drivers/net/wireless/broadcom/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
  11
  12   SDIO support
  13   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  14
  15   Some parts of the code in this file are derived from the ipw2200
  16   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  17
  18   This program is free software; you can redistribute it and/or modify
  19   it under the terms of the GNU General Public License as published by
  20   the Free Software Foundation; either version 2 of the License, or
  21   (at your option) any later version.
  22
  23   This program is distributed in the hope that it will be useful,
  24   but WITHOUT ANY WARRANTY; without even the implied warranty of
  25   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26   GNU General Public License for more details.
  27
  28   You should have received a copy of the GNU General Public License
  29   along with this program; see the file COPYING.  If not, write to
  30   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  31   Boston, MA 02110-1301, USA.
  32
  33 */
  34
  35 #include <linux/delay.h>
  36 #include <linux/init.h>
  37 #include <linux/module.h>
  38 #include <linux/if_arp.h>
  39 #include <linux/etherdevice.h>
  40 #include <linux/firmware.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "sdio.h"
  60 #include <linux/mmc/sdio_func.h>
  61
  62 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  63 MODULE_AUTHOR("Martin Langer");
  64 MODULE_AUTHOR("Stefano Brivio");
  65 MODULE_AUTHOR("Michael Buesch");
  66 MODULE_AUTHOR("Gábor Stefanik");
  67 MODULE_AUTHOR("Rafał Miłecki");
  68 MODULE_LICENSE("GPL");
  69
  70 /*(DEBLOBBED)*/
  71
  72 static int modparam_bad_frames_preempt;
  73 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  74 MODULE_PARM_DESC(bad_frames_preempt,
  75                  "enable(1) / disable(0) Bad Frames Preemption");
  76
  77 static char modparam_fwpostfix[16];
  78 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  79 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  80
  81 static int modparam_hwpctl;
  82 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  83 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  84
  85 static int modparam_nohwcrypt;
  86 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  87 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  88
  89 static int modparam_hwtkip;
  90 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  91 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  92
  93 static int modparam_qos = 1;
  94 module_param_named(qos, modparam_qos, int, 0444);
  95 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  96
  97 static int modparam_btcoex = 1;
  98 module_param_named(btcoex, modparam_btcoex, int, 0444);
  99 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 100
 101 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 102 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 103 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 104
 105 static int b43_modparam_pio = 0;
 106 module_param_named(pio, b43_modparam_pio, int, 0644);
 107 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 108
 109 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
 110 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
 111 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
 112
 113 #ifdef CONFIG_B43_BCMA
 114 static const struct bcma_device_id b43_bcma_tbl[] = {
 115         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 116         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
 117         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
 122         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
 123         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
 124         {},
 125 };
 126 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 127 #endif
 128
 129 #ifdef CONFIG_B43_SSB
 130 static const struct ssb_device_id b43_ssb_tbl[] = {
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 138         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 139         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 140         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 141         {},
 142 };
 143 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 144 #endif
 145
 146 /* Channel and ratetables are shared for all devices.
 147  * They can't be const, because ieee80211 puts some precalculated
 148  * data in there. This data is the same for all devices, so we don't
 149  * get concurrency issues */
 150 #define RATETAB_ENT(_rateid, _flags) \
 151         {                                                               \
 152                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 153                 .hw_value       = (_rateid),                            \
 154                 .flags          = (_flags),                             \
 155         }
 156
 157 /*
 158  * NOTE: When changing this, sync with xmit.c's
 159  *       b43_plcp_get_bitrate_idx_* functions!
 160  */
 161 static struct ieee80211_rate __b43_ratetable[] = {
 162         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 163         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 164         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 165         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 166         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 171         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 172         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 173         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 174 };
 175
 176 #define b43_a_ratetable         (__b43_ratetable + 4)
 177 #define b43_a_ratetable_size    8
 178 #define b43_b_ratetable         (__b43_ratetable + 0)
 179 #define b43_b_ratetable_size    4
 180 #define b43_g_ratetable         (__b43_ratetable + 0)
 181 #define b43_g_ratetable_size    12
 182
 183 #define CHAN2G(_channel, _freq, _flags) {                       \
 184         .band                   = NL80211_BAND_2GHZ,            \
 185         .center_freq            = (_freq),                      \
 186         .hw_value               = (_channel),                   \
 187         .flags                  = (_flags),                     \
 188         .max_antenna_gain       = 0,                            \
 189         .max_power              = 30,                           \
 190 }
 191 static struct ieee80211_channel b43_2ghz_chantable[] = {
 192         CHAN2G(1, 2412, 0),
 193         CHAN2G(2, 2417, 0),
 194         CHAN2G(3, 2422, 0),
 195         CHAN2G(4, 2427, 0),
 196         CHAN2G(5, 2432, 0),
 197         CHAN2G(6, 2437, 0),
 198         CHAN2G(7, 2442, 0),
 199         CHAN2G(8, 2447, 0),
 200         CHAN2G(9, 2452, 0),
 201         CHAN2G(10, 2457, 0),
 202         CHAN2G(11, 2462, 0),
 203         CHAN2G(12, 2467, 0),
 204         CHAN2G(13, 2472, 0),
 205         CHAN2G(14, 2484, 0),
 206 };
 207
 208 /* No support for the last 3 channels (12, 13, 14) */
 209 #define b43_2ghz_chantable_limited_size         11
 210 #undef CHAN2G
 211
 212 #define CHAN4G(_channel, _flags) {                              \
 213         .band                   = NL80211_BAND_5GHZ,            \
 214         .center_freq            = 4000 + (5 * (_channel)),      \
 215         .hw_value               = (_channel),                   \
 216         .flags                  = (_flags),                     \
 217         .max_antenna_gain       = 0,                            \
 218         .max_power              = 30,                           \
 219 }
 220 #define CHAN5G(_channel, _flags) {                              \
 221         .band                   = NL80211_BAND_5GHZ,            \
 222         .center_freq            = 5000 + (5 * (_channel)),      \
 223         .hw_value               = (_channel),                   \
 224         .flags                  = (_flags),                     \
 225         .max_antenna_gain       = 0,                            \
 226         .max_power              = 30,                           \
 227 }
 228 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 229         CHAN4G(184, 0),         CHAN4G(186, 0),
 230         CHAN4G(188, 0),         CHAN4G(190, 0),
 231         CHAN4G(192, 0),         CHAN4G(194, 0),
 232         CHAN4G(196, 0),         CHAN4G(198, 0),
 233         CHAN4G(200, 0),         CHAN4G(202, 0),
 234         CHAN4G(204, 0),         CHAN4G(206, 0),
 235         CHAN4G(208, 0),         CHAN4G(210, 0),
 236         CHAN4G(212, 0),         CHAN4G(214, 0),
 237         CHAN4G(216, 0),         CHAN4G(218, 0),
 238         CHAN4G(220, 0),         CHAN4G(222, 0),
 239         CHAN4G(224, 0),         CHAN4G(226, 0),
 240         CHAN4G(228, 0),
 241         CHAN5G(32, 0),          CHAN5G(34, 0),
 242         CHAN5G(36, 0),          CHAN5G(38, 0),
 243         CHAN5G(40, 0),          CHAN5G(42, 0),
 244         CHAN5G(44, 0),          CHAN5G(46, 0),
 245         CHAN5G(48, 0),          CHAN5G(50, 0),
 246         CHAN5G(52, 0),          CHAN5G(54, 0),
 247         CHAN5G(56, 0),          CHAN5G(58, 0),
 248         CHAN5G(60, 0),          CHAN5G(62, 0),
 249         CHAN5G(64, 0),          CHAN5G(66, 0),
 250         CHAN5G(68, 0),          CHAN5G(70, 0),
 251         CHAN5G(72, 0),          CHAN5G(74, 0),
 252         CHAN5G(76, 0),          CHAN5G(78, 0),
 253         CHAN5G(80, 0),          CHAN5G(82, 0),
 254         CHAN5G(84, 0),          CHAN5G(86, 0),
 255         CHAN5G(88, 0),          CHAN5G(90, 0),
 256         CHAN5G(92, 0),          CHAN5G(94, 0),
 257         CHAN5G(96, 0),          CHAN5G(98, 0),
 258         CHAN5G(100, 0),         CHAN5G(102, 0),
 259         CHAN5G(104, 0),         CHAN5G(106, 0),
 260         CHAN5G(108, 0),         CHAN5G(110, 0),
 261         CHAN5G(112, 0),         CHAN5G(114, 0),
 262         CHAN5G(116, 0),         CHAN5G(118, 0),
 263         CHAN5G(120, 0),         CHAN5G(122, 0),
 264         CHAN5G(124, 0),         CHAN5G(126, 0),
 265         CHAN5G(128, 0),         CHAN5G(130, 0),
 266         CHAN5G(132, 0),         CHAN5G(134, 0),
 267         CHAN5G(136, 0),         CHAN5G(138, 0),
 268         CHAN5G(140, 0),         CHAN5G(142, 0),
 269         CHAN5G(144, 0),         CHAN5G(145, 0),
 270         CHAN5G(146, 0),         CHAN5G(147, 0),
 271         CHAN5G(148, 0),         CHAN5G(149, 0),
 272         CHAN5G(150, 0),         CHAN5G(151, 0),
 273         CHAN5G(152, 0),         CHAN5G(153, 0),
 274         CHAN5G(154, 0),         CHAN5G(155, 0),
 275         CHAN5G(156, 0),         CHAN5G(157, 0),
 276         CHAN5G(158, 0),         CHAN5G(159, 0),
 277         CHAN5G(160, 0),         CHAN5G(161, 0),
 278         CHAN5G(162, 0),         CHAN5G(163, 0),
 279         CHAN5G(164, 0),         CHAN5G(165, 0),
 280         CHAN5G(166, 0),         CHAN5G(168, 0),
 281         CHAN5G(170, 0),         CHAN5G(172, 0),
 282         CHAN5G(174, 0),         CHAN5G(176, 0),
 283         CHAN5G(178, 0),         CHAN5G(180, 0),
 284         CHAN5G(182, 0),
 285 };
 286
 287 static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
 288         CHAN5G(36, 0),          CHAN5G(40, 0),
 289         CHAN5G(44, 0),          CHAN5G(48, 0),
 290         CHAN5G(149, 0),         CHAN5G(153, 0),
 291         CHAN5G(157, 0),         CHAN5G(161, 0),
 292         CHAN5G(165, 0),
 293 };
 294
 295 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 296         CHAN5G(34, 0),          CHAN5G(36, 0),
 297         CHAN5G(38, 0),          CHAN5G(40, 0),
 298         CHAN5G(42, 0),          CHAN5G(44, 0),
 299         CHAN5G(46, 0),          CHAN5G(48, 0),
 300         CHAN5G(52, 0),          CHAN5G(56, 0),
 301         CHAN5G(60, 0),          CHAN5G(64, 0),
 302         CHAN5G(100, 0),         CHAN5G(104, 0),
 303         CHAN5G(108, 0),         CHAN5G(112, 0),
 304         CHAN5G(116, 0),         CHAN5G(120, 0),
 305         CHAN5G(124, 0),         CHAN5G(128, 0),
 306         CHAN5G(132, 0),         CHAN5G(136, 0),
 307         CHAN5G(140, 0),         CHAN5G(149, 0),
 308         CHAN5G(153, 0),         CHAN5G(157, 0),
 309         CHAN5G(161, 0),         CHAN5G(165, 0),
 310         CHAN5G(184, 0),         CHAN5G(188, 0),
 311         CHAN5G(192, 0),         CHAN5G(196, 0),
 312         CHAN5G(200, 0),         CHAN5G(204, 0),
 313         CHAN5G(208, 0),         CHAN5G(212, 0),
 314         CHAN5G(216, 0),
 315 };
 316 #undef CHAN4G
 317 #undef CHAN5G
 318
 319 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 320         .band           = NL80211_BAND_5GHZ,
 321         .channels       = b43_5ghz_nphy_chantable,
 322         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 323         .bitrates       = b43_a_ratetable,
 324         .n_bitrates     = b43_a_ratetable_size,
 325 };
 326
 327 static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
 328         .band           = NL80211_BAND_5GHZ,
 329         .channels       = b43_5ghz_nphy_chantable_limited,
 330         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
 331         .bitrates       = b43_a_ratetable,
 332         .n_bitrates     = b43_a_ratetable_size,
 333 };
 334
 335 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 336         .band           = NL80211_BAND_5GHZ,
 337         .channels       = b43_5ghz_aphy_chantable,
 338         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 339         .bitrates       = b43_a_ratetable,
 340         .n_bitrates     = b43_a_ratetable_size,
 341 };
 342
 343 static struct ieee80211_supported_band b43_band_2GHz = {
 344         .band           = NL80211_BAND_2GHZ,
 345         .channels       = b43_2ghz_chantable,
 346         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 347         .bitrates       = b43_g_ratetable,
 348         .n_bitrates     = b43_g_ratetable_size,
 349 };
 350
 351 static struct ieee80211_supported_band b43_band_2ghz_limited = {
 352         .band           = NL80211_BAND_2GHZ,
 353         .channels       = b43_2ghz_chantable,
 354         .n_channels     = b43_2ghz_chantable_limited_size,
 355         .bitrates       = b43_g_ratetable,
 356         .n_bitrates     = b43_g_ratetable_size,
 357 };
 358
 359 static void b43_wireless_core_exit(struct b43_wldev *dev);
 360 static int b43_wireless_core_init(struct b43_wldev *dev);
 361 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 362 static int b43_wireless_core_start(struct b43_wldev *dev);
 363 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 364                                     struct ieee80211_vif *vif,
 365                                     struct ieee80211_bss_conf *conf,
 366                                     u32 changed);
 367
 368 static int b43_ratelimit(struct b43_wl *wl)
 369 {
 370         if (!wl || !wl->current_dev)
 371                 return 1;
 372         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 373                 return 1;
 374         /* We are up and running.
 375          * Ratelimit the messages to avoid DoS over the net. */
 376         return net_ratelimit();
 377 }
 378
 379 void b43info(struct b43_wl *wl, const char *fmt, ...)
 380 {
 381         struct va_format vaf;
 382         va_list args;
 383
 384         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 385                 return;
 386         if (!b43_ratelimit(wl))
 387                 return;
 388
 389         va_start(args, fmt);
 390
 391         vaf.fmt = fmt;
 392         vaf.va = &args;
 393
 394         printk(KERN_INFO "b43-%s: %pV",
 395                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 396
 397         va_end(args);
 398 }
 399
 400 void b43err(struct b43_wl *wl, const char *fmt, ...)
 401 {
 402         struct va_format vaf;
 403         va_list args;
 404
 405         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 406                 return;
 407         if (!b43_ratelimit(wl))
 408                 return;
 409
 410         va_start(args, fmt);
 411
 412         vaf.fmt = fmt;
 413         vaf.va = &args;
 414
 415         printk(KERN_ERR "b43-%s ERROR: %pV",
 416                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 417
 418         va_end(args);
 419 }
 420
 421 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 422 {
 423         struct va_format vaf;
 424         va_list args;
 425
 426         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 427                 return;
 428         if (!b43_ratelimit(wl))
 429                 return;
 430
 431         va_start(args, fmt);
 432
 433         vaf.fmt = fmt;
 434         vaf.va = &args;
 435
 436         printk(KERN_WARNING "b43-%s warning: %pV",
 437                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 438
 439         va_end(args);
 440 }
 441
 442 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 443 {
 444         struct va_format vaf;
 445         va_list args;
 446
 447         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 448                 return;
 449
 450         va_start(args, fmt);
 451
 452         vaf.fmt = fmt;
 453         vaf.va = &args;
 454
 455         printk(KERN_DEBUG "b43-%s debug: %pV",
 456                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 457
 458         va_end(args);
 459 }
 460
 461 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 462 {
 463         u32 macctl;
 464
 465         B43_WARN_ON(offset % 4 != 0);
 466
 467         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 468         if (macctl & B43_MACCTL_BE)
 469                 val = swab32(val);
 470
 471         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 472         mmiowb();
 473         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 474 }
 475
 476 static inline void b43_shm_control_word(struct b43_wldev *dev,
 477                                         u16 routing, u16 offset)
 478 {
 479         u32 control;
 480
 481         /* "offset" is the WORD offset. */
 482         control = routing;
 483         control <<= 16;
 484         control |= offset;
 485         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 486 }
 487
 488 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 489 {
 490         u32 ret;
 491
 492         if (routing == B43_SHM_SHARED) {
 493                 B43_WARN_ON(offset & 0x0001);
 494                 if (offset & 0x0003) {
 495                         /* Unaligned access */
 496                         b43_shm_control_word(dev, routing, offset >> 2);
 497                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 498                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 499                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 500
 501                         goto out;
 502                 }
 503                 offset >>= 2;
 504         }
 505         b43_shm_control_word(dev, routing, offset);
 506         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 507 out:
 508         return ret;
 509 }
 510
 511 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 512 {
 513         u16 ret;
 514
 515         if (routing == B43_SHM_SHARED) {
 516                 B43_WARN_ON(offset & 0x0001);
 517                 if (offset & 0x0003) {
 518                         /* Unaligned access */
 519                         b43_shm_control_word(dev, routing, offset >> 2);
 520                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 521
 522                         goto out;
 523                 }
 524                 offset >>= 2;
 525         }
 526         b43_shm_control_word(dev, routing, offset);
 527         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 528 out:
 529         return ret;
 530 }
 531
 532 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 533 {
 534         if (routing == B43_SHM_SHARED) {
 535                 B43_WARN_ON(offset & 0x0001);
 536                 if (offset & 0x0003) {
 537                         /* Unaligned access */
 538                         b43_shm_control_word(dev, routing, offset >> 2);
 539                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 540                                     value & 0xFFFF);
 541                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 542                         b43_write16(dev, B43_MMIO_SHM_DATA,
 543                                     (value >> 16) & 0xFFFF);
 544                         return;
 545                 }
 546                 offset >>= 2;
 547         }
 548         b43_shm_control_word(dev, routing, offset);
 549         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 550 }
 551
 552 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 553 {
 554         if (routing == B43_SHM_SHARED) {
 555                 B43_WARN_ON(offset & 0x0001);
 556                 if (offset & 0x0003) {
 557                         /* Unaligned access */
 558                         b43_shm_control_word(dev, routing, offset >> 2);
 559                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 560                         return;
 561                 }
 562                 offset >>= 2;
 563         }
 564         b43_shm_control_word(dev, routing, offset);
 565         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 566 }
 567
 568 /* Read HostFlags */
 569 u64 b43_hf_read(struct b43_wldev *dev)
 570 {
 571         u64 ret;
 572
 573         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
 574         ret <<= 16;
 575         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
 576         ret <<= 16;
 577         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
 578
 579         return ret;
 580 }
 581
 582 /* Write HostFlags */
 583 void b43_hf_write(struct b43_wldev *dev, u64 value)
 584 {
 585         u16 lo, mi, hi;
 586
 587         lo = (value & 0x00000000FFFFULL);
 588         mi = (value & 0x0000FFFF0000ULL) >> 16;
 589         hi = (value & 0xFFFF00000000ULL) >> 32;
 590         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
 591         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
 592         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
 593 }
 594
 595 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 596 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 597 {
 598         B43_WARN_ON(!dev->fw.opensource);
 599         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 600 }
 601
 602 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 603 {
 604         u32 low, high;
 605
 606         B43_WARN_ON(dev->dev->core_rev < 3);
 607
 608         /* The hardware guarantees us an atomic read, if we
 609          * read the low register first. */
 610         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 611         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 612
 613         *tsf = high;
 614         *tsf <<= 32;
 615         *tsf |= low;
 616 }
 617
 618 static void b43_time_lock(struct b43_wldev *dev)
 619 {
 620         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
 621         /* Commit the write */
 622         b43_read32(dev, B43_MMIO_MACCTL);
 623 }
 624
 625 static void b43_time_unlock(struct b43_wldev *dev)
 626 {
 627         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
 628         /* Commit the write */
 629         b43_read32(dev, B43_MMIO_MACCTL);
 630 }
 631
 632 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 633 {
 634         u32 low, high;
 635
 636         B43_WARN_ON(dev->dev->core_rev < 3);
 637
 638         low = tsf;
 639         high = (tsf >> 32);
 640         /* The hardware guarantees us an atomic write, if we
 641          * write the low register first. */
 642         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 643         mmiowb();
 644         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 645         mmiowb();
 646 }
 647
 648 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 649 {
 650         b43_time_lock(dev);
 651         b43_tsf_write_locked(dev, tsf);
 652         b43_time_unlock(dev);
 653 }
 654
 655 static
 656 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 657 {
 658         static const u8 zero_addr[ETH_ALEN] = { 0 };
 659         u16 data;
 660
 661         if (!mac)
 662                 mac = zero_addr;
 663
 664         offset |= 0x0020;
 665         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 666
 667         data = mac[0];
 668         data |= mac[1] << 8;
 669         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 670         data = mac[2];
 671         data |= mac[3] << 8;
 672         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 673         data = mac[4];
 674         data |= mac[5] << 8;
 675         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 676 }
 677
 678 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 679 {
 680         const u8 *mac;
 681         const u8 *bssid;
 682         u8 mac_bssid[ETH_ALEN * 2];
 683         int i;
 684         u32 tmp;
 685
 686         bssid = dev->wl->bssid;
 687         mac = dev->wl->mac_addr;
 688
 689         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 690
 691         memcpy(mac_bssid, mac, ETH_ALEN);
 692         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 693
 694         /* Write our MAC address and BSSID to template ram */
 695         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 696                 tmp = (u32) (mac_bssid[i + 0]);
 697                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 698                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 699                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 700                 b43_ram_write(dev, 0x20 + i, tmp);
 701         }
 702 }
 703
 704 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 705 {
 706         b43_write_mac_bssid_templates(dev);
 707         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 708 }
 709
 710 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 711 {
 712         /* slot_time is in usec. */
 713         /* This test used to exit for all but a G PHY. */
 714         if (b43_current_band(dev->wl) == NL80211_BAND_5GHZ)
 715                 return;
 716         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 717         /* Shared memory location 0x0010 is the slot time and should be
 718          * set to slot_time; however, this register is initially 0 and changing
 719          * the value adversely affects the transmit rate for BCM4311
 720          * devices. Until this behavior is unterstood, delete this step
 721          *
 722          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 723          */
 724 }
 725
 726 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 727 {
 728         b43_set_slot_time(dev, 9);
 729 }
 730
 731 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 732 {
 733         b43_set_slot_time(dev, 20);
 734 }
 735
 736 /* DummyTransmission function, as documented on
 737  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 738  */
 739 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 740 {
 741         struct b43_phy *phy = &dev->phy;
 742         unsigned int i, max_loop;
 743         u16 value;
 744         u32 buffer[5] = {
 745                 0x00000000,
 746                 0x00D40000,
 747                 0x00000000,
 748                 0x01000000,
 749                 0x00000000,
 750         };
 751
 752         if (ofdm) {
 753                 max_loop = 0x1E;
 754                 buffer[0] = 0x000201CC;
 755         } else {
 756                 max_loop = 0xFA;
 757                 buffer[0] = 0x000B846E;
 758         }
 759
 760         for (i = 0; i < 5; i++)
 761                 b43_ram_write(dev, i * 4, buffer[i]);
 762
 763         b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
 764
 765         if (dev->dev->core_rev < 11)
 766                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
 767         else
 768                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
 769
 770         value = (ofdm ? 0x41 : 0x40);
 771         b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
 772         if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
 773             phy->type == B43_PHYTYPE_LCN)
 774                 b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
 775
 776         b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
 777         b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
 778
 779         b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
 780         b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
 781         b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
 782         b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
 783
 784         if (!pa_on && phy->type == B43_PHYTYPE_N)
 785                 ; /*b43_nphy_pa_override(dev, false) */
 786
 787         switch (phy->type) {
 788         case B43_PHYTYPE_N:
 789         case B43_PHYTYPE_LCN:
 790                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
 791                 break;
 792         case B43_PHYTYPE_LP:
 793                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
 794                 break;
 795         default:
 796                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
 797         }
 798         b43_read16(dev, B43_MMIO_TXE0_AUX);
 799
 800         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 801                 b43_radio_write16(dev, 0x0051, 0x0017);
 802         for (i = 0x00; i < max_loop; i++) {
 803                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 804                 if (value & 0x0080)
 805                         break;
 806                 udelay(10);
 807         }
 808         for (i = 0x00; i < 0x0A; i++) {
 809                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 810                 if (value & 0x0400)
 811                         break;
 812                 udelay(10);
 813         }
 814         for (i = 0x00; i < 0x19; i++) {
 815                 value = b43_read16(dev, B43_MMIO_IFSSTAT);
 816                 if (!(value & 0x0100))
 817                         break;
 818                 udelay(10);
 819         }
 820         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 821                 b43_radio_write16(dev, 0x0051, 0x0037);
 822 }
 823
 824 static void key_write(struct b43_wldev *dev,
 825                       u8 index, u8 algorithm, const u8 *key)
 826 {
 827         unsigned int i;
 828         u32 offset;
 829         u16 value;
 830         u16 kidx;
 831
 832         /* Key index/algo block */
 833         kidx = b43_kidx_to_fw(dev, index);
 834         value = ((kidx << 4) | algorithm);
 835         b43_shm_write16(dev, B43_SHM_SHARED,
 836                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 837
 838         /* Write the key to the Key Table Pointer offset */
 839         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 840         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 841                 value = key[i];
 842                 value |= (u16) (key[i + 1]) << 8;
 843                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 844         }
 845 }
 846
 847 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 848 {
 849         u32 addrtmp[2] = { 0, 0, };
 850         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 851
 852         if (b43_new_kidx_api(dev))
 853                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 854
 855         B43_WARN_ON(index < pairwise_keys_start);
 856         /* We have four default TX keys and possibly four default RX keys.
