drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
  11
  12   SDIO support
  13   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  14
  15   Some parts of the code in this file are derived from the ipw2200
  16   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  17
  18   This program is free software; you can redistribute it and/or modify
  19   it under the terms of the GNU General Public License as published by
  20   the Free Software Foundation; either version 2 of the License, or
  21   (at your option) any later version.
  22
  23   This program is distributed in the hope that it will be useful,
  24   but WITHOUT ANY WARRANTY; without even the implied warranty of
  25   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26   GNU General Public License for more details.
  27
  28   You should have received a copy of the GNU General Public License
  29   along with this program; see the file COPYING.  If not, write to
  30   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  31   Boston, MA 02110-1301, USA.
  32
  33 */
  34
  35 #include <linux/delay.h>
  36 #include <linux/init.h>
  37 #include <linux/module.h>
  38 #include <linux/if_arp.h>
  39 #include <linux/etherdevice.h>
  40 #include <linux/firmware.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "sdio.h"
  60 #include <linux/mmc/sdio_func.h>
  61
  62 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  63 MODULE_AUTHOR("Martin Langer");
  64 MODULE_AUTHOR("Stefano Brivio");
  65 MODULE_AUTHOR("Michael Buesch");
  66 MODULE_AUTHOR("Gábor Stefanik");
  67 MODULE_AUTHOR("Rafał Miłecki");
  68 MODULE_LICENSE("GPL");
  69
  70 /*(DEBLOBBED)*/
  71
  72 static int modparam_bad_frames_preempt;
  73 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  74 MODULE_PARM_DESC(bad_frames_preempt,
  75                  "enable(1) / disable(0) Bad Frames Preemption");
  76
  77 static char modparam_fwpostfix[16];
  78 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  79 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  80
  81 static int modparam_hwpctl;
  82 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  83 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  84
  85 static int modparam_nohwcrypt;
  86 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  87 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  88
  89 static int modparam_hwtkip;
  90 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  91 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  92
  93 static int modparam_qos = 1;
  94 module_param_named(qos, modparam_qos, int, 0444);
  95 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  96
  97 static int modparam_btcoex = 1;
  98 module_param_named(btcoex, modparam_btcoex, int, 0444);
  99 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 100
 101 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 102 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 103 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 104
 105 static int b43_modparam_pio = 0;
 106 module_param_named(pio, b43_modparam_pio, int, 0644);
 107 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 108
 109 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
 110 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
 111 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
 112
 113 #ifdef CONFIG_B43_BCMA
 114 static const struct bcma_device_id b43_bcma_tbl[] = {
 115         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 116         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
 117         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
 122         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
 123         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
 124         {},
 125 };
 126 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 127 #endif
 128
 129 #ifdef CONFIG_B43_SSB
 130 static const struct ssb_device_id b43_ssb_tbl[] = {
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 138         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 139         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 140         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 141         {},
 142 };
 143 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 144 #endif
 145
 146 /* Channel and ratetables are shared for all devices.
 147  * They can't be const, because ieee80211 puts some precalculated
 148  * data in there. This data is the same for all devices, so we don't
 149  * get concurrency issues */
 150 #define RATETAB_ENT(_rateid, _flags) \
 151         {                                                               \
 152                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 153                 .hw_value       = (_rateid),                            \
 154                 .flags          = (_flags),                             \
 155         }
 156
 157 /*
 158  * NOTE: When changing this, sync with xmit.c's
 159  *       b43_plcp_get_bitrate_idx_* functions!
 160  */
 161 static struct ieee80211_rate __b43_ratetable[] = {
 162         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 163         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 164         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 165         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 166         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 171         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 172         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 173         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 174 };
 175
 176 #define b43_a_ratetable         (__b43_ratetable + 4)
 177 #define b43_a_ratetable_size    8
 178 #define b43_b_ratetable         (__b43_ratetable + 0)
 179 #define b43_b_ratetable_size    4
 180 #define b43_g_ratetable         (__b43_ratetable + 0)
 181 #define b43_g_ratetable_size    12
 182
 183 #define CHAN2G(_channel, _freq, _flags) {                       \
 184         .band                   = IEEE80211_BAND_2GHZ,          \
 185         .center_freq            = (_freq),                      \
 186         .hw_value               = (_channel),                   \
 187         .flags                  = (_flags),                     \
 188         .max_antenna_gain       = 0,                            \
 189         .max_power              = 30,                           \
 190 }
 191 static struct ieee80211_channel b43_2ghz_chantable[] = {
 192         CHAN2G(1, 2412, 0),
 193         CHAN2G(2, 2417, 0),
 194         CHAN2G(3, 2422, 0),
 195         CHAN2G(4, 2427, 0),
 196         CHAN2G(5, 2432, 0),
 197         CHAN2G(6, 2437, 0),
 198         CHAN2G(7, 2442, 0),
 199         CHAN2G(8, 2447, 0),
 200         CHAN2G(9, 2452, 0),
 201         CHAN2G(10, 2457, 0),
 202         CHAN2G(11, 2462, 0),
 203         CHAN2G(12, 2467, 0),
 204         CHAN2G(13, 2472, 0),
 205         CHAN2G(14, 2484, 0),
 206 };
 207
 208 /* No support for the last 3 channels (12, 13, 14) */
 209 #define b43_2ghz_chantable_limited_size         11
 210 #undef CHAN2G
 211
 212 #define CHAN4G(_channel, _flags) {                              \
 213         .band                   = IEEE80211_BAND_5GHZ,          \
 214         .center_freq            = 4000 + (5 * (_channel)),      \
 215         .hw_value               = (_channel),                   \
 216         .flags                  = (_flags),                     \
 217         .max_antenna_gain       = 0,                            \
 218         .max_power              = 30,                           \
 219 }
 220 #define CHAN5G(_channel, _flags) {                              \
 221         .band                   = IEEE80211_BAND_5GHZ,          \
 222         .center_freq            = 5000 + (5 * (_channel)),      \
 223         .hw_value               = (_channel),                   \
 224         .flags                  = (_flags),                     \
 225         .max_antenna_gain       = 0,                            \
 226         .max_power              = 30,                           \
 227 }
 228 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 229         CHAN4G(184, 0),         CHAN4G(186, 0),
 230         CHAN4G(188, 0),         CHAN4G(190, 0),
 231         CHAN4G(192, 0),         CHAN4G(194, 0),
 232         CHAN4G(196, 0),         CHAN4G(198, 0),
 233         CHAN4G(200, 0),         CHAN4G(202, 0),
 234         CHAN4G(204, 0),         CHAN4G(206, 0),
 235         CHAN4G(208, 0),         CHAN4G(210, 0),
 236         CHAN4G(212, 0),         CHAN4G(214, 0),
 237         CHAN4G(216, 0),         CHAN4G(218, 0),
 238         CHAN4G(220, 0),         CHAN4G(222, 0),
 239         CHAN4G(224, 0),         CHAN4G(226, 0),
 240         CHAN4G(228, 0),
 241         CHAN5G(32, 0),          CHAN5G(34, 0),
 242         CHAN5G(36, 0),          CHAN5G(38, 0),
 243         CHAN5G(40, 0),          CHAN5G(42, 0),
 244         CHAN5G(44, 0),          CHAN5G(46, 0),
 245         CHAN5G(48, 0),          CHAN5G(50, 0),
 246         CHAN5G(52, 0),          CHAN5G(54, 0),
 247         CHAN5G(56, 0),          CHAN5G(58, 0),
 248         CHAN5G(60, 0),          CHAN5G(62, 0),
 249         CHAN5G(64, 0),          CHAN5G(66, 0),
 250         CHAN5G(68, 0),          CHAN5G(70, 0),
 251         CHAN5G(72, 0),          CHAN5G(74, 0),
 252         CHAN5G(76, 0),          CHAN5G(78, 0),
 253         CHAN5G(80, 0),          CHAN5G(82, 0),
 254         CHAN5G(84, 0),          CHAN5G(86, 0),
 255         CHAN5G(88, 0),          CHAN5G(90, 0),
 256         CHAN5G(92, 0),          CHAN5G(94, 0),
 257         CHAN5G(96, 0),          CHAN5G(98, 0),
 258         CHAN5G(100, 0),         CHAN5G(102, 0),
 259         CHAN5G(104, 0),         CHAN5G(106, 0),
 260         CHAN5G(108, 0),         CHAN5G(110, 0),
 261         CHAN5G(112, 0),         CHAN5G(114, 0),
 262         CHAN5G(116, 0),         CHAN5G(118, 0),
 263         CHAN5G(120, 0),         CHAN5G(122, 0),
 264         CHAN5G(124, 0),         CHAN5G(126, 0),
 265         CHAN5G(128, 0),         CHAN5G(130, 0),
 266         CHAN5G(132, 0),         CHAN5G(134, 0),
 267         CHAN5G(136, 0),         CHAN5G(138, 0),
 268         CHAN5G(140, 0),         CHAN5G(142, 0),
 269         CHAN5G(144, 0),         CHAN5G(145, 0),
 270         CHAN5G(146, 0),         CHAN5G(147, 0),
 271         CHAN5G(148, 0),         CHAN5G(149, 0),
 272         CHAN5G(150, 0),         CHAN5G(151, 0),
 273         CHAN5G(152, 0),         CHAN5G(153, 0),
 274         CHAN5G(154, 0),         CHAN5G(155, 0),
 275         CHAN5G(156, 0),         CHAN5G(157, 0),
 276         CHAN5G(158, 0),         CHAN5G(159, 0),
 277         CHAN5G(160, 0),         CHAN5G(161, 0),
 278         CHAN5G(162, 0),         CHAN5G(163, 0),
 279         CHAN5G(164, 0),         CHAN5G(165, 0),
 280         CHAN5G(166, 0),         CHAN5G(168, 0),
 281         CHAN5G(170, 0),         CHAN5G(172, 0),
 282         CHAN5G(174, 0),         CHAN5G(176, 0),
 283         CHAN5G(178, 0),         CHAN5G(180, 0),
 284         CHAN5G(182, 0),
 285 };
 286
 287 static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
 288         CHAN5G(36, 0),          CHAN5G(40, 0),
 289         CHAN5G(44, 0),          CHAN5G(48, 0),
 290         CHAN5G(149, 0),         CHAN5G(153, 0),
 291         CHAN5G(157, 0),         CHAN5G(161, 0),
 292         CHAN5G(165, 0),
 293 };
 294
 295 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 296         CHAN5G(34, 0),          CHAN5G(36, 0),
 297         CHAN5G(38, 0),          CHAN5G(40, 0),
 298         CHAN5G(42, 0),          CHAN5G(44, 0),
 299         CHAN5G(46, 0),          CHAN5G(48, 0),
 300         CHAN5G(52, 0),          CHAN5G(56, 0),
 301         CHAN5G(60, 0),          CHAN5G(64, 0),
 302         CHAN5G(100, 0),         CHAN5G(104, 0),
 303         CHAN5G(108, 0),         CHAN5G(112, 0),
 304         CHAN5G(116, 0),         CHAN5G(120, 0),
 305         CHAN5G(124, 0),         CHAN5G(128, 0),
 306         CHAN5G(132, 0),         CHAN5G(136, 0),
 307         CHAN5G(140, 0),         CHAN5G(149, 0),
 308         CHAN5G(153, 0),         CHAN5G(157, 0),
 309         CHAN5G(161, 0),         CHAN5G(165, 0),
 310         CHAN5G(184, 0),         CHAN5G(188, 0),
 311         CHAN5G(192, 0),         CHAN5G(196, 0),
 312         CHAN5G(200, 0),         CHAN5G(204, 0),
 313         CHAN5G(208, 0),         CHAN5G(212, 0),
 314         CHAN5G(216, 0),
 315 };
 316 #undef CHAN4G
 317 #undef CHAN5G
 318
 319 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 320         .band           = IEEE80211_BAND_5GHZ,
 321         .channels       = b43_5ghz_nphy_chantable,
 322         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 323         .bitrates       = b43_a_ratetable,
 324         .n_bitrates     = b43_a_ratetable_size,
 325 };
 326
 327 static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
 328         .band           = IEEE80211_BAND_5GHZ,
 329         .channels       = b43_5ghz_nphy_chantable_limited,
 330         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
 331         .bitrates       = b43_a_ratetable,
 332         .n_bitrates     = b43_a_ratetable_size,
 333 };
 334
 335 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 336         .band           = IEEE80211_BAND_5GHZ,
 337         .channels       = b43_5ghz_aphy_chantable,
 338         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 339         .bitrates       = b43_a_ratetable,
 340         .n_bitrates     = b43_a_ratetable_size,
 341 };
 342
 343 static struct ieee80211_supported_band b43_band_2GHz = {
 344         .band           = IEEE80211_BAND_2GHZ,
 345         .channels       = b43_2ghz_chantable,
 346         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 347         .bitrates       = b43_g_ratetable,
 348         .n_bitrates     = b43_g_ratetable_size,
 349 };
 350
 351 static struct ieee80211_supported_band b43_band_2ghz_limited = {
 352         .band           = IEEE80211_BAND_2GHZ,
 353         .channels       = b43_2ghz_chantable,
 354         .n_channels     = b43_2ghz_chantable_limited_size,
 355         .bitrates       = b43_g_ratetable,
 356         .n_bitrates     = b43_g_ratetable_size,
 357 };
 358
 359 static void b43_wireless_core_exit(struct b43_wldev *dev);
 360 static int b43_wireless_core_init(struct b43_wldev *dev);
 361 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 362 static int b43_wireless_core_start(struct b43_wldev *dev);
 363 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 364                                     struct ieee80211_vif *vif,
 365                                     struct ieee80211_bss_conf *conf,
 366                                     u32 changed);
 367
 368 static int b43_ratelimit(struct b43_wl *wl)
 369 {
 370         if (!wl || !wl->current_dev)
 371                 return 1;
 372         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 373                 return 1;
 374         /* We are up and running.
 375          * Ratelimit the messages to avoid DoS over the net. */
 376         return net_ratelimit();
 377 }
 378
 379 void b43info(struct b43_wl *wl, const char *fmt, ...)
 380 {
 381         struct va_format vaf;
 382         va_list args;
 383
 384         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 385                 return;
 386         if (!b43_ratelimit(wl))
 387                 return;
 388
 389         va_start(args, fmt);
 390
 391         vaf.fmt = fmt;
 392         vaf.va = &args;
 393
 394         printk(KERN_INFO "b43-%s: %pV",
 395                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 396
 397         va_end(args);
 398 }
 399
 400 void b43err(struct b43_wl *wl, const char *fmt, ...)
 401 {
 402         struct va_format vaf;
 403         va_list args;
 404
 405         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 406                 return;
 407         if (!b43_ratelimit(wl))
 408                 return;
 409
 410         va_start(args, fmt);
 411
 412         vaf.fmt = fmt;
 413         vaf.va = &args;
 414
 415         printk(KERN_ERR "b43-%s ERROR: %pV",
 416                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 417
 418         va_end(args);
 419 }
 420
 421 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 422 {
 423         struct va_format vaf;
 424         va_list args;
 425
 426         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 427                 return;
 428         if (!b43_ratelimit(wl))
 429                 return;
 430
 431         va_start(args, fmt);
 432
 433         vaf.fmt = fmt;
 434         vaf.va = &args;
 435
 436         printk(KERN_WARNING "b43-%s warning: %pV",
 437                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 438
 439         va_end(args);
 440 }
 441
 442 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 443 {
 444         struct va_format vaf;
 445         va_list args;
 446
 447         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 448                 return;
 449
 450         va_start(args, fmt);
 451
 452         vaf.fmt = fmt;
 453         vaf.va = &args;
 454
 455         printk(KERN_DEBUG "b43-%s debug: %pV",
 456                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 457
 458         va_end(args);
 459 }
 460
 461 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 462 {
 463         u32 macctl;
 464
 465         B43_WARN_ON(offset % 4 != 0);
 466
 467         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 468         if (macctl & B43_MACCTL_BE)
 469                 val = swab32(val);
 470
 471         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 472         mmiowb();
 473         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 474 }
 475
 476 static inline void b43_shm_control_word(struct b43_wldev *dev,
 477                                         u16 routing, u16 offset)
 478 {
 479         u32 control;
 480
 481         /* "offset" is the WORD offset. */
 482         control = routing;
 483         control <<= 16;
 484         control |= offset;
 485         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 486 }
 487
 488 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 489 {
 490         u32 ret;
 491
 492         if (routing == B43_SHM_SHARED) {
 493                 B43_WARN_ON(offset & 0x0001);
 494                 if (offset & 0x0003) {
 495                         /* Unaligned access */
 496                         b43_shm_control_word(dev, routing, offset >> 2);
 497                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 498                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 499                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 500
 501                         goto out;
 502                 }
 503                 offset >>= 2;
 504         }
 505         b43_shm_control_word(dev, routing, offset);
 506         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 507 out:
 508         return ret;
 509 }
 510
 511 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 512 {
 513         u16 ret;
 514
 515         if (routing == B43_SHM_SHARED) {
 516                 B43_WARN_ON(offset & 0x0001);
 517                 if (offset & 0x0003) {
 518                         /* Unaligned access */
 519                         b43_shm_control_word(dev, routing, offset >> 2);
 520                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 521
 522                         goto out;
 523                 }
 524                 offset >>= 2;
 525         }
 526         b43_shm_control_word(dev, routing, offset);
 527         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 528 out:
 529         return ret;
 530 }
 531
 532 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 533 {
 534         if (routing == B43_SHM_SHARED) {
 535                 B43_WARN_ON(offset & 0x0001);
 536                 if (offset & 0x0003) {
 537                         /* Unaligned access */
 538                         b43_shm_control_word(dev, routing, offset >> 2);
 539                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 540                                     value & 0xFFFF);
 541                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 542                         b43_write16(dev, B43_MMIO_SHM_DATA,
 543                                     (value >> 16) & 0xFFFF);
 544                         return;
 545                 }
 546                 offset >>= 2;
 547         }
 548         b43_shm_control_word(dev, routing, offset);
 549         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 550 }
 551
 552 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 553 {
 554         if (routing == B43_SHM_SHARED) {
 555                 B43_WARN_ON(offset & 0x0001);
 556                 if (offset & 0x0003) {
 557                         /* Unaligned access */
 558                         b43_shm_control_word(dev, routing, offset >> 2);
 559                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 560                         return;
 561                 }
 562                 offset >>= 2;
 563         }
 564         b43_shm_control_word(dev, routing, offset);
 565         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 566 }
 567
 568 /* Read HostFlags */
 569 u64 b43_hf_read(struct b43_wldev *dev)
 570 {
 571         u64 ret;
 572
 573         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
 574         ret <<= 16;
 575         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
 576         ret <<= 16;
 577         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
 578
 579         return ret;
 580 }
 581
 582 /* Write HostFlags */
 583 void b43_hf_write(struct b43_wldev *dev, u64 value)
 584 {
 585         u16 lo, mi, hi;
 586
 587         lo = (value & 0x00000000FFFFULL);
 588         mi = (value & 0x0000FFFF0000ULL) >> 16;
 589         hi = (value & 0xFFFF00000000ULL) >> 32;
 590         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
 591         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
 592         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
 593 }
 594
 595 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 596 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 597 {
 598         B43_WARN_ON(!dev->fw.opensource);
 599         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 600 }
 601
 602 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 603 {
 604         u32 low, high;
 605
 606         B43_WARN_ON(dev->dev->core_rev < 3);
 607
 608         /* The hardware guarantees us an atomic read, if we
 609          * read the low register first. */
 610         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 611         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 612
 613         *tsf = high;
 614         *tsf <<= 32;
 615         *tsf |= low;
 616 }
 617
 618 static void b43_time_lock(struct b43_wldev *dev)
 619 {
 620         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
 621         /* Commit the write */
 622         b43_read32(dev, B43_MMIO_MACCTL);
 623 }
 624
 625 static void b43_time_unlock(struct b43_wldev *dev)
 626 {
 627         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
 628         /* Commit the write */
 629         b43_read32(dev, B43_MMIO_MACCTL);
 630 }
 631
 632 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 633 {
 634         u32 low, high;
 635
 636         B43_WARN_ON(dev->dev->core_rev < 3);
 637
 638         low = tsf;
 639         high = (tsf >> 32);
 640         /* The hardware guarantees us an atomic write, if we
 641          * write the low register first. */
 642         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 643         mmiowb();
 644         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 645         mmiowb();
 646 }
 647
 648 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 649 {
 650         b43_time_lock(dev);
 651         b43_tsf_write_locked(dev, tsf);
 652         b43_time_unlock(dev);
 653 }
 654
 655 static
 656 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 657 {
 658         static const u8 zero_addr[ETH_ALEN] = { 0 };
 659         u16 data;
 660
 661         if (!mac)
 662                 mac = zero_addr;
 663
 664         offset |= 0x0020;
 665         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 666
 667         data = mac[0];
 668         data |= mac[1] << 8;
 669         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 670         data = mac[2];
 671         data |= mac[3] << 8;
 672         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 673         data = mac[4];
 674         data |= mac[5] << 8;
 675         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 676 }
 677
 678 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 679 {
 680         const u8 *mac;
 681         const u8 *bssid;
 682         u8 mac_bssid[ETH_ALEN * 2];
 683         int i;
 684         u32 tmp;
 685
 686         bssid = dev->wl->bssid;
 687         mac = dev->wl->mac_addr;
 688
 689         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 690
 691         memcpy(mac_bssid, mac, ETH_ALEN);
 692         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 693
 694         /* Write our MAC address and BSSID to template ram */
 695         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 696                 tmp = (u32) (mac_bssid[i + 0]);
 697                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 698                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 699                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 700                 b43_ram_write(dev, 0x20 + i, tmp);
 701         }
 702 }
 703
 704 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 705 {
 706         b43_write_mac_bssid_templates(dev);
 707         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 708 }
 709
 710 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 711 {
 712         /* slot_time is in usec. */
 713         /* This test used to exit for all but a G PHY. */
 714         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 715                 return;
 716         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 717         /* Shared memory location 0x0010 is the slot time and should be
 718          * set to slot_time; however, this register is initially 0 and changing
 719          * the value adversely affects the transmit rate for BCM4311
 720          * devices. Until this behavior is unterstood, delete this step
 721          *
 722          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 723          */
 724 }
 725
 726 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 727 {
 728         b43_set_slot_time(dev, 9);
 729 }
 730
 731 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 732 {
 733         b43_set_slot_time(dev, 20);
 734 }
 735
 736 /* DummyTransmission function, as documented on
 737  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 738  */
 739 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 740 {
 741         struct b43_phy *phy = &dev->phy;
 742         unsigned int i, max_loop;
 743         u16 value;
 744         u32 buffer[5] = {
 745                 0x00000000,
 746                 0x00D40000,
 747                 0x00000000,
 748                 0x01000000,
 749                 0x00000000,
 750         };
 751
 752         if (ofdm) {
 753                 max_loop = 0x1E;
 754                 buffer[0] = 0x000201CC;
 755         } else {
 756                 max_loop = 0xFA;
 757                 buffer[0] = 0x000B846E;
 758         }
 759
 760         for (i = 0; i < 5; i++)
 761                 b43_ram_write(dev, i * 4, buffer[i]);
 762
 763         b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
 764
 765         if (dev->dev->core_rev < 11)
 766                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
 767         else
 768                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
 769
 770         value = (ofdm ? 0x41 : 0x40);
 771         b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
 772         if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
 773             phy->type == B43_PHYTYPE_LCN)
 774                 b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
 775
 776         b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
 777         b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
 778
 779         b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
 780         b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
 781         b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
 782         b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
 783
 784         if (!pa_on && phy->type == B43_PHYTYPE_N)
 785                 ; /*b43_nphy_pa_override(dev, false) */
 786
 787         switch (phy->type) {
 788         case B43_PHYTYPE_N:
 789         case B43_PHYTYPE_LCN:
 790                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
 791                 break;
 792         case B43_PHYTYPE_LP:
 793                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
 794                 break;
 795         default:
 796                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
 797         }
 798         b43_read16(dev, B43_MMIO_TXE0_AUX);
 799
 800         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 801                 b43_radio_write16(dev, 0x0051, 0x0017);
 802         for (i = 0x00; i < max_loop; i++) {
 803                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 804                 if (value & 0x0080)
 805                         break;
 806                 udelay(10);
 807         }
 808         for (i = 0x00; i < 0x0A; i++) {
 809                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 810                 if (value & 0x0400)
 811                         break;
 812                 udelay(10);
 813         }
 814         for (i = 0x00; i < 0x19; i++) {
 815                 value = b43_read16(dev, B43_MMIO_IFSSTAT);
 816                 if (!(value & 0x0100))
 817                         break;
 818                 udelay(10);
 819         }
 820         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 821                 b43_radio_write16(dev, 0x0051, 0x0037);
 822 }
 823
 824 static void key_write(struct b43_wldev *dev,
 825                       u8 index, u8 algorithm, const u8 *key)
 826 {
 827         unsigned int i;
 828         u32 offset;
 829         u16 value;
 830         u16 kidx;
 831
 832         /* Key index/algo block */
 833         kidx = b43_kidx_to_fw(dev, index);
 834         value = ((kidx << 4) | algorithm);
 835         b43_shm_write16(dev, B43_SHM_SHARED,
 836                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 837
 838         /* Write the key to the Key Table Pointer offset */
 839         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 840         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 841                 value = key[i];
 842                 value |= (u16) (key[i + 1]) << 8;
 843                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 844         }
 845 }
 846
 847 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 848 {
 849         u32 addrtmp[2] = { 0, 0, };
 850         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 851
 852         if (b43_new_kidx_api(dev))
 853                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 854
 855         B43_WARN_ON(index < pairwise_keys_start);
 856         /* We have four default TX keys and possibly four default RX keys.
