drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/version.h>
  37 #include <linux/firmware.h>
  38 #include <linux/wireless.h>
  39 #include <linux/workqueue.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/io.h>
  42 #include <linux/dma-mapping.h>
  43 #include <asm/unaligned.h>
  44
  45 #include "b43.h"
  46 #include "main.h"
  47 #include "debugfs.h"
  48 #include "phy.h"
  49 #include "nphy.h"
  50 #include "dma.h"
  51 #include "pio.h"
  52 #include "sysfs.h"
  53 #include "xmit.h"
  54 #include "lo.h"
  55 #include "pcmcia.h"
  56
  57 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  58 MODULE_AUTHOR("Martin Langer");
  59 MODULE_AUTHOR("Stefano Brivio");
  60 MODULE_AUTHOR("Michael Buesch");
  61 MODULE_LICENSE("GPL");
  62
  63 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  64
  65
  66 static int modparam_bad_frames_preempt;
  67 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  68 MODULE_PARM_DESC(bad_frames_preempt,
  69                  "enable(1) / disable(0) Bad Frames Preemption");
  70
  71 static char modparam_fwpostfix[16];
  72 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  73 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  74
  75 static int modparam_hwpctl;
  76 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  77 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  78
  79 static int modparam_nohwcrypt;
  80 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  81 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  82
  83 int b43_modparam_qos = 1;
  84 module_param_named(qos, b43_modparam_qos, int, 0444);
  85 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  86
  87 static int modparam_btcoex = 1;
  88 module_param_named(btcoex, modparam_btcoex, int, 0444);
  89 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
  90
  91
  92 static const struct ssb_device_id b43_ssb_tbl[] = {
  93         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
  94         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
  95         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
  96         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
  97         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
  98         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
  99         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 100         SSB_DEVTABLE_END
 101 };
 102
 103 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 104
 105 /* Channel and ratetables are shared for all devices.
 106  * They can't be const, because ieee80211 puts some precalculated
 107  * data in there. This data is the same for all devices, so we don't
 108  * get concurrency issues */
 109 #define RATETAB_ENT(_rateid, _flags) \
 110         {                                                               \
 111                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 112                 .hw_value       = (_rateid),                            \
 113                 .flags          = (_flags),                             \
 114         }
 115
 116 /*
 117  * NOTE: When changing this, sync with xmit.c's
 118  *       b43_plcp_get_bitrate_idx_* functions!
 119  */
 120 static struct ieee80211_rate __b43_ratetable[] = {
 121         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 122         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 123         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 124         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 125         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 126         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 127         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 128         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 129         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 130         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 131         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 132         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 133 };
 134
 135 #define b43_a_ratetable         (__b43_ratetable + 4)
 136 #define b43_a_ratetable_size    8
 137 #define b43_b_ratetable         (__b43_ratetable + 0)
 138 #define b43_b_ratetable_size    4
 139 #define b43_g_ratetable         (__b43_ratetable + 0)
 140 #define b43_g_ratetable_size    12
 141
 142 #define CHAN4G(_channel, _freq, _flags) {                       \
 143         .band                   = IEEE80211_BAND_2GHZ,          \
 144         .center_freq            = (_freq),                      \
 145         .hw_value               = (_channel),                   \
 146         .flags                  = (_flags),                     \
 147         .max_antenna_gain       = 0,                            \
 148         .max_power              = 30,                           \
 149 }
 150 static struct ieee80211_channel b43_2ghz_chantable[] = {
 151         CHAN4G(1, 2412, 0),
 152         CHAN4G(2, 2417, 0),
 153         CHAN4G(3, 2422, 0),
 154         CHAN4G(4, 2427, 0),
 155         CHAN4G(5, 2432, 0),
 156         CHAN4G(6, 2437, 0),
 157         CHAN4G(7, 2442, 0),
 158         CHAN4G(8, 2447, 0),
 159         CHAN4G(9, 2452, 0),
 160         CHAN4G(10, 2457, 0),
 161         CHAN4G(11, 2462, 0),
 162         CHAN4G(12, 2467, 0),
 163         CHAN4G(13, 2472, 0),
 164         CHAN4G(14, 2484, 0),
 165 };
 166 #undef CHAN4G
 167
 168 #define CHAN5G(_channel, _flags) {                              \
 169         .band                   = IEEE80211_BAND_5GHZ,          \
 170         .center_freq            = 5000 + (5 * (_channel)),      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 177         CHAN5G(32, 0),          CHAN5G(34, 0),
 178         CHAN5G(36, 0),          CHAN5G(38, 0),
 179         CHAN5G(40, 0),          CHAN5G(42, 0),
 180         CHAN5G(44, 0),          CHAN5G(46, 0),
 181         CHAN5G(48, 0),          CHAN5G(50, 0),
 182         CHAN5G(52, 0),          CHAN5G(54, 0),
 183         CHAN5G(56, 0),          CHAN5G(58, 0),
 184         CHAN5G(60, 0),          CHAN5G(62, 0),
 185         CHAN5G(64, 0),          CHAN5G(66, 0),
 186         CHAN5G(68, 0),          CHAN5G(70, 0),
 187         CHAN5G(72, 0),          CHAN5G(74, 0),
 188         CHAN5G(76, 0),          CHAN5G(78, 0),
 189         CHAN5G(80, 0),          CHAN5G(82, 0),
 190         CHAN5G(84, 0),          CHAN5G(86, 0),
 191         CHAN5G(88, 0),          CHAN5G(90, 0),
 192         CHAN5G(92, 0),          CHAN5G(94, 0),
 193         CHAN5G(96, 0),          CHAN5G(98, 0),
 194         CHAN5G(100, 0),         CHAN5G(102, 0),
 195         CHAN5G(104, 0),         CHAN5G(106, 0),
 196         CHAN5G(108, 0),         CHAN5G(110, 0),
 197         CHAN5G(112, 0),         CHAN5G(114, 0),
 198         CHAN5G(116, 0),         CHAN5G(118, 0),
 199         CHAN5G(120, 0),         CHAN5G(122, 0),
 200         CHAN5G(124, 0),         CHAN5G(126, 0),
 201         CHAN5G(128, 0),         CHAN5G(130, 0),
 202         CHAN5G(132, 0),         CHAN5G(134, 0),
 203         CHAN5G(136, 0),         CHAN5G(138, 0),
 204         CHAN5G(140, 0),         CHAN5G(142, 0),
 205         CHAN5G(144, 0),         CHAN5G(145, 0),
 206         CHAN5G(146, 0),         CHAN5G(147, 0),
 207         CHAN5G(148, 0),         CHAN5G(149, 0),
 208         CHAN5G(150, 0),         CHAN5G(151, 0),
 209         CHAN5G(152, 0),         CHAN5G(153, 0),
 210         CHAN5G(154, 0),         CHAN5G(155, 0),
 211         CHAN5G(156, 0),         CHAN5G(157, 0),
 212         CHAN5G(158, 0),         CHAN5G(159, 0),
 213         CHAN5G(160, 0),         CHAN5G(161, 0),
 214         CHAN5G(162, 0),         CHAN5G(163, 0),
 215         CHAN5G(164, 0),         CHAN5G(165, 0),
 216         CHAN5G(166, 0),         CHAN5G(168, 0),
 217         CHAN5G(170, 0),         CHAN5G(172, 0),
 218         CHAN5G(174, 0),         CHAN5G(176, 0),
 219         CHAN5G(178, 0),         CHAN5G(180, 0),
 220         CHAN5G(182, 0),         CHAN5G(184, 0),
 221         CHAN5G(186, 0),         CHAN5G(188, 0),
 222         CHAN5G(190, 0),         CHAN5G(192, 0),
 223         CHAN5G(194, 0),         CHAN5G(196, 0),
 224         CHAN5G(198, 0),         CHAN5G(200, 0),
 225         CHAN5G(202, 0),         CHAN5G(204, 0),
 226         CHAN5G(206, 0),         CHAN5G(208, 0),
 227         CHAN5G(210, 0),         CHAN5G(212, 0),
 228         CHAN5G(214, 0),         CHAN5G(216, 0),
 229         CHAN5G(218, 0),         CHAN5G(220, 0),
 230         CHAN5G(222, 0),         CHAN5G(224, 0),
 231         CHAN5G(226, 0),         CHAN5G(228, 0),
 232 };
 233
 234 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 235         CHAN5G(34, 0),          CHAN5G(36, 0),
 236         CHAN5G(38, 0),          CHAN5G(40, 0),
 237         CHAN5G(42, 0),          CHAN5G(44, 0),
 238         CHAN5G(46, 0),          CHAN5G(48, 0),
 239         CHAN5G(52, 0),          CHAN5G(56, 0),
 240         CHAN5G(60, 0),          CHAN5G(64, 0),
 241         CHAN5G(100, 0),         CHAN5G(104, 0),
 242         CHAN5G(108, 0),         CHAN5G(112, 0),
 243         CHAN5G(116, 0),         CHAN5G(120, 0),
 244         CHAN5G(124, 0),         CHAN5G(128, 0),
 245         CHAN5G(132, 0),         CHAN5G(136, 0),
 246         CHAN5G(140, 0),         CHAN5G(149, 0),
 247         CHAN5G(153, 0),         CHAN5G(157, 0),
 248         CHAN5G(161, 0),         CHAN5G(165, 0),
 249         CHAN5G(184, 0),         CHAN5G(188, 0),
 250         CHAN5G(192, 0),         CHAN5G(196, 0),
 251         CHAN5G(200, 0),         CHAN5G(204, 0),
 252         CHAN5G(208, 0),         CHAN5G(212, 0),
 253         CHAN5G(216, 0),
 254 };
 255 #undef CHAN5G
 256
 257 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 258         .band           = IEEE80211_BAND_5GHZ,
 259         .channels       = b43_5ghz_nphy_chantable,
 260         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 261         .bitrates       = b43_a_ratetable,
 262         .n_bitrates     = b43_a_ratetable_size,
 263 };
 264
 265 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 266         .band           = IEEE80211_BAND_5GHZ,
 267         .channels       = b43_5ghz_aphy_chantable,
 268         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 269         .bitrates       = b43_a_ratetable,
 270         .n_bitrates     = b43_a_ratetable_size,
 271 };
 272
 273 static struct ieee80211_supported_band b43_band_2GHz = {
 274         .band           = IEEE80211_BAND_2GHZ,
 275         .channels       = b43_2ghz_chantable,
 276         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 277         .bitrates       = b43_g_ratetable,
 278         .n_bitrates     = b43_g_ratetable_size,
 279 };
 280
 281 static void b43_wireless_core_exit(struct b43_wldev *dev);
 282 static int b43_wireless_core_init(struct b43_wldev *dev);
 283 static void b43_wireless_core_stop(struct b43_wldev *dev);
 284 static int b43_wireless_core_start(struct b43_wldev *dev);
 285
 286 static int b43_ratelimit(struct b43_wl *wl)
 287 {
 288         if (!wl || !wl->current_dev)
 289                 return 1;
 290         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 291                 return 1;
 292         /* We are up and running.
 293          * Ratelimit the messages to avoid DoS over the net. */
 294         return net_ratelimit();
 295 }
 296
 297 void b43info(struct b43_wl *wl, const char *fmt, ...)
 298 {
 299         va_list args;
 300
 301         if (!b43_ratelimit(wl))
 302                 return;
 303         va_start(args, fmt);
 304         printk(KERN_INFO "b43-%s: ",
 305                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 306         vprintk(fmt, args);
 307         va_end(args);
 308 }
 309
 310 void b43err(struct b43_wl *wl, const char *fmt, ...)
 311 {
 312         va_list args;
 313
 314         if (!b43_ratelimit(wl))
 315                 return;
 316         va_start(args, fmt);
 317         printk(KERN_ERR "b43-%s ERROR: ",
 318                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 319         vprintk(fmt, args);
 320         va_end(args);
 321 }
 322
 323 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         va_list args;
 326
 327         if (!b43_ratelimit(wl))
 328                 return;
 329         va_start(args, fmt);
 330         printk(KERN_WARNING "b43-%s warning: ",
 331                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 332         vprintk(fmt, args);
 333         va_end(args);
 334 }
 335
 336 #if B43_DEBUG
 337 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 338 {
 339         va_list args;
 340
 341         va_start(args, fmt);
 342         printk(KERN_DEBUG "b43-%s debug: ",
 343                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 344         vprintk(fmt, args);
 345         va_end(args);
 346 }
 347 #endif /* DEBUG */
 348
 349 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 350 {
 351         u32 macctl;
 352
 353         B43_WARN_ON(offset % 4 != 0);
 354
 355         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 356         if (macctl & B43_MACCTL_BE)
 357                 val = swab32(val);
 358
 359         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 360         mmiowb();
 361         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 362 }
 363
 364 static inline void b43_shm_control_word(struct b43_wldev *dev,
 365                                         u16 routing, u16 offset)
 366 {
 367         u32 control;
 368
 369         /* "offset" is the WORD offset. */
 370         control = routing;
 371         control <<= 16;
 372         control |= offset;
 373         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 374 }
 375
 376 u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 377 {
 378         u32 ret;
 379
 380         if (routing == B43_SHM_SHARED) {
 381                 B43_WARN_ON(offset & 0x0001);
 382                 if (offset & 0x0003) {
 383                         /* Unaligned access */
 384                         b43_shm_control_word(dev, routing, offset >> 2);
 385                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 386                         ret <<= 16;
 387                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 388                         ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
 389
 390                         goto out;
 391                 }
 392                 offset >>= 2;
 393         }
 394         b43_shm_control_word(dev, routing, offset);
 395         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 396 out:
 397         return ret;
 398 }
 399
 400 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 401 {
 402         struct b43_wl *wl = dev->wl;
 403         unsigned long flags;
 404         u32 ret;
 405
 406         spin_lock_irqsave(&wl->shm_lock, flags);
 407         ret = __b43_shm_read32(dev, routing, offset);
 408         spin_unlock_irqrestore(&wl->shm_lock, flags);
 409
 410         return ret;
 411 }
 412
 413 u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 414 {
 415         u16 ret;
 416
 417         if (routing == B43_SHM_SHARED) {
 418                 B43_WARN_ON(offset & 0x0001);
 419                 if (offset & 0x0003) {
 420                         /* Unaligned access */
 421                         b43_shm_control_word(dev, routing, offset >> 2);
 422                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 423
 424                         goto out;
 425                 }
 426                 offset >>= 2;
 427         }
 428         b43_shm_control_word(dev, routing, offset);
 429         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 430 out:
 431         return ret;
 432 }
 433
 434 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 435 {
 436         struct b43_wl *wl = dev->wl;
 437         unsigned long flags;
 438         u16 ret;
 439
 440         spin_lock_irqsave(&wl->shm_lock, flags);
 441         ret = __b43_shm_read16(dev, routing, offset);
 442         spin_unlock_irqrestore(&wl->shm_lock, flags);
 443
 444         return ret;
 445 }
 446
 447 void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 448 {
 449         if (routing == B43_SHM_SHARED) {
 450                 B43_WARN_ON(offset & 0x0001);
 451                 if (offset & 0x0003) {
 452                         /* Unaligned access */
 453                         b43_shm_control_word(dev, routing, offset >> 2);
 454                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 455                                     (value >> 16) & 0xffff);
 456                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 457                         b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
 458                         return;
 459                 }
 460                 offset >>= 2;
 461         }
 462         b43_shm_control_word(dev, routing, offset);
 463         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 464 }
 465
 466 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 467 {
 468         struct b43_wl *wl = dev->wl;
 469         unsigned long flags;
 470
 471         spin_lock_irqsave(&wl->shm_lock, flags);
 472         __b43_shm_write32(dev, routing, offset, value);
 473         spin_unlock_irqrestore(&wl->shm_lock, flags);
 474 }
 475
 476 void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 477 {
 478         if (routing == B43_SHM_SHARED) {
 479                 B43_WARN_ON(offset & 0x0001);
 480                 if (offset & 0x0003) {
 481                         /* Unaligned access */
 482                         b43_shm_control_word(dev, routing, offset >> 2);
 483                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 484                         return;
 485                 }
 486                 offset >>= 2;
 487         }
 488         b43_shm_control_word(dev, routing, offset);
 489         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 490 }
 491
 492 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 493 {
 494         struct b43_wl *wl = dev->wl;
 495         unsigned long flags;
 496
 497         spin_lock_irqsave(&wl->shm_lock, flags);
 498         __b43_shm_write16(dev, routing, offset, value);
 499         spin_unlock_irqrestore(&wl->shm_lock, flags);
 500 }
 501
 502 /* Read HostFlags */
 503 u64 b43_hf_read(struct b43_wldev * dev)
 504 {
 505         u64 ret;
 506
 507         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 508         ret <<= 16;
 509         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 510         ret <<= 16;
 511         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 512
 513         return ret;
 514 }
 515
 516 /* Write HostFlags */
 517 void b43_hf_write(struct b43_wldev *dev, u64 value)
 518 {
 519         u16 lo, mi, hi;
 520
 521         lo = (value & 0x00000000FFFFULL);
 522         mi = (value & 0x0000FFFF0000ULL) >> 16;
 523         hi = (value & 0xFFFF00000000ULL) >> 32;
 524         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 525         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 526         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 527 }
 528
 529 void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
 530 {
 531         /* We need to be careful. As we read the TSF from multiple
 532          * registers, we should take care of register overflows.
 533          * In theory, the whole tsf read process should be atomic.
 534          * We try to be atomic here, by restaring the read process,
 535          * if any of the high registers changed (overflew).
 536          */
 537         if (dev->dev->id.revision >= 3) {
 538                 u32 low, high, high2;
 539
 540                 do {
 541                         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 542                         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 543                         high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 544                 } while (unlikely(high != high2));
 545
 546                 *tsf = high;
 547                 *tsf <<= 32;
 548                 *tsf |= low;
 549         } else {
 550                 u64 tmp;
 551                 u16 v0, v1, v2, v3;
 552                 u16 test1, test2, test3;
 553
 554                 do {
 555                         v3 = b43_read16(dev, B43_MMIO_TSF_3);
 556                         v2 = b43_read16(dev, B43_MMIO_TSF_2);
 557                         v1 = b43_read16(dev, B43_MMIO_TSF_1);
 558                         v0 = b43_read16(dev, B43_MMIO_TSF_0);
 559
 560                         test3 = b43_read16(dev, B43_MMIO_TSF_3);
 561                         test2 = b43_read16(dev, B43_MMIO_TSF_2);
 562                         test1 = b43_read16(dev, B43_MMIO_TSF_1);
 563                 } while (v3 != test3 || v2 != test2 || v1 != test1);
 564
 565                 *tsf = v3;
 566                 *tsf <<= 48;
 567                 tmp = v2;
 568                 tmp <<= 32;
 569                 *tsf |= tmp;
 570                 tmp = v1;
 571                 tmp <<= 16;
 572                 *tsf |= tmp;
 573                 *tsf |= v0;
 574         }
 575 }
 576
 577 static void b43_time_lock(struct b43_wldev *dev)
 578 {
 579         u32 macctl;
 580
 581         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 582         macctl |= B43_MACCTL_TBTTHOLD;
 583         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 584         /* Commit the write */
 585         b43_read32(dev, B43_MMIO_MACCTL);
 586 }
 587
 588 static void b43_time_unlock(struct b43_wldev *dev)
 589 {
 590         u32 macctl;
 591
 592         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 593         macctl &= ~B43_MACCTL_TBTTHOLD;
 594         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 595         /* Commit the write */
 596         b43_read32(dev, B43_MMIO_MACCTL);
 597 }
 598
 599 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 600 {
 601         /* Be careful with the in-progress timer.
 602          * First zero out the low register, so we have a full
 603          * register-overflow duration to complete the operation.
