git.oblomov.eu Git - linux-2.6/blob - drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/firmware.h>
  37 #include <linux/wireless.h>
  38 #include <linux/workqueue.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/io.h>
  41 #include <linux/dma-mapping.h>
  42 #include <asm/unaligned.h>
  43
  44 #include "b43.h"
  45 #include "main.h"
  46 #include "debugfs.h"
  47 #include "phy_common.h"
  48 #include "phy_g.h"
  49 #include "phy_n.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 int b43_modparam_qos = 1;
  84 module_param_named(qos, b43_modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91
  92 static const struct ssb_device_id b43_ssb_tbl[] = {
  93         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  94         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  95         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
  96         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 100         SSB_DEVTABLE_END
 101 };
 102
 103 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 104
 105 /* Channel and ratetables are shared for all devices.
 106  * They can't be const, because ieee80211 puts some precalculated
 107  * data in there. This data is the same for all devices, so we don't
 108  * get concurrency issues */
 109 #define RATETAB_ENT(_rateid, _flags) \
 110         {                                                               \
 111                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 112                 .hw_value       = (_rateid),                            \
 113                 .flags          = (_flags),                             \
 114         }
 115
 116 /*
 117  * NOTE: When changing this, sync with xmit.c's
 118  *       b43_plcp_get_bitrate_idx_* functions!
 119  */
 120 static struct ieee80211_rate __b43_ratetable[] = {
 121         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 122         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 123         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 124         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 125         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 126         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 127         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 128         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 129         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 130         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 131         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 133 };
 134
 135 #define b43_a_ratetable         (__b43_ratetable + 4)
 136 #define b43_a_ratetable_size    8
 137 #define b43_b_ratetable         (__b43_ratetable + 0)
 138 #define b43_b_ratetable_size    4
 139 #define b43_g_ratetable         (__b43_ratetable + 0)
 140 #define b43_g_ratetable_size    12
 141
 142 #define CHAN4G(_channel, _freq, _flags) {                       \
 143         .band                   = IEEE80211_BAND_2GHZ,          \
 144         .center_freq            = (_freq),                      \
 145         .hw_value               = (_channel),                   \
 146         .flags                  = (_flags),                     \
 147         .max_antenna_gain       = 0,                            \
 148         .max_power              = 30,                           \
 149 }
 150 static struct ieee80211_channel b43_2ghz_chantable[] = {
 151         CHAN4G(1, 2412, 0),
 152         CHAN4G(2, 2417, 0),
 153         CHAN4G(3, 2422, 0),
 154         CHAN4G(4, 2427, 0),
 155         CHAN4G(5, 2432, 0),
 156         CHAN4G(6, 2437, 0),
 157         CHAN4G(7, 2442, 0),
 158         CHAN4G(8, 2447, 0),
 159         CHAN4G(9, 2452, 0),
 160         CHAN4G(10, 2457, 0),
 161         CHAN4G(11, 2462, 0),
 162         CHAN4G(12, 2467, 0),
 163         CHAN4G(13, 2472, 0),
 164         CHAN4G(14, 2484, 0),
 165 };
 166 #undef CHAN4G
 167
 168 #define CHAN5G(_channel, _flags) {                              \
 169         .band                   = IEEE80211_BAND_5GHZ,          \
 170         .center_freq            = 5000 + (5 * (_channel)),      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 177         CHAN5G(32, 0),          CHAN5G(34, 0),
 178         CHAN5G(36, 0),          CHAN5G(38, 0),
 179         CHAN5G(40, 0),          CHAN5G(42, 0),
 180         CHAN5G(44, 0),          CHAN5G(46, 0),
 181         CHAN5G(48, 0),          CHAN5G(50, 0),
 182         CHAN5G(52, 0),          CHAN5G(54, 0),
 183         CHAN5G(56, 0),          CHAN5G(58, 0),
 184         CHAN5G(60, 0),          CHAN5G(62, 0),
 185         CHAN5G(64, 0),          CHAN5G(66, 0),
 186         CHAN5G(68, 0),          CHAN5G(70, 0),
 187         CHAN5G(72, 0),          CHAN5G(74, 0),
 188         CHAN5G(76, 0),          CHAN5G(78, 0),
 189         CHAN5G(80, 0),          CHAN5G(82, 0),
 190         CHAN5G(84, 0),          CHAN5G(86, 0),
 191         CHAN5G(88, 0),          CHAN5G(90, 0),
 192         CHAN5G(92, 0),          CHAN5G(94, 0),
 193         CHAN5G(96, 0),          CHAN5G(98, 0),
 194         CHAN5G(100, 0),         CHAN5G(102, 0),
 195         CHAN5G(104, 0),         CHAN5G(106, 0),
 196         CHAN5G(108, 0),         CHAN5G(110, 0),
 197         CHAN5G(112, 0),         CHAN5G(114, 0),
 198         CHAN5G(116, 0),         CHAN5G(118, 0),
 199         CHAN5G(120, 0),         CHAN5G(122, 0),
 200         CHAN5G(124, 0),         CHAN5G(126, 0),
 201         CHAN5G(128, 0),         CHAN5G(130, 0),
 202         CHAN5G(132, 0),         CHAN5G(134, 0),
 203         CHAN5G(136, 0),         CHAN5G(138, 0),
 204         CHAN5G(140, 0),         CHAN5G(142, 0),
 205         CHAN5G(144, 0),         CHAN5G(145, 0),
 206         CHAN5G(146, 0),         CHAN5G(147, 0),
 207         CHAN5G(148, 0),         CHAN5G(149, 0),
 208         CHAN5G(150, 0),         CHAN5G(151, 0),
 209         CHAN5G(152, 0),         CHAN5G(153, 0),
 210         CHAN5G(154, 0),         CHAN5G(155, 0),
 211         CHAN5G(156, 0),         CHAN5G(157, 0),
 212         CHAN5G(158, 0),         CHAN5G(159, 0),
 213         CHAN5G(160, 0),         CHAN5G(161, 0),
 214         CHAN5G(162, 0),         CHAN5G(163, 0),
 215         CHAN5G(164, 0),         CHAN5G(165, 0),
 216         CHAN5G(166, 0),         CHAN5G(168, 0),
 217         CHAN5G(170, 0),         CHAN5G(172, 0),
 218         CHAN5G(174, 0),         CHAN5G(176, 0),
 219         CHAN5G(178, 0),         CHAN5G(180, 0),
 220         CHAN5G(182, 0),         CHAN5G(184, 0),
 221         CHAN5G(186, 0),         CHAN5G(188, 0),
 222         CHAN5G(190, 0),         CHAN5G(192, 0),
 223         CHAN5G(194, 0),         CHAN5G(196, 0),
 224         CHAN5G(198, 0),         CHAN5G(200, 0),
 225         CHAN5G(202, 0),         CHAN5G(204, 0),
 226         CHAN5G(206, 0),         CHAN5G(208, 0),
 227         CHAN5G(210, 0),         CHAN5G(212, 0),
 228         CHAN5G(214, 0),         CHAN5G(216, 0),
 229         CHAN5G(218, 0),         CHAN5G(220, 0),
 230         CHAN5G(222, 0),         CHAN5G(224, 0),
 231         CHAN5G(226, 0),         CHAN5G(228, 0),
 232 };
 233
 234 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 235         CHAN5G(34, 0),          CHAN5G(36, 0),
 236         CHAN5G(38, 0),          CHAN5G(40, 0),
 237         CHAN5G(42, 0),          CHAN5G(44, 0),
 238         CHAN5G(46, 0),          CHAN5G(48, 0),
 239         CHAN5G(52, 0),          CHAN5G(56, 0),
 240         CHAN5G(60, 0),          CHAN5G(64, 0),
 241         CHAN5G(100, 0),         CHAN5G(104, 0),
 242         CHAN5G(108, 0),         CHAN5G(112, 0),
 243         CHAN5G(116, 0),         CHAN5G(120, 0),
 244         CHAN5G(124, 0),         CHAN5G(128, 0),
 245         CHAN5G(132, 0),         CHAN5G(136, 0),
 246         CHAN5G(140, 0),         CHAN5G(149, 0),
 247         CHAN5G(153, 0),         CHAN5G(157, 0),
 248         CHAN5G(161, 0),         CHAN5G(165, 0),
 249         CHAN5G(184, 0),         CHAN5G(188, 0),
 250         CHAN5G(192, 0),         CHAN5G(196, 0),
 251         CHAN5G(200, 0),         CHAN5G(204, 0),
 252         CHAN5G(208, 0),         CHAN5G(212, 0),
 253         CHAN5G(216, 0),
 254 };
 255 #undef CHAN5G
 256
 257 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 258         .band           = IEEE80211_BAND_5GHZ,
 259         .channels       = b43_5ghz_nphy_chantable,
 260         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 261         .bitrates       = b43_a_ratetable,
 262         .n_bitrates     = b43_a_ratetable_size,
 263 };
 264
 265 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 266         .band           = IEEE80211_BAND_5GHZ,
 267         .channels       = b43_5ghz_aphy_chantable,
 268         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 269         .bitrates       = b43_a_ratetable,
 270         .n_bitrates     = b43_a_ratetable_size,
 271 };
 272
 273 static struct ieee80211_supported_band b43_band_2GHz = {
 274         .band           = IEEE80211_BAND_2GHZ,
 275         .channels       = b43_2ghz_chantable,
 276         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 277         .bitrates       = b43_g_ratetable,
 278         .n_bitrates     = b43_g_ratetable_size,
 279 };
 280
 281 static void b43_wireless_core_exit(struct b43_wldev *dev);
 282 static int b43_wireless_core_init(struct b43_wldev *dev);
 283 static void b43_wireless_core_stop(struct b43_wldev *dev);
 284 static int b43_wireless_core_start(struct b43_wldev *dev);
 285
 286 static int b43_ratelimit(struct b43_wl *wl)
 287 {
 288         if (!wl || !wl->current_dev)
 289                 return 1;
 290         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 291                 return 1;
 292         /* We are up and running.
 293          * Ratelimit the messages to avoid DoS over the net. */
 294         return net_ratelimit();
 295 }
 296
 297 void b43info(struct b43_wl *wl, const char *fmt, ...)
 298 {
 299         va_list args;
 300
 301         if (!b43_ratelimit(wl))
 302                 return;
 303         va_start(args, fmt);
 304         printk(KERN_INFO "b43-%s: ",
 305                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 306         vprintk(fmt, args);
 307         va_end(args);
 308 }
 309
 310 void b43err(struct b43_wl *wl, const char *fmt, ...)
 311 {
 312         va_list args;
 313
 314         if (!b43_ratelimit(wl))
 315                 return;
 316         va_start(args, fmt);
 317         printk(KERN_ERR "b43-%s ERROR: ",
 318                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 319         vprintk(fmt, args);
 320         va_end(args);
 321 }
 322
 323 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         va_list args;
 326
 327         if (!b43_ratelimit(wl))
 328                 return;
 329         va_start(args, fmt);
 330         printk(KERN_WARNING "b43-%s warning: ",
 331                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 332         vprintk(fmt, args);
 333         va_end(args);
 334 }
 335
 336 #if B43_DEBUG
 337 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 338 {
 339         va_list args;
 340
 341         va_start(args, fmt);
 342         printk(KERN_DEBUG "b43-%s debug: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347 #endif /* DEBUG */
 348
 349 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 350 {
 351         u32 macctl;
 352
 353         B43_WARN_ON(offset % 4 != 0);
 354
 355         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 356         if (macctl & B43_MACCTL_BE)
 357                 val = swab32(val);
 358
 359         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 360         mmiowb();
 361         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 362 }
 363
 364 static inline void b43_shm_control_word(struct b43_wldev *dev,
 365                                         u16 routing, u16 offset)
 366 {
 367         u32 control;
 368
 369         /* "offset" is the WORD offset. */
 370         control = routing;
 371         control <<= 16;
 372         control |= offset;
 373         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 374 }
 375
 376 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 377 {
 378         u32 ret;
 379
 380         if (routing == B43_SHM_SHARED) {
 381                 B43_WARN_ON(offset & 0x0001);
 382                 if (offset & 0x0003) {
 383                         /* Unaligned access */
 384                         b43_shm_control_word(dev, routing, offset >> 2);
 385                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 386                         ret <<= 16;
 387                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 388                         ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
 389
 390                         goto out;
 391                 }
 392                 offset >>= 2;
 393         }
 394         b43_shm_control_word(dev, routing, offset);
 395         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 396 out:
 397         return ret;
 398 }
 399
 400 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 401 {
 402         struct b43_wl *wl = dev->wl;
 403         unsigned long flags;
 404         u32 ret;
 405
 406         spin_lock_irqsave(&wl->shm_lock, flags);
 407         ret = __b43_shm_read32(dev, routing, offset);
 408         spin_unlock_irqrestore(&wl->shm_lock, flags);
 409
 410         return ret;
 411 }
 412
 413 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 414 {
 415         u16 ret;
 416
 417         if (routing == B43_SHM_SHARED) {
 418                 B43_WARN_ON(offset & 0x0001);
 419                 if (offset & 0x0003) {
 420                         /* Unaligned access */
 421                         b43_shm_control_word(dev, routing, offset >> 2);
 422                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 423
 424                         goto out;
 425                 }
 426                 offset >>= 2;
 427         }
 428         b43_shm_control_word(dev, routing, offset);
 429         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 430 out:
 431         return ret;
 432 }
 433
 434 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 435 {
 436         struct b43_wl *wl = dev->wl;
 437         unsigned long flags;
 438         u16 ret;
 439
 440         spin_lock_irqsave(&wl->shm_lock, flags);
 441         ret = __b43_shm_read16(dev, routing, offset);
 442         spin_unlock_irqrestore(&wl->shm_lock, flags);
 443
 444         return ret;
 445 }
 446
 447 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 448 {
 449         if (routing == B43_SHM_SHARED) {
 450                 B43_WARN_ON(offset & 0x0001);
 451                 if (offset & 0x0003) {
 452                         /* Unaligned access */
 453                         b43_shm_control_word(dev, routing, offset >> 2);
 454                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 455                                     (value >> 16) & 0xffff);
 456                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 457                         b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
 458                         return;
 459                 }
 460                 offset >>= 2;
 461         }
 462         b43_shm_control_word(dev, routing, offset);
 463         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 464 }
 465
 466 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 467 {
 468         struct b43_wl *wl = dev->wl;
 469         unsigned long flags;
 470
 471         spin_lock_irqsave(&wl->shm_lock, flags);
 472         __b43_shm_write32(dev, routing, offset, value);
 473         spin_unlock_irqrestore(&wl->shm_lock, flags);
 474 }
 475
 476 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 477 {
 478         if (routing == B43_SHM_SHARED) {
 479                 B43_WARN_ON(offset & 0x0001);
 480                 if (offset & 0x0003) {
 481                         /* Unaligned access */
 482                         b43_shm_control_word(dev, routing, offset >> 2);
 483                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 484                         return;
 485                 }
 486                 offset >>= 2;
 487         }
 488         b43_shm_control_word(dev, routing, offset);
 489         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 490 }
 491
 492 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 493 {
 494         struct b43_wl *wl = dev->wl;
 495         unsigned long flags;
 496
 497         spin_lock_irqsave(&wl->shm_lock, flags);
 498         __b43_shm_write16(dev, routing, offset, value);
 499         spin_unlock_irqrestore(&wl->shm_lock, flags);
 500 }
 501
 502 /* Read HostFlags */
 503 u64 b43_hf_read(struct b43_wldev * dev)
 504 {
 505         u64 ret;
 506
 507         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 508         ret <<= 16;
 509         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 510         ret <<= 16;
 511         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 512
 513         return ret;
 514 }
 515
 516 /* Write HostFlags */
 517 void b43_hf_write(struct b43_wldev *dev, u64 value)
 518 {
 519         u16 lo, mi, hi;
 520
 521         lo = (value & 0x00000000FFFFULL);
 522         mi = (value & 0x0000FFFF0000ULL) >> 16;
 523         hi = (value & 0xFFFF00000000ULL) >> 32;
 524         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 525         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 526         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 527 }
 528
 529 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 530 {
 531         u32 low, high;
 532
 533         B43_WARN_ON(dev->dev->id.revision < 3);
 534
 535         /* The hardware guarantees us an atomic read, if we
 536          * read the low register first. */
 537         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 538         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 539
 540         *tsf = high;
 541         *tsf <<= 32;
 542         *tsf |= low;
 543 }
 544
 545 static void b43_time_lock(struct b43_wldev *dev)
 546 {
 547         u32 macctl;
 548
 549         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 550         macctl |= B43_MACCTL_TBTTHOLD;
 551         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 552         /* Commit the write */
 553         b43_read32(dev, B43_MMIO_MACCTL);
 554 }
 555
 556 static void b43_time_unlock(struct b43_wldev *dev)
 557 {
 558         u32 macctl;
 559
 560         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 561         macctl &= ~B43_MACCTL_TBTTHOLD;
 562         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 563         /* Commit the write */
 564         b43_read32(dev, B43_MMIO_MACCTL);
 565 }
 566
 567 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 568 {
 569         u32 low, high;
 570
 571         B43_WARN_ON(dev->dev->id.revision < 3);
 572
 573         low = tsf;
 574         high = (tsf >> 32);
 575         /* The hardware guarantees us an atomic write, if we
 576          * write the low register first. */
 577         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 578         mmiowb();
 579         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 580         mmiowb();
 581 }
 582
 583 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 584 {
 585         b43_time_lock(dev);
 586         b43_tsf_write_locked(dev, tsf);
 587         b43_time_unlock(dev);
 588 }
 589
 590 static
 591 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
 592 {
 593         static const u8 zero_addr[ETH_ALEN] = { 0 };
 594         u16 data;
 595
 596         if (!mac)
 597                 mac = zero_addr;
 598
 599         offset |= 0x0020;
 600         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 601
 602         data = mac[0];
 603         data |= mac[1] << 8;
 604         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 605         data = mac[2];
 606         data |= mac[3] << 8;
 607         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 608         data = mac[4];
 609         data |= mac[5] << 8;
 610         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 611 }
 612
 613 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 614 {
 615         const u8 *mac;
 616         const u8 *bssid;
 617         u8 mac_bssid[ETH_ALEN * 2];
 618         int i;
 619         u32 tmp;
 620
 621         bssid = dev->wl->bssid;
 622         mac = dev->wl->mac_addr;
 623
 624         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 625
 626         memcpy(mac_bssid, mac, ETH_ALEN);
 627         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 628
 629         /* Write our MAC address and BSSID to template ram */
 630         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 631                 tmp = (u32) (mac_bssid[i + 0]);
 632                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 633                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 634                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 635                 b43_ram_write(dev, 0x20 + i, tmp);
 636         }
 637 }
 638
 639 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 640 {
 641         b43_write_mac_bssid_templates(dev);
 642         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 643 }
 644
 645 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 646 {
 647         /* slot_time is in usec. */
 648         if (dev->phy.type != B43_PHYTYPE_G)
 649                 return;
 650         b43_write16(dev, 0x684, 510 + slot_time);
 651         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 652 }
 653
 654 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 655 {
 656         b43_set_slot_time(dev, 9);
 657 }
 658
 659 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 660 {
 661         b43_set_slot_time(dev, 20);
 662 }
 663
 664 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
 665  * Returns the _previously_ enabled IRQ mask.
