drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
  11
  12   SDIO support
  13   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  14
  15   Some parts of the code in this file are derived from the ipw2200
  16   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  17
  18   This program is free software; you can redistribute it and/or modify
  19   it under the terms of the GNU General Public License as published by
  20   the Free Software Foundation; either version 2 of the License, or
  21   (at your option) any later version.
  22
  23   This program is distributed in the hope that it will be useful,
  24   but WITHOUT ANY WARRANTY; without even the implied warranty of
  25   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26   GNU General Public License for more details.
  27
  28   You should have received a copy of the GNU General Public License
  29   along with this program; see the file COPYING.  If not, write to
  30   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  31   Boston, MA 02110-1301, USA.
  32
  33 */
  34
  35 #include <linux/delay.h>
  36 #include <linux/init.h>
  37 #include <linux/module.h>
  38 #include <linux/if_arp.h>
  39 #include <linux/etherdevice.h>
  40 #include <linux/firmware.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_AUTHOR("Rafał Miłecki");
  69 MODULE_LICENSE("GPL");
  70
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = 0;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
 117 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
 118 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
 119
 120 #ifdef CONFIG_B43_BCMA
 121 static const struct bcma_device_id b43_bcma_tbl[] = {
 122         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 123         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 124         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 125         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
 126         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 127         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
 128         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
 129         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
 130         BCMA_CORETABLE_END
 131 };
 132 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 133 #endif
 134
 135 #ifdef CONFIG_B43_SSB
 136 static const struct ssb_device_id b43_ssb_tbl[] = {
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 138         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 139         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 140         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 141         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 142         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 143         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 144         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 145         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 146         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 147         SSB_DEVTABLE_END
 148 };
 149 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 150 #endif
 151
 152 /* Channel and ratetables are shared for all devices.
 153  * They can't be const, because ieee80211 puts some precalculated
 154  * data in there. This data is the same for all devices, so we don't
 155  * get concurrency issues */
 156 #define RATETAB_ENT(_rateid, _flags) \
 157         {                                                               \
 158                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 159                 .hw_value       = (_rateid),                            \
 160                 .flags          = (_flags),                             \
 161         }
 162
 163 /*
 164  * NOTE: When changing this, sync with xmit.c's
 165  *       b43_plcp_get_bitrate_idx_* functions!
 166  */
 167 static struct ieee80211_rate __b43_ratetable[] = {
 168         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 169         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 170         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 171         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 172         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 173         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 174         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 175         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 176         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 177         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 178         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 179         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 180 };
 181
 182 #define b43_a_ratetable         (__b43_ratetable + 4)
 183 #define b43_a_ratetable_size    8
 184 #define b43_b_ratetable         (__b43_ratetable + 0)
 185 #define b43_b_ratetable_size    4
 186 #define b43_g_ratetable         (__b43_ratetable + 0)
 187 #define b43_g_ratetable_size    12
 188
 189 #define CHAN2G(_channel, _freq, _flags) {                       \
 190         .band                   = IEEE80211_BAND_2GHZ,          \
 191         .center_freq            = (_freq),                      \
 192         .hw_value               = (_channel),                   \
 193         .flags                  = (_flags),                     \
 194         .max_antenna_gain       = 0,                            \
 195         .max_power              = 30,                           \
 196 }
 197 static struct ieee80211_channel b43_2ghz_chantable[] = {
 198         CHAN2G(1, 2412, 0),
 199         CHAN2G(2, 2417, 0),
 200         CHAN2G(3, 2422, 0),
 201         CHAN2G(4, 2427, 0),
 202         CHAN2G(5, 2432, 0),
 203         CHAN2G(6, 2437, 0),
 204         CHAN2G(7, 2442, 0),
 205         CHAN2G(8, 2447, 0),
 206         CHAN2G(9, 2452, 0),
 207         CHAN2G(10, 2457, 0),
 208         CHAN2G(11, 2462, 0),
 209         CHAN2G(12, 2467, 0),
 210         CHAN2G(13, 2472, 0),
 211         CHAN2G(14, 2484, 0),
 212 };
 213
 214 /* No support for the last 3 channels (12, 13, 14) */
 215 #define b43_2ghz_chantable_limited_size         11
 216 #undef CHAN2G
 217
 218 #define CHAN4G(_channel, _flags) {                              \
 219         .band                   = IEEE80211_BAND_5GHZ,          \
 220         .center_freq            = 4000 + (5 * (_channel)),      \
 221         .hw_value               = (_channel),                   \
 222         .flags                  = (_flags),                     \
 223         .max_antenna_gain       = 0,                            \
 224         .max_power              = 30,                           \
 225 }
 226 #define CHAN5G(_channel, _flags) {                              \
 227         .band                   = IEEE80211_BAND_5GHZ,          \
 228         .center_freq            = 5000 + (5 * (_channel)),      \
 229         .hw_value               = (_channel),                   \
 230         .flags                  = (_flags),                     \
 231         .max_antenna_gain       = 0,                            \
 232         .max_power              = 30,                           \
 233 }
 234 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 235         CHAN4G(184, 0),         CHAN4G(186, 0),
 236         CHAN4G(188, 0),         CHAN4G(190, 0),
 237         CHAN4G(192, 0),         CHAN4G(194, 0),
 238         CHAN4G(196, 0),         CHAN4G(198, 0),
 239         CHAN4G(200, 0),         CHAN4G(202, 0),
 240         CHAN4G(204, 0),         CHAN4G(206, 0),
 241         CHAN4G(208, 0),         CHAN4G(210, 0),
 242         CHAN4G(212, 0),         CHAN4G(214, 0),
 243         CHAN4G(216, 0),         CHAN4G(218, 0),
 244         CHAN4G(220, 0),         CHAN4G(222, 0),
 245         CHAN4G(224, 0),         CHAN4G(226, 0),
 246         CHAN4G(228, 0),
 247         CHAN5G(32, 0),          CHAN5G(34, 0),
 248         CHAN5G(36, 0),          CHAN5G(38, 0),
 249         CHAN5G(40, 0),          CHAN5G(42, 0),
 250         CHAN5G(44, 0),          CHAN5G(46, 0),
 251         CHAN5G(48, 0),          CHAN5G(50, 0),
 252         CHAN5G(52, 0),          CHAN5G(54, 0),
 253         CHAN5G(56, 0),          CHAN5G(58, 0),
 254         CHAN5G(60, 0),          CHAN5G(62, 0),
 255         CHAN5G(64, 0),          CHAN5G(66, 0),
 256         CHAN5G(68, 0),          CHAN5G(70, 0),
 257         CHAN5G(72, 0),          CHAN5G(74, 0),
 258         CHAN5G(76, 0),          CHAN5G(78, 0),
 259         CHAN5G(80, 0),          CHAN5G(82, 0),
 260         CHAN5G(84, 0),          CHAN5G(86, 0),
 261         CHAN5G(88, 0),          CHAN5G(90, 0),
 262         CHAN5G(92, 0),          CHAN5G(94, 0),
 263         CHAN5G(96, 0),          CHAN5G(98, 0),
 264         CHAN5G(100, 0),         CHAN5G(102, 0),
 265         CHAN5G(104, 0),         CHAN5G(106, 0),
 266         CHAN5G(108, 0),         CHAN5G(110, 0),
 267         CHAN5G(112, 0),         CHAN5G(114, 0),
 268         CHAN5G(116, 0),         CHAN5G(118, 0),
 269         CHAN5G(120, 0),         CHAN5G(122, 0),
 270         CHAN5G(124, 0),         CHAN5G(126, 0),
 271         CHAN5G(128, 0),         CHAN5G(130, 0),
 272         CHAN5G(132, 0),         CHAN5G(134, 0),
 273         CHAN5G(136, 0),         CHAN5G(138, 0),
 274         CHAN5G(140, 0),         CHAN5G(142, 0),
 275         CHAN5G(144, 0),         CHAN5G(145, 0),
 276         CHAN5G(146, 0),         CHAN5G(147, 0),
 277         CHAN5G(148, 0),         CHAN5G(149, 0),
 278         CHAN5G(150, 0),         CHAN5G(151, 0),
 279         CHAN5G(152, 0),         CHAN5G(153, 0),
 280         CHAN5G(154, 0),         CHAN5G(155, 0),
 281         CHAN5G(156, 0),         CHAN5G(157, 0),
 282         CHAN5G(158, 0),         CHAN5G(159, 0),
 283         CHAN5G(160, 0),         CHAN5G(161, 0),
 284         CHAN5G(162, 0),         CHAN5G(163, 0),
 285         CHAN5G(164, 0),         CHAN5G(165, 0),
 286         CHAN5G(166, 0),         CHAN5G(168, 0),
 287         CHAN5G(170, 0),         CHAN5G(172, 0),
 288         CHAN5G(174, 0),         CHAN5G(176, 0),
 289         CHAN5G(178, 0),         CHAN5G(180, 0),
 290         CHAN5G(182, 0),
 291 };
 292
 293 static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
 294         CHAN5G(36, 0),          CHAN5G(40, 0),
 295         CHAN5G(44, 0),          CHAN5G(48, 0),
 296         CHAN5G(149, 0),         CHAN5G(153, 0),
 297         CHAN5G(157, 0),         CHAN5G(161, 0),
 298         CHAN5G(165, 0),
 299 };
 300
 301 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 302         CHAN5G(34, 0),          CHAN5G(36, 0),
 303         CHAN5G(38, 0),          CHAN5G(40, 0),
 304         CHAN5G(42, 0),          CHAN5G(44, 0),
 305         CHAN5G(46, 0),          CHAN5G(48, 0),
 306         CHAN5G(52, 0),          CHAN5G(56, 0),
 307         CHAN5G(60, 0),          CHAN5G(64, 0),
 308         CHAN5G(100, 0),         CHAN5G(104, 0),
 309         CHAN5G(108, 0),         CHAN5G(112, 0),
 310         CHAN5G(116, 0),         CHAN5G(120, 0),
 311         CHAN5G(124, 0),         CHAN5G(128, 0),
 312         CHAN5G(132, 0),         CHAN5G(136, 0),
 313         CHAN5G(140, 0),         CHAN5G(149, 0),
 314         CHAN5G(153, 0),         CHAN5G(157, 0),
 315         CHAN5G(161, 0),         CHAN5G(165, 0),
 316         CHAN5G(184, 0),         CHAN5G(188, 0),
 317         CHAN5G(192, 0),         CHAN5G(196, 0),
 318         CHAN5G(200, 0),         CHAN5G(204, 0),
 319         CHAN5G(208, 0),         CHAN5G(212, 0),
 320         CHAN5G(216, 0),
 321 };
 322 #undef CHAN4G
 323 #undef CHAN5G
 324
 325 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 326         .band           = IEEE80211_BAND_5GHZ,
 327         .channels       = b43_5ghz_nphy_chantable,
 328         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 329         .bitrates       = b43_a_ratetable,
 330         .n_bitrates     = b43_a_ratetable_size,
 331 };
 332
 333 static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
 334         .band           = IEEE80211_BAND_5GHZ,
 335         .channels       = b43_5ghz_nphy_chantable_limited,
 336         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
 337         .bitrates       = b43_a_ratetable,
 338         .n_bitrates     = b43_a_ratetable_size,
 339 };
 340
 341 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 342         .band           = IEEE80211_BAND_5GHZ,
 343         .channels       = b43_5ghz_aphy_chantable,
 344         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 345         .bitrates       = b43_a_ratetable,
 346         .n_bitrates     = b43_a_ratetable_size,
 347 };
 348
 349 static struct ieee80211_supported_band b43_band_2GHz = {
 350         .band           = IEEE80211_BAND_2GHZ,
 351         .channels       = b43_2ghz_chantable,
 352         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 353         .bitrates       = b43_g_ratetable,
 354         .n_bitrates     = b43_g_ratetable_size,
 355 };
 356
 357 static struct ieee80211_supported_band b43_band_2ghz_limited = {
 358         .band           = IEEE80211_BAND_2GHZ,
 359         .channels       = b43_2ghz_chantable,
 360         .n_channels     = b43_2ghz_chantable_limited_size,
 361         .bitrates       = b43_g_ratetable,
 362         .n_bitrates     = b43_g_ratetable_size,
 363 };
 364
 365 static void b43_wireless_core_exit(struct b43_wldev *dev);
 366 static int b43_wireless_core_init(struct b43_wldev *dev);
 367 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 368 static int b43_wireless_core_start(struct b43_wldev *dev);
 369 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 370                                     struct ieee80211_vif *vif,
 371                                     struct ieee80211_bss_conf *conf,
 372                                     u32 changed);
 373
 374 static int b43_ratelimit(struct b43_wl *wl)
 375 {
 376         if (!wl || !wl->current_dev)
 377                 return 1;
 378         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 379                 return 1;
 380         /* We are up and running.
 381          * Ratelimit the messages to avoid DoS over the net. */
 382         return net_ratelimit();
 383 }
 384
 385 void b43info(struct b43_wl *wl, const char *fmt, ...)
 386 {
 387         struct va_format vaf;
 388         va_list args;
 389
 390         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 391                 return;
 392         if (!b43_ratelimit(wl))
 393                 return;
 394
 395         va_start(args, fmt);
 396
 397         vaf.fmt = fmt;
 398         vaf.va = &args;
 399
 400         printk(KERN_INFO "b43-%s: %pV",
 401                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 402
 403         va_end(args);
 404 }
 405
 406 void b43err(struct b43_wl *wl, const char *fmt, ...)
 407 {
 408         struct va_format vaf;
 409         va_list args;
 410
 411         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 412                 return;
 413         if (!b43_ratelimit(wl))
 414                 return;
 415
 416         va_start(args, fmt);
 417
 418         vaf.fmt = fmt;
 419         vaf.va = &args;
 420
 421         printk(KERN_ERR "b43-%s ERROR: %pV",
 422                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 423
 424         va_end(args);
 425 }
 426
 427 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 428 {
 429         struct va_format vaf;
 430         va_list args;
 431
 432         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 433                 return;
 434         if (!b43_ratelimit(wl))
 435                 return;
 436
 437         va_start(args, fmt);
 438
 439         vaf.fmt = fmt;
 440         vaf.va = &args;
 441
 442         printk(KERN_WARNING "b43-%s warning: %pV",
 443                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 444
 445         va_end(args);
 446 }
 447
 448 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 449 {
 450         struct va_format vaf;
 451         va_list args;
 452
 453         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 454                 return;
 455
 456         va_start(args, fmt);
 457
 458         vaf.fmt = fmt;
 459         vaf.va = &args;
 460
 461         printk(KERN_DEBUG "b43-%s debug: %pV",
 462                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 463
 464         va_end(args);
 465 }
 466
 467 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 468 {
 469         u32 macctl;
 470
 471         B43_WARN_ON(offset % 4 != 0);
 472
 473         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 474         if (macctl & B43_MACCTL_BE)
 475                 val = swab32(val);
 476
 477         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 478         mmiowb();
 479         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 480 }
 481
 482 static inline void b43_shm_control_word(struct b43_wldev *dev,
 483                                         u16 routing, u16 offset)
 484 {
 485         u32 control;
 486
 487         /* "offset" is the WORD offset. */
 488         control = routing;
 489         control <<= 16;
 490         control |= offset;
 491         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 492 }
 493
 494 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 495 {
 496         u32 ret;
 497
 498         if (routing == B43_SHM_SHARED) {
 499                 B43_WARN_ON(offset & 0x0001);
 500                 if (offset & 0x0003) {
 501                         /* Unaligned access */
 502                         b43_shm_control_word(dev, routing, offset >> 2);
 503                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 504                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 505                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 506
 507                         goto out;
 508                 }
 509                 offset >>= 2;
 510         }
 511         b43_shm_control_word(dev, routing, offset);
 512         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 513 out:
 514         return ret;
 515 }
 516
 517 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 518 {
 519         u16 ret;
 520
 521         if (routing == B43_SHM_SHARED) {
 522                 B43_WARN_ON(offset & 0x0001);
 523                 if (offset & 0x0003) {
 524                         /* Unaligned access */
 525                         b43_shm_control_word(dev, routing, offset >> 2);
 526                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 527
 528                         goto out;
 529                 }
 530                 offset >>= 2;
 531         }
 532         b43_shm_control_word(dev, routing, offset);
 533         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 534 out:
 535         return ret;
 536 }
 537
 538 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 539 {
 540         if (routing == B43_SHM_SHARED) {
 541                 B43_WARN_ON(offset & 0x0001);
 542                 if (offset & 0x0003) {
 543                         /* Unaligned access */
 544                         b43_shm_control_word(dev, routing, offset >> 2);
 545                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 546                                     value & 0xFFFF);
 547                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 548                         b43_write16(dev, B43_MMIO_SHM_DATA,
 549                                     (value >> 16) & 0xFFFF);
 550                         return;
 551                 }
 552                 offset >>= 2;
 553         }
 554         b43_shm_control_word(dev, routing, offset);
 555         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 556 }
 557
 558 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 559 {
 560         if (routing == B43_SHM_SHARED) {
 561                 B43_WARN_ON(offset & 0x0001);
 562                 if (offset & 0x0003) {
 563                         /* Unaligned access */
 564                         b43_shm_control_word(dev, routing, offset >> 2);
 565                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 566                         return;
 567                 }
 568                 offset >>= 2;
 569         }
 570         b43_shm_control_word(dev, routing, offset);
 571         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 572 }
 573
 574 /* Read HostFlags */
 575 u64 b43_hf_read(struct b43_wldev *dev)
 576 {
 577         u64 ret;
 578
 579         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
 580         ret <<= 16;
 581         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
 582         ret <<= 16;
 583         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
 584
 585         return ret;
 586 }
 587
 588 /* Write HostFlags */
 589 void b43_hf_write(struct b43_wldev *dev, u64 value)
 590 {
 591         u16 lo, mi, hi;
 592
 593         lo = (value & 0x00000000FFFFULL);
 594         mi = (value & 0x0000FFFF0000ULL) >> 16;
 595         hi = (value & 0xFFFF00000000ULL) >> 32;
 596         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
 597         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
 598         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
 599 }
 600
 601 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 602 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 603 {
 604         B43_WARN_ON(!dev->fw.opensource);
 605         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 606 }
 607
 608 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 609 {
 610         u32 low, high;
 611
 612         B43_WARN_ON(dev->dev->core_rev < 3);
 613
 614         /* The hardware guarantees us an atomic read, if we
 615          * read the low register first. */
 616         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 617         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 618
 619         *tsf = high;
 620         *tsf <<= 32;
 621         *tsf |= low;
 622 }
 623
 624 static void b43_time_lock(struct b43_wldev *dev)
 625 {
 626         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
 627         /* Commit the write */
 628         b43_read32(dev, B43_MMIO_MACCTL);
 629 }
 630
 631 static void b43_time_unlock(struct b43_wldev *dev)
 632 {
 633         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
 634         /* Commit the write */
 635         b43_read32(dev, B43_MMIO_MACCTL);
 636 }
 637
 638 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 639 {
 640         u32 low, high;
 641
 642         B43_WARN_ON(dev->dev->core_rev < 3);
 643
 644         low = tsf;
 645         high = (tsf >> 32);
 646         /* The hardware guarantees us an atomic write, if we
 647          * write the low register first. */
 648         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 649         mmiowb();
 650         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 651         mmiowb();
 652 }
 653
 654 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 655 {
 656         b43_time_lock(dev);
 657         b43_tsf_write_locked(dev, tsf);
 658         b43_time_unlock(dev);
 659 }
 660
 661 static
 662 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 663 {
 664         static const u8 zero_addr[ETH_ALEN] = { 0 };
 665         u16 data;
 666
 667         if (!mac)
 668                 mac = zero_addr;
 669
 670         offset |= 0x0020;
 671         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 672
 673         data = mac[0];
 674         data |= mac[1] << 8;
 675         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 676         data = mac[2];
 677         data |= mac[3] << 8;
 678         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 679         data = mac[4];
 680         data |= mac[5] << 8;
 681         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 682 }
 683
 684 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 685 {
 686         const u8 *mac;
 687         const u8 *bssid;
 688         u8 mac_bssid[ETH_ALEN * 2];
 689         int i;
 690         u32 tmp;
 691
 692         bssid = dev->wl->bssid;
 693         mac = dev->wl->mac_addr;
 694
 695         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 696
 697         memcpy(mac_bssid, mac, ETH_ALEN);
 698         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 699
 700         /* Write our MAC address and BSSID to template ram */
 701         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 702                 tmp = (u32) (mac_bssid[i + 0]);
 703                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 704                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 705                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 706                 b43_ram_write(dev, 0x20 + i, tmp);
 707         }
 708 }
 709
 710 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 711 {
 712         b43_write_mac_bssid_templates(dev);
 713         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 714 }
 715
 716 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 717 {
 718         /* slot_time is in usec. */
 719         /* This test used to exit for all but a G PHY. */
 720         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 721                 return;
 722         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 723         /* Shared memory location 0x0010 is the slot time and should be
 724          * set to slot_time; however, this register is initially 0 and changing
 725          * the value adversely affects the transmit rate for BCM4311
 726          * devices. Until this behavior is unterstood, delete this step
 727          *
 728          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 729          */
 730 }
 731
 732 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 733 {
 734         b43_set_slot_time(dev, 9);
 735 }
 736
 737 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 738 {
 739         b43_set_slot_time(dev, 20);
 740 }
 741
 742 /* DummyTransmission function, as documented on
 743  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 744  */
 745 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 746 {
 747         struct b43_phy *phy = &dev->phy;
 748         unsigned int i, max_loop;
 749         u16 value;
 750         u32 buffer[5] = {
 751                 0x00000000,
 752                 0x00D40000,
 753                 0x00000000,
 754                 0x01000000,
 755                 0x00000000,
 756         };
 757
 758         if (ofdm) {
 759                 max_loop = 0x1E;
 760                 buffer[0] = 0x000201CC;
 761         } else {
 762                 max_loop = 0xFA;
 763                 buffer[0] = 0x000B846E;
 764         }
 765
 766         for (i = 0; i < 5; i++)
 767                 b43_ram_write(dev, i * 4, buffer[i]);
 768
 769         b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
 770
 771         if (dev->dev->core_rev < 11)
 772                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
 773         else
 774                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
 775
 776         value = (ofdm ? 0x41 : 0x40);
 777         b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
 778         if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
 779             phy->type == B43_PHYTYPE_LCN)
 780                 b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
 781
 782         b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
 783         b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
 784
 785         b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
 786         b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
 787         b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
 788         b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
 789
 790         if (!pa_on && phy->type == B43_PHYTYPE_N)
 791                 ; /*b43_nphy_pa_override(dev, false) */
 792
 793         switch (phy->type) {
 794         case B43_PHYTYPE_N:
 795         case B43_PHYTYPE_LCN:
 796                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
 797                 break;
 798         case B43_PHYTYPE_LP:
 799                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
 800                 break;
 801         default:
 802                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
 803         }
 804         b43_read16(dev, B43_MMIO_TXE0_AUX);
 805
 806         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 807                 b43_radio_write16(dev, 0x0051, 0x0017);
 808         for (i = 0x00; i < max_loop; i++) {
 809                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 810                 if (value & 0x0080)
 811                         break;
 812                 udelay(10);
 813         }
 814         for (i = 0x00; i < 0x0A; i++) {
 815                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 816                 if (value & 0x0400)
 817                         break;
 818                 udelay(10);
 819         }
 820         for (i = 0x00; i < 0x19; i++) {
 821                 value = b43_read16(dev, B43_MMIO_IFSSTAT);
 822                 if (!(value & 0x0100))
 823                         break;
 824                 udelay(10);
 825         }
 826         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 827                 b43_radio_write16(dev, 0x0051, 0x0037);
 828 }
 829
 830 static void key_write(struct b43_wldev *dev,
 831                       u8 index, u8 algorithm, const u8 *key)
 832 {
 833         unsigned int i;
 834         u32 offset;
 835         u16 value;
 836         u16 kidx;
 837
 838         /* Key index/algo block */
 839         kidx = b43_kidx_to_fw(dev, index);
 840         value = ((kidx << 4) | algorithm);
 841         b43_shm_write16(dev, B43_SHM_SHARED,
 842                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 843
 844         /* Write the key to the Key Table Pointer offset */
 845         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 846         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 847                 value = key[i];
 848                 value |= (u16) (key[i + 1]) << 8;
 849                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 850         }
 851 }
 852
 853 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 854 {
 855         u32 addrtmp[2] = { 0, 0, };
 856         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 857
 858         if (b43_new_kidx_api(dev))
 859                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 860
 861         B43_WARN_ON(index < pairwise_keys_start);
 862         /* We have four default TX keys and possibly four default RX keys.
