git.oblomov.eu Git - linux-2.6/blob - drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/version.h>
  37 #include <linux/firmware.h>
  38 #include <linux/wireless.h>
  39 #include <linux/workqueue.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/io.h>
  42 #include <linux/dma-mapping.h>
  43 #include <asm/unaligned.h>
  44
  45 #include "b43.h"
  46 #include "main.h"
  47 #include "debugfs.h"
  48 #include "phy.h"
  49 #include "nphy.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 int b43_modparam_qos = 1;
  84 module_param_named(qos, b43_modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91
  92 static const struct ssb_device_id b43_ssb_tbl[] = {
  93         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  94         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  95         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
  96         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 100         SSB_DEVTABLE_END
 101 };
 102
 103 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 104
 105 /* Channel and ratetables are shared for all devices.
 106  * They can't be const, because ieee80211 puts some precalculated
 107  * data in there. This data is the same for all devices, so we don't
 108  * get concurrency issues */
 109 #define RATETAB_ENT(_rateid, _flags) \
 110         {                                                               \
 111                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 112                 .hw_value       = (_rateid),                            \
 113                 .flags          = (_flags),                             \
 114         }
 115
 116 /*
 117  * NOTE: When changing this, sync with xmit.c's
 118  *       b43_plcp_get_bitrate_idx_* functions!
 119  */
 120 static struct ieee80211_rate __b43_ratetable[] = {
 121         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 122         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 123         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 124         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 125         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 126         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 127         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 128         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 129         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 130         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 131         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 133 };
 134
 135 #define b43_a_ratetable         (__b43_ratetable + 4)
 136 #define b43_a_ratetable_size    8
 137 #define b43_b_ratetable         (__b43_ratetable + 0)
 138 #define b43_b_ratetable_size    4
 139 #define b43_g_ratetable         (__b43_ratetable + 0)
 140 #define b43_g_ratetable_size    12
 141
 142 #define CHAN4G(_channel, _freq, _flags) {                       \
 143         .band                   = IEEE80211_BAND_2GHZ,          \
 144         .center_freq            = (_freq),                      \
 145         .hw_value               = (_channel),                   \
 146         .flags                  = (_flags),                     \
 147         .max_antenna_gain       = 0,                            \
 148         .max_power              = 30,                           \
 149 }
 150 static struct ieee80211_channel b43_2ghz_chantable[] = {
 151         CHAN4G(1, 2412, 0),
 152         CHAN4G(2, 2417, 0),
 153         CHAN4G(3, 2422, 0),
 154         CHAN4G(4, 2427, 0),
 155         CHAN4G(5, 2432, 0),
 156         CHAN4G(6, 2437, 0),
 157         CHAN4G(7, 2442, 0),
 158         CHAN4G(8, 2447, 0),
 159         CHAN4G(9, 2452, 0),
 160         CHAN4G(10, 2457, 0),
 161         CHAN4G(11, 2462, 0),
 162         CHAN4G(12, 2467, 0),
 163         CHAN4G(13, 2472, 0),
 164         CHAN4G(14, 2484, 0),
 165 };
 166 #undef CHAN4G
 167
 168 #define CHAN5G(_channel, _flags) {                              \
 169         .band                   = IEEE80211_BAND_5GHZ,          \
 170         .center_freq            = 5000 + (5 * (_channel)),      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 177         CHAN5G(32, 0),          CHAN5G(34, 0),
 178         CHAN5G(36, 0),          CHAN5G(38, 0),
 179         CHAN5G(40, 0),          CHAN5G(42, 0),
 180         CHAN5G(44, 0),          CHAN5G(46, 0),
 181         CHAN5G(48, 0),          CHAN5G(50, 0),
 182         CHAN5G(52, 0),          CHAN5G(54, 0),
 183         CHAN5G(56, 0),          CHAN5G(58, 0),
 184         CHAN5G(60, 0),          CHAN5G(62, 0),
 185         CHAN5G(64, 0),          CHAN5G(66, 0),
 186         CHAN5G(68, 0),          CHAN5G(70, 0),
 187         CHAN5G(72, 0),          CHAN5G(74, 0),
 188         CHAN5G(76, 0),          CHAN5G(78, 0),
 189         CHAN5G(80, 0),          CHAN5G(82, 0),
 190         CHAN5G(84, 0),          CHAN5G(86, 0),
 191         CHAN5G(88, 0),          CHAN5G(90, 0),
 192         CHAN5G(92, 0),          CHAN5G(94, 0),
 193         CHAN5G(96, 0),          CHAN5G(98, 0),
 194         CHAN5G(100, 0),         CHAN5G(102, 0),
 195         CHAN5G(104, 0),         CHAN5G(106, 0),
 196         CHAN5G(108, 0),         CHAN5G(110, 0),
 197         CHAN5G(112, 0),         CHAN5G(114, 0),
 198         CHAN5G(116, 0),         CHAN5G(118, 0),
 199         CHAN5G(120, 0),         CHAN5G(122, 0),
 200         CHAN5G(124, 0),         CHAN5G(126, 0),
 201         CHAN5G(128, 0),         CHAN5G(130, 0),
 202         CHAN5G(132, 0),         CHAN5G(134, 0),
 203         CHAN5G(136, 0),         CHAN5G(138, 0),
 204         CHAN5G(140, 0),         CHAN5G(142, 0),
 205         CHAN5G(144, 0),         CHAN5G(145, 0),
 206         CHAN5G(146, 0),         CHAN5G(147, 0),
 207         CHAN5G(148, 0),         CHAN5G(149, 0),
 208         CHAN5G(150, 0),         CHAN5G(151, 0),
 209         CHAN5G(152, 0),         CHAN5G(153, 0),
 210         CHAN5G(154, 0),         CHAN5G(155, 0),
 211         CHAN5G(156, 0),         CHAN5G(157, 0),
 212         CHAN5G(158, 0),         CHAN5G(159, 0),
 213         CHAN5G(160, 0),         CHAN5G(161, 0),
 214         CHAN5G(162, 0),         CHAN5G(163, 0),
 215         CHAN5G(164, 0),         CHAN5G(165, 0),
 216         CHAN5G(166, 0),         CHAN5G(168, 0),
 217         CHAN5G(170, 0),         CHAN5G(172, 0),
 218         CHAN5G(174, 0),         CHAN5G(176, 0),
 219         CHAN5G(178, 0),         CHAN5G(180, 0),
 220         CHAN5G(182, 0),         CHAN5G(184, 0),
 221         CHAN5G(186, 0),         CHAN5G(188, 0),
 222         CHAN5G(190, 0),         CHAN5G(192, 0),
 223         CHAN5G(194, 0),         CHAN5G(196, 0),
 224         CHAN5G(198, 0),         CHAN5G(200, 0),
 225         CHAN5G(202, 0),         CHAN5G(204, 0),
 226         CHAN5G(206, 0),         CHAN5G(208, 0),
 227         CHAN5G(210, 0),         CHAN5G(212, 0),
 228         CHAN5G(214, 0),         CHAN5G(216, 0),
 229         CHAN5G(218, 0),         CHAN5G(220, 0),
 230         CHAN5G(222, 0),         CHAN5G(224, 0),
 231         CHAN5G(226, 0),         CHAN5G(228, 0),
 232 };
 233
 234 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 235         CHAN5G(34, 0),          CHAN5G(36, 0),
 236         CHAN5G(38, 0),          CHAN5G(40, 0),
 237         CHAN5G(42, 0),          CHAN5G(44, 0),
 238         CHAN5G(46, 0),          CHAN5G(48, 0),
 239         CHAN5G(52, 0),          CHAN5G(56, 0),
 240         CHAN5G(60, 0),          CHAN5G(64, 0),
 241         CHAN5G(100, 0),         CHAN5G(104, 0),
 242         CHAN5G(108, 0),         CHAN5G(112, 0),
 243         CHAN5G(116, 0),         CHAN5G(120, 0),
 244         CHAN5G(124, 0),         CHAN5G(128, 0),
 245         CHAN5G(132, 0),         CHAN5G(136, 0),
 246         CHAN5G(140, 0),         CHAN5G(149, 0),
 247         CHAN5G(153, 0),         CHAN5G(157, 0),
 248         CHAN5G(161, 0),         CHAN5G(165, 0),
 249         CHAN5G(184, 0),         CHAN5G(188, 0),
 250         CHAN5G(192, 0),         CHAN5G(196, 0),
 251         CHAN5G(200, 0),         CHAN5G(204, 0),
 252         CHAN5G(208, 0),         CHAN5G(212, 0),
 253         CHAN5G(216, 0),
 254 };
 255 #undef CHAN5G
 256
 257 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 258         .band           = IEEE80211_BAND_5GHZ,
 259         .channels       = b43_5ghz_nphy_chantable,
 260         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 261         .bitrates       = b43_a_ratetable,
 262         .n_bitrates     = b43_a_ratetable_size,
 263 };
 264
 265 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 266         .band           = IEEE80211_BAND_5GHZ,
 267         .channels       = b43_5ghz_aphy_chantable,
 268         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 269         .bitrates       = b43_a_ratetable,
 270         .n_bitrates     = b43_a_ratetable_size,
 271 };
 272
 273 static struct ieee80211_supported_band b43_band_2GHz = {
 274         .band           = IEEE80211_BAND_2GHZ,
 275         .channels       = b43_2ghz_chantable,
 276         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 277         .bitrates       = b43_g_ratetable,
 278         .n_bitrates     = b43_g_ratetable_size,
 279 };
 280
 281 static void b43_wireless_core_exit(struct b43_wldev *dev);
 282 static int b43_wireless_core_init(struct b43_wldev *dev);
 283 static void b43_wireless_core_stop(struct b43_wldev *dev);
 284 static int b43_wireless_core_start(struct b43_wldev *dev);
 285
 286 static int b43_ratelimit(struct b43_wl *wl)
 287 {
 288         if (!wl || !wl->current_dev)
 289                 return 1;
 290         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 291                 return 1;
 292         /* We are up and running.
 293          * Ratelimit the messages to avoid DoS over the net. */
 294         return net_ratelimit();
 295 }
 296
 297 void b43info(struct b43_wl *wl, const char *fmt, ...)
 298 {
 299         va_list args;
 300
 301         if (!b43_ratelimit(wl))
 302                 return;
 303         va_start(args, fmt);
 304         printk(KERN_INFO "b43-%s: ",
 305                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 306         vprintk(fmt, args);
 307         va_end(args);
 308 }
 309
 310 void b43err(struct b43_wl *wl, const char *fmt, ...)
 311 {
 312         va_list args;
 313
 314         if (!b43_ratelimit(wl))
 315                 return;
 316         va_start(args, fmt);
 317         printk(KERN_ERR "b43-%s ERROR: ",
 318                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 319         vprintk(fmt, args);
 320         va_end(args);
 321 }
 322
 323 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         va_list args;
 326
 327         if (!b43_ratelimit(wl))
 328                 return;
 329         va_start(args, fmt);
 330         printk(KERN_WARNING "b43-%s warning: ",
 331                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 332         vprintk(fmt, args);
 333         va_end(args);
 334 }
 335
 336 #if B43_DEBUG
 337 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 338 {
 339         va_list args;
 340
 341         va_start(args, fmt);
 342         printk(KERN_DEBUG "b43-%s debug: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347 #endif /* DEBUG */
 348
 349 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 350 {
 351         u32 macctl;
 352
 353         B43_WARN_ON(offset % 4 != 0);
 354
 355         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 356         if (macctl & B43_MACCTL_BE)
 357                 val = swab32(val);
 358
 359         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 360         mmiowb();
 361         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 362 }
 363
 364 static inline void b43_shm_control_word(struct b43_wldev *dev,
 365                                         u16 routing, u16 offset)
 366 {
 367         u32 control;
 368
 369         /* "offset" is the WORD offset. */
 370         control = routing;
 371         control <<= 16;
 372         control |= offset;
 373         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 374 }
 375
 376 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 377 {
 378         struct b43_wl *wl = dev->wl;
 379         unsigned long flags;
 380         u32 ret;
 381
 382         spin_lock_irqsave(&wl->shm_lock, flags);
 383         if (routing == B43_SHM_SHARED) {
 384                 B43_WARN_ON(offset & 0x0001);
 385                 if (offset & 0x0003) {
 386                         /* Unaligned access */
 387                         b43_shm_control_word(dev, routing, offset >> 2);
 388                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 389                         ret <<= 16;
 390                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 391                         ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
 392
 393                         goto out;
 394                 }
 395                 offset >>= 2;
 396         }
 397         b43_shm_control_word(dev, routing, offset);
 398         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 399 out:
 400         spin_unlock_irqrestore(&wl->shm_lock, flags);
 401
 402         return ret;
 403 }
 404
 405 u16 b43_shm_read16(struct b43_wldev * dev, u16 routing, u16 offset)
 406 {
 407         struct b43_wl *wl = dev->wl;
 408         unsigned long flags;
 409         u16 ret;
 410
 411         spin_lock_irqsave(&wl->shm_lock, flags);
 412         if (routing == B43_SHM_SHARED) {
 413                 B43_WARN_ON(offset & 0x0001);
 414                 if (offset & 0x0003) {
 415                         /* Unaligned access */
 416                         b43_shm_control_word(dev, routing, offset >> 2);
 417                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 418
 419                         goto out;
 420                 }
 421                 offset >>= 2;
 422         }
 423         b43_shm_control_word(dev, routing, offset);
 424         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 425 out:
 426         spin_unlock_irqrestore(&wl->shm_lock, flags);
 427
 428         return ret;
 429 }
 430
 431 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 432 {
 433         struct b43_wl *wl = dev->wl;
 434         unsigned long flags;
 435
 436         spin_lock_irqsave(&wl->shm_lock, flags);
 437         if (routing == B43_SHM_SHARED) {
 438                 B43_WARN_ON(offset & 0x0001);
 439                 if (offset & 0x0003) {
 440                         /* Unaligned access */
 441                         b43_shm_control_word(dev, routing, offset >> 2);
 442                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 443                                     (value >> 16) & 0xffff);
 444                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 445                         b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
 446                         goto out;
 447                 }
 448                 offset >>= 2;
 449         }
 450         b43_shm_control_word(dev, routing, offset);
 451         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 452 out:
 453         spin_unlock_irqrestore(&wl->shm_lock, flags);
 454 }
 455
 456 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 457 {
 458         struct b43_wl *wl = dev->wl;
 459         unsigned long flags;
 460
 461         spin_lock_irqsave(&wl->shm_lock, flags);
 462         if (routing == B43_SHM_SHARED) {
 463                 B43_WARN_ON(offset & 0x0001);
 464                 if (offset & 0x0003) {
 465                         /* Unaligned access */
 466                         b43_shm_control_word(dev, routing, offset >> 2);
 467                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 468                         goto out;
 469                 }
 470                 offset >>= 2;
 471         }
 472         b43_shm_control_word(dev, routing, offset);
 473         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 474 out:
 475         spin_unlock_irqrestore(&wl->shm_lock, flags);
 476 }
 477
 478 /* Read HostFlags */
 479 u64 b43_hf_read(struct b43_wldev * dev)
 480 {
 481         u64 ret;
 482
 483         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 484         ret <<= 16;
 485         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 486         ret <<= 16;
 487         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 488
 489         return ret;
 490 }
 491
 492 /* Write HostFlags */
 493 void b43_hf_write(struct b43_wldev *dev, u64 value)
 494 {
 495         u16 lo, mi, hi;
 496
 497         lo = (value & 0x00000000FFFFULL);
 498         mi = (value & 0x0000FFFF0000ULL) >> 16;
 499         hi = (value & 0xFFFF00000000ULL) >> 32;
 500         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 501         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 502         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 503 }
 504
 505 void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
 506 {
 507         /* We need to be careful. As we read the TSF from multiple
 508          * registers, we should take care of register overflows.
 509          * In theory, the whole tsf read process should be atomic.
 510          * We try to be atomic here, by restaring the read process,
 511          * if any of the high registers changed (overflew).
 512          */
 513         if (dev->dev->id.revision >= 3) {
 514                 u32 low, high, high2;
 515
 516                 do {
 517                         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 518                         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 519                         high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 520                 } while (unlikely(high != high2));
 521
 522                 *tsf = high;
 523                 *tsf <<= 32;
 524                 *tsf |= low;
 525         } else {
 526                 u64 tmp;
 527                 u16 v0, v1, v2, v3;
 528                 u16 test1, test2, test3;
 529
 530                 do {
 531                         v3 = b43_read16(dev, B43_MMIO_TSF_3);
 532                         v2 = b43_read16(dev, B43_MMIO_TSF_2);
 533                         v1 = b43_read16(dev, B43_MMIO_TSF_1);
 534                         v0 = b43_read16(dev, B43_MMIO_TSF_0);
 535
 536                         test3 = b43_read16(dev, B43_MMIO_TSF_3);
 537                         test2 = b43_read16(dev, B43_MMIO_TSF_2);
 538                         test1 = b43_read16(dev, B43_MMIO_TSF_1);
 539                 } while (v3 != test3 || v2 != test2 || v1 != test1);
 540
 541                 *tsf = v3;
 542                 *tsf <<= 48;
 543                 tmp = v2;
 544                 tmp <<= 32;
 545                 *tsf |= tmp;
 546                 tmp = v1;
 547                 tmp <<= 16;
 548                 *tsf |= tmp;
 549                 *tsf |= v0;
 550         }
 551 }
 552
 553 static void b43_time_lock(struct b43_wldev *dev)
 554 {
 555         u32 macctl;
 556
 557         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 558         macctl |= B43_MACCTL_TBTTHOLD;
 559         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 560         /* Commit the write */
 561         b43_read32(dev, B43_MMIO_MACCTL);
 562 }
 563
 564 static void b43_time_unlock(struct b43_wldev *dev)
 565 {
 566         u32 macctl;
 567
 568         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 569         macctl &= ~B43_MACCTL_TBTTHOLD;
 570         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 571         /* Commit the write */
 572         b43_read32(dev, B43_MMIO_MACCTL);
 573 }
 574
 575 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 576 {
 577         /* Be careful with the in-progress timer.
 578          * First zero out the low register, so we have a full
 579          * register-overflow duration to complete the operation.