 666  */
 667 static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
 668 {
 669         u32 old_mask;
 670
 671         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 672         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
 673
 674         return old_mask;
 675 }
 676
 677 /* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
 678  * Returns the _previously_ enabled IRQ mask.
 679  */
 680 static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
 681 {
 682         u32 old_mask;
 683
 684         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 685         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
 686
 687         return old_mask;
 688 }
 689
 690 /* Synchronize IRQ top- and bottom-half.
 691  * IRQs must be masked before calling this.
 692  * This must not be called with the irq_lock held.
 693  */
 694 static void b43_synchronize_irq(struct b43_wldev *dev)
 695 {
 696         synchronize_irq(dev->dev->irq);
 697         tasklet_kill(&dev->isr_tasklet);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-specs.sipsolutions.net/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev)
 704 {
 705         struct b43_wl *wl = dev->wl;
 706         struct b43_phy *phy = &dev->phy;
 707         unsigned int i, max_loop;
 708         u16 value;
 709         u32 buffer[5] = {
 710                 0x00000000,
 711                 0x00D40000,
 712                 0x00000000,
 713                 0x01000000,
 714                 0x00000000,
 715         };
 716
 717         switch (phy->type) {
 718         case B43_PHYTYPE_A:
 719                 max_loop = 0x1E;
 720                 buffer[0] = 0x000201CC;
 721                 break;
 722         case B43_PHYTYPE_B:
 723         case B43_PHYTYPE_G:
 724                 max_loop = 0xFA;
 725                 buffer[0] = 0x000B846E;
 726                 break;
 727         default:
 728                 B43_WARN_ON(1);
 729                 return;
 730         }
 731
 732         spin_lock_irq(&wl->irq_lock);
 733         write_lock(&wl->tx_lock);
 734
 735         for (i = 0; i < 5; i++)
 736                 b43_ram_write(dev, i * 4, buffer[i]);
 737
 738         /* Commit writes */
 739         b43_read32(dev, B43_MMIO_MACCTL);
 740
 741         b43_write16(dev, 0x0568, 0x0000);
 742         b43_write16(dev, 0x07C0, 0x0000);
 743         value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
 744         b43_write16(dev, 0x050C, value);
 745         b43_write16(dev, 0x0508, 0x0000);
 746         b43_write16(dev, 0x050A, 0x0000);
 747         b43_write16(dev, 0x054C, 0x0000);
 748         b43_write16(dev, 0x056A, 0x0014);
 749         b43_write16(dev, 0x0568, 0x0826);
 750         b43_write16(dev, 0x0500, 0x0000);
 751         b43_write16(dev, 0x0502, 0x0030);
 752
 753         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 754                 b43_radio_write16(dev, 0x0051, 0x0017);
 755         for (i = 0x00; i < max_loop; i++) {
 756                 value = b43_read16(dev, 0x050E);
 757                 if (value & 0x0080)
 758                         break;
 759                 udelay(10);
 760         }
 761         for (i = 0x00; i < 0x0A; i++) {
 762                 value = b43_read16(dev, 0x050E);
 763                 if (value & 0x0400)
 764                         break;
 765                 udelay(10);
 766         }
 767         for (i = 0x00; i < 0x19; i++) {
 768                 value = b43_read16(dev, 0x0690);
 769                 if (!(value & 0x0100))
 770                         break;
 771                 udelay(10);
 772         }
 773         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 774                 b43_radio_write16(dev, 0x0051, 0x0037);
 775
 776         write_unlock(&wl->tx_lock);
 777         spin_unlock_irq(&wl->irq_lock);
 778 }
 779
 780 static void key_write(struct b43_wldev *dev,
 781                       u8 index, u8 algorithm, const u8 * key)
 782 {
 783         unsigned int i;
 784         u32 offset;
 785         u16 value;
 786         u16 kidx;
 787
 788         /* Key index/algo block */
 789         kidx = b43_kidx_to_fw(dev, index);
 790         value = ((kidx << 4) | algorithm);
 791         b43_shm_write16(dev, B43_SHM_SHARED,
 792                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 793
 794         /* Write the key to the Key Table Pointer offset */
 795         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 796         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 797                 value = key[i];
 798                 value |= (u16) (key[i + 1]) << 8;
 799                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 800         }
 801 }
 802
 803 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
 804 {
 805         u32 addrtmp[2] = { 0, 0, };
 806         u8 per_sta_keys_start = 8;
 807
 808         if (b43_new_kidx_api(dev))
 809                 per_sta_keys_start = 4;
 810
 811         B43_WARN_ON(index < per_sta_keys_start);
 812         /* We have two default TX keys and possibly two default RX keys.
 813          * Physical mac 0 is mapped to physical key 4 or 8, depending
 814          * on the firmware version.
 815          * So we must adjust the index here.
 816          */
 817         index -= per_sta_keys_start;
 818
 819         if (addr) {
 820                 addrtmp[0] = addr[0];
 821                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 822                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 823                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 824                 addrtmp[1] = addr[4];
 825                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 826         }
 827
 828         if (dev->dev->id.revision >= 5) {
 829                 /* Receive match transmitter address mechanism */
 830                 b43_shm_write32(dev, B43_SHM_RCMTA,
 831                                 (index * 2) + 0, addrtmp[0]);
 832                 b43_shm_write16(dev, B43_SHM_RCMTA,
 833                                 (index * 2) + 1, addrtmp[1]);
 834         } else {
 835                 /* RXE (Receive Engine) and
 836                  * PSM (Programmable State Machine) mechanism
 837                  */
 838                 if (index < 8) {
 839                         /* TODO write to RCM 16, 19, 22 and 25 */
 840                 } else {
 841                         b43_shm_write32(dev, B43_SHM_SHARED,
 842                                         B43_SHM_SH_PSM + (index * 6) + 0,
 843                                         addrtmp[0]);
 844                         b43_shm_write16(dev, B43_SHM_SHARED,
 845                                         B43_SHM_SH_PSM + (index * 6) + 4,
 846                                         addrtmp[1]);
 847                 }
 848         }
 849 }
 850
 851 static void do_key_write(struct b43_wldev *dev,
 852                          u8 index, u8 algorithm,
 853                          const u8 * key, size_t key_len, const u8 * mac_addr)
 854 {
 855         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 856         u8 per_sta_keys_start = 8;
 857
 858         if (b43_new_kidx_api(dev))
 859                 per_sta_keys_start = 4;
 860
 861         B43_WARN_ON(index >= dev->max_nr_keys);
 862         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 863
 864         if (index >= per_sta_keys_start)
 865                 keymac_write(dev, index, NULL); /* First zero out mac. */
 866         if (key)
 867                 memcpy(buf, key, key_len);
 868         key_write(dev, index, algorithm, buf);
 869         if (index >= per_sta_keys_start)
 870                 keymac_write(dev, index, mac_addr);
 871
 872         dev->key[index].algorithm = algorithm;
 873 }
 874
 875 static int b43_key_write(struct b43_wldev *dev,
 876                          int index, u8 algorithm,
 877                          const u8 * key, size_t key_len,
 878                          const u8 * mac_addr,
 879                          struct ieee80211_key_conf *keyconf)
 880 {
 881         int i;
 882         int sta_keys_start;
 883
 884         if (key_len > B43_SEC_KEYSIZE)
 885                 return -EINVAL;
 886         for (i = 0; i < dev->max_nr_keys; i++) {
 887                 /* Check that we don't already have this key. */
 888                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 889         }
 890         if (index < 0) {
 891                 /* Pairwise key. Get an empty slot for the key. */
 892                 if (b43_new_kidx_api(dev))
 893                         sta_keys_start = 4;
 894                 else
 895                         sta_keys_start = 8;
 896                 for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
 897                         if (!dev->key[i].keyconf) {
 898                                 /* found empty */
 899                                 index = i;
 900                                 break;
 901                         }
 902                 }
 903                 if (index < 0) {
 904                         b43warn(dev->wl, "Out of hardware key memory\n");
 905                         return -ENOSPC;
 906                 }
 907         } else
 908                 B43_WARN_ON(index > 3);
 909
 910         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 911         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 912                 /* Default RX key */
 913                 B43_WARN_ON(mac_addr);
 914                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 915         }
 916         keyconf->hw_key_idx = index;
 917         dev->key[index].keyconf = keyconf;
 918
 919         return 0;
 920 }
 921
 922 static int b43_key_clear(struct b43_wldev *dev, int index)
 923 {
 924         if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
 925                 return -EINVAL;
 926         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 927                      NULL, B43_SEC_KEYSIZE, NULL);
 928         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 929                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 930                              NULL, B43_SEC_KEYSIZE, NULL);
 931         }
 932         dev->key[index].keyconf = NULL;
 933
 934         return 0;
 935 }
 936
 937 static void b43_clear_keys(struct b43_wldev *dev)
 938 {
 939         int i;
 940
 941         for (i = 0; i < dev->max_nr_keys; i++)
 942                 b43_key_clear(dev, i);
 943 }
 944
 945 static void b43_dump_keymemory(struct b43_wldev *dev)
 946 {
 947         unsigned int i, index, offset;
 948         DECLARE_MAC_BUF(macbuf);
 949         u8 mac[ETH_ALEN];
 950         u16 algo;
 951         u32 rcmta0;
 952         u16 rcmta1;
 953         u64 hf;
 954         struct b43_key *key;
 955
 956         if (!b43_debug(dev, B43_DBG_KEYS))
 957                 return;
 958
 959         hf = b43_hf_read(dev);
 960         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
 961                !!(hf & B43_HF_USEDEFKEYS));
 962         for (index = 0; index < dev->max_nr_keys; index++) {
 963                 key = &(dev->key[index]);
 964                 printk(KERN_DEBUG "Key slot %02u: %s",
 965                        index, (key->keyconf == NULL) ? " " : "*");
 966                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 967                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 968                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
 969                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
 970                 }
 971
 972                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
 973                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
 974                 printk("   Algo: %04X/%02X", algo, key->algorithm);
 975
 976                 if (index >= 4) {
 977                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
 978                                                 ((index - 4) * 2) + 0);
 979                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
 980                                                 ((index - 4) * 2) + 1);
 981                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
 982                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
 983                         printk("   MAC: %s",
 984                                print_mac(macbuf, mac));
 985                 } else
 986                         printk("   DEFAULT KEY");
 987                 printk("\n");
 988         }
 989 }
 990
 991 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 992 {
 993         u32 macctl;
 994         u16 ucstat;
 995         bool hwps;
 996         bool awake;
 997         int i;
 998
 999         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1000                     (ps_flags & B43_PS_DISABLED));
1001         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1002
1003         if (ps_flags & B43_PS_ENABLED) {
1004                 hwps = 1;
1005         } else if (ps_flags & B43_PS_DISABLED) {
1006                 hwps = 0;
1007         } else {
1008                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1009                 //      and thus is not an AP and we are associated, set bit 25
1010         }
1011         if (ps_flags & B43_PS_AWAKE) {
1012                 awake = 1;
1013         } else if (ps_flags & B43_PS_ASLEEP) {
1014                 awake = 0;
1015         } else {
1016                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1017                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1018                 //      successful, set bit26
1019         }
1020
1021 /* FIXME: For now we force awake-on and hwps-off */
1022         hwps = 0;
1023         awake = 1;
1024
1025         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1026         if (hwps)
1027                 macctl |= B43_MACCTL_HWPS;
1028         else
1029                 macctl &= ~B43_MACCTL_HWPS;
1030         if (awake)
1031                 macctl |= B43_MACCTL_AWAKE;
1032         else
1033                 macctl &= ~B43_MACCTL_AWAKE;
1034         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1035         /* Commit write */
1036         b43_read32(dev, B43_MMIO_MACCTL);
1037         if (awake && dev->dev->id.revision >= 5) {
1038                 /* Wait for the microcode to wake up. */
1039                 for (i = 0; i < 100; i++) {
1040                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1041                                                 B43_SHM_SH_UCODESTAT);
1042                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1043                                 break;
1044                         udelay(10);
1045                 }
1046         }
1047 }
1048
1049 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1050 {
1051         u32 tmslow;
1052         u32 macctl;
1053
1054         flags |= B43_TMSLOW_PHYCLKEN;
1055         flags |= B43_TMSLOW_PHYRESET;
1056         ssb_device_enable(dev->dev, flags);
1057         msleep(2);              /* Wait for the PLL to turn on. */
1058
1059         /* Now take the PHY out of Reset again */
1060         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1061         tmslow |= SSB_TMSLOW_FGC;
1062         tmslow &= ~B43_TMSLOW_PHYRESET;
1063         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1064         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1065         msleep(1);
1066         tmslow &= ~SSB_TMSLOW_FGC;
1067         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1068         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1069         msleep(1);
1070
1071         /* Turn Analog ON, but only if we already know the PHY-type.
1072          * This protects against very early setup where we don't know the
1073          * PHY-type, yet. wireless_core_reset will be called once again later,
1074          * when we know the PHY-type. */
1075         if (dev->phy.ops)
1076                 dev->phy.ops->switch_analog(dev, 1);
1077
1078         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1079         macctl &= ~B43_MACCTL_GMODE;
1080         if (flags & B43_TMSLOW_GMODE)
1081                 macctl |= B43_MACCTL_GMODE;
1082         macctl |= B43_MACCTL_IHR_ENABLED;
1083         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1084 }
1085
1086 static void handle_irq_transmit_status(struct b43_wldev *dev)
1087 {
1088         u32 v0, v1;
1089         u16 tmp;
1090         struct b43_txstatus stat;
1091
1092         while (1) {
1093                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1094                 if (!(v0 & 0x00000001))
1095                         break;
1096                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1097
1098                 stat.cookie = (v0 >> 16);
1099                 stat.seq = (v1 & 0x0000FFFF);
1100                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1101                 tmp = (v0 & 0x0000FFFF);
1102                 stat.frame_count = ((tmp & 0xF000) >> 12);
1103                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1104                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1105                 stat.pm_indicated = !!(tmp & 0x0080);
1106                 stat.intermediate = !!(tmp & 0x0040);
1107                 stat.for_ampdu = !!(tmp & 0x0020);
1108                 stat.acked = !!(tmp & 0x0002);
1109
1110                 b43_handle_txstatus(dev, &stat);
1111         }
1112 }
1113
1114 static void drain_txstatus_queue(struct b43_wldev *dev)
1115 {
1116         u32 dummy;
1117
1118         if (dev->dev->id.revision < 5)
1119                 return;
1120         /* Read all entries from the microcode TXstatus FIFO
1121          * and throw them away.
1122          */
1123         while (1) {
1124                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1125                 if (!(dummy & 0x00000001))
1126                         break;
1127                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1128         }
1129 }
1130
1131 static u32 b43_jssi_read(struct b43_wldev *dev)
1132 {
1133         u32 val = 0;
1134
1135         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1136         val <<= 16;
1137         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1138
1139         return val;
1140 }
1141
1142 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1143 {
1144         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1145         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1146 }
1147
1148 static void b43_generate_noise_sample(struct b43_wldev *dev)
1149 {
1150         b43_jssi_write(dev, 0x7F7F7F7F);
1151         b43_write32(dev, B43_MMIO_MACCMD,
1152                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1153 }
1154
1155 static void b43_calculate_link_quality(struct b43_wldev *dev)
1156 {
1157         /* Top half of Link Quality calculation. */
1158
1159         if (dev->phy.type != B43_PHYTYPE_G)
1160                 return;
1161         if (dev->noisecalc.calculation_running)
1162                 return;
1163         dev->noisecalc.calculation_running = 1;
1164         dev->noisecalc.nr_samples = 0;
1165
1166         b43_generate_noise_sample(dev);
1167 }
1168
1169 static void handle_irq_noise(struct b43_wldev *dev)
1170 {
1171         struct b43_phy_g *phy = dev->phy.g;
1172         u16 tmp;
1173         u8 noise[4];
1174         u8 i, j;
1175         s32 average;
1176
1177         /* Bottom half of Link Quality calculation. */
1178
1179         if (dev->phy.type != B43_PHYTYPE_G)
1180                 return;
1181
1182         /* Possible race condition: It might be possible that the user
1183          * changed to a different channel in the meantime since we
1184          * started the calculation. We ignore that fact, since it's
1185          * not really that much of a problem. The background noise is
1186          * an estimation only anyway. Slightly wrong results will get damped
1187          * by the averaging of the 8 sample rounds. Additionally the
1188          * value is shortlived. So it will be replaced by the next noise
1189          * calculation round soon. */
1190
1191         B43_WARN_ON(!dev->noisecalc.calculation_running);
1192         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1193         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1194             noise[2] == 0x7F || noise[3] == 0x7F)
1195                 goto generate_new;
1196
1197         /* Get the noise samples. */
1198         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1199         i = dev->noisecalc.nr_samples;
1200         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1201         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1202         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1203         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1204         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1205         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1206         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1207         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1208         dev->noisecalc.nr_samples++;
1209         if (dev->noisecalc.nr_samples == 8) {
1210                 /* Calculate the Link Quality by the noise samples. */
1211                 average = 0;
1212                 for (i = 0; i < 8; i++) {
1213                         for (j = 0; j < 4; j++)
1214                                 average += dev->noisecalc.samples[i][j];
1215                 }
1216                 average /= (8 * 4);
1217                 average *= 125;
1218                 average += 64;
1219                 average /= 128;
1220                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1221                 tmp = (tmp / 128) & 0x1F;
1222                 if (tmp >= 8)
1223                         average += 2;
1224                 else
1225                         average -= 25;
1226                 if (tmp == 8)
1227                         average -= 72;
1228                 else
1229                         average -= 48;
1230
1231                 dev->stats.link_noise = average;
1232                 dev->noisecalc.calculation_running = 0;
1233                 return;
1234         }
1235 generate_new:
1236         b43_generate_noise_sample(dev);
1237 }
1238
1239 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1240 {
1241         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1242                 ///TODO: PS TBTT
1243         } else {
1244                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1245                         b43_power_saving_ctl_bits(dev, 0);
1246         }
1247         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1248                 dev->dfq_valid = 1;
1249 }
1250
1251 static void handle_irq_atim_end(struct b43_wldev *dev)
1252 {
1253         if (dev->dfq_valid) {
1254                 b43_write32(dev, B43_MMIO_MACCMD,
1255                             b43_read32(dev, B43_MMIO_MACCMD)
1256                             | B43_MACCMD_DFQ_VALID);
1257                 dev->dfq_valid = 0;
1258         }
1259 }
1260
1261 static void handle_irq_pmq(struct b43_wldev *dev)
1262 {
1263         u32 tmp;
1264
1265         //TODO: AP mode.