 604          */
 605         if (dev->dev->id.revision >= 3) {
 606                 u32 lo = (tsf & 0x00000000FFFFFFFFULL);
 607                 u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
 608
 609                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
 610                 mmiowb();
 611                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
 612                 mmiowb();
 613                 b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
 614         } else {
 615                 u16 v0 = (tsf & 0x000000000000FFFFULL);
 616                 u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
 617                 u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
 618                 u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
 619
 620                 b43_write16(dev, B43_MMIO_TSF_0, 0);
 621                 mmiowb();
 622                 b43_write16(dev, B43_MMIO_TSF_3, v3);
 623                 mmiowb();
 624                 b43_write16(dev, B43_MMIO_TSF_2, v2);
 625                 mmiowb();
 626                 b43_write16(dev, B43_MMIO_TSF_1, v1);
 627                 mmiowb();
 628                 b43_write16(dev, B43_MMIO_TSF_0, v0);
 629         }
 630 }
 631
 632 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 633 {
 634         b43_time_lock(dev);
 635         b43_tsf_write_locked(dev, tsf);
 636         b43_time_unlock(dev);
 637 }
 638
 639 static
 640 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
 641 {
 642         static const u8 zero_addr[ETH_ALEN] = { 0 };
 643         u16 data;
 644
 645         if (!mac)
 646                 mac = zero_addr;
 647
 648         offset |= 0x0020;
 649         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 650
 651         data = mac[0];
 652         data |= mac[1] << 8;
 653         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 654         data = mac[2];
 655         data |= mac[3] << 8;
 656         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 657         data = mac[4];
 658         data |= mac[5] << 8;
 659         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 660 }
 661
 662 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 663 {
 664         const u8 *mac;
 665         const u8 *bssid;
 666         u8 mac_bssid[ETH_ALEN * 2];
 667         int i;
 668         u32 tmp;
 669
 670         bssid = dev->wl->bssid;
 671         mac = dev->wl->mac_addr;
 672
 673         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 674
 675         memcpy(mac_bssid, mac, ETH_ALEN);
 676         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 677
 678         /* Write our MAC address and BSSID to template ram */
 679         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 680                 tmp = (u32) (mac_bssid[i + 0]);
 681                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 682                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 683                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 684                 b43_ram_write(dev, 0x20 + i, tmp);
 685         }
 686 }
 687
 688 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 689 {
 690         b43_write_mac_bssid_templates(dev);
 691         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 692 }
 693
 694 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 695 {
 696         /* slot_time is in usec. */
 697         if (dev->phy.type != B43_PHYTYPE_G)
 698                 return;
 699         b43_write16(dev, 0x684, 510 + slot_time);
 700         b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 701 }
 702
 703 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 704 {
 705         b43_set_slot_time(dev, 9);
 706         dev->short_slot = 1;
 707 }
 708
 709 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 710 {
 711         b43_set_slot_time(dev, 20);
 712         dev->short_slot = 0;
 713 }
 714
 715 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
 716  * Returns the _previously_ enabled IRQ mask.
 717  */
 718 static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
 719 {
 720         u32 old_mask;
 721
 722         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 723         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
 724
 725         return old_mask;
 726 }
 727
 728 /* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
 729  * Returns the _previously_ enabled IRQ mask.
 730  */
 731 static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
 732 {
 733         u32 old_mask;
 734
 735         old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
 736         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
 737
 738         return old_mask;
 739 }
 740
 741 /* Synchronize IRQ top- and bottom-half.
 742  * IRQs must be masked before calling this.
 743  * This must not be called with the irq_lock held.
 744  */
 745 static void b43_synchronize_irq(struct b43_wldev *dev)
 746 {
 747         synchronize_irq(dev->dev->irq);
 748         tasklet_kill(&dev->isr_tasklet);
 749 }
 750
 751 /* DummyTransmission function, as documented on
 752  * http://bcm-specs.sipsolutions.net/DummyTransmission
 753  */
 754 void b43_dummy_transmission(struct b43_wldev *dev)
 755 {
 756         struct b43_wl *wl = dev->wl;
 757         struct b43_phy *phy = &dev->phy;
 758         unsigned int i, max_loop;
 759         u16 value;
 760         u32 buffer[5] = {
 761                 0x00000000,
 762                 0x00D40000,
 763                 0x00000000,
 764                 0x01000000,
 765                 0x00000000,
 766         };
 767
 768         switch (phy->type) {
 769         case B43_PHYTYPE_A:
 770                 max_loop = 0x1E;
 771                 buffer[0] = 0x000201CC;
 772                 break;
 773         case B43_PHYTYPE_B:
 774         case B43_PHYTYPE_G:
 775                 max_loop = 0xFA;
 776                 buffer[0] = 0x000B846E;
 777                 break;
 778         default:
 779                 B43_WARN_ON(1);
 780                 return;
 781         }
 782
 783         spin_lock_irq(&wl->irq_lock);
 784         write_lock(&wl->tx_lock);
 785
 786         for (i = 0; i < 5; i++)
 787                 b43_ram_write(dev, i * 4, buffer[i]);
 788
 789         /* Commit writes */
 790         b43_read32(dev, B43_MMIO_MACCTL);
 791
 792         b43_write16(dev, 0x0568, 0x0000);
 793         b43_write16(dev, 0x07C0, 0x0000);
 794         value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
 795         b43_write16(dev, 0x050C, value);
 796         b43_write16(dev, 0x0508, 0x0000);
 797         b43_write16(dev, 0x050A, 0x0000);
 798         b43_write16(dev, 0x054C, 0x0000);
 799         b43_write16(dev, 0x056A, 0x0014);
 800         b43_write16(dev, 0x0568, 0x0826);
 801         b43_write16(dev, 0x0500, 0x0000);
 802         b43_write16(dev, 0x0502, 0x0030);
 803
 804         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 805                 b43_radio_write16(dev, 0x0051, 0x0017);
 806         for (i = 0x00; i < max_loop; i++) {
 807                 value = b43_read16(dev, 0x050E);
 808                 if (value & 0x0080)
 809                         break;
 810                 udelay(10);
 811         }
 812         for (i = 0x00; i < 0x0A; i++) {
 813                 value = b43_read16(dev, 0x050E);
 814                 if (value & 0x0400)
 815                         break;
 816                 udelay(10);
 817         }
 818         for (i = 0x00; i < 0x0A; i++) {
 819                 value = b43_read16(dev, 0x0690);
 820                 if (!(value & 0x0100))
 821                         break;
 822                 udelay(10);
 823         }
 824         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 825                 b43_radio_write16(dev, 0x0051, 0x0037);
 826
 827         write_unlock(&wl->tx_lock);
 828         spin_unlock_irq(&wl->irq_lock);
 829 }
 830
 831 static void key_write(struct b43_wldev *dev,
 832                       u8 index, u8 algorithm, const u8 * key)
 833 {
 834         unsigned int i;
 835         u32 offset;
 836         u16 value;
 837         u16 kidx;
 838
 839         /* Key index/algo block */
 840         kidx = b43_kidx_to_fw(dev, index);
 841         value = ((kidx << 4) | algorithm);
 842         b43_shm_write16(dev, B43_SHM_SHARED,
 843                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 844
 845         /* Write the key to the Key Table Pointer offset */
 846         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 847         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 848                 value = key[i];
 849                 value |= (u16) (key[i + 1]) << 8;
 850                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 851         }
 852 }
 853
 854 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
 855 {
 856         u32 addrtmp[2] = { 0, 0, };
 857         u8 per_sta_keys_start = 8;
 858
 859         if (b43_new_kidx_api(dev))
 860                 per_sta_keys_start = 4;
 861
 862         B43_WARN_ON(index < per_sta_keys_start);
 863         /* We have two default TX keys and possibly two default RX keys.
 864          * Physical mac 0 is mapped to physical key 4 or 8, depending
 865          * on the firmware version.
 866          * So we must adjust the index here.
 867          */
 868         index -= per_sta_keys_start;
 869
 870         if (addr) {
 871                 addrtmp[0] = addr[0];
 872                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 873                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 874                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 875                 addrtmp[1] = addr[4];
 876                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 877         }
 878
 879         if (dev->dev->id.revision >= 5) {
 880                 /* Receive match transmitter address mechanism */
 881                 b43_shm_write32(dev, B43_SHM_RCMTA,
 882                                 (index * 2) + 0, addrtmp[0]);
 883                 b43_shm_write16(dev, B43_SHM_RCMTA,
 884                                 (index * 2) + 1, addrtmp[1]);
 885         } else {
 886                 /* RXE (Receive Engine) and
 887                  * PSM (Programmable State Machine) mechanism
 888                  */
 889                 if (index < 8) {
 890                         /* TODO write to RCM 16, 19, 22 and 25 */
 891                 } else {
 892                         b43_shm_write32(dev, B43_SHM_SHARED,
 893                                         B43_SHM_SH_PSM + (index * 6) + 0,
 894                                         addrtmp[0]);
 895                         b43_shm_write16(dev, B43_SHM_SHARED,
 896                                         B43_SHM_SH_PSM + (index * 6) + 4,
 897                                         addrtmp[1]);
 898                 }
 899         }
 900 }
 901
 902 static void do_key_write(struct b43_wldev *dev,
 903                          u8 index, u8 algorithm,
 904                          const u8 * key, size_t key_len, const u8 * mac_addr)
 905 {
 906         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 907         u8 per_sta_keys_start = 8;
 908
 909         if (b43_new_kidx_api(dev))
 910                 per_sta_keys_start = 4;
 911
 912         B43_WARN_ON(index >= dev->max_nr_keys);
 913         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 914
 915         if (index >= per_sta_keys_start)
 916                 keymac_write(dev, index, NULL); /* First zero out mac. */
 917         if (key)
 918                 memcpy(buf, key, key_len);
 919         key_write(dev, index, algorithm, buf);
 920         if (index >= per_sta_keys_start)
 921                 keymac_write(dev, index, mac_addr);
 922
 923         dev->key[index].algorithm = algorithm;
 924 }
 925
 926 static int b43_key_write(struct b43_wldev *dev,
 927                          int index, u8 algorithm,
 928                          const u8 * key, size_t key_len,
 929                          const u8 * mac_addr,
 930                          struct ieee80211_key_conf *keyconf)
 931 {
 932         int i;
 933         int sta_keys_start;
 934
 935         if (key_len > B43_SEC_KEYSIZE)
 936                 return -EINVAL;
 937         for (i = 0; i < dev->max_nr_keys; i++) {
 938                 /* Check that we don't already have this key. */
 939                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 940         }
 941         if (index < 0) {
 942                 /* Either pairwise key or address is 00:00:00:00:00:00
 943                  * for transmit-only keys. Search the index. */
 944                 if (b43_new_kidx_api(dev))
 945                         sta_keys_start = 4;
 946                 else
 947                         sta_keys_start = 8;
 948                 for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
 949                         if (!dev->key[i].keyconf) {
 950                                 /* found empty */
 951                                 index = i;
 952                                 break;
 953                         }
 954                 }
 955                 if (index < 0) {
 956                         b43err(dev->wl, "Out of hardware key memory\n");
 957                         return -ENOSPC;
 958                 }
 959         } else
 960                 B43_WARN_ON(index > 3);
 961
 962         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 963         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 964                 /* Default RX key */
 965                 B43_WARN_ON(mac_addr);
 966                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 967         }
 968         keyconf->hw_key_idx = index;
 969         dev->key[index].keyconf = keyconf;
 970
 971         return 0;
 972 }
 973
 974 static int b43_key_clear(struct b43_wldev *dev, int index)
 975 {
 976         if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
 977                 return -EINVAL;
 978         do_key_write(dev, index, B43_SEC_ALGO_NONE,
 979                      NULL, B43_SEC_KEYSIZE, NULL);
 980         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 981                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
 982                              NULL, B43_SEC_KEYSIZE, NULL);
 983         }
 984         dev->key[index].keyconf = NULL;
 985
 986         return 0;
 987 }
 988
 989 static void b43_clear_keys(struct b43_wldev *dev)
 990 {
 991         int i;
 992
 993         for (i = 0; i < dev->max_nr_keys; i++)
 994                 b43_key_clear(dev, i);
 995 }
 996
 997 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
 998 {
 999         u32 macctl;
1000         u16 ucstat;
1001         bool hwps;
1002         bool awake;
1003         int i;
1004
1005         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1006                     (ps_flags & B43_PS_DISABLED));
1007         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1008
1009         if (ps_flags & B43_PS_ENABLED) {
1010                 hwps = 1;
1011         } else if (ps_flags & B43_PS_DISABLED) {
1012                 hwps = 0;
1013         } else {
1014                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1015                 //      and thus is not an AP and we are associated, set bit 25
1016         }
1017         if (ps_flags & B43_PS_AWAKE) {
1018                 awake = 1;
1019         } else if (ps_flags & B43_PS_ASLEEP) {
1020                 awake = 0;
1021         } else {
1022                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1023                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1024                 //      successful, set bit26
1025         }
1026
1027 /* FIXME: For now we force awake-on and hwps-off */
1028         hwps = 0;
1029         awake = 1;
1030
1031         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1032         if (hwps)
1033                 macctl |= B43_MACCTL_HWPS;
1034         else
1035                 macctl &= ~B43_MACCTL_HWPS;
1036         if (awake)
1037                 macctl |= B43_MACCTL_AWAKE;
1038         else
1039                 macctl &= ~B43_MACCTL_AWAKE;
1040         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1041         /* Commit write */
1042         b43_read32(dev, B43_MMIO_MACCTL);
1043         if (awake && dev->dev->id.revision >= 5) {
1044                 /* Wait for the microcode to wake up. */
1045                 for (i = 0; i < 100; i++) {
1046                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1047                                                 B43_SHM_SH_UCODESTAT);
1048                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1049                                 break;
1050                         udelay(10);
1051                 }
1052         }
1053 }
1054
1055 /* Turn the Analog ON/OFF */
1056 static void b43_switch_analog(struct b43_wldev *dev, int on)
1057 {
1058         switch (dev->phy.type) {
1059         case B43_PHYTYPE_A:
1060         case B43_PHYTYPE_G:
1061                 b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
1062                 break;
1063         case B43_PHYTYPE_N:
1064                 b43_phy_write(dev, B43_NPHY_AFECTL_OVER,
1065                               on ? 0 : 0x7FFF);
1066                 break;
1067         default:
1068                 B43_WARN_ON(1);
1069         }
1070 }
1071
1072 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1073 {
1074         u32 tmslow;
1075         u32 macctl;
1076
1077         flags |= B43_TMSLOW_PHYCLKEN;
1078         flags |= B43_TMSLOW_PHYRESET;
1079         ssb_device_enable(dev->dev, flags);
1080         msleep(2);              /* Wait for the PLL to turn on. */
1081
1082         /* Now take the PHY out of Reset again */
1083         tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1084         tmslow |= SSB_TMSLOW_FGC;
1085         tmslow &= ~B43_TMSLOW_PHYRESET;
1086         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1087         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1088         msleep(1);
1089         tmslow &= ~SSB_TMSLOW_FGC;
1090         ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1091         ssb_read32(dev->dev, SSB_TMSLOW);       /* flush */
1092         msleep(1);
1093
1094         /* Turn Analog ON */
1095         b43_switch_analog(dev, 1);
1096
1097         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1098         macctl &= ~B43_MACCTL_GMODE;
1099         if (flags & B43_TMSLOW_GMODE)
1100                 macctl |= B43_MACCTL_GMODE;
1101         macctl |= B43_MACCTL_IHR_ENABLED;
1102         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1103 }
1104
1105 static void handle_irq_transmit_status(struct b43_wldev *dev)
1106 {
1107         u32 v0, v1;
1108         u16 tmp;
1109         struct b43_txstatus stat;
1110
1111         while (1) {
1112                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1113                 if (!(v0 & 0x00000001))
1114                         break;
1115                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1116
1117                 stat.cookie = (v0 >> 16);
1118                 stat.seq = (v1 & 0x0000FFFF);
1119                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1120                 tmp = (v0 & 0x0000FFFF);
1121                 stat.frame_count = ((tmp & 0xF000) >> 12);
1122                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1123                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1124                 stat.pm_indicated = !!(tmp & 0x0080);
1125                 stat.intermediate = !!(tmp & 0x0040);
1126                 stat.for_ampdu = !!(tmp & 0x0020);
1127                 stat.acked = !!(tmp & 0x0002);
1128
1129                 b43_handle_txstatus(dev, &stat);
1130         }
1131 }
1132
1133 static void drain_txstatus_queue(struct b43_wldev *dev)
1134 {
1135         u32 dummy;
1136
1137         if (dev->dev->id.revision < 5)
1138                 return;
1139         /* Read all entries from the microcode TXstatus FIFO
1140          * and throw them away.
1141          */
1142         while (1) {
1143                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1144                 if (!(dummy & 0x00000001))
1145                         break;
1146                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1147         }
1148 }
1149
1150 static u32 b43_jssi_read(struct b43_wldev *dev)
1151 {
1152         u32 val = 0;
1153
1154         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1155         val <<= 16;
1156         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1157
1158         return val;
1159 }
1160
1161 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1162 {
1163         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1164         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1165 }
1166
1167 static void b43_generate_noise_sample(struct b43_wldev *dev)
1168 {
1169         b43_jssi_write(dev, 0x7F7F7F7F);
1170         b43_write32(dev, B43_MMIO_MACCMD,
1171                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1172 }
1173
1174 static void b43_calculate_link_quality(struct b43_wldev *dev)
1175 {
1176         /* Top half of Link Quality calculation. */
1177
1178         if (dev->noisecalc.calculation_running)
1179                 return;
1180         dev->noisecalc.calculation_running = 1;
1181         dev->noisecalc.nr_samples = 0;
1182
1183         b43_generate_noise_sample(dev);
1184 }
1185
1186 static void handle_irq_noise(struct b43_wldev *dev)
1187 {
1188         struct b43_phy *phy = &dev->phy;
1189         u16 tmp;
1190         u8 noise[4];
1191         u8 i, j;
1192         s32 average;
1193
1194         /* Bottom half of Link Quality calculation. */
1195
1196         /* Possible race condition: It might be possible that the user
1197          * changed to a different channel in the meantime since we
1198          * started the calculation. We ignore that fact, since it's
1199          * not really that much of a problem. The background noise is
1200          * an estimation only anyway. Slightly wrong results will get damped
1201          * by the averaging of the 8 sample rounds. Additionally the
1202          * value is shortlived. So it will be replaced by the next noise
1203          * calculation round soon. */
1204
1205         B43_WARN_ON(!dev->noisecalc.calculation_running);
1206         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1207         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1208             noise[2] == 0x7F || noise[3] == 0x7F)
1209                 goto generate_new;
1210
1211         /* Get the noise samples. */
1212         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1213         i = dev->noisecalc.nr_samples;
1214         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1215         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1216         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1217         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1218         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1219         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1220         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1221         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1222         dev->noisecalc.nr_samples++;
1223         if (dev->noisecalc.nr_samples == 8) {
1224                 /* Calculate the Link Quality by the noise samples. */
1225                 average = 0;
1226                 for (i = 0; i < 8; i++) {
1227                         for (j = 0; j < 4; j++)
1228                                 average += dev->noisecalc.samples[i][j];
1229                 }
1230                 average /= (8 * 4);
1231                 average *= 125;
1232                 average += 64;
1233                 average /= 128;
1234                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1235                 tmp = (tmp / 128) & 0x1F;
1236                 if (tmp >= 8)
1237                         average += 2;
1238                 else
1239                         average -= 25;
1240                 if (tmp == 8)
1241                         average -= 72;
1242                 else
1243                         average -= 48;
1244
1245                 dev->stats.link_noise = average;
1246                 dev->noisecalc.calculation_running = 0;
1247                 return;
1248         }
1249 generate_new:
1250         b43_generate_noise_sample(dev);
1251 }
1252
1253 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1254 {
1255         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP)) {
1256                 ///TODO: PS TBTT
1257         } else {
1258                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1259                         b43_power_saving_ctl_bits(dev, 0);
1260         }
1261         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
1262                 dev->dfq_valid = 1;
1263 }
1264
1265 static void handle_irq_atim_end(struct b43_wldev *dev)
1266 {
1267         if (dev->dfq_valid) {
1268                 b43_write32(dev, B43_MMIO_MACCMD,
1269                             b43_read32(dev, B43_MMIO_MACCMD)
1270                             | B43_MACCMD_DFQ_VALID);
1271                 dev->dfq_valid = 0;
1272         }
1273 }
1274
1275 static void handle_irq_pmq(struct b43_wldev *dev)
1276 {
1277         u32 tmp;
1278
1279         //TODO: AP mode.