 580          */
 581         if (dev->dev->id.revision >= 3) {
 582                 u32 lo = (tsf & 0x00000000FFFFFFFFULL);
 583                 u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
 584
 585                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
 586                 mmiowb();
 587                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
 588                 mmiowb();
 589                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
 590         } else {
 591                 u16 v0 = (tsf & 0x000000000000FFFFULL);
 592                 u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
 593                 u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
 594                 u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
 595
 596                 b43_write16(dev, B43_MMIO_TSF_0, 0);
 597                 mmiowb();
 598                 b43_write16(dev, B43_MMIO_TSF_3, v3);
 599                 mmiowb();
 600                 b43_write16(dev, B43_MMIO_TSF_2, v2);
 601                 mmiowb();
 602                 b43_write16(dev, B43_MMIO_TSF_1, v1);
 603                 mmiowb();
 604                 b43_write16(dev, B43_MMIO_TSF_0, v0);
 605         }
 606 }
 607
 608 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 609 {
 610         b43_time_lock(dev);
 611         b43_tsf_write_locked(dev, tsf);
 612         b43_time_unlock(dev);
 613 }
 614
 615 static
 616 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
 617 {
 618         static const u8 zero_addr[ETH_ALEN] = { 0 };
 619         u16 data;
 620
 621         if (!mac)
 622                 mac = zero_addr;
 623
 624         offset |= 0x0020;
 625         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 626
 627         data = mac[0];
 628         data |= mac[1] << 8;
 629         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 630         data = mac[2];
 631         data |= mac[3] << 8;
 632         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 633         data = mac[4];
 634         data |= mac[5] << 8;
 635         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 636 }
 637
 638 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 639 {
 640         const u8 *mac;
 641         const u8 *bssid;
 642         u8 mac_bssid[ETH_ALEN * 2];
 643         int i;
 644         u32 tmp;
 645
 646         bssid = dev->wl->bssid;
 647         mac = dev->wl->mac_addr;
 648
 649         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 650
 651         memcpy(mac_bssid, mac, ETH_ALEN);
 652         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 653
 654         /* Write our MAC address and BSSID to template ram */
 655         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 656                 tmp = (u32) (mac_bssid[i + 0]);
 657                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 658                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 659                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 660                 b43_ram_write(dev, 0x20 + i, tmp);
 661         }
 662 }
 663
 664 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 665 {
 666         b43_write_mac_bssid_templates(dev);
 667         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 668 }
 669
 670 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 671 {
 672         /* slot_time is in usec. */
 673         if (dev->phy.type != B43_PHYTYPE_G)
 674                 return;
 675         b43_write16(dev, 0x684, 510 + slot_time);
 676         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 677 }
 678
 679 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 680 {
 681         b43_set_slot_time(dev, 9);
 682         dev->short_slot = 1;
 683 }
 684
 685 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 686 {
 687         b43_set_slot_time(dev, 20);
 688         dev->short_slot = 0;
 689 }
 690
 691 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
 692  * Returns the _previously_ enabled IRQ mask.
 693  */
 694 static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
 695 {
 696         u32 old_mask;
 697
 698         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 699         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
 700
 701         return old_mask;
 702 }
 703
 704 /* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
 705  * Returns the _previously_ enabled IRQ mask.
 706  */
 707 static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
 708 {
 709         u32 old_mask;
 710
 711         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 712         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
 713
 714         return old_mask;
 715 }
 716
 717 /* Synchronize IRQ top- and bottom-half.
 718  * IRQs must be masked before calling this.
 719  * This must not be called with the irq_lock held.
 720  */
 721 static void b43_synchronize_irq(struct b43_wldev *dev)
 722 {
 723         synchronize_irq(dev->dev->irq);
 724         tasklet_kill(&dev->isr_tasklet);
 725 }
 726
 727 /* DummyTransmission function, as documented on
 728  * http://bcm-specs.sipsolutions.net/DummyTransmission
 729  */
 730 void b43_dummy_transmission(struct b43_wldev *dev)
 731 {
 732         struct b43_wl *wl = dev->wl;
 733         struct b43_phy *phy = &dev->phy;
 734         unsigned int i, max_loop;
 735         u16 value;
 736         u32 buffer[5] = {
 737                 0x00000000,
 738                 0x00D40000,
 739                 0x00000000,
 740                 0x01000000,
 741                 0x00000000,
 742         };
 743
 744         switch (phy->type) {
 745         case B43_PHYTYPE_A:
 746                 max_loop = 0x1E;
 747                 buffer[0] = 0x000201CC;
 748                 break;
 749         case B43_PHYTYPE_B:
 750         case B43_PHYTYPE_G:
 751                 max_loop = 0xFA;
 752                 buffer[0] = 0x000B846E;
 753                 break;
 754         default:
 755                 B43_WARN_ON(1);
 756                 return;
 757         }
 758
 759         spin_lock_irq(&wl->irq_lock);
 760         write_lock(&wl->tx_lock);
 761
 762         for (i = 0; i < 5; i++)
 763                 b43_ram_write(dev, i * 4, buffer[i]);
 764
 765         /* Commit writes */
 766         b43_read32(dev, B43_MMIO_MACCTL);
 767
 768         b43_write16(dev, 0x0568, 0x0000);
 769         b43_write16(dev, 0x07C0, 0x0000);
 770         value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
 771         b43_write16(dev, 0x050C, value);
 772         b43_write16(dev, 0x0508, 0x0000);
 773         b43_write16(dev, 0x050A, 0x0000);
 774         b43_write16(dev, 0x054C, 0x0000);
 775         b43_write16(dev, 0x056A, 0x0014);
 776         b43_write16(dev, 0x0568, 0x0826);
 777         b43_write16(dev, 0x0500, 0x0000);
 778         b43_write16(dev, 0x0502, 0x0030);
 779
 780         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 781                 b43_radio_write16(dev, 0x0051, 0x0017);
 782         for (i = 0x00; i < max_loop; i++) {
 783                 value = b43_read16(dev, 0x050E);
 784                 if (value & 0x0080)
 785                         break;
 786                 udelay(10);
 787         }
 788         for (i = 0x00; i < 0x0A; i++) {
 789                 value = b43_read16(dev, 0x050E);
 790                 if (value & 0x0400)
 791                         break;
 792                 udelay(10);
 793         }
 794         for (i = 0x00; i < 0x0A; i++) {
 795                 value = b43_read16(dev, 0x0690);
 796                 if (!(value & 0x0100))
 797                         break;
 798                 udelay(10);
 799         }
 800         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 801                 b43_radio_write16(dev, 0x0051, 0x0037);
 802
 803         write_unlock(&wl->tx_lock);
 804         spin_unlock_irq(&wl->irq_lock);
 805 }
 806
 807 static void key_write(struct b43_wldev *dev,
 808                       u8 index, u8 algorithm, const u8 * key)
 809 {
 810         unsigned int i;
 811         u32 offset;
 812         u16 value;
 813         u16 kidx;
 814
 815         /* Key index/algo block */
 816         kidx = b43_kidx_to_fw(dev, index);
 817         value = ((kidx << 4) | algorithm);
 818         b43_shm_write16(dev, B43_SHM_SHARED,
 819                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 820
 821         /* Write the key to the Key Table Pointer offset */
 822         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 823         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 824                 value = key[i];
 825                 value |= (u16) (key[i + 1]) << 8;
 826                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 827         }
 828 }
 829
 830 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
 831 {
 832         u32 addrtmp[2] = { 0, 0, };
 833         u8 per_sta_keys_start = 8;
 834
 835         if (b43_new_kidx_api(dev))
 836                 per_sta_keys_start = 4;
 837
 838         B43_WARN_ON(index < per_sta_keys_start);
 839         /* We have two default TX keys and possibly two default RX keys.
 840          * Physical mac 0 is mapped to physical key 4 or 8, depending
 841          * on the firmware version.
 842          * So we must adjust the index here.
 843          */
 844         index -= per_sta_keys_start;
 845
 846         if (addr) {
 847                 addrtmp[0] = addr[0];
 848                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 849                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 850                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 851                 addrtmp[1] = addr[4];
 852                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 853         }
 854
 855         if (dev->dev->id.revision >= 5) {
 856                 /* Receive match transmitter address mechanism */
 857                 b43_shm_write32(dev, B43_SHM_RCMTA,
 858                                 (index * 2) + 0, addrtmp[0]);
 859                 b43_shm_write16(dev, B43_SHM_RCMTA,
 860                                 (index * 2) + 1, addrtmp[1]);
 861         } else {
 862                 /* RXE (Receive Engine) and
 863                  * PSM (Programmable State Machine) mechanism
 864                  */
 865                 if (index < 8) {
 866                         /* TODO write to RCM 16, 19, 22 and 25 */
 867                 } else {
 868                         b43_shm_write32(dev, B43_SHM_SHARED,
 869                                         B43_SHM_SH_PSM + (index * 6) + 0,
 870                                         addrtmp[0]);
 871                         b43_shm_write16(dev, B43_SHM_SHARED,
 872                                         B43_SHM_SH_PSM + (index * 6) + 4,
 873                                         addrtmp[1]);
 874                 }
 875         }
 876 }
 877
 878 static void do_key_write(struct b43_wldev *dev,
 879                          u8 index, u8 algorithm,
 880                          const u8 * key, size_t key_len, const u8 * mac_addr)
 881 {
 882         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 883         u8 per_sta_keys_start = 8;
 884
 885         if (b43_new_kidx_api(dev))
 886                 per_sta_keys_start = 4;
 887
 888         B43_WARN_ON(index >= dev->max_nr_keys);
 889         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 890
 891         if (index >= per_sta_keys_start)
 892                 keymac_write(dev, index, NULL); /* First zero out mac. */
 893         if (key)
 894                 memcpy(buf, key, key_len);
 895         key_write(dev, index, algorithm, buf);
 896         if (index >= per_sta_keys_start)
 897                 keymac_write(dev, index, mac_addr);
 898
 899         dev->key[index].algorithm = algorithm;
 900 }
 901
 902 static int b43_key_write(struct b43_wldev *dev,
 903                          int index, u8 algorithm,
 904                          const u8 * key, size_t key_len,
 905                          const u8 * mac_addr,
 906                          struct ieee80211_key_conf *keyconf)
 907 {
 908         int i;
 909         int sta_keys_start;
 910
 911         if (key_len > B43_SEC_KEYSIZE)
 912                 return -EINVAL;
 913         for (i = 0; i < dev->max_nr_keys; i++) {
 914                 /* Check that we don't already have this key. */
 915                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 916         }
 917         if (index < 0) {
 918                 /* Either pairwise key or address is 00:00:00:00:00:00
 919                  * for transmit-only keys. Search the index. */
 920                 if (b43_new_kidx_api(dev))
 921                         sta_keys_start = 4;
 922                 else
 923                         sta_keys_start = 8;
 924                 for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
 925                         if (!dev->key[i].keyconf) {
 926                                 /* found empty */
 927                                 index = i;
 928                                 break;
 929                         }
 930                 }
 931                 if (index < 0) {
 932                         b43err(dev->wl, "Out of hardware key memory\n");
 933                         return -ENOSPC;
 934                 }
 935         } else
 936                 B43_WARN_ON(index > 3);
 937
 938         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 939         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 940                 /* Default RX key */
 941                 B43_WARN_ON(mac_addr);
 942                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 943         }
 944         keyconf->hw_key_idx = index;
 945         dev->key[index].keyconf = keyconf;
 946
 947         return 0;
 948 }
 949
 950 static int b43_key_clear(struct b43_wldev *dev, int index)
 951 {
 952         if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
 953                 return -EINVAL;
 954         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 955                      NULL, B43_SEC_KEYSIZE, NULL);
 956         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 957                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 958                              NULL, B43_SEC_KEYSIZE, NULL);
 959         }
 960         dev->key[index].keyconf = NULL;
 961
 962         return 0;
 963 }
 964
 965 static void b43_clear_keys(struct b43_wldev *dev)
 966 {
 967         int i;
 968
 969         for (i = 0; i < dev->max_nr_keys; i++)
 970                 b43_key_clear(dev, i);
 971 }
 972
 973 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 974 {
 975         u32 macctl;
 976         u16 ucstat;
 977         bool hwps;
 978         bool awake;
 979         int i;
 980
 981         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
 982                     (ps_flags & B43_PS_DISABLED));
 983         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
 984
 985         if (ps_flags & B43_PS_ENABLED) {
 986                 hwps = 1;
 987         } else if (ps_flags & B43_PS_DISABLED) {
 988                 hwps = 0;
 989         } else {
 990                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
 991                 //      and thus is not an AP and we are associated, set bit 25
 992         }
 993         if (ps_flags & B43_PS_AWAKE) {
 994                 awake = 1;
 995         } else if (ps_flags & B43_PS_ASLEEP) {
 996                 awake = 0;
 997         } else {
 998                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
 999                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1000                 //      successful, set bit26
1001         }
1002
1003 /* FIXME: For now we force awake-on and hwps-off */
1004         hwps = 0;
1005         awake = 1;
1006
1007         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1008         if (hwps)
1009                 macctl |= B43_MACCTL_HWPS;
1010         else
1011                 macctl &= ~B43_MACCTL_HWPS;
1012         if (awake)
1013                 macctl |= B43_MACCTL_AWAKE;
1014         else
1015                 macctl &= ~B43_MACCTL_AWAKE;
1016         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1017         /* Commit write */
1018         b43_read32(dev, B43_MMIO_MACCTL);
1019         if (awake && dev->dev->id.revision >= 5) {
1020                 /* Wait for the microcode to wake up. */
1021                 for (i = 0; i < 100; i++) {
1022                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1023                                                 B43_SHM_SH_UCODESTAT);
1024                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1025                                 break;
1026                         udelay(10);
1027                 }
1028         }
1029 }
1030
1031 /* Turn the Analog ON/OFF */
1032 static void b43_switch_analog(struct b43_wldev *dev, int on)
1033 {
1034         switch (dev->phy.type) {
1035         case B43_PHYTYPE_A:
1036         case B43_PHYTYPE_G:
1037                 b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
1038                 break;
1039         case B43_PHYTYPE_N:
1040                 b43_phy_write(dev, B43_NPHY_AFECTL_OVER,
1041                               on ? 0 : 0x7FFF);
1042                 break;
1043         default:
1044                 B43_WARN_ON(1);
1045         }
1046 }
1047
1048 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1049 {
1050         u32 tmslow;
1051         u32 macctl;
1052
1053         flags |= B43_TMSLOW_PHYCLKEN;
1054         flags |= B43_TMSLOW_PHYRESET;
1055         ssb_device_enable(dev->dev, flags);
1056         msleep(2);              /* Wait for the PLL to turn on. */
1057
1058         /* Now take the PHY out of Reset again */
1059         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1060         tmslow |= SSB_TMSLOW_FGC;
1061         tmslow &= ~B43_TMSLOW_PHYRESET;
1062         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1063         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1064         msleep(1);
1065         tmslow &= ~SSB_TMSLOW_FGC;
1066         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1067         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1068         msleep(1);
1069
1070         /* Turn Analog ON */
1071         b43_switch_analog(dev, 1);
1072
1073         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1074         macctl &= ~B43_MACCTL_GMODE;
1075         if (flags & B43_TMSLOW_GMODE)
1076                 macctl |= B43_MACCTL_GMODE;
1077         macctl |= B43_MACCTL_IHR_ENABLED;
1078         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1079 }
1080
1081 static void handle_irq_transmit_status(struct b43_wldev *dev)
1082 {
1083         u32 v0, v1;
1084         u16 tmp;
1085         struct b43_txstatus stat;
1086
1087         while (1) {
1088                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1089                 if (!(v0 & 0x00000001))
1090                         break;
1091                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1092
1093                 stat.cookie = (v0 >> 16);
1094                 stat.seq = (v1 & 0x0000FFFF);
1095                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1096                 tmp = (v0 & 0x0000FFFF);
1097                 stat.frame_count = ((tmp & 0xF000) >> 12);
1098                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1099                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1100                 stat.pm_indicated = !!(tmp & 0x0080);
1101                 stat.intermediate = !!(tmp & 0x0040);
1102                 stat.for_ampdu = !!(tmp & 0x0020);
1103                 stat.acked = !!(tmp & 0x0002);
1104
1105                 b43_handle_txstatus(dev, &stat);
1106         }
1107 }
1108
1109 static void drain_txstatus_queue(struct b43_wldev *dev)
1110 {
1111         u32 dummy;
1112
1113         if (dev->dev->id.revision < 5)
1114                 return;
1115         /* Read all entries from the microcode TXstatus FIFO
1116          * and throw them away.
1117          */
1118         while (1) {
1119                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1120                 if (!(dummy & 0x00000001))
1121                         break;
1122                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1123         }
1124 }
1125
1126 static u32 b43_jssi_read(struct b43_wldev *dev)
1127 {
1128         u32 val = 0;
1129
1130         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1131         val <<= 16;
1132         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1133
1134         return val;
1135 }
1136
1137 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1138 {
1139         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1140         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1141 }
1142
1143 static void b43_generate_noise_sample(struct b43_wldev *dev)
1144 {
1145         b43_jssi_write(dev, 0x7F7F7F7F);
1146         b43_write32(dev, B43_MMIO_MACCMD,
1147                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1148         B43_WARN_ON(dev->noisecalc.channel_at_start != dev->phy.channel);
1149 }
1150
1151 static void b43_calculate_link_quality(struct b43_wldev *dev)
1152 {
1153         /* Top half of Link Quality calculation. */
1154
1155         if (dev->noisecalc.calculation_running)
1156                 return;
1157         dev->noisecalc.channel_at_start = dev->phy.channel;
1158         dev->noisecalc.calculation_running = 1;
1159         dev->noisecalc.nr_samples = 0;
1160
1161         b43_generate_noise_sample(dev);
1162 }
1163
1164 static void handle_irq_noise(struct b43_wldev *dev)
1165 {
1166         struct b43_phy *phy = &dev->phy;
1167         u16 tmp;
1168         u8 noise[4];
1169         u8 i, j;
1170         s32 average;
1171
1172         /* Bottom half of Link Quality calculation. */
1173
1174         B43_WARN_ON(!dev->noisecalc.calculation_running);
1175         if (dev->noisecalc.channel_at_start != phy->channel)
1176                 goto drop_calculation;
1177         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1178         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1179             noise[2] == 0x7F || noise[3] == 0x7F)
1180                 goto generate_new;
1181
1182         /* Get the noise samples. */
1183         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1184         i = dev->noisecalc.nr_samples;
1185         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1186         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1187         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1188         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1189         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1190         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1191         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1192         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1193         dev->noisecalc.nr_samples++;
1194         if (dev->noisecalc.nr_samples == 8) {
1195                 /* Calculate the Link Quality by the noise samples. */
1196                 average = 0;
1197                 for (i = 0; i < 8; i++) {
1198                         for (j = 0; j < 4; j++)
1199                                 average += dev->noisecalc.samples[i][j];
1200                 }
1201                 average /= (8 * 4);
1202                 average *= 125;
1203                 average += 64;
1204                 average /= 128;
1205                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1206                 tmp = (tmp / 128) & 0x1F;
1207                 if (tmp >= 8)
1208                         average += 2;
1209                 else
1210                         average -= 25;
1211                 if (tmp == 8)
1212                         average -= 72;
1213                 else
1214                         average -= 48;
1215
1216                 dev->stats.link_noise = average;
1217               drop_calculation:
1218                 dev->noisecalc.calculation_running = 0;
1219                 return;
1220         }
1221       generate_new:
1222         b43_generate_noise_sample(dev);
1223 }
1224
1225 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1226 {
1227         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP)) {
1228                 ///TODO: PS TBTT
1229         } else {
1230                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1231                         b43_power_saving_ctl_bits(dev, 0);
1232         }
1233         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
1234                 dev->dfq_valid = 1;
1235 }
1236
1237 static void handle_irq_atim_end(struct b43_wldev *dev)
1238 {
1239         if (dev->dfq_valid) {
1240                 b43_write32(dev, B43_MMIO_MACCMD,
1241                             b43_read32(dev, B43_MMIO_MACCMD)
1242                             | B43_MACCMD_DFQ_VALID);
1243                 dev->dfq_valid = 0;
1244         }
1245 }
1246
1247 static void handle_irq_pmq(struct b43_wldev *dev)
1248 {
1249         u32 tmp;
1250
1251         //TODO: AP mode.
