drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
  11
  12   SDIO support
  13   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  14
  15   Some parts of the code in this file are derived from the ipw2200
  16   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  17
  18   This program is free software; you can redistribute it and/or modify
  19   it under the terms of the GNU General Public License as published by
  20   the Free Software Foundation; either version 2 of the License, or
  21   (at your option) any later version.
  22
  23   This program is distributed in the hope that it will be useful,
  24   but WITHOUT ANY WARRANTY; without even the implied warranty of
  25   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26   GNU General Public License for more details.
  27
  28   You should have received a copy of the GNU General Public License
  29   along with this program; see the file COPYING.  If not, write to
  30   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  31   Boston, MA 02110-1301, USA.
  32
  33 */
  34
  35 #include <linux/delay.h>
  36 #include <linux/init.h>
  37 #include <linux/module.h>
  38 #include <linux/if_arp.h>
  39 #include <linux/etherdevice.h>
  40 #include <linux/firmware.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_AUTHOR("Rafał Miłecki");
  69 MODULE_LICENSE("GPL");
  70
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = 0;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
 117 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
 118 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
 119
 120 #ifdef CONFIG_B43_BCMA
 121 static const struct bcma_device_id b43_bcma_tbl[] = {
 122         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 123         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 124         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 125         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 126         BCMA_CORETABLE_END
 127 };
 128 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 129 #endif
 130
 131 #ifdef CONFIG_B43_SSB
 132 static const struct ssb_device_id b43_ssb_tbl[] = {
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 138         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 139         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 140         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 141         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 142         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 143         SSB_DEVTABLE_END
 144 };
 145 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 146 #endif
 147
 148 /* Channel and ratetables are shared for all devices.
 149  * They can't be const, because ieee80211 puts some precalculated
 150  * data in there. This data is the same for all devices, so we don't
 151  * get concurrency issues */
 152 #define RATETAB_ENT(_rateid, _flags) \
 153         {                                                               \
 154                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 155                 .hw_value       = (_rateid),                            \
 156                 .flags          = (_flags),                             \
 157         }
 158
 159 /*
 160  * NOTE: When changing this, sync with xmit.c's
 161  *       b43_plcp_get_bitrate_idx_* functions!
 162  */
 163 static struct ieee80211_rate __b43_ratetable[] = {
 164         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 165         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 166         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 167         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 168         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 171         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 172         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 173         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 174         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 175         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 176 };
 177
 178 #define b43_a_ratetable         (__b43_ratetable + 4)
 179 #define b43_a_ratetable_size    8
 180 #define b43_b_ratetable         (__b43_ratetable + 0)
 181 #define b43_b_ratetable_size    4
 182 #define b43_g_ratetable         (__b43_ratetable + 0)
 183 #define b43_g_ratetable_size    12
 184
 185 #define CHAN4G(_channel, _freq, _flags) {                       \
 186         .band                   = IEEE80211_BAND_2GHZ,          \
 187         .center_freq            = (_freq),                      \
 188         .hw_value               = (_channel),                   \
 189         .flags                  = (_flags),                     \
 190         .max_antenna_gain       = 0,                            \
 191         .max_power              = 30,                           \
 192 }
 193 static struct ieee80211_channel b43_2ghz_chantable[] = {
 194         CHAN4G(1, 2412, 0),
 195         CHAN4G(2, 2417, 0),
 196         CHAN4G(3, 2422, 0),
 197         CHAN4G(4, 2427, 0),
 198         CHAN4G(5, 2432, 0),
 199         CHAN4G(6, 2437, 0),
 200         CHAN4G(7, 2442, 0),
 201         CHAN4G(8, 2447, 0),
 202         CHAN4G(9, 2452, 0),
 203         CHAN4G(10, 2457, 0),
 204         CHAN4G(11, 2462, 0),
 205         CHAN4G(12, 2467, 0),
 206         CHAN4G(13, 2472, 0),
 207         CHAN4G(14, 2484, 0),
 208 };
 209 #undef CHAN4G
 210
 211 #define CHAN5G(_channel, _flags) {                              \
 212         .band                   = IEEE80211_BAND_5GHZ,          \
 213         .center_freq            = 5000 + (5 * (_channel)),      \
 214         .hw_value               = (_channel),                   \
 215         .flags                  = (_flags),                     \
 216         .max_antenna_gain       = 0,                            \
 217         .max_power              = 30,                           \
 218 }
 219 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 220         CHAN5G(32, 0),          CHAN5G(34, 0),
 221         CHAN5G(36, 0),          CHAN5G(38, 0),
 222         CHAN5G(40, 0),          CHAN5G(42, 0),
 223         CHAN5G(44, 0),          CHAN5G(46, 0),
 224         CHAN5G(48, 0),          CHAN5G(50, 0),
 225         CHAN5G(52, 0),          CHAN5G(54, 0),
 226         CHAN5G(56, 0),          CHAN5G(58, 0),
 227         CHAN5G(60, 0),          CHAN5G(62, 0),
 228         CHAN5G(64, 0),          CHAN5G(66, 0),
 229         CHAN5G(68, 0),          CHAN5G(70, 0),
 230         CHAN5G(72, 0),          CHAN5G(74, 0),
 231         CHAN5G(76, 0),          CHAN5G(78, 0),
 232         CHAN5G(80, 0),          CHAN5G(82, 0),
 233         CHAN5G(84, 0),          CHAN5G(86, 0),
 234         CHAN5G(88, 0),          CHAN5G(90, 0),
 235         CHAN5G(92, 0),          CHAN5G(94, 0),
 236         CHAN5G(96, 0),          CHAN5G(98, 0),
 237         CHAN5G(100, 0),         CHAN5G(102, 0),
 238         CHAN5G(104, 0),         CHAN5G(106, 0),
 239         CHAN5G(108, 0),         CHAN5G(110, 0),
 240         CHAN5G(112, 0),         CHAN5G(114, 0),
 241         CHAN5G(116, 0),         CHAN5G(118, 0),
 242         CHAN5G(120, 0),         CHAN5G(122, 0),
 243         CHAN5G(124, 0),         CHAN5G(126, 0),
 244         CHAN5G(128, 0),         CHAN5G(130, 0),
 245         CHAN5G(132, 0),         CHAN5G(134, 0),
 246         CHAN5G(136, 0),         CHAN5G(138, 0),
 247         CHAN5G(140, 0),         CHAN5G(142, 0),
 248         CHAN5G(144, 0),         CHAN5G(145, 0),
 249         CHAN5G(146, 0),         CHAN5G(147, 0),
 250         CHAN5G(148, 0),         CHAN5G(149, 0),
 251         CHAN5G(150, 0),         CHAN5G(151, 0),
 252         CHAN5G(152, 0),         CHAN5G(153, 0),
 253         CHAN5G(154, 0),         CHAN5G(155, 0),
 254         CHAN5G(156, 0),         CHAN5G(157, 0),
 255         CHAN5G(158, 0),         CHAN5G(159, 0),
 256         CHAN5G(160, 0),         CHAN5G(161, 0),
 257         CHAN5G(162, 0),         CHAN5G(163, 0),
 258         CHAN5G(164, 0),         CHAN5G(165, 0),
 259         CHAN5G(166, 0),         CHAN5G(168, 0),
 260         CHAN5G(170, 0),         CHAN5G(172, 0),
 261         CHAN5G(174, 0),         CHAN5G(176, 0),
 262         CHAN5G(178, 0),         CHAN5G(180, 0),
 263         CHAN5G(182, 0),         CHAN5G(184, 0),
 264         CHAN5G(186, 0),         CHAN5G(188, 0),
 265         CHAN5G(190, 0),         CHAN5G(192, 0),
 266         CHAN5G(194, 0),         CHAN5G(196, 0),
 267         CHAN5G(198, 0),         CHAN5G(200, 0),
 268         CHAN5G(202, 0),         CHAN5G(204, 0),
 269         CHAN5G(206, 0),         CHAN5G(208, 0),
 270         CHAN5G(210, 0),         CHAN5G(212, 0),
 271         CHAN5G(214, 0),         CHAN5G(216, 0),
 272         CHAN5G(218, 0),         CHAN5G(220, 0),
 273         CHAN5G(222, 0),         CHAN5G(224, 0),
 274         CHAN5G(226, 0),         CHAN5G(228, 0),
 275 };
 276
 277 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 278         CHAN5G(34, 0),          CHAN5G(36, 0),
 279         CHAN5G(38, 0),          CHAN5G(40, 0),
 280         CHAN5G(42, 0),          CHAN5G(44, 0),
 281         CHAN5G(46, 0),          CHAN5G(48, 0),
 282         CHAN5G(52, 0),          CHAN5G(56, 0),
 283         CHAN5G(60, 0),          CHAN5G(64, 0),
 284         CHAN5G(100, 0),         CHAN5G(104, 0),
 285         CHAN5G(108, 0),         CHAN5G(112, 0),
 286         CHAN5G(116, 0),         CHAN5G(120, 0),
 287         CHAN5G(124, 0),         CHAN5G(128, 0),
 288         CHAN5G(132, 0),         CHAN5G(136, 0),
 289         CHAN5G(140, 0),         CHAN5G(149, 0),
 290         CHAN5G(153, 0),         CHAN5G(157, 0),
 291         CHAN5G(161, 0),         CHAN5G(165, 0),
 292         CHAN5G(184, 0),         CHAN5G(188, 0),
 293         CHAN5G(192, 0),         CHAN5G(196, 0),
 294         CHAN5G(200, 0),         CHAN5G(204, 0),
 295         CHAN5G(208, 0),         CHAN5G(212, 0),
 296         CHAN5G(216, 0),
 297 };
 298 #undef CHAN5G
 299
 300 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 301         .band           = IEEE80211_BAND_5GHZ,
 302         .channels       = b43_5ghz_nphy_chantable,
 303         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 304         .bitrates       = b43_a_ratetable,
 305         .n_bitrates     = b43_a_ratetable_size,
 306 };
 307
 308 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 309         .band           = IEEE80211_BAND_5GHZ,
 310         .channels       = b43_5ghz_aphy_chantable,
 311         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 312         .bitrates       = b43_a_ratetable,
 313         .n_bitrates     = b43_a_ratetable_size,
 314 };
 315
 316 static struct ieee80211_supported_band b43_band_2GHz = {
 317         .band           = IEEE80211_BAND_2GHZ,
 318         .channels       = b43_2ghz_chantable,
 319         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 320         .bitrates       = b43_g_ratetable,
 321         .n_bitrates     = b43_g_ratetable_size,
 322 };
 323
 324 static void b43_wireless_core_exit(struct b43_wldev *dev);
 325 static int b43_wireless_core_init(struct b43_wldev *dev);
 326 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 327 static int b43_wireless_core_start(struct b43_wldev *dev);
 328 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 329                                     struct ieee80211_vif *vif,
 330                                     struct ieee80211_bss_conf *conf,
 331                                     u32 changed);
 332
 333 static int b43_ratelimit(struct b43_wl *wl)
 334 {
 335         if (!wl || !wl->current_dev)
 336                 return 1;
 337         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 338                 return 1;
 339         /* We are up and running.
 340          * Ratelimit the messages to avoid DoS over the net. */
 341         return net_ratelimit();
 342 }
 343
 344 void b43info(struct b43_wl *wl, const char *fmt, ...)
 345 {
 346         struct va_format vaf;
 347         va_list args;
 348
 349         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 350                 return;
 351         if (!b43_ratelimit(wl))
 352                 return;
 353
 354         va_start(args, fmt);
 355
 356         vaf.fmt = fmt;
 357         vaf.va = &args;
 358
 359         printk(KERN_INFO "b43-%s: %pV",
 360                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 361
 362         va_end(args);
 363 }
 364
 365 void b43err(struct b43_wl *wl, const char *fmt, ...)
 366 {
 367         struct va_format vaf;
 368         va_list args;
 369
 370         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 371                 return;
 372         if (!b43_ratelimit(wl))
 373                 return;
 374
 375         va_start(args, fmt);
 376
 377         vaf.fmt = fmt;
 378         vaf.va = &args;
 379
 380         printk(KERN_ERR "b43-%s ERROR: %pV",
 381                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 382
 383         va_end(args);
 384 }
 385
 386 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 387 {
 388         struct va_format vaf;
 389         va_list args;
 390
 391         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 392                 return;
 393         if (!b43_ratelimit(wl))
 394                 return;
 395
 396         va_start(args, fmt);
 397
 398         vaf.fmt = fmt;
 399         vaf.va = &args;
 400
 401         printk(KERN_WARNING "b43-%s warning: %pV",
 402                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 403
 404         va_end(args);
 405 }
 406
 407 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 408 {
 409         struct va_format vaf;
 410         va_list args;
 411
 412         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 413                 return;
 414
 415         va_start(args, fmt);
 416
 417         vaf.fmt = fmt;
 418         vaf.va = &args;
 419
 420         printk(KERN_DEBUG "b43-%s debug: %pV",
 421                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 422
 423         va_end(args);
 424 }
 425
 426 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 427 {
 428         u32 macctl;
 429
 430         B43_WARN_ON(offset % 4 != 0);
 431
 432         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 433         if (macctl & B43_MACCTL_BE)
 434                 val = swab32(val);
 435
 436         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 437         mmiowb();
 438         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 439 }
 440
 441 static inline void b43_shm_control_word(struct b43_wldev *dev,
 442                                         u16 routing, u16 offset)
 443 {
 444         u32 control;
 445
 446         /* "offset" is the WORD offset. */
 447         control = routing;
 448         control <<= 16;
 449         control |= offset;
 450         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 451 }
 452
 453 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 454 {
 455         u32 ret;
 456
 457         if (routing == B43_SHM_SHARED) {
 458                 B43_WARN_ON(offset & 0x0001);
 459                 if (offset & 0x0003) {
 460                         /* Unaligned access */
 461                         b43_shm_control_word(dev, routing, offset >> 2);
 462                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 463                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 464                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 465
 466                         goto out;
 467                 }
 468                 offset >>= 2;
 469         }
 470         b43_shm_control_word(dev, routing, offset);
 471         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 472 out:
 473         return ret;
 474 }
 475
 476 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 477 {
 478         u16 ret;
 479
 480         if (routing == B43_SHM_SHARED) {
 481                 B43_WARN_ON(offset & 0x0001);
 482                 if (offset & 0x0003) {
 483                         /* Unaligned access */
 484                         b43_shm_control_word(dev, routing, offset >> 2);
 485                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 486
 487                         goto out;
 488                 }
 489                 offset >>= 2;
 490         }
 491         b43_shm_control_word(dev, routing, offset);
 492         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 493 out:
 494         return ret;
 495 }
 496
 497 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 498 {
 499         if (routing == B43_SHM_SHARED) {
 500                 B43_WARN_ON(offset & 0x0001);
 501                 if (offset & 0x0003) {
 502                         /* Unaligned access */
 503                         b43_shm_control_word(dev, routing, offset >> 2);
 504                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 505                                     value & 0xFFFF);
 506                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 507                         b43_write16(dev, B43_MMIO_SHM_DATA,
 508                                     (value >> 16) & 0xFFFF);
 509                         return;
 510                 }
 511                 offset >>= 2;
 512         }
 513         b43_shm_control_word(dev, routing, offset);
 514         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 515 }
 516
 517 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 518 {
 519         if (routing == B43_SHM_SHARED) {
 520                 B43_WARN_ON(offset & 0x0001);
 521                 if (offset & 0x0003) {
 522                         /* Unaligned access */
 523                         b43_shm_control_word(dev, routing, offset >> 2);
 524                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 525                         return;
 526                 }
 527                 offset >>= 2;
 528         }
 529         b43_shm_control_word(dev, routing, offset);
 530         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 531 }
 532
 533 /* Read HostFlags */
 534 u64 b43_hf_read(struct b43_wldev *dev)
 535 {
 536         u64 ret;
 537
 538         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
 539         ret <<= 16;
 540         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
 541         ret <<= 16;
 542         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
 543
 544         return ret;
 545 }
 546
 547 /* Write HostFlags */
 548 void b43_hf_write(struct b43_wldev *dev, u64 value)
 549 {
 550         u16 lo, mi, hi;
 551
 552         lo = (value & 0x00000000FFFFULL);
 553         mi = (value & 0x0000FFFF0000ULL) >> 16;
 554         hi = (value & 0xFFFF00000000ULL) >> 32;
 555         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
 556         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
 557         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
 558 }
 559
 560 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 561 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 562 {
 563         B43_WARN_ON(!dev->fw.opensource);
 564         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 565 }
 566
 567 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 568 {
 569         u32 low, high;
 570
 571         B43_WARN_ON(dev->dev->core_rev < 3);
 572
 573         /* The hardware guarantees us an atomic read, if we
 574          * read the low register first. */
 575         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 576         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 577
 578         *tsf = high;
 579         *tsf <<= 32;
 580         *tsf |= low;
 581 }
 582
 583 static void b43_time_lock(struct b43_wldev *dev)
 584 {
 585         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
 586         /* Commit the write */
 587         b43_read32(dev, B43_MMIO_MACCTL);
 588 }
 589
 590 static void b43_time_unlock(struct b43_wldev *dev)
 591 {
 592         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
 593         /* Commit the write */
 594         b43_read32(dev, B43_MMIO_MACCTL);
 595 }
 596
 597 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 598 {
 599         u32 low, high;
 600
 601         B43_WARN_ON(dev->dev->core_rev < 3);
 602
 603         low = tsf;
 604         high = (tsf >> 32);
 605         /* The hardware guarantees us an atomic write, if we
 606          * write the low register first. */
 607         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 608         mmiowb();
 609         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 610         mmiowb();
 611 }
 612
 613 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 614 {
 615         b43_time_lock(dev);
 616         b43_tsf_write_locked(dev, tsf);
 617         b43_time_unlock(dev);
 618 }
 619
 620 static
 621 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 622 {
 623         static const u8 zero_addr[ETH_ALEN] = { 0 };
 624         u16 data;
 625
 626         if (!mac)
 627                 mac = zero_addr;
 628
 629         offset |= 0x0020;
 630         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 631
 632         data = mac[0];
 633         data |= mac[1] << 8;
 634         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 635         data = mac[2];
 636         data |= mac[3] << 8;
 637         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 638         data = mac[4];
 639         data |= mac[5] << 8;
 640         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 641 }
 642
 643 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 644 {
 645         const u8 *mac;
 646         const u8 *bssid;
 647         u8 mac_bssid[ETH_ALEN * 2];
 648         int i;
 649         u32 tmp;
 650
 651         bssid = dev->wl->bssid;
 652         mac = dev->wl->mac_addr;
 653
 654         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 655
 656         memcpy(mac_bssid, mac, ETH_ALEN);
 657         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 658
 659         /* Write our MAC address and BSSID to template ram */
 660         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 661                 tmp = (u32) (mac_bssid[i + 0]);
 662                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 663                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 664                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 665                 b43_ram_write(dev, 0x20 + i, tmp);
 666         }
 667 }
 668
 669 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 670 {
 671         b43_write_mac_bssid_templates(dev);
 672         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 673 }
 674
 675 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 676 {
 677         /* slot_time is in usec. */
 678         /* This test used to exit for all but a G PHY. */
 679         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 680                 return;
 681         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 682         /* Shared memory location 0x0010 is the slot time and should be
 683          * set to slot_time; however, this register is initially 0 and changing
 684          * the value adversely affects the transmit rate for BCM4311
 685          * devices. Until this behavior is unterstood, delete this step
 686          *
 687          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 688          */
 689 }
 690
 691 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 692 {
 693         b43_set_slot_time(dev, 9);
 694 }
 695
 696 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 697 {
 698         b43_set_slot_time(dev, 20);
 699 }
 700
 701 /* DummyTransmission function, as documented on
 702  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 703  */
 704 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 705 {
 706         struct b43_phy *phy = &dev->phy;
 707         unsigned int i, max_loop;
 708         u16 value;
 709         u32 buffer[5] = {
 710                 0x00000000,
 711                 0x00D40000,
 712                 0x00000000,
 713                 0x01000000,
 714                 0x00000000,
 715         };
 716
 717         if (ofdm) {
 718                 max_loop = 0x1E;
 719                 buffer[0] = 0x000201CC;
 720         } else {
 721                 max_loop = 0xFA;
 722                 buffer[0] = 0x000B846E;
 723         }
 724
 725         for (i = 0; i < 5; i++)
 726                 b43_ram_write(dev, i * 4, buffer[i]);
 727
 728         b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
 729
 730         if (dev->dev->core_rev < 11)
 731                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
 732         else
 733                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
 734
 735         value = (ofdm ? 0x41 : 0x40);
 736         b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
 737         if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
 738             phy->type == B43_PHYTYPE_LCN)
 739                 b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
 740
 741         b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
 742         b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
 743
 744         b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
 745         b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
 746         b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
 747         b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
 748
 749         if (!pa_on && phy->type == B43_PHYTYPE_N)
 750                 ; /*b43_nphy_pa_override(dev, false) */
 751
 752         switch (phy->type) {
 753         case B43_PHYTYPE_N:
 754         case B43_PHYTYPE_LCN:
 755                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
 756                 break;
 757         case B43_PHYTYPE_LP:
 758                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
 759                 break;
 760         default:
 761                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
 762         }
 763         b43_read16(dev, B43_MMIO_TXE0_AUX);
 764
 765         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 766                 b43_radio_write16(dev, 0x0051, 0x0017);
 767         for (i = 0x00; i < max_loop; i++) {
 768                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 769                 if (value & 0x0080)
 770                         break;
 771                 udelay(10);
 772         }
 773         for (i = 0x00; i < 0x0A; i++) {
 774                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 775                 if (value & 0x0400)
 776                         break;
 777                 udelay(10);
 778         }
 779         for (i = 0x00; i < 0x19; i++) {
 780                 value = b43_read16(dev, B43_MMIO_IFSSTAT);
 781                 if (!(value & 0x0100))
 782                         break;
 783                 udelay(10);
 784         }
 785         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 786                 b43_radio_write16(dev, 0x0051, 0x0037);
 787 }
 788
 789 static void key_write(struct b43_wldev *dev,
 790                       u8 index, u8 algorithm, const u8 *key)
 791 {
 792         unsigned int i;
 793         u32 offset;
 794         u16 value;
 795         u16 kidx;
 796
 797         /* Key index/algo block */
 798         kidx = b43_kidx_to_fw(dev, index);
 799         value = ((kidx << 4) | algorithm);
 800         b43_shm_write16(dev, B43_SHM_SHARED,
 801                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 802
 803         /* Write the key to the Key Table Pointer offset */
 804         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 805         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 806                 value = key[i];
 807                 value |= (u16) (key[i + 1]) << 8;
 808                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 809         }
 810 }
 811
 812 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 813 {
 814         u32 addrtmp[2] = { 0, 0, };
 815         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 816
 817         if (b43_new_kidx_api(dev))
 818                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 819
 820         B43_WARN_ON(index < pairwise_keys_start);
 821         /* We have four default TX keys and possibly four default RX keys.