 857          * Physical mac 0 is mapped to physical key 4 or 8, depending
 858          * on the firmware version.
 859          * So we must adjust the index here.
 860          */
 861         index -= pairwise_keys_start;
 862         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 863
 864         if (addr) {
 865                 addrtmp[0] = addr[0];
 866                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 867                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 868                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 869                 addrtmp[1] = addr[4];
 870                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 871         }
 872
 873         /* Receive match transmitter address (RCMTA) mechanism */
 874         b43_shm_write32(dev, B43_SHM_RCMTA,
 875                         (index * 2) + 0, addrtmp[0]);
 876         b43_shm_write16(dev, B43_SHM_RCMTA,
 877                         (index * 2) + 1, addrtmp[1]);
 878 }
 879
 880 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 881  * When a packet is received, the iv32 is checked.
 882  * - if it doesn't the packet is returned without modification (and software
 883  *   decryption can be done). That's what happen when iv16 wrap.
 884  * - if it does, the rc4 key is computed, and decryption is tried.
 885  *   Either it will success and B43_RX_MAC_DEC is returned,
 886  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 887  *   and the packet is not usable (it got modified by the ucode).
 888  * So in order to never have B43_RX_MAC_DECERR, we should provide
 889  * a iv32 and phase1key that match. Because we drop packets in case of
 890  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 891  * packets will be lost without higher layer knowing (ie no resync possible
 892  * until next wrap).
 893  *
 894  * NOTE : this should support 50 key like RCMTA because
 895  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 896  */
 897 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 898                 u16 *phase1key)
 899 {
 900         unsigned int i;
 901         u32 offset;
 902         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 903
 904         if (!modparam_hwtkip)
 905                 return;
 906
 907         if (b43_new_kidx_api(dev))
 908                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 909
 910         B43_WARN_ON(index < pairwise_keys_start);
 911         /* We have four default TX keys and possibly four default RX keys.
 912          * Physical mac 0 is mapped to physical key 4 or 8, depending
 913          * on the firmware version.
 914          * So we must adjust the index here.
 915          */
 916         index -= pairwise_keys_start;
 917         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 918
 919         if (b43_debug(dev, B43_DBG_KEYS)) {
 920                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 921                                 index, iv32);
 922         }
 923         /* Write the key to the  RX tkip shared mem */
 924         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 925         for (i = 0; i < 10; i += 2) {
 926                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 927                                 phase1key ? phase1key[i / 2] : 0);
 928         }
 929         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 930         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 931 }
 932
 933 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 934                                    struct ieee80211_vif *vif,
 935                                    struct ieee80211_key_conf *keyconf,
 936                                    struct ieee80211_sta *sta,
 937                                    u32 iv32, u16 *phase1key)
 938 {
 939         struct b43_wl *wl = hw_to_b43_wl(hw);
 940         struct b43_wldev *dev;
 941         int index = keyconf->hw_key_idx;
 942
 943         if (B43_WARN_ON(!modparam_hwtkip))
 944                 return;
 945
 946         /* This is only called from the RX path through mac80211, where
 947          * our mutex is already locked. */
 948         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 949         dev = wl->current_dev;
 950         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 951
 952         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 953
 954         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 955         /* only pairwise TKIP keys are supported right now */
 956         if (WARN_ON(!sta))
 957                 return;
 958         keymac_write(dev, index, sta->addr);
 959 }
 960
 961 static void do_key_write(struct b43_wldev *dev,
 962                          u8 index, u8 algorithm,
 963                          const u8 *key, size_t key_len, const u8 *mac_addr)
 964 {
 965         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 966         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 967
 968         if (b43_new_kidx_api(dev))
 969                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 970
 971         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 972         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 973
 974         if (index >= pairwise_keys_start)
 975                 keymac_write(dev, index, NULL); /* First zero out mac. */
 976         if (algorithm == B43_SEC_ALGO_TKIP) {
 977                 /*
 978                  * We should provide an initial iv32, phase1key pair.
 979                  * We could start with iv32=0 and compute the corresponding
 980                  * phase1key, but this means calling ieee80211_get_tkip_key
 981                  * with a fake skb (or export other tkip function).
 982                  * Because we are lazy we hope iv32 won't start with
 983                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 984                  * correct pair.
 985                  */
 986                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 987         } else if (index >= pairwise_keys_start) /* clear it */
 988                 rx_tkip_phase1_write(dev, index, 0, NULL);
 989         if (key)
 990                 memcpy(buf, key, key_len);
 991         key_write(dev, index, algorithm, buf);
 992         if (index >= pairwise_keys_start)
 993                 keymac_write(dev, index, mac_addr);
 994
 995         dev->key[index].algorithm = algorithm;
 996 }
 997
 998 static int b43_key_write(struct b43_wldev *dev,
 999                          int index, u8 algorithm,
1000                          const u8 *key, size_t key_len,
1001                          const u8 *mac_addr,
1002                          struct ieee80211_key_conf *keyconf)
1003 {
1004         int i;
1005         int pairwise_keys_start;
1006
1007         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1008          *      - Temporal Encryption Key (128 bits)
1009          *      - Temporal Authenticator Tx MIC Key (64 bits)
1010          *      - Temporal Authenticator Rx MIC Key (64 bits)
1011          *
1012          *      Hardware only store TEK
1013          */
1014         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1015                 key_len = 16;
1016         if (key_len > B43_SEC_KEYSIZE)
1017                 return -EINVAL;
1018         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1019                 /* Check that we don't already have this key. */
1020                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
1021         }
1022         if (index < 0) {
1023                 /* Pairwise key. Get an empty slot for the key. */
1024                 if (b43_new_kidx_api(dev))
1025                         pairwise_keys_start = B43_NR_GROUP_KEYS;
1026                 else
1027                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1028                 for (i = pairwise_keys_start;
1029                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1030                      i++) {
1031                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1032                         if (!dev->key[i].keyconf) {
1033                                 /* found empty */
1034                                 index = i;
1035                                 break;
1036                         }
1037                 }
1038                 if (index < 0) {
1039                         b43warn(dev->wl, "Out of hardware key memory\n");
1040                         return -ENOSPC;
1041                 }
1042         } else
1043                 B43_WARN_ON(index > 3);
1044
1045         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1046         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1047                 /* Default RX key */
1048                 B43_WARN_ON(mac_addr);
1049                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1050         }
1051         keyconf->hw_key_idx = index;
1052         dev->key[index].keyconf = keyconf;
1053
1054         return 0;
1055 }
1056
1057 static int b43_key_clear(struct b43_wldev *dev, int index)
1058 {
1059         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1060                 return -EINVAL;
1061         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1062                      NULL, B43_SEC_KEYSIZE, NULL);
1063         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1064                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1065                              NULL, B43_SEC_KEYSIZE, NULL);
1066         }
1067         dev->key[index].keyconf = NULL;
1068
1069         return 0;
1070 }
1071
1072 static void b43_clear_keys(struct b43_wldev *dev)
1073 {
1074         int i, count;
1075
1076         if (b43_new_kidx_api(dev))
1077                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1078         else
1079                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1080         for (i = 0; i < count; i++)
1081                 b43_key_clear(dev, i);
1082 }
1083
1084 static void b43_dump_keymemory(struct b43_wldev *dev)
1085 {
1086         unsigned int i, index, count, offset, pairwise_keys_start;
1087         u8 mac[ETH_ALEN];
1088         u16 algo;
1089         u32 rcmta0;
1090         u16 rcmta1;
1091         u64 hf;
1092         struct b43_key *key;
1093
1094         if (!b43_debug(dev, B43_DBG_KEYS))
1095                 return;
1096
1097         hf = b43_hf_read(dev);
1098         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1099                !!(hf & B43_HF_USEDEFKEYS));
1100         if (b43_new_kidx_api(dev)) {
1101                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1102                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1103         } else {
1104                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1105                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1106         }
1107         for (index = 0; index < count; index++) {
1108                 key = &(dev->key[index]);
1109                 printk(KERN_DEBUG "Key slot %02u: %s",
1110                        index, (key->keyconf == NULL) ? " " : "*");
1111                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1112                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1113                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1114                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1115                 }
1116
1117                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1118                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1119                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1120
1121                 if (index >= pairwise_keys_start) {
1122                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1123                                 printk("   TKIP: ");
1124                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1125                                 for (i = 0; i < 14; i += 2) {
1126                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1127                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1128                                 }
1129                         }
1130                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1131                                                 ((index - pairwise_keys_start) * 2) + 0);
1132                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1133                                                 ((index - pairwise_keys_start) * 2) + 1);
1134                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1135                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1136                         printk("   MAC: %pM", mac);
1137                 } else
1138                         printk("   DEFAULT KEY");
1139                 printk("\n");
1140         }
1141 }
1142
1143 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1144 {
1145         u32 macctl;
1146         u16 ucstat;
1147         bool hwps;
1148         bool awake;
1149         int i;
1150
1151         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1152                     (ps_flags & B43_PS_DISABLED));
1153         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1154
1155         if (ps_flags & B43_PS_ENABLED) {
1156                 hwps = true;
1157         } else if (ps_flags & B43_PS_DISABLED) {
1158                 hwps = false;
1159         } else {
1160                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1161                 //      and thus is not an AP and we are associated, set bit 25
1162         }
1163         if (ps_flags & B43_PS_AWAKE) {
1164                 awake = true;
1165         } else if (ps_flags & B43_PS_ASLEEP) {
1166                 awake = false;
1167         } else {
1168                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1169                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1170                 //      successful, set bit26
1171         }
1172
1173 /* FIXME: For now we force awake-on and hwps-off */
1174         hwps = false;
1175         awake = true;
1176
1177         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1178         if (hwps)
1179                 macctl |= B43_MACCTL_HWPS;
1180         else
1181                 macctl &= ~B43_MACCTL_HWPS;
1182         if (awake)
1183                 macctl |= B43_MACCTL_AWAKE;
1184         else
1185                 macctl &= ~B43_MACCTL_AWAKE;
1186         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1187         /* Commit write */
1188         b43_read32(dev, B43_MMIO_MACCTL);
1189         if (awake && dev->dev->core_rev >= 5) {
1190                 /* Wait for the microcode to wake up. */
1191                 for (i = 0; i < 100; i++) {
1192                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1193                                                 B43_SHM_SH_UCODESTAT);
1194                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1195                                 break;
1196                         udelay(10);
1197                 }
1198         }
1199 }
1200
1201 /* http://bcm-v4.sipsolutions.net/802.11/PHY/BmacCorePllReset */
1202 void b43_wireless_core_phy_pll_reset(struct b43_wldev *dev)
1203 {
1204         struct bcma_drv_cc *bcma_cc __maybe_unused;
1205         struct ssb_chipcommon *ssb_cc __maybe_unused;
1206
1207         switch (dev->dev->bus_type) {
1208 #ifdef CONFIG_B43_BCMA
1209         case B43_BUS_BCMA:
1210                 bcma_cc = &dev->dev->bdev->bus->drv_cc;
1211
1212                 bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
1213                 bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1214                 bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
1215                 bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1216                 break;
1217 #endif
1218 #ifdef CONFIG_B43_SSB
1219         case B43_BUS_SSB:
1220                 ssb_cc = &dev->dev->sdev->bus->chipco;
1221
1222                 chipco_write32(ssb_cc, SSB_CHIPCO_CHIPCTL_ADDR, 0);
1223                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1224                 chipco_set32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, 0x4);
1225                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1226                 break;
1227 #endif
1228         }
1229 }
1230
1231 #ifdef CONFIG_B43_BCMA
1232 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1233 {
1234         u32 flags;
1235
1236         /* Put PHY into reset */
1237         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1238         flags |= B43_BCMA_IOCTL_PHY_RESET;
1239         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1240         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1241         udelay(2);
1242
1243         b43_phy_take_out_of_reset(dev);
1244 }
1245
1246 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1247 {
1248         u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1249                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1250         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1251                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
1252         u32 flags;
1253
1254         flags = B43_BCMA_IOCTL_PHY_CLKEN;
1255         if (gmode)
1256                 flags |= B43_BCMA_IOCTL_GMODE;
1257         b43_device_enable(dev, flags);
1258
1259         if (dev->phy.type == B43_PHYTYPE_AC) {
1260                 u16 tmp;
1261
1262                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1263                 tmp &= ~B43_BCMA_IOCTL_DAC;
1264                 tmp |= 0x100;
1265                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1266
1267                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1268                 tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
1269                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1270
1271                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1272                 tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
1273                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1274         }
1275
1276         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1277         b43_bcma_phy_reset(dev);
1278         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1279 }
1280 #endif
1281
1282 #ifdef CONFIG_B43_SSB
1283 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1284 {
1285         u32 flags = 0;
1286
1287         if (gmode)
1288                 flags |= B43_TMSLOW_GMODE;
1289         flags |= B43_TMSLOW_PHYCLKEN;
1290         flags |= B43_TMSLOW_PHYRESET;
1291         if (dev->phy.type == B43_PHYTYPE_N)
1292                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1293         b43_device_enable(dev, flags);
1294         msleep(2);              /* Wait for the PLL to turn on. */
1295
1296         b43_phy_take_out_of_reset(dev);
1297 }
1298 #endif
1299
1300 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1301 {
1302         u32 macctl;
1303
1304         switch (dev->dev->bus_type) {
1305 #ifdef CONFIG_B43_BCMA
1306         case B43_BUS_BCMA:
1307                 b43_bcma_wireless_core_reset(dev, gmode);
1308                 break;
1309 #endif
1310 #ifdef CONFIG_B43_SSB
1311         case B43_BUS_SSB:
1312                 b43_ssb_wireless_core_reset(dev, gmode);
1313                 break;
1314 #endif
1315         }
1316
1317         /* Turn Analog ON, but only if we already know the PHY-type.
1318          * This protects against very early setup where we don't know the
1319          * PHY-type, yet. wireless_core_reset will be called once again later,
1320          * when we know the PHY-type. */
1321         if (dev->phy.ops)
1322                 dev->phy.ops->switch_analog(dev, 1);
1323
1324         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1325         macctl &= ~B43_MACCTL_GMODE;
1326         if (gmode)
1327                 macctl |= B43_MACCTL_GMODE;
1328         macctl |= B43_MACCTL_IHR_ENABLED;
1329         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1330 }
1331
1332 static void handle_irq_transmit_status(struct b43_wldev *dev)
1333 {
1334         u32 v0, v1;
1335         u16 tmp;
1336         struct b43_txstatus stat;
1337
1338         while (1) {
1339                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1340                 if (!(v0 & 0x00000001))
1341                         break;
1342                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1343
1344                 stat.cookie = (v0 >> 16);
1345                 stat.seq = (v1 & 0x0000FFFF);
1346                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1347                 tmp = (v0 & 0x0000FFFF);
1348                 stat.frame_count = ((tmp & 0xF000) >> 12);
1349                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1350                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1351                 stat.pm_indicated = !!(tmp & 0x0080);
1352                 stat.intermediate = !!(tmp & 0x0040);
1353                 stat.for_ampdu = !!(tmp & 0x0020);
1354                 stat.acked = !!(tmp & 0x0002);
1355
1356                 b43_handle_txstatus(dev, &stat);
1357         }
1358 }
1359
1360 static void drain_txstatus_queue(struct b43_wldev *dev)
1361 {
1362         u32 dummy;
1363
1364         if (dev->dev->core_rev < 5)
1365                 return;
1366         /* Read all entries from the microcode TXstatus FIFO
1367          * and throw them away.
1368          */
1369         while (1) {
1370                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1371                 if (!(dummy & 0x00000001))
1372                         break;
1373                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1374         }
1375 }
1376
1377 static u32 b43_jssi_read(struct b43_wldev *dev)
1378 {
1379         u32 val = 0;
1380
1381         val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1382         val <<= 16;
1383         val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1384
1385         return val;
1386 }
1387
1388 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1389 {
1390         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1391                         (jssi & 0x0000FFFF));
1392         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1393                         (jssi & 0xFFFF0000) >> 16);
1394 }
1395
1396 static void b43_generate_noise_sample(struct b43_wldev *dev)
1397 {
1398         b43_jssi_write(dev, 0x7F7F7F7F);
1399         b43_write32(dev, B43_MMIO_MACCMD,
1400                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1401 }
1402
1403 static void b43_calculate_link_quality(struct b43_wldev *dev)
1404 {
1405         /* Top half of Link Quality calculation. */
1406
1407         if (dev->phy.type != B43_PHYTYPE_G)
1408                 return;
1409         if (dev->noisecalc.calculation_running)
1410                 return;
1411         dev->noisecalc.calculation_running = true;
1412         dev->noisecalc.nr_samples = 0;
1413
1414         b43_generate_noise_sample(dev);
1415 }
1416
1417 static void handle_irq_noise(struct b43_wldev *dev)
1418 {
1419         struct b43_phy_g *phy = dev->phy.g;
1420         u16 tmp;
1421         u8 noise[4];
1422         u8 i, j;
1423         s32 average;
1424
1425         /* Bottom half of Link Quality calculation. */
1426
1427         if (dev->phy.type != B43_PHYTYPE_G)
1428                 return;
1429
1430         /* Possible race condition: It might be possible that the user
1431          * changed to a different channel in the meantime since we
1432          * started the calculation. We ignore that fact, since it's
1433          * not really that much of a problem. The background noise is
1434          * an estimation only anyway. Slightly wrong results will get damped
1435          * by the averaging of the 8 sample rounds. Additionally the
1436          * value is shortlived. So it will be replaced by the next noise
1437          * calculation round soon. */
1438
1439         B43_WARN_ON(!dev->noisecalc.calculation_running);
1440         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1441         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1442             noise[2] == 0x7F || noise[3] == 0x7F)
1443                 goto generate_new;
1444
1445         /* Get the noise samples. */
1446         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1447         i = dev->noisecalc.nr_samples;
1448         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1449         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1450         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1451         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1452         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1453         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1454         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1455         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1456         dev->noisecalc.nr_samples++;
1457         if (dev->noisecalc.nr_samples == 8) {
1458                 /* Calculate the Link Quality by the noise samples. */
1459                 average = 0;
1460                 for (i = 0; i < 8; i++) {
1461                         for (j = 0; j < 4; j++)
1462                                 average += dev->noisecalc.samples[i][j];
1463                 }
1464                 average /= (8 * 4);
1465                 average *= 125;
1466                 average += 64;
1467                 average /= 128;
1468                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1469                 tmp = (tmp / 128) & 0x1F;
1470                 if (tmp >= 8)
1471                         average += 2;
1472                 else
1473                         average -= 25;
1474                 if (tmp == 8)
1475                         average -= 72;
1476                 else
1477                         average -= 48;
1478
1479                 dev->stats.link_noise = average;
1480                 dev->noisecalc.calculation_running = false;
1481                 return;
1482         }
1483 generate_new:
1484         b43_generate_noise_sample(dev);
1485 }
1486
1487 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1488 {
1489         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1490                 ///TODO: PS TBTT
1491         } else {
1492                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1493                         b43_power_saving_ctl_bits(dev, 0);
1494         }
1495         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1496                 dev->dfq_valid = true;
1497 }
1498
1499 static void handle_irq_atim_end(struct b43_wldev *dev)
1500 {
1501         if (dev->dfq_valid) {
1502                 b43_write32(dev, B43_MMIO_MACCMD,
1503                             b43_read32(dev, B43_MMIO_MACCMD)
1504                             | B43_MACCMD_DFQ_VALID);
1505                 dev->dfq_valid = false;
1506         }
1507 }
1508
1509 static void handle_irq_pmq(struct b43_wldev *dev)
1510 {
1511         u32 tmp;
1512
1513         //TODO: AP mode.
1514
1515         while (1) {
1516                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1517                 if (!(tmp & 0x00000008))
1518                         break;
1519         }
1520         /* 16bit write is odd, but correct. */
1521         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1522 }
1523
1524 static void b43_write_template_common(struct b43_wldev *dev,
1525                                       const u8 *data, u16 size,
1526                                       u16 ram_offset,
1527                                       u16 shm_size_offset, u8 rate)
1528 {
1529         u32 i, tmp;
1530         struct b43_plcp_hdr4 plcp;
1531
1532         plcp.data = 0;
1533         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1534         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1535         ram_offset += sizeof(u32);
1536         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1537          * So leave the first two bytes of the next write blank.