1252
1253         while (1) {
1254                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1255                 if (!(tmp & 0x00000008))
1256                         break;
1257         }
1258         /* 16bit write is odd, but correct. */
1259         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1260 }
1261
1262 static void b43_write_template_common(struct b43_wldev *dev,
1263                                       const u8 * data, u16 size,
1264                                       u16 ram_offset,
1265                                       u16 shm_size_offset, u8 rate)
1266 {
1267         u32 i, tmp;
1268         struct b43_plcp_hdr4 plcp;
1269
1270         plcp.data = 0;
1271         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1272         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1273         ram_offset += sizeof(u32);
1274         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1275          * So leave the first two bytes of the next write blank.
1276          */
1277         tmp = (u32) (data[0]) << 16;
1278         tmp |= (u32) (data[1]) << 24;
1279         b43_ram_write(dev, ram_offset, tmp);
1280         ram_offset += sizeof(u32);
1281         for (i = 2; i < size; i += sizeof(u32)) {
1282                 tmp = (u32) (data[i + 0]);
1283                 if (i + 1 < size)
1284                         tmp |= (u32) (data[i + 1]) << 8;
1285                 if (i + 2 < size)
1286                         tmp |= (u32) (data[i + 2]) << 16;
1287                 if (i + 3 < size)
1288                         tmp |= (u32) (data[i + 3]) << 24;
1289                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1290         }
1291         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1292                         size + sizeof(struct b43_plcp_hdr6));
1293 }
1294
1295 /* Check if the use of the antenna that ieee80211 told us to
1296  * use is possible. This will fall back to DEFAULT.
1297  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1298 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1299                                   u8 antenna_nr)
1300 {
1301         u8 antenna_mask;
1302
1303         if (antenna_nr == 0) {
1304                 /* Zero means "use default antenna". That's always OK. */
1305                 return 0;
1306         }
1307
1308         /* Get the mask of available antennas. */
1309         if (dev->phy.gmode)
1310                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1311         else
1312                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1313
1314         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1315                 /* This antenna is not available. Fall back to default. */
1316                 return 0;
1317         }
1318
1319         return antenna_nr;
1320 }
1321
1322 static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
1323 {
1324         antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
1325         switch (antenna) {
1326         case 0:         /* default/diversity */
1327                 return B43_ANTENNA_DEFAULT;
1328         case 1:         /* Antenna 0 */
1329                 return B43_ANTENNA0;
1330         case 2:         /* Antenna 1 */
1331                 return B43_ANTENNA1;
1332         case 3:         /* Antenna 2 */
1333                 return B43_ANTENNA2;
1334         case 4:         /* Antenna 3 */
1335                 return B43_ANTENNA3;
1336         default:
1337                 return B43_ANTENNA_DEFAULT;
1338         }
1339 }
1340
1341 /* Convert a b43 antenna number value to the PHY TX control value. */
1342 static u16 b43_antenna_to_phyctl(int antenna)
1343 {
1344         switch (antenna) {
1345         case B43_ANTENNA0:
1346                 return B43_TXH_PHY_ANT0;
1347         case B43_ANTENNA1:
1348                 return B43_TXH_PHY_ANT1;
1349         case B43_ANTENNA2:
1350                 return B43_TXH_PHY_ANT2;
1351         case B43_ANTENNA3:
1352                 return B43_TXH_PHY_ANT3;
1353         case B43_ANTENNA_AUTO:
1354                 return B43_TXH_PHY_ANT01AUTO;
1355         }
1356         B43_WARN_ON(1);
1357         return 0;
1358 }
1359
1360 static void b43_write_beacon_template(struct b43_wldev *dev,
1361                                       u16 ram_offset,
1362                                       u16 shm_size_offset)
1363 {
1364         unsigned int i, len, variable_len;
1365         const struct ieee80211_mgmt *bcn;
1366         const u8 *ie;
1367         bool tim_found = 0;
1368         unsigned int rate;
1369         u16 ctl;
1370         int antenna;
1371         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1372
1373         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1374         len = min((size_t) dev->wl->current_beacon->len,
1375                   0x200 - sizeof(struct b43_plcp_hdr6));
1376         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1377
1378         b43_write_template_common(dev, (const u8 *)bcn,
1379                                   len, ram_offset, shm_size_offset, rate);
1380
1381         /* Write the PHY TX control parameters. */
1382         antenna = b43_antenna_from_ieee80211(dev, info->antenna_sel_tx);
1383         antenna = b43_antenna_to_phyctl(antenna);
1384         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1385         /* We can't send beacons with short preamble. Would get PHY errors. */
1386         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1387         ctl &= ~B43_TXH_PHY_ANT;
1388         ctl &= ~B43_TXH_PHY_ENC;
1389         ctl |= antenna;
1390         if (b43_is_cck_rate(rate))
1391                 ctl |= B43_TXH_PHY_ENC_CCK;
1392         else
1393                 ctl |= B43_TXH_PHY_ENC_OFDM;
1394         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1395
1396         /* Find the position of the TIM and the DTIM_period value
1397          * and write them to SHM. */
1398         ie = bcn->u.beacon.variable;
1399         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1400         for (i = 0; i < variable_len - 2; ) {
1401                 uint8_t ie_id, ie_len;
1402
1403                 ie_id = ie[i];
1404                 ie_len = ie[i + 1];
1405                 if (ie_id == 5) {
1406                         u16 tim_position;
1407                         u16 dtim_period;
1408                         /* This is the TIM Information Element */
1409
1410                         /* Check whether the ie_len is in the beacon data range. */
1411                         if (variable_len < ie_len + 2 + i)
1412                                 break;
1413                         /* A valid TIM is at least 4 bytes long. */
1414                         if (ie_len < 4)
1415                                 break;
1416                         tim_found = 1;
1417
1418                         tim_position = sizeof(struct b43_plcp_hdr6);
1419                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1420                         tim_position += i;
1421
1422                         dtim_period = ie[i + 3];
1423
1424                         b43_shm_write16(dev, B43_SHM_SHARED,
1425                                         B43_SHM_SH_TIMBPOS, tim_position);
1426                         b43_shm_write16(dev, B43_SHM_SHARED,
1427                                         B43_SHM_SH_DTIMPER, dtim_period);
1428                         break;
1429                 }
1430                 i += ie_len + 2;
1431         }
1432         if (!tim_found) {
1433                 /*
1434                  * If ucode wants to modify TIM do it behind the beacon, this
1435                  * will happen, for example, when doing mesh networking.
1436                  */
1437                 b43_shm_write16(dev, B43_SHM_SHARED,
1438                                 B43_SHM_SH_TIMBPOS,
1439                                 len + sizeof(struct b43_plcp_hdr6));
1440                 b43_shm_write16(dev, B43_SHM_SHARED,
1441                                 B43_SHM_SH_DTIMPER, 0);
1442         }
1443         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1444 }
1445
1446 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1447                                       u16 shm_offset, u16 size,
1448                                       struct ieee80211_rate *rate)
1449 {
1450         struct b43_plcp_hdr4 plcp;
1451         u32 tmp;
1452         __le16 dur;
1453
1454         plcp.data = 0;
1455         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1456         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1457                                                dev->wl->vif, size,
1458                                                rate);
1459         /* Write PLCP in two parts and timing for packet transfer */
1460         tmp = le32_to_cpu(plcp.data);
1461         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1462         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1463         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1464 }
1465
1466 /* Instead of using custom probe response template, this function
1467  * just patches custom beacon template by:
1468  * 1) Changing packet type
1469  * 2) Patching duration field
1470  * 3) Stripping TIM
1471  */
1472 static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1473                                           u16 *dest_size,
1474                                           struct ieee80211_rate *rate)
1475 {
1476         const u8 *src_data;
1477         u8 *dest_data;
1478         u16 src_size, elem_size, src_pos, dest_pos;
1479         __le16 dur;
1480         struct ieee80211_hdr *hdr;
1481         size_t ie_start;
1482
1483         src_size = dev->wl->current_beacon->len;
1484         src_data = (const u8 *)dev->wl->current_beacon->data;
1485
1486         /* Get the start offset of the variable IEs in the packet. */
1487         ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1488         B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1489
1490         if (B43_WARN_ON(src_size < ie_start))
1491                 return NULL;
1492
1493         dest_data = kmalloc(src_size, GFP_ATOMIC);
1494         if (unlikely(!dest_data))
1495                 return NULL;
1496
1497         /* Copy the static data and all Information Elements, except the TIM. */
1498         memcpy(dest_data, src_data, ie_start);
1499         src_pos = ie_start;
1500         dest_pos = ie_start;
1501         for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1502                 elem_size = src_data[src_pos + 1] + 2;
1503                 if (src_data[src_pos] == 5) {
1504                         /* This is the TIM. */
1505                         continue;
1506                 }
1507                 memcpy(dest_data + dest_pos, src_data + src_pos,
1508                        elem_size);
1509                 dest_pos += elem_size;
1510         }
1511         *dest_size = dest_pos;
1512         hdr = (struct ieee80211_hdr *)dest_data;
1513
1514         /* Set the frame control. */
1515         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1516                                          IEEE80211_STYPE_PROBE_RESP);
1517         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1518                                                dev->wl->vif, *dest_size,
1519                                                rate);
1520         hdr->duration_id = dur;
1521
1522         return dest_data;
1523 }
1524
1525 static void b43_write_probe_resp_template(struct b43_wldev *dev,
1526                                           u16 ram_offset,
1527                                           u16 shm_size_offset,
1528                                           struct ieee80211_rate *rate)
1529 {
1530         const u8 *probe_resp_data;
1531         u16 size;
1532
1533         size = dev->wl->current_beacon->len;
1534         probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1535         if (unlikely(!probe_resp_data))
1536                 return;
1537
1538         /* Looks like PLCP headers plus packet timings are stored for
1539          * all possible basic rates
1540          */
1541         b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1542         b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1543         b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1544         b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1545
1546         size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1547         b43_write_template_common(dev, probe_resp_data,
1548                                   size, ram_offset, shm_size_offset,
1549                                   rate->hw_value);
1550         kfree(probe_resp_data);
1551 }
1552
1553 static void handle_irq_beacon(struct b43_wldev *dev)
1554 {
1555         struct b43_wl *wl = dev->wl;
1556         u32 cmd, beacon0_valid, beacon1_valid;
1557
1558         if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP) &&
1559             !b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
1560                 return;
1561
1562         /* This is the bottom half of the asynchronous beacon update. */
1563
1564         /* Ignore interrupt in the future. */
1565         dev->irq_savedstate &= ~B43_IRQ_BEACON;
1566
1567         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1568         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1569         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1570
1571         /* Schedule interrupt manually, if busy. */
1572         if (beacon0_valid && beacon1_valid) {
1573                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1574                 dev->irq_savedstate |= B43_IRQ_BEACON;
1575                 return;
1576         }
1577
1578         if (!beacon0_valid) {
1579                 if (!wl->beacon0_uploaded) {
1580                         b43_write_beacon_template(dev, 0x68, 0x18);
1581                         b43_write_probe_resp_template(dev, 0x268, 0x4A,
1582                                                       &__b43_ratetable[3]);
1583                         wl->beacon0_uploaded = 1;
1584                 }
1585                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1586                 cmd |= B43_MACCMD_BEACON0_VALID;
1587                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1588         } else if (!beacon1_valid) {
1589                 if (!wl->beacon1_uploaded) {
1590                         b43_write_beacon_template(dev, 0x468, 0x1A);
1591                         wl->beacon1_uploaded = 1;
1592                 }
1593                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1594                 cmd |= B43_MACCMD_BEACON1_VALID;
1595                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1596         }
1597 }
1598
1599 static void b43_beacon_update_trigger_work(struct work_struct *work)
1600 {
1601         struct b43_wl *wl = container_of(work, struct b43_wl,
1602                                          beacon_update_trigger);
1603         struct b43_wldev *dev;
1604
1605         mutex_lock(&wl->mutex);
1606         dev = wl->current_dev;
1607         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1608                 spin_lock_irq(&wl->irq_lock);
1609                 /* update beacon right away or defer to irq */
1610                 dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1611                 handle_irq_beacon(dev);
1612                 /* The handler might have updated the IRQ mask. */
1613                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1614                             dev->irq_savedstate);
1615                 mmiowb();
1616                 spin_unlock_irq(&wl->irq_lock);
1617         }
1618         mutex_unlock(&wl->mutex);
1619 }
1620
1621 /* Asynchronously update the packet templates in template RAM.
1622  * Locking: Requires wl->irq_lock to be locked. */
1623 static void b43_update_templates(struct b43_wl *wl, struct sk_buff *beacon)
1624 {
1625         /* This is the top half of the ansynchronous beacon update.
1626          * The bottom half is the beacon IRQ.
1627          * Beacon update must be asynchronous to avoid sending an
1628          * invalid beacon. This can happen for example, if the firmware
1629          * transmits a beacon while we are updating it. */
1630
1631         if (wl->current_beacon)
1632                 dev_kfree_skb_any(wl->current_beacon);
1633         wl->current_beacon = beacon;
1634         wl->beacon0_uploaded = 0;
1635         wl->beacon1_uploaded = 0;
1636         queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1637 }
1638
1639 static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
1640 {
1641         u32 tmp;
1642         u16 i, len;
1643
1644         len = min((u16) ssid_len, (u16) 0x100);
1645         for (i = 0; i < len; i += sizeof(u32)) {
1646                 tmp = (u32) (ssid[i + 0]);
1647                 if (i + 1 < len)
1648                         tmp |= (u32) (ssid[i + 1]) << 8;
1649                 if (i + 2 < len)
1650                         tmp |= (u32) (ssid[i + 2]) << 16;
1651                 if (i + 3 < len)
1652                         tmp |= (u32) (ssid[i + 3]) << 24;
1653                 b43_shm_write32(dev, B43_SHM_SHARED, 0x380 + i, tmp);
1654         }
1655         b43_shm_write16(dev, B43_SHM_SHARED, 0x48, len);
1656 }
1657
1658 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1659 {
1660         b43_time_lock(dev);
1661         if (dev->dev->id.revision >= 3) {
1662                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1663                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1664         } else {
1665                 b43_write16(dev, 0x606, (beacon_int >> 6));
1666                 b43_write16(dev, 0x610, beacon_int);
1667         }
1668         b43_time_unlock(dev);
1669         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1670 }
1671
1672 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1673 {
1674         u16 reason;
1675
1676         /* Read the register that contains the reason code for the panic. */
1677         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1678         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1679
1680         switch (reason) {
1681         default:
1682                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1683                 /* fallthrough */
1684         case B43_FWPANIC_DIE:
1685                 /* Do not restart the controller or firmware.
1686                  * The device is nonfunctional from now on.