 863          * Physical mac 0 is mapped to physical key 4 or 8, depending
 864          * on the firmware version.
 865          * So we must adjust the index here.
 866          */
 867         index -= pairwise_keys_start;
 868         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 869
 870         if (addr) {
 871                 addrtmp[0] = addr[0];
 872                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 873                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 874                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 875                 addrtmp[1] = addr[4];
 876                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 877         }
 878
 879         /* Receive match transmitter address (RCMTA) mechanism */
 880         b43_shm_write32(dev, B43_SHM_RCMTA,
 881                         (index * 2) + 0, addrtmp[0]);
 882         b43_shm_write16(dev, B43_SHM_RCMTA,
 883                         (index * 2) + 1, addrtmp[1]);
 884 }
 885
 886 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 887  * When a packet is received, the iv32 is checked.
 888  * - if it doesn't the packet is returned without modification (and software
 889  *   decryption can be done). That's what happen when iv16 wrap.
 890  * - if it does, the rc4 key is computed, and decryption is tried.
 891  *   Either it will success and B43_RX_MAC_DEC is returned,
 892  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 893  *   and the packet is not usable (it got modified by the ucode).
 894  * So in order to never have B43_RX_MAC_DECERR, we should provide
 895  * a iv32 and phase1key that match. Because we drop packets in case of
 896  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 897  * packets will be lost without higher layer knowing (ie no resync possible
 898  * until next wrap).
 899  *
 900  * NOTE : this should support 50 key like RCMTA because
 901  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 902  */
 903 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 904                 u16 *phase1key)
 905 {
 906         unsigned int i;
 907         u32 offset;
 908         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 909
 910         if (!modparam_hwtkip)
 911                 return;
 912
 913         if (b43_new_kidx_api(dev))
 914                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 915
 916         B43_WARN_ON(index < pairwise_keys_start);
 917         /* We have four default TX keys and possibly four default RX keys.
 918          * Physical mac 0 is mapped to physical key 4 or 8, depending
 919          * on the firmware version.
 920          * So we must adjust the index here.
 921          */
 922         index -= pairwise_keys_start;
 923         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 924
 925         if (b43_debug(dev, B43_DBG_KEYS)) {
 926                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 927                                 index, iv32);
 928         }
 929         /* Write the key to the  RX tkip shared mem */
 930         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 931         for (i = 0; i < 10; i += 2) {
 932                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 933                                 phase1key ? phase1key[i / 2] : 0);
 934         }
 935         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 936         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 937 }
 938
 939 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 940                                    struct ieee80211_vif *vif,
 941                                    struct ieee80211_key_conf *keyconf,
 942                                    struct ieee80211_sta *sta,
 943                                    u32 iv32, u16 *phase1key)
 944 {
 945         struct b43_wl *wl = hw_to_b43_wl(hw);
 946         struct b43_wldev *dev;
 947         int index = keyconf->hw_key_idx;
 948
 949         if (B43_WARN_ON(!modparam_hwtkip))
 950                 return;
 951
 952         /* This is only called from the RX path through mac80211, where
 953          * our mutex is already locked. */
 954         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 955         dev = wl->current_dev;
 956         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 957
 958         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 959
 960         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 961         /* only pairwise TKIP keys are supported right now */
 962         if (WARN_ON(!sta))
 963                 return;
 964         keymac_write(dev, index, sta->addr);
 965 }
 966
 967 static void do_key_write(struct b43_wldev *dev,
 968                          u8 index, u8 algorithm,
 969                          const u8 *key, size_t key_len, const u8 *mac_addr)
 970 {
 971         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 972         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 973
 974         if (b43_new_kidx_api(dev))
 975                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 976
 977         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 978         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 979
 980         if (index >= pairwise_keys_start)
 981                 keymac_write(dev, index, NULL); /* First zero out mac. */
 982         if (algorithm == B43_SEC_ALGO_TKIP) {
 983                 /*
 984                  * We should provide an initial iv32, phase1key pair.
 985                  * We could start with iv32=0 and compute the corresponding
 986                  * phase1key, but this means calling ieee80211_get_tkip_key
 987                  * with a fake skb (or export other tkip function).
 988                  * Because we are lazy we hope iv32 won't start with
 989                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 990                  * correct pair.
 991                  */
 992                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 993         } else if (index >= pairwise_keys_start) /* clear it */
 994                 rx_tkip_phase1_write(dev, index, 0, NULL);
 995         if (key)
 996                 memcpy(buf, key, key_len);
 997         key_write(dev, index, algorithm, buf);
 998         if (index >= pairwise_keys_start)
 999                 keymac_write(dev, index, mac_addr);
1000
1001         dev->key[index].algorithm = algorithm;
1002 }
1003
1004 static int b43_key_write(struct b43_wldev *dev,
1005                          int index, u8 algorithm,
1006                          const u8 *key, size_t key_len,
1007                          const u8 *mac_addr,
1008                          struct ieee80211_key_conf *keyconf)
1009 {
1010         int i;
1011         int pairwise_keys_start;
1012
1013         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1014          *      - Temporal Encryption Key (128 bits)
1015          *      - Temporal Authenticator Tx MIC Key (64 bits)
1016          *      - Temporal Authenticator Rx MIC Key (64 bits)
1017          *
1018          *      Hardware only store TEK
1019          */
1020         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1021                 key_len = 16;
1022         if (key_len > B43_SEC_KEYSIZE)
1023                 return -EINVAL;
1024         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1025                 /* Check that we don't already have this key. */
1026                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
1027         }
1028         if (index < 0) {
1029                 /* Pairwise key. Get an empty slot for the key. */
1030                 if (b43_new_kidx_api(dev))
1031                         pairwise_keys_start = B43_NR_GROUP_KEYS;
1032                 else
1033                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1034                 for (i = pairwise_keys_start;
1035                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1036                      i++) {
1037                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1038                         if (!dev->key[i].keyconf) {
1039                                 /* found empty */
1040                                 index = i;
1041                                 break;
1042                         }
1043                 }
1044                 if (index < 0) {
1045                         b43warn(dev->wl, "Out of hardware key memory\n");
1046                         return -ENOSPC;
1047                 }
1048         } else
1049                 B43_WARN_ON(index > 3);
1050
1051         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1052         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1053                 /* Default RX key */
1054                 B43_WARN_ON(mac_addr);
1055                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1056         }
1057         keyconf->hw_key_idx = index;
1058         dev->key[index].keyconf = keyconf;
1059
1060         return 0;
1061 }
1062
1063 static int b43_key_clear(struct b43_wldev *dev, int index)
1064 {
1065         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1066                 return -EINVAL;
1067         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1068                      NULL, B43_SEC_KEYSIZE, NULL);
1069         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1070                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1071                              NULL, B43_SEC_KEYSIZE, NULL);
1072         }
1073         dev->key[index].keyconf = NULL;
1074
1075         return 0;
1076 }
1077
1078 static void b43_clear_keys(struct b43_wldev *dev)
1079 {
1080         int i, count;
1081
1082         if (b43_new_kidx_api(dev))
1083                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1084         else
1085                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1086         for (i = 0; i < count; i++)
1087                 b43_key_clear(dev, i);
1088 }
1089
1090 static void b43_dump_keymemory(struct b43_wldev *dev)
1091 {
1092         unsigned int i, index, count, offset, pairwise_keys_start;
1093         u8 mac[ETH_ALEN];
1094         u16 algo;
1095         u32 rcmta0;
1096         u16 rcmta1;
1097         u64 hf;
1098         struct b43_key *key;
1099
1100         if (!b43_debug(dev, B43_DBG_KEYS))
1101                 return;
1102
1103         hf = b43_hf_read(dev);
1104         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1105                !!(hf & B43_HF_USEDEFKEYS));
1106         if (b43_new_kidx_api(dev)) {
1107                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1108                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1109         } else {
1110                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1111                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1112         }
1113         for (index = 0; index < count; index++) {
1114                 key = &(dev->key[index]);
1115                 printk(KERN_DEBUG "Key slot %02u: %s",
1116                        index, (key->keyconf == NULL) ? " " : "*");
1117                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1118                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1119                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1120                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1121                 }
1122
1123                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1124                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1125                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1126
1127                 if (index >= pairwise_keys_start) {
1128                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1129                                 printk("   TKIP: ");
1130                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1131                                 for (i = 0; i < 14; i += 2) {
1132                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1133                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1134                                 }
1135                         }
1136                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1137                                                 ((index - pairwise_keys_start) * 2) + 0);
1138                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1139                                                 ((index - pairwise_keys_start) * 2) + 1);
1140                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1141                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1142                         printk("   MAC: %pM", mac);
1143                 } else
1144                         printk("   DEFAULT KEY");
1145                 printk("\n");
1146         }
1147 }
1148
1149 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1150 {
1151         u32 macctl;
1152         u16 ucstat;
1153         bool hwps;
1154         bool awake;
1155         int i;
1156
1157         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1158                     (ps_flags & B43_PS_DISABLED));
1159         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1160
1161         if (ps_flags & B43_PS_ENABLED) {
1162                 hwps = true;
1163         } else if (ps_flags & B43_PS_DISABLED) {
1164                 hwps = false;
1165         } else {
1166                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1167                 //      and thus is not an AP and we are associated, set bit 25
1168         }
1169         if (ps_flags & B43_PS_AWAKE) {
1170                 awake = true;
1171         } else if (ps_flags & B43_PS_ASLEEP) {
1172                 awake = false;
1173         } else {
1174                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1175                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1176                 //      successful, set bit26
1177         }
1178
1179 /* FIXME: For now we force awake-on and hwps-off */
1180         hwps = false;
1181         awake = true;
1182
1183         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1184         if (hwps)
1185                 macctl |= B43_MACCTL_HWPS;
1186         else
1187                 macctl &= ~B43_MACCTL_HWPS;
1188         if (awake)
1189                 macctl |= B43_MACCTL_AWAKE;
1190         else
1191                 macctl &= ~B43_MACCTL_AWAKE;
1192         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1193         /* Commit write */
1194         b43_read32(dev, B43_MMIO_MACCTL);
1195         if (awake && dev->dev->core_rev >= 5) {
1196                 /* Wait for the microcode to wake up. */
1197                 for (i = 0; i < 100; i++) {
1198                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1199                                                 B43_SHM_SH_UCODESTAT);
1200                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1201                                 break;
1202                         udelay(10);
1203                 }
1204         }
1205 }
1206
1207 #ifdef CONFIG_B43_BCMA
1208 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1209 {
1210         u32 flags;
1211
1212         /* Put PHY into reset */
1213         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1214         flags |= B43_BCMA_IOCTL_PHY_RESET;
1215         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1216         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1217         udelay(2);
1218
1219         b43_phy_take_out_of_reset(dev);
1220 }
1221
1222 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1223 {
1224         u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1225                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1226         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1227                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
1228         u32 flags;
1229
1230         flags = B43_BCMA_IOCTL_PHY_CLKEN;
1231         if (gmode)
1232                 flags |= B43_BCMA_IOCTL_GMODE;
1233         b43_device_enable(dev, flags);
1234
1235         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1236         b43_bcma_phy_reset(dev);
1237         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1238 }
1239 #endif
1240
1241 #ifdef CONFIG_B43_SSB
1242 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1243 {
1244         u32 flags = 0;
1245
1246         if (gmode)
1247                 flags |= B43_TMSLOW_GMODE;
1248         flags |= B43_TMSLOW_PHYCLKEN;
1249         flags |= B43_TMSLOW_PHYRESET;
1250         if (dev->phy.type == B43_PHYTYPE_N)
1251                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1252         b43_device_enable(dev, flags);
1253         msleep(2);              /* Wait for the PLL to turn on. */
1254
1255         b43_phy_take_out_of_reset(dev);
1256 }
1257 #endif
1258
1259 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1260 {
1261         u32 macctl;
1262
1263         switch (dev->dev->bus_type) {
1264 #ifdef CONFIG_B43_BCMA
1265         case B43_BUS_BCMA:
1266                 b43_bcma_wireless_core_reset(dev, gmode);
1267                 break;
1268 #endif
1269 #ifdef CONFIG_B43_SSB
1270         case B43_BUS_SSB:
1271                 b43_ssb_wireless_core_reset(dev, gmode);
1272                 break;
1273 #endif
1274         }
1275
1276         /* Turn Analog ON, but only if we already know the PHY-type.
1277          * This protects against very early setup where we don't know the
1278          * PHY-type, yet. wireless_core_reset will be called once again later,
1279          * when we know the PHY-type. */
1280         if (dev->phy.ops)
1281                 dev->phy.ops->switch_analog(dev, 1);
1282
1283         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1284         macctl &= ~B43_MACCTL_GMODE;
1285         if (gmode)
1286                 macctl |= B43_MACCTL_GMODE;
1287         macctl |= B43_MACCTL_IHR_ENABLED;
1288         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1289 }
1290
1291 static void handle_irq_transmit_status(struct b43_wldev *dev)
1292 {
1293         u32 v0, v1;
1294         u16 tmp;
1295         struct b43_txstatus stat;
1296
1297         while (1) {
1298                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1299                 if (!(v0 & 0x00000001))
1300                         break;
1301                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1302
1303                 stat.cookie = (v0 >> 16);
1304                 stat.seq = (v1 & 0x0000FFFF);
1305                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1306                 tmp = (v0 & 0x0000FFFF);
1307                 stat.frame_count = ((tmp & 0xF000) >> 12);
1308                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1309                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1310                 stat.pm_indicated = !!(tmp & 0x0080);
1311                 stat.intermediate = !!(tmp & 0x0040);
1312                 stat.for_ampdu = !!(tmp & 0x0020);
1313                 stat.acked = !!(tmp & 0x0002);
1314
1315                 b43_handle_txstatus(dev, &stat);
1316         }
1317 }
1318
1319 static void drain_txstatus_queue(struct b43_wldev *dev)
1320 {
1321         u32 dummy;
1322
1323         if (dev->dev->core_rev < 5)
1324                 return;
1325         /* Read all entries from the microcode TXstatus FIFO
1326          * and throw them away.
1327          */
1328         while (1) {
1329                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1330                 if (!(dummy & 0x00000001))
1331                         break;
1332                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1333         }
1334 }
1335
1336 static u32 b43_jssi_read(struct b43_wldev *dev)
1337 {
1338         u32 val = 0;
1339
1340         val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1341         val <<= 16;
1342         val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1343
1344         return val;
1345 }
1346
1347 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1348 {
1349         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1350                         (jssi & 0x0000FFFF));
1351         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1352                         (jssi & 0xFFFF0000) >> 16);
1353 }
1354
1355 static void b43_generate_noise_sample(struct b43_wldev *dev)
1356 {
1357         b43_jssi_write(dev, 0x7F7F7F7F);
1358         b43_write32(dev, B43_MMIO_MACCMD,
1359                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1360 }
1361
1362 static void b43_calculate_link_quality(struct b43_wldev *dev)
1363 {
1364         /* Top half of Link Quality calculation. */
1365
1366         if (dev->phy.type != B43_PHYTYPE_G)
1367                 return;
1368         if (dev->noisecalc.calculation_running)
1369                 return;
1370         dev->noisecalc.calculation_running = true;
1371         dev->noisecalc.nr_samples = 0;
1372
1373         b43_generate_noise_sample(dev);
1374 }
1375
1376 static void handle_irq_noise(struct b43_wldev *dev)
1377 {
1378         struct b43_phy_g *phy = dev->phy.g;
1379         u16 tmp;
1380         u8 noise[4];
1381         u8 i, j;
1382         s32 average;
1383
1384         /* Bottom half of Link Quality calculation. */
1385
1386         if (dev->phy.type != B43_PHYTYPE_G)
1387                 return;
1388
1389         /* Possible race condition: It might be possible that the user
1390          * changed to a different channel in the meantime since we
1391          * started the calculation. We ignore that fact, since it's
1392          * not really that much of a problem. The background noise is
1393          * an estimation only anyway. Slightly wrong results will get damped
1394          * by the averaging of the 8 sample rounds. Additionally the
1395          * value is shortlived. So it will be replaced by the next noise
1396          * calculation round soon. */
1397
1398         B43_WARN_ON(!dev->noisecalc.calculation_running);
1399         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1400         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1401             noise[2] == 0x7F || noise[3] == 0x7F)
1402                 goto generate_new;
1403
1404         /* Get the noise samples. */
1405         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1406         i = dev->noisecalc.nr_samples;
1407         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1408         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1409         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1410         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1411         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1412         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1413         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1414         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1415         dev->noisecalc.nr_samples++;
1416         if (dev->noisecalc.nr_samples == 8) {
1417                 /* Calculate the Link Quality by the noise samples. */
1418                 average = 0;
1419                 for (i = 0; i < 8; i++) {
1420                         for (j = 0; j < 4; j++)
1421                                 average += dev->noisecalc.samples[i][j];
1422                 }
1423                 average /= (8 * 4);
1424                 average *= 125;
1425                 average += 64;
1426                 average /= 128;
1427                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1428                 tmp = (tmp / 128) & 0x1F;
1429                 if (tmp >= 8)
1430                         average += 2;
1431                 else
1432                         average -= 25;
1433                 if (tmp == 8)
1434                         average -= 72;
1435                 else
1436                         average -= 48;
1437
1438                 dev->stats.link_noise = average;
1439                 dev->noisecalc.calculation_running = false;
1440                 return;
1441         }
1442 generate_new:
1443         b43_generate_noise_sample(dev);
1444 }
1445
1446 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1447 {
1448         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1449                 ///TODO: PS TBTT
1450         } else {
1451                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1452                         b43_power_saving_ctl_bits(dev, 0);
1453         }
1454         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1455                 dev->dfq_valid = true;
1456 }
1457
1458 static void handle_irq_atim_end(struct b43_wldev *dev)
1459 {
1460         if (dev->dfq_valid) {
1461                 b43_write32(dev, B43_MMIO_MACCMD,
1462                             b43_read32(dev, B43_MMIO_MACCMD)
1463                             | B43_MACCMD_DFQ_VALID);
1464                 dev->dfq_valid = false;
1465         }
1466 }
1467
1468 static void handle_irq_pmq(struct b43_wldev *dev)
1469 {
1470         u32 tmp;
1471
1472         //TODO: AP mode.
1473
1474         while (1) {
1475                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1476                 if (!(tmp & 0x00000008))
1477                         break;
1478         }
1479         /* 16bit write is odd, but correct. */
1480         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1481 }
1482
1483 static void b43_write_template_common(struct b43_wldev *dev,
1484                                       const u8 *data, u16 size,
1485                                       u16 ram_offset,
1486                                       u16 shm_size_offset, u8 rate)
1487 {
1488         u32 i, tmp;
1489         struct b43_plcp_hdr4 plcp;
1490
1491         plcp.data = 0;
1492         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1493         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1494         ram_offset += sizeof(u32);
1495         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1496          * So leave the first two bytes of the next write blank.
1497          */
1498         tmp = (u32) (data[0]) << 16;
1499         tmp |= (u32) (data[1]) << 24;
1500         b43_ram_write(dev, ram_offset, tmp);
1501         ram_offset += sizeof(u32);
1502         for (i = 2; i < size; i += sizeof(u32)) {
1503                 tmp = (u32) (data[i + 0]);
1504                 if (i + 1 < size)
1505                         tmp |= (u32) (data[i + 1]) << 8;
1506                 if (i + 2 < size)
1507                         tmp |= (u32) (data[i + 2]) << 16;
1508                 if (i + 3 < size)
1509                         tmp |= (u32) (data[i + 3]) << 24;
1510                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1511         }
1512         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1513                         size + sizeof(struct b43_plcp_hdr6));
1514 }
1515
1516 /* Check if the use of the antenna that ieee80211 told us to
1517  * use is possible. This will fall back to DEFAULT.