 857          * Physical mac 0 is mapped to physical key 4 or 8, depending
 858          * on the firmware version.
 859          * So we must adjust the index here.
 860          */
 861         index -= pairwise_keys_start;
 862         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 863
 864         if (addr) {
 865                 addrtmp[0] = addr[0];
 866                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 867                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 868                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 869                 addrtmp[1] = addr[4];
 870                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 871         }
 872
 873         /* Receive match transmitter address (RCMTA) mechanism */
 874         b43_shm_write32(dev, B43_SHM_RCMTA,
 875                         (index * 2) + 0, addrtmp[0]);
 876         b43_shm_write16(dev, B43_SHM_RCMTA,
 877                         (index * 2) + 1, addrtmp[1]);
 878 }
 879
 880 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 881  * When a packet is received, the iv32 is checked.
 882  * - if it doesn't the packet is returned without modification (and software
 883  *   decryption can be done). That's what happen when iv16 wrap.
 884  * - if it does, the rc4 key is computed, and decryption is tried.
 885  *   Either it will success and B43_RX_MAC_DEC is returned,
 886  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 887  *   and the packet is not usable (it got modified by the ucode).
 888  * So in order to never have B43_RX_MAC_DECERR, we should provide
 889  * a iv32 and phase1key that match. Because we drop packets in case of
 890  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 891  * packets will be lost without higher layer knowing (ie no resync possible
 892  * until next wrap).
 893  *
 894  * NOTE : this should support 50 key like RCMTA because
 895  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 896  */
 897 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 898                 u16 *phase1key)
 899 {
 900         unsigned int i;
 901         u32 offset;
 902         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 903
 904         if (!modparam_hwtkip)
 905                 return;
 906
 907         if (b43_new_kidx_api(dev))
 908                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 909
 910         B43_WARN_ON(index < pairwise_keys_start);
 911         /* We have four default TX keys and possibly four default RX keys.
 912          * Physical mac 0 is mapped to physical key 4 or 8, depending
 913          * on the firmware version.
 914          * So we must adjust the index here.
 915          */
 916         index -= pairwise_keys_start;
 917         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 918
 919         if (b43_debug(dev, B43_DBG_KEYS)) {
 920                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 921                                 index, iv32);
 922         }
 923         /* Write the key to the  RX tkip shared mem */
 924         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 925         for (i = 0; i < 10; i += 2) {
 926                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 927                                 phase1key ? phase1key[i / 2] : 0);
 928         }
 929         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 930         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 931 }
 932
 933 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 934                                    struct ieee80211_vif *vif,
 935                                    struct ieee80211_key_conf *keyconf,
 936                                    struct ieee80211_sta *sta,
 937                                    u32 iv32, u16 *phase1key)
 938 {
 939         struct b43_wl *wl = hw_to_b43_wl(hw);
 940         struct b43_wldev *dev;
 941         int index = keyconf->hw_key_idx;
 942
 943         if (B43_WARN_ON(!modparam_hwtkip))
 944                 return;
 945
 946         /* This is only called from the RX path through mac80211, where
 947          * our mutex is already locked. */
 948         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 949         dev = wl->current_dev;
 950         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 951
 952         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 953
 954         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 955         /* only pairwise TKIP keys are supported right now */
 956         if (WARN_ON(!sta))
 957                 return;
 958         keymac_write(dev, index, sta->addr);
 959 }
 960
 961 static void do_key_write(struct b43_wldev *dev,
 962                          u8 index, u8 algorithm,
 963                          const u8 *key, size_t key_len, const u8 *mac_addr)
 964 {
 965         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 966         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 967
 968         if (b43_new_kidx_api(dev))
 969                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 970
 971         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 972         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 973
 974         if (index >= pairwise_keys_start)
 975                 keymac_write(dev, index, NULL); /* First zero out mac. */
 976         if (algorithm == B43_SEC_ALGO_TKIP) {
 977                 /*
 978                  * We should provide an initial iv32, phase1key pair.
 979                  * We could start with iv32=0 and compute the corresponding
 980                  * phase1key, but this means calling ieee80211_get_tkip_key
 981                  * with a fake skb (or export other tkip function).
 982                  * Because we are lazy we hope iv32 won't start with
 983                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 984                  * correct pair.
 985                  */
 986                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 987         } else if (index >= pairwise_keys_start) /* clear it */
 988                 rx_tkip_phase1_write(dev, index, 0, NULL);
 989         if (key)
 990                 memcpy(buf, key, key_len);
 991         key_write(dev, index, algorithm, buf);
 992         if (index >= pairwise_keys_start)
 993                 keymac_write(dev, index, mac_addr);
 994
 995         dev->key[index].algorithm = algorithm;
 996 }
 997
 998 static int b43_key_write(struct b43_wldev *dev,
 999                          int index, u8 algorithm,
1000                          const u8 *key, size_t key_len,
1001                          const u8 *mac_addr,
1002                          struct ieee80211_key_conf *keyconf)
1003 {
1004         int i;
1005         int pairwise_keys_start;
1006
1007         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1008          *      - Temporal Encryption Key (128 bits)
1009          *      - Temporal Authenticator Tx MIC Key (64 bits)
1010          *      - Temporal Authenticator Rx MIC Key (64 bits)
1011          *
1012          *      Hardware only store TEK
1013          */
1014         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1015                 key_len = 16;
1016         if (key_len > B43_SEC_KEYSIZE)
1017                 return -EINVAL;
1018         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1019                 /* Check that we don't already have this key. */
1020                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
1021         }
1022         if (index < 0) {
1023                 /* Pairwise key. Get an empty slot for the key. */
1024                 if (b43_new_kidx_api(dev))
1025                         pairwise_keys_start = B43_NR_GROUP_KEYS;
1026                 else
1027                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1028                 for (i = pairwise_keys_start;
1029                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1030                      i++) {
1031                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1032                         if (!dev->key[i].keyconf) {
1033                                 /* found empty */
1034                                 index = i;
1035                                 break;
1036                         }
1037                 }
1038                 if (index < 0) {
1039                         b43warn(dev->wl, "Out of hardware key memory\n");
1040                         return -ENOSPC;
1041                 }
1042         } else
1043                 B43_WARN_ON(index > 3);
1044
1045         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1046         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1047                 /* Default RX key */
1048                 B43_WARN_ON(mac_addr);
1049                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1050         }
1051         keyconf->hw_key_idx = index;
1052         dev->key[index].keyconf = keyconf;
1053
1054         return 0;
1055 }
1056
1057 static int b43_key_clear(struct b43_wldev *dev, int index)
1058 {
1059         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1060                 return -EINVAL;
1061         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1062                      NULL, B43_SEC_KEYSIZE, NULL);
1063         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1064                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1065                              NULL, B43_SEC_KEYSIZE, NULL);
1066         }
1067         dev->key[index].keyconf = NULL;
1068
1069         return 0;
1070 }
1071
1072 static void b43_clear_keys(struct b43_wldev *dev)
1073 {
1074         int i, count;
1075
1076         if (b43_new_kidx_api(dev))
1077                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1078         else
1079                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1080         for (i = 0; i < count; i++)
1081                 b43_key_clear(dev, i);
1082 }
1083
1084 static void b43_dump_keymemory(struct b43_wldev *dev)
1085 {
1086         unsigned int i, index, count, offset, pairwise_keys_start;
1087         u8 mac[ETH_ALEN];
1088         u16 algo;
1089         u32 rcmta0;
1090         u16 rcmta1;
1091         u64 hf;
1092         struct b43_key *key;
1093
1094         if (!b43_debug(dev, B43_DBG_KEYS))
1095                 return;
1096
1097         hf = b43_hf_read(dev);
1098         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1099                !!(hf & B43_HF_USEDEFKEYS));
1100         if (b43_new_kidx_api(dev)) {
1101                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1102                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1103         } else {
1104                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1105                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1106         }
1107         for (index = 0; index < count; index++) {
1108                 key = &(dev->key[index]);
1109                 printk(KERN_DEBUG "Key slot %02u: %s",
1110                        index, (key->keyconf == NULL) ? " " : "*");
1111                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1112                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1113                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1114                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1115                 }
1116
1117                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1118                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1119                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1120
1121                 if (index >= pairwise_keys_start) {
1122                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1123                                 printk("   TKIP: ");
1124                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1125                                 for (i = 0; i < 14; i += 2) {
1126                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1127                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1128                                 }
1129                         }
1130                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1131                                                 ((index - pairwise_keys_start) * 2) + 0);
1132                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1133                                                 ((index - pairwise_keys_start) * 2) + 1);
1134                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1135                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1136                         printk("   MAC: %pM", mac);
1137                 } else
1138                         printk("   DEFAULT KEY");
1139                 printk("\n");
1140         }
1141 }
1142
1143 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1144 {
1145         u32 macctl;
1146         u16 ucstat;
1147         bool hwps;
1148         bool awake;
1149         int i;
1150
1151         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1152                     (ps_flags & B43_PS_DISABLED));
1153         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1154
1155         if (ps_flags & B43_PS_ENABLED) {
1156                 hwps = true;
1157         } else if (ps_flags & B43_PS_DISABLED) {
1158                 hwps = false;
1159         } else {
1160                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1161                 //      and thus is not an AP and we are associated, set bit 25
1162         }
1163         if (ps_flags & B43_PS_AWAKE) {
1164                 awake = true;
1165         } else if (ps_flags & B43_PS_ASLEEP) {
1166                 awake = false;
1167         } else {
1168                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1169                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1170                 //      successful, set bit26
1171         }
1172
1173 /* FIXME: For now we force awake-on and hwps-off */
1174         hwps = false;
1175         awake = true;
1176
1177         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1178         if (hwps)
1179                 macctl |= B43_MACCTL_HWPS;
1180         else
1181                 macctl &= ~B43_MACCTL_HWPS;
1182         if (awake)
1183                 macctl |= B43_MACCTL_AWAKE;
1184         else
1185                 macctl &= ~B43_MACCTL_AWAKE;
1186         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1187         /* Commit write */
1188         b43_read32(dev, B43_MMIO_MACCTL);
1189         if (awake && dev->dev->core_rev >= 5) {
1190                 /* Wait for the microcode to wake up. */
1191                 for (i = 0; i < 100; i++) {
1192                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1193                                                 B43_SHM_SH_UCODESTAT);
1194                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1195                                 break;
1196                         udelay(10);
1197                 }
1198         }
1199 }
1200
1201 /* http://bcm-v4.sipsolutions.net/802.11/PHY/BmacCorePllReset */
1202 void b43_wireless_core_phy_pll_reset(struct b43_wldev *dev)
1203 {
1204         struct bcma_drv_cc *bcma_cc __maybe_unused;
1205         struct ssb_chipcommon *ssb_cc __maybe_unused;
1206
1207         switch (dev->dev->bus_type) {
1208 #ifdef CONFIG_B43_BCMA
1209         case B43_BUS_BCMA:
1210                 bcma_cc = &dev->dev->bdev->bus->drv_cc;
1211
1212                 bcma_cc_write32(bcma_cc, BCMA_CC_CHIPCTL_ADDR, 0);
1213                 bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
1214                 bcma_cc_set32(bcma_cc, BCMA_CC_CHIPCTL_DATA, 0x4);
1215                 bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
1216                 break;
1217 #endif
1218 #ifdef CONFIG_B43_SSB
1219         case B43_BUS_SSB:
1220                 ssb_cc = &dev->dev->sdev->bus->chipco;
1221
1222                 chipco_write32(ssb_cc, SSB_CHIPCO_CHIPCTL_ADDR, 0);
1223                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1224                 chipco_set32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, 0x4);
1225                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1226                 break;
1227 #endif
1228         }
1229 }
1230
1231 #ifdef CONFIG_B43_BCMA
1232 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1233 {
1234         u32 flags;
1235
1236         /* Put PHY into reset */
1237         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1238         flags |= B43_BCMA_IOCTL_PHY_RESET;
1239         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1240         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1241         udelay(2);
1242
1243         b43_phy_take_out_of_reset(dev);
1244 }
1245
1246 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1247 {
1248         u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1249                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1250         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1251                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
1252         u32 flags;
1253
1254         flags = B43_BCMA_IOCTL_PHY_CLKEN;
1255         if (gmode)
1256                 flags |= B43_BCMA_IOCTL_GMODE;
1257         b43_device_enable(dev, flags);
1258
1259         if (dev->phy.type == B43_PHYTYPE_AC) {
1260                 u16 tmp;
1261
1262                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1263                 tmp &= ~B43_BCMA_IOCTL_DAC;
1264                 tmp |= 0x100;
1265                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1266
1267                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1268                 tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
1269                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1270
1271                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1272                 tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
1273                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1274         }
1275
1276         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1277         b43_bcma_phy_reset(dev);
1278         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1279 }
1280 #endif
1281
1282 #ifdef CONFIG_B43_SSB
1283 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1284 {
1285         u32 flags = 0;
1286
1287         if (gmode)
1288                 flags |= B43_TMSLOW_GMODE;
1289         flags |= B43_TMSLOW_PHYCLKEN;
1290         flags |= B43_TMSLOW_PHYRESET;
1291         if (dev->phy.type == B43_PHYTYPE_N)
1292                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1293         b43_device_enable(dev, flags);
1294         msleep(2);              /* Wait for the PLL to turn on. */
1295
1296         b43_phy_take_out_of_reset(dev);
1297 }
1298 #endif
1299
1300 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1301 {
1302         u32 macctl;
1303
1304         switch (dev->dev->bus_type) {
1305 #ifdef CONFIG_B43_BCMA
1306         case B43_BUS_BCMA:
1307                 b43_bcma_wireless_core_reset(dev, gmode);
1308                 break;
1309 #endif
1310 #ifdef CONFIG_B43_SSB
1311         case B43_BUS_SSB:
1312                 b43_ssb_wireless_core_reset(dev, gmode);
1313                 break;
1314 #endif
1315         }
1316
1317         /* Turn Analog ON, but only if we already know the PHY-type.
1318          * This protects against very early setup where we don't know the
1319          * PHY-type, yet. wireless_core_reset will be called once again later,
1320          * when we know the PHY-type. */
1321         if (dev->phy.ops)
1322                 dev->phy.ops->switch_analog(dev, 1);
1323
1324         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1325         macctl &= ~B43_MACCTL_GMODE;
1326         if (gmode)
1327                 macctl |= B43_MACCTL_GMODE;
1328         macctl |= B43_MACCTL_IHR_ENABLED;
1329         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1330 }
1331
1332 static void handle_irq_transmit_status(struct b43_wldev *dev)
1333 {
1334         u32 v0, v1;
1335         u16 tmp;
1336         struct b43_txstatus stat;
1337
1338         while (1) {
1339                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1340                 if (!(v0 & 0x00000001))
1341                         break;
1342                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1343
1344                 stat.cookie = (v0 >> 16);
1345                 stat.seq = (v1 & 0x0000FFFF);
1346                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1347                 tmp = (v0 & 0x0000FFFF);
1348                 stat.frame_count = ((tmp & 0xF000) >> 12);
1349                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1350                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1351                 stat.pm_indicated = !!(tmp & 0x0080);
1352                 stat.intermediate = !!(tmp & 0x0040);
1353                 stat.for_ampdu = !!(tmp & 0x0020);
1354                 stat.acked = !!(tmp & 0x0002);
1355
1356                 b43_handle_txstatus(dev, &stat);
1357         }
1358 }
1359
1360 static void drain_txstatus_queue(struct b43_wldev *dev)
1361 {
1362         u32 dummy;
1363
1364         if (dev->dev->core_rev < 5)
1365                 return;
1366         /* Read all entries from the microcode TXstatus FIFO
1367          * and throw them away.
1368          */
1369         while (1) {
1370                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1371                 if (!(dummy & 0x00000001))
1372                         break;
1373                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1374         }
1375 }
1376
1377 static u32 b43_jssi_read(struct b43_wldev *dev)
1378 {
1379         u32 val = 0;
1380
1381         val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1382         val <<= 16;
1383         val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1384
1385         return val;
1386 }
1387
1388 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1389 {
1390         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1391                         (jssi & 0x0000FFFF));
1392         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1393                         (jssi & 0xFFFF0000) >> 16);
1394 }
1395
1396 static void b43_generate_noise_sample(struct b43_wldev *dev)
1397 {
1398         b43_jssi_write(dev, 0x7F7F7F7F);
1399         b43_write32(dev, B43_MMIO_MACCMD,
1400                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1401 }
1402
1403 static void b43_calculate_link_quality(struct b43_wldev *dev)
1404 {
1405         /* Top half of Link Quality calculation. */
1406
1407         if (dev->phy.type != B43_PHYTYPE_G)
1408                 return;
1409         if (dev->noisecalc.calculation_running)
1410                 return;
1411         dev->noisecalc.calculation_running = true;
1412         dev->noisecalc.nr_samples = 0;
1413
1414         b43_generate_noise_sample(dev);
1415 }
1416
1417 static void handle_irq_noise(struct b43_wldev *dev)
1418 {
1419         struct b43_phy_g *phy = dev->phy.g;
1420         u16 tmp;
1421         u8 noise[4];
1422         u8 i, j;
1423         s32 average;
1424
1425         /* Bottom half of Link Quality calculation. */
1426
1427         if (dev->phy.type != B43_PHYTYPE_G)
1428                 return;
1429
1430         /* Possible race condition: It might be possible that the user
1431          * changed to a different channel in the meantime since we
1432          * started the calculation. We ignore that fact, since it's
1433          * not really that much of a problem. The background noise is
1434          * an estimation only anyway. Slightly wrong results will get damped
1435          * by the averaging of the 8 sample rounds. Additionally the
1436          * value is shortlived. So it will be replaced by the next noise
1437          * calculation round soon. */
1438
1439         B43_WARN_ON(!dev->noisecalc.calculation_running);
1440         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1441         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1442             noise[2] == 0x7F || noise[3] == 0x7F)
1443                 goto generate_new;
1444
1445         /* Get the noise samples. */
1446         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1447         i = dev->noisecalc.nr_samples;
1448         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1449         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1450         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1451         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1452         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1453         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1454         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1455         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1456         dev->noisecalc.nr_samples++;
1457         if (dev->noisecalc.nr_samples == 8) {
1458                 /* Calculate the Link Quality by the noise samples. */
1459                 average = 0;
1460                 for (i = 0; i < 8; i++) {
1461                         for (j = 0; j < 4; j++)
1462                                 average += dev->noisecalc.samples[i][j];
1463                 }
1464                 average /= (8 * 4);
1465                 average *= 125;
1466                 average += 64;
1467                 average /= 128;
1468                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1469                 tmp = (tmp / 128) & 0x1F;
1470                 if (tmp >= 8)
1471                         average += 2;
1472                 else
1473                         average -= 25;
1474                 if (tmp == 8)
1475                         average -= 72;
1476                 else
1477                         average -= 48;
1478
1479                 dev->stats.link_noise = average;
1480                 dev->noisecalc.calculation_running = false;
1481                 return;
1482         }
1483 generate_new:
1484         b43_generate_noise_sample(dev);
1485 }
1486
1487 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1488 {
1489         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1490                 ///TODO: PS TBTT
1491         } else {
1492                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1493                         b43_power_saving_ctl_bits(dev, 0);
1494         }
1495         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1496                 dev->dfq_valid = true;
1497 }
1498
1499 static void handle_irq_atim_end(struct b43_wldev *dev)
1500 {
1501         if (dev->dfq_valid) {
1502                 b43_write32(dev, B43_MMIO_MACCMD,
1503                             b43_read32(dev, B43_MMIO_MACCMD)
1504                             | B43_MACCMD_DFQ_VALID);
1505                 dev->dfq_valid = false;
1506         }
1507 }
1508
1509 static void handle_irq_pmq(struct b43_wldev *dev)
1510 {
1511         u32 tmp;
1512
1513         //TODO: AP mode.
1514
1515         while (1) {
1516                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1517                 if (!(tmp & 0x00000008))
1518                         break;
1519         }
1520         /* 16bit write is odd, but correct. */
1521         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1522 }
1523
1524 static void b43_write_template_common(struct b43_wldev *dev,
1525                                       const u8 *data, u16 size,
1526                                       u16 ram_offset,
1527                                       u16 shm_size_offset, u8 rate)
1528 {
1529         u32 i, tmp;
1530         struct b43_plcp_hdr4 plcp;
1531
1532         plcp.data = 0;
1533         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1534         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1535         ram_offset += sizeof(u32);
1536         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1537          * So leave the first two bytes of the next write blank.