1687                  * Restarting would result in this panic to trigger again,
1688                  * so we avoid that recursion. */
1689                 break;
1690         case B43_FWPANIC_RESTART:
1691                 b43_controller_restart(dev, "Microcode panic");
1692                 break;
1693         }
1694 }
1695
1696 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1697 {
1698         unsigned int i, cnt;
1699         u16 reason, marker_id, marker_line;
1700         __le16 *buf;
1701
1702         /* The proprietary firmware doesn't have this IRQ. */
1703         if (!dev->fw.opensource)
1704                 return;
1705
1706         /* Read the register that contains the reason code for this IRQ. */
1707         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1708
1709         switch (reason) {
1710         case B43_DEBUGIRQ_PANIC:
1711                 b43_handle_firmware_panic(dev);
1712                 break;
1713         case B43_DEBUGIRQ_DUMP_SHM:
1714                 if (!B43_DEBUG)
1715                         break; /* Only with driver debugging enabled. */
1716                 buf = kmalloc(4096, GFP_ATOMIC);
1717                 if (!buf) {
1718                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1719                         goto out;
1720                 }
1721                 for (i = 0; i < 4096; i += 2) {
1722                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1723                         buf[i / 2] = cpu_to_le16(tmp);
1724                 }
1725                 b43info(dev->wl, "Shared memory dump:\n");
1726                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1727                                16, 2, buf, 4096, 1);
1728                 kfree(buf);
1729                 break;
1730         case B43_DEBUGIRQ_DUMP_REGS:
1731                 if (!B43_DEBUG)
1732                         break; /* Only with driver debugging enabled. */
1733                 b43info(dev->wl, "Microcode register dump:\n");
1734                 for (i = 0, cnt = 0; i < 64; i++) {
1735                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1736                         if (cnt == 0)
1737                                 printk(KERN_INFO);
1738                         printk("r%02u: 0x%04X  ", i, tmp);
1739                         cnt++;
1740                         if (cnt == 6) {
1741                                 printk("\n");
1742                                 cnt = 0;
1743                         }
1744                 }
1745                 printk("\n");
1746                 break;
1747         case B43_DEBUGIRQ_MARKER:
1748                 if (!B43_DEBUG)
1749                         break; /* Only with driver debugging enabled. */
1750                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1751                                            B43_MARKER_ID_REG);
1752                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1753                                              B43_MARKER_LINE_REG);
1754                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1755                         "at line number %u\n",
1756                         marker_id, marker_line);
1757                 break;
1758         default:
1759                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1760                        reason);
1761         }
1762 out:
1763         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1764         b43_shm_write16(dev, B43_SHM_SCRATCH,
1765                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1766 }
1767
1768 /* Interrupt handler bottom-half */
1769 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1770 {
1771         u32 reason;
1772         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1773         u32 merged_dma_reason = 0;
1774         int i;
1775         unsigned long flags;
1776
1777         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1778
1779         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1780
1781         reason = dev->irq_reason;
1782         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1783                 dma_reason[i] = dev->dma_reason[i];
1784                 merged_dma_reason |= dma_reason[i];
1785         }
1786
1787         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1788                 b43err(dev->wl, "MAC transmission error\n");
1789
1790         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1791                 b43err(dev->wl, "PHY transmission error\n");
1792                 rmb();
1793                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1794                         atomic_set(&dev->phy.txerr_cnt,
1795                                    B43_PHY_TX_BADNESS_LIMIT);
1796                         b43err(dev->wl, "Too many PHY TX errors, "
1797                                         "restarting the controller\n");
1798                         b43_controller_restart(dev, "PHY TX errors");
1799                 }
1800         }
1801
1802         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1803                                           B43_DMAIRQ_NONFATALMASK))) {
1804                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1805                         b43err(dev->wl, "Fatal DMA error: "
1806                                "0x%08X, 0x%08X, 0x%08X, "
1807                                "0x%08X, 0x%08X, 0x%08X\n",
1808                                dma_reason[0], dma_reason[1],
1809                                dma_reason[2], dma_reason[3],
1810                                dma_reason[4], dma_reason[5]);
1811                         b43_controller_restart(dev, "DMA error");
1812                         mmiowb();
1813                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1814                         return;
1815                 }
1816                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1817                         b43err(dev->wl, "DMA error: "
1818                                "0x%08X, 0x%08X, 0x%08X, "
1819                                "0x%08X, 0x%08X, 0x%08X\n",
1820                                dma_reason[0], dma_reason[1],
1821                                dma_reason[2], dma_reason[3],
1822                                dma_reason[4], dma_reason[5]);
1823                 }
1824         }
1825
1826         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1827                 handle_irq_ucode_debug(dev);
1828         if (reason & B43_IRQ_TBTT_INDI)
1829                 handle_irq_tbtt_indication(dev);
1830         if (reason & B43_IRQ_ATIM_END)
1831                 handle_irq_atim_end(dev);
1832         if (reason & B43_IRQ_BEACON)
1833                 handle_irq_beacon(dev);
1834         if (reason & B43_IRQ_PMQ)
1835                 handle_irq_pmq(dev);
1836         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1837                 ;/* TODO */
1838         if (reason & B43_IRQ_NOISESAMPLE_OK)
1839                 handle_irq_noise(dev);
1840
1841         /* Check the DMA reason registers for received data. */
1842         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1843                 if (b43_using_pio_transfers(dev))
1844                         b43_pio_rx(dev->pio.rx_queue);
1845                 else
1846                         b43_dma_rx(dev->dma.rx_ring);
1847         }
1848         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1849         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1850         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1851         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1852         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1853
1854         if (reason & B43_IRQ_TX_OK)
1855                 handle_irq_transmit_status(dev);
1856
1857         b43_interrupt_enable(dev, dev->irq_savedstate);
1858         mmiowb();
1859         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1860 }
1861
1862 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1863 {
1864         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1865
1866         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1867         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1868         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1869         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1870         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1871         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1872 }
1873
1874 /* Interrupt handler top-half */
1875 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1876 {
1877         irqreturn_t ret = IRQ_NONE;
1878         struct b43_wldev *dev = dev_id;
1879         u32 reason;
1880
1881         if (!dev)
1882                 return IRQ_NONE;
1883
1884         spin_lock(&dev->wl->irq_lock);
1885
1886         if (b43_status(dev) < B43_STAT_STARTED)
1887                 goto out;
1888         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1889         if (reason == 0xffffffff)       /* shared IRQ */
1890                 goto out;
1891         ret = IRQ_HANDLED;
1892         reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1893         if (!reason)
1894                 goto out;
1895
1896         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1897             & 0x0001DC00;
1898         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1899             & 0x0000DC00;
1900         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1901             & 0x0000DC00;
1902         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1903             & 0x0001DC00;
1904         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1905             & 0x0000DC00;
1906         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1907             & 0x0000DC00;
1908
1909         b43_interrupt_ack(dev, reason);
1910         /* disable all IRQs. They are enabled again in the bottom half. */
1911         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1912         /* save the reason code and call our bottom half. */
1913         dev->irq_reason = reason;
1914         tasklet_schedule(&dev->isr_tasklet);
1915       out:
1916         mmiowb();
1917         spin_unlock(&dev->wl->irq_lock);
1918
1919         return ret;
1920 }
1921
1922 static void do_release_fw(struct b43_firmware_file *fw)
1923 {
1924         release_firmware(fw->data);
1925         fw->data = NULL;
1926         fw->filename = NULL;
1927 }
1928
1929 static void b43_release_firmware(struct b43_wldev *dev)
1930 {
1931         do_release_fw(&dev->fw.ucode);
1932         do_release_fw(&dev->fw.pcm);
1933         do_release_fw(&dev->fw.initvals);
1934         do_release_fw(&dev->fw.initvals_band);
1935 }
1936
1937 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1938 {
1939         const char *text;
1940
1941         text = "You must go to "
1942                "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1943                "and download the latest firmware (version 4).\n";
1944         if (error)
1945                 b43err(wl, text);
1946         else
1947                 b43warn(wl, text);
1948 }
1949
1950 static int do_request_fw(struct b43_wldev *dev,
1951                          const char *name,
1952                          struct b43_firmware_file *fw,
1953                          bool silent)
1954 {
1955         char path[sizeof(modparam_fwpostfix) + 32];
1956         const struct firmware *blob;
1957         struct b43_fw_header *hdr;
1958         u32 size;
1959         int err;
1960
1961         if (!name) {
1962                 /* Don't fetch anything. Free possibly cached firmware. */
1963                 do_release_fw(fw);
1964                 return 0;
1965         }
1966         if (fw->filename) {
1967                 if (strcmp(fw->filename, name) == 0)
1968                         return 0; /* Already have this fw. */
1969                 /* Free the cached firmware first. */
1970                 do_release_fw(fw);
1971         }
1972
1973         snprintf(path, ARRAY_SIZE(path),
1974                  "b43%s/%s.fw",
1975                  modparam_fwpostfix, name);
1976         err = request_firmware(&blob, path, dev->dev->dev);
1977         if (err == -ENOENT) {
1978                 if (!silent) {
1979                         b43err(dev->wl, "Firmware file \"%s\" not found\n",
1980                                path);
1981                 }
1982                 return err;
1983         } else if (err) {
1984                 b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
1985                        path, err);
1986                 return err;
1987         }
1988         if (blob->size < sizeof(struct b43_fw_header))
1989                 goto err_format;
1990         hdr = (struct b43_fw_header *)(blob->data);
1991         switch (hdr->type) {
1992         case B43_FW_TYPE_UCODE:
1993         case B43_FW_TYPE_PCM:
1994                 size = be32_to_cpu(hdr->size);
1995                 if (size != blob->size - sizeof(struct b43_fw_header))
1996                         goto err_format;
1997                 /* fallthrough */
1998         case B43_FW_TYPE_IV:
1999                 if (hdr->ver != 1)
2000                         goto err_format;
2001                 break;
2002         default:
2003                 goto err_format;
2004         }
2005
2006         fw->data = blob;
2007         fw->filename = name;
2008
2009         return 0;
2010
2011 err_format:
2012         b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2013         release_firmware(blob);
2014
2015         return -EPROTO;
2016 }
2017
2018 static int b43_request_firmware(struct b43_wldev *dev)
2019 {
2020         struct b43_firmware *fw = &dev->fw;
2021         const u8 rev = dev->dev->id.revision;
2022         const char *filename;
2023         u32 tmshigh;
2024         int err;
2025
2026         /* Get microcode */
2027         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2028         if ((rev >= 5) && (rev <= 10))
2029                 filename = "ucode5";
2030         else if ((rev >= 11) && (rev <= 12))
2031                 filename = "ucode11";
2032         else if (rev >= 13)
2033                 filename = "ucode13";
2034         else
2035                 goto err_no_ucode;
2036         err = do_request_fw(dev, filename, &fw->ucode, 0);
2037         if (err)
2038                 goto err_load;
2039
2040         /* Get PCM code */
2041         if ((rev >= 5) && (rev <= 10))
2042                 filename = "pcm5";
2043         else if (rev >= 11)
2044                 filename = NULL;
2045         else
2046                 goto err_no_pcm;
2047         fw->pcm_request_failed = 0;
2048         err = do_request_fw(dev, filename, &fw->pcm, 1);
2049         if (err == -ENOENT) {
2050                 /* We did not find a PCM file? Not fatal, but
2051                  * core rev <= 10 must do without hwcrypto then. */
2052                 fw->pcm_request_failed = 1;
2053         } else if (err)
2054                 goto err_load;
2055
2056         /* Get initvals */
2057         switch (dev->phy.type) {
2058         case B43_PHYTYPE_A:
2059                 if ((rev >= 5) && (rev <= 10)) {
2060                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2061                                 filename = "a0g1initvals5";
2062                         else
2063                                 filename = "a0g0initvals5";
2064                 } else
2065                         goto err_no_initvals;
2066                 break;
2067         case B43_PHYTYPE_G:
2068                 if ((rev >= 5) && (rev <= 10))
2069                         filename = "b0g0initvals5";
2070                 else if (rev >= 13)
2071                         filename = "b0g0initvals13";
2072                 else
2073                         goto err_no_initvals;
2074                 break;
2075         case B43_PHYTYPE_N:
2076                 if ((rev >= 11) && (rev <= 12))
2077                         filename = "n0initvals11";
2078                 else
2079                         goto err_no_initvals;
2080                 break;
2081         default:
2082                 goto err_no_initvals;
2083         }
2084         err = do_request_fw(dev, filename, &fw->initvals, 0);
2085         if (err)
2086                 goto err_load;
2087
2088         /* Get bandswitch initvals */
2089         switch (dev->phy.type) {
2090         case B43_PHYTYPE_A:
2091                 if ((rev >= 5) && (rev <= 10)) {
2092                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2093                                 filename = "a0g1bsinitvals5";
2094                         else
2095                                 filename = "a0g0bsinitvals5";
2096                 } else if (rev >= 11)
2097                         filename = NULL;
2098                 else
2099                         goto err_no_initvals;
2100                 break;
2101         case B43_PHYTYPE_G:
2102                 if ((rev >= 5) && (rev <= 10))
2103                         filename = "b0g0bsinitvals5";
2104                 else if (rev >= 11)
2105                         filename = NULL;
2106                 else
2107                         goto err_no_initvals;
2108                 break;
2109         case B43_PHYTYPE_N:
2110                 if ((rev >= 11) && (rev <= 12))
2111                         filename = "n0bsinitvals11";
2112                 else
2113                         goto err_no_initvals;
2114                 break;
2115         default:
2116                 goto err_no_initvals;
2117         }
2118         err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2119         if (err)
2120                 goto err_load;
2121
2122         return 0;
2123
2124 err_load:
2125         b43_print_fw_helptext(dev->wl, 1);
2126         goto error;
2127
2128 err_no_ucode:
2129         err = -ENODEV;
2130         b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2131         goto error;
2132
2133 err_no_pcm:
2134         err = -ENODEV;
2135         b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2136         goto error;
2137
2138 err_no_initvals:
2139         err = -ENODEV;
2140         b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2141                "core rev %u\n", dev->phy.type, rev);
2142         goto error;
2143
2144 error:
2145         b43_release_firmware(dev);
2146         return err;
2147 }
2148
2149 static int b43_upload_microcode(struct b43_wldev *dev)
2150 {
2151         const size_t hdr_len = sizeof(struct b43_fw_header);
2152         const __be32 *data;
2153         unsigned int i, len;
2154         u16 fwrev, fwpatch, fwdate, fwtime;
2155         u32 tmp, macctl;
2156         int err = 0;
2157
2158         /* Jump the microcode PSM to offset 0 */
2159         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2160         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2161         macctl |= B43_MACCTL_PSM_JMP0;
2162         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2163         /* Zero out all microcode PSM registers and shared memory. */
2164         for (i = 0; i < 64; i++)
2165                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2166         for (i = 0; i < 4096; i += 2)
2167                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2168
2169         /* Upload Microcode. */
2170         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2171         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2172         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2173         for (i = 0; i < len; i++) {
2174                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2175                 udelay(10);
2176         }
2177
2178         if (dev->fw.pcm.data) {
2179                 /* Upload PCM data. */
2180                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2181                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2182                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2183                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2184                 /* No need for autoinc bit in SHM_HW */
2185                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2186                 for (i = 0; i < len; i++) {
2187                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2188                         udelay(10);
2189                 }
2190         }
2191
2192         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2193
2194         /* Start the microcode PSM */
2195         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2196         macctl &= ~B43_MACCTL_PSM_JMP0;
2197         macctl |= B43_MACCTL_PSM_RUN;
2198         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2199
2200         /* Wait for the microcode to load and respond */
2201         i = 0;
2202         while (1) {
2203                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2204                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2205                         break;
2206                 i++;
2207                 if (i >= 20) {
2208                         b43err(dev->wl, "Microcode not responding\n");
2209                         b43_print_fw_helptext(dev->wl, 1);
2210                         err = -ENODEV;
2211                         goto error;
2212                 }
2213                 msleep_interruptible(50);
2214                 if (signal_pending(current)) {
2215                         err = -EINTR;
2216                         goto error;
2217                 }
2218         }
2219         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2220
2221         /* Get and check the revisions. */
2222         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2223         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2224         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2225         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2226
2227         if (fwrev <= 0x128) {
2228                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2229                        "binary drivers older than version 4.x is unsupported. "
2230                        "You must upgrade your firmware files.\n");
2231                 b43_print_fw_helptext(dev->wl, 1);
2232                 err = -EOPNOTSUPP;
2233                 goto error;
2234         }
2235         dev->fw.rev = fwrev;
2236         dev->fw.patch = fwpatch;
2237         dev->fw.opensource = (fwdate == 0xFFFF);
2238
2239         if (dev->fw.opensource) {
2240                 /* Patchlevel info is encoded in the "time" field. */
2241                 dev->fw.patch = fwtime;
2242                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2243                         dev->fw.rev, dev->fw.patch,
2244                         dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2245         } else {
2246                 b43info(dev->wl, "Loading firmware version %u.%u "
2247                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2248                         fwrev, fwpatch,
2249                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2250                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2251                 if (dev->fw.pcm_request_failed) {
2252                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2253                                 "Hardware accelerated cryptography is disabled.\n");
2254                         b43_print_fw_helptext(dev->wl, 0);
2255                 }
2256         }
2257
2258         if (b43_is_old_txhdr_format(dev)) {
2259                 b43warn(dev->wl, "You are using an old firmware image. "
2260                         "Support for old firmware will be removed in July 2008.\n");
2261                 b43_print_fw_helptext(dev->wl, 0);
2262         }
2263
2264         return 0;
2265
2266 error:
2267         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2268         macctl &= ~B43_MACCTL_PSM_RUN;
2269         macctl |= B43_MACCTL_PSM_JMP0;
2270         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2271
2272         return err;
2273 }
2274
2275 static int b43_write_initvals(struct b43_wldev *dev,
2276                               const struct b43_iv *ivals,
2277                               size_t count,
2278                               size_t array_size)
2279 {
2280         const struct b43_iv *iv;
2281         u16 offset;
2282         size_t i;
2283         bool bit32;
2284
2285         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2286         iv = ivals;
2287         for (i = 0; i < count; i++) {
2288                 if (array_size < sizeof(iv->offset_size))
2289                         goto err_format;
2290                 array_size -= sizeof(iv->offset_size);
2291                 offset = be16_to_cpu(iv->offset_size);
2292                 bit32 = !!(offset & B43_IV_32BIT);
2293                 offset &= B43_IV_OFFSET_MASK;
2294                 if (offset >= 0x1000)
2295                         goto err_format;
2296                 if (bit32) {
2297                         u32 value;
2298
2299                         if (array_size < sizeof(iv->data.d32))
2300                                 goto err_format;
2301                         array_size -= sizeof(iv->data.d32);
2302
2303                         value = get_unaligned_be32(&iv->data.d32);
2304                         b43_write32(dev, offset, value);
2305
2306                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2307                                                         sizeof(__be16) +