1266
1267         while (1) {
1268                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1269                 if (!(tmp & 0x00000008))
1270                         break;
1271         }
1272         /* 16bit write is odd, but correct. */
1273         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1274 }
1275
1276 static void b43_write_template_common(struct b43_wldev *dev,
1277                                       const u8 * data, u16 size,
1278                                       u16 ram_offset,
1279                                       u16 shm_size_offset, u8 rate)
1280 {
1281         u32 i, tmp;
1282         struct b43_plcp_hdr4 plcp;
1283
1284         plcp.data = 0;
1285         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1286         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1287         ram_offset += sizeof(u32);
1288         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1289          * So leave the first two bytes of the next write blank.
1290          */
1291         tmp = (u32) (data[0]) << 16;
1292         tmp |= (u32) (data[1]) << 24;
1293         b43_ram_write(dev, ram_offset, tmp);
1294         ram_offset += sizeof(u32);
1295         for (i = 2; i < size; i += sizeof(u32)) {
1296                 tmp = (u32) (data[i + 0]);
1297                 if (i + 1 < size)
1298                         tmp |= (u32) (data[i + 1]) << 8;
1299                 if (i + 2 < size)
1300                         tmp |= (u32) (data[i + 2]) << 16;
1301                 if (i + 3 < size)
1302                         tmp |= (u32) (data[i + 3]) << 24;
1303                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1304         }
1305         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1306                         size + sizeof(struct b43_plcp_hdr6));
1307 }
1308
1309 /* Check if the use of the antenna that ieee80211 told us to
1310  * use is possible. This will fall back to DEFAULT.
1311  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1312 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1313                                   u8 antenna_nr)
1314 {
1315         u8 antenna_mask;
1316
1317         if (antenna_nr == 0) {
1318                 /* Zero means "use default antenna". That's always OK. */
1319                 return 0;
1320         }
1321
1322         /* Get the mask of available antennas. */
1323         if (dev->phy.gmode)
1324                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1325         else
1326                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1327
1328         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1329                 /* This antenna is not available. Fall back to default. */
1330                 return 0;
1331         }
1332
1333         return antenna_nr;
1334 }
1335
1336 /* Convert a b43 antenna number value to the PHY TX control value. */
1337 static u16 b43_antenna_to_phyctl(int antenna)
1338 {
1339         switch (antenna) {
1340         case B43_ANTENNA0:
1341                 return B43_TXH_PHY_ANT0;
1342         case B43_ANTENNA1:
1343                 return B43_TXH_PHY_ANT1;
1344         case B43_ANTENNA2:
1345                 return B43_TXH_PHY_ANT2;
1346         case B43_ANTENNA3:
1347                 return B43_TXH_PHY_ANT3;
1348         case B43_ANTENNA_AUTO:
1349                 return B43_TXH_PHY_ANT01AUTO;
1350         }
1351         B43_WARN_ON(1);
1352         return 0;
1353 }
1354
1355 static void b43_write_beacon_template(struct b43_wldev *dev,
1356                                       u16 ram_offset,
1357                                       u16 shm_size_offset)
1358 {
1359         unsigned int i, len, variable_len;
1360         const struct ieee80211_mgmt *bcn;
1361         const u8 *ie;
1362         bool tim_found = 0;
1363         unsigned int rate;
1364         u16 ctl;
1365         int antenna;
1366         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1367
1368         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1369         len = min((size_t) dev->wl->current_beacon->len,
1370                   0x200 - sizeof(struct b43_plcp_hdr6));
1371         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1372
1373         b43_write_template_common(dev, (const u8 *)bcn,
1374                                   len, ram_offset, shm_size_offset, rate);
1375
1376         /* Write the PHY TX control parameters. */
1377         antenna = B43_ANTENNA_DEFAULT;
1378         antenna = b43_antenna_to_phyctl(antenna);
1379         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1380         /* We can't send beacons with short preamble. Would get PHY errors. */
1381         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1382         ctl &= ~B43_TXH_PHY_ANT;
1383         ctl &= ~B43_TXH_PHY_ENC;
1384         ctl |= antenna;
1385         if (b43_is_cck_rate(rate))
1386                 ctl |= B43_TXH_PHY_ENC_CCK;
1387         else
1388                 ctl |= B43_TXH_PHY_ENC_OFDM;
1389         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1390
1391         /* Find the position of the TIM and the DTIM_period value
1392          * and write them to SHM. */
1393         ie = bcn->u.beacon.variable;
1394         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1395         for (i = 0; i < variable_len - 2; ) {
1396                 uint8_t ie_id, ie_len;
1397
1398                 ie_id = ie[i];
1399                 ie_len = ie[i + 1];
1400                 if (ie_id == 5) {
1401                         u16 tim_position;
1402                         u16 dtim_period;
1403                         /* This is the TIM Information Element */
1404
1405                         /* Check whether the ie_len is in the beacon data range. */
1406                         if (variable_len < ie_len + 2 + i)
1407                                 break;
1408                         /* A valid TIM is at least 4 bytes long. */
1409                         if (ie_len < 4)
1410                                 break;
1411                         tim_found = 1;
1412
1413                         tim_position = sizeof(struct b43_plcp_hdr6);
1414                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1415                         tim_position += i;
1416
1417                         dtim_period = ie[i + 3];
1418
1419                         b43_shm_write16(dev, B43_SHM_SHARED,
1420                                         B43_SHM_SH_TIMBPOS, tim_position);
1421                         b43_shm_write16(dev, B43_SHM_SHARED,
1422                                         B43_SHM_SH_DTIMPER, dtim_period);
1423                         break;
1424                 }
1425                 i += ie_len + 2;
1426         }
1427         if (!tim_found) {
1428                 /*
1429                  * If ucode wants to modify TIM do it behind the beacon, this
1430                  * will happen, for example, when doing mesh networking.
1431                  */
1432                 b43_shm_write16(dev, B43_SHM_SHARED,
1433                                 B43_SHM_SH_TIMBPOS,
1434                                 len + sizeof(struct b43_plcp_hdr6));
1435                 b43_shm_write16(dev, B43_SHM_SHARED,
1436                                 B43_SHM_SH_DTIMPER, 0);
1437         }
1438         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1439 }
1440
1441 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1442                                       u16 shm_offset, u16 size,
1443                                       struct ieee80211_rate *rate)
1444 {
1445         struct b43_plcp_hdr4 plcp;
1446         u32 tmp;
1447         __le16 dur;
1448
1449         plcp.data = 0;
1450         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1451         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1452                                                dev->wl->vif, size,
1453                                                rate);
1454         /* Write PLCP in two parts and timing for packet transfer */
1455         tmp = le32_to_cpu(plcp.data);
1456         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1457         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1458         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1459 }
1460
1461 /* Instead of using custom probe response template, this function
1462  * just patches custom beacon template by:
1463  * 1) Changing packet type
1464  * 2) Patching duration field
1465  * 3) Stripping TIM
1466  */
1467 static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1468                                           u16 *dest_size,
1469                                           struct ieee80211_rate *rate)
1470 {
1471         const u8 *src_data;
1472         u8 *dest_data;
1473         u16 src_size, elem_size, src_pos, dest_pos;
1474         __le16 dur;
1475         struct ieee80211_hdr *hdr;
1476         size_t ie_start;
1477
1478         src_size = dev->wl->current_beacon->len;
1479         src_data = (const u8 *)dev->wl->current_beacon->data;
1480
1481         /* Get the start offset of the variable IEs in the packet. */
1482         ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1483         B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1484
1485         if (B43_WARN_ON(src_size < ie_start))
1486                 return NULL;
1487
1488         dest_data = kmalloc(src_size, GFP_ATOMIC);
1489         if (unlikely(!dest_data))
1490                 return NULL;
1491
1492         /* Copy the static data and all Information Elements, except the TIM. */
1493         memcpy(dest_data, src_data, ie_start);
1494         src_pos = ie_start;
1495         dest_pos = ie_start;
1496         for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1497                 elem_size = src_data[src_pos + 1] + 2;
1498                 if (src_data[src_pos] == 5) {
1499                         /* This is the TIM. */
1500                         continue;
1501                 }
1502                 memcpy(dest_data + dest_pos, src_data + src_pos,
1503                        elem_size);
1504                 dest_pos += elem_size;
1505         }
1506         *dest_size = dest_pos;
1507         hdr = (struct ieee80211_hdr *)dest_data;
1508
1509         /* Set the frame control. */
1510         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1511                                          IEEE80211_STYPE_PROBE_RESP);
1512         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1513                                                dev->wl->vif, *dest_size,
1514                                                rate);
1515         hdr->duration_id = dur;
1516
1517         return dest_data;
1518 }
1519
1520 static void b43_write_probe_resp_template(struct b43_wldev *dev,
1521                                           u16 ram_offset,
1522                                           u16 shm_size_offset,
1523                                           struct ieee80211_rate *rate)
1524 {
1525         const u8 *probe_resp_data;
1526         u16 size;
1527
1528         size = dev->wl->current_beacon->len;
1529         probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1530         if (unlikely(!probe_resp_data))
1531                 return;
1532
1533         /* Looks like PLCP headers plus packet timings are stored for
1534          * all possible basic rates
1535          */
1536         b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1537         b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1538         b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1539         b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1540
1541         size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1542         b43_write_template_common(dev, probe_resp_data,
1543                                   size, ram_offset, shm_size_offset,
1544                                   rate->hw_value);
1545         kfree(probe_resp_data);
1546 }
1547
1548 static void b43_upload_beacon0(struct b43_wldev *dev)
1549 {
1550         struct b43_wl *wl = dev->wl;
1551
1552         if (wl->beacon0_uploaded)
1553                 return;
1554         b43_write_beacon_template(dev, 0x68, 0x18);
1555         /* FIXME: Probe resp upload doesn't really belong here,
1556          *        but we don't use that feature anyway. */
1557         b43_write_probe_resp_template(dev, 0x268, 0x4A,
1558                                       &__b43_ratetable[3]);
1559         wl->beacon0_uploaded = 1;
1560 }
1561
1562 static void b43_upload_beacon1(struct b43_wldev *dev)
1563 {
1564         struct b43_wl *wl = dev->wl;
1565
1566         if (wl->beacon1_uploaded)
1567                 return;
1568         b43_write_beacon_template(dev, 0x468, 0x1A);
1569         wl->beacon1_uploaded = 1;
1570 }
1571
1572 static void handle_irq_beacon(struct b43_wldev *dev)
1573 {
1574         struct b43_wl *wl = dev->wl;
1575         u32 cmd, beacon0_valid, beacon1_valid;
1576
1577         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1578             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1579                 return;
1580
1581         /* This is the bottom half of the asynchronous beacon update. */
1582
1583         /* Ignore interrupt in the future. */
1584         dev->irq_savedstate &= ~B43_IRQ_BEACON;
1585
1586         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1587         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1588         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1589
1590         /* Schedule interrupt manually, if busy. */
1591         if (beacon0_valid && beacon1_valid) {
1592                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1593                 dev->irq_savedstate |= B43_IRQ_BEACON;
1594                 return;
1595         }
1596
1597         if (unlikely(wl->beacon_templates_virgin)) {
1598                 /* We never uploaded a beacon before.
1599                  * Upload both templates now, but only mark one valid. */
1600                 wl->beacon_templates_virgin = 0;
1601                 b43_upload_beacon0(dev);
1602                 b43_upload_beacon1(dev);
1603                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1604                 cmd |= B43_MACCMD_BEACON0_VALID;
1605                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1606         } else {
1607                 if (!beacon0_valid) {
1608                         b43_upload_beacon0(dev);
1609                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1610                         cmd |= B43_MACCMD_BEACON0_VALID;
1611                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1612                 } else if (!beacon1_valid) {
1613                         b43_upload_beacon1(dev);
1614                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1615                         cmd |= B43_MACCMD_BEACON1_VALID;
1616                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1617                 }
1618         }
1619 }
1620
1621 static void b43_beacon_update_trigger_work(struct work_struct *work)
1622 {
1623         struct b43_wl *wl = container_of(work, struct b43_wl,
1624                                          beacon_update_trigger);
1625         struct b43_wldev *dev;
1626
1627         mutex_lock(&wl->mutex);
1628         dev = wl->current_dev;
1629         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1630                 spin_lock_irq(&wl->irq_lock);
1631                 /* update beacon right away or defer to irq */
1632                 dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1633                 handle_irq_beacon(dev);
1634                 /* The handler might have updated the IRQ mask. */
1635                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1636                             dev->irq_savedstate);
1637                 mmiowb();
1638                 spin_unlock_irq(&wl->irq_lock);
1639         }
1640         mutex_unlock(&wl->mutex);
1641 }
1642
1643 /* Asynchronously update the packet templates in template RAM.
1644  * Locking: Requires wl->irq_lock to be locked. */
1645 static void b43_update_templates(struct b43_wl *wl)
1646 {
1647         struct sk_buff *beacon;
1648
1649         /* This is the top half of the ansynchronous beacon update.
1650          * The bottom half is the beacon IRQ.
1651          * Beacon update must be asynchronous to avoid sending an
1652          * invalid beacon. This can happen for example, if the firmware
1653          * transmits a beacon while we are updating it. */
1654
1655         /* We could modify the existing beacon and set the aid bit in
1656          * the TIM field, but that would probably require resizing and
1657          * moving of data within the beacon template.
1658          * Simply request a new beacon and let mac80211 do the hard work. */
1659         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1660         if (unlikely(!beacon))
1661                 return;
1662
1663         if (wl->current_beacon)
1664                 dev_kfree_skb_any(wl->current_beacon);
1665         wl->current_beacon = beacon;
1666         wl->beacon0_uploaded = 0;
1667         wl->beacon1_uploaded = 0;
1668         queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1669 }
1670
1671 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1672 {
1673         b43_time_lock(dev);
1674         if (dev->dev->id.revision >= 3) {
1675                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1676                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1677         } else {
1678                 b43_write16(dev, 0x606, (beacon_int >> 6));
1679                 b43_write16(dev, 0x610, beacon_int);
1680         }
1681         b43_time_unlock(dev);
1682         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1683 }
1684
1685 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1686 {
1687         u16 reason;
1688
1689         /* Read the register that contains the reason code for the panic. */
1690         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1691         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1692
1693         switch (reason) {
1694         default:
1695                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1696                 /* fallthrough */
1697         case B43_FWPANIC_DIE:
1698                 /* Do not restart the controller or firmware.
1699                  * The device is nonfunctional from now on.