1538          */
1539         tmp = (u32) (data[0]) << 16;
1540         tmp |= (u32) (data[1]) << 24;
1541         b43_ram_write(dev, ram_offset, tmp);
1542         ram_offset += sizeof(u32);
1543         for (i = 2; i < size; i += sizeof(u32)) {
1544                 tmp = (u32) (data[i + 0]);
1545                 if (i + 1 < size)
1546                         tmp |= (u32) (data[i + 1]) << 8;
1547                 if (i + 2 < size)
1548                         tmp |= (u32) (data[i + 2]) << 16;
1549                 if (i + 3 < size)
1550                         tmp |= (u32) (data[i + 3]) << 24;
1551                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1552         }
1553         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1554                         size + sizeof(struct b43_plcp_hdr6));
1555 }
1556
1557 /* Check if the use of the antenna that ieee80211 told us to
1558  * use is possible. This will fall back to DEFAULT.
1559  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1560 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1561                                   u8 antenna_nr)
1562 {
1563         u8 antenna_mask;
1564
1565         if (antenna_nr == 0) {
1566                 /* Zero means "use default antenna". That's always OK. */
1567                 return 0;
1568         }
1569
1570         /* Get the mask of available antennas. */
1571         if (dev->phy.gmode)
1572                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1573         else
1574                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1575
1576         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1577                 /* This antenna is not available. Fall back to default. */
1578                 return 0;
1579         }
1580
1581         return antenna_nr;
1582 }
1583
1584 /* Convert a b43 antenna number value to the PHY TX control value. */
1585 static u16 b43_antenna_to_phyctl(int antenna)
1586 {
1587         switch (antenna) {
1588         case B43_ANTENNA0:
1589                 return B43_TXH_PHY_ANT0;
1590         case B43_ANTENNA1:
1591                 return B43_TXH_PHY_ANT1;
1592         case B43_ANTENNA2:
1593                 return B43_TXH_PHY_ANT2;
1594         case B43_ANTENNA3:
1595                 return B43_TXH_PHY_ANT3;
1596         case B43_ANTENNA_AUTO0:
1597         case B43_ANTENNA_AUTO1:
1598                 return B43_TXH_PHY_ANT01AUTO;
1599         }
1600         B43_WARN_ON(1);
1601         return 0;
1602 }
1603
1604 static void b43_write_beacon_template(struct b43_wldev *dev,
1605                                       u16 ram_offset,
1606                                       u16 shm_size_offset)
1607 {
1608         unsigned int i, len, variable_len;
1609         const struct ieee80211_mgmt *bcn;
1610         const u8 *ie;
1611         bool tim_found = false;
1612         unsigned int rate;
1613         u16 ctl;
1614         int antenna;
1615         struct ieee80211_tx_info *info;
1616         unsigned long flags;
1617         struct sk_buff *beacon_skb;
1618
1619         spin_lock_irqsave(&dev->wl->beacon_lock, flags);
1620         info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1621         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1622         /* Clone the beacon, so it cannot go away, while we write it to hw. */
1623         beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
1624         spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
1625
1626         if (!beacon_skb) {
1627                 b43dbg(dev->wl, "Could not upload beacon. "
1628                        "Failed to clone beacon skb.");
1629                 return;
1630         }
1631
1632         bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
1633         len = min_t(size_t, beacon_skb->len,
1634                     0x200 - sizeof(struct b43_plcp_hdr6));
1635
1636         b43_write_template_common(dev, (const u8 *)bcn,
1637                                   len, ram_offset, shm_size_offset, rate);
1638
1639         /* Write the PHY TX control parameters. */
1640         antenna = B43_ANTENNA_DEFAULT;
1641         antenna = b43_antenna_to_phyctl(antenna);
1642         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1643         /* We can't send beacons with short preamble. Would get PHY errors. */
1644         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1645         ctl &= ~B43_TXH_PHY_ANT;
1646         ctl &= ~B43_TXH_PHY_ENC;
1647         ctl |= antenna;
1648         if (b43_is_cck_rate(rate))
1649                 ctl |= B43_TXH_PHY_ENC_CCK;
1650         else
1651                 ctl |= B43_TXH_PHY_ENC_OFDM;
1652         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1653
1654         /* Find the position of the TIM and the DTIM_period value
1655          * and write them to SHM. */
1656         ie = bcn->u.beacon.variable;
1657         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1658         for (i = 0; i < variable_len - 2; ) {
1659                 uint8_t ie_id, ie_len;
1660
1661                 ie_id = ie[i];
1662                 ie_len = ie[i + 1];
1663                 if (ie_id == 5) {
1664                         u16 tim_position;
1665                         u16 dtim_period;
1666                         /* This is the TIM Information Element */
1667
1668                         /* Check whether the ie_len is in the beacon data range. */
1669                         if (variable_len < ie_len + 2 + i)
1670                                 break;
1671                         /* A valid TIM is at least 4 bytes long. */
1672                         if (ie_len < 4)
1673                                 break;
1674                         tim_found = true;
1675
1676                         tim_position = sizeof(struct b43_plcp_hdr6);
1677                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1678                         tim_position += i;
1679
1680                         dtim_period = ie[i + 3];
1681
1682                         b43_shm_write16(dev, B43_SHM_SHARED,
1683                                         B43_SHM_SH_TIMBPOS, tim_position);
1684                         b43_shm_write16(dev, B43_SHM_SHARED,
1685                                         B43_SHM_SH_DTIMPER, dtim_period);
1686                         break;
1687                 }
1688                 i += ie_len + 2;
1689         }
1690         if (!tim_found) {
1691                 /*
1692                  * If ucode wants to modify TIM do it behind the beacon, this
1693                  * will happen, for example, when doing mesh networking.
1694                  */
1695                 b43_shm_write16(dev, B43_SHM_SHARED,
1696                                 B43_SHM_SH_TIMBPOS,
1697                                 len + sizeof(struct b43_plcp_hdr6));
1698                 b43_shm_write16(dev, B43_SHM_SHARED,
1699                                 B43_SHM_SH_DTIMPER, 0);
1700         }
1701         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1702
1703         dev_kfree_skb_any(beacon_skb);
1704 }
1705
1706 static void b43_upload_beacon0(struct b43_wldev *dev)
1707 {
1708         struct b43_wl *wl = dev->wl;
1709
1710         if (wl->beacon0_uploaded)
1711                 return;
1712         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1713         wl->beacon0_uploaded = true;
1714 }
1715
1716 static void b43_upload_beacon1(struct b43_wldev *dev)
1717 {
1718         struct b43_wl *wl = dev->wl;
1719
1720         if (wl->beacon1_uploaded)
1721                 return;
1722         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1723         wl->beacon1_uploaded = true;
1724 }
1725
1726 static void handle_irq_beacon(struct b43_wldev *dev)
1727 {
1728         struct b43_wl *wl = dev->wl;
1729         u32 cmd, beacon0_valid, beacon1_valid;
1730
1731         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1732             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1733             !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1734                 return;
1735
1736         /* This is the bottom half of the asynchronous beacon update. */
1737
1738         /* Ignore interrupt in the future. */
1739         dev->irq_mask &= ~B43_IRQ_BEACON;
1740
1741         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1742         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1743         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1744
1745         /* Schedule interrupt manually, if busy. */
1746         if (beacon0_valid && beacon1_valid) {
1747                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1748                 dev->irq_mask |= B43_IRQ_BEACON;
1749                 return;
1750         }
1751
1752         if (unlikely(wl->beacon_templates_virgin)) {
1753                 /* We never uploaded a beacon before.
1754                  * Upload both templates now, but only mark one valid. */
1755                 wl->beacon_templates_virgin = false;
1756                 b43_upload_beacon0(dev);
1757                 b43_upload_beacon1(dev);
1758                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1759                 cmd |= B43_MACCMD_BEACON0_VALID;
1760                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1761         } else {
1762                 if (!beacon0_valid) {
1763                         b43_upload_beacon0(dev);
1764                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1765                         cmd |= B43_MACCMD_BEACON0_VALID;
1766                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1767                 } else if (!beacon1_valid) {
1768                         b43_upload_beacon1(dev);
1769                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1770                         cmd |= B43_MACCMD_BEACON1_VALID;
1771                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1772                 }
1773         }
1774 }
1775
1776 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1777 {
1778         u32 old_irq_mask = dev->irq_mask;
1779
1780         /* update beacon right away or defer to irq */
1781         handle_irq_beacon(dev);
1782         if (old_irq_mask != dev->irq_mask) {
1783                 /* The handler updated the IRQ mask. */
1784                 B43_WARN_ON(!dev->irq_mask);
1785                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1786                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1787                 } else {
1788                         /* Device interrupts are currently disabled. That means
1789                          * we just ran the hardirq handler and scheduled the
1790                          * IRQ thread. The thread will write the IRQ mask when
1791                          * it finished, so there's nothing to do here. Writing
1792                          * the mask _here_ would incorrectly re-enable IRQs. */
1793                 }
1794         }
1795 }
1796
1797 static void b43_beacon_update_trigger_work(struct work_struct *work)
1798 {
1799         struct b43_wl *wl = container_of(work, struct b43_wl,
1800                                          beacon_update_trigger);
1801         struct b43_wldev *dev;
1802
1803         mutex_lock(&wl->mutex);
1804         dev = wl->current_dev;
1805         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1806                 if (b43_bus_host_is_sdio(dev->dev)) {
1807                         /* wl->mutex is enough. */
1808                         b43_do_beacon_update_trigger_work(dev);
1809                         mmiowb();
1810                 } else {
1811                         spin_lock_irq(&wl->hardirq_lock);
1812                         b43_do_beacon_update_trigger_work(dev);
1813                         mmiowb();
1814                         spin_unlock_irq(&wl->hardirq_lock);
1815                 }
1816         }
1817         mutex_unlock(&wl->mutex);
1818 }
1819
1820 /* Asynchronously update the packet templates in template RAM. */
1821 static void b43_update_templates(struct b43_wl *wl)
1822 {
1823         struct sk_buff *beacon, *old_beacon;
1824         unsigned long flags;
1825
1826         /* This is the top half of the asynchronous beacon update.
1827          * The bottom half is the beacon IRQ.
1828          * Beacon update must be asynchronous to avoid sending an
1829          * invalid beacon. This can happen for example, if the firmware
1830          * transmits a beacon while we are updating it. */
1831
1832         /* We could modify the existing beacon and set the aid bit in
1833          * the TIM field, but that would probably require resizing and
1834          * moving of data within the beacon template.
1835          * Simply request a new beacon and let mac80211 do the hard work. */
1836         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1837         if (unlikely(!beacon))
1838                 return;
1839
1840         spin_lock_irqsave(&wl->beacon_lock, flags);
1841         old_beacon = wl->current_beacon;
1842         wl->current_beacon = beacon;
1843         wl->beacon0_uploaded = false;
1844         wl->beacon1_uploaded = false;
1845         spin_unlock_irqrestore(&wl->beacon_lock, flags);
1846
1847         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1848
1849         if (old_beacon)
1850                 dev_kfree_skb_any(old_beacon);
1851 }
1852
1853 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1854 {
1855         b43_time_lock(dev);
1856         if (dev->dev->core_rev >= 3) {
1857                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1858                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1859         } else {
1860                 b43_write16(dev, 0x606, (beacon_int >> 6));
1861                 b43_write16(dev, 0x610, beacon_int);
1862         }
1863         b43_time_unlock(dev);
1864         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1865 }
1866
1867 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1868 {
1869         u16 reason;
1870
1871         /* Read the register that contains the reason code for the panic. */
1872         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1873         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1874
1875         switch (reason) {
1876         default:
1877                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1878                 /* fallthrough */
1879         case B43_FWPANIC_DIE:
1880                 /* Do not restart the controller or firmware.
1881                  * The device is nonfunctional from now on.
1882                  * Restarting would result in this panic to trigger again,
1883                  * so we avoid that recursion. */
1884                 break;
1885         case B43_FWPANIC_RESTART:
1886                 b43_controller_restart(dev, "Microcode panic");
1887                 break;
1888         }
1889 }
1890
1891 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1892 {
1893         unsigned int i, cnt;
1894         u16 reason, marker_id, marker_line;
1895         __le16 *buf;
1896
1897         /* The proprietary firmware doesn't have this IRQ. */
1898         if (!dev->fw.opensource)
1899                 return;
1900
1901         /* Read the register that contains the reason code for this IRQ. */
1902         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1903
1904         switch (reason) {
1905         case B43_DEBUGIRQ_PANIC:
1906                 b43_handle_firmware_panic(dev);
1907                 break;
1908         case B43_DEBUGIRQ_DUMP_SHM:
1909                 if (!B43_DEBUG)
1910                         break; /* Only with driver debugging enabled. */
1911                 buf = kmalloc(4096, GFP_ATOMIC);
1912                 if (!buf) {
1913                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1914                         goto out;
1915                 }
1916                 for (i = 0; i < 4096; i += 2) {
1917                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1918                         buf[i / 2] = cpu_to_le16(tmp);
1919                 }
1920                 b43info(dev->wl, "Shared memory dump:\n");
1921                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1922                                16, 2, buf, 4096, 1);
1923                 kfree(buf);
1924                 break;
1925         case B43_DEBUGIRQ_DUMP_REGS:
1926                 if (!B43_DEBUG)
1927                         break; /* Only with driver debugging enabled. */
1928                 b43info(dev->wl, "Microcode register dump:\n");
1929                 for (i = 0, cnt = 0; i < 64; i++) {
1930                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1931                         if (cnt == 0)
1932                                 printk(KERN_INFO);
1933                         printk("r%02u: 0x%04X  ", i, tmp);
1934                         cnt++;
1935                         if (cnt == 6) {
1936                                 printk("\n");
1937                                 cnt = 0;
1938                         }
1939                 }
1940                 printk("\n");
1941                 break;
1942         case B43_DEBUGIRQ_MARKER:
1943                 if (!B43_DEBUG)
1944                         break; /* Only with driver debugging enabled. */
1945                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1946                                            B43_MARKER_ID_REG);
1947                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1948                                              B43_MARKER_LINE_REG);
1949                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1950                         "at line number %u\n",
1951                         marker_id, marker_line);
1952                 break;
1953         default:
1954                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1955                        reason);
1956         }
1957 out:
1958         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1959         b43_shm_write16(dev, B43_SHM_SCRATCH,
1960                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1961 }
1962
1963 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1964 {
1965         u32 reason;
1966         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1967         u32 merged_dma_reason = 0;
1968         int i;
1969
1970         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1971                 return;
1972
1973         reason = dev->irq_reason;
1974         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1975                 dma_reason[i] = dev->dma_reason[i];
1976                 merged_dma_reason |= dma_reason[i];
1977         }
1978
1979         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1980                 b43err(dev->wl, "MAC transmission error\n");
1981
1982         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1983                 b43err(dev->wl, "PHY transmission error\n");
1984                 rmb();
1985                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1986                         atomic_set(&dev->phy.txerr_cnt,
1987                                    B43_PHY_TX_BADNESS_LIMIT);
1988                         b43err(dev->wl, "Too many PHY TX errors, "
1989                                         "restarting the controller\n");
1990                         b43_controller_restart(dev, "PHY TX errors");
1991                 }
1992         }
1993
1994         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
1995                 b43err(dev->wl,
1996                         "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1997                         dma_reason[0], dma_reason[1],
1998                         dma_reason[2], dma_reason[3],
1999                         dma_reason[4], dma_reason[5]);
2000                 b43err(dev->wl, "This device does not support DMA "
2001                                "on your system. It will now be switched to PIO.\n");
2002                 /* Fall back to PIO transfers if we get fatal DMA errors! */
2003                 dev->use_pio = true;
2004                 b43_controller_restart(dev, "DMA error");
2005                 return;
2006         }
2007
2008         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
2009                 handle_irq_ucode_debug(dev);
2010         if (reason & B43_IRQ_TBTT_INDI)
2011                 handle_irq_tbtt_indication(dev);
2012         if (reason & B43_IRQ_ATIM_END)
2013                 handle_irq_atim_end(dev);
2014         if (reason & B43_IRQ_BEACON)
2015                 handle_irq_beacon(dev);
2016         if (reason & B43_IRQ_PMQ)
2017                 handle_irq_pmq(dev);
2018         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
2019                 ;/* TODO */
2020         if (reason & B43_IRQ_NOISESAMPLE_OK)
2021                 handle_irq_noise(dev);
2022
2023         /* Check the DMA reason registers for received data. */
2024         if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
2025                 if (B43_DEBUG)
2026                         b43warn(dev->wl, "RX descriptor underrun\n");
2027                 b43_dma_handle_rx_overflow(dev->dma.rx_ring);
2028         }
2029         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
2030                 if (b43_using_pio_transfers(dev))
2031                         b43_pio_rx(dev->pio.rx_queue);
2032                 else
2033                         b43_dma_rx(dev->dma.rx_ring);
2034         }
2035         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
2036         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
2037         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
2038         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
2039         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
2040
2041         if (reason & B43_IRQ_TX_OK)
2042                 handle_irq_transmit_status(dev);
2043
2044         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
2045         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2046
2047 #if B43_DEBUG
2048         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2049                 dev->irq_count++;
2050                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2051                         if (reason & (1 << i))
2052                                 dev->irq_bit_count[i]++;
2053                 }
2054         }
2055 #endif
2056 }
2057
2058 /* Interrupt thread handler. Handles device interrupts in thread context. */
2059 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
2060 {
2061         struct b43_wldev *dev = dev_id;
2062
2063         mutex_lock(&dev->wl->mutex);
2064         b43_do_interrupt_thread(dev);
2065         mmiowb();
2066         mutex_unlock(&dev->wl->mutex);
2067
2068         return IRQ_HANDLED;
2069 }
2070
2071 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2072 {
2073         u32 reason;
2074
2075         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2076          * On SDIO, this runs under wl->mutex. */
2077
2078         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2079         if (reason == 0xffffffff)       /* shared IRQ */
2080                 return IRQ_NONE;
2081         reason &= dev->irq_mask;
2082         if (!reason)
2083                 return IRQ_NONE;
2084
2085         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2086             & 0x0001FC00;
2087         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2088             & 0x0000DC00;
2089         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2090             & 0x0000DC00;
2091         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2092             & 0x0001DC00;
2093         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2094             & 0x0000DC00;
2095 /* Unused ring
2096         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2097             & 0x0000DC00;
2098 */
2099
2100         /* ACK the interrupt. */
2101         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2102         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2103         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2104         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2105         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2106         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2107 /* Unused ring
2108         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2109 */
2110
2111         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2112         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2113         /* Save the reason bitmasks for the IRQ thread handler. */
2114         dev->irq_reason = reason;
2115
2116         return IRQ_WAKE_THREAD;
2117 }
2118
2119 /* Interrupt handler top-half. This runs with interrupts disabled. */
2120 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2121 {
2122         struct b43_wldev *dev = dev_id;
2123         irqreturn_t ret;
2124
2125         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2126                 return IRQ_NONE;
2127
2128         spin_lock(&dev->wl->hardirq_lock);
2129         ret = b43_do_interrupt(dev);
2130         mmiowb();
2131         spin_unlock(&dev->wl->hardirq_lock);
2132
2133         return ret;
2134 }
2135
2136 /* SDIO interrupt handler. This runs in process context. */
2137 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2138 {
2139         struct b43_wl *wl = dev->wl;
2140         irqreturn_t ret;
2141
2142         mutex_lock(&wl->mutex);
2143
2144         ret = b43_do_interrupt(dev);
2145         if (ret == IRQ_WAKE_THREAD)
2146                 b43_do_interrupt_thread(dev);
2147
2148         mutex_unlock(&wl->mutex);
2149 }
2150
2151 void b43_do_release_fw(struct b43_firmware_file *fw)
2152 {
2153         release_firmware(fw->data);
2154         fw->data = NULL;
2155         fw->filename = NULL;
2156 }
2157
2158 static void b43_release_firmware(struct b43_wldev *dev)
2159 {
2160         complete(&dev->fw_load_complete);
2161         b43_do_release_fw(&dev->fw.ucode);
2162         b43_do_release_fw(&dev->fw.pcm);
2163         b43_do_release_fw(&dev->fw.initvals);
2164         b43_do_release_fw(&dev->fw.initvals_band);
2165 }
2166
2167 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2168 {
2169         const char text[] =
2170                 "/*(DEBLOBBED)*/";
2171
2172         if (error)
2173                 b43err(wl, text);
2174         else
2175                 b43warn(wl, text);
2176 }
2177
2178 static void b43_fw_cb(const struct firmware *firmware, void *context)
2179 {
2180         struct b43_request_fw_context *ctx = context;
2181
2182         ctx->blob = firmware;
2183         complete(&ctx->dev->fw_load_complete);
2184 }
2185
2186 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2187                       const char *name,
2188                       struct b43_firmware_file *fw, bool async)
2189 {
2190         struct b43_fw_header *hdr;
2191         u32 size;
2192         int err;
2193
2194         if (!name) {
2195                 /* Don't fetch anything. Free possibly cached firmware. */
2196                 /* FIXME: We should probably keep it anyway, to save some headache
2197                  * on suspend/resume with multiband devices. */
2198                 b43_do_release_fw(fw);
2199                 return 0;
2200         }
2201         if (fw->filename) {
2202                 if ((fw->type == ctx->req_type) &&
2203                     (strcmp(fw->filename, name) == 0))
2204                         return 0; /* Already have this fw. */
2205                 /* Free the cached firmware first. */
2206                 /* FIXME: We should probably do this later after we successfully
2207                  * got the new fw. This could reduce headache with multiband devices.