2308                                                         sizeof(__be32));
2309                 } else {
2310                         u16 value;
2311
2312                         if (array_size < sizeof(iv->data.d16))
2313                                 goto err_format;
2314                         array_size -= sizeof(iv->data.d16);
2315
2316                         value = be16_to_cpu(iv->data.d16);
2317                         b43_write16(dev, offset, value);
2318
2319                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2320                                                         sizeof(__be16) +
2321                                                         sizeof(__be16));
2322                 }
2323         }
2324         if (array_size)
2325                 goto err_format;
2326
2327         return 0;
2328
2329 err_format:
2330         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2331         b43_print_fw_helptext(dev->wl, 1);
2332
2333         return -EPROTO;
2334 }
2335
2336 static int b43_upload_initvals(struct b43_wldev *dev)
2337 {
2338         const size_t hdr_len = sizeof(struct b43_fw_header);
2339         const struct b43_fw_header *hdr;
2340         struct b43_firmware *fw = &dev->fw;
2341         const struct b43_iv *ivals;
2342         size_t count;
2343         int err;
2344
2345         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2346         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2347         count = be32_to_cpu(hdr->size);
2348         err = b43_write_initvals(dev, ivals, count,
2349                                  fw->initvals.data->size - hdr_len);
2350         if (err)
2351                 goto out;
2352         if (fw->initvals_band.data) {
2353                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2354                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2355                 count = be32_to_cpu(hdr->size);
2356                 err = b43_write_initvals(dev, ivals, count,
2357                                          fw->initvals_band.data->size - hdr_len);
2358                 if (err)
2359                         goto out;
2360         }
2361 out:
2362
2363         return err;
2364 }
2365
2366 /* Initialize the GPIOs
2367  * http://bcm-specs.sipsolutions.net/GPIO
2368  */
2369 static int b43_gpio_init(struct b43_wldev *dev)
2370 {
2371         struct ssb_bus *bus = dev->dev->bus;
2372         struct ssb_device *gpiodev, *pcidev = NULL;
2373         u32 mask, set;
2374
2375         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2376                     & ~B43_MACCTL_GPOUTSMSK);
2377
2378         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2379                     | 0x000F);
2380
2381         mask = 0x0000001F;
2382         set = 0x0000000F;
2383         if (dev->dev->bus->chip_id == 0x4301) {
2384                 mask |= 0x0060;
2385                 set |= 0x0060;
2386         }
2387         if (0 /* FIXME: conditional unknown */ ) {
2388                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2389                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2390                             | 0x0100);
2391                 mask |= 0x0180;
2392                 set |= 0x0180;
2393         }
2394         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2395                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2396                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2397                             | 0x0200);
2398                 mask |= 0x0200;
2399                 set |= 0x0200;
2400         }
2401         if (dev->dev->id.revision >= 2)
2402                 mask |= 0x0010; /* FIXME: This is redundant. */
2403
2404 #ifdef CONFIG_SSB_DRIVER_PCICORE
2405         pcidev = bus->pcicore.dev;
2406 #endif
2407         gpiodev = bus->chipco.dev ? : pcidev;
2408         if (!gpiodev)
2409                 return 0;
2410         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2411                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2412                      & mask) | set);
2413
2414         return 0;
2415 }
2416
2417 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2418 static void b43_gpio_cleanup(struct b43_wldev *dev)
2419 {
2420         struct ssb_bus *bus = dev->dev->bus;
2421         struct ssb_device *gpiodev, *pcidev = NULL;
2422
2423 #ifdef CONFIG_SSB_DRIVER_PCICORE
2424         pcidev = bus->pcicore.dev;
2425 #endif
2426         gpiodev = bus->chipco.dev ? : pcidev;
2427         if (!gpiodev)
2428                 return;
2429         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2430 }
2431
2432 /* http://bcm-specs.sipsolutions.net/EnableMac */
2433 void b43_mac_enable(struct b43_wldev *dev)
2434 {
2435         dev->mac_suspended--;
2436         B43_WARN_ON(dev->mac_suspended < 0);
2437         if (dev->mac_suspended == 0) {
2438                 b43_write32(dev, B43_MMIO_MACCTL,
2439                             b43_read32(dev, B43_MMIO_MACCTL)
2440                             | B43_MACCTL_ENABLED);
2441                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2442                             B43_IRQ_MAC_SUSPENDED);
2443                 /* Commit writes */
2444                 b43_read32(dev, B43_MMIO_MACCTL);
2445                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2446                 b43_power_saving_ctl_bits(dev, 0);
2447         }
2448 }
2449
2450 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2451 void b43_mac_suspend(struct b43_wldev *dev)
2452 {
2453         int i;
2454         u32 tmp;
2455
2456         might_sleep();
2457         B43_WARN_ON(dev->mac_suspended < 0);
2458
2459         if (dev->mac_suspended == 0) {
2460                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2461                 b43_write32(dev, B43_MMIO_MACCTL,
2462                             b43_read32(dev, B43_MMIO_MACCTL)
2463                             & ~B43_MACCTL_ENABLED);
2464                 /* force pci to flush the write */
2465                 b43_read32(dev, B43_MMIO_MACCTL);
2466                 for (i = 35; i; i--) {
2467                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2468                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2469                                 goto out;
2470                         udelay(10);
2471                 }
2472                 /* Hm, it seems this will take some time. Use msleep(). */
2473                 for (i = 40; i; i--) {
2474                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2475                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2476                                 goto out;
2477                         msleep(1);
2478                 }
2479                 b43err(dev->wl, "MAC suspend failed\n");
2480         }
2481 out:
2482         dev->mac_suspended++;
2483 }
2484
2485 static void b43_adjust_opmode(struct b43_wldev *dev)
2486 {
2487         struct b43_wl *wl = dev->wl;
2488         u32 ctl;
2489         u16 cfp_pretbtt;
2490
2491         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2492         /* Reset status to STA infrastructure mode. */
2493         ctl &= ~B43_MACCTL_AP;
2494         ctl &= ~B43_MACCTL_KEEP_CTL;
2495         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2496         ctl &= ~B43_MACCTL_KEEP_BAD;
2497         ctl &= ~B43_MACCTL_PROMISC;
2498         ctl &= ~B43_MACCTL_BEACPROMISC;
2499         ctl |= B43_MACCTL_INFRA;
2500
2501         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
2502             b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
2503                 ctl |= B43_MACCTL_AP;
2504         else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS))
2505                 ctl &= ~B43_MACCTL_INFRA;
2506
2507         if (wl->filter_flags & FIF_CONTROL)
2508                 ctl |= B43_MACCTL_KEEP_CTL;
2509         if (wl->filter_flags & FIF_FCSFAIL)
2510                 ctl |= B43_MACCTL_KEEP_BAD;
2511         if (wl->filter_flags & FIF_PLCPFAIL)
2512                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2513         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2514                 ctl |= B43_MACCTL_PROMISC;
2515         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2516                 ctl |= B43_MACCTL_BEACPROMISC;
2517
2518         /* Workaround: On old hardware the HW-MAC-address-filter
2519          * doesn't work properly, so always run promisc in filter
2520          * it in software. */
2521         if (dev->dev->id.revision <= 4)
2522                 ctl |= B43_MACCTL_PROMISC;
2523
2524         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2525
2526         cfp_pretbtt = 2;
2527         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2528                 if (dev->dev->bus->chip_id == 0x4306 &&
2529                     dev->dev->bus->chip_rev == 3)
2530                         cfp_pretbtt = 100;
2531                 else
2532                         cfp_pretbtt = 50;
2533         }
2534         b43_write16(dev, 0x612, cfp_pretbtt);
2535 }
2536
2537 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2538 {
2539         u16 offset;
2540
2541         if (is_ofdm) {
2542                 offset = 0x480;
2543                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2544         } else {
2545                 offset = 0x4C0;
2546                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2547         }
2548         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2549                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2550 }
2551
2552 static void b43_rate_memory_init(struct b43_wldev *dev)
2553 {
2554         switch (dev->phy.type) {
2555         case B43_PHYTYPE_A:
2556         case B43_PHYTYPE_G:
2557         case B43_PHYTYPE_N:
2558                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2559                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2560                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2561                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2562                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2563                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2564                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2565                 if (dev->phy.type == B43_PHYTYPE_A)
2566                         break;
2567                 /* fallthrough */
2568         case B43_PHYTYPE_B:
2569                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2570                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2571                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2572                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2573                 break;
2574         default:
2575                 B43_WARN_ON(1);
2576         }
2577 }
2578
2579 /* Set the default values for the PHY TX Control Words. */
2580 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2581 {
2582         u16 ctl = 0;
2583
2584         ctl |= B43_TXH_PHY_ENC_CCK;
2585         ctl |= B43_TXH_PHY_ANT01AUTO;
2586         ctl |= B43_TXH_PHY_TXPWR;
2587
2588         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2589         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2590         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2591 }
2592
2593 /* Set the TX-Antenna for management frames sent by firmware. */
2594 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2595 {
2596         u16 ant;
2597         u16 tmp;
2598
2599         ant = b43_antenna_to_phyctl(antenna);
2600
2601         /* For ACK/CTS */
2602         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2603         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2604         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2605         /* For Probe Resposes */
2606         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2607         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2608         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2609 }
2610
2611 /* This is the opposite of b43_chip_init() */
2612 static void b43_chip_exit(struct b43_wldev *dev)
2613 {
2614         b43_radio_turn_off(dev, 1);
2615         b43_gpio_cleanup(dev);
2616         b43_lo_g_cleanup(dev);
2617         /* firmware is released later */
2618 }
2619
2620 /* Initialize the chip
2621  * http://bcm-specs.sipsolutions.net/ChipInit
2622  */
2623 static int b43_chip_init(struct b43_wldev *dev)
2624 {
2625         struct b43_phy *phy = &dev->phy;
2626         int err, tmp;
2627         u32 value32, macctl;
2628         u16 value16;
2629
2630         /* Initialize the MAC control */
2631         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2632         if (dev->phy.gmode)
2633                 macctl |= B43_MACCTL_GMODE;
2634         macctl |= B43_MACCTL_INFRA;
2635         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2636
2637         err = b43_request_firmware(dev);
2638         if (err)
2639                 goto out;
2640         err = b43_upload_microcode(dev);
2641         if (err)
2642                 goto out;       /* firmware is released later */
2643
2644         err = b43_gpio_init(dev);
2645         if (err)
2646                 goto out;       /* firmware is released later */
2647
2648         err = b43_upload_initvals(dev);
2649         if (err)
2650                 goto err_gpio_clean;
2651         b43_radio_turn_on(dev);
2652
2653         b43_write16(dev, 0x03E6, 0x0000);
2654         err = b43_phy_init(dev);
2655         if (err)
2656                 goto err_radio_off;
2657
2658         /* Select initial Interference Mitigation. */
2659         tmp = phy->interfmode;
2660         phy->interfmode = B43_INTERFMODE_NONE;
2661         b43_radio_set_interference_mitigation(dev, tmp);
2662
2663         b43_set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2664         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2665
2666         if (phy->type == B43_PHYTYPE_B) {
2667                 value16 = b43_read16(dev, 0x005E);
2668                 value16 |= 0x0004;
2669                 b43_write16(dev, 0x005E, value16);
2670         }
2671         b43_write32(dev, 0x0100, 0x01000000);
2672         if (dev->dev->id.revision < 5)
2673                 b43_write32(dev, 0x010C, 0x01000000);
2674
2675         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2676                     & ~B43_MACCTL_INFRA);
2677         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2678                     | B43_MACCTL_INFRA);
2679
2680         /* Probe Response Timeout value */
2681         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2682         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2683
2684         /* Initially set the wireless operation mode. */
2685         b43_adjust_opmode(dev);
2686
2687         if (dev->dev->id.revision < 3) {
2688                 b43_write16(dev, 0x060E, 0x0000);
2689                 b43_write16(dev, 0x0610, 0x8000);
2690                 b43_write16(dev, 0x0604, 0x0000);
2691                 b43_write16(dev, 0x0606, 0x0200);
2692         } else {
2693                 b43_write32(dev, 0x0188, 0x80000000);
2694                 b43_write32(dev, 0x018C, 0x02000000);
2695         }
2696         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2697         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2698         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2699         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2700         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2701         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2702         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2703
2704         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2705         value32 |= 0x00100000;
2706         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2707
2708         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2709                     dev->dev->bus->chipco.fast_pwrup_delay);
2710
2711         err = 0;
2712         b43dbg(dev->wl, "Chip initialized\n");
2713 out:
2714         return err;
2715
2716 err_radio_off:
2717         b43_radio_turn_off(dev, 1);
2718 err_gpio_clean:
2719         b43_gpio_cleanup(dev);
2720         return err;
2721 }
2722
2723 static void b43_periodic_every60sec(struct b43_wldev *dev)
2724 {
2725         struct b43_phy *phy = &dev->phy;
2726
2727         if (phy->type != B43_PHYTYPE_G)
2728                 return;
2729         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_RSSI) {
2730                 b43_mac_suspend(dev);
2731                 b43_calc_nrssi_slope(dev);
2732                 if ((phy->radio_ver == 0x2050) && (phy->radio_rev == 8)) {
2733                         u8 old_chan = phy->channel;
2734
2735                         /* VCO Calibration */
2736                         if (old_chan >= 8)
2737                                 b43_radio_selectchannel(dev, 1, 0);
2738                         else
2739                                 b43_radio_selectchannel(dev, 13, 0);
2740                         b43_radio_selectchannel(dev, old_chan, 0);
2741                 }
2742                 b43_mac_enable(dev);
2743         }
2744 }
2745
2746 static void b43_periodic_every30sec(struct b43_wldev *dev)
2747 {
2748         /* Update device statistics. */
2749         b43_calculate_link_quality(dev);
2750 }
2751
2752 static void b43_periodic_every15sec(struct b43_wldev *dev)
2753 {
2754         struct b43_phy *phy = &dev->phy;
2755
2756         if (phy->type == B43_PHYTYPE_G) {
2757                 //TODO: update_aci_moving_average
2758                 if (phy->aci_enable && phy->aci_wlan_automatic) {
2759                         b43_mac_suspend(dev);
2760                         if (!phy->aci_enable && 1 /*TODO: not scanning? */ ) {
2761                                 if (0 /*TODO: bunch of conditions */ ) {
2762                                         b43_radio_set_interference_mitigation
2763                                             (dev, B43_INTERFMODE_MANUALWLAN);
2764                                 }
2765                         } else if (1 /*TODO*/) {
2766                                 /*
2767                                    if ((aci_average > 1000) && !(b43_radio_aci_scan(dev))) {
2768                                    b43_radio_set_interference_mitigation(dev,
2769                                    B43_INTERFMODE_NONE);
2770                                    }
2771                                  */
2772                         }
2773                         b43_mac_enable(dev);
2774                 } else if (phy->interfmode == B43_INTERFMODE_NONWLAN &&
2775                            phy->rev == 1) {
2776                         //TODO: implement rev1 workaround
2777                 }
2778         }
2779         b43_phy_xmitpower(dev); //FIXME: unless scanning?
2780         b43_lo_g_maintanance_work(dev);
2781         //TODO for APHY (temperature?)
2782
2783         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2784         wmb();
2785 }
2786
2787 static void do_periodic_work(struct b43_wldev *dev)
2788 {
2789         unsigned int state;
2790
2791         state = dev->periodic_state;
2792         if (state % 4 == 0)
2793                 b43_periodic_every60sec(dev);
2794         if (state % 2 == 0)
2795                 b43_periodic_every30sec(dev);
2796         b43_periodic_every15sec(dev);
2797 }
2798
2799 /* Periodic work locking policy:
2800  *      The whole periodic work handler is protected by
2801  *      wl->mutex. If another lock is needed somewhere in the
2802  *      pwork callchain, it's aquired in-place, where it's needed.
2803  */
2804 static void b43_periodic_work_handler(struct work_struct *work)
2805 {
2806         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2807                                              periodic_work.work);
2808         struct b43_wl *wl = dev->wl;
2809         unsigned long delay;
2810
2811         mutex_lock(&wl->mutex);
2812
2813         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2814                 goto out;
2815         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2816                 goto out_requeue;
2817
2818         do_periodic_work(dev);
2819
2820         dev->periodic_state++;
2821 out_requeue:
2822         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2823                 delay = msecs_to_jiffies(50);
2824         else
2825                 delay = round_jiffies_relative(HZ * 15);
2826         queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2827 out:
2828         mutex_unlock(&wl->mutex);
2829 }
2830
2831 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2832 {
2833         struct delayed_work *work = &dev->periodic_work;
2834
2835         dev->periodic_state = 0;
2836         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2837         queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2838 }
2839
2840 /* Check if communication with the device works correctly. */
2841 static int b43_validate_chipaccess(struct b43_wldev *dev)
2842 {
2843         u32 v, backup;
2844
2845         backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2846
2847         /* Check for read/write and endianness problems. */
2848         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2849         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2850                 goto error;
2851         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2852         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2853                 goto error;
2854
2855         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2856
2857         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2858                 /* The 32bit register shadows the two 16bit registers
2859                  * with update sideeffects. Validate this. */
2860                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2861                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2862                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2863                         goto error;
2864                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2865                         goto error;
2866         }
2867         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2868
2869         v = b43_read32(dev, B43_MMIO_MACCTL);
2870         v |= B43_MACCTL_GMODE;
2871         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2872                 goto error;
2873
2874         return 0;
2875 error:
2876         b43err(dev->wl, "Failed to validate the chipaccess\n");
2877         return -ENODEV;
2878 }
2879
2880 static void b43_security_init(struct b43_wldev *dev)
2881 {
2882         dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2883         B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2884         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2885         /* KTP is a word address, but we address SHM bytewise.
2886          * So multiply by two.
2887          */
2888         dev->ktp *= 2;
2889         if (dev->dev->id.revision >= 5) {
2890                 /* Number of RCMTA address slots */
2891                 b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2892         }
2893         b43_clear_keys(dev);
2894 }
2895
2896 static int b43_rng_read(struct hwrng *rng, u32 * data)
2897 {
2898         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2899         unsigned long flags;
2900
2901         /* Don't take wl->mutex here, as it could deadlock with
2902          * hwrng internal locking. It's not needed to take
2903          * wl->mutex here, anyway. */
2904
2905         spin_lock_irqsave(&wl->irq_lock, flags);
2906         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2907         spin_unlock_irqrestore(&wl->irq_lock, flags);
2908
2909         return (sizeof(u16));
2910 }
2911
2912 static void b43_rng_exit(struct b43_wl *wl)
2913 {
2914         if (wl->rng_initialized)
2915                 hwrng_unregister(&wl->rng);
2916 }
2917
2918 static int b43_rng_init(struct b43_wl *wl)
2919 {
2920         int err;
2921
2922         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2923                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2924         wl->rng.name = wl->rng_name;
2925         wl->rng.data_read = b43_rng_read;
2926         wl->rng.priv = (unsigned long)wl;
2927         wl->rng_initialized = 1;
2928         err = hwrng_register(&wl->rng);
2929         if (err) {
2930                 wl->rng_initialized = 0;
2931                 b43err(wl, "Failed to register the random "
2932                        "number generator (%d)\n", err);
2933         }
2934
2935         return err;
2936 }
2937
2938 static int b43_op_tx(struct ieee80211_hw *hw,
2939                      struct sk_buff *skb)
2940 {
2941         struct b43_wl *wl = hw_to_b43_wl(hw);
2942         struct b43_wldev *dev = wl->current_dev;
2943         unsigned long flags;
2944         int err;
2945
2946         if (unlikely(skb->len < 2 + 2 + 6)) {
2947                 /* Too short, this can't be a valid frame. */
2948                 dev_kfree_skb_any(skb);
2949                 return NETDEV_TX_OK;
2950         }
2951         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2952         if (unlikely(!dev))
2953                 return NETDEV_TX_BUSY;
2954