1280
1281         while (1) {
1282                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1283                 if (!(tmp & 0x00000008))
1284                         break;
1285         }
1286         /* 16bit write is odd, but correct. */
1287         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1288 }
1289
1290 static void b43_write_template_common(struct b43_wldev *dev,
1291                                       const u8 * data, u16 size,
1292                                       u16 ram_offset,
1293                                       u16 shm_size_offset, u8 rate)
1294 {
1295         u32 i, tmp;
1296         struct b43_plcp_hdr4 plcp;
1297
1298         plcp.data = 0;
1299         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1300         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1301         ram_offset += sizeof(u32);
1302         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1303          * So leave the first two bytes of the next write blank.
1304          */
1305         tmp = (u32) (data[0]) << 16;
1306         tmp |= (u32) (data[1]) << 24;
1307         b43_ram_write(dev, ram_offset, tmp);
1308         ram_offset += sizeof(u32);
1309         for (i = 2; i < size; i += sizeof(u32)) {
1310                 tmp = (u32) (data[i + 0]);
1311                 if (i + 1 < size)
1312                         tmp |= (u32) (data[i + 1]) << 8;
1313                 if (i + 2 < size)
1314                         tmp |= (u32) (data[i + 2]) << 16;
1315                 if (i + 3 < size)
1316                         tmp |= (u32) (data[i + 3]) << 24;
1317                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1318         }
1319         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1320                         size + sizeof(struct b43_plcp_hdr6));
1321 }
1322
1323 /* Check if the use of the antenna that ieee80211 told us to
1324  * use is possible. This will fall back to DEFAULT.
1325  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1326 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1327                                   u8 antenna_nr)
1328 {
1329         u8 antenna_mask;
1330
1331         if (antenna_nr == 0) {
1332                 /* Zero means "use default antenna". That's always OK. */
1333                 return 0;
1334         }
1335
1336         /* Get the mask of available antennas. */
1337         if (dev->phy.gmode)
1338                 antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1339         else
1340                 antenna_mask = dev->dev->bus->sprom.ant_available_a;
1341
1342         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1343                 /* This antenna is not available. Fall back to default. */
1344                 return 0;
1345         }
1346
1347         return antenna_nr;
1348 }
1349
1350 static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
1351 {
1352         antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
1353         switch (antenna) {
1354         case 0:         /* default/diversity */
1355                 return B43_ANTENNA_DEFAULT;
1356         case 1:         /* Antenna 0 */
1357                 return B43_ANTENNA0;
1358         case 2:         /* Antenna 1 */
1359                 return B43_ANTENNA1;
1360         case 3:         /* Antenna 2 */
1361                 return B43_ANTENNA2;
1362         case 4:         /* Antenna 3 */
1363                 return B43_ANTENNA3;
1364         default:
1365                 return B43_ANTENNA_DEFAULT;
1366         }
1367 }
1368
1369 /* Convert a b43 antenna number value to the PHY TX control value. */
1370 static u16 b43_antenna_to_phyctl(int antenna)
1371 {
1372         switch (antenna) {
1373         case B43_ANTENNA0:
1374                 return B43_TXH_PHY_ANT0;
1375         case B43_ANTENNA1:
1376                 return B43_TXH_PHY_ANT1;
1377         case B43_ANTENNA2:
1378                 return B43_TXH_PHY_ANT2;
1379         case B43_ANTENNA3:
1380                 return B43_TXH_PHY_ANT3;
1381         case B43_ANTENNA_AUTO:
1382                 return B43_TXH_PHY_ANT01AUTO;
1383         }
1384         B43_WARN_ON(1);
1385         return 0;
1386 }
1387
1388 static void b43_write_beacon_template(struct b43_wldev *dev,
1389                                       u16 ram_offset,
1390                                       u16 shm_size_offset)
1391 {
1392         unsigned int i, len, variable_len;
1393         const struct ieee80211_mgmt *bcn;
1394         const u8 *ie;
1395         bool tim_found = 0;
1396         unsigned int rate;
1397         u16 ctl;
1398         int antenna;
1399         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1400
1401         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1402         len = min((size_t) dev->wl->current_beacon->len,
1403                   0x200 - sizeof(struct b43_plcp_hdr6));
1404         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1405
1406         b43_write_template_common(dev, (const u8 *)bcn,
1407                                   len, ram_offset, shm_size_offset, rate);
1408
1409         /* Write the PHY TX control parameters. */
1410         antenna = b43_antenna_from_ieee80211(dev, info->antenna_sel_tx);
1411         antenna = b43_antenna_to_phyctl(antenna);
1412         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1413         /* We can't send beacons with short preamble. Would get PHY errors. */
1414         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1415         ctl &= ~B43_TXH_PHY_ANT;
1416         ctl &= ~B43_TXH_PHY_ENC;
1417         ctl |= antenna;
1418         if (b43_is_cck_rate(rate))
1419                 ctl |= B43_TXH_PHY_ENC_CCK;
1420         else
1421                 ctl |= B43_TXH_PHY_ENC_OFDM;
1422         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1423
1424         /* Find the position of the TIM and the DTIM_period value
1425          * and write them to SHM. */
1426         ie = bcn->u.beacon.variable;
1427         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1428         for (i = 0; i < variable_len - 2; ) {
1429                 uint8_t ie_id, ie_len;
1430
1431                 ie_id = ie[i];
1432                 ie_len = ie[i + 1];
1433                 if (ie_id == 5) {
1434                         u16 tim_position;
1435                         u16 dtim_period;
1436                         /* This is the TIM Information Element */
1437
1438                         /* Check whether the ie_len is in the beacon data range. */
1439                         if (variable_len < ie_len + 2 + i)
1440                                 break;
1441                         /* A valid TIM is at least 4 bytes long. */
1442                         if (ie_len < 4)
1443                                 break;
1444                         tim_found = 1;
1445
1446                         tim_position = sizeof(struct b43_plcp_hdr6);
1447                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1448                         tim_position += i;
1449
1450                         dtim_period = ie[i + 3];
1451
1452                         b43_shm_write16(dev, B43_SHM_SHARED,
1453                                         B43_SHM_SH_TIMBPOS, tim_position);
1454                         b43_shm_write16(dev, B43_SHM_SHARED,
1455                                         B43_SHM_SH_DTIMPER, dtim_period);
1456                         break;
1457                 }
1458                 i += ie_len + 2;
1459         }
1460         if (!tim_found) {
1461                 /*
1462                  * If ucode wants to modify TIM do it behind the beacon, this
1463                  * will happen, for example, when doing mesh networking.
1464                  */
1465                 b43_shm_write16(dev, B43_SHM_SHARED,
1466                                 B43_SHM_SH_TIMBPOS,
1467                                 len + sizeof(struct b43_plcp_hdr6));
1468                 b43_shm_write16(dev, B43_SHM_SHARED,
1469                                 B43_SHM_SH_DTIMPER, 0);
1470         }
1471         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1472 }
1473
1474 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1475                                       u16 shm_offset, u16 size,
1476                                       struct ieee80211_rate *rate)
1477 {
1478         struct b43_plcp_hdr4 plcp;
1479         u32 tmp;
1480         __le16 dur;
1481
1482         plcp.data = 0;
1483         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1484         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1485                                                dev->wl->vif, size,
1486                                                rate);
1487         /* Write PLCP in two parts and timing for packet transfer */
1488         tmp = le32_to_cpu(plcp.data);
1489         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1490         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1491         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1492 }
1493
1494 /* Instead of using custom probe response template, this function
1495  * just patches custom beacon template by:
1496  * 1) Changing packet type
1497  * 2) Patching duration field
1498  * 3) Stripping TIM
1499  */
1500 static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1501                                           u16 *dest_size,
1502                                           struct ieee80211_rate *rate)
1503 {
1504         const u8 *src_data;
1505         u8 *dest_data;
1506         u16 src_size, elem_size, src_pos, dest_pos;
1507         __le16 dur;
1508         struct ieee80211_hdr *hdr;
1509         size_t ie_start;
1510
1511         src_size = dev->wl->current_beacon->len;
1512         src_data = (const u8 *)dev->wl->current_beacon->data;
1513
1514         /* Get the start offset of the variable IEs in the packet. */
1515         ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1516         B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1517
1518         if (B43_WARN_ON(src_size < ie_start))
1519                 return NULL;
1520
1521         dest_data = kmalloc(src_size, GFP_ATOMIC);
1522         if (unlikely(!dest_data))
1523                 return NULL;
1524
1525         /* Copy the static data and all Information Elements, except the TIM. */
1526         memcpy(dest_data, src_data, ie_start);
1527         src_pos = ie_start;
1528         dest_pos = ie_start;
1529         for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1530                 elem_size = src_data[src_pos + 1] + 2;
1531                 if (src_data[src_pos] == 5) {
1532                         /* This is the TIM. */
1533                         continue;
1534                 }
1535                 memcpy(dest_data + dest_pos, src_data + src_pos,
1536                        elem_size);
1537                 dest_pos += elem_size;
1538         }
1539         *dest_size = dest_pos;
1540         hdr = (struct ieee80211_hdr *)dest_data;
1541
1542         /* Set the frame control. */
1543         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1544                                          IEEE80211_STYPE_PROBE_RESP);
1545         dur = ieee80211_generic_frame_duration(dev->wl->hw,
1546                                                dev->wl->vif, *dest_size,
1547                                                rate);
1548         hdr->duration_id = dur;
1549
1550         return dest_data;
1551 }
1552
1553 static void b43_write_probe_resp_template(struct b43_wldev *dev,
1554                                           u16 ram_offset,
1555                                           u16 shm_size_offset,
1556                                           struct ieee80211_rate *rate)
1557 {
1558         const u8 *probe_resp_data;
1559         u16 size;
1560
1561         size = dev->wl->current_beacon->len;
1562         probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1563         if (unlikely(!probe_resp_data))
1564                 return;
1565
1566         /* Looks like PLCP headers plus packet timings are stored for
1567          * all possible basic rates
1568          */
1569         b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1570         b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1571         b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1572         b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1573
1574         size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1575         b43_write_template_common(dev, probe_resp_data,
1576                                   size, ram_offset, shm_size_offset,
1577                                   rate->hw_value);
1578         kfree(probe_resp_data);
1579 }
1580
1581 static void b43_upload_beacon0(struct b43_wldev *dev)
1582 {
1583         struct b43_wl *wl = dev->wl;
1584
1585         if (wl->beacon0_uploaded)
1586                 return;
1587         b43_write_beacon_template(dev, 0x68, 0x18);
1588         /* FIXME: Probe resp upload doesn't really belong here,
1589          *        but we don't use that feature anyway. */
1590         b43_write_probe_resp_template(dev, 0x268, 0x4A,
1591                                       &__b43_ratetable[3]);
1592         wl->beacon0_uploaded = 1;
1593 }
1594
1595 static void b43_upload_beacon1(struct b43_wldev *dev)
1596 {
1597         struct b43_wl *wl = dev->wl;
1598
1599         if (wl->beacon1_uploaded)
1600                 return;
1601         b43_write_beacon_template(dev, 0x468, 0x1A);
1602         wl->beacon1_uploaded = 1;
1603 }
1604
1605 static void handle_irq_beacon(struct b43_wldev *dev)
1606 {
1607         struct b43_wl *wl = dev->wl;
1608         u32 cmd, beacon0_valid, beacon1_valid;
1609
1610         if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP) &&
1611             !b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
1612                 return;
1613
1614         /* This is the bottom half of the asynchronous beacon update. */
1615
1616         /* Ignore interrupt in the future. */
1617         dev->irq_savedstate &= ~B43_IRQ_BEACON;
1618
1619         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1620         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1621         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1622
1623         /* Schedule interrupt manually, if busy. */
1624         if (beacon0_valid && beacon1_valid) {
1625                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1626                 dev->irq_savedstate |= B43_IRQ_BEACON;
1627                 return;
1628         }
1629
1630         if (unlikely(wl->beacon_templates_virgin)) {
1631                 /* We never uploaded a beacon before.
1632                  * Upload both templates now, but only mark one valid. */
1633                 wl->beacon_templates_virgin = 0;
1634                 b43_upload_beacon0(dev);
1635                 b43_upload_beacon1(dev);
1636                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1637                 cmd |= B43_MACCMD_BEACON0_VALID;
1638                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1639         } else {
1640                 if (!beacon0_valid) {
1641                         b43_upload_beacon0(dev);
1642                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1643                         cmd |= B43_MACCMD_BEACON0_VALID;
1644                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1645                 } else if (!beacon1_valid) {
1646                         b43_upload_beacon1(dev);
1647                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1648                         cmd |= B43_MACCMD_BEACON1_VALID;
1649                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1650                 }
1651         }
1652 }
1653
1654 static void b43_beacon_update_trigger_work(struct work_struct *work)
1655 {
1656         struct b43_wl *wl = container_of(work, struct b43_wl,
1657                                          beacon_update_trigger);
1658         struct b43_wldev *dev;
1659
1660         mutex_lock(&wl->mutex);
1661         dev = wl->current_dev;
1662         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1663                 spin_lock_irq(&wl->irq_lock);
1664                 /* update beacon right away or defer to irq */
1665                 dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1666                 handle_irq_beacon(dev);
1667                 /* The handler might have updated the IRQ mask. */
1668                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1669                             dev->irq_savedstate);
1670                 mmiowb();
1671                 spin_unlock_irq(&wl->irq_lock);
1672         }
1673         mutex_unlock(&wl->mutex);
1674 }
1675
1676 /* Asynchronously update the packet templates in template RAM.
1677  * Locking: Requires wl->irq_lock to be locked. */
1678 static void b43_update_templates(struct b43_wl *wl)
1679 {
1680         struct sk_buff *beacon;
1681
1682         /* This is the top half of the ansynchronous beacon update.
1683          * The bottom half is the beacon IRQ.
1684          * Beacon update must be asynchronous to avoid sending an
1685          * invalid beacon. This can happen for example, if the firmware
1686          * transmits a beacon while we are updating it. */
1687
1688         /* We could modify the existing beacon and set the aid bit in
1689          * the TIM field, but that would probably require resizing and
1690          * moving of data within the beacon template.
1691          * Simply request a new beacon and let mac80211 do the hard work. */
1692         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1693         if (unlikely(!beacon))
1694                 return;
1695
1696         if (wl->current_beacon)
1697                 dev_kfree_skb_any(wl->current_beacon);
1698         wl->current_beacon = beacon;
1699         wl->beacon0_uploaded = 0;
1700         wl->beacon1_uploaded = 0;
1701         queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1702 }
1703
1704 static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
1705 {
1706         u32 tmp;
1707         u16 i, len;
1708
1709         len = min((u16) ssid_len, (u16) 0x100);
1710         for (i = 0; i < len; i += sizeof(u32)) {
1711                 tmp = (u32) (ssid[i + 0]);
1712                 if (i + 1 < len)
1713                         tmp |= (u32) (ssid[i + 1]) << 8;
1714                 if (i + 2 < len)
1715                         tmp |= (u32) (ssid[i + 2]) << 16;
1716                 if (i + 3 < len)
1717                         tmp |= (u32) (ssid[i + 3]) << 24;
1718                 b43_shm_write32(dev, B43_SHM_SHARED, 0x380 + i, tmp);
1719         }
1720         b43_shm_write16(dev, B43_SHM_SHARED, 0x48, len);
1721 }
1722
1723 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1724 {
1725         b43_time_lock(dev);
1726         if (dev->dev->id.revision >= 3) {
1727                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1728                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1729         } else {
1730                 b43_write16(dev, 0x606, (beacon_int >> 6));
1731                 b43_write16(dev, 0x610, beacon_int);
1732         }
1733         b43_time_unlock(dev);
1734         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1735 }
1736
1737 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1738 {
1739         u16 reason;
1740
1741         /* Read the register that contains the reason code for the panic. */
1742         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1743         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1744
1745         switch (reason) {
1746         default:
1747                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1748                 /* fallthrough */
1749         case B43_FWPANIC_DIE:
1750                 /* Do not restart the controller or firmware.
1751                  * The device is nonfunctional from now on.
