drivers/net/wireless/broadcom/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
  11
  12   SDIO support
  13   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  14
  15   Some parts of the code in this file are derived from the ipw2200
  16   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  17
  18   This program is free software; you can redistribute it and/or modify
  19   it under the terms of the GNU General Public License as published by
  20   the Free Software Foundation; either version 2 of the License, or
  21   (at your option) any later version.
  22
  23   This program is distributed in the hope that it will be useful,
  24   but WITHOUT ANY WARRANTY; without even the implied warranty of
  25   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26   GNU General Public License for more details.
  27
  28   You should have received a copy of the GNU General Public License
  29   along with this program; see the file COPYING.  If not, write to
  30   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  31   Boston, MA 02110-1301, USA.
  32
  33 */
  34
  35 #include <linux/delay.h>
  36 #include <linux/init.h>
  37 #include <linux/module.h>
  38 #include <linux/if_arp.h>
  39 #include <linux/etherdevice.h>
  40 #include <linux/firmware.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "sdio.h"
  60 #include <linux/mmc/sdio_func.h>
  61
  62 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  63 MODULE_AUTHOR("Martin Langer");
  64 MODULE_AUTHOR("Stefano Brivio");
  65 MODULE_AUTHOR("Michael Buesch");
  66 MODULE_AUTHOR("Gábor Stefanik");
  67 MODULE_AUTHOR("Rafał Miłecki");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE("b43/ucode11.fw");
  71 MODULE_FIRMWARE("b43/ucode13.fw");
  72 MODULE_FIRMWARE("b43/ucode14.fw");
  73 MODULE_FIRMWARE("b43/ucode15.fw");
  74 MODULE_FIRMWARE("b43/ucode16_lp.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode24_lcn.fw");
  77 MODULE_FIRMWARE("b43/ucode25_lcn.fw");
  78 MODULE_FIRMWARE("b43/ucode25_mimo.fw");
  79 MODULE_FIRMWARE("b43/ucode26_mimo.fw");
  80 MODULE_FIRMWARE("b43/ucode29_mimo.fw");
  81 MODULE_FIRMWARE("b43/ucode33_lcn40.fw");
  82 MODULE_FIRMWARE("b43/ucode30_mimo.fw");
  83 MODULE_FIRMWARE("b43/ucode5.fw");
  84 MODULE_FIRMWARE("b43/ucode40.fw");
  85 MODULE_FIRMWARE("b43/ucode42.fw");
  86 MODULE_FIRMWARE("b43/ucode9.fw");
  87
  88 static int modparam_bad_frames_preempt;
  89 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  90 MODULE_PARM_DESC(bad_frames_preempt,
  91                  "enable(1) / disable(0) Bad Frames Preemption");
  92
  93 static char modparam_fwpostfix[16];
  94 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  95 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  96
  97 static int modparam_hwpctl;
  98 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  99 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
 100
 101 static int modparam_nohwcrypt;
 102 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
 103 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 104
 105 static int modparam_hwtkip;
 106 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
 107 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
 108
 109 static int modparam_qos = 1;
 110 module_param_named(qos, modparam_qos, int, 0444);
 111 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 112
 113 static int modparam_btcoex = 1;
 114 module_param_named(btcoex, modparam_btcoex, int, 0444);
 115 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 116
 117 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 118 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 119 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 120
 121 static int b43_modparam_pio = 0;
 122 module_param_named(pio, b43_modparam_pio, int, 0644);
 123 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 124
 125 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
 126 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
 127 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
 128
 129 #ifdef CONFIG_B43_BCMA
 130 static const struct bcma_device_id b43_bcma_tbl[] = {
 131         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 132         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
 133         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 134         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 135         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
 136         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 137         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
 138         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
 139         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
 140         {},
 141 };
 142 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 143 #endif
 144
 145 #ifdef CONFIG_B43_SSB
 146 static const struct ssb_device_id b43_ssb_tbl[] = {
 147         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 148         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 149         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 150         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 151         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 152         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 153         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 154         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 155         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 156         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 157         {},
 158 };
 159 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 160 #endif
 161
 162 /* Channel and ratetables are shared for all devices.
 163  * They can't be const, because ieee80211 puts some precalculated
 164  * data in there. This data is the same for all devices, so we don't
 165  * get concurrency issues */
 166 #define RATETAB_ENT(_rateid, _flags) \
 167         {                                                               \
 168                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 169                 .hw_value       = (_rateid),                            \
 170                 .flags          = (_flags),                             \
 171         }
 172
 173 /*
 174  * NOTE: When changing this, sync with xmit.c's
 175  *       b43_plcp_get_bitrate_idx_* functions!
 176  */
 177 static struct ieee80211_rate __b43_ratetable[] = {
 178         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 179         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 180         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 181         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 182         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 183         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 184         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 185         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 186         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 187         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 188         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 189         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 190 };
 191
 192 #define b43_a_ratetable         (__b43_ratetable + 4)
 193 #define b43_a_ratetable_size    8
 194 #define b43_b_ratetable         (__b43_ratetable + 0)
 195 #define b43_b_ratetable_size    4
 196 #define b43_g_ratetable         (__b43_ratetable + 0)
 197 #define b43_g_ratetable_size    12
 198
 199 #define CHAN2G(_channel, _freq, _flags) {                       \
 200         .band                   = NL80211_BAND_2GHZ,            \
 201         .center_freq            = (_freq),                      \
 202         .hw_value               = (_channel),                   \
 203         .flags                  = (_flags),                     \
 204         .max_antenna_gain       = 0,                            \
 205         .max_power              = 30,                           \
 206 }
 207 static struct ieee80211_channel b43_2ghz_chantable[] = {
 208         CHAN2G(1, 2412, 0),
 209         CHAN2G(2, 2417, 0),
 210         CHAN2G(3, 2422, 0),
 211         CHAN2G(4, 2427, 0),
 212         CHAN2G(5, 2432, 0),
 213         CHAN2G(6, 2437, 0),
 214         CHAN2G(7, 2442, 0),
 215         CHAN2G(8, 2447, 0),
 216         CHAN2G(9, 2452, 0),
 217         CHAN2G(10, 2457, 0),
 218         CHAN2G(11, 2462, 0),
 219         CHAN2G(12, 2467, 0),
 220         CHAN2G(13, 2472, 0),
 221         CHAN2G(14, 2484, 0),
 222 };
 223
 224 /* No support for the last 3 channels (12, 13, 14) */
 225 #define b43_2ghz_chantable_limited_size         11
 226 #undef CHAN2G
 227
 228 #define CHAN4G(_channel, _flags) {                              \
 229         .band                   = NL80211_BAND_5GHZ,            \
 230         .center_freq            = 4000 + (5 * (_channel)),      \
 231         .hw_value               = (_channel),                   \
 232         .flags                  = (_flags),                     \
 233         .max_antenna_gain       = 0,                            \
 234         .max_power              = 30,                           \
 235 }
 236 #define CHAN5G(_channel, _flags) {                              \
 237         .band                   = NL80211_BAND_5GHZ,            \
 238         .center_freq            = 5000 + (5 * (_channel)),      \
 239         .hw_value               = (_channel),                   \
 240         .flags                  = (_flags),                     \
 241         .max_antenna_gain       = 0,                            \
 242         .max_power              = 30,                           \
 243 }
 244 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 245         CHAN4G(184, 0),         CHAN4G(186, 0),
 246         CHAN4G(188, 0),         CHAN4G(190, 0),
 247         CHAN4G(192, 0),         CHAN4G(194, 0),
 248         CHAN4G(196, 0),         CHAN4G(198, 0),
 249         CHAN4G(200, 0),         CHAN4G(202, 0),
 250         CHAN4G(204, 0),         CHAN4G(206, 0),
 251         CHAN4G(208, 0),         CHAN4G(210, 0),
 252         CHAN4G(212, 0),         CHAN4G(214, 0),
 253         CHAN4G(216, 0),         CHAN4G(218, 0),
 254         CHAN4G(220, 0),         CHAN4G(222, 0),
 255         CHAN4G(224, 0),         CHAN4G(226, 0),
 256         CHAN4G(228, 0),
 257         CHAN5G(32, 0),          CHAN5G(34, 0),
 258         CHAN5G(36, 0),          CHAN5G(38, 0),
 259         CHAN5G(40, 0),          CHAN5G(42, 0),
 260         CHAN5G(44, 0),          CHAN5G(46, 0),
 261         CHAN5G(48, 0),          CHAN5G(50, 0),
 262         CHAN5G(52, 0),          CHAN5G(54, 0),
 263         CHAN5G(56, 0),          CHAN5G(58, 0),
 264         CHAN5G(60, 0),          CHAN5G(62, 0),
 265         CHAN5G(64, 0),          CHAN5G(66, 0),
 266         CHAN5G(68, 0),          CHAN5G(70, 0),
 267         CHAN5G(72, 0),          CHAN5G(74, 0),
 268         CHAN5G(76, 0),          CHAN5G(78, 0),
 269         CHAN5G(80, 0),          CHAN5G(82, 0),
 270         CHAN5G(84, 0),          CHAN5G(86, 0),
 271         CHAN5G(88, 0),          CHAN5G(90, 0),
 272         CHAN5G(92, 0),          CHAN5G(94, 0),
 273         CHAN5G(96, 0),          CHAN5G(98, 0),
 274         CHAN5G(100, 0),         CHAN5G(102, 0),
 275         CHAN5G(104, 0),         CHAN5G(106, 0),
 276         CHAN5G(108, 0),         CHAN5G(110, 0),
 277         CHAN5G(112, 0),         CHAN5G(114, 0),
 278         CHAN5G(116, 0),         CHAN5G(118, 0),
 279         CHAN5G(120, 0),         CHAN5G(122, 0),
 280         CHAN5G(124, 0),         CHAN5G(126, 0),
 281         CHAN5G(128, 0),         CHAN5G(130, 0),
 282         CHAN5G(132, 0),         CHAN5G(134, 0),
 283         CHAN5G(136, 0),         CHAN5G(138, 0),
 284         CHAN5G(140, 0),         CHAN5G(142, 0),
 285         CHAN5G(144, 0),         CHAN5G(145, 0),
 286         CHAN5G(146, 0),         CHAN5G(147, 0),
 287         CHAN5G(148, 0),         CHAN5G(149, 0),
 288         CHAN5G(150, 0),         CHAN5G(151, 0),
 289         CHAN5G(152, 0),         CHAN5G(153, 0),
 290         CHAN5G(154, 0),         CHAN5G(155, 0),
 291         CHAN5G(156, 0),         CHAN5G(157, 0),
 292         CHAN5G(158, 0),         CHAN5G(159, 0),
 293         CHAN5G(160, 0),         CHAN5G(161, 0),
 294         CHAN5G(162, 0),         CHAN5G(163, 0),
 295         CHAN5G(164, 0),         CHAN5G(165, 0),
 296         CHAN5G(166, 0),         CHAN5G(168, 0),
 297         CHAN5G(170, 0),         CHAN5G(172, 0),
 298         CHAN5G(174, 0),         CHAN5G(176, 0),
 299         CHAN5G(178, 0),         CHAN5G(180, 0),
 300         CHAN5G(182, 0),
 301 };
 302
 303 static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
 304         CHAN5G(36, 0),          CHAN5G(40, 0),
 305         CHAN5G(44, 0),          CHAN5G(48, 0),
 306         CHAN5G(149, 0),         CHAN5G(153, 0),
 307         CHAN5G(157, 0),         CHAN5G(161, 0),
 308         CHAN5G(165, 0),
 309 };
 310
 311 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 312         CHAN5G(34, 0),          CHAN5G(36, 0),
 313         CHAN5G(38, 0),          CHAN5G(40, 0),
 314         CHAN5G(42, 0),          CHAN5G(44, 0),
 315         CHAN5G(46, 0),          CHAN5G(48, 0),
 316         CHAN5G(52, 0),          CHAN5G(56, 0),
 317         CHAN5G(60, 0),          CHAN5G(64, 0),
 318         CHAN5G(100, 0),         CHAN5G(104, 0),
 319         CHAN5G(108, 0),         CHAN5G(112, 0),
 320         CHAN5G(116, 0),         CHAN5G(120, 0),
 321         CHAN5G(124, 0),         CHAN5G(128, 0),
 322         CHAN5G(132, 0),         CHAN5G(136, 0),
 323         CHAN5G(140, 0),         CHAN5G(149, 0),
 324         CHAN5G(153, 0),         CHAN5G(157, 0),
 325         CHAN5G(161, 0),         CHAN5G(165, 0),
 326         CHAN5G(184, 0),         CHAN5G(188, 0),
 327         CHAN5G(192, 0),         CHAN5G(196, 0),
 328         CHAN5G(200, 0),         CHAN5G(204, 0),
 329         CHAN5G(208, 0),         CHAN5G(212, 0),
 330         CHAN5G(216, 0),
 331 };
 332 #undef CHAN4G
 333 #undef CHAN5G
 334
 335 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 336         .band           = NL80211_BAND_5GHZ,
 337         .channels       = b43_5ghz_nphy_chantable,
 338         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 339         .bitrates       = b43_a_ratetable,
 340         .n_bitrates     = b43_a_ratetable_size,
 341 };
 342
 343 static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
 344         .band           = NL80211_BAND_5GHZ,
 345         .channels       = b43_5ghz_nphy_chantable_limited,
 346         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
 347         .bitrates       = b43_a_ratetable,
 348         .n_bitrates     = b43_a_ratetable_size,
 349 };
 350
 351 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 352         .band           = NL80211_BAND_5GHZ,
 353         .channels       = b43_5ghz_aphy_chantable,
 354         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 355         .bitrates       = b43_a_ratetable,
 356         .n_bitrates     = b43_a_ratetable_size,
 357 };
 358
 359 static struct ieee80211_supported_band b43_band_2GHz = {
 360         .band           = NL80211_BAND_2GHZ,
 361         .channels       = b43_2ghz_chantable,
 362         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 363         .bitrates       = b43_g_ratetable,
 364         .n_bitrates     = b43_g_ratetable_size,
 365 };
 366
 367 static struct ieee80211_supported_band b43_band_2ghz_limited = {
 368         .band           = NL80211_BAND_2GHZ,
 369         .channels       = b43_2ghz_chantable,
 370         .n_channels     = b43_2ghz_chantable_limited_size,
 371         .bitrates       = b43_g_ratetable,
 372         .n_bitrates     = b43_g_ratetable_size,
 373 };
 374
 375 static void b43_wireless_core_exit(struct b43_wldev *dev);
 376 static int b43_wireless_core_init(struct b43_wldev *dev);
 377 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 378 static int b43_wireless_core_start(struct b43_wldev *dev);
 379 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 380                                     struct ieee80211_vif *vif,
 381                                     struct ieee80211_bss_conf *conf,
 382                                     u32 changed);
 383
 384 static int b43_ratelimit(struct b43_wl *wl)
 385 {
 386         if (!wl || !wl->current_dev)
 387                 return 1;
 388         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 389                 return 1;
 390         /* We are up and running.
 391          * Ratelimit the messages to avoid DoS over the net. */
 392         return net_ratelimit();
 393 }
 394
 395 void b43info(struct b43_wl *wl, const char *fmt, ...)
 396 {
 397         struct va_format vaf;
 398         va_list args;
 399
 400         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 401                 return;
 402         if (!b43_ratelimit(wl))
 403                 return;
 404
 405         va_start(args, fmt);
 406
 407         vaf.fmt = fmt;
 408         vaf.va = &args;
 409
 410         printk(KERN_INFO "b43-%s: %pV",
 411                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 412
 413         va_end(args);
 414 }
 415
 416 void b43err(struct b43_wl *wl, const char *fmt, ...)
 417 {
 418         struct va_format vaf;
 419         va_list args;
 420
 421         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 422                 return;
 423         if (!b43_ratelimit(wl))
 424                 return;
 425
 426         va_start(args, fmt);
 427
 428         vaf.fmt = fmt;
 429         vaf.va = &args;
 430
 431         printk(KERN_ERR "b43-%s ERROR: %pV",
 432                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 433
 434         va_end(args);
 435 }
 436
 437 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 438 {
 439         struct va_format vaf;
 440         va_list args;
 441
 442         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 443                 return;
 444         if (!b43_ratelimit(wl))
 445                 return;
 446
 447         va_start(args, fmt);
 448
 449         vaf.fmt = fmt;
 450         vaf.va = &args;
 451
 452         printk(KERN_WARNING "b43-%s warning: %pV",
 453                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 454
 455         va_end(args);
 456 }
 457
 458 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 459 {
 460         struct va_format vaf;
 461         va_list args;
 462
 463         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 464                 return;
 465
 466         va_start(args, fmt);
 467
 468         vaf.fmt = fmt;
 469         vaf.va = &args;
 470
 471         printk(KERN_DEBUG "b43-%s debug: %pV",
 472                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 473
 474         va_end(args);
 475 }
 476
 477 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 478 {
 479         u32 macctl;
 480
 481         B43_WARN_ON(offset % 4 != 0);
 482
 483         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 484         if (macctl & B43_MACCTL_BE)
 485                 val = swab32(val);
 486
 487         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 488         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 489 }
 490
 491 static inline void b43_shm_control_word(struct b43_wldev *dev,
 492                                         u16 routing, u16 offset)
 493 {
 494         u32 control;
 495
 496         /* "offset" is the WORD offset. */
 497         control = routing;
 498         control <<= 16;
 499         control |= offset;
 500         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 501 }
 502
 503 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 504 {
 505         u32 ret;
 506
 507         if (routing == B43_SHM_SHARED) {
 508                 B43_WARN_ON(offset & 0x0001);
 509                 if (offset & 0x0003) {
 510                         /* Unaligned access */
 511                         b43_shm_control_word(dev, routing, offset >> 2);
 512                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 513                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 514                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 515
 516                         goto out;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 522 out:
 523         return ret;
 524 }
 525
 526 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 527 {
 528         u16 ret;
 529
 530         if (routing == B43_SHM_SHARED) {
 531                 B43_WARN_ON(offset & 0x0001);
 532                 if (offset & 0x0003) {
 533                         /* Unaligned access */
 534                         b43_shm_control_word(dev, routing, offset >> 2);
 535                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 536
 537                         goto out;
 538                 }
 539                 offset >>= 2;
 540         }
 541         b43_shm_control_word(dev, routing, offset);
 542         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 543 out:
 544         return ret;
 545 }
 546
 547 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 548 {
 549         if (routing == B43_SHM_SHARED) {
 550                 B43_WARN_ON(offset & 0x0001);
 551                 if (offset & 0x0003) {
 552                         /* Unaligned access */
 553                         b43_shm_control_word(dev, routing, offset >> 2);
 554                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 555                                     value & 0xFFFF);
 556                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 557                         b43_write16(dev, B43_MMIO_SHM_DATA,
 558                                     (value >> 16) & 0xFFFF);
 559                         return;
 560                 }
 561                 offset >>= 2;
 562         }
 563         b43_shm_control_word(dev, routing, offset);
 564         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 565 }
 566
 567 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 568 {
 569         if (routing == B43_SHM_SHARED) {
 570                 B43_WARN_ON(offset & 0x0001);
 571                 if (offset & 0x0003) {
 572                         /* Unaligned access */
 573                         b43_shm_control_word(dev, routing, offset >> 2);
 574                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 575                         return;
 576                 }
 577                 offset >>= 2;
 578         }
 579         b43_shm_control_word(dev, routing, offset);
 580         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 581 }
 582
 583 /* Read HostFlags */
 584 u64 b43_hf_read(struct b43_wldev *dev)
 585 {
 586         u64 ret;
 587
 588         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
 589         ret <<= 16;
 590         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
 591         ret <<= 16;
 592         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
 593
 594         return ret;
 595 }
 596
 597 /* Write HostFlags */
 598 void b43_hf_write(struct b43_wldev *dev, u64 value)
 599 {
 600         u16 lo, mi, hi;
 601
 602         lo = (value & 0x00000000FFFFULL);
 603         mi = (value & 0x0000FFFF0000ULL) >> 16;
 604         hi = (value & 0xFFFF00000000ULL) >> 32;
 605         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
 606         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
 607         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
 608 }
 609
 610 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 611 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 612 {
 613         B43_WARN_ON(!dev->fw.opensource);
 614         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 615 }
 616
 617 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 618 {
 619         u32 low, high;
 620
 621         B43_WARN_ON(dev->dev->core_rev < 3);
 622
 623         /* The hardware guarantees us an atomic read, if we
 624          * read the low register first. */
 625         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 626         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 627
 628         *tsf = high;
 629         *tsf <<= 32;
 630         *tsf |= low;
 631 }
 632
 633 static void b43_time_lock(struct b43_wldev *dev)
 634 {
 635         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
 636         /* Commit the write */
 637         b43_read32(dev, B43_MMIO_MACCTL);
 638 }
 639
 640 static void b43_time_unlock(struct b43_wldev *dev)
 641 {
 642         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
 643         /* Commit the write */
 644         b43_read32(dev, B43_MMIO_MACCTL);
 645 }
 646
 647 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 648 {
 649         u32 low, high;
 650
 651         B43_WARN_ON(dev->dev->core_rev < 3);
 652
 653         low = tsf;
 654         high = (tsf >> 32);
 655         /* The hardware guarantees us an atomic write, if we
 656          * write the low register first. */
 657         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 658         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 659 }
 660
 661 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 662 {
 663         b43_time_lock(dev);
 664         b43_tsf_write_locked(dev, tsf);
 665         b43_time_unlock(dev);
 666 }
 667
 668 static
 669 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 670 {
 671         static const u8 zero_addr[ETH_ALEN] = { 0 };
 672         u16 data;
 673
 674         if (!mac)
 675                 mac = zero_addr;
 676
 677         offset |= 0x0020;
 678         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 679
 680         data = mac[0];
 681         data |= mac[1] << 8;
 682         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 683         data = mac[2];
 684         data |= mac[3] << 8;
 685         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 686         data = mac[4];
 687         data |= mac[5] << 8;
 688         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 689 }
 690
 691 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 692 {
 693         const u8 *mac;
 694         const u8 *bssid;
 695         u8 mac_bssid[ETH_ALEN * 2];
 696         int i;
 697         u32 tmp;
 698
 699         bssid = dev->wl->bssid;
 700         mac = dev->wl->mac_addr;
 701
 702         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 703
 704         memcpy(mac_bssid, mac, ETH_ALEN);
 705         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 706
 707         /* Write our MAC address and BSSID to template ram */
 708         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 709                 tmp = (u32) (mac_bssid[i + 0]);
 710                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 711                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 712                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 713                 b43_ram_write(dev, 0x20 + i, tmp);
 714         }
 715 }
 716
 717 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 718 {
 719         b43_write_mac_bssid_templates(dev);
 720         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 721 }
 722
 723 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 724 {
 725         /* slot_time is in usec. */
 726         /* This test used to exit for all but a G PHY. */
 727         if (b43_current_band(dev->wl) == NL80211_BAND_5GHZ)
 728                 return;
 729         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 730         /* Shared memory location 0x0010 is the slot time and should be
 731          * set to slot_time; however, this register is initially 0 and changing
 732          * the value adversely affects the transmit rate for BCM4311
 733          * devices. Until this behavior is unterstood, delete this step
 734          *
 735          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 736          */
 737 }
 738
 739 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 740 {
 741         b43_set_slot_time(dev, 9);
 742 }
 743
 744 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 745 {
 746         b43_set_slot_time(dev, 20);
 747 }
 748
 749 /* DummyTransmission function, as documented on
 750  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 751  */
 752 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 753 {
 754         struct b43_phy *phy = &dev->phy;
 755         unsigned int i, max_loop;
 756         u16 value;
 757         u32 buffer[5] = {
 758                 0x00000000,
 759                 0x00D40000,
 760                 0x00000000,
 761                 0x01000000,
 762                 0x00000000,
 763         };
 764
 765         if (ofdm) {
 766                 max_loop = 0x1E;
 767                 buffer[0] = 0x000201CC;
 768         } else {
 769                 max_loop = 0xFA;
 770                 buffer[0] = 0x000B846E;
 771         }
 772
 773         for (i = 0; i < 5; i++)
 774                 b43_ram_write(dev, i * 4, buffer[i]);
 775
 776         b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
 777
 778         if (dev->dev->core_rev < 11)
 779                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
 780         else
 781                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
 782
 783         value = (ofdm ? 0x41 : 0x40);
 784         b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
 785         if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
 786             phy->type == B43_PHYTYPE_LCN)
 787                 b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
 788
 789         b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
 790         b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
 791
 792         b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
 793         b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
 794         b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
 795         b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
 796
 797         if (!pa_on && phy->type == B43_PHYTYPE_N)
 798                 ; /*b43_nphy_pa_override(dev, false) */
 799
 800         switch (phy->type) {
 801         case B43_PHYTYPE_N:
 802         case B43_PHYTYPE_LCN:
 803                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
 804                 break;
 805         case B43_PHYTYPE_LP:
 806                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
 807                 break;
 808         default:
 809                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
 810         }
 811         b43_read16(dev, B43_MMIO_TXE0_AUX);
 812
 813         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 814                 b43_radio_write16(dev, 0x0051, 0x0017);
 815         for (i = 0x00; i < max_loop; i++) {
 816                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 817                 if (value & 0x0080)
 818                         break;
 819                 udelay(10);
 820         }
 821         for (i = 0x00; i < 0x0A; i++) {
 822                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 823                 if (value & 0x0400)
 824                         break;
 825                 udelay(10);
 826         }
 827         for (i = 0x00; i < 0x19; i++) {
 828                 value = b43_read16(dev, B43_MMIO_IFSSTAT);
 829                 if (!(value & 0x0100))
 830                         break;
 831                 udelay(10);
 832         }
 833         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 834                 b43_radio_write16(dev, 0x0051, 0x0037);
 835 }
 836
 837 static void key_write(struct b43_wldev *dev,
 838                       u8 index, u8 algorithm, const u8 *key)
 839 {
 840         unsigned int i;
 841         u32 offset;
 842         u16 value;
 843         u16 kidx;
 844
 845         /* Key index/algo block */
 846         kidx = b43_kidx_to_fw(dev, index);
 847         value = ((kidx << 4) | algorithm);
 848         b43_shm_write16(dev, B43_SHM_SHARED,
 849                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 850
 851         /* Write the key to the Key Table Pointer offset */
 852         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 853         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 854                 value = key[i];
 855                 value |= (u16) (key[i + 1]) << 8;
 856                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 857         }
 858 }
 859
 860 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 861 {
 862         u32 addrtmp[2] = { 0, 0, };
 863         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 864
 865         if (b43_new_kidx_api(dev))
 866                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 867
 868         B43_WARN_ON(index < pairwise_keys_start);
 869         /* We have four default TX keys and possibly four default RX keys.