1700                  * Restarting would result in this panic to trigger again,
1701                  * so we avoid that recursion. */
1702                 break;
1703         case B43_FWPANIC_RESTART:
1704                 b43_controller_restart(dev, "Microcode panic");
1705                 break;
1706         }
1707 }
1708
1709 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1710 {
1711         unsigned int i, cnt;
1712         u16 reason, marker_id, marker_line;
1713         __le16 *buf;
1714
1715         /* The proprietary firmware doesn't have this IRQ. */
1716         if (!dev->fw.opensource)
1717                 return;
1718
1719         /* Read the register that contains the reason code for this IRQ. */
1720         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1721
1722         switch (reason) {
1723         case B43_DEBUGIRQ_PANIC:
1724                 b43_handle_firmware_panic(dev);
1725                 break;
1726         case B43_DEBUGIRQ_DUMP_SHM:
1727                 if (!B43_DEBUG)
1728                         break; /* Only with driver debugging enabled. */
1729                 buf = kmalloc(4096, GFP_ATOMIC);
1730                 if (!buf) {
1731                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1732                         goto out;
1733                 }
1734                 for (i = 0; i < 4096; i += 2) {
1735                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1736                         buf[i / 2] = cpu_to_le16(tmp);
1737                 }
1738                 b43info(dev->wl, "Shared memory dump:\n");
1739                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1740                                16, 2, buf, 4096, 1);
1741                 kfree(buf);
1742                 break;
1743         case B43_DEBUGIRQ_DUMP_REGS:
1744                 if (!B43_DEBUG)
1745                         break; /* Only with driver debugging enabled. */
1746                 b43info(dev->wl, "Microcode register dump:\n");
1747                 for (i = 0, cnt = 0; i < 64; i++) {
1748                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1749                         if (cnt == 0)
1750                                 printk(KERN_INFO);
1751                         printk("r%02u: 0x%04X  ", i, tmp);
1752                         cnt++;
1753                         if (cnt == 6) {
1754                                 printk("\n");
1755                                 cnt = 0;
1756                         }
1757                 }
1758                 printk("\n");
1759                 break;
1760         case B43_DEBUGIRQ_MARKER:
1761                 if (!B43_DEBUG)
1762                         break; /* Only with driver debugging enabled. */
1763                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1764                                            B43_MARKER_ID_REG);
1765                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1766                                              B43_MARKER_LINE_REG);
1767                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1768                         "at line number %u\n",
1769                         marker_id, marker_line);
1770                 break;
1771         default:
1772                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1773                        reason);
1774         }
1775 out:
1776         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1777         b43_shm_write16(dev, B43_SHM_SCRATCH,
1778                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1779 }
1780
1781 /* Interrupt handler bottom-half */
1782 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1783 {
1784         u32 reason;
1785         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1786         u32 merged_dma_reason = 0;
1787         int i;
1788         unsigned long flags;
1789
1790         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1791
1792         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1793
1794         reason = dev->irq_reason;
1795         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1796                 dma_reason[i] = dev->dma_reason[i];
1797                 merged_dma_reason |= dma_reason[i];
1798         }
1799
1800         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1801                 b43err(dev->wl, "MAC transmission error\n");
1802
1803         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1804                 b43err(dev->wl, "PHY transmission error\n");
1805                 rmb();
1806                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1807                         atomic_set(&dev->phy.txerr_cnt,
1808                                    B43_PHY_TX_BADNESS_LIMIT);
1809                         b43err(dev->wl, "Too many PHY TX errors, "
1810                                         "restarting the controller\n");
1811                         b43_controller_restart(dev, "PHY TX errors");
1812                 }
1813         }
1814
1815         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1816                                           B43_DMAIRQ_NONFATALMASK))) {
1817                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1818                         b43err(dev->wl, "Fatal DMA error: "
1819                                "0x%08X, 0x%08X, 0x%08X, "
1820                                "0x%08X, 0x%08X, 0x%08X\n",
1821                                dma_reason[0], dma_reason[1],
1822                                dma_reason[2], dma_reason[3],
1823                                dma_reason[4], dma_reason[5]);
1824                         b43_controller_restart(dev, "DMA error");
1825                         mmiowb();
1826                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1827                         return;
1828                 }
1829                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1830                         b43err(dev->wl, "DMA error: "
1831                                "0x%08X, 0x%08X, 0x%08X, "
1832                                "0x%08X, 0x%08X, 0x%08X\n",
1833                                dma_reason[0], dma_reason[1],
1834                                dma_reason[2], dma_reason[3],
1835                                dma_reason[4], dma_reason[5]);
1836                 }
1837         }
1838
1839         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1840                 handle_irq_ucode_debug(dev);
1841         if (reason & B43_IRQ_TBTT_INDI)
1842                 handle_irq_tbtt_indication(dev);
1843         if (reason & B43_IRQ_ATIM_END)
1844                 handle_irq_atim_end(dev);
1845         if (reason & B43_IRQ_BEACON)
1846                 handle_irq_beacon(dev);
1847         if (reason & B43_IRQ_PMQ)
1848                 handle_irq_pmq(dev);
1849         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1850                 ;/* TODO */
1851         if (reason & B43_IRQ_NOISESAMPLE_OK)
1852                 handle_irq_noise(dev);
1853
1854         /* Check the DMA reason registers for received data. */
1855         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1856                 if (b43_using_pio_transfers(dev))
1857                         b43_pio_rx(dev->pio.rx_queue);
1858                 else
1859                         b43_dma_rx(dev->dma.rx_ring);
1860         }
1861         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1862         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1863         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1864         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1865         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1866
1867         if (reason & B43_IRQ_TX_OK)
1868                 handle_irq_transmit_status(dev);
1869
1870         b43_interrupt_enable(dev, dev->irq_savedstate);
1871         mmiowb();
1872         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1873 }
1874
1875 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1876 {
1877         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1878
1879         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1880         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1881         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1882         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1883         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1884         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1885 }
1886
1887 /* Interrupt handler top-half */
1888 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1889 {
1890         irqreturn_t ret = IRQ_NONE;
1891         struct b43_wldev *dev = dev_id;
1892         u32 reason;
1893
1894         if (!dev)
1895                 return IRQ_NONE;
1896
1897         spin_lock(&dev->wl->irq_lock);
1898
1899         if (b43_status(dev) < B43_STAT_STARTED)
1900                 goto out;
1901         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1902         if (reason == 0xffffffff)       /* shared IRQ */
1903                 goto out;
1904         ret = IRQ_HANDLED;
1905         reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1906         if (!reason)
1907                 goto out;
1908
1909         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1910             & 0x0001DC00;
1911         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1912             & 0x0000DC00;
1913         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1914             & 0x0000DC00;
1915         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1916             & 0x0001DC00;
1917         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1918             & 0x0000DC00;
1919         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1920             & 0x0000DC00;
1921
1922         b43_interrupt_ack(dev, reason);
1923         /* disable all IRQs. They are enabled again in the bottom half. */
1924         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1925         /* save the reason code and call our bottom half. */
1926         dev->irq_reason = reason;
1927         tasklet_schedule(&dev->isr_tasklet);
1928       out:
1929         mmiowb();
1930         spin_unlock(&dev->wl->irq_lock);
1931
1932         return ret;
1933 }
1934
1935 static void do_release_fw(struct b43_firmware_file *fw)
1936 {
1937         release_firmware(fw->data);
1938         fw->data = NULL;
1939         fw->filename = NULL;
1940 }
1941
1942 static void b43_release_firmware(struct b43_wldev *dev)
1943 {
1944         do_release_fw(&dev->fw.ucode);
1945         do_release_fw(&dev->fw.pcm);
1946         do_release_fw(&dev->fw.initvals);
1947         do_release_fw(&dev->fw.initvals_band);
1948 }
1949
1950 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1951 {
1952         const char *text;
1953
1954         text = "You must go to "
1955                "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1956                "and download the latest firmware (version 4).\n";
1957         if (error)
1958                 b43err(wl, text);
1959         else
1960                 b43warn(wl, text);
1961 }
1962
1963 static int do_request_fw(struct b43_wldev *dev,
1964                          const char *name,
1965                          struct b43_firmware_file *fw,
1966                          bool silent)
1967 {
1968         char path[sizeof(modparam_fwpostfix) + 32];
1969         const struct firmware *blob;
1970         struct b43_fw_header *hdr;
1971         u32 size;
1972         int err;
1973
1974         if (!name) {
1975                 /* Don't fetch anything. Free possibly cached firmware. */
1976                 do_release_fw(fw);
1977                 return 0;
1978         }
1979         if (fw->filename) {
1980                 if (strcmp(fw->filename, name) == 0)
1981                         return 0; /* Already have this fw. */
1982                 /* Free the cached firmware first. */
1983                 do_release_fw(fw);
1984         }
1985
1986         snprintf(path, ARRAY_SIZE(path),
1987                  "b43%s/%s.fw",
1988                  modparam_fwpostfix, name);
1989         err = request_firmware(&blob, path, dev->dev->dev);
1990         if (err == -ENOENT) {
1991                 if (!silent) {
1992                         b43err(dev->wl, "Firmware file \"%s\" not found\n",
1993                                path);
1994                 }
1995                 return err;
1996         } else if (err) {
1997                 b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
1998                        path, err);
1999                 return err;
2000         }
2001         if (blob->size < sizeof(struct b43_fw_header))
2002                 goto err_format;
2003         hdr = (struct b43_fw_header *)(blob->data);
2004         switch (hdr->type) {
2005         case B43_FW_TYPE_UCODE:
2006         case B43_FW_TYPE_PCM:
2007                 size = be32_to_cpu(hdr->size);
2008                 if (size != blob->size - sizeof(struct b43_fw_header))
2009                         goto err_format;
2010                 /* fallthrough */
2011         case B43_FW_TYPE_IV:
2012                 if (hdr->ver != 1)
2013                         goto err_format;
2014                 break;
2015         default:
2016                 goto err_format;
2017         }
2018
2019         fw->data = blob;
2020         fw->filename = name;
2021
2022         return 0;
2023
2024 err_format:
2025         b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2026         release_firmware(blob);
2027
2028         return -EPROTO;
2029 }
2030
2031 static int b43_request_firmware(struct b43_wldev *dev)
2032 {
2033         struct b43_firmware *fw = &dev->fw;
2034         const u8 rev = dev->dev->id.revision;
2035         const char *filename;
2036         u32 tmshigh;
2037         int err;
2038
2039         /* Get microcode */
2040         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2041         if ((rev >= 5) && (rev <= 10))
2042                 filename = "ucode5";
2043         else if ((rev >= 11) && (rev <= 12))
2044                 filename = "ucode11";
2045         else if (rev >= 13)
2046                 filename = "ucode13";
2047         else
2048                 goto err_no_ucode;
2049         err = do_request_fw(dev, filename, &fw->ucode, 0);
2050         if (err)
2051                 goto err_load;
2052
2053         /* Get PCM code */
2054         if ((rev >= 5) && (rev <= 10))
2055                 filename = "pcm5";
2056         else if (rev >= 11)
2057                 filename = NULL;
2058         else
2059                 goto err_no_pcm;
2060         fw->pcm_request_failed = 0;
2061         err = do_request_fw(dev, filename, &fw->pcm, 1);
2062         if (err == -ENOENT) {
2063                 /* We did not find a PCM file? Not fatal, but
2064                  * core rev <= 10 must do without hwcrypto then. */
2065                 fw->pcm_request_failed = 1;
2066         } else if (err)
2067                 goto err_load;
2068
2069         /* Get initvals */
2070         switch (dev->phy.type) {
2071         case B43_PHYTYPE_A:
2072                 if ((rev >= 5) && (rev <= 10)) {
2073                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2074                                 filename = "a0g1initvals5";
2075                         else
2076                                 filename = "a0g0initvals5";
2077                 } else
2078                         goto err_no_initvals;
2079                 break;
2080         case B43_PHYTYPE_G:
2081                 if ((rev >= 5) && (rev <= 10))
2082                         filename = "b0g0initvals5";
2083                 else if (rev >= 13)
2084                         filename = "b0g0initvals13";
2085                 else
2086                         goto err_no_initvals;
2087                 break;
2088         case B43_PHYTYPE_N:
2089                 if ((rev >= 11) && (rev <= 12))
2090                         filename = "n0initvals11";
2091                 else
2092                         goto err_no_initvals;
2093                 break;
2094         default:
2095                 goto err_no_initvals;
2096         }
2097         err = do_request_fw(dev, filename, &fw->initvals, 0);
2098         if (err)
2099                 goto err_load;
2100
2101         /* Get bandswitch initvals */
2102         switch (dev->phy.type) {
2103         case B43_PHYTYPE_A:
2104                 if ((rev >= 5) && (rev <= 10)) {
2105                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2106                                 filename = "a0g1bsinitvals5";
2107                         else
2108                                 filename = "a0g0bsinitvals5";
2109                 } else if (rev >= 11)
2110                         filename = NULL;
2111                 else
2112                         goto err_no_initvals;
2113                 break;
2114         case B43_PHYTYPE_G:
2115                 if ((rev >= 5) && (rev <= 10))
2116                         filename = "b0g0bsinitvals5";
2117                 else if (rev >= 11)
2118                         filename = NULL;
2119                 else
2120                         goto err_no_initvals;
2121                 break;
2122         case B43_PHYTYPE_N:
2123                 if ((rev >= 11) && (rev <= 12))
2124                         filename = "n0bsinitvals11";
2125                 else
2126                         goto err_no_initvals;
2127                 break;
2128         default:
2129                 goto err_no_initvals;
2130         }
2131         err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2132         if (err)
2133                 goto err_load;
2134
2135         return 0;
2136
2137 err_load:
2138         b43_print_fw_helptext(dev->wl, 1);
2139         goto error;
2140
2141 err_no_ucode:
2142         err = -ENODEV;
2143         b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2144         goto error;
2145
2146 err_no_pcm:
2147         err = -ENODEV;
2148         b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2149         goto error;
2150
2151 err_no_initvals:
2152         err = -ENODEV;
2153         b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2154                "core rev %u\n", dev->phy.type, rev);
2155         goto error;
2156
2157 error:
2158         b43_release_firmware(dev);
2159         return err;
2160 }
2161
2162 static int b43_upload_microcode(struct b43_wldev *dev)
2163 {
2164         const size_t hdr_len = sizeof(struct b43_fw_header);
2165         const __be32 *data;
2166         unsigned int i, len;
2167         u16 fwrev, fwpatch, fwdate, fwtime;
2168         u32 tmp, macctl;
2169         int err = 0;
2170
2171         /* Jump the microcode PSM to offset 0 */
2172         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2173         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2174         macctl |= B43_MACCTL_PSM_JMP0;
2175         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2176         /* Zero out all microcode PSM registers and shared memory. */
2177         for (i = 0; i < 64; i++)
2178                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2179         for (i = 0; i < 4096; i += 2)
2180                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2181
2182         /* Upload Microcode. */
2183         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2184         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2185         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2186         for (i = 0; i < len; i++) {
2187                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2188                 udelay(10);
2189         }
2190
2191         if (dev->fw.pcm.data) {
2192                 /* Upload PCM data. */
2193                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2194                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2195                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2196                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2197                 /* No need for autoinc bit in SHM_HW */
2198                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2199                 for (i = 0; i < len; i++) {
2200                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2201                         udelay(10);
2202                 }
2203         }
2204
2205         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2206
2207         /* Start the microcode PSM */
2208         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2209         macctl &= ~B43_MACCTL_PSM_JMP0;
2210         macctl |= B43_MACCTL_PSM_RUN;
2211         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2212
2213         /* Wait for the microcode to load and respond */
2214         i = 0;
2215         while (1) {
2216                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2217                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2218                         break;
2219                 i++;
2220                 if (i >= 20) {
2221                         b43err(dev->wl, "Microcode not responding\n");
2222                         b43_print_fw_helptext(dev->wl, 1);
2223                         err = -ENODEV;
2224                         goto error;
2225                 }
2226                 msleep_interruptible(50);
2227                 if (signal_pending(current)) {
2228                         err = -EINTR;
2229                         goto error;
2230                 }
2231         }
2232         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2233
2234         /* Get and check the revisions. */
2235         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2236         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2237         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2238         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2239
2240         if (fwrev <= 0x128) {
2241                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2242                        "binary drivers older than version 4.x is unsupported. "
2243                        "You must upgrade your firmware files.\n");
2244                 b43_print_fw_helptext(dev->wl, 1);
2245                 err = -EOPNOTSUPP;
2246                 goto error;
2247         }
2248         dev->fw.rev = fwrev;
2249         dev->fw.patch = fwpatch;
2250         dev->fw.opensource = (fwdate == 0xFFFF);
2251
2252         if (dev->fw.opensource) {
2253                 /* Patchlevel info is encoded in the "time" field. */
2254                 dev->fw.patch = fwtime;
2255                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2256                         dev->fw.rev, dev->fw.patch,
2257                         dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2258         } else {
2259                 b43info(dev->wl, "Loading firmware version %u.%u "
2260                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2261                         fwrev, fwpatch,
2262                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2263                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2264                 if (dev->fw.pcm_request_failed) {
2265                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2266                                 "Hardware accelerated cryptography is disabled.\n");
2267                         b43_print_fw_helptext(dev->wl, 0);
2268                 }
2269         }
2270
2271         if (b43_is_old_txhdr_format(dev)) {
2272                 b43warn(dev->wl, "You are using an old firmware image. "
2273                         "Support for old firmware will be removed in July 2008.\n");
2274                 b43_print_fw_helptext(dev->wl, 0);
2275         }
2276
2277         return 0;
2278
2279 error:
2280         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2281         macctl &= ~B43_MACCTL_PSM_RUN;
2282         macctl |= B43_MACCTL_PSM_JMP0;
2283         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2284
2285         return err;
2286 }
2287
2288 static int b43_write_initvals(struct b43_wldev *dev,
2289                               const struct b43_iv *ivals,
2290                               size_t count,
2291                               size_t array_size)
2292 {
2293         const struct b43_iv *iv;
2294         u16 offset;
2295         size_t i;
2296         bool bit32;
2297
2298         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2299         iv = ivals;
2300         for (i = 0; i < count; i++) {
2301                 if (array_size < sizeof(iv->offset_size))
2302                         goto err_format;
2303                 array_size -= sizeof(iv->offset_size);
2304                 offset = be16_to_cpu(iv->offset_size);
2305                 bit32 = !!(offset & B43_IV_32BIT);
2306                 offset &= B43_IV_OFFSET_MASK;
2307                 if (offset >= 0x1000)
2308                         goto err_format;
2309                 if (bit32) {
2310                         u32 value;
2311
2312                         if (array_size < sizeof(iv->data.d32))
2313                                 goto err_format;
2314                         array_size -= sizeof(iv->data.d32);
2315
2316                         value = get_unaligned_be32(&iv->data.d32);
2317                         b43_write32(dev, offset, value);
2318
2319                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2320                                                         sizeof(__be16) +
2321                                                         sizeof(__be32));
2322                 } else {
2323                         u16 value;
2324
2325                         if (array_size < sizeof(iv->data.d16))
2326                                 goto err_format;
2327                         array_size -= sizeof(iv->data.d16);
2328
2329                         value = be16_to_cpu(iv->data.d16);
2330                         b43_write16(dev, offset, value);
2331
2332                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2333                                                         sizeof(__be16) +
2334                                                         sizeof(__be16));
2335                 }
2336         }
2337         if (array_size)