1538          */
1539         tmp = (u32) (data[0]) << 16;
1540         tmp |= (u32) (data[1]) << 24;
1541         b43_ram_write(dev, ram_offset, tmp);
1542         ram_offset += sizeof(u32);
1543         for (i = 2; i < size; i += sizeof(u32)) {
1544                 tmp = (u32) (data[i + 0]);
1545                 if (i + 1 < size)
1546                         tmp |= (u32) (data[i + 1]) << 8;
1547                 if (i + 2 < size)
1548                         tmp |= (u32) (data[i + 2]) << 16;
1549                 if (i + 3 < size)
1550                         tmp |= (u32) (data[i + 3]) << 24;
1551                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1552         }
1553         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1554                         size + sizeof(struct b43_plcp_hdr6));
1555 }
1556
1557 /* Check if the use of the antenna that ieee80211 told us to
1558  * use is possible. This will fall back to DEFAULT.
1559  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1560 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1561                                   u8 antenna_nr)
1562 {
1563         u8 antenna_mask;
1564
1565         if (antenna_nr == 0) {
1566                 /* Zero means "use default antenna". That's always OK. */
1567                 return 0;
1568         }
1569
1570         /* Get the mask of available antennas. */
1571         if (dev->phy.gmode)
1572                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1573         else
1574                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1575
1576         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1577                 /* This antenna is not available. Fall back to default. */
1578                 return 0;
1579         }
1580
1581         return antenna_nr;
1582 }
1583
1584 /* Convert a b43 antenna number value to the PHY TX control value. */
1585 static u16 b43_antenna_to_phyctl(int antenna)
1586 {
1587         switch (antenna) {
1588         case B43_ANTENNA0:
1589                 return B43_TXH_PHY_ANT0;
1590         case B43_ANTENNA1:
1591                 return B43_TXH_PHY_ANT1;
1592         case B43_ANTENNA2:
1593                 return B43_TXH_PHY_ANT2;
1594         case B43_ANTENNA3:
1595                 return B43_TXH_PHY_ANT3;
1596         case B43_ANTENNA_AUTO0:
1597         case B43_ANTENNA_AUTO1:
1598                 return B43_TXH_PHY_ANT01AUTO;
1599         }
1600         B43_WARN_ON(1);
1601         return 0;
1602 }
1603
1604 static void b43_write_beacon_template(struct b43_wldev *dev,
1605                                       u16 ram_offset,
1606                                       u16 shm_size_offset)
1607 {
1608         unsigned int i, len, variable_len;
1609         const struct ieee80211_mgmt *bcn;
1610         const u8 *ie;
1611         bool tim_found = false;
1612         unsigned int rate;
1613         u16 ctl;
1614         int antenna;
1615         struct ieee80211_tx_info *info;
1616         unsigned long flags;
1617         struct sk_buff *beacon_skb;
1618
1619         spin_lock_irqsave(&dev->wl->beacon_lock, flags);
1620         info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1621         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1622         /* Clone the beacon, so it cannot go away, while we write it to hw. */
1623         beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
1624         spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
1625
1626         if (!beacon_skb) {
1627                 b43dbg(dev->wl, "Could not upload beacon. "
1628                        "Failed to clone beacon skb.");
1629                 return;
1630         }
1631
1632         bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
1633         len = min_t(size_t, beacon_skb->len,
1634                     0x200 - sizeof(struct b43_plcp_hdr6));
1635
1636         b43_write_template_common(dev, (const u8 *)bcn,
1637                                   len, ram_offset, shm_size_offset, rate);
1638
1639         /* Write the PHY TX control parameters. */
1640         antenna = B43_ANTENNA_DEFAULT;
1641         antenna = b43_antenna_to_phyctl(antenna);
1642         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1643         /* We can't send beacons with short preamble. Would get PHY errors. */
1644         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1645         ctl &= ~B43_TXH_PHY_ANT;
1646         ctl &= ~B43_TXH_PHY_ENC;
1647         ctl |= antenna;
1648         if (b43_is_cck_rate(rate))
1649                 ctl |= B43_TXH_PHY_ENC_CCK;
1650         else
1651                 ctl |= B43_TXH_PHY_ENC_OFDM;
1652         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1653
1654         /* Find the position of the TIM and the DTIM_period value
1655          * and write them to SHM. */
1656         ie = bcn->u.beacon.variable;
1657         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1658         for (i = 0; i < variable_len - 2; ) {
1659                 uint8_t ie_id, ie_len;
1660
1661                 ie_id = ie[i];
1662                 ie_len = ie[i + 1];
1663                 if (ie_id == 5) {
1664                         u16 tim_position;
1665                         u16 dtim_period;
1666                         /* This is the TIM Information Element */
1667
1668                         /* Check whether the ie_len is in the beacon data range. */
1669                         if (variable_len < ie_len + 2 + i)
1670                                 break;
1671                         /* A valid TIM is at least 4 bytes long. */
1672                         if (ie_len < 4)
1673                                 break;
1674                         tim_found = true;
1675
1676                         tim_position = sizeof(struct b43_plcp_hdr6);
1677                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1678                         tim_position += i;
1679
1680                         dtim_period = ie[i + 3];
1681
1682                         b43_shm_write16(dev, B43_SHM_SHARED,
1683                                         B43_SHM_SH_TIMBPOS, tim_position);
1684                         b43_shm_write16(dev, B43_SHM_SHARED,
1685                                         B43_SHM_SH_DTIMPER, dtim_period);
1686                         break;
1687                 }
1688                 i += ie_len + 2;
1689         }
1690         if (!tim_found) {
1691                 /*
1692                  * If ucode wants to modify TIM do it behind the beacon, this
1693                  * will happen, for example, when doing mesh networking.
1694                  */
1695                 b43_shm_write16(dev, B43_SHM_SHARED,
1696                                 B43_SHM_SH_TIMBPOS,
1697                                 len + sizeof(struct b43_plcp_hdr6));
1698                 b43_shm_write16(dev, B43_SHM_SHARED,
1699                                 B43_SHM_SH_DTIMPER, 0);
1700         }
1701         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1702
1703         dev_kfree_skb_any(beacon_skb);
1704 }
1705
1706 static void b43_upload_beacon0(struct b43_wldev *dev)
1707 {
1708         struct b43_wl *wl = dev->wl;
1709
1710         if (wl->beacon0_uploaded)
1711                 return;
1712         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1713         wl->beacon0_uploaded = true;
1714 }
1715
1716 static void b43_upload_beacon1(struct b43_wldev *dev)
1717 {
1718         struct b43_wl *wl = dev->wl;
1719
1720         if (wl->beacon1_uploaded)
1721                 return;
1722         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1723         wl->beacon1_uploaded = true;
1724 }
1725
1726 static void handle_irq_beacon(struct b43_wldev *dev)
1727 {
1728         struct b43_wl *wl = dev->wl;
1729         u32 cmd, beacon0_valid, beacon1_valid;
1730
1731         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1732             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1733             !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1734                 return;
1735
1736         /* This is the bottom half of the asynchronous beacon update. */
1737
1738         /* Ignore interrupt in the future. */
1739         dev->irq_mask &= ~B43_IRQ_BEACON;
1740
1741         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1742         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1743         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1744
1745         /* Schedule interrupt manually, if busy. */
1746         if (beacon0_valid && beacon1_valid) {
1747                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1748                 dev->irq_mask |= B43_IRQ_BEACON;
1749                 return;
1750         }
1751
1752         if (unlikely(wl->beacon_templates_virgin)) {
1753                 /* We never uploaded a beacon before.
1754                  * Upload both templates now, but only mark one valid. */
1755                 wl->beacon_templates_virgin = false;
1756                 b43_upload_beacon0(dev);
1757                 b43_upload_beacon1(dev);
1758                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1759                 cmd |= B43_MACCMD_BEACON0_VALID;
1760                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1761         } else {
1762                 if (!beacon0_valid) {
1763                         b43_upload_beacon0(dev);
1764                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1765                         cmd |= B43_MACCMD_BEACON0_VALID;
1766                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1767                 } else if (!beacon1_valid) {
1768                         b43_upload_beacon1(dev);
1769                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1770                         cmd |= B43_MACCMD_BEACON1_VALID;
1771                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1772                 }
1773         }
1774 }
1775
1776 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1777 {
1778         u32 old_irq_mask = dev->irq_mask;
1779
1780         /* update beacon right away or defer to irq */
1781         handle_irq_beacon(dev);
1782         if (old_irq_mask != dev->irq_mask) {
1783                 /* The handler updated the IRQ mask. */
1784                 B43_WARN_ON(!dev->irq_mask);
1785                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1786                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1787                 } else {
1788                         /* Device interrupts are currently disabled. That means
1789                          * we just ran the hardirq handler and scheduled the
1790                          * IRQ thread. The thread will write the IRQ mask when
1791                          * it finished, so there's nothing to do here. Writing
1792                          * the mask _here_ would incorrectly re-enable IRQs. */
1793                 }
1794         }
1795 }
1796
1797 static void b43_beacon_update_trigger_work(struct work_struct *work)
1798 {
1799         struct b43_wl *wl = container_of(work, struct b43_wl,
1800                                          beacon_update_trigger);
1801         struct b43_wldev *dev;
1802
1803         mutex_lock(&wl->mutex);
1804         dev = wl->current_dev;
1805         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1806                 if (b43_bus_host_is_sdio(dev->dev)) {
1807                         /* wl->mutex is enough. */
1808                         b43_do_beacon_update_trigger_work(dev);
1809                         mmiowb();
1810                 } else {
1811                         spin_lock_irq(&wl->hardirq_lock);
1812                         b43_do_beacon_update_trigger_work(dev);
1813                         mmiowb();
1814                         spin_unlock_irq(&wl->hardirq_lock);
1815                 }
1816         }
1817         mutex_unlock(&wl->mutex);
1818 }
1819
1820 /* Asynchronously update the packet templates in template RAM. */
1821 static void b43_update_templates(struct b43_wl *wl)
1822 {
1823         struct sk_buff *beacon, *old_beacon;
1824         unsigned long flags;
1825
1826         /* This is the top half of the asynchronous beacon update.
1827          * The bottom half is the beacon IRQ.
1828          * Beacon update must be asynchronous to avoid sending an
1829          * invalid beacon. This can happen for example, if the firmware
1830          * transmits a beacon while we are updating it. */
1831
1832         /* We could modify the existing beacon and set the aid bit in
1833          * the TIM field, but that would probably require resizing and
1834          * moving of data within the beacon template.
1835          * Simply request a new beacon and let mac80211 do the hard work. */
1836         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1837         if (unlikely(!beacon))
1838                 return;
1839
1840         spin_lock_irqsave(&wl->beacon_lock, flags);
1841         old_beacon = wl->current_beacon;
1842         wl->current_beacon = beacon;
1843         wl->beacon0_uploaded = false;
1844         wl->beacon1_uploaded = false;
1845         spin_unlock_irqrestore(&wl->beacon_lock, flags);
1846
1847         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1848
1849         if (old_beacon)
1850                 dev_kfree_skb_any(old_beacon);
1851 }
1852
1853 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1854 {
1855         b43_time_lock(dev);
1856         if (dev->dev->core_rev >= 3) {
1857                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1858                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1859         } else {
1860                 b43_write16(dev, 0x606, (beacon_int >> 6));
1861                 b43_write16(dev, 0x610, beacon_int);
1862         }
1863         b43_time_unlock(dev);
1864         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1865 }
1866
1867 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1868 {
1869         u16 reason;
1870
1871         /* Read the register that contains the reason code for the panic. */
1872         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1873         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1874
1875         switch (reason) {
1876         default:
1877                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1878                 /* fallthrough */
1879         case B43_FWPANIC_DIE:
1880                 /* Do not restart the controller or firmware.
1881                  * The device is nonfunctional from now on.
1882                  * Restarting would result in this panic to trigger again,
1883                  * so we avoid that recursion. */
1884                 break;
1885         case B43_FWPANIC_RESTART:
1886                 b43_controller_restart(dev, "Microcode panic");
1887                 break;
1888         }
1889 }
1890
1891 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1892 {
1893         unsigned int i, cnt;
1894         u16 reason, marker_id, marker_line;
1895         __le16 *buf;
1896
1897         /* The proprietary firmware doesn't have this IRQ. */
1898         if (!dev->fw.opensource)
1899                 return;
1900
1901         /* Read the register that contains the reason code for this IRQ. */
1902         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1903
1904         switch (reason) {
1905         case B43_DEBUGIRQ_PANIC:
1906                 b43_handle_firmware_panic(dev);
1907                 break;
1908         case B43_DEBUGIRQ_DUMP_SHM:
1909                 if (!B43_DEBUG)
1910                         break; /* Only with driver debugging enabled. */
1911                 buf = kmalloc(4096, GFP_ATOMIC);
1912                 if (!buf) {
1913                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1914                         goto out;
1915                 }
1916                 for (i = 0; i < 4096; i += 2) {
1917                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1918                         buf[i / 2] = cpu_to_le16(tmp);
1919                 }
1920                 b43info(dev->wl, "Shared memory dump:\n");
1921                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1922                                16, 2, buf, 4096, 1);
1923                 kfree(buf);
1924                 break;
1925         case B43_DEBUGIRQ_DUMP_REGS:
1926                 if (!B43_DEBUG)
1927                         break; /* Only with driver debugging enabled. */
1928                 b43info(dev->wl, "Microcode register dump:\n");
1929                 for (i = 0, cnt = 0; i < 64; i++) {
1930                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1931                         if (cnt == 0)
1932                                 printk(KERN_INFO);
1933                         printk("r%02u: 0x%04X  ", i, tmp);
1934                         cnt++;
1935                         if (cnt == 6) {
1936                                 printk("\n");
1937                                 cnt = 0;
1938                         }
1939                 }
1940                 printk("\n");
1941                 break;
1942         case B43_DEBUGIRQ_MARKER:
1943                 if (!B43_DEBUG)
1944                         break; /* Only with driver debugging enabled. */
1945                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1946                                            B43_MARKER_ID_REG);
1947                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1948                                              B43_MARKER_LINE_REG);
1949                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1950                         "at line number %u\n",
1951                         marker_id, marker_line);
1952                 break;
1953         default:
1954                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1955                        reason);
1956         }
1957 out:
1958         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1959         b43_shm_write16(dev, B43_SHM_SCRATCH,
1960                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1961 }
1962
1963 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1964 {
1965         u32 reason;
1966         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1967         u32 merged_dma_reason = 0;
1968         int i;
1969
1970         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1971                 return;
1972
1973         reason = dev->irq_reason;
1974         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1975                 dma_reason[i] = dev->dma_reason[i];
1976                 merged_dma_reason |= dma_reason[i];
1977         }
1978
1979         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1980                 b43err(dev->wl, "MAC transmission error\n");
1981
1982         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1983                 b43err(dev->wl, "PHY transmission error\n");
1984                 rmb();
1985                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1986                         atomic_set(&dev->phy.txerr_cnt,
1987                                    B43_PHY_TX_BADNESS_LIMIT);
1988                         b43err(dev->wl, "Too many PHY TX errors, "
1989                                         "restarting the controller\n");
1990                         b43_controller_restart(dev, "PHY TX errors");
1991                 }
1992         }
1993
1994         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
1995                 b43err(dev->wl,
1996                         "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1997                         dma_reason[0], dma_reason[1],
1998                         dma_reason[2], dma_reason[3],
1999                         dma_reason[4], dma_reason[5]);
2000                 b43err(dev->wl, "This device does not support DMA "
2001                                "on your system. It will now be switched to PIO.\n");
2002                 /* Fall back to PIO transfers if we get fatal DMA errors! */
2003                 dev->use_pio = true;
2004                 b43_controller_restart(dev, "DMA error");
2005                 return;
2006         }
2007
2008         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
2009                 handle_irq_ucode_debug(dev);
2010         if (reason & B43_IRQ_TBTT_INDI)
2011                 handle_irq_tbtt_indication(dev);
2012         if (reason & B43_IRQ_ATIM_END)
2013                 handle_irq_atim_end(dev);
2014         if (reason & B43_IRQ_BEACON)
2015                 handle_irq_beacon(dev);
2016         if (reason & B43_IRQ_PMQ)
2017                 handle_irq_pmq(dev);
2018         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
2019                 ;/* TODO */
2020         if (reason & B43_IRQ_NOISESAMPLE_OK)
2021                 handle_irq_noise(dev);
2022
2023         /* Check the DMA reason registers for received data. */
2024         if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
2025                 if (B43_DEBUG)
2026                         b43warn(dev->wl, "RX descriptor underrun\n");
2027                 b43_dma_handle_rx_overflow(dev->dma.rx_ring);
2028         }
2029         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
2030                 if (b43_using_pio_transfers(dev))
2031                         b43_pio_rx(dev->pio.rx_queue);
2032                 else
2033                         b43_dma_rx(dev->dma.rx_ring);
2034         }
2035         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
2036         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
2037         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
2038         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
2039         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
2040
2041         if (reason & B43_IRQ_TX_OK)
2042                 handle_irq_transmit_status(dev);
2043
2044         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
2045         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2046
2047 #if B43_DEBUG
2048         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2049                 dev->irq_count++;
2050                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2051                         if (reason & (1 << i))
2052                                 dev->irq_bit_count[i]++;
2053                 }
2054         }
2055 #endif
2056 }
2057
2058 /* Interrupt thread handler. Handles device interrupts in thread context. */
2059 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
2060 {
2061         struct b43_wldev *dev = dev_id;
2062
2063         mutex_lock(&dev->wl->mutex);
2064         b43_do_interrupt_thread(dev);
2065         mmiowb();
2066         mutex_unlock(&dev->wl->mutex);
2067
2068         return IRQ_HANDLED;
2069 }
2070
2071 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2072 {
2073         u32 reason;
2074
2075         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2076          * On SDIO, this runs under wl->mutex. */
2077
2078         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2079         if (reason == 0xffffffff)       /* shared IRQ */
2080                 return IRQ_NONE;
2081         reason &= dev->irq_mask;
2082         if (!reason)
2083                 return IRQ_NONE;
2084
2085         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2086             & 0x0001FC00;
2087         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2088             & 0x0000DC00;
2089         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2090             & 0x0000DC00;
2091         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2092             & 0x0001DC00;
2093         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2094             & 0x0000DC00;
2095 /* Unused ring
2096         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2097             & 0x0000DC00;
2098 */
2099
2100         /* ACK the interrupt. */
2101         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2102         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2103         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2104         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2105         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2106         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2107 /* Unused ring
2108         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2109 */
2110
2111         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2112         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2113         /* Save the reason bitmasks for the IRQ thread handler. */
2114         dev->irq_reason = reason;
2115
2116         return IRQ_WAKE_THREAD;
2117 }
2118
2119 /* Interrupt handler top-half. This runs with interrupts disabled. */
2120 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2121 {
2122         struct b43_wldev *dev = dev_id;
2123         irqreturn_t ret;
2124
2125         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2126                 return IRQ_NONE;
2127
2128         spin_lock(&dev->wl->hardirq_lock);
2129         ret = b43_do_interrupt(dev);
2130         mmiowb();
2131         spin_unlock(&dev->wl->hardirq_lock);
2132
2133         return ret;
2134 }
2135
2136 /* SDIO interrupt handler. This runs in process context. */
2137 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2138 {
2139         struct b43_wl *wl = dev->wl;
2140         irqreturn_t ret;
2141
2142         mutex_lock(&wl->mutex);
2143
2144         ret = b43_do_interrupt(dev);
2145         if (ret == IRQ_WAKE_THREAD)
2146                 b43_do_interrupt_thread(dev);
2147
2148         mutex_unlock(&wl->mutex);
2149 }
2150
2151 void b43_do_release_fw(struct b43_firmware_file *fw)
2152 {
2153         release_firmware(fw->data);
2154         fw->data = NULL;
2155         fw->filename = NULL;
2156 }
2157
2158 static void b43_release_firmware(struct b43_wldev *dev)
2159 {
2160         complete(&dev->fw_load_complete);
2161         b43_do_release_fw(&dev->fw.ucode);
2162         b43_do_release_fw(&dev->fw.pcm);
2163         b43_do_release_fw(&dev->fw.initvals);
2164         b43_do_release_fw(&dev->fw.initvals_band);
2165 }
2166
2167 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2168 {
2169         const char text[] =
2170                 "/*(DEBLOBBED)*/";
2171
2172         if (error)
2173                 b43err(wl, text);
2174         else
2175                 b43warn(wl, text);
2176 }
2177
2178 static void b43_fw_cb(const struct firmware *firmware, void *context)
2179 {
2180         struct b43_request_fw_context *ctx = context;
2181
2182         ctx->blob = firmware;
2183         complete(&ctx->dev->fw_load_complete);
2184 }
2185
2186 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2187                       const char *name,
2188                       struct b43_firmware_file *fw, bool async)
2189 {
2190         struct b43_fw_header *hdr;
2191         u32 size;
2192         int err;
2193
2194         if (!name) {
2195                 /* Don't fetch anything. Free possibly cached firmware. */
2196                 /* FIXME: We should probably keep it anyway, to save some headache
2197                  * on suspend/resume with multiband devices. */
2198                 b43_do_release_fw(fw);
2199                 return 0;
2200         }
2201         if (fw->filename) {
2202                 if ((fw->type == ctx->req_type) &&
2203                     (strcmp(fw->filename, name) == 0))
2204                         return 0; /* Already have this fw. */
2205                 /* Free the cached firmware first. */
2206                 /* FIXME: We should probably do this later after we successfully
2207                  * got the new fw. This could reduce headache with multiband devices.
