SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/version.h>
  37 #include <linux/firmware.h>
  38 #include <linux/wireless.h>
  39 #include <linux/workqueue.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/io.h>
  42 #include <linux/dma-mapping.h>
  43 #include <asm/unaligned.h>
  44
  45 #include "b43.h"
  46 #include "main.h"
  47 #include "debugfs.h"
  48 #include "phy.h"
  49 #include "dma.h"
  50 #include "sysfs.h"
  51 #include "xmit.h"
  52 #include "lo.h"
  53 #include "pcmcia.h"
  54
  55 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  56 MODULE_AUTHOR("Martin Langer");
  57 MODULE_AUTHOR("Stefano Brivio");
  58 MODULE_AUTHOR("Michael Buesch");
  59 MODULE_LICENSE("GPL");
  60
  61 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  62
  63
  64 static int modparam_bad_frames_preempt;
  65 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  66 MODULE_PARM_DESC(bad_frames_preempt,
  67                  "enable(1) / disable(0) Bad Frames Preemption");
  68
  69 static char modparam_fwpostfix[16];
  70 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  71 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  72
  73 static int modparam_hwpctl;
  74 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  75 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  76
  77 static int modparam_nohwcrypt;
  78 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  79 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  80
  81 int b43_modparam_qos = 1;
  82 module_param_named(qos, b43_modparam_qos, int, 0444);
  83 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  84
  85
  86 static const struct ssb_device_id b43_ssb_tbl[] = {
  87         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  88         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  89         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
  90         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
  91         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
  92         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
  93         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
  94         SSB_DEVTABLE_END
  95 };
  96
  97 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
  98
  99 /* Channel and ratetables are shared for all devices.
 100  * They can't be const, because ieee80211 puts some precalculated
 101  * data in there. This data is the same for all devices, so we don't
 102  * get concurrency issues */
 103 #define RATETAB_ENT(_rateid, _flags) \
 104         {                                                               \
 105                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 106                 .hw_value       = (_rateid),                            \
 107                 .flags          = (_flags),                             \
 108         }
 109
 110 /*
 111  * NOTE: When changing this, sync with xmit.c's
 112  *       b43_plcp_get_bitrate_idx_* functions!
 113  */
 114 static struct ieee80211_rate __b43_ratetable[] = {
 115         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 116         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 117         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 118         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 119         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 120         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 121         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 122         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 123         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 124         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 125         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 126         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 127 };
 128
 129 #define b43_a_ratetable         (__b43_ratetable + 4)
 130 #define b43_a_ratetable_size    8
 131 #define b43_b_ratetable         (__b43_ratetable + 0)
 132 #define b43_b_ratetable_size    4
 133 #define b43_g_ratetable         (__b43_ratetable + 0)
 134 #define b43_g_ratetable_size    12
 135
 136 #define CHAN4G(_channel, _freq, _flags) {                       \
 137         .band                   = IEEE80211_BAND_2GHZ,          \
 138         .center_freq            = (_freq),                      \
 139         .hw_value               = (_channel),                   \
 140         .flags                  = (_flags),                     \
 141         .max_antenna_gain       = 0,                            \
 142         .max_power              = 30,                           \
 143 }
 144 static struct ieee80211_channel b43_2ghz_chantable[] = {
 145         CHAN4G(1, 2412, 0),
 146         CHAN4G(2, 2417, 0),
 147         CHAN4G(3, 2422, 0),
 148         CHAN4G(4, 2427, 0),
 149         CHAN4G(5, 2432, 0),
 150         CHAN4G(6, 2437, 0),
 151         CHAN4G(7, 2442, 0),
 152         CHAN4G(8, 2447, 0),
 153         CHAN4G(9, 2452, 0),
 154         CHAN4G(10, 2457, 0),
 155         CHAN4G(11, 2462, 0),
 156         CHAN4G(12, 2467, 0),
 157         CHAN4G(13, 2472, 0),
 158         CHAN4G(14, 2484, 0),
 159 };
 160 #undef CHAN4G
 161
 162 #define CHAN5G(_channel, _flags) {                              \
 163         .band                   = IEEE80211_BAND_5GHZ,          \
 164         .center_freq            = 5000 + (5 * (_channel)),      \
 165         .hw_value               = (_channel),                   \
 166         .flags                  = (_flags),                     \
 167         .max_antenna_gain       = 0,                            \
 168         .max_power              = 30,                           \
 169 }
 170 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 171         CHAN5G(32, 0),          CHAN5G(34, 0),
 172         CHAN5G(36, 0),          CHAN5G(38, 0),
 173         CHAN5G(40, 0),          CHAN5G(42, 0),
 174         CHAN5G(44, 0),          CHAN5G(46, 0),
 175         CHAN5G(48, 0),          CHAN5G(50, 0),
 176         CHAN5G(52, 0),          CHAN5G(54, 0),
 177         CHAN5G(56, 0),          CHAN5G(58, 0),
 178         CHAN5G(60, 0),          CHAN5G(62, 0),
 179         CHAN5G(64, 0),          CHAN5G(66, 0),
 180         CHAN5G(68, 0),          CHAN5G(70, 0),
 181         CHAN5G(72, 0),          CHAN5G(74, 0),
 182         CHAN5G(76, 0),          CHAN5G(78, 0),
 183         CHAN5G(80, 0),          CHAN5G(82, 0),
 184         CHAN5G(84, 0),          CHAN5G(86, 0),
 185         CHAN5G(88, 0),          CHAN5G(90, 0),
 186         CHAN5G(92, 0),          CHAN5G(94, 0),
 187         CHAN5G(96, 0),          CHAN5G(98, 0),
 188         CHAN5G(100, 0),         CHAN5G(102, 0),
 189         CHAN5G(104, 0),         CHAN5G(106, 0),
 190         CHAN5G(108, 0),         CHAN5G(110, 0),
 191         CHAN5G(112, 0),         CHAN5G(114, 0),
 192         CHAN5G(116, 0),         CHAN5G(118, 0),
 193         CHAN5G(120, 0),         CHAN5G(122, 0),
 194         CHAN5G(124, 0),         CHAN5G(126, 0),
 195         CHAN5G(128, 0),         CHAN5G(130, 0),
 196         CHAN5G(132, 0),         CHAN5G(134, 0),
 197         CHAN5G(136, 0),         CHAN5G(138, 0),
 198         CHAN5G(140, 0),         CHAN5G(142, 0),
 199         CHAN5G(144, 0),         CHAN5G(145, 0),
 200         CHAN5G(146, 0),         CHAN5G(147, 0),
 201         CHAN5G(148, 0),         CHAN5G(149, 0),
 202         CHAN5G(150, 0),         CHAN5G(151, 0),
 203         CHAN5G(152, 0),         CHAN5G(153, 0),
 204         CHAN5G(154, 0),         CHAN5G(155, 0),
 205         CHAN5G(156, 0),         CHAN5G(157, 0),
 206         CHAN5G(158, 0),         CHAN5G(159, 0),
 207         CHAN5G(160, 0),         CHAN5G(161, 0),
 208         CHAN5G(162, 0),         CHAN5G(163, 0),
 209         CHAN5G(164, 0),         CHAN5G(165, 0),
 210         CHAN5G(166, 0),         CHAN5G(168, 0),
 211         CHAN5G(170, 0),         CHAN5G(172, 0),
 212         CHAN5G(174, 0),         CHAN5G(176, 0),
 213         CHAN5G(178, 0),         CHAN5G(180, 0),
 214         CHAN5G(182, 0),         CHAN5G(184, 0),
 215         CHAN5G(186, 0),         CHAN5G(188, 0),
 216         CHAN5G(190, 0),         CHAN5G(192, 0),
 217         CHAN5G(194, 0),         CHAN5G(196, 0),
 218         CHAN5G(198, 0),         CHAN5G(200, 0),
 219         CHAN5G(202, 0),         CHAN5G(204, 0),
 220         CHAN5G(206, 0),         CHAN5G(208, 0),
 221         CHAN5G(210, 0),         CHAN5G(212, 0),
 222         CHAN5G(214, 0),         CHAN5G(216, 0),
 223         CHAN5G(218, 0),         CHAN5G(220, 0),
 224         CHAN5G(222, 0),         CHAN5G(224, 0),
 225         CHAN5G(226, 0),         CHAN5G(228, 0),
 226 };
 227
 228 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 229         CHAN5G(34, 0),          CHAN5G(36, 0),
 230         CHAN5G(38, 0),          CHAN5G(40, 0),
 231         CHAN5G(42, 0),          CHAN5G(44, 0),
 232         CHAN5G(46, 0),          CHAN5G(48, 0),
 233         CHAN5G(52, 0),          CHAN5G(56, 0),
 234         CHAN5G(60, 0),          CHAN5G(64, 0),
 235         CHAN5G(100, 0),         CHAN5G(104, 0),
 236         CHAN5G(108, 0),         CHAN5G(112, 0),
 237         CHAN5G(116, 0),         CHAN5G(120, 0),
 238         CHAN5G(124, 0),         CHAN5G(128, 0),
 239         CHAN5G(132, 0),         CHAN5G(136, 0),
 240         CHAN5G(140, 0),         CHAN5G(149, 0),
 241         CHAN5G(153, 0),         CHAN5G(157, 0),
 242         CHAN5G(161, 0),         CHAN5G(165, 0),
 243         CHAN5G(184, 0),         CHAN5G(188, 0),
 244         CHAN5G(192, 0),         CHAN5G(196, 0),
 245         CHAN5G(200, 0),         CHAN5G(204, 0),
 246         CHAN5G(208, 0),         CHAN5G(212, 0),
 247         CHAN5G(216, 0),
 248 };
 249 #undef CHAN5G
 250
 251 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 252         .band           = IEEE80211_BAND_5GHZ,
 253         .channels       = b43_5ghz_nphy_chantable,
 254         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 255         .bitrates       = b43_a_ratetable,
 256         .n_bitrates     = b43_a_ratetable_size,
 257 };
 258
 259 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 260         .band           = IEEE80211_BAND_5GHZ,
 261         .channels       = b43_5ghz_aphy_chantable,
 262         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 263         .bitrates       = b43_a_ratetable,
 264         .n_bitrates     = b43_a_ratetable_size,
 265 };
 266
 267 static struct ieee80211_supported_band b43_band_2GHz = {
 268         .band           = IEEE80211_BAND_2GHZ,
 269         .channels       = b43_2ghz_chantable,
 270         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 271         .bitrates       = b43_g_ratetable,
 272         .n_bitrates     = b43_g_ratetable_size,
 273 };
 274
 275 static void b43_wireless_core_exit(struct b43_wldev *dev);
 276 static int b43_wireless_core_init(struct b43_wldev *dev);
 277 static void b43_wireless_core_stop(struct b43_wldev *dev);
 278 static int b43_wireless_core_start(struct b43_wldev *dev);
 279
 280 static int b43_ratelimit(struct b43_wl *wl)
 281 {
 282         if (!wl || !wl->current_dev)
 283                 return 1;
 284         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 285                 return 1;
 286         /* We are up and running.
 287          * Ratelimit the messages to avoid DoS over the net. */
 288         return net_ratelimit();
 289 }
 290
 291 void b43info(struct b43_wl *wl, const char *fmt, ...)
 292 {
 293         va_list args;
 294
 295         if (!b43_ratelimit(wl))
 296                 return;
 297         va_start(args, fmt);
 298         printk(KERN_INFO "b43-%s: ",
 299                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 300         vprintk(fmt, args);
 301         va_end(args);
 302 }
 303
 304 void b43err(struct b43_wl *wl, const char *fmt, ...)
 305 {
 306         va_list args;
 307
 308         if (!b43_ratelimit(wl))
 309                 return;
 310         va_start(args, fmt);
 311         printk(KERN_ERR "b43-%s ERROR: ",
 312                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 313         vprintk(fmt, args);
 314         va_end(args);
 315 }
 316
 317 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 318 {
 319         va_list args;
 320
 321         if (!b43_ratelimit(wl))
 322                 return;
 323         va_start(args, fmt);
 324         printk(KERN_WARNING "b43-%s warning: ",
 325                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 326         vprintk(fmt, args);
 327         va_end(args);
 328 }
 329
 330 #if B43_DEBUG
 331 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 332 {
 333         va_list args;
 334
 335         va_start(args, fmt);
 336         printk(KERN_DEBUG "b43-%s debug: ",
 337                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 338         vprintk(fmt, args);
 339         va_end(args);
 340 }
 341 #endif /* DEBUG */
 342
 343 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 344 {
 345         u32 macctl;
 346
 347         B43_WARN_ON(offset % 4 != 0);
 348
 349         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 350         if (macctl & B43_MACCTL_BE)
 351                 val = swab32(val);
 352
 353         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 354         mmiowb();
 355         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 356 }
 357
 358 static inline void b43_shm_control_word(struct b43_wldev *dev,
 359                                         u16 routing, u16 offset)
 360 {
 361         u32 control;
 362
 363         /* "offset" is the WORD offset. */
 364         control = routing;
 365         control <<= 16;
 366         control |= offset;
 367         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 368 }
 369
 370 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 371 {
 372         struct b43_wl *wl = dev->wl;
 373         unsigned long flags;
 374         u32 ret;
 375
 376         spin_lock_irqsave(&wl->shm_lock, flags);
 377         if (routing == B43_SHM_SHARED) {
 378                 B43_WARN_ON(offset & 0x0001);
 379                 if (offset & 0x0003) {
 380                         /* Unaligned access */
 381                         b43_shm_control_word(dev, routing, offset >> 2);
 382                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 383                         ret <<= 16;
 384                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 385                         ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
 386
 387                         goto out;
 388                 }
 389                 offset >>= 2;
 390         }
 391         b43_shm_control_word(dev, routing, offset);
 392         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 393 out:
 394         spin_unlock_irqrestore(&wl->shm_lock, flags);
 395
 396         return ret;
 397 }
 398
 399 u16 b43_shm_read16(struct b43_wldev * dev, u16 routing, u16 offset)
 400 {
 401         struct b43_wl *wl = dev->wl;
 402         unsigned long flags;
 403         u16 ret;
 404
 405         spin_lock_irqsave(&wl->shm_lock, flags);
 406         if (routing == B43_SHM_SHARED) {
 407                 B43_WARN_ON(offset & 0x0001);
 408                 if (offset & 0x0003) {
 409                         /* Unaligned access */
 410                         b43_shm_control_word(dev, routing, offset >> 2);
 411                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 412
 413                         goto out;
 414                 }
 415                 offset >>= 2;
 416         }
 417         b43_shm_control_word(dev, routing, offset);
 418         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 419 out:
 420         spin_unlock_irqrestore(&wl->shm_lock, flags);
 421
 422         return ret;
 423 }
 424
 425 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 426 {
 427         struct b43_wl *wl = dev->wl;
 428         unsigned long flags;
 429
 430         spin_lock_irqsave(&wl->shm_lock, flags);
 431         if (routing == B43_SHM_SHARED) {
 432                 B43_WARN_ON(offset & 0x0001);
 433                 if (offset & 0x0003) {
 434                         /* Unaligned access */
 435                         b43_shm_control_word(dev, routing, offset >> 2);
 436                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 437                                     (value >> 16) & 0xffff);
 438                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 439                         b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
 440                         goto out;
 441                 }
 442                 offset >>= 2;
 443         }
 444         b43_shm_control_word(dev, routing, offset);
 445         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 446 out:
 447         spin_unlock_irqrestore(&wl->shm_lock, flags);
 448 }
 449
 450 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 451 {
 452         struct b43_wl *wl = dev->wl;
 453         unsigned long flags;
 454
 455         spin_lock_irqsave(&wl->shm_lock, flags);
 456         if (routing == B43_SHM_SHARED) {
 457                 B43_WARN_ON(offset & 0x0001);
 458                 if (offset & 0x0003) {
 459                         /* Unaligned access */
 460                         b43_shm_control_word(dev, routing, offset >> 2);
 461                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 462                         goto out;
 463                 }
 464                 offset >>= 2;
 465         }
 466         b43_shm_control_word(dev, routing, offset);
 467         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 468 out:
 469         spin_unlock_irqrestore(&wl->shm_lock, flags);
 470 }
 471
 472 /* Read HostFlags */
 473 u64 b43_hf_read(struct b43_wldev * dev)
 474 {
 475         u64 ret;
 476
 477         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 478         ret <<= 16;
 479         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 480         ret <<= 16;
 481         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 482
 483         return ret;
 484 }
 485
 486 /* Write HostFlags */
 487 void b43_hf_write(struct b43_wldev *dev, u64 value)
 488 {
 489         u16 lo, mi, hi;
 490
 491         lo = (value & 0x00000000FFFFULL);
 492         mi = (value & 0x0000FFFF0000ULL) >> 16;
 493         hi = (value & 0xFFFF00000000ULL) >> 32;
 494         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 495         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 496         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 497 }
 498
 499 void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
 500 {
 501         /* We need to be careful. As we read the TSF from multiple
 502          * registers, we should take care of register overflows.
 503          * In theory, the whole tsf read process should be atomic.
 504          * We try to be atomic here, by restaring the read process,
 505          * if any of the high registers changed (overflew).
 506          */
 507         if (dev->dev->id.revision >= 3) {
 508                 u32 low, high, high2;
 509
 510                 do {
 511                         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 512                         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 513                         high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 514                 } while (unlikely(high != high2));
 515
 516                 *tsf = high;
 517                 *tsf <<= 32;
 518                 *tsf |= low;
 519         } else {
 520                 u64 tmp;
 521                 u16 v0, v1, v2, v3;
 522                 u16 test1, test2, test3;
 523
 524                 do {
 525                         v3 = b43_read16(dev, B43_MMIO_TSF_3);
 526                         v2 = b43_read16(dev, B43_MMIO_TSF_2);
 527                         v1 = b43_read16(dev, B43_MMIO_TSF_1);
 528                         v0 = b43_read16(dev, B43_MMIO_TSF_0);
 529
 530                         test3 = b43_read16(dev, B43_MMIO_TSF_3);
 531                         test2 = b43_read16(dev, B43_MMIO_TSF_2);
 532                         test1 = b43_read16(dev, B43_MMIO_TSF_1);
 533                 } while (v3 != test3 || v2 != test2 || v1 != test1);
 534
 535                 *tsf = v3;
 536                 *tsf <<= 48;
 537                 tmp = v2;
 538                 tmp <<= 32;
 539                 *tsf |= tmp;
 540                 tmp = v1;
 541                 tmp <<= 16;
 542                 *tsf |= tmp;
 543                 *tsf |= v0;
 544         }
 545 }
 546
 547 static void b43_time_lock(struct b43_wldev *dev)
 548 {
 549         u32 macctl;
 550
 551         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 552         macctl |= B43_MACCTL_TBTTHOLD;
 553         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 554         /* Commit the write */
 555         b43_read32(dev, B43_MMIO_MACCTL);
 556 }
 557
 558 static void b43_time_unlock(struct b43_wldev *dev)
 559 {
 560         u32 macctl;
 561
 562         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 563         macctl &= ~B43_MACCTL_TBTTHOLD;
 564         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 565         /* Commit the write */
 566         b43_read32(dev, B43_MMIO_MACCTL);
 567 }
 568
 569 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 570 {
 571         /* Be careful with the in-progress timer.