 822          * Physical mac 0 is mapped to physical key 4 or 8, depending
 823          * on the firmware version.
 824          * So we must adjust the index here.
 825          */
 826         index -= pairwise_keys_start;
 827         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 828
 829         if (addr) {
 830                 addrtmp[0] = addr[0];
 831                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 832                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 833                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 834                 addrtmp[1] = addr[4];
 835                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 836         }
 837
 838         /* Receive match transmitter address (RCMTA) mechanism */
 839         b43_shm_write32(dev, B43_SHM_RCMTA,
 840                         (index * 2) + 0, addrtmp[0]);
 841         b43_shm_write16(dev, B43_SHM_RCMTA,
 842                         (index * 2) + 1, addrtmp[1]);
 843 }
 844
 845 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 846  * When a packet is received, the iv32 is checked.
 847  * - if it doesn't the packet is returned without modification (and software
 848  *   decryption can be done). That's what happen when iv16 wrap.
 849  * - if it does, the rc4 key is computed, and decryption is tried.
 850  *   Either it will success and B43_RX_MAC_DEC is returned,
 851  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 852  *   and the packet is not usable (it got modified by the ucode).
 853  * So in order to never have B43_RX_MAC_DECERR, we should provide
 854  * a iv32 and phase1key that match. Because we drop packets in case of
 855  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 856  * packets will be lost without higher layer knowing (ie no resync possible
 857  * until next wrap).
 858  *
 859  * NOTE : this should support 50 key like RCMTA because
 860  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 861  */
 862 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 863                 u16 *phase1key)
 864 {
 865         unsigned int i;
 866         u32 offset;
 867         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 868
 869         if (!modparam_hwtkip)
 870                 return;
 871
 872         if (b43_new_kidx_api(dev))
 873                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 874
 875         B43_WARN_ON(index < pairwise_keys_start);
 876         /* We have four default TX keys and possibly four default RX keys.
 877          * Physical mac 0 is mapped to physical key 4 or 8, depending
 878          * on the firmware version.
 879          * So we must adjust the index here.
 880          */
 881         index -= pairwise_keys_start;
 882         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 883
 884         if (b43_debug(dev, B43_DBG_KEYS)) {
 885                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 886                                 index, iv32);
 887         }
 888         /* Write the key to the  RX tkip shared mem */
 889         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 890         for (i = 0; i < 10; i += 2) {
 891                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 892                                 phase1key ? phase1key[i / 2] : 0);
 893         }
 894         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 895         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 896 }
 897
 898 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 899                                    struct ieee80211_vif *vif,
 900                                    struct ieee80211_key_conf *keyconf,
 901                                    struct ieee80211_sta *sta,
 902                                    u32 iv32, u16 *phase1key)
 903 {
 904         struct b43_wl *wl = hw_to_b43_wl(hw);
 905         struct b43_wldev *dev;
 906         int index = keyconf->hw_key_idx;
 907
 908         if (B43_WARN_ON(!modparam_hwtkip))
 909                 return;
 910
 911         /* This is only called from the RX path through mac80211, where
 912          * our mutex is already locked. */
 913         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 914         dev = wl->current_dev;
 915         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 916
 917         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 918
 919         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 920         /* only pairwise TKIP keys are supported right now */
 921         if (WARN_ON(!sta))
 922                 return;
 923         keymac_write(dev, index, sta->addr);
 924 }
 925
 926 static void do_key_write(struct b43_wldev *dev,
 927                          u8 index, u8 algorithm,
 928                          const u8 *key, size_t key_len, const u8 *mac_addr)
 929 {
 930         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 931         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 932
 933         if (b43_new_kidx_api(dev))
 934                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 935
 936         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 937         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 938
 939         if (index >= pairwise_keys_start)
 940                 keymac_write(dev, index, NULL); /* First zero out mac. */
 941         if (algorithm == B43_SEC_ALGO_TKIP) {
 942                 /*
 943                  * We should provide an initial iv32, phase1key pair.
 944                  * We could start with iv32=0 and compute the corresponding
 945                  * phase1key, but this means calling ieee80211_get_tkip_key
 946                  * with a fake skb (or export other tkip function).
 947                  * Because we are lazy we hope iv32 won't start with
 948                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 949                  * correct pair.
 950                  */
 951                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 952         } else if (index >= pairwise_keys_start) /* clear it */
 953                 rx_tkip_phase1_write(dev, index, 0, NULL);
 954         if (key)
 955                 memcpy(buf, key, key_len);
 956         key_write(dev, index, algorithm, buf);
 957         if (index >= pairwise_keys_start)
 958                 keymac_write(dev, index, mac_addr);
 959
 960         dev->key[index].algorithm = algorithm;
 961 }
 962
 963 static int b43_key_write(struct b43_wldev *dev,
 964                          int index, u8 algorithm,
 965                          const u8 *key, size_t key_len,
 966                          const u8 *mac_addr,
 967                          struct ieee80211_key_conf *keyconf)
 968 {
 969         int i;
 970         int pairwise_keys_start;
 971
 972         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 973          *      - Temporal Encryption Key (128 bits)
 974          *      - Temporal Authenticator Tx MIC Key (64 bits)
 975          *      - Temporal Authenticator Rx MIC Key (64 bits)
 976          *
 977          *      Hardware only store TEK
 978          */
 979         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 980                 key_len = 16;
 981         if (key_len > B43_SEC_KEYSIZE)
 982                 return -EINVAL;
 983         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 984                 /* Check that we don't already have this key. */
 985                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 986         }
 987         if (index < 0) {
 988                 /* Pairwise key. Get an empty slot for the key. */
 989                 if (b43_new_kidx_api(dev))
 990                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 991                 else
 992                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 993                 for (i = pairwise_keys_start;
 994                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 995                      i++) {
 996                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 997                         if (!dev->key[i].keyconf) {
 998                                 /* found empty */
 999                                 index = i;
1000                                 break;
1001                         }
1002                 }
1003                 if (index < 0) {
1004                         b43warn(dev->wl, "Out of hardware key memory\n");
1005                         return -ENOSPC;
1006                 }
1007         } else
1008                 B43_WARN_ON(index > 3);
1009
1010         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1011         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1012                 /* Default RX key */
1013                 B43_WARN_ON(mac_addr);
1014                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1015         }
1016         keyconf->hw_key_idx = index;
1017         dev->key[index].keyconf = keyconf;
1018
1019         return 0;
1020 }
1021
1022 static int b43_key_clear(struct b43_wldev *dev, int index)
1023 {
1024         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1025                 return -EINVAL;
1026         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1027                      NULL, B43_SEC_KEYSIZE, NULL);
1028         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1029                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1030                              NULL, B43_SEC_KEYSIZE, NULL);
1031         }
1032         dev->key[index].keyconf = NULL;
1033
1034         return 0;
1035 }
1036
1037 static void b43_clear_keys(struct b43_wldev *dev)
1038 {
1039         int i, count;
1040
1041         if (b43_new_kidx_api(dev))
1042                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1043         else
1044                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1045         for (i = 0; i < count; i++)
1046                 b43_key_clear(dev, i);
1047 }
1048
1049 static void b43_dump_keymemory(struct b43_wldev *dev)
1050 {
1051         unsigned int i, index, count, offset, pairwise_keys_start;
1052         u8 mac[ETH_ALEN];
1053         u16 algo;
1054         u32 rcmta0;
1055         u16 rcmta1;
1056         u64 hf;
1057         struct b43_key *key;
1058
1059         if (!b43_debug(dev, B43_DBG_KEYS))
1060                 return;
1061
1062         hf = b43_hf_read(dev);
1063         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1064                !!(hf & B43_HF_USEDEFKEYS));
1065         if (b43_new_kidx_api(dev)) {
1066                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1067                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1068         } else {
1069                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1070                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1071         }
1072         for (index = 0; index < count; index++) {
1073                 key = &(dev->key[index]);
1074                 printk(KERN_DEBUG "Key slot %02u: %s",
1075                        index, (key->keyconf == NULL) ? " " : "*");
1076                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1077                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1078                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1079                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1080                 }
1081
1082                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1083                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1084                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1085
1086                 if (index >= pairwise_keys_start) {
1087                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1088                                 printk("   TKIP: ");
1089                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1090                                 for (i = 0; i < 14; i += 2) {
1091                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1092                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1093                                 }
1094                         }
1095                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1096                                                 ((index - pairwise_keys_start) * 2) + 0);
1097                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1098                                                 ((index - pairwise_keys_start) * 2) + 1);
1099                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1100                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1101                         printk("   MAC: %pM", mac);
1102                 } else
1103                         printk("   DEFAULT KEY");
1104                 printk("\n");
1105         }
1106 }
1107
1108 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1109 {
1110         u32 macctl;
1111         u16 ucstat;
1112         bool hwps;
1113         bool awake;
1114         int i;
1115
1116         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1117                     (ps_flags & B43_PS_DISABLED));
1118         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1119
1120         if (ps_flags & B43_PS_ENABLED) {
1121                 hwps = true;
1122         } else if (ps_flags & B43_PS_DISABLED) {
1123                 hwps = false;
1124         } else {
1125                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1126                 //      and thus is not an AP and we are associated, set bit 25
1127         }
1128         if (ps_flags & B43_PS_AWAKE) {
1129                 awake = true;
1130         } else if (ps_flags & B43_PS_ASLEEP) {
1131                 awake = false;
1132         } else {
1133                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1134                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1135                 //      successful, set bit26
1136         }
1137
1138 /* FIXME: For now we force awake-on and hwps-off */
1139         hwps = false;
1140         awake = true;
1141
1142         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1143         if (hwps)
1144                 macctl |= B43_MACCTL_HWPS;
1145         else
1146                 macctl &= ~B43_MACCTL_HWPS;
1147         if (awake)
1148                 macctl |= B43_MACCTL_AWAKE;
1149         else
1150                 macctl &= ~B43_MACCTL_AWAKE;
1151         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1152         /* Commit write */
1153         b43_read32(dev, B43_MMIO_MACCTL);
1154         if (awake && dev->dev->core_rev >= 5) {
1155                 /* Wait for the microcode to wake up. */
1156                 for (i = 0; i < 100; i++) {
1157                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1158                                                 B43_SHM_SH_UCODESTAT);
1159                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1160                                 break;
1161                         udelay(10);
1162                 }
1163         }
1164 }
1165
1166 #ifdef CONFIG_B43_BCMA
1167 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1168 {
1169         u32 flags;
1170
1171         /* Put PHY into reset */
1172         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1173         flags |= B43_BCMA_IOCTL_PHY_RESET;
1174         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1175         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1176         udelay(2);
1177
1178         b43_phy_take_out_of_reset(dev);
1179 }
1180
1181 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1182 {
1183         u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1184                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1185         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1186                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
1187         u32 flags;
1188
1189         flags = B43_BCMA_IOCTL_PHY_CLKEN;
1190         if (gmode)
1191                 flags |= B43_BCMA_IOCTL_GMODE;
1192         b43_device_enable(dev, flags);
1193
1194         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1195         b43_bcma_phy_reset(dev);
1196         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1197 }
1198 #endif
1199
1200 #ifdef CONFIG_B43_SSB
1201 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1202 {
1203         u32 flags = 0;
1204
1205         if (gmode)
1206                 flags |= B43_TMSLOW_GMODE;
1207         flags |= B43_TMSLOW_PHYCLKEN;
1208         flags |= B43_TMSLOW_PHYRESET;
1209         if (dev->phy.type == B43_PHYTYPE_N)
1210                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1211         b43_device_enable(dev, flags);
1212         msleep(2);              /* Wait for the PLL to turn on. */
1213
1214         b43_phy_take_out_of_reset(dev);
1215 }
1216 #endif
1217
1218 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1219 {
1220         u32 macctl;
1221
1222         switch (dev->dev->bus_type) {
1223 #ifdef CONFIG_B43_BCMA
1224         case B43_BUS_BCMA:
1225                 b43_bcma_wireless_core_reset(dev, gmode);
1226                 break;
1227 #endif
1228 #ifdef CONFIG_B43_SSB
1229         case B43_BUS_SSB:
1230                 b43_ssb_wireless_core_reset(dev, gmode);
1231                 break;
1232 #endif
1233         }
1234
1235         /* Turn Analog ON, but only if we already know the PHY-type.
1236          * This protects against very early setup where we don't know the
1237          * PHY-type, yet. wireless_core_reset will be called once again later,
1238          * when we know the PHY-type. */
1239         if (dev->phy.ops)
1240                 dev->phy.ops->switch_analog(dev, 1);
1241
1242         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1243         macctl &= ~B43_MACCTL_GMODE;
1244         if (gmode)
1245                 macctl |= B43_MACCTL_GMODE;
1246         macctl |= B43_MACCTL_IHR_ENABLED;
1247         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1248 }
1249
1250 static void handle_irq_transmit_status(struct b43_wldev *dev)
1251 {
1252         u32 v0, v1;
1253         u16 tmp;
1254         struct b43_txstatus stat;
1255
1256         while (1) {
1257                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1258                 if (!(v0 & 0x00000001))
1259                         break;
1260                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1261
1262                 stat.cookie = (v0 >> 16);
1263                 stat.seq = (v1 & 0x0000FFFF);
1264                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1265                 tmp = (v0 & 0x0000FFFF);
1266                 stat.frame_count = ((tmp & 0xF000) >> 12);
1267                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1268                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1269                 stat.pm_indicated = !!(tmp & 0x0080);
1270                 stat.intermediate = !!(tmp & 0x0040);
1271                 stat.for_ampdu = !!(tmp & 0x0020);
1272                 stat.acked = !!(tmp & 0x0002);
1273
1274                 b43_handle_txstatus(dev, &stat);
1275         }
1276 }
1277
1278 static void drain_txstatus_queue(struct b43_wldev *dev)
1279 {
1280         u32 dummy;
1281
1282         if (dev->dev->core_rev < 5)
1283                 return;
1284         /* Read all entries from the microcode TXstatus FIFO
1285          * and throw them away.
1286          */
1287         while (1) {
1288                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1289                 if (!(dummy & 0x00000001))
1290                         break;
1291                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1292         }
1293 }
1294
1295 static u32 b43_jssi_read(struct b43_wldev *dev)
1296 {
1297         u32 val = 0;
1298
1299         val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1300         val <<= 16;
1301         val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1302
1303         return val;
1304 }
1305
1306 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1307 {
1308         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1309                         (jssi & 0x0000FFFF));
1310         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1311                         (jssi & 0xFFFF0000) >> 16);
1312 }
1313
1314 static void b43_generate_noise_sample(struct b43_wldev *dev)
1315 {
1316         b43_jssi_write(dev, 0x7F7F7F7F);
1317         b43_write32(dev, B43_MMIO_MACCMD,
1318                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1319 }
1320
1321 static void b43_calculate_link_quality(struct b43_wldev *dev)
1322 {
1323         /* Top half of Link Quality calculation. */
1324
1325         if (dev->phy.type != B43_PHYTYPE_G)
1326                 return;
1327         if (dev->noisecalc.calculation_running)
1328                 return;
1329         dev->noisecalc.calculation_running = true;
1330         dev->noisecalc.nr_samples = 0;
1331
1332         b43_generate_noise_sample(dev);
1333 }
1334
1335 static void handle_irq_noise(struct b43_wldev *dev)
1336 {
1337         struct b43_phy_g *phy = dev->phy.g;
1338         u16 tmp;
1339         u8 noise[4];
1340         u8 i, j;
1341         s32 average;
1342
1343         /* Bottom half of Link Quality calculation. */
1344
1345         if (dev->phy.type != B43_PHYTYPE_G)
1346                 return;
1347
1348         /* Possible race condition: It might be possible that the user
1349          * changed to a different channel in the meantime since we
1350          * started the calculation. We ignore that fact, since it's
1351          * not really that much of a problem. The background noise is
1352          * an estimation only anyway. Slightly wrong results will get damped
1353          * by the averaging of the 8 sample rounds. Additionally the
1354          * value is shortlived. So it will be replaced by the next noise
1355          * calculation round soon. */
1356
1357         B43_WARN_ON(!dev->noisecalc.calculation_running);
1358         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1359         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1360             noise[2] == 0x7F || noise[3] == 0x7F)
1361                 goto generate_new;
1362
1363         /* Get the noise samples. */
1364         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1365         i = dev->noisecalc.nr_samples;
1366         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1367         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1368         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1369         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1370         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1371         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1372         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1373         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1374         dev->noisecalc.nr_samples++;
1375         if (dev->noisecalc.nr_samples == 8) {
1376                 /* Calculate the Link Quality by the noise samples. */
1377                 average = 0;
1378                 for (i = 0; i < 8; i++) {
1379                         for (j = 0; j < 4; j++)
1380                                 average += dev->noisecalc.samples[i][j];
1381                 }
1382                 average /= (8 * 4);
1383                 average *= 125;
1384                 average += 64;
1385                 average /= 128;
1386                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1387                 tmp = (tmp / 128) & 0x1F;
1388                 if (tmp >= 8)
1389                         average += 2;
1390                 else
1391                         average -= 25;
1392                 if (tmp == 8)
1393                         average -= 72;
1394                 else
1395                         average -= 48;
1396
1397                 dev->stats.link_noise = average;
1398                 dev->noisecalc.calculation_running = false;
1399                 return;
1400         }
1401 generate_new:
1402         b43_generate_noise_sample(dev);
1403 }
1404
1405 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1406 {
1407         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1408                 ///TODO: PS TBTT
1409         } else {
1410                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1411                         b43_power_saving_ctl_bits(dev, 0);
1412         }
1413         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1414                 dev->dfq_valid = true;
1415 }
1416
1417 static void handle_irq_atim_end(struct b43_wldev *dev)
1418 {
1419         if (dev->dfq_valid) {
1420                 b43_write32(dev, B43_MMIO_MACCMD,
1421                             b43_read32(dev, B43_MMIO_MACCMD)
1422                             | B43_MACCMD_DFQ_VALID);
1423                 dev->dfq_valid = false;
1424         }
1425 }
1426
1427 static void handle_irq_pmq(struct b43_wldev *dev)
1428 {
1429         u32 tmp;
1430
1431         //TODO: AP mode.
1432
1433         while (1) {
1434                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1435                 if (!(tmp & 0x00000008))
1436                         break;
1437         }
1438         /* 16bit write is odd, but correct. */
1439         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1440 }
1441
1442 static void b43_write_template_common(struct b43_wldev *dev,
1443                                       const u8 *data, u16 size,
1444                                       u16 ram_offset,
1445                                       u16 shm_size_offset, u8 rate)
1446 {
1447         u32 i, tmp;
1448         struct b43_plcp_hdr4 plcp;
1449
1450         plcp.data = 0;
1451         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1452         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1453         ram_offset += sizeof(u32);
1454         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1455          * So leave the first two bytes of the next write blank.
1456          */
1457         tmp = (u32) (data[0]) << 16;
1458         tmp |= (u32) (data[1]) << 24;
1459         b43_ram_write(dev, ram_offset, tmp);
1460         ram_offset += sizeof(u32);
1461         for (i = 2; i < size; i += sizeof(u32)) {
1462                 tmp = (u32) (data[i + 0]);
1463                 if (i + 1 < size)
1464                         tmp |= (u32) (data[i + 1]) << 8;
1465                 if (i + 2 < size)
1466                         tmp |= (u32) (data[i + 2]) << 16;
1467                 if (i + 3 < size)
1468                         tmp |= (u32) (data[i + 3]) << 24;
1469                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1470         }
1471         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1472                         size + sizeof(struct b43_plcp_hdr6));
1473 }
1474
1475 /* Check if the use of the antenna that ieee80211 told us to
1476  * use is possible. This will fall back to DEFAULT.