 870          * Physical mac 0 is mapped to physical key 4 or 8, depending
 871          * on the firmware version.
 872          * So we must adjust the index here.
 873          */
 874         index -= pairwise_keys_start;
 875         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 876
 877         if (addr) {
 878                 addrtmp[0] = addr[0];
 879                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 880                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 881                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 882                 addrtmp[1] = addr[4];
 883                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 884         }
 885
 886         /* Receive match transmitter address (RCMTA) mechanism */
 887         b43_shm_write32(dev, B43_SHM_RCMTA,
 888                         (index * 2) + 0, addrtmp[0]);
 889         b43_shm_write16(dev, B43_SHM_RCMTA,
 890                         (index * 2) + 1, addrtmp[1]);
 891 }
 892
 893 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 894  * When a packet is received, the iv32 is checked.
 895  * - if it doesn't the packet is returned without modification (and software
 896  *   decryption can be done). That's what happen when iv16 wrap.
 897  * - if it does, the rc4 key is computed, and decryption is tried.
 898  *   Either it will success and B43_RX_MAC_DEC is returned,
 899  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 900  *   and the packet is not usable (it got modified by the ucode).
 901  * So in order to never have B43_RX_MAC_DECERR, we should provide
 902  * a iv32 and phase1key that match. Because we drop packets in case of
 903  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 904  * packets will be lost without higher layer knowing (ie no resync possible
 905  * until next wrap).
 906  *
 907  * NOTE : this should support 50 key like RCMTA because
 908  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 909  */
 910 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 911                 u16 *phase1key)
 912 {
 913         unsigned int i;
 914         u32 offset;
 915         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 916
 917         if (!modparam_hwtkip)
 918                 return;
 919
 920         if (b43_new_kidx_api(dev))
 921                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 922
 923         B43_WARN_ON(index < pairwise_keys_start);
 924         /* We have four default TX keys and possibly four default RX keys.
 925          * Physical mac 0 is mapped to physical key 4 or 8, depending
 926          * on the firmware version.
 927          * So we must adjust the index here.
 928          */
 929         index -= pairwise_keys_start;
 930         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 931
 932         if (b43_debug(dev, B43_DBG_KEYS)) {
 933                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 934                                 index, iv32);
 935         }
 936         /* Write the key to the  RX tkip shared mem */
 937         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 938         for (i = 0; i < 10; i += 2) {
 939                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 940                                 phase1key ? phase1key[i / 2] : 0);
 941         }
 942         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 943         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 944 }
 945
 946 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 947                                    struct ieee80211_vif *vif,
 948                                    struct ieee80211_key_conf *keyconf,
 949                                    struct ieee80211_sta *sta,
 950                                    u32 iv32, u16 *phase1key)
 951 {
 952         struct b43_wl *wl = hw_to_b43_wl(hw);
 953         struct b43_wldev *dev;
 954         int index = keyconf->hw_key_idx;
 955
 956         if (B43_WARN_ON(!modparam_hwtkip))
 957                 return;
 958
 959         /* This is only called from the RX path through mac80211, where
 960          * our mutex is already locked. */
 961         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 962         dev = wl->current_dev;
 963         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 964
 965         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 966
 967         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 968         /* only pairwise TKIP keys are supported right now */
 969         if (WARN_ON(!sta))
 970                 return;
 971         keymac_write(dev, index, sta->addr);
 972 }
 973
 974 static void do_key_write(struct b43_wldev *dev,
 975                          u8 index, u8 algorithm,
 976                          const u8 *key, size_t key_len, const u8 *mac_addr)
 977 {
 978         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 979         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 980
 981         if (b43_new_kidx_api(dev))
 982                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 983
 984         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 985         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 986
 987         if (index >= pairwise_keys_start)
 988                 keymac_write(dev, index, NULL); /* First zero out mac. */
 989         if (algorithm == B43_SEC_ALGO_TKIP) {
 990                 /*
 991                  * We should provide an initial iv32, phase1key pair.
 992                  * We could start with iv32=0 and compute the corresponding
 993                  * phase1key, but this means calling ieee80211_get_tkip_key
 994                  * with a fake skb (or export other tkip function).
 995                  * Because we are lazy we hope iv32 won't start with
 996                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 997                  * correct pair.
 998                  */
 999                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
1000         } else if (index >= pairwise_keys_start) /* clear it */
1001                 rx_tkip_phase1_write(dev, index, 0, NULL);
1002         if (key)
1003                 memcpy(buf, key, key_len);
1004         key_write(dev, index, algorithm, buf);
1005         if (index >= pairwise_keys_start)
1006                 keymac_write(dev, index, mac_addr);
1007
1008         dev->key[index].algorithm = algorithm;
1009 }
1010
1011 static int b43_key_write(struct b43_wldev *dev,
1012                          int index, u8 algorithm,
1013                          const u8 *key, size_t key_len,
1014                          const u8 *mac_addr,
1015                          struct ieee80211_key_conf *keyconf)
1016 {
1017         int i;
1018         int pairwise_keys_start;
1019
1020         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1021          *      - Temporal Encryption Key (128 bits)
1022          *      - Temporal Authenticator Tx MIC Key (64 bits)
1023          *      - Temporal Authenticator Rx MIC Key (64 bits)
1024          *
1025          *      Hardware only store TEK
1026          */
1027         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1028                 key_len = 16;
1029         if (key_len > B43_SEC_KEYSIZE)
1030                 return -EINVAL;
1031         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1032                 /* Check that we don't already have this key. */
1033                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
1034         }
1035         if (index < 0) {
1036                 /* Pairwise key. Get an empty slot for the key. */
1037                 if (b43_new_kidx_api(dev))
1038                         pairwise_keys_start = B43_NR_GROUP_KEYS;
1039                 else
1040                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1041                 for (i = pairwise_keys_start;
1042                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1043                      i++) {
1044                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1045                         if (!dev->key[i].keyconf) {
1046                                 /* found empty */
1047                                 index = i;
1048                                 break;
1049                         }
1050                 }
1051                 if (index < 0) {
1052                         b43warn(dev->wl, "Out of hardware key memory\n");
1053                         return -ENOSPC;
1054                 }
1055         } else
1056                 B43_WARN_ON(index > 3);
1057
1058         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1059         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1060                 /* Default RX key */
1061                 B43_WARN_ON(mac_addr);
1062                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1063         }
1064         keyconf->hw_key_idx = index;
1065         dev->key[index].keyconf = keyconf;
1066
1067         return 0;
1068 }
1069
1070 static int b43_key_clear(struct b43_wldev *dev, int index)
1071 {
1072         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1073                 return -EINVAL;
1074         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1075                      NULL, B43_SEC_KEYSIZE, NULL);
1076         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1077                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1078                              NULL, B43_SEC_KEYSIZE, NULL);
1079         }
1080         dev->key[index].keyconf = NULL;
1081
1082         return 0;
1083 }
1084
1085 static void b43_clear_keys(struct b43_wldev *dev)
1086 {
1087         int i, count;
1088
1089         if (b43_new_kidx_api(dev))
1090                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1091         else
1092                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1093         for (i = 0; i < count; i++)
1094                 b43_key_clear(dev, i);
1095 }
1096
1097 static void b43_dump_keymemory(struct b43_wldev *dev)
1098 {
1099         unsigned int i, index, count, offset, pairwise_keys_start;
1100         u8 mac[ETH_ALEN];
1101         u16 algo;
1102         u32 rcmta0;
1103         u16 rcmta1;
1104         u64 hf;
1105         struct b43_key *key;
1106
1107         if (!b43_debug(dev, B43_DBG_KEYS))
1108                 return;
1109
1110         hf = b43_hf_read(dev);
1111         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1112                !!(hf & B43_HF_USEDEFKEYS));
1113         if (b43_new_kidx_api(dev)) {
1114                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1115                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1116         } else {
1117                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1118                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1119         }
1120         for (index = 0; index < count; index++) {
1121                 key = &(dev->key[index]);
1122                 printk(KERN_DEBUG "Key slot %02u: %s",
1123                        index, (key->keyconf == NULL) ? " " : "*");
1124                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1125                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1126                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1127                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1128                 }
1129
1130                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1131                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1132                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1133
1134                 if (index >= pairwise_keys_start) {
1135                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1136                                 printk("   TKIP: ");
1137                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1138                                 for (i = 0; i < 14; i += 2) {
1139                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1140                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1141                                 }
1142                         }
1143                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1144                                                 ((index - pairwise_keys_start) * 2) + 0);
1145                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1146                                                 ((index - pairwise_keys_start) * 2) + 1);
1147                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1148                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1149                         printk("   MAC: %pM", mac);
1150                 } else
1151                         printk("   DEFAULT KEY");
1152                 printk("\n");
1153         }
1154 }
1155
1156 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1157 {
1158         u32 macctl;
1159         u16 ucstat;
1160         bool hwps;
1161         bool awake;
1162         int i;
1163
1164         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1165                     (ps_flags & B43_PS_DISABLED));
1166         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1167
1168         if (ps_flags & B43_PS_ENABLED) {
1169                 hwps = true;
1170         } else if (ps_flags & B43_PS_DISABLED) {
1171                 hwps = false;
1172         } else {
1173                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1174                 //      and thus is not an AP and we are associated, set bit 25
1175         }
1176         if (ps_flags & B43_PS_AWAKE) {
1177                 awake = true;
1178         } else if (ps_flags & B43_PS_ASLEEP) {
1179                 awake = false;
1180         } else {
1181                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1182                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1183                 //      successful, set bit26
1184         }
1185
1186 /* FIXME: For now we force awake-on and hwps-off */
1187         hwps = false;
1188         awake = true;
1189
1190         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1191         if (hwps)
1192                 macctl |= B43_MACCTL_HWPS;
1193         else
1194                 macctl &= ~B43_MACCTL_HWPS;
1195         if (awake)
1196                 macctl |= B43_MACCTL_AWAKE;
1197         else
1198                 macctl &= ~B43_MACCTL_AWAKE;
1199         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1200         /* Commit write */
1201         b43_read32(dev, B43_MMIO_MACCTL);
1202         if (awake && dev->dev->core_rev >= 5) {
1203                 /* Wait for the microcode to wake up. */
1204                 for (i = 0; i < 100; i++) {
1205                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1206                                                 B43_SHM_SH_UCODESTAT);
1207                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1208                                 break;
1209                         udelay(10);
1210                 }
1211         }
1212 }
1213
1214 /* http://bcm-v4.sipsolutions.net/802.11/PHY/BmacCorePllReset */
1215 void b43_wireless_core_phy_pll_reset(struct b43_wldev *dev)
1216 {
1217         struct bcma_drv_cc *bcma_cc __maybe_unused;
1218         struct ssb_chipcommon *ssb_cc __maybe_unused;
1219
1220         switch (dev->dev->bus_type) {
1221 #ifdef CONFIG_B43_BCMA
1222         case B43_BUS_BCMA:
1223                 bcma_cc = &dev->dev->bdev->bus->drv_cc;
1224
1225                 bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
1226                 bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1227                 bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
1228                 bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1229                 break;
1230 #endif
1231 #ifdef CONFIG_B43_SSB
1232         case B43_BUS_SSB:
1233                 ssb_cc = &dev->dev->sdev->bus->chipco;
1234
1235                 chipco_write32(ssb_cc, SSB_CHIPCO_CHIPCTL_ADDR, 0);
1236                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1237                 chipco_set32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, 0x4);
1238                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1239                 break;
1240 #endif
1241         }
1242 }
1243
1244 #ifdef CONFIG_B43_BCMA
1245 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1246 {
1247         u32 flags;
1248
1249         /* Put PHY into reset */
1250         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1251         flags |= B43_BCMA_IOCTL_PHY_RESET;
1252         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1253         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1254         udelay(2);
1255
1256         b43_phy_take_out_of_reset(dev);
1257 }
1258
1259 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1260 {
1261         u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1262                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1263         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1264                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
1265         u32 flags;
1266
1267         flags = B43_BCMA_IOCTL_PHY_CLKEN;
1268         if (gmode)
1269                 flags |= B43_BCMA_IOCTL_GMODE;
1270         b43_device_enable(dev, flags);
1271
1272         if (dev->phy.type == B43_PHYTYPE_AC) {
1273                 u16 tmp;
1274
1275                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1276                 tmp &= ~B43_BCMA_IOCTL_DAC;
1277                 tmp |= 0x100;
1278                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1279
1280                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1281                 tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
1282                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1283
1284                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1285                 tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
1286                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1287         }
1288
1289         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1290         b43_bcma_phy_reset(dev);
1291         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1292 }
1293 #endif
1294
1295 #ifdef CONFIG_B43_SSB
1296 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1297 {
1298         u32 flags = 0;
1299
1300         if (gmode)
1301                 flags |= B43_TMSLOW_GMODE;
1302         flags |= B43_TMSLOW_PHYCLKEN;
1303         flags |= B43_TMSLOW_PHYRESET;
1304         if (dev->phy.type == B43_PHYTYPE_N)
1305                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1306         b43_device_enable(dev, flags);
1307         msleep(2);              /* Wait for the PLL to turn on. */
1308
1309         b43_phy_take_out_of_reset(dev);
1310 }
1311 #endif
1312
1313 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1314 {
1315         u32 macctl;
1316
1317         switch (dev->dev->bus_type) {
1318 #ifdef CONFIG_B43_BCMA
1319         case B43_BUS_BCMA:
1320                 b43_bcma_wireless_core_reset(dev, gmode);
1321                 break;
1322 #endif
1323 #ifdef CONFIG_B43_SSB
1324         case B43_BUS_SSB:
1325                 b43_ssb_wireless_core_reset(dev, gmode);
1326                 break;
1327 #endif
1328         }
1329
1330         /* Turn Analog ON, but only if we already know the PHY-type.
1331          * This protects against very early setup where we don't know the
1332          * PHY-type, yet. wireless_core_reset will be called once again later,
1333          * when we know the PHY-type. */
1334         if (dev->phy.ops)
1335                 dev->phy.ops->switch_analog(dev, 1);
1336
1337         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1338         macctl &= ~B43_MACCTL_GMODE;
1339         if (gmode)
1340                 macctl |= B43_MACCTL_GMODE;
1341         macctl |= B43_MACCTL_IHR_ENABLED;
1342         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1343 }
1344
1345 static void handle_irq_transmit_status(struct b43_wldev *dev)
1346 {
1347         u32 v0, v1;
1348         u16 tmp;
1349         struct b43_txstatus stat;
1350
1351         while (1) {
1352                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1353                 if (!(v0 & 0x00000001))
1354                         break;
1355                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1356
1357                 stat.cookie = (v0 >> 16);
1358                 stat.seq = (v1 & 0x0000FFFF);
1359                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1360                 tmp = (v0 & 0x0000FFFF);
1361                 stat.frame_count = ((tmp & 0xF000) >> 12);
1362                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1363                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1364                 stat.pm_indicated = !!(tmp & 0x0080);
1365                 stat.intermediate = !!(tmp & 0x0040);
1366                 stat.for_ampdu = !!(tmp & 0x0020);
1367                 stat.acked = !!(tmp & 0x0002);
1368
1369                 b43_handle_txstatus(dev, &stat);
1370         }
1371 }
1372
1373 static void drain_txstatus_queue(struct b43_wldev *dev)
1374 {
1375         u32 dummy;
1376
1377         if (dev->dev->core_rev < 5)
1378                 return;
1379         /* Read all entries from the microcode TXstatus FIFO
1380          * and throw them away.
1381          */
1382         while (1) {
1383                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1384                 if (!(dummy & 0x00000001))
1385                         break;
1386                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1387         }
1388 }
1389
1390 static u32 b43_jssi_read(struct b43_wldev *dev)
1391 {
1392         u32 val = 0;
1393
1394         val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1395         val <<= 16;
1396         val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1397
1398         return val;
1399 }
1400
1401 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1402 {
1403         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1404                         (jssi & 0x0000FFFF));
1405         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1406                         (jssi & 0xFFFF0000) >> 16);
1407 }
1408
1409 static void b43_generate_noise_sample(struct b43_wldev *dev)
1410 {
1411         b43_jssi_write(dev, 0x7F7F7F7F);
1412         b43_write32(dev, B43_MMIO_MACCMD,
1413                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1414 }
1415
1416 static void b43_calculate_link_quality(struct b43_wldev *dev)
1417 {
1418         /* Top half of Link Quality calculation. */
1419
1420         if (dev->phy.type != B43_PHYTYPE_G)
1421                 return;
1422         if (dev->noisecalc.calculation_running)
1423                 return;
1424         dev->noisecalc.calculation_running = true;
1425         dev->noisecalc.nr_samples = 0;
1426
1427         b43_generate_noise_sample(dev);
1428 }
1429
1430 static void handle_irq_noise(struct b43_wldev *dev)
1431 {
1432         struct b43_phy_g *phy = dev->phy.g;
1433         u16 tmp;
1434         u8 noise[4];
1435         u8 i, j;
1436         s32 average;
1437
1438         /* Bottom half of Link Quality calculation. */
1439
1440         if (dev->phy.type != B43_PHYTYPE_G)
1441                 return;
1442
1443         /* Possible race condition: It might be possible that the user
1444          * changed to a different channel in the meantime since we
1445          * started the calculation. We ignore that fact, since it's
1446          * not really that much of a problem. The background noise is
1447          * an estimation only anyway. Slightly wrong results will get damped
1448          * by the averaging of the 8 sample rounds. Additionally the
1449          * value is shortlived. So it will be replaced by the next noise
1450          * calculation round soon. */
1451
1452         B43_WARN_ON(!dev->noisecalc.calculation_running);
1453         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1454         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1455             noise[2] == 0x7F || noise[3] == 0x7F)
1456                 goto generate_new;
1457
1458         /* Get the noise samples. */
1459         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1460         i = dev->noisecalc.nr_samples;
1461         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1462         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1463         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1464         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1465         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1466         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1467         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1468         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1469         dev->noisecalc.nr_samples++;
1470         if (dev->noisecalc.nr_samples == 8) {
1471                 /* Calculate the Link Quality by the noise samples. */
1472                 average = 0;
1473                 for (i = 0; i < 8; i++) {
1474                         for (j = 0; j < 4; j++)
1475                                 average += dev->noisecalc.samples[i][j];
1476                 }
1477                 average /= (8 * 4);
1478                 average *= 125;
1479                 average += 64;
1480                 average /= 128;
1481                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1482                 tmp = (tmp / 128) & 0x1F;
1483                 if (tmp >= 8)
1484                         average += 2;
1485                 else
1486                         average -= 25;
1487                 if (tmp == 8)
1488                         average -= 72;
1489                 else
1490                         average -= 48;
1491
1492                 dev->stats.link_noise = average;
1493                 dev->noisecalc.calculation_running = false;
1494                 return;
1495         }
1496 generate_new:
1497         b43_generate_noise_sample(dev);
1498 }
1499
1500 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1501 {
1502         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1503                 ///TODO: PS TBTT
1504         } else {
1505                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1506                         b43_power_saving_ctl_bits(dev, 0);
1507         }
1508         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1509                 dev->dfq_valid = true;
1510 }
1511
1512 static void handle_irq_atim_end(struct b43_wldev *dev)
1513 {
1514         if (dev->dfq_valid) {
1515                 b43_write32(dev, B43_MMIO_MACCMD,
1516                             b43_read32(dev, B43_MMIO_MACCMD)
1517                             | B43_MACCMD_DFQ_VALID);
1518                 dev->dfq_valid = false;
1519         }
1520 }
1521
1522 static void handle_irq_pmq(struct b43_wldev *dev)
1523 {
1524         u32 tmp;
1525
1526         //TODO: AP mode.