1518  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1519 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1520                                   u8 antenna_nr)
1521 {
1522         u8 antenna_mask;
1523
1524         if (antenna_nr == 0) {
1525                 /* Zero means "use default antenna". That's always OK. */
1526                 return 0;
1527         }
1528
1529         /* Get the mask of available antennas. */
1530         if (dev->phy.gmode)
1531                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1532         else
1533                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1534
1535         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1536                 /* This antenna is not available. Fall back to default. */
1537                 return 0;
1538         }
1539
1540         return antenna_nr;
1541 }
1542
1543 /* Convert a b43 antenna number value to the PHY TX control value. */
1544 static u16 b43_antenna_to_phyctl(int antenna)
1545 {
1546         switch (antenna) {
1547         case B43_ANTENNA0:
1548                 return B43_TXH_PHY_ANT0;
1549         case B43_ANTENNA1:
1550                 return B43_TXH_PHY_ANT1;
1551         case B43_ANTENNA2:
1552                 return B43_TXH_PHY_ANT2;
1553         case B43_ANTENNA3:
1554                 return B43_TXH_PHY_ANT3;
1555         case B43_ANTENNA_AUTO0:
1556         case B43_ANTENNA_AUTO1:
1557                 return B43_TXH_PHY_ANT01AUTO;
1558         }
1559         B43_WARN_ON(1);
1560         return 0;
1561 }
1562
1563 static void b43_write_beacon_template(struct b43_wldev *dev,
1564                                       u16 ram_offset,
1565                                       u16 shm_size_offset)
1566 {
1567         unsigned int i, len, variable_len;
1568         const struct ieee80211_mgmt *bcn;
1569         const u8 *ie;
1570         bool tim_found = false;
1571         unsigned int rate;
1572         u16 ctl;
1573         int antenna;
1574         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1575
1576         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1577         len = min_t(size_t, dev->wl->current_beacon->len,
1578                   0x200 - sizeof(struct b43_plcp_hdr6));
1579         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1580
1581         b43_write_template_common(dev, (const u8 *)bcn,
1582                                   len, ram_offset, shm_size_offset, rate);
1583
1584         /* Write the PHY TX control parameters. */
1585         antenna = B43_ANTENNA_DEFAULT;
1586         antenna = b43_antenna_to_phyctl(antenna);
1587         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1588         /* We can't send beacons with short preamble. Would get PHY errors. */
1589         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1590         ctl &= ~B43_TXH_PHY_ANT;
1591         ctl &= ~B43_TXH_PHY_ENC;
1592         ctl |= antenna;
1593         if (b43_is_cck_rate(rate))
1594                 ctl |= B43_TXH_PHY_ENC_CCK;
1595         else
1596                 ctl |= B43_TXH_PHY_ENC_OFDM;
1597         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1598
1599         /* Find the position of the TIM and the DTIM_period value
1600          * and write them to SHM. */
1601         ie = bcn->u.beacon.variable;
1602         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1603         for (i = 0; i < variable_len - 2; ) {
1604                 uint8_t ie_id, ie_len;
1605
1606                 ie_id = ie[i];
1607                 ie_len = ie[i + 1];
1608                 if (ie_id == 5) {
1609                         u16 tim_position;
1610                         u16 dtim_period;
1611                         /* This is the TIM Information Element */
1612
1613                         /* Check whether the ie_len is in the beacon data range. */
1614                         if (variable_len < ie_len + 2 + i)
1615                                 break;
1616                         /* A valid TIM is at least 4 bytes long. */
1617                         if (ie_len < 4)
1618                                 break;
1619                         tim_found = true;
1620
1621                         tim_position = sizeof(struct b43_plcp_hdr6);
1622                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1623                         tim_position += i;
1624
1625                         dtim_period = ie[i + 3];
1626
1627                         b43_shm_write16(dev, B43_SHM_SHARED,
1628                                         B43_SHM_SH_TIMBPOS, tim_position);
1629                         b43_shm_write16(dev, B43_SHM_SHARED,
1630                                         B43_SHM_SH_DTIMPER, dtim_period);
1631                         break;
1632                 }
1633                 i += ie_len + 2;
1634         }
1635         if (!tim_found) {
1636                 /*
1637                  * If ucode wants to modify TIM do it behind the beacon, this
1638                  * will happen, for example, when doing mesh networking.
1639                  */
1640                 b43_shm_write16(dev, B43_SHM_SHARED,
1641                                 B43_SHM_SH_TIMBPOS,
1642                                 len + sizeof(struct b43_plcp_hdr6));
1643                 b43_shm_write16(dev, B43_SHM_SHARED,
1644                                 B43_SHM_SH_DTIMPER, 0);
1645         }
1646         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1647 }
1648
1649 static void b43_upload_beacon0(struct b43_wldev *dev)
1650 {
1651         struct b43_wl *wl = dev->wl;
1652
1653         if (wl->beacon0_uploaded)
1654                 return;
1655         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1656         wl->beacon0_uploaded = true;
1657 }
1658
1659 static void b43_upload_beacon1(struct b43_wldev *dev)
1660 {
1661         struct b43_wl *wl = dev->wl;
1662
1663         if (wl->beacon1_uploaded)
1664                 return;
1665         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1666         wl->beacon1_uploaded = true;
1667 }
1668
1669 static void handle_irq_beacon(struct b43_wldev *dev)
1670 {
1671         struct b43_wl *wl = dev->wl;
1672         u32 cmd, beacon0_valid, beacon1_valid;
1673
1674         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1675             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1676             !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1677                 return;
1678
1679         /* This is the bottom half of the asynchronous beacon update. */
1680
1681         /* Ignore interrupt in the future. */
1682         dev->irq_mask &= ~B43_IRQ_BEACON;
1683
1684         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1685         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1686         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1687
1688         /* Schedule interrupt manually, if busy. */
1689         if (beacon0_valid && beacon1_valid) {
1690                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1691                 dev->irq_mask |= B43_IRQ_BEACON;
1692                 return;
1693         }
1694
1695         if (unlikely(wl->beacon_templates_virgin)) {
1696                 /* We never uploaded a beacon before.
1697                  * Upload both templates now, but only mark one valid. */
1698                 wl->beacon_templates_virgin = false;
1699                 b43_upload_beacon0(dev);
1700                 b43_upload_beacon1(dev);
1701                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1702                 cmd |= B43_MACCMD_BEACON0_VALID;
1703                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1704         } else {
1705                 if (!beacon0_valid) {
1706                         b43_upload_beacon0(dev);
1707                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1708                         cmd |= B43_MACCMD_BEACON0_VALID;
1709                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1710                 } else if (!beacon1_valid) {
1711                         b43_upload_beacon1(dev);
1712                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1713                         cmd |= B43_MACCMD_BEACON1_VALID;
1714                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1715                 }
1716         }
1717 }
1718
1719 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1720 {
1721         u32 old_irq_mask = dev->irq_mask;
1722
1723         /* update beacon right away or defer to irq */
1724         handle_irq_beacon(dev);
1725         if (old_irq_mask != dev->irq_mask) {
1726                 /* The handler updated the IRQ mask. */
1727                 B43_WARN_ON(!dev->irq_mask);
1728                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1729                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1730                 } else {
1731                         /* Device interrupts are currently disabled. That means
1732                          * we just ran the hardirq handler and scheduled the
1733                          * IRQ thread. The thread will write the IRQ mask when
1734                          * it finished, so there's nothing to do here. Writing
1735                          * the mask _here_ would incorrectly re-enable IRQs. */
1736                 }
1737         }
1738 }
1739
1740 static void b43_beacon_update_trigger_work(struct work_struct *work)
1741 {
1742         struct b43_wl *wl = container_of(work, struct b43_wl,
1743                                          beacon_update_trigger);
1744         struct b43_wldev *dev;
1745
1746         mutex_lock(&wl->mutex);
1747         dev = wl->current_dev;
1748         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1749                 if (b43_bus_host_is_sdio(dev->dev)) {
1750                         /* wl->mutex is enough. */
1751                         b43_do_beacon_update_trigger_work(dev);
1752                         mmiowb();
1753                 } else {
1754                         spin_lock_irq(&wl->hardirq_lock);
1755                         b43_do_beacon_update_trigger_work(dev);
1756                         mmiowb();
1757                         spin_unlock_irq(&wl->hardirq_lock);
1758                 }
1759         }
1760         mutex_unlock(&wl->mutex);
1761 }
1762
1763 /* Asynchronously update the packet templates in template RAM.
1764  * Locking: Requires wl->mutex to be locked. */
1765 static void b43_update_templates(struct b43_wl *wl)
1766 {
1767         struct sk_buff *beacon;
1768
1769         /* This is the top half of the ansynchronous beacon update.
1770          * The bottom half is the beacon IRQ.
1771          * Beacon update must be asynchronous to avoid sending an
1772          * invalid beacon. This can happen for example, if the firmware
1773          * transmits a beacon while we are updating it. */
1774
1775         /* We could modify the existing beacon and set the aid bit in
1776          * the TIM field, but that would probably require resizing and
1777          * moving of data within the beacon template.
1778          * Simply request a new beacon and let mac80211 do the hard work. */
1779         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1780         if (unlikely(!beacon))
1781                 return;
1782
1783         if (wl->current_beacon)
1784                 dev_kfree_skb_any(wl->current_beacon);
1785         wl->current_beacon = beacon;
1786         wl->beacon0_uploaded = false;
1787         wl->beacon1_uploaded = false;
1788         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1789 }
1790
1791 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1792 {
1793         b43_time_lock(dev);
1794         if (dev->dev->core_rev >= 3) {
1795                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1796                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1797         } else {
1798                 b43_write16(dev, 0x606, (beacon_int >> 6));
1799                 b43_write16(dev, 0x610, beacon_int);
1800         }
1801         b43_time_unlock(dev);
1802         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1803 }
1804
1805 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1806 {
1807         u16 reason;
1808
1809         /* Read the register that contains the reason code for the panic. */
1810         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1811         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1812
1813         switch (reason) {
1814         default:
1815                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1816                 /* fallthrough */
1817         case B43_FWPANIC_DIE:
1818                 /* Do not restart the controller or firmware.
1819                  * The device is nonfunctional from now on.
1820                  * Restarting would result in this panic to trigger again,
1821                  * so we avoid that recursion. */
1822                 break;
1823         case B43_FWPANIC_RESTART:
1824                 b43_controller_restart(dev, "Microcode panic");
1825                 break;
1826         }
1827 }
1828
1829 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1830 {
1831         unsigned int i, cnt;
1832         u16 reason, marker_id, marker_line;
1833         __le16 *buf;
1834
1835         /* The proprietary firmware doesn't have this IRQ. */
1836         if (!dev->fw.opensource)
1837                 return;
1838
1839         /* Read the register that contains the reason code for this IRQ. */
1840         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1841
1842         switch (reason) {
1843         case B43_DEBUGIRQ_PANIC:
1844                 b43_handle_firmware_panic(dev);
1845                 break;
1846         case B43_DEBUGIRQ_DUMP_SHM:
1847                 if (!B43_DEBUG)
1848                         break; /* Only with driver debugging enabled. */
1849                 buf = kmalloc(4096, GFP_ATOMIC);
1850                 if (!buf) {
1851                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1852                         goto out;
1853                 }
1854                 for (i = 0; i < 4096; i += 2) {
1855                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1856                         buf[i / 2] = cpu_to_le16(tmp);
1857                 }
1858                 b43info(dev->wl, "Shared memory dump:\n");
1859                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1860                                16, 2, buf, 4096, 1);
1861                 kfree(buf);
1862                 break;
1863         case B43_DEBUGIRQ_DUMP_REGS:
1864                 if (!B43_DEBUG)
1865                         break; /* Only with driver debugging enabled. */
1866                 b43info(dev->wl, "Microcode register dump:\n");
1867                 for (i = 0, cnt = 0; i < 64; i++) {
1868                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1869                         if (cnt == 0)
1870                                 printk(KERN_INFO);
1871                         printk("r%02u: 0x%04X  ", i, tmp);
1872                         cnt++;
1873                         if (cnt == 6) {
1874                                 printk("\n");
1875                                 cnt = 0;
1876                         }
1877                 }
1878                 printk("\n");
1879                 break;
1880         case B43_DEBUGIRQ_MARKER:
1881                 if (!B43_DEBUG)
1882                         break; /* Only with driver debugging enabled. */
1883                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1884                                            B43_MARKER_ID_REG);
1885                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1886                                              B43_MARKER_LINE_REG);
1887                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1888                         "at line number %u\n",
1889                         marker_id, marker_line);
1890                 break;
1891         default:
1892                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1893                        reason);
1894         }
1895 out:
1896         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1897         b43_shm_write16(dev, B43_SHM_SCRATCH,
1898                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1899 }
1900
1901 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1902 {
1903         u32 reason;
1904         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1905         u32 merged_dma_reason = 0;
1906         int i;
1907
1908         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1909                 return;
1910
1911         reason = dev->irq_reason;
1912         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1913                 dma_reason[i] = dev->dma_reason[i];
1914                 merged_dma_reason |= dma_reason[i];
1915         }
1916
1917         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1918                 b43err(dev->wl, "MAC transmission error\n");
1919
1920         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1921                 b43err(dev->wl, "PHY transmission error\n");
1922                 rmb();
1923                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1924                         atomic_set(&dev->phy.txerr_cnt,
1925                                    B43_PHY_TX_BADNESS_LIMIT);
1926                         b43err(dev->wl, "Too many PHY TX errors, "
1927                                         "restarting the controller\n");
1928                         b43_controller_restart(dev, "PHY TX errors");
1929                 }
1930         }
1931
1932         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
1933                 b43err(dev->wl,
1934                         "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1935                         dma_reason[0], dma_reason[1],
1936                         dma_reason[2], dma_reason[3],
1937                         dma_reason[4], dma_reason[5]);
1938                 b43err(dev->wl, "This device does not support DMA "
1939                                "on your system. It will now be switched to PIO.\n");
1940                 /* Fall back to PIO transfers if we get fatal DMA errors! */
1941                 dev->use_pio = true;
1942                 b43_controller_restart(dev, "DMA error");
1943                 return;
1944         }
1945
1946         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1947                 handle_irq_ucode_debug(dev);
1948         if (reason & B43_IRQ_TBTT_INDI)
1949                 handle_irq_tbtt_indication(dev);
1950         if (reason & B43_IRQ_ATIM_END)
1951                 handle_irq_atim_end(dev);
1952         if (reason & B43_IRQ_BEACON)
1953                 handle_irq_beacon(dev);
1954         if (reason & B43_IRQ_PMQ)
1955                 handle_irq_pmq(dev);
1956         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1957                 ;/* TODO */
1958         if (reason & B43_IRQ_NOISESAMPLE_OK)
1959                 handle_irq_noise(dev);
1960
1961         /* Check the DMA reason registers for received data. */
1962         if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
1963                 if (B43_DEBUG)
1964                         b43warn(dev->wl, "RX descriptor underrun\n");
1965                 b43_dma_handle_rx_overflow(dev->dma.rx_ring);
1966         }
1967         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1968                 if (b43_using_pio_transfers(dev))
1969                         b43_pio_rx(dev->pio.rx_queue);
1970                 else
1971                         b43_dma_rx(dev->dma.rx_ring);
1972         }
1973         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1974         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1975         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1976         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1977         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1978
1979         if (reason & B43_IRQ_TX_OK)
1980                 handle_irq_transmit_status(dev);
1981
1982         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1983         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1984
1985 #if B43_DEBUG
1986         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1987                 dev->irq_count++;
1988                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1989                         if (reason & (1 << i))
1990                                 dev->irq_bit_count[i]++;
1991                 }
1992         }
1993 #endif
1994 }
1995
1996 /* Interrupt thread handler. Handles device interrupts in thread context. */
1997 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1998 {
1999         struct b43_wldev *dev = dev_id;
2000
2001         mutex_lock(&dev->wl->mutex);
2002         b43_do_interrupt_thread(dev);
2003         mmiowb();
2004         mutex_unlock(&dev->wl->mutex);
2005
2006         return IRQ_HANDLED;
2007 }
2008
2009 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2010 {
2011         u32 reason;
2012
2013         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2014          * On SDIO, this runs under wl->mutex. */
2015
2016         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2017         if (reason == 0xffffffff)       /* shared IRQ */
2018                 return IRQ_NONE;
2019         reason &= dev->irq_mask;
2020         if (!reason)
2021                 return IRQ_NONE;
2022
2023         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2024             & 0x0001FC00;
2025         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2026             & 0x0000DC00;
2027         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2028             & 0x0000DC00;
2029         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2030             & 0x0001DC00;
2031         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2032             & 0x0000DC00;
2033 /* Unused ring
2034         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2035             & 0x0000DC00;
2036 */
2037
2038         /* ACK the interrupt. */
2039         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2040         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2041         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2042         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2043         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2044         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2045 /* Unused ring
2046         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2047 */
2048
2049         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2050         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2051         /* Save the reason bitmasks for the IRQ thread handler. */
2052         dev->irq_reason = reason;
2053
2054         return IRQ_WAKE_THREAD;
2055 }
2056
2057 /* Interrupt handler top-half. This runs with interrupts disabled. */
2058 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2059 {
2060         struct b43_wldev *dev = dev_id;
2061         irqreturn_t ret;
2062
2063         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2064                 return IRQ_NONE;
2065
2066         spin_lock(&dev->wl->hardirq_lock);
2067         ret = b43_do_interrupt(dev);
2068         mmiowb();
2069         spin_unlock(&dev->wl->hardirq_lock);
2070
2071         return ret;
2072 }
2073
2074 /* SDIO interrupt handler. This runs in process context. */
2075 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2076 {
2077         struct b43_wl *wl = dev->wl;
2078         irqreturn_t ret;
2079
2080         mutex_lock(&wl->mutex);
2081
2082         ret = b43_do_interrupt(dev);
2083         if (ret == IRQ_WAKE_THREAD)
2084                 b43_do_interrupt_thread(dev);
2085
2086         mutex_unlock(&wl->mutex);
2087 }
2088
2089 void b43_do_release_fw(struct b43_firmware_file *fw)
2090 {
2091         release_firmware(fw->data);
2092         fw->data = NULL;
2093         fw->filename = NULL;
2094 }
2095
2096 static void b43_release_firmware(struct b43_wldev *dev)
2097 {
2098         complete(&dev->fw_load_complete);
2099         b43_do_release_fw(&dev->fw.ucode);
2100         b43_do_release_fw(&dev->fw.pcm);
2101         b43_do_release_fw(&dev->fw.initvals);
2102         b43_do_release_fw(&dev->fw.initvals_band);
2103 }
2104
2105 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2106 {
2107         const char text[] =
2108                 "You must go to " \
2109                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2110                 "and download the correct firmware for this driver version. " \
2111                 "Please carefully read all instructions on this website.\n";
2112
2113         if (error)
2114                 b43err(wl, text);
2115         else
2116                 b43warn(wl, text);
2117 }
2118
2119 static void b43_fw_cb(const struct firmware *firmware, void *context)
2120 {
2121         struct b43_request_fw_context *ctx = context;
2122
2123         ctx->blob = firmware;
2124         complete(&ctx->dev->fw_load_complete);
2125 }
2126
2127 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2128                       const char *name,
2129                       struct b43_firmware_file *fw, bool async)
2130 {
2131         struct b43_fw_header *hdr;
2132         u32 size;
2133         int err;
2134
2135         if (!name) {
2136                 /* Don't fetch anything. Free possibly cached firmware. */
2137                 /* FIXME: We should probably keep it anyway, to save some headache
2138                  * on suspend/resume with multiband devices. */
2139                 b43_do_release_fw(fw);
2140                 return 0;
2141         }
2142         if (fw->filename) {
2143                 if ((fw->type == ctx->req_type) &&
2144                     (strcmp(fw->filename, name) == 0))
2145                         return 0; /* Already have this fw. */
2146                 /* Free the cached firmware first. */
2147                 /* FIXME: We should probably do this later after we successfully
2148                  * got the new fw. This could reduce headache with multiband devices.