2208                  * We could also redesign this to cache the firmware for all possible
2209                  * bands all the time. */
2210                 b43_do_release_fw(fw);
2211         }
2212
2213         switch (ctx->req_type) {
2214         case B43_FWTYPE_PROPRIETARY:
2215                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2216                          "/*(DEBLOBBED)*/",
2217                          modparam_fwpostfix, name);
2218                 break;
2219         case B43_FWTYPE_OPENSOURCE:
2220                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2221                          "b43-open%s/%s.fw",
2222                          modparam_fwpostfix, name);
2223                 break;
2224         default:
2225                 B43_WARN_ON(1);
2226                 return -ENOSYS;
2227         }
2228         if (async) {
2229                 /* do this part asynchronously */
2230                 init_completion(&ctx->dev->fw_load_complete);
2231                 err = maybe_reject_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2232                                               ctx->dev->dev->dev, GFP_KERNEL,
2233                                               ctx, b43_fw_cb);
2234                 if (err < 0) {
2235                         pr_err("Unable to load firmware\n");
2236                         return err;
2237                 }
2238                 wait_for_completion(&ctx->dev->fw_load_complete);
2239                 if (ctx->blob)
2240                         goto fw_ready;
2241         /* On some ARM systems, the async request will fail, but the next sync
2242          * request works. For this reason, we fall through here
2243          */
2244         }
2245         err = maybe_reject_firmware(&ctx->blob, ctx->fwname,
2246                                ctx->dev->dev->dev);
2247         if (err == -ENOENT) {
2248                 snprintf(ctx->errors[ctx->req_type],
2249                          sizeof(ctx->errors[ctx->req_type]),
2250                          "Firmware file \"%s\" not found\n",
2251                          ctx->fwname);
2252                 return err;
2253         } else if (err) {
2254                 snprintf(ctx->errors[ctx->req_type],
2255                          sizeof(ctx->errors[ctx->req_type]),
2256                          "Firmware file \"%s\" request failed (err=%d)\n",
2257                          ctx->fwname, err);
2258                 return err;
2259         }
2260 fw_ready:
2261         if (ctx->blob->size < sizeof(struct b43_fw_header))
2262                 goto err_format;
2263         hdr = (struct b43_fw_header *)(ctx->blob->data);
2264         switch (hdr->type) {
2265         case B43_FW_TYPE_UCODE:
2266         case B43_FW_TYPE_PCM:
2267                 size = be32_to_cpu(hdr->size);
2268                 if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2269                         goto err_format;
2270                 /* fallthrough */
2271         case B43_FW_TYPE_IV:
2272                 if (hdr->ver != 1)
2273                         goto err_format;
2274                 break;
2275         default:
2276                 goto err_format;
2277         }
2278
2279         fw->data = ctx->blob;
2280         fw->filename = name;
2281         fw->type = ctx->req_type;
2282
2283         return 0;
2284
2285 err_format:
2286         snprintf(ctx->errors[ctx->req_type],
2287                  sizeof(ctx->errors[ctx->req_type]),
2288                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2289         release_firmware(ctx->blob);
2290
2291         return -EPROTO;
2292 }
2293
2294 /* http://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2295 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2296 {
2297         struct b43_wldev *dev = ctx->dev;
2298         struct b43_firmware *fw = &ctx->dev->fw;
2299         struct b43_phy *phy = &dev->phy;
2300         const u8 rev = ctx->dev->dev->core_rev;
2301         const char *filename;
2302         int err;
2303
2304         /* Get microcode */
2305         filename = NULL;
2306         switch (rev) {
2307         case 42:
2308                 if (phy->type == B43_PHYTYPE_AC)
2309                         filename = "/*(DEBLOBBED)*/";
2310                 break;
2311         case 40:
2312                 if (phy->type == B43_PHYTYPE_AC)
2313                         filename = "/*(DEBLOBBED)*/";
2314                 break;
2315         case 33:
2316                 if (phy->type == B43_PHYTYPE_LCN40)
2317                         filename = "/*(DEBLOBBED)*/";
2318                 break;
2319         case 30:
2320                 if (phy->type == B43_PHYTYPE_N)
2321                         filename = "/*(DEBLOBBED)*/";
2322                 break;
2323         case 29:
2324                 if (phy->type == B43_PHYTYPE_HT)
2325                         filename = "/*(DEBLOBBED)*/";
2326                 break;
2327         case 26:
2328                 if (phy->type == B43_PHYTYPE_HT)
2329                         filename = "/*(DEBLOBBED)*/";
2330                 break;
2331         case 28:
2332         case 25:
2333                 if (phy->type == B43_PHYTYPE_N)
2334                         filename = "/*(DEBLOBBED)*/";
2335                 else if (phy->type == B43_PHYTYPE_LCN)
2336                         filename = "/*(DEBLOBBED)*/";
2337                 break;
2338         case 24:
2339                 if (phy->type == B43_PHYTYPE_LCN)
2340                         filename = "/*(DEBLOBBED)*/";
2341                 break;
2342         case 23:
2343                 if (phy->type == B43_PHYTYPE_N)
2344                         filename = "/*(DEBLOBBED)*/";
2345                 break;
2346         case 16 ... 19:
2347                 if (phy->type == B43_PHYTYPE_N)
2348                         filename = "/*(DEBLOBBED)*/";
2349                 else if (phy->type == B43_PHYTYPE_LP)
2350                         filename = "/*(DEBLOBBED)*/";
2351                 break;
2352         case 15:
2353                 filename = "/*(DEBLOBBED)*/";
2354                 break;
2355         case 14:
2356                 filename = "/*(DEBLOBBED)*/";
2357                 break;
2358         case 13:
2359                 filename = "/*(DEBLOBBED)*/";
2360                 break;
2361         case 11 ... 12:
2362                 filename = "/*(DEBLOBBED)*/";
2363                 break;
2364         case 5 ... 10:
2365                 filename = "ucode5";
2366                 break;
2367         }
2368         if (!filename)
2369                 goto err_no_ucode;
2370         err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2371         if (err)
2372                 goto err_load;
2373
2374         /* Get PCM code */
2375         if ((rev >= 5) && (rev <= 10))
2376                 filename = "/*(DEBLOBBED)*/";
2377         else if (rev >= 11)
2378                 filename = NULL;
2379         else
2380                 goto err_no_pcm;
2381         fw->pcm_request_failed = false;
2382         err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2383         if (err == -ENOENT) {
2384                 /* We did not find a PCM file? Not fatal, but
2385                  * core rev <= 10 must do without hwcrypto then. */
2386                 fw->pcm_request_failed = true;
2387         } else if (err)
2388                 goto err_load;
2389
2390         /* Get initvals */
2391         filename = NULL;
2392         switch (dev->phy.type) {
2393         case B43_PHYTYPE_G:
2394                 if (rev == 13)
2395                         filename = "/*(DEBLOBBED)*/";
2396                 else if (rev >= 5 && rev <= 10)
2397                         filename = "b0g0initvals5";
2398                 break;
2399         case B43_PHYTYPE_N:
2400                 if (rev == 30)
2401                         filename = "/*(DEBLOBBED)*/";
2402                 else if (rev == 28 || rev == 25)
2403                         filename = "/*(DEBLOBBED)*/";
2404                 else if (rev == 24)
2405                         filename = "/*(DEBLOBBED)*/";
2406                 else if (rev == 23)
2407                         filename = "/*(DEBLOBBED)*/"; /*(DEBLOBBED)*/
2408                 else if (rev >= 16 && rev <= 18)
2409                         filename = "/*(DEBLOBBED)*/";
2410                 else if (rev >= 11 && rev <= 12)
2411                         filename = "/*(DEBLOBBED)*/";
2412                 break;
2413         case B43_PHYTYPE_LP:
2414                 if (rev >= 16 && rev <= 18)
2415                         filename = "/*(DEBLOBBED)*/";
2416                 else if (rev == 15)
2417                         filename = "/*(DEBLOBBED)*/";
2418                 else if (rev == 14)
2419                         filename = "/*(DEBLOBBED)*/";
2420                 else if (rev == 13)
2421                         filename = "/*(DEBLOBBED)*/";
2422                 break;
2423         case B43_PHYTYPE_HT:
2424                 if (rev == 29)
2425                         filename = "/*(DEBLOBBED)*/";
2426                 else if (rev == 26)
2427                         filename = "/*(DEBLOBBED)*/";
2428                 break;
2429         case B43_PHYTYPE_LCN:
2430                 if (rev == 24)
2431                         filename = "/*(DEBLOBBED)*/";
2432                 break;
2433         case B43_PHYTYPE_LCN40:
2434                 if (rev == 33)
2435                         filename = "/*(DEBLOBBED)*/";
2436                 break;
2437         case B43_PHYTYPE_AC:
2438                 if (rev == 42)
2439                         filename = "/*(DEBLOBBED)*/";
2440                 else if (rev == 40)
2441                         filename = "/*(DEBLOBBED)*/";
2442                 break;
2443         }
2444         if (!filename)
2445                 goto err_no_initvals;
2446         err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2447         if (err)
2448                 goto err_load;
2449
2450         /* Get bandswitch initvals */
2451         filename = NULL;
2452         switch (dev->phy.type) {
2453         case B43_PHYTYPE_G:
2454                 if (rev == 13)
2455                         filename = "/*(DEBLOBBED)*/";
2456                 else if (rev >= 5 && rev <= 10)
2457                         filename = "b0g0bsinitvals5";
2458                 break;
2459         case B43_PHYTYPE_N:
2460                 if (rev == 30)
2461                         filename = "/*(DEBLOBBED)*/";
2462                 else if (rev == 28 || rev == 25)
2463                         filename = "/*(DEBLOBBED)*/";
2464                 else if (rev == 24)
2465                         filename = "/*(DEBLOBBED)*/";
2466                 else if (rev == 23)
2467                         filename = "/*(DEBLOBBED)*/"; /*(DEBLOBBED)*/
2468                 else if (rev >= 16 && rev <= 18)
2469                         filename = "/*(DEBLOBBED)*/";
2470                 else if (rev >= 11 && rev <= 12)
2471                         filename = "/*(DEBLOBBED)*/";
2472                 break;
2473         case B43_PHYTYPE_LP:
2474                 if (rev >= 16 && rev <= 18)
2475                         filename = "/*(DEBLOBBED)*/";
2476                 else if (rev == 15)
2477                         filename = "/*(DEBLOBBED)*/";
2478                 else if (rev == 14)
2479                         filename = "/*(DEBLOBBED)*/";
2480                 else if (rev == 13)
2481                         filename = "/*(DEBLOBBED)*/";
2482                 break;
2483         case B43_PHYTYPE_HT:
2484                 if (rev == 29)
2485                         filename = "/*(DEBLOBBED)*/";
2486                 else if (rev == 26)
2487                         filename = "/*(DEBLOBBED)*/";
2488                 break;
2489         case B43_PHYTYPE_LCN:
2490                 if (rev == 24)
2491                         filename = "/*(DEBLOBBED)*/";
2492                 break;
2493         case B43_PHYTYPE_LCN40:
2494                 if (rev == 33)
2495                         filename = "/*(DEBLOBBED)*/";
2496                 break;
2497         case B43_PHYTYPE_AC:
2498                 if (rev == 42)
2499                         filename = "/*(DEBLOBBED)*/";
2500                 else if (rev == 40)
2501                         filename = "/*(DEBLOBBED)*/";
2502                 break;
2503         }
2504         if (!filename)
2505                 goto err_no_initvals;
2506         err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2507         if (err)
2508                 goto err_load;
2509
2510         fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2511
2512         return 0;
2513
2514 err_no_ucode:
2515         err = ctx->fatal_failure = -EOPNOTSUPP;
2516         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2517                "is required for your device (wl-core rev %u)\n", rev);
2518         goto error;
2519
2520 err_no_pcm:
2521         err = ctx->fatal_failure = -EOPNOTSUPP;
2522         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2523                "is required for your device (wl-core rev %u)\n", rev);
2524         goto error;
2525
2526 err_no_initvals:
2527         err = ctx->fatal_failure = -EOPNOTSUPP;
2528         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2529                "is required for your device (wl-core rev %u)\n", rev);
2530         goto error;
2531
2532 err_load:
2533         /* We failed to load this firmware image. The error message
2534          * already is in ctx->errors. Return and let our caller decide
2535          * what to do. */
2536         goto error;
2537
2538 error:
2539         b43_release_firmware(dev);
2540         return err;
2541 }
2542
2543 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2544 static void b43_one_core_detach(struct b43_bus_dev *dev);
2545 static int b43_rng_init(struct b43_wl *wl);
2546
2547 static void b43_request_firmware(struct work_struct *work)
2548 {
2549         struct b43_wl *wl = container_of(work,
2550                             struct b43_wl, firmware_load);
2551         struct b43_wldev *dev = wl->current_dev;
2552         struct b43_request_fw_context *ctx;
2553         unsigned int i;
2554         int err;
2555         const char *errmsg;
2556
2557         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2558         if (!ctx)
2559                 return;
2560         ctx->dev = dev;
2561
2562         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2563         err = b43_try_request_fw(ctx);
2564         if (!err)
2565                 goto start_ieee80211; /* Successfully loaded it. */
2566         /* Was fw version known? */
2567         if (ctx->fatal_failure)
2568                 goto out;
2569
2570         /* proprietary fw not found, try open source */
2571         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2572         err = b43_try_request_fw(ctx);
2573         if (!err)
2574                 goto start_ieee80211; /* Successfully loaded it. */
2575         if(ctx->fatal_failure)
2576                 goto out;
2577
2578         /* Could not find a usable firmware. Print the errors. */
2579         for (i = 0; i < B43_NR_FWTYPES; i++) {
2580                 errmsg = ctx->errors[i];
2581                 if (strlen(errmsg))
2582                         b43err(dev->wl, "%s", errmsg);
2583         }
2584         b43_print_fw_helptext(dev->wl, 1);
2585         goto out;
2586
2587 start_ieee80211:
2588         wl->hw->queues = B43_QOS_QUEUE_NUM;
2589         if (!modparam_qos || dev->fw.opensource)
2590                 wl->hw->queues = 1;
2591
2592         err = ieee80211_register_hw(wl->hw);
2593         if (err)
2594                 goto err_one_core_detach;
2595         wl->hw_registred = true;
2596         b43_leds_register(wl->current_dev);
2597
2598         /* Register HW RNG driver */
2599         b43_rng_init(wl);
2600
2601         goto out;
2602
2603 err_one_core_detach:
2604         b43_one_core_detach(dev->dev);
2605
2606 out:
2607         kfree(ctx);
2608 }
2609
2610 static int b43_upload_microcode(struct b43_wldev *dev)
2611 {
2612         struct wiphy *wiphy = dev->wl->hw->wiphy;
2613         const size_t hdr_len = sizeof(struct b43_fw_header);
2614         const __be32 *data;
2615         unsigned int i, len;
2616         u16 fwrev, fwpatch, fwdate, fwtime;
2617         u32 tmp, macctl;
2618         int err = 0;
2619
2620         /* Jump the microcode PSM to offset 0 */
2621         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2622         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2623         macctl |= B43_MACCTL_PSM_JMP0;
2624         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2625         /* Zero out all microcode PSM registers and shared memory. */
2626         for (i = 0; i < 64; i++)
2627                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2628         for (i = 0; i < 4096; i += 2)
2629                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2630
2631         /* Upload Microcode. */
2632         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2633         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2634         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2635         for (i = 0; i < len; i++) {
2636                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2637                 udelay(10);
2638         }
2639
2640         if (dev->fw.pcm.data) {
2641                 /* Upload PCM data. */
2642                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2643                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2644                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2645                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2646                 /* No need for autoinc bit in SHM_HW */
2647                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2648                 for (i = 0; i < len; i++) {
2649                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2650                         udelay(10);
2651                 }
2652         }
2653
2654         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2655
2656         /* Start the microcode PSM */
2657         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2658                       B43_MACCTL_PSM_RUN);
2659
2660         /* Wait for the microcode to load and respond */
2661         i = 0;
2662         while (1) {
2663                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2664                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2665                         break;
2666                 i++;
2667                 if (i >= 20) {
2668                         b43err(dev->wl, "Microcode not responding\n");
2669                         b43_print_fw_helptext(dev->wl, 1);
2670                         err = -ENODEV;
2671                         goto error;
2672                 }
2673                 msleep(50);
2674         }
2675         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2676
2677         /* Get and check the revisions. */
2678         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2679         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2680         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2681         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2682
2683         if (fwrev <= 0x128) {
2684                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2685                        "binary drivers older than version 4.x is unsupported. "
2686                        "You must upgrade your firmware files.\n");
2687                 b43_print_fw_helptext(dev->wl, 1);
2688                 err = -EOPNOTSUPP;
2689                 goto error;
2690         }
2691         dev->fw.rev = fwrev;
2692         dev->fw.patch = fwpatch;
2693         if (dev->fw.rev >= 598)
2694                 dev->fw.hdr_format = B43_FW_HDR_598;
2695         else if (dev->fw.rev >= 410)
2696                 dev->fw.hdr_format = B43_FW_HDR_410;
2697         else
2698                 dev->fw.hdr_format = B43_FW_HDR_351;
2699         WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2700
2701         dev->qos_enabled = dev->wl->hw->queues > 1;
2702         /* Default to firmware/hardware crypto acceleration. */
2703         dev->hwcrypto_enabled = true;
2704
2705         if (!dev->fw.opensource) {
2706                 b43err(dev->wl, "Rejected non-Free firmware\n");
2707                 err = -EOPNOTSUPP;
2708                 goto error;
2709         }
2710         if (dev->fw.opensource) {
2711                 u16 fwcapa;
2712
2713                 /* Patchlevel info is encoded in the "time" field. */
2714                 dev->fw.patch = fwtime;
2715                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2716                         dev->fw.rev, dev->fw.patch);
2717
2718                 fwcapa = b43_fwcapa_read(dev);
2719                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2720                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2721                         /* Disable hardware crypto and fall back to software crypto. */
2722                         dev->hwcrypto_enabled = false;
2723                 }
2724                 /* adding QoS support should use an offline discovery mechanism */
2725                 WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2726         } else {
2727                 b43info(dev->wl, "Loading firmware version %u.%u "
2728                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2729                         fwrev, fwpatch,
2730                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2731                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2732                 if (dev->fw.pcm_request_failed) {
2733                         b43warn(dev->wl, "No \"/*(DEBLOBBED)*/\" firmware file found. "
2734                                 "Hardware accelerated cryptography is disabled.\n");
2735                         b43_print_fw_helptext(dev->wl, 0);
2736                 }
2737         }
2738
2739         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2740                         dev->fw.rev, dev->fw.patch);
2741         wiphy->hw_version = dev->dev->core_id;
2742
2743         if (dev->fw.hdr_format == B43_FW_HDR_351) {
2744                 /* We're over the deadline, but we keep support for old fw
2745                  * until it turns out to be in major conflict with something new. */
2746                 b43warn(dev->wl, "You are using an old firmware image. "
2747                         "Support for old firmware will be removed soon "
2748                         "(official deadline was July 2008).\n");
2749                 b43_print_fw_helptext(dev->wl, 0);
2750         }
2751
2752         return 0;
2753
2754 error:
2755         /* Stop the microcode PSM. */
2756         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2757                       B43_MACCTL_PSM_JMP0);
2758
2759         return err;
2760 }
2761
2762 static int b43_write_initvals(struct b43_wldev *dev,
2763                               const struct b43_iv *ivals,
2764                               size_t count,
2765                               size_t array_size)
2766 {
2767         const struct b43_iv *iv;
2768         u16 offset;
2769         size_t i;
2770         bool bit32;
2771
2772         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2773         iv = ivals;
2774         for (i = 0; i < count; i++) {
2775                 if (array_size < sizeof(iv->offset_size))
2776                         goto err_format;
2777                 array_size -= sizeof(iv->offset_size);
2778                 offset = be16_to_cpu(iv->offset_size);
2779                 bit32 = !!(offset & B43_IV_32BIT);
2780                 offset &= B43_IV_OFFSET_MASK;
2781                 if (offset >= 0x1000)
2782                         goto err_format;
2783                 if (bit32) {
2784                         u32 value;
2785
2786                         if (array_size < sizeof(iv->data.d32))
2787                                 goto err_format;
2788                         array_size -= sizeof(iv->data.d32);
2789
2790                         value = get_unaligned_be32(&iv->data.d32);
2791                         b43_write32(dev, offset, value);
2792
2793                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2794                                                         sizeof(__be16) +
2795                                                         sizeof(__be32));
2796                 } else {
2797                         u16 value;
2798
2799                         if (array_size < sizeof(iv->data.d16))
2800                                 goto err_format;
2801                         array_size -= sizeof(iv->data.d16);
2802
2803                         value = be16_to_cpu(iv->data.d16);
2804                         b43_write16(dev, offset, value);
2805
2806                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2807                                                         sizeof(__be16) +
2808                                                         sizeof(__be16));
2809                 }
2810         }
2811         if (array_size)
2812                 goto err_format;
2813
2814         return 0;
2815
2816 err_format:
2817         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2818         b43_print_fw_helptext(dev->wl, 1);
2819
2820         return -EPROTO;
2821 }
2822
2823 static int b43_upload_initvals(struct b43_wldev *dev)
2824 {
2825         const size_t hdr_len = sizeof(struct b43_fw_header);
2826         const struct b43_fw_header *hdr;
2827         struct b43_firmware *fw = &dev->fw;
2828         const struct b43_iv *ivals;
2829         size_t count;
2830
2831         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2832         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2833         count = be32_to_cpu(hdr->size);
2834         return b43_write_initvals(dev, ivals, count,
2835                                  fw->initvals.data->size - hdr_len);
2836 }
2837
2838 static int b43_upload_initvals_band(struct b43_wldev *dev)
2839 {
2840         const size_t hdr_len = sizeof(struct b43_fw_header);
2841         const struct b43_fw_header *hdr;
2842         struct b43_firmware *fw = &dev->fw;
2843         const struct b43_iv *ivals;
2844         size_t count;
2845
2846         if (!fw->initvals_band.data)
2847                 return 0;
2848
2849         hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2850         ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2851         count = be32_to_cpu(hdr->size);
2852         return b43_write_initvals(dev, ivals, count,
2853                                   fw->initvals_band.data->size - hdr_len);
2854 }
2855
2856 /* Initialize the GPIOs
2857  * http://bcm-specs.sipsolutions.net/GPIO
2858  */
2859
2860 #ifdef CONFIG_B43_SSB
2861 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2862 {
2863         struct ssb_bus *bus = dev->dev->sdev->bus;
2864
2865 #ifdef CONFIG_SSB_DRIVER_PCICORE