1752                  * Restarting would result in this panic to trigger again,
1753                  * so we avoid that recursion. */
1754                 break;
1755         case B43_FWPANIC_RESTART:
1756                 b43_controller_restart(dev, "Microcode panic");
1757                 break;
1758         }
1759 }
1760
1761 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1762 {
1763         unsigned int i, cnt;
1764         u16 reason, marker_id, marker_line;
1765         __le16 *buf;
1766
1767         /* The proprietary firmware doesn't have this IRQ. */
1768         if (!dev->fw.opensource)
1769                 return;
1770
1771         /* Read the register that contains the reason code for this IRQ. */
1772         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1773
1774         switch (reason) {
1775         case B43_DEBUGIRQ_PANIC:
1776                 b43_handle_firmware_panic(dev);
1777                 break;
1778         case B43_DEBUGIRQ_DUMP_SHM:
1779                 if (!B43_DEBUG)
1780                         break; /* Only with driver debugging enabled. */
1781                 buf = kmalloc(4096, GFP_ATOMIC);
1782                 if (!buf) {
1783                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1784                         goto out;
1785                 }
1786                 for (i = 0; i < 4096; i += 2) {
1787                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1788                         buf[i / 2] = cpu_to_le16(tmp);
1789                 }
1790                 b43info(dev->wl, "Shared memory dump:\n");
1791                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1792                                16, 2, buf, 4096, 1);
1793                 kfree(buf);
1794                 break;
1795         case B43_DEBUGIRQ_DUMP_REGS:
1796                 if (!B43_DEBUG)
1797                         break; /* Only with driver debugging enabled. */
1798                 b43info(dev->wl, "Microcode register dump:\n");
1799                 for (i = 0, cnt = 0; i < 64; i++) {
1800                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1801                         if (cnt == 0)
1802                                 printk(KERN_INFO);
1803                         printk("r%02u: 0x%04X  ", i, tmp);
1804                         cnt++;
1805                         if (cnt == 6) {
1806                                 printk("\n");
1807                                 cnt = 0;
1808                         }
1809                 }
1810                 printk("\n");
1811                 break;
1812         case B43_DEBUGIRQ_MARKER:
1813                 if (!B43_DEBUG)
1814                         break; /* Only with driver debugging enabled. */
1815                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1816                                            B43_MARKER_ID_REG);
1817                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1818                                              B43_MARKER_LINE_REG);
1819                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1820                         "at line number %u\n",
1821                         marker_id, marker_line);
1822                 break;
1823         default:
1824                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1825                        reason);
1826         }
1827 out:
1828         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1829         b43_shm_write16(dev, B43_SHM_SCRATCH,
1830                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1831 }
1832
1833 /* Interrupt handler bottom-half */
1834 static void b43_interrupt_tasklet(struct b43_wldev *dev)
1835 {
1836         u32 reason;
1837         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1838         u32 merged_dma_reason = 0;
1839         int i;
1840         unsigned long flags;
1841
1842         spin_lock_irqsave(&dev->wl->irq_lock, flags);
1843
1844         B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1845
1846         reason = dev->irq_reason;
1847         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1848                 dma_reason[i] = dev->dma_reason[i];
1849                 merged_dma_reason |= dma_reason[i];
1850         }
1851
1852         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1853                 b43err(dev->wl, "MAC transmission error\n");
1854
1855         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1856                 b43err(dev->wl, "PHY transmission error\n");
1857                 rmb();
1858                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1859                         atomic_set(&dev->phy.txerr_cnt,
1860                                    B43_PHY_TX_BADNESS_LIMIT);
1861                         b43err(dev->wl, "Too many PHY TX errors, "
1862                                         "restarting the controller\n");
1863                         b43_controller_restart(dev, "PHY TX errors");
1864                 }
1865         }
1866
1867         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1868                                           B43_DMAIRQ_NONFATALMASK))) {
1869                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1870                         b43err(dev->wl, "Fatal DMA error: "
1871                                "0x%08X, 0x%08X, 0x%08X, "
1872                                "0x%08X, 0x%08X, 0x%08X\n",
1873                                dma_reason[0], dma_reason[1],
1874                                dma_reason[2], dma_reason[3],
1875                                dma_reason[4], dma_reason[5]);
1876                         b43_controller_restart(dev, "DMA error");
1877                         mmiowb();
1878                         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1879                         return;
1880                 }
1881                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1882                         b43err(dev->wl, "DMA error: "
1883                                "0x%08X, 0x%08X, 0x%08X, "
1884                                "0x%08X, 0x%08X, 0x%08X\n",
1885                                dma_reason[0], dma_reason[1],
1886                                dma_reason[2], dma_reason[3],
1887                                dma_reason[4], dma_reason[5]);
1888                 }
1889         }
1890
1891         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1892                 handle_irq_ucode_debug(dev);
1893         if (reason & B43_IRQ_TBTT_INDI)
1894                 handle_irq_tbtt_indication(dev);
1895         if (reason & B43_IRQ_ATIM_END)
1896                 handle_irq_atim_end(dev);
1897         if (reason & B43_IRQ_BEACON)
1898                 handle_irq_beacon(dev);
1899         if (reason & B43_IRQ_PMQ)
1900                 handle_irq_pmq(dev);
1901         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1902                 ;/* TODO */
1903         if (reason & B43_IRQ_NOISESAMPLE_OK)
1904                 handle_irq_noise(dev);
1905
1906         /* Check the DMA reason registers for received data. */
1907         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1908                 if (b43_using_pio_transfers(dev))
1909                         b43_pio_rx(dev->pio.rx_queue);
1910                 else
1911                         b43_dma_rx(dev->dma.rx_ring);
1912         }
1913         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1914         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1915         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1916         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1917         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1918
1919         if (reason & B43_IRQ_TX_OK)
1920                 handle_irq_transmit_status(dev);
1921
1922         b43_interrupt_enable(dev, dev->irq_savedstate);
1923         mmiowb();
1924         spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1925 }
1926
1927 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1928 {
1929         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1930
1931         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1932         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1933         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1934         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1935         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1936         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1937 }
1938
1939 /* Interrupt handler top-half */
1940 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1941 {
1942         irqreturn_t ret = IRQ_NONE;
1943         struct b43_wldev *dev = dev_id;
1944         u32 reason;
1945
1946         if (!dev)
1947                 return IRQ_NONE;
1948
1949         spin_lock(&dev->wl->irq_lock);
1950
1951         if (b43_status(dev) < B43_STAT_STARTED)
1952                 goto out;
1953         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1954         if (reason == 0xffffffff)       /* shared IRQ */
1955                 goto out;
1956         ret = IRQ_HANDLED;
1957         reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1958         if (!reason)
1959                 goto out;
1960
1961         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1962             & 0x0001DC00;
1963         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1964             & 0x0000DC00;
1965         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1966             & 0x0000DC00;
1967         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1968             & 0x0001DC00;
1969         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1970             & 0x0000DC00;
1971         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1972             & 0x0000DC00;
1973
1974         b43_interrupt_ack(dev, reason);
1975         /* disable all IRQs. They are enabled again in the bottom half. */
1976         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1977         /* save the reason code and call our bottom half. */
1978         dev->irq_reason = reason;
1979         tasklet_schedule(&dev->isr_tasklet);
1980       out:
1981         mmiowb();
1982         spin_unlock(&dev->wl->irq_lock);
1983
1984         return ret;
1985 }
1986
1987 static void do_release_fw(struct b43_firmware_file *fw)
1988 {
1989         release_firmware(fw->data);
1990         fw->data = NULL;
1991         fw->filename = NULL;
1992 }
1993
1994 static void b43_release_firmware(struct b43_wldev *dev)
1995 {
1996         do_release_fw(&dev->fw.ucode);
1997         do_release_fw(&dev->fw.pcm);
1998         do_release_fw(&dev->fw.initvals);
1999         do_release_fw(&dev->fw.initvals_band);
2000 }
2001
2002 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2003 {
2004         const char *text;
2005
2006         text = "You must go to "
2007                "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
2008                "and download the latest firmware (version 4).\n";
2009         if (error)
2010                 b43err(wl, text);
2011         else
2012                 b43warn(wl, text);
2013 }
2014
2015 static int do_request_fw(struct b43_wldev *dev,
2016                          const char *name,
2017                          struct b43_firmware_file *fw,
2018                          bool silent)
2019 {
2020         char path[sizeof(modparam_fwpostfix) + 32];
2021         const struct firmware *blob;
2022         struct b43_fw_header *hdr;
2023         u32 size;
2024         int err;
2025
2026         if (!name) {
2027                 /* Don't fetch anything. Free possibly cached firmware. */
2028                 do_release_fw(fw);
2029                 return 0;
2030         }
2031         if (fw->filename) {
2032                 if (strcmp(fw->filename, name) == 0)
2033                         return 0; /* Already have this fw. */
2034                 /* Free the cached firmware first. */
2035                 do_release_fw(fw);
2036         }
2037
2038         snprintf(path, ARRAY_SIZE(path),
2039                  "b43%s/%s.fw",
2040                  modparam_fwpostfix, name);
2041         err = request_firmware(&blob, path, dev->dev->dev);
2042         if (err == -ENOENT) {
2043                 if (!silent) {
2044                         b43err(dev->wl, "Firmware file \"%s\" not found\n",
2045                                path);
2046                 }
2047                 return err;
2048         } else if (err) {
2049                 b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
2050                        path, err);
2051                 return err;
2052         }
2053         if (blob->size < sizeof(struct b43_fw_header))
2054                 goto err_format;
2055         hdr = (struct b43_fw_header *)(blob->data);
2056         switch (hdr->type) {
2057         case B43_FW_TYPE_UCODE:
2058         case B43_FW_TYPE_PCM:
2059                 size = be32_to_cpu(hdr->size);
2060                 if (size != blob->size - sizeof(struct b43_fw_header))
2061                         goto err_format;
2062                 /* fallthrough */
2063         case B43_FW_TYPE_IV:
2064                 if (hdr->ver != 1)
2065                         goto err_format;
2066                 break;
2067         default:
2068                 goto err_format;
2069         }
2070
2071         fw->data = blob;
2072         fw->filename = name;
2073
2074         return 0;
2075
2076 err_format:
2077         b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2078         release_firmware(blob);
2079
2080         return -EPROTO;
2081 }
2082
2083 static int b43_request_firmware(struct b43_wldev *dev)
2084 {
2085         struct b43_firmware *fw = &dev->fw;
2086         const u8 rev = dev->dev->id.revision;
2087         const char *filename;
2088         u32 tmshigh;
2089         int err;
2090
2091         /* Get microcode */
2092         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2093         if ((rev >= 5) && (rev <= 10))
2094                 filename = "ucode5";
2095         else if ((rev >= 11) && (rev <= 12))
2096                 filename = "ucode11";
2097         else if (rev >= 13)
2098                 filename = "ucode13";
2099         else
2100                 goto err_no_ucode;
2101         err = do_request_fw(dev, filename, &fw->ucode, 0);
2102         if (err)
2103                 goto err_load;
2104
2105         /* Get PCM code */
2106         if ((rev >= 5) && (rev <= 10))
2107                 filename = "pcm5";
2108         else if (rev >= 11)
2109                 filename = NULL;
2110         else
2111                 goto err_no_pcm;
2112         fw->pcm_request_failed = 0;
2113         err = do_request_fw(dev, filename, &fw->pcm, 1);
2114         if (err == -ENOENT) {
2115                 /* We did not find a PCM file? Not fatal, but
2116                  * core rev <= 10 must do without hwcrypto then. */
2117                 fw->pcm_request_failed = 1;
2118         } else if (err)
2119                 goto err_load;
2120
2121         /* Get initvals */
2122         switch (dev->phy.type) {
2123         case B43_PHYTYPE_A:
2124                 if ((rev >= 5) && (rev <= 10)) {
2125                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2126                                 filename = "a0g1initvals5";
2127                         else
2128                                 filename = "a0g0initvals5";
2129                 } else
2130                         goto err_no_initvals;
2131                 break;
2132         case B43_PHYTYPE_G:
2133                 if ((rev >= 5) && (rev <= 10))
2134                         filename = "b0g0initvals5";
2135                 else if (rev >= 13)
2136                         filename = "b0g0initvals13";
2137                 else
2138                         goto err_no_initvals;
2139                 break;
2140         case B43_PHYTYPE_N:
2141                 if ((rev >= 11) && (rev <= 12))
2142                         filename = "n0initvals11";
2143                 else
2144                         goto err_no_initvals;
2145                 break;
2146         default:
2147                 goto err_no_initvals;
2148         }
2149         err = do_request_fw(dev, filename, &fw->initvals, 0);
2150         if (err)
2151                 goto err_load;
2152
2153         /* Get bandswitch initvals */
2154         switch (dev->phy.type) {
2155         case B43_PHYTYPE_A:
2156                 if ((rev >= 5) && (rev <= 10)) {
2157                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2158                                 filename = "a0g1bsinitvals5";
2159                         else
2160                                 filename = "a0g0bsinitvals5";
2161                 } else if (rev >= 11)
2162                         filename = NULL;
2163                 else
2164                         goto err_no_initvals;
2165                 break;
2166         case B43_PHYTYPE_G:
2167                 if ((rev >= 5) && (rev <= 10))
2168                         filename = "b0g0bsinitvals5";
2169                 else if (rev >= 11)
2170                         filename = NULL;
2171                 else
2172                         goto err_no_initvals;
2173                 break;
2174         case B43_PHYTYPE_N:
2175                 if ((rev >= 11) && (rev <= 12))
2176                         filename = "n0bsinitvals11";
2177                 else
2178                         goto err_no_initvals;
2179                 break;
2180         default:
2181                 goto err_no_initvals;
2182         }
2183         err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2184         if (err)
2185                 goto err_load;
2186
2187         return 0;
2188
2189 err_load:
2190         b43_print_fw_helptext(dev->wl, 1);
2191         goto error;
2192
2193 err_no_ucode:
2194         err = -ENODEV;
2195         b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2196         goto error;
2197
2198 err_no_pcm:
2199         err = -ENODEV;
2200         b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2201         goto error;
2202
2203 err_no_initvals:
2204         err = -ENODEV;
2205         b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2206                "core rev %u\n", dev->phy.type, rev);
2207         goto error;
2208
2209 error:
2210         b43_release_firmware(dev);
2211         return err;
2212 }
2213
2214 static int b43_upload_microcode(struct b43_wldev *dev)
2215 {
2216         const size_t hdr_len = sizeof(struct b43_fw_header);
2217         const __be32 *data;
2218         unsigned int i, len;
2219         u16 fwrev, fwpatch, fwdate, fwtime;
2220         u32 tmp, macctl;
2221         int err = 0;
2222
2223         /* Jump the microcode PSM to offset 0 */
2224         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2225         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2226         macctl |= B43_MACCTL_PSM_JMP0;
2227         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2228         /* Zero out all microcode PSM registers and shared memory. */
2229         for (i = 0; i < 64; i++)
2230                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2231         for (i = 0; i < 4096; i += 2)
2232                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2233
2234         /* Upload Microcode. */
2235         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2236         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2237         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2238         for (i = 0; i < len; i++) {
2239                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2240                 udelay(10);
2241         }
2242
2243         if (dev->fw.pcm.data) {
2244                 /* Upload PCM data. */
2245                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2246                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2247                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2248                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2249                 /* No need for autoinc bit in SHM_HW */
2250                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2251                 for (i = 0; i < len; i++) {
2252                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2253                         udelay(10);
2254                 }
2255         }
2256
2257         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2258
2259         /* Start the microcode PSM */
2260         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2261         macctl &= ~B43_MACCTL_PSM_JMP0;
2262         macctl |= B43_MACCTL_PSM_RUN;
2263         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2264
2265         /* Wait for the microcode to load and respond */
2266         i = 0;
2267         while (1) {
2268                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2269                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2270                         break;
2271                 i++;
2272                 if (i >= 20) {
2273                         b43err(dev->wl, "Microcode not responding\n");
2274                         b43_print_fw_helptext(dev->wl, 1);
2275                         err = -ENODEV;
2276                         goto error;
2277                 }
2278                 msleep_interruptible(50);
2279                 if (signal_pending(current)) {
2280                         err = -EINTR;
2281                         goto error;
2282                 }
2283         }
2284         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2285
2286         /* Get and check the revisions. */
2287         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2288         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2289         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2290         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2291
2292         if (fwrev <= 0x128) {
2293                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2294                        "binary drivers older than version 4.x is unsupported. "
2295                        "You must upgrade your firmware files.\n");
2296                 b43_print_fw_helptext(dev->wl, 1);
2297                 err = -EOPNOTSUPP;
2298                 goto error;
2299         }
2300         dev->fw.rev = fwrev;
2301         dev->fw.patch = fwpatch;
2302         dev->fw.opensource = (fwdate == 0xFFFF);
2303
2304         if (dev->fw.opensource) {
2305                 /* Patchlevel info is encoded in the "time" field. */
2306                 dev->fw.patch = fwtime;
2307                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2308                         dev->fw.rev, dev->fw.patch,
2309                         dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2310         } else {
2311                 b43info(dev->wl, "Loading firmware version %u.%u "
2312                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2313                         fwrev, fwpatch,
2314                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2315                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2316                 if (dev->fw.pcm_request_failed) {
2317                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2318                                 "Hardware accelerated cryptography is disabled.\n");
2319                         b43_print_fw_helptext(dev->wl, 0);
2320                 }
2321         }
2322
2323         if (b43_is_old_txhdr_format(dev)) {
2324                 b43warn(dev->wl, "You are using an old firmware image. "
2325                         "Support for old firmware will be removed in July 2008.\n");
2326                 b43_print_fw_helptext(dev->wl, 0);
2327         }
2328
2329         return 0;
2330
2331 error:
2332         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2333         macctl &= ~B43_MACCTL_PSM_RUN;
2334         macctl |= B43_MACCTL_PSM_JMP0;
2335         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2336
2337         return err;
2338 }
2339
2340 static int b43_write_initvals(struct b43_wldev *dev,
2341                               const struct b43_iv *ivals,
2342                               size_t count,
2343                               size_t array_size)
2344 {
2345         const struct b43_iv *iv;
2346         u16 offset;
2347         size_t i;
2348         bool bit32;
2349
2350         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2351         iv = ivals;
2352         for (i = 0; i < count; i++) {
2353                 if (array_size < sizeof(iv->offset_size))
2354                         goto err_format;
2355                 array_size -= sizeof(iv->offset_size);
2356                 offset = be16_to_cpu(iv->offset_size);
2357                 bit32 = !!(offset & B43_IV_32BIT);
2358                 offset &= B43_IV_OFFSET_MASK;
2359                 if (offset >= 0x1000)
2360                         goto err_format;