2149                  * We could also redesign this to cache the firmware for all possible
2150                  * bands all the time. */
2151                 b43_do_release_fw(fw);
2152         }
2153
2154         switch (ctx->req_type) {
2155         case B43_FWTYPE_PROPRIETARY:
2156                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2157                          "b43%s/%s.fw",
2158                          modparam_fwpostfix, name);
2159                 break;
2160         case B43_FWTYPE_OPENSOURCE:
2161                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2162                          "b43-open%s/%s.fw",
2163                          modparam_fwpostfix, name);
2164                 break;
2165         default:
2166                 B43_WARN_ON(1);
2167                 return -ENOSYS;
2168         }
2169         if (async) {
2170                 /* do this part asynchronously */
2171                 init_completion(&ctx->dev->fw_load_complete);
2172                 err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2173                                               ctx->dev->dev->dev, GFP_KERNEL,
2174                                               ctx, b43_fw_cb);
2175                 if (err < 0) {
2176                         pr_err("Unable to load firmware\n");
2177                         return err;
2178                 }
2179                 wait_for_completion(&ctx->dev->fw_load_complete);
2180                 if (ctx->blob)
2181                         goto fw_ready;
2182         /* On some ARM systems, the async request will fail, but the next sync
2183          * request works. For this reason, we fall through here
2184          */
2185         }
2186         err = request_firmware(&ctx->blob, ctx->fwname,
2187                                ctx->dev->dev->dev);
2188         if (err == -ENOENT) {
2189                 snprintf(ctx->errors[ctx->req_type],
2190                          sizeof(ctx->errors[ctx->req_type]),
2191                          "Firmware file \"%s\" not found\n",
2192                          ctx->fwname);
2193                 return err;
2194         } else if (err) {
2195                 snprintf(ctx->errors[ctx->req_type],
2196                          sizeof(ctx->errors[ctx->req_type]),
2197                          "Firmware file \"%s\" request failed (err=%d)\n",
2198                          ctx->fwname, err);
2199                 return err;
2200         }
2201 fw_ready:
2202         if (ctx->blob->size < sizeof(struct b43_fw_header))
2203                 goto err_format;
2204         hdr = (struct b43_fw_header *)(ctx->blob->data);
2205         switch (hdr->type) {
2206         case B43_FW_TYPE_UCODE:
2207         case B43_FW_TYPE_PCM:
2208                 size = be32_to_cpu(hdr->size);
2209                 if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2210                         goto err_format;
2211                 /* fallthrough */
2212         case B43_FW_TYPE_IV:
2213                 if (hdr->ver != 1)
2214                         goto err_format;
2215                 break;
2216         default:
2217                 goto err_format;
2218         }
2219
2220         fw->data = ctx->blob;
2221         fw->filename = name;
2222         fw->type = ctx->req_type;
2223
2224         return 0;
2225
2226 err_format:
2227         snprintf(ctx->errors[ctx->req_type],
2228                  sizeof(ctx->errors[ctx->req_type]),
2229                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2230         release_firmware(ctx->blob);
2231
2232         return -EPROTO;
2233 }
2234
2235 /* http://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2236 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2237 {
2238         struct b43_wldev *dev = ctx->dev;
2239         struct b43_firmware *fw = &ctx->dev->fw;
2240         struct b43_phy *phy = &dev->phy;
2241         const u8 rev = ctx->dev->dev->core_rev;
2242         const char *filename;
2243         int err;
2244
2245         /* Get microcode */
2246         filename = NULL;
2247         switch (rev) {
2248         case 42:
2249                 if (phy->type == B43_PHYTYPE_AC)
2250                         filename = "ucode42";
2251                 break;
2252         case 40:
2253                 if (phy->type == B43_PHYTYPE_AC)
2254                         filename = "ucode40";
2255                 break;
2256         case 33:
2257                 if (phy->type == B43_PHYTYPE_LCN40)
2258                         filename = "ucode33_lcn40";
2259                 break;
2260         case 30:
2261                 if (phy->type == B43_PHYTYPE_N)
2262                         filename = "ucode30_mimo";
2263                 break;
2264         case 29:
2265                 if (phy->type == B43_PHYTYPE_HT)
2266                         filename = "ucode29_mimo";
2267                 break;
2268         case 26:
2269                 if (phy->type == B43_PHYTYPE_HT)
2270                         filename = "ucode26_mimo";
2271                 break;
2272         case 28:
2273         case 25:
2274                 if (phy->type == B43_PHYTYPE_N)
2275                         filename = "ucode25_mimo";
2276                 else if (phy->type == B43_PHYTYPE_LCN)
2277                         filename = "ucode25_lcn";
2278                 break;
2279         case 24:
2280                 if (phy->type == B43_PHYTYPE_LCN)
2281                         filename = "ucode24_lcn";
2282                 break;
2283         case 23:
2284                 if (phy->type == B43_PHYTYPE_N)
2285                         filename = "ucode16_mimo";
2286                 break;
2287         case 16 ... 19:
2288                 if (phy->type == B43_PHYTYPE_N)
2289                         filename = "ucode16_mimo";
2290                 else if (phy->type == B43_PHYTYPE_LP)
2291                         filename = "ucode16_lp";
2292                 break;
2293         case 15:
2294                 filename = "ucode15";
2295                 break;
2296         case 14:
2297                 filename = "ucode14";
2298                 break;
2299         case 13:
2300                 filename = "ucode13";
2301                 break;
2302         case 11 ... 12:
2303                 filename = "ucode11";
2304                 break;
2305         case 5 ... 10:
2306                 filename = "ucode5";
2307                 break;
2308         }
2309         if (!filename)
2310                 goto err_no_ucode;
2311         err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2312         if (err)
2313                 goto err_load;
2314
2315         /* Get PCM code */
2316         if ((rev >= 5) && (rev <= 10))
2317                 filename = "pcm5";
2318         else if (rev >= 11)
2319                 filename = NULL;
2320         else
2321                 goto err_no_pcm;
2322         fw->pcm_request_failed = false;
2323         err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2324         if (err == -ENOENT) {
2325                 /* We did not find a PCM file? Not fatal, but
2326                  * core rev <= 10 must do without hwcrypto then. */
2327                 fw->pcm_request_failed = true;
2328         } else if (err)
2329                 goto err_load;
2330
2331         /* Get initvals */
2332         filename = NULL;
2333         switch (dev->phy.type) {
2334         case B43_PHYTYPE_G:
2335                 if (rev == 13)
2336                         filename = "b0g0initvals13";
2337                 else if (rev >= 5 && rev <= 10)
2338                         filename = "b0g0initvals5";
2339                 break;
2340         case B43_PHYTYPE_N:
2341                 if (rev == 30)
2342                         filename = "n16initvals30";
2343                 else if (rev == 28 || rev == 25)
2344                         filename = "n0initvals25";
2345                 else if (rev == 24)
2346                         filename = "n0initvals24";
2347                 else if (rev == 23)
2348                         filename = "n0initvals16"; /* What about n0initvals22? */
2349                 else if (rev >= 16 && rev <= 18)
2350                         filename = "n0initvals16";
2351                 else if (rev >= 11 && rev <= 12)
2352                         filename = "n0initvals11";
2353                 break;
2354         case B43_PHYTYPE_LP:
2355                 if (rev >= 16 && rev <= 18)
2356                         filename = "lp0initvals16";
2357                 else if (rev == 15)
2358                         filename = "lp0initvals15";
2359                 else if (rev == 14)
2360                         filename = "lp0initvals14";
2361                 else if (rev == 13)
2362                         filename = "lp0initvals13";
2363                 break;
2364         case B43_PHYTYPE_HT:
2365                 if (rev == 29)
2366                         filename = "ht0initvals29";
2367                 else if (rev == 26)
2368                         filename = "ht0initvals26";
2369                 break;
2370         case B43_PHYTYPE_LCN:
2371                 if (rev == 24)
2372                         filename = "lcn0initvals24";
2373                 break;
2374         case B43_PHYTYPE_LCN40:
2375                 if (rev == 33)
2376                         filename = "lcn400initvals33";
2377                 break;
2378         case B43_PHYTYPE_AC:
2379                 if (rev == 42)
2380                         filename = "ac1initvals42";
2381                 else if (rev == 40)
2382                         filename = "ac0initvals40";
2383                 break;
2384         }
2385         if (!filename)
2386                 goto err_no_initvals;
2387         err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2388         if (err)
2389                 goto err_load;
2390
2391         /* Get bandswitch initvals */
2392         filename = NULL;
2393         switch (dev->phy.type) {
2394         case B43_PHYTYPE_G:
2395                 if (rev == 13)
2396                         filename = "b0g0bsinitvals13";
2397                 else if (rev >= 5 && rev <= 10)
2398                         filename = "b0g0bsinitvals5";
2399                 break;
2400         case B43_PHYTYPE_N:
2401                 if (rev == 30)
2402                         filename = "n16bsinitvals30";
2403                 else if (rev == 28 || rev == 25)
2404                         filename = "n0bsinitvals25";
2405                 else if (rev == 24)
2406                         filename = "n0bsinitvals24";
2407                 else if (rev == 23)
2408                         filename = "n0bsinitvals16"; /* What about n0bsinitvals22? */
2409                 else if (rev >= 16 && rev <= 18)
2410                         filename = "n0bsinitvals16";
2411                 else if (rev >= 11 && rev <= 12)
2412                         filename = "n0bsinitvals11";
2413                 break;
2414         case B43_PHYTYPE_LP:
2415                 if (rev >= 16 && rev <= 18)
2416                         filename = "lp0bsinitvals16";
2417                 else if (rev == 15)
2418                         filename = "lp0bsinitvals15";
2419                 else if (rev == 14)
2420                         filename = "lp0bsinitvals14";
2421                 else if (rev == 13)
2422                         filename = "lp0bsinitvals13";
2423                 break;
2424         case B43_PHYTYPE_HT:
2425                 if (rev == 29)
2426                         filename = "ht0bsinitvals29";
2427                 else if (rev == 26)
2428                         filename = "ht0bsinitvals26";
2429                 break;
2430         case B43_PHYTYPE_LCN:
2431                 if (rev == 24)
2432                         filename = "lcn0bsinitvals24";
2433                 break;
2434         case B43_PHYTYPE_LCN40:
2435                 if (rev == 33)
2436                         filename = "lcn400bsinitvals33";
2437                 break;
2438         case B43_PHYTYPE_AC:
2439                 if (rev == 42)
2440                         filename = "ac1bsinitvals42";
2441                 else if (rev == 40)
2442                         filename = "ac0bsinitvals40";
2443                 break;
2444         }
2445         if (!filename)
2446                 goto err_no_initvals;
2447         err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2448         if (err)
2449                 goto err_load;
2450
2451         fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2452
2453         return 0;
2454
2455 err_no_ucode:
2456         err = ctx->fatal_failure = -EOPNOTSUPP;
2457         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2458                "is required for your device (wl-core rev %u)\n", rev);
2459         goto error;
2460
2461 err_no_pcm:
2462         err = ctx->fatal_failure = -EOPNOTSUPP;
2463         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2464                "is required for your device (wl-core rev %u)\n", rev);
2465         goto error;
2466
2467 err_no_initvals:
2468         err = ctx->fatal_failure = -EOPNOTSUPP;
2469         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2470                "is required for your device (wl-core rev %u)\n", rev);
2471         goto error;
2472
2473 err_load:
2474         /* We failed to load this firmware image. The error message
2475          * already is in ctx->errors. Return and let our caller decide
2476          * what to do. */
2477         goto error;
2478
2479 error:
2480         b43_release_firmware(dev);
2481         return err;
2482 }
2483
2484 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2485 static void b43_one_core_detach(struct b43_bus_dev *dev);
2486 static int b43_rng_init(struct b43_wl *wl);
2487
2488 static void b43_request_firmware(struct work_struct *work)
2489 {
2490         struct b43_wl *wl = container_of(work,
2491                             struct b43_wl, firmware_load);
2492         struct b43_wldev *dev = wl->current_dev;
2493         struct b43_request_fw_context *ctx;
2494         unsigned int i;
2495         int err;
2496         const char *errmsg;
2497
2498         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2499         if (!ctx)
2500                 return;
2501         ctx->dev = dev;
2502
2503         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2504         err = b43_try_request_fw(ctx);
2505         if (!err)
2506                 goto start_ieee80211; /* Successfully loaded it. */
2507         /* Was fw version known? */
2508         if (ctx->fatal_failure)
2509                 goto out;
2510
2511         /* proprietary fw not found, try open source */
2512         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2513         err = b43_try_request_fw(ctx);
2514         if (!err)
2515                 goto start_ieee80211; /* Successfully loaded it. */
2516         if(ctx->fatal_failure)
2517                 goto out;
2518
2519         /* Could not find a usable firmware. Print the errors. */
2520         for (i = 0; i < B43_NR_FWTYPES; i++) {
2521                 errmsg = ctx->errors[i];
2522                 if (strlen(errmsg))
2523                         b43err(dev->wl, "%s", errmsg);
2524         }
2525         b43_print_fw_helptext(dev->wl, 1);
2526         goto out;
2527
2528 start_ieee80211:
2529         wl->hw->queues = B43_QOS_QUEUE_NUM;
2530         if (!modparam_qos || dev->fw.opensource)
2531                 wl->hw->queues = 1;
2532
2533         err = ieee80211_register_hw(wl->hw);
2534         if (err)
2535                 goto err_one_core_detach;
2536         wl->hw_registred = true;
2537         b43_leds_register(wl->current_dev);
2538
2539         /* Register HW RNG driver */
2540         b43_rng_init(wl);
2541
2542         goto out;
2543
2544 err_one_core_detach:
2545         b43_one_core_detach(dev->dev);
2546
2547 out:
2548         kfree(ctx);
2549 }
2550
2551 static int b43_upload_microcode(struct b43_wldev *dev)
2552 {
2553         struct wiphy *wiphy = dev->wl->hw->wiphy;
2554         const size_t hdr_len = sizeof(struct b43_fw_header);
2555         const __be32 *data;
2556         unsigned int i, len;
2557         u16 fwrev, fwpatch, fwdate, fwtime;
2558         u32 tmp, macctl;
2559         int err = 0;
2560
2561         /* Jump the microcode PSM to offset 0 */
2562         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2563         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2564         macctl |= B43_MACCTL_PSM_JMP0;
2565         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2566         /* Zero out all microcode PSM registers and shared memory. */
2567         for (i = 0; i < 64; i++)
2568                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2569         for (i = 0; i < 4096; i += 2)
2570                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2571
2572         /* Upload Microcode. */
2573         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2574         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2575         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2576         for (i = 0; i < len; i++) {
2577                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2578                 udelay(10);
2579         }
2580
2581         if (dev->fw.pcm.data) {
2582                 /* Upload PCM data. */
2583                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2584                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2585                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2586                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2587                 /* No need for autoinc bit in SHM_HW */
2588                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2589                 for (i = 0; i < len; i++) {
2590                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2591                         udelay(10);
2592                 }
2593         }
2594
2595         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2596
2597         /* Start the microcode PSM */
2598         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2599                       B43_MACCTL_PSM_RUN);
2600
2601         /* Wait for the microcode to load and respond */
2602         i = 0;
2603         while (1) {
2604                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2605                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2606                         break;
2607                 i++;
2608                 if (i >= 20) {
2609                         b43err(dev->wl, "Microcode not responding\n");
2610                         b43_print_fw_helptext(dev->wl, 1);
2611                         err = -ENODEV;
2612                         goto error;
2613                 }
2614                 msleep(50);
2615         }
2616         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2617
2618         /* Get and check the revisions. */
2619         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2620         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2621         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2622         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2623
2624         if (fwrev <= 0x128) {
2625                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2626                        "binary drivers older than version 4.x is unsupported. "
2627                        "You must upgrade your firmware files.\n");
2628                 b43_print_fw_helptext(dev->wl, 1);
2629                 err = -EOPNOTSUPP;
2630                 goto error;
2631         }
2632         dev->fw.rev = fwrev;
2633         dev->fw.patch = fwpatch;
2634         if (dev->fw.rev >= 598)
2635                 dev->fw.hdr_format = B43_FW_HDR_598;
2636         else if (dev->fw.rev >= 410)
2637                 dev->fw.hdr_format = B43_FW_HDR_410;
2638         else
2639                 dev->fw.hdr_format = B43_FW_HDR_351;
2640         WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2641
2642         dev->qos_enabled = dev->wl->hw->queues > 1;
2643         /* Default to firmware/hardware crypto acceleration. */
2644         dev->hwcrypto_enabled = true;
2645
2646         if (dev->fw.opensource) {
2647                 u16 fwcapa;
2648
2649                 /* Patchlevel info is encoded in the "time" field. */
2650                 dev->fw.patch = fwtime;
2651                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2652                         dev->fw.rev, dev->fw.patch);
2653
2654                 fwcapa = b43_fwcapa_read(dev);
2655                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2656                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2657                         /* Disable hardware crypto and fall back to software crypto. */
2658                         dev->hwcrypto_enabled = false;
2659                 }
2660                 /* adding QoS support should use an offline discovery mechanism */
2661                 WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2662         } else {
2663                 b43info(dev->wl, "Loading firmware version %u.%u "
2664                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2665                         fwrev, fwpatch,
2666                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2667                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2668                 if (dev->fw.pcm_request_failed) {
2669                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2670                                 "Hardware accelerated cryptography is disabled.\n");
2671                         b43_print_fw_helptext(dev->wl, 0);
2672                 }
2673         }
2674
2675         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2676                         dev->fw.rev, dev->fw.patch);
2677         wiphy->hw_version = dev->dev->core_id;
2678
2679         if (dev->fw.hdr_format == B43_FW_HDR_351) {
2680                 /* We're over the deadline, but we keep support for old fw
2681                  * until it turns out to be in major conflict with something new. */
2682                 b43warn(dev->wl, "You are using an old firmware image. "
2683                         "Support for old firmware will be removed soon "
2684                         "(official deadline was July 2008).\n");
2685                 b43_print_fw_helptext(dev->wl, 0);
2686         }
2687
2688         return 0;
2689
2690 error:
2691         /* Stop the microcode PSM. */
2692         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2693                       B43_MACCTL_PSM_JMP0);
2694
2695         return err;
2696 }
2697
2698 static int b43_write_initvals(struct b43_wldev *dev,
2699                               const struct b43_iv *ivals,
2700                               size_t count,
2701                               size_t array_size)
2702 {
2703         const struct b43_iv *iv;
2704         u16 offset;
2705         size_t i;
2706         bool bit32;
2707
2708         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2709         iv = ivals;
2710         for (i = 0; i < count; i++) {
2711                 if (array_size < sizeof(iv->offset_size))
2712                         goto err_format;
2713                 array_size -= sizeof(iv->offset_size);
2714                 offset = be16_to_cpu(iv->offset_size);
2715                 bit32 = !!(offset & B43_IV_32BIT);
2716                 offset &= B43_IV_OFFSET_MASK;
2717                 if (offset >= 0x1000)
2718                         goto err_format;
2719                 if (bit32) {
2720                         u32 value;
2721
2722                         if (array_size < sizeof(iv->data.d32))
2723                                 goto err_format;
2724                         array_size -= sizeof(iv->data.d32);
2725
2726                         value = get_unaligned_be32(&iv->data.d32);
2727                         b43_write32(dev, offset, value);
2728
2729                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2730                                                         sizeof(__be16) +
2731                                                         sizeof(__be32));
2732                 } else {
2733                         u16 value;
2734
2735                         if (array_size < sizeof(iv->data.d16))
2736                                 goto err_format;
2737                         array_size -= sizeof(iv->data.d16);
2738
2739                         value = be16_to_cpu(iv->data.d16);
2740                         b43_write16(dev, offset, value);
2741
2742                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2743                                                         sizeof(__be16) +
2744                                                         sizeof(__be16));
2745                 }
2746         }
2747         if (array_size)
2748                 goto err_format;
2749
2750         return 0;
2751
2752 err_format:
2753         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2754         b43_print_fw_helptext(dev->wl, 1);
2755
2756         return -EPROTO;
2757 }
2758
2759 static int b43_upload_initvals(struct b43_wldev *dev)
2760 {
2761         const size_t hdr_len = sizeof(struct b43_fw_header);
2762         const struct b43_fw_header *hdr;
2763         struct b43_firmware *fw = &dev->fw;
2764         const struct b43_iv *ivals;
2765         size_t count;
2766
2767         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2768         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2769         count = be32_to_cpu(hdr->size);
2770         return b43_write_initvals(dev, ivals, count,
2771                                  fw->initvals.data->size - hdr_len);
2772 }
2773
2774 static int b43_upload_initvals_band(struct b43_wldev *dev)
2775 {
2776         const size_t hdr_len = sizeof(struct b43_fw_header);
2777         const struct b43_fw_header *hdr;
2778         struct b43_firmware *fw = &dev->fw;
2779         const struct b43_iv *ivals;
2780         size_t count;
2781
2782         if (!fw->initvals_band.data)
2783                 return 0;
2784
2785         hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2786         ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2787         count = be32_to_cpu(hdr->size);
2788         return b43_write_initvals(dev, ivals, count,
2789                                   fw->initvals_band.data->size - hdr_len);
2790 }
2791
2792 /* Initialize the GPIOs
2793  * http://bcm-specs.sipsolutions.net/GPIO
2794  */
2795
2796 #ifdef CONFIG_B43_SSB
2797 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2798 {
2799         struct ssb_bus *bus = dev->dev->sdev->bus;
2800
2801 #ifdef CONFIG_SSB_DRIVER_PCICORE
2802         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2803 #else
2804         return bus->chipco.dev;
2805 #endif
2806 }
2807 #endif
2808
2809 static int b43_gpio_init(struct b43_wldev *dev)
2810 {
2811 #ifdef CONFIG_B43_SSB
2812         struct ssb_device *gpiodev;
2813 #endif
2814         u32 mask, set;
2815
2816         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2817         b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2818
2819         mask = 0x0000001F;
2820         set = 0x0000000F;
2821         if (dev->dev->chip_id == 0x4301) {
2822                 mask |= 0x0060;
2823                 set |= 0x0060;
2824         } else if (dev->dev->chip_id == 0x5354) {
2825                 /* Don't allow overtaking buttons GPIOs */
2826                 set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2827         }
2828
2829         if (0 /* FIXME: conditional unknown */ ) {
2830                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2831                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2832                             | 0x0100);
2833                 /* BT Coexistance Input */
2834                 mask |= 0x0080;
2835                 set |= 0x0080;
2836                 /* BT Coexistance Out */
2837                 mask |= 0x0100;
2838                 set |= 0x0100;
2839         }
2840         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2841                 /* PA is controlled by gpio 9, let ucode handle it */
2842                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2843                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2844                             | 0x0200);
2845                 mask |= 0x0200;
2846                 set |= 0x0200;
2847         }
2848
2849         switch (dev->dev->bus_type) {
2850 #ifdef CONFIG_B43_BCMA
2851         case B43_BUS_BCMA:
2852                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2853                 break;
2854 #endif
2855 #ifdef CONFIG_B43_SSB
2856         case B43_BUS_SSB:
2857                 gpiodev = b43_ssb_gpio_dev(dev);
2858                 if (gpiodev)
2859                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2860                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2861                                     & ~mask) | set);
2862                 break;
2863 #endif
2864         }
2865
2866         return 0;
2867 }
2868
2869 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2870 static void b43_gpio_cleanup(struct b43_wldev *dev)
2871 {
2872 #ifdef CONFIG_B43_SSB
2873         struct ssb_device *gpiodev;
2874 #endif
2875
2876         switch (dev->dev->bus_type) {
2877 #ifdef CONFIG_B43_BCMA
2878         case B43_BUS_BCMA:
2879                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2880                 break;
2881 #endif
2882 #ifdef CONFIG_B43_SSB
2883         case B43_BUS_SSB:
2884                 gpiodev = b43_ssb_gpio_dev(dev);
2885                 if (gpiodev)
2886                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2887                 break;
2888 #endif
2889         }
2890 }
2891
2892 /* http://bcm-specs.sipsolutions.net/EnableMac */
2893 void b43_mac_enable(struct b43_wldev *dev)
2894 {
2895         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2896                 u16 fwstate;
2897
2898                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2899                                          B43_SHM_SH_UCODESTAT);
2900                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2901                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2902                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2903                                "should be suspended, but current state is %u\n",
2904                                fwstate);
2905                 }
2906         }
2907
2908         dev->mac_suspended--;
2909         B43_WARN_ON(dev->mac_suspended < 0);
2910         if (dev->mac_suspended == 0) {
2911                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2912                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2913                             B43_IRQ_MAC_SUSPENDED);
2914                 /* Commit writes */
2915                 b43_read32(dev, B43_MMIO_MACCTL);
2916                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2917                 b43_power_saving_ctl_bits(dev, 0);
2918         }
2919 }
2920
2921 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2922 void b43_mac_suspend(struct b43_wldev *dev)
2923 {
2924         int i;
2925         u32 tmp;
2926
2927         might_sleep();
2928         B43_WARN_ON(dev->mac_suspended < 0);
2929
2930         if (dev->mac_suspended == 0) {
2931                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2932                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
2933                 /* force pci to flush the write */
2934                 b43_read32(dev, B43_MMIO_MACCTL);
2935                 for (i = 35; i; i--) {
2936                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2937                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2938                                 goto out;
2939                         udelay(10);
2940                 }
2941                 /* Hm, it seems this will take some time. Use msleep(). */
2942                 for (i = 40; i; i--) {
2943                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2944                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2945                                 goto out;
2946                         msleep(1);
2947                 }
2948                 b43err(dev->wl, "MAC suspend failed\n");
2949         }
2950 out:
2951         dev->mac_suspended++;
2952 }
2953
2954 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2955 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2956 {
2957         u32 tmp;
2958
2959         switch (dev->dev->bus_type) {
2960 #ifdef CONFIG_B43_BCMA
2961         case B43_BUS_BCMA:
2962                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
2963                 if (on)
2964                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2965                 else
2966                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2967                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
2968                 break;
2969 #endif
2970 #ifdef CONFIG_B43_SSB
2971         case B43_BUS_SSB:
2972                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2973                 if (on)
2974                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2975                 else
2976                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2977                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2978                 break;
2979 #endif
2980         }
2981 }
2982
2983 /* brcms_b_switch_macfreq */
2984 void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
2985 {
2986         u16 chip_id = dev->dev->chip_id;
2987
2988         if (chip_id == BCMA_CHIP_ID_BCM43131 ||
2989             chip_id == BCMA_CHIP_ID_BCM43217 ||
2990             chip_id == BCMA_CHIP_ID_BCM43222 ||
2991             chip_id == BCMA_CHIP_ID_BCM43224 ||
2992             chip_id == BCMA_CHIP_ID_BCM43225 ||
2993             chip_id == BCMA_CHIP_ID_BCM43227 ||
2994             chip_id == BCMA_CHIP_ID_BCM43228) {
2995                 switch (spurmode) {
2996                 case 2: /* 126 Mhz */
2997                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
2998                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
2999                         break;
3000                 case 1: /* 123 Mhz */
3001                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3002                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3003                         break;
3004                 default: /* 120 Mhz */
3005                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3006                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3007                         break;
3008                 }
3009         } else if (dev->phy.type == B43_PHYTYPE_LCN) {
3010                 switch (spurmode) {
3011                 case 1: /* 82 Mhz */
3012                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3013                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3014                         break;
3015                 default: /* 80 Mhz */
3016                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3017                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3018                         break;
3019                 }
3020         }
3021 }
3022
3023 static void b43_adjust_opmode(struct b43_wldev *dev)
3024 {
3025         struct b43_wl *wl = dev->wl;
3026         u32 ctl;
3027         u16 cfp_pretbtt;
3028
3029         ctl = b43_read32(dev, B43_MMIO_MACCTL);
3030         /* Reset status to STA infrastructure mode. */
3031         ctl &= ~B43_MACCTL_AP;
3032         ctl &= ~B43_MACCTL_KEEP_CTL;
3033         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3034         ctl &= ~B43_MACCTL_KEEP_BAD;
3035         ctl &= ~B43_MACCTL_PROMISC;
3036         ctl &= ~B43_MACCTL_BEACPROMISC;
3037         ctl |= B43_MACCTL_INFRA;
3038
3039         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3040             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3041                 ctl |= B43_MACCTL_AP;
3042         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3043                 ctl &= ~B43_MACCTL_INFRA;
3044
3045         if (wl->filter_flags & FIF_CONTROL)
3046                 ctl |= B43_MACCTL_KEEP_CTL;
3047         if (wl->filter_flags & FIF_FCSFAIL)
3048                 ctl |= B43_MACCTL_KEEP_BAD;
3049         if (wl->filter_flags & FIF_PLCPFAIL)
3050                 ctl |= B43_MACCTL_KEEP_BADPLCP;
3051         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
3052                 ctl |= B43_MACCTL_PROMISC;
3053         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3054                 ctl |= B43_MACCTL_BEACPROMISC;
3055
3056         /* Workaround: On old hardware the HW-MAC-address-filter
3057          * doesn't work properly, so always run promisc in filter
3058          * it in software. */
3059         if (dev->dev->core_rev <= 4)
3060                 ctl |= B43_MACCTL_PROMISC;
3061
3062         b43_write32(dev, B43_MMIO_MACCTL, ctl);
3063
3064         cfp_pretbtt = 2;
3065         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3066                 if (dev->dev->chip_id == 0x4306 &&
3067                     dev->dev->chip_rev == 3)
3068                         cfp_pretbtt = 100;
3069                 else
3070                         cfp_pretbtt = 50;
3071         }
3072         b43_write16(dev, 0x612, cfp_pretbtt);
3073
3074         /* FIXME: We don't currently implement the PMQ mechanism,
3075          *        so always disable it. If we want to implement PMQ,
3076          *        we need to enable it here (clear DISCPMQ) in AP mode.