1527
1528         while (1) {
1529                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1530                 if (!(tmp & 0x00000008))
1531                         break;
1532         }
1533         /* 16bit write is odd, but correct. */
1534         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1535 }
1536
1537 static void b43_write_template_common(struct b43_wldev *dev,
1538                                       const u8 *data, u16 size,
1539                                       u16 ram_offset,
1540                                       u16 shm_size_offset, u8 rate)
1541 {
1542         u32 i, tmp;
1543         struct b43_plcp_hdr4 plcp;
1544
1545         plcp.data = 0;
1546         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1547         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1548         ram_offset += sizeof(u32);
1549         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1550          * So leave the first two bytes of the next write blank.
1551          */
1552         tmp = (u32) (data[0]) << 16;
1553         tmp |= (u32) (data[1]) << 24;
1554         b43_ram_write(dev, ram_offset, tmp);
1555         ram_offset += sizeof(u32);
1556         for (i = 2; i < size; i += sizeof(u32)) {
1557                 tmp = (u32) (data[i + 0]);
1558                 if (i + 1 < size)
1559                         tmp |= (u32) (data[i + 1]) << 8;
1560                 if (i + 2 < size)
1561                         tmp |= (u32) (data[i + 2]) << 16;
1562                 if (i + 3 < size)
1563                         tmp |= (u32) (data[i + 3]) << 24;
1564                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1565         }
1566         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1567                         size + sizeof(struct b43_plcp_hdr6));
1568 }
1569
1570 /* Check if the use of the antenna that ieee80211 told us to
1571  * use is possible. This will fall back to DEFAULT.
1572  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1573 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1574                                   u8 antenna_nr)
1575 {
1576         u8 antenna_mask;
1577
1578         if (antenna_nr == 0) {
1579                 /* Zero means "use default antenna". That's always OK. */
1580                 return 0;
1581         }
1582
1583         /* Get the mask of available antennas. */
1584         if (dev->phy.gmode)
1585                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1586         else
1587                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1588
1589         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1590                 /* This antenna is not available. Fall back to default. */
1591                 return 0;
1592         }
1593
1594         return antenna_nr;
1595 }
1596
1597 /* Convert a b43 antenna number value to the PHY TX control value. */
1598 static u16 b43_antenna_to_phyctl(int antenna)
1599 {
1600         switch (antenna) {
1601         case B43_ANTENNA0:
1602                 return B43_TXH_PHY_ANT0;
1603         case B43_ANTENNA1:
1604                 return B43_TXH_PHY_ANT1;
1605         case B43_ANTENNA2:
1606                 return B43_TXH_PHY_ANT2;
1607         case B43_ANTENNA3:
1608                 return B43_TXH_PHY_ANT3;
1609         case B43_ANTENNA_AUTO0:
1610         case B43_ANTENNA_AUTO1:
1611                 return B43_TXH_PHY_ANT01AUTO;
1612         }
1613         B43_WARN_ON(1);
1614         return 0;
1615 }
1616
1617 static void b43_write_beacon_template(struct b43_wldev *dev,
1618                                       u16 ram_offset,
1619                                       u16 shm_size_offset)
1620 {
1621         unsigned int i, len, variable_len;
1622         const struct ieee80211_mgmt *bcn;
1623         const u8 *ie;
1624         bool tim_found = false;
1625         unsigned int rate;
1626         u16 ctl;
1627         int antenna;
1628         struct ieee80211_tx_info *info;
1629         unsigned long flags;
1630         struct sk_buff *beacon_skb;
1631
1632         spin_lock_irqsave(&dev->wl->beacon_lock, flags);
1633         info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1634         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1635         /* Clone the beacon, so it cannot go away, while we write it to hw. */
1636         beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
1637         spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
1638
1639         if (!beacon_skb) {
1640                 b43dbg(dev->wl, "Could not upload beacon. "
1641                        "Failed to clone beacon skb.");
1642                 return;
1643         }
1644
1645         bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
1646         len = min_t(size_t, beacon_skb->len,
1647                     0x200 - sizeof(struct b43_plcp_hdr6));
1648
1649         b43_write_template_common(dev, (const u8 *)bcn,
1650                                   len, ram_offset, shm_size_offset, rate);
1651
1652         /* Write the PHY TX control parameters. */
1653         antenna = B43_ANTENNA_DEFAULT;
1654         antenna = b43_antenna_to_phyctl(antenna);
1655         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1656         /* We can't send beacons with short preamble. Would get PHY errors. */
1657         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1658         ctl &= ~B43_TXH_PHY_ANT;
1659         ctl &= ~B43_TXH_PHY_ENC;
1660         ctl |= antenna;
1661         if (b43_is_cck_rate(rate))
1662                 ctl |= B43_TXH_PHY_ENC_CCK;
1663         else
1664                 ctl |= B43_TXH_PHY_ENC_OFDM;
1665         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1666
1667         /* Find the position of the TIM and the DTIM_period value
1668          * and write them to SHM. */
1669         ie = bcn->u.beacon.variable;
1670         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1671         for (i = 0; i < variable_len - 2; ) {
1672                 uint8_t ie_id, ie_len;
1673
1674                 ie_id = ie[i];
1675                 ie_len = ie[i + 1];
1676                 if (ie_id == 5) {
1677                         u16 tim_position;
1678                         u16 dtim_period;
1679                         /* This is the TIM Information Element */
1680
1681                         /* Check whether the ie_len is in the beacon data range. */
1682                         if (variable_len < ie_len + 2 + i)
1683                                 break;
1684                         /* A valid TIM is at least 4 bytes long. */
1685                         if (ie_len < 4)
1686                                 break;
1687                         tim_found = true;
1688
1689                         tim_position = sizeof(struct b43_plcp_hdr6);
1690                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1691                         tim_position += i;
1692
1693                         dtim_period = ie[i + 3];
1694
1695                         b43_shm_write16(dev, B43_SHM_SHARED,
1696                                         B43_SHM_SH_TIMBPOS, tim_position);
1697                         b43_shm_write16(dev, B43_SHM_SHARED,
1698                                         B43_SHM_SH_DTIMPER, dtim_period);
1699                         break;
1700                 }
1701                 i += ie_len + 2;
1702         }
1703         if (!tim_found) {
1704                 /*
1705                  * If ucode wants to modify TIM do it behind the beacon, this
1706                  * will happen, for example, when doing mesh networking.
1707                  */
1708                 b43_shm_write16(dev, B43_SHM_SHARED,
1709                                 B43_SHM_SH_TIMBPOS,
1710                                 len + sizeof(struct b43_plcp_hdr6));
1711                 b43_shm_write16(dev, B43_SHM_SHARED,
1712                                 B43_SHM_SH_DTIMPER, 0);
1713         }
1714         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1715
1716         dev_kfree_skb_any(beacon_skb);
1717 }
1718
1719 static void b43_upload_beacon0(struct b43_wldev *dev)
1720 {
1721         struct b43_wl *wl = dev->wl;
1722
1723         if (wl->beacon0_uploaded)
1724                 return;
1725         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1726         wl->beacon0_uploaded = true;
1727 }
1728
1729 static void b43_upload_beacon1(struct b43_wldev *dev)
1730 {
1731         struct b43_wl *wl = dev->wl;
1732
1733         if (wl->beacon1_uploaded)
1734                 return;
1735         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1736         wl->beacon1_uploaded = true;
1737 }
1738
1739 static void handle_irq_beacon(struct b43_wldev *dev)
1740 {
1741         struct b43_wl *wl = dev->wl;
1742         u32 cmd, beacon0_valid, beacon1_valid;
1743
1744         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1745             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1746             !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1747                 return;
1748
1749         /* This is the bottom half of the asynchronous beacon update. */
1750
1751         /* Ignore interrupt in the future. */
1752         dev->irq_mask &= ~B43_IRQ_BEACON;
1753
1754         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1755         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1756         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1757
1758         /* Schedule interrupt manually, if busy. */
1759         if (beacon0_valid && beacon1_valid) {
1760                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1761                 dev->irq_mask |= B43_IRQ_BEACON;
1762                 return;
1763         }
1764
1765         if (unlikely(wl->beacon_templates_virgin)) {
1766                 /* We never uploaded a beacon before.
1767                  * Upload both templates now, but only mark one valid. */
1768                 wl->beacon_templates_virgin = false;
1769                 b43_upload_beacon0(dev);
1770                 b43_upload_beacon1(dev);
1771                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1772                 cmd |= B43_MACCMD_BEACON0_VALID;
1773                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1774         } else {
1775                 if (!beacon0_valid) {
1776                         b43_upload_beacon0(dev);
1777                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1778                         cmd |= B43_MACCMD_BEACON0_VALID;
1779                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1780                 } else if (!beacon1_valid) {
1781                         b43_upload_beacon1(dev);
1782                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1783                         cmd |= B43_MACCMD_BEACON1_VALID;
1784                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1785                 }
1786         }
1787 }
1788
1789 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1790 {
1791         u32 old_irq_mask = dev->irq_mask;
1792
1793         /* update beacon right away or defer to irq */
1794         handle_irq_beacon(dev);
1795         if (old_irq_mask != dev->irq_mask) {
1796                 /* The handler updated the IRQ mask. */
1797                 B43_WARN_ON(!dev->irq_mask);
1798                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1799                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1800                 } else {
1801                         /* Device interrupts are currently disabled. That means
1802                          * we just ran the hardirq handler and scheduled the
1803                          * IRQ thread. The thread will write the IRQ mask when
1804                          * it finished, so there's nothing to do here. Writing
1805                          * the mask _here_ would incorrectly re-enable IRQs. */
1806                 }
1807         }
1808 }
1809
1810 static void b43_beacon_update_trigger_work(struct work_struct *work)
1811 {
1812         struct b43_wl *wl = container_of(work, struct b43_wl,
1813                                          beacon_update_trigger);
1814         struct b43_wldev *dev;
1815
1816         mutex_lock(&wl->mutex);
1817         dev = wl->current_dev;
1818         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1819                 if (b43_bus_host_is_sdio(dev->dev)) {
1820                         /* wl->mutex is enough. */
1821                         b43_do_beacon_update_trigger_work(dev);
1822                 } else {
1823                         spin_lock_irq(&wl->hardirq_lock);
1824                         b43_do_beacon_update_trigger_work(dev);
1825                         spin_unlock_irq(&wl->hardirq_lock);
1826                 }
1827         }
1828         mutex_unlock(&wl->mutex);
1829 }
1830
1831 /* Asynchronously update the packet templates in template RAM. */
1832 static void b43_update_templates(struct b43_wl *wl)
1833 {
1834         struct sk_buff *beacon, *old_beacon;
1835         unsigned long flags;
1836
1837         /* This is the top half of the asynchronous beacon update.
1838          * The bottom half is the beacon IRQ.
1839          * Beacon update must be asynchronous to avoid sending an
1840          * invalid beacon. This can happen for example, if the firmware
1841          * transmits a beacon while we are updating it. */
1842
1843         /* We could modify the existing beacon and set the aid bit in
1844          * the TIM field, but that would probably require resizing and
1845          * moving of data within the beacon template.
1846          * Simply request a new beacon and let mac80211 do the hard work. */
1847         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1848         if (unlikely(!beacon))
1849                 return;
1850
1851         spin_lock_irqsave(&wl->beacon_lock, flags);
1852         old_beacon = wl->current_beacon;
1853         wl->current_beacon = beacon;
1854         wl->beacon0_uploaded = false;
1855         wl->beacon1_uploaded = false;
1856         spin_unlock_irqrestore(&wl->beacon_lock, flags);
1857
1858         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1859
1860         if (old_beacon)
1861                 dev_kfree_skb_any(old_beacon);
1862 }
1863
1864 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1865 {
1866         b43_time_lock(dev);
1867         if (dev->dev->core_rev >= 3) {
1868                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1869                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1870         } else {
1871                 b43_write16(dev, 0x606, (beacon_int >> 6));
1872                 b43_write16(dev, 0x610, beacon_int);
1873         }
1874         b43_time_unlock(dev);
1875         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1876 }
1877
1878 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1879 {
1880         u16 reason;
1881
1882         /* Read the register that contains the reason code for the panic. */
1883         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1884         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1885
1886         switch (reason) {
1887         default:
1888                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1889                 /* fallthrough */
1890         case B43_FWPANIC_DIE:
1891                 /* Do not restart the controller or firmware.
1892                  * The device is nonfunctional from now on.
1893                  * Restarting would result in this panic to trigger again,
1894                  * so we avoid that recursion. */
1895                 break;
1896         case B43_FWPANIC_RESTART:
1897                 b43_controller_restart(dev, "Microcode panic");
1898                 break;
1899         }
1900 }
1901
1902 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1903 {
1904         unsigned int i, cnt;
1905         u16 reason, marker_id, marker_line;
1906         __le16 *buf;
1907
1908         /* The proprietary firmware doesn't have this IRQ. */
1909         if (!dev->fw.opensource)
1910                 return;
1911
1912         /* Read the register that contains the reason code for this IRQ. */
1913         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1914
1915         switch (reason) {
1916         case B43_DEBUGIRQ_PANIC:
1917                 b43_handle_firmware_panic(dev);
1918                 break;
1919         case B43_DEBUGIRQ_DUMP_SHM:
1920                 if (!B43_DEBUG)
1921                         break; /* Only with driver debugging enabled. */
1922                 buf = kmalloc(4096, GFP_ATOMIC);
1923                 if (!buf) {
1924                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1925                         goto out;
1926                 }
1927                 for (i = 0; i < 4096; i += 2) {
1928                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1929                         buf[i / 2] = cpu_to_le16(tmp);
1930                 }
1931                 b43info(dev->wl, "Shared memory dump:\n");
1932                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1933                                16, 2, buf, 4096, 1);
1934                 kfree(buf);
1935                 break;
1936         case B43_DEBUGIRQ_DUMP_REGS:
1937                 if (!B43_DEBUG)
1938                         break; /* Only with driver debugging enabled. */
1939                 b43info(dev->wl, "Microcode register dump:\n");
1940                 for (i = 0, cnt = 0; i < 64; i++) {
1941                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1942                         if (cnt == 0)
1943                                 printk(KERN_INFO);
1944                         printk("r%02u: 0x%04X  ", i, tmp);
1945                         cnt++;
1946                         if (cnt == 6) {
1947                                 printk("\n");
1948                                 cnt = 0;
1949                         }
1950                 }
1951                 printk("\n");
1952                 break;
1953         case B43_DEBUGIRQ_MARKER:
1954                 if (!B43_DEBUG)
1955                         break; /* Only with driver debugging enabled. */
1956                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1957                                            B43_MARKER_ID_REG);
1958                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1959                                              B43_MARKER_LINE_REG);
1960                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1961                         "at line number %u\n",
1962                         marker_id, marker_line);
1963                 break;
1964         default:
1965                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1966                        reason);
1967         }
1968 out:
1969         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1970         b43_shm_write16(dev, B43_SHM_SCRATCH,
1971                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1972 }
1973
1974 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1975 {
1976         u32 reason;
1977         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1978         u32 merged_dma_reason = 0;
1979         int i;
1980
1981         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1982                 return;
1983
1984         reason = dev->irq_reason;
1985         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1986                 dma_reason[i] = dev->dma_reason[i];
1987                 merged_dma_reason |= dma_reason[i];
1988         }
1989
1990         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1991                 b43err(dev->wl, "MAC transmission error\n");
1992
1993         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1994                 b43err(dev->wl, "PHY transmission error\n");
1995                 rmb();
1996                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1997                         atomic_set(&dev->phy.txerr_cnt,
1998                                    B43_PHY_TX_BADNESS_LIMIT);
1999                         b43err(dev->wl, "Too many PHY TX errors, "
2000                                         "restarting the controller\n");
2001                         b43_controller_restart(dev, "PHY TX errors");
2002                 }
2003         }
2004
2005         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
2006                 b43err(dev->wl,
2007                         "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
2008                         dma_reason[0], dma_reason[1],
2009                         dma_reason[2], dma_reason[3],
2010                         dma_reason[4], dma_reason[5]);
2011                 b43err(dev->wl, "This device does not support DMA "
2012                                "on your system. It will now be switched to PIO.\n");
2013                 /* Fall back to PIO transfers if we get fatal DMA errors! */
2014                 dev->use_pio = true;
2015                 b43_controller_restart(dev, "DMA error");
2016                 return;
2017         }
2018
2019         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
2020                 handle_irq_ucode_debug(dev);
2021         if (reason & B43_IRQ_TBTT_INDI)
2022                 handle_irq_tbtt_indication(dev);
2023         if (reason & B43_IRQ_ATIM_END)
2024                 handle_irq_atim_end(dev);
2025         if (reason & B43_IRQ_BEACON)
2026                 handle_irq_beacon(dev);
2027         if (reason & B43_IRQ_PMQ)
2028                 handle_irq_pmq(dev);
2029         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
2030                 ;/* TODO */
2031         if (reason & B43_IRQ_NOISESAMPLE_OK)
2032                 handle_irq_noise(dev);
2033
2034         /* Check the DMA reason registers for received data. */
2035         if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
2036                 if (B43_DEBUG)
2037                         b43warn(dev->wl, "RX descriptor underrun\n");
2038                 b43_dma_handle_rx_overflow(dev->dma.rx_ring);
2039         }
2040         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
2041                 if (b43_using_pio_transfers(dev))
2042                         b43_pio_rx(dev->pio.rx_queue);
2043                 else
2044                         b43_dma_rx(dev->dma.rx_ring);
2045         }
2046         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
2047         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
2048         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
2049         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
2050         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
2051
2052         if (reason & B43_IRQ_TX_OK)
2053                 handle_irq_transmit_status(dev);
2054
2055         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
2056         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2057
2058 #if B43_DEBUG
2059         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2060                 dev->irq_count++;
2061                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2062                         if (reason & (1 << i))
2063                                 dev->irq_bit_count[i]++;
2064                 }
2065         }
2066 #endif
2067 }
2068
2069 /* Interrupt thread handler. Handles device interrupts in thread context. */
2070 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
2071 {
2072         struct b43_wldev *dev = dev_id;
2073
2074         mutex_lock(&dev->wl->mutex);
2075         b43_do_interrupt_thread(dev);
2076         mutex_unlock(&dev->wl->mutex);
2077
2078         return IRQ_HANDLED;
2079 }
2080
2081 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2082 {
2083         u32 reason;
2084
2085         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2086          * On SDIO, this runs under wl->mutex. */
2087
2088         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2089         if (reason == 0xffffffff)       /* shared IRQ */
2090                 return IRQ_NONE;
2091         reason &= dev->irq_mask;
2092         if (!reason)
2093                 return IRQ_NONE;
2094
2095         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2096             & 0x0001FC00;
2097         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2098             & 0x0000DC00;
2099         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2100             & 0x0000DC00;
2101         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2102             & 0x0001DC00;
2103         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2104             & 0x0000DC00;
2105 /* Unused ring
2106         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2107             & 0x0000DC00;
2108 */
2109
2110         /* ACK the interrupt. */
2111         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2112         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2113         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2114         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2115         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2116         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2117 /* Unused ring
2118         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2119 */
2120
2121         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2122         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2123         /* Save the reason bitmasks for the IRQ thread handler. */
2124         dev->irq_reason = reason;
2125
2126         return IRQ_WAKE_THREAD;
2127 }
2128
2129 /* Interrupt handler top-half. This runs with interrupts disabled. */
2130 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2131 {
2132         struct b43_wldev *dev = dev_id;
2133         irqreturn_t ret;
2134
2135         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2136                 return IRQ_NONE;
2137
2138         spin_lock(&dev->wl->hardirq_lock);
2139         ret = b43_do_interrupt(dev);
2140         spin_unlock(&dev->wl->hardirq_lock);
2141
2142         return ret;
2143 }
2144
2145 /* SDIO interrupt handler. This runs in process context. */
2146 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2147 {
2148         struct b43_wl *wl = dev->wl;
2149         irqreturn_t ret;
2150
2151         mutex_lock(&wl->mutex);
2152
2153         ret = b43_do_interrupt(dev);
2154         if (ret == IRQ_WAKE_THREAD)
2155                 b43_do_interrupt_thread(dev);
2156
2157         mutex_unlock(&wl->mutex);
2158 }
2159
2160 void b43_do_release_fw(struct b43_firmware_file *fw)
2161 {
2162         release_firmware(fw->data);
2163         fw->data = NULL;
2164         fw->filename = NULL;
2165 }
2166
2167 static void b43_release_firmware(struct b43_wldev *dev)
2168 {
2169         complete(&dev->fw_load_complete);
2170         b43_do_release_fw(&dev->fw.ucode);
2171         b43_do_release_fw(&dev->fw.pcm);
2172         b43_do_release_fw(&dev->fw.initvals);
2173         b43_do_release_fw(&dev->fw.initvals_band);
2174 }
2175
2176 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2177 {
2178         const char text[] =
2179                 "You must go to " \
2180                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2181                 "and download the correct firmware for this driver version. " \
2182                 "Please carefully read all instructions on this website.\n";
2183
2184         if (error)
2185                 b43err(wl, text);
2186         else
2187                 b43warn(wl, text);
2188 }
2189
2190 static void b43_fw_cb(const struct firmware *firmware, void *context)
2191 {
2192         struct b43_request_fw_context *ctx = context;
2193
2194         ctx->blob = firmware;
2195         complete(&ctx->dev->fw_load_complete);
2196 }
2197
2198 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2199                       const char *name,
2200                       struct b43_firmware_file *fw, bool async)
2201 {
2202         struct b43_fw_header *hdr;
2203         u32 size;
2204         int err;
2205
2206         if (!name) {
2207                 /* Don't fetch anything. Free possibly cached firmware. */
2208                 /* FIXME: We should probably keep it anyway, to save some headache
2209                  * on suspend/resume with multiband devices. */
2210                 b43_do_release_fw(fw);
2211                 return 0;
2212         }
2213         if (fw->filename) {
2214                 if ((fw->type == ctx->req_type) &&
2215                     (strcmp(fw->filename, name) == 0))
2216                         return 0; /* Already have this fw. */
2217                 /* Free the cached firmware first. */
2218                 /* FIXME: We should probably do this later after we successfully
2219                  * got the new fw. This could reduce headache with multiband devices.