2208                  * We could also redesign this to cache the firmware for all possible
2209                  * bands all the time. */
2210                 b43_do_release_fw(fw);
2211         }
2212
2213         switch (ctx->req_type) {
2214         case B43_FWTYPE_PROPRIETARY:
2215                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2216                          "/*(DEBLOBBED)*/",
2217                          modparam_fwpostfix, name);
2218                 break;
2219         case B43_FWTYPE_OPENSOURCE:
2220                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2221                          "b43-open%s/%s.fw",
2222                          modparam_fwpostfix, name);
2223                 break;
2224         default:
2225                 B43_WARN_ON(1);
2226                 return -ENOSYS;
2227         }
2228         if (async) {
2229                 /* do this part asynchronously */
2230                 init_completion(&ctx->dev->fw_load_complete);
2231                 err = maybe_reject_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2232                                               ctx->dev->dev->dev, GFP_KERNEL,
2233                                               ctx, b43_fw_cb);
2234                 if (err < 0) {
2235                         pr_err("Unable to load firmware\n");
2236                         return err;
2237                 }
2238                 wait_for_completion(&ctx->dev->fw_load_complete);
2239                 if (ctx->blob)
2240                         goto fw_ready;
2241         /* On some ARM systems, the async request will fail, but the next sync
2242          * request works. For this reason, we fall through here
2243          */
2244         }
2245         err = maybe_reject_firmware(&ctx->blob, ctx->fwname,
2246                                ctx->dev->dev->dev);
2247         if (err == -ENOENT) {
2248                 snprintf(ctx->errors[ctx->req_type],
2249                          sizeof(ctx->errors[ctx->req_type]),
2250                          "Firmware file \"%s\" not found\n",
2251                          ctx->fwname);
2252                 return err;
2253         } else if (err) {
2254                 snprintf(ctx->errors[ctx->req_type],
2255                          sizeof(ctx->errors[ctx->req_type]),
2256                          "Firmware file \"%s\" request failed (err=%d)\n",
2257                          ctx->fwname, err);
2258                 return err;
2259         }
2260 fw_ready:
2261         if (ctx->blob->size < sizeof(struct b43_fw_header))
2262                 goto err_format;
2263         hdr = (struct b43_fw_header *)(ctx->blob->data);
2264         switch (hdr->type) {
2265         case B43_FW_TYPE_UCODE:
2266         case B43_FW_TYPE_PCM:
2267                 size = be32_to_cpu(hdr->size);
2268                 if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2269                         goto err_format;
2270                 /* fallthrough */
2271         case B43_FW_TYPE_IV:
2272                 if (hdr->ver != 1)
2273                         goto err_format;
2274                 break;
2275         default:
2276                 goto err_format;
2277         }
2278
2279         fw->data = ctx->blob;
2280         fw->filename = name;
2281         fw->type = ctx->req_type;
2282
2283         return 0;
2284
2285 err_format:
2286         snprintf(ctx->errors[ctx->req_type],
2287                  sizeof(ctx->errors[ctx->req_type]),
2288                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2289         release_firmware(ctx->blob);
2290
2291         return -EPROTO;
2292 }
2293
2294 /* http://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2295 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2296 {
2297         struct b43_wldev *dev = ctx->dev;
2298         struct b43_firmware *fw = &ctx->dev->fw;
2299         struct b43_phy *phy = &dev->phy;
2300         const u8 rev = ctx->dev->dev->core_rev;
2301         const char *filename;
2302         int err;
2303
2304         /* Get microcode */
2305         filename = NULL;
2306         switch (rev) {
2307         case 42:
2308                 if (phy->type == B43_PHYTYPE_AC)
2309                         filename = "/*(DEBLOBBED)*/";
2310                 break;
2311         case 40:
2312                 if (phy->type == B43_PHYTYPE_AC)
2313                         filename = "/*(DEBLOBBED)*/";
2314                 break;
2315         case 33:
2316                 if (phy->type == B43_PHYTYPE_LCN40)
2317                         filename = "/*(DEBLOBBED)*/";
2318                 break;
2319         case 30:
2320                 if (phy->type == B43_PHYTYPE_N)
2321                         filename = "/*(DEBLOBBED)*/";
2322                 break;
2323         case 29:
2324                 if (phy->type == B43_PHYTYPE_HT)
2325                         filename = "/*(DEBLOBBED)*/";
2326                 break;
2327         case 26:
2328                 if (phy->type == B43_PHYTYPE_HT)
2329                         filename = "/*(DEBLOBBED)*/";
2330                 break;
2331         case 28:
2332         case 25:
2333                 if (phy->type == B43_PHYTYPE_N)
2334                         filename = "/*(DEBLOBBED)*/";
2335                 else if (phy->type == B43_PHYTYPE_LCN)
2336                         filename = "/*(DEBLOBBED)*/";
2337                 break;
2338         case 24:
2339                 if (phy->type == B43_PHYTYPE_LCN)
2340                         filename = "/*(DEBLOBBED)*/";
2341                 break;
2342         case 23:
2343                 if (phy->type == B43_PHYTYPE_N)
2344                         filename = "/*(DEBLOBBED)*/";
2345                 break;
2346         case 16 ... 19:
2347                 if (phy->type == B43_PHYTYPE_N)
2348                         filename = "/*(DEBLOBBED)*/";
2349                 else if (phy->type == B43_PHYTYPE_LP)
2350                         filename = "/*(DEBLOBBED)*/";
2351                 break;
2352         case 15:
2353                 filename = "/*(DEBLOBBED)*/";
2354                 break;
2355         case 14:
2356                 filename = "/*(DEBLOBBED)*/";
2357                 break;
2358         case 13:
2359                 filename = "/*(DEBLOBBED)*/";
2360                 break;
2361         case 11 ... 12:
2362                 filename = "/*(DEBLOBBED)*/";
2363                 break;
2364         case 5 ... 10:
2365                 filename = "ucode5";
2366                 break;
2367         }
2368         if (!filename)
2369                 goto err_no_ucode;
2370         err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2371         if (err)
2372                 goto err_load;
2373
2374         /* Get PCM code */
2375         if ((rev >= 5) && (rev <= 10))
2376                 filename = "/*(DEBLOBBED)*/";
2377         else if (rev >= 11)
2378                 filename = NULL;
2379         else
2380                 goto err_no_pcm;
2381         fw->pcm_request_failed = false;
2382         err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2383         if (err == -ENOENT) {
2384                 /* We did not find a PCM file? Not fatal, but
2385                  * core rev <= 10 must do without hwcrypto then. */
2386                 fw->pcm_request_failed = true;
2387         } else if (err)
2388                 goto err_load;
2389
2390         /* Get initvals */
2391         filename = NULL;
2392         switch (dev->phy.type) {
2393         case B43_PHYTYPE_G:
2394                 if (rev == 13)
2395                         filename = "/*(DEBLOBBED)*/";
2396                 else if (rev >= 5 && rev <= 10)
2397                         filename = "b0g0initvals5";
2398                 break;
2399         case B43_PHYTYPE_N:
2400                 if (rev == 30)
2401                         filename = "/*(DEBLOBBED)*/";
2402                 else if (rev == 28 || rev == 25)
2403                         filename = "/*(DEBLOBBED)*/";
2404                 else if (rev == 24)
2405                         filename = "/*(DEBLOBBED)*/";
2406                 else if (rev == 23)
2407                         filename = "/*(DEBLOBBED)*/"; /*(DEBLOBBED)*/
2408                 else if (rev >= 16 && rev <= 18)
2409                         filename = "/*(DEBLOBBED)*/";
2410                 else if (rev >= 11 && rev <= 12)
2411                         filename = "/*(DEBLOBBED)*/";
2412                 break;
2413         case B43_PHYTYPE_LP:
2414                 if (rev >= 16 && rev <= 18)
2415                         filename = "/*(DEBLOBBED)*/";
2416                 else if (rev == 15)
2417                         filename = "/*(DEBLOBBED)*/";
2418                 else if (rev == 14)
2419                         filename = "/*(DEBLOBBED)*/";
2420                 else if (rev == 13)
2421                         filename = "/*(DEBLOBBED)*/";
2422                 break;
2423         case B43_PHYTYPE_HT:
2424                 if (rev == 29)
2425                         filename = "/*(DEBLOBBED)*/";
2426                 else if (rev == 26)
2427                         filename = "/*(DEBLOBBED)*/";
2428                 break;
2429         case B43_PHYTYPE_LCN:
2430                 if (rev == 24)
2431                         filename = "/*(DEBLOBBED)*/";
2432                 break;
2433         case B43_PHYTYPE_LCN40:
2434                 if (rev == 33)
2435                         filename = "/*(DEBLOBBED)*/";
2436                 break;
2437         case B43_PHYTYPE_AC:
2438                 if (rev == 42)
2439                         filename = "/*(DEBLOBBED)*/";
2440                 else if (rev == 40)
2441                         filename = "/*(DEBLOBBED)*/";
2442                 break;
2443         }
2444         if (!filename)
2445                 goto err_no_initvals;
2446         err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2447         if (err)
2448                 goto err_load;
2449
2450         /* Get bandswitch initvals */
2451         filename = NULL;
2452         switch (dev->phy.type) {
2453         case B43_PHYTYPE_G:
2454                 if (rev == 13)
2455                         filename = "/*(DEBLOBBED)*/";
2456                 else if (rev >= 5 && rev <= 10)
2457                         filename = "b0g0bsinitvals5";
2458                 break;
2459         case B43_PHYTYPE_N:
2460                 if (rev == 30)
2461                         filename = "/*(DEBLOBBED)*/";
2462                 else if (rev == 28 || rev == 25)
2463                         filename = "/*(DEBLOBBED)*/";
2464                 else if (rev == 24)
2465                         filename = "/*(DEBLOBBED)*/";
2466                 else if (rev == 23)
2467                         filename = "/*(DEBLOBBED)*/"; /*(DEBLOBBED)*/
2468                 else if (rev >= 16 && rev <= 18)
2469                         filename = "/*(DEBLOBBED)*/";
2470                 else if (rev >= 11 && rev <= 12)
2471                         filename = "/*(DEBLOBBED)*/";
2472                 break;
2473         case B43_PHYTYPE_LP:
2474                 if (rev >= 16 && rev <= 18)
2475                         filename = "/*(DEBLOBBED)*/";
2476                 else if (rev == 15)
2477                         filename = "/*(DEBLOBBED)*/";
2478                 else if (rev == 14)
2479                         filename = "/*(DEBLOBBED)*/";
2480                 else if (rev == 13)
2481                         filename = "/*(DEBLOBBED)*/";
2482                 break;
2483         case B43_PHYTYPE_HT:
2484                 if (rev == 29)
2485                         filename = "/*(DEBLOBBED)*/";
2486                 else if (rev == 26)
2487                         filename = "/*(DEBLOBBED)*/";
2488                 break;
2489         case B43_PHYTYPE_LCN:
2490                 if (rev == 24)
2491                         filename = "/*(DEBLOBBED)*/";
2492                 break;
2493         case B43_PHYTYPE_LCN40:
2494                 if (rev == 33)
2495                         filename = "/*(DEBLOBBED)*/";
2496                 break;
2497         case B43_PHYTYPE_AC:
2498                 if (rev == 42)
2499                         filename = "/*(DEBLOBBED)*/";
2500                 else if (rev == 40)
2501                         filename = "/*(DEBLOBBED)*/";
2502                 break;
2503         }
2504         if (!filename)
2505                 goto err_no_initvals;
2506         err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2507         if (err)
2508                 goto err_load;
2509
2510         fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2511
2512         return 0;
2513
2514 err_no_ucode:
2515         err = ctx->fatal_failure = -EOPNOTSUPP;
2516         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2517                "is required for your device (wl-core rev %u)\n", rev);
2518         goto error;
2519
2520 err_no_pcm:
2521         err = ctx->fatal_failure = -EOPNOTSUPP;
2522         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2523                "is required for your device (wl-core rev %u)\n", rev);
2524         goto error;
2525
2526 err_no_initvals:
2527         err = ctx->fatal_failure = -EOPNOTSUPP;
2528         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2529                "is required for your device (wl-core rev %u)\n", rev);
2530         goto error;
2531
2532 err_load:
2533         /* We failed to load this firmware image. The error message
2534          * already is in ctx->errors. Return and let our caller decide
2535          * what to do. */
2536         goto error;
2537
2538 error:
2539         b43_release_firmware(dev);
2540         return err;
2541 }
2542
2543 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2544 static void b43_one_core_detach(struct b43_bus_dev *dev);
2545 static int b43_rng_init(struct b43_wl *wl);
2546
2547 static void b43_request_firmware(struct work_struct *work)
2548 {
2549         struct b43_wl *wl = container_of(work,
2550                             struct b43_wl, firmware_load);
2551         struct b43_wldev *dev = wl->current_dev;
2552         struct b43_request_fw_context *ctx;
2553         unsigned int i;
2554         int err;
2555         const char *errmsg;
2556
2557         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2558         if (!ctx)
2559                 return;
2560         ctx->dev = dev;
2561
2562         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2563         err = b43_try_request_fw(ctx);
2564         if (!err)
2565                 goto start_ieee80211; /* Successfully loaded it. */
2566         /* Was fw version known? */
2567         if (ctx->fatal_failure)
2568                 goto out;
2569
2570         /* proprietary fw not found, try open source */
2571         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2572         err = b43_try_request_fw(ctx);
2573         if (!err)
2574                 goto start_ieee80211; /* Successfully loaded it. */
2575         if(ctx->fatal_failure)
2576                 goto out;
2577
2578         /* Could not find a usable firmware. Print the errors. */
2579         for (i = 0; i < B43_NR_FWTYPES; i++) {
2580                 errmsg = ctx->errors[i];
2581                 if (strlen(errmsg))
2582                         b43err(dev->wl, "%s", errmsg);
2583         }
2584         b43_print_fw_helptext(dev->wl, 1);
2585         goto out;
2586
2587 start_ieee80211:
2588         wl->hw->queues = B43_QOS_QUEUE_NUM;
2589         if (!modparam_qos || dev->fw.opensource)
2590                 wl->hw->queues = 1;
2591
2592         err = ieee80211_register_hw(wl->hw);
2593         if (err)
2594                 goto err_one_core_detach;
2595         wl->hw_registred = true;
2596         b43_leds_register(wl->current_dev);
2597
2598         /* Register HW RNG driver */
2599         b43_rng_init(wl);
2600
2601         goto out;
2602
2603 err_one_core_detach:
2604         b43_one_core_detach(dev->dev);
2605
2606 out:
2607         kfree(ctx);
2608 }
2609
2610 static int b43_upload_microcode(struct b43_wldev *dev)
2611 {
2612         struct wiphy *wiphy = dev->wl->hw->wiphy;
2613         const size_t hdr_len = sizeof(struct b43_fw_header);
2614         const __be32 *data;
2615         unsigned int i, len;
2616         u16 fwrev, fwpatch, fwdate, fwtime;
2617         u32 tmp, macctl;
2618         int err = 0;
2619
2620         /* Jump the microcode PSM to offset 0 */
2621         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2622         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2623         macctl |= B43_MACCTL_PSM_JMP0;
2624         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2625         /* Zero out all microcode PSM registers and shared memory. */
2626         for (i = 0; i < 64; i++)
2627                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2628         for (i = 0; i < 4096; i += 2)
2629                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2630
2631         /* Upload Microcode. */
2632         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2633         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2634         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2635         for (i = 0; i < len; i++) {
2636                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2637                 udelay(10);
2638         }
2639
2640         if (dev->fw.pcm.data) {
2641                 /* Upload PCM data. */
2642                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2643                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2644                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2645                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2646                 /* No need for autoinc bit in SHM_HW */
2647                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2648                 for (i = 0; i < len; i++) {
2649                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2650                         udelay(10);
2651                 }
2652         }
2653
2654         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2655
2656         /* Start the microcode PSM */
2657         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2658                       B43_MACCTL_PSM_RUN);
2659
2660         /* Wait for the microcode to load and respond */
2661         i = 0;
2662         while (1) {
2663                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2664                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2665                         break;
2666                 i++;
2667                 if (i >= 20) {
2668                         b43err(dev->wl, "Microcode not responding\n");
2669                         b43_print_fw_helptext(dev->wl, 1);
2670                         err = -ENODEV;
2671                         goto error;
2672                 }
2673                 msleep(50);
2674         }
2675         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2676
2677         /* Get and check the revisions. */
2678         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2679         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2680         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2681         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2682
2683         if (fwrev <= 0x128) {
2684                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2685                        "binary drivers older than version 4.x is unsupported. "
2686                        "You must upgrade your firmware files.\n");
2687                 b43_print_fw_helptext(dev->wl, 1);
2688                 err = -EOPNOTSUPP;
2689                 goto error;
2690         }
2691         dev->fw.rev = fwrev;
2692         dev->fw.patch = fwpatch;
2693         if (dev->fw.rev >= 598)
2694                 dev->fw.hdr_format = B43_FW_HDR_598;
2695         else if (dev->fw.rev >= 410)
2696                 dev->fw.hdr_format = B43_FW_HDR_410;
2697         else
2698                 dev->fw.hdr_format = B43_FW_HDR_351;
2699         WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2700
2701         dev->qos_enabled = dev->wl->hw->queues > 1;
2702         /* Default to firmware/hardware crypto acceleration. */
2703         dev->hwcrypto_enabled = true;
2704
2705         if (!dev->fw.opensource) {
2706                 b43err(dev->wl, "Rejected non-Free firmware\n");
2707                 err = -EOPNOTSUPP;
2708                 goto error;
2709         }
2710         if (dev->fw.opensource) {
2711                 u16 fwcapa;
2712
2713                 /* Patchlevel info is encoded in the "time" field. */
2714                 dev->fw.patch = fwtime;
2715                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2716                         dev->fw.rev, dev->fw.patch);
2717
2718                 fwcapa = b43_fwcapa_read(dev);
2719                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2720                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2721                         /* Disable hardware crypto and fall back to software crypto. */
2722                         dev->hwcrypto_enabled = false;
2723                 }
2724                 /* adding QoS support should use an offline discovery mechanism */
2725                 WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2726         } else {
2727                 b43info(dev->wl, "Loading firmware version %u.%u "
2728                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2729                         fwrev, fwpatch,
2730                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2731                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2732                 if (dev->fw.pcm_request_failed) {
2733                         b43warn(dev->wl, "No \"/*(DEBLOBBED)*/\" firmware file found. "
2734                                 "Hardware accelerated cryptography is disabled.\n");
2735                         b43_print_fw_helptext(dev->wl, 0);
2736                 }
2737         }
2738
2739         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2740                         dev->fw.rev, dev->fw.patch);
2741         wiphy->hw_version = dev->dev->core_id;
2742
2743         if (dev->fw.hdr_format == B43_FW_HDR_351) {
2744                 /* We're over the deadline, but we keep support for old fw
2745                  * until it turns out to be in major conflict with something new. */
2746                 b43warn(dev->wl, "You are using an old firmware image. "
2747                         "Support for old firmware will be removed soon "
2748                         "(official deadline was July 2008).\n");
2749                 b43_print_fw_helptext(dev->wl, 0);
2750         }
2751
2752         return 0;
2753
2754 error:
2755         /* Stop the microcode PSM. */
2756         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2757                       B43_MACCTL_PSM_JMP0);
2758
2759         return err;
2760 }
2761
2762 static int b43_write_initvals(struct b43_wldev *dev,
2763                               const struct b43_iv *ivals,
2764                               size_t count,
2765                               size_t array_size)
2766 {
2767         const struct b43_iv *iv;
2768         u16 offset;
2769         size_t i;
2770         bool bit32;
2771
2772         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2773         iv = ivals;
2774         for (i = 0; i < count; i++) {
2775                 if (array_size < sizeof(iv->offset_size))
2776                         goto err_format;
2777                 array_size -= sizeof(iv->offset_size);
2778                 offset = be16_to_cpu(iv->offset_size);
2779                 bit32 = !!(offset & B43_IV_32BIT);
2780                 offset &= B43_IV_OFFSET_MASK;
2781                 if (offset >= 0x1000)
2782                         goto err_format;
2783                 if (bit32) {
2784                         u32 value;
2785
2786                         if (array_size < sizeof(iv->data.d32))
2787                                 goto err_format;
2788                         array_size -= sizeof(iv->data.d32);
2789
2790                         value = get_unaligned_be32(&iv->data.d32);
2791                         b43_write32(dev, offset, value);
2792
2793                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2794                                                         sizeof(__be16) +
2795                                                         sizeof(__be32));
2796                 } else {
2797                         u16 value;
2798
2799                         if (array_size < sizeof(iv->data.d16))
2800                                 goto err_format;
2801                         array_size -= sizeof(iv->data.d16);
2802
2803                         value = be16_to_cpu(iv->data.d16);
2804                         b43_write16(dev, offset, value);
2805
2806                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2807                                                         sizeof(__be16) +
2808                                                         sizeof(__be16));
2809                 }
2810         }
2811         if (array_size)
2812                 goto err_format;
2813
2814         return 0;
2815
2816 err_format:
2817         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2818         b43_print_fw_helptext(dev->wl, 1);
2819
2820         return -EPROTO;
2821 }
2822
2823 static int b43_upload_initvals(struct b43_wldev *dev)
2824 {
2825         const size_t hdr_len = sizeof(struct b43_fw_header);
2826         const struct b43_fw_header *hdr;
2827         struct b43_firmware *fw = &dev->fw;
2828         const struct b43_iv *ivals;
2829         size_t count;
2830
2831         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2832         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2833         count = be32_to_cpu(hdr->size);
2834         return b43_write_initvals(dev, ivals, count,
2835                                  fw->initvals.data->size - hdr_len);
2836 }
2837
2838 static int b43_upload_initvals_band(struct b43_wldev *dev)
2839 {
2840         const size_t hdr_len = sizeof(struct b43_fw_header);
2841         const struct b43_fw_header *hdr;
2842         struct b43_firmware *fw = &dev->fw;
2843         const struct b43_iv *ivals;
2844         size_t count;
2845
2846         if (!fw->initvals_band.data)
2847                 return 0;
2848
2849         hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2850         ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2851         count = be32_to_cpu(hdr->size);
2852         return b43_write_initvals(dev, ivals, count,
2853                                   fw->initvals_band.data->size - hdr_len);
2854 }
2855
2856 /* Initialize the GPIOs
2857  * http://bcm-specs.sipsolutions.net/GPIO
2858  */
2859
2860 #ifdef CONFIG_B43_SSB
2861 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2862 {