1477  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1478 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1479                                   u8 antenna_nr)
1480 {
1481         u8 antenna_mask;
1482
1483         if (antenna_nr == 0) {
1484                 /* Zero means "use default antenna". That's always OK. */
1485                 return 0;
1486         }
1487
1488         /* Get the mask of available antennas. */
1489         if (dev->phy.gmode)
1490                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1491         else
1492                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1493
1494         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1495                 /* This antenna is not available. Fall back to default. */
1496                 return 0;
1497         }
1498
1499         return antenna_nr;
1500 }
1501
1502 /* Convert a b43 antenna number value to the PHY TX control value. */
1503 static u16 b43_antenna_to_phyctl(int antenna)
1504 {
1505         switch (antenna) {
1506         case B43_ANTENNA0:
1507                 return B43_TXH_PHY_ANT0;
1508         case B43_ANTENNA1:
1509                 return B43_TXH_PHY_ANT1;
1510         case B43_ANTENNA2:
1511                 return B43_TXH_PHY_ANT2;
1512         case B43_ANTENNA3:
1513                 return B43_TXH_PHY_ANT3;
1514         case B43_ANTENNA_AUTO0:
1515         case B43_ANTENNA_AUTO1:
1516                 return B43_TXH_PHY_ANT01AUTO;
1517         }
1518         B43_WARN_ON(1);
1519         return 0;
1520 }
1521
1522 static void b43_write_beacon_template(struct b43_wldev *dev,
1523                                       u16 ram_offset,
1524                                       u16 shm_size_offset)
1525 {
1526         unsigned int i, len, variable_len;
1527         const struct ieee80211_mgmt *bcn;
1528         const u8 *ie;
1529         bool tim_found = false;
1530         unsigned int rate;
1531         u16 ctl;
1532         int antenna;
1533         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1534
1535         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1536         len = min_t(size_t, dev->wl->current_beacon->len,
1537                   0x200 - sizeof(struct b43_plcp_hdr6));
1538         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1539
1540         b43_write_template_common(dev, (const u8 *)bcn,
1541                                   len, ram_offset, shm_size_offset, rate);
1542
1543         /* Write the PHY TX control parameters. */
1544         antenna = B43_ANTENNA_DEFAULT;
1545         antenna = b43_antenna_to_phyctl(antenna);
1546         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1547         /* We can't send beacons with short preamble. Would get PHY errors. */
1548         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1549         ctl &= ~B43_TXH_PHY_ANT;
1550         ctl &= ~B43_TXH_PHY_ENC;
1551         ctl |= antenna;
1552         if (b43_is_cck_rate(rate))
1553                 ctl |= B43_TXH_PHY_ENC_CCK;
1554         else
1555                 ctl |= B43_TXH_PHY_ENC_OFDM;
1556         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1557
1558         /* Find the position of the TIM and the DTIM_period value
1559          * and write them to SHM. */
1560         ie = bcn->u.beacon.variable;
1561         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1562         for (i = 0; i < variable_len - 2; ) {
1563                 uint8_t ie_id, ie_len;
1564
1565                 ie_id = ie[i];
1566                 ie_len = ie[i + 1];
1567                 if (ie_id == 5) {
1568                         u16 tim_position;
1569                         u16 dtim_period;
1570                         /* This is the TIM Information Element */
1571
1572                         /* Check whether the ie_len is in the beacon data range. */
1573                         if (variable_len < ie_len + 2 + i)
1574                                 break;
1575                         /* A valid TIM is at least 4 bytes long. */
1576                         if (ie_len < 4)
1577                                 break;
1578                         tim_found = true;
1579
1580                         tim_position = sizeof(struct b43_plcp_hdr6);
1581                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1582                         tim_position += i;
1583
1584                         dtim_period = ie[i + 3];
1585
1586                         b43_shm_write16(dev, B43_SHM_SHARED,
1587                                         B43_SHM_SH_TIMBPOS, tim_position);
1588                         b43_shm_write16(dev, B43_SHM_SHARED,
1589                                         B43_SHM_SH_DTIMPER, dtim_period);
1590                         break;
1591                 }
1592                 i += ie_len + 2;
1593         }
1594         if (!tim_found) {
1595                 /*
1596                  * If ucode wants to modify TIM do it behind the beacon, this
1597                  * will happen, for example, when doing mesh networking.
1598                  */
1599                 b43_shm_write16(dev, B43_SHM_SHARED,
1600                                 B43_SHM_SH_TIMBPOS,
1601                                 len + sizeof(struct b43_plcp_hdr6));
1602                 b43_shm_write16(dev, B43_SHM_SHARED,
1603                                 B43_SHM_SH_DTIMPER, 0);
1604         }
1605         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1606 }
1607
1608 static void b43_upload_beacon0(struct b43_wldev *dev)
1609 {
1610         struct b43_wl *wl = dev->wl;
1611
1612         if (wl->beacon0_uploaded)
1613                 return;
1614         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1615         wl->beacon0_uploaded = true;
1616 }
1617
1618 static void b43_upload_beacon1(struct b43_wldev *dev)
1619 {
1620         struct b43_wl *wl = dev->wl;
1621
1622         if (wl->beacon1_uploaded)
1623                 return;
1624         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1625         wl->beacon1_uploaded = true;
1626 }
1627
1628 static void handle_irq_beacon(struct b43_wldev *dev)
1629 {
1630         struct b43_wl *wl = dev->wl;
1631         u32 cmd, beacon0_valid, beacon1_valid;
1632
1633         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1634             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1635             !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1636                 return;
1637
1638         /* This is the bottom half of the asynchronous beacon update. */
1639
1640         /* Ignore interrupt in the future. */
1641         dev->irq_mask &= ~B43_IRQ_BEACON;
1642
1643         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1644         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1645         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1646
1647         /* Schedule interrupt manually, if busy. */
1648         if (beacon0_valid && beacon1_valid) {
1649                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1650                 dev->irq_mask |= B43_IRQ_BEACON;
1651                 return;
1652         }
1653
1654         if (unlikely(wl->beacon_templates_virgin)) {
1655                 /* We never uploaded a beacon before.
1656                  * Upload both templates now, but only mark one valid. */
1657                 wl->beacon_templates_virgin = false;
1658                 b43_upload_beacon0(dev);
1659                 b43_upload_beacon1(dev);
1660                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1661                 cmd |= B43_MACCMD_BEACON0_VALID;
1662                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1663         } else {
1664                 if (!beacon0_valid) {
1665                         b43_upload_beacon0(dev);
1666                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1667                         cmd |= B43_MACCMD_BEACON0_VALID;
1668                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1669                 } else if (!beacon1_valid) {
1670                         b43_upload_beacon1(dev);
1671                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1672                         cmd |= B43_MACCMD_BEACON1_VALID;
1673                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1674                 }
1675         }
1676 }
1677
1678 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1679 {
1680         u32 old_irq_mask = dev->irq_mask;
1681
1682         /* update beacon right away or defer to irq */
1683         handle_irq_beacon(dev);
1684         if (old_irq_mask != dev->irq_mask) {
1685                 /* The handler updated the IRQ mask. */
1686                 B43_WARN_ON(!dev->irq_mask);
1687                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1688                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1689                 } else {
1690                         /* Device interrupts are currently disabled. That means
1691                          * we just ran the hardirq handler and scheduled the
1692                          * IRQ thread. The thread will write the IRQ mask when
1693                          * it finished, so there's nothing to do here. Writing
1694                          * the mask _here_ would incorrectly re-enable IRQs. */
1695                 }
1696         }
1697 }
1698
1699 static void b43_beacon_update_trigger_work(struct work_struct *work)
1700 {
1701         struct b43_wl *wl = container_of(work, struct b43_wl,
1702                                          beacon_update_trigger);
1703         struct b43_wldev *dev;
1704
1705         mutex_lock(&wl->mutex);
1706         dev = wl->current_dev;
1707         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1708                 if (b43_bus_host_is_sdio(dev->dev)) {
1709                         /* wl->mutex is enough. */
1710                         b43_do_beacon_update_trigger_work(dev);
1711                         mmiowb();
1712                 } else {
1713                         spin_lock_irq(&wl->hardirq_lock);
1714                         b43_do_beacon_update_trigger_work(dev);
1715                         mmiowb();
1716                         spin_unlock_irq(&wl->hardirq_lock);
1717                 }
1718         }
1719         mutex_unlock(&wl->mutex);
1720 }
1721
1722 /* Asynchronously update the packet templates in template RAM.
1723  * Locking: Requires wl->mutex to be locked. */
1724 static void b43_update_templates(struct b43_wl *wl)
1725 {
1726         struct sk_buff *beacon;
1727
1728         /* This is the top half of the ansynchronous beacon update.
1729          * The bottom half is the beacon IRQ.
1730          * Beacon update must be asynchronous to avoid sending an
1731          * invalid beacon. This can happen for example, if the firmware
1732          * transmits a beacon while we are updating it. */
1733
1734         /* We could modify the existing beacon and set the aid bit in
1735          * the TIM field, but that would probably require resizing and
1736          * moving of data within the beacon template.
1737          * Simply request a new beacon and let mac80211 do the hard work. */
1738         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1739         if (unlikely(!beacon))
1740                 return;
1741
1742         if (wl->current_beacon)
1743                 dev_kfree_skb_any(wl->current_beacon);
1744         wl->current_beacon = beacon;
1745         wl->beacon0_uploaded = false;
1746         wl->beacon1_uploaded = false;
1747         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1748 }
1749
1750 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1751 {
1752         b43_time_lock(dev);
1753         if (dev->dev->core_rev >= 3) {
1754                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1755                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1756         } else {
1757                 b43_write16(dev, 0x606, (beacon_int >> 6));
1758                 b43_write16(dev, 0x610, beacon_int);
1759         }
1760         b43_time_unlock(dev);
1761         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1762 }
1763
1764 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1765 {
1766         u16 reason;
1767
1768         /* Read the register that contains the reason code for the panic. */
1769         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1770         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1771
1772         switch (reason) {
1773         default:
1774                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1775                 /* fallthrough */
1776         case B43_FWPANIC_DIE:
1777                 /* Do not restart the controller or firmware.
1778                  * The device is nonfunctional from now on.
1779                  * Restarting would result in this panic to trigger again,
1780                  * so we avoid that recursion. */
1781                 break;
1782         case B43_FWPANIC_RESTART:
1783                 b43_controller_restart(dev, "Microcode panic");
1784                 break;
1785         }
1786 }
1787
1788 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1789 {
1790         unsigned int i, cnt;
1791         u16 reason, marker_id, marker_line;
1792         __le16 *buf;
1793
1794         /* The proprietary firmware doesn't have this IRQ. */
1795         if (!dev->fw.opensource)
1796                 return;
1797
1798         /* Read the register that contains the reason code for this IRQ. */
1799         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1800
1801         switch (reason) {
1802         case B43_DEBUGIRQ_PANIC:
1803                 b43_handle_firmware_panic(dev);
1804                 break;
1805         case B43_DEBUGIRQ_DUMP_SHM:
1806                 if (!B43_DEBUG)
1807                         break; /* Only with driver debugging enabled. */
1808                 buf = kmalloc(4096, GFP_ATOMIC);
1809                 if (!buf) {
1810                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1811                         goto out;
1812                 }
1813                 for (i = 0; i < 4096; i += 2) {
1814                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1815                         buf[i / 2] = cpu_to_le16(tmp);
1816                 }
1817                 b43info(dev->wl, "Shared memory dump:\n");
1818                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1819                                16, 2, buf, 4096, 1);
1820                 kfree(buf);
1821                 break;
1822         case B43_DEBUGIRQ_DUMP_REGS:
1823                 if (!B43_DEBUG)
1824                         break; /* Only with driver debugging enabled. */
1825                 b43info(dev->wl, "Microcode register dump:\n");
1826                 for (i = 0, cnt = 0; i < 64; i++) {
1827                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1828                         if (cnt == 0)
1829                                 printk(KERN_INFO);
1830                         printk("r%02u: 0x%04X  ", i, tmp);
1831                         cnt++;
1832                         if (cnt == 6) {
1833                                 printk("\n");
1834                                 cnt = 0;
1835                         }
1836                 }
1837                 printk("\n");
1838                 break;
1839         case B43_DEBUGIRQ_MARKER:
1840                 if (!B43_DEBUG)
1841                         break; /* Only with driver debugging enabled. */
1842                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1843                                            B43_MARKER_ID_REG);
1844                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1845                                              B43_MARKER_LINE_REG);
1846                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1847                         "at line number %u\n",
1848                         marker_id, marker_line);
1849                 break;
1850         default:
1851                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1852                        reason);
1853         }
1854 out:
1855         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1856         b43_shm_write16(dev, B43_SHM_SCRATCH,
1857                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1858 }
1859
1860 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1861 {
1862         u32 reason;
1863         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1864         u32 merged_dma_reason = 0;
1865         int i;
1866
1867         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1868                 return;
1869
1870         reason = dev->irq_reason;
1871         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1872                 dma_reason[i] = dev->dma_reason[i];
1873                 merged_dma_reason |= dma_reason[i];
1874         }
1875
1876         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1877                 b43err(dev->wl, "MAC transmission error\n");
1878
1879         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1880                 b43err(dev->wl, "PHY transmission error\n");
1881                 rmb();
1882                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1883                         atomic_set(&dev->phy.txerr_cnt,
1884                                    B43_PHY_TX_BADNESS_LIMIT);
1885                         b43err(dev->wl, "Too many PHY TX errors, "
1886                                         "restarting the controller\n");
1887                         b43_controller_restart(dev, "PHY TX errors");
1888                 }
1889         }
1890
1891         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
1892                 b43err(dev->wl,
1893                         "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1894                         dma_reason[0], dma_reason[1],
1895                         dma_reason[2], dma_reason[3],
1896                         dma_reason[4], dma_reason[5]);
1897                 b43err(dev->wl, "This device does not support DMA "
1898                                "on your system. It will now be switched to PIO.\n");
1899                 /* Fall back to PIO transfers if we get fatal DMA errors! */
1900                 dev->use_pio = true;
1901                 b43_controller_restart(dev, "DMA error");
1902                 return;
1903         }
1904
1905         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1906                 handle_irq_ucode_debug(dev);
1907         if (reason & B43_IRQ_TBTT_INDI)
1908                 handle_irq_tbtt_indication(dev);
1909         if (reason & B43_IRQ_ATIM_END)
1910                 handle_irq_atim_end(dev);
1911         if (reason & B43_IRQ_BEACON)
1912                 handle_irq_beacon(dev);
1913         if (reason & B43_IRQ_PMQ)
1914                 handle_irq_pmq(dev);
1915         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1916                 ;/* TODO */
1917         if (reason & B43_IRQ_NOISESAMPLE_OK)
1918                 handle_irq_noise(dev);
1919
1920         /* Check the DMA reason registers for received data. */
1921         if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
1922                 if (B43_DEBUG)
1923                         b43warn(dev->wl, "RX descriptor underrun\n");
1924                 b43_dma_handle_rx_overflow(dev->dma.rx_ring);
1925         }
1926         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1927                 if (b43_using_pio_transfers(dev))
1928                         b43_pio_rx(dev->pio.rx_queue);
1929                 else
1930                         b43_dma_rx(dev->dma.rx_ring);
1931         }
1932         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1933         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1934         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1935         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1936         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1937
1938         if (reason & B43_IRQ_TX_OK)
1939                 handle_irq_transmit_status(dev);
1940
1941         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1942         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1943
1944 #if B43_DEBUG
1945         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1946                 dev->irq_count++;
1947                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1948                         if (reason & (1 << i))
1949                                 dev->irq_bit_count[i]++;
1950                 }
1951         }
1952 #endif
1953 }
1954
1955 /* Interrupt thread handler. Handles device interrupts in thread context. */
1956 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1957 {
1958         struct b43_wldev *dev = dev_id;
1959
1960         mutex_lock(&dev->wl->mutex);
1961         b43_do_interrupt_thread(dev);
1962         mmiowb();
1963         mutex_unlock(&dev->wl->mutex);
1964
1965         return IRQ_HANDLED;
1966 }
1967
1968 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1969 {
1970         u32 reason;
1971
1972         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1973          * On SDIO, this runs under wl->mutex. */
1974
1975         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1976         if (reason == 0xffffffff)       /* shared IRQ */
1977                 return IRQ_NONE;
1978         reason &= dev->irq_mask;
1979         if (!reason)
1980                 return IRQ_NONE;
1981
1982         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1983             & 0x0001FC00;
1984         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1985             & 0x0000DC00;
1986         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1987             & 0x0000DC00;
1988         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1989             & 0x0001DC00;
1990         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1991             & 0x0000DC00;
1992 /* Unused ring
1993         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1994             & 0x0000DC00;
1995 */
1996
1997         /* ACK the interrupt. */
1998         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1999         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2000         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2001         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2002         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2003         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2004 /* Unused ring
2005         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2006 */
2007
2008         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2009         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2010         /* Save the reason bitmasks for the IRQ thread handler. */
2011         dev->irq_reason = reason;
2012
2013         return IRQ_WAKE_THREAD;
2014 }
2015
2016 /* Interrupt handler top-half. This runs with interrupts disabled. */
2017 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2018 {
2019         struct b43_wldev *dev = dev_id;
2020         irqreturn_t ret;
2021
2022         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2023                 return IRQ_NONE;
2024
2025         spin_lock(&dev->wl->hardirq_lock);
2026         ret = b43_do_interrupt(dev);
2027         mmiowb();
2028         spin_unlock(&dev->wl->hardirq_lock);
2029
2030         return ret;
2031 }
2032
2033 /* SDIO interrupt handler. This runs in process context. */
2034 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2035 {
2036         struct b43_wl *wl = dev->wl;
2037         irqreturn_t ret;
2038
2039         mutex_lock(&wl->mutex);
2040
2041         ret = b43_do_interrupt(dev);
2042         if (ret == IRQ_WAKE_THREAD)
2043                 b43_do_interrupt_thread(dev);
2044
2045         mutex_unlock(&wl->mutex);
2046 }
2047
2048 void b43_do_release_fw(struct b43_firmware_file *fw)
2049 {
2050         release_firmware(fw->data);
2051         fw->data = NULL;
2052         fw->filename = NULL;
2053 }
2054
2055 static void b43_release_firmware(struct b43_wldev *dev)
2056 {
2057         complete(&dev->fw_load_complete);
2058         b43_do_release_fw(&dev->fw.ucode);
2059         b43_do_release_fw(&dev->fw.pcm);
2060         b43_do_release_fw(&dev->fw.initvals);
2061         b43_do_release_fw(&dev->fw.initvals_band);
2062 }
2063
2064 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2065 {
2066         const char text[] =
2067                 "You must go to " \
2068                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2069                 "and download the correct firmware for this driver version. " \
2070                 "Please carefully read all instructions on this website.\n";
2071
2072         if (error)
2073                 b43err(wl, text);
2074         else
2075                 b43warn(wl, text);
2076 }
2077
2078 static void b43_fw_cb(const struct firmware *firmware, void *context)
2079 {
2080         struct b43_request_fw_context *ctx = context;
2081
2082         ctx->blob = firmware;
2083         complete(&ctx->dev->fw_load_complete);
2084 }
2085
2086 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2087                       const char *name,
2088                       struct b43_firmware_file *fw, bool async)
2089 {
2090         struct b43_fw_header *hdr;
2091         u32 size;
2092         int err;
2093
2094         if (!name) {
2095                 /* Don't fetch anything. Free possibly cached firmware. */
2096                 /* FIXME: We should probably keep it anyway, to save some headache
2097                  * on suspend/resume with multiband devices. */
2098                 b43_do_release_fw(fw);
2099                 return 0;
2100         }
2101         if (fw->filename) {
2102                 if ((fw->type == ctx->req_type) &&
2103                     (strcmp(fw->filename, name) == 0))
2104                         return 0; /* Already have this fw. */
2105                 /* Free the cached firmware first. */
2106                 /* FIXME: We should probably do this later after we successfully
2107                  * got the new fw. This could reduce headache with multiband devices.