2220                  * We could also redesign this to cache the firmware for all possible
2221                  * bands all the time. */
2222                 b43_do_release_fw(fw);
2223         }
2224
2225         switch (ctx->req_type) {
2226         case B43_FWTYPE_PROPRIETARY:
2227                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2228                          "b43%s/%s.fw",
2229                          modparam_fwpostfix, name);
2230                 break;
2231         case B43_FWTYPE_OPENSOURCE:
2232                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2233                          "b43-open%s/%s.fw",
2234                          modparam_fwpostfix, name);
2235                 break;
2236         default:
2237                 B43_WARN_ON(1);
2238                 return -ENOSYS;
2239         }
2240         if (async) {
2241                 /* do this part asynchronously */
2242                 init_completion(&ctx->dev->fw_load_complete);
2243                 err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2244                                               ctx->dev->dev->dev, GFP_KERNEL,
2245                                               ctx, b43_fw_cb);
2246                 if (err < 0) {
2247                         pr_err("Unable to load firmware\n");
2248                         return err;
2249                 }
2250                 wait_for_completion(&ctx->dev->fw_load_complete);
2251                 if (ctx->blob)
2252                         goto fw_ready;
2253         /* On some ARM systems, the async request will fail, but the next sync
2254          * request works. For this reason, we fall through here
2255          */
2256         }
2257         err = request_firmware(&ctx->blob, ctx->fwname,
2258                                ctx->dev->dev->dev);
2259         if (err == -ENOENT) {
2260                 snprintf(ctx->errors[ctx->req_type],
2261                          sizeof(ctx->errors[ctx->req_type]),
2262                          "Firmware file \"%s\" not found\n",
2263                          ctx->fwname);
2264                 return err;
2265         } else if (err) {
2266                 snprintf(ctx->errors[ctx->req_type],
2267                          sizeof(ctx->errors[ctx->req_type]),
2268                          "Firmware file \"%s\" request failed (err=%d)\n",
2269                          ctx->fwname, err);
2270                 return err;
2271         }
2272 fw_ready:
2273         if (ctx->blob->size < sizeof(struct b43_fw_header))
2274                 goto err_format;
2275         hdr = (struct b43_fw_header *)(ctx->blob->data);
2276         switch (hdr->type) {
2277         case B43_FW_TYPE_UCODE:
2278         case B43_FW_TYPE_PCM:
2279                 size = be32_to_cpu(hdr->size);
2280                 if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2281                         goto err_format;
2282                 /* fallthrough */
2283         case B43_FW_TYPE_IV:
2284                 if (hdr->ver != 1)
2285                         goto err_format;
2286                 break;
2287         default:
2288                 goto err_format;
2289         }
2290
2291         fw->data = ctx->blob;
2292         fw->filename = name;
2293         fw->type = ctx->req_type;
2294
2295         return 0;
2296
2297 err_format:
2298         snprintf(ctx->errors[ctx->req_type],
2299                  sizeof(ctx->errors[ctx->req_type]),
2300                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2301         release_firmware(ctx->blob);
2302
2303         return -EPROTO;
2304 }
2305
2306 /* http://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2307 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2308 {
2309         struct b43_wldev *dev = ctx->dev;
2310         struct b43_firmware *fw = &ctx->dev->fw;
2311         struct b43_phy *phy = &dev->phy;
2312         const u8 rev = ctx->dev->dev->core_rev;
2313         const char *filename;
2314         int err;
2315
2316         /* Get microcode */
2317         filename = NULL;
2318         switch (rev) {
2319         case 42:
2320                 if (phy->type == B43_PHYTYPE_AC)
2321                         filename = "ucode42";
2322                 break;
2323         case 40:
2324                 if (phy->type == B43_PHYTYPE_AC)
2325                         filename = "ucode40";
2326                 break;
2327         case 33:
2328                 if (phy->type == B43_PHYTYPE_LCN40)
2329                         filename = "ucode33_lcn40";
2330                 break;
2331         case 30:
2332                 if (phy->type == B43_PHYTYPE_N)
2333                         filename = "ucode30_mimo";
2334                 break;
2335         case 29:
2336                 if (phy->type == B43_PHYTYPE_HT)
2337                         filename = "ucode29_mimo";
2338                 break;
2339         case 26:
2340                 if (phy->type == B43_PHYTYPE_HT)
2341                         filename = "ucode26_mimo";
2342                 break;
2343         case 28:
2344         case 25:
2345                 if (phy->type == B43_PHYTYPE_N)
2346                         filename = "ucode25_mimo";
2347                 else if (phy->type == B43_PHYTYPE_LCN)
2348                         filename = "ucode25_lcn";
2349                 break;
2350         case 24:
2351                 if (phy->type == B43_PHYTYPE_LCN)
2352                         filename = "ucode24_lcn";
2353                 break;
2354         case 23:
2355                 if (phy->type == B43_PHYTYPE_N)
2356                         filename = "ucode16_mimo";
2357                 break;
2358         case 16 ... 19:
2359                 if (phy->type == B43_PHYTYPE_N)
2360                         filename = "ucode16_mimo";
2361                 else if (phy->type == B43_PHYTYPE_LP)
2362                         filename = "ucode16_lp";
2363                 break;
2364         case 15:
2365                 filename = "ucode15";
2366                 break;
2367         case 14:
2368                 filename = "ucode14";
2369                 break;
2370         case 13:
2371                 filename = "ucode13";
2372                 break;
2373         case 11 ... 12:
2374                 filename = "ucode11";
2375                 break;
2376         case 5 ... 10:
2377                 filename = "ucode5";
2378                 break;
2379         }
2380         if (!filename)
2381                 goto err_no_ucode;
2382         err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2383         if (err)
2384                 goto err_load;
2385
2386         /* Get PCM code */
2387         if ((rev >= 5) && (rev <= 10))
2388                 filename = "pcm5";
2389         else if (rev >= 11)
2390                 filename = NULL;
2391         else
2392                 goto err_no_pcm;
2393         fw->pcm_request_failed = false;
2394         err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2395         if (err == -ENOENT) {
2396                 /* We did not find a PCM file? Not fatal, but
2397                  * core rev <= 10 must do without hwcrypto then. */
2398                 fw->pcm_request_failed = true;
2399         } else if (err)
2400                 goto err_load;
2401
2402         /* Get initvals */
2403         filename = NULL;
2404         switch (dev->phy.type) {
2405         case B43_PHYTYPE_G:
2406                 if (rev == 13)
2407                         filename = "b0g0initvals13";
2408                 else if (rev >= 5 && rev <= 10)
2409                         filename = "b0g0initvals5";
2410                 break;
2411         case B43_PHYTYPE_N:
2412                 if (rev == 30)
2413                         filename = "n16initvals30";
2414                 else if (rev == 28 || rev == 25)
2415                         filename = "n0initvals25";
2416                 else if (rev == 24)
2417                         filename = "n0initvals24";
2418                 else if (rev == 23)
2419                         filename = "n0initvals16"; /* What about n0initvals22? */
2420                 else if (rev >= 16 && rev <= 18)
2421                         filename = "n0initvals16";
2422                 else if (rev >= 11 && rev <= 12)
2423                         filename = "n0initvals11";
2424                 break;
2425         case B43_PHYTYPE_LP:
2426                 if (rev >= 16 && rev <= 18)
2427                         filename = "lp0initvals16";
2428                 else if (rev == 15)
2429                         filename = "lp0initvals15";
2430                 else if (rev == 14)
2431                         filename = "lp0initvals14";
2432                 else if (rev == 13)
2433                         filename = "lp0initvals13";
2434                 break;
2435         case B43_PHYTYPE_HT:
2436                 if (rev == 29)
2437                         filename = "ht0initvals29";
2438                 else if (rev == 26)
2439                         filename = "ht0initvals26";
2440                 break;
2441         case B43_PHYTYPE_LCN:
2442                 if (rev == 24)
2443                         filename = "lcn0initvals24";
2444                 break;
2445         case B43_PHYTYPE_LCN40:
2446                 if (rev == 33)
2447                         filename = "lcn400initvals33";
2448                 break;
2449         case B43_PHYTYPE_AC:
2450                 if (rev == 42)
2451                         filename = "ac1initvals42";
2452                 else if (rev == 40)
2453                         filename = "ac0initvals40";
2454                 break;
2455         }
2456         if (!filename)
2457                 goto err_no_initvals;
2458         err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2459         if (err)
2460                 goto err_load;
2461
2462         /* Get bandswitch initvals */
2463         filename = NULL;
2464         switch (dev->phy.type) {
2465         case B43_PHYTYPE_G:
2466                 if (rev == 13)
2467                         filename = "b0g0bsinitvals13";
2468                 else if (rev >= 5 && rev <= 10)
2469                         filename = "b0g0bsinitvals5";
2470                 break;
2471         case B43_PHYTYPE_N:
2472                 if (rev == 30)
2473                         filename = "n16bsinitvals30";
2474                 else if (rev == 28 || rev == 25)
2475                         filename = "n0bsinitvals25";
2476                 else if (rev == 24)
2477                         filename = "n0bsinitvals24";
2478                 else if (rev == 23)
2479                         filename = "n0bsinitvals16"; /* What about n0bsinitvals22? */
2480                 else if (rev >= 16 && rev <= 18)
2481                         filename = "n0bsinitvals16";
2482                 else if (rev >= 11 && rev <= 12)
2483                         filename = "n0bsinitvals11";
2484                 break;
2485         case B43_PHYTYPE_LP:
2486                 if (rev >= 16 && rev <= 18)
2487                         filename = "lp0bsinitvals16";
2488                 else if (rev == 15)
2489                         filename = "lp0bsinitvals15";
2490                 else if (rev == 14)
2491                         filename = "lp0bsinitvals14";
2492                 else if (rev == 13)
2493                         filename = "lp0bsinitvals13";
2494                 break;
2495         case B43_PHYTYPE_HT:
2496                 if (rev == 29)
2497                         filename = "ht0bsinitvals29";
2498                 else if (rev == 26)
2499                         filename = "ht0bsinitvals26";
2500                 break;
2501         case B43_PHYTYPE_LCN:
2502                 if (rev == 24)
2503                         filename = "lcn0bsinitvals24";
2504                 break;
2505         case B43_PHYTYPE_LCN40:
2506                 if (rev == 33)
2507                         filename = "lcn400bsinitvals33";
2508                 break;
2509         case B43_PHYTYPE_AC:
2510                 if (rev == 42)
2511                         filename = "ac1bsinitvals42";
2512                 else if (rev == 40)
2513                         filename = "ac0bsinitvals40";
2514                 break;
2515         }
2516         if (!filename)
2517                 goto err_no_initvals;
2518         err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2519         if (err)
2520                 goto err_load;
2521
2522         fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2523
2524         return 0;
2525
2526 err_no_ucode:
2527         err = ctx->fatal_failure = -EOPNOTSUPP;
2528         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2529                "is required for your device (wl-core rev %u)\n", rev);
2530         goto error;
2531
2532 err_no_pcm:
2533         err = ctx->fatal_failure = -EOPNOTSUPP;
2534         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2535                "is required for your device (wl-core rev %u)\n", rev);
2536         goto error;
2537
2538 err_no_initvals:
2539         err = ctx->fatal_failure = -EOPNOTSUPP;
2540         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2541                "is required for your device (wl-core rev %u)\n", rev);
2542         goto error;
2543
2544 err_load:
2545         /* We failed to load this firmware image. The error message
2546          * already is in ctx->errors. Return and let our caller decide
2547          * what to do. */
2548         goto error;
2549
2550 error:
2551         b43_release_firmware(dev);
2552         return err;
2553 }
2554
2555 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2556 static void b43_one_core_detach(struct b43_bus_dev *dev);
2557 static int b43_rng_init(struct b43_wl *wl);
2558
2559 static void b43_request_firmware(struct work_struct *work)
2560 {
2561         struct b43_wl *wl = container_of(work,
2562                             struct b43_wl, firmware_load);
2563         struct b43_wldev *dev = wl->current_dev;
2564         struct b43_request_fw_context *ctx;
2565         unsigned int i;
2566         int err;
2567         const char *errmsg;
2568
2569         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2570         if (!ctx)
2571                 return;
2572         ctx->dev = dev;
2573
2574         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2575         err = b43_try_request_fw(ctx);
2576         if (!err)
2577                 goto start_ieee80211; /* Successfully loaded it. */
2578         /* Was fw version known? */
2579         if (ctx->fatal_failure)
2580                 goto out;
2581
2582         /* proprietary fw not found, try open source */
2583         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2584         err = b43_try_request_fw(ctx);
2585         if (!err)
2586                 goto start_ieee80211; /* Successfully loaded it. */
2587         if(ctx->fatal_failure)
2588                 goto out;
2589
2590         /* Could not find a usable firmware. Print the errors. */
2591         for (i = 0; i < B43_NR_FWTYPES; i++) {
2592                 errmsg = ctx->errors[i];
2593                 if (strlen(errmsg))
2594                         b43err(dev->wl, "%s", errmsg);
2595         }
2596         b43_print_fw_helptext(dev->wl, 1);
2597         goto out;
2598
2599 start_ieee80211:
2600         wl->hw->queues = B43_QOS_QUEUE_NUM;
2601         if (!modparam_qos || dev->fw.opensource)
2602                 wl->hw->queues = 1;
2603
2604         err = ieee80211_register_hw(wl->hw);
2605         if (err)
2606                 goto err_one_core_detach;
2607         wl->hw_registered = true;
2608         b43_leds_register(wl->current_dev);
2609
2610         /* Register HW RNG driver */
2611         b43_rng_init(wl);
2612
2613         goto out;
2614
2615 err_one_core_detach:
2616         b43_one_core_detach(dev->dev);
2617
2618 out:
2619         kfree(ctx);
2620 }
2621
2622 static int b43_upload_microcode(struct b43_wldev *dev)
2623 {
2624         struct wiphy *wiphy = dev->wl->hw->wiphy;
2625         const size_t hdr_len = sizeof(struct b43_fw_header);
2626         const __be32 *data;
2627         unsigned int i, len;
2628         u16 fwrev, fwpatch, fwdate, fwtime;
2629         u32 tmp, macctl;
2630         int err = 0;
2631
2632         /* Jump the microcode PSM to offset 0 */
2633         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2634         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2635         macctl |= B43_MACCTL_PSM_JMP0;
2636         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2637         /* Zero out all microcode PSM registers and shared memory. */
2638         for (i = 0; i < 64; i++)
2639                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2640         for (i = 0; i < 4096; i += 2)
2641                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2642
2643         /* Upload Microcode. */
2644         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2645         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2646         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2647         for (i = 0; i < len; i++) {
2648                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2649                 udelay(10);
2650         }
2651
2652         if (dev->fw.pcm.data) {
2653                 /* Upload PCM data. */
2654                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2655                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2656                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2657                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2658                 /* No need for autoinc bit in SHM_HW */
2659                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2660                 for (i = 0; i < len; i++) {
2661                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2662                         udelay(10);
2663                 }
2664         }
2665
2666         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2667
2668         /* Start the microcode PSM */
2669         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2670                       B43_MACCTL_PSM_RUN);
2671
2672         /* Wait for the microcode to load and respond */
2673         i = 0;
2674         while (1) {
2675                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2676                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2677                         break;
2678                 i++;
2679                 if (i >= 20) {
2680                         b43err(dev->wl, "Microcode not responding\n");
2681                         b43_print_fw_helptext(dev->wl, 1);
2682                         err = -ENODEV;
2683                         goto error;
2684                 }
2685                 msleep(50);
2686         }
2687         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2688
2689         /* Get and check the revisions. */
2690         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2691         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2692         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2693         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2694
2695         if (fwrev <= 0x128) {
2696                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2697                        "binary drivers older than version 4.x is unsupported. "
2698                        "You must upgrade your firmware files.\n");
2699                 b43_print_fw_helptext(dev->wl, 1);
2700                 err = -EOPNOTSUPP;
2701                 goto error;
2702         }
2703         dev->fw.rev = fwrev;
2704         dev->fw.patch = fwpatch;
2705         if (dev->fw.rev >= 598)
2706                 dev->fw.hdr_format = B43_FW_HDR_598;
2707         else if (dev->fw.rev >= 410)
2708                 dev->fw.hdr_format = B43_FW_HDR_410;
2709         else
2710                 dev->fw.hdr_format = B43_FW_HDR_351;
2711         WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2712
2713         dev->qos_enabled = dev->wl->hw->queues > 1;
2714         /* Default to firmware/hardware crypto acceleration. */
2715         dev->hwcrypto_enabled = true;
2716
2717         if (dev->fw.opensource) {
2718                 u16 fwcapa;
2719
2720                 /* Patchlevel info is encoded in the "time" field. */
2721                 dev->fw.patch = fwtime;
2722                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2723                         dev->fw.rev, dev->fw.patch);
2724
2725                 fwcapa = b43_fwcapa_read(dev);
2726                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2727                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2728                         /* Disable hardware crypto and fall back to software crypto. */
2729                         dev->hwcrypto_enabled = false;
2730                 }
2731                 /* adding QoS support should use an offline discovery mechanism */
2732                 WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2733         } else {
2734                 b43info(dev->wl, "Loading firmware version %u.%u "
2735                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2736                         fwrev, fwpatch,
2737                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2738                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2739                 if (dev->fw.pcm_request_failed) {
2740                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2741                                 "Hardware accelerated cryptography is disabled.\n");
2742                         b43_print_fw_helptext(dev->wl, 0);
2743                 }
2744         }
2745
2746         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2747                         dev->fw.rev, dev->fw.patch);
2748         wiphy->hw_version = dev->dev->core_id;
2749
2750         if (dev->fw.hdr_format == B43_FW_HDR_351) {
2751                 /* We're over the deadline, but we keep support for old fw
2752                  * until it turns out to be in major conflict with something new. */
2753                 b43warn(dev->wl, "You are using an old firmware image. "
2754                         "Support for old firmware will be removed soon "
2755                         "(official deadline was July 2008).\n");
2756                 b43_print_fw_helptext(dev->wl, 0);
2757         }
2758
2759         return 0;
2760
2761 error:
2762         /* Stop the microcode PSM. */
2763         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2764                       B43_MACCTL_PSM_JMP0);
2765
2766         return err;
2767 }
2768
2769 static int b43_write_initvals(struct b43_wldev *dev,
2770                               const struct b43_iv *ivals,
2771                               size_t count,
2772                               size_t array_size)
2773 {
2774         const struct b43_iv *iv;
2775         u16 offset;
2776         size_t i;
2777         bool bit32;
2778
2779         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2780         iv = ivals;
2781         for (i = 0; i < count; i++) {
2782                 if (array_size < sizeof(iv->offset_size))
2783                         goto err_format;
2784                 array_size -= sizeof(iv->offset_size);
2785                 offset = be16_to_cpu(iv->offset_size);
2786                 bit32 = !!(offset & B43_IV_32BIT);
2787                 offset &= B43_IV_OFFSET_MASK;
2788                 if (offset >= 0x1000)
2789                         goto err_format;
2790                 if (bit32) {
2791                         u32 value;
2792
2793                         if (array_size < sizeof(iv->data.d32))
2794                                 goto err_format;
2795                         array_size -= sizeof(iv->data.d32);
2796
2797                         value = get_unaligned_be32(&iv->data.d32);
2798                         b43_write32(dev, offset, value);
2799
2800                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2801                                                         sizeof(__be16) +
2802                                                         sizeof(__be32));
2803                 } else {
2804                         u16 value;
2805
2806                         if (array_size < sizeof(iv->data.d16))
2807                                 goto err_format;
2808                         array_size -= sizeof(iv->data.d16);
2809
2810                         value = be16_to_cpu(iv->data.d16);
2811                         b43_write16(dev, offset, value);
2812
2813                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2814                                                         sizeof(__be16) +
2815                                                         sizeof(__be16));
2816                 }
2817         }
2818         if (array_size)
2819                 goto err_format;
2820
2821         return 0;
2822
2823 err_format:
2824         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2825         b43_print_fw_helptext(dev->wl, 1);
2826
2827         return -EPROTO;
2828 }
2829
2830 static int b43_upload_initvals(struct b43_wldev *dev)
2831 {
2832         const size_t hdr_len = sizeof(struct b43_fw_header);
2833         const struct b43_fw_header *hdr;
2834         struct b43_firmware *fw = &dev->fw;
2835         const struct b43_iv *ivals;
2836         size_t count;
2837
2838         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2839         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2840         count = be32_to_cpu(hdr->size);
2841         return b43_write_initvals(dev, ivals, count,
2842                                  fw->initvals.data->size - hdr_len);
2843 }
2844
2845 static int b43_upload_initvals_band(struct b43_wldev *dev)
2846 {
2847         const size_t hdr_len = sizeof(struct b43_fw_header);
2848         const struct b43_fw_header *hdr;
2849         struct b43_firmware *fw = &dev->fw;
2850         const struct b43_iv *ivals;
2851         size_t count;
2852
2853         if (!fw->initvals_band.data)
2854                 return 0;
2855
2856         hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2857         ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2858         count = be32_to_cpu(hdr->size);
2859         return b43_write_initvals(dev, ivals, count,
2860                                   fw->initvals_band.data->size - hdr_len);
2861 }
2862
2863 /* Initialize the GPIOs
2864  * http://bcm-specs.sipsolutions.net/GPIO
2865  */
2866
2867 #ifdef CONFIG_B43_SSB
2868 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2869 {
2870         struct ssb_bus *bus = dev->dev->sdev->bus;
2871
2872 #ifdef CONFIG_SSB_DRIVER_PCICORE
2873         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2874 #else