2338                 goto err_format;
2339
2340         return 0;
2341
2342 err_format:
2343         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2344         b43_print_fw_helptext(dev->wl, 1);
2345
2346         return -EPROTO;
2347 }
2348
2349 static int b43_upload_initvals(struct b43_wldev *dev)
2350 {
2351         const size_t hdr_len = sizeof(struct b43_fw_header);
2352         const struct b43_fw_header *hdr;
2353         struct b43_firmware *fw = &dev->fw;
2354         const struct b43_iv *ivals;
2355         size_t count;
2356         int err;
2357
2358         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2359         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2360         count = be32_to_cpu(hdr->size);
2361         err = b43_write_initvals(dev, ivals, count,
2362                                  fw->initvals.data->size - hdr_len);
2363         if (err)
2364                 goto out;
2365         if (fw->initvals_band.data) {
2366                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2367                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2368                 count = be32_to_cpu(hdr->size);
2369                 err = b43_write_initvals(dev, ivals, count,
2370                                          fw->initvals_band.data->size - hdr_len);
2371                 if (err)
2372                         goto out;
2373         }
2374 out:
2375
2376         return err;
2377 }
2378
2379 /* Initialize the GPIOs
2380  * http://bcm-specs.sipsolutions.net/GPIO
2381  */
2382 static int b43_gpio_init(struct b43_wldev *dev)
2383 {
2384         struct ssb_bus *bus = dev->dev->bus;
2385         struct ssb_device *gpiodev, *pcidev = NULL;
2386         u32 mask, set;
2387
2388         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2389                     & ~B43_MACCTL_GPOUTSMSK);
2390
2391         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2392                     | 0x000F);
2393
2394         mask = 0x0000001F;
2395         set = 0x0000000F;
2396         if (dev->dev->bus->chip_id == 0x4301) {
2397                 mask |= 0x0060;
2398                 set |= 0x0060;
2399         }
2400         if (0 /* FIXME: conditional unknown */ ) {
2401                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2402                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2403                             | 0x0100);
2404                 mask |= 0x0180;
2405                 set |= 0x0180;
2406         }
2407         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2408                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2409                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2410                             | 0x0200);
2411                 mask |= 0x0200;
2412                 set |= 0x0200;
2413         }
2414         if (dev->dev->id.revision >= 2)
2415                 mask |= 0x0010; /* FIXME: This is redundant. */
2416
2417 #ifdef CONFIG_SSB_DRIVER_PCICORE
2418         pcidev = bus->pcicore.dev;
2419 #endif
2420         gpiodev = bus->chipco.dev ? : pcidev;
2421         if (!gpiodev)
2422                 return 0;
2423         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2424                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2425                      & mask) | set);
2426
2427         return 0;
2428 }
2429
2430 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2431 static void b43_gpio_cleanup(struct b43_wldev *dev)
2432 {
2433         struct ssb_bus *bus = dev->dev->bus;
2434         struct ssb_device *gpiodev, *pcidev = NULL;
2435
2436 #ifdef CONFIG_SSB_DRIVER_PCICORE
2437         pcidev = bus->pcicore.dev;
2438 #endif
2439         gpiodev = bus->chipco.dev ? : pcidev;
2440         if (!gpiodev)
2441                 return;
2442         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2443 }
2444
2445 /* http://bcm-specs.sipsolutions.net/EnableMac */
2446 void b43_mac_enable(struct b43_wldev *dev)
2447 {
2448         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2449                 u16 fwstate;
2450
2451                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2452                                          B43_SHM_SH_UCODESTAT);
2453                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2454                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2455                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2456                                "should be suspended, but current state is %u\n",
2457                                fwstate);
2458                 }
2459         }
2460
2461         dev->mac_suspended--;
2462         B43_WARN_ON(dev->mac_suspended < 0);
2463         if (dev->mac_suspended == 0) {
2464                 b43_write32(dev, B43_MMIO_MACCTL,
2465                             b43_read32(dev, B43_MMIO_MACCTL)
2466                             | B43_MACCTL_ENABLED);
2467                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2468                             B43_IRQ_MAC_SUSPENDED);
2469                 /* Commit writes */
2470                 b43_read32(dev, B43_MMIO_MACCTL);
2471                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2472                 b43_power_saving_ctl_bits(dev, 0);
2473         }
2474 }
2475
2476 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2477 void b43_mac_suspend(struct b43_wldev *dev)
2478 {
2479         int i;
2480         u32 tmp;
2481
2482         might_sleep();
2483         B43_WARN_ON(dev->mac_suspended < 0);
2484
2485         if (dev->mac_suspended == 0) {
2486                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2487                 b43_write32(dev, B43_MMIO_MACCTL,
2488                             b43_read32(dev, B43_MMIO_MACCTL)
2489                             & ~B43_MACCTL_ENABLED);
2490                 /* force pci to flush the write */
2491                 b43_read32(dev, B43_MMIO_MACCTL);
2492                 for (i = 35; i; i--) {
2493                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2494                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2495                                 goto out;
2496                         udelay(10);
2497                 }
2498                 /* Hm, it seems this will take some time. Use msleep(). */
2499                 for (i = 40; i; i--) {
2500                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2501                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2502                                 goto out;
2503                         msleep(1);
2504                 }
2505                 b43err(dev->wl, "MAC suspend failed\n");
2506         }
2507 out:
2508         dev->mac_suspended++;
2509 }
2510
2511 static void b43_adjust_opmode(struct b43_wldev *dev)
2512 {
2513         struct b43_wl *wl = dev->wl;
2514         u32 ctl;
2515         u16 cfp_pretbtt;
2516
2517         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2518         /* Reset status to STA infrastructure mode. */
2519         ctl &= ~B43_MACCTL_AP;
2520         ctl &= ~B43_MACCTL_KEEP_CTL;
2521         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2522         ctl &= ~B43_MACCTL_KEEP_BAD;
2523         ctl &= ~B43_MACCTL_PROMISC;
2524         ctl &= ~B43_MACCTL_BEACPROMISC;
2525         ctl |= B43_MACCTL_INFRA;
2526
2527         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2528             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2529                 ctl |= B43_MACCTL_AP;
2530         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2531                 ctl &= ~B43_MACCTL_INFRA;
2532
2533         if (wl->filter_flags & FIF_CONTROL)
2534                 ctl |= B43_MACCTL_KEEP_CTL;
2535         if (wl->filter_flags & FIF_FCSFAIL)
2536                 ctl |= B43_MACCTL_KEEP_BAD;
2537         if (wl->filter_flags & FIF_PLCPFAIL)
2538                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2539         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2540                 ctl |= B43_MACCTL_PROMISC;
2541         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2542                 ctl |= B43_MACCTL_BEACPROMISC;
2543
2544         /* Workaround: On old hardware the HW-MAC-address-filter
2545          * doesn't work properly, so always run promisc in filter
2546          * it in software. */
2547         if (dev->dev->id.revision <= 4)
2548                 ctl |= B43_MACCTL_PROMISC;
2549
2550         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2551
2552         cfp_pretbtt = 2;
2553         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2554                 if (dev->dev->bus->chip_id == 0x4306 &&
2555                     dev->dev->bus->chip_rev == 3)
2556                         cfp_pretbtt = 100;
2557                 else
2558                         cfp_pretbtt = 50;
2559         }
2560         b43_write16(dev, 0x612, cfp_pretbtt);
2561 }
2562
2563 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2564 {
2565         u16 offset;
2566
2567         if (is_ofdm) {
2568                 offset = 0x480;
2569                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2570         } else {
2571                 offset = 0x4C0;
2572                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2573         }
2574         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2575                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2576 }
2577
2578 static void b43_rate_memory_init(struct b43_wldev *dev)
2579 {
2580         switch (dev->phy.type) {
2581         case B43_PHYTYPE_A:
2582         case B43_PHYTYPE_G:
2583         case B43_PHYTYPE_N:
2584                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2585                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2586                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2587                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2588                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2589                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2590                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2591                 if (dev->phy.type == B43_PHYTYPE_A)
2592                         break;
2593                 /* fallthrough */
2594         case B43_PHYTYPE_B:
2595                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2596                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2597                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2598                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2599                 break;
2600         default:
2601                 B43_WARN_ON(1);
2602         }
2603 }
2604
2605 /* Set the default values for the PHY TX Control Words. */
2606 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2607 {
2608         u16 ctl = 0;
2609
2610         ctl |= B43_TXH_PHY_ENC_CCK;
2611         ctl |= B43_TXH_PHY_ANT01AUTO;
2612         ctl |= B43_TXH_PHY_TXPWR;
2613
2614         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2615         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2616         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2617 }
2618
2619 /* Set the TX-Antenna for management frames sent by firmware. */
2620 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2621 {
2622         u16 ant;
2623         u16 tmp;
2624
2625         ant = b43_antenna_to_phyctl(antenna);
2626
2627         /* For ACK/CTS */
2628         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2629         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2630         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2631         /* For Probe Resposes */
2632         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2633         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2634         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2635 }
2636
2637 /* This is the opposite of b43_chip_init() */
2638 static void b43_chip_exit(struct b43_wldev *dev)
2639 {
2640         b43_phy_exit(dev);
2641         b43_gpio_cleanup(dev);
2642         /* firmware is released later */
2643 }
2644
2645 /* Initialize the chip
2646  * http://bcm-specs.sipsolutions.net/ChipInit
2647  */
2648 static int b43_chip_init(struct b43_wldev *dev)
2649 {
2650         struct b43_phy *phy = &dev->phy;
2651         int err;
2652         u32 value32, macctl;
2653         u16 value16;
2654
2655         /* Initialize the MAC control */
2656         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2657         if (dev->phy.gmode)
2658                 macctl |= B43_MACCTL_GMODE;
2659         macctl |= B43_MACCTL_INFRA;
2660         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2661
2662         err = b43_request_firmware(dev);
2663         if (err)
2664                 goto out;
2665         err = b43_upload_microcode(dev);
2666         if (err)
2667                 goto out;       /* firmware is released later */
2668
2669         err = b43_gpio_init(dev);
2670         if (err)
2671                 goto out;       /* firmware is released later */
2672
2673         err = b43_upload_initvals(dev);
2674         if (err)
2675                 goto err_gpio_clean;
2676
2677         /* Turn the Analog on and initialize the PHY. */
2678         phy->ops->switch_analog(dev, 1);
2679         err = b43_phy_init(dev);
2680         if (err)
2681                 goto err_gpio_clean;
2682
2683         /* Disable Interference Mitigation. */
2684         if (phy->ops->interf_mitigation)
2685                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2686
2687         /* Select the antennae */
2688         if (phy->ops->set_rx_antenna)
2689                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2690         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2691
2692         if (phy->type == B43_PHYTYPE_B) {
2693                 value16 = b43_read16(dev, 0x005E);
2694                 value16 |= 0x0004;
2695                 b43_write16(dev, 0x005E, value16);
2696         }
2697         b43_write32(dev, 0x0100, 0x01000000);
2698         if (dev->dev->id.revision < 5)
2699                 b43_write32(dev, 0x010C, 0x01000000);
2700
2701         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2702                     & ~B43_MACCTL_INFRA);
2703         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2704                     | B43_MACCTL_INFRA);
2705
2706         /* Probe Response Timeout value */
2707         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2708         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2709
2710         /* Initially set the wireless operation mode. */
2711         b43_adjust_opmode(dev);
2712
2713         if (dev->dev->id.revision < 3) {
2714                 b43_write16(dev, 0x060E, 0x0000);
2715                 b43_write16(dev, 0x0610, 0x8000);
2716                 b43_write16(dev, 0x0604, 0x0000);
2717                 b43_write16(dev, 0x0606, 0x0200);
2718         } else {
2719                 b43_write32(dev, 0x0188, 0x80000000);
2720                 b43_write32(dev, 0x018C, 0x02000000);
2721         }
2722         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2723         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2724         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2725         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2726         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2727         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2728         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2729
2730         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2731         value32 |= 0x00100000;
2732         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2733
2734         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2735                     dev->dev->bus->chipco.fast_pwrup_delay);
2736
2737         err = 0;
2738         b43dbg(dev->wl, "Chip initialized\n");
2739 out:
2740         return err;
2741
2742 err_gpio_clean:
2743         b43_gpio_cleanup(dev);
2744         return err;
2745 }
2746
2747 static void b43_periodic_every60sec(struct b43_wldev *dev)
2748 {
2749         const struct b43_phy_operations *ops = dev->phy.ops;
2750
2751         if (ops->pwork_60sec)
2752                 ops->pwork_60sec(dev);
2753
2754         /* Force check the TX power emission now. */
2755         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2756 }
2757
2758 static void b43_periodic_every30sec(struct b43_wldev *dev)
2759 {
2760         /* Update device statistics. */
2761         b43_calculate_link_quality(dev);
2762 }
2763
2764 static void b43_periodic_every15sec(struct b43_wldev *dev)
2765 {
2766         struct b43_phy *phy = &dev->phy;
2767         u16 wdr;
2768
2769         if (dev->fw.opensource) {
2770                 /* Check if the firmware is still alive.
2771                  * It will reset the watchdog counter to 0 in its idle loop. */
2772                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2773                 if (unlikely(wdr)) {
2774                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2775                         b43_controller_restart(dev, "Firmware watchdog");
2776                         return;
2777                 } else {
2778                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2779                                         B43_WATCHDOG_REG, 1);
2780                 }
2781         }
2782
2783         if (phy->ops->pwork_15sec)
2784                 phy->ops->pwork_15sec(dev);
2785
2786         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2787         wmb();
2788 }
2789
2790 static void do_periodic_work(struct b43_wldev *dev)
2791 {
2792         unsigned int state;
2793
2794         state = dev->periodic_state;
2795         if (state % 4 == 0)
2796                 b43_periodic_every60sec(dev);
2797         if (state % 2 == 0)
2798                 b43_periodic_every30sec(dev);
2799         b43_periodic_every15sec(dev);
2800 }
2801
2802 /* Periodic work locking policy:
2803  *      The whole periodic work handler is protected by
2804  *      wl->mutex. If another lock is needed somewhere in the
2805  *      pwork callchain, it's aquired in-place, where it's needed.
2806  */
2807 static void b43_periodic_work_handler(struct work_struct *work)
2808 {
2809         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2810                                              periodic_work.work);
2811         struct b43_wl *wl = dev->wl;
2812         unsigned long delay;
2813
2814         mutex_lock(&wl->mutex);
2815
2816         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2817                 goto out;
2818         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2819                 goto out_requeue;
2820
2821         do_periodic_work(dev);
2822
2823         dev->periodic_state++;
2824 out_requeue:
2825         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2826                 delay = msecs_to_jiffies(50);
2827         else
2828                 delay = round_jiffies_relative(HZ * 15);
2829         queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2830 out:
2831         mutex_unlock(&wl->mutex);
2832 }
2833
2834 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2835 {
2836         struct delayed_work *work = &dev->periodic_work;
2837
2838         dev->periodic_state = 0;
2839         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2840         queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2841 }
2842
2843 /* Check if communication with the device works correctly. */
2844 static int b43_validate_chipaccess(struct b43_wldev *dev)
2845 {
2846         u32 v, backup;
2847
2848         backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2849
2850         /* Check for read/write and endianness problems. */
2851         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2852         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2853                 goto error;
2854         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2855         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2856                 goto error;
2857
2858         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2859
2860         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2861                 /* The 32bit register shadows the two 16bit registers
2862                  * with update sideeffects. Validate this. */
2863                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2864                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2865                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2866                         goto error;
2867                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2868                         goto error;
2869         }
2870         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2871
2872         v = b43_read32(dev, B43_MMIO_MACCTL);
2873         v |= B43_MACCTL_GMODE;
2874         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2875                 goto error;
2876
2877         return 0;
2878 error:
2879         b43err(dev->wl, "Failed to validate the chipaccess\n");
2880         return -ENODEV;
2881 }
2882
2883 static void b43_security_init(struct b43_wldev *dev)
2884 {
2885         dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2886         B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2887         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2888         /* KTP is a word address, but we address SHM bytewise.
2889          * So multiply by two.
2890          */
2891         dev->ktp *= 2;
2892         if (dev->dev->id.revision >= 5) {
2893                 /* Number of RCMTA address slots */
2894                 b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2895         }
2896         b43_clear_keys(dev);
2897 }
2898
2899 static int b43_rng_read(struct hwrng *rng, u32 * data)
2900 {
2901         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2902         unsigned long flags;
2903
2904         /* Don't take wl->mutex here, as it could deadlock with
2905          * hwrng internal locking. It's not needed to take
2906          * wl->mutex here, anyway. */
2907
2908         spin_lock_irqsave(&wl->irq_lock, flags);
2909         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2910         spin_unlock_irqrestore(&wl->irq_lock, flags);
2911
2912         return (sizeof(u16));
2913 }
2914
2915 static void b43_rng_exit(struct b43_wl *wl)
2916 {
2917         if (wl->rng_initialized)
2918                 hwrng_unregister(&wl->rng);
2919 }
2920
2921 static int b43_rng_init(struct b43_wl *wl)
2922 {
2923         int err;
2924
2925         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2926                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2927         wl->rng.name = wl->rng_name;
2928         wl->rng.data_read = b43_rng_read;
2929         wl->rng.priv = (unsigned long)wl;
2930         wl->rng_initialized = 1;
2931         err = hwrng_register(&wl->rng);
2932         if (err) {
2933                 wl->rng_initialized = 0;
2934                 b43err(wl, "Failed to register the random "
2935                        "number generator (%d)\n", err);
2936         }
2937
2938         return err;
2939 }
2940
2941 static int b43_op_tx(struct ieee80211_hw *hw,
2942                      struct sk_buff *skb)
2943 {
2944         struct b43_wl *wl = hw_to_b43_wl(hw);
2945         struct b43_wldev *dev = wl->current_dev;
2946         unsigned long flags;
2947         int err;
2948
2949         if (unlikely(skb->len < 2 + 2 + 6)) {
2950                 /* Too short, this can't be a valid frame. */
2951                 goto drop_packet;
2952         }
2953         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2954         if (unlikely(!dev))
2955                 goto drop_packet;
2956
2957         /* Transmissions on seperate queues can run concurrently. */
2958         read_lock_irqsave(&wl->tx_lock, flags);
2959
2960         err = -ENODEV;
2961         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2962                 if (b43_using_pio_transfers(dev))
2963                         err = b43_pio_tx(dev, skb);
2964                 else
2965                         err = b43_dma_tx(dev, skb);
2966         }
2967
2968         read_unlock_irqrestore(&wl->tx_lock, flags);
2969
2970         if (unlikely(err))
2971                 goto drop_packet;
2972         return NETDEV_TX_OK;
2973
2974 drop_packet:
2975         /* We can not transmit this packet. Drop it. */
2976         dev_kfree_skb_any(skb);
2977         return NETDEV_TX_OK;
2978 }
2979
2980 /* Locking: wl->irq_lock */
2981 static void b43_qos_params_upload(struct b43_wldev *dev,
2982                                   const struct ieee80211_tx_queue_params *p,
2983                                   u16 shm_offset)
2984 {
2985         u16 params[B43_NR_QOSPARAMS];
2986         int bslots, tmp;
2987         unsigned int i;
2988
2989         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
2990
2991         memset(&params, 0, sizeof(params));
2992
2993         params[B43_QOSPARAM_TXOP] = p->txop * 32;
2994         params[B43_QOSPARAM_CWMIN] = p->cw_min;
2995         params[B43_QOSPARAM_CWMAX] = p->cw_max;
2996         params[B43_QOSPARAM_CWCUR] = p->cw_min;
2997         params[B43_QOSPARAM_AIFS] = p->aifs;
2998         params[B43_QOSPARAM_BSLOTS] = bslots;
2999         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3000
3001         for (i = 0; i < ARRAY_SIZE(params); i++) {
3002                 if (i == B43_QOSPARAM_STATUS) {
3003                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3004                                              shm_offset + (i * 2));
3005                         /* Mark the parameters as updated. */
3006                         tmp |= 0x100;
3007                         b43_shm_write16(dev, B43_SHM_SHARED,
3008                                         shm_offset + (i * 2),
3009                                         tmp);
3010                 } else {
3011                         b43_shm_write16(dev, B43_SHM_SHARED,
3012                                         shm_offset + (i * 2),
3013                                         params[i]);