2863         struct ssb_bus *bus = dev->dev->sdev->bus;
2864
2865 #ifdef CONFIG_SSB_DRIVER_PCICORE
2866         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2867 #else
2868         return bus->chipco.dev;
2869 #endif
2870 }
2871 #endif
2872
2873 static int b43_gpio_init(struct b43_wldev *dev)
2874 {
2875 #ifdef CONFIG_B43_SSB
2876         struct ssb_device *gpiodev;
2877 #endif
2878         u32 mask, set;
2879
2880         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2881         b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2882
2883         mask = 0x0000001F;
2884         set = 0x0000000F;
2885         if (dev->dev->chip_id == 0x4301) {
2886                 mask |= 0x0060;
2887                 set |= 0x0060;
2888         } else if (dev->dev->chip_id == 0x5354) {
2889                 /* Don't allow overtaking buttons GPIOs */
2890                 set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2891         }
2892
2893         if (0 /* FIXME: conditional unknown */ ) {
2894                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2895                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2896                             | 0x0100);
2897                 /* BT Coexistance Input */
2898                 mask |= 0x0080;
2899                 set |= 0x0080;
2900                 /* BT Coexistance Out */
2901                 mask |= 0x0100;
2902                 set |= 0x0100;
2903         }
2904         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2905                 /* PA is controlled by gpio 9, let ucode handle it */
2906                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2907                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2908                             | 0x0200);
2909                 mask |= 0x0200;
2910                 set |= 0x0200;
2911         }
2912
2913         switch (dev->dev->bus_type) {
2914 #ifdef CONFIG_B43_BCMA
2915         case B43_BUS_BCMA:
2916                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2917                 break;
2918 #endif
2919 #ifdef CONFIG_B43_SSB
2920         case B43_BUS_SSB:
2921                 gpiodev = b43_ssb_gpio_dev(dev);
2922                 if (gpiodev)
2923                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2924                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2925                                     & ~mask) | set);
2926                 break;
2927 #endif
2928         }
2929
2930         return 0;
2931 }
2932
2933 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2934 static void b43_gpio_cleanup(struct b43_wldev *dev)
2935 {
2936 #ifdef CONFIG_B43_SSB
2937         struct ssb_device *gpiodev;
2938 #endif
2939
2940         switch (dev->dev->bus_type) {
2941 #ifdef CONFIG_B43_BCMA
2942         case B43_BUS_BCMA:
2943                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2944                 break;
2945 #endif
2946 #ifdef CONFIG_B43_SSB
2947         case B43_BUS_SSB:
2948                 gpiodev = b43_ssb_gpio_dev(dev);
2949                 if (gpiodev)
2950                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2951                 break;
2952 #endif
2953         }
2954 }
2955
2956 /* http://bcm-specs.sipsolutions.net/EnableMac */
2957 void b43_mac_enable(struct b43_wldev *dev)
2958 {
2959         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2960                 u16 fwstate;
2961
2962                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2963                                          B43_SHM_SH_UCODESTAT);
2964                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2965                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2966                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2967                                "should be suspended, but current state is %u\n",
2968                                fwstate);
2969                 }
2970         }
2971
2972         dev->mac_suspended--;
2973         B43_WARN_ON(dev->mac_suspended < 0);
2974         if (dev->mac_suspended == 0) {
2975                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2976                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2977                             B43_IRQ_MAC_SUSPENDED);
2978                 /* Commit writes */
2979                 b43_read32(dev, B43_MMIO_MACCTL);
2980                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2981                 b43_power_saving_ctl_bits(dev, 0);
2982         }
2983 }
2984
2985 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2986 void b43_mac_suspend(struct b43_wldev *dev)
2987 {
2988         int i;
2989         u32 tmp;
2990
2991         might_sleep();
2992         B43_WARN_ON(dev->mac_suspended < 0);
2993
2994         if (dev->mac_suspended == 0) {
2995                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2996                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
2997                 /* force pci to flush the write */
2998                 b43_read32(dev, B43_MMIO_MACCTL);
2999                 for (i = 35; i; i--) {
3000                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3001                         if (tmp & B43_IRQ_MAC_SUSPENDED)
3002                                 goto out;
3003                         udelay(10);
3004                 }
3005                 /* Hm, it seems this will take some time. Use msleep(). */
3006                 for (i = 40; i; i--) {
3007                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3008                         if (tmp & B43_IRQ_MAC_SUSPENDED)
3009                                 goto out;
3010                         msleep(1);
3011                 }
3012                 b43err(dev->wl, "MAC suspend failed\n");
3013         }
3014 out:
3015         dev->mac_suspended++;
3016 }
3017
3018 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
3019 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
3020 {
3021         u32 tmp;
3022
3023         switch (dev->dev->bus_type) {
3024 #ifdef CONFIG_B43_BCMA
3025         case B43_BUS_BCMA:
3026                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3027                 if (on)
3028                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
3029                 else
3030                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
3031                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3032                 break;
3033 #endif
3034 #ifdef CONFIG_B43_SSB
3035         case B43_BUS_SSB:
3036                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3037                 if (on)
3038                         tmp |= B43_TMSLOW_MACPHYCLKEN;
3039                 else
3040                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
3041                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3042                 break;
3043 #endif
3044         }
3045 }
3046
3047 /* brcms_b_switch_macfreq */
3048 void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
3049 {
3050         u16 chip_id = dev->dev->chip_id;
3051
3052         if (chip_id == BCMA_CHIP_ID_BCM4331) {
3053                 switch (spurmode) {
3054                 case 2: /* 168 Mhz: 2^26/168 = 0x61862 */
3055                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x1862);
3056                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3057                         break;
3058                 case 1: /* 164 Mhz: 2^26/164 = 0x63e70 */
3059                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x3e70);
3060                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3061                         break;
3062                 default: /* 160 Mhz: 2^26/160 = 0x66666 */
3063                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x6666);
3064                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3065                         break;
3066                 }
3067         } else if (chip_id == BCMA_CHIP_ID_BCM43131 ||
3068             chip_id == BCMA_CHIP_ID_BCM43217 ||
3069             chip_id == BCMA_CHIP_ID_BCM43222 ||
3070             chip_id == BCMA_CHIP_ID_BCM43224 ||
3071             chip_id == BCMA_CHIP_ID_BCM43225 ||
3072             chip_id == BCMA_CHIP_ID_BCM43227 ||
3073             chip_id == BCMA_CHIP_ID_BCM43228) {
3074                 switch (spurmode) {
3075                 case 2: /* 126 Mhz */
3076                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
3077                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3078                         break;
3079                 case 1: /* 123 Mhz */
3080                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3081                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3082                         break;
3083                 default: /* 120 Mhz */
3084                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3085                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3086                         break;
3087                 }
3088         } else if (dev->phy.type == B43_PHYTYPE_LCN) {
3089                 switch (spurmode) {
3090                 case 1: /* 82 Mhz */
3091                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3092                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3093                         break;
3094                 default: /* 80 Mhz */
3095                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3096                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3097                         break;
3098                 }
3099         }
3100 }
3101
3102 static void b43_adjust_opmode(struct b43_wldev *dev)
3103 {
3104         struct b43_wl *wl = dev->wl;
3105         u32 ctl;
3106         u16 cfp_pretbtt;
3107
3108         ctl = b43_read32(dev, B43_MMIO_MACCTL);
3109         /* Reset status to STA infrastructure mode. */
3110         ctl &= ~B43_MACCTL_AP;
3111         ctl &= ~B43_MACCTL_KEEP_CTL;
3112         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3113         ctl &= ~B43_MACCTL_KEEP_BAD;
3114         ctl &= ~B43_MACCTL_PROMISC;
3115         ctl &= ~B43_MACCTL_BEACPROMISC;
3116         ctl |= B43_MACCTL_INFRA;
3117
3118         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3119             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3120                 ctl |= B43_MACCTL_AP;
3121         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3122                 ctl &= ~B43_MACCTL_INFRA;
3123
3124         if (wl->filter_flags & FIF_CONTROL)
3125                 ctl |= B43_MACCTL_KEEP_CTL;
3126         if (wl->filter_flags & FIF_FCSFAIL)
3127                 ctl |= B43_MACCTL_KEEP_BAD;
3128         if (wl->filter_flags & FIF_PLCPFAIL)
3129                 ctl |= B43_MACCTL_KEEP_BADPLCP;
3130         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3131                 ctl |= B43_MACCTL_BEACPROMISC;
3132
3133         /* Workaround: On old hardware the HW-MAC-address-filter
3134          * doesn't work properly, so always run promisc in filter
3135          * it in software. */
3136         if (dev->dev->core_rev <= 4)
3137                 ctl |= B43_MACCTL_PROMISC;
3138
3139         b43_write32(dev, B43_MMIO_MACCTL, ctl);
3140
3141         cfp_pretbtt = 2;
3142         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3143                 if (dev->dev->chip_id == 0x4306 &&
3144                     dev->dev->chip_rev == 3)
3145                         cfp_pretbtt = 100;
3146                 else
3147                         cfp_pretbtt = 50;
3148         }
3149         b43_write16(dev, 0x612, cfp_pretbtt);
3150
3151         /* FIXME: We don't currently implement the PMQ mechanism,
3152          *        so always disable it. If we want to implement PMQ,
3153          *        we need to enable it here (clear DISCPMQ) in AP mode.
3154          */
3155         if (0  /* ctl & B43_MACCTL_AP */)
3156                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3157         else
3158                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3159 }
3160
3161 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3162 {
3163         u16 offset;
3164
3165         if (is_ofdm) {
3166                 offset = 0x480;
3167                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3168         } else {
3169                 offset = 0x4C0;
3170                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3171         }
3172         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3173                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
3174 }
3175
3176 static void b43_rate_memory_init(struct b43_wldev *dev)
3177 {
3178         switch (dev->phy.type) {
3179         case B43_PHYTYPE_G:
3180         case B43_PHYTYPE_N:
3181         case B43_PHYTYPE_LP:
3182         case B43_PHYTYPE_HT:
3183         case B43_PHYTYPE_LCN:
3184                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3185                 b43_rate_memory_write(dev, B43_OFDM_RATE_9MB, 1);
3186                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3187                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3188                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3189                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3190                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3191                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3192                 /* fallthrough */
3193         case B43_PHYTYPE_B:
3194                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3195                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3196                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3197                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3198                 break;
3199         default:
3200                 B43_WARN_ON(1);
3201         }
3202 }
3203
3204 /* Set the default values for the PHY TX Control Words. */
3205 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3206 {
3207         u16 ctl = 0;
3208
3209         ctl |= B43_TXH_PHY_ENC_CCK;
3210         ctl |= B43_TXH_PHY_ANT01AUTO;
3211         ctl |= B43_TXH_PHY_TXPWR;
3212
3213         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3214         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3215         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3216 }
3217
3218 /* Set the TX-Antenna for management frames sent by firmware. */
3219 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3220 {
3221         u16 ant;
3222         u16 tmp;
3223
3224         ant = b43_antenna_to_phyctl(antenna);
3225
3226         /* For ACK/CTS */
3227         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3228         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3229         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3230         /* For Probe Resposes */
3231         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3232         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3233         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3234 }
3235
3236 /* This is the opposite of b43_chip_init() */
3237 static void b43_chip_exit(struct b43_wldev *dev)
3238 {
3239         b43_phy_exit(dev);
3240         b43_gpio_cleanup(dev);
3241         /* firmware is released later */
3242 }
3243
3244 /* Initialize the chip
3245  * http://bcm-specs.sipsolutions.net/ChipInit
3246  */
3247 static int b43_chip_init(struct b43_wldev *dev)
3248 {
3249         struct b43_phy *phy = &dev->phy;
3250         int err;
3251         u32 macctl;
3252         u16 value16;
3253
3254         /* Initialize the MAC control */
3255         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3256         if (dev->phy.gmode)
3257                 macctl |= B43_MACCTL_GMODE;
3258         macctl |= B43_MACCTL_INFRA;
3259         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3260
3261         err = b43_upload_microcode(dev);
3262         if (err)
3263                 goto out;       /* firmware is released later */
3264
3265         err = b43_gpio_init(dev);
3266         if (err)
3267                 goto out;       /* firmware is released later */
3268
3269         err = b43_upload_initvals(dev);
3270         if (err)
3271                 goto err_gpio_clean;
3272
3273         err = b43_upload_initvals_band(dev);
3274         if (err)
3275                 goto err_gpio_clean;
3276
3277         /* Turn the Analog on and initialize the PHY. */
3278         phy->ops->switch_analog(dev, 1);
3279         err = b43_phy_init(dev);
3280         if (err)
3281                 goto err_gpio_clean;
3282
3283         /* Disable Interference Mitigation. */
3284         if (phy->ops->interf_mitigation)
3285                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3286
3287         /* Select the antennae */
3288         if (phy->ops->set_rx_antenna)
3289                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3290         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3291
3292         if (phy->type == B43_PHYTYPE_B) {
3293                 value16 = b43_read16(dev, 0x005E);
3294                 value16 |= 0x0004;
3295                 b43_write16(dev, 0x005E, value16);
3296         }
3297         b43_write32(dev, 0x0100, 0x01000000);
3298         if (dev->dev->core_rev < 5)
3299                 b43_write32(dev, 0x010C, 0x01000000);
3300
3301         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3302         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3303
3304         /* Probe Response Timeout value */
3305         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3306         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3307
3308         /* Initially set the wireless operation mode. */
3309         b43_adjust_opmode(dev);
3310
3311         if (dev->dev->core_rev < 3) {
3312                 b43_write16(dev, 0x060E, 0x0000);
3313                 b43_write16(dev, 0x0610, 0x8000);
3314                 b43_write16(dev, 0x0604, 0x0000);
3315                 b43_write16(dev, 0x0606, 0x0200);
3316         } else {
3317                 b43_write32(dev, 0x0188, 0x80000000);
3318                 b43_write32(dev, 0x018C, 0x02000000);
3319         }
3320         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3321         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3322         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3323         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3324         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3325         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3326         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3327
3328         b43_mac_phy_clock_set(dev, true);
3329
3330         switch (dev->dev->bus_type) {
3331 #ifdef CONFIG_B43_BCMA
3332         case B43_BUS_BCMA:
3333                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3334                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3335                 break;
3336 #endif
3337 #ifdef CONFIG_B43_SSB
3338         case B43_BUS_SSB:
3339                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3340                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3341                 break;
3342 #endif
3343         }
3344
3345         err = 0;
3346         b43dbg(dev->wl, "Chip initialized\n");
3347 out:
3348         return err;
3349
3350 err_gpio_clean:
3351         b43_gpio_cleanup(dev);
3352         return err;
3353 }
3354
3355 static void b43_periodic_every60sec(struct b43_wldev *dev)
3356 {
3357         const struct b43_phy_operations *ops = dev->phy.ops;
3358
3359         if (ops->pwork_60sec)
3360                 ops->pwork_60sec(dev);
3361
3362         /* Force check the TX power emission now. */
3363         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3364 }
3365
3366 static void b43_periodic_every30sec(struct b43_wldev *dev)
3367 {
3368         /* Update device statistics. */
3369         b43_calculate_link_quality(dev);
3370 }
3371
3372 static void b43_periodic_every15sec(struct b43_wldev *dev)
3373 {
3374         struct b43_phy *phy = &dev->phy;
3375         u16 wdr;
3376
3377         if (dev->fw.opensource) {
3378                 /* Check if the firmware is still alive.
3379                  * It will reset the watchdog counter to 0 in its idle loop. */
3380                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3381                 if (unlikely(wdr)) {
3382                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3383                         b43_controller_restart(dev, "Firmware watchdog");
3384                         return;
3385                 } else {
3386                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3387                                         B43_WATCHDOG_REG, 1);
3388                 }
3389         }
3390
3391         if (phy->ops->pwork_15sec)
3392                 phy->ops->pwork_15sec(dev);
3393
3394         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3395         wmb();
3396
3397 #if B43_DEBUG
3398         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3399                 unsigned int i;
3400
3401                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3402                        dev->irq_count / 15,
3403                        dev->tx_count / 15,
3404                        dev->rx_count / 15);
3405                 dev->irq_count = 0;
3406                 dev->tx_count = 0;
3407                 dev->rx_count = 0;
3408                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3409                         if (dev->irq_bit_count[i]) {
3410                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3411                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3412                                 dev->irq_bit_count[i] = 0;
3413                         }
3414                 }
3415         }
3416 #endif
3417 }
3418
3419 static void do_periodic_work(struct b43_wldev *dev)
3420 {
3421         unsigned int state;
3422
3423         state = dev->periodic_state;
3424         if (state % 4 == 0)
3425                 b43_periodic_every60sec(dev);
3426         if (state % 2 == 0)
3427                 b43_periodic_every30sec(dev);
3428         b43_periodic_every15sec(dev);
3429 }
3430
3431 /* Periodic work locking policy:
3432  *      The whole periodic work handler is protected by
3433  *      wl->mutex. If another lock is needed somewhere in the
3434  *      pwork callchain, it's acquired in-place, where it's needed.
3435  */
3436 static void b43_periodic_work_handler(struct work_struct *work)
3437 {
3438         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3439                                              periodic_work.work);
3440         struct b43_wl *wl = dev->wl;
3441         unsigned long delay;
3442
3443         mutex_lock(&wl->mutex);
3444
3445         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3446                 goto out;
3447         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3448                 goto out_requeue;
3449
3450         do_periodic_work(dev);
3451
3452         dev->periodic_state++;
3453 out_requeue:
3454         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3455                 delay = msecs_to_jiffies(50);
3456         else
3457                 delay = round_jiffies_relative(HZ * 15);
3458         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3459 out:
3460         mutex_unlock(&wl->mutex);
3461 }
3462
3463 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3464 {
3465         struct delayed_work *work = &dev->periodic_work;
3466
3467         dev->periodic_state = 0;
3468         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3469         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3470 }
3471
3472 /* Check if communication with the device works correctly. */
3473 static int b43_validate_chipaccess(struct b43_wldev *dev)
3474 {
3475         u32 v, backup0, backup4;
3476
3477         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3478         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3479
3480         /* Check for read/write and endianness problems. */
3481         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3482         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3483                 goto error;
3484         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3485         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3486                 goto error;
3487
3488         /* Check if unaligned 32bit SHM_SHARED access works properly.
3489          * However, don't bail out on failure, because it's noncritical. */
3490         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3491         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3492         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3493         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3494         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3495                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3496         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3497         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3498             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3499             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3500             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3501                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3502
3503         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3504         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3505
3506         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3507                 /* The 32bit register shadows the two 16bit registers
3508                  * with update sideeffects. Validate this. */
3509                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3510                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3511                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3512                         goto error;
3513                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3514                         goto error;
3515         }
3516         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3517
3518         v = b43_read32(dev, B43_MMIO_MACCTL);
3519         v |= B43_MACCTL_GMODE;
3520         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3521                 goto error;
3522
3523         return 0;
3524 error:
3525         b43err(dev->wl, "Failed to validate the chipaccess\n");
3526         return -ENODEV;
3527 }
3528
3529 static void b43_security_init(struct b43_wldev *dev)
3530 {
3531         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3532         /* KTP is a word address, but we address SHM bytewise.
3533          * So multiply by two.