3077          */
3078         if (0  /* ctl & B43_MACCTL_AP */)
3079                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3080         else
3081                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3082 }
3083
3084 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3085 {
3086         u16 offset;
3087
3088         if (is_ofdm) {
3089                 offset = 0x480;
3090                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3091         } else {
3092                 offset = 0x4C0;
3093                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3094         }
3095         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3096                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
3097 }
3098
3099 static void b43_rate_memory_init(struct b43_wldev *dev)
3100 {
3101         switch (dev->phy.type) {
3102         case B43_PHYTYPE_A:
3103         case B43_PHYTYPE_G:
3104         case B43_PHYTYPE_N:
3105         case B43_PHYTYPE_LP:
3106         case B43_PHYTYPE_HT:
3107         case B43_PHYTYPE_LCN:
3108                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3109                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3110                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3111                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3112                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3113                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3114                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3115                 if (dev->phy.type == B43_PHYTYPE_A)
3116                         break;
3117                 /* fallthrough */
3118         case B43_PHYTYPE_B:
3119                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3120                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3121                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3122                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3123                 break;
3124         default:
3125                 B43_WARN_ON(1);
3126         }
3127 }
3128
3129 /* Set the default values for the PHY TX Control Words. */
3130 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3131 {
3132         u16 ctl = 0;
3133
3134         ctl |= B43_TXH_PHY_ENC_CCK;
3135         ctl |= B43_TXH_PHY_ANT01AUTO;
3136         ctl |= B43_TXH_PHY_TXPWR;
3137
3138         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3139         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3140         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3141 }
3142
3143 /* Set the TX-Antenna for management frames sent by firmware. */
3144 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3145 {
3146         u16 ant;
3147         u16 tmp;
3148
3149         ant = b43_antenna_to_phyctl(antenna);
3150
3151         /* For ACK/CTS */
3152         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3153         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3154         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3155         /* For Probe Resposes */
3156         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3157         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3158         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3159 }
3160
3161 /* This is the opposite of b43_chip_init() */
3162 static void b43_chip_exit(struct b43_wldev *dev)
3163 {
3164         b43_phy_exit(dev);
3165         b43_gpio_cleanup(dev);
3166         /* firmware is released later */
3167 }
3168
3169 /* Initialize the chip
3170  * http://bcm-specs.sipsolutions.net/ChipInit
3171  */
3172 static int b43_chip_init(struct b43_wldev *dev)
3173 {
3174         struct b43_phy *phy = &dev->phy;
3175         int err;
3176         u32 macctl;
3177         u16 value16;
3178
3179         /* Initialize the MAC control */
3180         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3181         if (dev->phy.gmode)
3182                 macctl |= B43_MACCTL_GMODE;
3183         macctl |= B43_MACCTL_INFRA;
3184         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3185
3186         err = b43_upload_microcode(dev);
3187         if (err)
3188                 goto out;       /* firmware is released later */
3189
3190         err = b43_gpio_init(dev);
3191         if (err)
3192                 goto out;       /* firmware is released later */
3193
3194         err = b43_upload_initvals(dev);
3195         if (err)
3196                 goto err_gpio_clean;
3197
3198         err = b43_upload_initvals_band(dev);
3199         if (err)
3200                 goto err_gpio_clean;
3201
3202         /* Turn the Analog on and initialize the PHY. */
3203         phy->ops->switch_analog(dev, 1);
3204         err = b43_phy_init(dev);
3205         if (err)
3206                 goto err_gpio_clean;
3207
3208         /* Disable Interference Mitigation. */
3209         if (phy->ops->interf_mitigation)
3210                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3211
3212         /* Select the antennae */
3213         if (phy->ops->set_rx_antenna)
3214                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3215         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3216
3217         if (phy->type == B43_PHYTYPE_B) {
3218                 value16 = b43_read16(dev, 0x005E);
3219                 value16 |= 0x0004;
3220                 b43_write16(dev, 0x005E, value16);
3221         }
3222         b43_write32(dev, 0x0100, 0x01000000);
3223         if (dev->dev->core_rev < 5)
3224                 b43_write32(dev, 0x010C, 0x01000000);
3225
3226         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3227         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3228
3229         /* Probe Response Timeout value */
3230         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3231         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3232
3233         /* Initially set the wireless operation mode. */
3234         b43_adjust_opmode(dev);
3235
3236         if (dev->dev->core_rev < 3) {
3237                 b43_write16(dev, 0x060E, 0x0000);
3238                 b43_write16(dev, 0x0610, 0x8000);
3239                 b43_write16(dev, 0x0604, 0x0000);
3240                 b43_write16(dev, 0x0606, 0x0200);
3241         } else {
3242                 b43_write32(dev, 0x0188, 0x80000000);
3243                 b43_write32(dev, 0x018C, 0x02000000);
3244         }
3245         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3246         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3247         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3248         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3249         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3250         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3251         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3252
3253         b43_mac_phy_clock_set(dev, true);
3254
3255         switch (dev->dev->bus_type) {
3256 #ifdef CONFIG_B43_BCMA
3257         case B43_BUS_BCMA:
3258                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3259                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3260                 break;
3261 #endif
3262 #ifdef CONFIG_B43_SSB
3263         case B43_BUS_SSB:
3264                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3265                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3266                 break;
3267 #endif
3268         }
3269
3270         err = 0;
3271         b43dbg(dev->wl, "Chip initialized\n");
3272 out:
3273         return err;
3274
3275 err_gpio_clean:
3276         b43_gpio_cleanup(dev);
3277         return err;
3278 }
3279
3280 static void b43_periodic_every60sec(struct b43_wldev *dev)
3281 {
3282         const struct b43_phy_operations *ops = dev->phy.ops;
3283
3284         if (ops->pwork_60sec)
3285                 ops->pwork_60sec(dev);
3286
3287         /* Force check the TX power emission now. */
3288         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3289 }
3290
3291 static void b43_periodic_every30sec(struct b43_wldev *dev)
3292 {
3293         /* Update device statistics. */
3294         b43_calculate_link_quality(dev);
3295 }
3296
3297 static void b43_periodic_every15sec(struct b43_wldev *dev)
3298 {
3299         struct b43_phy *phy = &dev->phy;
3300         u16 wdr;
3301
3302         if (dev->fw.opensource) {
3303                 /* Check if the firmware is still alive.
3304                  * It will reset the watchdog counter to 0 in its idle loop. */
3305                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3306                 if (unlikely(wdr)) {
3307                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3308                         b43_controller_restart(dev, "Firmware watchdog");
3309                         return;
3310                 } else {
3311                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3312                                         B43_WATCHDOG_REG, 1);
3313                 }
3314         }
3315
3316         if (phy->ops->pwork_15sec)
3317                 phy->ops->pwork_15sec(dev);
3318
3319         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3320         wmb();
3321
3322 #if B43_DEBUG
3323         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3324                 unsigned int i;
3325
3326                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3327                        dev->irq_count / 15,
3328                        dev->tx_count / 15,
3329                        dev->rx_count / 15);
3330                 dev->irq_count = 0;
3331                 dev->tx_count = 0;
3332                 dev->rx_count = 0;
3333                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3334                         if (dev->irq_bit_count[i]) {
3335                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3336                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3337                                 dev->irq_bit_count[i] = 0;
3338                         }
3339                 }
3340         }
3341 #endif
3342 }
3343
3344 static void do_periodic_work(struct b43_wldev *dev)
3345 {
3346         unsigned int state;
3347
3348         state = dev->periodic_state;
3349         if (state % 4 == 0)
3350                 b43_periodic_every60sec(dev);
3351         if (state % 2 == 0)
3352                 b43_periodic_every30sec(dev);
3353         b43_periodic_every15sec(dev);
3354 }
3355
3356 /* Periodic work locking policy:
3357  *      The whole periodic work handler is protected by
3358  *      wl->mutex. If another lock is needed somewhere in the
3359  *      pwork callchain, it's acquired in-place, where it's needed.
3360  */
3361 static void b43_periodic_work_handler(struct work_struct *work)
3362 {
3363         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3364                                              periodic_work.work);
3365         struct b43_wl *wl = dev->wl;
3366         unsigned long delay;
3367
3368         mutex_lock(&wl->mutex);
3369
3370         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3371                 goto out;
3372         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3373                 goto out_requeue;
3374
3375         do_periodic_work(dev);
3376
3377         dev->periodic_state++;
3378 out_requeue:
3379         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3380                 delay = msecs_to_jiffies(50);
3381         else
3382                 delay = round_jiffies_relative(HZ * 15);
3383         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3384 out:
3385         mutex_unlock(&wl->mutex);
3386 }
3387
3388 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3389 {
3390         struct delayed_work *work = &dev->periodic_work;
3391
3392         dev->periodic_state = 0;
3393         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3394         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3395 }
3396
3397 /* Check if communication with the device works correctly. */
3398 static int b43_validate_chipaccess(struct b43_wldev *dev)
3399 {
3400         u32 v, backup0, backup4;
3401
3402         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3403         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3404
3405         /* Check for read/write and endianness problems. */
3406         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3407         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3408                 goto error;
3409         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3410         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3411                 goto error;
3412
3413         /* Check if unaligned 32bit SHM_SHARED access works properly.
3414          * However, don't bail out on failure, because it's noncritical. */
3415         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3416         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3417         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3418         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3419         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3420                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3421         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3422         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3423             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3424             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3425             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3426                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3427
3428         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3429         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3430
3431         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3432                 /* The 32bit register shadows the two 16bit registers
3433                  * with update sideeffects. Validate this. */
3434                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3435                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3436                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3437                         goto error;
3438                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3439                         goto error;
3440         }
3441         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3442
3443         v = b43_read32(dev, B43_MMIO_MACCTL);
3444         v |= B43_MACCTL_GMODE;
3445         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3446                 goto error;
3447
3448         return 0;
3449 error:
3450         b43err(dev->wl, "Failed to validate the chipaccess\n");
3451         return -ENODEV;
3452 }
3453
3454 static void b43_security_init(struct b43_wldev *dev)
3455 {
3456         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3457         /* KTP is a word address, but we address SHM bytewise.
3458          * So multiply by two.
3459          */
3460         dev->ktp *= 2;
3461         /* Number of RCMTA address slots */
3462         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3463         /* Clear the key memory. */
3464         b43_clear_keys(dev);
3465 }
3466
3467 #ifdef CONFIG_B43_HWRNG
3468 static int b43_rng_read(struct hwrng *rng, u32 *data)
3469 {
3470         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3471         struct b43_wldev *dev;
3472         int count = -ENODEV;
3473
3474         mutex_lock(&wl->mutex);
3475         dev = wl->current_dev;
3476         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3477                 *data = b43_read16(dev, B43_MMIO_RNG);
3478                 count = sizeof(u16);
3479         }
3480         mutex_unlock(&wl->mutex);
3481
3482         return count;
3483 }
3484 #endif /* CONFIG_B43_HWRNG */
3485
3486 static void b43_rng_exit(struct b43_wl *wl)
3487 {
3488 #ifdef CONFIG_B43_HWRNG
3489         if (wl->rng_initialized)
3490                 hwrng_unregister(&wl->rng);
3491 #endif /* CONFIG_B43_HWRNG */
3492 }
3493
3494 static int b43_rng_init(struct b43_wl *wl)
3495 {
3496         int err = 0;
3497
3498 #ifdef CONFIG_B43_HWRNG
3499         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3500                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3501         wl->rng.name = wl->rng_name;
3502         wl->rng.data_read = b43_rng_read;
3503         wl->rng.priv = (unsigned long)wl;
3504         wl->rng_initialized = true;
3505         err = hwrng_register(&wl->rng);
3506         if (err) {
3507                 wl->rng_initialized = false;
3508                 b43err(wl, "Failed to register the random "
3509                        "number generator (%d)\n", err);
3510         }
3511 #endif /* CONFIG_B43_HWRNG */
3512
3513         return err;
3514 }
3515
3516 static void b43_tx_work(struct work_struct *work)
3517 {
3518         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3519         struct b43_wldev *dev;
3520         struct sk_buff *skb;
3521         int queue_num;
3522         int err = 0;
3523
3524         mutex_lock(&wl->mutex);
3525         dev = wl->current_dev;
3526         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3527                 mutex_unlock(&wl->mutex);
3528                 return;
3529         }
3530
3531         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3532                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
3533                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
3534                         if (b43_using_pio_transfers(dev))
3535                                 err = b43_pio_tx(dev, skb);
3536                         else
3537                                 err = b43_dma_tx(dev, skb);
3538                         if (err == -ENOSPC) {
3539                                 wl->tx_queue_stopped[queue_num] = 1;
3540                                 ieee80211_stop_queue(wl->hw, queue_num);
3541                                 skb_queue_head(&wl->tx_queue[queue_num], skb);
3542                                 break;
3543                         }
3544                         if (unlikely(err))
3545                                 ieee80211_free_txskb(wl->hw, skb);
3546                         err = 0;
3547                 }
3548
3549                 if (!err)
3550                         wl->tx_queue_stopped[queue_num] = 0;
3551         }
3552
3553 #if B43_DEBUG
3554         dev->tx_count++;
3555 #endif
3556         mutex_unlock(&wl->mutex);
3557 }
3558
3559 static void b43_op_tx(struct ieee80211_hw *hw,
3560                       struct ieee80211_tx_control *control,
3561                       struct sk_buff *skb)
3562 {
3563         struct b43_wl *wl = hw_to_b43_wl(hw);
3564
3565         if (unlikely(skb->len < 2 + 2 + 6)) {
3566                 /* Too short, this can't be a valid frame. */
3567                 ieee80211_free_txskb(hw, skb);
3568                 return;
3569         }
3570         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3571
3572         skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3573         if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3574                 ieee80211_queue_work(wl->hw, &wl->tx_work);
3575         } else {
3576                 ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3577         }
3578 }
3579
3580 static void b43_qos_params_upload(struct b43_wldev *dev,
3581                                   const struct ieee80211_tx_queue_params *p,
3582                                   u16 shm_offset)
3583 {
3584         u16 params[B43_NR_QOSPARAMS];
3585         int bslots, tmp;
3586         unsigned int i;
3587
3588         if (!dev->qos_enabled)
3589                 return;
3590
3591         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3592
3593         memset(&params, 0, sizeof(params));
3594
3595         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3596         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3597         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3598         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3599         params[B43_QOSPARAM_AIFS] = p->aifs;
3600         params[B43_QOSPARAM_BSLOTS] = bslots;
3601         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3602
3603         for (i = 0; i < ARRAY_SIZE(params); i++) {
3604                 if (i == B43_QOSPARAM_STATUS) {
3605                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3606                                              shm_offset + (i * 2));
3607                         /* Mark the parameters as updated. */
3608                         tmp |= 0x100;
3609                         b43_shm_write16(dev, B43_SHM_SHARED,
3610                                         shm_offset + (i * 2),
3611                                         tmp);
3612                 } else {
3613                         b43_shm_write16(dev, B43_SHM_SHARED,
3614                                         shm_offset + (i * 2),
3615                                         params[i]);
3616                 }
3617         }
3618 }
3619
3620 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3621 static const u16 b43_qos_shm_offsets[] = {
3622         /* [mac80211-queue-nr] = SHM_OFFSET, */
3623         [0] = B43_QOS_VOICE,
3624         [1] = B43_QOS_VIDEO,
3625         [2] = B43_QOS_BESTEFFORT,
3626         [3] = B43_QOS_BACKGROUND,
3627 };
3628
3629 /* Update all QOS parameters in hardware. */
3630 static void b43_qos_upload_all(struct b43_wldev *dev)
3631 {
3632         struct b43_wl *wl = dev->wl;
3633         struct b43_qos_params *params;
3634         unsigned int i;
3635
3636         if (!dev->qos_enabled)
3637                 return;
3638
3639         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3640                      ARRAY_SIZE(wl->qos_params));
3641
3642         b43_mac_suspend(dev);
3643         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3644                 params = &(wl->qos_params[i]);
3645                 b43_qos_params_upload(dev, &(params->p),
3646                                       b43_qos_shm_offsets[i]);
3647         }
3648         b43_mac_enable(dev);
3649 }
3650
3651 static void b43_qos_clear(struct b43_wl *wl)
3652 {
3653         struct b43_qos_params *params;
3654         unsigned int i;
3655
3656         /* Initialize QoS parameters to sane defaults. */
3657
3658         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3659                      ARRAY_SIZE(wl->qos_params));
3660
3661         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3662                 params = &(wl->qos_params[i]);
3663
3664                 switch (b43_qos_shm_offsets[i]) {
3665                 case B43_QOS_VOICE:
3666                         params->p.txop = 0;
3667                         params->p.aifs = 2;
3668                         params->p.cw_min = 0x0001;
3669                         params->p.cw_max = 0x0001;
3670                         break;
3671                 case B43_QOS_VIDEO:
3672                         params->p.txop = 0;
3673                         params->p.aifs = 2;
3674                         params->p.cw_min = 0x0001;
3675                         params->p.cw_max = 0x0001;
3676                         break;
3677                 case B43_QOS_BESTEFFORT:
3678                         params->p.txop = 0;
3679                         params->p.aifs = 3;
3680                         params->p.cw_min = 0x0001;
3681                         params->p.cw_max = 0x03FF;
3682                         break;
3683                 case B43_QOS_BACKGROUND:
3684                         params->p.txop = 0;
3685                         params->p.aifs = 7;
3686                         params->p.cw_min = 0x0001;
3687                         params->p.cw_max = 0x03FF;
3688                         break;
3689                 default:
3690                         B43_WARN_ON(1);
3691                 }
3692         }
3693 }
3694
3695 /* Initialize the core's QOS capabilities */
3696 static void b43_qos_init(struct b43_wldev *dev)
3697 {
3698         if (!dev->qos_enabled) {
3699                 /* Disable QOS support. */
3700                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3701                 b43_write16(dev, B43_MMIO_IFSCTL,
3702                             b43_read16(dev, B43_MMIO_IFSCTL)
3703                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3704                 b43dbg(dev->wl, "QoS disabled\n");
3705                 return;
3706         }
3707
3708         /* Upload the current QOS parameters. */
3709         b43_qos_upload_all(dev);
3710
3711         /* Enable QOS support. */
3712         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3713         b43_write16(dev, B43_MMIO_IFSCTL,
3714                     b43_read16(dev, B43_MMIO_IFSCTL)
3715                     | B43_MMIO_IFSCTL_USE_EDCF);
3716         b43dbg(dev->wl, "QoS enabled\n");
3717 }
3718
3719 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3720                           struct ieee80211_vif *vif, u16 _queue,
3721                           const struct ieee80211_tx_queue_params *params)
3722 {
3723         struct b43_wl *wl = hw_to_b43_wl(hw);
3724         struct b43_wldev *dev;
3725         unsigned int queue = (unsigned int)_queue;
3726         int err = -ENODEV;
3727
3728         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3729                 /* Queue not available or don't support setting
3730                  * params on this queue. Return success to not
3731                  * confuse mac80211. */
3732                 return 0;
3733         }
3734         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3735                      ARRAY_SIZE(wl->qos_params));