 572          * First zero out the low register, so we have a full
 573          * register-overflow duration to complete the operation.
 574          */
 575         if (dev->dev->id.revision >= 3) {
 576                 u32 lo = (tsf & 0x00000000FFFFFFFFULL);
 577                 u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
 578
 579                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
 580                 mmiowb();
 581                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
 582                 mmiowb();
 583                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
 584         } else {
 585                 u16 v0 = (tsf & 0x000000000000FFFFULL);
 586                 u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
 587                 u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
 588                 u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
 589
 590                 b43_write16(dev, B43_MMIO_TSF_0, 0);
 591                 mmiowb();
 592                 b43_write16(dev, B43_MMIO_TSF_3, v3);
 593                 mmiowb();
 594                 b43_write16(dev, B43_MMIO_TSF_2, v2);
 595                 mmiowb();
 596                 b43_write16(dev, B43_MMIO_TSF_1, v1);
 597                 mmiowb();
 598                 b43_write16(dev, B43_MMIO_TSF_0, v0);
 599         }
 600 }
 601
 602 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 603 {
 604         b43_time_lock(dev);
 605         b43_tsf_write_locked(dev, tsf);
 606         b43_time_unlock(dev);
 607 }
 608
 609 static
 610 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
 611 {
 612         static const u8 zero_addr[ETH_ALEN] = { 0 };
 613         u16 data;
 614
 615         if (!mac)
 616                 mac = zero_addr;
 617
 618         offset |= 0x0020;
 619         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 620
 621         data = mac[0];
 622         data |= mac[1] << 8;
 623         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 624         data = mac[2];
 625         data |= mac[3] << 8;
 626         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 627         data = mac[4];
 628         data |= mac[5] << 8;
 629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 630 }
 631
 632 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 633 {
 634         const u8 *mac;
 635         const u8 *bssid;
 636         u8 mac_bssid[ETH_ALEN * 2];
 637         int i;
 638         u32 tmp;
 639
 640         bssid = dev->wl->bssid;
 641         mac = dev->wl->mac_addr;
 642
 643         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 644
 645         memcpy(mac_bssid, mac, ETH_ALEN);
 646         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 647
 648         /* Write our MAC address and BSSID to template ram */
 649         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 650                 tmp = (u32) (mac_bssid[i + 0]);
 651                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 652                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 653                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 654                 b43_ram_write(dev, 0x20 + i, tmp);
 655         }
 656 }
 657
 658 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 659 {
 660         b43_write_mac_bssid_templates(dev);
 661         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 662 }
 663
 664 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 665 {
 666         /* slot_time is in usec. */
 667         if (dev->phy.type != B43_PHYTYPE_G)
 668                 return;
 669         b43_write16(dev, 0x684, 510 + slot_time);
 670         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 671 }
 672
 673 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 674 {
 675         b43_set_slot_time(dev, 9);
 676         dev->short_slot = 1;
 677 }
 678
 679 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 680 {
 681         b43_set_slot_time(dev, 20);
 682         dev->short_slot = 0;
 683 }
 684
 685 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
 686  * Returns the _previously_ enabled IRQ mask.
 687  */
 688 static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
 689 {
 690         u32 old_mask;
 691
 692         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 693         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
 694
 695         return old_mask;
 696 }
 697
 698 /* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
 699  * Returns the _previously_ enabled IRQ mask.
 700  */
 701 static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
 702 {
 703         u32 old_mask;
 704
 705         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 706         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
 707
 708         return old_mask;
 709 }
 710
 711 /* Synchronize IRQ top- and bottom-half.
 712  * IRQs must be masked before calling this.
 713  * This must not be called with the irq_lock held.
 714  */
 715 static void b43_synchronize_irq(struct b43_wldev *dev)
 716 {
 717         synchronize_irq(dev->dev->irq);
 718         tasklet_kill(&dev->isr_tasklet);
 719 }
 720
 721 /* DummyTransmission function, as documented on
 722  * http://bcm-specs.sipsolutions.net/DummyTransmission
 723  */
 724 void b43_dummy_transmission(struct b43_wldev *dev)
 725 {
 726         struct b43_phy *phy = &dev->phy;
 727         unsigned int i, max_loop;
 728         u16 value;
 729         u32 buffer[5] = {
 730                 0x00000000,
 731                 0x00D40000,
 732                 0x00000000,
 733                 0x01000000,
 734                 0x00000000,
 735         };
 736
 737         switch (phy->type) {
 738         case B43_PHYTYPE_A:
 739                 max_loop = 0x1E;
 740                 buffer[0] = 0x000201CC;
 741                 break;
 742         case B43_PHYTYPE_B:
 743         case B43_PHYTYPE_G:
 744                 max_loop = 0xFA;
 745                 buffer[0] = 0x000B846E;
 746                 break;
 747         default:
 748                 B43_WARN_ON(1);
 749                 return;
 750         }
 751
 752         for (i = 0; i < 5; i++)
 753                 b43_ram_write(dev, i * 4, buffer[i]);
 754
 755         /* Commit writes */
 756         b43_read32(dev, B43_MMIO_MACCTL);
 757
 758         b43_write16(dev, 0x0568, 0x0000);
 759         b43_write16(dev, 0x07C0, 0x0000);
 760         value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
 761         b43_write16(dev, 0x050C, value);
 762         b43_write16(dev, 0x0508, 0x0000);
 763         b43_write16(dev, 0x050A, 0x0000);
 764         b43_write16(dev, 0x054C, 0x0000);
 765         b43_write16(dev, 0x056A, 0x0014);
 766         b43_write16(dev, 0x0568, 0x0826);
 767         b43_write16(dev, 0x0500, 0x0000);
 768         b43_write16(dev, 0x0502, 0x0030);
 769
 770         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 771                 b43_radio_write16(dev, 0x0051, 0x0017);
 772         for (i = 0x00; i < max_loop; i++) {
 773                 value = b43_read16(dev, 0x050E);
 774                 if (value & 0x0080)
 775                         break;
 776                 udelay(10);
 777         }
 778         for (i = 0x00; i < 0x0A; i++) {
 779                 value = b43_read16(dev, 0x050E);
 780                 if (value & 0x0400)
 781                         break;
 782                 udelay(10);
 783         }
 784         for (i = 0x00; i < 0x0A; i++) {
 785                 value = b43_read16(dev, 0x0690);
 786                 if (!(value & 0x0100))
 787                         break;
 788                 udelay(10);
 789         }
 790         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 791                 b43_radio_write16(dev, 0x0051, 0x0037);
 792 }
 793
 794 static void key_write(struct b43_wldev *dev,
 795                       u8 index, u8 algorithm, const u8 * key)
 796 {
 797         unsigned int i;
 798         u32 offset;
 799         u16 value;
 800         u16 kidx;
 801
 802         /* Key index/algo block */
 803         kidx = b43_kidx_to_fw(dev, index);
 804         value = ((kidx << 4) | algorithm);
 805         b43_shm_write16(dev, B43_SHM_SHARED,
 806                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 807
 808         /* Write the key to the Key Table Pointer offset */
 809         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 810         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 811                 value = key[i];
 812                 value |= (u16) (key[i + 1]) << 8;
 813                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 814         }
 815 }
 816
 817 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
 818 {
 819         u32 addrtmp[2] = { 0, 0, };
 820         u8 per_sta_keys_start = 8;
 821
 822         if (b43_new_kidx_api(dev))
 823                 per_sta_keys_start = 4;
 824
 825         B43_WARN_ON(index < per_sta_keys_start);
 826         /* We have two default TX keys and possibly two default RX keys.
 827          * Physical mac 0 is mapped to physical key 4 or 8, depending
 828          * on the firmware version.
 829          * So we must adjust the index here.
 830          */
 831         index -= per_sta_keys_start;
 832
 833         if (addr) {
 834                 addrtmp[0] = addr[0];
 835                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 836                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 837                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 838                 addrtmp[1] = addr[4];
 839                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 840         }
 841
 842         if (dev->dev->id.revision >= 5) {
 843                 /* Receive match transmitter address mechanism */
 844                 b43_shm_write32(dev, B43_SHM_RCMTA,
 845                                 (index * 2) + 0, addrtmp[0]);
 846                 b43_shm_write16(dev, B43_SHM_RCMTA,
 847                                 (index * 2) + 1, addrtmp[1]);
 848         } else {
 849                 /* RXE (Receive Engine) and
 850                  * PSM (Programmable State Machine) mechanism
 851                  */
 852                 if (index < 8) {
 853                         /* TODO write to RCM 16, 19, 22 and 25 */
 854                 } else {
 855                         b43_shm_write32(dev, B43_SHM_SHARED,
 856                                         B43_SHM_SH_PSM + (index * 6) + 0,
 857                                         addrtmp[0]);
 858                         b43_shm_write16(dev, B43_SHM_SHARED,
 859                                         B43_SHM_SH_PSM + (index * 6) + 4,
 860                                         addrtmp[1]);
 861                 }
 862         }
 863 }
 864
 865 static void do_key_write(struct b43_wldev *dev,
 866                          u8 index, u8 algorithm,
 867                          const u8 * key, size_t key_len, const u8 * mac_addr)
 868 {
 869         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 870         u8 per_sta_keys_start = 8;
 871
 872         if (b43_new_kidx_api(dev))
 873                 per_sta_keys_start = 4;
 874
 875         B43_WARN_ON(index >= dev->max_nr_keys);
 876         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 877
 878         if (index >= per_sta_keys_start)
 879                 keymac_write(dev, index, NULL); /* First zero out mac. */
 880         if (key)
 881                 memcpy(buf, key, key_len);
 882         key_write(dev, index, algorithm, buf);
 883         if (index >= per_sta_keys_start)
 884                 keymac_write(dev, index, mac_addr);
 885
 886         dev->key[index].algorithm = algorithm;
 887 }
 888
 889 static int b43_key_write(struct b43_wldev *dev,
 890                          int index, u8 algorithm,
 891                          const u8 * key, size_t key_len,
 892                          const u8 * mac_addr,
 893                          struct ieee80211_key_conf *keyconf)
 894 {
 895         int i;
 896         int sta_keys_start;
 897
 898         if (key_len > B43_SEC_KEYSIZE)
 899                 return -EINVAL;
 900         for (i = 0; i < dev->max_nr_keys; i++) {
 901                 /* Check that we don't already have this key. */
 902                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 903         }
 904         if (index < 0) {
 905                 /* Either pairwise key or address is 00:00:00:00:00:00
 906                  * for transmit-only keys. Search the index. */
 907                 if (b43_new_kidx_api(dev))
 908                         sta_keys_start = 4;
 909                 else
 910                         sta_keys_start = 8;
 911                 for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
 912                         if (!dev->key[i].keyconf) {
 913                                 /* found empty */
 914                                 index = i;
 915                                 break;
 916                         }
 917                 }
 918                 if (index < 0) {
 919                         b43err(dev->wl, "Out of hardware key memory\n");
 920                         return -ENOSPC;
 921                 }
 922         } else
 923                 B43_WARN_ON(index > 3);
 924
 925         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 926         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 927                 /* Default RX key */
 928                 B43_WARN_ON(mac_addr);
 929                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 930         }
 931         keyconf->hw_key_idx = index;
 932         dev->key[index].keyconf = keyconf;
 933
 934         return 0;
 935 }
 936
 937 static int b43_key_clear(struct b43_wldev *dev, int index)
 938 {
 939         if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
 940                 return -EINVAL;
 941         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 942                      NULL, B43_SEC_KEYSIZE, NULL);
 943         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 944                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 945                              NULL, B43_SEC_KEYSIZE, NULL);
 946         }
 947         dev->key[index].keyconf = NULL;
 948
 949         return 0;
 950 }
 951
 952 static void b43_clear_keys(struct b43_wldev *dev)
 953 {
 954         int i;
 955
 956         for (i = 0; i < dev->max_nr_keys; i++)
 957                 b43_key_clear(dev, i);
 958 }
 959
 960 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 961 {
 962         u32 macctl;
 963         u16 ucstat;
 964         bool hwps;
 965         bool awake;
 966         int i;
 967
 968         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
 969                     (ps_flags & B43_PS_DISABLED));
 970         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
 971
 972         if (ps_flags & B43_PS_ENABLED) {
 973                 hwps = 1;
 974         } else if (ps_flags & B43_PS_DISABLED) {
 975                 hwps = 0;
 976         } else {
 977                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
 978                 //      and thus is not an AP and we are associated, set bit 25
 979         }
 980         if (ps_flags & B43_PS_AWAKE) {
 981                 awake = 1;
 982         } else if (ps_flags & B43_PS_ASLEEP) {
 983                 awake = 0;
 984         } else {
 985                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
 986                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
 987                 //      successful, set bit26
 988         }
 989
 990 /* FIXME: For now we force awake-on and hwps-off */
 991         hwps = 0;
 992         awake = 1;
 993
 994         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 995         if (hwps)
 996                 macctl |= B43_MACCTL_HWPS;
 997         else
 998                 macctl &= ~B43_MACCTL_HWPS;
 999         if (awake)
1000                 macctl |= B43_MACCTL_AWAKE;
1001         else
1002                 macctl &= ~B43_MACCTL_AWAKE;
1003         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1004         /* Commit write */
1005         b43_read32(dev, B43_MMIO_MACCTL);
1006         if (awake && dev->dev->id.revision >= 5) {
1007                 /* Wait for the microcode to wake up. */
1008                 for (i = 0; i < 100; i++) {
1009                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1010                                                 B43_SHM_SH_UCODESTAT);
1011                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1012                                 break;
1013                         udelay(10);
1014                 }
1015         }
1016 }
1017
1018 /* Turn the Analog ON/OFF */
1019 static void b43_switch_analog(struct b43_wldev *dev, int on)
1020 {
1021         b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
1022 }
1023
1024 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1025 {
1026         u32 tmslow;
1027         u32 macctl;
1028
1029         flags |= B43_TMSLOW_PHYCLKEN;
1030         flags |= B43_TMSLOW_PHYRESET;
1031         ssb_device_enable(dev->dev, flags);
1032         msleep(2);              /* Wait for the PLL to turn on. */
1033
1034         /* Now take the PHY out of Reset again */
1035         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1036         tmslow |= SSB_TMSLOW_FGC;
1037         tmslow &= ~B43_TMSLOW_PHYRESET;
1038         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1039         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1040         msleep(1);
1041         tmslow &= ~SSB_TMSLOW_FGC;
1042         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1043         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1044         msleep(1);
1045
1046         /* Turn Analog ON */
1047         b43_switch_analog(dev, 1);
1048
1049         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1050         macctl &= ~B43_MACCTL_GMODE;
1051         if (flags & B43_TMSLOW_GMODE)
1052                 macctl |= B43_MACCTL_GMODE;
1053         macctl |= B43_MACCTL_IHR_ENABLED;
1054         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1055 }
1056
1057 static void handle_irq_transmit_status(struct b43_wldev *dev)
1058 {
1059         u32 v0, v1;
1060         u16 tmp;
1061         struct b43_txstatus stat;
1062
1063         while (1) {
1064                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1065                 if (!(v0 & 0x00000001))
1066                         break;
1067                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1068
1069                 stat.cookie = (v0 >> 16);
1070                 stat.seq = (v1 & 0x0000FFFF);
1071                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1072                 tmp = (v0 & 0x0000FFFF);
1073                 stat.frame_count = ((tmp & 0xF000) >> 12);
1074                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1075                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1076                 stat.pm_indicated = !!(tmp & 0x0080);
1077                 stat.intermediate = !!(tmp & 0x0040);
1078                 stat.for_ampdu = !!(tmp & 0x0020);
1079                 stat.acked = !!(tmp & 0x0002);
1080
1081                 b43_handle_txstatus(dev, &stat);
1082         }
1083 }
1084
1085 static void drain_txstatus_queue(struct b43_wldev *dev)
1086 {
1087         u32 dummy;
1088
1089         if (dev->dev->id.revision < 5)
1090                 return;
1091         /* Read all entries from the microcode TXstatus FIFO
1092          * and throw them away.