2108                  * We could also redesign this to cache the firmware for all possible
2109                  * bands all the time. */
2110                 b43_do_release_fw(fw);
2111         }
2112
2113         switch (ctx->req_type) {
2114         case B43_FWTYPE_PROPRIETARY:
2115                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2116                          "b43%s/%s.fw",
2117                          modparam_fwpostfix, name);
2118                 break;
2119         case B43_FWTYPE_OPENSOURCE:
2120                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2121                          "b43-open%s/%s.fw",
2122                          modparam_fwpostfix, name);
2123                 break;
2124         default:
2125                 B43_WARN_ON(1);
2126                 return -ENOSYS;
2127         }
2128         if (async) {
2129                 /* do this part asynchronously */
2130                 init_completion(&ctx->dev->fw_load_complete);
2131                 err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2132                                               ctx->dev->dev->dev, GFP_KERNEL,
2133                                               ctx, b43_fw_cb);
2134                 if (err < 0) {
2135                         pr_err("Unable to load firmware\n");
2136                         return err;
2137                 }
2138                 wait_for_completion(&ctx->dev->fw_load_complete);
2139                 if (ctx->blob)
2140                         goto fw_ready;
2141         /* On some ARM systems, the async request will fail, but the next sync
2142          * request works. For this reason, we fall through here
2143          */
2144         }
2145         err = request_firmware(&ctx->blob, ctx->fwname,
2146                                ctx->dev->dev->dev);
2147         if (err == -ENOENT) {
2148                 snprintf(ctx->errors[ctx->req_type],
2149                          sizeof(ctx->errors[ctx->req_type]),
2150                          "Firmware file \"%s\" not found\n",
2151                          ctx->fwname);
2152                 return err;
2153         } else if (err) {
2154                 snprintf(ctx->errors[ctx->req_type],
2155                          sizeof(ctx->errors[ctx->req_type]),
2156                          "Firmware file \"%s\" request failed (err=%d)\n",
2157                          ctx->fwname, err);
2158                 return err;
2159         }
2160 fw_ready:
2161         if (ctx->blob->size < sizeof(struct b43_fw_header))
2162                 goto err_format;
2163         hdr = (struct b43_fw_header *)(ctx->blob->data);
2164         switch (hdr->type) {
2165         case B43_FW_TYPE_UCODE:
2166         case B43_FW_TYPE_PCM:
2167                 size = be32_to_cpu(hdr->size);
2168                 if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2169                         goto err_format;
2170                 /* fallthrough */
2171         case B43_FW_TYPE_IV:
2172                 if (hdr->ver != 1)
2173                         goto err_format;
2174                 break;
2175         default:
2176                 goto err_format;
2177         }
2178
2179         fw->data = ctx->blob;
2180         fw->filename = name;
2181         fw->type = ctx->req_type;
2182
2183         return 0;
2184
2185 err_format:
2186         snprintf(ctx->errors[ctx->req_type],
2187                  sizeof(ctx->errors[ctx->req_type]),
2188                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2189         release_firmware(ctx->blob);
2190
2191         return -EPROTO;
2192 }
2193
2194 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2195 {
2196         struct b43_wldev *dev = ctx->dev;
2197         struct b43_firmware *fw = &ctx->dev->fw;
2198         const u8 rev = ctx->dev->dev->core_rev;
2199         const char *filename;
2200         u32 tmshigh;
2201         int err;
2202
2203         /* Files for HT and LCN were found by trying one by one */
2204
2205         /* Get microcode */
2206         if ((rev >= 5) && (rev <= 10)) {
2207                 filename = "ucode5";
2208         } else if ((rev >= 11) && (rev <= 12)) {
2209                 filename = "ucode11";
2210         } else if (rev == 13) {
2211                 filename = "ucode13";
2212         } else if (rev == 14) {
2213                 filename = "ucode14";
2214         } else if (rev == 15) {
2215                 filename = "ucode15";
2216         } else {
2217                 switch (dev->phy.type) {
2218                 case B43_PHYTYPE_N:
2219                         if (rev >= 16)
2220                                 filename = "ucode16_mimo";
2221                         else
2222                                 goto err_no_ucode;
2223                         break;
2224                 case B43_PHYTYPE_HT:
2225                         if (rev == 29)
2226                                 filename = "ucode29_mimo";
2227                         else
2228                                 goto err_no_ucode;
2229                         break;
2230                 case B43_PHYTYPE_LCN:
2231                         if (rev == 24)
2232                                 filename = "ucode24_mimo";
2233                         else
2234                                 goto err_no_ucode;
2235                         break;
2236                 default:
2237                         goto err_no_ucode;
2238                 }
2239         }
2240         err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2241         if (err)
2242                 goto err_load;
2243
2244         /* Get PCM code */
2245         if ((rev >= 5) && (rev <= 10))
2246                 filename = "pcm5";
2247         else if (rev >= 11)
2248                 filename = NULL;
2249         else
2250                 goto err_no_pcm;
2251         fw->pcm_request_failed = false;
2252         err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2253         if (err == -ENOENT) {
2254                 /* We did not find a PCM file? Not fatal, but
2255                  * core rev <= 10 must do without hwcrypto then. */
2256                 fw->pcm_request_failed = true;
2257         } else if (err)
2258                 goto err_load;
2259
2260         /* Get initvals */
2261         switch (dev->phy.type) {
2262         case B43_PHYTYPE_A:
2263                 if ((rev >= 5) && (rev <= 10)) {
2264                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2265                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2266                                 filename = "a0g1initvals5";
2267                         else
2268                                 filename = "a0g0initvals5";
2269                 } else
2270                         goto err_no_initvals;
2271                 break;
2272         case B43_PHYTYPE_G:
2273                 if ((rev >= 5) && (rev <= 10))
2274                         filename = "b0g0initvals5";
2275                 else if (rev >= 13)
2276                         filename = "b0g0initvals13";
2277                 else
2278                         goto err_no_initvals;
2279                 break;
2280         case B43_PHYTYPE_N:
2281                 if (rev >= 16)
2282                         filename = "n0initvals16";
2283                 else if ((rev >= 11) && (rev <= 12))
2284                         filename = "n0initvals11";
2285                 else
2286                         goto err_no_initvals;
2287                 break;
2288         case B43_PHYTYPE_LP:
2289                 if (rev == 13)
2290                         filename = "lp0initvals13";
2291                 else if (rev == 14)
2292                         filename = "lp0initvals14";
2293                 else if (rev >= 15)
2294                         filename = "lp0initvals15";
2295                 else
2296                         goto err_no_initvals;
2297                 break;
2298         case B43_PHYTYPE_HT:
2299                 if (rev == 29)
2300                         filename = "ht0initvals29";
2301                 else
2302                         goto err_no_initvals;
2303                 break;
2304         case B43_PHYTYPE_LCN:
2305                 if (rev == 24)
2306                         filename = "lcn0initvals24";
2307                 else
2308                         goto err_no_initvals;
2309                 break;
2310         default:
2311                 goto err_no_initvals;
2312         }
2313         err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2314         if (err)
2315                 goto err_load;
2316
2317         /* Get bandswitch initvals */
2318         switch (dev->phy.type) {
2319         case B43_PHYTYPE_A:
2320                 if ((rev >= 5) && (rev <= 10)) {
2321                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2322                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2323                                 filename = "a0g1bsinitvals5";
2324                         else
2325                                 filename = "a0g0bsinitvals5";
2326                 } else if (rev >= 11)
2327                         filename = NULL;
2328                 else
2329                         goto err_no_initvals;
2330                 break;
2331         case B43_PHYTYPE_G:
2332                 if ((rev >= 5) && (rev <= 10))
2333                         filename = "b0g0bsinitvals5";
2334                 else if (rev >= 11)
2335                         filename = NULL;
2336                 else
2337                         goto err_no_initvals;
2338                 break;
2339         case B43_PHYTYPE_N:
2340                 if (rev >= 16)
2341                         filename = "n0bsinitvals16";
2342                 else if ((rev >= 11) && (rev <= 12))
2343                         filename = "n0bsinitvals11";
2344                 else
2345                         goto err_no_initvals;
2346                 break;
2347         case B43_PHYTYPE_LP:
2348                 if (rev == 13)
2349                         filename = "lp0bsinitvals13";
2350                 else if (rev == 14)
2351                         filename = "lp0bsinitvals14";
2352                 else if (rev >= 15)
2353                         filename = "lp0bsinitvals15";
2354                 else
2355                         goto err_no_initvals;
2356                 break;
2357         case B43_PHYTYPE_HT:
2358                 if (rev == 29)
2359                         filename = "ht0bsinitvals29";
2360                 else
2361                         goto err_no_initvals;
2362                 break;
2363         case B43_PHYTYPE_LCN:
2364                 if (rev == 24)
2365                         filename = "lcn0bsinitvals24";
2366                 else
2367                         goto err_no_initvals;
2368                 break;
2369         default:
2370                 goto err_no_initvals;
2371         }
2372         err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2373         if (err)
2374                 goto err_load;
2375
2376         fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2377
2378         return 0;
2379
2380 err_no_ucode:
2381         err = ctx->fatal_failure = -EOPNOTSUPP;
2382         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2383                "is required for your device (wl-core rev %u)\n", rev);
2384         goto error;
2385
2386 err_no_pcm:
2387         err = ctx->fatal_failure = -EOPNOTSUPP;
2388         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2389                "is required for your device (wl-core rev %u)\n", rev);
2390         goto error;
2391
2392 err_no_initvals:
2393         err = ctx->fatal_failure = -EOPNOTSUPP;
2394         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2395                "is required for your device (wl-core rev %u)\n", rev);
2396         goto error;
2397
2398 err_load:
2399         /* We failed to load this firmware image. The error message
2400          * already is in ctx->errors. Return and let our caller decide
2401          * what to do. */
2402         goto error;
2403
2404 error:
2405         b43_release_firmware(dev);
2406         return err;
2407 }
2408
2409 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2410 static void b43_one_core_detach(struct b43_bus_dev *dev);
2411 static int b43_rng_init(struct b43_wl *wl);
2412
2413 static void b43_request_firmware(struct work_struct *work)
2414 {
2415         struct b43_wl *wl = container_of(work,
2416                             struct b43_wl, firmware_load);
2417         struct b43_wldev *dev = wl->current_dev;
2418         struct b43_request_fw_context *ctx;
2419         unsigned int i;
2420         int err;
2421         const char *errmsg;
2422
2423         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2424         if (!ctx)
2425                 return;
2426         ctx->dev = dev;
2427
2428         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2429         err = b43_try_request_fw(ctx);
2430         if (!err)
2431                 goto start_ieee80211; /* Successfully loaded it. */
2432         /* Was fw version known? */
2433         if (ctx->fatal_failure)
2434                 goto out;
2435
2436         /* proprietary fw not found, try open source */
2437         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2438         err = b43_try_request_fw(ctx);
2439         if (!err)
2440                 goto start_ieee80211; /* Successfully loaded it. */
2441         if(ctx->fatal_failure)
2442                 goto out;
2443
2444         /* Could not find a usable firmware. Print the errors. */
2445         for (i = 0; i < B43_NR_FWTYPES; i++) {
2446                 errmsg = ctx->errors[i];
2447                 if (strlen(errmsg))
2448                         b43err(dev->wl, "%s", errmsg);
2449         }
2450         b43_print_fw_helptext(dev->wl, 1);
2451         goto out;
2452
2453 start_ieee80211:
2454         wl->hw->queues = B43_QOS_QUEUE_NUM;
2455         if (!modparam_qos || dev->fw.opensource)
2456                 wl->hw->queues = 1;
2457
2458         err = ieee80211_register_hw(wl->hw);
2459         if (err)
2460                 goto err_one_core_detach;
2461         wl->hw_registred = true;
2462         b43_leds_register(wl->current_dev);
2463
2464         /* Register HW RNG driver */
2465         b43_rng_init(wl);
2466
2467         goto out;
2468
2469 err_one_core_detach:
2470         b43_one_core_detach(dev->dev);
2471
2472 out:
2473         kfree(ctx);
2474 }
2475
2476 static int b43_upload_microcode(struct b43_wldev *dev)
2477 {
2478         struct wiphy *wiphy = dev->wl->hw->wiphy;
2479         const size_t hdr_len = sizeof(struct b43_fw_header);
2480         const __be32 *data;
2481         unsigned int i, len;
2482         u16 fwrev, fwpatch, fwdate, fwtime;
2483         u32 tmp, macctl;
2484         int err = 0;
2485
2486         /* Jump the microcode PSM to offset 0 */
2487         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2488         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2489         macctl |= B43_MACCTL_PSM_JMP0;
2490         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2491         /* Zero out all microcode PSM registers and shared memory. */
2492         for (i = 0; i < 64; i++)
2493                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2494         for (i = 0; i < 4096; i += 2)
2495                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2496
2497         /* Upload Microcode. */
2498         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2499         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2500         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2501         for (i = 0; i < len; i++) {
2502                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2503                 udelay(10);
2504         }
2505
2506         if (dev->fw.pcm.data) {
2507                 /* Upload PCM data. */
2508                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2509                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2510                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2511                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2512                 /* No need for autoinc bit in SHM_HW */
2513                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2514                 for (i = 0; i < len; i++) {
2515                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2516                         udelay(10);
2517                 }
2518         }
2519
2520         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2521
2522         /* Start the microcode PSM */
2523         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2524                       B43_MACCTL_PSM_RUN);
2525
2526         /* Wait for the microcode to load and respond */
2527         i = 0;
2528         while (1) {
2529                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2530                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2531                         break;
2532                 i++;
2533                 if (i >= 20) {
2534                         b43err(dev->wl, "Microcode not responding\n");
2535                         b43_print_fw_helptext(dev->wl, 1);
2536                         err = -ENODEV;
2537                         goto error;
2538                 }
2539                 msleep(50);
2540         }
2541         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2542
2543         /* Get and check the revisions. */
2544         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2545         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2546         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2547         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2548
2549         if (fwrev <= 0x128) {
2550                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2551                        "binary drivers older than version 4.x is unsupported. "
2552                        "You must upgrade your firmware files.\n");
2553                 b43_print_fw_helptext(dev->wl, 1);
2554                 err = -EOPNOTSUPP;
2555                 goto error;
2556         }
2557         dev->fw.rev = fwrev;
2558         dev->fw.patch = fwpatch;
2559         if (dev->fw.rev >= 598)
2560                 dev->fw.hdr_format = B43_FW_HDR_598;
2561         else if (dev->fw.rev >= 410)
2562                 dev->fw.hdr_format = B43_FW_HDR_410;
2563         else
2564                 dev->fw.hdr_format = B43_FW_HDR_351;
2565         WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2566
2567         dev->qos_enabled = dev->wl->hw->queues > 1;
2568         /* Default to firmware/hardware crypto acceleration. */
2569         dev->hwcrypto_enabled = true;
2570
2571         if (dev->fw.opensource) {
2572                 u16 fwcapa;
2573
2574                 /* Patchlevel info is encoded in the "time" field. */
2575                 dev->fw.patch = fwtime;
2576                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2577                         dev->fw.rev, dev->fw.patch);
2578
2579                 fwcapa = b43_fwcapa_read(dev);
2580                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2581                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2582                         /* Disable hardware crypto and fall back to software crypto. */
2583                         dev->hwcrypto_enabled = false;
2584                 }
2585                 /* adding QoS support should use an offline discovery mechanism */
2586                 WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2587         } else {
2588                 b43info(dev->wl, "Loading firmware version %u.%u "
2589                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2590                         fwrev, fwpatch,
2591                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2592                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2593                 if (dev->fw.pcm_request_failed) {
2594                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2595                                 "Hardware accelerated cryptography is disabled.\n");
2596                         b43_print_fw_helptext(dev->wl, 0);
2597                 }
2598         }
2599
2600         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2601                         dev->fw.rev, dev->fw.patch);
2602         wiphy->hw_version = dev->dev->core_id;
2603
2604         if (dev->fw.hdr_format == B43_FW_HDR_351) {
2605                 /* We're over the deadline, but we keep support for old fw
2606                  * until it turns out to be in major conflict with something new. */
2607                 b43warn(dev->wl, "You are using an old firmware image. "
2608                         "Support for old firmware will be removed soon "
2609                         "(official deadline was July 2008).\n");
2610                 b43_print_fw_helptext(dev->wl, 0);
2611         }
2612
2613         return 0;
2614
2615 error:
2616         /* Stop the microcode PSM. */
2617         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2618                       B43_MACCTL_PSM_JMP0);
2619
2620         return err;
2621 }
2622
2623 static int b43_write_initvals(struct b43_wldev *dev,
2624                               const struct b43_iv *ivals,
2625                               size_t count,
2626                               size_t array_size)
2627 {
2628         const struct b43_iv *iv;
2629         u16 offset;
2630         size_t i;
2631         bool bit32;
2632
2633         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2634         iv = ivals;
2635         for (i = 0; i < count; i++) {
2636                 if (array_size < sizeof(iv->offset_size))
2637                         goto err_format;
2638                 array_size -= sizeof(iv->offset_size);
2639                 offset = be16_to_cpu(iv->offset_size);
2640                 bit32 = !!(offset & B43_IV_32BIT);
2641                 offset &= B43_IV_OFFSET_MASK;
2642                 if (offset >= 0x1000)
2643                         goto err_format;
2644                 if (bit32) {
2645                         u32 value;
2646
2647                         if (array_size < sizeof(iv->data.d32))
2648                                 goto err_format;
2649                         array_size -= sizeof(iv->data.d32);
2650
2651                         value = get_unaligned_be32(&iv->data.d32);
2652                         b43_write32(dev, offset, value);
2653
2654                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2655                                                         sizeof(__be16) +
2656                                                         sizeof(__be32));
2657                 } else {
2658                         u16 value;
2659
2660                         if (array_size < sizeof(iv->data.d16))
2661                                 goto err_format;
2662                         array_size -= sizeof(iv->data.d16);
2663
2664                         value = be16_to_cpu(iv->data.d16);
2665                         b43_write16(dev, offset, value);
2666
2667                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2668                                                         sizeof(__be16) +
2669                                                         sizeof(__be16));
2670                 }
2671         }
2672         if (array_size)
2673                 goto err_format;
2674
2675         return 0;
2676
2677 err_format:
2678         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2679         b43_print_fw_helptext(dev->wl, 1);
2680
2681         return -EPROTO;
2682 }
2683
2684 static int b43_upload_initvals(struct b43_wldev *dev)
2685 {
2686         const size_t hdr_len = sizeof(struct b43_fw_header);
2687         const struct b43_fw_header *hdr;
2688         struct b43_firmware *fw = &dev->fw;
2689         const struct b43_iv *ivals;
2690         size_t count;
2691
2692         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2693         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2694         count = be32_to_cpu(hdr->size);
2695         return b43_write_initvals(dev, ivals, count,
2696                                  fw->initvals.data->size - hdr_len);
2697 }
2698
2699 static int b43_upload_initvals_band(struct b43_wldev *dev)
2700 {
2701         const size_t hdr_len = sizeof(struct b43_fw_header);
2702         const struct b43_fw_header *hdr;
2703         struct b43_firmware *fw = &dev->fw;
2704         const struct b43_iv *ivals;
2705         size_t count;
2706
2707         if (!fw->initvals_band.data)
2708                 return 0;
2709
2710         hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2711         ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2712         count = be32_to_cpu(hdr->size);
2713         return b43_write_initvals(dev, ivals, count,
2714                                   fw->initvals_band.data->size - hdr_len);
2715 }
2716
2717 /* Initialize the GPIOs
2718  * http://bcm-specs.sipsolutions.net/GPIO
2719  */
2720
2721 #ifdef CONFIG_B43_SSB
2722 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2723 {
2724         struct ssb_bus *bus = dev->dev->sdev->bus;
2725
2726 #ifdef CONFIG_SSB_DRIVER_PCICORE
2727         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2728 #else
2729         return bus->chipco.dev;
2730 #endif
2731 }
2732 #endif
2733
2734 static int b43_gpio_init(struct b43_wldev *dev)
2735 {
2736 #ifdef CONFIG_B43_SSB
2737         struct ssb_device *gpiodev;
2738 #endif
2739         u32 mask, set;
2740
2741         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2742         b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2743
2744         mask = 0x0000001F;
2745         set = 0x0000000F;
2746         if (dev->dev->chip_id == 0x4301) {
2747                 mask |= 0x0060;
2748                 set |= 0x0060;
2749         } else if (dev->dev->chip_id == 0x5354) {
2750                 /* Don't allow overtaking buttons GPIOs */
2751                 set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2752         }
2753
2754         if (0 /* FIXME: conditional unknown */ ) {
2755                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2756                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2757                             | 0x0100);
2758                 /* BT Coexistance Input */
2759                 mask |= 0x0080;
2760                 set |= 0x0080;
2761                 /* BT Coexistance Out */
2762                 mask |= 0x0100;
2763                 set |= 0x0100;
2764         }
2765         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2766                 /* PA is controlled by gpio 9, let ucode handle it */
2767                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2768                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2769                             | 0x0200);
2770                 mask |= 0x0200;
2771                 set |= 0x0200;
2772         }
2773
2774         switch (dev->dev->bus_type) {
2775 #ifdef CONFIG_B43_BCMA
2776         case B43_BUS_BCMA:
2777                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2778                 break;
2779 #endif
2780 #ifdef CONFIG_B43_SSB
2781         case B43_BUS_SSB:
2782                 gpiodev = b43_ssb_gpio_dev(dev);
2783                 if (gpiodev)
2784                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2785                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2786                                     & ~mask) | set);
2787                 break;
2788 #endif
2789         }
2790
2791         return 0;
2792 }
2793
2794 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2795 static void b43_gpio_cleanup(struct b43_wldev *dev)
2796 {
2797 #ifdef CONFIG_B43_SSB
2798         struct ssb_device *gpiodev;
2799 #endif
2800
2801         switch (dev->dev->bus_type) {
2802 #ifdef CONFIG_B43_BCMA
2803         case B43_BUS_BCMA:
2804                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2805                 break;
2806 #endif
2807 #ifdef CONFIG_B43_SSB
2808         case B43_BUS_SSB:
2809                 gpiodev = b43_ssb_gpio_dev(dev);
2810                 if (gpiodev)
2811                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2812                 break;
2813 #endif
2814         }
2815 }
2816
2817 /* http://bcm-specs.sipsolutions.net/EnableMac */
2818 void b43_mac_enable(struct b43_wldev *dev)
2819 {
2820         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2821                 u16 fwstate;
2822
2823                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2824                                          B43_SHM_SH_UCODESTAT);
2825                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2826                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2827                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2828                                "should be suspended, but current state is %u\n",
2829                                fwstate);
2830                 }
2831         }
2832
2833         dev->mac_suspended--;
2834         B43_WARN_ON(dev->mac_suspended < 0);
2835         if (dev->mac_suspended == 0) {
2836                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2837                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2838                             B43_IRQ_MAC_SUSPENDED);
2839                 /* Commit writes */
2840                 b43_read32(dev, B43_MMIO_MACCTL);
2841                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2842                 b43_power_saving_ctl_bits(dev, 0);
2843         }
2844 }
2845
2846 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2847 void b43_mac_suspend(struct b43_wldev *dev)
2848 {
2849         int i;
2850         u32 tmp;
2851
2852         might_sleep();
2853         B43_WARN_ON(dev->mac_suspended < 0);
2854
2855         if (dev->mac_suspended == 0) {
2856                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2857                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
2858                 /* force pci to flush the write */
2859                 b43_read32(dev, B43_MMIO_MACCTL);
2860                 for (i = 35; i; i--) {
2861                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2862                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2863                                 goto out;
2864                         udelay(10);
2865                 }
2866                 /* Hm, it seems this will take some time. Use msleep(). */
2867                 for (i = 40; i; i--) {
2868                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2869                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2870                                 goto out;
2871                         msleep(1);
2872                 }
2873                 b43err(dev->wl, "MAC suspend failed\n");
2874         }
2875 out:
2876         dev->mac_suspended++;
2877 }
2878
2879 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2880 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2881 {
2882         u32 tmp;
2883
2884         switch (dev->dev->bus_type) {
2885 #ifdef CONFIG_B43_BCMA
2886         case B43_BUS_BCMA:
2887                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
2888                 if (on)
2889                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2890                 else
2891                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2892                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
2893                 break;
2894 #endif
2895 #ifdef CONFIG_B43_SSB
2896         case B43_BUS_SSB:
2897                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2898                 if (on)
2899                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2900                 else
2901                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2902                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2903                 break;
2904 #endif
2905         }
2906 }
2907
2908 static void b43_adjust_opmode(struct b43_wldev *dev)
2909 {
2910         struct b43_wl *wl = dev->wl;
2911         u32 ctl;
2912         u16 cfp_pretbtt;
2913
2914         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2915         /* Reset status to STA infrastructure mode. */
2916         ctl &= ~B43_MACCTL_AP;
2917         ctl &= ~B43_MACCTL_KEEP_CTL;
2918         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2919         ctl &= ~B43_MACCTL_KEEP_BAD;
2920         ctl &= ~B43_MACCTL_PROMISC;
2921         ctl &= ~B43_MACCTL_BEACPROMISC;
2922         ctl |= B43_MACCTL_INFRA;
2923
2924         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2925             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2926                 ctl |= B43_MACCTL_AP;
2927         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2928                 ctl &= ~B43_MACCTL_INFRA;
2929
2930         if (wl->filter_flags & FIF_CONTROL)
2931                 ctl |= B43_MACCTL_KEEP_CTL;
2932         if (wl->filter_flags & FIF_FCSFAIL)
2933                 ctl |= B43_MACCTL_KEEP_BAD;
2934         if (wl->filter_flags & FIF_PLCPFAIL)
2935                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2936         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2937                 ctl |= B43_MACCTL_PROMISC;
2938         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2939                 ctl |= B43_MACCTL_BEACPROMISC;
2940
2941         /* Workaround: On old hardware the HW-MAC-address-filter
2942          * doesn't work properly, so always run promisc in filter
2943          * it in software. */
2944         if (dev->dev->core_rev <= 4)
2945                 ctl |= B43_MACCTL_PROMISC;
2946
2947         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2948
2949         cfp_pretbtt = 2;
2950         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2951                 if (dev->dev->chip_id == 0x4306 &&
2952                     dev->dev->chip_rev == 3)
2953                         cfp_pretbtt = 100;
2954                 else
2955                         cfp_pretbtt = 50;
2956         }
2957         b43_write16(dev, 0x612, cfp_pretbtt);
2958
2959         /* FIXME: We don't currently implement the PMQ mechanism,
2960          *        so always disable it. If we want to implement PMQ,
2961          *        we need to enable it here (clear DISCPMQ) in AP mode.