3736
3737         mutex_lock(&wl->mutex);
3738         dev = wl->current_dev;
3739         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3740                 goto out_unlock;
3741
3742         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3743         b43_mac_suspend(dev);
3744         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3745                               b43_qos_shm_offsets[queue]);
3746         b43_mac_enable(dev);
3747         err = 0;
3748
3749 out_unlock:
3750         mutex_unlock(&wl->mutex);
3751
3752         return err;
3753 }
3754
3755 static int b43_op_get_stats(struct ieee80211_hw *hw,
3756                             struct ieee80211_low_level_stats *stats)
3757 {
3758         struct b43_wl *wl = hw_to_b43_wl(hw);
3759
3760         mutex_lock(&wl->mutex);
3761         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3762         mutex_unlock(&wl->mutex);
3763
3764         return 0;
3765 }
3766
3767 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3768 {
3769         struct b43_wl *wl = hw_to_b43_wl(hw);
3770         struct b43_wldev *dev;
3771         u64 tsf;
3772
3773         mutex_lock(&wl->mutex);
3774         dev = wl->current_dev;
3775
3776         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3777                 b43_tsf_read(dev, &tsf);
3778         else
3779                 tsf = 0;
3780
3781         mutex_unlock(&wl->mutex);
3782
3783         return tsf;
3784 }
3785
3786 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3787                            struct ieee80211_vif *vif, u64 tsf)
3788 {
3789         struct b43_wl *wl = hw_to_b43_wl(hw);
3790         struct b43_wldev *dev;
3791
3792         mutex_lock(&wl->mutex);
3793         dev = wl->current_dev;
3794
3795         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3796                 b43_tsf_write(dev, tsf);
3797
3798         mutex_unlock(&wl->mutex);
3799 }
3800
3801 static const char *band_to_string(enum ieee80211_band band)
3802 {
3803         switch (band) {
3804         case IEEE80211_BAND_5GHZ:
3805                 return "5";
3806         case IEEE80211_BAND_2GHZ:
3807                 return "2.4";
3808         default:
3809                 break;
3810         }
3811         B43_WARN_ON(1);
3812         return "";
3813 }
3814
3815 /* Expects wl->mutex locked */
3816 static int b43_switch_band(struct b43_wldev *dev,
3817                            struct ieee80211_channel *chan)
3818 {
3819         struct b43_phy *phy = &dev->phy;
3820         bool gmode;
3821         u32 tmp;
3822
3823         switch (chan->band) {
3824         case IEEE80211_BAND_5GHZ:
3825                 gmode = false;
3826                 break;
3827         case IEEE80211_BAND_2GHZ:
3828                 gmode = true;
3829                 break;
3830         default:
3831                 B43_WARN_ON(1);
3832                 return -EINVAL;
3833         }
3834
3835         if (!((gmode && phy->supports_2ghz) ||
3836               (!gmode && phy->supports_5ghz))) {
3837                 b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3838                        band_to_string(chan->band));
3839                 return -ENODEV;
3840         }
3841
3842         if (!!phy->gmode == !!gmode) {
3843                 /* This device is already running. */
3844                 return 0;
3845         }
3846
3847         b43dbg(dev->wl, "Switching to %s GHz band\n",
3848                band_to_string(chan->band));
3849
3850         /* Some new devices don't need disabling radio for band switching */
3851         if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3852                 b43_software_rfkill(dev, true);
3853
3854         phy->gmode = gmode;
3855         b43_phy_put_into_reset(dev);
3856         switch (dev->dev->bus_type) {
3857 #ifdef CONFIG_B43_BCMA
3858         case B43_BUS_BCMA:
3859                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3860                 if (gmode)
3861                         tmp |= B43_BCMA_IOCTL_GMODE;
3862                 else
3863                         tmp &= ~B43_BCMA_IOCTL_GMODE;
3864                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3865                 break;
3866 #endif
3867 #ifdef CONFIG_B43_SSB
3868         case B43_BUS_SSB:
3869                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3870                 if (gmode)
3871                         tmp |= B43_TMSLOW_GMODE;
3872                 else
3873                         tmp &= ~B43_TMSLOW_GMODE;
3874                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3875                 break;
3876 #endif
3877         }
3878         b43_phy_take_out_of_reset(dev);
3879
3880         b43_upload_initvals_band(dev);
3881
3882         b43_phy_init(dev);
3883
3884         return 0;
3885 }
3886
3887 /* Write the short and long frame retry limit values. */
3888 static void b43_set_retry_limits(struct b43_wldev *dev,
3889                                  unsigned int short_retry,
3890                                  unsigned int long_retry)
3891 {
3892         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3893          * the chip-internal counter. */
3894         short_retry = min(short_retry, (unsigned int)0xF);
3895         long_retry = min(long_retry, (unsigned int)0xF);
3896
3897         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3898                         short_retry);
3899         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3900                         long_retry);
3901 }
3902
3903 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3904 {
3905         struct b43_wl *wl = hw_to_b43_wl(hw);
3906         struct b43_wldev *dev = wl->current_dev;
3907         struct b43_phy *phy = &dev->phy;
3908         struct ieee80211_conf *conf = &hw->conf;
3909         int antenna;
3910         int err = 0;
3911
3912         mutex_lock(&wl->mutex);
3913         b43_mac_suspend(dev);
3914
3915         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
3916                 phy->chandef = &conf->chandef;
3917                 phy->channel = conf->chandef.chan->hw_value;
3918
3919                 /* Switch the band (if necessary). */
3920                 err = b43_switch_band(dev, conf->chandef.chan);
3921                 if (err)
3922                         goto out_mac_enable;
3923
3924                 /* Switch to the requested channel.
3925                  * The firmware takes care of races with the TX handler.
3926                  */
3927                 b43_switch_channel(dev, phy->channel);
3928         }
3929
3930         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3931                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3932                                           conf->long_frame_max_tx_count);
3933         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3934         if (!changed)
3935                 goto out_mac_enable;
3936
3937         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3938
3939         /* Adjust the desired TX power level. */
3940         if (conf->power_level != 0) {
3941                 if (conf->power_level != phy->desired_txpower) {
3942                         phy->desired_txpower = conf->power_level;
3943                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3944                                                    B43_TXPWR_IGNORE_TSSI);
3945                 }
3946         }
3947
3948         /* Antennas for RX and management frame TX. */
3949         antenna = B43_ANTENNA_DEFAULT;
3950         b43_mgmtframe_txantenna(dev, antenna);
3951         antenna = B43_ANTENNA_DEFAULT;
3952         if (phy->ops->set_rx_antenna)
3953                 phy->ops->set_rx_antenna(dev, antenna);
3954
3955         if (wl->radio_enabled != phy->radio_on) {
3956                 if (wl->radio_enabled) {
3957                         b43_software_rfkill(dev, false);
3958                         b43info(dev->wl, "Radio turned on by software\n");
3959                         if (!dev->radio_hw_enable) {
3960                                 b43info(dev->wl, "The hardware RF-kill button "
3961                                         "still turns the radio physically off. "
3962                                         "Press the button to turn it on.\n");
3963                         }
3964                 } else {
3965                         b43_software_rfkill(dev, true);
3966                         b43info(dev->wl, "Radio turned off by software\n");
3967                 }
3968         }
3969
3970 out_mac_enable:
3971         b43_mac_enable(dev);
3972         mutex_unlock(&wl->mutex);
3973
3974         return err;
3975 }
3976
3977 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3978 {
3979         struct ieee80211_supported_band *sband =
3980                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3981         struct ieee80211_rate *rate;
3982         int i;
3983         u16 basic, direct, offset, basic_offset, rateptr;
3984
3985         for (i = 0; i < sband->n_bitrates; i++) {
3986                 rate = &sband->bitrates[i];
3987
3988                 if (b43_is_cck_rate(rate->hw_value)) {
3989                         direct = B43_SHM_SH_CCKDIRECT;
3990                         basic = B43_SHM_SH_CCKBASIC;
3991                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3992                         offset &= 0xF;
3993                 } else {
3994                         direct = B43_SHM_SH_OFDMDIRECT;
3995                         basic = B43_SHM_SH_OFDMBASIC;
3996                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3997                         offset &= 0xF;
3998                 }
3999
4000                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4001
4002                 if (b43_is_cck_rate(rate->hw_value)) {
4003                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4004                         basic_offset &= 0xF;
4005                 } else {
4006                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4007                         basic_offset &= 0xF;
4008                 }
4009
4010                 /*
4011                  * Get the pointer that we need to point to
4012                  * from the direct map
4013                  */
4014                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4015                                          direct + 2 * basic_offset);
4016                 /* and write it to the basic map */
4017                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4018                                 rateptr);
4019         }
4020 }
4021
4022 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4023                                     struct ieee80211_vif *vif,
4024                                     struct ieee80211_bss_conf *conf,
4025                                     u32 changed)
4026 {
4027         struct b43_wl *wl = hw_to_b43_wl(hw);
4028         struct b43_wldev *dev;
4029
4030         mutex_lock(&wl->mutex);
4031
4032         dev = wl->current_dev;
4033         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4034                 goto out_unlock_mutex;
4035
4036         B43_WARN_ON(wl->vif != vif);
4037
4038         if (changed & BSS_CHANGED_BSSID) {
4039                 if (conf->bssid)
4040                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4041                 else
4042                         memset(wl->bssid, 0, ETH_ALEN);
4043         }
4044
4045         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4046                 if (changed & BSS_CHANGED_BEACON &&
4047                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4048                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4049                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4050                         b43_update_templates(wl);
4051
4052                 if (changed & BSS_CHANGED_BSSID)
4053                         b43_write_mac_bssid_templates(dev);
4054         }
4055
4056         b43_mac_suspend(dev);
4057
4058         /* Update templates for AP/mesh mode. */
4059         if (changed & BSS_CHANGED_BEACON_INT &&
4060             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4061              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4062              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4063             conf->beacon_int)
4064                 b43_set_beacon_int(dev, conf->beacon_int);
4065
4066         if (changed & BSS_CHANGED_BASIC_RATES)
4067                 b43_update_basic_rates(dev, conf->basic_rates);
4068
4069         if (changed & BSS_CHANGED_ERP_SLOT) {
4070                 if (conf->use_short_slot)
4071                         b43_short_slot_timing_enable(dev);
4072                 else
4073                         b43_short_slot_timing_disable(dev);
4074         }
4075
4076         b43_mac_enable(dev);
4077 out_unlock_mutex:
4078         mutex_unlock(&wl->mutex);
4079 }
4080
4081 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4082                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4083                           struct ieee80211_key_conf *key)
4084 {
4085         struct b43_wl *wl = hw_to_b43_wl(hw);
4086         struct b43_wldev *dev;
4087         u8 algorithm;
4088         u8 index;
4089         int err;
4090         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4091
4092         if (modparam_nohwcrypt)
4093                 return -ENOSPC; /* User disabled HW-crypto */
4094
4095         if ((vif->type == NL80211_IFTYPE_ADHOC ||
4096              vif->type == NL80211_IFTYPE_MESH_POINT) &&
4097             (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4098              key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4099             !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4100                 /*
4101                  * For now, disable hw crypto for the RSN IBSS group keys. This
4102                  * could be optimized in the future, but until that gets
4103                  * implemented, use of software crypto for group addressed
4104                  * frames is a acceptable to allow RSN IBSS to be used.
4105                  */
4106                 return -EOPNOTSUPP;
4107         }
4108
4109         mutex_lock(&wl->mutex);
4110
4111         dev = wl->current_dev;
4112         err = -ENODEV;
4113         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4114                 goto out_unlock;
4115
4116         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4117                 /* We don't have firmware for the crypto engine.
4118                  * Must use software-crypto. */
4119                 err = -EOPNOTSUPP;
4120                 goto out_unlock;
4121         }
4122
4123         err = -EINVAL;
4124         switch (key->cipher) {
4125         case WLAN_CIPHER_SUITE_WEP40:
4126                 algorithm = B43_SEC_ALGO_WEP40;
4127                 break;
4128         case WLAN_CIPHER_SUITE_WEP104:
4129                 algorithm = B43_SEC_ALGO_WEP104;
4130                 break;
4131         case WLAN_CIPHER_SUITE_TKIP:
4132                 algorithm = B43_SEC_ALGO_TKIP;
4133                 break;
4134         case WLAN_CIPHER_SUITE_CCMP:
4135                 algorithm = B43_SEC_ALGO_AES;
4136                 break;
4137         default:
4138                 B43_WARN_ON(1);
4139                 goto out_unlock;
4140         }
4141         index = (u8) (key->keyidx);
4142         if (index > 3)
4143                 goto out_unlock;
4144
4145         switch (cmd) {
4146         case SET_KEY:
4147                 if (algorithm == B43_SEC_ALGO_TKIP &&
4148                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4149                     !modparam_hwtkip)) {
4150                         /* We support only pairwise key */
4151                         err = -EOPNOTSUPP;
4152                         goto out_unlock;
4153                 }
4154
4155                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4156                         if (WARN_ON(!sta)) {
4157                                 err = -EOPNOTSUPP;
4158                                 goto out_unlock;
4159                         }
4160                         /* Pairwise key with an assigned MAC address. */
4161                         err = b43_key_write(dev, -1, algorithm,
4162                                             key->key, key->keylen,
4163                                             sta->addr, key);
4164                 } else {
4165                         /* Group key */
4166                         err = b43_key_write(dev, index, algorithm,
4167                                             key->key, key->keylen, NULL, key);
4168                 }
4169                 if (err)
4170                         goto out_unlock;
4171
4172                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4173                     algorithm == B43_SEC_ALGO_WEP104) {
4174                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4175                 } else {
4176                         b43_hf_write(dev,
4177                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4178                 }
4179                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4180                 if (algorithm == B43_SEC_ALGO_TKIP)
4181                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4182                 break;
4183         case DISABLE_KEY: {
4184                 err = b43_key_clear(dev, key->hw_key_idx);
4185                 if (err)
4186                         goto out_unlock;
4187                 break;
4188         }
4189         default:
4190                 B43_WARN_ON(1);
4191         }
4192
4193 out_unlock:
4194         if (!err) {
4195                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4196                        "mac: %pM\n",
4197                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4198                        sta ? sta->addr : bcast_addr);
4199                 b43_dump_keymemory(dev);
4200         }
4201         mutex_unlock(&wl->mutex);
4202
4203         return err;
4204 }
4205
4206 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4207                                     unsigned int changed, unsigned int *fflags,
4208                                     u64 multicast)
4209 {
4210         struct b43_wl *wl = hw_to_b43_wl(hw);
4211         struct b43_wldev *dev;
4212
4213         mutex_lock(&wl->mutex);
4214         dev = wl->current_dev;
4215         if (!dev) {
4216                 *fflags = 0;
4217                 goto out_unlock;
4218         }
4219
4220         *fflags &= FIF_PROMISC_IN_BSS |
4221                   FIF_ALLMULTI |
4222                   FIF_FCSFAIL |
4223                   FIF_PLCPFAIL |
4224                   FIF_CONTROL |
4225                   FIF_OTHER_BSS |
4226                   FIF_BCN_PRBRESP_PROMISC;
4227
4228         changed &= FIF_PROMISC_IN_BSS |
4229                    FIF_ALLMULTI |
4230                    FIF_FCSFAIL |
4231                    FIF_PLCPFAIL |
4232                    FIF_CONTROL |
4233                    FIF_OTHER_BSS |
4234                    FIF_BCN_PRBRESP_PROMISC;
4235
4236         wl->filter_flags = *fflags;
4237
4238         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4239                 b43_adjust_opmode(dev);
4240
4241 out_unlock:
4242         mutex_unlock(&wl->mutex);
4243 }
4244
4245 /* Locking: wl->mutex
4246  * Returns the current dev. This might be different from the passed in dev,
4247  * because the core might be gone away while we unlocked the mutex. */
4248 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4249 {
4250         struct b43_wl *wl;
4251         struct b43_wldev *orig_dev;
4252         u32 mask;
4253         int queue_num;
4254
4255         if (!dev)
4256                 return NULL;
4257         wl = dev->wl;
4258 redo:
4259         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4260                 return dev;
4261
4262         /* Cancel work. Unlock to avoid deadlocks. */
4263         mutex_unlock(&wl->mutex);
4264         cancel_delayed_work_sync(&dev->periodic_work);
4265         cancel_work_sync(&wl->tx_work);
4266         mutex_lock(&wl->mutex);
4267         dev = wl->current_dev;
4268         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4269                 /* Whoops, aliens ate up the device while we were unlocked. */
4270                 return dev;
4271         }
4272
4273         /* Disable interrupts on the device. */
4274         b43_set_status(dev, B43_STAT_INITIALIZED);
4275         if (b43_bus_host_is_sdio(dev->dev)) {
4276                 /* wl->mutex is locked. That is enough. */
4277                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4278                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4279         } else {
4280                 spin_lock_irq(&wl->hardirq_lock);
4281                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4282                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4283                 spin_unlock_irq(&wl->hardirq_lock);
4284         }
4285         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4286         orig_dev = dev;
4287         mutex_unlock(&wl->mutex);
4288         if (b43_bus_host_is_sdio(dev->dev)) {
4289                 b43_sdio_free_irq(dev);
4290         } else {
4291                 synchronize_irq(dev->dev->irq);
4292                 free_irq(dev->dev->irq, dev);
4293         }
4294         mutex_lock(&wl->mutex);
4295         dev = wl->current_dev;
4296         if (!dev)
4297                 return dev;
4298         if (dev != orig_dev) {
4299                 if (b43_status(dev) >= B43_STAT_STARTED)
4300                         goto redo;
4301                 return dev;
4302         }
4303         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4304         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4305
4306         /* Drain all TX queues. */
4307         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4308                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
4309                         struct sk_buff *skb;
4310
4311                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
4312                         ieee80211_free_txskb(wl->hw, skb);
4313                 }
4314         }
4315
4316         b43_mac_suspend(dev);
4317         b43_leds_exit(dev);
4318         b43dbg(wl, "Wireless interface stopped\n");
4319
4320         return dev;
4321 }
4322
4323 /* Locking: wl->mutex */
4324 static int b43_wireless_core_start(struct b43_wldev *dev)
4325 {
4326         int err;
4327
4328         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4329
4330         drain_txstatus_queue(dev);
4331         if (b43_bus_host_is_sdio(dev->dev)) {
4332                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4333                 if (err) {
4334                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4335                         goto out;
4336                 }
4337         } else {
4338                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4339                                            b43_interrupt_thread_handler,
4340                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4341                 if (err) {
4342                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4343                                dev->dev->irq);
4344                         goto out;
4345                 }
4346         }
4347
4348         /* We are ready to run. */
4349         ieee80211_wake_queues(dev->wl->hw);
4350         b43_set_status(dev, B43_STAT_STARTED);
4351
4352         /* Start data flow (TX/RX). */
4353         b43_mac_enable(dev);
4354         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4355
4356         /* Start maintenance work */
4357         b43_periodic_tasks_setup(dev);
4358
4359         b43_leds_init(dev);
4360
4361         b43dbg(dev->wl, "Wireless interface started\n");
4362 out:
4363         return err;
4364 }
4365
4366 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4367 {
4368         switch (phy_type) {
4369         case B43_PHYTYPE_A:
4370                 return "A";
4371         case B43_PHYTYPE_B:
4372                 return "B";
4373         case B43_PHYTYPE_G:
4374                 return "G";
4375         case B43_PHYTYPE_N:
4376                 return "N";
4377         case B43_PHYTYPE_LP:
4378                 return "LP";
4379         case B43_PHYTYPE_SSLPN:
4380                 return "SSLPN";
4381         case B43_PHYTYPE_HT:
4382                 return "HT";
4383         case B43_PHYTYPE_LCN:
4384                 return "LCN";
4385         case B43_PHYTYPE_LCNXN:
4386                 return "LCNXN";
4387         case B43_PHYTYPE_LCN40:
4388                 return "LCN40";
4389         case B43_PHYTYPE_AC:
4390                 return "AC";
4391         }
4392         return "UNKNOWN";
4393 }
4394
4395 /* Get PHY and RADIO versioning numbers */
4396 static int b43_phy_versioning(struct b43_wldev *dev)
4397 {
4398         struct b43_phy *phy = &dev->phy;
4399         const u8 core_rev = dev->dev->core_rev;
4400         u32 tmp;
4401         u8 analog_type;
4402         u8 phy_type;
4403         u8 phy_rev;
4404         u16 radio_manuf;
4405         u16 radio_id;
4406         u16 radio_rev;
4407         u8 radio_ver;
4408         int unsupported = 0;
4409
4410         /* Get PHY versioning */
4411         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4412         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4413         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4414         phy_rev = (tmp & B43_PHYVER_VERSION);
4415
4416         /* LCNXN is continuation of N which run out of revisions */