3534          */
3535         dev->ktp *= 2;
3536         /* Number of RCMTA address slots */
3537         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3538         /* Clear the key memory. */
3539         b43_clear_keys(dev);
3540 }
3541
3542 #ifdef CONFIG_B43_HWRNG
3543 static int b43_rng_read(struct hwrng *rng, u32 *data)
3544 {
3545         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3546         struct b43_wldev *dev;
3547         int count = -ENODEV;
3548
3549         mutex_lock(&wl->mutex);
3550         dev = wl->current_dev;
3551         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3552                 *data = b43_read16(dev, B43_MMIO_RNG);
3553                 count = sizeof(u16);
3554         }
3555         mutex_unlock(&wl->mutex);
3556
3557         return count;
3558 }
3559 #endif /* CONFIG_B43_HWRNG */
3560
3561 static void b43_rng_exit(struct b43_wl *wl)
3562 {
3563 #ifdef CONFIG_B43_HWRNG
3564         if (wl->rng_initialized)
3565                 hwrng_unregister(&wl->rng);
3566 #endif /* CONFIG_B43_HWRNG */
3567 }
3568
3569 static int b43_rng_init(struct b43_wl *wl)
3570 {
3571         int err = 0;
3572
3573 #ifdef CONFIG_B43_HWRNG
3574         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3575                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3576         wl->rng.name = wl->rng_name;
3577         wl->rng.data_read = b43_rng_read;
3578         wl->rng.priv = (unsigned long)wl;
3579         wl->rng_initialized = true;
3580         err = hwrng_register(&wl->rng);
3581         if (err) {
3582                 wl->rng_initialized = false;
3583                 b43err(wl, "Failed to register the random "
3584                        "number generator (%d)\n", err);
3585         }
3586 #endif /* CONFIG_B43_HWRNG */
3587
3588         return err;
3589 }
3590
3591 static void b43_tx_work(struct work_struct *work)
3592 {
3593         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3594         struct b43_wldev *dev;
3595         struct sk_buff *skb;
3596         int queue_num;
3597         int err = 0;
3598
3599         mutex_lock(&wl->mutex);
3600         dev = wl->current_dev;
3601         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3602                 mutex_unlock(&wl->mutex);
3603                 return;
3604         }
3605
3606         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3607                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
3608                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
3609                         if (b43_using_pio_transfers(dev))
3610                                 err = b43_pio_tx(dev, skb);
3611                         else
3612                                 err = b43_dma_tx(dev, skb);
3613                         if (err == -ENOSPC) {
3614                                 wl->tx_queue_stopped[queue_num] = 1;
3615                                 ieee80211_stop_queue(wl->hw, queue_num);
3616                                 skb_queue_head(&wl->tx_queue[queue_num], skb);
3617                                 break;
3618                         }
3619                         if (unlikely(err))
3620                                 ieee80211_free_txskb(wl->hw, skb);
3621                         err = 0;
3622                 }
3623
3624                 if (!err)
3625                         wl->tx_queue_stopped[queue_num] = 0;
3626         }
3627
3628 #if B43_DEBUG
3629         dev->tx_count++;
3630 #endif
3631         mutex_unlock(&wl->mutex);
3632 }
3633
3634 static void b43_op_tx(struct ieee80211_hw *hw,
3635                       struct ieee80211_tx_control *control,
3636                       struct sk_buff *skb)
3637 {
3638         struct b43_wl *wl = hw_to_b43_wl(hw);
3639
3640         if (unlikely(skb->len < 2 + 2 + 6)) {
3641                 /* Too short, this can't be a valid frame. */
3642                 ieee80211_free_txskb(hw, skb);
3643                 return;
3644         }
3645         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3646
3647         skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3648         if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3649                 ieee80211_queue_work(wl->hw, &wl->tx_work);
3650         } else {
3651                 ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3652         }
3653 }
3654
3655 static void b43_qos_params_upload(struct b43_wldev *dev,
3656                                   const struct ieee80211_tx_queue_params *p,
3657                                   u16 shm_offset)
3658 {
3659         u16 params[B43_NR_QOSPARAMS];
3660         int bslots, tmp;
3661         unsigned int i;
3662
3663         if (!dev->qos_enabled)
3664                 return;
3665
3666         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3667
3668         memset(&params, 0, sizeof(params));
3669
3670         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3671         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3672         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3673         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3674         params[B43_QOSPARAM_AIFS] = p->aifs;
3675         params[B43_QOSPARAM_BSLOTS] = bslots;
3676         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3677
3678         for (i = 0; i < ARRAY_SIZE(params); i++) {
3679                 if (i == B43_QOSPARAM_STATUS) {
3680                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3681                                              shm_offset + (i * 2));
3682                         /* Mark the parameters as updated. */
3683                         tmp |= 0x100;
3684                         b43_shm_write16(dev, B43_SHM_SHARED,
3685                                         shm_offset + (i * 2),
3686                                         tmp);
3687                 } else {
3688                         b43_shm_write16(dev, B43_SHM_SHARED,
3689                                         shm_offset + (i * 2),
3690                                         params[i]);
3691                 }
3692         }
3693 }
3694
3695 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3696 static const u16 b43_qos_shm_offsets[] = {
3697         /* [mac80211-queue-nr] = SHM_OFFSET, */
3698         [0] = B43_QOS_VOICE,
3699         [1] = B43_QOS_VIDEO,
3700         [2] = B43_QOS_BESTEFFORT,
3701         [3] = B43_QOS_BACKGROUND,
3702 };
3703
3704 /* Update all QOS parameters in hardware. */
3705 static void b43_qos_upload_all(struct b43_wldev *dev)
3706 {
3707         struct b43_wl *wl = dev->wl;
3708         struct b43_qos_params *params;
3709         unsigned int i;
3710
3711         if (!dev->qos_enabled)
3712                 return;
3713
3714         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3715                      ARRAY_SIZE(wl->qos_params));
3716
3717         b43_mac_suspend(dev);
3718         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3719                 params = &(wl->qos_params[i]);
3720                 b43_qos_params_upload(dev, &(params->p),
3721                                       b43_qos_shm_offsets[i]);
3722         }
3723         b43_mac_enable(dev);
3724 }
3725
3726 static void b43_qos_clear(struct b43_wl *wl)
3727 {
3728         struct b43_qos_params *params;
3729         unsigned int i;
3730
3731         /* Initialize QoS parameters to sane defaults. */
3732
3733         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3734                      ARRAY_SIZE(wl->qos_params));
3735
3736         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3737                 params = &(wl->qos_params[i]);
3738
3739                 switch (b43_qos_shm_offsets[i]) {
3740                 case B43_QOS_VOICE:
3741                         params->p.txop = 0;
3742                         params->p.aifs = 2;
3743                         params->p.cw_min = 0x0001;
3744                         params->p.cw_max = 0x0001;
3745                         break;
3746                 case B43_QOS_VIDEO:
3747                         params->p.txop = 0;
3748                         params->p.aifs = 2;
3749                         params->p.cw_min = 0x0001;
3750                         params->p.cw_max = 0x0001;
3751                         break;
3752                 case B43_QOS_BESTEFFORT:
3753                         params->p.txop = 0;
3754                         params->p.aifs = 3;
3755                         params->p.cw_min = 0x0001;
3756                         params->p.cw_max = 0x03FF;
3757                         break;
3758                 case B43_QOS_BACKGROUND:
3759                         params->p.txop = 0;
3760                         params->p.aifs = 7;
3761                         params->p.cw_min = 0x0001;
3762                         params->p.cw_max = 0x03FF;
3763                         break;
3764                 default:
3765                         B43_WARN_ON(1);
3766                 }
3767         }
3768 }
3769
3770 /* Initialize the core's QOS capabilities */
3771 static void b43_qos_init(struct b43_wldev *dev)
3772 {
3773         if (!dev->qos_enabled) {
3774                 /* Disable QOS support. */
3775                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3776                 b43_write16(dev, B43_MMIO_IFSCTL,
3777                             b43_read16(dev, B43_MMIO_IFSCTL)
3778                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3779                 b43dbg(dev->wl, "QoS disabled\n");
3780                 return;
3781         }
3782
3783         /* Upload the current QOS parameters. */
3784         b43_qos_upload_all(dev);
3785
3786         /* Enable QOS support. */
3787         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3788         b43_write16(dev, B43_MMIO_IFSCTL,
3789                     b43_read16(dev, B43_MMIO_IFSCTL)
3790                     | B43_MMIO_IFSCTL_USE_EDCF);
3791         b43dbg(dev->wl, "QoS enabled\n");
3792 }
3793
3794 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3795                           struct ieee80211_vif *vif, u16 _queue,
3796                           const struct ieee80211_tx_queue_params *params)
3797 {
3798         struct b43_wl *wl = hw_to_b43_wl(hw);
3799         struct b43_wldev *dev;
3800         unsigned int queue = (unsigned int)_queue;
3801         int err = -ENODEV;
3802
3803         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3804                 /* Queue not available or don't support setting
3805                  * params on this queue. Return success to not
3806                  * confuse mac80211. */
3807                 return 0;
3808         }
3809         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3810                      ARRAY_SIZE(wl->qos_params));
3811
3812         mutex_lock(&wl->mutex);
3813         dev = wl->current_dev;
3814         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3815                 goto out_unlock;
3816
3817         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3818         b43_mac_suspend(dev);
3819         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3820                               b43_qos_shm_offsets[queue]);
3821         b43_mac_enable(dev);
3822         err = 0;
3823
3824 out_unlock:
3825         mutex_unlock(&wl->mutex);
3826
3827         return err;
3828 }
3829
3830 static int b43_op_get_stats(struct ieee80211_hw *hw,
3831                             struct ieee80211_low_level_stats *stats)
3832 {
3833         struct b43_wl *wl = hw_to_b43_wl(hw);
3834
3835         mutex_lock(&wl->mutex);
3836         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3837         mutex_unlock(&wl->mutex);
3838
3839         return 0;
3840 }
3841
3842 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3843 {
3844         struct b43_wl *wl = hw_to_b43_wl(hw);
3845         struct b43_wldev *dev;
3846         u64 tsf;
3847
3848         mutex_lock(&wl->mutex);
3849         dev = wl->current_dev;
3850
3851         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3852                 b43_tsf_read(dev, &tsf);
3853         else
3854                 tsf = 0;
3855
3856         mutex_unlock(&wl->mutex);
3857
3858         return tsf;
3859 }
3860
3861 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3862                            struct ieee80211_vif *vif, u64 tsf)
3863 {
3864         struct b43_wl *wl = hw_to_b43_wl(hw);
3865         struct b43_wldev *dev;
3866
3867         mutex_lock(&wl->mutex);
3868         dev = wl->current_dev;
3869
3870         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3871                 b43_tsf_write(dev, tsf);
3872
3873         mutex_unlock(&wl->mutex);
3874 }
3875
3876 static const char *band_to_string(enum nl80211_band band)
3877 {
3878         switch (band) {
3879         case NL80211_BAND_5GHZ:
3880                 return "5";
3881         case NL80211_BAND_2GHZ:
3882                 return "2.4";
3883         default:
3884                 break;
3885         }
3886         B43_WARN_ON(1);
3887         return "";
3888 }
3889
3890 /* Expects wl->mutex locked */
3891 static int b43_switch_band(struct b43_wldev *dev,
3892                            struct ieee80211_channel *chan)
3893 {
3894         struct b43_phy *phy = &dev->phy;
3895         bool gmode;
3896         u32 tmp;
3897
3898         switch (chan->band) {
3899         case NL80211_BAND_5GHZ:
3900                 gmode = false;
3901                 break;
3902         case NL80211_BAND_2GHZ:
3903                 gmode = true;
3904                 break;
3905         default:
3906                 B43_WARN_ON(1);
3907                 return -EINVAL;
3908         }
3909
3910         if (!((gmode && phy->supports_2ghz) ||
3911               (!gmode && phy->supports_5ghz))) {
3912                 b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3913                        band_to_string(chan->band));
3914                 return -ENODEV;
3915         }
3916
3917         if (!!phy->gmode == !!gmode) {
3918                 /* This device is already running. */
3919                 return 0;
3920         }
3921
3922         b43dbg(dev->wl, "Switching to %s GHz band\n",
3923                band_to_string(chan->band));
3924
3925         /* Some new devices don't need disabling radio for band switching */
3926         if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3927                 b43_software_rfkill(dev, true);
3928
3929         phy->gmode = gmode;
3930         b43_phy_put_into_reset(dev);
3931         switch (dev->dev->bus_type) {
3932 #ifdef CONFIG_B43_BCMA
3933         case B43_BUS_BCMA:
3934                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3935                 if (gmode)
3936                         tmp |= B43_BCMA_IOCTL_GMODE;
3937                 else
3938                         tmp &= ~B43_BCMA_IOCTL_GMODE;
3939                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3940                 break;
3941 #endif
3942 #ifdef CONFIG_B43_SSB
3943         case B43_BUS_SSB:
3944                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3945                 if (gmode)
3946                         tmp |= B43_TMSLOW_GMODE;
3947                 else
3948                         tmp &= ~B43_TMSLOW_GMODE;
3949                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3950                 break;
3951 #endif
3952         }
3953         b43_phy_take_out_of_reset(dev);
3954
3955         b43_upload_initvals_band(dev);
3956
3957         b43_phy_init(dev);
3958
3959         return 0;
3960 }
3961
3962 static void b43_set_beacon_listen_interval(struct b43_wldev *dev, u16 interval)
3963 {
3964         interval = min_t(u16, interval, (u16)0xFF);
3965         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BCN_LI, interval);
3966 }
3967
3968 /* Write the short and long frame retry limit values. */
3969 static void b43_set_retry_limits(struct b43_wldev *dev,
3970                                  unsigned int short_retry,
3971                                  unsigned int long_retry)
3972 {
3973         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3974          * the chip-internal counter. */
3975         short_retry = min(short_retry, (unsigned int)0xF);
3976         long_retry = min(long_retry, (unsigned int)0xF);
3977
3978         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3979                         short_retry);
3980         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3981                         long_retry);
3982 }
3983
3984 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3985 {
3986         struct b43_wl *wl = hw_to_b43_wl(hw);
3987         struct b43_wldev *dev = wl->current_dev;
3988         struct b43_phy *phy = &dev->phy;
3989         struct ieee80211_conf *conf = &hw->conf;
3990         int antenna;
3991         int err = 0;
3992
3993         mutex_lock(&wl->mutex);
3994         b43_mac_suspend(dev);
3995
3996         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL)
3997                 b43_set_beacon_listen_interval(dev, conf->listen_interval);
3998
3999         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
4000                 phy->chandef = &conf->chandef;
4001                 phy->channel = conf->chandef.chan->hw_value;
4002
4003                 /* Switch the band (if necessary). */
4004                 err = b43_switch_band(dev, conf->chandef.chan);
4005                 if (err)
4006                         goto out_mac_enable;
4007
4008                 /* Switch to the requested channel.
4009                  * The firmware takes care of races with the TX handler.
4010                  */
4011                 b43_switch_channel(dev, phy->channel);
4012         }
4013
4014         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
4015                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
4016                                           conf->long_frame_max_tx_count);
4017         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
4018         if (!changed)
4019                 goto out_mac_enable;
4020
4021         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
4022
4023         /* Adjust the desired TX power level. */
4024         if (conf->power_level != 0) {
4025                 if (conf->power_level != phy->desired_txpower) {
4026                         phy->desired_txpower = conf->power_level;
4027                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
4028                                                    B43_TXPWR_IGNORE_TSSI);
4029                 }
4030         }
4031
4032         /* Antennas for RX and management frame TX. */
4033         antenna = B43_ANTENNA_DEFAULT;
4034         b43_mgmtframe_txantenna(dev, antenna);
4035         antenna = B43_ANTENNA_DEFAULT;
4036         if (phy->ops->set_rx_antenna)
4037                 phy->ops->set_rx_antenna(dev, antenna);
4038
4039         if (wl->radio_enabled != phy->radio_on) {
4040                 if (wl->radio_enabled) {
4041                         b43_software_rfkill(dev, false);
4042                         b43info(dev->wl, "Radio turned on by software\n");
4043                         if (!dev->radio_hw_enable) {
4044                                 b43info(dev->wl, "The hardware RF-kill button "
4045                                         "still turns the radio physically off. "
4046                                         "Press the button to turn it on.\n");
4047                         }
4048                 } else {
4049                         b43_software_rfkill(dev, true);
4050                         b43info(dev->wl, "Radio turned off by software\n");
4051                 }
4052         }
4053
4054 out_mac_enable:
4055         b43_mac_enable(dev);
4056         mutex_unlock(&wl->mutex);
4057
4058         return err;
4059 }
4060
4061 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
4062 {
4063         struct ieee80211_supported_band *sband =
4064                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
4065         struct ieee80211_rate *rate;
4066         int i;
4067         u16 basic, direct, offset, basic_offset, rateptr;
4068
4069         for (i = 0; i < sband->n_bitrates; i++) {
4070                 rate = &sband->bitrates[i];
4071
4072                 if (b43_is_cck_rate(rate->hw_value)) {
4073                         direct = B43_SHM_SH_CCKDIRECT;
4074                         basic = B43_SHM_SH_CCKBASIC;
4075                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4076                         offset &= 0xF;
4077                 } else {
4078                         direct = B43_SHM_SH_OFDMDIRECT;
4079                         basic = B43_SHM_SH_OFDMBASIC;
4080                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4081                         offset &= 0xF;
4082                 }
4083
4084                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4085
4086                 if (b43_is_cck_rate(rate->hw_value)) {
4087                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4088                         basic_offset &= 0xF;
4089                 } else {
4090                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4091                         basic_offset &= 0xF;
4092                 }
4093
4094                 /*
4095                  * Get the pointer that we need to point to
4096                  * from the direct map
4097                  */
4098                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4099                                          direct + 2 * basic_offset);
4100                 /* and write it to the basic map */
4101                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4102                                 rateptr);
4103         }
4104 }
4105
4106 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4107                                     struct ieee80211_vif *vif,
4108                                     struct ieee80211_bss_conf *conf,
4109                                     u32 changed)
4110 {
4111         struct b43_wl *wl = hw_to_b43_wl(hw);
4112         struct b43_wldev *dev;
4113
4114         mutex_lock(&wl->mutex);
4115
4116         dev = wl->current_dev;
4117         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4118                 goto out_unlock_mutex;
4119
4120         B43_WARN_ON(wl->vif != vif);
4121
4122         if (changed & BSS_CHANGED_BSSID) {
4123                 if (conf->bssid)
4124                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4125                 else
4126                         eth_zero_addr(wl->bssid);
4127         }
4128
4129         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4130                 if (changed & BSS_CHANGED_BEACON &&
4131                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4132                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4133                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4134                         b43_update_templates(wl);
4135
4136                 if (changed & BSS_CHANGED_BSSID)
4137                         b43_write_mac_bssid_templates(dev);
4138         }
4139
4140         b43_mac_suspend(dev);
4141
4142         /* Update templates for AP/mesh mode. */
4143         if (changed & BSS_CHANGED_BEACON_INT &&
4144             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4145              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4146              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4147             conf->beacon_int)
4148                 b43_set_beacon_int(dev, conf->beacon_int);
4149
4150         if (changed & BSS_CHANGED_BASIC_RATES)
4151                 b43_update_basic_rates(dev, conf->basic_rates);
4152
4153         if (changed & BSS_CHANGED_ERP_SLOT) {
4154                 if (conf->use_short_slot)
4155                         b43_short_slot_timing_enable(dev);
4156                 else
4157                         b43_short_slot_timing_disable(dev);
4158         }
4159
4160         b43_mac_enable(dev);
4161 out_unlock_mutex:
4162         mutex_unlock(&wl->mutex);
4163 }
4164
4165 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4166                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4167                           struct ieee80211_key_conf *key)
4168 {
4169         struct b43_wl *wl = hw_to_b43_wl(hw);
4170         struct b43_wldev *dev;
4171         u8 algorithm;
4172         u8 index;
4173         int err;
4174         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4175
4176         if (modparam_nohwcrypt)
4177                 return -ENOSPC; /* User disabled HW-crypto */
4178
4179         if ((vif->type == NL80211_IFTYPE_ADHOC ||
4180              vif->type == NL80211_IFTYPE_MESH_POINT) &&
4181             (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4182              key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4183             !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4184                 /*
4185                  * For now, disable hw crypto for the RSN IBSS group keys. This
4186                  * could be optimized in the future, but until that gets
4187                  * implemented, use of software crypto for group addressed
4188                  * frames is a acceptable to allow RSN IBSS to be used.
4189                  */
4190                 return -EOPNOTSUPP;
4191         }
4192
4193         mutex_lock(&wl->mutex);
4194
4195         dev = wl->current_dev;
4196         err = -ENODEV;
4197         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4198                 goto out_unlock;
4199
4200         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4201                 /* We don't have firmware for the crypto engine.
4202                  * Must use software-crypto. */
4203                 err = -EOPNOTSUPP;
4204                 goto out_unlock;
4205         }
4206
4207         err = -EINVAL;
4208         switch (key->cipher) {
4209         case WLAN_CIPHER_SUITE_WEP40:
4210                 algorithm = B43_SEC_ALGO_WEP40;
4211                 break;
4212         case WLAN_CIPHER_SUITE_WEP104:
4213                 algorithm = B43_SEC_ALGO_WEP104;
4214                 break;
4215         case WLAN_CIPHER_SUITE_TKIP:
4216                 algorithm = B43_SEC_ALGO_TKIP;
4217                 break;
4218         case WLAN_CIPHER_SUITE_CCMP:
4219                 algorithm = B43_SEC_ALGO_AES;
4220                 break;
4221         default:
4222                 B43_WARN_ON(1);
4223                 goto out_unlock;
4224         }
4225         index = (u8) (key->keyidx);
4226         if (index > 3)
4227                 goto out_unlock;
4228
4229         switch (cmd) {
4230         case SET_KEY:
4231                 if (algorithm == B43_SEC_ALGO_TKIP &&
4232                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4233                     !modparam_hwtkip)) {
4234                         /* We support only pairwise key */
4235                         err = -EOPNOTSUPP;
4236                         goto out_unlock;
4237                 }
4238
4239                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4240                         if (WARN_ON(!sta)) {
4241                                 err = -EOPNOTSUPP;
4242                                 goto out_unlock;
4243                         }
4244                         /* Pairwise key with an assigned MAC address. */
4245                         err = b43_key_write(dev, -1, algorithm,
4246                                             key->key, key->keylen,
4247                                             sta->addr, key);
4248                 } else {
4249                         /* Group key */
4250                         err = b43_key_write(dev, index, algorithm,
4251                                             key->key, key->keylen, NULL, key);
4252                 }
4253                 if (err)
4254                         goto out_unlock;
4255
4256                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4257                     algorithm == B43_SEC_ALGO_WEP104) {
4258                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4259                 } else {
4260                         b43_hf_write(dev,
4261                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4262                 }
4263                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4264                 if (algorithm == B43_SEC_ALGO_TKIP)
4265                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4266                 break;
4267         case DISABLE_KEY: {
4268                 err = b43_key_clear(dev, key->hw_key_idx);
4269                 if (err)
4270                         goto out_unlock;
4271                 break;
4272         }
4273         default:
4274                 B43_WARN_ON(1);
4275         }
4276
4277 out_unlock:
4278         if (!err) {
4279                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4280                        "mac: %pM\n",
4281                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4282                        sta ? sta->addr : bcast_addr);
4283                 b43_dump_keymemory(dev);
4284         }
4285         mutex_unlock(&wl->mutex);
4286
4287         return err;
4288 }
4289
4290 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4291                                     unsigned int changed, unsigned int *fflags,
4292                                     u64 multicast)
4293 {
4294         struct b43_wl *wl = hw_to_b43_wl(hw);
4295         struct b43_wldev *dev;
4296
4297         mutex_lock(&wl->mutex);
4298         dev = wl->current_dev;
4299         if (!dev) {
4300                 *fflags = 0;
4301                 goto out_unlock;
4302         }
4303
4304         *fflags &= FIF_ALLMULTI |
4305                   FIF_FCSFAIL |
4306                   FIF_PLCPFAIL |
4307                   FIF_CONTROL |
4308                   FIF_OTHER_BSS |
4309                   FIF_BCN_PRBRESP_PROMISC;
4310
4311         changed &= FIF_ALLMULTI |
4312                    FIF_FCSFAIL |
4313                    FIF_PLCPFAIL |
4314                    FIF_CONTROL |
4315                    FIF_OTHER_BSS |
4316                    FIF_BCN_PRBRESP_PROMISC;
4317
4318         wl->filter_flags = *fflags;
4319
4320         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4321                 b43_adjust_opmode(dev);
4322
4323 out_unlock:
4324         mutex_unlock(&wl->mutex);
4325 }
4326
4327 /* Locking: wl->mutex
4328  * Returns the current dev. This might be different from the passed in dev,
4329  * because the core might be gone away while we unlocked the mutex. */
4330 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4331 {
4332         struct b43_wl *wl;
4333         struct b43_wldev *orig_dev;
4334         u32 mask;
4335         int queue_num;
4336
4337         if (!dev)
4338                 return NULL;
4339         wl = dev->wl;
4340 redo:
4341         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4342                 return dev;
4343
4344         /* Cancel work. Unlock to avoid deadlocks. */
4345         mutex_unlock(&wl->mutex);
4346         cancel_delayed_work_sync(&dev->periodic_work);
4347         cancel_work_sync(&wl->tx_work);
4348         b43_leds_stop(dev);
4349         mutex_lock(&wl->mutex);
4350         dev = wl->current_dev;
4351         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4352                 /* Whoops, aliens ate up the device while we were unlocked. */
4353                 return dev;
4354         }
4355