2955         /* Transmissions on seperate queues can run concurrently. */
2956         read_lock_irqsave(&wl->tx_lock, flags);
2957
2958         err = -ENODEV;
2959         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2960                 if (b43_using_pio_transfers(dev))
2961                         err = b43_pio_tx(dev, skb);
2962                 else
2963                         err = b43_dma_tx(dev, skb);
2964         }
2965
2966         read_unlock_irqrestore(&wl->tx_lock, flags);
2967
2968         if (unlikely(err))
2969                 return NETDEV_TX_BUSY;
2970         return NETDEV_TX_OK;
2971 }
2972
2973 /* Locking: wl->irq_lock */
2974 static void b43_qos_params_upload(struct b43_wldev *dev,
2975                                   const struct ieee80211_tx_queue_params *p,
2976                                   u16 shm_offset)
2977 {
2978         u16 params[B43_NR_QOSPARAMS];
2979         int cw_min, cw_max, aifs, bslots, tmp;
2980         unsigned int i;
2981
2982         const u16 aCWmin = 0x0001;
2983         const u16 aCWmax = 0x03FF;
2984
2985         /* Calculate the default values for the parameters, if needed. */
2986         switch (shm_offset) {
2987         case B43_QOS_VOICE:
2988                 aifs = (p->aifs == -1) ? 2 : p->aifs;
2989                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 4 - 1) : p->cw_min;
2990                 cw_max = (p->cw_max == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_max;
2991                 break;
2992         case B43_QOS_VIDEO:
2993                 aifs = (p->aifs == -1) ? 2 : p->aifs;
2994                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_min;
2995                 cw_max = (p->cw_max == 0) ? aCWmin : p->cw_max;
2996                 break;
2997         case B43_QOS_BESTEFFORT:
2998                 aifs = (p->aifs == -1) ? 3 : p->aifs;
2999                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
3000                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
3001                 break;
3002         case B43_QOS_BACKGROUND:
3003                 aifs = (p->aifs == -1) ? 7 : p->aifs;
3004                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
3005                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
3006                 break;
3007         default:
3008                 B43_WARN_ON(1);
3009                 return;
3010         }
3011         if (cw_min <= 0)
3012                 cw_min = aCWmin;
3013         if (cw_max <= 0)
3014                 cw_max = aCWmin;
3015         bslots = b43_read16(dev, B43_MMIO_RNG) % cw_min;
3016
3017         memset(&params, 0, sizeof(params));
3018
3019         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3020         params[B43_QOSPARAM_CWMIN] = cw_min;
3021         params[B43_QOSPARAM_CWMAX] = cw_max;
3022         params[B43_QOSPARAM_CWCUR] = cw_min;
3023         params[B43_QOSPARAM_AIFS] = aifs;
3024         params[B43_QOSPARAM_BSLOTS] = bslots;
3025         params[B43_QOSPARAM_REGGAP] = bslots + aifs;
3026
3027         for (i = 0; i < ARRAY_SIZE(params); i++) {
3028                 if (i == B43_QOSPARAM_STATUS) {
3029                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3030                                              shm_offset + (i * 2));
3031                         /* Mark the parameters as updated. */
3032                         tmp |= 0x100;
3033                         b43_shm_write16(dev, B43_SHM_SHARED,
3034                                         shm_offset + (i * 2),
3035                                         tmp);
3036                 } else {
3037                         b43_shm_write16(dev, B43_SHM_SHARED,
3038                                         shm_offset + (i * 2),
3039                                         params[i]);
3040                 }
3041         }
3042 }
3043
3044 /* Update the QOS parameters in hardware. */
3045 static void b43_qos_update(struct b43_wldev *dev)
3046 {
3047         struct b43_wl *wl = dev->wl;
3048         struct b43_qos_params *params;
3049         unsigned long flags;
3050         unsigned int i;
3051
3052         /* Mapping of mac80211 queues to b43 SHM offsets. */
3053         static const u16 qos_shm_offsets[] = {
3054                 [0] = B43_QOS_VOICE,
3055                 [1] = B43_QOS_VIDEO,
3056                 [2] = B43_QOS_BESTEFFORT,
3057                 [3] = B43_QOS_BACKGROUND,
3058         };
3059         BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
3060
3061         b43_mac_suspend(dev);
3062         spin_lock_irqsave(&wl->irq_lock, flags);
3063
3064         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3065                 params = &(wl->qos_params[i]);
3066                 if (params->need_hw_update) {
3067                         b43_qos_params_upload(dev, &(params->p),
3068                                               qos_shm_offsets[i]);
3069                         params->need_hw_update = 0;
3070                 }
3071         }
3072
3073         spin_unlock_irqrestore(&wl->irq_lock, flags);
3074         b43_mac_enable(dev);
3075 }
3076
3077 static void b43_qos_clear(struct b43_wl *wl)
3078 {
3079         struct b43_qos_params *params;
3080         unsigned int i;
3081
3082         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3083                 params = &(wl->qos_params[i]);
3084
3085                 memset(&(params->p), 0, sizeof(params->p));
3086                 params->p.aifs = -1;
3087                 params->need_hw_update = 1;
3088         }
3089 }
3090
3091 /* Initialize the core's QOS capabilities */
3092 static void b43_qos_init(struct b43_wldev *dev)
3093 {
3094         struct b43_wl *wl = dev->wl;
3095         unsigned int i;
3096
3097         /* Upload the current QOS parameters. */
3098         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
3099                 wl->qos_params[i].need_hw_update = 1;
3100         b43_qos_update(dev);
3101
3102         /* Enable QOS support. */
3103         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3104         b43_write16(dev, B43_MMIO_IFSCTL,
3105                     b43_read16(dev, B43_MMIO_IFSCTL)
3106                     | B43_MMIO_IFSCTL_USE_EDCF);
3107 }
3108
3109 static void b43_qos_update_work(struct work_struct *work)
3110 {
3111         struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
3112         struct b43_wldev *dev;
3113
3114         mutex_lock(&wl->mutex);
3115         dev = wl->current_dev;
3116         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
3117                 b43_qos_update(dev);
3118         mutex_unlock(&wl->mutex);
3119 }
3120
3121 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3122                           const struct ieee80211_tx_queue_params *params)
3123 {
3124         struct b43_wl *wl = hw_to_b43_wl(hw);
3125         unsigned long flags;
3126         unsigned int queue = (unsigned int)_queue;
3127         struct b43_qos_params *p;
3128
3129         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3130                 /* Queue not available or don't support setting
3131                  * params on this queue. Return success to not
3132                  * confuse mac80211. */
3133                 return 0;
3134         }
3135
3136         spin_lock_irqsave(&wl->irq_lock, flags);
3137         p = &(wl->qos_params[queue]);
3138         memcpy(&(p->p), params, sizeof(p->p));
3139         p->need_hw_update = 1;
3140         spin_unlock_irqrestore(&wl->irq_lock, flags);
3141
3142         queue_work(hw->workqueue, &wl->qos_update_work);
3143
3144         return 0;
3145 }
3146
3147 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3148                                struct ieee80211_tx_queue_stats *stats)
3149 {
3150         struct b43_wl *wl = hw_to_b43_wl(hw);
3151         struct b43_wldev *dev = wl->current_dev;
3152         unsigned long flags;
3153         int err = -ENODEV;
3154
3155         if (!dev)
3156                 goto out;
3157         spin_lock_irqsave(&wl->irq_lock, flags);
3158         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3159                 if (b43_using_pio_transfers(dev))
3160                         b43_pio_get_tx_stats(dev, stats);
3161                 else
3162                         b43_dma_get_tx_stats(dev, stats);
3163                 err = 0;
3164         }
3165         spin_unlock_irqrestore(&wl->irq_lock, flags);
3166 out:
3167         return err;
3168 }
3169
3170 static int b43_op_get_stats(struct ieee80211_hw *hw,
3171                             struct ieee80211_low_level_stats *stats)
3172 {
3173         struct b43_wl *wl = hw_to_b43_wl(hw);
3174         unsigned long flags;
3175
3176         spin_lock_irqsave(&wl->irq_lock, flags);
3177         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3178         spin_unlock_irqrestore(&wl->irq_lock, flags);
3179
3180         return 0;
3181 }
3182
3183 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3184 {
3185         struct ssb_device *sdev = dev->dev;
3186         u32 tmslow;
3187
3188         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3189         tmslow &= ~B43_TMSLOW_GMODE;
3190         tmslow |= B43_TMSLOW_PHYRESET;
3191         tmslow |= SSB_TMSLOW_FGC;
3192         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3193         msleep(1);
3194
3195         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3196         tmslow &= ~SSB_TMSLOW_FGC;
3197         tmslow |= B43_TMSLOW_PHYRESET;
3198         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3199         msleep(1);
3200 }
3201
3202 static const char * band_to_string(enum ieee80211_band band)
3203 {
3204         switch (band) {
3205         case IEEE80211_BAND_5GHZ:
3206                 return "5";
3207         case IEEE80211_BAND_2GHZ:
3208                 return "2.4";
3209         default:
3210                 break;
3211         }
3212         B43_WARN_ON(1);
3213         return "";
3214 }
3215
3216 /* Expects wl->mutex locked */
3217 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3218 {
3219         struct b43_wldev *up_dev = NULL;
3220         struct b43_wldev *down_dev;
3221         struct b43_wldev *d;
3222         int err;
3223         bool gmode;
3224         int prev_status;
3225
3226         /* Find a device and PHY which supports the band. */
3227         list_for_each_entry(d, &wl->devlist, list) {
3228                 switch (chan->band) {
3229                 case IEEE80211_BAND_5GHZ:
3230                         if (d->phy.supports_5ghz) {
3231                                 up_dev = d;
3232                                 gmode = 0;
3233                         }
3234                         break;
3235                 case IEEE80211_BAND_2GHZ:
3236                         if (d->phy.supports_2ghz) {
3237                                 up_dev = d;
3238                                 gmode = 1;
3239                         }
3240                         break;
3241                 default:
3242                         B43_WARN_ON(1);
3243                         return -EINVAL;
3244                 }
3245                 if (up_dev)
3246                         break;
3247         }
3248         if (!up_dev) {
3249                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3250                        band_to_string(chan->band));
3251                 return -ENODEV;
3252         }
3253         if ((up_dev == wl->current_dev) &&
3254             (!!wl->current_dev->phy.gmode == !!gmode)) {
3255                 /* This device is already running. */
3256                 return 0;
3257         }
3258         b43dbg(wl, "Switching to %s-GHz band\n",
3259                band_to_string(chan->band));
3260         down_dev = wl->current_dev;
3261
3262         prev_status = b43_status(down_dev);
3263         /* Shutdown the currently running core. */
3264         if (prev_status >= B43_STAT_STARTED)
3265                 b43_wireless_core_stop(down_dev);
3266         if (prev_status >= B43_STAT_INITIALIZED)
3267                 b43_wireless_core_exit(down_dev);
3268
3269         if (down_dev != up_dev) {
3270                 /* We switch to a different core, so we put PHY into
3271                  * RESET on the old core. */
3272                 b43_put_phy_into_reset(down_dev);
3273         }
3274
3275         /* Now start the new core. */
3276         up_dev->phy.gmode = gmode;
3277         if (prev_status >= B43_STAT_INITIALIZED) {
3278                 err = b43_wireless_core_init(up_dev);
3279                 if (err) {
3280                         b43err(wl, "Fatal: Could not initialize device for "
3281                                "selected %s-GHz band\n",
3282                                band_to_string(chan->band));
3283                         goto init_failure;
3284                 }
3285         }
3286         if (prev_status >= B43_STAT_STARTED) {
3287                 err = b43_wireless_core_start(up_dev);
3288                 if (err) {
3289                         b43err(wl, "Fatal: Coult not start device for "
3290                                "selected %s-GHz band\n",
3291                                band_to_string(chan->band));
3292                         b43_wireless_core_exit(up_dev);
3293                         goto init_failure;
3294                 }
3295         }
3296         B43_WARN_ON(b43_status(up_dev) != prev_status);
3297
3298         wl->current_dev = up_dev;
3299
3300         return 0;
3301 init_failure:
3302         /* Whoops, failed to init the new core. No core is operating now. */
3303         wl->current_dev = NULL;
3304         return err;
3305 }
3306
3307 static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
3308 {
3309         struct b43_wl *wl = hw_to_b43_wl(hw);
3310         struct b43_wldev *dev;
3311         struct b43_phy *phy;
3312         unsigned long flags;
3313         int antenna;
3314         int err = 0;
3315         u32 savedirqs;
3316
3317         mutex_lock(&wl->mutex);
3318
3319         /* Switch the band (if necessary). This might change the active core. */
3320         err = b43_switch_band(wl, conf->channel);
3321         if (err)
3322                 goto out_unlock_mutex;
3323         dev = wl->current_dev;
3324         phy = &dev->phy;
3325
3326         /* Disable IRQs while reconfiguring the device.
3327          * This makes it possible to drop the spinlock throughout
3328          * the reconfiguration process. */
3329         spin_lock_irqsave(&wl->irq_lock, flags);
3330         if (b43_status(dev) < B43_STAT_STARTED) {
3331                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3332                 goto out_unlock_mutex;
3333         }
3334         savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3335         spin_unlock_irqrestore(&wl->irq_lock, flags);
3336         b43_synchronize_irq(dev);
3337
3338         /* Switch to the requested channel.
3339          * The firmware takes care of races with the TX handler. */
3340         if (conf->channel->hw_value != phy->channel)
3341                 b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
3342
3343         /* Enable/Disable ShortSlot timing. */
3344         if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
3345             dev->short_slot) {
3346                 B43_WARN_ON(phy->type != B43_PHYTYPE_G);
3347                 if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)
3348                         b43_short_slot_timing_enable(dev);
3349                 else
3350                         b43_short_slot_timing_disable(dev);
3351         }
3352
3353         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3354
3355         /* Adjust the desired TX power level. */
3356         if (conf->power_level != 0) {
3357                 if (conf->power_level != phy->power_level) {
3358                         phy->power_level = conf->power_level;
3359                         b43_phy_xmitpower(dev);
3360                 }
3361         }
3362
3363         /* Antennas for RX and management frame TX. */
3364         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
3365         b43_mgmtframe_txantenna(dev, antenna);
3366         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
3367         b43_set_rx_antenna(dev, antenna);
3368
3369         /* Update templates for AP/mesh mode. */
3370         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3371             b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
3372                 b43_set_beacon_int(dev, conf->beacon_int);
3373
3374         if (!!conf->radio_enabled != phy->radio_on) {
3375                 if (conf->radio_enabled) {
3376                         b43_radio_turn_on(dev);
3377                         b43info(dev->wl, "Radio turned on by software\n");
3378                         if (!dev->radio_hw_enable) {
3379                                 b43info(dev->wl, "The hardware RF-kill button "
3380                                         "still turns the radio physically off. "
3381                                         "Press the button to turn it on.\n");
3382                         }
3383                 } else {
3384                         b43_radio_turn_off(dev, 0);
3385                         b43info(dev->wl, "Radio turned off by software\n");
3386                 }
3387         }
3388
3389         spin_lock_irqsave(&wl->irq_lock, flags);
3390         b43_interrupt_enable(dev, savedirqs);
3391         mmiowb();
3392         spin_unlock_irqrestore(&wl->irq_lock, flags);
3393       out_unlock_mutex:
3394         mutex_unlock(&wl->mutex);
3395
3396         return err;
3397 }
3398
3399 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3400                            const u8 *local_addr, const u8 *addr,
3401                            struct ieee80211_key_conf *key)
3402 {
3403         struct b43_wl *wl = hw_to_b43_wl(hw);
3404         struct b43_wldev *dev;
3405         unsigned long flags;
3406         u8 algorithm;
3407         u8 index;
3408         int err;
3409         DECLARE_MAC_BUF(mac);
3410
3411         if (modparam_nohwcrypt)
3412                 return -ENOSPC; /* User disabled HW-crypto */
3413
3414         mutex_lock(&wl->mutex);
3415         spin_lock_irqsave(&wl->irq_lock, flags);
3416
3417         dev = wl->current_dev;
3418         err = -ENODEV;
3419         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3420                 goto out_unlock;
3421
3422         if (dev->fw.pcm_request_failed) {
3423                 /* We don't have firmware for the crypto engine.
3424                  * Must use software-crypto. */
3425                 err = -EOPNOTSUPP;
3426                 goto out_unlock;
3427         }
3428
3429         err = -EINVAL;
3430         switch (key->alg) {
3431         case ALG_WEP:
3432                 if (key->keylen == 5)
3433                         algorithm = B43_SEC_ALGO_WEP40;
3434                 else
3435                         algorithm = B43_SEC_ALGO_WEP104;
3436                 break;
3437         case ALG_TKIP:
3438                 algorithm = B43_SEC_ALGO_TKIP;
3439                 break;
3440         case ALG_CCMP:
3441                 algorithm = B43_SEC_ALGO_AES;
3442                 break;
3443         default:
3444                 B43_WARN_ON(1);
3445                 goto out_unlock;
3446         }
3447         index = (u8) (key->keyidx);
3448         if (index > 3)
3449                 goto out_unlock;
3450
3451         switch (cmd) {
3452         case SET_KEY:
3453                 if (algorithm == B43_SEC_ALGO_TKIP) {
3454                         /* FIXME: No TKIP hardware encryption for now. */
3455                         err = -EOPNOTSUPP;
3456                         goto out_unlock;
3457                 }
3458
3459                 if (is_broadcast_ether_addr(addr)) {
3460                         /* addr is FF:FF:FF:FF:FF:FF for default keys */
3461                         err = b43_key_write(dev, index, algorithm,
3462                                             key->key, key->keylen, NULL, key);
3463                 } else {
3464                         /*
3465                          * either pairwise key or address is 00:00:00:00:00:00
3466                          * for transmit-only keys
3467                          */
3468                         err = b43_key_write(dev, -1, algorithm,
3469                                             key->key, key->keylen, addr, key);
3470                 }
3471                 if (err)
3472                         goto out_unlock;
3473
3474                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3475                     algorithm == B43_SEC_ALGO_WEP104) {
3476                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3477                 } else {
3478                         b43_hf_write(dev,
3479                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3480                 }
3481                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3482                 break;
3483         case DISABLE_KEY: {
3484                 err = b43_key_clear(dev, key->hw_key_idx);
3485                 if (err)
3486                         goto out_unlock;
3487                 break;
3488         }
3489         default:
3490                 B43_WARN_ON(1);
3491         }
3492 out_unlock:
3493         spin_unlock_irqrestore(&wl->irq_lock, flags);
3494         mutex_unlock(&wl->mutex);
3495         if (!err) {
3496                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3497                        "mac: %s\n",
3498                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3499                        print_mac(mac, addr));
3500         }
3501         return err;
3502 }
3503
3504 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3505                                     unsigned int changed, unsigned int *fflags,
3506                                     int mc_count, struct dev_addr_list *mc_list)
3507 {
3508         struct b43_wl *wl = hw_to_b43_wl(hw);
3509         struct b43_wldev *dev = wl->current_dev;
3510         unsigned long flags;
3511
3512         if (!dev) {
3513                 *fflags = 0;
3514                 return;
3515         }
3516
3517         spin_lock_irqsave(&wl->irq_lock, flags);
3518         *fflags &= FIF_PROMISC_IN_BSS |
3519                   FIF_ALLMULTI |
3520                   FIF_FCSFAIL |
3521                   FIF_PLCPFAIL |
3522                   FIF_CONTROL |
3523                   FIF_OTHER_BSS |
3524                   FIF_BCN_PRBRESP_PROMISC;
3525
3526         changed &= FIF_PROMISC_IN_BSS |
3527                    FIF_ALLMULTI |
3528                    FIF_FCSFAIL |
3529                    FIF_PLCPFAIL |
3530                    FIF_CONTROL |
3531                    FIF_OTHER_BSS |
3532                    FIF_BCN_PRBRESP_PROMISC;
3533
3534         wl->filter_flags = *fflags;
3535
3536         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3537                 b43_adjust_opmode(dev);
3538         spin_unlock_irqrestore(&wl->irq_lock, flags);
3539 }
3540
3541 static int b43_op_config_interface(struct ieee80211_hw *hw,
3542                                    struct ieee80211_vif *vif,
3543                                    struct ieee80211_if_conf *conf)
3544 {
3545         struct b43_wl *wl = hw_to_b43_wl(hw);
3546         struct b43_wldev *dev = wl->current_dev;
3547         unsigned long flags;
3548
3549         if (!dev)
3550                 return -ENODEV;
3551         mutex_lock(&wl->mutex);
3552         spin_lock_irqsave(&wl->irq_lock, flags);
3553         B43_WARN_ON(wl->vif != vif);
3554         if (conf->bssid)
3555                 memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3556         else
3557                 memset(wl->bssid, 0, ETH_ALEN);
3558         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3559                 if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3560                     b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT)) {
3561                         B43_WARN_ON(conf->type != wl->if_type);
3562                         b43_set_ssid(dev, conf->ssid, conf->ssid_len);
3563                         if (conf->beacon)
3564                                 b43_update_templates(wl, conf->beacon);
3565                 }
3566                 b43_write_mac_bssid_templates(dev);
3567         }
3568         spin_unlock_irqrestore(&wl->irq_lock, flags);
3569         mutex_unlock(&wl->mutex);
3570
3571         return 0;
3572 }
3573
3574 /* Locking: wl->mutex */
3575 static void b43_wireless_core_stop(struct b43_wldev *dev)
3576 {
3577         struct b43_wl *wl = dev->wl;
3578         unsigned long flags;
3579
3580         if (b43_status(dev) < B43_STAT_STARTED)
3581                 return;
3582
3583         /* Disable and sync interrupts. We must do this before than
3584          * setting the status to INITIALIZED, as the interrupt handler
3585          * won't care about IRQs then. */
3586         spin_lock_irqsave(&wl->irq_lock, flags);
3587         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3588         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3589         spin_unlock_irqrestore(&wl->irq_lock, flags);
3590         b43_synchronize_irq(dev);
3591
3592         write_lock_irqsave(&wl->tx_lock, flags);
3593         b43_set_status(dev, B43_STAT_INITIALIZED);
3594         write_unlock_irqrestore(&wl->tx_lock, flags);
3595
3596         b43_pio_stop(dev);
3597         mutex_unlock(&wl->mutex);
3598         /* Must unlock as it would otherwise deadlock. No races here.