3014                 }
3015         }
3016 }
3017
3018 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3019 static const u16 b43_qos_shm_offsets[] = {
3020         /* [mac80211-queue-nr] = SHM_OFFSET, */
3021         [0] = B43_QOS_VOICE,
3022         [1] = B43_QOS_VIDEO,
3023         [2] = B43_QOS_BESTEFFORT,
3024         [3] = B43_QOS_BACKGROUND,
3025 };
3026
3027 /* Update all QOS parameters in hardware. */
3028 static void b43_qos_upload_all(struct b43_wldev *dev)
3029 {
3030         struct b43_wl *wl = dev->wl;
3031         struct b43_qos_params *params;
3032         unsigned int i;
3033
3034         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3035                      ARRAY_SIZE(wl->qos_params));
3036
3037         b43_mac_suspend(dev);
3038         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3039                 params = &(wl->qos_params[i]);
3040                 b43_qos_params_upload(dev, &(params->p),
3041                                       b43_qos_shm_offsets[i]);
3042         }
3043         b43_mac_enable(dev);
3044 }
3045
3046 static void b43_qos_clear(struct b43_wl *wl)
3047 {
3048         struct b43_qos_params *params;
3049         unsigned int i;
3050
3051         /* Initialize QoS parameters to sane defaults. */
3052
3053         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3054                      ARRAY_SIZE(wl->qos_params));
3055
3056         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3057                 params = &(wl->qos_params[i]);
3058
3059                 switch (b43_qos_shm_offsets[i]) {
3060                 case B43_QOS_VOICE:
3061                         params->p.txop = 0;
3062                         params->p.aifs = 2;
3063                         params->p.cw_min = 0x0001;
3064                         params->p.cw_max = 0x0001;
3065                         break;
3066                 case B43_QOS_VIDEO:
3067                         params->p.txop = 0;
3068                         params->p.aifs = 2;
3069                         params->p.cw_min = 0x0001;
3070                         params->p.cw_max = 0x0001;
3071                         break;
3072                 case B43_QOS_BESTEFFORT:
3073                         params->p.txop = 0;
3074                         params->p.aifs = 3;
3075                         params->p.cw_min = 0x0001;
3076                         params->p.cw_max = 0x03FF;
3077                         break;
3078                 case B43_QOS_BACKGROUND:
3079                         params->p.txop = 0;
3080                         params->p.aifs = 7;
3081                         params->p.cw_min = 0x0001;
3082                         params->p.cw_max = 0x03FF;
3083                         break;
3084                 default:
3085                         B43_WARN_ON(1);
3086                 }
3087         }
3088 }
3089
3090 /* Initialize the core's QOS capabilities */
3091 static void b43_qos_init(struct b43_wldev *dev)
3092 {
3093         /* Upload the current QOS parameters. */
3094         b43_qos_upload_all(dev);
3095
3096         /* Enable QOS support. */
3097         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3098         b43_write16(dev, B43_MMIO_IFSCTL,
3099                     b43_read16(dev, B43_MMIO_IFSCTL)
3100                     | B43_MMIO_IFSCTL_USE_EDCF);
3101 }
3102
3103 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3104                           const struct ieee80211_tx_queue_params *params)
3105 {
3106         struct b43_wl *wl = hw_to_b43_wl(hw);
3107         struct b43_wldev *dev;
3108         unsigned int queue = (unsigned int)_queue;
3109         int err = -ENODEV;
3110
3111         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3112                 /* Queue not available or don't support setting
3113                  * params on this queue. Return success to not
3114                  * confuse mac80211. */
3115                 return 0;
3116         }
3117         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3118                      ARRAY_SIZE(wl->qos_params));
3119
3120         mutex_lock(&wl->mutex);
3121         dev = wl->current_dev;
3122         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3123                 goto out_unlock;
3124
3125         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3126         b43_mac_suspend(dev);
3127         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3128                               b43_qos_shm_offsets[queue]);
3129         b43_mac_enable(dev);
3130         err = 0;
3131
3132 out_unlock:
3133         mutex_unlock(&wl->mutex);
3134
3135         return err;
3136 }
3137
3138 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3139                                struct ieee80211_tx_queue_stats *stats)
3140 {
3141         struct b43_wl *wl = hw_to_b43_wl(hw);
3142         struct b43_wldev *dev = wl->current_dev;
3143         unsigned long flags;
3144         int err = -ENODEV;
3145
3146         if (!dev)
3147                 goto out;
3148         spin_lock_irqsave(&wl->irq_lock, flags);
3149         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3150                 if (b43_using_pio_transfers(dev))
3151                         b43_pio_get_tx_stats(dev, stats);
3152                 else
3153                         b43_dma_get_tx_stats(dev, stats);
3154                 err = 0;
3155         }
3156         spin_unlock_irqrestore(&wl->irq_lock, flags);
3157 out:
3158         return err;
3159 }
3160
3161 static int b43_op_get_stats(struct ieee80211_hw *hw,
3162                             struct ieee80211_low_level_stats *stats)
3163 {
3164         struct b43_wl *wl = hw_to_b43_wl(hw);
3165         unsigned long flags;
3166
3167         spin_lock_irqsave(&wl->irq_lock, flags);
3168         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3169         spin_unlock_irqrestore(&wl->irq_lock, flags);
3170
3171         return 0;
3172 }
3173
3174 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3175 {
3176         struct ssb_device *sdev = dev->dev;
3177         u32 tmslow;
3178
3179         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3180         tmslow &= ~B43_TMSLOW_GMODE;
3181         tmslow |= B43_TMSLOW_PHYRESET;
3182         tmslow |= SSB_TMSLOW_FGC;
3183         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3184         msleep(1);
3185
3186         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3187         tmslow &= ~SSB_TMSLOW_FGC;
3188         tmslow |= B43_TMSLOW_PHYRESET;
3189         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3190         msleep(1);
3191 }
3192
3193 static const char * band_to_string(enum ieee80211_band band)
3194 {
3195         switch (band) {
3196         case IEEE80211_BAND_5GHZ:
3197                 return "5";
3198         case IEEE80211_BAND_2GHZ:
3199                 return "2.4";
3200         default:
3201                 break;
3202         }
3203         B43_WARN_ON(1);
3204         return "";
3205 }
3206
3207 /* Expects wl->mutex locked */
3208 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3209 {
3210         struct b43_wldev *up_dev = NULL;
3211         struct b43_wldev *down_dev;
3212         struct b43_wldev *d;
3213         int err;
3214         bool uninitialized_var(gmode);
3215         int prev_status;
3216
3217         /* Find a device and PHY which supports the band. */
3218         list_for_each_entry(d, &wl->devlist, list) {
3219                 switch (chan->band) {
3220                 case IEEE80211_BAND_5GHZ:
3221                         if (d->phy.supports_5ghz) {
3222                                 up_dev = d;
3223                                 gmode = 0;
3224                         }
3225                         break;
3226                 case IEEE80211_BAND_2GHZ:
3227                         if (d->phy.supports_2ghz) {
3228                                 up_dev = d;
3229                                 gmode = 1;
3230                         }
3231                         break;
3232                 default:
3233                         B43_WARN_ON(1);
3234                         return -EINVAL;
3235                 }
3236                 if (up_dev)
3237                         break;
3238         }
3239         if (!up_dev) {
3240                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3241                        band_to_string(chan->band));
3242                 return -ENODEV;
3243         }
3244         if ((up_dev == wl->current_dev) &&
3245             (!!wl->current_dev->phy.gmode == !!gmode)) {
3246                 /* This device is already running. */
3247                 return 0;
3248         }
3249         b43dbg(wl, "Switching to %s-GHz band\n",
3250                band_to_string(chan->band));
3251         down_dev = wl->current_dev;
3252
3253         prev_status = b43_status(down_dev);
3254         /* Shutdown the currently running core. */
3255         if (prev_status >= B43_STAT_STARTED)
3256                 b43_wireless_core_stop(down_dev);
3257         if (prev_status >= B43_STAT_INITIALIZED)
3258                 b43_wireless_core_exit(down_dev);
3259
3260         if (down_dev != up_dev) {
3261                 /* We switch to a different core, so we put PHY into
3262                  * RESET on the old core. */
3263                 b43_put_phy_into_reset(down_dev);
3264         }
3265
3266         /* Now start the new core. */
3267         up_dev->phy.gmode = gmode;
3268         if (prev_status >= B43_STAT_INITIALIZED) {
3269                 err = b43_wireless_core_init(up_dev);
3270                 if (err) {
3271                         b43err(wl, "Fatal: Could not initialize device for "
3272                                "selected %s-GHz band\n",
3273                                band_to_string(chan->band));
3274                         goto init_failure;
3275                 }
3276         }
3277         if (prev_status >= B43_STAT_STARTED) {
3278                 err = b43_wireless_core_start(up_dev);
3279                 if (err) {
3280                         b43err(wl, "Fatal: Coult not start device for "
3281                                "selected %s-GHz band\n",
3282                                band_to_string(chan->band));
3283                         b43_wireless_core_exit(up_dev);
3284                         goto init_failure;
3285                 }
3286         }
3287         B43_WARN_ON(b43_status(up_dev) != prev_status);
3288
3289         wl->current_dev = up_dev;
3290
3291         return 0;
3292 init_failure:
3293         /* Whoops, failed to init the new core. No core is operating now. */
3294         wl->current_dev = NULL;
3295         return err;
3296 }
3297
3298 /* Write the short and long frame retry limit values. */
3299 static void b43_set_retry_limits(struct b43_wldev *dev,
3300                                  unsigned int short_retry,
3301                                  unsigned int long_retry)
3302 {
3303         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3304          * the chip-internal counter. */
3305         short_retry = min(short_retry, (unsigned int)0xF);
3306         long_retry = min(long_retry, (unsigned int)0xF);
3307
3308         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3309                         short_retry);
3310         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3311                         long_retry);
3312 }
3313
3314 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3315 {
3316         struct b43_wl *wl = hw_to_b43_wl(hw);
3317         struct b43_wldev *dev;
3318         struct b43_phy *phy;
3319         struct ieee80211_conf *conf = &hw->conf;
3320         unsigned long flags;
3321         int antenna;
3322         int err = 0;
3323
3324         mutex_lock(&wl->mutex);
3325
3326         /* Switch the band (if necessary). This might change the active core. */
3327         err = b43_switch_band(wl, conf->channel);
3328         if (err)
3329                 goto out_unlock_mutex;
3330         dev = wl->current_dev;
3331         phy = &dev->phy;
3332
3333         b43_mac_suspend(dev);
3334
3335         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3336                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3337                                           conf->long_frame_max_tx_count);
3338         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3339         if (!changed)
3340                 goto out_mac_enable;
3341
3342         /* Switch to the requested channel.
3343          * The firmware takes care of races with the TX handler. */
3344         if (conf->channel->hw_value != phy->channel)
3345                 b43_switch_channel(dev, conf->channel->hw_value);
3346
3347         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3348
3349         /* Adjust the desired TX power level. */
3350         if (conf->power_level != 0) {
3351                 spin_lock_irqsave(&wl->irq_lock, flags);
3352                 if (conf->power_level != phy->desired_txpower) {
3353                         phy->desired_txpower = conf->power_level;
3354                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3355                                                    B43_TXPWR_IGNORE_TSSI);
3356                 }
3357                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3358         }
3359
3360         /* Antennas for RX and management frame TX. */
3361         antenna = B43_ANTENNA_DEFAULT;
3362         b43_mgmtframe_txantenna(dev, antenna);
3363         antenna = B43_ANTENNA_DEFAULT;
3364         if (phy->ops->set_rx_antenna)
3365                 phy->ops->set_rx_antenna(dev, antenna);
3366
3367         /* Update templates for AP/mesh mode. */
3368         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3369             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3370                 b43_set_beacon_int(dev, conf->beacon_int);
3371
3372         if (!!conf->radio_enabled != phy->radio_on) {
3373                 if (conf->radio_enabled) {
3374                         b43_software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
3375                         b43info(dev->wl, "Radio turned on by software\n");
3376                         if (!dev->radio_hw_enable) {
3377                                 b43info(dev->wl, "The hardware RF-kill button "
3378                                         "still turns the radio physically off. "
3379                                         "Press the button to turn it on.\n");
3380                         }
3381                 } else {
3382                         b43_software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
3383                         b43info(dev->wl, "Radio turned off by software\n");
3384                 }
3385         }
3386
3387 out_mac_enable:
3388         b43_mac_enable(dev);
3389 out_unlock_mutex:
3390         mutex_unlock(&wl->mutex);
3391
3392         return err;
3393 }
3394
3395 static void b43_update_basic_rates(struct b43_wldev *dev, u64 brates)
3396 {
3397         struct ieee80211_supported_band *sband =
3398                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3399         struct ieee80211_rate *rate;
3400         int i;
3401         u16 basic, direct, offset, basic_offset, rateptr;
3402
3403         for (i = 0; i < sband->n_bitrates; i++) {
3404                 rate = &sband->bitrates[i];
3405
3406                 if (b43_is_cck_rate(rate->hw_value)) {
3407                         direct = B43_SHM_SH_CCKDIRECT;
3408                         basic = B43_SHM_SH_CCKBASIC;
3409                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3410                         offset &= 0xF;
3411                 } else {
3412                         direct = B43_SHM_SH_OFDMDIRECT;
3413                         basic = B43_SHM_SH_OFDMBASIC;
3414                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3415                         offset &= 0xF;
3416                 }
3417
3418                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3419
3420                 if (b43_is_cck_rate(rate->hw_value)) {
3421                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3422                         basic_offset &= 0xF;
3423                 } else {
3424                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3425                         basic_offset &= 0xF;
3426                 }
3427
3428                 /*
3429                  * Get the pointer that we need to point to
3430                  * from the direct map
3431                  */
3432                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3433                                          direct + 2 * basic_offset);
3434                 /* and write it to the basic map */
3435                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3436                                 rateptr);
3437         }
3438 }
3439
3440 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3441                                     struct ieee80211_vif *vif,
3442                                     struct ieee80211_bss_conf *conf,
3443                                     u32 changed)
3444 {
3445         struct b43_wl *wl = hw_to_b43_wl(hw);
3446         struct b43_wldev *dev;
3447
3448         mutex_lock(&wl->mutex);
3449
3450         dev = wl->current_dev;
3451         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3452                 goto out_unlock_mutex;
3453         b43_mac_suspend(dev);
3454
3455         if (changed & BSS_CHANGED_BASIC_RATES)
3456                 b43_update_basic_rates(dev, conf->basic_rates);
3457
3458         if (changed & BSS_CHANGED_ERP_SLOT) {
3459                 if (conf->use_short_slot)
3460                         b43_short_slot_timing_enable(dev);
3461                 else
3462                         b43_short_slot_timing_disable(dev);
3463         }
3464
3465         b43_mac_enable(dev);
3466 out_unlock_mutex:
3467         mutex_unlock(&wl->mutex);
3468
3469         return;
3470 }
3471
3472 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3473                            const u8 *local_addr, const u8 *addr,
3474                            struct ieee80211_key_conf *key)
3475 {
3476         struct b43_wl *wl = hw_to_b43_wl(hw);
3477         struct b43_wldev *dev;
3478         u8 algorithm;
3479         u8 index;
3480         int err;
3481
3482         if (modparam_nohwcrypt)
3483                 return -ENOSPC; /* User disabled HW-crypto */
3484
3485         mutex_lock(&wl->mutex);
3486         spin_lock_irq(&wl->irq_lock);
3487         write_lock(&wl->tx_lock);
3488         /* Why do we need all this locking here?
3489          * mutex     -> Every config operation must take it.
3490          * irq_lock  -> We modify the dev->key array, which is accessed
3491          *              in the IRQ handlers.
3492          * tx_lock   -> We modify the dev->key array, which is accessed
3493          *              in the TX handler.
3494          */
3495
3496         dev = wl->current_dev;
3497         err = -ENODEV;
3498         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3499                 goto out_unlock;
3500
3501         if (dev->fw.pcm_request_failed) {
3502                 /* We don't have firmware for the crypto engine.
3503                  * Must use software-crypto. */
3504                 err = -EOPNOTSUPP;
3505                 goto out_unlock;
3506         }
3507
3508         err = -EINVAL;
3509         switch (key->alg) {
3510         case ALG_WEP:
3511                 if (key->keylen == LEN_WEP40)
3512                         algorithm = B43_SEC_ALGO_WEP40;
3513                 else
3514                         algorithm = B43_SEC_ALGO_WEP104;
3515                 break;
3516         case ALG_TKIP:
3517                 algorithm = B43_SEC_ALGO_TKIP;
3518                 break;
3519         case ALG_CCMP:
3520                 algorithm = B43_SEC_ALGO_AES;
3521                 break;
3522         default:
3523                 B43_WARN_ON(1);
3524                 goto out_unlock;
3525         }
3526         index = (u8) (key->keyidx);
3527         if (index > 3)
3528                 goto out_unlock;
3529
3530         switch (cmd) {
3531         case SET_KEY:
3532                 if (algorithm == B43_SEC_ALGO_TKIP) {
3533                         /* FIXME: No TKIP hardware encryption for now. */
3534                         err = -EOPNOTSUPP;
3535                         goto out_unlock;
3536                 }
3537
3538                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3539                         /* Pairwise key with an assigned MAC address. */
3540                         err = b43_key_write(dev, -1, algorithm,
3541                                             key->key, key->keylen, addr, key);
3542                 } else {
3543                         /* Group key */
3544                         err = b43_key_write(dev, index, algorithm,
3545                                             key->key, key->keylen, NULL, key);
3546                 }
3547                 if (err)
3548                         goto out_unlock;
3549
3550                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3551                     algorithm == B43_SEC_ALGO_WEP104) {
3552                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3553                 } else {
3554                         b43_hf_write(dev,
3555                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3556                 }
3557                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3558                 break;
3559         case DISABLE_KEY: {
3560                 err = b43_key_clear(dev, key->hw_key_idx);
3561                 if (err)
3562                         goto out_unlock;
3563                 break;
3564         }
3565         default:
3566                 B43_WARN_ON(1);
3567         }
3568
3569 out_unlock:
3570         if (!err) {
3571                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3572                        "mac: %pM\n",
3573                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3574                        addr);
3575                 b43_dump_keymemory(dev);
3576         }
3577         write_unlock(&wl->tx_lock);
3578         spin_unlock_irq(&wl->irq_lock);
3579         mutex_unlock(&wl->mutex);
3580
3581         return err;
3582 }
3583
3584 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3585                                     unsigned int changed, unsigned int *fflags,
3586                                     int mc_count, struct dev_addr_list *mc_list)
3587 {
3588         struct b43_wl *wl = hw_to_b43_wl(hw);
3589         struct b43_wldev *dev = wl->current_dev;
3590         unsigned long flags;
3591
3592         if (!dev) {
3593                 *fflags = 0;
3594                 return;
3595         }
3596
3597         spin_lock_irqsave(&wl->irq_lock, flags);
3598         *fflags &= FIF_PROMISC_IN_BSS |
3599                   FIF_ALLMULTI |
3600                   FIF_FCSFAIL |
3601                   FIF_PLCPFAIL |
3602                   FIF_CONTROL |
3603                   FIF_OTHER_BSS |
3604                   FIF_BCN_PRBRESP_PROMISC;
3605
3606         changed &= FIF_PROMISC_IN_BSS |
3607                    FIF_ALLMULTI |
3608                    FIF_FCSFAIL |
3609                    FIF_PLCPFAIL |
3610                    FIF_CONTROL |
3611                    FIF_OTHER_BSS |
3612                    FIF_BCN_PRBRESP_PROMISC;
3613
3614         wl->filter_flags = *fflags;
3615
3616         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3617                 b43_adjust_opmode(dev);
3618         spin_unlock_irqrestore(&wl->irq_lock, flags);
3619 }
3620
3621 static int b43_op_config_interface(struct ieee80211_hw *hw,
3622                                    struct ieee80211_vif *vif,
3623                                    struct ieee80211_if_conf *conf)
3624 {
3625         struct b43_wl *wl = hw_to_b43_wl(hw);
3626         struct b43_wldev *dev = wl->current_dev;
3627         unsigned long flags;
3628
3629         if (!dev)
3630                 return -ENODEV;
3631         mutex_lock(&wl->mutex);
3632         spin_lock_irqsave(&wl->irq_lock, flags);
3633         B43_WARN_ON(wl->vif != vif);
3634         if (conf->bssid)
3635                 memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3636         else
3637                 memset(wl->bssid, 0, ETH_ALEN);
3638         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3639                 if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3640                     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT)) {
3641                         B43_WARN_ON(vif->type != wl->if_type);
3642                         if (conf->changed & IEEE80211_IFCC_BEACON)
3643                                 b43_update_templates(wl);
3644                 } else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
3645                         if (conf->changed & IEEE80211_IFCC_BEACON)
3646                                 b43_update_templates(wl);
3647                 }
3648                 b43_write_mac_bssid_templates(dev);
3649         }
3650         spin_unlock_irqrestore(&wl->irq_lock, flags);
3651         mutex_unlock(&wl->mutex);
3652
3653         return 0;
3654 }
3655
3656 /* Locking: wl->mutex */
3657 static void b43_wireless_core_stop(struct b43_wldev *dev)
3658 {
3659         struct b43_wl *wl = dev->wl;
3660         unsigned long flags;
3661
3662         if (b43_status(dev) < B43_STAT_STARTED)
3663                 return;
3664
3665         /* Disable and sync interrupts. We must do this before than
3666          * setting the status to INITIALIZED, as the interrupt handler
3667          * won't care about IRQs then. */
3668         spin_lock_irqsave(&wl->irq_lock, flags);
3669         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3670         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3671         spin_unlock_irqrestore(&wl->irq_lock, flags);
3672         b43_synchronize_irq(dev);
3673
3674         write_lock_irqsave(&wl->tx_lock, flags);
3675         b43_set_status(dev, B43_STAT_INITIALIZED);
3676         write_unlock_irqrestore(&wl->tx_lock, flags);
3677
3678         b43_pio_stop(dev);
3679         mutex_unlock(&wl->mutex);
3680         /* Must unlock as it would otherwise deadlock. No races here.