1093          */
1094         while (1) {
1095                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1096                 if (!(dummy & 0x00000001))
1097                         break;
1098                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1099         }
1100 }
1101
1102 static u32 b43_jssi_read(struct b43_wldev *dev)
1103 {
1104         u32 val = 0;
1105
1106         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1107         val <<= 16;
1108         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1109
1110         return val;
1111 }
1112
1113 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1114 {
1115         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1116         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1117 }
1118
1119 static void b43_generate_noise_sample(struct b43_wldev *dev)
1120 {
1121         b43_jssi_write(dev, 0x7F7F7F7F);
1122         b43_write32(dev, B43_MMIO_MACCMD,
1123                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1124         B43_WARN_ON(dev->noisecalc.channel_at_start != dev->phy.channel);
1125 }
1126
1127 static void b43_calculate_link_quality(struct b43_wldev *dev)
1128 {
1129         /* Top half of Link Quality calculation. */
1130
1131         if (dev->noisecalc.calculation_running)
1132                 return;
1133         dev->noisecalc.channel_at_start = dev->phy.channel;
1134         dev->noisecalc.calculation_running = 1;
1135         dev->noisecalc.nr_samples = 0;
1136
1137         b43_generate_noise_sample(dev);
1138 }
1139
1140 static void handle_irq_noise(struct b43_wldev *dev)
1141 {
1142         struct b43_phy *phy = &dev->phy;
1143         u16 tmp;
1144         u8 noise[4];
1145         u8 i, j;
1146         s32 average;
1147
1148         /* Bottom half of Link Quality calculation. */
1149
1150         B43_WARN_ON(!dev->noisecalc.calculation_running);
1151         if (dev->noisecalc.channel_at_start != phy->channel)
1152                 goto drop_calculation;
1153         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1154         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1155             noise[2] == 0x7F || noise[3] == 0x7F)
1156                 goto generate_new;
1157
1158         /* Get the noise samples. */
1159         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1160         i = dev->noisecalc.nr_samples;
1161         noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1162         noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1163         noise[2] = limit_value(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1164         noise[3] = limit_value(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1165         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1166         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1167         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1168         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1169         dev->noisecalc.nr_samples++;
1170         if (dev->noisecalc.nr_samples == 8) {
1171                 /* Calculate the Link Quality by the noise samples. */
1172                 average = 0;
1173                 for (i = 0; i < 8; i++) {
1174                         for (j = 0; j < 4; j++)
1175                                 average += dev->noisecalc.samples[i][j];
1176                 }
1177                 average /= (8 * 4);
1178                 average *= 125;
1179                 average += 64;
1180                 average /= 128;
1181                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1182                 tmp = (tmp / 128) & 0x1F;
1183                 if (tmp >= 8)
1184                         average += 2;
1185                 else
1186                         average -= 25;
1187                 if (tmp == 8)
1188                         average -= 72;
1189                 else
1190                         average -= 48;
1191
1192                 dev->stats.link_noise = average;
1193               drop_calculation:
1194                 dev->noisecalc.calculation_running = 0;
1195                 return;
1196         }
1197       generate_new:
1198         b43_generate_noise_sample(dev);
1199 }
1200
1201 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1202 {
1203         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP)) {
1204                 ///TODO: PS TBTT
1205         } else {
1206                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1207                         b43_power_saving_ctl_bits(dev, 0);
1208         }
1209         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
1210                 dev->dfq_valid = 1;
1211 }
1212
1213 static void handle_irq_atim_end(struct b43_wldev *dev)
1214 {
1215         if (dev->dfq_valid) {
1216                 b43_write32(dev, B43_MMIO_MACCMD,
1217                             b43_read32(dev, B43_MMIO_MACCMD)
1218                             | B43_MACCMD_DFQ_VALID);
1219                 dev->dfq_valid = 0;
1220         }
1221 }
1222
1223 static void handle_irq_pmq(struct b43_wldev *dev)
1224 {
1225         u32 tmp;
1226
1227         //TODO: AP mode.
1228
1229         while (1) {
1230                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1231                 if (!(tmp & 0x00000008))
1232                         break;
1233         }
1234         /* 16bit write is odd, but correct. */
1235         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1236 }
1237
1238 static void b43_write_template_common(struct b43_wldev *dev,
1239                                       const u8 * data, u16 size,
1240                                       u16 ram_offset,
1241                                       u16 shm_size_offset, u8 rate)
1242 {
1243         u32 i, tmp;
1244         struct b43_plcp_hdr4 plcp;
1245
1246         plcp.data = 0;
1247         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1248         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1249         ram_offset += sizeof(u32);
1250         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1251          * So leave the first two bytes of the next write blank.
1252          */
1253         tmp = (u32) (data[0]) << 16;
1254         tmp |= (u32) (data[1]) << 24;
1255         b43_ram_write(dev, ram_offset, tmp);
1256         ram_offset += sizeof(u32);
1257         for (i = 2; i < size; i += sizeof(u32)) {
1258                 tmp = (u32) (data[i + 0]);
1259                 if (i + 1 < size)
1260                         tmp |= (u32) (data[i + 1]) << 8;
1261                 if (i + 2 < size)
1262                         tmp |= (u32) (data[i + 2]) << 16;
1263                 if (i + 3 < size)
1264                         tmp |= (u32) (data[i + 3]) << 24;
1265                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1266         }
1267         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1268                         size + sizeof(struct b43_plcp_hdr6));
1269 }
1270
1271 static void b43_write_beacon_template(struct b43_wldev *dev,
1272                                       u16 ram_offset,
1273                                       u16 shm_size_offset, u8 rate)
1274 {
1275         unsigned int i, len, variable_len;
1276         const struct ieee80211_mgmt *bcn;
1277         const u8 *ie;
1278         bool tim_found = 0;
1279
1280         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1281         len = min((size_t) dev->wl->current_beacon->len,
1282                   0x200 - sizeof(struct b43_plcp_hdr6));
1283
1284         b43_write_template_common(dev, (const u8 *)bcn,
1285                                   len, ram_offset, shm_size_offset, rate);
1286
1287         /* Find the position of the TIM and the DTIM_period value
1288          * and write them to SHM. */
1289         ie = bcn->u.beacon.variable;
1290         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1291         for (i = 0; i < variable_len - 2; ) {
1292                 uint8_t ie_id, ie_len;
1293
1294                 ie_id = ie[i];
1295                 ie_len = ie[i + 1];
1296                 if (ie_id == 5) {
1297                         u16 tim_position;
1298                         u16 dtim_period;
1299                         /* This is the TIM Information Element */
1300
1301                         /* Check whether the ie_len is in the beacon data range. */
1302                         if (variable_len < ie_len + 2 + i)
1303                                 break;
1304                         /* A valid TIM is at least 4 bytes long. */
1305                         if (ie_len < 4)
1306                                 break;
1307                         tim_found = 1;
1308
1309                         tim_position = sizeof(struct b43_plcp_hdr6);
1310                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1311                         tim_position += i;
1312
1313                         dtim_period = ie[i + 3];
1314
1315                         b43_shm_write16(dev, B43_SHM_SHARED,
1316                                         B43_SHM_SH_TIMBPOS, tim_position);
1317                         b43_shm_write16(dev, B43_SHM_SHARED,
1318                                         B43_SHM_SH_DTIMPER, dtim_period);
1319                         break;
1320                 }
1321                 i += ie_len + 2;
1322         }
1323         if (!tim_found) {
1324                 b43warn(dev->wl, "Did not find a valid TIM IE in "
1325                         "the beacon template packet. AP or IBSS operation "
1326                         "may be broken.\n");
1327         }
1328 }
1329
1330 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1331                                       u16 shm_offset, u16 size,
1332                                       struct ieee80211_rate *rate)
1333 {
1334         struct b43_plcp_hdr4 plcp;
1335         u32 tmp;
1336         __le16 dur;
1337
1338         plcp.data = 0;
1339         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1340         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1341                                                dev->wl->vif, size,
1342                                                rate);
1343         /* Write PLCP in two parts and timing for packet transfer */
1344         tmp = le32_to_cpu(plcp.data);
1345         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1346         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1347         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1348 }
1349
1350 /* Instead of using custom probe response template, this function
1351  * just patches custom beacon template by:
1352  * 1) Changing packet type
1353  * 2) Patching duration field
1354  * 3) Stripping TIM
1355  */
1356 static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1357                                           u16 *dest_size,
1358                                           struct ieee80211_rate *rate)
1359 {
1360         const u8 *src_data;
1361         u8 *dest_data;
1362         u16 src_size, elem_size, src_pos, dest_pos;
1363         __le16 dur;
1364         struct ieee80211_hdr *hdr;
1365         size_t ie_start;
1366
1367         src_size = dev->wl->current_beacon->len;
1368         src_data = (const u8 *)dev->wl->current_beacon->data;
1369
1370         /* Get the start offset of the variable IEs in the packet. */
1371         ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1372         B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1373
1374         if (B43_WARN_ON(src_size < ie_start))
1375                 return NULL;
1376
1377         dest_data = kmalloc(src_size, GFP_ATOMIC);
1378         if (unlikely(!dest_data))
1379                 return NULL;
1380
1381         /* Copy the static data and all Information Elements, except the TIM. */
1382         memcpy(dest_data, src_data, ie_start);
1383         src_pos = ie_start;
1384         dest_pos = ie_start;
1385         for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1386                 elem_size = src_data[src_pos + 1] + 2;
1387                 if (src_data[src_pos] == 5) {
1388                         /* This is the TIM. */
1389                         continue;
1390                 }
1391                 memcpy(dest_data + dest_pos, src_data + src_pos,
1392                        elem_size);
1393                 dest_pos += elem_size;
1394         }
1395         *dest_size = dest_pos;
1396         hdr = (struct ieee80211_hdr *)dest_data;
1397
1398         /* Set the frame control. */
1399         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1400                                          IEEE80211_STYPE_PROBE_RESP);
1401         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1402                                                dev->wl->vif, *dest_size,
1403                                                rate);
1404         hdr->duration_id = dur;
1405
1406         return dest_data;
1407 }
1408
1409 static void b43_write_probe_resp_template(struct b43_wldev *dev,
1410                                           u16 ram_offset,
1411                                           u16 shm_size_offset,
1412                                           struct ieee80211_rate *rate)
1413 {
1414         const u8 *probe_resp_data;
1415         u16 size;
1416
1417         size = dev->wl->current_beacon->len;
1418         probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1419         if (unlikely(!probe_resp_data))
1420                 return;
1421
1422         /* Looks like PLCP headers plus packet timings are stored for
1423          * all possible basic rates
1424          */
1425         b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1426         b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1427         b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1428         b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1429
1430         size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1431         b43_write_template_common(dev, probe_resp_data,
1432                                   size, ram_offset, shm_size_offset,
1433                                   rate->hw_value);
1434         kfree(probe_resp_data);
1435 }
1436
1437 /* Asynchronously update the packet templates in template RAM.
1438  * Locking: Requires wl->irq_lock to be locked. */
1439 static void b43_update_templates(struct b43_wl *wl, struct sk_buff *beacon)
1440 {
1441         /* This is the top half of the ansynchronous beacon update.
1442          * The bottom half is the beacon IRQ.
1443          * Beacon update must be asynchronous to avoid sending an
1444          * invalid beacon. This can happen for example, if the firmware
1445          * transmits a beacon while we are updating it. */
1446
1447         if (wl->current_beacon)
1448                 dev_kfree_skb_any(wl->current_beacon);
1449         wl->current_beacon = beacon;
1450         wl->beacon0_uploaded = 0;
1451         wl->beacon1_uploaded = 0;
1452 }
1453
1454 static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
1455 {
1456         u32 tmp;
1457         u16 i, len;
1458
1459         len = min((u16) ssid_len, (u16) 0x100);
1460         for (i = 0; i < len; i += sizeof(u32)) {
1461                 tmp = (u32) (ssid[i + 0]);
1462                 if (i + 1 < len)
1463                         tmp |= (u32) (ssid[i + 1]) << 8;
1464                 if (i + 2 < len)
1465                         tmp |= (u32) (ssid[i + 2]) << 16;
1466                 if (i + 3 < len)
1467                         tmp |= (u32) (ssid[i + 3]) << 24;
1468                 b43_shm_write32(dev, B43_SHM_SHARED, 0x380 + i, tmp);
1469         }
1470         b43_shm_write16(dev, B43_SHM_SHARED, 0x48, len);
1471 }
1472
1473 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1474 {
1475         b43_time_lock(dev);
1476         if (dev->dev->id.revision >= 3) {
1477                 b43_write32(dev, 0x188, (beacon_int << 16));
1478         } else {
1479                 b43_write16(dev, 0x606, (beacon_int >> 6));
1480                 b43_write16(dev, 0x610, beacon_int);
1481         }
1482         b43_time_unlock(dev);
1483 }
1484
1485 static void handle_irq_beacon(struct b43_wldev *dev)
1486 {
1487         struct b43_wl *wl = dev->wl;
1488         u32 cmd;
1489
1490         if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
1491                 return;
1492
1493         /* This is the bottom half of the asynchronous beacon update. */
1494
1495         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1496         if (!(cmd & B43_MACCMD_BEACON0_VALID)) {
1497                 if (!wl->beacon0_uploaded) {
1498                         b43_write_beacon_template(dev, 0x68, 0x18,
1499                                                   B43_CCK_RATE_1MB);
1500                         b43_write_probe_resp_template(dev, 0x268, 0x4A,
1501                                                       &__b43_ratetable[3]);
1502                         wl->beacon0_uploaded = 1;
1503                 }
1504                 cmd |= B43_MACCMD_BEACON0_VALID;
1505         }
1506         if (!(cmd & B43_MACCMD_BEACON1_VALID)) {
1507                 if (!wl->beacon1_uploaded) {
1508                         b43_write_beacon_template(dev, 0x468, 0x1A,
1509                                                   B43_CCK_RATE_1MB);
1510                         wl->beacon1_uploaded = 1;
1511                 }
1512                 cmd |= B43_MACCMD_BEACON1_VALID;
1513         }
1514         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1515 }
1516
1517 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1518 {
1519         //TODO
1520 }
1521
1522 /* Interrupt handler bottom-half */
1523 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1524 {
1525         u32 reason;
1526         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1527         u32 merged_dma_reason = 0;
1528         int i;
1529         unsigned long flags;
1530
1531         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1532
1533         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1534
1535         reason = dev->irq_reason;
1536         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1537                 dma_reason[i] = dev->dma_reason[i];
1538                 merged_dma_reason |= dma_reason[i];
1539         }
1540
1541         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1542                 b43err(dev->wl, "MAC transmission error\n");
1543
1544         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1545                 b43err(dev->wl, "PHY transmission error\n");
1546                 rmb();
1547                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1548                         atomic_set(&dev->phy.txerr_cnt,
1549                                    B43_PHY_TX_BADNESS_LIMIT);
1550                         b43err(dev->wl, "Too many PHY TX errors, "
1551                                         "restarting the controller\n");
1552                         b43_controller_restart(dev, "PHY TX errors");
1553                 }
1554         }
1555
1556         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1557                                           B43_DMAIRQ_NONFATALMASK))) {
1558                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1559                         b43err(dev->wl, "Fatal DMA error: "
1560                                "0x%08X, 0x%08X, 0x%08X, "
1561                                "0x%08X, 0x%08X, 0x%08X\n",
1562                                dma_reason[0], dma_reason[1],
1563                                dma_reason[2], dma_reason[3],
1564                                dma_reason[4], dma_reason[5]);
1565                         b43_controller_restart(dev, "DMA error");
1566                         mmiowb();
1567                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1568                         return;
1569                 }
1570                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1571                         b43err(dev->wl, "DMA error: "
1572                                "0x%08X, 0x%08X, 0x%08X, "
1573                                "0x%08X, 0x%08X, 0x%08X\n",
1574                                dma_reason[0], dma_reason[1],
1575                                dma_reason[2], dma_reason[3],
1576                                dma_reason[4], dma_reason[5]);
1577                 }
1578         }
1579
1580         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1581                 handle_irq_ucode_debug(dev);
1582         if (reason & B43_IRQ_TBTT_INDI)
1583                 handle_irq_tbtt_indication(dev);
1584         if (reason & B43_IRQ_ATIM_END)
1585                 handle_irq_atim_end(dev);
1586         if (reason & B43_IRQ_BEACON)
1587                 handle_irq_beacon(dev);
1588         if (reason & B43_IRQ_PMQ)
1589                 handle_irq_pmq(dev);
1590         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1591                 ;/* TODO */
1592         if (reason & B43_IRQ_NOISESAMPLE_OK)
1593                 handle_irq_noise(dev);
1594
1595         /* Check the DMA reason registers for received data. */
1596         if (dma_reason[0] & B43_DMAIRQ_RX_DONE)
1597                 b43_dma_rx(dev->dma.rx_ring);
1598         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1599         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1600         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1601         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1602         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1603
1604         if (reason & B43_IRQ_TX_OK)
1605                 handle_irq_transmit_status(dev);
1606
1607         b43_interrupt_enable(dev, dev->irq_savedstate);
1608         mmiowb();
1609         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1610 }
1611
1612 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1613 {
1614         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1615
1616         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1617         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1618         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1619         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1620         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1621         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1622 }
1623
1624 /* Interrupt handler top-half */
1625 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1626 {
1627         irqreturn_t ret = IRQ_NONE;
1628         struct b43_wldev *dev = dev_id;
1629         u32 reason;
1630
1631         if (!dev)
1632                 return IRQ_NONE;
1633
1634         spin_lock(&dev->wl->irq_lock);
1635
1636         if (b43_status(dev) < B43_STAT_STARTED)
1637                 goto out;