4356         /* Disable interrupts on the device. */
4357         b43_set_status(dev, B43_STAT_INITIALIZED);
4358         if (b43_bus_host_is_sdio(dev->dev)) {
4359                 /* wl->mutex is locked. That is enough. */
4360                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4361                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4362         } else {
4363                 spin_lock_irq(&wl->hardirq_lock);
4364                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4365                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4366                 spin_unlock_irq(&wl->hardirq_lock);
4367         }
4368         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4369         orig_dev = dev;
4370         mutex_unlock(&wl->mutex);
4371         if (b43_bus_host_is_sdio(dev->dev))
4372                 b43_sdio_free_irq(dev);
4373         else
4374                 free_irq(dev->dev->irq, dev);
4375         mutex_lock(&wl->mutex);
4376         dev = wl->current_dev;
4377         if (!dev)
4378                 return dev;
4379         if (dev != orig_dev) {
4380                 if (b43_status(dev) >= B43_STAT_STARTED)
4381                         goto redo;
4382                 return dev;
4383         }
4384         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4385         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4386
4387         /* Drain all TX queues. */
4388         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4389                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
4390                         struct sk_buff *skb;
4391
4392                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
4393                         ieee80211_free_txskb(wl->hw, skb);
4394                 }
4395         }
4396
4397         b43_mac_suspend(dev);
4398         b43_leds_exit(dev);
4399         b43dbg(wl, "Wireless interface stopped\n");
4400
4401         return dev;
4402 }
4403
4404 /* Locking: wl->mutex */
4405 static int b43_wireless_core_start(struct b43_wldev *dev)
4406 {
4407         int err;
4408
4409         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4410
4411         drain_txstatus_queue(dev);
4412         if (b43_bus_host_is_sdio(dev->dev)) {
4413                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4414                 if (err) {
4415                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4416                         goto out;
4417                 }
4418         } else {
4419                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4420                                            b43_interrupt_thread_handler,
4421                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4422                 if (err) {
4423                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4424                                dev->dev->irq);
4425                         goto out;
4426                 }
4427         }
4428
4429         /* We are ready to run. */
4430         ieee80211_wake_queues(dev->wl->hw);
4431         b43_set_status(dev, B43_STAT_STARTED);
4432
4433         /* Start data flow (TX/RX). */
4434         b43_mac_enable(dev);
4435         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4436
4437         /* Start maintenance work */
4438         b43_periodic_tasks_setup(dev);
4439
4440         b43_leds_init(dev);
4441
4442         b43dbg(dev->wl, "Wireless interface started\n");
4443 out:
4444         return err;
4445 }
4446
4447 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4448 {
4449         switch (phy_type) {
4450         case B43_PHYTYPE_A:
4451                 return "A";
4452         case B43_PHYTYPE_B:
4453                 return "B";
4454         case B43_PHYTYPE_G:
4455                 return "G";
4456         case B43_PHYTYPE_N:
4457                 return "N";
4458         case B43_PHYTYPE_LP:
4459                 return "LP";
4460         case B43_PHYTYPE_SSLPN:
4461                 return "SSLPN";
4462         case B43_PHYTYPE_HT:
4463                 return "HT";
4464         case B43_PHYTYPE_LCN:
4465                 return "LCN";
4466         case B43_PHYTYPE_LCNXN:
4467                 return "LCNXN";
4468         case B43_PHYTYPE_LCN40:
4469                 return "LCN40";
4470         case B43_PHYTYPE_AC:
4471                 return "AC";
4472         }
4473         return "UNKNOWN";
4474 }
4475
4476 /* Get PHY and RADIO versioning numbers */
4477 static int b43_phy_versioning(struct b43_wldev *dev)
4478 {
4479         struct b43_phy *phy = &dev->phy;
4480         const u8 core_rev = dev->dev->core_rev;
4481         u32 tmp;
4482         u8 analog_type;
4483         u8 phy_type;
4484         u8 phy_rev;
4485         u16 radio_manuf;
4486         u16 radio_id;
4487         u16 radio_rev;
4488         u8 radio_ver;
4489         int unsupported = 0;
4490
4491         /* Get PHY versioning */
4492         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4493         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4494         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4495         phy_rev = (tmp & B43_PHYVER_VERSION);
4496
4497         /* LCNXN is continuation of N which run out of revisions */
4498         if (phy_type == B43_PHYTYPE_LCNXN) {
4499                 phy_type = B43_PHYTYPE_N;
4500                 phy_rev += 16;
4501         }
4502
4503         switch (phy_type) {
4504 #ifdef CONFIG_B43_PHY_G
4505         case B43_PHYTYPE_G:
4506                 if (phy_rev > 9)
4507                         unsupported = 1;
4508                 break;
4509 #endif
4510 #ifdef CONFIG_B43_PHY_N
4511         case B43_PHYTYPE_N:
4512                 if (phy_rev >= 19)
4513                         unsupported = 1;
4514                 break;
4515 #endif
4516 #ifdef CONFIG_B43_PHY_LP
4517         case B43_PHYTYPE_LP:
4518                 if (phy_rev > 2)
4519                         unsupported = 1;
4520                 break;
4521 #endif
4522 #ifdef CONFIG_B43_PHY_HT
4523         case B43_PHYTYPE_HT:
4524                 if (phy_rev > 1)
4525                         unsupported = 1;
4526                 break;
4527 #endif
4528 #ifdef CONFIG_B43_PHY_LCN
4529         case B43_PHYTYPE_LCN:
4530                 if (phy_rev > 1)
4531                         unsupported = 1;
4532                 break;
4533 #endif
4534 #ifdef CONFIG_B43_PHY_AC
4535         case B43_PHYTYPE_AC:
4536                 if (phy_rev > 1)
4537                         unsupported = 1;
4538                 break;
4539 #endif
4540         default:
4541                 unsupported = 1;
4542         }
4543         if (unsupported) {
4544                 b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4545                        analog_type, phy_type, b43_phy_name(dev, phy_type),
4546                        phy_rev);
4547                 return -EOPNOTSUPP;
4548         }
4549         b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4550                 analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4551
4552         /* Get RADIO versioning */
4553         if (core_rev == 40 || core_rev == 42) {
4554                 radio_manuf = 0x17F;
4555
4556                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 0);
4557                 radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4558
4559                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 1);
4560                 radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4561
4562                 radio_ver = 0; /* Is there version somewhere? */
4563         } else if (core_rev >= 24) {
4564                 u16 radio24[3];
4565
4566                 for (tmp = 0; tmp < 3; tmp++) {
4567                         b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4568                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4569                 }
4570
4571                 radio_manuf = 0x17F;
4572                 radio_id = (radio24[2] << 8) | radio24[1];
4573                 radio_rev = (radio24[0] & 0xF);
4574                 radio_ver = (radio24[0] & 0xF0) >> 4;
4575         } else {
4576                 if (dev->dev->chip_id == 0x4317) {
4577                         if (dev->dev->chip_rev == 0)
4578                                 tmp = 0x3205017F;
4579                         else if (dev->dev->chip_rev == 1)
4580                                 tmp = 0x4205017F;
4581                         else
4582                                 tmp = 0x5205017F;
4583                 } else {
4584                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4585                                      B43_RADIOCTL_ID);
4586                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4587                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4588                                      B43_RADIOCTL_ID);
4589                         tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4590                 }
4591                 radio_manuf = (tmp & 0x00000FFF);
4592                 radio_id = (tmp & 0x0FFFF000) >> 12;
4593                 radio_rev = (tmp & 0xF0000000) >> 28;
4594                 radio_ver = 0; /* Probably not available on old hw */
4595         }
4596
4597         if (radio_manuf != 0x17F /* Broadcom */)
4598                 unsupported = 1;
4599         switch (phy_type) {
4600         case B43_PHYTYPE_B:
4601                 if ((radio_id & 0xFFF0) != 0x2050)
4602                         unsupported = 1;
4603                 break;
4604         case B43_PHYTYPE_G:
4605                 if (radio_id != 0x2050)
4606                         unsupported = 1;
4607                 break;
4608         case B43_PHYTYPE_N:
4609                 if (radio_id != 0x2055 && radio_id != 0x2056 &&
4610                     radio_id != 0x2057)
4611                         unsupported = 1;
4612                 if (radio_id == 0x2057 &&
4613                     !(radio_rev == 9 || radio_rev == 14))
4614                         unsupported = 1;
4615                 break;
4616         case B43_PHYTYPE_LP:
4617                 if (radio_id != 0x2062 && radio_id != 0x2063)
4618                         unsupported = 1;
4619                 break;
4620         case B43_PHYTYPE_HT:
4621                 if (radio_id != 0x2059)
4622                         unsupported = 1;
4623                 break;
4624         case B43_PHYTYPE_LCN:
4625                 if (radio_id != 0x2064)
4626                         unsupported = 1;
4627                 break;
4628         case B43_PHYTYPE_AC:
4629                 if (radio_id != 0x2069)
4630                         unsupported = 1;
4631                 break;
4632         default:
4633                 B43_WARN_ON(1);
4634         }
4635         if (unsupported) {
4636                 b43err(dev->wl,
4637                        "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4638                        radio_manuf, radio_id, radio_rev, radio_ver);
4639                 return -EOPNOTSUPP;
4640         }
4641         b43info(dev->wl,
4642                 "Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4643                 radio_manuf, radio_id, radio_rev, radio_ver);
4644
4645         /* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4646         phy->radio_manuf = radio_manuf;
4647         phy->radio_ver = radio_id;
4648         phy->radio_rev = radio_rev;
4649
4650         phy->analog = analog_type;
4651         phy->type = phy_type;
4652         phy->rev = phy_rev;
4653
4654         return 0;
4655 }
4656
4657 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4658                                       struct b43_phy *phy)
4659 {
4660         phy->hardware_power_control = !!modparam_hwpctl;
4661         phy->next_txpwr_check_time = jiffies;
4662         /* PHY TX errors counter. */
4663         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4664
4665 #if B43_DEBUG
4666         phy->phy_locked = false;
4667         phy->radio_locked = false;
4668 #endif
4669 }
4670
4671 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4672 {
4673         dev->dfq_valid = false;
4674
4675         /* Assume the radio is enabled. If it's not enabled, the state will
4676          * immediately get fixed on the first periodic work run. */
4677         dev->radio_hw_enable = true;
4678
4679         /* Stats */
4680         memset(&dev->stats, 0, sizeof(dev->stats));
4681
4682         setup_struct_phy_for_init(dev, &dev->phy);
4683
4684         /* IRQ related flags */
4685         dev->irq_reason = 0;
4686         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4687         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4688         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4689                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4690
4691         dev->mac_suspended = 1;
4692
4693         /* Noise calculation context */
4694         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4695 }
4696
4697 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4698 {
4699         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4700         u64 hf;
4701
4702         if (!modparam_btcoex)
4703                 return;
4704         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4705                 return;
4706         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4707                 return;
4708
4709         hf = b43_hf_read(dev);
4710         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4711                 hf |= B43_HF_BTCOEXALT;
4712         else
4713                 hf |= B43_HF_BTCOEX;
4714         b43_hf_write(dev, hf);
4715 }
4716
4717 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4718 {
4719         if (!modparam_btcoex)
4720                 return;
4721         //TODO
4722 }
4723
4724 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4725 {
4726         struct ssb_bus *bus;
4727         u32 tmp;
4728
4729 #ifdef CONFIG_B43_SSB
4730         if (dev->dev->bus_type != B43_BUS_SSB)
4731                 return;
4732 #else
4733         return;
4734 #endif
4735
4736         bus = dev->dev->sdev->bus;
4737
4738         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4739             (bus->chip_id == 0x4312)) {
4740                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4741                 tmp &= ~SSB_IMCFGLO_REQTO;
4742                 tmp &= ~SSB_IMCFGLO_SERTO;
4743                 tmp |= 0x3;
4744                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4745                 ssb_commit_settings(bus);
4746         }
4747 }
4748
4749 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4750 {
4751         u16 pu_delay;
4752
4753         /* The time value is in microseconds. */
4754         pu_delay = 1050;
4755         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4756                 pu_delay = 500;
4757         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4758                 pu_delay = max(pu_delay, (u16)2400);
4759
4760         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4761 }
4762
4763 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4764 static void b43_set_pretbtt(struct b43_wldev *dev)
4765 {
4766         u16 pretbtt;
4767
4768         /* The time value is in microseconds. */
4769         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
4770                 pretbtt = 2;
4771         else
4772                 pretbtt = 250;
4773         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4774         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4775 }
4776
4777 /* Shutdown a wireless core */
4778 /* Locking: wl->mutex */
4779 static void b43_wireless_core_exit(struct b43_wldev *dev)
4780 {
4781         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4782         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4783                 return;
4784
4785         b43_set_status(dev, B43_STAT_UNINIT);
4786
4787         /* Stop the microcode PSM. */
4788         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4789                       B43_MACCTL_PSM_JMP0);
4790
4791         switch (dev->dev->bus_type) {
4792 #ifdef CONFIG_B43_BCMA
4793         case B43_BUS_BCMA:
4794                 bcma_host_pci_down(dev->dev->bdev->bus);
4795                 break;
4796 #endif
4797 #ifdef CONFIG_B43_SSB
4798         case B43_BUS_SSB:
4799                 /* TODO */
4800                 break;
4801 #endif
4802         }
4803
4804         b43_dma_free(dev);
4805         b43_pio_free(dev);
4806         b43_chip_exit(dev);
4807         dev->phy.ops->switch_analog(dev, 0);
4808         if (dev->wl->current_beacon) {
4809                 dev_kfree_skb_any(dev->wl->current_beacon);
4810                 dev->wl->current_beacon = NULL;
4811         }
4812
4813         b43_device_disable(dev, 0);
4814         b43_bus_may_powerdown(dev);
4815 }
4816
4817 /* Initialize a wireless core */
4818 static int b43_wireless_core_init(struct b43_wldev *dev)
4819 {
4820         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4821         struct b43_phy *phy = &dev->phy;
4822         int err;
4823         u64 hf;
4824
4825         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4826
4827         err = b43_bus_powerup(dev, 0);
4828         if (err)
4829                 goto out;
4830         if (!b43_device_is_enabled(dev))
4831                 b43_wireless_core_reset(dev, phy->gmode);
4832
4833         /* Reset all data structures. */
4834         setup_struct_wldev_for_init(dev);
4835         phy->ops->prepare_structs(dev);
4836
4837         /* Enable IRQ routing to this device. */
4838         switch (dev->dev->bus_type) {
4839 #ifdef CONFIG_B43_BCMA
4840         case B43_BUS_BCMA:
4841                 bcma_host_pci_irq_ctl(dev->dev->bdev->bus,
4842                                       dev->dev->bdev, true);
4843                 bcma_host_pci_up(dev->dev->bdev->bus);
4844                 break;
4845 #endif
4846 #ifdef CONFIG_B43_SSB
4847         case B43_BUS_SSB:
4848                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4849                                                dev->dev->sdev);
4850                 break;
4851 #endif
4852         }
4853
4854         b43_imcfglo_timeouts_workaround(dev);
4855         b43_bluetooth_coext_disable(dev);
4856         if (phy->ops->prepare_hardware) {
4857                 err = phy->ops->prepare_hardware(dev);
4858                 if (err)
4859                         goto err_busdown;
4860         }
4861         err = b43_chip_init(dev);
4862         if (err)
4863                 goto err_busdown;
4864         b43_shm_write16(dev, B43_SHM_SHARED,
4865                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4866         hf = b43_hf_read(dev);
4867         if (phy->type == B43_PHYTYPE_G) {
4868                 hf |= B43_HF_SYMW;
4869                 if (phy->rev == 1)
4870                         hf |= B43_HF_GDCW;
4871                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4872                         hf |= B43_HF_OFDMPABOOST;
4873         }
4874         if (phy->radio_ver == 0x2050) {
4875                 if (phy->radio_rev == 6)
4876                         hf |= B43_HF_4318TSSI;
4877                 if (phy->radio_rev < 6)
4878                         hf |= B43_HF_VCORECALC;
4879         }
4880         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4881                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4882 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4883         if (dev->dev->bus_type == B43_BUS_SSB &&
4884             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4885             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4886                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4887 #endif
4888         hf &= ~B43_HF_SKCFPUP;
4889         b43_hf_write(dev, hf);
4890
4891         /* tell the ucode MAC capabilities */
4892         if (dev->dev->core_rev >= 13) {
4893                 u32 mac_hw_cap = b43_read32(dev, B43_MMIO_MAC_HW_CAP);
4894
4895                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_L,
4896                                 mac_hw_cap & 0xffff);
4897                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_H,
4898                                 (mac_hw_cap >> 16) & 0xffff);
4899         }
4900
4901         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4902                              B43_DEFAULT_LONG_RETRY_LIMIT);
4903         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4904         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4905
4906         /* Disable sending probe responses from firmware.
4907          * Setting the MaxTime to one usec will always trigger
4908          * a timeout, so we never send any probe resp.
4909          * A timeout of zero is infinite. */
4910         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4911
4912         b43_rate_memory_init(dev);
4913         b43_set_phytxctl_defaults(dev);
4914
4915         /* Minimum Contention Window */
4916         if (phy->type == B43_PHYTYPE_B)
4917                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4918         else
4919                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4920         /* Maximum Contention Window */
4921         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4922
4923         /* write phytype and phyvers */
4924         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYTYPE, phy->type);
4925         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYVER, phy->rev);
4926
4927         if (b43_bus_host_is_pcmcia(dev->dev) ||
4928             b43_bus_host_is_sdio(dev->dev)) {
4929                 dev->__using_pio_transfers = true;
4930                 err = b43_pio_init(dev);
4931         } else if (dev->use_pio) {
4932                 b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4933                         "This should not be needed and will result in lower "
4934                         "performance.\n");
4935                 dev->__using_pio_transfers = true;
4936                 err = b43_pio_init(dev);
4937         } else {
4938                 dev->__using_pio_transfers = false;
4939                 err = b43_dma_init(dev);
4940         }
4941         if (err)
4942                 goto err_chip_exit;
4943         b43_qos_init(dev);
4944         b43_set_synth_pu_delay(dev, 1);
4945         b43_bluetooth_coext_enable(dev);
4946
4947         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4948         b43_upload_card_macaddress(dev);
4949         b43_security_init(dev);
4950
4951         ieee80211_wake_queues(dev->wl->hw);
4952
4953         b43_set_status(dev, B43_STAT_INITIALIZED);
4954
4955 out:
4956         return err;
4957
4958 err_chip_exit:
4959         b43_chip_exit(dev);
4960 err_busdown:
4961         b43_bus_may_powerdown(dev);
4962         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4963         return err;
4964 }
4965
4966 static int b43_op_add_interface(struct ieee80211_hw *hw,
4967                                 struct ieee80211_vif *vif)
4968 {
4969         struct b43_wl *wl = hw_to_b43_wl(hw);
4970         struct b43_wldev *dev;
4971         int err = -EOPNOTSUPP;
4972
4973         /* TODO: allow WDS/AP devices to coexist */
4974
4975         if (vif->type != NL80211_IFTYPE_AP &&
4976             vif->type != NL80211_IFTYPE_MESH_POINT &&
4977             vif->type != NL80211_IFTYPE_STATION &&
4978             vif->type != NL80211_IFTYPE_WDS &&
4979             vif->type != NL80211_IFTYPE_ADHOC)
4980                 return -EOPNOTSUPP;
4981
4982         mutex_lock(&wl->mutex);
4983         if (wl->operating)
4984                 goto out_mutex_unlock;
4985
4986         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4987
4988         dev = wl->current_dev;
4989         wl->operating = true;
4990         wl->vif = vif;
4991         wl->if_type = vif->type;
4992         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4993
4994         b43_adjust_opmode(dev);
4995         b43_set_pretbtt(dev);
4996         b43_set_synth_pu_delay(dev, 0);
4997         b43_upload_card_macaddress(dev);
4998
4999         err = 0;
5000  out_mutex_unlock:
5001         mutex_unlock(&wl->mutex);
5002
5003         if (err == 0)
5004                 b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
5005
5006         return err;
5007 }
5008
5009 static void b43_op_remove_interface(struct ieee80211_hw *hw,
5010                                     struct ieee80211_vif *vif)
5011 {
5012         struct b43_wl *wl = hw_to_b43_wl(hw);
5013         struct b43_wldev *dev = wl->current_dev;
5014
5015         b43dbg(wl, "Removing Interface type %d\n", vif->type);
5016
5017         mutex_lock(&wl->mutex);
5018
5019         B43_WARN_ON(!wl->operating);
5020         B43_WARN_ON(wl->vif != vif);
5021         wl->vif = NULL;
5022
5023         wl->operating = false;
5024
5025         b43_adjust_opmode(dev);
5026         eth_zero_addr(wl->mac_addr);
5027         b43_upload_card_macaddress(dev);
5028
5029         mutex_unlock(&wl->mutex);
5030 }
5031
5032 static int b43_op_start(struct ieee80211_hw *hw)
5033 {
5034         struct b43_wl *wl = hw_to_b43_wl(hw);
5035         struct b43_wldev *dev = wl->current_dev;
5036         int did_init = 0;
5037         int err = 0;
5038
5039         /* Kill all old instance specific information to make sure
5040          * the card won't use it in the short timeframe between start
5041          * and mac80211 reconfiguring it. */
5042         eth_zero_addr(wl->bssid);
5043         eth_zero_addr(wl->mac_addr);
5044         wl->filter_flags = 0;
5045         wl->radiotap_enabled = false;
5046         b43_qos_clear(wl);
5047         wl->beacon0_uploaded = false;
5048         wl->beacon1_uploaded = false;
5049         wl->beacon_templates_virgin = true;
5050         wl->radio_enabled = true;
5051
5052         mutex_lock(&wl->mutex);
5053
5054         if (b43_status(dev) < B43_STAT_INITIALIZED) {
5055                 err = b43_wireless_core_init(dev);
5056                 if (err)
5057                         goto out_mutex_unlock;
5058                 did_init = 1;
5059         }
5060
5061         if (b43_status(dev) < B43_STAT_STARTED) {
5062                 err = b43_wireless_core_start(dev);
5063                 if (err) {
5064                         if (did_init)
5065                                 b43_wireless_core_exit(dev);
5066                         goto out_mutex_unlock;
5067                 }
5068         }
5069
5070         /* XXX: only do if device doesn't support rfkill irq */
5071         wiphy_rfkill_start_polling(hw->wiphy);
5072
5073  out_mutex_unlock:
5074         mutex_unlock(&wl->mutex);
5075
5076         /*
5077          * Configuration may have been overwritten during initialization.
5078          * Reload the configuration, but only if initialization was
5079          * successful. Reloading the configuration after a failed init
5080          * may hang the system.
5081          */
5082         if (!err)
5083                 b43_op_config(hw, ~0);
5084
5085         return err;
5086 }
5087
5088 static void b43_op_stop(struct ieee80211_hw *hw)
5089 {
5090         struct b43_wl *wl = hw_to_b43_wl(hw);
5091         struct b43_wldev *dev = wl->current_dev;
5092
5093         cancel_work_sync(&(wl->beacon_update_trigger));
5094
5095         if (!dev)
5096                 goto out;
5097
5098         mutex_lock(&wl->mutex);
5099         if (b43_status(dev) >= B43_STAT_STARTED) {
5100                 dev = b43_wireless_core_stop(dev);
5101                 if (!dev)
5102                         goto out_unlock;
5103         }
5104         b43_wireless_core_exit(dev);
5105         wl->radio_enabled = false;
5106
5107 out_unlock:
5108         mutex_unlock(&wl->mutex);
5109 out:
5110         cancel_work_sync(&(wl->txpower_adjust_work));
5111 }
5112
5113 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5114                                  struct ieee80211_sta *sta, bool set)
5115 {
5116         struct b43_wl *wl = hw_to_b43_wl(hw);
5117
5118         b43_update_templates(wl);
5119
5120         return 0;
5121 }
5122
5123 static void b43_op_sta_notify(struct ieee80211_hw *hw,
5124                               struct ieee80211_vif *vif,
5125                               enum sta_notify_cmd notify_cmd,
5126                               struct ieee80211_sta *sta)
5127 {
5128         struct b43_wl *wl = hw_to_b43_wl(hw);
5129
5130         B43_WARN_ON(!vif || wl->vif != vif);
5131 }
5132
5133 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw,
5134                                           struct ieee80211_vif *vif,
5135                                           const u8 *mac_addr)
5136 {
5137         struct b43_wl *wl = hw_to_b43_wl(hw);
5138         struct b43_wldev *dev;
5139
5140         mutex_lock(&wl->mutex);
5141         dev = wl->current_dev;
5142         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5143                 /* Disable CFP update during scan on other channels. */
5144                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5145         }
5146         mutex_unlock(&wl->mutex);
5147 }
5148
5149 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw,
5150                                              struct ieee80211_vif *vif)
5151 {
5152         struct b43_wl *wl = hw_to_b43_wl(hw);
5153         struct b43_wldev *dev;
5154
5155         mutex_lock(&wl->mutex);
5156         dev = wl->current_dev;
5157         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5158                 /* Re-enable CFP update. */
5159                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5160         }
5161         mutex_unlock(&wl->mutex);
5162 }
5163
5164 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5165                              struct survey_info *survey)
5166 {
5167         struct b43_wl *wl = hw_to_b43_wl(hw);
5168         struct b43_wldev *dev = wl->current_dev;
5169         struct ieee80211_conf *conf = &hw->conf;
5170
5171         if (idx != 0)
5172                 return -ENOENT;
5173
5174         survey->channel = conf->chandef.chan;
5175         survey->filled = SURVEY_INFO_NOISE_DBM;
5176         survey->noise = dev->stats.link_noise;
5177
5178         return 0;
5179 }
5180
5181 static const struct ieee80211_ops b43_hw_ops = {
5182         .tx                     = b43_op_tx,
5183         .conf_tx                = b43_op_conf_tx,
5184         .add_interface          = b43_op_add_interface,
5185         .remove_interface       = b43_op_remove_interface,
5186         .config                 = b43_op_config,
5187         .bss_info_changed       = b43_op_bss_info_changed,
5188         .configure_filter       = b43_op_configure_filter,
5189         .set_key                = b43_op_set_key,
5190         .update_tkip_key        = b43_op_update_tkip_key,
5191         .get_stats              = b43_op_get_stats,
5192         .get_tsf                = b43_op_get_tsf,
5193         .set_tsf                = b43_op_set_tsf,
5194         .start                  = b43_op_start,
5195         .stop                   = b43_op_stop,
5196         .set_tim                = b43_op_beacon_set_tim,
5197         .sta_notify             = b43_op_sta_notify,
5198         .sw_scan_start          = b43_op_sw_scan_start_notifier,
5199         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
5200         .get_survey             = b43_op_get_survey,
5201         .rfkill_poll            = b43_rfkill_poll,
5202 };
5203
5204 /* Hard-reset the chip. Do not call this directly.