2361                 if (bit32) {
2362                         u32 value;
2363
2364                         if (array_size < sizeof(iv->data.d32))
2365                                 goto err_format;
2366                         array_size -= sizeof(iv->data.d32);
2367
2368                         value = get_unaligned_be32(&iv->data.d32);
2369                         b43_write32(dev, offset, value);
2370
2371                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2372                                                         sizeof(__be16) +
2373                                                         sizeof(__be32));
2374                 } else {
2375                         u16 value;
2376
2377                         if (array_size < sizeof(iv->data.d16))
2378                                 goto err_format;
2379                         array_size -= sizeof(iv->data.d16);
2380
2381                         value = be16_to_cpu(iv->data.d16);
2382                         b43_write16(dev, offset, value);
2383
2384                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2385                                                         sizeof(__be16) +
2386                                                         sizeof(__be16));
2387                 }
2388         }
2389         if (array_size)
2390                 goto err_format;
2391
2392         return 0;
2393
2394 err_format:
2395         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2396         b43_print_fw_helptext(dev->wl, 1);
2397
2398         return -EPROTO;
2399 }
2400
2401 static int b43_upload_initvals(struct b43_wldev *dev)
2402 {
2403         const size_t hdr_len = sizeof(struct b43_fw_header);
2404         const struct b43_fw_header *hdr;
2405         struct b43_firmware *fw = &dev->fw;
2406         const struct b43_iv *ivals;
2407         size_t count;
2408         int err;
2409
2410         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2411         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2412         count = be32_to_cpu(hdr->size);
2413         err = b43_write_initvals(dev, ivals, count,
2414                                  fw->initvals.data->size - hdr_len);
2415         if (err)
2416                 goto out;
2417         if (fw->initvals_band.data) {
2418                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2419                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2420                 count = be32_to_cpu(hdr->size);
2421                 err = b43_write_initvals(dev, ivals, count,
2422                                          fw->initvals_band.data->size - hdr_len);
2423                 if (err)
2424                         goto out;
2425         }
2426 out:
2427
2428         return err;
2429 }
2430
2431 /* Initialize the GPIOs
2432  * http://bcm-specs.sipsolutions.net/GPIO
2433  */
2434 static int b43_gpio_init(struct b43_wldev *dev)
2435 {
2436         struct ssb_bus *bus = dev->dev->bus;
2437         struct ssb_device *gpiodev, *pcidev = NULL;
2438         u32 mask, set;
2439
2440         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2441                     & ~B43_MACCTL_GPOUTSMSK);
2442
2443         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2444                     | 0x000F);
2445
2446         mask = 0x0000001F;
2447         set = 0x0000000F;
2448         if (dev->dev->bus->chip_id == 0x4301) {
2449                 mask |= 0x0060;
2450                 set |= 0x0060;
2451         }
2452         if (0 /* FIXME: conditional unknown */ ) {
2453                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2454                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2455                             | 0x0100);
2456                 mask |= 0x0180;
2457                 set |= 0x0180;
2458         }
2459         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2460                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2461                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2462                             | 0x0200);
2463                 mask |= 0x0200;
2464                 set |= 0x0200;
2465         }
2466         if (dev->dev->id.revision >= 2)
2467                 mask |= 0x0010; /* FIXME: This is redundant. */
2468
2469 #ifdef CONFIG_SSB_DRIVER_PCICORE
2470         pcidev = bus->pcicore.dev;
2471 #endif
2472         gpiodev = bus->chipco.dev ? : pcidev;
2473         if (!gpiodev)
2474                 return 0;
2475         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2476                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2477                      & mask) | set);
2478
2479         return 0;
2480 }
2481
2482 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2483 static void b43_gpio_cleanup(struct b43_wldev *dev)
2484 {
2485         struct ssb_bus *bus = dev->dev->bus;
2486         struct ssb_device *gpiodev, *pcidev = NULL;
2487
2488 #ifdef CONFIG_SSB_DRIVER_PCICORE
2489         pcidev = bus->pcicore.dev;
2490 #endif
2491         gpiodev = bus->chipco.dev ? : pcidev;
2492         if (!gpiodev)
2493                 return;
2494         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2495 }
2496
2497 /* http://bcm-specs.sipsolutions.net/EnableMac */
2498 void b43_mac_enable(struct b43_wldev *dev)
2499 {
2500         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2501                 u16 fwstate;
2502
2503                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2504                                          B43_SHM_SH_UCODESTAT);
2505                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2506                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2507                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2508                                "should be suspended, but current state is %u\n",
2509                                fwstate);
2510                 }
2511         }
2512
2513         dev->mac_suspended--;
2514         B43_WARN_ON(dev->mac_suspended < 0);
2515         if (dev->mac_suspended == 0) {
2516                 b43_write32(dev, B43_MMIO_MACCTL,
2517                             b43_read32(dev, B43_MMIO_MACCTL)
2518                             | B43_MACCTL_ENABLED);
2519                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2520                             B43_IRQ_MAC_SUSPENDED);
2521                 /* Commit writes */
2522                 b43_read32(dev, B43_MMIO_MACCTL);
2523                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2524                 b43_power_saving_ctl_bits(dev, 0);
2525         }
2526 }
2527
2528 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2529 void b43_mac_suspend(struct b43_wldev *dev)
2530 {
2531         int i;
2532         u32 tmp;
2533
2534         might_sleep();
2535         B43_WARN_ON(dev->mac_suspended < 0);
2536
2537         if (dev->mac_suspended == 0) {
2538                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2539                 b43_write32(dev, B43_MMIO_MACCTL,
2540                             b43_read32(dev, B43_MMIO_MACCTL)
2541                             & ~B43_MACCTL_ENABLED);
2542                 /* force pci to flush the write */
2543                 b43_read32(dev, B43_MMIO_MACCTL);
2544                 for (i = 35; i; i--) {
2545                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2546                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2547                                 goto out;
2548                         udelay(10);
2549                 }
2550                 /* Hm, it seems this will take some time. Use msleep(). */
2551                 for (i = 40; i; i--) {
2552                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2553                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2554                                 goto out;
2555                         msleep(1);
2556                 }
2557                 b43err(dev->wl, "MAC suspend failed\n");
2558         }
2559 out:
2560         dev->mac_suspended++;
2561 }
2562
2563 static void b43_adjust_opmode(struct b43_wldev *dev)
2564 {
2565         struct b43_wl *wl = dev->wl;
2566         u32 ctl;
2567         u16 cfp_pretbtt;
2568
2569         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2570         /* Reset status to STA infrastructure mode. */
2571         ctl &= ~B43_MACCTL_AP;
2572         ctl &= ~B43_MACCTL_KEEP_CTL;
2573         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2574         ctl &= ~B43_MACCTL_KEEP_BAD;
2575         ctl &= ~B43_MACCTL_PROMISC;
2576         ctl &= ~B43_MACCTL_BEACPROMISC;
2577         ctl |= B43_MACCTL_INFRA;
2578
2579         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
2580             b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
2581                 ctl |= B43_MACCTL_AP;
2582         else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS))
2583                 ctl &= ~B43_MACCTL_INFRA;
2584
2585         if (wl->filter_flags & FIF_CONTROL)
2586                 ctl |= B43_MACCTL_KEEP_CTL;
2587         if (wl->filter_flags & FIF_FCSFAIL)
2588                 ctl |= B43_MACCTL_KEEP_BAD;
2589         if (wl->filter_flags & FIF_PLCPFAIL)
2590                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2591         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2592                 ctl |= B43_MACCTL_PROMISC;
2593         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2594                 ctl |= B43_MACCTL_BEACPROMISC;
2595
2596         /* Workaround: On old hardware the HW-MAC-address-filter
2597          * doesn't work properly, so always run promisc in filter
2598          * it in software. */
2599         if (dev->dev->id.revision <= 4)
2600                 ctl |= B43_MACCTL_PROMISC;
2601
2602         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2603
2604         cfp_pretbtt = 2;
2605         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2606                 if (dev->dev->bus->chip_id == 0x4306 &&
2607                     dev->dev->bus->chip_rev == 3)
2608                         cfp_pretbtt = 100;
2609                 else
2610                         cfp_pretbtt = 50;
2611         }
2612         b43_write16(dev, 0x612, cfp_pretbtt);
2613 }
2614
2615 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2616 {
2617         u16 offset;
2618
2619         if (is_ofdm) {
2620                 offset = 0x480;
2621                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2622         } else {
2623                 offset = 0x4C0;
2624                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2625         }
2626         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2627                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2628 }
2629
2630 static void b43_rate_memory_init(struct b43_wldev *dev)
2631 {
2632         switch (dev->phy.type) {
2633         case B43_PHYTYPE_A:
2634         case B43_PHYTYPE_G:
2635         case B43_PHYTYPE_N:
2636                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2637                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2638                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2639                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2640                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2641                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2642                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2643                 if (dev->phy.type == B43_PHYTYPE_A)
2644                         break;
2645                 /* fallthrough */
2646         case B43_PHYTYPE_B:
2647                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2648                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2649                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2650                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2651                 break;
2652         default:
2653                 B43_WARN_ON(1);
2654         }
2655 }
2656
2657 /* Set the default values for the PHY TX Control Words. */
2658 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2659 {
2660         u16 ctl = 0;
2661
2662         ctl |= B43_TXH_PHY_ENC_CCK;
2663         ctl |= B43_TXH_PHY_ANT01AUTO;
2664         ctl |= B43_TXH_PHY_TXPWR;
2665
2666         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2667         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2668         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2669 }
2670
2671 /* Set the TX-Antenna for management frames sent by firmware. */
2672 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2673 {
2674         u16 ant;
2675         u16 tmp;
2676
2677         ant = b43_antenna_to_phyctl(antenna);
2678
2679         /* For ACK/CTS */
2680         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2681         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2682         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2683         /* For Probe Resposes */
2684         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2685         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2686         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2687 }
2688
2689 /* This is the opposite of b43_chip_init() */
2690 static void b43_chip_exit(struct b43_wldev *dev)
2691 {
2692         b43_radio_turn_off(dev, 1);
2693         b43_gpio_cleanup(dev);
2694         b43_lo_g_cleanup(dev);
2695         /* firmware is released later */
2696 }
2697
2698 /* Initialize the chip
2699  * http://bcm-specs.sipsolutions.net/ChipInit
2700  */
2701 static int b43_chip_init(struct b43_wldev *dev)
2702 {
2703         struct b43_phy *phy = &dev->phy;
2704         int err, tmp;
2705         u32 value32, macctl;
2706         u16 value16;
2707
2708         /* Initialize the MAC control */
2709         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2710         if (dev->phy.gmode)
2711                 macctl |= B43_MACCTL_GMODE;
2712         macctl |= B43_MACCTL_INFRA;
2713         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2714
2715         err = b43_request_firmware(dev);
2716         if (err)
2717                 goto out;
2718         err = b43_upload_microcode(dev);
2719         if (err)
2720                 goto out;       /* firmware is released later */
2721
2722         err = b43_gpio_init(dev);
2723         if (err)
2724                 goto out;       /* firmware is released later */
2725
2726         err = b43_upload_initvals(dev);
2727         if (err)
2728                 goto err_gpio_clean;
2729         b43_radio_turn_on(dev);
2730
2731         b43_write16(dev, 0x03E6, 0x0000);
2732         err = b43_phy_init(dev);
2733         if (err)
2734                 goto err_radio_off;
2735
2736         /* Select initial Interference Mitigation. */
2737         tmp = phy->interfmode;
2738         phy->interfmode = B43_INTERFMODE_NONE;
2739         b43_radio_set_interference_mitigation(dev, tmp);
2740
2741         b43_set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2742         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2743
2744         if (phy->type == B43_PHYTYPE_B) {
2745                 value16 = b43_read16(dev, 0x005E);
2746                 value16 |= 0x0004;
2747                 b43_write16(dev, 0x005E, value16);
2748         }
2749         b43_write32(dev, 0x0100, 0x01000000);
2750         if (dev->dev->id.revision < 5)
2751                 b43_write32(dev, 0x010C, 0x01000000);
2752
2753         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2754                     & ~B43_MACCTL_INFRA);
2755         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2756                     | B43_MACCTL_INFRA);
2757
2758         /* Probe Response Timeout value */
2759         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2760         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2761
2762         /* Initially set the wireless operation mode. */
2763         b43_adjust_opmode(dev);
2764
2765         if (dev->dev->id.revision < 3) {
2766                 b43_write16(dev, 0x060E, 0x0000);
2767                 b43_write16(dev, 0x0610, 0x8000);
2768                 b43_write16(dev, 0x0604, 0x0000);
2769                 b43_write16(dev, 0x0606, 0x0200);
2770         } else {
2771                 b43_write32(dev, 0x0188, 0x80000000);
2772                 b43_write32(dev, 0x018C, 0x02000000);
2773         }
2774         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2775         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2776         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2777         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2778         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2779         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2780         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2781
2782         value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2783         value32 |= 0x00100000;
2784         ssb_write32(dev->dev, SSB_TMSLOW, value32);
2785
2786         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2787                     dev->dev->bus->chipco.fast_pwrup_delay);
2788
2789         err = 0;
2790         b43dbg(dev->wl, "Chip initialized\n");
2791 out:
2792         return err;
2793
2794 err_radio_off:
2795         b43_radio_turn_off(dev, 1);
2796 err_gpio_clean:
2797         b43_gpio_cleanup(dev);
2798         return err;
2799 }
2800
2801 static void b43_periodic_every60sec(struct b43_wldev *dev)
2802 {
2803         struct b43_phy *phy = &dev->phy;
2804
2805         if (phy->type != B43_PHYTYPE_G)
2806                 return;
2807         if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_RSSI) {
2808                 b43_mac_suspend(dev);
2809                 b43_calc_nrssi_slope(dev);
2810                 if ((phy->radio_ver == 0x2050) && (phy->radio_rev == 8)) {
2811                         u8 old_chan = phy->channel;
2812
2813                         /* VCO Calibration */
2814                         if (old_chan >= 8)
2815                                 b43_radio_selectchannel(dev, 1, 0);
2816                         else
2817                                 b43_radio_selectchannel(dev, 13, 0);
2818                         b43_radio_selectchannel(dev, old_chan, 0);
2819                 }
2820                 b43_mac_enable(dev);
2821         }
2822 }
2823
2824 static void b43_periodic_every30sec(struct b43_wldev *dev)
2825 {
2826         /* Update device statistics. */
2827         b43_calculate_link_quality(dev);
2828 }
2829
2830 static void b43_periodic_every15sec(struct b43_wldev *dev)
2831 {
2832         struct b43_phy *phy = &dev->phy;
2833         u16 wdr;
2834
2835         if (dev->fw.opensource) {
2836                 /* Check if the firmware is still alive.
2837                  * It will reset the watchdog counter to 0 in its idle loop. */
2838                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2839                 if (unlikely(wdr)) {
2840                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2841                         b43_controller_restart(dev, "Firmware watchdog");
2842                         return;
2843                 } else {
2844                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2845                                         B43_WATCHDOG_REG, 1);
2846                 }
2847         }
2848
2849         if (phy->type == B43_PHYTYPE_G) {
2850                 //TODO: update_aci_moving_average
2851                 if (phy->aci_enable && phy->aci_wlan_automatic) {
2852                         b43_mac_suspend(dev);
2853                         if (!phy->aci_enable && 1 /*TODO: not scanning? */ ) {
2854                                 if (0 /*TODO: bunch of conditions */ ) {
2855                                         b43_radio_set_interference_mitigation
2856                                             (dev, B43_INTERFMODE_MANUALWLAN);
2857                                 }
2858                         } else if (1 /*TODO*/) {
2859                                 /*
2860                                    if ((aci_average > 1000) && !(b43_radio_aci_scan(dev))) {
2861                                    b43_radio_set_interference_mitigation(dev,
2862                                    B43_INTERFMODE_NONE);
2863                                    }
2864                                  */
2865                         }
2866                         b43_mac_enable(dev);
2867                 } else if (phy->interfmode == B43_INTERFMODE_NONWLAN &&
2868                            phy->rev == 1) {
2869                         //TODO: implement rev1 workaround
2870                 }
2871         }
2872         b43_phy_xmitpower(dev); //FIXME: unless scanning?
2873         b43_lo_g_maintanance_work(dev);
2874         //TODO for APHY (temperature?)
2875
2876         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2877         wmb();
2878 }
2879
2880 static void do_periodic_work(struct b43_wldev *dev)
2881 {
2882         unsigned int state;
2883
2884         state = dev->periodic_state;
2885         if (state % 4 == 0)
2886                 b43_periodic_every60sec(dev);
2887         if (state % 2 == 0)
2888                 b43_periodic_every30sec(dev);
2889         b43_periodic_every15sec(dev);
2890 }
2891
2892 /* Periodic work locking policy:
2893  *      The whole periodic work handler is protected by
2894  *      wl->mutex. If another lock is needed somewhere in the
2895  *      pwork callchain, it's aquired in-place, where it's needed.
2896  */
2897 static void b43_periodic_work_handler(struct work_struct *work)
2898 {
2899         struct b43_wldev *dev = container_of(work, struct b43_wldev,
2900                                              periodic_work.work);
2901         struct b43_wl *wl = dev->wl;
2902         unsigned long delay;
2903
2904         mutex_lock(&wl->mutex);
2905
2906         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2907                 goto out;
2908         if (b43_debug(dev, B43_DBG_PWORK_STOP))
2909                 goto out_requeue;
2910
2911         do_periodic_work(dev);
2912
2913         dev->periodic_state++;
2914 out_requeue:
2915         if (b43_debug(dev, B43_DBG_PWORK_FAST))
2916                 delay = msecs_to_jiffies(50);
2917         else
2918                 delay = round_jiffies_relative(HZ * 15);
2919         queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2920 out:
2921         mutex_unlock(&wl->mutex);
2922 }
2923
2924 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2925 {
2926         struct delayed_work *work = &dev->periodic_work;
2927
2928         dev->periodic_state = 0;
2929         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2930         queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2931 }
2932
2933 /* Check if communication with the device works correctly. */
2934 static int b43_validate_chipaccess(struct b43_wldev *dev)
2935 {
2936         u32 v, backup;
2937
2938         backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2939
2940         /* Check for read/write and endianness problems. */
2941         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2942         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2943                 goto error;
2944         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2945         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2946                 goto error;
2947
2948         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2949
2950         if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2951                 /* The 32bit register shadows the two 16bit registers
2952                  * with update sideeffects. Validate this. */
2953                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2954                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2955                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2956                         goto error;
2957                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2958                         goto error;
2959         }
2960         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2961
2962         v = b43_read32(dev, B43_MMIO_MACCTL);
2963         v |= B43_MACCTL_GMODE;
2964         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2965                 goto error;
2966
2967         return 0;
2968 error:
2969         b43err(dev->wl, "Failed to validate the chipaccess\n");
2970         return -ENODEV;
2971 }
2972
2973 static void b43_security_init(struct b43_wldev *dev)
2974 {
2975         dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2976         B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2977         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2978         /* KTP is a word address, but we address SHM bytewise.
2979          * So multiply by two.