1638         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1639         if (reason == 0xffffffff)       /* shared IRQ */
1640                 goto out;
1641         ret = IRQ_HANDLED;
1642         reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1643         if (!reason)
1644                 goto out;
1645
1646         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1647             & 0x0001DC00;
1648         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1649             & 0x0000DC00;
1650         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1651             & 0x0000DC00;
1652         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1653             & 0x0001DC00;
1654         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1655             & 0x0000DC00;
1656         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1657             & 0x0000DC00;
1658
1659         b43_interrupt_ack(dev, reason);
1660         /* disable all IRQs. They are enabled again in the bottom half. */
1661         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1662         /* save the reason code and call our bottom half. */
1663         dev->irq_reason = reason;
1664         tasklet_schedule(&dev->isr_tasklet);
1665       out:
1666         mmiowb();
1667         spin_unlock(&dev->wl->irq_lock);
1668
1669         return ret;
1670 }
1671
1672 static void do_release_fw(struct b43_firmware_file *fw)
1673 {
1674         release_firmware(fw->data);
1675         fw->data = NULL;
1676         fw->filename = NULL;
1677 }
1678
1679 static void b43_release_firmware(struct b43_wldev *dev)
1680 {
1681         do_release_fw(&dev->fw.ucode);
1682         do_release_fw(&dev->fw.pcm);
1683         do_release_fw(&dev->fw.initvals);
1684         do_release_fw(&dev->fw.initvals_band);
1685 }
1686
1687 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1688 {
1689         const char *text;
1690
1691         text = "You must go to "
1692                "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1693                "and download the latest firmware (version 4).\n";
1694         if (error)
1695                 b43err(wl, text);
1696         else
1697                 b43warn(wl, text);
1698 }
1699
1700 static int do_request_fw(struct b43_wldev *dev,
1701                          const char *name,
1702                          struct b43_firmware_file *fw)
1703 {
1704         char path[sizeof(modparam_fwpostfix) + 32];
1705         const struct firmware *blob;
1706         struct b43_fw_header *hdr;
1707         u32 size;
1708         int err;
1709
1710         if (!name) {
1711                 /* Don't fetch anything. Free possibly cached firmware. */
1712                 do_release_fw(fw);
1713                 return 0;
1714         }
1715         if (fw->filename) {
1716                 if (strcmp(fw->filename, name) == 0)
1717                         return 0; /* Already have this fw. */
1718                 /* Free the cached firmware first. */
1719                 do_release_fw(fw);
1720         }
1721
1722         snprintf(path, ARRAY_SIZE(path),
1723                  "b43%s/%s.fw",
1724                  modparam_fwpostfix, name);
1725         err = request_firmware(&blob, path, dev->dev->dev);
1726         if (err) {
1727                 b43err(dev->wl, "Firmware file \"%s\" not found "
1728                        "or load failed.\n", path);
1729                 return err;
1730         }
1731         if (blob->size < sizeof(struct b43_fw_header))
1732                 goto err_format;
1733         hdr = (struct b43_fw_header *)(blob->data);
1734         switch (hdr->type) {
1735         case B43_FW_TYPE_UCODE:
1736         case B43_FW_TYPE_PCM:
1737                 size = be32_to_cpu(hdr->size);
1738                 if (size != blob->size - sizeof(struct b43_fw_header))
1739                         goto err_format;
1740                 /* fallthrough */
1741         case B43_FW_TYPE_IV:
1742                 if (hdr->ver != 1)
1743                         goto err_format;
1744                 break;
1745         default:
1746                 goto err_format;
1747         }
1748
1749         fw->data = blob;
1750         fw->filename = name;
1751
1752         return 0;
1753
1754 err_format:
1755         b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
1756         release_firmware(blob);
1757
1758         return -EPROTO;
1759 }
1760
1761 static int b43_request_firmware(struct b43_wldev *dev)
1762 {
1763         struct b43_firmware *fw = &dev->fw;
1764         const u8 rev = dev->dev->id.revision;
1765         const char *filename;
1766         u32 tmshigh;
1767         int err;
1768
1769         /* Get microcode */
1770         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
1771         if ((rev >= 5) && (rev <= 10))
1772                 filename = "ucode5";
1773         else if ((rev >= 11) && (rev <= 12))
1774                 filename = "ucode11";
1775         else if (rev >= 13)
1776                 filename = "ucode13";
1777         else
1778                 goto err_no_ucode;
1779         err = do_request_fw(dev, filename, &fw->ucode);
1780         if (err)
1781                 goto err_load;
1782
1783         /* Get PCM code */
1784         if ((rev >= 5) && (rev <= 10))
1785                 filename = "pcm5";
1786         else if (rev >= 11)
1787                 filename = NULL;
1788         else
1789                 goto err_no_pcm;
1790         err = do_request_fw(dev, filename, &fw->pcm);
1791         if (err)
1792                 goto err_load;
1793
1794         /* Get initvals */
1795         switch (dev->phy.type) {
1796         case B43_PHYTYPE_A:
1797                 if ((rev >= 5) && (rev <= 10)) {
1798                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
1799                                 filename = "a0g1initvals5";
1800                         else
1801                                 filename = "a0g0initvals5";
1802                 } else
1803                         goto err_no_initvals;
1804                 break;
1805         case B43_PHYTYPE_G:
1806                 if ((rev >= 5) && (rev <= 10))
1807                         filename = "b0g0initvals5";
1808                 else if (rev >= 13)
1809                         filename = "lp0initvals13";
1810                 else
1811                         goto err_no_initvals;
1812                 break;
1813         case B43_PHYTYPE_N:
1814                 if ((rev >= 11) && (rev <= 12))
1815                         filename = "n0initvals11";
1816                 else
1817                         goto err_no_initvals;
1818                 break;
1819         default:
1820                 goto err_no_initvals;
1821         }
1822         err = do_request_fw(dev, filename, &fw->initvals);
1823         if (err)
1824                 goto err_load;
1825
1826         /* Get bandswitch initvals */
1827         switch (dev->phy.type) {
1828         case B43_PHYTYPE_A:
1829                 if ((rev >= 5) && (rev <= 10)) {
1830                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
1831                                 filename = "a0g1bsinitvals5";
1832                         else
1833                                 filename = "a0g0bsinitvals5";
1834                 } else if (rev >= 11)
1835                         filename = NULL;
1836                 else
1837                         goto err_no_initvals;
1838                 break;
1839         case B43_PHYTYPE_G:
1840                 if ((rev >= 5) && (rev <= 10))
1841                         filename = "b0g0bsinitvals5";
1842                 else if (rev >= 11)
1843                         filename = NULL;
1844                 else
1845                         goto err_no_initvals;
1846                 break;
1847         case B43_PHYTYPE_N:
1848                 if ((rev >= 11) && (rev <= 12))
1849                         filename = "n0bsinitvals11";
1850                 else
1851                         goto err_no_initvals;
1852                 break;
1853         default:
1854                 goto err_no_initvals;
1855         }
1856         err = do_request_fw(dev, filename, &fw->initvals_band);
1857         if (err)
1858                 goto err_load;
1859
1860         return 0;
1861
1862 err_load:
1863         b43_print_fw_helptext(dev->wl, 1);
1864         goto error;
1865
1866 err_no_ucode:
1867         err = -ENODEV;
1868         b43err(dev->wl, "No microcode available for core rev %u\n", rev);
1869         goto error;
1870
1871 err_no_pcm:
1872         err = -ENODEV;
1873         b43err(dev->wl, "No PCM available for core rev %u\n", rev);
1874         goto error;
1875
1876 err_no_initvals:
1877         err = -ENODEV;
1878         b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
1879                "core rev %u\n", dev->phy.type, rev);
1880         goto error;
1881
1882 error:
1883         b43_release_firmware(dev);
1884         return err;
1885 }
1886
1887 static int b43_upload_microcode(struct b43_wldev *dev)
1888 {
1889         const size_t hdr_len = sizeof(struct b43_fw_header);
1890         const __be32 *data;
1891         unsigned int i, len;
1892         u16 fwrev, fwpatch, fwdate, fwtime;
1893         u32 tmp, macctl;
1894         int err = 0;
1895
1896         /* Jump the microcode PSM to offset 0 */
1897         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1898         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
1899         macctl |= B43_MACCTL_PSM_JMP0;
1900         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1901         /* Zero out all microcode PSM registers and shared memory. */
1902         for (i = 0; i < 64; i++)
1903                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
1904         for (i = 0; i < 4096; i += 2)
1905                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
1906
1907         /* Upload Microcode. */
1908         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
1909         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
1910         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
1911         for (i = 0; i < len; i++) {
1912                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
1913                 udelay(10);
1914         }
1915
1916         if (dev->fw.pcm.data) {
1917                 /* Upload PCM data. */
1918                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
1919                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
1920                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
1921                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
1922                 /* No need for autoinc bit in SHM_HW */
1923                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
1924                 for (i = 0; i < len; i++) {
1925                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
1926                         udelay(10);
1927                 }
1928         }
1929
1930         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
1931
1932         /* Start the microcode PSM */
1933         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1934         macctl &= ~B43_MACCTL_PSM_JMP0;
1935         macctl |= B43_MACCTL_PSM_RUN;
1936         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1937
1938         /* Wait for the microcode to load and respond */
1939         i = 0;
1940         while (1) {
1941                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1942                 if (tmp == B43_IRQ_MAC_SUSPENDED)
1943                         break;
1944                 i++;
1945                 if (i >= 20) {
1946                         b43err(dev->wl, "Microcode not responding\n");
1947                         b43_print_fw_helptext(dev->wl, 1);
1948                         err = -ENODEV;
1949                         goto error;
1950                 }
1951                 msleep_interruptible(50);
1952                 if (signal_pending(current)) {
1953                         err = -EINTR;
1954                         goto error;
1955                 }
1956         }
1957         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
1958
1959         /* Get and check the revisions. */
1960         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
1961         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
1962         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
1963         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
1964
1965         if (fwrev <= 0x128) {
1966                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
1967                        "binary drivers older than version 4.x is unsupported. "
1968                        "You must upgrade your firmware files.\n");
1969                 b43_print_fw_helptext(dev->wl, 1);
1970                 err = -EOPNOTSUPP;
1971                 goto error;
1972         }
1973         b43info(dev->wl, "Loading firmware version %u.%u "
1974                 "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
1975                 fwrev, fwpatch,
1976                 (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
1977                 (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
1978
1979         dev->fw.rev = fwrev;
1980         dev->fw.patch = fwpatch;
1981
1982         if (b43_is_old_txhdr_format(dev)) {
1983                 b43warn(dev->wl, "You are using an old firmware image. "
1984                         "Support for old firmware will be removed in July 2008.\n");
1985                 b43_print_fw_helptext(dev->wl, 0);
1986         }
1987
1988         return 0;
1989
1990 error:
1991         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1992         macctl &= ~B43_MACCTL_PSM_RUN;
1993         macctl |= B43_MACCTL_PSM_JMP0;
1994         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1995
1996         return err;
1997 }
1998
1999 static int b43_write_initvals(struct b43_wldev *dev,
2000                               const struct b43_iv *ivals,
2001                               size_t count,
2002                               size_t array_size)
2003 {
2004         const struct b43_iv *iv;
2005         u16 offset;
2006         size_t i;
2007         bool bit32;
2008
2009         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2010         iv = ivals;
2011         for (i = 0; i < count; i++) {
2012                 if (array_size < sizeof(iv->offset_size))
2013                         goto err_format;
2014                 array_size -= sizeof(iv->offset_size);
2015                 offset = be16_to_cpu(iv->offset_size);
2016                 bit32 = !!(offset & B43_IV_32BIT);
2017                 offset &= B43_IV_OFFSET_MASK;
2018                 if (offset >= 0x1000)
2019                         goto err_format;
2020                 if (bit32) {
2021                         u32 value;
2022
2023                         if (array_size < sizeof(iv->data.d32))
2024                                 goto err_format;
2025                         array_size -= sizeof(iv->data.d32);
2026
2027                         value = be32_to_cpu(get_unaligned(&iv->data.d32));
2028                         b43_write32(dev, offset, value);
2029
2030                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2031                                                         sizeof(__be16) +
2032                                                         sizeof(__be32));
2033                 } else {
2034                         u16 value;
2035
2036                         if (array_size < sizeof(iv->data.d16))
2037                                 goto err_format;
2038                         array_size -= sizeof(iv->data.d16);
2039
2040                         value = be16_to_cpu(iv->data.d16);
2041                         b43_write16(dev, offset, value);
2042
2043                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2044                                                         sizeof(__be16) +
2045                                                         sizeof(__be16));
2046                 }
2047         }
2048         if (array_size)
2049                 goto err_format;
2050
2051         return 0;
2052
2053 err_format:
2054         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2055         b43_print_fw_helptext(dev->wl, 1);
2056
2057         return -EPROTO;
2058 }
2059
2060 static int b43_upload_initvals(struct b43_wldev *dev)
2061 {
2062         const size_t hdr_len = sizeof(struct b43_fw_header);
2063         const struct b43_fw_header *hdr;
2064         struct b43_firmware *fw = &dev->fw;
2065         const struct b43_iv *ivals;
2066         size_t count;
2067         int err;
2068
2069         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2070         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2071         count = be32_to_cpu(hdr->size);
2072         err = b43_write_initvals(dev, ivals, count,
2073                                  fw->initvals.data->size - hdr_len);
2074         if (err)
2075                 goto out;
2076         if (fw->initvals_band.data) {
2077                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2078                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2079                 count = be32_to_cpu(hdr->size);
2080                 err = b43_write_initvals(dev, ivals, count,
2081                                          fw->initvals_band.data->size - hdr_len);
2082                 if (err)
2083                         goto out;
2084         }
2085 out:
2086
2087         return err;
2088 }
2089
2090 /* Initialize the GPIOs
2091  * http://bcm-specs.sipsolutions.net/GPIO
2092  */
2093 static int b43_gpio_init(struct b43_wldev *dev)
2094 {
2095         struct ssb_bus *bus = dev->dev->bus;
2096         struct ssb_device *gpiodev, *pcidev = NULL;
2097         u32 mask, set;
2098
2099         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2100                     & ~B43_MACCTL_GPOUTSMSK);
2101
2102         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2103                     | 0x000F);
2104
2105         mask = 0x0000001F;
2106         set = 0x0000000F;
2107         if (dev->dev->bus->chip_id == 0x4301) {
2108                 mask |= 0x0060;
2109                 set |= 0x0060;
2110         }
2111         if (0 /* FIXME: conditional unknown */ ) {
2112                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2113                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2114                             | 0x0100);
2115                 mask |= 0x0180;
2116                 set |= 0x0180;
2117         }
2118         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2119                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2120                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2121                             | 0x0200);
2122                 mask |= 0x0200;
2123                 set |= 0x0200;
2124         }
2125         if (dev->dev->id.revision >= 2)
2126                 mask |= 0x0010; /* FIXME: This is redundant. */
2127
2128 #ifdef CONFIG_SSB_DRIVER_PCICORE
2129         pcidev = bus->pcicore.dev;
2130 #endif
2131         gpiodev = bus->chipco.dev ? : pcidev;
2132         if (!gpiodev)
2133                 return 0;
2134         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2135                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2136                      & mask) | set);
2137
2138         return 0;
2139 }
2140
2141 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2142 static void b43_gpio_cleanup(struct b43_wldev *dev)
2143 {
2144         struct ssb_bus *bus = dev->dev->bus;
2145         struct ssb_device *gpiodev, *pcidev = NULL;
2146
2147 #ifdef CONFIG_SSB_DRIVER_PCICORE
2148         pcidev = bus->pcicore.dev;
2149 #endif
2150         gpiodev = bus->chipco.dev ? : pcidev;
2151         if (!gpiodev)
2152                 return;
2153         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2154 }
2155
2156 /* http://bcm-specs.sipsolutions.net/EnableMac */
2157 void b43_mac_enable(struct b43_wldev *dev)
2158 {
2159         dev->mac_suspended--;
2160         B43_WARN_ON(dev->mac_suspended < 0);
2161         B43_WARN_ON(irqs_disabled());
2162         if (dev->mac_suspended == 0) {
2163                 b43_write32(dev, B43_MMIO_MACCTL,
2164                             b43_read32(dev, B43_MMIO_MACCTL)
2165                             | B43_MACCTL_ENABLED);
2166                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2167                             B43_IRQ_MAC_SUSPENDED);
2168                 /* Commit writes */
2169                 b43_read32(dev, B43_MMIO_MACCTL);
2170                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2171                 b43_power_saving_ctl_bits(dev, 0);
2172
2173                 /* Re-enable IRQs. */
2174                 spin_lock_irq(&dev->wl->irq_lock);
2175                 b43_interrupt_enable(dev, dev->irq_savedstate);
2176                 spin_unlock_irq(&dev->wl->irq_lock);
2177         }
2178 }
2179
2180 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2181 void b43_mac_suspend(struct b43_wldev *dev)
2182 {
2183         int i;
2184         u32 tmp;
2185
2186         might_sleep();
2187         B43_WARN_ON(irqs_disabled());
2188         B43_WARN_ON(dev->mac_suspended < 0);
2189
2190         if (dev->mac_suspended == 0) {
2191                 /* Mask IRQs before suspending MAC. Otherwise
2192                  * the MAC stays busy and won't suspend. */
2193                 spin_lock_irq(&dev->wl->irq_lock);
2194                 tmp = b43_interrupt_disable(dev, B43_IRQ_ALL);
2195                 spin_unlock_irq(&dev->wl->irq_lock);
2196                 b43_synchronize_irq(dev);
2197                 dev->irq_savedstate = tmp;
2198
2199                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2200                 b43_write32(dev, B43_MMIO_MACCTL,
2201                             b43_read32(dev, B43_MMIO_MACCTL)
2202                             & ~B43_MACCTL_ENABLED);
2203                 /* force pci to flush the write */
2204                 b43_read32(dev, B43_MMIO_MACCTL);
2205                 for (i = 40; i; i--) {
2206                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2207                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2208                                 goto out;
2209                         msleep(1);
2210                 }
2211                 b43err(dev->wl, "MAC suspend failed\n");
2212         }
2213 out:
2214         dev->mac_suspended++;
2215 }
2216
2217 static void b43_adjust_opmode(struct b43_wldev *dev)
2218 {
2219         struct b43_wl *wl = dev->wl;
2220         u32 ctl;
2221         u16 cfp_pretbtt;
2222