2866         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2867 #else
2868         return bus->chipco.dev;
2869 #endif
2870 }
2871 #endif
2872
2873 static int b43_gpio_init(struct b43_wldev *dev)
2874 {
2875 #ifdef CONFIG_B43_SSB
2876         struct ssb_device *gpiodev;
2877 #endif
2878         u32 mask, set;
2879
2880         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2881         b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2882
2883         mask = 0x0000001F;
2884         set = 0x0000000F;
2885         if (dev->dev->chip_id == 0x4301) {
2886                 mask |= 0x0060;
2887                 set |= 0x0060;
2888         } else if (dev->dev->chip_id == 0x5354) {
2889                 /* Don't allow overtaking buttons GPIOs */
2890                 set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2891         }
2892
2893         if (0 /* FIXME: conditional unknown */ ) {
2894                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2895                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2896                             | 0x0100);
2897                 /* BT Coexistance Input */
2898                 mask |= 0x0080;
2899                 set |= 0x0080;
2900                 /* BT Coexistance Out */
2901                 mask |= 0x0100;
2902                 set |= 0x0100;
2903         }
2904         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2905                 /* PA is controlled by gpio 9, let ucode handle it */
2906                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2907                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2908                             | 0x0200);
2909                 mask |= 0x0200;
2910                 set |= 0x0200;
2911         }
2912
2913         switch (dev->dev->bus_type) {
2914 #ifdef CONFIG_B43_BCMA
2915         case B43_BUS_BCMA:
2916                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2917                 break;
2918 #endif
2919 #ifdef CONFIG_B43_SSB
2920         case B43_BUS_SSB:
2921                 gpiodev = b43_ssb_gpio_dev(dev);
2922                 if (gpiodev)
2923                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2924                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2925                                     & ~mask) | set);
2926                 break;
2927 #endif
2928         }
2929
2930         return 0;
2931 }
2932
2933 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2934 static void b43_gpio_cleanup(struct b43_wldev *dev)
2935 {
2936 #ifdef CONFIG_B43_SSB
2937         struct ssb_device *gpiodev;
2938 #endif
2939
2940         switch (dev->dev->bus_type) {
2941 #ifdef CONFIG_B43_BCMA
2942         case B43_BUS_BCMA:
2943                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2944                 break;
2945 #endif
2946 #ifdef CONFIG_B43_SSB
2947         case B43_BUS_SSB:
2948                 gpiodev = b43_ssb_gpio_dev(dev);
2949                 if (gpiodev)
2950                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2951                 break;
2952 #endif
2953         }
2954 }
2955
2956 /* http://bcm-specs.sipsolutions.net/EnableMac */
2957 void b43_mac_enable(struct b43_wldev *dev)
2958 {
2959         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2960                 u16 fwstate;
2961
2962                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2963                                          B43_SHM_SH_UCODESTAT);
2964                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2965                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2966                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2967                                "should be suspended, but current state is %u\n",
2968                                fwstate);
2969                 }
2970         }
2971
2972         dev->mac_suspended--;
2973         B43_WARN_ON(dev->mac_suspended < 0);
2974         if (dev->mac_suspended == 0) {
2975                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2976                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2977                             B43_IRQ_MAC_SUSPENDED);
2978                 /* Commit writes */
2979                 b43_read32(dev, B43_MMIO_MACCTL);
2980                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2981                 b43_power_saving_ctl_bits(dev, 0);
2982         }
2983 }
2984
2985 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2986 void b43_mac_suspend(struct b43_wldev *dev)
2987 {
2988         int i;
2989         u32 tmp;
2990
2991         might_sleep();
2992         B43_WARN_ON(dev->mac_suspended < 0);
2993
2994         if (dev->mac_suspended == 0) {
2995                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2996                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
2997                 /* force pci to flush the write */
2998                 b43_read32(dev, B43_MMIO_MACCTL);
2999                 for (i = 35; i; i--) {
3000                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3001                         if (tmp & B43_IRQ_MAC_SUSPENDED)
3002                                 goto out;
3003                         udelay(10);
3004                 }
3005                 /* Hm, it seems this will take some time. Use msleep(). */
3006                 for (i = 40; i; i--) {
3007                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3008                         if (tmp & B43_IRQ_MAC_SUSPENDED)
3009                                 goto out;
3010                         msleep(1);
3011                 }
3012                 b43err(dev->wl, "MAC suspend failed\n");
3013         }
3014 out:
3015         dev->mac_suspended++;
3016 }
3017
3018 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
3019 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
3020 {
3021         u32 tmp;
3022
3023         switch (dev->dev->bus_type) {
3024 #ifdef CONFIG_B43_BCMA
3025         case B43_BUS_BCMA:
3026                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3027                 if (on)
3028                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
3029                 else
3030                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
3031                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3032                 break;
3033 #endif
3034 #ifdef CONFIG_B43_SSB
3035         case B43_BUS_SSB:
3036                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3037                 if (on)
3038                         tmp |= B43_TMSLOW_MACPHYCLKEN;
3039                 else
3040                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
3041                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3042                 break;
3043 #endif
3044         }
3045 }
3046
3047 /* brcms_b_switch_macfreq */
3048 void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
3049 {
3050         u16 chip_id = dev->dev->chip_id;
3051
3052         if (chip_id == BCMA_CHIP_ID_BCM4331) {
3053                 switch (spurmode) {
3054                 case 2: /* 168 Mhz: 2^26/168 = 0x61862 */
3055                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x1862);
3056                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3057                         break;
3058                 case 1: /* 164 Mhz: 2^26/164 = 0x63e70 */
3059                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x3e70);
3060                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3061                         break;
3062                 default: /* 160 Mhz: 2^26/160 = 0x66666 */
3063                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x6666);
3064                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3065                         break;
3066                 }
3067         } else if (chip_id == BCMA_CHIP_ID_BCM43131 ||
3068             chip_id == BCMA_CHIP_ID_BCM43217 ||
3069             chip_id == BCMA_CHIP_ID_BCM43222 ||
3070             chip_id == BCMA_CHIP_ID_BCM43224 ||
3071             chip_id == BCMA_CHIP_ID_BCM43225 ||
3072             chip_id == BCMA_CHIP_ID_BCM43227 ||
3073             chip_id == BCMA_CHIP_ID_BCM43228) {
3074                 switch (spurmode) {
3075                 case 2: /* 126 Mhz */
3076                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
3077                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3078                         break;
3079                 case 1: /* 123 Mhz */
3080                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3081                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3082                         break;
3083                 default: /* 120 Mhz */
3084                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3085                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3086                         break;
3087                 }
3088         } else if (dev->phy.type == B43_PHYTYPE_LCN) {
3089                 switch (spurmode) {
3090                 case 1: /* 82 Mhz */
3091                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3092                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3093                         break;
3094                 default: /* 80 Mhz */
3095                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3096                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3097                         break;
3098                 }
3099         }
3100 }
3101
3102 static void b43_adjust_opmode(struct b43_wldev *dev)
3103 {
3104         struct b43_wl *wl = dev->wl;
3105         u32 ctl;
3106         u16 cfp_pretbtt;
3107
3108         ctl = b43_read32(dev, B43_MMIO_MACCTL);
3109         /* Reset status to STA infrastructure mode. */
3110         ctl &= ~B43_MACCTL_AP;
3111         ctl &= ~B43_MACCTL_KEEP_CTL;
3112         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3113         ctl &= ~B43_MACCTL_KEEP_BAD;
3114         ctl &= ~B43_MACCTL_PROMISC;
3115         ctl &= ~B43_MACCTL_BEACPROMISC;
3116         ctl |= B43_MACCTL_INFRA;
3117
3118         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3119             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3120                 ctl |= B43_MACCTL_AP;
3121         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3122                 ctl &= ~B43_MACCTL_INFRA;
3123
3124         if (wl->filter_flags & FIF_CONTROL)
3125                 ctl |= B43_MACCTL_KEEP_CTL;
3126         if (wl->filter_flags & FIF_FCSFAIL)
3127                 ctl |= B43_MACCTL_KEEP_BAD;
3128         if (wl->filter_flags & FIF_PLCPFAIL)
3129                 ctl |= B43_MACCTL_KEEP_BADPLCP;
3130         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3131                 ctl |= B43_MACCTL_BEACPROMISC;
3132
3133         /* Workaround: On old hardware the HW-MAC-address-filter
3134          * doesn't work properly, so always run promisc in filter
3135          * it in software. */
3136         if (dev->dev->core_rev <= 4)
3137                 ctl |= B43_MACCTL_PROMISC;
3138
3139         b43_write32(dev, B43_MMIO_MACCTL, ctl);
3140
3141         cfp_pretbtt = 2;
3142         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3143                 if (dev->dev->chip_id == 0x4306 &&
3144                     dev->dev->chip_rev == 3)
3145                         cfp_pretbtt = 100;
3146                 else
3147                         cfp_pretbtt = 50;
3148         }
3149         b43_write16(dev, 0x612, cfp_pretbtt);
3150
3151         /* FIXME: We don't currently implement the PMQ mechanism,
3152          *        so always disable it. If we want to implement PMQ,
3153          *        we need to enable it here (clear DISCPMQ) in AP mode.
3154          */
3155         if (0  /* ctl & B43_MACCTL_AP */)
3156                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3157         else
3158                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3159 }
3160
3161 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3162 {
3163         u16 offset;
3164
3165         if (is_ofdm) {
3166                 offset = 0x480;
3167                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3168         } else {
3169                 offset = 0x4C0;
3170                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3171         }
3172         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3173                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
3174 }
3175
3176 static void b43_rate_memory_init(struct b43_wldev *dev)
3177 {
3178         switch (dev->phy.type) {
3179         case B43_PHYTYPE_A:
3180         case B43_PHYTYPE_G:
3181         case B43_PHYTYPE_N:
3182         case B43_PHYTYPE_LP:
3183         case B43_PHYTYPE_HT:
3184         case B43_PHYTYPE_LCN:
3185                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3186                 b43_rate_memory_write(dev, B43_OFDM_RATE_9MB, 1);
3187                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3188                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3189                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3190                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3191                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3192                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3193                 if (dev->phy.type == B43_PHYTYPE_A)
3194                         break;
3195                 /* fallthrough */
3196         case B43_PHYTYPE_B:
3197                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3198                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3199                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3200                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3201                 break;
3202         default:
3203                 B43_WARN_ON(1);
3204         }
3205 }
3206
3207 /* Set the default values for the PHY TX Control Words. */
3208 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3209 {
3210         u16 ctl = 0;
3211
3212         ctl |= B43_TXH_PHY_ENC_CCK;
3213         ctl |= B43_TXH_PHY_ANT01AUTO;
3214         ctl |= B43_TXH_PHY_TXPWR;
3215
3216         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3217         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3218         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3219 }
3220
3221 /* Set the TX-Antenna for management frames sent by firmware. */
3222 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3223 {
3224         u16 ant;
3225         u16 tmp;
3226
3227         ant = b43_antenna_to_phyctl(antenna);
3228
3229         /* For ACK/CTS */
3230         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3231         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3232         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3233         /* For Probe Resposes */
3234         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3235         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3236         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3237 }
3238
3239 /* This is the opposite of b43_chip_init() */
3240 static void b43_chip_exit(struct b43_wldev *dev)
3241 {
3242         b43_phy_exit(dev);
3243         b43_gpio_cleanup(dev);
3244         /* firmware is released later */
3245 }
3246
3247 /* Initialize the chip
3248  * http://bcm-specs.sipsolutions.net/ChipInit
3249  */
3250 static int b43_chip_init(struct b43_wldev *dev)
3251 {
3252         struct b43_phy *phy = &dev->phy;
3253         int err;
3254         u32 macctl;
3255         u16 value16;
3256
3257         /* Initialize the MAC control */
3258         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3259         if (dev->phy.gmode)
3260                 macctl |= B43_MACCTL_GMODE;
3261         macctl |= B43_MACCTL_INFRA;
3262         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3263
3264         err = b43_upload_microcode(dev);
3265         if (err)
3266                 goto out;       /* firmware is released later */
3267
3268         err = b43_gpio_init(dev);
3269         if (err)
3270                 goto out;       /* firmware is released later */
3271
3272         err = b43_upload_initvals(dev);
3273         if (err)
3274                 goto err_gpio_clean;
3275
3276         err = b43_upload_initvals_band(dev);
3277         if (err)
3278                 goto err_gpio_clean;
3279
3280         /* Turn the Analog on and initialize the PHY. */
3281         phy->ops->switch_analog(dev, 1);
3282         err = b43_phy_init(dev);
3283         if (err)
3284                 goto err_gpio_clean;
3285
3286         /* Disable Interference Mitigation. */
3287         if (phy->ops->interf_mitigation)
3288                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3289
3290         /* Select the antennae */
3291         if (phy->ops->set_rx_antenna)
3292                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3293         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3294
3295         if (phy->type == B43_PHYTYPE_B) {
3296                 value16 = b43_read16(dev, 0x005E);
3297                 value16 |= 0x0004;
3298                 b43_write16(dev, 0x005E, value16);
3299         }
3300         b43_write32(dev, 0x0100, 0x01000000);
3301         if (dev->dev->core_rev < 5)
3302                 b43_write32(dev, 0x010C, 0x01000000);
3303
3304         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3305         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3306
3307         /* Probe Response Timeout value */
3308         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3309         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3310
3311         /* Initially set the wireless operation mode. */
3312         b43_adjust_opmode(dev);
3313
3314         if (dev->dev->core_rev < 3) {
3315                 b43_write16(dev, 0x060E, 0x0000);
3316                 b43_write16(dev, 0x0610, 0x8000);
3317                 b43_write16(dev, 0x0604, 0x0000);
3318                 b43_write16(dev, 0x0606, 0x0200);
3319         } else {
3320                 b43_write32(dev, 0x0188, 0x80000000);
3321                 b43_write32(dev, 0x018C, 0x02000000);
3322         }
3323         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3324         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3325         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3326         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3327         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3328         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3329         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3330
3331         b43_mac_phy_clock_set(dev, true);
3332
3333         switch (dev->dev->bus_type) {
3334 #ifdef CONFIG_B43_BCMA
3335         case B43_BUS_BCMA:
3336                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3337                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3338                 break;
3339 #endif
3340 #ifdef CONFIG_B43_SSB
3341         case B43_BUS_SSB:
3342                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3343                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3344                 break;
3345 #endif
3346         }
3347
3348         err = 0;
3349         b43dbg(dev->wl, "Chip initialized\n");
3350 out:
3351         return err;
3352
3353 err_gpio_clean:
3354         b43_gpio_cleanup(dev);
3355         return err;
3356 }
3357
3358 static void b43_periodic_every60sec(struct b43_wldev *dev)
3359 {
3360         const struct b43_phy_operations *ops = dev->phy.ops;
3361
3362         if (ops->pwork_60sec)
3363                 ops->pwork_60sec(dev);
3364
3365         /* Force check the TX power emission now. */
3366         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3367 }
3368
3369 static void b43_periodic_every30sec(struct b43_wldev *dev)
3370 {
3371         /* Update device statistics. */
3372         b43_calculate_link_quality(dev);
3373 }
3374
3375 static void b43_periodic_every15sec(struct b43_wldev *dev)
3376 {
3377         struct b43_phy *phy = &dev->phy;
3378         u16 wdr;
3379
3380         if (dev->fw.opensource) {
3381                 /* Check if the firmware is still alive.
3382                  * It will reset the watchdog counter to 0 in its idle loop. */
3383                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3384                 if (unlikely(wdr)) {
3385                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3386                         b43_controller_restart(dev, "Firmware watchdog");
3387                         return;
3388                 } else {
3389                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3390                                         B43_WATCHDOG_REG, 1);
3391                 }
3392         }
3393
3394         if (phy->ops->pwork_15sec)
3395                 phy->ops->pwork_15sec(dev);
3396
3397         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3398         wmb();
3399
3400 #if B43_DEBUG
3401         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3402                 unsigned int i;
3403
3404                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3405                        dev->irq_count / 15,
3406                        dev->tx_count / 15,
3407                        dev->rx_count / 15);
3408                 dev->irq_count = 0;
3409                 dev->tx_count = 0;
3410                 dev->rx_count = 0;
3411                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3412                         if (dev->irq_bit_count[i]) {
3413                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3414                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3415                                 dev->irq_bit_count[i] = 0;
3416                         }
3417                 }
3418         }
3419 #endif
3420 }
3421
3422 static void do_periodic_work(struct b43_wldev *dev)
3423 {
3424         unsigned int state;
3425
3426         state = dev->periodic_state;
3427         if (state % 4 == 0)
3428                 b43_periodic_every60sec(dev);
3429         if (state % 2 == 0)
3430                 b43_periodic_every30sec(dev);
3431         b43_periodic_every15sec(dev);
3432 }
3433
3434 /* Periodic work locking policy:
3435  *      The whole periodic work handler is protected by
3436  *      wl->mutex. If another lock is needed somewhere in the
3437  *      pwork callchain, it's acquired in-place, where it's needed.
3438  */
3439 static void b43_periodic_work_handler(struct work_struct *work)
3440 {
3441         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3442                                              periodic_work.work);
3443         struct b43_wl *wl = dev->wl;
3444         unsigned long delay;
3445
3446         mutex_lock(&wl->mutex);
3447
3448         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3449                 goto out;
3450         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3451                 goto out_requeue;
3452
3453         do_periodic_work(dev);
3454
3455         dev->periodic_state++;
3456 out_requeue:
3457         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3458                 delay = msecs_to_jiffies(50);
3459         else
3460                 delay = round_jiffies_relative(HZ * 15);
3461         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3462 out:
3463         mutex_unlock(&wl->mutex);
3464 }
3465
3466 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3467 {
3468         struct delayed_work *work = &dev->periodic_work;
3469
3470         dev->periodic_state = 0;
3471         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3472         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3473 }
3474
3475 /* Check if communication with the device works correctly. */
3476 static int b43_validate_chipaccess(struct b43_wldev *dev)
3477 {
3478         u32 v, backup0, backup4;
3479
3480         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3481         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3482
3483         /* Check for read/write and endianness problems. */
3484         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3485         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3486                 goto error;
3487         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3488         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3489                 goto error;
3490
3491         /* Check if unaligned 32bit SHM_SHARED access works properly.
3492          * However, don't bail out on failure, because it's noncritical. */
3493         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3494         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3495         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3496         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3497         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3498                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3499         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3500         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3501             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3502             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3503             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3504                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3505
3506         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3507         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3508
3509         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3510                 /* The 32bit register shadows the two 16bit registers
3511                  * with update sideeffects. Validate this. */
3512                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3513                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3514                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3515                         goto error;
3516                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3517                         goto error;
3518         }
3519         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3520
3521         v = b43_read32(dev, B43_MMIO_MACCTL);
3522         v |= B43_MACCTL_GMODE;
3523         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3524                 goto error;
3525
3526         return 0;
3527 error:
3528         b43err(dev->wl, "Failed to validate the chipaccess\n");
3529         return -ENODEV;
3530 }
3531
3532 static void b43_security_init(struct b43_wldev *dev)
3533 {
3534         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3535         /* KTP is a word address, but we address SHM bytewise.
3536          * So multiply by two.