2875         return bus->chipco.dev;
2876 #endif
2877 }
2878 #endif
2879
2880 static int b43_gpio_init(struct b43_wldev *dev)
2881 {
2882 #ifdef CONFIG_B43_SSB
2883         struct ssb_device *gpiodev;
2884 #endif
2885         u32 mask, set;
2886
2887         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2888         b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2889
2890         mask = 0x0000001F;
2891         set = 0x0000000F;
2892         if (dev->dev->chip_id == 0x4301) {
2893                 mask |= 0x0060;
2894                 set |= 0x0060;
2895         } else if (dev->dev->chip_id == 0x5354) {
2896                 /* Don't allow overtaking buttons GPIOs */
2897                 set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2898         }
2899
2900         if (0 /* FIXME: conditional unknown */ ) {
2901                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2902                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2903                             | 0x0100);
2904                 /* BT Coexistance Input */
2905                 mask |= 0x0080;
2906                 set |= 0x0080;
2907                 /* BT Coexistance Out */
2908                 mask |= 0x0100;
2909                 set |= 0x0100;
2910         }
2911         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2912                 /* PA is controlled by gpio 9, let ucode handle it */
2913                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2914                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2915                             | 0x0200);
2916                 mask |= 0x0200;
2917                 set |= 0x0200;
2918         }
2919
2920         switch (dev->dev->bus_type) {
2921 #ifdef CONFIG_B43_BCMA
2922         case B43_BUS_BCMA:
2923                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2924                 break;
2925 #endif
2926 #ifdef CONFIG_B43_SSB
2927         case B43_BUS_SSB:
2928                 gpiodev = b43_ssb_gpio_dev(dev);
2929                 if (gpiodev)
2930                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2931                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2932                                     & ~mask) | set);
2933                 break;
2934 #endif
2935         }
2936
2937         return 0;
2938 }
2939
2940 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2941 static void b43_gpio_cleanup(struct b43_wldev *dev)
2942 {
2943 #ifdef CONFIG_B43_SSB
2944         struct ssb_device *gpiodev;
2945 #endif
2946
2947         switch (dev->dev->bus_type) {
2948 #ifdef CONFIG_B43_BCMA
2949         case B43_BUS_BCMA:
2950                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2951                 break;
2952 #endif
2953 #ifdef CONFIG_B43_SSB
2954         case B43_BUS_SSB:
2955                 gpiodev = b43_ssb_gpio_dev(dev);
2956                 if (gpiodev)
2957                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2958                 break;
2959 #endif
2960         }
2961 }
2962
2963 /* http://bcm-specs.sipsolutions.net/EnableMac */
2964 void b43_mac_enable(struct b43_wldev *dev)
2965 {
2966         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2967                 u16 fwstate;
2968
2969                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2970                                          B43_SHM_SH_UCODESTAT);
2971                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2972                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2973                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2974                                "should be suspended, but current state is %u\n",
2975                                fwstate);
2976                 }
2977         }
2978
2979         dev->mac_suspended--;
2980         B43_WARN_ON(dev->mac_suspended < 0);
2981         if (dev->mac_suspended == 0) {
2982                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2983                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2984                             B43_IRQ_MAC_SUSPENDED);
2985                 /* Commit writes */
2986                 b43_read32(dev, B43_MMIO_MACCTL);
2987                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2988                 b43_power_saving_ctl_bits(dev, 0);
2989         }
2990 }
2991
2992 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2993 void b43_mac_suspend(struct b43_wldev *dev)
2994 {
2995         int i;
2996         u32 tmp;
2997
2998         might_sleep();
2999         B43_WARN_ON(dev->mac_suspended < 0);
3000
3001         if (dev->mac_suspended == 0) {
3002                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
3003                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
3004                 /* force pci to flush the write */
3005                 b43_read32(dev, B43_MMIO_MACCTL);
3006                 for (i = 35; i; i--) {
3007                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3008                         if (tmp & B43_IRQ_MAC_SUSPENDED)
3009                                 goto out;
3010                         udelay(10);
3011                 }
3012                 /* Hm, it seems this will take some time. Use msleep(). */
3013                 for (i = 40; i; i--) {
3014                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3015                         if (tmp & B43_IRQ_MAC_SUSPENDED)
3016                                 goto out;
3017                         msleep(1);
3018                 }
3019                 b43err(dev->wl, "MAC suspend failed\n");
3020         }
3021 out:
3022         dev->mac_suspended++;
3023 }
3024
3025 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
3026 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
3027 {
3028         u32 tmp;
3029
3030         switch (dev->dev->bus_type) {
3031 #ifdef CONFIG_B43_BCMA
3032         case B43_BUS_BCMA:
3033                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3034                 if (on)
3035                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
3036                 else
3037                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
3038                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3039                 break;
3040 #endif
3041 #ifdef CONFIG_B43_SSB
3042         case B43_BUS_SSB:
3043                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3044                 if (on)
3045                         tmp |= B43_TMSLOW_MACPHYCLKEN;
3046                 else
3047                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
3048                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3049                 break;
3050 #endif
3051         }
3052 }
3053
3054 /* brcms_b_switch_macfreq */
3055 void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
3056 {
3057         u16 chip_id = dev->dev->chip_id;
3058
3059         if (chip_id == BCMA_CHIP_ID_BCM4331) {
3060                 switch (spurmode) {
3061                 case 2: /* 168 Mhz: 2^26/168 = 0x61862 */
3062                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x1862);
3063                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3064                         break;
3065                 case 1: /* 164 Mhz: 2^26/164 = 0x63e70 */
3066                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x3e70);
3067                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3068                         break;
3069                 default: /* 160 Mhz: 2^26/160 = 0x66666 */
3070                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x6666);
3071                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3072                         break;
3073                 }
3074         } else if (chip_id == BCMA_CHIP_ID_BCM43131 ||
3075             chip_id == BCMA_CHIP_ID_BCM43217 ||
3076             chip_id == BCMA_CHIP_ID_BCM43222 ||
3077             chip_id == BCMA_CHIP_ID_BCM43224 ||
3078             chip_id == BCMA_CHIP_ID_BCM43225 ||
3079             chip_id == BCMA_CHIP_ID_BCM43227 ||
3080             chip_id == BCMA_CHIP_ID_BCM43228) {
3081                 switch (spurmode) {
3082                 case 2: /* 126 Mhz */
3083                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
3084                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3085                         break;
3086                 case 1: /* 123 Mhz */
3087                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3088                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3089                         break;
3090                 default: /* 120 Mhz */
3091                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3092                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3093                         break;
3094                 }
3095         } else if (dev->phy.type == B43_PHYTYPE_LCN) {
3096                 switch (spurmode) {
3097                 case 1: /* 82 Mhz */
3098                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3099                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3100                         break;
3101                 default: /* 80 Mhz */
3102                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3103                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3104                         break;
3105                 }
3106         }
3107 }
3108
3109 static void b43_adjust_opmode(struct b43_wldev *dev)
3110 {
3111         struct b43_wl *wl = dev->wl;
3112         u32 ctl;
3113         u16 cfp_pretbtt;
3114
3115         ctl = b43_read32(dev, B43_MMIO_MACCTL);
3116         /* Reset status to STA infrastructure mode. */
3117         ctl &= ~B43_MACCTL_AP;
3118         ctl &= ~B43_MACCTL_KEEP_CTL;
3119         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3120         ctl &= ~B43_MACCTL_KEEP_BAD;
3121         ctl &= ~B43_MACCTL_PROMISC;
3122         ctl &= ~B43_MACCTL_BEACPROMISC;
3123         ctl |= B43_MACCTL_INFRA;
3124
3125         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3126             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3127                 ctl |= B43_MACCTL_AP;
3128         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3129                 ctl &= ~B43_MACCTL_INFRA;
3130
3131         if (wl->filter_flags & FIF_CONTROL)
3132                 ctl |= B43_MACCTL_KEEP_CTL;
3133         if (wl->filter_flags & FIF_FCSFAIL)
3134                 ctl |= B43_MACCTL_KEEP_BAD;
3135         if (wl->filter_flags & FIF_PLCPFAIL)
3136                 ctl |= B43_MACCTL_KEEP_BADPLCP;
3137         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3138                 ctl |= B43_MACCTL_BEACPROMISC;
3139
3140         /* Workaround: On old hardware the HW-MAC-address-filter
3141          * doesn't work properly, so always run promisc in filter
3142          * it in software. */
3143         if (dev->dev->core_rev <= 4)
3144                 ctl |= B43_MACCTL_PROMISC;
3145
3146         b43_write32(dev, B43_MMIO_MACCTL, ctl);
3147
3148         cfp_pretbtt = 2;
3149         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3150                 if (dev->dev->chip_id == 0x4306 &&
3151                     dev->dev->chip_rev == 3)
3152                         cfp_pretbtt = 100;
3153                 else
3154                         cfp_pretbtt = 50;
3155         }
3156         b43_write16(dev, 0x612, cfp_pretbtt);
3157
3158         /* FIXME: We don't currently implement the PMQ mechanism,
3159          *        so always disable it. If we want to implement PMQ,
3160          *        we need to enable it here (clear DISCPMQ) in AP mode.
3161          */
3162         if (0  /* ctl & B43_MACCTL_AP */)
3163                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3164         else
3165                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3166 }
3167
3168 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3169 {
3170         u16 offset;
3171
3172         if (is_ofdm) {
3173                 offset = 0x480;
3174                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3175         } else {
3176                 offset = 0x4C0;
3177                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3178         }
3179         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3180                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
3181 }
3182
3183 static void b43_rate_memory_init(struct b43_wldev *dev)
3184 {
3185         switch (dev->phy.type) {
3186         case B43_PHYTYPE_G:
3187         case B43_PHYTYPE_N:
3188         case B43_PHYTYPE_LP:
3189         case B43_PHYTYPE_HT:
3190         case B43_PHYTYPE_LCN:
3191                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3192                 b43_rate_memory_write(dev, B43_OFDM_RATE_9MB, 1);
3193                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3194                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3195                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3196                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3197                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3198                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3199                 /* fallthrough */
3200         case B43_PHYTYPE_B:
3201                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3202                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3203                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3204                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3205                 break;
3206         default:
3207                 B43_WARN_ON(1);
3208         }
3209 }
3210
3211 /* Set the default values for the PHY TX Control Words. */
3212 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3213 {
3214         u16 ctl = 0;
3215
3216         ctl |= B43_TXH_PHY_ENC_CCK;
3217         ctl |= B43_TXH_PHY_ANT01AUTO;
3218         ctl |= B43_TXH_PHY_TXPWR;
3219
3220         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3221         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3222         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3223 }
3224
3225 /* Set the TX-Antenna for management frames sent by firmware. */
3226 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3227 {
3228         u16 ant;
3229         u16 tmp;
3230
3231         ant = b43_antenna_to_phyctl(antenna);
3232
3233         /* For ACK/CTS */
3234         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3235         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3236         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3237         /* For Probe Resposes */
3238         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3239         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3240         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3241 }
3242
3243 /* This is the opposite of b43_chip_init() */
3244 static void b43_chip_exit(struct b43_wldev *dev)
3245 {
3246         b43_phy_exit(dev);
3247         b43_gpio_cleanup(dev);
3248         /* firmware is released later */
3249 }
3250
3251 /* Initialize the chip
3252  * http://bcm-specs.sipsolutions.net/ChipInit
3253  */
3254 static int b43_chip_init(struct b43_wldev *dev)
3255 {
3256         struct b43_phy *phy = &dev->phy;
3257         int err;
3258         u32 macctl;
3259         u16 value16;
3260
3261         /* Initialize the MAC control */
3262         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3263         if (dev->phy.gmode)
3264                 macctl |= B43_MACCTL_GMODE;
3265         macctl |= B43_MACCTL_INFRA;
3266         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3267
3268         err = b43_upload_microcode(dev);
3269         if (err)
3270                 goto out;       /* firmware is released later */
3271
3272         err = b43_gpio_init(dev);
3273         if (err)
3274                 goto out;       /* firmware is released later */
3275
3276         err = b43_upload_initvals(dev);
3277         if (err)
3278                 goto err_gpio_clean;
3279
3280         err = b43_upload_initvals_band(dev);
3281         if (err)
3282                 goto err_gpio_clean;
3283
3284         /* Turn the Analog on and initialize the PHY. */
3285         phy->ops->switch_analog(dev, 1);
3286         err = b43_phy_init(dev);
3287         if (err)
3288                 goto err_gpio_clean;
3289
3290         /* Disable Interference Mitigation. */
3291         if (phy->ops->interf_mitigation)
3292                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3293
3294         /* Select the antennae */
3295         if (phy->ops->set_rx_antenna)
3296                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3297         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3298
3299         if (phy->type == B43_PHYTYPE_B) {
3300                 value16 = b43_read16(dev, 0x005E);
3301                 value16 |= 0x0004;
3302                 b43_write16(dev, 0x005E, value16);
3303         }
3304         b43_write32(dev, 0x0100, 0x01000000);
3305         if (dev->dev->core_rev < 5)
3306                 b43_write32(dev, 0x010C, 0x01000000);
3307
3308         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3309         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3310
3311         /* Probe Response Timeout value */
3312         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3313         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3314
3315         /* Initially set the wireless operation mode. */
3316         b43_adjust_opmode(dev);
3317
3318         if (dev->dev->core_rev < 3) {
3319                 b43_write16(dev, 0x060E, 0x0000);
3320                 b43_write16(dev, 0x0610, 0x8000);
3321                 b43_write16(dev, 0x0604, 0x0000);
3322                 b43_write16(dev, 0x0606, 0x0200);
3323         } else {
3324                 b43_write32(dev, 0x0188, 0x80000000);
3325                 b43_write32(dev, 0x018C, 0x02000000);
3326         }
3327         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3328         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3329         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3330         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3331         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3332         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3333         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3334
3335         b43_mac_phy_clock_set(dev, true);
3336
3337         switch (dev->dev->bus_type) {
3338 #ifdef CONFIG_B43_BCMA
3339         case B43_BUS_BCMA:
3340                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3341                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3342                 break;
3343 #endif
3344 #ifdef CONFIG_B43_SSB
3345         case B43_BUS_SSB:
3346                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3347                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3348                 break;
3349 #endif
3350         }
3351
3352         err = 0;
3353         b43dbg(dev->wl, "Chip initialized\n");
3354 out:
3355         return err;
3356
3357 err_gpio_clean:
3358         b43_gpio_cleanup(dev);
3359         return err;
3360 }
3361
3362 static void b43_periodic_every60sec(struct b43_wldev *dev)
3363 {
3364         const struct b43_phy_operations *ops = dev->phy.ops;
3365
3366         if (ops->pwork_60sec)
3367                 ops->pwork_60sec(dev);
3368
3369         /* Force check the TX power emission now. */
3370         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3371 }
3372
3373 static void b43_periodic_every30sec(struct b43_wldev *dev)
3374 {
3375         /* Update device statistics. */
3376         b43_calculate_link_quality(dev);
3377 }
3378
3379 static void b43_periodic_every15sec(struct b43_wldev *dev)
3380 {
3381         struct b43_phy *phy = &dev->phy;
3382         u16 wdr;
3383
3384         if (dev->fw.opensource) {
3385                 /* Check if the firmware is still alive.
3386                  * It will reset the watchdog counter to 0 in its idle loop. */
3387                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3388                 if (unlikely(wdr)) {
3389                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3390                         b43_controller_restart(dev, "Firmware watchdog");
3391                         return;
3392                 } else {
3393                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3394                                         B43_WATCHDOG_REG, 1);
3395                 }
3396         }
3397
3398         if (phy->ops->pwork_15sec)
3399                 phy->ops->pwork_15sec(dev);
3400
3401         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3402         wmb();
3403
3404 #if B43_DEBUG
3405         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3406                 unsigned int i;
3407
3408                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3409                        dev->irq_count / 15,
3410                        dev->tx_count / 15,
3411                        dev->rx_count / 15);
3412                 dev->irq_count = 0;
3413                 dev->tx_count = 0;
3414                 dev->rx_count = 0;
3415                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3416                         if (dev->irq_bit_count[i]) {
3417                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3418                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3419                                 dev->irq_bit_count[i] = 0;
3420                         }
3421                 }
3422         }
3423 #endif
3424 }
3425
3426 static void do_periodic_work(struct b43_wldev *dev)
3427 {
3428         unsigned int state;
3429
3430         state = dev->periodic_state;
3431         if (state % 4 == 0)
3432                 b43_periodic_every60sec(dev);
3433         if (state % 2 == 0)
3434                 b43_periodic_every30sec(dev);
3435         b43_periodic_every15sec(dev);
3436 }
3437
3438 /* Periodic work locking policy:
3439  *      The whole periodic work handler is protected by
3440  *      wl->mutex. If another lock is needed somewhere in the
3441  *      pwork callchain, it's acquired in-place, where it's needed.
3442  */
3443 static void b43_periodic_work_handler(struct work_struct *work)
3444 {
3445         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3446                                              periodic_work.work);
3447         struct b43_wl *wl = dev->wl;
3448         unsigned long delay;
3449
3450         mutex_lock(&wl->mutex);
3451
3452         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3453                 goto out;
3454         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3455                 goto out_requeue;
3456
3457         do_periodic_work(dev);
3458
3459         dev->periodic_state++;
3460 out_requeue:
3461         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3462                 delay = msecs_to_jiffies(50);
3463         else
3464                 delay = round_jiffies_relative(HZ * 15);
3465         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3466 out:
3467         mutex_unlock(&wl->mutex);
3468 }
3469
3470 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3471 {
3472         struct delayed_work *work = &dev->periodic_work;
3473
3474         dev->periodic_state = 0;
3475         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3476         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3477 }
3478
3479 /* Check if communication with the device works correctly. */
3480 static int b43_validate_chipaccess(struct b43_wldev *dev)
3481 {
3482         u32 v, backup0, backup4;
3483
3484         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3485         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3486
3487         /* Check for read/write and endianness problems. */
3488         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3489         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3490                 goto error;
3491         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3492         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3493                 goto error;
3494
3495         /* Check if unaligned 32bit SHM_SHARED access works properly.
3496          * However, don't bail out on failure, because it's noncritical. */
3497         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3498         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3499         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3500         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3501         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3502                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3503         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3504         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3505             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3506             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3507             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3508                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3509
3510         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3511         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3512
3513         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3514                 /* The 32bit register shadows the two 16bit registers
3515                  * with update sideeffects. Validate this. */
3516                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3517                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3518                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3519                         goto error;
3520                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3521                         goto error;
3522         }
3523         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3524
3525         v = b43_read32(dev, B43_MMIO_MACCTL);
3526         v |= B43_MACCTL_GMODE;
3527         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3528                 goto error;
3529
3530         return 0;
3531 error:
3532         b43err(dev->wl, "Failed to validate the chipaccess\n");
3533         return -ENODEV;
3534 }
3535
3536 static void b43_security_init(struct b43_wldev *dev)
3537 {
3538         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3539         /* KTP is a word address, but we address SHM bytewise.
3540          * So multiply by two.
