
4861 static void b43_print_driverinfo(void)
4862 {
4863         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4864                    *feat_leds = "", *feat_rfkill = "";
4865
4866 #ifdef CONFIG_B43_PCI_AUTOSELECT
4867         feat_pci = "P";
4868 #endif
4869 #ifdef CONFIG_B43_PCMCIA
4870         feat_pcmcia = "M";
4871 #endif
4872 #ifdef CONFIG_B43_NPHY
4873         feat_nphy = "N";
4874 #endif
4875 #ifdef CONFIG_B43_LEDS
4876         feat_leds = "L";
4877 #endif
4878 #ifdef CONFIG_B43_RFKILL
4879         feat_rfkill = "R";
4880 #endif
4881         printk(KERN_INFO "Broadcom 43xx driver loaded "
4882                "[ Features: %s%s%s%s%s, Firmware-ID: "
4883                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4884                feat_pci, feat_pcmcia, feat_nphy,
4885                feat_leds, feat_rfkill);
4886 }
4887
4888 static int __init b43_init(void)
4889 {
4890         int err;
4891
4892         b43_debugfs_init();
4893         err = b43_pcmcia_init();
4894         if (err)
4895                 goto err_dfs_exit;
4896         err = ssb_driver_register(&b43_ssb_driver);
4897         if (err)
4898                 goto err_pcmcia_exit;
4899         b43_print_driverinfo();
4900
4901         return err;
4902
4903 err_pcmcia_exit:
4904         b43_pcmcia_exit();
4905 err_dfs_exit:
4906         b43_debugfs_exit();
4907         return err;
4908 }
4909
4910 static void __exit b43_exit(void)
4911 {
4912         ssb_driver_unregister(&b43_ssb_driver);
4913         b43_pcmcia_exit();
4914         b43_debugfs_exit();
4915 }
4916
4917 module_init(b43_init)
4918 module_exit(b43_exit)