5205  * Use b43_controller_restart()
5206  */
5207 static void b43_chip_reset(struct work_struct *work)
5208 {
5209         struct b43_wldev *dev =
5210             container_of(work, struct b43_wldev, restart_work);
5211         struct b43_wl *wl = dev->wl;
5212         int err = 0;
5213         int prev_status;
5214
5215         mutex_lock(&wl->mutex);
5216
5217         prev_status = b43_status(dev);
5218         /* Bring the device down... */
5219         if (prev_status >= B43_STAT_STARTED) {
5220                 dev = b43_wireless_core_stop(dev);
5221                 if (!dev) {
5222                         err = -ENODEV;
5223                         goto out;
5224                 }
5225         }
5226         if (prev_status >= B43_STAT_INITIALIZED)
5227                 b43_wireless_core_exit(dev);
5228
5229         /* ...and up again. */
5230         if (prev_status >= B43_STAT_INITIALIZED) {
5231                 err = b43_wireless_core_init(dev);
5232                 if (err)
5233                         goto out;
5234         }
5235         if (prev_status >= B43_STAT_STARTED) {
5236                 err = b43_wireless_core_start(dev);
5237                 if (err) {
5238                         b43_wireless_core_exit(dev);
5239                         goto out;
5240                 }
5241         }
5242 out:
5243         if (err)
5244                 wl->current_dev = NULL; /* Failed to init the dev. */
5245         mutex_unlock(&wl->mutex);
5246
5247         if (err) {
5248                 b43err(wl, "Controller restart FAILED\n");
5249                 return;
5250         }
5251
5252         /* reload configuration */
5253         b43_op_config(wl->hw, ~0);
5254         if (wl->vif)
5255                 b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5256
5257         b43info(wl, "Controller restarted\n");
5258 }
5259
5260 static int b43_setup_bands(struct b43_wldev *dev,
5261                            bool have_2ghz_phy, bool have_5ghz_phy)
5262 {
5263         struct ieee80211_hw *hw = dev->wl->hw;
5264         struct b43_phy *phy = &dev->phy;
5265         bool limited_2g;
5266         bool limited_5g;
5267
5268         /* We don't support all 2 GHz channels on some devices */
5269         limited_2g = phy->radio_ver == 0x2057 &&
5270                      (phy->radio_rev == 9 || phy->radio_rev == 14);
5271         limited_5g = phy->radio_ver == 0x2057 &&
5272                      phy->radio_rev == 9;
5273
5274         if (have_2ghz_phy)
5275                 hw->wiphy->bands[NL80211_BAND_2GHZ] = limited_2g ?
5276                         &b43_band_2ghz_limited : &b43_band_2GHz;
5277         if (dev->phy.type == B43_PHYTYPE_N) {
5278                 if (have_5ghz_phy)
5279                         hw->wiphy->bands[NL80211_BAND_5GHZ] = limited_5g ?
5280                                 &b43_band_5GHz_nphy_limited :
5281                                 &b43_band_5GHz_nphy;
5282         } else {
5283                 if (have_5ghz_phy)
5284                         hw->wiphy->bands[NL80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5285         }
5286
5287         dev->phy.supports_2ghz = have_2ghz_phy;
5288         dev->phy.supports_5ghz = have_5ghz_phy;
5289
5290         return 0;
5291 }
5292
5293 static void b43_wireless_core_detach(struct b43_wldev *dev)
5294 {
5295         /* We release firmware that late to not be required to re-request
5296          * is all the time when we reinit the core. */
5297         b43_release_firmware(dev);
5298         b43_phy_free(dev);
5299 }
5300
5301 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5302                                 bool *have_5ghz_phy)
5303 {
5304         u16 dev_id = 0;
5305
5306 #ifdef CONFIG_B43_BCMA
5307         if (dev->dev->bus_type == B43_BUS_BCMA &&
5308             dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5309                 dev_id = dev->dev->bdev->bus->host_pci->device;
5310 #endif
5311 #ifdef CONFIG_B43_SSB
5312         if (dev->dev->bus_type == B43_BUS_SSB &&
5313             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5314                 dev_id = dev->dev->sdev->bus->host_pci->device;
5315 #endif
5316         /* Override with SPROM value if available */
5317         if (dev->dev->bus_sprom->dev_id)
5318                 dev_id = dev->dev->bus_sprom->dev_id;
5319
5320         /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5321         switch (dev_id) {
5322         case 0x4324: /* BCM4306 */
5323         case 0x4312: /* BCM4311 */
5324         case 0x4319: /* BCM4318 */
5325         case 0x4328: /* BCM4321 */
5326         case 0x432b: /* BCM4322 */
5327         case 0x4350: /* BCM43222 */
5328         case 0x4353: /* BCM43224 */
5329         case 0x0576: /* BCM43224 */
5330         case 0x435f: /* BCM6362 */
5331         case 0x4331: /* BCM4331 */
5332         case 0x4359: /* BCM43228 */
5333         case 0x43a0: /* BCM4360 */
5334         case 0x43b1: /* BCM4352 */
5335                 /* Dual band devices */
5336                 *have_2ghz_phy = true;
5337                 *have_5ghz_phy = true;
5338                 return;
5339         case 0x4321: /* BCM4306 */
5340                 /* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
5341                 if (dev->phy.type != B43_PHYTYPE_G)
5342                         break;
5343                 /* fall through */
5344         case 0x4313: /* BCM4311 */
5345         case 0x431a: /* BCM4318 */
5346         case 0x432a: /* BCM4321 */
5347         case 0x432d: /* BCM4322 */
5348         case 0x4352: /* BCM43222 */
5349         case 0x435a: /* BCM43228 */
5350         case 0x4333: /* BCM4331 */
5351         case 0x43a2: /* BCM4360 */
5352         case 0x43b3: /* BCM4352 */
5353                 /* 5 GHz only devices */
5354                 *have_2ghz_phy = false;
5355                 *have_5ghz_phy = true;
5356                 return;
5357         }
5358
5359         /* As a fallback, try to guess using PHY type */
5360         switch (dev->phy.type) {
5361         case B43_PHYTYPE_G:
5362         case B43_PHYTYPE_N:
5363         case B43_PHYTYPE_LP:
5364         case B43_PHYTYPE_HT:
5365         case B43_PHYTYPE_LCN:
5366                 *have_2ghz_phy = true;
5367                 *have_5ghz_phy = false;
5368                 return;
5369         }
5370
5371         B43_WARN_ON(1);
5372 }
5373
5374 static int b43_wireless_core_attach(struct b43_wldev *dev)
5375 {
5376         struct b43_wl *wl = dev->wl;
5377         struct b43_phy *phy = &dev->phy;
5378         int err;
5379         u32 tmp;
5380         bool have_2ghz_phy = false, have_5ghz_phy = false;
5381
5382         /* Do NOT do any device initialization here.
5383          * Do it in wireless_core_init() instead.
5384          * This function is for gathering basic information about the HW, only.
5385          * Also some structs may be set up here. But most likely you want to have
5386          * that in core_init(), too.
5387          */
5388
5389         err = b43_bus_powerup(dev, 0);
5390         if (err) {
5391                 b43err(wl, "Bus powerup failed\n");
5392                 goto out;
5393         }
5394
5395         phy->do_full_init = true;
5396
5397         /* Try to guess supported bands for the first init needs */
5398         switch (dev->dev->bus_type) {
5399 #ifdef CONFIG_B43_BCMA
5400         case B43_BUS_BCMA:
5401                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5402                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5403                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5404                 break;
5405 #endif
5406 #ifdef CONFIG_B43_SSB
5407         case B43_BUS_SSB:
5408                 if (dev->dev->core_rev >= 5) {
5409                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5410                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5411                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5412                 } else
5413                         B43_WARN_ON(1);
5414                 break;
5415 #endif
5416         }
5417
5418         dev->phy.gmode = have_2ghz_phy;
5419         b43_wireless_core_reset(dev, dev->phy.gmode);
5420
5421         /* Get the PHY type. */
5422         err = b43_phy_versioning(dev);
5423         if (err)
5424                 goto err_powerdown;
5425
5426         /* Get real info about supported bands */
5427         b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5428
5429         /* We don't support 5 GHz on some PHYs yet */
5430         if (have_5ghz_phy) {
5431                 switch (dev->phy.type) {
5432                 case B43_PHYTYPE_G:
5433                 case B43_PHYTYPE_LP:
5434                 case B43_PHYTYPE_HT:
5435                         b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5436                         have_5ghz_phy = false;
5437                 }
5438         }
5439
5440         if (!have_2ghz_phy && !have_5ghz_phy) {
5441                 b43err(wl, "b43 can't support any band on this device\n");
5442                 err = -EOPNOTSUPP;
5443                 goto err_powerdown;
5444         }
5445
5446         err = b43_phy_allocate(dev);
5447         if (err)
5448                 goto err_powerdown;
5449
5450         dev->phy.gmode = have_2ghz_phy;
5451         b43_wireless_core_reset(dev, dev->phy.gmode);
5452
5453         err = b43_validate_chipaccess(dev);
5454         if (err)
5455                 goto err_phy_free;
5456         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5457         if (err)
5458                 goto err_phy_free;
5459
5460         /* Now set some default "current_dev" */
5461         if (!wl->current_dev)
5462                 wl->current_dev = dev;
5463         INIT_WORK(&dev->restart_work, b43_chip_reset);
5464
5465         dev->phy.ops->switch_analog(dev, 0);
5466         b43_device_disable(dev, 0);
5467         b43_bus_may_powerdown(dev);
5468
5469 out:
5470         return err;
5471
5472 err_phy_free:
5473         b43_phy_free(dev);
5474 err_powerdown:
5475         b43_bus_may_powerdown(dev);
5476         return err;
5477 }
5478
5479 static void b43_one_core_detach(struct b43_bus_dev *dev)
5480 {
5481         struct b43_wldev *wldev;
5482         struct b43_wl *wl;
5483
5484         /* Do not cancel ieee80211-workqueue based work here.
5485          * See comment in b43_remove(). */
5486
5487         wldev = b43_bus_get_wldev(dev);
5488         wl = wldev->wl;
5489         b43_debugfs_remove_device(wldev);
5490         b43_wireless_core_detach(wldev);
5491         list_del(&wldev->list);
5492         b43_bus_set_wldev(dev, NULL);
5493         kfree(wldev);
5494 }
5495
5496 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5497 {
5498         struct b43_wldev *wldev;
5499         int err = -ENOMEM;
5500
5501         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5502         if (!wldev)
5503                 goto out;
5504
5505         wldev->use_pio = b43_modparam_pio;
5506         wldev->dev = dev;
5507         wldev->wl = wl;
5508         b43_set_status(wldev, B43_STAT_UNINIT);
5509         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5510         INIT_LIST_HEAD(&wldev->list);
5511
5512         err = b43_wireless_core_attach(wldev);
5513         if (err)
5514                 goto err_kfree_wldev;
5515
5516         b43_bus_set_wldev(dev, wldev);
5517         b43_debugfs_add_device(wldev);
5518
5519       out:
5520         return err;
5521
5522       err_kfree_wldev:
5523         kfree(wldev);
5524         return err;
5525 }
5526
5527 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5528         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5529         (pdev->device == _device) &&                                    \
5530         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5531         (pdev->subsystem_device == _subdevice)                          )
5532
5533 #ifdef CONFIG_B43_SSB
5534 static void b43_sprom_fixup(struct ssb_bus *bus)
5535 {
5536         struct pci_dev *pdev;
5537
5538         /* boardflags workarounds */
5539         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5540             bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5541                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5542         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5543             bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5544                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5545         if (bus->bustype == SSB_BUSTYPE_PCI) {
5546                 pdev = bus->host_pci;
5547                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5548                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5549                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5550                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5551                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5552                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5553                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5554                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5555         }
5556 }
5557
5558 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5559 {
5560         struct ieee80211_hw *hw = wl->hw;
5561
5562         ssb_set_devtypedata(dev->sdev, NULL);
5563         ieee80211_free_hw(hw);
5564 }
5565 #endif
5566
5567 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5568 {
5569         struct ssb_sprom *sprom = dev->bus_sprom;
5570         struct ieee80211_hw *hw;
5571         struct b43_wl *wl;
5572         char chip_name[6];
5573         int queue_num;
5574
5575         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5576         if (!hw) {
5577                 b43err(NULL, "Could not allocate ieee80211 device\n");
5578                 return ERR_PTR(-ENOMEM);
5579         }
5580         wl = hw_to_b43_wl(hw);
5581
5582         /* fill hw info */
5583         ieee80211_hw_set(hw, RX_INCLUDES_FCS);
5584         ieee80211_hw_set(hw, SIGNAL_DBM);
5585         ieee80211_hw_set(hw, MFP_CAPABLE);
5586         hw->wiphy->interface_modes =
5587                 BIT(NL80211_IFTYPE_AP) |
5588                 BIT(NL80211_IFTYPE_MESH_POINT) |
5589                 BIT(NL80211_IFTYPE_STATION) |
5590                 BIT(NL80211_IFTYPE_WDS) |
5591                 BIT(NL80211_IFTYPE_ADHOC);
5592
5593         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5594
5595         wl->hw_registred = false;
5596         hw->max_rates = 2;
5597         SET_IEEE80211_DEV(hw, dev->dev);
5598         if (is_valid_ether_addr(sprom->et1mac))
5599                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5600         else
5601                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5602
5603         /* Initialize struct b43_wl */
5604         wl->hw = hw;
5605         mutex_init(&wl->mutex);
5606         spin_lock_init(&wl->hardirq_lock);
5607         spin_lock_init(&wl->beacon_lock);
5608         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5609         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5610         INIT_WORK(&wl->tx_work, b43_tx_work);
5611
5612         /* Initialize queues and flags. */
5613         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5614                 skb_queue_head_init(&wl->tx_queue[queue_num]);
5615                 wl->tx_queue_stopped[queue_num] = 0;
5616         }
5617
5618         snprintf(chip_name, ARRAY_SIZE(chip_name),
5619                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5620         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5621                 dev->core_rev);
5622         return wl;
5623 }
5624
5625 #ifdef CONFIG_B43_BCMA
5626 static int b43_bcma_probe(struct bcma_device *core)
5627 {
5628         struct b43_bus_dev *dev;
5629         struct b43_wl *wl;
5630         int err;
5631
5632         if (!modparam_allhwsupport &&
5633             (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5634                 pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5635                 return -ENOTSUPP;
5636         }
5637
5638         dev = b43_bus_dev_bcma_init(core);
5639         if (!dev)
5640                 return -ENODEV;
5641
5642         wl = b43_wireless_init(dev);
5643         if (IS_ERR(wl)) {
5644                 err = PTR_ERR(wl);
5645                 goto bcma_out;
5646         }
5647
5648         err = b43_one_core_attach(dev, wl);
5649         if (err)
5650                 goto bcma_err_wireless_exit;
5651
5652         /* setup and start work to load firmware */
5653         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5654         schedule_work(&wl->firmware_load);
5655
5656         return err;
5657
5658 bcma_err_wireless_exit:
5659         ieee80211_free_hw(wl->hw);
5660 bcma_out:
5661         kfree(dev);
5662         return err;
5663 }
5664
5665 static void b43_bcma_remove(struct bcma_device *core)
5666 {
5667         struct b43_wldev *wldev = bcma_get_drvdata(core);
5668         struct b43_wl *wl = wldev->wl;
5669
5670         /* We must cancel any work here before unregistering from ieee80211,
5671          * as the ieee80211 unreg will destroy the workqueue. */
5672         cancel_work_sync(&wldev->restart_work);
5673         cancel_work_sync(&wl->firmware_load);
5674
5675         B43_WARN_ON(!wl);
5676         if (!wldev->fw.ucode.data)
5677                 return;                 /* NULL if firmware never loaded */
5678         if (wl->current_dev == wldev && wl->hw_registred) {
5679                 b43_leds_stop(wldev);
5680                 ieee80211_unregister_hw(wl->hw);
5681         }
5682
5683         b43_one_core_detach(wldev->dev);
5684
5685         /* Unregister HW RNG driver */
5686         b43_rng_exit(wl);
5687
5688         b43_leds_unregister(wl);
5689         ieee80211_free_hw(wl->hw);
5690         kfree(wldev->dev);
5691 }
5692
5693 static struct bcma_driver b43_bcma_driver = {
5694         .name           = KBUILD_MODNAME,
5695         .id_table       = b43_bcma_tbl,
5696         .probe          = b43_bcma_probe,
5697         .remove         = b43_bcma_remove,
5698 };
5699 #endif
5700
5701 #ifdef CONFIG_B43_SSB
5702 static
5703 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5704 {
5705         struct b43_bus_dev *dev;
5706         struct b43_wl *wl;
5707         int err;
5708
5709         dev = b43_bus_dev_ssb_init(sdev);
5710         if (!dev)
5711                 return -ENOMEM;
5712
5713         wl = ssb_get_devtypedata(sdev);
5714         if (wl) {
5715                 b43err(NULL, "Dual-core devices are not supported\n");
5716                 err = -ENOTSUPP;
5717                 goto err_ssb_kfree_dev;
5718         }
5719
5720         b43_sprom_fixup(sdev->bus);
5721
5722         wl = b43_wireless_init(dev);
5723         if (IS_ERR(wl)) {
5724                 err = PTR_ERR(wl);
5725                 goto err_ssb_kfree_dev;
5726         }
5727         ssb_set_devtypedata(sdev, wl);
5728         B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5729
5730         err = b43_one_core_attach(dev, wl);
5731         if (err)
5732                 goto err_ssb_wireless_exit;
5733
5734         /* setup and start work to load firmware */
5735         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5736         schedule_work(&wl->firmware_load);
5737
5738         return err;
5739
5740 err_ssb_wireless_exit:
5741         b43_wireless_exit(dev, wl);
5742 err_ssb_kfree_dev:
5743         kfree(dev);
5744         return err;
5745 }
5746
5747 static void b43_ssb_remove(struct ssb_device *sdev)
5748 {
5749         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5750         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5751         struct b43_bus_dev *dev = wldev->dev;
5752
5753         /* We must cancel any work here before unregistering from ieee80211,
5754          * as the ieee80211 unreg will destroy the workqueue. */
5755         cancel_work_sync(&wldev->restart_work);
5756         cancel_work_sync(&wl->firmware_load);
5757
5758         B43_WARN_ON(!wl);
5759         if (!wldev->fw.ucode.data)
5760                 return;                 /* NULL if firmware never loaded */
5761         if (wl->current_dev == wldev && wl->hw_registred) {
5762                 b43_leds_stop(wldev);
5763                 ieee80211_unregister_hw(wl->hw);
5764         }
5765
5766         b43_one_core_detach(dev);
5767
5768         /* Unregister HW RNG driver */
5769         b43_rng_exit(wl);
5770
5771         b43_leds_unregister(wl);
5772         b43_wireless_exit(dev, wl);
5773         kfree(dev);
5774 }
5775
5776 static struct ssb_driver b43_ssb_driver = {
5777         .name           = KBUILD_MODNAME,
5778         .id_table       = b43_ssb_tbl,
5779         .probe          = b43_ssb_probe,
5780         .remove         = b43_ssb_remove,
5781 };
5782 #endif /* CONFIG_B43_SSB */
5783
5784 /* Perform a hardware reset. This can be called from any context. */
5785 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5786 {
5787         /* Must avoid requeueing, if we are in shutdown. */
5788         if (b43_status(dev) < B43_STAT_INITIALIZED)
5789                 return;
5790         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5791         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5792 }
5793
5794 static void b43_print_driverinfo(void)
5795 {
5796         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5797                    *feat_leds = "", *feat_sdio = "";
5798
5799 #ifdef CONFIG_B43_PCI_AUTOSELECT
5800         feat_pci = "P";
5801 #endif
5802 #ifdef CONFIG_B43_PCMCIA
5803         feat_pcmcia = "M";
5804 #endif
5805 #ifdef CONFIG_B43_PHY_N
5806         feat_nphy = "N";
5807 #endif
5808 #ifdef CONFIG_B43_LEDS
5809         feat_leds = "L";
5810 #endif
5811 #ifdef CONFIG_B43_SDIO
5812         feat_sdio = "S";
5813 #endif
5814         printk(KERN_INFO "Broadcom 43xx driver loaded "
5815                "[ Features: %s%s%s%s%s ]\n",
5816                feat_pci, feat_pcmcia, feat_nphy,
5817                feat_leds, feat_sdio);
5818 }
5819
5820 static int __init b43_init(void)
5821 {
5822         int err;
5823
5824         b43_debugfs_init();
5825         err = b43_sdio_init();
5826         if (err)
5827                 goto err_dfs_exit;
5828 #ifdef CONFIG_B43_BCMA
5829         err = bcma_driver_register(&b43_bcma_driver);
5830         if (err)
5831                 goto err_sdio_exit;
5832 #endif
5833 #ifdef CONFIG_B43_SSB
5834         err = ssb_driver_register(&b43_ssb_driver);
5835         if (err)
5836                 goto err_bcma_driver_exit;
5837 #endif
5838         b43_print_driverinfo();
5839
5840         return err;
5841
5842 #ifdef CONFIG_B43_SSB
5843 err_bcma_driver_exit:
5844 #endif
5845 #ifdef CONFIG_B43_BCMA
5846         bcma_driver_unregister(&b43_bcma_driver);
5847 err_sdio_exit:
5848 #endif
5849         b43_sdio_exit();
5850 err_dfs_exit:
5851         b43_debugfs_exit();
5852         return err;
5853 }
5854
5855 static void __exit b43_exit(void)
5856 {
5857 #ifdef CONFIG_B43_SSB
5858         ssb_driver_unregister(&b43_ssb_driver);
5859 #endif
5860 #ifdef CONFIG_B43_BCMA
5861         bcma_driver_unregister(&b43_bcma_driver);
5862 #endif
5863         b43_sdio_exit();
5864         b43_debugfs_exit();
5865 }
5866
5867 module_init(b43_init)
5868 module_exit(b43_exit)