2962          */
2963         if (0  /* ctl & B43_MACCTL_AP */)
2964                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
2965         else
2966                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
2967 }
2968
2969 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2970 {
2971         u16 offset;
2972
2973         if (is_ofdm) {
2974                 offset = 0x480;
2975                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2976         } else {
2977                 offset = 0x4C0;
2978                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2979         }
2980         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2981                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2982 }
2983
2984 static void b43_rate_memory_init(struct b43_wldev *dev)
2985 {
2986         switch (dev->phy.type) {
2987         case B43_PHYTYPE_A:
2988         case B43_PHYTYPE_G:
2989         case B43_PHYTYPE_N:
2990         case B43_PHYTYPE_LP:
2991         case B43_PHYTYPE_HT:
2992         case B43_PHYTYPE_LCN:
2993                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2994                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2995                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2996                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2997                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2998                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2999                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3000                 if (dev->phy.type == B43_PHYTYPE_A)
3001                         break;
3002                 /* fallthrough */
3003         case B43_PHYTYPE_B:
3004                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3005                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3006                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3007                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3008                 break;
3009         default:
3010                 B43_WARN_ON(1);
3011         }
3012 }
3013
3014 /* Set the default values for the PHY TX Control Words. */
3015 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3016 {
3017         u16 ctl = 0;
3018
3019         ctl |= B43_TXH_PHY_ENC_CCK;
3020         ctl |= B43_TXH_PHY_ANT01AUTO;
3021         ctl |= B43_TXH_PHY_TXPWR;
3022
3023         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3024         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3025         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3026 }
3027
3028 /* Set the TX-Antenna for management frames sent by firmware. */
3029 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3030 {
3031         u16 ant;
3032         u16 tmp;
3033
3034         ant = b43_antenna_to_phyctl(antenna);
3035
3036         /* For ACK/CTS */
3037         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3038         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3039         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3040         /* For Probe Resposes */
3041         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3042         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3043         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3044 }
3045
3046 /* This is the opposite of b43_chip_init() */
3047 static void b43_chip_exit(struct b43_wldev *dev)
3048 {
3049         b43_phy_exit(dev);
3050         b43_gpio_cleanup(dev);
3051         /* firmware is released later */
3052 }
3053
3054 /* Initialize the chip
3055  * http://bcm-specs.sipsolutions.net/ChipInit
3056  */
3057 static int b43_chip_init(struct b43_wldev *dev)
3058 {
3059         struct b43_phy *phy = &dev->phy;
3060         int err;
3061         u32 macctl;
3062         u16 value16;
3063
3064         /* Initialize the MAC control */
3065         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3066         if (dev->phy.gmode)
3067                 macctl |= B43_MACCTL_GMODE;
3068         macctl |= B43_MACCTL_INFRA;
3069         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3070
3071         err = b43_upload_microcode(dev);
3072         if (err)
3073                 goto out;       /* firmware is released later */
3074
3075         err = b43_gpio_init(dev);
3076         if (err)
3077                 goto out;       /* firmware is released later */
3078
3079         err = b43_upload_initvals(dev);
3080         if (err)
3081                 goto err_gpio_clean;
3082
3083         err = b43_upload_initvals_band(dev);
3084         if (err)
3085                 goto err_gpio_clean;
3086
3087         /* Turn the Analog on and initialize the PHY. */
3088         phy->ops->switch_analog(dev, 1);
3089         err = b43_phy_init(dev);
3090         if (err)
3091                 goto err_gpio_clean;
3092
3093         /* Disable Interference Mitigation. */
3094         if (phy->ops->interf_mitigation)
3095                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3096
3097         /* Select the antennae */
3098         if (phy->ops->set_rx_antenna)
3099                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3100         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3101
3102         if (phy->type == B43_PHYTYPE_B) {
3103                 value16 = b43_read16(dev, 0x005E);
3104                 value16 |= 0x0004;
3105                 b43_write16(dev, 0x005E, value16);
3106         }
3107         b43_write32(dev, 0x0100, 0x01000000);
3108         if (dev->dev->core_rev < 5)
3109                 b43_write32(dev, 0x010C, 0x01000000);
3110
3111         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3112         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3113
3114         /* Probe Response Timeout value */
3115         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3116         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3117
3118         /* Initially set the wireless operation mode. */
3119         b43_adjust_opmode(dev);
3120
3121         if (dev->dev->core_rev < 3) {
3122                 b43_write16(dev, 0x060E, 0x0000);
3123                 b43_write16(dev, 0x0610, 0x8000);
3124                 b43_write16(dev, 0x0604, 0x0000);
3125                 b43_write16(dev, 0x0606, 0x0200);
3126         } else {
3127                 b43_write32(dev, 0x0188, 0x80000000);
3128                 b43_write32(dev, 0x018C, 0x02000000);
3129         }
3130         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3131         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3132         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3133         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3134         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3135         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3136         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3137
3138         b43_mac_phy_clock_set(dev, true);
3139
3140         switch (dev->dev->bus_type) {
3141 #ifdef CONFIG_B43_BCMA
3142         case B43_BUS_BCMA:
3143                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3144                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3145                 break;
3146 #endif
3147 #ifdef CONFIG_B43_SSB
3148         case B43_BUS_SSB:
3149                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3150                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3151                 break;
3152 #endif
3153         }
3154
3155         err = 0;
3156         b43dbg(dev->wl, "Chip initialized\n");
3157 out:
3158         return err;
3159
3160 err_gpio_clean:
3161         b43_gpio_cleanup(dev);
3162         return err;
3163 }
3164
3165 static void b43_periodic_every60sec(struct b43_wldev *dev)
3166 {
3167         const struct b43_phy_operations *ops = dev->phy.ops;
3168
3169         if (ops->pwork_60sec)
3170                 ops->pwork_60sec(dev);
3171
3172         /* Force check the TX power emission now. */
3173         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3174 }
3175
3176 static void b43_periodic_every30sec(struct b43_wldev *dev)
3177 {
3178         /* Update device statistics. */
3179         b43_calculate_link_quality(dev);
3180 }
3181
3182 static void b43_periodic_every15sec(struct b43_wldev *dev)
3183 {
3184         struct b43_phy *phy = &dev->phy;
3185         u16 wdr;
3186
3187         if (dev->fw.opensource) {
3188                 /* Check if the firmware is still alive.
3189                  * It will reset the watchdog counter to 0 in its idle loop. */
3190                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3191                 if (unlikely(wdr)) {
3192                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3193                         b43_controller_restart(dev, "Firmware watchdog");
3194                         return;
3195                 } else {
3196                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3197                                         B43_WATCHDOG_REG, 1);
3198                 }
3199         }
3200
3201         if (phy->ops->pwork_15sec)
3202                 phy->ops->pwork_15sec(dev);
3203
3204         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3205         wmb();
3206
3207 #if B43_DEBUG
3208         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3209                 unsigned int i;
3210
3211                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3212                        dev->irq_count / 15,
3213                        dev->tx_count / 15,
3214                        dev->rx_count / 15);
3215                 dev->irq_count = 0;
3216                 dev->tx_count = 0;
3217                 dev->rx_count = 0;
3218                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3219                         if (dev->irq_bit_count[i]) {
3220                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3221                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3222                                 dev->irq_bit_count[i] = 0;
3223                         }
3224                 }
3225         }
3226 #endif
3227 }
3228
3229 static void do_periodic_work(struct b43_wldev *dev)
3230 {
3231         unsigned int state;
3232
3233         state = dev->periodic_state;
3234         if (state % 4 == 0)
3235                 b43_periodic_every60sec(dev);
3236         if (state % 2 == 0)
3237                 b43_periodic_every30sec(dev);
3238         b43_periodic_every15sec(dev);
3239 }
3240
3241 /* Periodic work locking policy:
3242  *      The whole periodic work handler is protected by
3243  *      wl->mutex. If another lock is needed somewhere in the
3244  *      pwork callchain, it's acquired in-place, where it's needed.
3245  */
3246 static void b43_periodic_work_handler(struct work_struct *work)
3247 {
3248         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3249                                              periodic_work.work);
3250         struct b43_wl *wl = dev->wl;
3251         unsigned long delay;
3252
3253         mutex_lock(&wl->mutex);
3254
3255         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3256                 goto out;
3257         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3258                 goto out_requeue;
3259
3260         do_periodic_work(dev);
3261
3262         dev->periodic_state++;
3263 out_requeue:
3264         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3265                 delay = msecs_to_jiffies(50);
3266         else
3267                 delay = round_jiffies_relative(HZ * 15);
3268         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3269 out:
3270         mutex_unlock(&wl->mutex);
3271 }
3272
3273 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3274 {
3275         struct delayed_work *work = &dev->periodic_work;
3276
3277         dev->periodic_state = 0;
3278         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3279         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3280 }
3281
3282 /* Check if communication with the device works correctly. */
3283 static int b43_validate_chipaccess(struct b43_wldev *dev)
3284 {
3285         u32 v, backup0, backup4;
3286
3287         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3288         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3289
3290         /* Check for read/write and endianness problems. */
3291         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3292         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3293                 goto error;
3294         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3295         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3296                 goto error;
3297
3298         /* Check if unaligned 32bit SHM_SHARED access works properly.
3299          * However, don't bail out on failure, because it's noncritical. */
3300         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3301         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3302         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3303         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3304         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3305                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3306         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3307         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3308             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3309             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3310             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3311                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3312
3313         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3314         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3315
3316         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3317                 /* The 32bit register shadows the two 16bit registers
3318                  * with update sideeffects. Validate this. */
3319                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3320                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3321                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3322                         goto error;
3323                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3324                         goto error;
3325         }
3326         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3327
3328         v = b43_read32(dev, B43_MMIO_MACCTL);
3329         v |= B43_MACCTL_GMODE;
3330         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3331                 goto error;
3332
3333         return 0;
3334 error:
3335         b43err(dev->wl, "Failed to validate the chipaccess\n");
3336         return -ENODEV;
3337 }
3338
3339 static void b43_security_init(struct b43_wldev *dev)
3340 {
3341         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3342         /* KTP is a word address, but we address SHM bytewise.
3343          * So multiply by two.
3344          */
3345         dev->ktp *= 2;
3346         /* Number of RCMTA address slots */
3347         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3348         /* Clear the key memory. */
3349         b43_clear_keys(dev);
3350 }
3351
3352 #ifdef CONFIG_B43_HWRNG
3353 static int b43_rng_read(struct hwrng *rng, u32 *data)
3354 {
3355         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3356         struct b43_wldev *dev;
3357         int count = -ENODEV;
3358
3359         mutex_lock(&wl->mutex);
3360         dev = wl->current_dev;
3361         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3362                 *data = b43_read16(dev, B43_MMIO_RNG);
3363                 count = sizeof(u16);
3364         }
3365         mutex_unlock(&wl->mutex);
3366
3367         return count;
3368 }
3369 #endif /* CONFIG_B43_HWRNG */
3370
3371 static void b43_rng_exit(struct b43_wl *wl)
3372 {
3373 #ifdef CONFIG_B43_HWRNG
3374         if (wl->rng_initialized)
3375                 hwrng_unregister(&wl->rng);
3376 #endif /* CONFIG_B43_HWRNG */
3377 }
3378
3379 static int b43_rng_init(struct b43_wl *wl)
3380 {
3381         int err = 0;
3382
3383 #ifdef CONFIG_B43_HWRNG
3384         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3385                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3386         wl->rng.name = wl->rng_name;
3387         wl->rng.data_read = b43_rng_read;
3388         wl->rng.priv = (unsigned long)wl;
3389         wl->rng_initialized = true;
3390         err = hwrng_register(&wl->rng);
3391         if (err) {
3392                 wl->rng_initialized = false;
3393                 b43err(wl, "Failed to register the random "
3394                        "number generator (%d)\n", err);
3395         }
3396 #endif /* CONFIG_B43_HWRNG */
3397
3398         return err;
3399 }
3400
3401 static void b43_tx_work(struct work_struct *work)
3402 {
3403         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3404         struct b43_wldev *dev;
3405         struct sk_buff *skb;
3406         int queue_num;
3407         int err = 0;
3408
3409         mutex_lock(&wl->mutex);
3410         dev = wl->current_dev;
3411         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3412                 mutex_unlock(&wl->mutex);
3413                 return;
3414         }
3415
3416         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3417                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
3418                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
3419                         if (b43_using_pio_transfers(dev))
3420                                 err = b43_pio_tx(dev, skb);
3421                         else
3422                                 err = b43_dma_tx(dev, skb);
3423                         if (err == -ENOSPC) {
3424                                 wl->tx_queue_stopped[queue_num] = 1;
3425                                 ieee80211_stop_queue(wl->hw, queue_num);
3426                                 skb_queue_head(&wl->tx_queue[queue_num], skb);
3427                                 break;
3428                         }
3429                         if (unlikely(err))
3430                                 ieee80211_free_txskb(wl->hw, skb);
3431                         err = 0;
3432                 }
3433
3434                 if (!err)
3435                         wl->tx_queue_stopped[queue_num] = 0;
3436         }
3437
3438 #if B43_DEBUG
3439         dev->tx_count++;
3440 #endif
3441         mutex_unlock(&wl->mutex);
3442 }
3443
3444 static void b43_op_tx(struct ieee80211_hw *hw,
3445                       struct ieee80211_tx_control *control,
3446                       struct sk_buff *skb)
3447 {
3448         struct b43_wl *wl = hw_to_b43_wl(hw);
3449
3450         if (unlikely(skb->len < 2 + 2 + 6)) {
3451                 /* Too short, this can't be a valid frame. */
3452                 ieee80211_free_txskb(hw, skb);
3453                 return;
3454         }
3455         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3456
3457         skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3458         if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3459                 ieee80211_queue_work(wl->hw, &wl->tx_work);
3460         } else {
3461                 ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3462         }
3463 }
3464
3465 static void b43_qos_params_upload(struct b43_wldev *dev,
3466                                   const struct ieee80211_tx_queue_params *p,
3467                                   u16 shm_offset)
3468 {
3469         u16 params[B43_NR_QOSPARAMS];
3470         int bslots, tmp;
3471         unsigned int i;
3472
3473         if (!dev->qos_enabled)
3474                 return;
3475
3476         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3477
3478         memset(&params, 0, sizeof(params));
3479
3480         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3481         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3482         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3483         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3484         params[B43_QOSPARAM_AIFS] = p->aifs;
3485         params[B43_QOSPARAM_BSLOTS] = bslots;
3486         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3487
3488         for (i = 0; i < ARRAY_SIZE(params); i++) {
3489                 if (i == B43_QOSPARAM_STATUS) {
3490                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3491                                              shm_offset + (i * 2));
3492                         /* Mark the parameters as updated. */
3493                         tmp |= 0x100;
3494                         b43_shm_write16(dev, B43_SHM_SHARED,
3495                                         shm_offset + (i * 2),
3496                                         tmp);
3497                 } else {
3498                         b43_shm_write16(dev, B43_SHM_SHARED,
3499                                         shm_offset + (i * 2),
3500                                         params[i]);
3501                 }
3502         }
3503 }
3504
3505 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3506 static const u16 b43_qos_shm_offsets[] = {
3507         /* [mac80211-queue-nr] = SHM_OFFSET, */
3508         [0] = B43_QOS_VOICE,
3509         [1] = B43_QOS_VIDEO,
3510         [2] = B43_QOS_BESTEFFORT,
3511         [3] = B43_QOS_BACKGROUND,
3512 };
3513
3514 /* Update all QOS parameters in hardware. */
3515 static void b43_qos_upload_all(struct b43_wldev *dev)
3516 {
3517         struct b43_wl *wl = dev->wl;
3518         struct b43_qos_params *params;
3519         unsigned int i;
3520
3521         if (!dev->qos_enabled)
3522                 return;
3523
3524         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3525                      ARRAY_SIZE(wl->qos_params));
3526
3527         b43_mac_suspend(dev);
3528         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3529                 params = &(wl->qos_params[i]);
3530                 b43_qos_params_upload(dev, &(params->p),
3531                                       b43_qos_shm_offsets[i]);
3532         }
3533         b43_mac_enable(dev);
3534 }
3535
3536 static void b43_qos_clear(struct b43_wl *wl)
3537 {
3538         struct b43_qos_params *params;
3539         unsigned int i;
3540
3541         /* Initialize QoS parameters to sane defaults. */
3542
3543         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3544                      ARRAY_SIZE(wl->qos_params));
3545
3546         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3547                 params = &(wl->qos_params[i]);
3548
3549                 switch (b43_qos_shm_offsets[i]) {
3550                 case B43_QOS_VOICE:
3551                         params->p.txop = 0;
3552                         params->p.aifs = 2;
3553                         params->p.cw_min = 0x0001;
3554                         params->p.cw_max = 0x0001;
3555                         break;
3556                 case B43_QOS_VIDEO:
3557                         params->p.txop = 0;
3558                         params->p.aifs = 2;
3559                         params->p.cw_min = 0x0001;
3560                         params->p.cw_max = 0x0001;
3561                         break;
3562                 case B43_QOS_BESTEFFORT:
3563                         params->p.txop = 0;
3564                         params->p.aifs = 3;
3565                         params->p.cw_min = 0x0001;
3566                         params->p.cw_max = 0x03FF;
3567                         break;
3568                 case B43_QOS_BACKGROUND:
3569                         params->p.txop = 0;
3570                         params->p.aifs = 7;
3571                         params->p.cw_min = 0x0001;
3572                         params->p.cw_max = 0x03FF;
3573                         break;
3574                 default:
3575                         B43_WARN_ON(1);
3576                 }
3577         }
3578 }
3579
3580 /* Initialize the core's QOS capabilities */
3581 static void b43_qos_init(struct b43_wldev *dev)
3582 {
3583         if (!dev->qos_enabled) {
3584                 /* Disable QOS support. */
3585                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3586                 b43_write16(dev, B43_MMIO_IFSCTL,
3587                             b43_read16(dev, B43_MMIO_IFSCTL)
3588                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3589                 b43dbg(dev->wl, "QoS disabled\n");
3590                 return;
3591         }
3592
3593         /* Upload the current QOS parameters. */
3594         b43_qos_upload_all(dev);
3595
3596         /* Enable QOS support. */
3597         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3598         b43_write16(dev, B43_MMIO_IFSCTL,
3599                     b43_read16(dev, B43_MMIO_IFSCTL)
3600                     | B43_MMIO_IFSCTL_USE_EDCF);
3601         b43dbg(dev->wl, "QoS enabled\n");
3602 }
3603
3604 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3605                           struct ieee80211_vif *vif, u16 _queue,
3606                           const struct ieee80211_tx_queue_params *params)
3607 {
3608         struct b43_wl *wl = hw_to_b43_wl(hw);
3609         struct b43_wldev *dev;
3610         unsigned int queue = (unsigned int)_queue;
3611         int err = -ENODEV;
3612
3613         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3614                 /* Queue not available or don't support setting
3615                  * params on this queue. Return success to not
3616                  * confuse mac80211. */