2223         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2224         /* Reset status to STA infrastructure mode. */
2225         ctl &= ~B43_MACCTL_AP;
2226         ctl &= ~B43_MACCTL_KEEP_CTL;
2227         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2228         ctl &= ~B43_MACCTL_KEEP_BAD;
2229         ctl &= ~B43_MACCTL_PROMISC;
2230         ctl &= ~B43_MACCTL_BEACPROMISC;
2231         ctl |= B43_MACCTL_INFRA;
2232
2233         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
2234                 ctl |= B43_MACCTL_AP;
2235         else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS))
2236                 ctl &= ~B43_MACCTL_INFRA;
2237
2238         if (wl->filter_flags & FIF_CONTROL)
2239                 ctl |= B43_MACCTL_KEEP_CTL;
2240         if (wl->filter_flags & FIF_FCSFAIL)
2241                 ctl |= B43_MACCTL_KEEP_BAD;
2242         if (wl->filter_flags & FIF_PLCPFAIL)
2243                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2244         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2245                 ctl |= B43_MACCTL_PROMISC;
2246         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2247                 ctl |= B43_MACCTL_BEACPROMISC;
2248
2249         /* Workaround: On old hardware the HW-MAC-address-filter
2250          * doesn't work properly, so always run promisc in filter
2251          * it in software. */
2252         if (dev->dev->id.revision <= 4)
2253                 ctl |= B43_MACCTL_PROMISC;
2254
2255         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2256
2257         cfp_pretbtt = 2;
2258         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2259                 if (dev->dev->bus->chip_id == 0x4306 &&
2260                     dev->dev->bus->chip_rev == 3)
2261                         cfp_pretbtt = 100;
2262                 else
2263                         cfp_pretbtt = 50;
2264         }
2265         b43_write16(dev, 0x612, cfp_pretbtt);
2266 }
2267
2268 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2269 {
2270         u16 offset;
2271
2272         if (is_ofdm) {
2273                 offset = 0x480;
2274                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2275         } else {
2276                 offset = 0x4C0;
2277                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2278         }
2279         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2280                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2281 }
2282
2283 static void b43_rate_memory_init(struct b43_wldev *dev)
2284 {
2285         switch (dev->phy.type) {
2286         case B43_PHYTYPE_A:
2287         case B43_PHYTYPE_G:
2288         case B43_PHYTYPE_N:
2289                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2290                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2291                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2292                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2293                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2294                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2295                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2296                 if (dev->phy.type == B43_PHYTYPE_A)
2297                         break;
2298                 /* fallthrough */
2299         case B43_PHYTYPE_B:
2300                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2301                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2302                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2303                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2304                 break;
2305         default:
2306                 B43_WARN_ON(1);
2307         }
2308 }
2309
2310 /* Set the TX-Antenna for management frames sent by firmware. */
2311 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2312 {
2313         u16 ant = 0;
2314         u16 tmp;
2315
2316         switch (antenna) {
2317         case B43_ANTENNA0:
2318                 ant |= B43_TXH_PHY_ANT0;
2319                 break;
2320         case B43_ANTENNA1:
2321                 ant |= B43_TXH_PHY_ANT1;
2322                 break;
2323         case B43_ANTENNA2:
2324                 ant |= B43_TXH_PHY_ANT2;
2325                 break;
2326         case B43_ANTENNA3:
2327                 ant |= B43_TXH_PHY_ANT3;
2328                 break;
2329         case B43_ANTENNA_AUTO:
2330                 ant |= B43_TXH_PHY_ANT01AUTO;
2331                 break;
2332         default:
2333                 B43_WARN_ON(1);
2334         }
2335
2336         /* FIXME We also need to set the other flags of the PHY control field somewhere. */
2337
2338         /* For Beacons */
2339         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
2340         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2341         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, tmp);
2342         /* For ACK/CTS */
2343         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2344         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2345         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2346         /* For Probe Resposes */
2347         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2348         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2349         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2350 }
2351
2352 /* This is the opposite of b43_chip_init() */
2353 static void b43_chip_exit(struct b43_wldev *dev)
2354 {
2355         b43_radio_turn_off(dev, 1);
2356         b43_gpio_cleanup(dev);
2357         /* firmware is released later */
2358 }
2359
2360 /* Initialize the chip
2361  * http://bcm-specs.sipsolutions.net/ChipInit
2362  */
2363 static int b43_chip_init(struct b43_wldev *dev)
2364 {
2365         struct b43_phy *phy = &dev->phy;
2366         int err, tmp;
2367         u32 value32, macctl;
2368         u16 value16;
2369
2370         /* Initialize the MAC control */
2371         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2372         if (dev->phy.gmode)
2373                 macctl |= B43_MACCTL_GMODE;
2374         macctl |= B43_MACCTL_INFRA;
2375         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2376
2377         err = b43_request_firmware(dev);
2378         if (err)
2379                 goto out;
2380         err = b43_upload_microcode(dev);
2381         if (err)
2382                 goto out;       /* firmware is released later */
2383
2384         err = b43_gpio_init(dev);
2385         if (err)
2386                 goto out;       /* firmware is released later */
2387
2388         err = b43_upload_initvals(dev);
2389         if (err)
2390                 goto err_gpio_clean;
2391         b43_radio_turn_on(dev);
2392
2393         b43_write16(dev, 0x03E6, 0x0000);
2394         err = b43_phy_init(dev);
2395         if (err)
2396                 goto err_radio_off;
2397
2398         /* Select initial Interference Mitigation. */
2399         tmp = phy->interfmode;
2400         phy->interfmode = B43_INTERFMODE_NONE;
2401         b43_radio_set_interference_mitigation(dev, tmp);
2402
2403         b43_set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2404         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2405
2406         if (phy->type == B43_PHYTYPE_B) {
2407                 value16 = b43_read16(dev, 0x005E);
2408                 value16 |= 0x0004;
2409                 b43_write16(dev, 0x005E, value16);
2410         }
2411         b43_write32(dev, 0x0100, 0x01000000);
2412         if (dev->dev->id.revision < 5)
2413                 b43_write32(dev, 0x010C, 0x01000000);
2414
2415         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2416                     & ~B43_MACCTL_INFRA);
2417         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2418                     | B43_MACCTL_INFRA);
2419
2420         /* Probe Response Timeout value */
2421         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2422         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2423
2424         /* Initially set the wireless operation mode. */
2425         b43_adjust_opmode(dev);
2426
2427         if (dev->dev->id.revision < 3) {
2428                 b43_write16(dev, 0x060E, 0x0000);
2429                 b43_write16(dev, 0x0610, 0x8000);
2430                 b43_write16(dev, 0x0604, 0x0000);
2431                 b43_write16(dev, 0x0606, 0x0200);
2432         } else {
2433                 b43_write32(dev, 0x0188, 0x80000000);
2434                 b43_write32(dev, 0x018C, 0x02000000);
2435         }
2436         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2437         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2438         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2439         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2440         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2441         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2442         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2443
2444         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2445         value32 |= 0x00100000;
2446         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2447
2448         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2449                     dev->dev->bus->chipco.fast_pwrup_delay);
2450
2451         err = 0;
2452         b43dbg(dev->wl, "Chip initialized\n");
2453 out:
2454         return err;
2455
2456 err_radio_off:
2457         b43_radio_turn_off(dev, 1);
2458 err_gpio_clean:
2459         b43_gpio_cleanup(dev);
2460         return err;
2461 }
2462
2463 static void b43_periodic_every120sec(struct b43_wldev *dev)
2464 {
2465         struct b43_phy *phy = &dev->phy;
2466
2467         if (phy->type != B43_PHYTYPE_G || phy->rev < 2)
2468                 return;
2469
2470         b43_mac_suspend(dev);
2471         b43_lo_g_measure(dev);
2472         b43_mac_enable(dev);
2473         if (b43_has_hardware_pctl(phy))
2474                 b43_lo_g_ctl_mark_all_unused(dev);
2475 }
2476
2477 static void b43_periodic_every60sec(struct b43_wldev *dev)
2478 {
2479         struct b43_phy *phy = &dev->phy;
2480
2481         if (phy->type != B43_PHYTYPE_G)
2482                 return;
2483         if (!b43_has_hardware_pctl(phy))
2484                 b43_lo_g_ctl_mark_all_unused(dev);
2485         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_RSSI) {
2486                 b43_mac_suspend(dev);
2487                 b43_calc_nrssi_slope(dev);
2488                 if ((phy->radio_ver == 0x2050) && (phy->radio_rev == 8)) {
2489                         u8 old_chan = phy->channel;
2490
2491                         /* VCO Calibration */
2492                         if (old_chan >= 8)
2493                                 b43_radio_selectchannel(dev, 1, 0);
2494                         else
2495                                 b43_radio_selectchannel(dev, 13, 0);
2496                         b43_radio_selectchannel(dev, old_chan, 0);
2497                 }
2498                 b43_mac_enable(dev);
2499         }
2500 }
2501
2502 static void b43_periodic_every30sec(struct b43_wldev *dev)
2503 {
2504         /* Update device statistics. */
2505         b43_calculate_link_quality(dev);
2506 }
2507
2508 static void b43_periodic_every15sec(struct b43_wldev *dev)
2509 {
2510         struct b43_phy *phy = &dev->phy;
2511
2512         if (phy->type == B43_PHYTYPE_G) {
2513                 //TODO: update_aci_moving_average
2514                 if (phy->aci_enable && phy->aci_wlan_automatic) {
2515                         b43_mac_suspend(dev);
2516                         if (!phy->aci_enable && 1 /*TODO: not scanning? */ ) {
2517                                 if (0 /*TODO: bunch of conditions */ ) {
2518                                         b43_radio_set_interference_mitigation
2519                                             (dev, B43_INTERFMODE_MANUALWLAN);
2520                                 }
2521                         } else if (1 /*TODO*/) {
2522                                 /*
2523                                    if ((aci_average > 1000) && !(b43_radio_aci_scan(dev))) {
2524                                    b43_radio_set_interference_mitigation(dev,
2525                                    B43_INTERFMODE_NONE);
2526                                    }
2527                                  */
2528                         }
2529                         b43_mac_enable(dev);
2530                 } else if (phy->interfmode == B43_INTERFMODE_NONWLAN &&
2531                            phy->rev == 1) {
2532                         //TODO: implement rev1 workaround
2533                 }
2534         }
2535         b43_phy_xmitpower(dev); //FIXME: unless scanning?
2536         //TODO for APHY (temperature?)
2537
2538         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2539         wmb();
2540 }
2541
2542 static void do_periodic_work(struct b43_wldev *dev)
2543 {
2544         unsigned int state;
2545
2546         state = dev->periodic_state;
2547         if (state % 8 == 0)
2548                 b43_periodic_every120sec(dev);
2549         if (state % 4 == 0)
2550                 b43_periodic_every60sec(dev);
2551         if (state % 2 == 0)
2552                 b43_periodic_every30sec(dev);
2553         b43_periodic_every15sec(dev);
2554 }
2555
2556 /* Periodic work locking policy:
2557  *      The whole periodic work handler is protected by
2558  *      wl->mutex. If another lock is needed somewhere in the
2559  *      pwork callchain, it's aquired in-place, where it's needed.
2560  */
2561 static void b43_periodic_work_handler(struct work_struct *work)
2562 {
2563         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2564                                              periodic_work.work);
2565         struct b43_wl *wl = dev->wl;
2566         unsigned long delay;
2567
2568         mutex_lock(&wl->mutex);
2569
2570         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2571                 goto out;
2572         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2573                 goto out_requeue;
2574
2575         do_periodic_work(dev);
2576
2577         dev->periodic_state++;
2578 out_requeue:
2579         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2580                 delay = msecs_to_jiffies(50);
2581         else
2582                 delay = round_jiffies_relative(HZ * 15);
2583         queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2584 out:
2585         mutex_unlock(&wl->mutex);
2586 }
2587
2588 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2589 {
2590         struct delayed_work *work = &dev->periodic_work;
2591
2592         dev->periodic_state = 0;
2593         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2594         queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2595 }
2596
2597 /* Check if communication with the device works correctly. */
2598 static int b43_validate_chipaccess(struct b43_wldev *dev)
2599 {
2600         u32 v, backup;
2601
2602         backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2603
2604         /* Check for read/write and endianness problems. */
2605         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2606         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2607                 goto error;
2608         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2609         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2610                 goto error;
2611
2612         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2613
2614         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2615                 /* The 32bit register shadows the two 16bit registers
2616                  * with update sideeffects. Validate this. */
2617                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2618                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2619                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2620                         goto error;
2621                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2622                         goto error;
2623         }
2624         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2625
2626         v = b43_read32(dev, B43_MMIO_MACCTL);
2627         v |= B43_MACCTL_GMODE;
2628         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2629                 goto error;
2630
2631         return 0;
2632 error:
2633         b43err(dev->wl, "Failed to validate the chipaccess\n");
2634         return -ENODEV;
2635 }
2636
2637 static void b43_security_init(struct b43_wldev *dev)
2638 {
2639         dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2640         B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2641         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2642         /* KTP is a word address, but we address SHM bytewise.
2643          * So multiply by two.
2644          */
2645         dev->ktp *= 2;
2646         if (dev->dev->id.revision >= 5) {
2647                 /* Number of RCMTA address slots */
2648                 b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2649         }
2650         b43_clear_keys(dev);
2651 }
2652
2653 static int b43_rng_read(struct hwrng *rng, u32 * data)
2654 {
2655         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2656         unsigned long flags;
2657
2658         /* Don't take wl->mutex here, as it could deadlock with
2659          * hwrng internal locking. It's not needed to take
2660          * wl->mutex here, anyway. */
2661
2662         spin_lock_irqsave(&wl->irq_lock, flags);
2663         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2664         spin_unlock_irqrestore(&wl->irq_lock, flags);
2665
2666         return (sizeof(u16));
2667 }
2668
2669 static void b43_rng_exit(struct b43_wl *wl, bool suspended)
2670 {
2671         if (wl->rng_initialized)
2672                 __hwrng_unregister(&wl->rng, suspended);
2673 }
2674
2675 static int b43_rng_init(struct b43_wl *wl)
2676 {
2677         int err;
2678
2679         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2680                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2681         wl->rng.name = wl->rng_name;
2682         wl->rng.data_read = b43_rng_read;
2683         wl->rng.priv = (unsigned long)wl;
2684         wl->rng_initialized = 1;
2685         err = hwrng_register(&wl->rng);
2686         if (err) {
2687                 wl->rng_initialized = 0;
2688                 b43err(wl, "Failed to register the random "
2689                        "number generator (%d)\n", err);
2690         }
2691
2692         return err;
2693 }
2694
2695 static int b43_op_tx(struct ieee80211_hw *hw,
2696                      struct sk_buff *skb,
2697                      struct ieee80211_tx_control *ctl)
2698 {
2699         struct b43_wl *wl = hw_to_b43_wl(hw);
2700         struct b43_wldev *dev = wl->current_dev;
2701         int err = -ENODEV;
2702
2703         if (unlikely(!dev))
2704                 goto out;
2705         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2706                 goto out;
2707         /* DMA-TX is done without a global lock. */
2708         err = b43_dma_tx(dev, skb, ctl);
2709 out:
2710         if (unlikely(err))
2711                 return NETDEV_TX_BUSY;
2712         return NETDEV_TX_OK;
2713 }
2714
2715 /* Locking: wl->irq_lock */
2716 static void b43_qos_params_upload(struct b43_wldev *dev,
2717                                   const struct ieee80211_tx_queue_params *p,
2718                                   u16 shm_offset)
2719 {
2720         u16 params[B43_NR_QOSPARAMS];
2721         int cw_min, cw_max, aifs, bslots, tmp;
2722         unsigned int i;
2723
2724         const u16 aCWmin = 0x0001;
2725         const u16 aCWmax = 0x03FF;
2726
2727         /* Calculate the default values for the parameters, if needed. */
2728         switch (shm_offset) {
2729         case B43_QOS_VOICE:
2730                 aifs = (p->aifs == -1) ? 2 : p->aifs;
2731                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 4 - 1) : p->cw_min;
2732                 cw_max = (p->cw_max == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_max;
2733                 break;
2734         case B43_QOS_VIDEO:
2735                 aifs = (p->aifs == -1) ? 2 : p->aifs;
2736                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_min;
2737                 cw_max = (p->cw_max == 0) ? aCWmin : p->cw_max;
2738                 break;
2739         case B43_QOS_BESTEFFORT:
2740                 aifs = (p->aifs == -1) ? 3 : p->aifs;
2741                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
2742                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
2743                 break;
2744         case B43_QOS_BACKGROUND:
2745                 aifs = (p->aifs == -1) ? 7 : p->aifs;
2746                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
2747                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
2748                 break;
2749         default:
2750                 B43_WARN_ON(1);
2751                 return;
2752         }
2753         if (cw_min <= 0)
2754                 cw_min = aCWmin;
2755         if (cw_max <= 0)
2756                 cw_max = aCWmin;
2757         bslots = b43_read16(dev, B43_MMIO_RNG) % cw_min;
2758
2759         memset(&params, 0, sizeof(params));
2760
2761         params[B43_QOSPARAM_TXOP] = p->txop * 32;
2762         params[B43_QOSPARAM_CWMIN] = cw_min;
2763         params[B43_QOSPARAM_CWMAX] = cw_max;
2764         params[B43_QOSPARAM_CWCUR] = cw_min;
2765         params[B43_QOSPARAM_AIFS] = aifs;
2766         params[B43_QOSPARAM_BSLOTS] = bslots;
2767         params[B43_QOSPARAM_REGGAP] = bslots + aifs;
2768
2769         for (i = 0; i < ARRAY_SIZE(params); i++) {
2770                 if (i == B43_QOSPARAM_STATUS) {
2771                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
2772                                              shm_offset + (i * 2));
2773                         /* Mark the parameters as updated. */
2774                         tmp |= 0x100;
2775                         b43_shm_write16(dev, B43_SHM_SHARED,
2776                                         shm_offset + (i * 2),
2777                                         tmp);
2778                 } else {
2779                         b43_shm_write16(dev, B43_SHM_SHARED,
2780                                         shm_offset + (i * 2),
2781                                         params[i]);
2782                 }
2783         }
2784 }
2785
2786 /* Update the QOS parameters in hardware. */
2787 static void b43_qos_update(struct b43_wldev *dev)
2788 {
2789         struct b43_wl *wl = dev->wl;
2790         struct b43_qos_params *params;