3537          */
3538         dev->ktp *= 2;
3539         /* Number of RCMTA address slots */
3540         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3541         /* Clear the key memory. */
3542         b43_clear_keys(dev);
3543 }
3544
3545 #ifdef CONFIG_B43_HWRNG
3546 static int b43_rng_read(struct hwrng *rng, u32 *data)
3547 {
3548         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3549         struct b43_wldev *dev;
3550         int count = -ENODEV;
3551
3552         mutex_lock(&wl->mutex);
3553         dev = wl->current_dev;
3554         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3555                 *data = b43_read16(dev, B43_MMIO_RNG);
3556                 count = sizeof(u16);
3557         }
3558         mutex_unlock(&wl->mutex);
3559
3560         return count;
3561 }
3562 #endif /* CONFIG_B43_HWRNG */
3563
3564 static void b43_rng_exit(struct b43_wl *wl)
3565 {
3566 #ifdef CONFIG_B43_HWRNG
3567         if (wl->rng_initialized)
3568                 hwrng_unregister(&wl->rng);
3569 #endif /* CONFIG_B43_HWRNG */
3570 }
3571
3572 static int b43_rng_init(struct b43_wl *wl)
3573 {
3574         int err = 0;
3575
3576 #ifdef CONFIG_B43_HWRNG
3577         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3578                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3579         wl->rng.name = wl->rng_name;
3580         wl->rng.data_read = b43_rng_read;
3581         wl->rng.priv = (unsigned long)wl;
3582         wl->rng_initialized = true;
3583         err = hwrng_register(&wl->rng);
3584         if (err) {
3585                 wl->rng_initialized = false;
3586                 b43err(wl, "Failed to register the random "
3587                        "number generator (%d)\n", err);
3588         }
3589 #endif /* CONFIG_B43_HWRNG */
3590
3591         return err;
3592 }
3593
3594 static void b43_tx_work(struct work_struct *work)
3595 {
3596         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3597         struct b43_wldev *dev;
3598         struct sk_buff *skb;
3599         int queue_num;
3600         int err = 0;
3601
3602         mutex_lock(&wl->mutex);
3603         dev = wl->current_dev;
3604         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3605                 mutex_unlock(&wl->mutex);
3606                 return;
3607         }
3608
3609         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3610                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
3611                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
3612                         if (b43_using_pio_transfers(dev))
3613                                 err = b43_pio_tx(dev, skb);
3614                         else
3615                                 err = b43_dma_tx(dev, skb);
3616                         if (err == -ENOSPC) {
3617                                 wl->tx_queue_stopped[queue_num] = 1;
3618                                 ieee80211_stop_queue(wl->hw, queue_num);
3619                                 skb_queue_head(&wl->tx_queue[queue_num], skb);
3620                                 break;
3621                         }
3622                         if (unlikely(err))
3623                                 ieee80211_free_txskb(wl->hw, skb);
3624                         err = 0;
3625                 }
3626
3627                 if (!err)
3628                         wl->tx_queue_stopped[queue_num] = 0;
3629         }
3630
3631 #if B43_DEBUG
3632         dev->tx_count++;
3633 #endif
3634         mutex_unlock(&wl->mutex);
3635 }
3636
3637 static void b43_op_tx(struct ieee80211_hw *hw,
3638                       struct ieee80211_tx_control *control,
3639                       struct sk_buff *skb)
3640 {
3641         struct b43_wl *wl = hw_to_b43_wl(hw);
3642
3643         if (unlikely(skb->len < 2 + 2 + 6)) {
3644                 /* Too short, this can't be a valid frame. */
3645                 ieee80211_free_txskb(hw, skb);
3646                 return;
3647         }
3648         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3649
3650         skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3651         if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3652                 ieee80211_queue_work(wl->hw, &wl->tx_work);
3653         } else {
3654                 ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3655         }
3656 }
3657
3658 static void b43_qos_params_upload(struct b43_wldev *dev,
3659                                   const struct ieee80211_tx_queue_params *p,
3660                                   u16 shm_offset)
3661 {
3662         u16 params[B43_NR_QOSPARAMS];
3663         int bslots, tmp;
3664         unsigned int i;
3665
3666         if (!dev->qos_enabled)
3667                 return;
3668
3669         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3670
3671         memset(&params, 0, sizeof(params));
3672
3673         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3674         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3675         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3676         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3677         params[B43_QOSPARAM_AIFS] = p->aifs;
3678         params[B43_QOSPARAM_BSLOTS] = bslots;
3679         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3680
3681         for (i = 0; i < ARRAY_SIZE(params); i++) {
3682                 if (i == B43_QOSPARAM_STATUS) {
3683                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3684                                              shm_offset + (i * 2));
3685                         /* Mark the parameters as updated. */
3686                         tmp |= 0x100;
3687                         b43_shm_write16(dev, B43_SHM_SHARED,
3688                                         shm_offset + (i * 2),
3689                                         tmp);
3690                 } else {
3691                         b43_shm_write16(dev, B43_SHM_SHARED,
3692                                         shm_offset + (i * 2),
3693                                         params[i]);
3694                 }
3695         }
3696 }
3697
3698 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3699 static const u16 b43_qos_shm_offsets[] = {
3700         /* [mac80211-queue-nr] = SHM_OFFSET, */
3701         [0] = B43_QOS_VOICE,
3702         [1] = B43_QOS_VIDEO,
3703         [2] = B43_QOS_BESTEFFORT,
3704         [3] = B43_QOS_BACKGROUND,
3705 };
3706
3707 /* Update all QOS parameters in hardware. */
3708 static void b43_qos_upload_all(struct b43_wldev *dev)
3709 {
3710         struct b43_wl *wl = dev->wl;
3711         struct b43_qos_params *params;
3712         unsigned int i;
3713
3714         if (!dev->qos_enabled)
3715                 return;
3716
3717         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3718                      ARRAY_SIZE(wl->qos_params));
3719
3720         b43_mac_suspend(dev);
3721         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3722                 params = &(wl->qos_params[i]);
3723                 b43_qos_params_upload(dev, &(params->p),
3724                                       b43_qos_shm_offsets[i]);
3725         }
3726         b43_mac_enable(dev);
3727 }
3728
3729 static void b43_qos_clear(struct b43_wl *wl)
3730 {
3731         struct b43_qos_params *params;
3732         unsigned int i;
3733
3734         /* Initialize QoS parameters to sane defaults. */
3735
3736         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3737                      ARRAY_SIZE(wl->qos_params));
3738
3739         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3740                 params = &(wl->qos_params[i]);
3741
3742                 switch (b43_qos_shm_offsets[i]) {
3743                 case B43_QOS_VOICE:
3744                         params->p.txop = 0;
3745                         params->p.aifs = 2;
3746                         params->p.cw_min = 0x0001;
3747                         params->p.cw_max = 0x0001;
3748                         break;
3749                 case B43_QOS_VIDEO:
3750                         params->p.txop = 0;
3751                         params->p.aifs = 2;
3752                         params->p.cw_min = 0x0001;
3753                         params->p.cw_max = 0x0001;
3754                         break;
3755                 case B43_QOS_BESTEFFORT:
3756                         params->p.txop = 0;
3757                         params->p.aifs = 3;
3758                         params->p.cw_min = 0x0001;
3759                         params->p.cw_max = 0x03FF;
3760                         break;
3761                 case B43_QOS_BACKGROUND:
3762                         params->p.txop = 0;
3763                         params->p.aifs = 7;
3764                         params->p.cw_min = 0x0001;
3765                         params->p.cw_max = 0x03FF;
3766                         break;
3767                 default:
3768                         B43_WARN_ON(1);
3769                 }
3770         }
3771 }
3772
3773 /* Initialize the core's QOS capabilities */
3774 static void b43_qos_init(struct b43_wldev *dev)
3775 {
3776         if (!dev->qos_enabled) {
3777                 /* Disable QOS support. */
3778                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3779                 b43_write16(dev, B43_MMIO_IFSCTL,
3780                             b43_read16(dev, B43_MMIO_IFSCTL)
3781                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3782                 b43dbg(dev->wl, "QoS disabled\n");
3783                 return;
3784         }
3785
3786         /* Upload the current QOS parameters. */
3787         b43_qos_upload_all(dev);
3788
3789         /* Enable QOS support. */
3790         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3791         b43_write16(dev, B43_MMIO_IFSCTL,
3792                     b43_read16(dev, B43_MMIO_IFSCTL)
3793                     | B43_MMIO_IFSCTL_USE_EDCF);
3794         b43dbg(dev->wl, "QoS enabled\n");
3795 }
3796
3797 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3798                           struct ieee80211_vif *vif, u16 _queue,
3799                           const struct ieee80211_tx_queue_params *params)
3800 {
3801         struct b43_wl *wl = hw_to_b43_wl(hw);
3802         struct b43_wldev *dev;
3803         unsigned int queue = (unsigned int)_queue;
3804         int err = -ENODEV;
3805
3806         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3807                 /* Queue not available or don't support setting
3808                  * params on this queue. Return success to not
3809                  * confuse mac80211. */
3810                 return 0;
3811         }
3812         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3813                      ARRAY_SIZE(wl->qos_params));
3814
3815         mutex_lock(&wl->mutex);
3816         dev = wl->current_dev;
3817         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3818                 goto out_unlock;
3819
3820         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3821         b43_mac_suspend(dev);
3822         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3823                               b43_qos_shm_offsets[queue]);
3824         b43_mac_enable(dev);
3825         err = 0;
3826
3827 out_unlock:
3828         mutex_unlock(&wl->mutex);
3829
3830         return err;
3831 }
3832
3833 static int b43_op_get_stats(struct ieee80211_hw *hw,
3834                             struct ieee80211_low_level_stats *stats)
3835 {
3836         struct b43_wl *wl = hw_to_b43_wl(hw);
3837
3838         mutex_lock(&wl->mutex);
3839         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3840         mutex_unlock(&wl->mutex);
3841
3842         return 0;
3843 }
3844
3845 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3846 {
3847         struct b43_wl *wl = hw_to_b43_wl(hw);
3848         struct b43_wldev *dev;
3849         u64 tsf;
3850
3851         mutex_lock(&wl->mutex);
3852         dev = wl->current_dev;
3853
3854         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3855                 b43_tsf_read(dev, &tsf);
3856         else
3857                 tsf = 0;
3858
3859         mutex_unlock(&wl->mutex);
3860
3861         return tsf;
3862 }
3863
3864 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3865                            struct ieee80211_vif *vif, u64 tsf)
3866 {
3867         struct b43_wl *wl = hw_to_b43_wl(hw);
3868         struct b43_wldev *dev;
3869
3870         mutex_lock(&wl->mutex);
3871         dev = wl->current_dev;
3872
3873         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3874                 b43_tsf_write(dev, tsf);
3875
3876         mutex_unlock(&wl->mutex);
3877 }
3878
3879 static const char *band_to_string(enum ieee80211_band band)
3880 {
3881         switch (band) {
3882         case IEEE80211_BAND_5GHZ:
3883                 return "5";
3884         case IEEE80211_BAND_2GHZ:
3885                 return "2.4";
3886         default:
3887                 break;
3888         }
3889         B43_WARN_ON(1);
3890         return "";
3891 }
3892
3893 /* Expects wl->mutex locked */
3894 static int b43_switch_band(struct b43_wldev *dev,
3895                            struct ieee80211_channel *chan)
3896 {
3897         struct b43_phy *phy = &dev->phy;
3898         bool gmode;
3899         u32 tmp;
3900
3901         switch (chan->band) {
3902         case IEEE80211_BAND_5GHZ:
3903                 gmode = false;
3904                 break;
3905         case IEEE80211_BAND_2GHZ:
3906                 gmode = true;
3907                 break;
3908         default:
3909                 B43_WARN_ON(1);
3910                 return -EINVAL;
3911         }
3912
3913         if (!((gmode && phy->supports_2ghz) ||
3914               (!gmode && phy->supports_5ghz))) {
3915                 b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3916                        band_to_string(chan->band));
3917                 return -ENODEV;
3918         }
3919
3920         if (!!phy->gmode == !!gmode) {
3921                 /* This device is already running. */
3922                 return 0;
3923         }
3924
3925         b43dbg(dev->wl, "Switching to %s GHz band\n",
3926                band_to_string(chan->band));
3927
3928         /* Some new devices don't need disabling radio for band switching */
3929         if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3930                 b43_software_rfkill(dev, true);
3931
3932         phy->gmode = gmode;
3933         b43_phy_put_into_reset(dev);
3934         switch (dev->dev->bus_type) {
3935 #ifdef CONFIG_B43_BCMA
3936         case B43_BUS_BCMA:
3937                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3938                 if (gmode)
3939                         tmp |= B43_BCMA_IOCTL_GMODE;
3940                 else
3941                         tmp &= ~B43_BCMA_IOCTL_GMODE;
3942                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3943                 break;
3944 #endif
3945 #ifdef CONFIG_B43_SSB
3946         case B43_BUS_SSB:
3947                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3948                 if (gmode)
3949                         tmp |= B43_TMSLOW_GMODE;
3950                 else
3951                         tmp &= ~B43_TMSLOW_GMODE;
3952                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3953                 break;
3954 #endif
3955         }
3956         b43_phy_take_out_of_reset(dev);
3957
3958         b43_upload_initvals_band(dev);
3959
3960         b43_phy_init(dev);
3961
3962         return 0;
3963 }
3964
3965 static void b43_set_beacon_listen_interval(struct b43_wldev *dev, u16 interval)
3966 {
3967         interval = min_t(u16, interval, (u16)0xFF);
3968         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BCN_LI, interval);
3969 }
3970
3971 /* Write the short and long frame retry limit values. */
3972 static void b43_set_retry_limits(struct b43_wldev *dev,
3973                                  unsigned int short_retry,
3974                                  unsigned int long_retry)
3975 {
3976         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3977          * the chip-internal counter. */
3978         short_retry = min(short_retry, (unsigned int)0xF);
3979         long_retry = min(long_retry, (unsigned int)0xF);
3980
3981         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3982                         short_retry);
3983         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3984                         long_retry);
3985 }
3986
3987 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3988 {
3989         struct b43_wl *wl = hw_to_b43_wl(hw);
3990         struct b43_wldev *dev = wl->current_dev;
3991         struct b43_phy *phy = &dev->phy;
3992         struct ieee80211_conf *conf = &hw->conf;
3993         int antenna;
3994         int err = 0;
3995
3996         mutex_lock(&wl->mutex);
3997         b43_mac_suspend(dev);
3998
3999         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL)
4000                 b43_set_beacon_listen_interval(dev, conf->listen_interval);
4001
4002         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
4003                 phy->chandef = &conf->chandef;
4004                 phy->channel = conf->chandef.chan->hw_value;
4005
4006                 /* Switch the band (if necessary). */
4007                 err = b43_switch_band(dev, conf->chandef.chan);
4008                 if (err)
4009                         goto out_mac_enable;
4010
4011                 /* Switch to the requested channel.
4012                  * The firmware takes care of races with the TX handler.
4013                  */
4014                 b43_switch_channel(dev, phy->channel);
4015         }
4016
4017         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
4018                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
4019                                           conf->long_frame_max_tx_count);
4020         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
4021         if (!changed)
4022                 goto out_mac_enable;
4023
4024         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
4025
4026         /* Adjust the desired TX power level. */
4027         if (conf->power_level != 0) {
4028                 if (conf->power_level != phy->desired_txpower) {
4029                         phy->desired_txpower = conf->power_level;
4030                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
4031                                                    B43_TXPWR_IGNORE_TSSI);
4032                 }
4033         }
4034
4035         /* Antennas for RX and management frame TX. */
4036         antenna = B43_ANTENNA_DEFAULT;
4037         b43_mgmtframe_txantenna(dev, antenna);
4038         antenna = B43_ANTENNA_DEFAULT;
4039         if (phy->ops->set_rx_antenna)
4040                 phy->ops->set_rx_antenna(dev, antenna);
4041
4042         if (wl->radio_enabled != phy->radio_on) {
4043                 if (wl->radio_enabled) {
4044                         b43_software_rfkill(dev, false);
4045                         b43info(dev->wl, "Radio turned on by software\n");
4046                         if (!dev->radio_hw_enable) {
4047                                 b43info(dev->wl, "The hardware RF-kill button "
4048                                         "still turns the radio physically off. "
4049                                         "Press the button to turn it on.\n");
4050                         }
4051                 } else {
4052                         b43_software_rfkill(dev, true);
4053                         b43info(dev->wl, "Radio turned off by software\n");
4054                 }
4055         }
4056
4057 out_mac_enable:
4058         b43_mac_enable(dev);
4059         mutex_unlock(&wl->mutex);
4060
4061         return err;
4062 }
4063
4064 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
4065 {
4066         struct ieee80211_supported_band *sband =
4067                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
4068         struct ieee80211_rate *rate;
4069         int i;
4070         u16 basic, direct, offset, basic_offset, rateptr;
4071
4072         for (i = 0; i < sband->n_bitrates; i++) {
4073                 rate = &sband->bitrates[i];
4074
4075                 if (b43_is_cck_rate(rate->hw_value)) {
4076                         direct = B43_SHM_SH_CCKDIRECT;
4077                         basic = B43_SHM_SH_CCKBASIC;
4078                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4079                         offset &= 0xF;
4080                 } else {
4081                         direct = B43_SHM_SH_OFDMDIRECT;
4082                         basic = B43_SHM_SH_OFDMBASIC;
4083                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4084                         offset &= 0xF;
4085                 }
4086
4087                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4088
4089                 if (b43_is_cck_rate(rate->hw_value)) {
4090                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4091                         basic_offset &= 0xF;
4092                 } else {
4093                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4094                         basic_offset &= 0xF;
4095                 }
4096
4097                 /*
4098                  * Get the pointer that we need to point to
4099                  * from the direct map
4100                  */
4101                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4102                                          direct + 2 * basic_offset);
4103                 /* and write it to the basic map */
4104                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4105                                 rateptr);
4106         }
4107 }
4108
4109 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4110                                     struct ieee80211_vif *vif,
4111                                     struct ieee80211_bss_conf *conf,
4112                                     u32 changed)
4113 {
4114         struct b43_wl *wl = hw_to_b43_wl(hw);
4115         struct b43_wldev *dev;
4116
4117         mutex_lock(&wl->mutex);
4118
4119         dev = wl->current_dev;
4120         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4121                 goto out_unlock_mutex;
4122
4123         B43_WARN_ON(wl->vif != vif);
4124
4125         if (changed & BSS_CHANGED_BSSID) {
4126                 if (conf->bssid)
4127                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4128                 else
4129                         eth_zero_addr(wl->bssid);
4130         }
4131
4132         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4133                 if (changed & BSS_CHANGED_BEACON &&
4134                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4135                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4136                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4137                         b43_update_templates(wl);
4138
4139                 if (changed & BSS_CHANGED_BSSID)
4140                         b43_write_mac_bssid_templates(dev);
4141         }
4142
4143         b43_mac_suspend(dev);
4144
4145         /* Update templates for AP/mesh mode. */
4146         if (changed & BSS_CHANGED_BEACON_INT &&
4147             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4148              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4149              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4150             conf->beacon_int)
4151                 b43_set_beacon_int(dev, conf->beacon_int);
4152
4153         if (changed & BSS_CHANGED_BASIC_RATES)
4154                 b43_update_basic_rates(dev, conf->basic_rates);
4155
4156         if (changed & BSS_CHANGED_ERP_SLOT) {
4157                 if (conf->use_short_slot)
4158                         b43_short_slot_timing_enable(dev);
4159                 else
4160                         b43_short_slot_timing_disable(dev);
4161         }
4162
4163         b43_mac_enable(dev);
4164 out_unlock_mutex:
4165         mutex_unlock(&wl->mutex);
4166 }
4167
4168 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4169                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4170                           struct ieee80211_key_conf *key)
4171 {
4172         struct b43_wl *wl = hw_to_b43_wl(hw);
4173         struct b43_wldev *dev;
4174         u8 algorithm;
4175         u8 index;
4176         int err;
4177         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4178
4179         if (modparam_nohwcrypt)
4180                 return -ENOSPC; /* User disabled HW-crypto */
4181
4182         if ((vif->type == NL80211_IFTYPE_ADHOC ||
4183              vif->type == NL80211_IFTYPE_MESH_POINT) &&
4184             (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4185              key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4186             !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4187                 /*
4188                  * For now, disable hw crypto for the RSN IBSS group keys. This
4189                  * could be optimized in the future, but until that gets
4190                  * implemented, use of software crypto for group addressed
4191                  * frames is a acceptable to allow RSN IBSS to be used.
4192                  */
4193                 return -EOPNOTSUPP;
4194         }
4195
4196         mutex_lock(&wl->mutex);
4197
4198         dev = wl->current_dev;
4199         err = -ENODEV;
4200         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4201                 goto out_unlock;
4202
4203         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4204                 /* We don't have firmware for the crypto engine.
4205                  * Must use software-crypto. */
4206                 err = -EOPNOTSUPP;
4207                 goto out_unlock;
4208         }
4209
4210         err = -EINVAL;
4211         switch (key->cipher) {
4212         case WLAN_CIPHER_SUITE_WEP40:
4213                 algorithm = B43_SEC_ALGO_WEP40;
4214                 break;
4215         case WLAN_CIPHER_SUITE_WEP104:
4216                 algorithm = B43_SEC_ALGO_WEP104;
4217                 break;
4218         case WLAN_CIPHER_SUITE_TKIP:
4219                 algorithm = B43_SEC_ALGO_TKIP;
4220                 break;
4221         case WLAN_CIPHER_SUITE_CCMP:
4222                 algorithm = B43_SEC_ALGO_AES;
4223                 break;
4224         default:
4225                 B43_WARN_ON(1);
4226                 goto out_unlock;
4227         }
4228         index = (u8) (key->keyidx);
4229         if (index > 3)
4230                 goto out_unlock;
4231
4232         switch (cmd) {
4233         case SET_KEY:
4234                 if (algorithm == B43_SEC_ALGO_TKIP &&
4235                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4236                     !modparam_hwtkip)) {
4237                         /* We support only pairwise key */
4238                         err = -EOPNOTSUPP;
4239                         goto out_unlock;
4240                 }
4241
4242                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4243                         if (WARN_ON(!sta)) {
4244                                 err = -EOPNOTSUPP;
4245                                 goto out_unlock;
4246                         }
4247                         /* Pairwise key with an assigned MAC address. */
4248                         err = b43_key_write(dev, -1, algorithm,
4249                                             key->key, key->keylen,
4250                                             sta->addr, key);
4251                 } else {
4252                         /* Group key */
4253                         err = b43_key_write(dev, index, algorithm,
4254                                             key->key, key->keylen, NULL, key);
4255                 }
4256                 if (err)
4257                         goto out_unlock;
4258
4259                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4260                     algorithm == B43_SEC_ALGO_WEP104) {
4261                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4262                 } else {
4263                         b43_hf_write(dev,
4264                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4265                 }
4266                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4267                 if (algorithm == B43_SEC_ALGO_TKIP)
4268                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4269                 break;
4270         case DISABLE_KEY: {
4271                 err = b43_key_clear(dev, key->hw_key_idx);
4272                 if (err)
4273                         goto out_unlock;
4274                 break;
4275         }
4276         default:
4277                 B43_WARN_ON(1);
4278         }
4279
4280 out_unlock:
4281         if (!err) {
4282                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4283                        "mac: %pM\n",
4284                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4285                        sta ? sta->addr : bcast_addr);
4286                 b43_dump_keymemory(dev);
4287         }
4288         mutex_unlock(&wl->mutex);
4289
4290         return err;
4291 }
4292
4293 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4294                                     unsigned int changed, unsigned int *fflags,
4295                                     u64 multicast)
4296 {
4297         struct b43_wl *wl = hw_to_b43_wl(hw);
4298         struct b43_wldev *dev;
4299
4300         mutex_lock(&wl->mutex);
4301         dev = wl->current_dev;
4302         if (!dev) {
4303                 *fflags = 0;
4304                 goto out_unlock;
4305         }
4306
4307         *fflags &= FIF_ALLMULTI |
4308                   FIF_FCSFAIL |
4309                   FIF_PLCPFAIL |
4310                   FIF_CONTROL |
4311                   FIF_OTHER_BSS |
4312                   FIF_BCN_PRBRESP_PROMISC;
4313
4314         changed &= FIF_ALLMULTI |
4315                    FIF_FCSFAIL |
4316                    FIF_PLCPFAIL |
4317                    FIF_CONTROL |
4318                    FIF_OTHER_BSS |
4319                    FIF_BCN_PRBRESP_PROMISC;
4320
4321         wl->filter_flags = *fflags;
4322
4323         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4324                 b43_adjust_opmode(dev);
4325
4326 out_unlock:
4327         mutex_unlock(&wl->mutex);
4328 }
4329
4330 /* Locking: wl->mutex
4331  * Returns the current dev. This might be different from the passed in dev,
4332  * because the core might be gone away while we unlocked the mutex. */
4333 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4334 {
4335         struct b43_wl *wl;
4336         struct b43_wldev *orig_dev;
4337         u32 mask;
4338         int queue_num;
4339
4340         if (!dev)
4341                 return NULL;
4342         wl = dev->wl;
4343 redo:
4344         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4345                 return dev;
4346
4347         /* Cancel work. Unlock to avoid deadlocks. */
4348         mutex_unlock(&wl->mutex);
4349         cancel_delayed_work_sync(&dev->periodic_work);
4350         cancel_work_sync(&wl->tx_work);
4351         b43_leds_stop(dev);
4352         mutex_lock(&wl->mutex);
4353         dev = wl->current_dev;
4354         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4355                 /* Whoops, aliens ate up the device while we were unlocked. */
4356                 return dev;
4357         }
4358
4359         /* Disable interrupts on the device. */
4360         b43_set_status(dev, B43_STAT_INITIALIZED);
4361         if (b43_bus_host_is_sdio(dev->dev)) {
4362                 /* wl->mutex is locked. That is enough. */
4363                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4364                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4365         } else {