3599          * Cancel the possibly running self-rearming periodic work. */
3600         cancel_delayed_work_sync(&dev->periodic_work);
3601         mutex_lock(&wl->mutex);
3602
3603         b43_mac_suspend(dev);
3604         free_irq(dev->dev->irq, dev);
3605         b43dbg(wl, "Wireless interface stopped\n");
3606 }
3607
3608 /* Locking: wl->mutex */
3609 static int b43_wireless_core_start(struct b43_wldev *dev)
3610 {
3611         int err;
3612
3613         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3614
3615         drain_txstatus_queue(dev);
3616         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3617                           IRQF_SHARED, KBUILD_MODNAME, dev);
3618         if (err) {
3619                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3620                 goto out;
3621         }
3622
3623         /* We are ready to run. */
3624         b43_set_status(dev, B43_STAT_STARTED);
3625
3626         /* Start data flow (TX/RX). */
3627         b43_mac_enable(dev);
3628         b43_interrupt_enable(dev, dev->irq_savedstate);
3629
3630         /* Start maintainance work */
3631         b43_periodic_tasks_setup(dev);
3632
3633         b43dbg(dev->wl, "Wireless interface started\n");
3634       out:
3635         return err;
3636 }
3637
3638 /* Get PHY and RADIO versioning numbers */
3639 static int b43_phy_versioning(struct b43_wldev *dev)
3640 {
3641         struct b43_phy *phy = &dev->phy;
3642         u32 tmp;
3643         u8 analog_type;
3644         u8 phy_type;
3645         u8 phy_rev;
3646         u16 radio_manuf;
3647         u16 radio_ver;
3648         u16 radio_rev;
3649         int unsupported = 0;
3650
3651         /* Get PHY versioning */
3652         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3653         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3654         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3655         phy_rev = (tmp & B43_PHYVER_VERSION);
3656         switch (phy_type) {
3657         case B43_PHYTYPE_A:
3658                 if (phy_rev >= 4)
3659                         unsupported = 1;
3660                 break;
3661         case B43_PHYTYPE_B:
3662                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3663                     && phy_rev != 7)
3664                         unsupported = 1;
3665                 break;
3666         case B43_PHYTYPE_G:
3667                 if (phy_rev > 9)
3668                         unsupported = 1;
3669                 break;
3670 #ifdef CONFIG_B43_NPHY
3671         case B43_PHYTYPE_N:
3672                 if (phy_rev > 1)
3673                         unsupported = 1;
3674                 break;
3675 #endif
3676         default:
3677                 unsupported = 1;
3678         };
3679         if (unsupported) {
3680                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3681                        "(Analog %u, Type %u, Revision %u)\n",
3682                        analog_type, phy_type, phy_rev);
3683                 return -EOPNOTSUPP;
3684         }
3685         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3686                analog_type, phy_type, phy_rev);
3687
3688         /* Get RADIO versioning */
3689         if (dev->dev->bus->chip_id == 0x4317) {
3690                 if (dev->dev->bus->chip_rev == 0)
3691                         tmp = 0x3205017F;
3692                 else if (dev->dev->bus->chip_rev == 1)
3693                         tmp = 0x4205017F;
3694                 else
3695                         tmp = 0x5205017F;
3696         } else {
3697                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3698                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3699                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3700                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3701         }
3702         radio_manuf = (tmp & 0x00000FFF);
3703         radio_ver = (tmp & 0x0FFFF000) >> 12;
3704         radio_rev = (tmp & 0xF0000000) >> 28;
3705         if (radio_manuf != 0x17F /* Broadcom */)
3706                 unsupported = 1;
3707         switch (phy_type) {
3708         case B43_PHYTYPE_A:
3709                 if (radio_ver != 0x2060)
3710                         unsupported = 1;
3711                 if (radio_rev != 1)
3712                         unsupported = 1;
3713                 if (radio_manuf != 0x17F)
3714                         unsupported = 1;
3715                 break;
3716         case B43_PHYTYPE_B:
3717                 if ((radio_ver & 0xFFF0) != 0x2050)
3718                         unsupported = 1;
3719                 break;
3720         case B43_PHYTYPE_G:
3721                 if (radio_ver != 0x2050)
3722                         unsupported = 1;
3723                 break;
3724         case B43_PHYTYPE_N:
3725                 if (radio_ver != 0x2055)
3726                         unsupported = 1;
3727                 break;
3728         default:
3729                 B43_WARN_ON(1);
3730         }
3731         if (unsupported) {
3732                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3733                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3734                        radio_manuf, radio_ver, radio_rev);
3735                 return -EOPNOTSUPP;
3736         }
3737         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3738                radio_manuf, radio_ver, radio_rev);
3739
3740         phy->radio_manuf = radio_manuf;
3741         phy->radio_ver = radio_ver;
3742         phy->radio_rev = radio_rev;
3743
3744         phy->analog = analog_type;
3745         phy->type = phy_type;
3746         phy->rev = phy_rev;
3747
3748         return 0;
3749 }
3750
3751 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3752                                       struct b43_phy *phy)
3753 {
3754         struct b43_txpower_lo_control *lo;
3755         int i;
3756
3757         memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3758         memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3759
3760         phy->aci_enable = 0;
3761         phy->aci_wlan_automatic = 0;
3762         phy->aci_hw_rssi = 0;
3763
3764         phy->radio_off_context.valid = 0;
3765
3766         lo = phy->lo_control;
3767         if (lo) {
3768                 memset(lo, 0, sizeof(*(phy->lo_control)));
3769                 lo->tx_bias = 0xFF;
3770                 INIT_LIST_HEAD(&lo->calib_list);
3771         }
3772         phy->max_lb_gain = 0;
3773         phy->trsw_rx_gain = 0;
3774         phy->txpwr_offset = 0;
3775
3776         /* NRSSI */
3777         phy->nrssislope = 0;
3778         for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3779                 phy->nrssi[i] = -1000;
3780         for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3781                 phy->nrssi_lt[i] = i;
3782
3783         phy->lofcal = 0xFFFF;
3784         phy->initval = 0xFFFF;
3785
3786         phy->interfmode = B43_INTERFMODE_NONE;
3787         phy->channel = 0xFF;
3788
3789         phy->hardware_power_control = !!modparam_hwpctl;
3790
3791         /* PHY TX errors counter. */
3792         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3793
3794         /* OFDM-table address caching. */
3795         phy->ofdmtab_addr_direction = B43_OFDMTAB_DIRECTION_UNKNOWN;
3796 }
3797
3798 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3799 {
3800         dev->dfq_valid = 0;
3801
3802         /* Assume the radio is enabled. If it's not enabled, the state will
3803          * immediately get fixed on the first periodic work run. */
3804         dev->radio_hw_enable = 1;
3805
3806         /* Stats */
3807         memset(&dev->stats, 0, sizeof(dev->stats));
3808
3809         setup_struct_phy_for_init(dev, &dev->phy);
3810
3811         /* IRQ related flags */
3812         dev->irq_reason = 0;
3813         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3814         dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3815
3816         dev->mac_suspended = 1;
3817
3818         /* Noise calculation context */
3819         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3820 }
3821
3822 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3823 {
3824         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3825         u64 hf;
3826
3827         if (!modparam_btcoex)
3828                 return;
3829         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3830                 return;
3831         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3832                 return;
3833
3834         hf = b43_hf_read(dev);
3835         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3836                 hf |= B43_HF_BTCOEXALT;
3837         else
3838                 hf |= B43_HF_BTCOEX;
3839         b43_hf_write(dev, hf);
3840 }
3841
3842 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3843 {
3844         if (!modparam_btcoex)
3845                 return;
3846         //TODO
3847 }
3848
3849 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3850 {
3851 #ifdef CONFIG_SSB_DRIVER_PCICORE
3852         struct ssb_bus *bus = dev->dev->bus;
3853         u32 tmp;
3854
3855         if (bus->pcicore.dev &&
3856             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3857             bus->pcicore.dev->id.revision <= 5) {
3858                 /* IMCFGLO timeouts workaround. */
3859                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3860                 tmp &= ~SSB_IMCFGLO_REQTO;
3861                 tmp &= ~SSB_IMCFGLO_SERTO;
3862                 switch (bus->bustype) {
3863                 case SSB_BUSTYPE_PCI:
3864                 case SSB_BUSTYPE_PCMCIA:
3865                         tmp |= 0x32;
3866                         break;
3867                 case SSB_BUSTYPE_SSB:
3868                         tmp |= 0x53;
3869                         break;
3870                 }
3871                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3872         }
3873 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3874 }
3875
3876 /* Write the short and long frame retry limit values. */
3877 static void b43_set_retry_limits(struct b43_wldev *dev,
3878                                  unsigned int short_retry,
3879                                  unsigned int long_retry)
3880 {
3881         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3882          * the chip-internal counter. */
3883         short_retry = min(short_retry, (unsigned int)0xF);
3884         long_retry = min(long_retry, (unsigned int)0xF);
3885
3886         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3887                         short_retry);
3888         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3889                         long_retry);
3890 }
3891
3892 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3893 {
3894         u16 pu_delay;
3895
3896         /* The time value is in microseconds. */
3897         if (dev->phy.type == B43_PHYTYPE_A)
3898                 pu_delay = 3700;
3899         else
3900                 pu_delay = 1050;
3901         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS) || idle)
3902                 pu_delay = 500;
3903         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3904                 pu_delay = max(pu_delay, (u16)2400);
3905
3906         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3907 }
3908
3909 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3910 static void b43_set_pretbtt(struct b43_wldev *dev)
3911 {
3912         u16 pretbtt;
3913
3914         /* The time value is in microseconds. */
3915         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS)) {
3916                 pretbtt = 2;
3917         } else {
3918                 if (dev->phy.type == B43_PHYTYPE_A)
3919                         pretbtt = 120;
3920                 else
3921                         pretbtt = 250;
3922         }
3923         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3924         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3925 }
3926
3927 /* Shutdown a wireless core */
3928 /* Locking: wl->mutex */
3929 static void b43_wireless_core_exit(struct b43_wldev *dev)
3930 {
3931         struct b43_phy *phy = &dev->phy;
3932         u32 macctl;
3933
3934         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3935         if (b43_status(dev) != B43_STAT_INITIALIZED)
3936                 return;
3937         b43_set_status(dev, B43_STAT_UNINIT);
3938
3939         /* Stop the microcode PSM. */
3940         macctl = b43_read32(dev, B43_MMIO_MACCTL);
3941         macctl &= ~B43_MACCTL_PSM_RUN;
3942         macctl |= B43_MACCTL_PSM_JMP0;
3943         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3944
3945         if (!dev->suspend_in_progress) {
3946                 b43_leds_exit(dev);
3947                 b43_rng_exit(dev->wl);
3948         }
3949         b43_dma_free(dev);
3950         b43_pio_free(dev);
3951         b43_chip_exit(dev);
3952         b43_radio_turn_off(dev, 1);
3953         b43_switch_analog(dev, 0);
3954         if (phy->dyn_tssi_tbl)
3955                 kfree(phy->tssi2dbm);
3956         kfree(phy->lo_control);
3957         phy->lo_control = NULL;
3958         if (dev->wl->current_beacon) {
3959                 dev_kfree_skb_any(dev->wl->current_beacon);
3960                 dev->wl->current_beacon = NULL;
3961         }
3962
3963         ssb_device_disable(dev->dev, 0);
3964         ssb_bus_may_powerdown(dev->dev->bus);
3965 }
3966
3967 /* Initialize a wireless core */
3968 static int b43_wireless_core_init(struct b43_wldev *dev)
3969 {
3970         struct b43_wl *wl = dev->wl;
3971         struct ssb_bus *bus = dev->dev->bus;
3972         struct ssb_sprom *sprom = &bus->sprom;
3973         struct b43_phy *phy = &dev->phy;
3974         int err;
3975         u64 hf;
3976         u32 tmp;
3977
3978         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
3979
3980         err = ssb_bus_powerup(bus, 0);
3981         if (err)
3982                 goto out;
3983         if (!ssb_device_is_enabled(dev->dev)) {
3984                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
3985                 b43_wireless_core_reset(dev, tmp);
3986         }
3987
3988         if ((phy->type == B43_PHYTYPE_B) || (phy->type == B43_PHYTYPE_G)) {
3989                 phy->lo_control =
3990                     kzalloc(sizeof(*(phy->lo_control)), GFP_KERNEL);
3991                 if (!phy->lo_control) {
3992                         err = -ENOMEM;
3993                         goto err_busdown;
3994                 }
3995         }
3996         setup_struct_wldev_for_init(dev);
3997
3998         err = b43_phy_init_tssi2dbm_table(dev);
3999         if (err)
4000                 goto err_kfree_lo_control;
4001
4002         /* Enable IRQ routing to this device. */
4003         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4004
4005         b43_imcfglo_timeouts_workaround(dev);
4006         b43_bluetooth_coext_disable(dev);
4007         b43_phy_early_init(dev);
4008         err = b43_chip_init(dev);
4009         if (err)
4010                 goto err_kfree_tssitbl;
4011         b43_shm_write16(dev, B43_SHM_SHARED,
4012                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4013         hf = b43_hf_read(dev);
4014         if (phy->type == B43_PHYTYPE_G) {
4015                 hf |= B43_HF_SYMW;
4016                 if (phy->rev == 1)
4017                         hf |= B43_HF_GDCW;
4018                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4019                         hf |= B43_HF_OFDMPABOOST;
4020         } else if (phy->type == B43_PHYTYPE_B) {
4021                 hf |= B43_HF_SYMW;
4022                 if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4023                         hf &= ~B43_HF_GDCW;
4024         }
4025         b43_hf_write(dev, hf);
4026
4027         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4028                              B43_DEFAULT_LONG_RETRY_LIMIT);
4029         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4030         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4031
4032         /* Disable sending probe responses from firmware.
4033          * Setting the MaxTime to one usec will always trigger
4034          * a timeout, so we never send any probe resp.
4035          * A timeout of zero is infinite. */
4036         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4037
4038         b43_rate_memory_init(dev);
4039         b43_set_phytxctl_defaults(dev);
4040
4041         /* Minimum Contention Window */
4042         if (phy->type == B43_PHYTYPE_B) {
4043                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4044         } else {
4045                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4046         }
4047         /* Maximum Contention Window */
4048         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4049
4050         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4051                 dev->__using_pio_transfers = 1;
4052                 err = b43_pio_init(dev);
4053         } else {
4054                 dev->__using_pio_transfers = 0;
4055                 err = b43_dma_init(dev);
4056         }
4057         if (err)
4058                 goto err_chip_exit;
4059         b43_qos_init(dev);
4060         b43_set_synth_pu_delay(dev, 1);
4061         b43_bluetooth_coext_enable(dev);
4062
4063         ssb_bus_powerup(bus, 1);        /* Enable dynamic PCTL */
4064         b43_upload_card_macaddress(dev);
4065         b43_security_init(dev);
4066         if (!dev->suspend_in_progress)
4067                 b43_rng_init(wl);
4068
4069         b43_set_status(dev, B43_STAT_INITIALIZED);
4070
4071         if (!dev->suspend_in_progress)
4072                 b43_leds_init(dev);
4073 out:
4074         return err;
4075
4076       err_chip_exit:
4077         b43_chip_exit(dev);
4078       err_kfree_tssitbl:
4079         if (phy->dyn_tssi_tbl)
4080                 kfree(phy->tssi2dbm);
4081       err_kfree_lo_control:
4082         kfree(phy->lo_control);
4083         phy->lo_control = NULL;
4084       err_busdown:
4085         ssb_bus_may_powerdown(bus);
4086         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4087         return err;
4088 }
4089
4090 static int b43_op_add_interface(struct ieee80211_hw *hw,
4091                                 struct ieee80211_if_init_conf *conf)
4092 {
4093         struct b43_wl *wl = hw_to_b43_wl(hw);
4094         struct b43_wldev *dev;
4095         unsigned long flags;
4096         int err = -EOPNOTSUPP;
4097
4098         /* TODO: allow WDS/AP devices to coexist */
4099
4100         if (conf->type != IEEE80211_IF_TYPE_AP &&
4101             conf->type != IEEE80211_IF_TYPE_MESH_POINT &&
4102             conf->type != IEEE80211_IF_TYPE_STA &&
4103             conf->type != IEEE80211_IF_TYPE_WDS &&
4104             conf->type != IEEE80211_IF_TYPE_IBSS)
4105                 return -EOPNOTSUPP;
4106
4107         mutex_lock(&wl->mutex);
4108         if (wl->operating)
4109                 goto out_mutex_unlock;
4110
4111         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4112
4113         dev = wl->current_dev;
4114         wl->operating = 1;
4115         wl->vif = conf->vif;
4116         wl->if_type = conf->type;
4117         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4118
4119         spin_lock_irqsave(&wl->irq_lock, flags);
4120         b43_adjust_opmode(dev);
4121         b43_set_pretbtt(dev);
4122         b43_set_synth_pu_delay(dev, 0);
4123         b43_upload_card_macaddress(dev);
4124         spin_unlock_irqrestore(&wl->irq_lock, flags);
4125
4126         err = 0;
4127  out_mutex_unlock:
4128         mutex_unlock(&wl->mutex);
4129
4130         return err;
4131 }
4132
4133 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4134                                     struct ieee80211_if_init_conf *conf)
4135 {
4136         struct b43_wl *wl = hw_to_b43_wl(hw);
4137         struct b43_wldev *dev = wl->current_dev;
4138         unsigned long flags;
4139
4140         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4141
4142         mutex_lock(&wl->mutex);
4143
4144         B43_WARN_ON(!wl->operating);
4145         B43_WARN_ON(wl->vif != conf->vif);
4146         wl->vif = NULL;
4147
4148         wl->operating = 0;
4149
4150         spin_lock_irqsave(&wl->irq_lock, flags);
4151         b43_adjust_opmode(dev);
4152         memset(wl->mac_addr, 0, ETH_ALEN);
4153         b43_upload_card_macaddress(dev);
4154         spin_unlock_irqrestore(&wl->irq_lock, flags);
4155
4156         mutex_unlock(&wl->mutex);
4157 }
4158
4159 static int b43_op_start(struct ieee80211_hw *hw)
4160 {
4161         struct b43_wl *wl = hw_to_b43_wl(hw);
4162         struct b43_wldev *dev = wl->current_dev;
4163         int did_init = 0;
4164         int err = 0;
4165         bool do_rfkill_exit = 0;
4166
4167         /* Kill all old instance specific information to make sure
4168          * the card won't use it in the short timeframe between start
4169          * and mac80211 reconfiguring it. */
4170         memset(wl->bssid, 0, ETH_ALEN);
4171         memset(wl->mac_addr, 0, ETH_ALEN);
4172         wl->filter_flags = 0;
4173         wl->radiotap_enabled = 0;
4174         b43_qos_clear(wl);
4175
4176         /* First register RFkill.
4177          * LEDs that are registered later depend on it. */
4178         b43_rfkill_init(dev);
4179
4180         mutex_lock(&wl->mutex);
4181
4182         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4183                 err = b43_wireless_core_init(dev);
4184                 if (err) {
4185                         do_rfkill_exit = 1;
4186                         goto out_mutex_unlock;
4187                 }
4188                 did_init = 1;
4189         }
4190
4191         if (b43_status(dev) < B43_STAT_STARTED) {
4192                 err = b43_wireless_core_start(dev);
4193                 if (err) {
4194                         if (did_init)
4195                                 b43_wireless_core_exit(dev);
4196                         do_rfkill_exit = 1;
4197                         goto out_mutex_unlock;
4198                 }
4199         }
4200
4201  out_mutex_unlock:
4202         mutex_unlock(&wl->mutex);
4203
4204         if (do_rfkill_exit)
4205                 b43_rfkill_exit(dev);
4206
4207         return err;
4208 }
4209
4210 static void b43_op_stop(struct ieee80211_hw *hw)
4211 {
4212         struct b43_wl *wl = hw_to_b43_wl(hw);
4213         struct b43_wldev *dev = wl->current_dev;
4214
4215         b43_rfkill_exit(dev);
4216         cancel_work_sync(&(wl->qos_update_work));
4217         cancel_work_sync(&(wl->beacon_update_trigger));
4218
4219         mutex_lock(&wl->mutex);
4220         if (b43_status(dev) >= B43_STAT_STARTED)
4221                 b43_wireless_core_stop(dev);
4222         b43_wireless_core_exit(dev);
4223         mutex_unlock(&wl->mutex);
4224 }
4225
4226 static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
4227                                   u32 short_retry_limit, u32 long_retry_limit)
4228 {
4229         struct b43_wl *wl = hw_to_b43_wl(hw);
4230         struct b43_wldev *dev;
4231         int err = 0;
4232
4233         mutex_lock(&wl->mutex);
4234         dev = wl->current_dev;
4235         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
4236                 err = -ENODEV;
4237                 goto out_unlock;
4238         }
4239         b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
4240 out_unlock:
4241         mutex_unlock(&wl->mutex);
4242
4243         return err;
4244 }
4245
4246 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
4247 {
4248         struct b43_wl *wl = hw_to_b43_wl(hw);
4249         struct sk_buff *beacon;
4250         unsigned long flags;
4251
4252         /* We could modify the existing beacon and set the aid bit in
4253          * the TIM field, but that would probably require resizing and
4254          * moving of data within the beacon template.