3541          */
3542         dev->ktp *= 2;
3543         /* Number of RCMTA address slots */
3544         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3545         /* Clear the key memory. */
3546         b43_clear_keys(dev);
3547 }
3548
3549 #ifdef CONFIG_B43_HWRNG
3550 static int b43_rng_read(struct hwrng *rng, u32 *data)
3551 {
3552         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3553         struct b43_wldev *dev;
3554         int count = -ENODEV;
3555
3556         mutex_lock(&wl->mutex);
3557         dev = wl->current_dev;
3558         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3559                 *data = b43_read16(dev, B43_MMIO_RNG);
3560                 count = sizeof(u16);
3561         }
3562         mutex_unlock(&wl->mutex);
3563
3564         return count;
3565 }
3566 #endif /* CONFIG_B43_HWRNG */
3567
3568 static void b43_rng_exit(struct b43_wl *wl)
3569 {
3570 #ifdef CONFIG_B43_HWRNG
3571         if (wl->rng_initialized)
3572                 hwrng_unregister(&wl->rng);
3573 #endif /* CONFIG_B43_HWRNG */
3574 }
3575
3576 static int b43_rng_init(struct b43_wl *wl)
3577 {
3578         int err = 0;
3579
3580 #ifdef CONFIG_B43_HWRNG
3581         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3582                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3583         wl->rng.name = wl->rng_name;
3584         wl->rng.data_read = b43_rng_read;
3585         wl->rng.priv = (unsigned long)wl;
3586         wl->rng_initialized = true;
3587         err = hwrng_register(&wl->rng);
3588         if (err) {
3589                 wl->rng_initialized = false;
3590                 b43err(wl, "Failed to register the random "
3591                        "number generator (%d)\n", err);
3592         }
3593 #endif /* CONFIG_B43_HWRNG */
3594
3595         return err;
3596 }
3597
3598 static void b43_tx_work(struct work_struct *work)
3599 {
3600         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3601         struct b43_wldev *dev;
3602         struct sk_buff *skb;
3603         int queue_num;
3604         int err = 0;
3605
3606         mutex_lock(&wl->mutex);
3607         dev = wl->current_dev;
3608         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3609                 mutex_unlock(&wl->mutex);
3610                 return;
3611         }
3612
3613         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3614                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
3615                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
3616                         if (b43_using_pio_transfers(dev))
3617                                 err = b43_pio_tx(dev, skb);
3618                         else
3619                                 err = b43_dma_tx(dev, skb);
3620                         if (err == -ENOSPC) {
3621                                 wl->tx_queue_stopped[queue_num] = 1;
3622                                 ieee80211_stop_queue(wl->hw, queue_num);
3623                                 skb_queue_head(&wl->tx_queue[queue_num], skb);
3624                                 break;
3625                         }
3626                         if (unlikely(err))
3627                                 ieee80211_free_txskb(wl->hw, skb);
3628                         err = 0;
3629                 }
3630
3631                 if (!err)
3632                         wl->tx_queue_stopped[queue_num] = 0;
3633         }
3634
3635 #if B43_DEBUG
3636         dev->tx_count++;
3637 #endif
3638         mutex_unlock(&wl->mutex);
3639 }
3640
3641 static void b43_op_tx(struct ieee80211_hw *hw,
3642                       struct ieee80211_tx_control *control,
3643                       struct sk_buff *skb)
3644 {
3645         struct b43_wl *wl = hw_to_b43_wl(hw);
3646
3647         if (unlikely(skb->len < 2 + 2 + 6)) {
3648                 /* Too short, this can't be a valid frame. */
3649                 ieee80211_free_txskb(hw, skb);
3650                 return;
3651         }
3652         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3653
3654         skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3655         if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3656                 ieee80211_queue_work(wl->hw, &wl->tx_work);
3657         } else {
3658                 ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3659         }
3660 }
3661
3662 static void b43_qos_params_upload(struct b43_wldev *dev,
3663                                   const struct ieee80211_tx_queue_params *p,
3664                                   u16 shm_offset)
3665 {
3666         u16 params[B43_NR_QOSPARAMS];
3667         int bslots, tmp;
3668         unsigned int i;
3669
3670         if (!dev->qos_enabled)
3671                 return;
3672
3673         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3674
3675         memset(&params, 0, sizeof(params));
3676
3677         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3678         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3679         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3680         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3681         params[B43_QOSPARAM_AIFS] = p->aifs;
3682         params[B43_QOSPARAM_BSLOTS] = bslots;
3683         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3684
3685         for (i = 0; i < ARRAY_SIZE(params); i++) {
3686                 if (i == B43_QOSPARAM_STATUS) {
3687                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3688                                              shm_offset + (i * 2));
3689                         /* Mark the parameters as updated. */
3690                         tmp |= 0x100;
3691                         b43_shm_write16(dev, B43_SHM_SHARED,
3692                                         shm_offset + (i * 2),
3693                                         tmp);
3694                 } else {
3695                         b43_shm_write16(dev, B43_SHM_SHARED,
3696                                         shm_offset + (i * 2),
3697                                         params[i]);
3698                 }
3699         }
3700 }
3701
3702 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3703 static const u16 b43_qos_shm_offsets[] = {
3704         /* [mac80211-queue-nr] = SHM_OFFSET, */
3705         [0] = B43_QOS_VOICE,
3706         [1] = B43_QOS_VIDEO,
3707         [2] = B43_QOS_BESTEFFORT,
3708         [3] = B43_QOS_BACKGROUND,
3709 };
3710
3711 /* Update all QOS parameters in hardware. */
3712 static void b43_qos_upload_all(struct b43_wldev *dev)
3713 {
3714         struct b43_wl *wl = dev->wl;
3715         struct b43_qos_params *params;
3716         unsigned int i;
3717
3718         if (!dev->qos_enabled)
3719                 return;
3720
3721         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3722                      ARRAY_SIZE(wl->qos_params));
3723
3724         b43_mac_suspend(dev);
3725         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3726                 params = &(wl->qos_params[i]);
3727                 b43_qos_params_upload(dev, &(params->p),
3728                                       b43_qos_shm_offsets[i]);
3729         }
3730         b43_mac_enable(dev);
3731 }
3732
3733 static void b43_qos_clear(struct b43_wl *wl)
3734 {
3735         struct b43_qos_params *params;
3736         unsigned int i;
3737
3738         /* Initialize QoS parameters to sane defaults. */
3739
3740         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3741                      ARRAY_SIZE(wl->qos_params));
3742
3743         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3744                 params = &(wl->qos_params[i]);
3745
3746                 switch (b43_qos_shm_offsets[i]) {
3747                 case B43_QOS_VOICE:
3748                         params->p.txop = 0;
3749                         params->p.aifs = 2;
3750                         params->p.cw_min = 0x0001;
3751                         params->p.cw_max = 0x0001;
3752                         break;
3753                 case B43_QOS_VIDEO:
3754                         params->p.txop = 0;
3755                         params->p.aifs = 2;
3756                         params->p.cw_min = 0x0001;
3757                         params->p.cw_max = 0x0001;
3758                         break;
3759                 case B43_QOS_BESTEFFORT:
3760                         params->p.txop = 0;
3761                         params->p.aifs = 3;
3762                         params->p.cw_min = 0x0001;
3763                         params->p.cw_max = 0x03FF;
3764                         break;
3765                 case B43_QOS_BACKGROUND:
3766                         params->p.txop = 0;
3767                         params->p.aifs = 7;
3768                         params->p.cw_min = 0x0001;
3769                         params->p.cw_max = 0x03FF;
3770                         break;
3771                 default:
3772                         B43_WARN_ON(1);
3773                 }
3774         }
3775 }
3776
3777 /* Initialize the core's QOS capabilities */
3778 static void b43_qos_init(struct b43_wldev *dev)
3779 {
3780         if (!dev->qos_enabled) {
3781                 /* Disable QOS support. */
3782                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3783                 b43_write16(dev, B43_MMIO_IFSCTL,
3784                             b43_read16(dev, B43_MMIO_IFSCTL)
3785                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3786                 b43dbg(dev->wl, "QoS disabled\n");
3787                 return;
3788         }
3789
3790         /* Upload the current QOS parameters. */
3791         b43_qos_upload_all(dev);
3792
3793         /* Enable QOS support. */
3794         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3795         b43_write16(dev, B43_MMIO_IFSCTL,
3796                     b43_read16(dev, B43_MMIO_IFSCTL)
3797                     | B43_MMIO_IFSCTL_USE_EDCF);
3798         b43dbg(dev->wl, "QoS enabled\n");
3799 }
3800
3801 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3802                           struct ieee80211_vif *vif, u16 _queue,
3803                           const struct ieee80211_tx_queue_params *params)
3804 {
3805         struct b43_wl *wl = hw_to_b43_wl(hw);
3806         struct b43_wldev *dev;
3807         unsigned int queue = (unsigned int)_queue;
3808         int err = -ENODEV;
3809
3810         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3811                 /* Queue not available or don't support setting
3812                  * params on this queue. Return success to not
3813                  * confuse mac80211. */
3814                 return 0;
3815         }
3816         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3817                      ARRAY_SIZE(wl->qos_params));
3818
3819         mutex_lock(&wl->mutex);
3820         dev = wl->current_dev;
3821         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3822                 goto out_unlock;
3823
3824         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3825         b43_mac_suspend(dev);
3826         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3827                               b43_qos_shm_offsets[queue]);
3828         b43_mac_enable(dev);
3829         err = 0;
3830
3831 out_unlock:
3832         mutex_unlock(&wl->mutex);
3833
3834         return err;
3835 }
3836
3837 static int b43_op_get_stats(struct ieee80211_hw *hw,
3838                             struct ieee80211_low_level_stats *stats)
3839 {
3840         struct b43_wl *wl = hw_to_b43_wl(hw);
3841
3842         mutex_lock(&wl->mutex);
3843         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3844         mutex_unlock(&wl->mutex);
3845
3846         return 0;
3847 }
3848
3849 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3850 {
3851         struct b43_wl *wl = hw_to_b43_wl(hw);
3852         struct b43_wldev *dev;
3853         u64 tsf;
3854
3855         mutex_lock(&wl->mutex);
3856         dev = wl->current_dev;
3857
3858         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3859                 b43_tsf_read(dev, &tsf);
3860         else
3861                 tsf = 0;
3862
3863         mutex_unlock(&wl->mutex);
3864
3865         return tsf;
3866 }
3867
3868 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3869                            struct ieee80211_vif *vif, u64 tsf)
3870 {
3871         struct b43_wl *wl = hw_to_b43_wl(hw);
3872         struct b43_wldev *dev;
3873
3874         mutex_lock(&wl->mutex);
3875         dev = wl->current_dev;
3876
3877         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3878                 b43_tsf_write(dev, tsf);
3879
3880         mutex_unlock(&wl->mutex);
3881 }
3882
3883 static const char *band_to_string(enum nl80211_band band)
3884 {
3885         switch (band) {
3886         case NL80211_BAND_5GHZ:
3887                 return "5";
3888         case NL80211_BAND_2GHZ:
3889                 return "2.4";
3890         default:
3891                 break;
3892         }
3893         B43_WARN_ON(1);
3894         return "";
3895 }
3896
3897 /* Expects wl->mutex locked */
3898 static int b43_switch_band(struct b43_wldev *dev,
3899                            struct ieee80211_channel *chan)
3900 {
3901         struct b43_phy *phy = &dev->phy;
3902         bool gmode;
3903         u32 tmp;
3904
3905         switch (chan->band) {
3906         case NL80211_BAND_5GHZ:
3907                 gmode = false;
3908                 break;
3909         case NL80211_BAND_2GHZ:
3910                 gmode = true;
3911                 break;
3912         default:
3913                 B43_WARN_ON(1);
3914                 return -EINVAL;
3915         }
3916
3917         if (!((gmode && phy->supports_2ghz) ||
3918               (!gmode && phy->supports_5ghz))) {
3919                 b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3920                        band_to_string(chan->band));
3921                 return -ENODEV;
3922         }
3923
3924         if (!!phy->gmode == !!gmode) {
3925                 /* This device is already running. */
3926                 return 0;
3927         }
3928
3929         b43dbg(dev->wl, "Switching to %s GHz band\n",
3930                band_to_string(chan->band));
3931
3932         /* Some new devices don't need disabling radio for band switching */
3933         if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3934                 b43_software_rfkill(dev, true);
3935
3936         phy->gmode = gmode;
3937         b43_phy_put_into_reset(dev);
3938         switch (dev->dev->bus_type) {
3939 #ifdef CONFIG_B43_BCMA
3940         case B43_BUS_BCMA:
3941                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3942                 if (gmode)
3943                         tmp |= B43_BCMA_IOCTL_GMODE;
3944                 else
3945                         tmp &= ~B43_BCMA_IOCTL_GMODE;
3946                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3947                 break;
3948 #endif
3949 #ifdef CONFIG_B43_SSB
3950         case B43_BUS_SSB:
3951                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3952                 if (gmode)
3953                         tmp |= B43_TMSLOW_GMODE;
3954                 else
3955                         tmp &= ~B43_TMSLOW_GMODE;
3956                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3957                 break;
3958 #endif
3959         }
3960         b43_phy_take_out_of_reset(dev);
3961
3962         b43_upload_initvals_band(dev);
3963
3964         b43_phy_init(dev);
3965
3966         return 0;
3967 }
3968
3969 static void b43_set_beacon_listen_interval(struct b43_wldev *dev, u16 interval)
3970 {
3971         interval = min_t(u16, interval, (u16)0xFF);
3972         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BCN_LI, interval);
3973 }
3974
3975 /* Write the short and long frame retry limit values. */
3976 static void b43_set_retry_limits(struct b43_wldev *dev,
3977                                  unsigned int short_retry,
3978                                  unsigned int long_retry)
3979 {
3980         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3981          * the chip-internal counter. */
3982         short_retry = min(short_retry, (unsigned int)0xF);
3983         long_retry = min(long_retry, (unsigned int)0xF);
3984
3985         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3986                         short_retry);
3987         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3988                         long_retry);
3989 }
3990
3991 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3992 {
3993         struct b43_wl *wl = hw_to_b43_wl(hw);
3994         struct b43_wldev *dev = wl->current_dev;
3995         struct b43_phy *phy = &dev->phy;
3996         struct ieee80211_conf *conf = &hw->conf;
3997         int antenna;
3998         int err = 0;
3999
4000         mutex_lock(&wl->mutex);
4001         b43_mac_suspend(dev);
4002
4003         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL)
4004                 b43_set_beacon_listen_interval(dev, conf->listen_interval);
4005
4006         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
4007                 phy->chandef = &conf->chandef;
4008                 phy->channel = conf->chandef.chan->hw_value;
4009
4010                 /* Switch the band (if necessary). */
4011                 err = b43_switch_band(dev, conf->chandef.chan);
4012                 if (err)
4013                         goto out_mac_enable;
4014
4015                 /* Switch to the requested channel.
4016                  * The firmware takes care of races with the TX handler.
4017                  */
4018                 b43_switch_channel(dev, phy->channel);
4019         }
4020
4021         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
4022                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
4023                                           conf->long_frame_max_tx_count);
4024         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
4025         if (!changed)
4026                 goto out_mac_enable;
4027
4028         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
4029
4030         /* Adjust the desired TX power level. */
4031         if (conf->power_level != 0) {
4032                 if (conf->power_level != phy->desired_txpower) {
4033                         phy->desired_txpower = conf->power_level;
4034                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
4035                                                    B43_TXPWR_IGNORE_TSSI);
4036                 }
4037         }
4038
4039         /* Antennas for RX and management frame TX. */
4040         antenna = B43_ANTENNA_DEFAULT;
4041         b43_mgmtframe_txantenna(dev, antenna);
4042         antenna = B43_ANTENNA_DEFAULT;
4043         if (phy->ops->set_rx_antenna)
4044                 phy->ops->set_rx_antenna(dev, antenna);
4045
4046         if (wl->radio_enabled != phy->radio_on) {
4047                 if (wl->radio_enabled) {
4048                         b43_software_rfkill(dev, false);
4049                         b43info(dev->wl, "Radio turned on by software\n");
4050                         if (!dev->radio_hw_enable) {
4051                                 b43info(dev->wl, "The hardware RF-kill button "
4052                                         "still turns the radio physically off. "
4053                                         "Press the button to turn it on.\n");
4054                         }
4055                 } else {
4056                         b43_software_rfkill(dev, true);
4057                         b43info(dev->wl, "Radio turned off by software\n");
4058                 }
4059         }
4060
4061 out_mac_enable:
4062         b43_mac_enable(dev);
4063         mutex_unlock(&wl->mutex);
4064
4065         return err;
4066 }
4067
4068 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
4069 {
4070         struct ieee80211_supported_band *sband =
4071                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
4072         struct ieee80211_rate *rate;
4073         int i;
4074         u16 basic, direct, offset, basic_offset, rateptr;
4075
4076         for (i = 0; i < sband->n_bitrates; i++) {
4077                 rate = &sband->bitrates[i];
4078
4079                 if (b43_is_cck_rate(rate->hw_value)) {
4080                         direct = B43_SHM_SH_CCKDIRECT;
4081                         basic = B43_SHM_SH_CCKBASIC;
4082                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4083                         offset &= 0xF;
4084                 } else {
4085                         direct = B43_SHM_SH_OFDMDIRECT;
4086                         basic = B43_SHM_SH_OFDMBASIC;
4087                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4088                         offset &= 0xF;
4089                 }
4090
4091                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4092
4093                 if (b43_is_cck_rate(rate->hw_value)) {
4094                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4095                         basic_offset &= 0xF;
4096                 } else {
4097                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4098                         basic_offset &= 0xF;
4099                 }
4100
4101                 /*
4102                  * Get the pointer that we need to point to
4103                  * from the direct map
4104                  */
4105                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4106                                          direct + 2 * basic_offset);
4107                 /* and write it to the basic map */
4108                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4109                                 rateptr);
4110         }
4111 }
4112
4113 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4114                                     struct ieee80211_vif *vif,
4115                                     struct ieee80211_bss_conf *conf,
4116                                     u32 changed)
4117 {
4118         struct b43_wl *wl = hw_to_b43_wl(hw);
4119         struct b43_wldev *dev;
4120
4121         mutex_lock(&wl->mutex);
4122
4123         dev = wl->current_dev;
4124         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4125                 goto out_unlock_mutex;
4126
4127         B43_WARN_ON(wl->vif != vif);
4128
4129         if (changed & BSS_CHANGED_BSSID) {
4130                 if (conf->bssid)
4131                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4132                 else
4133                         eth_zero_addr(wl->bssid);
4134         }
4135
4136         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4137                 if (changed & BSS_CHANGED_BEACON &&
4138                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4139                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4140                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4141                         b43_update_templates(wl);
4142
4143                 if (changed & BSS_CHANGED_BSSID)
4144                         b43_write_mac_bssid_templates(dev);
4145         }
4146
4147         b43_mac_suspend(dev);
4148
4149         /* Update templates for AP/mesh mode. */
4150         if (changed & BSS_CHANGED_BEACON_INT &&
4151             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4152              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4153              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4154             conf->beacon_int)
4155                 b43_set_beacon_int(dev, conf->beacon_int);
4156
4157         if (changed & BSS_CHANGED_BASIC_RATES)
4158                 b43_update_basic_rates(dev, conf->basic_rates);
4159
4160         if (changed & BSS_CHANGED_ERP_SLOT) {
4161                 if (conf->use_short_slot)
4162                         b43_short_slot_timing_enable(dev);
4163                 else
4164                         b43_short_slot_timing_disable(dev);
4165         }
4166
4167         b43_mac_enable(dev);
4168 out_unlock_mutex:
4169         mutex_unlock(&wl->mutex);
4170 }
4171
4172 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4173                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4174                           struct ieee80211_key_conf *key)
4175 {
4176         struct b43_wl *wl = hw_to_b43_wl(hw);
4177         struct b43_wldev *dev;
4178         u8 algorithm;
4179         u8 index;
4180         int err;
4181         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4182
4183         if (modparam_nohwcrypt)
4184                 return -ENOSPC; /* User disabled HW-crypto */
4185
4186         if ((vif->type == NL80211_IFTYPE_ADHOC ||
4187              vif->type == NL80211_IFTYPE_MESH_POINT) &&
4188             (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4189              key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4190             !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4191                 /*
4192                  * For now, disable hw crypto for the RSN IBSS group keys. This
4193                  * could be optimized in the future, but until that gets
4194                  * implemented, use of software crypto for group addressed
4195                  * frames is a acceptable to allow RSN IBSS to be used.
4196                  */
4197                 return -EOPNOTSUPP;
4198         }
4199
4200         mutex_lock(&wl->mutex);
4201
4202         dev = wl->current_dev;
4203         err = -ENODEV;
4204         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4205                 goto out_unlock;
4206
4207         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4208                 /* We don't have firmware for the crypto engine.
4209                  * Must use software-crypto. */
4210                 err = -EOPNOTSUPP;
4211                 goto out_unlock;
4212         }
4213
4214         err = -EINVAL;
4215         switch (key->cipher) {
4216         case WLAN_CIPHER_SUITE_WEP40:
4217                 algorithm = B43_SEC_ALGO_WEP40;
4218                 break;
4219         case WLAN_CIPHER_SUITE_WEP104:
4220                 algorithm = B43_SEC_ALGO_WEP104;
4221                 break;
4222         case WLAN_CIPHER_SUITE_TKIP:
4223                 algorithm = B43_SEC_ALGO_TKIP;
4224                 break;
4225         case WLAN_CIPHER_SUITE_CCMP:
4226                 algorithm = B43_SEC_ALGO_AES;
4227                 break;
4228         default:
4229                 B43_WARN_ON(1);
4230                 goto out_unlock;
4231         }
4232         index = (u8) (key->keyidx);
4233         if (index > 3)
4234                 goto out_unlock;
4235
4236         switch (cmd) {
4237         case SET_KEY:
4238                 if (algorithm == B43_SEC_ALGO_TKIP &&
4239                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4240                     !modparam_hwtkip)) {
4241                         /* We support only pairwise key */
4242                         err = -EOPNOTSUPP;
4243                         goto out_unlock;
4244                 }
4245
4246                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4247                         if (WARN_ON(!sta)) {
4248                                 err = -EOPNOTSUPP;
4249                                 goto out_unlock;
4250                         }
4251                         /* Pairwise key with an assigned MAC address. */
4252                         err = b43_key_write(dev, -1, algorithm,
4253                                             key->key, key->keylen,
4254                                             sta->addr, key);
4255                 } else {
4256                         /* Group key */
4257                         err = b43_key_write(dev, index, algorithm,
4258                                             key->key, key->keylen, NULL, key);
4259                 }
4260                 if (err)
4261                         goto out_unlock;
4262
4263                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4264                     algorithm == B43_SEC_ALGO_WEP104) {
4265                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4266                 } else {
4267                         b43_hf_write(dev,
4268                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4269                 }
4270                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4271                 if (algorithm == B43_SEC_ALGO_TKIP)
4272                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4273                 break;
4274         case DISABLE_KEY: {
4275                 err = b43_key_clear(dev, key->hw_key_idx);
4276                 if (err)
4277                         goto out_unlock;
4278                 break;
4279         }
4280         default:
4281                 B43_WARN_ON(1);
4282         }
4283
4284 out_unlock:
4285         if (!err) {
4286                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4287                        "mac: %pM\n",
4288                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4289                        sta ? sta->addr : bcast_addr);
4290                 b43_dump_keymemory(dev);
4291         }
4292         mutex_unlock(&wl->mutex);
4293
4294         return err;
4295 }
4296
4297 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4298                                     unsigned int changed, unsigned int *fflags,
4299                                     u64 multicast)
4300 {
4301         struct b43_wl *wl = hw_to_b43_wl(hw);
4302         struct b43_wldev *dev;
4303
4304         mutex_lock(&wl->mutex);
4305         dev = wl->current_dev;
4306         if (!dev) {
4307                 *fflags = 0;
4308                 goto out_unlock;
4309         }
4310
4311         *fflags &= FIF_ALLMULTI |
4312                   FIF_FCSFAIL |
4313                   FIF_PLCPFAIL |
4314                   FIF_CONTROL |
4315                   FIF_OTHER_BSS |
4316                   FIF_BCN_PRBRESP_PROMISC;
4317
4318         changed &= FIF_ALLMULTI |
4319                    FIF_FCSFAIL |
4320                    FIF_PLCPFAIL |
4321                    FIF_CONTROL |
4322                    FIF_OTHER_BSS |
4323                    FIF_BCN_PRBRESP_PROMISC;
4324
4325         wl->filter_flags = *fflags;
4326
4327         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4328                 b43_adjust_opmode(dev);
4329
4330 out_unlock:
4331         mutex_unlock(&wl->mutex);
4332 }
4333
4334 /* Locking: wl->mutex
4335  * Returns the current dev. This might be different from the passed in dev,
4336  * because the core might be gone away while we unlocked the mutex. */
4337 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4338 {
4339         struct b43_wl *wl;
4340         struct b43_wldev *orig_dev;
4341         u32 mask;
4342         int queue_num;
4343
4344         if (!dev)
4345                 return NULL;
4346         wl = dev->wl;
4347 redo:
4348         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4349                 return dev;
4350
4351         /* Cancel work. Unlock to avoid deadlocks. */
4352         mutex_unlock(&wl->mutex);
4353         cancel_delayed_work_sync(&dev->periodic_work);
4354         cancel_work_sync(&wl->tx_work);
4355         b43_leds_stop(dev);
4356         mutex_lock(&wl->mutex);
4357         dev = wl->current_dev;
4358         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4359                 /* Whoops, aliens ate up the device while we were unlocked. */
4360                 return dev;
4361         }
4362