3617                 return 0;
3618         }
3619         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3620                      ARRAY_SIZE(wl->qos_params));
3621
3622         mutex_lock(&wl->mutex);
3623         dev = wl->current_dev;
3624         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3625                 goto out_unlock;
3626
3627         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3628         b43_mac_suspend(dev);
3629         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3630                               b43_qos_shm_offsets[queue]);
3631         b43_mac_enable(dev);
3632         err = 0;
3633
3634 out_unlock:
3635         mutex_unlock(&wl->mutex);
3636
3637         return err;
3638 }
3639
3640 static int b43_op_get_stats(struct ieee80211_hw *hw,
3641                             struct ieee80211_low_level_stats *stats)
3642 {
3643         struct b43_wl *wl = hw_to_b43_wl(hw);
3644
3645         mutex_lock(&wl->mutex);
3646         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3647         mutex_unlock(&wl->mutex);
3648
3649         return 0;
3650 }
3651
3652 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3653 {
3654         struct b43_wl *wl = hw_to_b43_wl(hw);
3655         struct b43_wldev *dev;
3656         u64 tsf;
3657
3658         mutex_lock(&wl->mutex);
3659         dev = wl->current_dev;
3660
3661         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3662                 b43_tsf_read(dev, &tsf);
3663         else
3664                 tsf = 0;
3665
3666         mutex_unlock(&wl->mutex);
3667
3668         return tsf;
3669 }
3670
3671 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3672                            struct ieee80211_vif *vif, u64 tsf)
3673 {
3674         struct b43_wl *wl = hw_to_b43_wl(hw);
3675         struct b43_wldev *dev;
3676
3677         mutex_lock(&wl->mutex);
3678         dev = wl->current_dev;
3679
3680         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3681                 b43_tsf_write(dev, tsf);
3682
3683         mutex_unlock(&wl->mutex);
3684 }
3685
3686 static const char *band_to_string(enum ieee80211_band band)
3687 {
3688         switch (band) {
3689         case IEEE80211_BAND_5GHZ:
3690                 return "5";
3691         case IEEE80211_BAND_2GHZ:
3692                 return "2.4";
3693         default:
3694                 break;
3695         }
3696         B43_WARN_ON(1);
3697         return "";
3698 }
3699
3700 /* Expects wl->mutex locked */
3701 static int b43_switch_band(struct b43_wldev *dev,
3702                            struct ieee80211_channel *chan)
3703 {
3704         struct b43_phy *phy = &dev->phy;
3705         bool gmode;
3706         u32 tmp;
3707
3708         switch (chan->band) {
3709         case IEEE80211_BAND_5GHZ:
3710                 gmode = false;
3711                 break;
3712         case IEEE80211_BAND_2GHZ:
3713                 gmode = true;
3714                 break;
3715         default:
3716                 B43_WARN_ON(1);
3717                 return -EINVAL;
3718         }
3719
3720         if (!((gmode && phy->supports_2ghz) ||
3721               (!gmode && phy->supports_5ghz))) {
3722                 b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3723                        band_to_string(chan->band));
3724                 return -ENODEV;
3725         }
3726
3727         if (!!phy->gmode == !!gmode) {
3728                 /* This device is already running. */
3729                 return 0;
3730         }
3731
3732         b43dbg(dev->wl, "Switching to %s GHz band\n",
3733                band_to_string(chan->band));
3734
3735         b43_software_rfkill(dev, true);
3736
3737         phy->gmode = gmode;
3738         b43_phy_put_into_reset(dev);
3739         switch (dev->dev->bus_type) {
3740 #ifdef CONFIG_B43_BCMA
3741         case B43_BUS_BCMA:
3742                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3743                 if (gmode)
3744                         tmp |= B43_BCMA_IOCTL_GMODE;
3745                 else
3746                         tmp &= ~B43_BCMA_IOCTL_GMODE;
3747                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3748                 break;
3749 #endif
3750 #ifdef CONFIG_B43_SSB
3751         case B43_BUS_SSB:
3752                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3753                 if (gmode)
3754                         tmp |= B43_TMSLOW_GMODE;
3755                 else
3756                         tmp &= ~B43_TMSLOW_GMODE;
3757                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3758                 break;
3759 #endif
3760         }
3761         b43_phy_take_out_of_reset(dev);
3762
3763         b43_upload_initvals_band(dev);
3764
3765         b43_phy_init(dev);
3766
3767         return 0;
3768 }
3769
3770 /* Write the short and long frame retry limit values. */
3771 static void b43_set_retry_limits(struct b43_wldev *dev,
3772                                  unsigned int short_retry,
3773                                  unsigned int long_retry)
3774 {
3775         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3776          * the chip-internal counter. */
3777         short_retry = min(short_retry, (unsigned int)0xF);
3778         long_retry = min(long_retry, (unsigned int)0xF);
3779
3780         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3781                         short_retry);
3782         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3783                         long_retry);
3784 }
3785
3786 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3787 {
3788         struct b43_wl *wl = hw_to_b43_wl(hw);
3789         struct b43_wldev *dev;
3790         struct b43_phy *phy;
3791         struct ieee80211_conf *conf = &hw->conf;
3792         int antenna;
3793         int err = 0;
3794         bool reload_bss = false;
3795
3796         mutex_lock(&wl->mutex);
3797
3798         dev = wl->current_dev;
3799
3800         b43_mac_suspend(dev);
3801
3802         /* Switch the band (if necessary). This might change the active core. */
3803         err = b43_switch_band(dev, conf->chandef.chan);
3804         if (err)
3805                 goto out_unlock_mutex;
3806
3807         /* Need to reload all settings if the core changed */
3808         if (dev != wl->current_dev) {
3809                 dev = wl->current_dev;
3810                 changed = ~0;
3811                 reload_bss = true;
3812         }
3813
3814         phy = &dev->phy;
3815
3816         if (conf_is_ht(conf))
3817                 phy->is_40mhz =
3818                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3819         else
3820                 phy->is_40mhz = false;
3821
3822         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3823                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3824                                           conf->long_frame_max_tx_count);
3825         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3826         if (!changed)
3827                 goto out_mac_enable;
3828
3829         /* Switch to the requested channel.
3830          * The firmware takes care of races with the TX handler. */
3831         if (conf->chandef.chan->hw_value != phy->channel)
3832                 b43_switch_channel(dev, conf->chandef.chan->hw_value);
3833
3834         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3835
3836         /* Adjust the desired TX power level. */
3837         if (conf->power_level != 0) {
3838                 if (conf->power_level != phy->desired_txpower) {
3839                         phy->desired_txpower = conf->power_level;
3840                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3841                                                    B43_TXPWR_IGNORE_TSSI);
3842                 }
3843         }
3844
3845         /* Antennas for RX and management frame TX. */
3846         antenna = B43_ANTENNA_DEFAULT;
3847         b43_mgmtframe_txantenna(dev, antenna);
3848         antenna = B43_ANTENNA_DEFAULT;
3849         if (phy->ops->set_rx_antenna)
3850                 phy->ops->set_rx_antenna(dev, antenna);
3851
3852         if (wl->radio_enabled != phy->radio_on) {
3853                 if (wl->radio_enabled) {
3854                         b43_software_rfkill(dev, false);
3855                         b43info(dev->wl, "Radio turned on by software\n");
3856                         if (!dev->radio_hw_enable) {
3857                                 b43info(dev->wl, "The hardware RF-kill button "
3858                                         "still turns the radio physically off. "
3859                                         "Press the button to turn it on.\n");
3860                         }
3861                 } else {
3862                         b43_software_rfkill(dev, true);
3863                         b43info(dev->wl, "Radio turned off by software\n");
3864                 }
3865         }
3866
3867 out_mac_enable:
3868         b43_mac_enable(dev);
3869 out_unlock_mutex:
3870         mutex_unlock(&wl->mutex);
3871
3872         if (wl->vif && reload_bss)
3873                 b43_op_bss_info_changed(hw, wl->vif, &wl->vif->bss_conf, ~0);
3874
3875         return err;
3876 }
3877
3878 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3879 {
3880         struct ieee80211_supported_band *sband =
3881                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3882         struct ieee80211_rate *rate;
3883         int i;
3884         u16 basic, direct, offset, basic_offset, rateptr;
3885
3886         for (i = 0; i < sband->n_bitrates; i++) {
3887                 rate = &sband->bitrates[i];
3888
3889                 if (b43_is_cck_rate(rate->hw_value)) {
3890                         direct = B43_SHM_SH_CCKDIRECT;
3891                         basic = B43_SHM_SH_CCKBASIC;
3892                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3893                         offset &= 0xF;
3894                 } else {
3895                         direct = B43_SHM_SH_OFDMDIRECT;
3896                         basic = B43_SHM_SH_OFDMBASIC;
3897                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3898                         offset &= 0xF;
3899                 }
3900
3901                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3902
3903                 if (b43_is_cck_rate(rate->hw_value)) {
3904                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3905                         basic_offset &= 0xF;
3906                 } else {
3907                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3908                         basic_offset &= 0xF;
3909                 }
3910
3911                 /*
3912                  * Get the pointer that we need to point to
3913                  * from the direct map
3914                  */
3915                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3916                                          direct + 2 * basic_offset);
3917                 /* and write it to the basic map */
3918                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3919                                 rateptr);
3920         }
3921 }
3922
3923 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3924                                     struct ieee80211_vif *vif,
3925                                     struct ieee80211_bss_conf *conf,
3926                                     u32 changed)
3927 {
3928         struct b43_wl *wl = hw_to_b43_wl(hw);
3929         struct b43_wldev *dev;
3930
3931         mutex_lock(&wl->mutex);
3932
3933         dev = wl->current_dev;
3934         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3935                 goto out_unlock_mutex;
3936
3937         B43_WARN_ON(wl->vif != vif);
3938
3939         if (changed & BSS_CHANGED_BSSID) {
3940                 if (conf->bssid)
3941                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3942                 else
3943                         memset(wl->bssid, 0, ETH_ALEN);
3944         }
3945
3946         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3947                 if (changed & BSS_CHANGED_BEACON &&
3948                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3949                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3950                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3951                         b43_update_templates(wl);
3952
3953                 if (changed & BSS_CHANGED_BSSID)
3954                         b43_write_mac_bssid_templates(dev);
3955         }
3956
3957         b43_mac_suspend(dev);
3958
3959         /* Update templates for AP/mesh mode. */
3960         if (changed & BSS_CHANGED_BEACON_INT &&
3961             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3962              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3963              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
3964             conf->beacon_int)
3965                 b43_set_beacon_int(dev, conf->beacon_int);
3966
3967         if (changed & BSS_CHANGED_BASIC_RATES)
3968                 b43_update_basic_rates(dev, conf->basic_rates);
3969
3970         if (changed & BSS_CHANGED_ERP_SLOT) {
3971                 if (conf->use_short_slot)
3972                         b43_short_slot_timing_enable(dev);
3973                 else
3974                         b43_short_slot_timing_disable(dev);
3975         }
3976
3977         b43_mac_enable(dev);
3978 out_unlock_mutex:
3979         mutex_unlock(&wl->mutex);
3980 }
3981
3982 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3983                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3984                           struct ieee80211_key_conf *key)
3985 {
3986         struct b43_wl *wl = hw_to_b43_wl(hw);
3987         struct b43_wldev *dev;
3988         u8 algorithm;
3989         u8 index;
3990         int err;
3991         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3992
3993         if (modparam_nohwcrypt)
3994                 return -ENOSPC; /* User disabled HW-crypto */
3995
3996         if ((vif->type == NL80211_IFTYPE_ADHOC ||
3997              vif->type == NL80211_IFTYPE_MESH_POINT) &&
3998             (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
3999              key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4000             !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4001                 /*
4002                  * For now, disable hw crypto for the RSN IBSS group keys. This
4003                  * could be optimized in the future, but until that gets
4004                  * implemented, use of software crypto for group addressed
4005                  * frames is a acceptable to allow RSN IBSS to be used.
4006                  */
4007                 return -EOPNOTSUPP;
4008         }
4009
4010         mutex_lock(&wl->mutex);
4011
4012         dev = wl->current_dev;
4013         err = -ENODEV;
4014         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4015                 goto out_unlock;
4016
4017         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4018                 /* We don't have firmware for the crypto engine.
4019                  * Must use software-crypto. */
4020                 err = -EOPNOTSUPP;
4021                 goto out_unlock;
4022         }
4023
4024         err = -EINVAL;
4025         switch (key->cipher) {
4026         case WLAN_CIPHER_SUITE_WEP40:
4027                 algorithm = B43_SEC_ALGO_WEP40;
4028                 break;
4029         case WLAN_CIPHER_SUITE_WEP104:
4030                 algorithm = B43_SEC_ALGO_WEP104;
4031                 break;
4032         case WLAN_CIPHER_SUITE_TKIP:
4033                 algorithm = B43_SEC_ALGO_TKIP;
4034                 break;
4035         case WLAN_CIPHER_SUITE_CCMP:
4036                 algorithm = B43_SEC_ALGO_AES;
4037                 break;
4038         default:
4039                 B43_WARN_ON(1);
4040                 goto out_unlock;
4041         }
4042         index = (u8) (key->keyidx);
4043         if (index > 3)
4044                 goto out_unlock;
4045
4046         switch (cmd) {
4047         case SET_KEY:
4048                 if (algorithm == B43_SEC_ALGO_TKIP &&
4049                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4050                     !modparam_hwtkip)) {
4051                         /* We support only pairwise key */
4052                         err = -EOPNOTSUPP;
4053                         goto out_unlock;
4054                 }
4055
4056                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4057                         if (WARN_ON(!sta)) {
4058                                 err = -EOPNOTSUPP;
4059                                 goto out_unlock;
4060                         }
4061                         /* Pairwise key with an assigned MAC address. */
4062                         err = b43_key_write(dev, -1, algorithm,
4063                                             key->key, key->keylen,
4064                                             sta->addr, key);
4065                 } else {
4066                         /* Group key */
4067                         err = b43_key_write(dev, index, algorithm,
4068                                             key->key, key->keylen, NULL, key);
4069                 }
4070                 if (err)
4071                         goto out_unlock;
4072
4073                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4074                     algorithm == B43_SEC_ALGO_WEP104) {
4075                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4076                 } else {
4077                         b43_hf_write(dev,
4078                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4079                 }
4080                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4081                 if (algorithm == B43_SEC_ALGO_TKIP)
4082                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4083                 break;
4084         case DISABLE_KEY: {
4085                 err = b43_key_clear(dev, key->hw_key_idx);
4086                 if (err)
4087                         goto out_unlock;
4088                 break;
4089         }
4090         default:
4091                 B43_WARN_ON(1);
4092         }
4093
4094 out_unlock:
4095         if (!err) {
4096                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4097                        "mac: %pM\n",
4098                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4099                        sta ? sta->addr : bcast_addr);
4100                 b43_dump_keymemory(dev);
4101         }
4102         mutex_unlock(&wl->mutex);
4103
4104         return err;
4105 }
4106
4107 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4108                                     unsigned int changed, unsigned int *fflags,
4109                                     u64 multicast)
4110 {
4111         struct b43_wl *wl = hw_to_b43_wl(hw);
4112         struct b43_wldev *dev;
4113
4114         mutex_lock(&wl->mutex);
4115         dev = wl->current_dev;
4116         if (!dev) {
4117                 *fflags = 0;
4118                 goto out_unlock;
4119         }
4120
4121         *fflags &= FIF_PROMISC_IN_BSS |
4122                   FIF_ALLMULTI |
4123                   FIF_FCSFAIL |
4124                   FIF_PLCPFAIL |
4125                   FIF_CONTROL |
4126                   FIF_OTHER_BSS |
4127                   FIF_BCN_PRBRESP_PROMISC;
4128
4129         changed &= FIF_PROMISC_IN_BSS |
4130                    FIF_ALLMULTI |
4131                    FIF_FCSFAIL |
4132                    FIF_PLCPFAIL |
4133                    FIF_CONTROL |
4134                    FIF_OTHER_BSS |
4135                    FIF_BCN_PRBRESP_PROMISC;
4136
4137         wl->filter_flags = *fflags;
4138
4139         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4140                 b43_adjust_opmode(dev);
4141
4142 out_unlock:
4143         mutex_unlock(&wl->mutex);
4144 }
4145
4146 /* Locking: wl->mutex
4147  * Returns the current dev. This might be different from the passed in dev,
4148  * because the core might be gone away while we unlocked the mutex. */
4149 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4150 {
4151         struct b43_wl *wl;
4152         struct b43_wldev *orig_dev;
4153         u32 mask;
4154         int queue_num;
4155
4156         if (!dev)
4157                 return NULL;
4158         wl = dev->wl;
4159 redo:
4160         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4161                 return dev;
4162
4163         /* Cancel work. Unlock to avoid deadlocks. */
4164         mutex_unlock(&wl->mutex);
4165         cancel_delayed_work_sync(&dev->periodic_work);
4166         cancel_work_sync(&wl->tx_work);
4167         mutex_lock(&wl->mutex);
4168         dev = wl->current_dev;
4169         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4170                 /* Whoops, aliens ate up the device while we were unlocked. */
4171                 return dev;
4172         }
4173
4174         /* Disable interrupts on the device. */
4175         b43_set_status(dev, B43_STAT_INITIALIZED);
4176         if (b43_bus_host_is_sdio(dev->dev)) {
4177                 /* wl->mutex is locked. That is enough. */
4178                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4179                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4180         } else {
4181                 spin_lock_irq(&wl->hardirq_lock);
4182                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4183                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4184                 spin_unlock_irq(&wl->hardirq_lock);
4185         }
4186         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4187         orig_dev = dev;
4188         mutex_unlock(&wl->mutex);
4189         if (b43_bus_host_is_sdio(dev->dev)) {
4190                 b43_sdio_free_irq(dev);
4191         } else {
4192                 synchronize_irq(dev->dev->irq);
4193                 free_irq(dev->dev->irq, dev);
4194         }
4195         mutex_lock(&wl->mutex);
4196         dev = wl->current_dev;
4197         if (!dev)
4198                 return dev;
4199         if (dev != orig_dev) {
4200                 if (b43_status(dev) >= B43_STAT_STARTED)
4201                         goto redo;
4202                 return dev;
4203         }
4204         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4205         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4206
4207         /* Drain all TX queues. */
4208         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4209                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
4210                         struct sk_buff *skb;
4211
4212                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
4213                         ieee80211_free_txskb(wl->hw, skb);
4214                 }
4215         }
4216
4217         b43_mac_suspend(dev);
4218         b43_leds_exit(dev);
4219         b43dbg(wl, "Wireless interface stopped\n");
4220
4221         return dev;
4222 }
4223
4224 /* Locking: wl->mutex */
4225 static int b43_wireless_core_start(struct b43_wldev *dev)
4226 {
4227         int err;
4228
4229         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4230
4231         drain_txstatus_queue(dev);
4232         if (b43_bus_host_is_sdio(dev->dev)) {
4233                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4234                 if (err) {
4235                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4236                         goto out;
4237                 }
4238         } else {
4239                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4240                                            b43_interrupt_thread_handler,
4241                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4242                 if (err) {
4243                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4244                                dev->dev->irq);
4245                         goto out;
4246                 }
4247         }
4248
4249         /* We are ready to run. */
4250         ieee80211_wake_queues(dev->wl->hw);
4251         b43_set_status(dev, B43_STAT_STARTED);
4252
4253         /* Start data flow (TX/RX). */
4254         b43_mac_enable(dev);
4255         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4256
4257         /* Start maintenance work */
4258         b43_periodic_tasks_setup(dev);
4259
4260         b43_leds_init(dev);
4261
4262         b43dbg(dev->wl, "Wireless interface started\n");
4263 out:
4264         return err;
4265 }
4266
4267 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4268 {
4269         switch (phy_type) {
4270         case B43_PHYTYPE_A:
4271                 return "A";
4272         case B43_PHYTYPE_B:
4273                 return "B";
4274         case B43_PHYTYPE_G:
4275                 return "G";
4276         case B43_PHYTYPE_N:
4277                 return "N";
4278         case B43_PHYTYPE_LP:
4279                 return "LP";
4280         case B43_PHYTYPE_SSLPN:
4281                 return "SSLPN";
4282         case B43_PHYTYPE_HT:
4283                 return "HT";
4284         case B43_PHYTYPE_LCN:
4285                 return "LCN";
4286         case B43_PHYTYPE_LCNXN:
4287                 return "LCNXN";
4288         case B43_PHYTYPE_LCN40:
4289                 return "LCN40";
4290         case B43_PHYTYPE_AC:
4291                 return "AC";
4292         }
4293         return "UNKNOWN";
4294 }
4295
4296 /* Get PHY and RADIO versioning numbers */
4297 static int b43_phy_versioning(struct b43_wldev *dev)
4298 {
4299         struct b43_phy *phy = &dev->phy;
4300         u32 tmp;