2791         unsigned long flags;
2792         unsigned int i;
2793
2794         /* Mapping of mac80211 queues to b43 SHM offsets. */
2795         static const u16 qos_shm_offsets[] = {
2796                 [0] = B43_QOS_VOICE,
2797                 [1] = B43_QOS_VIDEO,
2798                 [2] = B43_QOS_BESTEFFORT,
2799                 [3] = B43_QOS_BACKGROUND,
2800         };
2801         BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
2802
2803         b43_mac_suspend(dev);
2804         spin_lock_irqsave(&wl->irq_lock, flags);
2805
2806         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
2807                 params = &(wl->qos_params[i]);
2808                 if (params->need_hw_update) {
2809                         b43_qos_params_upload(dev, &(params->p),
2810                                               qos_shm_offsets[i]);
2811                         params->need_hw_update = 0;
2812                 }
2813         }
2814
2815         spin_unlock_irqrestore(&wl->irq_lock, flags);
2816         b43_mac_enable(dev);
2817 }
2818
2819 static void b43_qos_clear(struct b43_wl *wl)
2820 {
2821         struct b43_qos_params *params;
2822         unsigned int i;
2823
2824         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
2825                 params = &(wl->qos_params[i]);
2826
2827                 memset(&(params->p), 0, sizeof(params->p));
2828                 params->p.aifs = -1;
2829                 params->need_hw_update = 1;
2830         }
2831 }
2832
2833 /* Initialize the core's QOS capabilities */
2834 static void b43_qos_init(struct b43_wldev *dev)
2835 {
2836         struct b43_wl *wl = dev->wl;
2837         unsigned int i;
2838
2839         /* Upload the current QOS parameters. */
2840         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
2841                 wl->qos_params[i].need_hw_update = 1;
2842         b43_qos_update(dev);
2843
2844         /* Enable QOS support. */
2845         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
2846         b43_write16(dev, B43_MMIO_IFSCTL,
2847                     b43_read16(dev, B43_MMIO_IFSCTL)
2848                     | B43_MMIO_IFSCTL_USE_EDCF);
2849 }
2850
2851 static void b43_qos_update_work(struct work_struct *work)
2852 {
2853         struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
2854         struct b43_wldev *dev;
2855
2856         mutex_lock(&wl->mutex);
2857         dev = wl->current_dev;
2858         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
2859                 b43_qos_update(dev);
2860         mutex_unlock(&wl->mutex);
2861 }
2862
2863 static int b43_op_conf_tx(struct ieee80211_hw *hw,
2864                           int _queue,
2865                           const struct ieee80211_tx_queue_params *params)
2866 {
2867         struct b43_wl *wl = hw_to_b43_wl(hw);
2868         unsigned long flags;
2869         unsigned int queue = (unsigned int)_queue;
2870         struct b43_qos_params *p;
2871
2872         if (queue >= ARRAY_SIZE(wl->qos_params)) {
2873                 /* Queue not available or don't support setting
2874                  * params on this queue. Return success to not
2875                  * confuse mac80211. */
2876                 return 0;
2877         }
2878
2879         spin_lock_irqsave(&wl->irq_lock, flags);
2880         p = &(wl->qos_params[queue]);
2881         memcpy(&(p->p), params, sizeof(p->p));
2882         p->need_hw_update = 1;
2883         spin_unlock_irqrestore(&wl->irq_lock, flags);
2884
2885         queue_work(hw->workqueue, &wl->qos_update_work);
2886
2887         return 0;
2888 }
2889
2890 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
2891                                struct ieee80211_tx_queue_stats *stats)
2892 {
2893         struct b43_wl *wl = hw_to_b43_wl(hw);
2894         struct b43_wldev *dev = wl->current_dev;
2895         unsigned long flags;
2896         int err = -ENODEV;
2897
2898         if (!dev)
2899                 goto out;
2900         spin_lock_irqsave(&wl->irq_lock, flags);
2901         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2902                 b43_dma_get_tx_stats(dev, stats);
2903                 err = 0;
2904         }
2905         spin_unlock_irqrestore(&wl->irq_lock, flags);
2906 out:
2907         return err;
2908 }
2909
2910 static int b43_op_get_stats(struct ieee80211_hw *hw,
2911                             struct ieee80211_low_level_stats *stats)
2912 {
2913         struct b43_wl *wl = hw_to_b43_wl(hw);
2914         unsigned long flags;
2915
2916         spin_lock_irqsave(&wl->irq_lock, flags);
2917         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
2918         spin_unlock_irqrestore(&wl->irq_lock, flags);
2919
2920         return 0;
2921 }
2922
2923 static void b43_put_phy_into_reset(struct b43_wldev *dev)
2924 {
2925         struct ssb_device *sdev = dev->dev;
2926         u32 tmslow;
2927
2928         tmslow = ssb_read32(sdev, SSB_TMSLOW);
2929         tmslow &= ~B43_TMSLOW_GMODE;
2930         tmslow |= B43_TMSLOW_PHYRESET;
2931         tmslow |= SSB_TMSLOW_FGC;
2932         ssb_write32(sdev, SSB_TMSLOW, tmslow);
2933         msleep(1);
2934
2935         tmslow = ssb_read32(sdev, SSB_TMSLOW);
2936         tmslow &= ~SSB_TMSLOW_FGC;
2937         tmslow |= B43_TMSLOW_PHYRESET;
2938         ssb_write32(sdev, SSB_TMSLOW, tmslow);
2939         msleep(1);
2940 }
2941
2942 static const char * band_to_string(enum ieee80211_band band)
2943 {
2944         switch (band) {
2945         case IEEE80211_BAND_5GHZ:
2946                 return "5";
2947         case IEEE80211_BAND_2GHZ:
2948                 return "2.4";
2949         default:
2950                 break;
2951         }
2952         B43_WARN_ON(1);
2953         return "";
2954 }
2955
2956 /* Expects wl->mutex locked */
2957 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
2958 {
2959         struct b43_wldev *up_dev = NULL;
2960         struct b43_wldev *down_dev;
2961         struct b43_wldev *d;
2962         int err;
2963         bool gmode;
2964         int prev_status;
2965
2966         /* Find a device and PHY which supports the band. */
2967         list_for_each_entry(d, &wl->devlist, list) {
2968                 switch (chan->band) {
2969                 case IEEE80211_BAND_5GHZ:
2970                         if (d->phy.supports_5ghz) {
2971                                 up_dev = d;
2972                                 gmode = 0;
2973                         }
2974                         break;
2975                 case IEEE80211_BAND_2GHZ:
2976                         if (d->phy.supports_2ghz) {
2977                                 up_dev = d;
2978                                 gmode = 1;
2979                         }
2980                         break;
2981                 default:
2982                         B43_WARN_ON(1);
2983                         return -EINVAL;
2984                 }
2985                 if (up_dev)
2986                         break;
2987         }
2988         if (!up_dev) {
2989                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
2990                        band_to_string(chan->band));
2991                 return -ENODEV;
2992         }
2993         if ((up_dev == wl->current_dev) &&
2994             (!!wl->current_dev->phy.gmode == !!gmode)) {
2995                 /* This device is already running. */
2996                 return 0;
2997         }
2998         b43dbg(wl, "Switching to %s-GHz band\n",
2999                band_to_string(chan->band));
3000         down_dev = wl->current_dev;
3001
3002         prev_status = b43_status(down_dev);
3003         /* Shutdown the currently running core. */
3004         if (prev_status >= B43_STAT_STARTED)
3005                 b43_wireless_core_stop(down_dev);
3006         if (prev_status >= B43_STAT_INITIALIZED)
3007                 b43_wireless_core_exit(down_dev);
3008
3009         if (down_dev != up_dev) {
3010                 /* We switch to a different core, so we put PHY into
3011                  * RESET on the old core. */
3012                 b43_put_phy_into_reset(down_dev);
3013         }
3014
3015         /* Now start the new core. */
3016         up_dev->phy.gmode = gmode;
3017         if (prev_status >= B43_STAT_INITIALIZED) {
3018                 err = b43_wireless_core_init(up_dev);
3019                 if (err) {
3020                         b43err(wl, "Fatal: Could not initialize device for "
3021                                "selected %s-GHz band\n",
3022                                band_to_string(chan->band));
3023                         goto init_failure;
3024                 }
3025         }
3026         if (prev_status >= B43_STAT_STARTED) {
3027                 err = b43_wireless_core_start(up_dev);
3028                 if (err) {
3029                         b43err(wl, "Fatal: Coult not start device for "
3030                                "selected %s-GHz band\n",
3031                                band_to_string(chan->band));
3032                         b43_wireless_core_exit(up_dev);
3033                         goto init_failure;
3034                 }
3035         }
3036         B43_WARN_ON(b43_status(up_dev) != prev_status);
3037
3038         wl->current_dev = up_dev;
3039
3040         return 0;
3041 init_failure:
3042         /* Whoops, failed to init the new core. No core is operating now. */
3043         wl->current_dev = NULL;
3044         return err;
3045 }
3046
3047 /* Check if the use of the antenna that ieee80211 told us to
3048  * use is possible. This will fall back to DEFAULT.
3049  * "antenna_nr" is the antenna identifier we got from ieee80211. */
3050 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
3051                                   u8 antenna_nr)
3052 {
3053         u8 antenna_mask;
3054
3055         if (antenna_nr == 0) {
3056                 /* Zero means "use default antenna". That's always OK. */
3057                 return 0;
3058         }
3059
3060         /* Get the mask of available antennas. */
3061         if (dev->phy.gmode)
3062                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
3063         else
3064                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
3065
3066         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
3067                 /* This antenna is not available. Fall back to default. */
3068                 return 0;
3069         }
3070
3071         return antenna_nr;
3072 }
3073
3074 static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
3075 {
3076         antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
3077         switch (antenna) {
3078         case 0:         /* default/diversity */
3079                 return B43_ANTENNA_DEFAULT;
3080         case 1:         /* Antenna 0 */
3081                 return B43_ANTENNA0;
3082         case 2:         /* Antenna 1 */
3083                 return B43_ANTENNA1;
3084         case 3:         /* Antenna 2 */
3085                 return B43_ANTENNA2;
3086         case 4:         /* Antenna 3 */
3087                 return B43_ANTENNA3;
3088         default:
3089                 return B43_ANTENNA_DEFAULT;
3090         }
3091 }
3092
3093 static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
3094 {
3095         struct b43_wl *wl = hw_to_b43_wl(hw);
3096         struct b43_wldev *dev;
3097         struct b43_phy *phy;
3098         unsigned long flags;
3099         int antenna;
3100         int err = 0;
3101         u32 savedirqs;
3102
3103         mutex_lock(&wl->mutex);
3104
3105         /* Switch the band (if necessary). This might change the active core. */
3106         err = b43_switch_band(wl, conf->channel);
3107         if (err)
3108                 goto out_unlock_mutex;
3109         dev = wl->current_dev;
3110         phy = &dev->phy;
3111
3112         /* Disable IRQs while reconfiguring the device.
3113          * This makes it possible to drop the spinlock throughout
3114          * the reconfiguration process. */
3115         spin_lock_irqsave(&wl->irq_lock, flags);
3116         if (b43_status(dev) < B43_STAT_STARTED) {
3117                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3118                 goto out_unlock_mutex;
3119         }
3120         savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3121         spin_unlock_irqrestore(&wl->irq_lock, flags);
3122         b43_synchronize_irq(dev);
3123
3124         /* Switch to the requested channel.
3125          * The firmware takes care of races with the TX handler. */
3126         if (conf->channel->hw_value != phy->channel)
3127                 b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
3128
3129         /* Enable/Disable ShortSlot timing. */
3130         if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
3131             dev->short_slot) {
3132                 B43_WARN_ON(phy->type != B43_PHYTYPE_G);
3133                 if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)
3134                         b43_short_slot_timing_enable(dev);
3135                 else
3136                         b43_short_slot_timing_disable(dev);
3137         }
3138
3139         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3140
3141         /* Adjust the desired TX power level. */
3142         if (conf->power_level != 0) {
3143                 if (conf->power_level != phy->power_level) {
3144                         phy->power_level = conf->power_level;
3145                         b43_phy_xmitpower(dev);
3146                 }
3147         }
3148
3149         /* Antennas for RX and management frame TX. */
3150         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
3151         b43_mgmtframe_txantenna(dev, antenna);
3152         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
3153         b43_set_rx_antenna(dev, antenna);
3154
3155         /* Update templates for AP mode. */
3156         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
3157                 b43_set_beacon_int(dev, conf->beacon_int);
3158
3159         if (!!conf->radio_enabled != phy->radio_on) {
3160                 if (conf->radio_enabled) {
3161                         b43_radio_turn_on(dev);
3162                         b43info(dev->wl, "Radio turned on by software\n");
3163                         if (!dev->radio_hw_enable) {
3164                                 b43info(dev->wl, "The hardware RF-kill button "
3165                                         "still turns the radio physically off. "
3166                                         "Press the button to turn it on.\n");
3167                         }
3168                 } else {
3169                         b43_radio_turn_off(dev, 0);
3170                         b43info(dev->wl, "Radio turned off by software\n");
3171                 }
3172         }
3173
3174         spin_lock_irqsave(&wl->irq_lock, flags);
3175         b43_interrupt_enable(dev, savedirqs);
3176         mmiowb();
3177         spin_unlock_irqrestore(&wl->irq_lock, flags);
3178       out_unlock_mutex:
3179         mutex_unlock(&wl->mutex);
3180
3181         return err;
3182 }
3183
3184 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3185                            const u8 *local_addr, const u8 *addr,
3186                            struct ieee80211_key_conf *key)
3187 {
3188         struct b43_wl *wl = hw_to_b43_wl(hw);
3189         struct b43_wldev *dev;
3190         unsigned long flags;
3191         u8 algorithm;
3192         u8 index;
3193         int err;
3194         DECLARE_MAC_BUF(mac);
3195
3196         if (modparam_nohwcrypt)
3197                 return -ENOSPC; /* User disabled HW-crypto */
3198
3199         mutex_lock(&wl->mutex);
3200         spin_lock_irqsave(&wl->irq_lock, flags);
3201
3202         dev = wl->current_dev;
3203         err = -ENODEV;
3204         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3205                 goto out_unlock;
3206
3207         err = -EINVAL;
3208         switch (key->alg) {
3209         case ALG_WEP:
3210                 if (key->keylen == 5)
3211                         algorithm = B43_SEC_ALGO_WEP40;
3212                 else
3213                         algorithm = B43_SEC_ALGO_WEP104;
3214                 break;
3215         case ALG_TKIP:
3216                 algorithm = B43_SEC_ALGO_TKIP;
3217                 break;
3218         case ALG_CCMP:
3219                 algorithm = B43_SEC_ALGO_AES;
3220                 break;
3221         default:
3222                 B43_WARN_ON(1);
3223                 goto out_unlock;
3224         }
3225         index = (u8) (key->keyidx);
3226         if (index > 3)
3227                 goto out_unlock;
3228
3229         switch (cmd) {
3230         case SET_KEY:
3231                 if (algorithm == B43_SEC_ALGO_TKIP) {
3232                         /* FIXME: No TKIP hardware encryption for now. */
3233                         err = -EOPNOTSUPP;
3234                         goto out_unlock;
3235                 }
3236
3237                 if (is_broadcast_ether_addr(addr)) {
3238                         /* addr is FF:FF:FF:FF:FF:FF for default keys */
3239                         err = b43_key_write(dev, index, algorithm,
3240                                             key->key, key->keylen, NULL, key);
3241                 } else {
3242                         /*
3243                          * either pairwise key or address is 00:00:00:00:00:00
3244                          * for transmit-only keys
3245                          */
3246                         err = b43_key_write(dev, -1, algorithm,
3247                                             key->key, key->keylen, addr, key);
3248                 }
3249                 if (err)
3250                         goto out_unlock;
3251
3252                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3253                     algorithm == B43_SEC_ALGO_WEP104) {
3254                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3255                 } else {
3256                         b43_hf_write(dev,
3257                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3258                 }
3259                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3260                 break;
3261         case DISABLE_KEY: {
3262                 err = b43_key_clear(dev, key->hw_key_idx);
3263                 if (err)
3264                         goto out_unlock;
3265                 break;
3266         }
3267         default:
3268                 B43_WARN_ON(1);
3269         }
3270 out_unlock:
3271         spin_unlock_irqrestore(&wl->irq_lock, flags);
3272         mutex_unlock(&wl->mutex);
3273         if (!err) {
3274                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3275                        "mac: %s\n",
3276                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3277                        print_mac(mac, addr));
3278         }
3279         return err;
3280 }
3281
3282 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3283                                     unsigned int changed, unsigned int *fflags,
3284                                     int mc_count, struct dev_addr_list *mc_list)
3285 {
3286         struct b43_wl *wl = hw_to_b43_wl(hw);
3287         struct b43_wldev *dev = wl->current_dev;
3288         unsigned long flags;
3289
3290         if (!dev) {
3291                 *fflags = 0;
3292                 return;
3293         }
3294
3295         spin_lock_irqsave(&wl->irq_lock, flags);
3296         *fflags &= FIF_PROMISC_IN_BSS |
3297                   FIF_ALLMULTI |
3298                   FIF_FCSFAIL |
3299                   FIF_PLCPFAIL |
3300                   FIF_CONTROL |
3301                   FIF_OTHER_BSS |
3302                   FIF_BCN_PRBRESP_PROMISC;
3303
3304         changed &= FIF_PROMISC_IN_BSS |
3305                    FIF_ALLMULTI |
3306                    FIF_FCSFAIL |
3307                    FIF_PLCPFAIL |
3308                    FIF_CONTROL |
3309                    FIF_OTHER_BSS |
3310                    FIF_BCN_PRBRESP_PROMISC;
3311
3312         wl->filter_flags = *fflags;
3313
3314         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3315                 b43_adjust_opmode(dev);
3316         spin_unlock_irqrestore(&wl->irq_lock, flags);
3317 }
3318
3319 static int b43_op_config_interface(struct ieee80211_hw *hw,
3320                                    struct ieee80211_vif *vif,
3321                                    struct ieee80211_if_conf *conf)
3322 {
3323         struct b43_wl *wl = hw_to_b43_wl(hw);
3324         struct b43_wldev *dev = wl->current_dev;
3325         unsigned long flags;
3326
3327         if (!dev)
3328                 return -ENODEV;
3329         mutex_lock(&wl->mutex);
3330         spin_lock_irqsave(&wl->irq_lock, flags);
3331         B43_WARN_ON(wl->vif != vif);
3332         if (conf->bssid)
3333                 memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3334         else
3335                 memset(wl->bssid, 0, ETH_ALEN);
3336         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3337                 if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP)) {
3338                         B43_WARN_ON(conf->type != IEEE80211_IF_TYPE_AP);
3339                         b43_set_ssid(dev, conf->ssid, conf->ssid_len);
3340                         if (conf->beacon)
3341                                 b43_update_templates(wl, conf->beacon);
3342                 }
3343                 b43_write_mac_bssid_templates(dev);
3344         }
3345         spin_unlock_irqrestore(&wl->irq_lock, flags);
3346         mutex_unlock(&wl->mutex);
3347
3348         return 0;
3349 }
3350
3351 /* Locking: wl->mutex */
3352 static void b43_wireless_core_stop(struct b43_wldev *dev)
3353 {
3354         struct b43_wl *wl = dev->wl;
3355         unsigned long flags;
3356
3357         if (b43_status(dev) < B43_STAT_STARTED)
3358                 return;
3359
3360         /* Disable and sync interrupts. We must do this before than
3361          * setting the status to INITIALIZED, as the interrupt handler
3362          * won't care about IRQs then. */
3363         spin_lock_irqsave(&wl->irq_lock, flags);
3364         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3365         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3366         spin_unlock_irqrestore(&wl->irq_lock, flags);
3367         b43_synchronize_irq(dev);
3368
3369         b43_set_status(dev, B43_STAT_INITIALIZED);
3370
3371         mutex_unlock(&wl->mutex);
3372         /* Must unlock as it would otherwise deadlock. No races here.
3373          * Cancel the possibly running self-rearming periodic work. */
3374         cancel_delayed_work_sync(&dev->periodic_work);
3375         mutex_lock(&wl->mutex);
3376
3377         ieee80211_stop_queues(wl->hw);  //FIXME this could cause a deadlock, as mac80211 seems buggy.