4363         /* Disable interrupts on the device. */
4364         b43_set_status(dev, B43_STAT_INITIALIZED);
4365         if (b43_bus_host_is_sdio(dev->dev)) {
4366                 /* wl->mutex is locked. That is enough. */
4367                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4368                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4369         } else {
4370                 spin_lock_irq(&wl->hardirq_lock);
4371                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4372                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4373                 spin_unlock_irq(&wl->hardirq_lock);
4374         }
4375         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4376         orig_dev = dev;
4377         mutex_unlock(&wl->mutex);
4378         if (b43_bus_host_is_sdio(dev->dev))
4379                 b43_sdio_free_irq(dev);
4380         else
4381                 free_irq(dev->dev->irq, dev);
4382         mutex_lock(&wl->mutex);
4383         dev = wl->current_dev;
4384         if (!dev)
4385                 return dev;
4386         if (dev != orig_dev) {
4387                 if (b43_status(dev) >= B43_STAT_STARTED)
4388                         goto redo;
4389                 return dev;
4390         }
4391         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4392         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4393
4394         /* Drain all TX queues. */
4395         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4396                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
4397                         struct sk_buff *skb;
4398
4399                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
4400                         ieee80211_free_txskb(wl->hw, skb);
4401                 }
4402         }
4403
4404         b43_mac_suspend(dev);
4405         b43_leds_exit(dev);
4406         b43dbg(wl, "Wireless interface stopped\n");
4407
4408         return dev;
4409 }
4410
4411 /* Locking: wl->mutex */
4412 static int b43_wireless_core_start(struct b43_wldev *dev)
4413 {
4414         int err;
4415
4416         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4417
4418         drain_txstatus_queue(dev);
4419         if (b43_bus_host_is_sdio(dev->dev)) {
4420                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4421                 if (err) {
4422                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4423                         goto out;
4424                 }
4425         } else {
4426                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4427                                            b43_interrupt_thread_handler,
4428                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4429                 if (err) {
4430                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4431                                dev->dev->irq);
4432                         goto out;
4433                 }
4434         }
4435
4436         /* We are ready to run. */
4437         ieee80211_wake_queues(dev->wl->hw);
4438         b43_set_status(dev, B43_STAT_STARTED);
4439
4440         /* Start data flow (TX/RX). */
4441         b43_mac_enable(dev);
4442         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4443
4444         /* Start maintenance work */
4445         b43_periodic_tasks_setup(dev);
4446
4447         b43_leds_init(dev);
4448
4449         b43dbg(dev->wl, "Wireless interface started\n");
4450 out:
4451         return err;
4452 }
4453
4454 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4455 {
4456         switch (phy_type) {
4457         case B43_PHYTYPE_A:
4458                 return "A";
4459         case B43_PHYTYPE_B:
4460                 return "B";
4461         case B43_PHYTYPE_G:
4462                 return "G";
4463         case B43_PHYTYPE_N:
4464                 return "N";
4465         case B43_PHYTYPE_LP:
4466                 return "LP";
4467         case B43_PHYTYPE_SSLPN:
4468                 return "SSLPN";
4469         case B43_PHYTYPE_HT:
4470                 return "HT";
4471         case B43_PHYTYPE_LCN:
4472                 return "LCN";
4473         case B43_PHYTYPE_LCNXN:
4474                 return "LCNXN";
4475         case B43_PHYTYPE_LCN40:
4476                 return "LCN40";
4477         case B43_PHYTYPE_AC:
4478                 return "AC";
4479         }
4480         return "UNKNOWN";
4481 }
4482
4483 /* Get PHY and RADIO versioning numbers */
4484 static int b43_phy_versioning(struct b43_wldev *dev)
4485 {
4486         struct b43_phy *phy = &dev->phy;
4487         const u8 core_rev = dev->dev->core_rev;
4488         u32 tmp;
4489         u8 analog_type;
4490         u8 phy_type;
4491         u8 phy_rev;
4492         u16 radio_manuf;
4493         u16 radio_id;
4494         u16 radio_rev;
4495         u8 radio_ver;
4496         int unsupported = 0;
4497
4498         /* Get PHY versioning */
4499         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4500         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4501         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4502         phy_rev = (tmp & B43_PHYVER_VERSION);
4503
4504         /* LCNXN is continuation of N which run out of revisions */
4505         if (phy_type == B43_PHYTYPE_LCNXN) {
4506                 phy_type = B43_PHYTYPE_N;
4507                 phy_rev += 16;
4508         }
4509
4510         switch (phy_type) {
4511 #ifdef CONFIG_B43_PHY_G
4512         case B43_PHYTYPE_G:
4513                 if (phy_rev > 9)
4514                         unsupported = 1;
4515                 break;
4516 #endif
4517 #ifdef CONFIG_B43_PHY_N
4518         case B43_PHYTYPE_N:
4519                 if (phy_rev >= 19)
4520                         unsupported = 1;
4521                 break;
4522 #endif
4523 #ifdef CONFIG_B43_PHY_LP
4524         case B43_PHYTYPE_LP:
4525                 if (phy_rev > 2)
4526                         unsupported = 1;
4527                 break;
4528 #endif
4529 #ifdef CONFIG_B43_PHY_HT
4530         case B43_PHYTYPE_HT:
4531                 if (phy_rev > 1)
4532                         unsupported = 1;
4533                 break;
4534 #endif
4535 #ifdef CONFIG_B43_PHY_LCN
4536         case B43_PHYTYPE_LCN:
4537                 if (phy_rev > 1)
4538                         unsupported = 1;
4539                 break;
4540 #endif
4541 #ifdef CONFIG_B43_PHY_AC
4542         case B43_PHYTYPE_AC:
4543                 if (phy_rev > 1)
4544                         unsupported = 1;
4545                 break;
4546 #endif
4547         default:
4548                 unsupported = 1;
4549         }
4550         if (unsupported) {
4551                 b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4552                        analog_type, phy_type, b43_phy_name(dev, phy_type),
4553                        phy_rev);
4554                 return -EOPNOTSUPP;
4555         }
4556         b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4557                 analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4558
4559         /* Get RADIO versioning */
4560         if (core_rev == 40 || core_rev == 42) {
4561                 radio_manuf = 0x17F;
4562
4563                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 0);
4564                 radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4565
4566                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 1);
4567                 radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4568
4569                 radio_ver = 0; /* Is there version somewhere? */
4570         } else if (core_rev >= 24) {
4571                 u16 radio24[3];
4572
4573                 for (tmp = 0; tmp < 3; tmp++) {
4574                         b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4575                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4576                 }
4577
4578                 radio_manuf = 0x17F;
4579                 radio_id = (radio24[2] << 8) | radio24[1];
4580                 radio_rev = (radio24[0] & 0xF);
4581                 radio_ver = (radio24[0] & 0xF0) >> 4;
4582         } else {
4583                 if (dev->dev->chip_id == 0x4317) {
4584                         if (dev->dev->chip_rev == 0)
4585                                 tmp = 0x3205017F;
4586                         else if (dev->dev->chip_rev == 1)
4587                                 tmp = 0x4205017F;
4588                         else
4589                                 tmp = 0x5205017F;
4590                 } else {
4591                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4592                                      B43_RADIOCTL_ID);
4593                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4594                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4595                                      B43_RADIOCTL_ID);
4596                         tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4597                 }
4598                 radio_manuf = (tmp & 0x00000FFF);
4599                 radio_id = (tmp & 0x0FFFF000) >> 12;
4600                 radio_rev = (tmp & 0xF0000000) >> 28;
4601                 radio_ver = 0; /* Probably not available on old hw */
4602         }
4603
4604         if (radio_manuf != 0x17F /* Broadcom */)
4605                 unsupported = 1;
4606         switch (phy_type) {
4607         case B43_PHYTYPE_B:
4608                 if ((radio_id & 0xFFF0) != 0x2050)
4609                         unsupported = 1;
4610                 break;
4611         case B43_PHYTYPE_G:
4612                 if (radio_id != 0x2050)
4613                         unsupported = 1;
4614                 break;
4615         case B43_PHYTYPE_N:
4616                 if (radio_id != 0x2055 && radio_id != 0x2056 &&
4617                     radio_id != 0x2057)
4618                         unsupported = 1;
4619                 if (radio_id == 0x2057 &&
4620                     !(radio_rev == 9 || radio_rev == 14))
4621                         unsupported = 1;
4622                 break;
4623         case B43_PHYTYPE_LP:
4624                 if (radio_id != 0x2062 && radio_id != 0x2063)
4625                         unsupported = 1;
4626                 break;
4627         case B43_PHYTYPE_HT:
4628                 if (radio_id != 0x2059)
4629                         unsupported = 1;
4630                 break;
4631         case B43_PHYTYPE_LCN:
4632                 if (radio_id != 0x2064)
4633                         unsupported = 1;
4634                 break;
4635         case B43_PHYTYPE_AC:
4636                 if (radio_id != 0x2069)
4637                         unsupported = 1;
4638                 break;
4639         default:
4640                 B43_WARN_ON(1);
4641         }
4642         if (unsupported) {
4643                 b43err(dev->wl,
4644                        "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4645                        radio_manuf, radio_id, radio_rev, radio_ver);
4646                 return -EOPNOTSUPP;
4647         }
4648         b43info(dev->wl,
4649                 "Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4650                 radio_manuf, radio_id, radio_rev, radio_ver);
4651
4652         /* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4653         phy->radio_manuf = radio_manuf;
4654         phy->radio_ver = radio_id;
4655         phy->radio_rev = radio_rev;
4656
4657         phy->analog = analog_type;
4658         phy->type = phy_type;
4659         phy->rev = phy_rev;
4660
4661         return 0;
4662 }
4663
4664 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4665                                       struct b43_phy *phy)
4666 {
4667         phy->hardware_power_control = !!modparam_hwpctl;
4668         phy->next_txpwr_check_time = jiffies;
4669         /* PHY TX errors counter. */
4670         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4671
4672 #if B43_DEBUG
4673         phy->phy_locked = false;
4674         phy->radio_locked = false;
4675 #endif
4676 }
4677
4678 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4679 {
4680         dev->dfq_valid = false;
4681
4682         /* Assume the radio is enabled. If it's not enabled, the state will
4683          * immediately get fixed on the first periodic work run. */
4684         dev->radio_hw_enable = true;
4685
4686         /* Stats */
4687         memset(&dev->stats, 0, sizeof(dev->stats));
4688
4689         setup_struct_phy_for_init(dev, &dev->phy);
4690
4691         /* IRQ related flags */
4692         dev->irq_reason = 0;
4693         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4694         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4695         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4696                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4697
4698         dev->mac_suspended = 1;
4699
4700         /* Noise calculation context */
4701         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4702 }
4703
4704 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4705 {
4706         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4707         u64 hf;
4708
4709         if (!modparam_btcoex)
4710                 return;
4711         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4712                 return;
4713         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4714                 return;
4715
4716         hf = b43_hf_read(dev);
4717         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4718                 hf |= B43_HF_BTCOEXALT;
4719         else
4720                 hf |= B43_HF_BTCOEX;
4721         b43_hf_write(dev, hf);
4722 }
4723
4724 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4725 {
4726         if (!modparam_btcoex)
4727                 return;
4728         //TODO
4729 }
4730
4731 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4732 {
4733         struct ssb_bus *bus;
4734         u32 tmp;
4735
4736 #ifdef CONFIG_B43_SSB
4737         if (dev->dev->bus_type != B43_BUS_SSB)
4738                 return;
4739 #else
4740         return;
4741 #endif
4742
4743         bus = dev->dev->sdev->bus;
4744
4745         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4746             (bus->chip_id == 0x4312)) {
4747                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4748                 tmp &= ~SSB_IMCFGLO_REQTO;
4749                 tmp &= ~SSB_IMCFGLO_SERTO;
4750                 tmp |= 0x3;
4751                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4752                 ssb_commit_settings(bus);
4753         }
4754 }
4755
4756 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4757 {
4758         u16 pu_delay;
4759
4760         /* The time value is in microseconds. */
4761         pu_delay = 1050;
4762         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4763                 pu_delay = 500;
4764         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4765                 pu_delay = max(pu_delay, (u16)2400);
4766
4767         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4768 }
4769
4770 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4771 static void b43_set_pretbtt(struct b43_wldev *dev)
4772 {
4773         u16 pretbtt;
4774
4775         /* The time value is in microseconds. */
4776         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
4777                 pretbtt = 2;
4778         else
4779                 pretbtt = 250;
4780         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4781         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4782 }
4783
4784 /* Shutdown a wireless core */
4785 /* Locking: wl->mutex */
4786 static void b43_wireless_core_exit(struct b43_wldev *dev)
4787 {
4788         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4789         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4790                 return;
4791
4792         b43_set_status(dev, B43_STAT_UNINIT);
4793
4794         /* Stop the microcode PSM. */
4795         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4796                       B43_MACCTL_PSM_JMP0);
4797
4798         switch (dev->dev->bus_type) {
4799 #ifdef CONFIG_B43_BCMA
4800         case B43_BUS_BCMA:
4801                 bcma_host_pci_down(dev->dev->bdev->bus);
4802                 break;
4803 #endif
4804 #ifdef CONFIG_B43_SSB
4805         case B43_BUS_SSB:
4806                 /* TODO */
4807                 break;
4808 #endif
4809         }
4810
4811         b43_dma_free(dev);
4812         b43_pio_free(dev);
4813         b43_chip_exit(dev);
4814         dev->phy.ops->switch_analog(dev, 0);
4815         if (dev->wl->current_beacon) {
4816                 dev_kfree_skb_any(dev->wl->current_beacon);
4817                 dev->wl->current_beacon = NULL;
4818         }
4819
4820         b43_device_disable(dev, 0);
4821         b43_bus_may_powerdown(dev);
4822 }
4823
4824 /* Initialize a wireless core */
4825 static int b43_wireless_core_init(struct b43_wldev *dev)
4826 {
4827         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4828         struct b43_phy *phy = &dev->phy;
4829         int err;
4830         u64 hf;
4831
4832         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4833
4834         err = b43_bus_powerup(dev, 0);
4835         if (err)
4836                 goto out;
4837         if (!b43_device_is_enabled(dev))
4838                 b43_wireless_core_reset(dev, phy->gmode);
4839
4840         /* Reset all data structures. */
4841         setup_struct_wldev_for_init(dev);
4842         phy->ops->prepare_structs(dev);
4843
4844         /* Enable IRQ routing to this device. */
4845         switch (dev->dev->bus_type) {
4846 #ifdef CONFIG_B43_BCMA
4847         case B43_BUS_BCMA:
4848                 bcma_host_pci_irq_ctl(dev->dev->bdev->bus,
4849                                       dev->dev->bdev, true);
4850                 bcma_host_pci_up(dev->dev->bdev->bus);
4851                 break;
4852 #endif
4853 #ifdef CONFIG_B43_SSB
4854         case B43_BUS_SSB:
4855                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4856                                                dev->dev->sdev);
4857                 break;
4858 #endif
4859         }
4860
4861         b43_imcfglo_timeouts_workaround(dev);
4862         b43_bluetooth_coext_disable(dev);
4863         if (phy->ops->prepare_hardware) {
4864                 err = phy->ops->prepare_hardware(dev);
4865                 if (err)
4866                         goto err_busdown;
4867         }
4868         err = b43_chip_init(dev);
4869         if (err)
4870                 goto err_busdown;
4871         b43_shm_write16(dev, B43_SHM_SHARED,
4872                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4873         hf = b43_hf_read(dev);
4874         if (phy->type == B43_PHYTYPE_G) {
4875                 hf |= B43_HF_SYMW;
4876                 if (phy->rev == 1)
4877                         hf |= B43_HF_GDCW;
4878                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4879                         hf |= B43_HF_OFDMPABOOST;
4880         }
4881         if (phy->radio_ver == 0x2050) {
4882                 if (phy->radio_rev == 6)
4883                         hf |= B43_HF_4318TSSI;
4884                 if (phy->radio_rev < 6)
4885                         hf |= B43_HF_VCORECALC;
4886         }
4887         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4888                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4889 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4890         if (dev->dev->bus_type == B43_BUS_SSB &&
4891             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4892             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4893                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4894 #endif
4895         hf &= ~B43_HF_SKCFPUP;
4896         b43_hf_write(dev, hf);
4897
4898         /* tell the ucode MAC capabilities */
4899         if (dev->dev->core_rev >= 13) {
4900                 u32 mac_hw_cap = b43_read32(dev, B43_MMIO_MAC_HW_CAP);
4901
4902                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_L,
4903                                 mac_hw_cap & 0xffff);
4904                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_H,
4905                                 (mac_hw_cap >> 16) & 0xffff);
4906         }
4907
4908         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4909                              B43_DEFAULT_LONG_RETRY_LIMIT);
4910         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4911         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4912
4913         /* Disable sending probe responses from firmware.
4914          * Setting the MaxTime to one usec will always trigger
4915          * a timeout, so we never send any probe resp.
4916          * A timeout of zero is infinite. */
4917         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4918
4919         b43_rate_memory_init(dev);
4920         b43_set_phytxctl_defaults(dev);
4921
4922         /* Minimum Contention Window */
4923         if (phy->type == B43_PHYTYPE_B)
4924                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4925         else
4926                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4927         /* Maximum Contention Window */
4928         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4929
4930         /* write phytype and phyvers */
4931         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYTYPE, phy->type);
4932         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYVER, phy->rev);
4933
4934         if (b43_bus_host_is_pcmcia(dev->dev) ||
4935             b43_bus_host_is_sdio(dev->dev)) {
4936                 dev->__using_pio_transfers = true;
4937                 err = b43_pio_init(dev);
4938         } else if (dev->use_pio) {
4939                 b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4940                         "This should not be needed and will result in lower "
4941                         "performance.\n");
4942                 dev->__using_pio_transfers = true;
4943                 err = b43_pio_init(dev);
4944         } else {
4945                 dev->__using_pio_transfers = false;
4946                 err = b43_dma_init(dev);
4947         }
4948         if (err)
4949                 goto err_chip_exit;
4950         b43_qos_init(dev);
4951         b43_set_synth_pu_delay(dev, 1);
4952         b43_bluetooth_coext_enable(dev);
4953
4954         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4955         b43_upload_card_macaddress(dev);
4956         b43_security_init(dev);
4957
4958         ieee80211_wake_queues(dev->wl->hw);
4959
4960         b43_set_status(dev, B43_STAT_INITIALIZED);
4961
4962 out:
4963         return err;
4964
4965 err_chip_exit:
4966         b43_chip_exit(dev);
4967 err_busdown:
4968         b43_bus_may_powerdown(dev);
4969         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4970         return err;
4971 }
4972
4973 static int b43_op_add_interface(struct ieee80211_hw *hw,
4974                                 struct ieee80211_vif *vif)
4975 {
4976         struct b43_wl *wl = hw_to_b43_wl(hw);
4977         struct b43_wldev *dev;
4978         int err = -EOPNOTSUPP;
4979
4980         /* TODO: allow WDS/AP devices to coexist */
4981
4982         if (vif->type != NL80211_IFTYPE_AP &&
4983             vif->type != NL80211_IFTYPE_MESH_POINT &&
4984             vif->type != NL80211_IFTYPE_STATION &&
4985             vif->type != NL80211_IFTYPE_WDS &&
4986             vif->type != NL80211_IFTYPE_ADHOC)
4987                 return -EOPNOTSUPP;
4988
4989         mutex_lock(&wl->mutex);
4990         if (wl->operating)
4991                 goto out_mutex_unlock;
4992
4993         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4994
4995         dev = wl->current_dev;
4996         wl->operating = true;
4997         wl->vif = vif;
4998         wl->if_type = vif->type;
4999         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
5000
5001         b43_adjust_opmode(dev);
5002         b43_set_pretbtt(dev);
5003         b43_set_synth_pu_delay(dev, 0);
5004         b43_upload_card_macaddress(dev);
5005
5006         err = 0;
5007  out_mutex_unlock:
5008         mutex_unlock(&wl->mutex);
5009
5010         if (err == 0)
5011                 b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
5012
5013         return err;
5014 }
5015
5016 static void b43_op_remove_interface(struct ieee80211_hw *hw,
5017                                     struct ieee80211_vif *vif)
5018 {
5019         struct b43_wl *wl = hw_to_b43_wl(hw);
5020         struct b43_wldev *dev = wl->current_dev;
5021
5022         b43dbg(wl, "Removing Interface type %d\n", vif->type);
5023
5024         mutex_lock(&wl->mutex);
5025
5026         B43_WARN_ON(!wl->operating);
5027         B43_WARN_ON(wl->vif != vif);
5028         wl->vif = NULL;
5029
5030         wl->operating = false;
5031
5032         b43_adjust_opmode(dev);
5033         eth_zero_addr(wl->mac_addr);
5034         b43_upload_card_macaddress(dev);
5035
5036         mutex_unlock(&wl->mutex);
5037 }
5038
5039 static int b43_op_start(struct ieee80211_hw *hw)
5040 {
5041         struct b43_wl *wl = hw_to_b43_wl(hw);
5042         struct b43_wldev *dev = wl->current_dev;
5043         int did_init = 0;
5044         int err = 0;
5045
5046         /* Kill all old instance specific information to make sure
5047          * the card won't use it in the short timeframe between start
5048          * and mac80211 reconfiguring it. */
5049         eth_zero_addr(wl->bssid);
5050         eth_zero_addr(wl->mac_addr);
5051         wl->filter_flags = 0;
5052         wl->radiotap_enabled = false;
5053         b43_qos_clear(wl);
5054         wl->beacon0_uploaded = false;
5055         wl->beacon1_uploaded = false;
5056         wl->beacon_templates_virgin = true;
5057         wl->radio_enabled = true;
5058
5059         mutex_lock(&wl->mutex);
5060
5061         if (b43_status(dev) < B43_STAT_INITIALIZED) {
5062                 err = b43_wireless_core_init(dev);
5063                 if (err)
5064                         goto out_mutex_unlock;
5065                 did_init = 1;
5066         }
5067
5068         if (b43_status(dev) < B43_STAT_STARTED) {
5069                 err = b43_wireless_core_start(dev);
5070                 if (err) {
5071                         if (did_init)
5072                                 b43_wireless_core_exit(dev);
5073                         goto out_mutex_unlock;
5074                 }
5075         }
5076
5077         /* XXX: only do if device doesn't support rfkill irq */
5078         wiphy_rfkill_start_polling(hw->wiphy);
5079
5080  out_mutex_unlock:
5081         mutex_unlock(&wl->mutex);
5082
5083         /*
5084          * Configuration may have been overwritten during initialization.
5085          * Reload the configuration, but only if initialization was
5086          * successful. Reloading the configuration after a failed init
5087          * may hang the system.
5088          */
5089         if (!err)
5090                 b43_op_config(hw, ~0);
5091
5092         return err;
5093 }
5094
5095 static void b43_op_stop(struct ieee80211_hw *hw)
5096 {
5097         struct b43_wl *wl = hw_to_b43_wl(hw);
5098         struct b43_wldev *dev = wl->current_dev;
5099
5100         cancel_work_sync(&(wl->beacon_update_trigger));
5101
5102         if (!dev)
5103                 goto out;
5104
5105         mutex_lock(&wl->mutex);
5106         if (b43_status(dev) >= B43_STAT_STARTED) {
5107                 dev = b43_wireless_core_stop(dev);
5108                 if (!dev)
5109                         goto out_unlock;
5110         }
5111         b43_wireless_core_exit(dev);
5112         wl->radio_enabled = false;
5113
5114 out_unlock:
5115         mutex_unlock(&wl->mutex);
5116 out:
5117         cancel_work_sync(&(wl->txpower_adjust_work));
5118 }
5119
5120 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5121                                  struct ieee80211_sta *sta, bool set)
5122 {
5123         struct b43_wl *wl = hw_to_b43_wl(hw);
5124
5125         b43_update_templates(wl);
5126
5127         return 0;
5128 }
5129
5130 static void b43_op_sta_notify(struct ieee80211_hw *hw,
5131                               struct ieee80211_vif *vif,
5132                               enum sta_notify_cmd notify_cmd,
5133                               struct ieee80211_sta *sta)
5134 {
5135         struct b43_wl *wl = hw_to_b43_wl(hw);
5136
5137         B43_WARN_ON(!vif || wl->vif != vif);
5138 }
5139
5140 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw,
5141                                           struct ieee80211_vif *vif,
5142                                           const u8 *mac_addr)
5143 {
5144         struct b43_wl *wl = hw_to_b43_wl(hw);
5145         struct b43_wldev *dev;
5146
5147         mutex_lock(&wl->mutex);
5148         dev = wl->current_dev;
5149         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5150                 /* Disable CFP update during scan on other channels. */
5151                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5152         }
5153         mutex_unlock(&wl->mutex);
5154 }
5155
5156 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw,
5157                                              struct ieee80211_vif *vif)
5158 {
5159         struct b43_wl *wl = hw_to_b43_wl(hw);
5160         struct b43_wldev *dev;
5161
5162         mutex_lock(&wl->mutex);
5163         dev = wl->current_dev;
5164         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5165                 /* Re-enable CFP update. */
5166                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5167         }
5168         mutex_unlock(&wl->mutex);
5169 }
5170
5171 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5172                              struct survey_info *survey)
5173 {
5174         struct b43_wl *wl = hw_to_b43_wl(hw);
5175         struct b43_wldev *dev = wl->current_dev;
5176         struct ieee80211_conf *conf = &hw->conf;
5177
5178         if (idx != 0)
5179                 return -ENOENT;
5180
5181         survey->channel = conf->chandef.chan;
5182         survey->filled = SURVEY_INFO_NOISE_DBM;
5183         survey->noise = dev->stats.link_noise;
5184
5185         return 0;
5186 }
5187
5188 static const struct ieee80211_ops b43_hw_ops = {
5189         .tx                     = b43_op_tx,
5190         .conf_tx                = b43_op_conf_tx,
5191         .add_interface          = b43_op_add_interface,
5192         .remove_interface       = b43_op_remove_interface,
5193         .config                 = b43_op_config,
5194         .bss_info_changed       = b43_op_bss_info_changed,
5195         .configure_filter       = b43_op_configure_filter,
5196         .set_key                = b43_op_set_key,
5197         .update_tkip_key        = b43_op_update_tkip_key,
5198         .get_stats              = b43_op_get_stats,
5199         .get_tsf                = b43_op_get_tsf,
5200         .set_tsf                = b43_op_set_tsf,
5201         .start                  = b43_op_start,
5202         .stop                   = b43_op_stop,
5203         .set_tim                = b43_op_beacon_set_tim,
5204         .sta_notify             = b43_op_sta_notify,
5205         .sw_scan_start          = b43_op_sw_scan_start_notifier,
5206         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
5207         .get_survey             = b43_op_get_survey,
5208         .rfkill_poll            = b43_rfkill_poll,
5209 };
5210
5211 /* Hard-reset the chip. Do not call this directly.