3681          * Cancel the possibly running self-rearming periodic work. */
3682         cancel_delayed_work_sync(&dev->periodic_work);
3683         mutex_lock(&wl->mutex);
3684
3685         b43_mac_suspend(dev);
3686         free_irq(dev->dev->irq, dev);
3687         b43dbg(wl, "Wireless interface stopped\n");
3688 }
3689
3690 /* Locking: wl->mutex */
3691 static int b43_wireless_core_start(struct b43_wldev *dev)
3692 {
3693         int err;
3694
3695         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3696
3697         drain_txstatus_queue(dev);
3698         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3699                           IRQF_SHARED, KBUILD_MODNAME, dev);
3700         if (err) {
3701                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3702                 goto out;
3703         }
3704
3705         /* We are ready to run. */
3706         b43_set_status(dev, B43_STAT_STARTED);
3707
3708         /* Start data flow (TX/RX). */
3709         b43_mac_enable(dev);
3710         b43_interrupt_enable(dev, dev->irq_savedstate);
3711
3712         /* Start maintainance work */
3713         b43_periodic_tasks_setup(dev);
3714
3715         b43dbg(dev->wl, "Wireless interface started\n");
3716       out:
3717         return err;
3718 }
3719
3720 /* Get PHY and RADIO versioning numbers */
3721 static int b43_phy_versioning(struct b43_wldev *dev)
3722 {
3723         struct b43_phy *phy = &dev->phy;
3724         u32 tmp;
3725         u8 analog_type;
3726         u8 phy_type;
3727         u8 phy_rev;
3728         u16 radio_manuf;
3729         u16 radio_ver;
3730         u16 radio_rev;
3731         int unsupported = 0;
3732
3733         /* Get PHY versioning */
3734         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3735         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3736         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3737         phy_rev = (tmp & B43_PHYVER_VERSION);
3738         switch (phy_type) {
3739         case B43_PHYTYPE_A:
3740                 if (phy_rev >= 4)
3741                         unsupported = 1;
3742                 break;
3743         case B43_PHYTYPE_B:
3744                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3745                     && phy_rev != 7)
3746                         unsupported = 1;
3747                 break;
3748         case B43_PHYTYPE_G:
3749                 if (phy_rev > 9)
3750                         unsupported = 1;
3751                 break;
3752 #ifdef CONFIG_B43_NPHY
3753         case B43_PHYTYPE_N:
3754                 if (phy_rev > 1)
3755                         unsupported = 1;
3756                 break;
3757 #endif
3758         default:
3759                 unsupported = 1;
3760         };
3761         if (unsupported) {
3762                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3763                        "(Analog %u, Type %u, Revision %u)\n",
3764                        analog_type, phy_type, phy_rev);
3765                 return -EOPNOTSUPP;
3766         }
3767         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3768                analog_type, phy_type, phy_rev);
3769
3770         /* Get RADIO versioning */
3771         if (dev->dev->bus->chip_id == 0x4317) {
3772                 if (dev->dev->bus->chip_rev == 0)
3773                         tmp = 0x3205017F;
3774                 else if (dev->dev->bus->chip_rev == 1)
3775                         tmp = 0x4205017F;
3776                 else
3777                         tmp = 0x5205017F;
3778         } else {
3779                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3780                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3781                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3782                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3783         }
3784         radio_manuf = (tmp & 0x00000FFF);
3785         radio_ver = (tmp & 0x0FFFF000) >> 12;
3786         radio_rev = (tmp & 0xF0000000) >> 28;
3787         if (radio_manuf != 0x17F /* Broadcom */)
3788                 unsupported = 1;
3789         switch (phy_type) {
3790         case B43_PHYTYPE_A:
3791                 if (radio_ver != 0x2060)
3792                         unsupported = 1;
3793                 if (radio_rev != 1)
3794                         unsupported = 1;
3795                 if (radio_manuf != 0x17F)
3796                         unsupported = 1;
3797                 break;
3798         case B43_PHYTYPE_B:
3799                 if ((radio_ver & 0xFFF0) != 0x2050)
3800                         unsupported = 1;
3801                 break;
3802         case B43_PHYTYPE_G:
3803                 if (radio_ver != 0x2050)
3804                         unsupported = 1;
3805                 break;
3806         case B43_PHYTYPE_N:
3807                 if (radio_ver != 0x2055)
3808                         unsupported = 1;
3809                 break;
3810         default:
3811                 B43_WARN_ON(1);
3812         }
3813         if (unsupported) {
3814                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3815                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3816                        radio_manuf, radio_ver, radio_rev);
3817                 return -EOPNOTSUPP;
3818         }
3819         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3820                radio_manuf, radio_ver, radio_rev);
3821
3822         phy->radio_manuf = radio_manuf;
3823         phy->radio_ver = radio_ver;
3824         phy->radio_rev = radio_rev;
3825
3826         phy->analog = analog_type;
3827         phy->type = phy_type;
3828         phy->rev = phy_rev;
3829
3830         return 0;
3831 }
3832
3833 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3834                                       struct b43_phy *phy)
3835 {
3836         phy->hardware_power_control = !!modparam_hwpctl;
3837         phy->next_txpwr_check_time = jiffies;
3838         /* PHY TX errors counter. */
3839         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3840 }
3841
3842 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3843 {
3844         dev->dfq_valid = 0;
3845
3846         /* Assume the radio is enabled. If it's not enabled, the state will
3847          * immediately get fixed on the first periodic work run. */
3848         dev->radio_hw_enable = 1;
3849
3850         /* Stats */
3851         memset(&dev->stats, 0, sizeof(dev->stats));
3852
3853         setup_struct_phy_for_init(dev, &dev->phy);
3854
3855         /* IRQ related flags */
3856         dev->irq_reason = 0;
3857         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3858         dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3859
3860         dev->mac_suspended = 1;
3861
3862         /* Noise calculation context */
3863         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3864 }
3865
3866 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3867 {
3868         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3869         u64 hf;
3870
3871         if (!modparam_btcoex)
3872                 return;
3873         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3874                 return;
3875         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3876                 return;
3877
3878         hf = b43_hf_read(dev);
3879         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3880                 hf |= B43_HF_BTCOEXALT;
3881         else
3882                 hf |= B43_HF_BTCOEX;
3883         b43_hf_write(dev, hf);
3884 }
3885
3886 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3887 {
3888         if (!modparam_btcoex)
3889                 return;
3890         //TODO
3891 }
3892
3893 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3894 {
3895 #ifdef CONFIG_SSB_DRIVER_PCICORE
3896         struct ssb_bus *bus = dev->dev->bus;
3897         u32 tmp;
3898
3899         if (bus->pcicore.dev &&
3900             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3901             bus->pcicore.dev->id.revision <= 5) {
3902                 /* IMCFGLO timeouts workaround. */
3903                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3904                 tmp &= ~SSB_IMCFGLO_REQTO;
3905                 tmp &= ~SSB_IMCFGLO_SERTO;
3906                 switch (bus->bustype) {
3907                 case SSB_BUSTYPE_PCI:
3908                 case SSB_BUSTYPE_PCMCIA:
3909                         tmp |= 0x32;
3910                         break;
3911                 case SSB_BUSTYPE_SSB:
3912                         tmp |= 0x53;
3913                         break;
3914                 }
3915                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3916         }
3917 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3918 }
3919
3920 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3921 {
3922         u16 pu_delay;
3923
3924         /* The time value is in microseconds. */
3925         if (dev->phy.type == B43_PHYTYPE_A)
3926                 pu_delay = 3700;
3927         else
3928                 pu_delay = 1050;
3929         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3930                 pu_delay = 500;
3931         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3932                 pu_delay = max(pu_delay, (u16)2400);
3933
3934         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3935 }
3936
3937 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3938 static void b43_set_pretbtt(struct b43_wldev *dev)
3939 {
3940         u16 pretbtt;
3941
3942         /* The time value is in microseconds. */
3943         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
3944                 pretbtt = 2;
3945         } else {
3946                 if (dev->phy.type == B43_PHYTYPE_A)
3947                         pretbtt = 120;
3948                 else
3949                         pretbtt = 250;
3950         }
3951         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3952         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3953 }
3954
3955 /* Shutdown a wireless core */
3956 /* Locking: wl->mutex */
3957 static void b43_wireless_core_exit(struct b43_wldev *dev)
3958 {
3959         u32 macctl;
3960
3961         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3962         if (b43_status(dev) != B43_STAT_INITIALIZED)
3963                 return;
3964         b43_set_status(dev, B43_STAT_UNINIT);
3965
3966         /* Stop the microcode PSM. */
3967         macctl = b43_read32(dev, B43_MMIO_MACCTL);
3968         macctl &= ~B43_MACCTL_PSM_RUN;
3969         macctl |= B43_MACCTL_PSM_JMP0;
3970         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3971
3972         if (!dev->suspend_in_progress) {
3973                 b43_leds_exit(dev);
3974                 b43_rng_exit(dev->wl);
3975         }
3976         b43_dma_free(dev);
3977         b43_pio_free(dev);
3978         b43_chip_exit(dev);
3979         dev->phy.ops->switch_analog(dev, 0);
3980         if (dev->wl->current_beacon) {
3981                 dev_kfree_skb_any(dev->wl->current_beacon);
3982                 dev->wl->current_beacon = NULL;
3983         }
3984
3985         ssb_device_disable(dev->dev, 0);
3986         ssb_bus_may_powerdown(dev->dev->bus);
3987 }
3988
3989 /* Initialize a wireless core */
3990 static int b43_wireless_core_init(struct b43_wldev *dev)
3991 {
3992         struct b43_wl *wl = dev->wl;
3993         struct ssb_bus *bus = dev->dev->bus;
3994         struct ssb_sprom *sprom = &bus->sprom;
3995         struct b43_phy *phy = &dev->phy;
3996         int err;
3997         u64 hf;
3998         u32 tmp;
3999
4000         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4001
4002         err = ssb_bus_powerup(bus, 0);
4003         if (err)
4004                 goto out;
4005         if (!ssb_device_is_enabled(dev->dev)) {
4006                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4007                 b43_wireless_core_reset(dev, tmp);
4008         }
4009
4010         /* Reset all data structures. */
4011         setup_struct_wldev_for_init(dev);
4012         phy->ops->prepare_structs(dev);
4013
4014         /* Enable IRQ routing to this device. */
4015         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4016
4017         b43_imcfglo_timeouts_workaround(dev);
4018         b43_bluetooth_coext_disable(dev);
4019         if (phy->ops->prepare_hardware) {
4020                 err = phy->ops->prepare_hardware(dev);
4021                 if (err)
4022                         goto err_busdown;
4023         }
4024         err = b43_chip_init(dev);
4025         if (err)
4026                 goto err_busdown;
4027         b43_shm_write16(dev, B43_SHM_SHARED,
4028                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4029         hf = b43_hf_read(dev);
4030         if (phy->type == B43_PHYTYPE_G) {
4031                 hf |= B43_HF_SYMW;
4032                 if (phy->rev == 1)
4033                         hf |= B43_HF_GDCW;
4034                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4035                         hf |= B43_HF_OFDMPABOOST;
4036         } else if (phy->type == B43_PHYTYPE_B) {
4037                 hf |= B43_HF_SYMW;
4038                 if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4039                         hf &= ~B43_HF_GDCW;
4040         }
4041         b43_hf_write(dev, hf);
4042
4043         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4044                              B43_DEFAULT_LONG_RETRY_LIMIT);
4045         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4046         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4047
4048         /* Disable sending probe responses from firmware.
4049          * Setting the MaxTime to one usec will always trigger
4050          * a timeout, so we never send any probe resp.
4051          * A timeout of zero is infinite. */
4052         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4053
4054         b43_rate_memory_init(dev);
4055         b43_set_phytxctl_defaults(dev);
4056
4057         /* Minimum Contention Window */
4058         if (phy->type == B43_PHYTYPE_B) {
4059                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4060         } else {
4061                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4062         }
4063         /* Maximum Contention Window */
4064         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4065
4066         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4067                 dev->__using_pio_transfers = 1;
4068                 err = b43_pio_init(dev);
4069         } else {
4070                 dev->__using_pio_transfers = 0;
4071                 err = b43_dma_init(dev);
4072         }
4073         if (err)
4074                 goto err_chip_exit;
4075         b43_qos_init(dev);
4076         b43_set_synth_pu_delay(dev, 1);
4077         b43_bluetooth_coext_enable(dev);
4078
4079         ssb_bus_powerup(bus, 1);        /* Enable dynamic PCTL */
4080         b43_upload_card_macaddress(dev);
4081         b43_security_init(dev);
4082         if (!dev->suspend_in_progress)
4083                 b43_rng_init(wl);
4084
4085         b43_set_status(dev, B43_STAT_INITIALIZED);
4086
4087         if (!dev->suspend_in_progress)
4088                 b43_leds_init(dev);
4089 out:
4090         return err;
4091
4092 err_chip_exit:
4093         b43_chip_exit(dev);
4094 err_busdown:
4095         ssb_bus_may_powerdown(bus);
4096         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4097         return err;
4098 }
4099
4100 static int b43_op_add_interface(struct ieee80211_hw *hw,
4101                                 struct ieee80211_if_init_conf *conf)
4102 {
4103         struct b43_wl *wl = hw_to_b43_wl(hw);
4104         struct b43_wldev *dev;
4105         unsigned long flags;
4106         int err = -EOPNOTSUPP;
4107
4108         /* TODO: allow WDS/AP devices to coexist */
4109
4110         if (conf->type != NL80211_IFTYPE_AP &&
4111             conf->type != NL80211_IFTYPE_MESH_POINT &&
4112             conf->type != NL80211_IFTYPE_STATION &&
4113             conf->type != NL80211_IFTYPE_WDS &&
4114             conf->type != NL80211_IFTYPE_ADHOC)
4115                 return -EOPNOTSUPP;
4116
4117         mutex_lock(&wl->mutex);
4118         if (wl->operating)
4119                 goto out_mutex_unlock;
4120
4121         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4122
4123         dev = wl->current_dev;
4124         wl->operating = 1;
4125         wl->vif = conf->vif;
4126         wl->if_type = conf->type;
4127         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4128
4129         spin_lock_irqsave(&wl->irq_lock, flags);
4130         b43_adjust_opmode(dev);
4131         b43_set_pretbtt(dev);
4132         b43_set_synth_pu_delay(dev, 0);
4133         b43_upload_card_macaddress(dev);
4134         spin_unlock_irqrestore(&wl->irq_lock, flags);
4135
4136         err = 0;
4137  out_mutex_unlock:
4138         mutex_unlock(&wl->mutex);
4139
4140         return err;
4141 }
4142
4143 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4144                                     struct ieee80211_if_init_conf *conf)
4145 {
4146         struct b43_wl *wl = hw_to_b43_wl(hw);
4147         struct b43_wldev *dev = wl->current_dev;
4148         unsigned long flags;
4149
4150         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4151
4152         mutex_lock(&wl->mutex);
4153
4154         B43_WARN_ON(!wl->operating);
4155         B43_WARN_ON(wl->vif != conf->vif);
4156         wl->vif = NULL;
4157
4158         wl->operating = 0;
4159
4160         spin_lock_irqsave(&wl->irq_lock, flags);
4161         b43_adjust_opmode(dev);
4162         memset(wl->mac_addr, 0, ETH_ALEN);
4163         b43_upload_card_macaddress(dev);
4164         spin_unlock_irqrestore(&wl->irq_lock, flags);
4165
4166         mutex_unlock(&wl->mutex);
4167 }
4168
4169 static int b43_op_start(struct ieee80211_hw *hw)
4170 {
4171         struct b43_wl *wl = hw_to_b43_wl(hw);
4172         struct b43_wldev *dev = wl->current_dev;
4173         int did_init = 0;
4174         int err = 0;
4175         bool do_rfkill_exit = 0;
4176
4177         /* Kill all old instance specific information to make sure
4178          * the card won't use it in the short timeframe between start
4179          * and mac80211 reconfiguring it. */
4180         memset(wl->bssid, 0, ETH_ALEN);
4181         memset(wl->mac_addr, 0, ETH_ALEN);
4182         wl->filter_flags = 0;
4183         wl->radiotap_enabled = 0;
4184         b43_qos_clear(wl);
4185         wl->beacon0_uploaded = 0;
4186         wl->beacon1_uploaded = 0;
4187         wl->beacon_templates_virgin = 1;
4188
4189         /* First register RFkill.