4301         u8 analog_type;
4302         u8 phy_type;
4303         u8 phy_rev;
4304         u16 radio_manuf;
4305         u16 radio_ver;
4306         u16 radio_rev;
4307         int unsupported = 0;
4308
4309         /* Get PHY versioning */
4310         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4311         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4312         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4313         phy_rev = (tmp & B43_PHYVER_VERSION);
4314         switch (phy_type) {
4315         case B43_PHYTYPE_A:
4316                 if (phy_rev >= 4)
4317                         unsupported = 1;
4318                 break;
4319         case B43_PHYTYPE_B:
4320                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4321                     && phy_rev != 7)
4322                         unsupported = 1;
4323                 break;
4324         case B43_PHYTYPE_G:
4325                 if (phy_rev > 9)
4326                         unsupported = 1;
4327                 break;
4328 #ifdef CONFIG_B43_PHY_N
4329         case B43_PHYTYPE_N:
4330                 if (phy_rev > 9)
4331                         unsupported = 1;
4332                 break;
4333 #endif
4334 #ifdef CONFIG_B43_PHY_LP
4335         case B43_PHYTYPE_LP:
4336                 if (phy_rev > 2)
4337                         unsupported = 1;
4338                 break;
4339 #endif
4340 #ifdef CONFIG_B43_PHY_HT
4341         case B43_PHYTYPE_HT:
4342                 if (phy_rev > 1)
4343                         unsupported = 1;
4344                 break;
4345 #endif
4346 #ifdef CONFIG_B43_PHY_LCN
4347         case B43_PHYTYPE_LCN:
4348                 if (phy_rev > 1)
4349                         unsupported = 1;
4350                 break;
4351 #endif
4352         default:
4353                 unsupported = 1;
4354         }
4355         if (unsupported) {
4356                 b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4357                        analog_type, phy_type, b43_phy_name(dev, phy_type),
4358                        phy_rev);
4359                 return -EOPNOTSUPP;
4360         }
4361         b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4362                 analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4363
4364         /* Get RADIO versioning */
4365         if (dev->dev->core_rev >= 24) {
4366                 u16 radio24[3];
4367
4368                 for (tmp = 0; tmp < 3; tmp++) {
4369                         b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4370                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4371                 }
4372
4373                 /* Broadcom uses "id" for our "ver" and has separated "ver" */
4374                 /* radio_ver = (radio24[0] & 0xF0) >> 4; */
4375
4376                 radio_manuf = 0x17F;
4377                 radio_ver = (radio24[2] << 8) | radio24[1];
4378                 radio_rev = (radio24[0] & 0xF);
4379         } else {
4380                 if (dev->dev->chip_id == 0x4317) {
4381                         if (dev->dev->chip_rev == 0)
4382                                 tmp = 0x3205017F;
4383                         else if (dev->dev->chip_rev == 1)
4384                                 tmp = 0x4205017F;
4385                         else
4386                                 tmp = 0x5205017F;
4387                 } else {
4388                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4389                                     B43_RADIOCTL_ID);
4390                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4391                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4392                                     B43_RADIOCTL_ID);
4393                         tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4394                                 << 16;
4395                 }
4396                 radio_manuf = (tmp & 0x00000FFF);
4397                 radio_ver = (tmp & 0x0FFFF000) >> 12;
4398                 radio_rev = (tmp & 0xF0000000) >> 28;
4399         }
4400
4401         if (radio_manuf != 0x17F /* Broadcom */)
4402                 unsupported = 1;
4403         switch (phy_type) {
4404         case B43_PHYTYPE_A:
4405                 if (radio_ver != 0x2060)
4406                         unsupported = 1;
4407                 if (radio_rev != 1)
4408                         unsupported = 1;
4409                 if (radio_manuf != 0x17F)
4410                         unsupported = 1;
4411                 break;
4412         case B43_PHYTYPE_B:
4413                 if ((radio_ver & 0xFFF0) != 0x2050)
4414                         unsupported = 1;
4415                 break;
4416         case B43_PHYTYPE_G:
4417                 if (radio_ver != 0x2050)
4418                         unsupported = 1;
4419                 break;
4420         case B43_PHYTYPE_N:
4421                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4422                         unsupported = 1;
4423                 break;
4424         case B43_PHYTYPE_LP:
4425                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4426                         unsupported = 1;
4427                 break;
4428         case B43_PHYTYPE_HT:
4429                 if (radio_ver != 0x2059)
4430                         unsupported = 1;
4431                 break;
4432         case B43_PHYTYPE_LCN:
4433                 if (radio_ver != 0x2064)
4434                         unsupported = 1;
4435                 break;
4436         default:
4437                 B43_WARN_ON(1);
4438         }
4439         if (unsupported) {
4440                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4441                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4442                        radio_manuf, radio_ver, radio_rev);
4443                 return -EOPNOTSUPP;
4444         }
4445         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4446                radio_manuf, radio_ver, radio_rev);
4447
4448         phy->radio_manuf = radio_manuf;
4449         phy->radio_ver = radio_ver;
4450         phy->radio_rev = radio_rev;
4451
4452         phy->analog = analog_type;
4453         phy->type = phy_type;
4454         phy->rev = phy_rev;
4455
4456         return 0;
4457 }
4458
4459 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4460                                       struct b43_phy *phy)
4461 {
4462         phy->hardware_power_control = !!modparam_hwpctl;
4463         phy->next_txpwr_check_time = jiffies;
4464         /* PHY TX errors counter. */
4465         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4466
4467 #if B43_DEBUG
4468         phy->phy_locked = false;
4469         phy->radio_locked = false;
4470 #endif
4471 }
4472
4473 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4474 {
4475         dev->dfq_valid = false;
4476
4477         /* Assume the radio is enabled. If it's not enabled, the state will
4478          * immediately get fixed on the first periodic work run. */
4479         dev->radio_hw_enable = true;
4480
4481         /* Stats */
4482         memset(&dev->stats, 0, sizeof(dev->stats));
4483
4484         setup_struct_phy_for_init(dev, &dev->phy);
4485
4486         /* IRQ related flags */
4487         dev->irq_reason = 0;
4488         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4489         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4490         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4491                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4492
4493         dev->mac_suspended = 1;
4494
4495         /* Noise calculation context */
4496         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4497 }
4498
4499 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4500 {
4501         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4502         u64 hf;
4503
4504         if (!modparam_btcoex)
4505                 return;
4506         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4507                 return;
4508         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4509                 return;
4510
4511         hf = b43_hf_read(dev);
4512         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4513                 hf |= B43_HF_BTCOEXALT;
4514         else
4515                 hf |= B43_HF_BTCOEX;
4516         b43_hf_write(dev, hf);
4517 }
4518
4519 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4520 {
4521         if (!modparam_btcoex)
4522                 return;
4523         //TODO
4524 }
4525
4526 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4527 {
4528         struct ssb_bus *bus;
4529         u32 tmp;
4530
4531 #ifdef CONFIG_B43_SSB
4532         if (dev->dev->bus_type != B43_BUS_SSB)
4533                 return;
4534 #else
4535         return;
4536 #endif
4537
4538         bus = dev->dev->sdev->bus;
4539
4540         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4541             (bus->chip_id == 0x4312)) {
4542                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4543                 tmp &= ~SSB_IMCFGLO_REQTO;
4544                 tmp &= ~SSB_IMCFGLO_SERTO;
4545                 tmp |= 0x3;
4546                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4547                 ssb_commit_settings(bus);
4548         }
4549 }
4550
4551 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4552 {
4553         u16 pu_delay;
4554
4555         /* The time value is in microseconds. */
4556         if (dev->phy.type == B43_PHYTYPE_A)
4557                 pu_delay = 3700;
4558         else
4559                 pu_delay = 1050;
4560         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4561                 pu_delay = 500;
4562         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4563                 pu_delay = max(pu_delay, (u16)2400);
4564
4565         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4566 }
4567
4568 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4569 static void b43_set_pretbtt(struct b43_wldev *dev)
4570 {
4571         u16 pretbtt;
4572
4573         /* The time value is in microseconds. */
4574         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4575                 pretbtt = 2;
4576         } else {
4577                 if (dev->phy.type == B43_PHYTYPE_A)
4578                         pretbtt = 120;
4579                 else
4580                         pretbtt = 250;
4581         }
4582         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4583         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4584 }
4585
4586 /* Shutdown a wireless core */
4587 /* Locking: wl->mutex */
4588 static void b43_wireless_core_exit(struct b43_wldev *dev)
4589 {
4590         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4591         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4592                 return;
4593
4594         b43_set_status(dev, B43_STAT_UNINIT);
4595
4596         /* Stop the microcode PSM. */
4597         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4598                       B43_MACCTL_PSM_JMP0);
4599
4600         switch (dev->dev->bus_type) {
4601 #ifdef CONFIG_B43_BCMA
4602         case B43_BUS_BCMA:
4603                 bcma_core_pci_down(dev->dev->bdev->bus);
4604                 break;
4605 #endif
4606 #ifdef CONFIG_B43_SSB
4607         case B43_BUS_SSB:
4608                 /* TODO */
4609                 break;
4610 #endif
4611         }
4612
4613         b43_dma_free(dev);
4614         b43_pio_free(dev);
4615         b43_chip_exit(dev);
4616         dev->phy.ops->switch_analog(dev, 0);
4617         if (dev->wl->current_beacon) {
4618                 dev_kfree_skb_any(dev->wl->current_beacon);
4619                 dev->wl->current_beacon = NULL;
4620         }
4621
4622         b43_device_disable(dev, 0);
4623         b43_bus_may_powerdown(dev);
4624 }
4625
4626 /* Initialize a wireless core */
4627 static int b43_wireless_core_init(struct b43_wldev *dev)
4628 {
4629         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4630         struct b43_phy *phy = &dev->phy;
4631         int err;
4632         u64 hf;
4633
4634         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4635
4636         err = b43_bus_powerup(dev, 0);
4637         if (err)
4638                 goto out;
4639         if (!b43_device_is_enabled(dev))
4640                 b43_wireless_core_reset(dev, phy->gmode);
4641
4642         /* Reset all data structures. */
4643         setup_struct_wldev_for_init(dev);
4644         phy->ops->prepare_structs(dev);
4645
4646         /* Enable IRQ routing to this device. */
4647         switch (dev->dev->bus_type) {
4648 #ifdef CONFIG_B43_BCMA
4649         case B43_BUS_BCMA:
4650                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci[0],
4651                                       dev->dev->bdev, true);
4652                 bcma_core_pci_up(dev->dev->bdev->bus);
4653                 break;
4654 #endif
4655 #ifdef CONFIG_B43_SSB
4656         case B43_BUS_SSB:
4657                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4658                                                dev->dev->sdev);
4659                 break;
4660 #endif
4661         }
4662
4663         b43_imcfglo_timeouts_workaround(dev);
4664         b43_bluetooth_coext_disable(dev);
4665         if (phy->ops->prepare_hardware) {
4666                 err = phy->ops->prepare_hardware(dev);
4667                 if (err)
4668                         goto err_busdown;
4669         }
4670         err = b43_chip_init(dev);
4671         if (err)
4672                 goto err_busdown;
4673         b43_shm_write16(dev, B43_SHM_SHARED,
4674                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4675         hf = b43_hf_read(dev);
4676         if (phy->type == B43_PHYTYPE_G) {
4677                 hf |= B43_HF_SYMW;
4678                 if (phy->rev == 1)
4679                         hf |= B43_HF_GDCW;
4680                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4681                         hf |= B43_HF_OFDMPABOOST;
4682         }
4683         if (phy->radio_ver == 0x2050) {
4684                 if (phy->radio_rev == 6)
4685                         hf |= B43_HF_4318TSSI;
4686                 if (phy->radio_rev < 6)
4687                         hf |= B43_HF_VCORECALC;
4688         }
4689         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4690                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4691 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4692         if (dev->dev->bus_type == B43_BUS_SSB &&
4693             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4694             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4695                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4696 #endif
4697         hf &= ~B43_HF_SKCFPUP;
4698         b43_hf_write(dev, hf);
4699
4700         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4701                              B43_DEFAULT_LONG_RETRY_LIMIT);
4702         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4703         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4704
4705         /* Disable sending probe responses from firmware.
4706          * Setting the MaxTime to one usec will always trigger
4707          * a timeout, so we never send any probe resp.
4708          * A timeout of zero is infinite. */
4709         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4710
4711         b43_rate_memory_init(dev);
4712         b43_set_phytxctl_defaults(dev);
4713
4714         /* Minimum Contention Window */
4715         if (phy->type == B43_PHYTYPE_B)
4716                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4717         else
4718                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4719         /* Maximum Contention Window */
4720         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4721
4722         if (b43_bus_host_is_pcmcia(dev->dev) ||
4723             b43_bus_host_is_sdio(dev->dev)) {
4724                 dev->__using_pio_transfers = true;
4725                 err = b43_pio_init(dev);
4726         } else if (dev->use_pio) {
4727                 b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4728                         "This should not be needed and will result in lower "
4729                         "performance.\n");
4730                 dev->__using_pio_transfers = true;
4731                 err = b43_pio_init(dev);
4732         } else {
4733                 dev->__using_pio_transfers = false;
4734                 err = b43_dma_init(dev);
4735         }
4736         if (err)
4737                 goto err_chip_exit;
4738         b43_qos_init(dev);
4739         b43_set_synth_pu_delay(dev, 1);
4740         b43_bluetooth_coext_enable(dev);
4741
4742         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4743         b43_upload_card_macaddress(dev);
4744         b43_security_init(dev);
4745
4746         ieee80211_wake_queues(dev->wl->hw);
4747
4748         b43_set_status(dev, B43_STAT_INITIALIZED);
4749
4750 out:
4751         return err;
4752
4753 err_chip_exit:
4754         b43_chip_exit(dev);
4755 err_busdown:
4756         b43_bus_may_powerdown(dev);
4757         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4758         return err;
4759 }
4760
4761 static int b43_op_add_interface(struct ieee80211_hw *hw,
4762                                 struct ieee80211_vif *vif)
4763 {
4764         struct b43_wl *wl = hw_to_b43_wl(hw);
4765         struct b43_wldev *dev;
4766         int err = -EOPNOTSUPP;
4767
4768         /* TODO: allow WDS/AP devices to coexist */
4769
4770         if (vif->type != NL80211_IFTYPE_AP &&
4771             vif->type != NL80211_IFTYPE_MESH_POINT &&
4772             vif->type != NL80211_IFTYPE_STATION &&
4773             vif->type != NL80211_IFTYPE_WDS &&
4774             vif->type != NL80211_IFTYPE_ADHOC)
4775                 return -EOPNOTSUPP;
4776
4777         mutex_lock(&wl->mutex);
4778         if (wl->operating)
4779                 goto out_mutex_unlock;
4780
4781         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4782
4783         dev = wl->current_dev;
4784         wl->operating = true;
4785         wl->vif = vif;
4786         wl->if_type = vif->type;
4787         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4788
4789         b43_adjust_opmode(dev);
4790         b43_set_pretbtt(dev);
4791         b43_set_synth_pu_delay(dev, 0);
4792         b43_upload_card_macaddress(dev);
4793
4794         err = 0;
4795  out_mutex_unlock:
4796         mutex_unlock(&wl->mutex);
4797
4798         if (err == 0)
4799                 b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
4800
4801         return err;
4802 }
4803
4804 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4805                                     struct ieee80211_vif *vif)
4806 {
4807         struct b43_wl *wl = hw_to_b43_wl(hw);
4808         struct b43_wldev *dev = wl->current_dev;
4809
4810         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4811
4812         mutex_lock(&wl->mutex);
4813
4814         B43_WARN_ON(!wl->operating);
4815         B43_WARN_ON(wl->vif != vif);
4816         wl->vif = NULL;
4817
4818         wl->operating = false;
4819
4820         b43_adjust_opmode(dev);
4821         memset(wl->mac_addr, 0, ETH_ALEN);
4822         b43_upload_card_macaddress(dev);
4823
4824         mutex_unlock(&wl->mutex);
4825 }
4826
4827 static int b43_op_start(struct ieee80211_hw *hw)
4828 {
4829         struct b43_wl *wl = hw_to_b43_wl(hw);
4830         struct b43_wldev *dev = wl->current_dev;
4831         int did_init = 0;
4832         int err = 0;
4833
4834         /* Kill all old instance specific information to make sure
4835          * the card won't use it in the short timeframe between start
4836          * and mac80211 reconfiguring it. */
4837         memset(wl->bssid, 0, ETH_ALEN);
4838         memset(wl->mac_addr, 0, ETH_ALEN);
4839         wl->filter_flags = 0;
4840         wl->radiotap_enabled = false;
4841         b43_qos_clear(wl);
4842         wl->beacon0_uploaded = false;
4843         wl->beacon1_uploaded = false;
4844         wl->beacon_templates_virgin = true;
4845         wl->radio_enabled = true;
4846
4847         mutex_lock(&wl->mutex);
4848
4849         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4850                 err = b43_wireless_core_init(dev);
4851                 if (err)
4852                         goto out_mutex_unlock;
4853                 did_init = 1;
4854         }
4855
4856         if (b43_status(dev) < B43_STAT_STARTED) {
4857                 err = b43_wireless_core_start(dev);
4858                 if (err) {
4859                         if (did_init)
4860                                 b43_wireless_core_exit(dev);
4861                         goto out_mutex_unlock;
4862                 }
4863         }
4864
4865         /* XXX: only do if device doesn't support rfkill irq */
4866         wiphy_rfkill_start_polling(hw->wiphy);
4867
4868  out_mutex_unlock:
4869         mutex_unlock(&wl->mutex);
4870
4871         /*
4872          * Configuration may have been overwritten during initialization.
4873          * Reload the configuration, but only if initialization was
4874          * successful. Reloading the configuration after a failed init
4875          * may hang the system.
4876          */
4877         if (!err)
4878                 b43_op_config(hw, ~0);
4879
4880         return err;
4881 }
4882
4883 static void b43_op_stop(struct ieee80211_hw *hw)
4884 {
4885         struct b43_wl *wl = hw_to_b43_wl(hw);
4886         struct b43_wldev *dev = wl->current_dev;
4887
4888         cancel_work_sync(&(wl->beacon_update_trigger));
4889
4890         if (!dev)
4891                 goto out;
4892
4893         mutex_lock(&wl->mutex);
4894         if (b43_status(dev) >= B43_STAT_STARTED) {
4895                 dev = b43_wireless_core_stop(dev);
4896                 if (!dev)
4897                         goto out_unlock;
4898         }
4899         b43_wireless_core_exit(dev);
4900         wl->radio_enabled = false;
4901
4902 out_unlock:
4903         mutex_unlock(&wl->mutex);
4904 out:
4905         cancel_work_sync(&(wl->txpower_adjust_work));
4906 }
4907
4908 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4909                                  struct ieee80211_sta *sta, bool set)
4910 {
4911         struct b43_wl *wl = hw_to_b43_wl(hw);
4912
4913         /* FIXME: add locking */
4914         b43_update_templates(wl);
4915
4916         return 0;
4917 }
4918
4919 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4920                               struct ieee80211_vif *vif,
4921                               enum sta_notify_cmd notify_cmd,
4922                               struct ieee80211_sta *sta)
4923 {
4924         struct b43_wl *wl = hw_to_b43_wl(hw);
4925
4926         B43_WARN_ON(!vif || wl->vif != vif);
4927 }
4928
4929 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4930 {
4931         struct b43_wl *wl = hw_to_b43_wl(hw);
4932         struct b43_wldev *dev;
4933
4934         mutex_lock(&wl->mutex);
4935         dev = wl->current_dev;
4936         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4937                 /* Disable CFP update during scan on other channels. */
4938                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4939         }
4940         mutex_unlock(&wl->mutex);
4941 }
4942
4943 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4944 {
4945         struct b43_wl *wl = hw_to_b43_wl(hw);
4946         struct b43_wldev *dev;
4947
4948         mutex_lock(&wl->mutex);
4949         dev = wl->current_dev;
4950         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4951                 /* Re-enable CFP update. */
4952                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4953         }
4954         mutex_unlock(&wl->mutex);
4955 }
4956
4957 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4958                              struct survey_info *survey)
4959 {
4960         struct b43_wl *wl = hw_to_b43_wl(hw);
4961         struct b43_wldev *dev = wl->current_dev;
4962         struct ieee80211_conf *conf = &hw->conf;
4963
4964         if (idx != 0)
4965                 return -ENOENT;
4966
4967         survey->channel = conf->chandef.chan;
4968         survey->filled = SURVEY_INFO_NOISE_DBM;
4969         survey->noise = dev->stats.link_noise;
4970
4971         return 0;
4972 }
4973
4974 static const struct ieee80211_ops b43_hw_ops = {
4975         .tx                     = b43_op_tx,
4976         .conf_tx                = b43_op_conf_tx,
4977         .add_interface          = b43_op_add_interface,
4978         .remove_interface       = b43_op_remove_interface,
4979         .config                 = b43_op_config,
4980         .bss_info_changed       = b43_op_bss_info_changed,
4981         .configure_filter       = b43_op_configure_filter,
4982         .set_key                = b43_op_set_key,
4983         .update_tkip_key        = b43_op_update_tkip_key,
4984         .get_stats              = b43_op_get_stats,
4985         .get_tsf                = b43_op_get_tsf,
4986         .set_tsf                = b43_op_set_tsf,
4987         .start                  = b43_op_start,
4988         .stop                   = b43_op_stop,
4989         .set_tim                = b43_op_beacon_set_tim,
4990         .sta_notify             = b43_op_sta_notify,
4991         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4992         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4993         .get_survey             = b43_op_get_survey,
4994         .rfkill_poll            = b43_rfkill_poll,
4995 };
4996
4997 /* Hard-reset the chip. Do not call this directly.