2980          */
2981         dev->ktp *= 2;
2982         if (dev->dev->id.revision >= 5) {
2983                 /* Number of RCMTA address slots */
2984                 b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2985         }
2986         b43_clear_keys(dev);
2987 }
2988
2989 static int b43_rng_read(struct hwrng *rng, u32 * data)
2990 {
2991         struct b43_wl *wl = (struct b43_wl *)rng->priv;
2992         unsigned long flags;
2993
2994         /* Don't take wl->mutex here, as it could deadlock with
2995          * hwrng internal locking. It's not needed to take
2996          * wl->mutex here, anyway. */
2997
2998         spin_lock_irqsave(&wl->irq_lock, flags);
2999         *data = b43_read16(wl->current_dev, B43_MMIO_RNG);
3000         spin_unlock_irqrestore(&wl->irq_lock, flags);
3001
3002         return (sizeof(u16));
3003 }
3004
3005 static void b43_rng_exit(struct b43_wl *wl)
3006 {
3007         if (wl->rng_initialized)
3008                 hwrng_unregister(&wl->rng);
3009 }
3010
3011 static int b43_rng_init(struct b43_wl *wl)
3012 {
3013         int err;
3014
3015         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3016                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3017         wl->rng.name = wl->rng_name;
3018         wl->rng.data_read = b43_rng_read;
3019         wl->rng.priv = (unsigned long)wl;
3020         wl->rng_initialized = 1;
3021         err = hwrng_register(&wl->rng);
3022         if (err) {
3023                 wl->rng_initialized = 0;
3024                 b43err(wl, "Failed to register the random "
3025                        "number generator (%d)\n", err);
3026         }
3027
3028         return err;
3029 }
3030
3031 static int b43_op_tx(struct ieee80211_hw *hw,
3032                      struct sk_buff *skb)
3033 {
3034         struct b43_wl *wl = hw_to_b43_wl(hw);
3035         struct b43_wldev *dev = wl->current_dev;
3036         unsigned long flags;
3037         int err;
3038
3039         if (unlikely(skb->len < 2 + 2 + 6)) {
3040                 /* Too short, this can't be a valid frame. */
3041                 goto drop_packet;
3042         }
3043         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3044         if (unlikely(!dev))
3045                 goto drop_packet;
3046
3047         /* Transmissions on seperate queues can run concurrently. */
3048         read_lock_irqsave(&wl->tx_lock, flags);
3049
3050         err = -ENODEV;
3051         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3052                 if (b43_using_pio_transfers(dev))
3053                         err = b43_pio_tx(dev, skb);
3054                 else
3055                         err = b43_dma_tx(dev, skb);
3056         }
3057
3058         read_unlock_irqrestore(&wl->tx_lock, flags);
3059
3060         if (unlikely(err))
3061                 goto drop_packet;
3062         return NETDEV_TX_OK;
3063
3064 drop_packet:
3065         /* We can not transmit this packet. Drop it. */
3066         dev_kfree_skb_any(skb);
3067         return NETDEV_TX_OK;
3068 }
3069
3070 /* Locking: wl->irq_lock */
3071 static void b43_qos_params_upload(struct b43_wldev *dev,
3072                                   const struct ieee80211_tx_queue_params *p,
3073                                   u16 shm_offset)
3074 {
3075         u16 params[B43_NR_QOSPARAMS];
3076         int cw_min, cw_max, aifs, bslots, tmp;
3077         unsigned int i;
3078
3079         const u16 aCWmin = 0x0001;
3080         const u16 aCWmax = 0x03FF;
3081
3082         /* Calculate the default values for the parameters, if needed. */
3083         switch (shm_offset) {
3084         case B43_QOS_VOICE:
3085                 aifs = (p->aifs == -1) ? 2 : p->aifs;
3086                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 4 - 1) : p->cw_min;
3087                 cw_max = (p->cw_max == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_max;
3088                 break;
3089         case B43_QOS_VIDEO:
3090                 aifs = (p->aifs == -1) ? 2 : p->aifs;
3091                 cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_min;
3092                 cw_max = (p->cw_max == 0) ? aCWmin : p->cw_max;
3093                 break;
3094         case B43_QOS_BESTEFFORT:
3095                 aifs = (p->aifs == -1) ? 3 : p->aifs;
3096                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
3097                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
3098                 break;
3099         case B43_QOS_BACKGROUND:
3100                 aifs = (p->aifs == -1) ? 7 : p->aifs;
3101                 cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
3102                 cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
3103                 break;
3104         default:
3105                 B43_WARN_ON(1);
3106                 return;
3107         }
3108         if (cw_min <= 0)
3109                 cw_min = aCWmin;
3110         if (cw_max <= 0)
3111                 cw_max = aCWmin;
3112         bslots = b43_read16(dev, B43_MMIO_RNG) % cw_min;
3113
3114         memset(&params, 0, sizeof(params));
3115
3116         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3117         params[B43_QOSPARAM_CWMIN] = cw_min;
3118         params[B43_QOSPARAM_CWMAX] = cw_max;
3119         params[B43_QOSPARAM_CWCUR] = cw_min;
3120         params[B43_QOSPARAM_AIFS] = aifs;
3121         params[B43_QOSPARAM_BSLOTS] = bslots;
3122         params[B43_QOSPARAM_REGGAP] = bslots + aifs;
3123
3124         for (i = 0; i < ARRAY_SIZE(params); i++) {
3125                 if (i == B43_QOSPARAM_STATUS) {
3126                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3127                                              shm_offset + (i * 2));
3128                         /* Mark the parameters as updated. */
3129                         tmp |= 0x100;
3130                         b43_shm_write16(dev, B43_SHM_SHARED,
3131                                         shm_offset + (i * 2),
3132                                         tmp);
3133                 } else {
3134                         b43_shm_write16(dev, B43_SHM_SHARED,
3135                                         shm_offset + (i * 2),
3136                                         params[i]);
3137                 }
3138         }
3139 }
3140
3141 /* Update the QOS parameters in hardware. */
3142 static void b43_qos_update(struct b43_wldev *dev)
3143 {
3144         struct b43_wl *wl = dev->wl;
3145         struct b43_qos_params *params;
3146         unsigned long flags;
3147         unsigned int i;
3148
3149         /* Mapping of mac80211 queues to b43 SHM offsets. */
3150         static const u16 qos_shm_offsets[] = {
3151                 [0] = B43_QOS_VOICE,
3152                 [1] = B43_QOS_VIDEO,
3153                 [2] = B43_QOS_BESTEFFORT,
3154                 [3] = B43_QOS_BACKGROUND,
3155         };
3156         BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
3157
3158         b43_mac_suspend(dev);
3159         spin_lock_irqsave(&wl->irq_lock, flags);
3160
3161         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3162                 params = &(wl->qos_params[i]);
3163                 if (params->need_hw_update) {
3164                         b43_qos_params_upload(dev, &(params->p),
3165                                               qos_shm_offsets[i]);
3166                         params->need_hw_update = 0;
3167                 }
3168         }
3169
3170         spin_unlock_irqrestore(&wl->irq_lock, flags);
3171         b43_mac_enable(dev);
3172 }
3173
3174 static void b43_qos_clear(struct b43_wl *wl)
3175 {
3176         struct b43_qos_params *params;
3177         unsigned int i;
3178
3179         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3180                 params = &(wl->qos_params[i]);
3181
3182                 memset(&(params->p), 0, sizeof(params->p));
3183                 params->p.aifs = -1;
3184                 params->need_hw_update = 1;
3185         }
3186 }
3187
3188 /* Initialize the core's QOS capabilities */
3189 static void b43_qos_init(struct b43_wldev *dev)
3190 {
3191         struct b43_wl *wl = dev->wl;
3192         unsigned int i;
3193
3194         /* Upload the current QOS parameters. */
3195         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
3196                 wl->qos_params[i].need_hw_update = 1;
3197         b43_qos_update(dev);
3198
3199         /* Enable QOS support. */
3200         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3201         b43_write16(dev, B43_MMIO_IFSCTL,
3202                     b43_read16(dev, B43_MMIO_IFSCTL)
3203                     | B43_MMIO_IFSCTL_USE_EDCF);
3204 }
3205
3206 static void b43_qos_update_work(struct work_struct *work)
3207 {
3208         struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
3209         struct b43_wldev *dev;
3210
3211         mutex_lock(&wl->mutex);
3212         dev = wl->current_dev;
3213         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
3214                 b43_qos_update(dev);
3215         mutex_unlock(&wl->mutex);
3216 }
3217
3218 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3219                           const struct ieee80211_tx_queue_params *params)
3220 {
3221         struct b43_wl *wl = hw_to_b43_wl(hw);
3222         unsigned long flags;
3223         unsigned int queue = (unsigned int)_queue;
3224         struct b43_qos_params *p;
3225
3226         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3227                 /* Queue not available or don't support setting
3228                  * params on this queue. Return success to not
3229                  * confuse mac80211. */
3230                 return 0;
3231         }
3232
3233         spin_lock_irqsave(&wl->irq_lock, flags);
3234         p = &(wl->qos_params[queue]);
3235         memcpy(&(p->p), params, sizeof(p->p));
3236         p->need_hw_update = 1;
3237         spin_unlock_irqrestore(&wl->irq_lock, flags);
3238
3239         queue_work(hw->workqueue, &wl->qos_update_work);
3240
3241         return 0;
3242 }
3243
3244 static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3245                                struct ieee80211_tx_queue_stats *stats)
3246 {
3247         struct b43_wl *wl = hw_to_b43_wl(hw);
3248         struct b43_wldev *dev = wl->current_dev;
3249         unsigned long flags;
3250         int err = -ENODEV;
3251
3252         if (!dev)
3253                 goto out;
3254         spin_lock_irqsave(&wl->irq_lock, flags);
3255         if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3256                 if (b43_using_pio_transfers(dev))
3257                         b43_pio_get_tx_stats(dev, stats);
3258                 else
3259                         b43_dma_get_tx_stats(dev, stats);
3260                 err = 0;
3261         }
3262         spin_unlock_irqrestore(&wl->irq_lock, flags);
3263 out:
3264         return err;
3265 }
3266
3267 static int b43_op_get_stats(struct ieee80211_hw *hw,
3268                             struct ieee80211_low_level_stats *stats)
3269 {
3270         struct b43_wl *wl = hw_to_b43_wl(hw);
3271         unsigned long flags;
3272
3273         spin_lock_irqsave(&wl->irq_lock, flags);
3274         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3275         spin_unlock_irqrestore(&wl->irq_lock, flags);
3276
3277         return 0;
3278 }
3279
3280 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3281 {
3282         struct ssb_device *sdev = dev->dev;
3283         u32 tmslow;
3284
3285         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3286         tmslow &= ~B43_TMSLOW_GMODE;
3287         tmslow |= B43_TMSLOW_PHYRESET;
3288         tmslow |= SSB_TMSLOW_FGC;
3289         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3290         msleep(1);
3291
3292         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3293         tmslow &= ~SSB_TMSLOW_FGC;
3294         tmslow |= B43_TMSLOW_PHYRESET;
3295         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3296         msleep(1);
3297 }
3298
3299 static const char * band_to_string(enum ieee80211_band band)
3300 {
3301         switch (band) {
3302         case IEEE80211_BAND_5GHZ:
3303                 return "5";
3304         case IEEE80211_BAND_2GHZ:
3305                 return "2.4";
3306         default:
3307                 break;
3308         }
3309         B43_WARN_ON(1);
3310         return "";
3311 }
3312
3313 /* Expects wl->mutex locked */
3314 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3315 {
3316         struct b43_wldev *up_dev = NULL;
3317         struct b43_wldev *down_dev;
3318         struct b43_wldev *d;
3319         int err;
3320         bool gmode;
3321         int prev_status;
3322
3323         /* Find a device and PHY which supports the band. */
3324         list_for_each_entry(d, &wl->devlist, list) {
3325                 switch (chan->band) {
3326                 case IEEE80211_BAND_5GHZ:
3327                         if (d->phy.supports_5ghz) {
3328                                 up_dev = d;
3329                                 gmode = 0;
3330                         }
3331                         break;
3332                 case IEEE80211_BAND_2GHZ:
3333                         if (d->phy.supports_2ghz) {
3334                                 up_dev = d;
3335                                 gmode = 1;
3336                         }
3337                         break;
3338                 default:
3339                         B43_WARN_ON(1);
3340                         return -EINVAL;
3341                 }
3342                 if (up_dev)
3343                         break;
3344         }
3345         if (!up_dev) {
3346                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3347                        band_to_string(chan->band));
3348                 return -ENODEV;
3349         }
3350         if ((up_dev == wl->current_dev) &&
3351             (!!wl->current_dev->phy.gmode == !!gmode)) {
3352                 /* This device is already running. */
3353                 return 0;
3354         }
3355         b43dbg(wl, "Switching to %s-GHz band\n",
3356                band_to_string(chan->band));
3357         down_dev = wl->current_dev;
3358
3359         prev_status = b43_status(down_dev);
3360         /* Shutdown the currently running core. */
3361         if (prev_status >= B43_STAT_STARTED)
3362                 b43_wireless_core_stop(down_dev);
3363         if (prev_status >= B43_STAT_INITIALIZED)
3364                 b43_wireless_core_exit(down_dev);
3365
3366         if (down_dev != up_dev) {
3367                 /* We switch to a different core, so we put PHY into
3368                  * RESET on the old core. */
3369                 b43_put_phy_into_reset(down_dev);
3370         }
3371
3372         /* Now start the new core. */
3373         up_dev->phy.gmode = gmode;
3374         if (prev_status >= B43_STAT_INITIALIZED) {
3375                 err = b43_wireless_core_init(up_dev);
3376                 if (err) {
3377                         b43err(wl, "Fatal: Could not initialize device for "
3378                                "selected %s-GHz band\n",
3379                                band_to_string(chan->band));
3380                         goto init_failure;
3381                 }
3382         }
3383         if (prev_status >= B43_STAT_STARTED) {
3384                 err = b43_wireless_core_start(up_dev);
3385                 if (err) {
3386                         b43err(wl, "Fatal: Coult not start device for "
3387                                "selected %s-GHz band\n",
3388                                band_to_string(chan->band));
3389                         b43_wireless_core_exit(up_dev);
3390                         goto init_failure;
3391                 }
3392         }
3393         B43_WARN_ON(b43_status(up_dev) != prev_status);
3394
3395         wl->current_dev = up_dev;
3396
3397         return 0;
3398 init_failure:
3399         /* Whoops, failed to init the new core. No core is operating now. */
3400         wl->current_dev = NULL;
3401         return err;
3402 }
3403
3404 static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
3405 {
3406         struct b43_wl *wl = hw_to_b43_wl(hw);
3407         struct b43_wldev *dev;
3408         struct b43_phy *phy;
3409         unsigned long flags;
3410         int antenna;
3411         int err = 0;
3412         u32 savedirqs;
3413
3414         mutex_lock(&wl->mutex);
3415
3416         /* Switch the band (if necessary). This might change the active core. */
3417         err = b43_switch_band(wl, conf->channel);
3418         if (err)
3419                 goto out_unlock_mutex;
3420         dev = wl->current_dev;
3421         phy = &dev->phy;
3422
3423         /* Disable IRQs while reconfiguring the device.
3424          * This makes it possible to drop the spinlock throughout
3425          * the reconfiguration process. */
3426         spin_lock_irqsave(&wl->irq_lock, flags);
3427         if (b43_status(dev) < B43_STAT_STARTED) {
3428                 spin_unlock_irqrestore(&wl->irq_lock, flags);
3429                 goto out_unlock_mutex;
3430         }
3431         savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3432         spin_unlock_irqrestore(&wl->irq_lock, flags);
3433         b43_synchronize_irq(dev);
3434
3435         /* Switch to the requested channel.
3436          * The firmware takes care of races with the TX handler. */
3437         if (conf->channel->hw_value != phy->channel)
3438                 b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
3439
3440         /* Enable/Disable ShortSlot timing. */
3441         if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
3442             dev->short_slot) {
3443                 B43_WARN_ON(phy->type != B43_PHYTYPE_G);
3444                 if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)
3445                         b43_short_slot_timing_enable(dev);
3446                 else
3447                         b43_short_slot_timing_disable(dev);
3448         }
3449
3450         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3451
3452         /* Adjust the desired TX power level. */
3453         if (conf->power_level != 0) {
3454                 if (conf->power_level != phy->power_level) {
3455                         phy->power_level = conf->power_level;
3456                         b43_phy_xmitpower(dev);
3457                 }
3458         }
3459
3460         /* Antennas for RX and management frame TX. */
3461         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
3462         b43_mgmtframe_txantenna(dev, antenna);
3463         antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
3464         b43_set_rx_antenna(dev, antenna);
3465
3466         /* Update templates for AP/mesh mode. */
3467         if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3468             b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
3469                 b43_set_beacon_int(dev, conf->beacon_int);
3470
3471         if (!!conf->radio_enabled != phy->radio_on) {
3472                 if (conf->radio_enabled) {
3473                         b43_radio_turn_on(dev);
3474                         b43info(dev->wl, "Radio turned on by software\n");
3475                         if (!dev->radio_hw_enable) {
3476                                 b43info(dev->wl, "The hardware RF-kill button "
3477                                         "still turns the radio physically off. "
3478                                         "Press the button to turn it on.\n");
3479                         }
3480                 } else {
3481                         b43_radio_turn_off(dev, 0);
3482                         b43info(dev->wl, "Radio turned off by software\n");
3483                 }
3484         }
3485
3486         spin_lock_irqsave(&wl->irq_lock, flags);
3487         b43_interrupt_enable(dev, savedirqs);
3488         mmiowb();
3489         spin_unlock_irqrestore(&wl->irq_lock, flags);
3490       out_unlock_mutex:
3491         mutex_unlock(&wl->mutex);
3492
3493         return err;
3494 }
3495
3496 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3497                            const u8 *local_addr, const u8 *addr,
3498                            struct ieee80211_key_conf *key)
3499 {
3500         struct b43_wl *wl = hw_to_b43_wl(hw);
3501         struct b43_wldev *dev;
3502         unsigned long flags;
3503         u8 algorithm;
3504         u8 index;
3505         int err;
3506         DECLARE_MAC_BUF(mac);
3507
3508         if (modparam_nohwcrypt)
3509                 return -ENOSPC; /* User disabled HW-crypto */
3510
3511         mutex_lock(&wl->mutex);
3512         spin_lock_irqsave(&wl->irq_lock, flags);
3513
3514         dev = wl->current_dev;
3515         err = -ENODEV;
3516         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3517                 goto out_unlock;
3518
3519         if (dev->fw.pcm_request_failed) {
3520                 /* We don't have firmware for the crypto engine.
3521                  * Must use software-crypto. */
3522                 err = -EOPNOTSUPP;
3523                 goto out_unlock;
3524         }
3525
3526         err = -EINVAL;
3527         switch (key->alg) {
3528         case ALG_WEP:
3529                 if (key->keylen == 5)
3530                         algorithm = B43_SEC_ALGO_WEP40;
3531                 else
3532                         algorithm = B43_SEC_ALGO_WEP104;
3533                 break;
3534         case ALG_TKIP:
3535                 algorithm = B43_SEC_ALGO_TKIP;
3536                 break;
3537         case ALG_CCMP:
3538                 algorithm = B43_SEC_ALGO_AES;
3539                 break;
3540         default:
3541                 B43_WARN_ON(1);
3542                 goto out_unlock;
3543         }
3544         index = (u8) (key->keyidx);
3545         if (index > 3)
3546                 goto out_unlock;
3547
3548         switch (cmd) {
3549         case SET_KEY:
3550                 if (algorithm == B43_SEC_ALGO_TKIP) {
3551                         /* FIXME: No TKIP hardware encryption for now. */
3552                         err = -EOPNOTSUPP;
3553                         goto out_unlock;
3554                 }
3555
3556                 if (is_broadcast_ether_addr(addr)) {
3557                         /* addr is FF:FF:FF:FF:FF:FF for default keys */
3558                         err = b43_key_write(dev, index, algorithm,
3559                                             key->key, key->keylen, NULL, key);
3560                 } else {
3561                         /*
3562                          * either pairwise key or address is 00:00:00:00:00:00
3563                          * for transmit-only keys
3564                          */
3565                         err = b43_key_write(dev, -1, algorithm,
3566                                             key->key, key->keylen, addr, key);
3567                 }
3568                 if (err)
3569                         goto out_unlock;
3570
3571                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3572                     algorithm == B43_SEC_ALGO_WEP104) {
3573                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3574                 } else {
3575                         b43_hf_write(dev,
3576                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3577                 }
3578                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3579                 break;
3580         case DISABLE_KEY: {
3581                 err = b43_key_clear(dev, key->hw_key_idx);
3582                 if (err)
3583                         goto out_unlock;
3584                 break;
3585         }
3586         default:
3587                 B43_WARN_ON(1);
3588         }
3589 out_unlock:
3590         spin_unlock_irqrestore(&wl->irq_lock, flags);
3591         mutex_unlock(&wl->mutex);
3592         if (!err) {
3593                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3594                        "mac: %s\n",
3595                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3596                        print_mac(mac, addr));
3597         }
3598         return err;
3599 }
3600
3601 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3602                                     unsigned int changed, unsigned int *fflags,
3603                                     int mc_count, struct dev_addr_list *mc_list)
3604 {
3605         struct b43_wl *wl = hw_to_b43_wl(hw);
3606         struct b43_wldev *dev = wl->current_dev;
3607         unsigned long flags;
3608
3609         if (!dev) {
3610                 *fflags = 0;
3611                 return;
3612         }
3613
3614         spin_lock_irqsave(&wl->irq_lock, flags);
3615         *fflags &= FIF_PROMISC_IN_BSS |
3616                   FIF_ALLMULTI |
3617                   FIF_FCSFAIL |
3618                   FIF_PLCPFAIL |
3619                   FIF_CONTROL |
3620                   FIF_OTHER_BSS |
3621                   FIF_BCN_PRBRESP_PROMISC;
3622
3623         changed &= FIF_PROMISC_IN_BSS |
3624                    FIF_ALLMULTI |
3625                    FIF_FCSFAIL |
3626                    FIF_PLCPFAIL |
3627                    FIF_CONTROL |
3628                    FIF_OTHER_BSS |
3629                    FIF_BCN_PRBRESP_PROMISC;
3630
3631         wl->filter_flags = *fflags;
3632
3633         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3634                 b43_adjust_opmode(dev);
3635         spin_unlock_irqrestore(&wl->irq_lock, flags);
3636 }
3637
3638 static int b43_op_config_interface(struct ieee80211_hw *hw,
3639                                    struct ieee80211_vif *vif,
3640                                    struct ieee80211_if_conf *conf)
3641 {
3642         struct b43_wl *wl = hw_to_b43_wl(hw);
3643         struct b43_wldev *dev = wl->current_dev;
3644         unsigned long flags;
3645
3646         if (!dev)
3647                 return -ENODEV;
3648         mutex_lock(&wl->mutex);
3649         spin_lock_irqsave(&wl->irq_lock, flags);
3650         B43_WARN_ON(wl->vif != vif);
3651         if (conf->bssid)
3652                 memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3653         else
3654                 memset(wl->bssid, 0, ETH_ALEN);
3655         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3656                 if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3657                     b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT)) {
3658                         B43_WARN_ON(vif->type != wl->if_type);
3659                         if (conf->changed & IEEE80211_IFCC_SSID)
3660                                 b43_set_ssid(dev, conf->ssid, conf->ssid_len);
3661                         if (conf->changed & IEEE80211_IFCC_BEACON)
3662                                 b43_update_templates(wl);
3663                 } else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS)) {
3664                         if (conf->changed & IEEE80211_IFCC_BEACON)
3665                                 b43_update_templates(wl);
3666                 }
3667                 b43_write_mac_bssid_templates(dev);
3668         }
3669         spin_unlock_irqrestore(&wl->irq_lock, flags);
3670         mutex_unlock(&wl->mutex);
3671
3672         return 0;
3673 }
3674
3675 /* Locking: wl->mutex */
3676 static void b43_wireless_core_stop(struct b43_wldev *dev)
3677 {
3678         struct b43_wl *wl = dev->wl;
3679         unsigned long flags;
3680
3681         if (b43_status(dev) < B43_STAT_STARTED)
3682                 return;
3683
3684         /* Disable and sync interrupts. We must do this before than
3685          * setting the status to INITIALIZED, as the interrupt handler
3686          * won't care about IRQs then. */
3687         spin_lock_irqsave(&wl->irq_lock, flags);
3688         dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3689         b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
3690         spin_unlock_irqrestore(&wl->irq_lock, flags);
3691         b43_synchronize_irq(dev);
3692
3693         write_lock_irqsave(&wl->tx_lock, flags);
3694         b43_set_status(dev, B43_STAT_INITIALIZED);
3695         write_unlock_irqrestore(&wl->tx_lock, flags);
3696
3697         b43_pio_stop(dev);
3698         mutex_unlock(&wl->mutex);
3699         /* Must unlock as it would otherwise deadlock. No races here.