4417         if (phy_type == B43_PHYTYPE_LCNXN) {
4418                 phy_type = B43_PHYTYPE_N;
4419                 phy_rev += 16;
4420         }
4421
4422         switch (phy_type) {
4423 #ifdef CONFIG_B43_PHY_G
4424         case B43_PHYTYPE_G:
4425                 if (phy_rev > 9)
4426                         unsupported = 1;
4427                 break;
4428 #endif
4429 #ifdef CONFIG_B43_PHY_N
4430         case B43_PHYTYPE_N:
4431                 if (phy_rev >= 19)
4432                         unsupported = 1;
4433                 break;
4434 #endif
4435 #ifdef CONFIG_B43_PHY_LP
4436         case B43_PHYTYPE_LP:
4437                 if (phy_rev > 2)
4438                         unsupported = 1;
4439                 break;
4440 #endif
4441 #ifdef CONFIG_B43_PHY_HT
4442         case B43_PHYTYPE_HT:
4443                 if (phy_rev > 1)
4444                         unsupported = 1;
4445                 break;
4446 #endif
4447 #ifdef CONFIG_B43_PHY_LCN
4448         case B43_PHYTYPE_LCN:
4449                 if (phy_rev > 1)
4450                         unsupported = 1;
4451                 break;
4452 #endif
4453         default:
4454                 unsupported = 1;
4455         }
4456         if (unsupported) {
4457                 b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4458                        analog_type, phy_type, b43_phy_name(dev, phy_type),
4459                        phy_rev);
4460                 return -EOPNOTSUPP;
4461         }
4462         b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4463                 analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4464
4465         /* Get RADIO versioning */
4466         if (core_rev == 40 || core_rev == 42) {
4467                 radio_manuf = 0x17F;
4468
4469                 b43_write16(dev, B43_MMIO_RADIO24_CONTROL, 0);
4470                 radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4471
4472                 b43_write16(dev, B43_MMIO_RADIO24_CONTROL, 1);
4473                 radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4474
4475                 radio_ver = 0; /* Is there version somewhere? */
4476         } else if (core_rev >= 24) {
4477                 u16 radio24[3];
4478
4479                 for (tmp = 0; tmp < 3; tmp++) {
4480                         b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4481                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4482                 }
4483
4484                 radio_manuf = 0x17F;
4485                 radio_id = (radio24[2] << 8) | radio24[1];
4486                 radio_rev = (radio24[0] & 0xF);
4487                 radio_ver = (radio24[0] & 0xF0) >> 4;
4488         } else {
4489                 if (dev->dev->chip_id == 0x4317) {
4490                         if (dev->dev->chip_rev == 0)
4491                                 tmp = 0x3205017F;
4492                         else if (dev->dev->chip_rev == 1)
4493                                 tmp = 0x4205017F;
4494                         else
4495                                 tmp = 0x5205017F;
4496                 } else {
4497                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4498                                     B43_RADIOCTL_ID);
4499                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4500                         b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4501                                     B43_RADIOCTL_ID);
4502                         tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4503                                 << 16;
4504                 }
4505                 radio_manuf = (tmp & 0x00000FFF);
4506                 radio_id = (tmp & 0x0FFFF000) >> 12;
4507                 radio_rev = (tmp & 0xF0000000) >> 28;
4508                 radio_ver = 0; /* Probably not available on old hw */
4509         }
4510
4511         if (radio_manuf != 0x17F /* Broadcom */)
4512                 unsupported = 1;
4513         switch (phy_type) {
4514         case B43_PHYTYPE_A:
4515                 if (radio_id != 0x2060)
4516                         unsupported = 1;
4517                 if (radio_rev != 1)
4518                         unsupported = 1;
4519                 if (radio_manuf != 0x17F)
4520                         unsupported = 1;
4521                 break;
4522         case B43_PHYTYPE_B:
4523                 if ((radio_id & 0xFFF0) != 0x2050)
4524                         unsupported = 1;
4525                 break;
4526         case B43_PHYTYPE_G:
4527                 if (radio_id != 0x2050)
4528                         unsupported = 1;
4529                 break;
4530         case B43_PHYTYPE_N:
4531                 if (radio_id != 0x2055 && radio_id != 0x2056 &&
4532                     radio_id != 0x2057)
4533                         unsupported = 1;
4534                 if (radio_id == 0x2057 &&
4535                     !(radio_rev == 9 || radio_rev == 14))
4536                         unsupported = 1;
4537                 break;
4538         case B43_PHYTYPE_LP:
4539                 if (radio_id != 0x2062 && radio_id != 0x2063)
4540                         unsupported = 1;
4541                 break;
4542         case B43_PHYTYPE_HT:
4543                 if (radio_id != 0x2059)
4544                         unsupported = 1;
4545                 break;
4546         case B43_PHYTYPE_LCN:
4547                 if (radio_id != 0x2064)
4548                         unsupported = 1;
4549                 break;
4550         default:
4551                 B43_WARN_ON(1);
4552         }
4553         if (unsupported) {
4554                 b43err(dev->wl,
4555                        "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4556                        radio_manuf, radio_id, radio_rev, radio_ver);
4557                 return -EOPNOTSUPP;
4558         }
4559         b43info(dev->wl,
4560                 "Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4561                 radio_manuf, radio_id, radio_rev, radio_ver);
4562
4563         /* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4564         phy->radio_manuf = radio_manuf;
4565         phy->radio_ver = radio_id;
4566         phy->radio_rev = radio_rev;
4567
4568         phy->analog = analog_type;
4569         phy->type = phy_type;
4570         phy->rev = phy_rev;
4571
4572         return 0;
4573 }
4574
4575 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4576                                       struct b43_phy *phy)
4577 {
4578         phy->hardware_power_control = !!modparam_hwpctl;
4579         phy->next_txpwr_check_time = jiffies;
4580         /* PHY TX errors counter. */
4581         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4582
4583 #if B43_DEBUG
4584         phy->phy_locked = false;
4585         phy->radio_locked = false;
4586 #endif
4587 }
4588
4589 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4590 {
4591         dev->dfq_valid = false;
4592
4593         /* Assume the radio is enabled. If it's not enabled, the state will
4594          * immediately get fixed on the first periodic work run. */
4595         dev->radio_hw_enable = true;
4596
4597         /* Stats */
4598         memset(&dev->stats, 0, sizeof(dev->stats));
4599
4600         setup_struct_phy_for_init(dev, &dev->phy);
4601
4602         /* IRQ related flags */
4603         dev->irq_reason = 0;
4604         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4605         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4606         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4607                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4608
4609         dev->mac_suspended = 1;
4610
4611         /* Noise calculation context */
4612         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4613 }
4614
4615 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4616 {
4617         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4618         u64 hf;
4619
4620         if (!modparam_btcoex)
4621                 return;
4622         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4623                 return;
4624         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4625                 return;
4626
4627         hf = b43_hf_read(dev);
4628         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4629                 hf |= B43_HF_BTCOEXALT;
4630         else
4631                 hf |= B43_HF_BTCOEX;
4632         b43_hf_write(dev, hf);
4633 }
4634
4635 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4636 {
4637         if (!modparam_btcoex)
4638                 return;
4639         //TODO
4640 }
4641
4642 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4643 {
4644         struct ssb_bus *bus;
4645         u32 tmp;
4646
4647 #ifdef CONFIG_B43_SSB
4648         if (dev->dev->bus_type != B43_BUS_SSB)
4649                 return;
4650 #else
4651         return;
4652 #endif
4653
4654         bus = dev->dev->sdev->bus;
4655
4656         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4657             (bus->chip_id == 0x4312)) {
4658                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4659                 tmp &= ~SSB_IMCFGLO_REQTO;
4660                 tmp &= ~SSB_IMCFGLO_SERTO;
4661                 tmp |= 0x3;
4662                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4663                 ssb_commit_settings(bus);
4664         }
4665 }
4666
4667 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4668 {
4669         u16 pu_delay;
4670
4671         /* The time value is in microseconds. */
4672         if (dev->phy.type == B43_PHYTYPE_A)
4673                 pu_delay = 3700;
4674         else
4675                 pu_delay = 1050;
4676         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4677                 pu_delay = 500;
4678         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4679                 pu_delay = max(pu_delay, (u16)2400);
4680
4681         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4682 }
4683
4684 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4685 static void b43_set_pretbtt(struct b43_wldev *dev)
4686 {
4687         u16 pretbtt;
4688
4689         /* The time value is in microseconds. */
4690         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4691                 pretbtt = 2;
4692         } else {
4693                 if (dev->phy.type == B43_PHYTYPE_A)
4694                         pretbtt = 120;
4695                 else
4696                         pretbtt = 250;
4697         }
4698         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4699         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4700 }
4701
4702 /* Shutdown a wireless core */
4703 /* Locking: wl->mutex */
4704 static void b43_wireless_core_exit(struct b43_wldev *dev)
4705 {
4706         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4707         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4708                 return;
4709
4710         b43_set_status(dev, B43_STAT_UNINIT);
4711
4712         /* Stop the microcode PSM. */
4713         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4714                       B43_MACCTL_PSM_JMP0);
4715
4716         switch (dev->dev->bus_type) {
4717 #ifdef CONFIG_B43_BCMA
4718         case B43_BUS_BCMA:
4719                 bcma_core_pci_down(dev->dev->bdev->bus);
4720                 break;
4721 #endif
4722 #ifdef CONFIG_B43_SSB
4723         case B43_BUS_SSB:
4724                 /* TODO */
4725                 break;
4726 #endif
4727         }
4728
4729         b43_dma_free(dev);
4730         b43_pio_free(dev);
4731         b43_chip_exit(dev);
4732         dev->phy.ops->switch_analog(dev, 0);
4733         if (dev->wl->current_beacon) {
4734                 dev_kfree_skb_any(dev->wl->current_beacon);
4735                 dev->wl->current_beacon = NULL;
4736         }
4737
4738         b43_device_disable(dev, 0);
4739         b43_bus_may_powerdown(dev);
4740 }
4741
4742 /* Initialize a wireless core */
4743 static int b43_wireless_core_init(struct b43_wldev *dev)
4744 {
4745         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4746         struct b43_phy *phy = &dev->phy;
4747         int err;
4748         u64 hf;
4749
4750         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4751
4752         err = b43_bus_powerup(dev, 0);
4753         if (err)
4754                 goto out;
4755         if (!b43_device_is_enabled(dev))
4756                 b43_wireless_core_reset(dev, phy->gmode);
4757
4758         /* Reset all data structures. */
4759         setup_struct_wldev_for_init(dev);
4760         phy->ops->prepare_structs(dev);
4761
4762         /* Enable IRQ routing to this device. */
4763         switch (dev->dev->bus_type) {
4764 #ifdef CONFIG_B43_BCMA
4765         case B43_BUS_BCMA:
4766                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci[0],
4767                                       dev->dev->bdev, true);
4768                 bcma_core_pci_up(dev->dev->bdev->bus);
4769                 break;
4770 #endif
4771 #ifdef CONFIG_B43_SSB
4772         case B43_BUS_SSB:
4773                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4774                                                dev->dev->sdev);
4775                 break;
4776 #endif
4777         }
4778
4779         b43_imcfglo_timeouts_workaround(dev);
4780         b43_bluetooth_coext_disable(dev);
4781         if (phy->ops->prepare_hardware) {
4782                 err = phy->ops->prepare_hardware(dev);
4783                 if (err)
4784                         goto err_busdown;
4785         }
4786         err = b43_chip_init(dev);
4787         if (err)
4788                 goto err_busdown;
4789         b43_shm_write16(dev, B43_SHM_SHARED,
4790                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4791         hf = b43_hf_read(dev);
4792         if (phy->type == B43_PHYTYPE_G) {
4793                 hf |= B43_HF_SYMW;
4794                 if (phy->rev == 1)
4795                         hf |= B43_HF_GDCW;
4796                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4797                         hf |= B43_HF_OFDMPABOOST;
4798         }
4799         if (phy->radio_ver == 0x2050) {
4800                 if (phy->radio_rev == 6)
4801                         hf |= B43_HF_4318TSSI;
4802                 if (phy->radio_rev < 6)
4803                         hf |= B43_HF_VCORECALC;
4804         }
4805         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4806                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4807 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4808         if (dev->dev->bus_type == B43_BUS_SSB &&
4809             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4810             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4811                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4812 #endif
4813         hf &= ~B43_HF_SKCFPUP;
4814         b43_hf_write(dev, hf);
4815
4816         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4817                              B43_DEFAULT_LONG_RETRY_LIMIT);
4818         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4819         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4820
4821         /* Disable sending probe responses from firmware.
4822          * Setting the MaxTime to one usec will always trigger
4823          * a timeout, so we never send any probe resp.
4824          * A timeout of zero is infinite. */
4825         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4826
4827         b43_rate_memory_init(dev);
4828         b43_set_phytxctl_defaults(dev);
4829
4830         /* Minimum Contention Window */
4831         if (phy->type == B43_PHYTYPE_B)
4832                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4833         else
4834                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4835         /* Maximum Contention Window */
4836         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4837
4838         if (b43_bus_host_is_pcmcia(dev->dev) ||
4839             b43_bus_host_is_sdio(dev->dev)) {
4840                 dev->__using_pio_transfers = true;
4841                 err = b43_pio_init(dev);
4842         } else if (dev->use_pio) {
4843                 b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4844                         "This should not be needed and will result in lower "
4845                         "performance.\n");
4846                 dev->__using_pio_transfers = true;
4847                 err = b43_pio_init(dev);
4848         } else {
4849                 dev->__using_pio_transfers = false;
4850                 err = b43_dma_init(dev);
4851         }
4852         if (err)
4853                 goto err_chip_exit;
4854         b43_qos_init(dev);
4855         b43_set_synth_pu_delay(dev, 1);
4856         b43_bluetooth_coext_enable(dev);
4857
4858         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4859         b43_upload_card_macaddress(dev);
4860         b43_security_init(dev);
4861
4862         ieee80211_wake_queues(dev->wl->hw);
4863
4864         b43_set_status(dev, B43_STAT_INITIALIZED);
4865
4866 out:
4867         return err;
4868
4869 err_chip_exit:
4870         b43_chip_exit(dev);
4871 err_busdown:
4872         b43_bus_may_powerdown(dev);
4873         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4874         return err;
4875 }
4876
4877 static int b43_op_add_interface(struct ieee80211_hw *hw,
4878                                 struct ieee80211_vif *vif)
4879 {
4880         struct b43_wl *wl = hw_to_b43_wl(hw);
4881         struct b43_wldev *dev;
4882         int err = -EOPNOTSUPP;
4883
4884         /* TODO: allow WDS/AP devices to coexist */
4885
4886         if (vif->type != NL80211_IFTYPE_AP &&
4887             vif->type != NL80211_IFTYPE_MESH_POINT &&
4888             vif->type != NL80211_IFTYPE_STATION &&
4889             vif->type != NL80211_IFTYPE_WDS &&
4890             vif->type != NL80211_IFTYPE_ADHOC)
4891                 return -EOPNOTSUPP;
4892
4893         mutex_lock(&wl->mutex);
4894         if (wl->operating)
4895                 goto out_mutex_unlock;
4896
4897         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4898
4899         dev = wl->current_dev;
4900         wl->operating = true;
4901         wl->vif = vif;
4902         wl->if_type = vif->type;
4903         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4904
4905         b43_adjust_opmode(dev);
4906         b43_set_pretbtt(dev);
4907         b43_set_synth_pu_delay(dev, 0);
4908         b43_upload_card_macaddress(dev);
4909
4910         err = 0;
4911  out_mutex_unlock:
4912         mutex_unlock(&wl->mutex);
4913
4914         if (err == 0)
4915                 b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
4916
4917         return err;
4918 }
4919
4920 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4921                                     struct ieee80211_vif *vif)
4922 {
4923         struct b43_wl *wl = hw_to_b43_wl(hw);
4924         struct b43_wldev *dev = wl->current_dev;
4925
4926         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4927
4928         mutex_lock(&wl->mutex);
4929
4930         B43_WARN_ON(!wl->operating);
4931         B43_WARN_ON(wl->vif != vif);
4932         wl->vif = NULL;
4933
4934         wl->operating = false;
4935
4936         b43_adjust_opmode(dev);
4937         memset(wl->mac_addr, 0, ETH_ALEN);
4938         b43_upload_card_macaddress(dev);
4939
4940         mutex_unlock(&wl->mutex);
4941 }
4942
4943 static int b43_op_start(struct ieee80211_hw *hw)
4944 {
4945         struct b43_wl *wl = hw_to_b43_wl(hw);
4946         struct b43_wldev *dev = wl->current_dev;
4947         int did_init = 0;
4948         int err = 0;
4949
4950         /* Kill all old instance specific information to make sure
4951          * the card won't use it in the short timeframe between start
4952          * and mac80211 reconfiguring it. */
4953         memset(wl->bssid, 0, ETH_ALEN);
4954         memset(wl->mac_addr, 0, ETH_ALEN);
4955         wl->filter_flags = 0;
4956         wl->radiotap_enabled = false;
4957         b43_qos_clear(wl);
4958         wl->beacon0_uploaded = false;
4959         wl->beacon1_uploaded = false;
4960         wl->beacon_templates_virgin = true;
4961         wl->radio_enabled = true;
4962
4963         mutex_lock(&wl->mutex);
4964
4965         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4966                 err = b43_wireless_core_init(dev);
4967                 if (err)
4968                         goto out_mutex_unlock;
4969                 did_init = 1;
4970         }
4971
4972         if (b43_status(dev) < B43_STAT_STARTED) {
4973                 err = b43_wireless_core_start(dev);
4974                 if (err) {
4975                         if (did_init)
4976                                 b43_wireless_core_exit(dev);
4977                         goto out_mutex_unlock;
4978                 }
4979         }
4980
4981         /* XXX: only do if device doesn't support rfkill irq */
4982         wiphy_rfkill_start_polling(hw->wiphy);
4983
4984  out_mutex_unlock:
4985         mutex_unlock(&wl->mutex);
4986
4987         /*
4988          * Configuration may have been overwritten during initialization.
4989          * Reload the configuration, but only if initialization was
4990          * successful. Reloading the configuration after a failed init
4991          * may hang the system.
4992          */
4993         if (!err)
4994                 b43_op_config(hw, ~0);
4995
4996         return err;
4997 }
4998
4999 static void b43_op_stop(struct ieee80211_hw *hw)
5000 {
5001         struct b43_wl *wl = hw_to_b43_wl(hw);
5002         struct b43_wldev *dev = wl->current_dev;
5003
5004         cancel_work_sync(&(wl->beacon_update_trigger));
5005
5006         if (!dev)
5007                 goto out;
5008
5009         mutex_lock(&wl->mutex);
5010         if (b43_status(dev) >= B43_STAT_STARTED) {
5011                 dev = b43_wireless_core_stop(dev);
5012                 if (!dev)
5013                         goto out_unlock;
5014         }
5015         b43_wireless_core_exit(dev);
5016         wl->radio_enabled = false;
5017
5018 out_unlock:
5019         mutex_unlock(&wl->mutex);
5020 out:
5021         cancel_work_sync(&(wl->txpower_adjust_work));
5022 }
5023
5024 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5025                                  struct ieee80211_sta *sta, bool set)
5026 {
5027         struct b43_wl *wl = hw_to_b43_wl(hw);
5028
5029         /* FIXME: add locking */
5030         b43_update_templates(wl);
5031
5032         return 0;
5033 }
5034
5035 static void b43_op_sta_notify(struct ieee80211_hw *hw,
5036                               struct ieee80211_vif *vif,
5037                               enum sta_notify_cmd notify_cmd,
5038                               struct ieee80211_sta *sta)
5039 {
5040         struct b43_wl *wl = hw_to_b43_wl(hw);
5041
5042         B43_WARN_ON(!vif || wl->vif != vif);
5043 }
5044
5045 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
5046 {
5047         struct b43_wl *wl = hw_to_b43_wl(hw);
5048         struct b43_wldev *dev;
5049
5050         mutex_lock(&wl->mutex);
5051         dev = wl->current_dev;
5052         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5053                 /* Disable CFP update during scan on other channels. */
5054                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5055         }
5056         mutex_unlock(&wl->mutex);
5057 }
5058
5059 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
5060 {
5061         struct b43_wl *wl = hw_to_b43_wl(hw);
5062         struct b43_wldev *dev;
5063
5064         mutex_lock(&wl->mutex);
5065         dev = wl->current_dev;
5066         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5067                 /* Re-enable CFP update. */
5068                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5069         }
5070         mutex_unlock(&wl->mutex);
5071 }
5072
5073 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5074                              struct survey_info *survey)
5075 {
5076         struct b43_wl *wl = hw_to_b43_wl(hw);
5077         struct b43_wldev *dev = wl->current_dev;
5078         struct ieee80211_conf *conf = &hw->conf;
5079
5080         if (idx != 0)
5081                 return -ENOENT;
5082
5083         survey->channel = conf->chandef.chan;
5084         survey->filled = SURVEY_INFO_NOISE_DBM;
5085         survey->noise = dev->stats.link_noise;
5086
5087         return 0;
5088 }
5089
5090 static const struct ieee80211_ops b43_hw_ops = {
5091         .tx                     = b43_op_tx,
5092         .conf_tx                = b43_op_conf_tx,
5093         .add_interface          = b43_op_add_interface,
5094         .remove_interface       = b43_op_remove_interface,
5095         .config                 = b43_op_config,
5096         .bss_info_changed       = b43_op_bss_info_changed,
5097         .configure_filter       = b43_op_configure_filter,
5098         .set_key                = b43_op_set_key,
5099         .update_tkip_key        = b43_op_update_tkip_key,
5100         .get_stats              = b43_op_get_stats,
5101         .get_tsf                = b43_op_get_tsf,
5102         .set_tsf                = b43_op_set_tsf,
5103         .start                  = b43_op_start,
5104         .stop                   = b43_op_stop,
5105         .set_tim                = b43_op_beacon_set_tim,
5106         .sta_notify             = b43_op_sta_notify,
5107         .sw_scan_start          = b43_op_sw_scan_start_notifier,
5108         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
5109         .get_survey             = b43_op_get_survey,
5110         .rfkill_poll            = b43_rfkill_poll,
5111 };
5112
5113 /* Hard-reset the chip. Do not call this directly.