4998  * Use b43_controller_restart()
4999  */
5000 static void b43_chip_reset(struct work_struct *work)
5001 {
5002         struct b43_wldev *dev =
5003             container_of(work, struct b43_wldev, restart_work);
5004         struct b43_wl *wl = dev->wl;
5005         int err = 0;
5006         int prev_status;
5007
5008         mutex_lock(&wl->mutex);
5009
5010         prev_status = b43_status(dev);
5011         /* Bring the device down... */
5012         if (prev_status >= B43_STAT_STARTED) {
5013                 dev = b43_wireless_core_stop(dev);
5014                 if (!dev) {
5015                         err = -ENODEV;
5016                         goto out;
5017                 }
5018         }
5019         if (prev_status >= B43_STAT_INITIALIZED)
5020                 b43_wireless_core_exit(dev);
5021
5022         /* ...and up again. */
5023         if (prev_status >= B43_STAT_INITIALIZED) {
5024                 err = b43_wireless_core_init(dev);
5025                 if (err)
5026                         goto out;
5027         }
5028         if (prev_status >= B43_STAT_STARTED) {
5029                 err = b43_wireless_core_start(dev);
5030                 if (err) {
5031                         b43_wireless_core_exit(dev);
5032                         goto out;
5033                 }
5034         }
5035 out:
5036         if (err)
5037                 wl->current_dev = NULL; /* Failed to init the dev. */
5038         mutex_unlock(&wl->mutex);
5039
5040         if (err) {
5041                 b43err(wl, "Controller restart FAILED\n");
5042                 return;
5043         }
5044
5045         /* reload configuration */
5046         b43_op_config(wl->hw, ~0);
5047         if (wl->vif)
5048                 b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5049
5050         b43info(wl, "Controller restarted\n");
5051 }
5052
5053 static int b43_setup_bands(struct b43_wldev *dev,
5054                            bool have_2ghz_phy, bool have_5ghz_phy)
5055 {
5056         struct ieee80211_hw *hw = dev->wl->hw;
5057
5058         if (have_2ghz_phy)
5059                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
5060         if (dev->phy.type == B43_PHYTYPE_N) {
5061                 if (have_5ghz_phy)
5062                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
5063         } else {
5064                 if (have_5ghz_phy)
5065                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5066         }
5067
5068         dev->phy.supports_2ghz = have_2ghz_phy;
5069         dev->phy.supports_5ghz = have_5ghz_phy;
5070
5071         return 0;
5072 }
5073
5074 static void b43_wireless_core_detach(struct b43_wldev *dev)
5075 {
5076         /* We release firmware that late to not be required to re-request
5077          * is all the time when we reinit the core. */
5078         b43_release_firmware(dev);
5079         b43_phy_free(dev);
5080 }
5081
5082 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5083                                 bool *have_5ghz_phy)
5084 {
5085         u16 dev_id = 0;
5086
5087 #ifdef CONFIG_B43_BCMA
5088         if (dev->dev->bus_type == B43_BUS_BCMA &&
5089             dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5090                 dev_id = dev->dev->bdev->bus->host_pci->device;
5091 #endif
5092 #ifdef CONFIG_B43_SSB
5093         if (dev->dev->bus_type == B43_BUS_SSB &&
5094             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5095                 dev_id = dev->dev->sdev->bus->host_pci->device;
5096 #endif
5097         /* Override with SPROM value if available */
5098         if (dev->dev->bus_sprom->dev_id)
5099                 dev_id = dev->dev->bus_sprom->dev_id;
5100
5101         /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5102         switch (dev_id) {
5103         case 0x4324: /* BCM4306 */
5104         case 0x4312: /* BCM4311 */
5105         case 0x4319: /* BCM4318 */
5106         case 0x4328: /* BCM4321 */
5107         case 0x432b: /* BCM4322 */
5108         case 0x4350: /* BCM43222 */
5109         case 0x4353: /* BCM43224 */
5110         case 0x0576: /* BCM43224 */
5111         case 0x435f: /* BCM6362 */
5112         case 0x4331: /* BCM4331 */
5113         case 0x4359: /* BCM43228 */
5114         case 0x43a0: /* BCM4360 */
5115         case 0x43b1: /* BCM4352 */
5116                 /* Dual band devices */
5117                 *have_2ghz_phy = true;
5118                 *have_5ghz_phy = true;
5119                 return;
5120         case 0x4321: /* BCM4306 */
5121         case 0x4313: /* BCM4311 */
5122         case 0x431a: /* BCM4318 */
5123         case 0x432a: /* BCM4321 */
5124         case 0x432d: /* BCM4322 */
5125         case 0x4352: /* BCM43222 */
5126         case 0x4333: /* BCM4331 */
5127         case 0x43a2: /* BCM4360 */
5128         case 0x43b3: /* BCM4352 */
5129                 /* 5 GHz only devices */
5130                 *have_2ghz_phy = false;
5131                 *have_5ghz_phy = true;
5132                 return;
5133         }
5134
5135         /* As a fallback, try to guess using PHY type */
5136         switch (dev->phy.type) {
5137         case B43_PHYTYPE_A:
5138                 *have_2ghz_phy = false;
5139                 *have_5ghz_phy = true;
5140                 return;
5141         case B43_PHYTYPE_G:
5142         case B43_PHYTYPE_N:
5143         case B43_PHYTYPE_LP:
5144         case B43_PHYTYPE_HT:
5145         case B43_PHYTYPE_LCN:
5146                 *have_2ghz_phy = true;
5147                 *have_5ghz_phy = false;
5148                 return;
5149         }
5150
5151         B43_WARN_ON(1);
5152 }
5153
5154 static int b43_wireless_core_attach(struct b43_wldev *dev)
5155 {
5156         struct b43_wl *wl = dev->wl;
5157         int err;
5158         u32 tmp;
5159         bool have_2ghz_phy = false, have_5ghz_phy = false;
5160
5161         /* Do NOT do any device initialization here.
5162          * Do it in wireless_core_init() instead.
5163          * This function is for gathering basic information about the HW, only.
5164          * Also some structs may be set up here. But most likely you want to have
5165          * that in core_init(), too.
5166          */
5167
5168         err = b43_bus_powerup(dev, 0);
5169         if (err) {
5170                 b43err(wl, "Bus powerup failed\n");
5171                 goto out;
5172         }
5173
5174         /* Try to guess supported bands for the first init needs */
5175         switch (dev->dev->bus_type) {
5176 #ifdef CONFIG_B43_BCMA
5177         case B43_BUS_BCMA:
5178                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5179                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5180                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5181                 break;
5182 #endif
5183 #ifdef CONFIG_B43_SSB
5184         case B43_BUS_SSB:
5185                 if (dev->dev->core_rev >= 5) {
5186                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5187                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5188                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5189                 } else
5190                         B43_WARN_ON(1);
5191                 break;
5192 #endif
5193         }
5194
5195         dev->phy.gmode = have_2ghz_phy;
5196         b43_wireless_core_reset(dev, dev->phy.gmode);
5197
5198         /* Get the PHY type. */
5199         err = b43_phy_versioning(dev);
5200         if (err)
5201                 goto err_powerdown;
5202
5203         /* Get real info about supported bands */
5204         b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5205
5206         /* We don't support 5 GHz on some PHYs yet */
5207         switch (dev->phy.type) {
5208         case B43_PHYTYPE_A:
5209         case B43_PHYTYPE_N:
5210         case B43_PHYTYPE_LP:
5211         case B43_PHYTYPE_HT:
5212                 b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5213                 have_5ghz_phy = false;
5214         }
5215
5216         if (!have_2ghz_phy && !have_5ghz_phy) {
5217                 b43err(wl, "b43 can't support any band on this device\n");
5218                 err = -EOPNOTSUPP;
5219                 goto err_powerdown;
5220         }
5221
5222         err = b43_phy_allocate(dev);
5223         if (err)
5224                 goto err_powerdown;
5225
5226         dev->phy.gmode = have_2ghz_phy;
5227         b43_wireless_core_reset(dev, dev->phy.gmode);
5228
5229         err = b43_validate_chipaccess(dev);
5230         if (err)
5231                 goto err_phy_free;
5232         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5233         if (err)
5234                 goto err_phy_free;
5235
5236         /* Now set some default "current_dev" */
5237         if (!wl->current_dev)
5238                 wl->current_dev = dev;
5239         INIT_WORK(&dev->restart_work, b43_chip_reset);
5240
5241         dev->phy.ops->switch_analog(dev, 0);
5242         b43_device_disable(dev, 0);
5243         b43_bus_may_powerdown(dev);
5244
5245 out:
5246         return err;
5247
5248 err_phy_free:
5249         b43_phy_free(dev);
5250 err_powerdown:
5251         b43_bus_may_powerdown(dev);
5252         return err;
5253 }
5254
5255 static void b43_one_core_detach(struct b43_bus_dev *dev)
5256 {
5257         struct b43_wldev *wldev;
5258         struct b43_wl *wl;
5259
5260         /* Do not cancel ieee80211-workqueue based work here.
5261          * See comment in b43_remove(). */
5262
5263         wldev = b43_bus_get_wldev(dev);
5264         wl = wldev->wl;
5265         b43_debugfs_remove_device(wldev);
5266         b43_wireless_core_detach(wldev);
5267         list_del(&wldev->list);
5268         b43_bus_set_wldev(dev, NULL);
5269         kfree(wldev);
5270 }
5271
5272 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5273 {
5274         struct b43_wldev *wldev;
5275         int err = -ENOMEM;
5276
5277         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5278         if (!wldev)
5279                 goto out;
5280
5281         wldev->use_pio = b43_modparam_pio;
5282         wldev->dev = dev;
5283         wldev->wl = wl;
5284         b43_set_status(wldev, B43_STAT_UNINIT);
5285         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5286         INIT_LIST_HEAD(&wldev->list);
5287
5288         err = b43_wireless_core_attach(wldev);
5289         if (err)
5290                 goto err_kfree_wldev;
5291
5292         b43_bus_set_wldev(dev, wldev);
5293         b43_debugfs_add_device(wldev);
5294
5295       out:
5296         return err;
5297
5298       err_kfree_wldev:
5299         kfree(wldev);
5300         return err;
5301 }
5302
5303 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5304         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5305         (pdev->device == _device) &&                                    \
5306         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5307         (pdev->subsystem_device == _subdevice)                          )
5308
5309 #ifdef CONFIG_B43_SSB
5310 static void b43_sprom_fixup(struct ssb_bus *bus)
5311 {
5312         struct pci_dev *pdev;
5313
5314         /* boardflags workarounds */
5315         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5316             bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5317                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5318         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5319             bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5320                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5321         if (bus->bustype == SSB_BUSTYPE_PCI) {
5322                 pdev = bus->host_pci;
5323                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5324                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5325                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5326                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5327                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5328                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5329                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5330                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5331         }
5332 }
5333
5334 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5335 {
5336         struct ieee80211_hw *hw = wl->hw;
5337
5338         ssb_set_devtypedata(dev->sdev, NULL);
5339         ieee80211_free_hw(hw);
5340 }
5341 #endif
5342
5343 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5344 {
5345         struct ssb_sprom *sprom = dev->bus_sprom;
5346         struct ieee80211_hw *hw;
5347         struct b43_wl *wl;
5348         char chip_name[6];
5349         int queue_num;
5350
5351         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5352         if (!hw) {
5353                 b43err(NULL, "Could not allocate ieee80211 device\n");
5354                 return ERR_PTR(-ENOMEM);
5355         }
5356         wl = hw_to_b43_wl(hw);
5357
5358         /* fill hw info */
5359         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5360                     IEEE80211_HW_SIGNAL_DBM;
5361
5362         hw->wiphy->interface_modes =
5363                 BIT(NL80211_IFTYPE_AP) |
5364                 BIT(NL80211_IFTYPE_MESH_POINT) |
5365                 BIT(NL80211_IFTYPE_STATION) |
5366                 BIT(NL80211_IFTYPE_WDS) |
5367                 BIT(NL80211_IFTYPE_ADHOC);
5368
5369         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5370
5371         wl->hw_registred = false;
5372         hw->max_rates = 2;
5373         SET_IEEE80211_DEV(hw, dev->dev);
5374         if (is_valid_ether_addr(sprom->et1mac))
5375                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5376         else
5377                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5378
5379         /* Initialize struct b43_wl */
5380         wl->hw = hw;
5381         mutex_init(&wl->mutex);
5382         spin_lock_init(&wl->hardirq_lock);
5383         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5384         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5385         INIT_WORK(&wl->tx_work, b43_tx_work);
5386
5387         /* Initialize queues and flags. */
5388         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5389                 skb_queue_head_init(&wl->tx_queue[queue_num]);
5390                 wl->tx_queue_stopped[queue_num] = 0;
5391         }
5392
5393         snprintf(chip_name, ARRAY_SIZE(chip_name),
5394                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5395         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5396                 dev->core_rev);
5397         return wl;
5398 }
5399
5400 #ifdef CONFIG_B43_BCMA
5401 static int b43_bcma_probe(struct bcma_device *core)
5402 {
5403         struct b43_bus_dev *dev;
5404         struct b43_wl *wl;
5405         int err;
5406
5407         if (!modparam_allhwsupport &&
5408             (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5409                 pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5410                 return -ENOTSUPP;
5411         }
5412
5413         dev = b43_bus_dev_bcma_init(core);
5414         if (!dev)
5415                 return -ENODEV;
5416
5417         wl = b43_wireless_init(dev);
5418         if (IS_ERR(wl)) {
5419                 err = PTR_ERR(wl);
5420                 goto bcma_out;
5421         }
5422
5423         err = b43_one_core_attach(dev, wl);
5424         if (err)
5425                 goto bcma_err_wireless_exit;
5426
5427         /* setup and start work to load firmware */
5428         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5429         schedule_work(&wl->firmware_load);
5430
5431 bcma_out:
5432         return err;
5433
5434 bcma_err_wireless_exit:
5435         ieee80211_free_hw(wl->hw);
5436         return err;
5437 }
5438
5439 static void b43_bcma_remove(struct bcma_device *core)
5440 {
5441         struct b43_wldev *wldev = bcma_get_drvdata(core);
5442         struct b43_wl *wl = wldev->wl;
5443
5444         /* We must cancel any work here before unregistering from ieee80211,
5445          * as the ieee80211 unreg will destroy the workqueue. */
5446         cancel_work_sync(&wldev->restart_work);
5447         cancel_work_sync(&wl->firmware_load);
5448
5449         B43_WARN_ON(!wl);
5450         if (!wldev->fw.ucode.data)
5451                 return;                 /* NULL if firmware never loaded */
5452         if (wl->current_dev == wldev && wl->hw_registred) {
5453                 b43_leds_stop(wldev);
5454                 ieee80211_unregister_hw(wl->hw);
5455         }
5456
5457         b43_one_core_detach(wldev->dev);
5458
5459         /* Unregister HW RNG driver */
5460         b43_rng_exit(wl);
5461
5462         b43_leds_unregister(wl);
5463
5464         ieee80211_free_hw(wl->hw);
5465 }
5466
5467 static struct bcma_driver b43_bcma_driver = {
5468         .name           = KBUILD_MODNAME,
5469         .id_table       = b43_bcma_tbl,
5470         .probe          = b43_bcma_probe,
5471         .remove         = b43_bcma_remove,
5472 };
5473 #endif
5474
5475 #ifdef CONFIG_B43_SSB
5476 static
5477 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5478 {
5479         struct b43_bus_dev *dev;
5480         struct b43_wl *wl;
5481         int err;
5482
5483         dev = b43_bus_dev_ssb_init(sdev);
5484         if (!dev)
5485                 return -ENOMEM;
5486
5487         wl = ssb_get_devtypedata(sdev);
5488         if (wl) {
5489                 b43err(NULL, "Dual-core devices are not supported\n");
5490                 err = -ENOTSUPP;
5491                 goto err_ssb_kfree_dev;
5492         }
5493
5494         b43_sprom_fixup(sdev->bus);
5495
5496         wl = b43_wireless_init(dev);
5497         if (IS_ERR(wl)) {
5498                 err = PTR_ERR(wl);
5499                 goto err_ssb_kfree_dev;
5500         }
5501         ssb_set_devtypedata(sdev, wl);
5502         B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5503
5504         err = b43_one_core_attach(dev, wl);
5505         if (err)
5506                 goto err_ssb_wireless_exit;
5507
5508         /* setup and start work to load firmware */
5509         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5510         schedule_work(&wl->firmware_load);
5511
5512         return err;
5513
5514 err_ssb_wireless_exit:
5515         b43_wireless_exit(dev, wl);
5516 err_ssb_kfree_dev:
5517         kfree(dev);
5518         return err;
5519 }
5520
5521 static void b43_ssb_remove(struct ssb_device *sdev)
5522 {
5523         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5524         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5525         struct b43_bus_dev *dev = wldev->dev;
5526
5527         /* We must cancel any work here before unregistering from ieee80211,
5528          * as the ieee80211 unreg will destroy the workqueue. */
5529         cancel_work_sync(&wldev->restart_work);
5530         cancel_work_sync(&wl->firmware_load);
5531
5532         B43_WARN_ON(!wl);
5533         if (!wldev->fw.ucode.data)
5534                 return;                 /* NULL if firmware never loaded */
5535         if (wl->current_dev == wldev && wl->hw_registred) {
5536                 b43_leds_stop(wldev);
5537                 ieee80211_unregister_hw(wl->hw);
5538         }
5539
5540         b43_one_core_detach(dev);
5541
5542         /* Unregister HW RNG driver */
5543         b43_rng_exit(wl);
5544
5545         b43_leds_unregister(wl);
5546         b43_wireless_exit(dev, wl);
5547 }
5548
5549 static struct ssb_driver b43_ssb_driver = {
5550         .name           = KBUILD_MODNAME,
5551         .id_table       = b43_ssb_tbl,
5552         .probe          = b43_ssb_probe,
5553         .remove         = b43_ssb_remove,
5554 };
5555 #endif /* CONFIG_B43_SSB */
5556
5557 /* Perform a hardware reset. This can be called from any context. */
5558 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5559 {
5560         /* Must avoid requeueing, if we are in shutdown. */
5561         if (b43_status(dev) < B43_STAT_INITIALIZED)
5562                 return;
5563         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5564         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5565 }
5566
5567 static void b43_print_driverinfo(void)
5568 {
5569         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5570                    *feat_leds = "", *feat_sdio = "";
5571
5572 #ifdef CONFIG_B43_PCI_AUTOSELECT
5573         feat_pci = "P";
5574 #endif
5575 #ifdef CONFIG_B43_PCMCIA
5576         feat_pcmcia = "M";
5577 #endif
5578 #ifdef CONFIG_B43_PHY_N
5579         feat_nphy = "N";
5580 #endif
5581 #ifdef CONFIG_B43_LEDS
5582         feat_leds = "L";
5583 #endif
5584 #ifdef CONFIG_B43_SDIO
5585         feat_sdio = "S";
5586 #endif
5587         printk(KERN_INFO "Broadcom 43xx driver loaded "
5588                "[ Features: %s%s%s%s%s ]\n",
5589                feat_pci, feat_pcmcia, feat_nphy,
5590                feat_leds, feat_sdio);
5591 }
5592
5593 static int __init b43_init(void)
5594 {
5595         int err;
5596
5597         b43_debugfs_init();
5598         err = b43_pcmcia_init();
5599         if (err)
5600                 goto err_dfs_exit;
5601         err = b43_sdio_init();
5602         if (err)
5603                 goto err_pcmcia_exit;
5604 #ifdef CONFIG_B43_BCMA
5605         err = bcma_driver_register(&b43_bcma_driver);
5606         if (err)
5607                 goto err_sdio_exit;
5608 #endif
5609 #ifdef CONFIG_B43_SSB
5610         err = ssb_driver_register(&b43_ssb_driver);
5611         if (err)
5612                 goto err_bcma_driver_exit;
5613 #endif
5614         b43_print_driverinfo();
5615
5616         return err;
5617
5618 #ifdef CONFIG_B43_SSB
5619 err_bcma_driver_exit:
5620 #endif
5621 #ifdef CONFIG_B43_BCMA
5622         bcma_driver_unregister(&b43_bcma_driver);
5623 err_sdio_exit:
5624 #endif
5625         b43_sdio_exit();
5626 err_pcmcia_exit:
5627         b43_pcmcia_exit();
5628 err_dfs_exit:
5629         b43_debugfs_exit();
5630         return err;
5631 }
5632
5633 static void __exit b43_exit(void)
5634 {
5635 #ifdef CONFIG_B43_SSB
5636         ssb_driver_unregister(&b43_ssb_driver);
5637 #endif
5638 #ifdef CONFIG_B43_BCMA
5639         bcma_driver_unregister(&b43_bcma_driver);
5640 #endif
5641         b43_sdio_exit();
5642         b43_pcmcia_exit();
5643         b43_debugfs_exit();
5644 }
5645
5646 module_init(b43_init)
5647 module_exit(b43_exit)