4366                 spin_lock_irq(&wl->hardirq_lock);
4367                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4368                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4369                 spin_unlock_irq(&wl->hardirq_lock);
4370         }
4371         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4372         orig_dev = dev;
4373         mutex_unlock(&wl->mutex);
4374         if (b43_bus_host_is_sdio(dev->dev)) {
4375                 b43_sdio_free_irq(dev);
4376         } else {
4377                 synchronize_irq(dev->dev->irq);
4378                 free_irq(dev->dev->irq, dev);
4379         }
4380         mutex_lock(&wl->mutex);
4381         dev = wl->current_dev;
4382         if (!dev)
4383                 return dev;
4384         if (dev != orig_dev) {
4385                 if (b43_status(dev) >= B43_STAT_STARTED)
4386                         goto redo;
4387                 return dev;
4388         }
4389         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4390         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4391
4392         /* Drain all TX queues. */
4393         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4394                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
4395                         struct sk_buff *skb;
4396
4397                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
4398                         ieee80211_free_txskb(wl->hw, skb);
4399                 }
4400         }
4401
4402         b43_mac_suspend(dev);
4403         b43_leds_exit(dev);
4404         b43dbg(wl, "Wireless interface stopped\n");
4405
4406         return dev;
4407 }
4408
4409 /* Locking: wl->mutex */
4410 static int b43_wireless_core_start(struct b43_wldev *dev)
4411 {
4412         int err;
4413
4414         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4415
4416         drain_txstatus_queue(dev);
4417         if (b43_bus_host_is_sdio(dev->dev)) {
4418                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4419                 if (err) {
4420                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4421                         goto out;
4422                 }
4423         } else {
4424                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4425                                            b43_interrupt_thread_handler,
4426                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4427                 if (err) {
4428                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4429                                dev->dev->irq);
4430                         goto out;
4431                 }
4432         }
4433
4434         /* We are ready to run. */
4435         ieee80211_wake_queues(dev->wl->hw);
4436         b43_set_status(dev, B43_STAT_STARTED);
4437
4438         /* Start data flow (TX/RX). */
4439         b43_mac_enable(dev);
4440         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4441
4442         /* Start maintenance work */
4443         b43_periodic_tasks_setup(dev);
4444
4445         b43_leds_init(dev);
4446
4447         b43dbg(dev->wl, "Wireless interface started\n");
4448 out:
4449         return err;
4450 }
4451
4452 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4453 {
4454         switch (phy_type) {
4455         case B43_PHYTYPE_A:
4456                 return "A";
4457         case B43_PHYTYPE_B:
4458                 return "B";
4459         case B43_PHYTYPE_G:
4460                 return "G";
4461         case B43_PHYTYPE_N:
4462                 return "N";
4463         case B43_PHYTYPE_LP:
4464                 return "LP";
4465         case B43_PHYTYPE_SSLPN:
4466                 return "SSLPN";
4467         case B43_PHYTYPE_HT:
4468                 return "HT";
4469         case B43_PHYTYPE_LCN:
4470                 return "LCN";
4471         case B43_PHYTYPE_LCNXN:
4472                 return "LCNXN";
4473         case B43_PHYTYPE_LCN40:
4474                 return "LCN40";
4475         case B43_PHYTYPE_AC:
4476                 return "AC";
4477         }
4478         return "UNKNOWN";
4479 }
4480
4481 /* Get PHY and RADIO versioning numbers */
4482 static int b43_phy_versioning(struct b43_wldev *dev)
4483 {
4484         struct b43_phy *phy = &dev->phy;
4485         const u8 core_rev = dev->dev->core_rev;
4486         u32 tmp;
4487         u8 analog_type;
4488         u8 phy_type;
4489         u8 phy_rev;
4490         u16 radio_manuf;
4491         u16 radio_id;
4492         u16 radio_rev;
4493         u8 radio_ver;
4494         int unsupported = 0;
4495
4496         /* Get PHY versioning */
4497         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4498         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4499         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4500         phy_rev = (tmp & B43_PHYVER_VERSION);
4501
4502         /* LCNXN is continuation of N which run out of revisions */
4503         if (phy_type == B43_PHYTYPE_LCNXN) {
4504                 phy_type = B43_PHYTYPE_N;
4505                 phy_rev += 16;
4506         }
4507
4508         switch (phy_type) {
4509 #ifdef CONFIG_B43_PHY_G
4510         case B43_PHYTYPE_G:
4511                 if (phy_rev > 9)
4512                         unsupported = 1;
4513                 break;
4514 #endif
4515 #ifdef CONFIG_B43_PHY_N
4516         case B43_PHYTYPE_N:
4517                 if (phy_rev >= 19)
4518                         unsupported = 1;
4519                 break;
4520 #endif
4521 #ifdef CONFIG_B43_PHY_LP
4522         case B43_PHYTYPE_LP:
4523                 if (phy_rev > 2)
4524                         unsupported = 1;
4525                 break;
4526 #endif
4527 #ifdef CONFIG_B43_PHY_HT
4528         case B43_PHYTYPE_HT:
4529                 if (phy_rev > 1)
4530                         unsupported = 1;
4531                 break;
4532 #endif
4533 #ifdef CONFIG_B43_PHY_LCN
4534         case B43_PHYTYPE_LCN:
4535                 if (phy_rev > 1)
4536                         unsupported = 1;
4537                 break;
4538 #endif
4539 #ifdef CONFIG_B43_PHY_AC
4540         case B43_PHYTYPE_AC:
4541                 if (phy_rev > 1)
4542                         unsupported = 1;
4543                 break;
4544 #endif
4545         default:
4546                 unsupported = 1;
4547         }
4548         if (unsupported) {
4549                 b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4550                        analog_type, phy_type, b43_phy_name(dev, phy_type),
4551                        phy_rev);
4552                 return -EOPNOTSUPP;
4553         }
4554         b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4555                 analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4556
4557         /* Get RADIO versioning */
4558         if (core_rev == 40 || core_rev == 42) {
4559                 radio_manuf = 0x17F;
4560
4561                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 0);
4562                 radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4563
4564                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 1);
4565                 radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4566
4567                 radio_ver = 0; /* Is there version somewhere? */
4568         } else if (core_rev >= 24) {
4569                 u16 radio24[3];
4570
4571                 for (tmp = 0; tmp < 3; tmp++) {
4572                         b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4573                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4574                 }
4575
4576                 radio_manuf = 0x17F;
4577                 radio_id = (radio24[2] << 8) | radio24[1];
4578                 radio_rev = (radio24[0] & 0xF);
4579                 radio_ver = (radio24[0] & 0xF0) >> 4;
4580         } else {
4581                 if (dev->dev->chip_id == 0x4317) {
4582                         if (dev->dev->chip_rev == 0)
4583                                 tmp = 0x3205017F;
4584                         else if (dev->dev->chip_rev == 1)
4585                                 tmp = 0x4205017F;
4586                         else
4587                                 tmp = 0x5205017F;
4588                 } else {
4589                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4590                                      B43_RADIOCTL_ID);
4591                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4592                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4593                                      B43_RADIOCTL_ID);
4594                         tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4595                 }
4596                 radio_manuf = (tmp & 0x00000FFF);
4597                 radio_id = (tmp & 0x0FFFF000) >> 12;
4598                 radio_rev = (tmp & 0xF0000000) >> 28;
4599                 radio_ver = 0; /* Probably not available on old hw */
4600         }
4601
4602         if (radio_manuf != 0x17F /* Broadcom */)
4603                 unsupported = 1;
4604         switch (phy_type) {
4605         case B43_PHYTYPE_A:
4606                 if (radio_id != 0x2060)
4607                         unsupported = 1;
4608                 if (radio_rev != 1)
4609                         unsupported = 1;
4610                 if (radio_manuf != 0x17F)
4611                         unsupported = 1;
4612                 break;
4613         case B43_PHYTYPE_B:
4614                 if ((radio_id & 0xFFF0) != 0x2050)
4615                         unsupported = 1;
4616                 break;
4617         case B43_PHYTYPE_G:
4618                 if (radio_id != 0x2050)
4619                         unsupported = 1;
4620                 break;
4621         case B43_PHYTYPE_N:
4622                 if (radio_id != 0x2055 && radio_id != 0x2056 &&
4623                     radio_id != 0x2057)
4624                         unsupported = 1;
4625                 if (radio_id == 0x2057 &&
4626                     !(radio_rev == 9 || radio_rev == 14))
4627                         unsupported = 1;
4628                 break;
4629         case B43_PHYTYPE_LP:
4630                 if (radio_id != 0x2062 && radio_id != 0x2063)
4631                         unsupported = 1;
4632                 break;
4633         case B43_PHYTYPE_HT:
4634                 if (radio_id != 0x2059)
4635                         unsupported = 1;
4636                 break;
4637         case B43_PHYTYPE_LCN:
4638                 if (radio_id != 0x2064)
4639                         unsupported = 1;
4640                 break;
4641         case B43_PHYTYPE_AC:
4642                 if (radio_id != 0x2069)
4643                         unsupported = 1;
4644                 break;
4645         default:
4646                 B43_WARN_ON(1);
4647         }
4648         if (unsupported) {
4649                 b43err(dev->wl,
4650                        "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4651                        radio_manuf, radio_id, radio_rev, radio_ver);
4652                 return -EOPNOTSUPP;
4653         }
4654         b43info(dev->wl,
4655                 "Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4656                 radio_manuf, radio_id, radio_rev, radio_ver);
4657
4658         /* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4659         phy->radio_manuf = radio_manuf;
4660         phy->radio_ver = radio_id;
4661         phy->radio_rev = radio_rev;
4662
4663         phy->analog = analog_type;
4664         phy->type = phy_type;
4665         phy->rev = phy_rev;
4666
4667         return 0;
4668 }
4669
4670 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4671                                       struct b43_phy *phy)
4672 {
4673         phy->hardware_power_control = !!modparam_hwpctl;
4674         phy->next_txpwr_check_time = jiffies;
4675         /* PHY TX errors counter. */
4676         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4677
4678 #if B43_DEBUG
4679         phy->phy_locked = false;
4680         phy->radio_locked = false;
4681 #endif
4682 }
4683
4684 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4685 {
4686         dev->dfq_valid = false;
4687
4688         /* Assume the radio is enabled. If it's not enabled, the state will
4689          * immediately get fixed on the first periodic work run. */
4690         dev->radio_hw_enable = true;
4691
4692         /* Stats */
4693         memset(&dev->stats, 0, sizeof(dev->stats));
4694
4695         setup_struct_phy_for_init(dev, &dev->phy);
4696
4697         /* IRQ related flags */
4698         dev->irq_reason = 0;
4699         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4700         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4701         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4702                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4703
4704         dev->mac_suspended = 1;
4705
4706         /* Noise calculation context */
4707         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4708 }
4709
4710 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4711 {
4712         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4713         u64 hf;
4714
4715         if (!modparam_btcoex)
4716                 return;
4717         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4718                 return;
4719         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4720                 return;
4721
4722         hf = b43_hf_read(dev);
4723         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4724                 hf |= B43_HF_BTCOEXALT;
4725         else
4726                 hf |= B43_HF_BTCOEX;
4727         b43_hf_write(dev, hf);
4728 }
4729
4730 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4731 {
4732         if (!modparam_btcoex)
4733                 return;
4734         //TODO
4735 }
4736
4737 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4738 {
4739         struct ssb_bus *bus;
4740         u32 tmp;
4741
4742 #ifdef CONFIG_B43_SSB
4743         if (dev->dev->bus_type != B43_BUS_SSB)
4744                 return;
4745 #else
4746         return;
4747 #endif
4748
4749         bus = dev->dev->sdev->bus;
4750
4751         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4752             (bus->chip_id == 0x4312)) {
4753                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4754                 tmp &= ~SSB_IMCFGLO_REQTO;
4755                 tmp &= ~SSB_IMCFGLO_SERTO;
4756                 tmp |= 0x3;
4757                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4758                 ssb_commit_settings(bus);
4759         }
4760 }
4761
4762 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4763 {
4764         u16 pu_delay;
4765
4766         /* The time value is in microseconds. */
4767         if (dev->phy.type == B43_PHYTYPE_A)
4768                 pu_delay = 3700;
4769         else
4770                 pu_delay = 1050;
4771         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4772                 pu_delay = 500;
4773         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4774                 pu_delay = max(pu_delay, (u16)2400);
4775
4776         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4777 }
4778
4779 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4780 static void b43_set_pretbtt(struct b43_wldev *dev)
4781 {
4782         u16 pretbtt;
4783
4784         /* The time value is in microseconds. */
4785         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4786                 pretbtt = 2;
4787         } else {
4788                 if (dev->phy.type == B43_PHYTYPE_A)
4789                         pretbtt = 120;
4790                 else
4791                         pretbtt = 250;
4792         }
4793         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4794         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4795 }
4796
4797 /* Shutdown a wireless core */
4798 /* Locking: wl->mutex */
4799 static void b43_wireless_core_exit(struct b43_wldev *dev)
4800 {
4801         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4802         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4803                 return;
4804
4805         b43_set_status(dev, B43_STAT_UNINIT);
4806
4807         /* Stop the microcode PSM. */
4808         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4809                       B43_MACCTL_PSM_JMP0);
4810
4811         switch (dev->dev->bus_type) {
4812 #ifdef CONFIG_B43_BCMA
4813         case B43_BUS_BCMA:
4814                 bcma_host_pci_down(dev->dev->bdev->bus);
4815                 break;
4816 #endif
4817 #ifdef CONFIG_B43_SSB
4818         case B43_BUS_SSB:
4819                 /* TODO */
4820                 break;
4821 #endif
4822         }
4823
4824         b43_dma_free(dev);
4825         b43_pio_free(dev);
4826         b43_chip_exit(dev);
4827         dev->phy.ops->switch_analog(dev, 0);
4828         if (dev->wl->current_beacon) {
4829                 dev_kfree_skb_any(dev->wl->current_beacon);
4830                 dev->wl->current_beacon = NULL;
4831         }
4832
4833         b43_device_disable(dev, 0);
4834         b43_bus_may_powerdown(dev);
4835 }
4836
4837 /* Initialize a wireless core */
4838 static int b43_wireless_core_init(struct b43_wldev *dev)
4839 {
4840         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4841         struct b43_phy *phy = &dev->phy;
4842         int err;
4843         u64 hf;
4844
4845         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4846
4847         err = b43_bus_powerup(dev, 0);
4848         if (err)
4849                 goto out;
4850         if (!b43_device_is_enabled(dev))
4851                 b43_wireless_core_reset(dev, phy->gmode);
4852
4853         /* Reset all data structures. */
4854         setup_struct_wldev_for_init(dev);
4855         phy->ops->prepare_structs(dev);
4856
4857         /* Enable IRQ routing to this device. */
4858         switch (dev->dev->bus_type) {
4859 #ifdef CONFIG_B43_BCMA
4860         case B43_BUS_BCMA:
4861                 bcma_host_pci_irq_ctl(dev->dev->bdev->bus,
4862                                       dev->dev->bdev, true);
4863                 bcma_host_pci_up(dev->dev->bdev->bus);
4864                 break;
4865 #endif
4866 #ifdef CONFIG_B43_SSB
4867         case B43_BUS_SSB:
4868                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4869                                                dev->dev->sdev);
4870                 break;
4871 #endif
4872         }
4873
4874         b43_imcfglo_timeouts_workaround(dev);
4875         b43_bluetooth_coext_disable(dev);
4876         if (phy->ops->prepare_hardware) {
4877                 err = phy->ops->prepare_hardware(dev);
4878                 if (err)
4879                         goto err_busdown;
4880         }
4881         err = b43_chip_init(dev);
4882         if (err)
4883                 goto err_busdown;
4884         b43_shm_write16(dev, B43_SHM_SHARED,
4885                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4886         hf = b43_hf_read(dev);
4887         if (phy->type == B43_PHYTYPE_G) {
4888                 hf |= B43_HF_SYMW;
4889                 if (phy->rev == 1)
4890                         hf |= B43_HF_GDCW;
4891                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4892                         hf |= B43_HF_OFDMPABOOST;
4893         }
4894         if (phy->radio_ver == 0x2050) {
4895                 if (phy->radio_rev == 6)
4896                         hf |= B43_HF_4318TSSI;
4897                 if (phy->radio_rev < 6)
4898                         hf |= B43_HF_VCORECALC;
4899         }
4900         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4901                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4902 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4903         if (dev->dev->bus_type == B43_BUS_SSB &&
4904             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4905             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4906                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4907 #endif
4908         hf &= ~B43_HF_SKCFPUP;
4909         b43_hf_write(dev, hf);
4910
4911         /* tell the ucode MAC capabilities */
4912         if (dev->dev->core_rev >= 13) {
4913                 u32 mac_hw_cap = b43_read32(dev, B43_MMIO_MAC_HW_CAP);
4914
4915                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_L,
4916                                 mac_hw_cap & 0xffff);
4917                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_H,
4918                                 (mac_hw_cap >> 16) & 0xffff);
4919         }
4920
4921         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4922                              B43_DEFAULT_LONG_RETRY_LIMIT);
4923         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4924         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4925
4926         /* Disable sending probe responses from firmware.
4927          * Setting the MaxTime to one usec will always trigger
4928          * a timeout, so we never send any probe resp.
4929          * A timeout of zero is infinite. */
4930         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4931
4932         b43_rate_memory_init(dev);
4933         b43_set_phytxctl_defaults(dev);
4934
4935         /* Minimum Contention Window */
4936         if (phy->type == B43_PHYTYPE_B)
4937                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4938         else
4939                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4940         /* Maximum Contention Window */
4941         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4942
4943         /* write phytype and phyvers */
4944         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYTYPE, phy->type);
4945         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYVER, phy->rev);
4946
4947         if (b43_bus_host_is_pcmcia(dev->dev) ||
4948             b43_bus_host_is_sdio(dev->dev)) {
4949                 dev->__using_pio_transfers = true;
4950                 err = b43_pio_init(dev);
4951         } else if (dev->use_pio) {
4952                 b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4953                         "This should not be needed and will result in lower "
4954                         "performance.\n");
4955                 dev->__using_pio_transfers = true;
4956                 err = b43_pio_init(dev);
4957         } else {
4958                 dev->__using_pio_transfers = false;
4959                 err = b43_dma_init(dev);
4960         }
4961         if (err)
4962                 goto err_chip_exit;
4963         b43_qos_init(dev);
4964         b43_set_synth_pu_delay(dev, 1);
4965         b43_bluetooth_coext_enable(dev);
4966
4967         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4968         b43_upload_card_macaddress(dev);
4969         b43_security_init(dev);
4970
4971         ieee80211_wake_queues(dev->wl->hw);
4972
4973         b43_set_status(dev, B43_STAT_INITIALIZED);
4974
4975 out:
4976         return err;
4977
4978 err_chip_exit:
4979         b43_chip_exit(dev);
4980 err_busdown:
4981         b43_bus_may_powerdown(dev);
4982         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4983         return err;
4984 }
4985
4986 static int b43_op_add_interface(struct ieee80211_hw *hw,
4987                                 struct ieee80211_vif *vif)
4988 {
4989         struct b43_wl *wl = hw_to_b43_wl(hw);
4990         struct b43_wldev *dev;
4991         int err = -EOPNOTSUPP;
4992
4993         /* TODO: allow WDS/AP devices to coexist */
4994
4995         if (vif->type != NL80211_IFTYPE_AP &&
4996             vif->type != NL80211_IFTYPE_MESH_POINT &&
4997             vif->type != NL80211_IFTYPE_STATION &&
4998             vif->type != NL80211_IFTYPE_WDS &&
4999             vif->type != NL80211_IFTYPE_ADHOC)
5000                 return -EOPNOTSUPP;
5001
5002         mutex_lock(&wl->mutex);
5003         if (wl->operating)
5004                 goto out_mutex_unlock;
5005
5006         b43dbg(wl, "Adding Interface type %d\n", vif->type);
5007
5008         dev = wl->current_dev;
5009         wl->operating = true;
5010         wl->vif = vif;
5011         wl->if_type = vif->type;
5012         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
5013
5014         b43_adjust_opmode(dev);
5015         b43_set_pretbtt(dev);
5016         b43_set_synth_pu_delay(dev, 0);
5017         b43_upload_card_macaddress(dev);
5018
5019         err = 0;
5020  out_mutex_unlock:
5021         mutex_unlock(&wl->mutex);
5022
5023         if (err == 0)
5024                 b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
5025
5026         return err;
5027 }
5028
5029 static void b43_op_remove_interface(struct ieee80211_hw *hw,
5030                                     struct ieee80211_vif *vif)
5031 {
5032         struct b43_wl *wl = hw_to_b43_wl(hw);
5033         struct b43_wldev *dev = wl->current_dev;
5034
5035         b43dbg(wl, "Removing Interface type %d\n", vif->type);
5036
5037         mutex_lock(&wl->mutex);
5038
5039         B43_WARN_ON(!wl->operating);
5040         B43_WARN_ON(wl->vif != vif);
5041         wl->vif = NULL;
5042
5043         wl->operating = false;
5044
5045         b43_adjust_opmode(dev);
5046         eth_zero_addr(wl->mac_addr);
5047         b43_upload_card_macaddress(dev);
5048
5049         mutex_unlock(&wl->mutex);
5050 }
5051
5052 static int b43_op_start(struct ieee80211_hw *hw)
5053 {
5054         struct b43_wl *wl = hw_to_b43_wl(hw);
5055         struct b43_wldev *dev = wl->current_dev;
5056         int did_init = 0;
5057         int err = 0;
5058
5059         /* Kill all old instance specific information to make sure
5060          * the card won't use it in the short timeframe between start
5061          * and mac80211 reconfiguring it. */
5062         eth_zero_addr(wl->bssid);
5063         eth_zero_addr(wl->mac_addr);
5064         wl->filter_flags = 0;
5065         wl->radiotap_enabled = false;
5066         b43_qos_clear(wl);
5067         wl->beacon0_uploaded = false;
5068         wl->beacon1_uploaded = false;
5069         wl->beacon_templates_virgin = true;
5070         wl->radio_enabled = true;
5071
5072         mutex_lock(&wl->mutex);
5073
5074         if (b43_status(dev) < B43_STAT_INITIALIZED) {
5075                 err = b43_wireless_core_init(dev);
5076                 if (err)
5077                         goto out_mutex_unlock;
5078                 did_init = 1;
5079         }
5080
5081         if (b43_status(dev) < B43_STAT_STARTED) {
5082                 err = b43_wireless_core_start(dev);
5083                 if (err) {
5084                         if (did_init)
5085                                 b43_wireless_core_exit(dev);
5086                         goto out_mutex_unlock;
5087                 }
5088         }
5089
5090         /* XXX: only do if device doesn't support rfkill irq */
5091         wiphy_rfkill_start_polling(hw->wiphy);
5092
5093  out_mutex_unlock:
5094         mutex_unlock(&wl->mutex);
5095
5096         /*
5097          * Configuration may have been overwritten during initialization.
5098          * Reload the configuration, but only if initialization was
5099          * successful. Reloading the configuration after a failed init
5100          * may hang the system.
5101          */
5102         if (!err)
5103                 b43_op_config(hw, ~0);
5104
5105         return err;
5106 }
5107
5108 static void b43_op_stop(struct ieee80211_hw *hw)
5109 {
5110         struct b43_wl *wl = hw_to_b43_wl(hw);
5111         struct b43_wldev *dev = wl->current_dev;
5112
5113         cancel_work_sync(&(wl->beacon_update_trigger));
5114
5115         if (!dev)
5116                 goto out;
5117
5118         mutex_lock(&wl->mutex);
5119         if (b43_status(dev) >= B43_STAT_STARTED) {
5120                 dev = b43_wireless_core_stop(dev);
5121                 if (!dev)
5122                         goto out_unlock;
5123         }
5124         b43_wireless_core_exit(dev);
5125         wl->radio_enabled = false;
5126
5127 out_unlock:
5128         mutex_unlock(&wl->mutex);
5129 out:
5130         cancel_work_sync(&(wl->txpower_adjust_work));
5131 }
5132
5133 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5134                                  struct ieee80211_sta *sta, bool set)
5135 {
5136         struct b43_wl *wl = hw_to_b43_wl(hw);
5137
5138         b43_update_templates(wl);
5139
5140         return 0;
5141 }
5142
5143 static void b43_op_sta_notify(struct ieee80211_hw *hw,
5144                               struct ieee80211_vif *vif,
5145                               enum sta_notify_cmd notify_cmd,
5146                               struct ieee80211_sta *sta)
5147 {
5148         struct b43_wl *wl = hw_to_b43_wl(hw);
5149
5150         B43_WARN_ON(!vif || wl->vif != vif);
5151 }
5152
5153 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw,
5154                                           struct ieee80211_vif *vif,
5155                                           const u8 *mac_addr)
5156 {
5157         struct b43_wl *wl = hw_to_b43_wl(hw);
5158         struct b43_wldev *dev;
5159
5160         mutex_lock(&wl->mutex);
5161         dev = wl->current_dev;
5162         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5163                 /* Disable CFP update during scan on other channels. */
5164                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5165         }
5166         mutex_unlock(&wl->mutex);
5167 }
5168
5169 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw,
5170                                              struct ieee80211_vif *vif)
5171 {
5172         struct b43_wl *wl = hw_to_b43_wl(hw);
5173         struct b43_wldev *dev;
5174
5175         mutex_lock(&wl->mutex);
5176         dev = wl->current_dev;
5177         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5178                 /* Re-enable CFP update. */
5179                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5180         }
5181         mutex_unlock(&wl->mutex);
5182 }
5183
5184 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5185                              struct survey_info *survey)
5186 {
5187         struct b43_wl *wl = hw_to_b43_wl(hw);
5188         struct b43_wldev *dev = wl->current_dev;
5189         struct ieee80211_conf *conf = &hw->conf;
5190
5191         if (idx != 0)
5192                 return -ENOENT;
5193
5194         survey->channel = conf->chandef.chan;
5195         survey->filled = SURVEY_INFO_NOISE_DBM;
5196         survey->noise = dev->stats.link_noise;
5197
5198         return 0;
5199 }
5200
5201 static const struct ieee80211_ops b43_hw_ops = {
5202         .tx                     = b43_op_tx,
5203         .conf_tx                = b43_op_conf_tx,
5204         .add_interface          = b43_op_add_interface,
5205         .remove_interface       = b43_op_remove_interface,
5206         .config                 = b43_op_config,
5207         .bss_info_changed       = b43_op_bss_info_changed,
5208         .configure_filter       = b43_op_configure_filter,
5209         .set_key                = b43_op_set_key,
5210         .update_tkip_key        = b43_op_update_tkip_key,
5211         .get_stats              = b43_op_get_stats,
5212         .get_tsf                = b43_op_get_tsf,
5213         .set_tsf                = b43_op_set_tsf,
5214         .start                  = b43_op_start,
5215         .stop                   = b43_op_stop,
5216         .set_tim                = b43_op_beacon_set_tim,
5217         .sta_notify             = b43_op_sta_notify,
5218         .sw_scan_start          = b43_op_sw_scan_start_notifier,
5219         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
5220         .get_survey             = b43_op_get_survey,
5221         .rfkill_poll            = b43_rfkill_poll,
5222 };
5223
5224 /* Hard-reset the chip. Do not call this directly.