4255          * Simply request a new beacon and let mac80211 do the hard work. */
4256         beacon = ieee80211_beacon_get(hw, wl->vif);
4257         if (unlikely(!beacon))
4258                 return -ENOMEM;
4259         spin_lock_irqsave(&wl->irq_lock, flags);
4260         b43_update_templates(wl, beacon);
4261         spin_unlock_irqrestore(&wl->irq_lock, flags);
4262
4263         return 0;
4264 }
4265
4266 static int b43_op_ibss_beacon_update(struct ieee80211_hw *hw,
4267                                      struct sk_buff *beacon)
4268 {
4269         struct b43_wl *wl = hw_to_b43_wl(hw);
4270         unsigned long flags;
4271
4272         spin_lock_irqsave(&wl->irq_lock, flags);
4273         b43_update_templates(wl, beacon);
4274         spin_unlock_irqrestore(&wl->irq_lock, flags);
4275
4276         return 0;
4277 }
4278
4279 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4280                               struct ieee80211_vif *vif,
4281                               enum sta_notify_cmd notify_cmd,
4282                               const u8 *addr)
4283 {
4284         struct b43_wl *wl = hw_to_b43_wl(hw);
4285
4286         B43_WARN_ON(!vif || wl->vif != vif);
4287 }
4288
4289 static const struct ieee80211_ops b43_hw_ops = {
4290         .tx                     = b43_op_tx,
4291         .conf_tx                = b43_op_conf_tx,
4292         .add_interface          = b43_op_add_interface,
4293         .remove_interface       = b43_op_remove_interface,
4294         .config                 = b43_op_config,
4295         .config_interface       = b43_op_config_interface,
4296         .configure_filter       = b43_op_configure_filter,
4297         .set_key                = b43_op_set_key,
4298         .get_stats              = b43_op_get_stats,
4299         .get_tx_stats           = b43_op_get_tx_stats,
4300         .start                  = b43_op_start,
4301         .stop                   = b43_op_stop,
4302         .set_retry_limit        = b43_op_set_retry_limit,
4303         .set_tim                = b43_op_beacon_set_tim,
4304         .beacon_update          = b43_op_ibss_beacon_update,
4305         .sta_notify             = b43_op_sta_notify,
4306 };
4307
4308 /* Hard-reset the chip. Do not call this directly.
4309  * Use b43_controller_restart()
4310  */
4311 static void b43_chip_reset(struct work_struct *work)
4312 {
4313         struct b43_wldev *dev =
4314             container_of(work, struct b43_wldev, restart_work);
4315         struct b43_wl *wl = dev->wl;
4316         int err = 0;
4317         int prev_status;
4318
4319         mutex_lock(&wl->mutex);
4320
4321         prev_status = b43_status(dev);
4322         /* Bring the device down... */
4323         if (prev_status >= B43_STAT_STARTED)
4324                 b43_wireless_core_stop(dev);
4325         if (prev_status >= B43_STAT_INITIALIZED)
4326                 b43_wireless_core_exit(dev);
4327
4328         /* ...and up again. */
4329         if (prev_status >= B43_STAT_INITIALIZED) {
4330                 err = b43_wireless_core_init(dev);
4331                 if (err)
4332                         goto out;
4333         }
4334         if (prev_status >= B43_STAT_STARTED) {
4335                 err = b43_wireless_core_start(dev);
4336                 if (err) {
4337                         b43_wireless_core_exit(dev);
4338                         goto out;
4339                 }
4340         }
4341       out:
4342         mutex_unlock(&wl->mutex);
4343         if (err)
4344                 b43err(wl, "Controller restart FAILED\n");
4345         else
4346                 b43info(wl, "Controller restarted\n");
4347 }
4348
4349 static int b43_setup_bands(struct b43_wldev *dev,
4350                            bool have_2ghz_phy, bool have_5ghz_phy)
4351 {
4352         struct ieee80211_hw *hw = dev->wl->hw;
4353
4354         if (have_2ghz_phy)
4355                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4356         if (dev->phy.type == B43_PHYTYPE_N) {
4357                 if (have_5ghz_phy)
4358                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4359         } else {
4360                 if (have_5ghz_phy)
4361                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4362         }
4363
4364         dev->phy.supports_2ghz = have_2ghz_phy;
4365         dev->phy.supports_5ghz = have_5ghz_phy;
4366
4367         return 0;
4368 }
4369
4370 static void b43_wireless_core_detach(struct b43_wldev *dev)
4371 {
4372         /* We release firmware that late to not be required to re-request
4373          * is all the time when we reinit the core. */
4374         b43_release_firmware(dev);
4375 }
4376
4377 static int b43_wireless_core_attach(struct b43_wldev *dev)
4378 {
4379         struct b43_wl *wl = dev->wl;
4380         struct ssb_bus *bus = dev->dev->bus;
4381         struct pci_dev *pdev = bus->host_pci;
4382         int err;
4383         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4384         u32 tmp;
4385
4386         /* Do NOT do any device initialization here.
4387          * Do it in wireless_core_init() instead.
4388          * This function is for gathering basic information about the HW, only.
4389          * Also some structs may be set up here. But most likely you want to have
4390          * that in core_init(), too.
4391          */
4392
4393         err = ssb_bus_powerup(bus, 0);
4394         if (err) {
4395                 b43err(wl, "Bus powerup failed\n");
4396                 goto out;
4397         }
4398         /* Get the PHY type. */
4399         if (dev->dev->id.revision >= 5) {
4400                 u32 tmshigh;
4401
4402                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4403                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4404                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4405         } else
4406                 B43_WARN_ON(1);
4407
4408         dev->phy.gmode = have_2ghz_phy;
4409         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4410         b43_wireless_core_reset(dev, tmp);
4411
4412         err = b43_phy_versioning(dev);
4413         if (err)
4414                 goto err_powerdown;
4415         /* Check if this device supports multiband. */
4416         if (!pdev ||
4417             (pdev->device != 0x4312 &&
4418              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4419                 /* No multiband support. */
4420                 have_2ghz_phy = 0;
4421                 have_5ghz_phy = 0;
4422                 switch (dev->phy.type) {
4423                 case B43_PHYTYPE_A:
4424                         have_5ghz_phy = 1;
4425                         break;
4426                 case B43_PHYTYPE_G:
4427                 case B43_PHYTYPE_N:
4428                         have_2ghz_phy = 1;
4429                         break;
4430                 default:
4431                         B43_WARN_ON(1);
4432                 }
4433         }
4434         if (dev->phy.type == B43_PHYTYPE_A) {
4435                 /* FIXME */
4436                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4437                 err = -EOPNOTSUPP;
4438                 goto err_powerdown;
4439         }
4440         if (1 /* disable A-PHY */) {
4441                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4442                 if (dev->phy.type != B43_PHYTYPE_N) {
4443                         have_2ghz_phy = 1;
4444                         have_5ghz_phy = 0;
4445                 }
4446         }
4447
4448         dev->phy.gmode = have_2ghz_phy;
4449         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4450         b43_wireless_core_reset(dev, tmp);
4451
4452         err = b43_validate_chipaccess(dev);
4453         if (err)
4454                 goto err_powerdown;
4455         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4456         if (err)
4457                 goto err_powerdown;
4458
4459         /* Now set some default "current_dev" */
4460         if (!wl->current_dev)
4461                 wl->current_dev = dev;
4462         INIT_WORK(&dev->restart_work, b43_chip_reset);
4463
4464         b43_radio_turn_off(dev, 1);
4465         b43_switch_analog(dev, 0);
4466         ssb_device_disable(dev->dev, 0);
4467         ssb_bus_may_powerdown(bus);
4468
4469 out:
4470         return err;
4471
4472 err_powerdown:
4473         ssb_bus_may_powerdown(bus);
4474         return err;
4475 }
4476
4477 static void b43_one_core_detach(struct ssb_device *dev)
4478 {
4479         struct b43_wldev *wldev;
4480         struct b43_wl *wl;
4481
4482         wldev = ssb_get_drvdata(dev);
4483         wl = wldev->wl;
4484         cancel_work_sync(&wldev->restart_work);
4485         b43_debugfs_remove_device(wldev);
4486         b43_wireless_core_detach(wldev);
4487         list_del(&wldev->list);
4488         wl->nr_devs--;
4489         ssb_set_drvdata(dev, NULL);
4490         kfree(wldev);
4491 }
4492
4493 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4494 {
4495         struct b43_wldev *wldev;
4496         struct pci_dev *pdev;
4497         int err = -ENOMEM;
4498
4499         if (!list_empty(&wl->devlist)) {
4500                 /* We are not the first core on this chip. */
4501                 pdev = dev->bus->host_pci;
4502                 /* Only special chips support more than one wireless
4503                  * core, although some of the other chips have more than
4504                  * one wireless core as well. Check for this and
4505                  * bail out early.
4506                  */
4507                 if (!pdev ||
4508                     ((pdev->device != 0x4321) &&
4509                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4510                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4511                         return -ENODEV;
4512                 }
4513         }
4514
4515         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4516         if (!wldev)
4517                 goto out;
4518
4519         wldev->dev = dev;
4520         wldev->wl = wl;
4521         b43_set_status(wldev, B43_STAT_UNINIT);
4522         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4523         tasklet_init(&wldev->isr_tasklet,
4524                      (void (*)(unsigned long))b43_interrupt_tasklet,
4525                      (unsigned long)wldev);
4526         INIT_LIST_HEAD(&wldev->list);
4527
4528         err = b43_wireless_core_attach(wldev);
4529         if (err)
4530                 goto err_kfree_wldev;
4531
4532         list_add(&wldev->list, &wl->devlist);
4533         wl->nr_devs++;
4534         ssb_set_drvdata(dev, wldev);
4535         b43_debugfs_add_device(wldev);
4536
4537       out:
4538         return err;
4539
4540       err_kfree_wldev:
4541         kfree(wldev);
4542         return err;
4543 }
4544
4545 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4546         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4547         (pdev->device == _device) &&                                    \
4548         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4549         (pdev->subsystem_device == _subdevice)                          )
4550
4551 static void b43_sprom_fixup(struct ssb_bus *bus)
4552 {
4553         struct pci_dev *pdev;
4554
4555         /* boardflags workarounds */
4556         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4557             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4558                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4559         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4560             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4561                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4562         if (bus->bustype == SSB_BUSTYPE_PCI) {
4563                 pdev = bus->host_pci;
4564                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4565                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4566                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
4567                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4568         }
4569 }
4570
4571 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4572 {
4573         struct ieee80211_hw *hw = wl->hw;
4574
4575         ssb_set_devtypedata(dev, NULL);
4576         ieee80211_free_hw(hw);
4577 }
4578
4579 static int b43_wireless_init(struct ssb_device *dev)
4580 {
4581         struct ssb_sprom *sprom = &dev->bus->sprom;
4582         struct ieee80211_hw *hw;
4583         struct b43_wl *wl;
4584         int err = -ENOMEM;
4585
4586         b43_sprom_fixup(dev->bus);
4587
4588         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4589         if (!hw) {
4590                 b43err(NULL, "Could not allocate ieee80211 device\n");
4591                 goto out;
4592         }
4593
4594         /* fill hw info */
4595         hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
4596                     IEEE80211_HW_RX_INCLUDES_FCS |
4597                     IEEE80211_HW_SIGNAL_DBM |
4598                     IEEE80211_HW_NOISE_DBM;
4599
4600         hw->queues = b43_modparam_qos ? 4 : 1;
4601         SET_IEEE80211_DEV(hw, dev->dev);
4602         if (is_valid_ether_addr(sprom->et1mac))
4603                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4604         else
4605                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4606
4607         /* Get and initialize struct b43_wl */
4608         wl = hw_to_b43_wl(hw);
4609         memset(wl, 0, sizeof(*wl));
4610         wl->hw = hw;
4611         spin_lock_init(&wl->irq_lock);
4612         rwlock_init(&wl->tx_lock);
4613         spin_lock_init(&wl->leds_lock);
4614         spin_lock_init(&wl->shm_lock);
4615         mutex_init(&wl->mutex);
4616         INIT_LIST_HEAD(&wl->devlist);
4617         INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
4618         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4619
4620         ssb_set_devtypedata(dev, wl);
4621         b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4622         err = 0;
4623       out:
4624         return err;
4625 }
4626
4627 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4628 {
4629         struct b43_wl *wl;
4630         int err;
4631         int first = 0;
4632
4633         wl = ssb_get_devtypedata(dev);
4634         if (!wl) {
4635                 /* Probing the first core. Must setup common struct b43_wl */
4636                 first = 1;
4637                 err = b43_wireless_init(dev);
4638                 if (err)
4639                         goto out;
4640                 wl = ssb_get_devtypedata(dev);
4641                 B43_WARN_ON(!wl);
4642         }
4643         err = b43_one_core_attach(dev, wl);
4644         if (err)
4645                 goto err_wireless_exit;
4646
4647         if (first) {
4648                 err = ieee80211_register_hw(wl->hw);
4649                 if (err)
4650                         goto err_one_core_detach;
4651         }
4652
4653       out:
4654         return err;
4655
4656       err_one_core_detach:
4657         b43_one_core_detach(dev);
4658       err_wireless_exit:
4659         if (first)
4660                 b43_wireless_exit(dev, wl);
4661         return err;
4662 }
4663
4664 static void b43_remove(struct ssb_device *dev)
4665 {
4666         struct b43_wl *wl = ssb_get_devtypedata(dev);
4667         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4668
4669         B43_WARN_ON(!wl);
4670         if (wl->current_dev == wldev)
4671                 ieee80211_unregister_hw(wl->hw);
4672
4673         b43_one_core_detach(dev);
4674
4675         if (list_empty(&wl->devlist)) {
4676                 /* Last core on the chip unregistered.
4677                  * We can destroy common struct b43_wl.
4678                  */
4679                 b43_wireless_exit(dev, wl);
4680         }
4681 }
4682
4683 /* Perform a hardware reset. This can be called from any context. */
4684 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4685 {
4686         /* Must avoid requeueing, if we are in shutdown. */
4687         if (b43_status(dev) < B43_STAT_INITIALIZED)
4688                 return;
4689         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4690         queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4691 }
4692
4693 #ifdef CONFIG_PM
4694
4695 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4696 {
4697         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4698         struct b43_wl *wl = wldev->wl;
4699
4700         b43dbg(wl, "Suspending...\n");
4701
4702         mutex_lock(&wl->mutex);
4703         wldev->suspend_in_progress = true;
4704         wldev->suspend_init_status = b43_status(wldev);
4705         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4706                 b43_wireless_core_stop(wldev);
4707         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4708                 b43_wireless_core_exit(wldev);
4709         mutex_unlock(&wl->mutex);
4710
4711         b43dbg(wl, "Device suspended.\n");
4712
4713         return 0;
4714 }
4715
4716 static int b43_resume(struct ssb_device *dev)
4717 {
4718         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4719         struct b43_wl *wl = wldev->wl;
4720         int err = 0;
4721
4722         b43dbg(wl, "Resuming...\n");
4723
4724         mutex_lock(&wl->mutex);
4725         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4726                 err = b43_wireless_core_init(wldev);
4727                 if (err) {
4728                         b43err(wl, "Resume failed at core init\n");
4729                         goto out;
4730                 }
4731         }
4732         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4733                 err = b43_wireless_core_start(wldev);
4734                 if (err) {
4735                         b43_leds_exit(wldev);
4736                         b43_rng_exit(wldev->wl);
4737                         b43_wireless_core_exit(wldev);
4738                         b43err(wl, "Resume failed at core start\n");
4739                         goto out;
4740                 }
4741         }
4742         b43dbg(wl, "Device resumed.\n");
4743  out:
4744         wldev->suspend_in_progress = false;
4745         mutex_unlock(&wl->mutex);
4746         return err;
4747 }
4748
4749 #else /* CONFIG_PM */
4750 # define b43_suspend    NULL
4751 # define b43_resume     NULL
4752 #endif /* CONFIG_PM */
4753
4754 static struct ssb_driver b43_ssb_driver = {
4755         .name           = KBUILD_MODNAME,
4756         .id_table       = b43_ssb_tbl,
4757         .probe          = b43_probe,
4758         .remove         = b43_remove,
4759         .suspend        = b43_suspend,
4760         .resume         = b43_resume,
4761 };
4762
4763 static void b43_print_driverinfo(void)
4764 {
4765         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4766                    *feat_leds = "", *feat_rfkill = "";
4767
4768 #ifdef CONFIG_B43_PCI_AUTOSELECT
4769         feat_pci = "P";
4770 #endif
4771 #ifdef CONFIG_B43_PCMCIA
4772         feat_pcmcia = "M";
4773 #endif
4774 #ifdef CONFIG_B43_NPHY
4775         feat_nphy = "N";
4776 #endif
4777 #ifdef CONFIG_B43_LEDS
4778         feat_leds = "L";
4779 #endif
4780 #ifdef CONFIG_B43_RFKILL
4781         feat_rfkill = "R";
4782 #endif
4783         printk(KERN_INFO "Broadcom 43xx driver loaded "
4784                "[ Features: %s%s%s%s%s, Firmware-ID: "
4785                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4786                feat_pci, feat_pcmcia, feat_nphy,
4787                feat_leds, feat_rfkill);
4788 }
4789
4790 static int __init b43_init(void)
4791 {
4792         int err;
4793
4794         b43_debugfs_init();
4795         err = b43_pcmcia_init();
4796         if (err)
4797                 goto err_dfs_exit;
4798         err = ssb_driver_register(&b43_ssb_driver);
4799         if (err)
4800                 goto err_pcmcia_exit;
4801         b43_print_driverinfo();
4802
4803         return err;
4804
4805 err_pcmcia_exit:
4806         b43_pcmcia_exit();
4807 err_dfs_exit:
4808         b43_debugfs_exit();
4809         return err;
4810 }
4811
4812 static void __exit b43_exit(void)
4813 {
4814         ssb_driver_unregister(&b43_ssb_driver);
4815         b43_pcmcia_exit();
4816         b43_debugfs_exit();
4817 }
4818
4819 module_init(b43_init)
4820 module_exit(b43_exit)