3700          * Cancel the possibly running self-rearming periodic work. */
3701         cancel_delayed_work_sync(&dev->periodic_work);
3702         mutex_lock(&wl->mutex);
3703
3704         b43_mac_suspend(dev);
3705         free_irq(dev->dev->irq, dev);
3706         b43dbg(wl, "Wireless interface stopped\n");
3707 }
3708
3709 /* Locking: wl->mutex */
3710 static int b43_wireless_core_start(struct b43_wldev *dev)
3711 {
3712         int err;
3713
3714         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3715
3716         drain_txstatus_queue(dev);
3717         err = request_irq(dev->dev->irq, b43_interrupt_handler,
3718                           IRQF_SHARED, KBUILD_MODNAME, dev);
3719         if (err) {
3720                 b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3721                 goto out;
3722         }
3723
3724         /* We are ready to run. */
3725         b43_set_status(dev, B43_STAT_STARTED);
3726
3727         /* Start data flow (TX/RX). */
3728         b43_mac_enable(dev);
3729         b43_interrupt_enable(dev, dev->irq_savedstate);
3730
3731         /* Start maintainance work */
3732         b43_periodic_tasks_setup(dev);
3733
3734         b43dbg(dev->wl, "Wireless interface started\n");
3735       out:
3736         return err;
3737 }
3738
3739 /* Get PHY and RADIO versioning numbers */
3740 static int b43_phy_versioning(struct b43_wldev *dev)
3741 {
3742         struct b43_phy *phy = &dev->phy;
3743         u32 tmp;
3744         u8 analog_type;
3745         u8 phy_type;
3746         u8 phy_rev;
3747         u16 radio_manuf;
3748         u16 radio_ver;
3749         u16 radio_rev;
3750         int unsupported = 0;
3751
3752         /* Get PHY versioning */
3753         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3754         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3755         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3756         phy_rev = (tmp & B43_PHYVER_VERSION);
3757         switch (phy_type) {
3758         case B43_PHYTYPE_A:
3759                 if (phy_rev >= 4)
3760                         unsupported = 1;
3761                 break;
3762         case B43_PHYTYPE_B:
3763                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3764                     && phy_rev != 7)
3765                         unsupported = 1;
3766                 break;
3767         case B43_PHYTYPE_G:
3768                 if (phy_rev > 9)
3769                         unsupported = 1;
3770                 break;
3771 #ifdef CONFIG_B43_NPHY
3772         case B43_PHYTYPE_N:
3773                 if (phy_rev > 1)
3774                         unsupported = 1;
3775                 break;
3776 #endif
3777         default:
3778                 unsupported = 1;
3779         };
3780         if (unsupported) {
3781                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3782                        "(Analog %u, Type %u, Revision %u)\n",
3783                        analog_type, phy_type, phy_rev);
3784                 return -EOPNOTSUPP;
3785         }
3786         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3787                analog_type, phy_type, phy_rev);
3788
3789         /* Get RADIO versioning */
3790         if (dev->dev->bus->chip_id == 0x4317) {
3791                 if (dev->dev->bus->chip_rev == 0)
3792                         tmp = 0x3205017F;
3793                 else if (dev->dev->bus->chip_rev == 1)
3794                         tmp = 0x4205017F;
3795                 else
3796                         tmp = 0x5205017F;
3797         } else {
3798                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3799                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3800                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3801                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3802         }
3803         radio_manuf = (tmp & 0x00000FFF);
3804         radio_ver = (tmp & 0x0FFFF000) >> 12;
3805         radio_rev = (tmp & 0xF0000000) >> 28;
3806         if (radio_manuf != 0x17F /* Broadcom */)
3807                 unsupported = 1;
3808         switch (phy_type) {
3809         case B43_PHYTYPE_A:
3810                 if (radio_ver != 0x2060)
3811                         unsupported = 1;
3812                 if (radio_rev != 1)
3813                         unsupported = 1;
3814                 if (radio_manuf != 0x17F)
3815                         unsupported = 1;
3816                 break;
3817         case B43_PHYTYPE_B:
3818                 if ((radio_ver & 0xFFF0) != 0x2050)
3819                         unsupported = 1;
3820                 break;
3821         case B43_PHYTYPE_G:
3822                 if (radio_ver != 0x2050)
3823                         unsupported = 1;
3824                 break;
3825         case B43_PHYTYPE_N:
3826                 if (radio_ver != 0x2055)
3827                         unsupported = 1;
3828                 break;
3829         default:
3830                 B43_WARN_ON(1);
3831         }
3832         if (unsupported) {
3833                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3834                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3835                        radio_manuf, radio_ver, radio_rev);
3836                 return -EOPNOTSUPP;
3837         }
3838         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3839                radio_manuf, radio_ver, radio_rev);
3840
3841         phy->radio_manuf = radio_manuf;
3842         phy->radio_ver = radio_ver;
3843         phy->radio_rev = radio_rev;
3844
3845         phy->analog = analog_type;
3846         phy->type = phy_type;
3847         phy->rev = phy_rev;
3848
3849         return 0;
3850 }
3851
3852 static void setup_struct_phy_for_init(struct b43_wldev *dev,
3853                                       struct b43_phy *phy)
3854 {
3855         struct b43_txpower_lo_control *lo;
3856         int i;
3857
3858         memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3859         memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3860
3861         phy->aci_enable = 0;
3862         phy->aci_wlan_automatic = 0;
3863         phy->aci_hw_rssi = 0;
3864
3865         phy->radio_off_context.valid = 0;
3866
3867         lo = phy->lo_control;
3868         if (lo) {
3869                 memset(lo, 0, sizeof(*(phy->lo_control)));
3870                 lo->tx_bias = 0xFF;
3871                 INIT_LIST_HEAD(&lo->calib_list);
3872         }
3873         phy->max_lb_gain = 0;
3874         phy->trsw_rx_gain = 0;
3875         phy->txpwr_offset = 0;
3876
3877         /* NRSSI */
3878         phy->nrssislope = 0;
3879         for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3880                 phy->nrssi[i] = -1000;
3881         for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3882                 phy->nrssi_lt[i] = i;
3883
3884         phy->lofcal = 0xFFFF;
3885         phy->initval = 0xFFFF;
3886
3887         phy->interfmode = B43_INTERFMODE_NONE;
3888         phy->channel = 0xFF;
3889
3890         phy->hardware_power_control = !!modparam_hwpctl;
3891
3892         /* PHY TX errors counter. */
3893         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3894
3895         /* OFDM-table address caching. */
3896         phy->ofdmtab_addr_direction = B43_OFDMTAB_DIRECTION_UNKNOWN;
3897 }
3898
3899 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3900 {
3901         dev->dfq_valid = 0;
3902
3903         /* Assume the radio is enabled. If it's not enabled, the state will
3904          * immediately get fixed on the first periodic work run. */
3905         dev->radio_hw_enable = 1;
3906
3907         /* Stats */
3908         memset(&dev->stats, 0, sizeof(dev->stats));
3909
3910         setup_struct_phy_for_init(dev, &dev->phy);
3911
3912         /* IRQ related flags */
3913         dev->irq_reason = 0;
3914         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3915         dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3916
3917         dev->mac_suspended = 1;
3918
3919         /* Noise calculation context */
3920         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3921 }
3922
3923 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3924 {
3925         struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3926         u64 hf;
3927
3928         if (!modparam_btcoex)
3929                 return;
3930         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3931                 return;
3932         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3933                 return;
3934
3935         hf = b43_hf_read(dev);
3936         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3937                 hf |= B43_HF_BTCOEXALT;
3938         else
3939                 hf |= B43_HF_BTCOEX;
3940         b43_hf_write(dev, hf);
3941 }
3942
3943 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3944 {
3945         if (!modparam_btcoex)
3946                 return;
3947         //TODO
3948 }
3949
3950 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3951 {
3952 #ifdef CONFIG_SSB_DRIVER_PCICORE
3953         struct ssb_bus *bus = dev->dev->bus;
3954         u32 tmp;
3955
3956         if (bus->pcicore.dev &&
3957             bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3958             bus->pcicore.dev->id.revision <= 5) {
3959                 /* IMCFGLO timeouts workaround. */
3960                 tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3961                 tmp &= ~SSB_IMCFGLO_REQTO;
3962                 tmp &= ~SSB_IMCFGLO_SERTO;
3963                 switch (bus->bustype) {
3964                 case SSB_BUSTYPE_PCI:
3965                 case SSB_BUSTYPE_PCMCIA:
3966                         tmp |= 0x32;
3967                         break;
3968                 case SSB_BUSTYPE_SSB:
3969                         tmp |= 0x53;
3970                         break;
3971                 }
3972                 ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3973         }
3974 #endif /* CONFIG_SSB_DRIVER_PCICORE */
3975 }
3976
3977 /* Write the short and long frame retry limit values. */
3978 static void b43_set_retry_limits(struct b43_wldev *dev,
3979                                  unsigned int short_retry,
3980                                  unsigned int long_retry)
3981 {
3982         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3983          * the chip-internal counter. */
3984         short_retry = min(short_retry, (unsigned int)0xF);
3985         long_retry = min(long_retry, (unsigned int)0xF);
3986
3987         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3988                         short_retry);
3989         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3990                         long_retry);
3991 }
3992
3993 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3994 {
3995         u16 pu_delay;
3996
3997         /* The time value is in microseconds. */
3998         if (dev->phy.type == B43_PHYTYPE_A)
3999                 pu_delay = 3700;
4000         else
4001                 pu_delay = 1050;
4002         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS) || idle)
4003                 pu_delay = 500;
4004         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4005                 pu_delay = max(pu_delay, (u16)2400);
4006
4007         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4008 }
4009
4010 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4011 static void b43_set_pretbtt(struct b43_wldev *dev)
4012 {
4013         u16 pretbtt;
4014
4015         /* The time value is in microseconds. */
4016         if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS)) {
4017                 pretbtt = 2;
4018         } else {
4019                 if (dev->phy.type == B43_PHYTYPE_A)
4020                         pretbtt = 120;
4021                 else
4022                         pretbtt = 250;
4023         }
4024         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4025         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4026 }
4027
4028 /* Shutdown a wireless core */
4029 /* Locking: wl->mutex */
4030 static void b43_wireless_core_exit(struct b43_wldev *dev)
4031 {
4032         struct b43_phy *phy = &dev->phy;
4033         u32 macctl;
4034
4035         B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4036         if (b43_status(dev) != B43_STAT_INITIALIZED)
4037                 return;
4038         b43_set_status(dev, B43_STAT_UNINIT);
4039
4040         /* Stop the microcode PSM. */
4041         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4042         macctl &= ~B43_MACCTL_PSM_RUN;
4043         macctl |= B43_MACCTL_PSM_JMP0;
4044         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4045
4046         if (!dev->suspend_in_progress) {
4047                 b43_leds_exit(dev);
4048                 b43_rng_exit(dev->wl);
4049         }
4050         b43_dma_free(dev);
4051         b43_pio_free(dev);
4052         b43_chip_exit(dev);
4053         b43_radio_turn_off(dev, 1);
4054         b43_switch_analog(dev, 0);
4055         if (phy->dyn_tssi_tbl)
4056                 kfree(phy->tssi2dbm);
4057         kfree(phy->lo_control);
4058         phy->lo_control = NULL;
4059         if (dev->wl->current_beacon) {
4060                 dev_kfree_skb_any(dev->wl->current_beacon);
4061                 dev->wl->current_beacon = NULL;
4062         }
4063
4064         ssb_device_disable(dev->dev, 0);
4065         ssb_bus_may_powerdown(dev->dev->bus);
4066 }
4067
4068 /* Initialize a wireless core */
4069 static int b43_wireless_core_init(struct b43_wldev *dev)
4070 {
4071         struct b43_wl *wl = dev->wl;
4072         struct ssb_bus *bus = dev->dev->bus;
4073         struct ssb_sprom *sprom = &bus->sprom;
4074         struct b43_phy *phy = &dev->phy;
4075         int err;
4076         u64 hf;
4077         u32 tmp;
4078
4079         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4080
4081         err = ssb_bus_powerup(bus, 0);
4082         if (err)
4083                 goto out;
4084         if (!ssb_device_is_enabled(dev->dev)) {
4085                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4086                 b43_wireless_core_reset(dev, tmp);
4087         }
4088
4089         if ((phy->type == B43_PHYTYPE_B) || (phy->type == B43_PHYTYPE_G)) {
4090                 phy->lo_control =
4091                     kzalloc(sizeof(*(phy->lo_control)), GFP_KERNEL);
4092                 if (!phy->lo_control) {
4093                         err = -ENOMEM;
4094                         goto err_busdown;
4095                 }
4096         }
4097         setup_struct_wldev_for_init(dev);
4098
4099         err = b43_phy_init_tssi2dbm_table(dev);
4100         if (err)
4101                 goto err_kfree_lo_control;
4102
4103         /* Enable IRQ routing to this device. */
4104         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4105
4106         b43_imcfglo_timeouts_workaround(dev);
4107         b43_bluetooth_coext_disable(dev);
4108         b43_phy_early_init(dev);
4109         err = b43_chip_init(dev);
4110         if (err)
4111                 goto err_kfree_tssitbl;
4112         b43_shm_write16(dev, B43_SHM_SHARED,
4113                         B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4114         hf = b43_hf_read(dev);
4115         if (phy->type == B43_PHYTYPE_G) {
4116                 hf |= B43_HF_SYMW;
4117                 if (phy->rev == 1)
4118                         hf |= B43_HF_GDCW;
4119                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4120                         hf |= B43_HF_OFDMPABOOST;
4121         } else if (phy->type == B43_PHYTYPE_B) {
4122                 hf |= B43_HF_SYMW;
4123                 if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4124                         hf &= ~B43_HF_GDCW;
4125         }
4126         b43_hf_write(dev, hf);
4127
4128         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4129                              B43_DEFAULT_LONG_RETRY_LIMIT);
4130         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4131         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4132
4133         /* Disable sending probe responses from firmware.
4134          * Setting the MaxTime to one usec will always trigger
4135          * a timeout, so we never send any probe resp.
4136          * A timeout of zero is infinite. */
4137         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4138
4139         b43_rate_memory_init(dev);
4140         b43_set_phytxctl_defaults(dev);
4141
4142         /* Minimum Contention Window */
4143         if (phy->type == B43_PHYTYPE_B) {
4144                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4145         } else {
4146                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4147         }
4148         /* Maximum Contention Window */
4149         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4150
4151         if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4152                 dev->__using_pio_transfers = 1;
4153                 err = b43_pio_init(dev);
4154         } else {
4155                 dev->__using_pio_transfers = 0;
4156                 err = b43_dma_init(dev);
4157         }
4158         if (err)
4159                 goto err_chip_exit;
4160         b43_qos_init(dev);
4161         b43_set_synth_pu_delay(dev, 1);
4162         b43_bluetooth_coext_enable(dev);
4163
4164         ssb_bus_powerup(bus, 1);        /* Enable dynamic PCTL */
4165         b43_upload_card_macaddress(dev);
4166         b43_security_init(dev);
4167         if (!dev->suspend_in_progress)
4168                 b43_rng_init(wl);
4169
4170         b43_set_status(dev, B43_STAT_INITIALIZED);
4171
4172         if (!dev->suspend_in_progress)
4173                 b43_leds_init(dev);
4174 out:
4175         return err;
4176
4177       err_chip_exit:
4178         b43_chip_exit(dev);
4179       err_kfree_tssitbl:
4180         if (phy->dyn_tssi_tbl)
4181                 kfree(phy->tssi2dbm);
4182       err_kfree_lo_control:
4183         kfree(phy->lo_control);
4184         phy->lo_control = NULL;
4185       err_busdown:
4186         ssb_bus_may_powerdown(bus);
4187         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4188         return err;
4189 }
4190
4191 static int b43_op_add_interface(struct ieee80211_hw *hw,
4192                                 struct ieee80211_if_init_conf *conf)
4193 {
4194         struct b43_wl *wl = hw_to_b43_wl(hw);
4195         struct b43_wldev *dev;
4196         unsigned long flags;
4197         int err = -EOPNOTSUPP;
4198
4199         /* TODO: allow WDS/AP devices to coexist */
4200
4201         if (conf->type != IEEE80211_IF_TYPE_AP &&
4202             conf->type != IEEE80211_IF_TYPE_MESH_POINT &&
4203             conf->type != IEEE80211_IF_TYPE_STA &&
4204             conf->type != IEEE80211_IF_TYPE_WDS &&
4205             conf->type != IEEE80211_IF_TYPE_IBSS)
4206                 return -EOPNOTSUPP;
4207
4208         mutex_lock(&wl->mutex);
4209         if (wl->operating)
4210                 goto out_mutex_unlock;
4211
4212         b43dbg(wl, "Adding Interface type %d\n", conf->type);
4213
4214         dev = wl->current_dev;
4215         wl->operating = 1;
4216         wl->vif = conf->vif;
4217         wl->if_type = conf->type;
4218         memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4219
4220         spin_lock_irqsave(&wl->irq_lock, flags);
4221         b43_adjust_opmode(dev);
4222         b43_set_pretbtt(dev);
4223         b43_set_synth_pu_delay(dev, 0);
4224         b43_upload_card_macaddress(dev);
4225         spin_unlock_irqrestore(&wl->irq_lock, flags);
4226
4227         err = 0;
4228  out_mutex_unlock:
4229         mutex_unlock(&wl->mutex);
4230
4231         return err;
4232 }
4233
4234 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4235                                     struct ieee80211_if_init_conf *conf)
4236 {
4237         struct b43_wl *wl = hw_to_b43_wl(hw);
4238         struct b43_wldev *dev = wl->current_dev;
4239         unsigned long flags;
4240
4241         b43dbg(wl, "Removing Interface type %d\n", conf->type);
4242
4243         mutex_lock(&wl->mutex);
4244
4245         B43_WARN_ON(!wl->operating);
4246         B43_WARN_ON(wl->vif != conf->vif);
4247         wl->vif = NULL;
4248
4249         wl->operating = 0;
4250
4251         spin_lock_irqsave(&wl->irq_lock, flags);
4252         b43_adjust_opmode(dev);
4253         memset(wl->mac_addr, 0, ETH_ALEN);
4254         b43_upload_card_macaddress(dev);
4255         spin_unlock_irqrestore(&wl->irq_lock, flags);
4256
4257         mutex_unlock(&wl->mutex);
4258 }
4259
4260 static int b43_op_start(struct ieee80211_hw *hw)
4261 {
4262         struct b43_wl *wl = hw_to_b43_wl(hw);
4263         struct b43_wldev *dev = wl->current_dev;
4264         int did_init = 0;
4265         int err = 0;
4266         bool do_rfkill_exit = 0;
4267
4268         /* Kill all old instance specific information to make sure
4269          * the card won't use it in the short timeframe between start
4270          * and mac80211 reconfiguring it. */
4271         memset(wl->bssid, 0, ETH_ALEN);
4272         memset(wl->mac_addr, 0, ETH_ALEN);
4273         wl->filter_flags = 0;
4274         wl->radiotap_enabled = 0;
4275         b43_qos_clear(wl);
4276         wl->beacon0_uploaded = 0;
4277         wl->beacon1_uploaded = 0;
4278         wl->beacon_templates_virgin = 1;
4279
4280         /* First register RFkill.