3378
3379         b43_mac_suspend(dev);
3380         free_irq(dev->dev->irq, dev);
3381         b43dbg(wl, "Wireless interface stopped\n");
3382 }
3383
3384 /* Locking: wl->mutex */
3385 static int b43_wireless_core_start(struct b43_wldev *dev)
3386 {
3387         int err;
3388
3389         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3390
3391         drain_txstatus_queue(dev);
3392         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3393                           IRQF_SHARED, KBUILD_MODNAME, dev);
3394         if (err) {
3395                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3396                 goto out;
3397         }
3398
3399         /* We are ready to run. */
3400         b43_set_status(dev, B43_STAT_STARTED);
3401
3402         /* Start data flow (TX/RX). */
3403         b43_mac_enable(dev);
3404         b43_interrupt_enable(dev, dev->irq_savedstate);
3405         ieee80211_start_queues(dev->wl->hw);
3406
3407         /* Start maintainance work */
3408         b43_periodic_tasks_setup(dev);
3409
3410         b43dbg(dev->wl, "Wireless interface started\n");
3411       out:
3412         return err;
3413 }
3414
3415 /* Get PHY and RADIO versioning numbers */
3416 static int b43_phy_versioning(struct b43_wldev *dev)
3417 {
3418         struct b43_phy *phy = &dev->phy;
3419         u32 tmp;
3420         u8 analog_type;
3421         u8 phy_type;
3422         u8 phy_rev;
3423         u16 radio_manuf;
3424         u16 radio_ver;
3425         u16 radio_rev;
3426         int unsupported = 0;
3427
3428         /* Get PHY versioning */
3429         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3430         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3431         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3432         phy_rev = (tmp & B43_PHYVER_VERSION);
3433         switch (phy_type) {
3434         case B43_PHYTYPE_A:
3435                 if (phy_rev >= 4)
3436                         unsupported = 1;
3437                 break;
3438         case B43_PHYTYPE_B:
3439                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3440                     && phy_rev != 7)
3441                         unsupported = 1;
3442                 break;
3443         case B43_PHYTYPE_G:
3444                 if (phy_rev > 9)
3445                         unsupported = 1;
3446                 break;
3447 #ifdef CONFIG_B43_NPHY
3448         case B43_PHYTYPE_N:
3449                 if (phy_rev > 1)
3450                         unsupported = 1;
3451                 break;
3452 #endif
3453         default:
3454                 unsupported = 1;
3455         };
3456         if (unsupported) {
3457                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3458                        "(Analog %u, Type %u, Revision %u)\n",
3459                        analog_type, phy_type, phy_rev);
3460                 return -EOPNOTSUPP;
3461         }
3462         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3463                analog_type, phy_type, phy_rev);
3464
3465         /* Get RADIO versioning */
3466         if (dev->dev->bus->chip_id == 0x4317) {
3467                 if (dev->dev->bus->chip_rev == 0)
3468                         tmp = 0x3205017F;
3469                 else if (dev->dev->bus->chip_rev == 1)
3470                         tmp = 0x4205017F;
3471                 else
3472                         tmp = 0x5205017F;
3473         } else {
3474                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3475                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3476                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3477                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3478         }
3479         radio_manuf = (tmp & 0x00000FFF);
3480         radio_ver = (tmp & 0x0FFFF000) >> 12;
3481         radio_rev = (tmp & 0xF0000000) >> 28;
3482         if (radio_manuf != 0x17F /* Broadcom */)
3483                 unsupported = 1;
3484         switch (phy_type) {
3485         case B43_PHYTYPE_A:
3486                 if (radio_ver != 0x2060)
3487                         unsupported = 1;
3488                 if (radio_rev != 1)
3489                         unsupported = 1;
3490                 if (radio_manuf != 0x17F)
3491                         unsupported = 1;
3492                 break;
3493         case B43_PHYTYPE_B:
3494                 if ((radio_ver & 0xFFF0) != 0x2050)
3495                         unsupported = 1;
3496                 break;
3497         case B43_PHYTYPE_G:
3498                 if (radio_ver != 0x2050)
3499                         unsupported = 1;
3500                 break;
3501         case B43_PHYTYPE_N:
3502                 if (radio_ver != 0x2055)
3503                         unsupported = 1;
3504                 break;
3505         default:
3506                 B43_WARN_ON(1);
3507         }
3508         if (unsupported) {
3509                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3510                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3511                        radio_manuf, radio_ver, radio_rev);
3512                 return -EOPNOTSUPP;
3513         }
3514         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3515                radio_manuf, radio_ver, radio_rev);
3516
3517         phy->radio_manuf = radio_manuf;
3518         phy->radio_ver = radio_ver;
3519         phy->radio_rev = radio_rev;
3520
3521         phy->analog = analog_type;
3522         phy->type = phy_type;
3523         phy->rev = phy_rev;
3524
3525         return 0;
3526 }
3527
3528 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3529                                       struct b43_phy *phy)
3530 {
3531         struct b43_txpower_lo_control *lo;
3532         int i;
3533
3534         memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3535         memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3536
3537         phy->aci_enable = 0;
3538         phy->aci_wlan_automatic = 0;
3539         phy->aci_hw_rssi = 0;
3540
3541         phy->radio_off_context.valid = 0;
3542
3543         lo = phy->lo_control;
3544         if (lo) {
3545                 memset(lo, 0, sizeof(*(phy->lo_control)));
3546                 lo->rebuild = 1;
3547                 lo->tx_bias = 0xFF;
3548         }
3549         phy->max_lb_gain = 0;
3550         phy->trsw_rx_gain = 0;
3551         phy->txpwr_offset = 0;
3552
3553         /* NRSSI */
3554         phy->nrssislope = 0;
3555         for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3556                 phy->nrssi[i] = -1000;
3557         for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3558                 phy->nrssi_lt[i] = i;
3559
3560         phy->lofcal = 0xFFFF;
3561         phy->initval = 0xFFFF;
3562
3563         phy->interfmode = B43_INTERFMODE_NONE;
3564         phy->channel = 0xFF;
3565
3566         phy->hardware_power_control = !!modparam_hwpctl;
3567
3568         /* PHY TX errors counter. */
3569         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3570
3571         /* OFDM-table address caching. */
3572         phy->ofdmtab_addr_direction = B43_OFDMTAB_DIRECTION_UNKNOWN;
3573 }
3574
3575 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3576 {
3577         dev->dfq_valid = 0;
3578
3579         /* Assume the radio is enabled. If it's not enabled, the state will
3580          * immediately get fixed on the first periodic work run. */
3581         dev->radio_hw_enable = 1;
3582
3583         /* Stats */
3584         memset(&dev->stats, 0, sizeof(dev->stats));
3585
3586         setup_struct_phy_for_init(dev, &dev->phy);
3587
3588         /* IRQ related flags */
3589         dev->irq_reason = 0;
3590         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3591         dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3592
3593         dev->mac_suspended = 1;
3594
3595         /* Noise calculation context */
3596         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3597 }
3598
3599 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3600 {
3601         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3602         u32 hf;
3603
3604         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3605                 return;
3606         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3607                 return;
3608
3609         hf = b43_hf_read(dev);
3610         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3611                 hf |= B43_HF_BTCOEXALT;
3612         else
3613                 hf |= B43_HF_BTCOEX;
3614         b43_hf_write(dev, hf);
3615         //TODO
3616 }
3617
3618 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3619 {                               //TODO
3620 }
3621
3622 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3623 {
3624 #ifdef CONFIG_SSB_DRIVER_PCICORE
3625         struct ssb_bus *bus = dev->dev->bus;
3626         u32 tmp;
3627
3628         if (bus->pcicore.dev &&
3629             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3630             bus->pcicore.dev->id.revision <= 5) {
3631                 /* IMCFGLO timeouts workaround. */
3632                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3633                 tmp &= ~SSB_IMCFGLO_REQTO;
3634                 tmp &= ~SSB_IMCFGLO_SERTO;
3635                 switch (bus->bustype) {
3636                 case SSB_BUSTYPE_PCI:
3637                 case SSB_BUSTYPE_PCMCIA:
3638                         tmp |= 0x32;
3639                         break;
3640                 case SSB_BUSTYPE_SSB:
3641                         tmp |= 0x53;
3642                         break;
3643                 }
3644                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3645         }
3646 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3647 }
3648
3649 /* Write the short and long frame retry limit values. */
3650 static void b43_set_retry_limits(struct b43_wldev *dev,
3651                                  unsigned int short_retry,
3652                                  unsigned int long_retry)
3653 {
3654         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3655          * the chip-internal counter. */
3656         short_retry = min(short_retry, (unsigned int)0xF);
3657         long_retry = min(long_retry, (unsigned int)0xF);
3658
3659         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3660                         short_retry);
3661         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3662                         long_retry);
3663 }
3664
3665 /* Shutdown a wireless core */
3666 /* Locking: wl->mutex */
3667 static void b43_wireless_core_exit(struct b43_wldev *dev)
3668 {
3669         struct b43_phy *phy = &dev->phy;
3670         u32 macctl;
3671
3672         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3673         if (b43_status(dev) != B43_STAT_INITIALIZED)
3674                 return;
3675         b43_set_status(dev, B43_STAT_UNINIT);
3676
3677         /* Stop the microcode PSM. */
3678         macctl = b43_read32(dev, B43_MMIO_MACCTL);
3679         macctl &= ~B43_MACCTL_PSM_RUN;
3680         macctl |= B43_MACCTL_PSM_JMP0;
3681         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3682
3683         if (!dev->suspend_in_progress) {
3684                 b43_leds_exit(dev);
3685                 b43_rng_exit(dev->wl, false);
3686         }
3687         b43_dma_free(dev);
3688         b43_chip_exit(dev);
3689         b43_radio_turn_off(dev, 1);
3690         b43_switch_analog(dev, 0);
3691         if (phy->dyn_tssi_tbl)
3692                 kfree(phy->tssi2dbm);
3693         kfree(phy->lo_control);
3694         phy->lo_control = NULL;
3695         if (dev->wl->current_beacon) {
3696                 dev_kfree_skb_any(dev->wl->current_beacon);
3697                 dev->wl->current_beacon = NULL;
3698         }
3699
3700         ssb_device_disable(dev->dev, 0);
3701         ssb_bus_may_powerdown(dev->dev->bus);
3702 }
3703
3704 /* Initialize a wireless core */
3705 static int b43_wireless_core_init(struct b43_wldev *dev)
3706 {
3707         struct b43_wl *wl = dev->wl;
3708         struct ssb_bus *bus = dev->dev->bus;
3709         struct ssb_sprom *sprom = &bus->sprom;
3710         struct b43_phy *phy = &dev->phy;
3711         int err;
3712         u32 hf, tmp;
3713
3714         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
3715
3716         err = ssb_bus_powerup(bus, 0);
3717         if (err)
3718                 goto out;
3719         if (!ssb_device_is_enabled(dev->dev)) {
3720                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
3721                 b43_wireless_core_reset(dev, tmp);
3722         }
3723
3724         if ((phy->type == B43_PHYTYPE_B) || (phy->type == B43_PHYTYPE_G)) {
3725                 phy->lo_control =
3726                     kzalloc(sizeof(*(phy->lo_control)), GFP_KERNEL);
3727                 if (!phy->lo_control) {
3728                         err = -ENOMEM;
3729                         goto err_busdown;
3730                 }
3731         }
3732         setup_struct_wldev_for_init(dev);
3733
3734         err = b43_phy_init_tssi2dbm_table(dev);
3735         if (err)
3736                 goto err_kfree_lo_control;
3737
3738         /* Enable IRQ routing to this device. */
3739         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
3740
3741         b43_imcfglo_timeouts_workaround(dev);
3742         b43_bluetooth_coext_disable(dev);
3743         b43_phy_early_init(dev);
3744         err = b43_chip_init(dev);
3745         if (err)
3746                 goto err_kfree_tssitbl;
3747         b43_shm_write16(dev, B43_SHM_SHARED,
3748                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
3749         hf = b43_hf_read(dev);
3750         if (phy->type == B43_PHYTYPE_G) {
3751                 hf |= B43_HF_SYMW;
3752                 if (phy->rev == 1)
3753                         hf |= B43_HF_GDCW;
3754                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
3755                         hf |= B43_HF_OFDMPABOOST;
3756         } else if (phy->type == B43_PHYTYPE_B) {
3757                 hf |= B43_HF_SYMW;
3758                 if (phy->rev >= 2 && phy->radio_ver == 0x2050)
3759                         hf &= ~B43_HF_GDCW;
3760         }
3761         b43_hf_write(dev, hf);
3762
3763         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
3764                              B43_DEFAULT_LONG_RETRY_LIMIT);
3765         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
3766         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
3767
3768         /* Disable sending probe responses from firmware.
3769          * Setting the MaxTime to one usec will always trigger
3770          * a timeout, so we never send any probe resp.
3771          * A timeout of zero is infinite. */
3772         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
3773
3774         b43_rate_memory_init(dev);
3775
3776         /* Minimum Contention Window */
3777         if (phy->type == B43_PHYTYPE_B) {
3778                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
3779         } else {
3780                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
3781         }
3782         /* Maximum Contention Window */
3783         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
3784
3785         err = b43_dma_init(dev);
3786         if (err)
3787                 goto err_chip_exit;
3788         b43_qos_init(dev);
3789
3790 //FIXME
3791 #if 1
3792         b43_write16(dev, 0x0612, 0x0050);
3793         b43_shm_write16(dev, B43_SHM_SHARED, 0x0416, 0x0050);
3794         b43_shm_write16(dev, B43_SHM_SHARED, 0x0414, 0x01F4);
3795 #endif
3796
3797         b43_bluetooth_coext_enable(dev);
3798
3799         ssb_bus_powerup(bus, 1);        /* Enable dynamic PCTL */
3800         b43_upload_card_macaddress(dev);
3801         b43_security_init(dev);
3802         if (!dev->suspend_in_progress)
3803                 b43_rng_init(wl);
3804
3805         b43_set_status(dev, B43_STAT_INITIALIZED);
3806
3807         if (!dev->suspend_in_progress)
3808                 b43_leds_init(dev);
3809 out:
3810         return err;
3811
3812       err_chip_exit:
3813         b43_chip_exit(dev);
3814       err_kfree_tssitbl:
3815         if (phy->dyn_tssi_tbl)
3816                 kfree(phy->tssi2dbm);
3817       err_kfree_lo_control:
3818         kfree(phy->lo_control);
3819         phy->lo_control = NULL;
3820       err_busdown:
3821         ssb_bus_may_powerdown(bus);
3822         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
3823         return err;
3824 }
3825
3826 static int b43_op_add_interface(struct ieee80211_hw *hw,
3827                                 struct ieee80211_if_init_conf *conf)
3828 {
3829         struct b43_wl *wl = hw_to_b43_wl(hw);
3830         struct b43_wldev *dev;
3831         unsigned long flags;
3832         int err = -EOPNOTSUPP;
3833
3834         /* TODO: allow WDS/AP devices to coexist */
3835
3836         if (conf->type != IEEE80211_IF_TYPE_AP &&
3837             conf->type != IEEE80211_IF_TYPE_STA &&
3838             conf->type != IEEE80211_IF_TYPE_WDS &&
3839             conf->type != IEEE80211_IF_TYPE_IBSS)
3840                 return -EOPNOTSUPP;
3841
3842         mutex_lock(&wl->mutex);
3843         if (wl->operating)
3844                 goto out_mutex_unlock;
3845
3846         b43dbg(wl, "Adding Interface type %d\n", conf->type);
3847
3848         dev = wl->current_dev;
3849         wl->operating = 1;
3850         wl->vif = conf->vif;
3851         wl->if_type = conf->type;
3852         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
3853
3854         spin_lock_irqsave(&wl->irq_lock, flags);
3855         b43_adjust_opmode(dev);
3856         b43_upload_card_macaddress(dev);
3857         spin_unlock_irqrestore(&wl->irq_lock, flags);
3858
3859         err = 0;
3860  out_mutex_unlock:
3861         mutex_unlock(&wl->mutex);
3862
3863         return err;
3864 }
3865
3866 static void b43_op_remove_interface(struct ieee80211_hw *hw,
3867                                     struct ieee80211_if_init_conf *conf)
3868 {
3869         struct b43_wl *wl = hw_to_b43_wl(hw);
3870         struct b43_wldev *dev = wl->current_dev;
3871         unsigned long flags;
3872
3873         b43dbg(wl, "Removing Interface type %d\n", conf->type);
3874
3875         mutex_lock(&wl->mutex);
3876
3877         B43_WARN_ON(!wl->operating);
3878         B43_WARN_ON(wl->vif != conf->vif);
3879         wl->vif = NULL;
3880
3881         wl->operating = 0;
3882
3883         spin_lock_irqsave(&wl->irq_lock, flags);
3884         b43_adjust_opmode(dev);
3885         memset(wl->mac_addr, 0, ETH_ALEN);
3886         b43_upload_card_macaddress(dev);
3887         spin_unlock_irqrestore(&wl->irq_lock, flags);
3888
3889         mutex_unlock(&wl->mutex);
3890 }
3891
3892 static int b43_op_start(struct ieee80211_hw *hw)
3893 {
3894         struct b43_wl *wl = hw_to_b43_wl(hw);
3895         struct b43_wldev *dev = wl->current_dev;
3896         int did_init = 0;
3897         int err = 0;
3898         bool do_rfkill_exit = 0;
3899
3900         /* Kill all old instance specific information to make sure
3901          * the card won't use it in the short timeframe between start
3902          * and mac80211 reconfiguring it. */
3903         memset(wl->bssid, 0, ETH_ALEN);
3904         memset(wl->mac_addr, 0, ETH_ALEN);
3905         wl->filter_flags = 0;
3906         wl->radiotap_enabled = 0;
3907         b43_qos_clear(wl);
3908
3909         /* First register RFkill.
3910          * LEDs that are registered later depend on it. */
3911         b43_rfkill_init(dev);
3912
3913         mutex_lock(&wl->mutex);
3914
3915         if (b43_status(dev) < B43_STAT_INITIALIZED) {
3916                 err = b43_wireless_core_init(dev);
3917                 if (err) {
3918                         do_rfkill_exit = 1;
3919                         goto out_mutex_unlock;
3920                 }
3921                 did_init = 1;
3922         }
3923
3924         if (b43_status(dev) < B43_STAT_STARTED) {
3925                 err = b43_wireless_core_start(dev);
3926                 if (err) {
3927                         if (did_init)
3928                                 b43_wireless_core_exit(dev);
3929                         do_rfkill_exit = 1;
3930                         goto out_mutex_unlock;
3931                 }
3932         }
3933
3934  out_mutex_unlock:
3935         mutex_unlock(&wl->mutex);
3936
3937         if (do_rfkill_exit)
3938                 b43_rfkill_exit(dev);
3939
3940         return err;
3941 }
3942
3943 static void b43_op_stop(struct ieee80211_hw *hw)
3944 {
3945         struct b43_wl *wl = hw_to_b43_wl(hw);
3946         struct b43_wldev *dev = wl->current_dev;
3947
3948         b43_rfkill_exit(dev);
3949         cancel_work_sync(&(wl->qos_update_work));
3950
3951         mutex_lock(&wl->mutex);
3952         if (b43_status(dev) >= B43_STAT_STARTED)
3953                 b43_wireless_core_stop(dev);
3954         b43_wireless_core_exit(dev);
3955         mutex_unlock(&wl->mutex);
3956 }
3957
3958 static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
3959                                   u32 short_retry_limit, u32 long_retry_limit)
3960 {
3961         struct b43_wl *wl = hw_to_b43_wl(hw);
3962         struct b43_wldev *dev;
3963         int err = 0;
3964
3965         mutex_lock(&wl->mutex);
3966         dev = wl->current_dev;
3967         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
3968                 err = -ENODEV;
3969                 goto out_unlock;
3970         }
3971         b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
3972 out_unlock:
3973         mutex_unlock(&wl->mutex);
3974
3975         return err;
3976 }
3977
3978 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
3979 {
3980         struct b43_wl *wl = hw_to_b43_wl(hw);
3981         struct sk_buff *beacon;
3982         unsigned long flags;
3983
3984         /* We could modify the existing beacon and set the aid bit in
3985          * the TIM field, but that would probably require resizing and
3986          * moving of data within the beacon template.