4190          * LEDs that are registered later depend on it. */
4191         b43_rfkill_init(dev);
4192
4193         mutex_lock(&wl->mutex);
4194
4195         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4196                 err = b43_wireless_core_init(dev);
4197                 if (err) {
4198                         do_rfkill_exit = 1;
4199                         goto out_mutex_unlock;
4200                 }
4201                 did_init = 1;
4202         }
4203
4204         if (b43_status(dev) < B43_STAT_STARTED) {
4205                 err = b43_wireless_core_start(dev);
4206                 if (err) {
4207                         if (did_init)
4208                                 b43_wireless_core_exit(dev);
4209                         do_rfkill_exit = 1;
4210                         goto out_mutex_unlock;
4211                 }
4212         }
4213
4214  out_mutex_unlock:
4215         mutex_unlock(&wl->mutex);
4216
4217         if (do_rfkill_exit)
4218                 b43_rfkill_exit(dev);
4219
4220         return err;
4221 }
4222
4223 static void b43_op_stop(struct ieee80211_hw *hw)
4224 {
4225         struct b43_wl *wl = hw_to_b43_wl(hw);
4226         struct b43_wldev *dev = wl->current_dev;
4227
4228         b43_rfkill_exit(dev);
4229         cancel_work_sync(&(wl->beacon_update_trigger));
4230
4231         mutex_lock(&wl->mutex);
4232         if (b43_status(dev) >= B43_STAT_STARTED)
4233                 b43_wireless_core_stop(dev);
4234         b43_wireless_core_exit(dev);
4235         mutex_unlock(&wl->mutex);
4236
4237         cancel_work_sync(&(wl->txpower_adjust_work));
4238 }
4239
4240 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4241                                  struct ieee80211_sta *sta, bool set)
4242 {
4243         struct b43_wl *wl = hw_to_b43_wl(hw);
4244         unsigned long flags;
4245
4246         spin_lock_irqsave(&wl->irq_lock, flags);
4247         b43_update_templates(wl);
4248         spin_unlock_irqrestore(&wl->irq_lock, flags);
4249
4250         return 0;
4251 }
4252
4253 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4254                               struct ieee80211_vif *vif,
4255                               enum sta_notify_cmd notify_cmd,
4256                               struct ieee80211_sta *sta)
4257 {
4258         struct b43_wl *wl = hw_to_b43_wl(hw);
4259
4260         B43_WARN_ON(!vif || wl->vif != vif);
4261 }
4262
4263 static const struct ieee80211_ops b43_hw_ops = {
4264         .tx                     = b43_op_tx,
4265         .conf_tx                = b43_op_conf_tx,
4266         .add_interface          = b43_op_add_interface,
4267         .remove_interface       = b43_op_remove_interface,
4268         .config                 = b43_op_config,
4269         .bss_info_changed       = b43_op_bss_info_changed,
4270         .config_interface       = b43_op_config_interface,
4271         .configure_filter       = b43_op_configure_filter,
4272         .set_key                = b43_op_set_key,
4273         .get_stats              = b43_op_get_stats,
4274         .get_tx_stats           = b43_op_get_tx_stats,
4275         .start                  = b43_op_start,
4276         .stop                   = b43_op_stop,
4277         .set_tim                = b43_op_beacon_set_tim,
4278         .sta_notify             = b43_op_sta_notify,
4279 };
4280
4281 /* Hard-reset the chip. Do not call this directly.
4282  * Use b43_controller_restart()
4283  */
4284 static void b43_chip_reset(struct work_struct *work)
4285 {
4286         struct b43_wldev *dev =
4287             container_of(work, struct b43_wldev, restart_work);
4288         struct b43_wl *wl = dev->wl;
4289         int err = 0;
4290         int prev_status;
4291
4292         mutex_lock(&wl->mutex);
4293
4294         prev_status = b43_status(dev);
4295         /* Bring the device down... */
4296         if (prev_status >= B43_STAT_STARTED)
4297                 b43_wireless_core_stop(dev);
4298         if (prev_status >= B43_STAT_INITIALIZED)
4299                 b43_wireless_core_exit(dev);
4300
4301         /* ...and up again. */
4302         if (prev_status >= B43_STAT_INITIALIZED) {
4303                 err = b43_wireless_core_init(dev);
4304                 if (err)
4305                         goto out;
4306         }
4307         if (prev_status >= B43_STAT_STARTED) {
4308                 err = b43_wireless_core_start(dev);
4309                 if (err) {
4310                         b43_wireless_core_exit(dev);
4311                         goto out;
4312                 }
4313         }
4314 out:
4315         if (err)
4316                 wl->current_dev = NULL; /* Failed to init the dev. */
4317         mutex_unlock(&wl->mutex);
4318         if (err)
4319                 b43err(wl, "Controller restart FAILED\n");
4320         else
4321                 b43info(wl, "Controller restarted\n");
4322 }
4323
4324 static int b43_setup_bands(struct b43_wldev *dev,
4325                            bool have_2ghz_phy, bool have_5ghz_phy)
4326 {
4327         struct ieee80211_hw *hw = dev->wl->hw;
4328
4329         if (have_2ghz_phy)
4330                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4331         if (dev->phy.type == B43_PHYTYPE_N) {
4332                 if (have_5ghz_phy)
4333                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4334         } else {
4335                 if (have_5ghz_phy)
4336                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4337         }
4338
4339         dev->phy.supports_2ghz = have_2ghz_phy;
4340         dev->phy.supports_5ghz = have_5ghz_phy;
4341
4342         return 0;
4343 }
4344
4345 static void b43_wireless_core_detach(struct b43_wldev *dev)
4346 {
4347         /* We release firmware that late to not be required to re-request
4348          * is all the time when we reinit the core. */
4349         b43_release_firmware(dev);
4350         b43_phy_free(dev);
4351 }
4352
4353 static int b43_wireless_core_attach(struct b43_wldev *dev)
4354 {
4355         struct b43_wl *wl = dev->wl;
4356         struct ssb_bus *bus = dev->dev->bus;
4357         struct pci_dev *pdev = bus->host_pci;
4358         int err;
4359         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4360         u32 tmp;
4361
4362         /* Do NOT do any device initialization here.
4363          * Do it in wireless_core_init() instead.
4364          * This function is for gathering basic information about the HW, only.
4365          * Also some structs may be set up here. But most likely you want to have
4366          * that in core_init(), too.
4367          */
4368
4369         err = ssb_bus_powerup(bus, 0);
4370         if (err) {
4371                 b43err(wl, "Bus powerup failed\n");
4372                 goto out;
4373         }
4374         /* Get the PHY type. */
4375         if (dev->dev->id.revision >= 5) {
4376                 u32 tmshigh;
4377
4378                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4379                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4380                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4381         } else
4382                 B43_WARN_ON(1);
4383
4384         dev->phy.gmode = have_2ghz_phy;
4385         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4386         b43_wireless_core_reset(dev, tmp);
4387
4388         err = b43_phy_versioning(dev);
4389         if (err)
4390                 goto err_powerdown;
4391         /* Check if this device supports multiband. */
4392         if (!pdev ||
4393             (pdev->device != 0x4312 &&
4394              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4395                 /* No multiband support. */
4396                 have_2ghz_phy = 0;
4397                 have_5ghz_phy = 0;
4398                 switch (dev->phy.type) {
4399                 case B43_PHYTYPE_A:
4400                         have_5ghz_phy = 1;
4401                         break;
4402                 case B43_PHYTYPE_G:
4403                 case B43_PHYTYPE_N:
4404                         have_2ghz_phy = 1;
4405                         break;
4406                 default:
4407                         B43_WARN_ON(1);
4408                 }
4409         }
4410         if (dev->phy.type == B43_PHYTYPE_A) {
4411                 /* FIXME */
4412                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4413                 err = -EOPNOTSUPP;
4414                 goto err_powerdown;
4415         }
4416         if (1 /* disable A-PHY */) {
4417                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4418                 if (dev->phy.type != B43_PHYTYPE_N) {
4419                         have_2ghz_phy = 1;
4420                         have_5ghz_phy = 0;
4421                 }
4422         }
4423
4424         err = b43_phy_allocate(dev);
4425         if (err)
4426                 goto err_powerdown;
4427
4428         dev->phy.gmode = have_2ghz_phy;
4429         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4430         b43_wireless_core_reset(dev, tmp);
4431
4432         err = b43_validate_chipaccess(dev);
4433         if (err)
4434                 goto err_phy_free;
4435         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4436         if (err)
4437                 goto err_phy_free;
4438
4439         /* Now set some default "current_dev" */
4440         if (!wl->current_dev)
4441                 wl->current_dev = dev;
4442         INIT_WORK(&dev->restart_work, b43_chip_reset);
4443
4444         dev->phy.ops->switch_analog(dev, 0);
4445         ssb_device_disable(dev->dev, 0);
4446         ssb_bus_may_powerdown(bus);
4447
4448 out:
4449         return err;
4450
4451 err_phy_free:
4452         b43_phy_free(dev);
4453 err_powerdown:
4454         ssb_bus_may_powerdown(bus);
4455         return err;
4456 }
4457
4458 static void b43_one_core_detach(struct ssb_device *dev)
4459 {
4460         struct b43_wldev *wldev;
4461         struct b43_wl *wl;
4462
4463         /* Do not cancel ieee80211-workqueue based work here.
4464          * See comment in b43_remove(). */
4465
4466         wldev = ssb_get_drvdata(dev);
4467         wl = wldev->wl;
4468         b43_debugfs_remove_device(wldev);
4469         b43_wireless_core_detach(wldev);
4470         list_del(&wldev->list);
4471         wl->nr_devs--;
4472         ssb_set_drvdata(dev, NULL);
4473         kfree(wldev);
4474 }
4475
4476 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4477 {
4478         struct b43_wldev *wldev;
4479         struct pci_dev *pdev;
4480         int err = -ENOMEM;
4481
4482         if (!list_empty(&wl->devlist)) {
4483                 /* We are not the first core on this chip. */
4484                 pdev = dev->bus->host_pci;
4485                 /* Only special chips support more than one wireless
4486                  * core, although some of the other chips have more than
4487                  * one wireless core as well. Check for this and
4488                  * bail out early.
4489                  */
4490                 if (!pdev ||
4491                     ((pdev->device != 0x4321) &&
4492                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4493                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4494                         return -ENODEV;
4495                 }
4496         }
4497
4498         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4499         if (!wldev)
4500                 goto out;
4501
4502         wldev->dev = dev;
4503         wldev->wl = wl;
4504         b43_set_status(wldev, B43_STAT_UNINIT);
4505         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4506         tasklet_init(&wldev->isr_tasklet,
4507                      (void (*)(unsigned long))b43_interrupt_tasklet,
4508                      (unsigned long)wldev);
4509         INIT_LIST_HEAD(&wldev->list);
4510
4511         err = b43_wireless_core_attach(wldev);
4512         if (err)
4513                 goto err_kfree_wldev;
4514
4515         list_add(&wldev->list, &wl->devlist);
4516         wl->nr_devs++;
4517         ssb_set_drvdata(dev, wldev);
4518         b43_debugfs_add_device(wldev);
4519
4520       out:
4521         return err;
4522
4523       err_kfree_wldev:
4524         kfree(wldev);
4525         return err;
4526 }
4527
4528 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4529         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4530         (pdev->device == _device) &&                                    \
4531         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4532         (pdev->subsystem_device == _subdevice)                          )
4533
4534 static void b43_sprom_fixup(struct ssb_bus *bus)
4535 {
4536         struct pci_dev *pdev;
4537
4538         /* boardflags workarounds */
4539         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4540             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4541                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4542         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4543             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4544                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4545         if (bus->bustype == SSB_BUSTYPE_PCI) {
4546                 pdev = bus->host_pci;
4547                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4548                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4549                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4550                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4551                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4552                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4553                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4554                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4555         }
4556 }
4557
4558 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4559 {
4560         struct ieee80211_hw *hw = wl->hw;
4561
4562         ssb_set_devtypedata(dev, NULL);
4563         ieee80211_free_hw(hw);
4564 }
4565
4566 static int b43_wireless_init(struct ssb_device *dev)
4567 {
4568         struct ssb_sprom *sprom = &dev->bus->sprom;
4569         struct ieee80211_hw *hw;
4570         struct b43_wl *wl;
4571         int err = -ENOMEM;
4572
4573         b43_sprom_fixup(dev->bus);
4574
4575         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4576         if (!hw) {
4577                 b43err(NULL, "Could not allocate ieee80211 device\n");
4578                 goto out;
4579         }
4580
4581         /* fill hw info */
4582         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4583                     IEEE80211_HW_SIGNAL_DBM |
4584                     IEEE80211_HW_NOISE_DBM;
4585
4586         hw->wiphy->interface_modes =
4587                 BIT(NL80211_IFTYPE_AP) |
4588                 BIT(NL80211_IFTYPE_MESH_POINT) |
4589                 BIT(NL80211_IFTYPE_STATION) |
4590                 BIT(NL80211_IFTYPE_WDS) |
4591                 BIT(NL80211_IFTYPE_ADHOC);
4592
4593         hw->queues = b43_modparam_qos ? 4 : 1;
4594         hw->max_rates = 2;
4595         SET_IEEE80211_DEV(hw, dev->dev);
4596         if (is_valid_ether_addr(sprom->et1mac))
4597                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4598         else
4599                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4600
4601         /* Get and initialize struct b43_wl */
4602         wl = hw_to_b43_wl(hw);
4603         memset(wl, 0, sizeof(*wl));
4604         wl->hw = hw;
4605         spin_lock_init(&wl->irq_lock);
4606         rwlock_init(&wl->tx_lock);
4607         spin_lock_init(&wl->leds_lock);
4608         spin_lock_init(&wl->shm_lock);
4609         mutex_init(&wl->mutex);
4610         INIT_LIST_HEAD(&wl->devlist);
4611         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4612         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4613
4614         ssb_set_devtypedata(dev, wl);
4615         b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4616         err = 0;
4617       out:
4618         return err;
4619 }
4620
4621 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4622 {
4623         struct b43_wl *wl;
4624         int err;
4625         int first = 0;
4626
4627         wl = ssb_get_devtypedata(dev);
4628         if (!wl) {
4629                 /* Probing the first core. Must setup common struct b43_wl */
4630                 first = 1;
4631                 err = b43_wireless_init(dev);
4632                 if (err)
4633                         goto out;
4634                 wl = ssb_get_devtypedata(dev);
4635                 B43_WARN_ON(!wl);
4636         }
4637         err = b43_one_core_attach(dev, wl);
4638         if (err)
4639                 goto err_wireless_exit;
4640
4641         if (first) {
4642                 err = ieee80211_register_hw(wl->hw);
4643                 if (err)
4644                         goto err_one_core_detach;
4645         }
4646
4647       out:
4648         return err;
4649
4650       err_one_core_detach:
4651         b43_one_core_detach(dev);
4652       err_wireless_exit:
4653         if (first)
4654                 b43_wireless_exit(dev, wl);
4655         return err;
4656 }
4657
4658 static void b43_remove(struct ssb_device *dev)
4659 {
4660         struct b43_wl *wl = ssb_get_devtypedata(dev);
4661         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4662
4663         /* We must cancel any work here before unregistering from ieee80211,
4664          * as the ieee80211 unreg will destroy the workqueue. */
4665         cancel_work_sync(&wldev->restart_work);
4666
4667         B43_WARN_ON(!wl);
4668         if (wl->current_dev == wldev)
4669                 ieee80211_unregister_hw(wl->hw);
4670
4671         b43_one_core_detach(dev);
4672
4673         if (list_empty(&wl->devlist)) {
4674                 /* Last core on the chip unregistered.
4675                  * We can destroy common struct b43_wl.
4676                  */
4677                 b43_wireless_exit(dev, wl);
4678         }
4679 }
4680
4681 /* Perform a hardware reset. This can be called from any context. */
4682 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4683 {
4684         /* Must avoid requeueing, if we are in shutdown. */
4685         if (b43_status(dev) < B43_STAT_INITIALIZED)
4686                 return;
4687         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4688         queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4689 }
4690
4691 #ifdef CONFIG_PM
4692
4693 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4694 {
4695         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4696         struct b43_wl *wl = wldev->wl;
4697
4698         b43dbg(wl, "Suspending...\n");
4699
4700         mutex_lock(&wl->mutex);
4701         wldev->suspend_in_progress = true;
4702         wldev->suspend_init_status = b43_status(wldev);
4703         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4704                 b43_wireless_core_stop(wldev);
4705         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4706                 b43_wireless_core_exit(wldev);
4707         mutex_unlock(&wl->mutex);
4708
4709         b43dbg(wl, "Device suspended.\n");
4710
4711         return 0;
4712 }
4713
4714 static int b43_resume(struct ssb_device *dev)
4715 {
4716         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4717         struct b43_wl *wl = wldev->wl;
4718         int err = 0;
4719
4720         b43dbg(wl, "Resuming...\n");
4721
4722         mutex_lock(&wl->mutex);
4723         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4724                 err = b43_wireless_core_init(wldev);
4725                 if (err) {
4726                         b43err(wl, "Resume failed at core init\n");
4727                         goto out;
4728                 }
4729         }
4730         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4731                 err = b43_wireless_core_start(wldev);
4732                 if (err) {
4733                         b43_leds_exit(wldev);
4734                         b43_rng_exit(wldev->wl);
4735                         b43_wireless_core_exit(wldev);
4736                         b43err(wl, "Resume failed at core start\n");
4737                         goto out;
4738                 }
4739         }
4740         b43dbg(wl, "Device resumed.\n");
4741  out:
4742         wldev->suspend_in_progress = false;
4743         mutex_unlock(&wl->mutex);
4744         return err;
4745 }
4746
4747 #else /* CONFIG_PM */
4748 # define b43_suspend    NULL
4749 # define b43_resume     NULL
4750 #endif /* CONFIG_PM */
4751
4752 static struct ssb_driver b43_ssb_driver = {
4753         .name           = KBUILD_MODNAME,
4754         .id_table       = b43_ssb_tbl,
4755         .probe          = b43_probe,
4756         .remove         = b43_remove,
4757         .suspend        = b43_suspend,
4758         .resume         = b43_resume,
4759 };
4760
4761 static void b43_print_driverinfo(void)
4762 {
4763         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4764                    *feat_leds = "", *feat_rfkill = "";
4765
4766 #ifdef CONFIG_B43_PCI_AUTOSELECT
4767         feat_pci = "P";
4768 #endif
4769 #ifdef CONFIG_B43_PCMCIA
4770         feat_pcmcia = "M";
4771 #endif
4772 #ifdef CONFIG_B43_NPHY
4773         feat_nphy = "N";
4774 #endif
4775 #ifdef CONFIG_B43_LEDS
4776         feat_leds = "L";
4777 #endif
4778 #ifdef CONFIG_B43_RFKILL
4779         feat_rfkill = "R";
4780 #endif
4781         printk(KERN_INFO "Broadcom 43xx driver loaded "
4782                "[ Features: %s%s%s%s%s, Firmware-ID: "
4783                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4784                feat_pci, feat_pcmcia, feat_nphy,
4785                feat_leds, feat_rfkill);
4786 }
4787
4788 static int __init b43_init(void)
4789 {
4790         int err;
4791
4792         b43_debugfs_init();
4793         err = b43_pcmcia_init();
4794         if (err)
4795                 goto err_dfs_exit;
4796         err = ssb_driver_register(&b43_ssb_driver);
4797         if (err)
4798                 goto err_pcmcia_exit;
4799         b43_print_driverinfo();
4800
4801         return err;
4802
4803 err_pcmcia_exit:
4804         b43_pcmcia_exit();
4805 err_dfs_exit:
4806         b43_debugfs_exit();
4807         return err;
4808 }
4809
4810 static void __exit b43_exit(void)
4811 {
4812         ssb_driver_unregister(&b43_ssb_driver);
4813         b43_pcmcia_exit();
4814         b43_debugfs_exit();
4815 }
4816
4817 module_init(b43_init)
4818 module_exit(b43_exit)