5225  * Use b43_controller_restart()
5226  */
5227 static void b43_chip_reset(struct work_struct *work)
5228 {
5229         struct b43_wldev *dev =
5230             container_of(work, struct b43_wldev, restart_work);
5231         struct b43_wl *wl = dev->wl;
5232         int err = 0;
5233         int prev_status;
5234
5235         mutex_lock(&wl->mutex);
5236
5237         prev_status = b43_status(dev);
5238         /* Bring the device down... */
5239         if (prev_status >= B43_STAT_STARTED) {
5240                 dev = b43_wireless_core_stop(dev);
5241                 if (!dev) {
5242                         err = -ENODEV;
5243                         goto out;
5244                 }
5245         }
5246         if (prev_status >= B43_STAT_INITIALIZED)
5247                 b43_wireless_core_exit(dev);
5248
5249         /* ...and up again. */
5250         if (prev_status >= B43_STAT_INITIALIZED) {
5251                 err = b43_wireless_core_init(dev);
5252                 if (err)
5253                         goto out;
5254         }
5255         if (prev_status >= B43_STAT_STARTED) {
5256                 err = b43_wireless_core_start(dev);
5257                 if (err) {
5258                         b43_wireless_core_exit(dev);
5259                         goto out;
5260                 }
5261         }
5262 out:
5263         if (err)
5264                 wl->current_dev = NULL; /* Failed to init the dev. */
5265         mutex_unlock(&wl->mutex);
5266
5267         if (err) {
5268                 b43err(wl, "Controller restart FAILED\n");
5269                 return;
5270         }
5271
5272         /* reload configuration */
5273         b43_op_config(wl->hw, ~0);
5274         if (wl->vif)
5275                 b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5276
5277         b43info(wl, "Controller restarted\n");
5278 }
5279
5280 static int b43_setup_bands(struct b43_wldev *dev,
5281                            bool have_2ghz_phy, bool have_5ghz_phy)
5282 {
5283         struct ieee80211_hw *hw = dev->wl->hw;
5284         struct b43_phy *phy = &dev->phy;
5285         bool limited_2g;
5286         bool limited_5g;
5287
5288         /* We don't support all 2 GHz channels on some devices */
5289         limited_2g = phy->radio_ver == 0x2057 &&
5290                      (phy->radio_rev == 9 || phy->radio_rev == 14);
5291         limited_5g = phy->radio_ver == 0x2057 &&
5292                      phy->radio_rev == 9;
5293
5294         if (have_2ghz_phy)
5295                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = limited_2g ?
5296                         &b43_band_2ghz_limited : &b43_band_2GHz;
5297         if (dev->phy.type == B43_PHYTYPE_N) {
5298                 if (have_5ghz_phy)
5299                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = limited_5g ?
5300                                 &b43_band_5GHz_nphy_limited :
5301                                 &b43_band_5GHz_nphy;
5302         } else {
5303                 if (have_5ghz_phy)
5304                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5305         }
5306
5307         dev->phy.supports_2ghz = have_2ghz_phy;
5308         dev->phy.supports_5ghz = have_5ghz_phy;
5309
5310         return 0;
5311 }
5312
5313 static void b43_wireless_core_detach(struct b43_wldev *dev)
5314 {
5315         /* We release firmware that late to not be required to re-request
5316          * is all the time when we reinit the core. */
5317         b43_release_firmware(dev);
5318         b43_phy_free(dev);
5319 }
5320
5321 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5322                                 bool *have_5ghz_phy)
5323 {
5324         u16 dev_id = 0;
5325
5326 #ifdef CONFIG_B43_BCMA
5327         if (dev->dev->bus_type == B43_BUS_BCMA &&
5328             dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5329                 dev_id = dev->dev->bdev->bus->host_pci->device;
5330 #endif
5331 #ifdef CONFIG_B43_SSB
5332         if (dev->dev->bus_type == B43_BUS_SSB &&
5333             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5334                 dev_id = dev->dev->sdev->bus->host_pci->device;
5335 #endif
5336         /* Override with SPROM value if available */
5337         if (dev->dev->bus_sprom->dev_id)
5338                 dev_id = dev->dev->bus_sprom->dev_id;
5339
5340         /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5341         switch (dev_id) {
5342         case 0x4324: /* BCM4306 */
5343         case 0x4312: /* BCM4311 */
5344         case 0x4319: /* BCM4318 */
5345         case 0x4328: /* BCM4321 */
5346         case 0x432b: /* BCM4322 */
5347         case 0x4350: /* BCM43222 */
5348         case 0x4353: /* BCM43224 */
5349         case 0x0576: /* BCM43224 */
5350         case 0x435f: /* BCM6362 */
5351         case 0x4331: /* BCM4331 */
5352         case 0x4359: /* BCM43228 */
5353         case 0x43a0: /* BCM4360 */
5354         case 0x43b1: /* BCM4352 */
5355                 /* Dual band devices */
5356                 *have_2ghz_phy = true;
5357                 *have_5ghz_phy = true;
5358                 return;
5359         case 0x4321: /* BCM4306 */
5360                 /* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
5361                 if (dev->phy.type != B43_PHYTYPE_G)
5362                         break;
5363                 /* fall through */
5364         case 0x4313: /* BCM4311 */
5365         case 0x431a: /* BCM4318 */
5366         case 0x432a: /* BCM4321 */
5367         case 0x432d: /* BCM4322 */
5368         case 0x4352: /* BCM43222 */
5369         case 0x435a: /* BCM43228 */
5370         case 0x4333: /* BCM4331 */
5371         case 0x43a2: /* BCM4360 */
5372         case 0x43b3: /* BCM4352 */
5373                 /* 5 GHz only devices */
5374                 *have_2ghz_phy = false;
5375                 *have_5ghz_phy = true;
5376                 return;
5377         }
5378
5379         /* As a fallback, try to guess using PHY type */
5380         switch (dev->phy.type) {
5381         case B43_PHYTYPE_A:
5382                 *have_2ghz_phy = false;
5383                 *have_5ghz_phy = true;
5384                 return;
5385         case B43_PHYTYPE_G:
5386         case B43_PHYTYPE_N:
5387         case B43_PHYTYPE_LP:
5388         case B43_PHYTYPE_HT:
5389         case B43_PHYTYPE_LCN:
5390                 *have_2ghz_phy = true;
5391                 *have_5ghz_phy = false;
5392                 return;
5393         }
5394
5395         B43_WARN_ON(1);
5396 }
5397
5398 static int b43_wireless_core_attach(struct b43_wldev *dev)
5399 {
5400         struct b43_wl *wl = dev->wl;
5401         struct b43_phy *phy = &dev->phy;
5402         int err;
5403         u32 tmp;
5404         bool have_2ghz_phy = false, have_5ghz_phy = false;
5405
5406         /* Do NOT do any device initialization here.
5407          * Do it in wireless_core_init() instead.
5408          * This function is for gathering basic information about the HW, only.
5409          * Also some structs may be set up here. But most likely you want to have
5410          * that in core_init(), too.
5411          */
5412
5413         err = b43_bus_powerup(dev, 0);
5414         if (err) {
5415                 b43err(wl, "Bus powerup failed\n");
5416                 goto out;
5417         }
5418
5419         phy->do_full_init = true;
5420
5421         /* Try to guess supported bands for the first init needs */
5422         switch (dev->dev->bus_type) {
5423 #ifdef CONFIG_B43_BCMA
5424         case B43_BUS_BCMA:
5425                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5426                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5427                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5428                 break;
5429 #endif
5430 #ifdef CONFIG_B43_SSB
5431         case B43_BUS_SSB:
5432                 if (dev->dev->core_rev >= 5) {
5433                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5434                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5435                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5436                 } else
5437                         B43_WARN_ON(1);
5438                 break;
5439 #endif
5440         }
5441
5442         dev->phy.gmode = have_2ghz_phy;
5443         b43_wireless_core_reset(dev, dev->phy.gmode);
5444
5445         /* Get the PHY type. */
5446         err = b43_phy_versioning(dev);
5447         if (err)
5448                 goto err_powerdown;
5449
5450         /* Get real info about supported bands */
5451         b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5452
5453         /* We don't support 5 GHz on some PHYs yet */
5454         if (have_5ghz_phy) {
5455                 switch (dev->phy.type) {
5456                 case B43_PHYTYPE_A:
5457                 case B43_PHYTYPE_G:
5458                 case B43_PHYTYPE_LP:
5459                 case B43_PHYTYPE_HT:
5460                         b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5461                         have_5ghz_phy = false;
5462                 }
5463         }
5464
5465         if (!have_2ghz_phy && !have_5ghz_phy) {
5466                 b43err(wl, "b43 can't support any band on this device\n");
5467                 err = -EOPNOTSUPP;
5468                 goto err_powerdown;
5469         }
5470
5471         err = b43_phy_allocate(dev);
5472         if (err)
5473                 goto err_powerdown;
5474
5475         dev->phy.gmode = have_2ghz_phy;
5476         b43_wireless_core_reset(dev, dev->phy.gmode);
5477
5478         err = b43_validate_chipaccess(dev);
5479         if (err)
5480                 goto err_phy_free;
5481         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5482         if (err)
5483                 goto err_phy_free;
5484
5485         /* Now set some default "current_dev" */
5486         if (!wl->current_dev)
5487                 wl->current_dev = dev;
5488         INIT_WORK(&dev->restart_work, b43_chip_reset);
5489
5490         dev->phy.ops->switch_analog(dev, 0);
5491         b43_device_disable(dev, 0);
5492         b43_bus_may_powerdown(dev);
5493
5494 out:
5495         return err;
5496
5497 err_phy_free:
5498         b43_phy_free(dev);
5499 err_powerdown:
5500         b43_bus_may_powerdown(dev);
5501         return err;
5502 }
5503
5504 static void b43_one_core_detach(struct b43_bus_dev *dev)
5505 {
5506         struct b43_wldev *wldev;
5507         struct b43_wl *wl;
5508
5509         /* Do not cancel ieee80211-workqueue based work here.
5510          * See comment in b43_remove(). */
5511
5512         wldev = b43_bus_get_wldev(dev);
5513         wl = wldev->wl;
5514         b43_debugfs_remove_device(wldev);
5515         b43_wireless_core_detach(wldev);
5516         list_del(&wldev->list);
5517         b43_bus_set_wldev(dev, NULL);
5518         kfree(wldev);
5519 }
5520
5521 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5522 {
5523         struct b43_wldev *wldev;
5524         int err = -ENOMEM;
5525
5526         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5527         if (!wldev)
5528                 goto out;
5529
5530         wldev->use_pio = b43_modparam_pio;
5531         wldev->dev = dev;
5532         wldev->wl = wl;
5533         b43_set_status(wldev, B43_STAT_UNINIT);
5534         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5535         INIT_LIST_HEAD(&wldev->list);
5536
5537         err = b43_wireless_core_attach(wldev);
5538         if (err)
5539                 goto err_kfree_wldev;
5540
5541         b43_bus_set_wldev(dev, wldev);
5542         b43_debugfs_add_device(wldev);
5543
5544       out:
5545         return err;
5546
5547       err_kfree_wldev:
5548         kfree(wldev);
5549         return err;
5550 }
5551
5552 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5553         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5554         (pdev->device == _device) &&                                    \
5555         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5556         (pdev->subsystem_device == _subdevice)                          )
5557
5558 #ifdef CONFIG_B43_SSB
5559 static void b43_sprom_fixup(struct ssb_bus *bus)
5560 {
5561         struct pci_dev *pdev;
5562
5563         /* boardflags workarounds */
5564         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5565             bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5566                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5567         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5568             bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5569                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5570         if (bus->bustype == SSB_BUSTYPE_PCI) {
5571                 pdev = bus->host_pci;
5572                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5573                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5574                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5575                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5576                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5577                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5578                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5579                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5580         }
5581 }
5582
5583 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5584 {
5585         struct ieee80211_hw *hw = wl->hw;
5586
5587         ssb_set_devtypedata(dev->sdev, NULL);
5588         ieee80211_free_hw(hw);
5589 }
5590 #endif
5591
5592 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5593 {
5594         struct ssb_sprom *sprom = dev->bus_sprom;
5595         struct ieee80211_hw *hw;
5596         struct b43_wl *wl;
5597         char chip_name[6];
5598         int queue_num;
5599
5600         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5601         if (!hw) {
5602                 b43err(NULL, "Could not allocate ieee80211 device\n");
5603                 return ERR_PTR(-ENOMEM);
5604         }
5605         wl = hw_to_b43_wl(hw);
5606
5607         /* fill hw info */
5608         ieee80211_hw_set(hw, RX_INCLUDES_FCS);
5609         ieee80211_hw_set(hw, SIGNAL_DBM);
5610         ieee80211_hw_set(hw, MFP_CAPABLE);
5611         hw->wiphy->interface_modes =
5612                 BIT(NL80211_IFTYPE_AP) |
5613                 BIT(NL80211_IFTYPE_MESH_POINT) |
5614                 BIT(NL80211_IFTYPE_STATION) |
5615                 BIT(NL80211_IFTYPE_WDS) |
5616                 BIT(NL80211_IFTYPE_ADHOC);
5617
5618         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5619
5620         wl->hw_registred = false;
5621         hw->max_rates = 2;
5622         SET_IEEE80211_DEV(hw, dev->dev);
5623         if (is_valid_ether_addr(sprom->et1mac))
5624                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5625         else
5626                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5627
5628         /* Initialize struct b43_wl */
5629         wl->hw = hw;
5630         mutex_init(&wl->mutex);
5631         spin_lock_init(&wl->hardirq_lock);
5632         spin_lock_init(&wl->beacon_lock);
5633         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5634         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5635         INIT_WORK(&wl->tx_work, b43_tx_work);
5636
5637         /* Initialize queues and flags. */
5638         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5639                 skb_queue_head_init(&wl->tx_queue[queue_num]);
5640                 wl->tx_queue_stopped[queue_num] = 0;
5641         }
5642
5643         snprintf(chip_name, ARRAY_SIZE(chip_name),
5644                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5645         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5646                 dev->core_rev);
5647         return wl;
5648 }
5649
5650 #ifdef CONFIG_B43_BCMA
5651 static int b43_bcma_probe(struct bcma_device *core)
5652 {
5653         struct b43_bus_dev *dev;
5654         struct b43_wl *wl;
5655         int err;
5656
5657         if (!modparam_allhwsupport &&
5658             (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5659                 pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5660                 return -ENOTSUPP;
5661         }
5662
5663         dev = b43_bus_dev_bcma_init(core);
5664         if (!dev)
5665                 return -ENODEV;
5666
5667         wl = b43_wireless_init(dev);
5668         if (IS_ERR(wl)) {
5669                 err = PTR_ERR(wl);
5670                 goto bcma_out;
5671         }
5672
5673         err = b43_one_core_attach(dev, wl);
5674         if (err)
5675                 goto bcma_err_wireless_exit;
5676
5677         /* setup and start work to load firmware */
5678         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5679         schedule_work(&wl->firmware_load);
5680
5681 bcma_out:
5682         return err;
5683
5684 bcma_err_wireless_exit:
5685         ieee80211_free_hw(wl->hw);
5686         return err;
5687 }
5688
5689 static void b43_bcma_remove(struct bcma_device *core)
5690 {
5691         struct b43_wldev *wldev = bcma_get_drvdata(core);
5692         struct b43_wl *wl = wldev->wl;
5693
5694         /* We must cancel any work here before unregistering from ieee80211,
5695          * as the ieee80211 unreg will destroy the workqueue. */
5696         cancel_work_sync(&wldev->restart_work);
5697         cancel_work_sync(&wl->firmware_load);
5698
5699         B43_WARN_ON(!wl);
5700         if (!wldev->fw.ucode.data)
5701                 return;                 /* NULL if firmware never loaded */
5702         if (wl->current_dev == wldev && wl->hw_registred) {
5703                 b43_leds_stop(wldev);
5704                 ieee80211_unregister_hw(wl->hw);
5705         }
5706
5707         b43_one_core_detach(wldev->dev);
5708
5709         /* Unregister HW RNG driver */
5710         b43_rng_exit(wl);
5711
5712         b43_leds_unregister(wl);
5713
5714         ieee80211_free_hw(wl->hw);
5715 }
5716
5717 static struct bcma_driver b43_bcma_driver = {
5718         .name           = KBUILD_MODNAME,
5719         .id_table       = b43_bcma_tbl,
5720         .probe          = b43_bcma_probe,
5721         .remove         = b43_bcma_remove,
5722 };
5723 #endif
5724
5725 #ifdef CONFIG_B43_SSB
5726 static
5727 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5728 {
5729         struct b43_bus_dev *dev;
5730         struct b43_wl *wl;
5731         int err;
5732
5733         dev = b43_bus_dev_ssb_init(sdev);
5734         if (!dev)
5735                 return -ENOMEM;
5736
5737         wl = ssb_get_devtypedata(sdev);
5738         if (wl) {
5739                 b43err(NULL, "Dual-core devices are not supported\n");
5740                 err = -ENOTSUPP;
5741                 goto err_ssb_kfree_dev;
5742         }
5743
5744         b43_sprom_fixup(sdev->bus);
5745
5746         wl = b43_wireless_init(dev);
5747         if (IS_ERR(wl)) {
5748                 err = PTR_ERR(wl);
5749                 goto err_ssb_kfree_dev;
5750         }
5751         ssb_set_devtypedata(sdev, wl);
5752         B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5753
5754         err = b43_one_core_attach(dev, wl);
5755         if (err)
5756                 goto err_ssb_wireless_exit;
5757
5758         /* setup and start work to load firmware */
5759         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5760         schedule_work(&wl->firmware_load);
5761
5762         return err;
5763
5764 err_ssb_wireless_exit:
5765         b43_wireless_exit(dev, wl);
5766 err_ssb_kfree_dev:
5767         kfree(dev);
5768         return err;
5769 }
5770
5771 static void b43_ssb_remove(struct ssb_device *sdev)
5772 {
5773         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5774         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5775         struct b43_bus_dev *dev = wldev->dev;
5776
5777         /* We must cancel any work here before unregistering from ieee80211,
5778          * as the ieee80211 unreg will destroy the workqueue. */
5779         cancel_work_sync(&wldev->restart_work);
5780         cancel_work_sync(&wl->firmware_load);
5781
5782         B43_WARN_ON(!wl);
5783         if (!wldev->fw.ucode.data)
5784                 return;                 /* NULL if firmware never loaded */
5785         if (wl->current_dev == wldev && wl->hw_registred) {
5786                 b43_leds_stop(wldev);
5787                 ieee80211_unregister_hw(wl->hw);
5788         }
5789
5790         b43_one_core_detach(dev);
5791
5792         /* Unregister HW RNG driver */
5793         b43_rng_exit(wl);
5794
5795         b43_leds_unregister(wl);
5796         b43_wireless_exit(dev, wl);
5797 }
5798
5799 static struct ssb_driver b43_ssb_driver = {
5800         .name           = KBUILD_MODNAME,
5801         .id_table       = b43_ssb_tbl,
5802         .probe          = b43_ssb_probe,
5803         .remove         = b43_ssb_remove,
5804 };
5805 #endif /* CONFIG_B43_SSB */
5806
5807 /* Perform a hardware reset. This can be called from any context. */
5808 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5809 {
5810         /* Must avoid requeueing, if we are in shutdown. */
5811         if (b43_status(dev) < B43_STAT_INITIALIZED)
5812                 return;
5813         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5814         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5815 }
5816
5817 static void b43_print_driverinfo(void)
5818 {
5819         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5820                    *feat_leds = "", *feat_sdio = "";
5821
5822 #ifdef CONFIG_B43_PCI_AUTOSELECT
5823         feat_pci = "P";
5824 #endif
5825 #ifdef CONFIG_B43_PCMCIA
5826         feat_pcmcia = "M";
5827 #endif
5828 #ifdef CONFIG_B43_PHY_N
5829         feat_nphy = "N";
5830 #endif
5831 #ifdef CONFIG_B43_LEDS
5832         feat_leds = "L";
5833 #endif
5834 #ifdef CONFIG_B43_SDIO
5835         feat_sdio = "S";
5836 #endif
5837         printk(KERN_INFO "Broadcom 43xx driver loaded "
5838                "[ Features: %s%s%s%s%s ]\n",
5839                feat_pci, feat_pcmcia, feat_nphy,
5840                feat_leds, feat_sdio);
5841 }
5842
5843 static int __init b43_init(void)
5844 {
5845         int err;
5846
5847         b43_debugfs_init();
5848         err = b43_sdio_init();
5849         if (err)
5850                 goto err_dfs_exit;
5851 #ifdef CONFIG_B43_BCMA
5852         err = bcma_driver_register(&b43_bcma_driver);
5853         if (err)
5854                 goto err_sdio_exit;
5855 #endif
5856 #ifdef CONFIG_B43_SSB
5857         err = ssb_driver_register(&b43_ssb_driver);
5858         if (err)
5859                 goto err_bcma_driver_exit;
5860 #endif
5861         b43_print_driverinfo();
5862
5863         return err;
5864
5865 #ifdef CONFIG_B43_SSB
5866 err_bcma_driver_exit:
5867 #endif
5868 #ifdef CONFIG_B43_BCMA
5869         bcma_driver_unregister(&b43_bcma_driver);
5870 err_sdio_exit:
5871 #endif
5872         b43_sdio_exit();
5873 err_dfs_exit:
5874         b43_debugfs_exit();
5875         return err;
5876 }
5877
5878 static void __exit b43_exit(void)
5879 {
5880 #ifdef CONFIG_B43_SSB
5881         ssb_driver_unregister(&b43_ssb_driver);
5882 #endif
5883 #ifdef CONFIG_B43_BCMA
5884         bcma_driver_unregister(&b43_bcma_driver);
5885 #endif
5886         b43_sdio_exit();
5887         b43_debugfs_exit();
5888 }
5889
5890 module_init(b43_init)
5891 module_exit(b43_exit)