3987          * Simply request a new beacon and let mac80211 do the hard work. */
3988         beacon = ieee80211_beacon_get(hw, wl->vif, NULL);
3989         if (unlikely(!beacon))
3990                 return -ENOMEM;
3991         spin_lock_irqsave(&wl->irq_lock, flags);
3992         b43_update_templates(wl, beacon);
3993         spin_unlock_irqrestore(&wl->irq_lock, flags);
3994
3995         return 0;
3996 }
3997
3998 static int b43_op_ibss_beacon_update(struct ieee80211_hw *hw,
3999                                      struct sk_buff *beacon,
4000                                      struct ieee80211_tx_control *ctl)
4001 {
4002         struct b43_wl *wl = hw_to_b43_wl(hw);
4003         unsigned long flags;
4004
4005         spin_lock_irqsave(&wl->irq_lock, flags);
4006         b43_update_templates(wl, beacon);
4007         spin_unlock_irqrestore(&wl->irq_lock, flags);
4008
4009         return 0;
4010 }
4011
4012 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4013                               struct ieee80211_vif *vif,
4014                               enum sta_notify_cmd notify_cmd,
4015                               const u8 *addr)
4016 {
4017         struct b43_wl *wl = hw_to_b43_wl(hw);
4018
4019         B43_WARN_ON(!vif || wl->vif != vif);
4020 }
4021
4022 static const struct ieee80211_ops b43_hw_ops = {
4023         .tx                     = b43_op_tx,
4024         .conf_tx                = b43_op_conf_tx,
4025         .add_interface          = b43_op_add_interface,
4026         .remove_interface       = b43_op_remove_interface,
4027         .config                 = b43_op_config,
4028         .config_interface       = b43_op_config_interface,
4029         .configure_filter       = b43_op_configure_filter,
4030         .set_key                = b43_op_set_key,
4031         .get_stats              = b43_op_get_stats,
4032         .get_tx_stats           = b43_op_get_tx_stats,
4033         .start                  = b43_op_start,
4034         .stop                   = b43_op_stop,
4035         .set_retry_limit        = b43_op_set_retry_limit,
4036         .set_tim                = b43_op_beacon_set_tim,
4037         .beacon_update          = b43_op_ibss_beacon_update,
4038         .sta_notify             = b43_op_sta_notify,
4039 };
4040
4041 /* Hard-reset the chip. Do not call this directly.
4042  * Use b43_controller_restart()
4043  */
4044 static void b43_chip_reset(struct work_struct *work)
4045 {
4046         struct b43_wldev *dev =
4047             container_of(work, struct b43_wldev, restart_work);
4048         struct b43_wl *wl = dev->wl;
4049         int err = 0;
4050         int prev_status;
4051
4052         mutex_lock(&wl->mutex);
4053
4054         prev_status = b43_status(dev);
4055         /* Bring the device down... */
4056         if (prev_status >= B43_STAT_STARTED)
4057                 b43_wireless_core_stop(dev);
4058         if (prev_status >= B43_STAT_INITIALIZED)
4059                 b43_wireless_core_exit(dev);
4060
4061         /* ...and up again. */
4062         if (prev_status >= B43_STAT_INITIALIZED) {
4063                 err = b43_wireless_core_init(dev);
4064                 if (err)
4065                         goto out;
4066         }
4067         if (prev_status >= B43_STAT_STARTED) {
4068                 err = b43_wireless_core_start(dev);
4069                 if (err) {
4070                         b43_wireless_core_exit(dev);
4071                         goto out;
4072                 }
4073         }
4074       out:
4075         mutex_unlock(&wl->mutex);
4076         if (err)
4077                 b43err(wl, "Controller restart FAILED\n");
4078         else
4079                 b43info(wl, "Controller restarted\n");
4080 }
4081
4082 static int b43_setup_bands(struct b43_wldev *dev,
4083                            bool have_2ghz_phy, bool have_5ghz_phy)
4084 {
4085         struct ieee80211_hw *hw = dev->wl->hw;
4086
4087         if (have_2ghz_phy)
4088                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4089         if (dev->phy.type == B43_PHYTYPE_N) {
4090                 if (have_5ghz_phy)
4091                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4092         } else {
4093                 if (have_5ghz_phy)
4094                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4095         }
4096
4097         dev->phy.supports_2ghz = have_2ghz_phy;
4098         dev->phy.supports_5ghz = have_5ghz_phy;
4099
4100         return 0;
4101 }
4102
4103 static void b43_wireless_core_detach(struct b43_wldev *dev)
4104 {
4105         /* We release firmware that late to not be required to re-request
4106          * is all the time when we reinit the core. */
4107         b43_release_firmware(dev);
4108 }
4109
4110 static int b43_wireless_core_attach(struct b43_wldev *dev)
4111 {
4112         struct b43_wl *wl = dev->wl;
4113         struct ssb_bus *bus = dev->dev->bus;
4114         struct pci_dev *pdev = bus->host_pci;
4115         int err;
4116         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4117         u32 tmp;
4118
4119         /* Do NOT do any device initialization here.
4120          * Do it in wireless_core_init() instead.
4121          * This function is for gathering basic information about the HW, only.
4122          * Also some structs may be set up here. But most likely you want to have
4123          * that in core_init(), too.
4124          */
4125
4126         err = ssb_bus_powerup(bus, 0);
4127         if (err) {
4128                 b43err(wl, "Bus powerup failed\n");
4129                 goto out;
4130         }
4131         /* Get the PHY type. */
4132         if (dev->dev->id.revision >= 5) {
4133                 u32 tmshigh;
4134
4135                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4136                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4137                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4138         } else
4139                 B43_WARN_ON(1);
4140
4141         dev->phy.gmode = have_2ghz_phy;
4142         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4143         b43_wireless_core_reset(dev, tmp);
4144
4145         err = b43_phy_versioning(dev);
4146         if (err)
4147                 goto err_powerdown;
4148         /* Check if this device supports multiband. */
4149         if (!pdev ||
4150             (pdev->device != 0x4312 &&
4151              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4152                 /* No multiband support. */
4153                 have_2ghz_phy = 0;
4154                 have_5ghz_phy = 0;
4155                 switch (dev->phy.type) {
4156                 case B43_PHYTYPE_A:
4157                         have_5ghz_phy = 1;
4158                         break;
4159                 case B43_PHYTYPE_G:
4160                 case B43_PHYTYPE_N:
4161                         have_2ghz_phy = 1;
4162                         break;
4163                 default:
4164                         B43_WARN_ON(1);
4165                 }
4166         }
4167         if (dev->phy.type == B43_PHYTYPE_A) {
4168                 /* FIXME */
4169                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4170                 err = -EOPNOTSUPP;
4171                 goto err_powerdown;
4172         }
4173         dev->phy.gmode = have_2ghz_phy;
4174         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4175         b43_wireless_core_reset(dev, tmp);
4176
4177         err = b43_validate_chipaccess(dev);
4178         if (err)
4179                 goto err_powerdown;
4180         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4181         if (err)
4182                 goto err_powerdown;
4183
4184         /* Now set some default "current_dev" */
4185         if (!wl->current_dev)
4186                 wl->current_dev = dev;
4187         INIT_WORK(&dev->restart_work, b43_chip_reset);
4188
4189         b43_radio_turn_off(dev, 1);
4190         b43_switch_analog(dev, 0);
4191         ssb_device_disable(dev->dev, 0);
4192         ssb_bus_may_powerdown(bus);
4193
4194 out:
4195         return err;
4196
4197 err_powerdown:
4198         ssb_bus_may_powerdown(bus);
4199         return err;
4200 }
4201
4202 static void b43_one_core_detach(struct ssb_device *dev)
4203 {
4204         struct b43_wldev *wldev;
4205         struct b43_wl *wl;
4206
4207         wldev = ssb_get_drvdata(dev);
4208         wl = wldev->wl;
4209         cancel_work_sync(&wldev->restart_work);
4210         b43_debugfs_remove_device(wldev);
4211         b43_wireless_core_detach(wldev);
4212         list_del(&wldev->list);
4213         wl->nr_devs--;
4214         ssb_set_drvdata(dev, NULL);
4215         kfree(wldev);
4216 }
4217
4218 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4219 {
4220         struct b43_wldev *wldev;
4221         struct pci_dev *pdev;
4222         int err = -ENOMEM;
4223
4224         if (!list_empty(&wl->devlist)) {
4225                 /* We are not the first core on this chip. */
4226                 pdev = dev->bus->host_pci;
4227                 /* Only special chips support more than one wireless
4228                  * core, although some of the other chips have more than
4229                  * one wireless core as well. Check for this and
4230                  * bail out early.
4231                  */
4232                 if (!pdev ||
4233                     ((pdev->device != 0x4321) &&
4234                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4235                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4236                         return -ENODEV;
4237                 }
4238         }
4239
4240         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4241         if (!wldev)
4242                 goto out;
4243
4244         wldev->dev = dev;
4245         wldev->wl = wl;
4246         b43_set_status(wldev, B43_STAT_UNINIT);
4247         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4248         tasklet_init(&wldev->isr_tasklet,
4249                      (void (*)(unsigned long))b43_interrupt_tasklet,
4250                      (unsigned long)wldev);
4251         INIT_LIST_HEAD(&wldev->list);
4252
4253         err = b43_wireless_core_attach(wldev);
4254         if (err)
4255                 goto err_kfree_wldev;
4256
4257         list_add(&wldev->list, &wl->devlist);
4258         wl->nr_devs++;
4259         ssb_set_drvdata(dev, wldev);
4260         b43_debugfs_add_device(wldev);
4261
4262       out:
4263         return err;
4264
4265       err_kfree_wldev:
4266         kfree(wldev);
4267         return err;
4268 }
4269
4270 static void b43_sprom_fixup(struct ssb_bus *bus)
4271 {
4272         /* boardflags workarounds */
4273         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4274             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4275                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4276         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4277             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4278                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4279 }
4280
4281 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4282 {
4283         struct ieee80211_hw *hw = wl->hw;
4284
4285         ssb_set_devtypedata(dev, NULL);
4286         ieee80211_free_hw(hw);
4287 }
4288
4289 static int b43_wireless_init(struct ssb_device *dev)
4290 {
4291         struct ssb_sprom *sprom = &dev->bus->sprom;
4292         struct ieee80211_hw *hw;
4293         struct b43_wl *wl;
4294         int err = -ENOMEM;
4295
4296         b43_sprom_fixup(dev->bus);
4297
4298         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4299         if (!hw) {
4300                 b43err(NULL, "Could not allocate ieee80211 device\n");
4301                 goto out;
4302         }
4303
4304         /* fill hw info */
4305         hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
4306                     IEEE80211_HW_RX_INCLUDES_FCS;
4307         hw->max_signal = 100;
4308         hw->max_rssi = -110;
4309         hw->max_noise = -110;
4310         hw->queues = b43_modparam_qos ? 4 : 1;
4311         SET_IEEE80211_DEV(hw, dev->dev);
4312         if (is_valid_ether_addr(sprom->et1mac))
4313                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4314         else
4315                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4316
4317         /* Get and initialize struct b43_wl */
4318         wl = hw_to_b43_wl(hw);
4319         memset(wl, 0, sizeof(*wl));
4320         wl->hw = hw;
4321         spin_lock_init(&wl->irq_lock);
4322         spin_lock_init(&wl->leds_lock);
4323         spin_lock_init(&wl->shm_lock);
4324         mutex_init(&wl->mutex);
4325         INIT_LIST_HEAD(&wl->devlist);
4326         INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
4327
4328         ssb_set_devtypedata(dev, wl);
4329         b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4330         err = 0;
4331       out:
4332         return err;
4333 }
4334
4335 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4336 {
4337         struct b43_wl *wl;
4338         int err;
4339         int first = 0;
4340
4341         wl = ssb_get_devtypedata(dev);
4342         if (!wl) {
4343                 /* Probing the first core. Must setup common struct b43_wl */
4344                 first = 1;
4345                 err = b43_wireless_init(dev);
4346                 if (err)
4347                         goto out;
4348                 wl = ssb_get_devtypedata(dev);
4349                 B43_WARN_ON(!wl);
4350         }
4351         err = b43_one_core_attach(dev, wl);
4352         if (err)
4353                 goto err_wireless_exit;
4354
4355         if (first) {
4356                 err = ieee80211_register_hw(wl->hw);
4357                 if (err)
4358                         goto err_one_core_detach;
4359         }
4360
4361       out:
4362         return err;
4363
4364       err_one_core_detach:
4365         b43_one_core_detach(dev);
4366       err_wireless_exit:
4367         if (first)
4368                 b43_wireless_exit(dev, wl);
4369         return err;
4370 }
4371
4372 static void b43_remove(struct ssb_device *dev)
4373 {
4374         struct b43_wl *wl = ssb_get_devtypedata(dev);
4375         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4376
4377         B43_WARN_ON(!wl);
4378         if (wl->current_dev == wldev)
4379                 ieee80211_unregister_hw(wl->hw);
4380
4381         b43_one_core_detach(dev);
4382
4383         if (list_empty(&wl->devlist)) {
4384                 /* Last core on the chip unregistered.
4385                  * We can destroy common struct b43_wl.
4386                  */
4387                 b43_wireless_exit(dev, wl);
4388         }
4389 }
4390
4391 /* Perform a hardware reset. This can be called from any context. */
4392 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4393 {
4394         /* Must avoid requeueing, if we are in shutdown. */
4395         if (b43_status(dev) < B43_STAT_INITIALIZED)
4396                 return;
4397         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4398         queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4399 }
4400
4401 #ifdef CONFIG_PM
4402
4403 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4404 {
4405         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4406         struct b43_wl *wl = wldev->wl;
4407
4408         b43dbg(wl, "Suspending...\n");
4409
4410         mutex_lock(&wl->mutex);
4411         wldev->suspend_in_progress = true;
4412         wldev->suspend_init_status = b43_status(wldev);
4413         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4414                 b43_wireless_core_stop(wldev);
4415         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4416                 b43_wireless_core_exit(wldev);
4417         mutex_unlock(&wl->mutex);
4418
4419         b43dbg(wl, "Device suspended.\n");
4420
4421         return 0;
4422 }
4423
4424 static int b43_resume(struct ssb_device *dev)
4425 {
4426         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4427         struct b43_wl *wl = wldev->wl;
4428         int err = 0;
4429
4430         b43dbg(wl, "Resuming...\n");
4431
4432         mutex_lock(&wl->mutex);
4433         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4434                 err = b43_wireless_core_init(wldev);
4435                 if (err) {
4436                         b43err(wl, "Resume failed at core init\n");
4437                         goto out;
4438                 }
4439         }
4440         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4441                 err = b43_wireless_core_start(wldev);
4442                 if (err) {
4443                         b43_leds_exit(wldev);
4444                         b43_rng_exit(wldev->wl, true);
4445                         b43_wireless_core_exit(wldev);
4446                         b43err(wl, "Resume failed at core start\n");
4447                         goto out;
4448                 }
4449         }
4450         b43dbg(wl, "Device resumed.\n");
4451  out:
4452         wldev->suspend_in_progress = false;
4453         mutex_unlock(&wl->mutex);
4454         return err;
4455 }
4456
4457 #else /* CONFIG_PM */
4458 # define b43_suspend    NULL
4459 # define b43_resume     NULL
4460 #endif /* CONFIG_PM */
4461
4462 static struct ssb_driver b43_ssb_driver = {
4463         .name           = KBUILD_MODNAME,
4464         .id_table       = b43_ssb_tbl,
4465         .probe          = b43_probe,
4466         .remove         = b43_remove,
4467         .suspend        = b43_suspend,
4468         .resume         = b43_resume,
4469 };
4470
4471 static void b43_print_driverinfo(void)
4472 {
4473         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4474                    *feat_leds = "", *feat_rfkill = "";
4475
4476 #ifdef CONFIG_B43_PCI_AUTOSELECT
4477         feat_pci = "P";
4478 #endif
4479 #ifdef CONFIG_B43_PCMCIA
4480         feat_pcmcia = "M";
4481 #endif
4482 #ifdef CONFIG_B43_NPHY
4483         feat_nphy = "N";
4484 #endif
4485 #ifdef CONFIG_B43_LEDS
4486         feat_leds = "L";
4487 #endif
4488 #ifdef CONFIG_B43_RFKILL
4489         feat_rfkill = "R";
4490 #endif
4491         printk(KERN_INFO "Broadcom 43xx driver loaded "
4492                "[ Features: %s%s%s%s%s, Firmware-ID: "
4493                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4494                feat_pci, feat_pcmcia, feat_nphy,
4495                feat_leds, feat_rfkill);
4496 }
4497
4498 static int __init b43_init(void)
4499 {
4500         int err;
4501
4502         b43_debugfs_init();
4503         err = b43_pcmcia_init();
4504         if (err)
4505                 goto err_dfs_exit;
4506         err = ssb_driver_register(&b43_ssb_driver);
4507         if (err)
4508                 goto err_pcmcia_exit;
4509         b43_print_driverinfo();
4510
4511         return err;
4512
4513 err_pcmcia_exit:
4514         b43_pcmcia_exit();
4515 err_dfs_exit:
4516         b43_debugfs_exit();
4517         return err;
4518 }
4519
4520 static void __exit b43_exit(void)
4521 {
4522         ssb_driver_unregister(&b43_ssb_driver);
4523         b43_pcmcia_exit();
4524         b43_debugfs_exit();
4525 }
4526
4527 module_init(b43_init)
4528 module_exit(b43_exit)