4281          * LEDs that are registered later depend on it. */
4282         b43_rfkill_init(dev);
4283
4284         mutex_lock(&wl->mutex);
4285
4286         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4287                 err = b43_wireless_core_init(dev);
4288                 if (err) {
4289                         do_rfkill_exit = 1;
4290                         goto out_mutex_unlock;
4291                 }
4292                 did_init = 1;
4293         }
4294
4295         if (b43_status(dev) < B43_STAT_STARTED) {
4296                 err = b43_wireless_core_start(dev);
4297                 if (err) {
4298                         if (did_init)
4299                                 b43_wireless_core_exit(dev);
4300                         do_rfkill_exit = 1;
4301                         goto out_mutex_unlock;
4302                 }
4303         }
4304
4305  out_mutex_unlock:
4306         mutex_unlock(&wl->mutex);
4307
4308         if (do_rfkill_exit)
4309                 b43_rfkill_exit(dev);
4310
4311         return err;
4312 }
4313
4314 static void b43_op_stop(struct ieee80211_hw *hw)
4315 {
4316         struct b43_wl *wl = hw_to_b43_wl(hw);
4317         struct b43_wldev *dev = wl->current_dev;
4318
4319         b43_rfkill_exit(dev);
4320         cancel_work_sync(&(wl->qos_update_work));
4321         cancel_work_sync(&(wl->beacon_update_trigger));
4322
4323         mutex_lock(&wl->mutex);
4324         if (b43_status(dev) >= B43_STAT_STARTED)
4325                 b43_wireless_core_stop(dev);
4326         b43_wireless_core_exit(dev);
4327         mutex_unlock(&wl->mutex);
4328 }
4329
4330 static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
4331                                   u32 short_retry_limit, u32 long_retry_limit)
4332 {
4333         struct b43_wl *wl = hw_to_b43_wl(hw);
4334         struct b43_wldev *dev;
4335         int err = 0;
4336
4337         mutex_lock(&wl->mutex);
4338         dev = wl->current_dev;
4339         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
4340                 err = -ENODEV;
4341                 goto out_unlock;
4342         }
4343         b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
4344 out_unlock:
4345         mutex_unlock(&wl->mutex);
4346
4347         return err;
4348 }
4349
4350 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
4351 {
4352         struct b43_wl *wl = hw_to_b43_wl(hw);
4353         unsigned long flags;
4354
4355         spin_lock_irqsave(&wl->irq_lock, flags);
4356         b43_update_templates(wl);
4357         spin_unlock_irqrestore(&wl->irq_lock, flags);
4358
4359         return 0;
4360 }
4361
4362 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4363                               struct ieee80211_vif *vif,
4364                               enum sta_notify_cmd notify_cmd,
4365                               const u8 *addr)
4366 {
4367         struct b43_wl *wl = hw_to_b43_wl(hw);
4368
4369         B43_WARN_ON(!vif || wl->vif != vif);
4370 }
4371
4372 static const struct ieee80211_ops b43_hw_ops = {
4373         .tx                     = b43_op_tx,
4374         .conf_tx                = b43_op_conf_tx,
4375         .add_interface          = b43_op_add_interface,
4376         .remove_interface       = b43_op_remove_interface,
4377         .config                 = b43_op_config,
4378         .config_interface       = b43_op_config_interface,
4379         .configure_filter       = b43_op_configure_filter,
4380         .set_key                = b43_op_set_key,
4381         .get_stats              = b43_op_get_stats,
4382         .get_tx_stats           = b43_op_get_tx_stats,
4383         .start                  = b43_op_start,
4384         .stop                   = b43_op_stop,
4385         .set_retry_limit        = b43_op_set_retry_limit,
4386         .set_tim                = b43_op_beacon_set_tim,
4387         .sta_notify             = b43_op_sta_notify,
4388 };
4389
4390 /* Hard-reset the chip. Do not call this directly.
4391  * Use b43_controller_restart()
4392  */
4393 static void b43_chip_reset(struct work_struct *work)
4394 {
4395         struct b43_wldev *dev =
4396             container_of(work, struct b43_wldev, restart_work);
4397         struct b43_wl *wl = dev->wl;
4398         int err = 0;
4399         int prev_status;
4400
4401         mutex_lock(&wl->mutex);
4402
4403         prev_status = b43_status(dev);
4404         /* Bring the device down... */
4405         if (prev_status >= B43_STAT_STARTED)
4406                 b43_wireless_core_stop(dev);
4407         if (prev_status >= B43_STAT_INITIALIZED)
4408                 b43_wireless_core_exit(dev);
4409
4410         /* ...and up again. */
4411         if (prev_status >= B43_STAT_INITIALIZED) {
4412                 err = b43_wireless_core_init(dev);
4413                 if (err)
4414                         goto out;
4415         }
4416         if (prev_status >= B43_STAT_STARTED) {
4417                 err = b43_wireless_core_start(dev);
4418                 if (err) {
4419                         b43_wireless_core_exit(dev);
4420                         goto out;
4421                 }
4422         }
4423 out:
4424         if (err)
4425                 wl->current_dev = NULL; /* Failed to init the dev. */
4426         mutex_unlock(&wl->mutex);
4427         if (err)
4428                 b43err(wl, "Controller restart FAILED\n");
4429         else
4430                 b43info(wl, "Controller restarted\n");
4431 }
4432
4433 static int b43_setup_bands(struct b43_wldev *dev,
4434                            bool have_2ghz_phy, bool have_5ghz_phy)
4435 {
4436         struct ieee80211_hw *hw = dev->wl->hw;
4437
4438         if (have_2ghz_phy)
4439                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4440         if (dev->phy.type == B43_PHYTYPE_N) {
4441                 if (have_5ghz_phy)
4442                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4443         } else {
4444                 if (have_5ghz_phy)
4445                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4446         }
4447
4448         dev->phy.supports_2ghz = have_2ghz_phy;
4449         dev->phy.supports_5ghz = have_5ghz_phy;
4450
4451         return 0;
4452 }
4453
4454 static void b43_wireless_core_detach(struct b43_wldev *dev)
4455 {
4456         /* We release firmware that late to not be required to re-request
4457          * is all the time when we reinit the core. */
4458         b43_release_firmware(dev);
4459 }
4460
4461 static int b43_wireless_core_attach(struct b43_wldev *dev)
4462 {
4463         struct b43_wl *wl = dev->wl;
4464         struct ssb_bus *bus = dev->dev->bus;
4465         struct pci_dev *pdev = bus->host_pci;
4466         int err;
4467         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4468         u32 tmp;
4469
4470         /* Do NOT do any device initialization here.
4471          * Do it in wireless_core_init() instead.
4472          * This function is for gathering basic information about the HW, only.
4473          * Also some structs may be set up here. But most likely you want to have
4474          * that in core_init(), too.
4475          */
4476
4477         err = ssb_bus_powerup(bus, 0);
4478         if (err) {
4479                 b43err(wl, "Bus powerup failed\n");
4480                 goto out;
4481         }
4482         /* Get the PHY type. */
4483         if (dev->dev->id.revision >= 5) {
4484                 u32 tmshigh;
4485
4486                 tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4487                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4488                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4489         } else
4490                 B43_WARN_ON(1);
4491
4492         dev->phy.gmode = have_2ghz_phy;
4493         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4494         b43_wireless_core_reset(dev, tmp);
4495
4496         err = b43_phy_versioning(dev);
4497         if (err)
4498                 goto err_powerdown;
4499         /* Check if this device supports multiband. */
4500         if (!pdev ||
4501             (pdev->device != 0x4312 &&
4502              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4503                 /* No multiband support. */
4504                 have_2ghz_phy = 0;
4505                 have_5ghz_phy = 0;
4506                 switch (dev->phy.type) {
4507                 case B43_PHYTYPE_A:
4508                         have_5ghz_phy = 1;
4509                         break;
4510                 case B43_PHYTYPE_G:
4511                 case B43_PHYTYPE_N:
4512                         have_2ghz_phy = 1;
4513                         break;
4514                 default:
4515                         B43_WARN_ON(1);
4516                 }
4517         }
4518         if (dev->phy.type == B43_PHYTYPE_A) {
4519                 /* FIXME */
4520                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4521                 err = -EOPNOTSUPP;
4522                 goto err_powerdown;
4523         }
4524         if (1 /* disable A-PHY */) {
4525                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4526                 if (dev->phy.type != B43_PHYTYPE_N) {
4527                         have_2ghz_phy = 1;
4528                         have_5ghz_phy = 0;
4529                 }
4530         }
4531
4532         dev->phy.gmode = have_2ghz_phy;
4533         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4534         b43_wireless_core_reset(dev, tmp);
4535
4536         err = b43_validate_chipaccess(dev);
4537         if (err)
4538                 goto err_powerdown;
4539         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4540         if (err)
4541                 goto err_powerdown;
4542
4543         /* Now set some default "current_dev" */
4544         if (!wl->current_dev)
4545                 wl->current_dev = dev;
4546         INIT_WORK(&dev->restart_work, b43_chip_reset);
4547
4548         b43_radio_turn_off(dev, 1);
4549         b43_switch_analog(dev, 0);
4550         ssb_device_disable(dev->dev, 0);
4551         ssb_bus_may_powerdown(bus);
4552
4553 out:
4554         return err;
4555
4556 err_powerdown:
4557         ssb_bus_may_powerdown(bus);
4558         return err;
4559 }
4560
4561 static void b43_one_core_detach(struct ssb_device *dev)
4562 {
4563         struct b43_wldev *wldev;
4564         struct b43_wl *wl;
4565
4566         /* Do not cancel ieee80211-workqueue based work here.
4567          * See comment in b43_remove(). */
4568
4569         wldev = ssb_get_drvdata(dev);
4570         wl = wldev->wl;
4571         b43_debugfs_remove_device(wldev);
4572         b43_wireless_core_detach(wldev);
4573         list_del(&wldev->list);
4574         wl->nr_devs--;
4575         ssb_set_drvdata(dev, NULL);
4576         kfree(wldev);
4577 }
4578
4579 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4580 {
4581         struct b43_wldev *wldev;
4582         struct pci_dev *pdev;
4583         int err = -ENOMEM;
4584
4585         if (!list_empty(&wl->devlist)) {
4586                 /* We are not the first core on this chip. */
4587                 pdev = dev->bus->host_pci;
4588                 /* Only special chips support more than one wireless
4589                  * core, although some of the other chips have more than
4590                  * one wireless core as well. Check for this and
4591                  * bail out early.
4592                  */
4593                 if (!pdev ||
4594                     ((pdev->device != 0x4321) &&
4595                      (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4596                         b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4597                         return -ENODEV;
4598                 }
4599         }
4600
4601         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4602         if (!wldev)
4603                 goto out;
4604
4605         wldev->dev = dev;
4606         wldev->wl = wl;
4607         b43_set_status(wldev, B43_STAT_UNINIT);
4608         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4609         tasklet_init(&wldev->isr_tasklet,
4610                      (void (*)(unsigned long))b43_interrupt_tasklet,
4611                      (unsigned long)wldev);
4612         INIT_LIST_HEAD(&wldev->list);
4613
4614         err = b43_wireless_core_attach(wldev);
4615         if (err)
4616                 goto err_kfree_wldev;
4617
4618         list_add(&wldev->list, &wl->devlist);
4619         wl->nr_devs++;
4620         ssb_set_drvdata(dev, wldev);
4621         b43_debugfs_add_device(wldev);
4622
4623       out:
4624         return err;
4625
4626       err_kfree_wldev:
4627         kfree(wldev);
4628         return err;
4629 }
4630
4631 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4632         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4633         (pdev->device == _device) &&                                    \
4634         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4635         (pdev->subsystem_device == _subdevice)                          )
4636
4637 static void b43_sprom_fixup(struct ssb_bus *bus)
4638 {
4639         struct pci_dev *pdev;
4640
4641         /* boardflags workarounds */
4642         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4643             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4644                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4645         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4646             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4647                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4648         if (bus->bustype == SSB_BUSTYPE_PCI) {
4649                 pdev = bus->host_pci;
4650                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4651                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4652                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
4653                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4654         }
4655 }
4656
4657 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4658 {
4659         struct ieee80211_hw *hw = wl->hw;
4660
4661         ssb_set_devtypedata(dev, NULL);
4662         ieee80211_free_hw(hw);
4663 }
4664
4665 static int b43_wireless_init(struct ssb_device *dev)
4666 {
4667         struct ssb_sprom *sprom = &dev->bus->sprom;
4668         struct ieee80211_hw *hw;
4669         struct b43_wl *wl;
4670         int err = -ENOMEM;
4671
4672         b43_sprom_fixup(dev->bus);
4673
4674         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4675         if (!hw) {
4676                 b43err(NULL, "Could not allocate ieee80211 device\n");
4677                 goto out;
4678         }
4679
4680         /* fill hw info */
4681         hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
4682                     IEEE80211_HW_RX_INCLUDES_FCS |
4683                     IEEE80211_HW_SIGNAL_DBM |
4684                     IEEE80211_HW_NOISE_DBM;
4685
4686         hw->queues = b43_modparam_qos ? 4 : 1;
4687         SET_IEEE80211_DEV(hw, dev->dev);
4688         if (is_valid_ether_addr(sprom->et1mac))
4689                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4690         else
4691                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4692
4693         /* Get and initialize struct b43_wl */
4694         wl = hw_to_b43_wl(hw);
4695         memset(wl, 0, sizeof(*wl));
4696         wl->hw = hw;
4697         spin_lock_init(&wl->irq_lock);
4698         rwlock_init(&wl->tx_lock);
4699         spin_lock_init(&wl->leds_lock);
4700         spin_lock_init(&wl->shm_lock);
4701         mutex_init(&wl->mutex);
4702         INIT_LIST_HEAD(&wl->devlist);
4703         INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
4704         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4705
4706         ssb_set_devtypedata(dev, wl);
4707         b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4708         err = 0;
4709       out:
4710         return err;
4711 }
4712
4713 static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4714 {
4715         struct b43_wl *wl;
4716         int err;
4717         int first = 0;
4718
4719         wl = ssb_get_devtypedata(dev);
4720         if (!wl) {
4721                 /* Probing the first core. Must setup common struct b43_wl */
4722                 first = 1;
4723                 err = b43_wireless_init(dev);
4724                 if (err)
4725                         goto out;
4726                 wl = ssb_get_devtypedata(dev);
4727                 B43_WARN_ON(!wl);
4728         }
4729         err = b43_one_core_attach(dev, wl);
4730         if (err)
4731                 goto err_wireless_exit;
4732
4733         if (first) {
4734                 err = ieee80211_register_hw(wl->hw);
4735                 if (err)
4736                         goto err_one_core_detach;
4737         }
4738
4739       out:
4740         return err;
4741
4742       err_one_core_detach:
4743         b43_one_core_detach(dev);
4744       err_wireless_exit:
4745         if (first)
4746                 b43_wireless_exit(dev, wl);
4747         return err;
4748 }
4749
4750 static void b43_remove(struct ssb_device *dev)
4751 {
4752         struct b43_wl *wl = ssb_get_devtypedata(dev);
4753         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4754
4755         /* We must cancel any work here before unregistering from ieee80211,
4756          * as the ieee80211 unreg will destroy the workqueue. */
4757         cancel_work_sync(&wldev->restart_work);
4758
4759         B43_WARN_ON(!wl);
4760         if (wl->current_dev == wldev)
4761                 ieee80211_unregister_hw(wl->hw);
4762
4763         b43_one_core_detach(dev);
4764
4765         if (list_empty(&wl->devlist)) {
4766                 /* Last core on the chip unregistered.
4767                  * We can destroy common struct b43_wl.
4768                  */
4769                 b43_wireless_exit(dev, wl);
4770         }
4771 }
4772
4773 /* Perform a hardware reset. This can be called from any context. */
4774 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4775 {
4776         /* Must avoid requeueing, if we are in shutdown. */
4777         if (b43_status(dev) < B43_STAT_INITIALIZED)
4778                 return;
4779         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4780         queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4781 }
4782
4783 #ifdef CONFIG_PM
4784
4785 static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4786 {
4787         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4788         struct b43_wl *wl = wldev->wl;
4789
4790         b43dbg(wl, "Suspending...\n");
4791
4792         mutex_lock(&wl->mutex);
4793         wldev->suspend_in_progress = true;
4794         wldev->suspend_init_status = b43_status(wldev);
4795         if (wldev->suspend_init_status >= B43_STAT_STARTED)
4796                 b43_wireless_core_stop(wldev);
4797         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4798                 b43_wireless_core_exit(wldev);
4799         mutex_unlock(&wl->mutex);
4800
4801         b43dbg(wl, "Device suspended.\n");
4802
4803         return 0;
4804 }
4805
4806 static int b43_resume(struct ssb_device *dev)
4807 {
4808         struct b43_wldev *wldev = ssb_get_drvdata(dev);
4809         struct b43_wl *wl = wldev->wl;
4810         int err = 0;
4811
4812         b43dbg(wl, "Resuming...\n");
4813
4814         mutex_lock(&wl->mutex);
4815         if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4816                 err = b43_wireless_core_init(wldev);
4817                 if (err) {
4818                         b43err(wl, "Resume failed at core init\n");
4819                         goto out;
4820                 }
4821         }
4822         if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4823                 err = b43_wireless_core_start(wldev);
4824                 if (err) {
4825                         b43_leds_exit(wldev);
4826                         b43_rng_exit(wldev->wl);
4827                         b43_wireless_core_exit(wldev);
4828                         b43err(wl, "Resume failed at core start\n");
4829                         goto out;
4830                 }
4831         }
4832         b43dbg(wl, "Device resumed.\n");
4833  out:
4834         wldev->suspend_in_progress = false;
4835         mutex_unlock(&wl->mutex);
4836         return err;
4837 }
4838
4839 #else /* CONFIG_PM */
4840 # define b43_suspend    NULL
4841 # define b43_resume     NULL
4842 #endif /* CONFIG_PM */
4843
4844 static struct ssb_driver b43_ssb_driver = {
4845         .name           = KBUILD_MODNAME,
4846         .id_table       = b43_ssb_tbl,
4847         .probe          = b43_probe,
4848         .remove         = b43_remove,
4849         .suspend        = b43_suspend,
4850         .resume         = b43_resume,
4851 };
4852
4853 static void b43_print_driverinfo(void)
4854 {
4855         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4856                    *feat_leds = "", *feat_rfkill = "";
4857
4858 #ifdef CONFIG_B43_PCI_AUTOSELECT
4859         feat_pci = "P";
4860 #endif
4861 #ifdef CONFIG_B43_PCMCIA
4862         feat_pcmcia = "M";
4863 #endif
4864 #ifdef CONFIG_B43_NPHY
4865         feat_nphy = "N";
4866 #endif
4867 #ifdef CONFIG_B43_LEDS
4868         feat_leds = "L";
4869 #endif
4870 #ifdef CONFIG_B43_RFKILL
4871         feat_rfkill = "R";
4872 #endif
4873         printk(KERN_INFO "Broadcom 43xx driver loaded "
4874                "[ Features: %s%s%s%s%s, Firmware-ID: "
4875                B43_SUPPORTED_FIRMWARE_ID " ]\n",
4876                feat_pci, feat_pcmcia, feat_nphy,
4877                feat_leds, feat_rfkill);
4878 }
4879
4880 static int __init b43_init(void)
4881 {
4882         int err;
4883
4884         b43_debugfs_init();
4885         err = b43_pcmcia_init();
4886         if (err)
4887                 goto err_dfs_exit;
4888         err = ssb_driver_register(&b43_ssb_driver);
4889         if (err)
4890                 goto err_pcmcia_exit;
4891         b43_print_driverinfo();
4892
4893         return err;
4894
4895 err_pcmcia_exit:
4896         b43_pcmcia_exit();
4897 err_dfs_exit:
4898         b43_debugfs_exit();
4899         return err;
4900 }
4901
4902 static void __exit b43_exit(void)
4903 {
4904         ssb_driver_unregister(&b43_ssb_driver);
4905         b43_pcmcia_exit();
4906         b43_debugfs_exit();
4907 }
4908
4909 module_init(b43_init)
4910 module_exit(b43_exit)