5114  * Use b43_controller_restart()
5115  */
5116 static void b43_chip_reset(struct work_struct *work)
5117 {
5118         struct b43_wldev *dev =
5119             container_of(work, struct b43_wldev, restart_work);
5120         struct b43_wl *wl = dev->wl;
5121         int err = 0;
5122         int prev_status;
5123
5124         mutex_lock(&wl->mutex);
5125
5126         prev_status = b43_status(dev);
5127         /* Bring the device down... */
5128         if (prev_status >= B43_STAT_STARTED) {
5129                 dev = b43_wireless_core_stop(dev);
5130                 if (!dev) {
5131                         err = -ENODEV;
5132                         goto out;
5133                 }
5134         }
5135         if (prev_status >= B43_STAT_INITIALIZED)
5136                 b43_wireless_core_exit(dev);
5137
5138         /* ...and up again. */
5139         if (prev_status >= B43_STAT_INITIALIZED) {
5140                 err = b43_wireless_core_init(dev);
5141                 if (err)
5142                         goto out;
5143         }
5144         if (prev_status >= B43_STAT_STARTED) {
5145                 err = b43_wireless_core_start(dev);
5146                 if (err) {
5147                         b43_wireless_core_exit(dev);
5148                         goto out;
5149                 }
5150         }
5151 out:
5152         if (err)
5153                 wl->current_dev = NULL; /* Failed to init the dev. */
5154         mutex_unlock(&wl->mutex);
5155
5156         if (err) {
5157                 b43err(wl, "Controller restart FAILED\n");
5158                 return;
5159         }
5160
5161         /* reload configuration */
5162         b43_op_config(wl->hw, ~0);
5163         if (wl->vif)
5164                 b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5165
5166         b43info(wl, "Controller restarted\n");
5167 }
5168
5169 static int b43_setup_bands(struct b43_wldev *dev,
5170                            bool have_2ghz_phy, bool have_5ghz_phy)
5171 {
5172         struct ieee80211_hw *hw = dev->wl->hw;
5173         struct b43_phy *phy = &dev->phy;
5174         bool limited_2g;
5175         bool limited_5g;
5176
5177         /* We don't support all 2 GHz channels on some devices */
5178         limited_2g = phy->radio_ver == 0x2057 &&
5179                      (phy->radio_rev == 9 || phy->radio_rev == 14);
5180         limited_5g = phy->radio_ver == 0x2057 &&
5181                      phy->radio_rev == 9;
5182
5183         if (have_2ghz_phy)
5184                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = limited_2g ?
5185                         &b43_band_2ghz_limited : &b43_band_2GHz;
5186         if (dev->phy.type == B43_PHYTYPE_N) {
5187                 if (have_5ghz_phy)
5188                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = limited_5g ?
5189                                 &b43_band_5GHz_nphy_limited :
5190                                 &b43_band_5GHz_nphy;
5191         } else {
5192                 if (have_5ghz_phy)
5193                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5194         }
5195
5196         dev->phy.supports_2ghz = have_2ghz_phy;
5197         dev->phy.supports_5ghz = have_5ghz_phy;
5198
5199         return 0;
5200 }
5201
5202 static void b43_wireless_core_detach(struct b43_wldev *dev)
5203 {
5204         /* We release firmware that late to not be required to re-request
5205          * is all the time when we reinit the core. */
5206         b43_release_firmware(dev);
5207         b43_phy_free(dev);
5208 }
5209
5210 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5211                                 bool *have_5ghz_phy)
5212 {
5213         u16 dev_id = 0;
5214
5215 #ifdef CONFIG_B43_BCMA
5216         if (dev->dev->bus_type == B43_BUS_BCMA &&
5217             dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5218                 dev_id = dev->dev->bdev->bus->host_pci->device;
5219 #endif
5220 #ifdef CONFIG_B43_SSB
5221         if (dev->dev->bus_type == B43_BUS_SSB &&
5222             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5223                 dev_id = dev->dev->sdev->bus->host_pci->device;
5224 #endif
5225         /* Override with SPROM value if available */
5226         if (dev->dev->bus_sprom->dev_id)
5227                 dev_id = dev->dev->bus_sprom->dev_id;
5228
5229         /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5230         switch (dev_id) {
5231         case 0x4324: /* BCM4306 */
5232         case 0x4312: /* BCM4311 */
5233         case 0x4319: /* BCM4318 */
5234         case 0x4328: /* BCM4321 */
5235         case 0x432b: /* BCM4322 */
5236         case 0x4350: /* BCM43222 */
5237         case 0x4353: /* BCM43224 */
5238         case 0x0576: /* BCM43224 */
5239         case 0x435f: /* BCM6362 */
5240         case 0x4331: /* BCM4331 */
5241         case 0x4359: /* BCM43228 */
5242         case 0x43a0: /* BCM4360 */
5243         case 0x43b1: /* BCM4352 */
5244                 /* Dual band devices */
5245                 *have_2ghz_phy = true;
5246                 *have_5ghz_phy = true;
5247                 return;
5248         case 0x4321: /* BCM4306 */
5249         case 0x4313: /* BCM4311 */
5250         case 0x431a: /* BCM4318 */
5251         case 0x432a: /* BCM4321 */
5252         case 0x432d: /* BCM4322 */
5253         case 0x4352: /* BCM43222 */
5254         case 0x4333: /* BCM4331 */
5255         case 0x43a2: /* BCM4360 */
5256         case 0x43b3: /* BCM4352 */
5257                 /* 5 GHz only devices */
5258                 *have_2ghz_phy = false;
5259                 *have_5ghz_phy = true;
5260                 return;
5261         }
5262
5263         /* As a fallback, try to guess using PHY type */
5264         switch (dev->phy.type) {
5265         case B43_PHYTYPE_A:
5266                 *have_2ghz_phy = false;
5267                 *have_5ghz_phy = true;
5268                 return;
5269         case B43_PHYTYPE_G:
5270         case B43_PHYTYPE_N:
5271         case B43_PHYTYPE_LP:
5272         case B43_PHYTYPE_HT:
5273         case B43_PHYTYPE_LCN:
5274                 *have_2ghz_phy = true;
5275                 *have_5ghz_phy = false;
5276                 return;
5277         }
5278
5279         B43_WARN_ON(1);
5280 }
5281
5282 static int b43_wireless_core_attach(struct b43_wldev *dev)
5283 {
5284         struct b43_wl *wl = dev->wl;
5285         struct b43_phy *phy = &dev->phy;
5286         int err;
5287         u32 tmp;
5288         bool have_2ghz_phy = false, have_5ghz_phy = false;
5289
5290         /* Do NOT do any device initialization here.
5291          * Do it in wireless_core_init() instead.
5292          * This function is for gathering basic information about the HW, only.
5293          * Also some structs may be set up here. But most likely you want to have
5294          * that in core_init(), too.
5295          */
5296
5297         err = b43_bus_powerup(dev, 0);
5298         if (err) {
5299                 b43err(wl, "Bus powerup failed\n");
5300                 goto out;
5301         }
5302
5303         phy->do_full_init = true;
5304
5305         /* Try to guess supported bands for the first init needs */
5306         switch (dev->dev->bus_type) {
5307 #ifdef CONFIG_B43_BCMA
5308         case B43_BUS_BCMA:
5309                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5310                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5311                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5312                 break;
5313 #endif
5314 #ifdef CONFIG_B43_SSB
5315         case B43_BUS_SSB:
5316                 if (dev->dev->core_rev >= 5) {
5317                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5318                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5319                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5320                 } else
5321                         B43_WARN_ON(1);
5322                 break;
5323 #endif
5324         }
5325
5326         dev->phy.gmode = have_2ghz_phy;
5327         b43_wireless_core_reset(dev, dev->phy.gmode);
5328
5329         /* Get the PHY type. */
5330         err = b43_phy_versioning(dev);
5331         if (err)
5332                 goto err_powerdown;
5333
5334         /* Get real info about supported bands */
5335         b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5336
5337         /* We don't support 5 GHz on some PHYs yet */
5338         if (have_5ghz_phy) {
5339                 switch (dev->phy.type) {
5340                 case B43_PHYTYPE_A:
5341                 case B43_PHYTYPE_G:
5342                 case B43_PHYTYPE_LP:
5343                 case B43_PHYTYPE_HT:
5344                         b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5345                         have_5ghz_phy = false;
5346                 }
5347         }
5348
5349         if (!have_2ghz_phy && !have_5ghz_phy) {
5350                 b43err(wl, "b43 can't support any band on this device\n");
5351                 err = -EOPNOTSUPP;
5352                 goto err_powerdown;
5353         }
5354
5355         err = b43_phy_allocate(dev);
5356         if (err)
5357                 goto err_powerdown;
5358
5359         dev->phy.gmode = have_2ghz_phy;
5360         b43_wireless_core_reset(dev, dev->phy.gmode);
5361
5362         err = b43_validate_chipaccess(dev);
5363         if (err)
5364                 goto err_phy_free;
5365         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5366         if (err)
5367                 goto err_phy_free;
5368
5369         /* Now set some default "current_dev" */
5370         if (!wl->current_dev)
5371                 wl->current_dev = dev;
5372         INIT_WORK(&dev->restart_work, b43_chip_reset);
5373
5374         dev->phy.ops->switch_analog(dev, 0);
5375         b43_device_disable(dev, 0);
5376         b43_bus_may_powerdown(dev);
5377
5378 out:
5379         return err;
5380
5381 err_phy_free:
5382         b43_phy_free(dev);
5383 err_powerdown:
5384         b43_bus_may_powerdown(dev);
5385         return err;
5386 }
5387
5388 static void b43_one_core_detach(struct b43_bus_dev *dev)
5389 {
5390         struct b43_wldev *wldev;
5391         struct b43_wl *wl;
5392
5393         /* Do not cancel ieee80211-workqueue based work here.
5394          * See comment in b43_remove(). */
5395
5396         wldev = b43_bus_get_wldev(dev);
5397         wl = wldev->wl;
5398         b43_debugfs_remove_device(wldev);
5399         b43_wireless_core_detach(wldev);
5400         list_del(&wldev->list);
5401         b43_bus_set_wldev(dev, NULL);
5402         kfree(wldev);
5403 }
5404
5405 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5406 {
5407         struct b43_wldev *wldev;
5408         int err = -ENOMEM;
5409
5410         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5411         if (!wldev)
5412                 goto out;
5413
5414         wldev->use_pio = b43_modparam_pio;
5415         wldev->dev = dev;
5416         wldev->wl = wl;
5417         b43_set_status(wldev, B43_STAT_UNINIT);
5418         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5419         INIT_LIST_HEAD(&wldev->list);
5420
5421         err = b43_wireless_core_attach(wldev);
5422         if (err)
5423                 goto err_kfree_wldev;
5424
5425         b43_bus_set_wldev(dev, wldev);
5426         b43_debugfs_add_device(wldev);
5427
5428       out:
5429         return err;
5430
5431       err_kfree_wldev:
5432         kfree(wldev);
5433         return err;
5434 }
5435
5436 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5437         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5438         (pdev->device == _device) &&                                    \
5439         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5440         (pdev->subsystem_device == _subdevice)                          )
5441
5442 #ifdef CONFIG_B43_SSB
5443 static void b43_sprom_fixup(struct ssb_bus *bus)
5444 {
5445         struct pci_dev *pdev;
5446
5447         /* boardflags workarounds */
5448         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5449             bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5450                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5451         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5452             bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5453                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5454         if (bus->bustype == SSB_BUSTYPE_PCI) {
5455                 pdev = bus->host_pci;
5456                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5457                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5458                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5459                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5460                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5461                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5462                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5463                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5464         }
5465 }
5466
5467 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5468 {
5469         struct ieee80211_hw *hw = wl->hw;
5470
5471         ssb_set_devtypedata(dev->sdev, NULL);
5472         ieee80211_free_hw(hw);
5473 }
5474 #endif
5475
5476 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5477 {
5478         struct ssb_sprom *sprom = dev->bus_sprom;
5479         struct ieee80211_hw *hw;
5480         struct b43_wl *wl;
5481         char chip_name[6];
5482         int queue_num;
5483
5484         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5485         if (!hw) {
5486                 b43err(NULL, "Could not allocate ieee80211 device\n");
5487                 return ERR_PTR(-ENOMEM);
5488         }
5489         wl = hw_to_b43_wl(hw);
5490
5491         /* fill hw info */
5492         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5493                     IEEE80211_HW_SIGNAL_DBM;
5494
5495         hw->wiphy->interface_modes =
5496                 BIT(NL80211_IFTYPE_AP) |
5497                 BIT(NL80211_IFTYPE_MESH_POINT) |
5498                 BIT(NL80211_IFTYPE_STATION) |
5499                 BIT(NL80211_IFTYPE_WDS) |
5500                 BIT(NL80211_IFTYPE_ADHOC);
5501
5502         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5503
5504         wl->hw_registred = false;
5505         hw->max_rates = 2;
5506         SET_IEEE80211_DEV(hw, dev->dev);
5507         if (is_valid_ether_addr(sprom->et1mac))
5508                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5509         else
5510                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5511
5512         /* Initialize struct b43_wl */
5513         wl->hw = hw;
5514         mutex_init(&wl->mutex);
5515         spin_lock_init(&wl->hardirq_lock);
5516         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5517         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5518         INIT_WORK(&wl->tx_work, b43_tx_work);
5519
5520         /* Initialize queues and flags. */
5521         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5522                 skb_queue_head_init(&wl->tx_queue[queue_num]);
5523                 wl->tx_queue_stopped[queue_num] = 0;
5524         }
5525
5526         snprintf(chip_name, ARRAY_SIZE(chip_name),
5527                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5528         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5529                 dev->core_rev);
5530         return wl;
5531 }
5532
5533 #ifdef CONFIG_B43_BCMA
5534 static int b43_bcma_probe(struct bcma_device *core)
5535 {
5536         struct b43_bus_dev *dev;
5537         struct b43_wl *wl;
5538         int err;
5539
5540         if (!modparam_allhwsupport &&
5541             (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5542                 pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5543                 return -ENOTSUPP;
5544         }
5545
5546         dev = b43_bus_dev_bcma_init(core);
5547         if (!dev)
5548                 return -ENODEV;
5549
5550         wl = b43_wireless_init(dev);
5551         if (IS_ERR(wl)) {
5552                 err = PTR_ERR(wl);
5553                 goto bcma_out;
5554         }
5555
5556         err = b43_one_core_attach(dev, wl);
5557         if (err)
5558                 goto bcma_err_wireless_exit;
5559
5560         /* setup and start work to load firmware */
5561         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5562         schedule_work(&wl->firmware_load);
5563
5564 bcma_out:
5565         return err;
5566
5567 bcma_err_wireless_exit:
5568         ieee80211_free_hw(wl->hw);
5569         return err;
5570 }
5571
5572 static void b43_bcma_remove(struct bcma_device *core)
5573 {
5574         struct b43_wldev *wldev = bcma_get_drvdata(core);
5575         struct b43_wl *wl = wldev->wl;
5576
5577         /* We must cancel any work here before unregistering from ieee80211,
5578          * as the ieee80211 unreg will destroy the workqueue. */
5579         cancel_work_sync(&wldev->restart_work);
5580         cancel_work_sync(&wl->firmware_load);
5581
5582         B43_WARN_ON(!wl);
5583         if (!wldev->fw.ucode.data)
5584                 return;                 /* NULL if firmware never loaded */
5585         if (wl->current_dev == wldev && wl->hw_registred) {
5586                 b43_leds_stop(wldev);
5587                 ieee80211_unregister_hw(wl->hw);
5588         }
5589
5590         b43_one_core_detach(wldev->dev);
5591
5592         /* Unregister HW RNG driver */
5593         b43_rng_exit(wl);
5594
5595         b43_leds_unregister(wl);
5596
5597         ieee80211_free_hw(wl->hw);
5598 }
5599
5600 static struct bcma_driver b43_bcma_driver = {
5601         .name           = KBUILD_MODNAME,
5602         .id_table       = b43_bcma_tbl,
5603         .probe          = b43_bcma_probe,
5604         .remove         = b43_bcma_remove,
5605 };
5606 #endif
5607
5608 #ifdef CONFIG_B43_SSB
5609 static
5610 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5611 {
5612         struct b43_bus_dev *dev;
5613         struct b43_wl *wl;
5614         int err;
5615
5616         dev = b43_bus_dev_ssb_init(sdev);
5617         if (!dev)
5618                 return -ENOMEM;
5619
5620         wl = ssb_get_devtypedata(sdev);
5621         if (wl) {
5622                 b43err(NULL, "Dual-core devices are not supported\n");
5623                 err = -ENOTSUPP;
5624                 goto err_ssb_kfree_dev;
5625         }
5626
5627         b43_sprom_fixup(sdev->bus);
5628
5629         wl = b43_wireless_init(dev);
5630         if (IS_ERR(wl)) {
5631                 err = PTR_ERR(wl);
5632                 goto err_ssb_kfree_dev;
5633         }
5634         ssb_set_devtypedata(sdev, wl);
5635         B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5636
5637         err = b43_one_core_attach(dev, wl);
5638         if (err)
5639                 goto err_ssb_wireless_exit;
5640
5641         /* setup and start work to load firmware */
5642         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5643         schedule_work(&wl->firmware_load);
5644
5645         return err;
5646
5647 err_ssb_wireless_exit:
5648         b43_wireless_exit(dev, wl);
5649 err_ssb_kfree_dev:
5650         kfree(dev);
5651         return err;
5652 }
5653
5654 static void b43_ssb_remove(struct ssb_device *sdev)
5655 {
5656         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5657         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5658         struct b43_bus_dev *dev = wldev->dev;
5659
5660         /* We must cancel any work here before unregistering from ieee80211,
5661          * as the ieee80211 unreg will destroy the workqueue. */
5662         cancel_work_sync(&wldev->restart_work);
5663         cancel_work_sync(&wl->firmware_load);
5664
5665         B43_WARN_ON(!wl);
5666         if (!wldev->fw.ucode.data)
5667                 return;                 /* NULL if firmware never loaded */
5668         if (wl->current_dev == wldev && wl->hw_registred) {
5669                 b43_leds_stop(wldev);
5670                 ieee80211_unregister_hw(wl->hw);
5671         }
5672
5673         b43_one_core_detach(dev);
5674
5675         /* Unregister HW RNG driver */
5676         b43_rng_exit(wl);
5677
5678         b43_leds_unregister(wl);
5679         b43_wireless_exit(dev, wl);
5680 }
5681
5682 static struct ssb_driver b43_ssb_driver = {
5683         .name           = KBUILD_MODNAME,
5684         .id_table       = b43_ssb_tbl,
5685         .probe          = b43_ssb_probe,
5686         .remove         = b43_ssb_remove,
5687 };
5688 #endif /* CONFIG_B43_SSB */
5689
5690 /* Perform a hardware reset. This can be called from any context. */
5691 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5692 {
5693         /* Must avoid requeueing, if we are in shutdown. */
5694         if (b43_status(dev) < B43_STAT_INITIALIZED)
5695                 return;
5696         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5697         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5698 }
5699
5700 static void b43_print_driverinfo(void)
5701 {
5702         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5703                    *feat_leds = "", *feat_sdio = "";
5704
5705 #ifdef CONFIG_B43_PCI_AUTOSELECT
5706         feat_pci = "P";
5707 #endif
5708 #ifdef CONFIG_B43_PCMCIA
5709         feat_pcmcia = "M";
5710 #endif
5711 #ifdef CONFIG_B43_PHY_N
5712         feat_nphy = "N";
5713 #endif
5714 #ifdef CONFIG_B43_LEDS
5715         feat_leds = "L";
5716 #endif
5717 #ifdef CONFIG_B43_SDIO
5718         feat_sdio = "S";
5719 #endif
5720         printk(KERN_INFO "Broadcom 43xx driver loaded "
5721                "[ Features: %s%s%s%s%s ]\n",
5722                feat_pci, feat_pcmcia, feat_nphy,
5723                feat_leds, feat_sdio);
5724 }
5725
5726 static int __init b43_init(void)
5727 {
5728         int err;
5729
5730         b43_debugfs_init();
5731         err = b43_pcmcia_init();
5732         if (err)
5733                 goto err_dfs_exit;
5734         err = b43_sdio_init();
5735         if (err)
5736                 goto err_pcmcia_exit;
5737 #ifdef CONFIG_B43_BCMA
5738         err = bcma_driver_register(&b43_bcma_driver);
5739         if (err)
5740                 goto err_sdio_exit;
5741 #endif
5742 #ifdef CONFIG_B43_SSB
5743         err = ssb_driver_register(&b43_ssb_driver);
5744         if (err)
5745                 goto err_bcma_driver_exit;
5746 #endif
5747         b43_print_driverinfo();
5748
5749         return err;
5750
5751 #ifdef CONFIG_B43_SSB
5752 err_bcma_driver_exit:
5753 #endif
5754 #ifdef CONFIG_B43_BCMA
5755         bcma_driver_unregister(&b43_bcma_driver);
5756 err_sdio_exit:
5757 #endif
5758         b43_sdio_exit();
5759 err_pcmcia_exit:
5760         b43_pcmcia_exit();
5761 err_dfs_exit:
5762         b43_debugfs_exit();
5763         return err;
5764 }
5765
5766 static void __exit b43_exit(void)
5767 {
5768 #ifdef CONFIG_B43_SSB
5769         ssb_driver_unregister(&b43_ssb_driver);
5770 #endif
5771 #ifdef CONFIG_B43_BCMA
5772         bcma_driver_unregister(&b43_bcma_driver);
5773 #endif
5774         b43_sdio_exit();
5775         b43_pcmcia_exit();
5776         b43_debugfs_exit();
5777 }
5778
5779 module_init(b43_init)
5780 module_exit(b43_exit)