5212  * Use b43_controller_restart()
5213  */
5214 static void b43_chip_reset(struct work_struct *work)
5215 {
5216         struct b43_wldev *dev =
5217             container_of(work, struct b43_wldev, restart_work);
5218         struct b43_wl *wl = dev->wl;
5219         int err = 0;
5220         int prev_status;
5221
5222         mutex_lock(&wl->mutex);
5223
5224         prev_status = b43_status(dev);
5225         /* Bring the device down... */
5226         if (prev_status >= B43_STAT_STARTED) {
5227                 dev = b43_wireless_core_stop(dev);
5228                 if (!dev) {
5229                         err = -ENODEV;
5230                         goto out;
5231                 }
5232         }
5233         if (prev_status >= B43_STAT_INITIALIZED)
5234                 b43_wireless_core_exit(dev);
5235
5236         /* ...and up again. */
5237         if (prev_status >= B43_STAT_INITIALIZED) {
5238                 err = b43_wireless_core_init(dev);
5239                 if (err)
5240                         goto out;
5241         }
5242         if (prev_status >= B43_STAT_STARTED) {
5243                 err = b43_wireless_core_start(dev);
5244                 if (err) {
5245                         b43_wireless_core_exit(dev);
5246                         goto out;
5247                 }
5248         }
5249 out:
5250         if (err)
5251                 wl->current_dev = NULL; /* Failed to init the dev. */
5252         mutex_unlock(&wl->mutex);
5253
5254         if (err) {
5255                 b43err(wl, "Controller restart FAILED\n");
5256                 return;
5257         }
5258
5259         /* reload configuration */
5260         b43_op_config(wl->hw, ~0);
5261         if (wl->vif)
5262                 b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5263
5264         b43info(wl, "Controller restarted\n");
5265 }
5266
5267 static int b43_setup_bands(struct b43_wldev *dev,
5268                            bool have_2ghz_phy, bool have_5ghz_phy)
5269 {
5270         struct ieee80211_hw *hw = dev->wl->hw;
5271         struct b43_phy *phy = &dev->phy;
5272         bool limited_2g;
5273         bool limited_5g;
5274
5275         /* We don't support all 2 GHz channels on some devices */
5276         limited_2g = phy->radio_ver == 0x2057 &&
5277                      (phy->radio_rev == 9 || phy->radio_rev == 14);
5278         limited_5g = phy->radio_ver == 0x2057 &&
5279                      phy->radio_rev == 9;
5280
5281         if (have_2ghz_phy)
5282                 hw->wiphy->bands[NL80211_BAND_2GHZ] = limited_2g ?
5283                         &b43_band_2ghz_limited : &b43_band_2GHz;
5284         if (dev->phy.type == B43_PHYTYPE_N) {
5285                 if (have_5ghz_phy)
5286                         hw->wiphy->bands[NL80211_BAND_5GHZ] = limited_5g ?
5287                                 &b43_band_5GHz_nphy_limited :
5288                                 &b43_band_5GHz_nphy;
5289         } else {
5290                 if (have_5ghz_phy)
5291                         hw->wiphy->bands[NL80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5292         }
5293
5294         dev->phy.supports_2ghz = have_2ghz_phy;
5295         dev->phy.supports_5ghz = have_5ghz_phy;
5296
5297         return 0;
5298 }
5299
5300 static void b43_wireless_core_detach(struct b43_wldev *dev)
5301 {
5302         /* We release firmware that late to not be required to re-request
5303          * is all the time when we reinit the core. */
5304         b43_release_firmware(dev);
5305         b43_phy_free(dev);
5306 }
5307
5308 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5309                                 bool *have_5ghz_phy)
5310 {
5311         u16 dev_id = 0;
5312
5313 #ifdef CONFIG_B43_BCMA
5314         if (dev->dev->bus_type == B43_BUS_BCMA &&
5315             dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5316                 dev_id = dev->dev->bdev->bus->host_pci->device;
5317 #endif
5318 #ifdef CONFIG_B43_SSB
5319         if (dev->dev->bus_type == B43_BUS_SSB &&
5320             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5321                 dev_id = dev->dev->sdev->bus->host_pci->device;
5322 #endif
5323         /* Override with SPROM value if available */
5324         if (dev->dev->bus_sprom->dev_id)
5325                 dev_id = dev->dev->bus_sprom->dev_id;
5326
5327         /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5328         switch (dev_id) {
5329         case 0x4324: /* BCM4306 */
5330         case 0x4312: /* BCM4311 */
5331         case 0x4319: /* BCM4318 */
5332         case 0x4328: /* BCM4321 */
5333         case 0x432b: /* BCM4322 */
5334         case 0x4350: /* BCM43222 */
5335         case 0x4353: /* BCM43224 */
5336         case 0x0576: /* BCM43224 */
5337         case 0x435f: /* BCM6362 */
5338         case 0x4331: /* BCM4331 */
5339         case 0x4359: /* BCM43228 */
5340         case 0x43a0: /* BCM4360 */
5341         case 0x43b1: /* BCM4352 */
5342                 /* Dual band devices */
5343                 *have_2ghz_phy = true;
5344                 *have_5ghz_phy = true;
5345                 return;
5346         case 0x4321: /* BCM4306 */
5347                 /* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
5348                 if (dev->phy.type != B43_PHYTYPE_G)
5349                         break;
5350                 /* fall through */
5351         case 0x4313: /* BCM4311 */
5352         case 0x431a: /* BCM4318 */
5353         case 0x432a: /* BCM4321 */
5354         case 0x432d: /* BCM4322 */
5355         case 0x4352: /* BCM43222 */
5356         case 0x435a: /* BCM43228 */
5357         case 0x4333: /* BCM4331 */
5358         case 0x43a2: /* BCM4360 */
5359         case 0x43b3: /* BCM4352 */
5360                 /* 5 GHz only devices */
5361                 *have_2ghz_phy = false;
5362                 *have_5ghz_phy = true;
5363                 return;
5364         }
5365
5366         /* As a fallback, try to guess using PHY type */
5367         switch (dev->phy.type) {
5368         case B43_PHYTYPE_G:
5369         case B43_PHYTYPE_N:
5370         case B43_PHYTYPE_LP:
5371         case B43_PHYTYPE_HT:
5372         case B43_PHYTYPE_LCN:
5373                 *have_2ghz_phy = true;
5374                 *have_5ghz_phy = false;
5375                 return;
5376         }
5377
5378         B43_WARN_ON(1);
5379 }
5380
5381 static int b43_wireless_core_attach(struct b43_wldev *dev)
5382 {
5383         struct b43_wl *wl = dev->wl;
5384         struct b43_phy *phy = &dev->phy;
5385         int err;
5386         u32 tmp;
5387         bool have_2ghz_phy = false, have_5ghz_phy = false;
5388
5389         /* Do NOT do any device initialization here.
5390          * Do it in wireless_core_init() instead.
5391          * This function is for gathering basic information about the HW, only.
5392          * Also some structs may be set up here. But most likely you want to have
5393          * that in core_init(), too.
5394          */
5395
5396         err = b43_bus_powerup(dev, 0);
5397         if (err) {
5398                 b43err(wl, "Bus powerup failed\n");
5399                 goto out;
5400         }
5401
5402         phy->do_full_init = true;
5403
5404         /* Try to guess supported bands for the first init needs */
5405         switch (dev->dev->bus_type) {
5406 #ifdef CONFIG_B43_BCMA
5407         case B43_BUS_BCMA:
5408                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5409                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5410                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5411                 break;
5412 #endif
5413 #ifdef CONFIG_B43_SSB
5414         case B43_BUS_SSB:
5415                 if (dev->dev->core_rev >= 5) {
5416                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5417                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5418                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5419                 } else
5420                         B43_WARN_ON(1);
5421                 break;
5422 #endif
5423         }
5424
5425         dev->phy.gmode = have_2ghz_phy;
5426         b43_wireless_core_reset(dev, dev->phy.gmode);
5427
5428         /* Get the PHY type. */
5429         err = b43_phy_versioning(dev);
5430         if (err)
5431                 goto err_powerdown;
5432
5433         /* Get real info about supported bands */
5434         b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5435
5436         /* We don't support 5 GHz on some PHYs yet */
5437         if (have_5ghz_phy) {
5438                 switch (dev->phy.type) {
5439                 case B43_PHYTYPE_G:
5440                 case B43_PHYTYPE_LP:
5441                 case B43_PHYTYPE_HT:
5442                         b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5443                         have_5ghz_phy = false;
5444                 }
5445         }
5446
5447         if (!have_2ghz_phy && !have_5ghz_phy) {
5448                 b43err(wl, "b43 can't support any band on this device\n");
5449                 err = -EOPNOTSUPP;
5450                 goto err_powerdown;
5451         }
5452
5453         err = b43_phy_allocate(dev);
5454         if (err)
5455                 goto err_powerdown;
5456
5457         dev->phy.gmode = have_2ghz_phy;
5458         b43_wireless_core_reset(dev, dev->phy.gmode);
5459
5460         err = b43_validate_chipaccess(dev);
5461         if (err)
5462                 goto err_phy_free;
5463         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5464         if (err)
5465                 goto err_phy_free;
5466
5467         /* Now set some default "current_dev" */
5468         if (!wl->current_dev)
5469                 wl->current_dev = dev;
5470         INIT_WORK(&dev->restart_work, b43_chip_reset);
5471
5472         dev->phy.ops->switch_analog(dev, 0);
5473         b43_device_disable(dev, 0);
5474         b43_bus_may_powerdown(dev);
5475
5476 out:
5477         return err;
5478
5479 err_phy_free:
5480         b43_phy_free(dev);
5481 err_powerdown:
5482         b43_bus_may_powerdown(dev);
5483         return err;
5484 }
5485
5486 static void b43_one_core_detach(struct b43_bus_dev *dev)
5487 {
5488         struct b43_wldev *wldev;
5489
5490         /* Do not cancel ieee80211-workqueue based work here.
5491          * See comment in b43_remove(). */
5492
5493         wldev = b43_bus_get_wldev(dev);
5494         b43_debugfs_remove_device(wldev);
5495         b43_wireless_core_detach(wldev);
5496         list_del(&wldev->list);
5497         b43_bus_set_wldev(dev, NULL);
5498         kfree(wldev);
5499 }
5500
5501 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5502 {
5503         struct b43_wldev *wldev;
5504         int err = -ENOMEM;
5505
5506         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5507         if (!wldev)
5508                 goto out;
5509
5510         wldev->use_pio = b43_modparam_pio;
5511         wldev->dev = dev;
5512         wldev->wl = wl;
5513         b43_set_status(wldev, B43_STAT_UNINIT);
5514         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5515         INIT_LIST_HEAD(&wldev->list);
5516
5517         err = b43_wireless_core_attach(wldev);
5518         if (err)
5519                 goto err_kfree_wldev;
5520
5521         b43_bus_set_wldev(dev, wldev);
5522         b43_debugfs_add_device(wldev);
5523
5524       out:
5525         return err;
5526
5527       err_kfree_wldev:
5528         kfree(wldev);
5529         return err;
5530 }
5531
5532 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5533         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5534         (pdev->device == _device) &&                                    \
5535         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5536         (pdev->subsystem_device == _subdevice)                          )
5537
5538 #ifdef CONFIG_B43_SSB
5539 static void b43_sprom_fixup(struct ssb_bus *bus)
5540 {
5541         struct pci_dev *pdev;
5542
5543         /* boardflags workarounds */
5544         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5545             bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5546                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5547         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5548             bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5549                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5550         if (bus->bustype == SSB_BUSTYPE_PCI) {
5551                 pdev = bus->host_pci;
5552                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5553                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5554                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5555                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5556                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5557                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5558                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5559                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5560         }
5561 }
5562
5563 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5564 {
5565         struct ieee80211_hw *hw = wl->hw;
5566
5567         ssb_set_devtypedata(dev->sdev, NULL);
5568         ieee80211_free_hw(hw);
5569 }
5570 #endif
5571
5572 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5573 {
5574         struct ssb_sprom *sprom = dev->bus_sprom;
5575         struct ieee80211_hw *hw;
5576         struct b43_wl *wl;
5577         char chip_name[6];
5578         int queue_num;
5579
5580         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5581         if (!hw) {
5582                 b43err(NULL, "Could not allocate ieee80211 device\n");
5583                 return ERR_PTR(-ENOMEM);
5584         }
5585         wl = hw_to_b43_wl(hw);
5586
5587         /* fill hw info */
5588         ieee80211_hw_set(hw, RX_INCLUDES_FCS);
5589         ieee80211_hw_set(hw, SIGNAL_DBM);
5590
5591         hw->wiphy->interface_modes =
5592                 BIT(NL80211_IFTYPE_AP) |
5593                 BIT(NL80211_IFTYPE_MESH_POINT) |
5594                 BIT(NL80211_IFTYPE_STATION) |
5595 #ifdef CONFIG_WIRELESS_WDS
5596                 BIT(NL80211_IFTYPE_WDS) |
5597 #endif
5598                 BIT(NL80211_IFTYPE_ADHOC);
5599
5600         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5601
5602         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5603
5604         wl->hw_registered = false;
5605         hw->max_rates = 2;
5606         SET_IEEE80211_DEV(hw, dev->dev);
5607         if (is_valid_ether_addr(sprom->et1mac))
5608                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5609         else
5610                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5611
5612         /* Initialize struct b43_wl */
5613         wl->hw = hw;
5614         mutex_init(&wl->mutex);
5615         spin_lock_init(&wl->hardirq_lock);
5616         spin_lock_init(&wl->beacon_lock);
5617         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5618         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5619         INIT_WORK(&wl->tx_work, b43_tx_work);
5620
5621         /* Initialize queues and flags. */
5622         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5623                 skb_queue_head_init(&wl->tx_queue[queue_num]);
5624                 wl->tx_queue_stopped[queue_num] = 0;
5625         }
5626
5627         snprintf(chip_name, ARRAY_SIZE(chip_name),
5628                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5629         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5630                 dev->core_rev);
5631         return wl;
5632 }
5633
5634 #ifdef CONFIG_B43_BCMA
5635 static int b43_bcma_probe(struct bcma_device *core)
5636 {
5637         struct b43_bus_dev *dev;
5638         struct b43_wl *wl;
5639         int err;
5640
5641         if (!modparam_allhwsupport &&
5642             (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5643                 pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5644                 return -ENOTSUPP;
5645         }
5646
5647         dev = b43_bus_dev_bcma_init(core);
5648         if (!dev)
5649                 return -ENODEV;
5650
5651         wl = b43_wireless_init(dev);
5652         if (IS_ERR(wl)) {
5653                 err = PTR_ERR(wl);
5654                 goto bcma_out;
5655         }
5656
5657         err = b43_one_core_attach(dev, wl);
5658         if (err)
5659                 goto bcma_err_wireless_exit;
5660
5661         /* setup and start work to load firmware */
5662         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5663         schedule_work(&wl->firmware_load);
5664
5665         return err;
5666
5667 bcma_err_wireless_exit:
5668         ieee80211_free_hw(wl->hw);
5669 bcma_out:
5670         kfree(dev);
5671         return err;
5672 }
5673
5674 static void b43_bcma_remove(struct bcma_device *core)
5675 {
5676         struct b43_wldev *wldev = bcma_get_drvdata(core);
5677         struct b43_wl *wl = wldev->wl;
5678
5679         /* We must cancel any work here before unregistering from ieee80211,
5680          * as the ieee80211 unreg will destroy the workqueue. */
5681         cancel_work_sync(&wldev->restart_work);
5682         cancel_work_sync(&wl->firmware_load);
5683
5684         B43_WARN_ON(!wl);
5685         if (!wldev->fw.ucode.data)
5686                 return;                 /* NULL if firmware never loaded */
5687         if (wl->current_dev == wldev && wl->hw_registered) {
5688                 b43_leds_stop(wldev);
5689                 ieee80211_unregister_hw(wl->hw);
5690         }
5691
5692         b43_one_core_detach(wldev->dev);
5693
5694         /* Unregister HW RNG driver */
5695         b43_rng_exit(wl);
5696
5697         b43_leds_unregister(wl);
5698         ieee80211_free_hw(wl->hw);
5699         kfree(wldev->dev);
5700 }
5701
5702 static struct bcma_driver b43_bcma_driver = {
5703         .name           = KBUILD_MODNAME,
5704         .id_table       = b43_bcma_tbl,
5705         .probe          = b43_bcma_probe,
5706         .remove         = b43_bcma_remove,
5707 };
5708 #endif
5709
5710 #ifdef CONFIG_B43_SSB
5711 static
5712 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5713 {
5714         struct b43_bus_dev *dev;
5715         struct b43_wl *wl;
5716         int err;
5717
5718         dev = b43_bus_dev_ssb_init(sdev);
5719         if (!dev)
5720                 return -ENOMEM;
5721
5722         wl = ssb_get_devtypedata(sdev);
5723         if (wl) {
5724                 b43err(NULL, "Dual-core devices are not supported\n");
5725                 err = -ENOTSUPP;
5726                 goto err_ssb_kfree_dev;
5727         }
5728
5729         b43_sprom_fixup(sdev->bus);
5730
5731         wl = b43_wireless_init(dev);
5732         if (IS_ERR(wl)) {
5733                 err = PTR_ERR(wl);
5734                 goto err_ssb_kfree_dev;
5735         }
5736         ssb_set_devtypedata(sdev, wl);
5737         B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5738
5739         err = b43_one_core_attach(dev, wl);
5740         if (err)
5741                 goto err_ssb_wireless_exit;
5742
5743         /* setup and start work to load firmware */
5744         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5745         schedule_work(&wl->firmware_load);
5746
5747         return err;
5748
5749 err_ssb_wireless_exit:
5750         b43_wireless_exit(dev, wl);
5751 err_ssb_kfree_dev:
5752         kfree(dev);
5753         return err;
5754 }
5755
5756 static void b43_ssb_remove(struct ssb_device *sdev)
5757 {
5758         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5759         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5760         struct b43_bus_dev *dev = wldev->dev;
5761
5762         /* We must cancel any work here before unregistering from ieee80211,
5763          * as the ieee80211 unreg will destroy the workqueue. */
5764         cancel_work_sync(&wldev->restart_work);
5765         cancel_work_sync(&wl->firmware_load);
5766
5767         B43_WARN_ON(!wl);
5768         if (!wldev->fw.ucode.data)
5769                 return;                 /* NULL if firmware never loaded */
5770         if (wl->current_dev == wldev && wl->hw_registered) {
5771                 b43_leds_stop(wldev);
5772                 ieee80211_unregister_hw(wl->hw);
5773         }
5774
5775         b43_one_core_detach(dev);
5776
5777         /* Unregister HW RNG driver */
5778         b43_rng_exit(wl);
5779
5780         b43_leds_unregister(wl);
5781         b43_wireless_exit(dev, wl);
5782         kfree(dev);
5783 }
5784
5785 static struct ssb_driver b43_ssb_driver = {
5786         .name           = KBUILD_MODNAME,
5787         .id_table       = b43_ssb_tbl,
5788         .probe          = b43_ssb_probe,
5789         .remove         = b43_ssb_remove,
5790 };
5791 #endif /* CONFIG_B43_SSB */
5792
5793 /* Perform a hardware reset. This can be called from any context. */
5794 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5795 {
5796         /* Must avoid requeueing, if we are in shutdown. */
5797         if (b43_status(dev) < B43_STAT_INITIALIZED)
5798                 return;
5799         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5800         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5801 }
5802
5803 static void b43_print_driverinfo(void)
5804 {
5805         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5806                    *feat_leds = "", *feat_sdio = "";
5807
5808 #ifdef CONFIG_B43_PCI_AUTOSELECT
5809         feat_pci = "P";
5810 #endif
5811 #ifdef CONFIG_B43_PCMCIA
5812         feat_pcmcia = "M";
5813 #endif
5814 #ifdef CONFIG_B43_PHY_N
5815         feat_nphy = "N";
5816 #endif
5817 #ifdef CONFIG_B43_LEDS
5818         feat_leds = "L";
5819 #endif
5820 #ifdef CONFIG_B43_SDIO
5821         feat_sdio = "S";
5822 #endif
5823         printk(KERN_INFO "Broadcom 43xx driver loaded "
5824                "[ Features: %s%s%s%s%s ]\n",
5825                feat_pci, feat_pcmcia, feat_nphy,
5826                feat_leds, feat_sdio);
5827 }
5828
5829 static int __init b43_init(void)
5830 {
5831         int err;
5832
5833         b43_debugfs_init();
5834         err = b43_sdio_init();
5835         if (err)
5836                 goto err_dfs_exit;
5837 #ifdef CONFIG_B43_BCMA
5838         err = bcma_driver_register(&b43_bcma_driver);
5839         if (err)
5840                 goto err_sdio_exit;
5841 #endif
5842 #ifdef CONFIG_B43_SSB
5843         err = ssb_driver_register(&b43_ssb_driver);
5844         if (err)
5845                 goto err_bcma_driver_exit;
5846 #endif
5847         b43_print_driverinfo();
5848
5849         return err;
5850
5851 #ifdef CONFIG_B43_SSB
5852 err_bcma_driver_exit:
5853 #endif
5854 #ifdef CONFIG_B43_BCMA
5855         bcma_driver_unregister(&b43_bcma_driver);
5856 err_sdio_exit:
5857 #endif
5858         b43_sdio_exit();
5859 err_dfs_exit:
5860         b43_debugfs_exit();
5861         return err;
5862 }
5863
5864 static void __exit b43_exit(void)
5865 {
5866 #ifdef CONFIG_B43_SSB
5867         ssb_driver_unregister(&b43_ssb_driver);
5868 #endif
5869 #ifdef CONFIG_B43_BCMA
5870         bcma_driver_unregister(&b43_bcma_driver);
5871 #endif
5872         b43_sdio_exit();
5873         b43_debugfs_exit();
5874 }
5875
5876 module_init(b43_init)
5877 module_exit(b43_exit)