linux/drivers/net/wireless/b43/main.c
<<
>>
Prefs
   1/*
   2
   3  Broadcom B43 wireless driver
   4
   5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7  Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10  Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
  11
  12  SDIO support
  13  Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  14
  15  Some parts of the code in this file are derived from the ipw2200
  16  driver  Copyright(c) 2003 - 2004 Intel Corporation.
  17
  18  This program is free software; you can redistribute it and/or modify
  19  it under the terms of the GNU General Public License as published by
  20  the Free Software Foundation; either version 2 of the License, or
  21  (at your option) any later version.
  22
  23  This program is distributed in the hope that it will be useful,
  24  but WITHOUT ANY WARRANTY; without even the implied warranty of
  25  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  26  GNU General Public License for more details.
  27
  28  You should have received a copy of the GNU General Public License
  29  along with this program; see the file COPYING.  If not, write to
  30  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  31  Boston, MA 02110-1301, USA.
  32
  33*/
  34
  35#include <linux/delay.h>
  36#include <linux/init.h>
  37#include <linux/module.h>
  38#include <linux/if_arp.h>
  39#include <linux/etherdevice.h>
  40#include <linux/firmware.h>
  41#include <linux/workqueue.h>
  42#include <linux/skbuff.h>
  43#include <linux/io.h>
  44#include <linux/dma-mapping.h>
  45#include <linux/slab.h>
  46#include <asm/unaligned.h>
  47
  48#include "b43.h"
  49#include "main.h"
  50#include "debugfs.h"
  51#include "phy_common.h"
  52#include "phy_g.h"
  53#include "phy_n.h"
  54#include "dma.h"
  55#include "pio.h"
  56#include "sysfs.h"
  57#include "xmit.h"
  58#include "lo.h"
  59#include "pcmcia.h"
  60#include "sdio.h"
  61#include <linux/mmc/sdio_func.h>
  62
  63MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64MODULE_AUTHOR("Martin Langer");
  65MODULE_AUTHOR("Stefano Brivio");
  66MODULE_AUTHOR("Michael Buesch");
  67MODULE_AUTHOR("Gábor Stefanik");
  68MODULE_AUTHOR("Rafał Miłecki");
  69MODULE_LICENSE("GPL");
  70
  71MODULE_FIRMWARE("b43/ucode11.fw");
  72MODULE_FIRMWARE("b43/ucode13.fw");
  73MODULE_FIRMWARE("b43/ucode14.fw");
  74MODULE_FIRMWARE("b43/ucode15.fw");
  75MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76MODULE_FIRMWARE("b43/ucode5.fw");
  77MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79static int modparam_bad_frames_preempt;
  80module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81MODULE_PARM_DESC(bad_frames_preempt,
  82                 "enable(1) / disable(0) Bad Frames Preemption");
  83
  84static char modparam_fwpostfix[16];
  85module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88static int modparam_hwpctl;
  89module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92static int modparam_nohwcrypt;
  93module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96static int modparam_hwtkip;
  97module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100static int modparam_qos = 1;
 101module_param_named(qos, modparam_qos, int, 0444);
 102MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104static int modparam_btcoex = 1;
 105module_param_named(btcoex, modparam_btcoex, int, 0444);
 106MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112static int b43_modparam_pio = 0;
 113module_param_named(pio, b43_modparam_pio, int, 0644);
 114MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
 117module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
 118MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
 119
 120#ifdef CONFIG_B43_BCMA
 121static const struct bcma_device_id b43_bcma_tbl[] = {
 122        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 123        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 124        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 125        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
 126        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 127        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
 128        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
 129        BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
 130        BCMA_CORETABLE_END
 131};
 132MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 133#endif
 134
 135#ifdef CONFIG_B43_SSB
 136static const struct ssb_device_id b43_ssb_tbl[] = {
 137        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 138        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 139        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 140        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 141        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 142        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 143        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 144        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 145        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 146        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 147        SSB_DEVTABLE_END
 148};
 149MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 150#endif
 151
 152/* Channel and ratetables are shared for all devices.
 153 * They can't be const, because ieee80211 puts some precalculated
 154 * data in there. This data is the same for all devices, so we don't
 155 * get concurrency issues */
 156#define RATETAB_ENT(_rateid, _flags) \
 157        {                                                               \
 158                .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 159                .hw_value       = (_rateid),                            \
 160                .flags          = (_flags),                             \
 161        }
 162
 163/*
 164 * NOTE: When changing this, sync with xmit.c's
 165 *       b43_plcp_get_bitrate_idx_* functions!
 166 */
 167static struct ieee80211_rate __b43_ratetable[] = {
 168        RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 169        RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 170        RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 171        RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 172        RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 173        RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 174        RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 175        RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 176        RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 177        RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 178        RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 179        RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 180};
 181
 182#define b43_a_ratetable         (__b43_ratetable + 4)
 183#define b43_a_ratetable_size    8
 184#define b43_b_ratetable         (__b43_ratetable + 0)
 185#define b43_b_ratetable_size    4
 186#define b43_g_ratetable         (__b43_ratetable + 0)
 187#define b43_g_ratetable_size    12
 188
 189#define CHAN2G(_channel, _freq, _flags) {                       \
 190        .band                   = IEEE80211_BAND_2GHZ,          \
 191        .center_freq            = (_freq),                      \
 192        .hw_value               = (_channel),                   \
 193        .flags                  = (_flags),                     \
 194        .max_antenna_gain       = 0,                            \
 195        .max_power              = 30,                           \
 196}
 197static struct ieee80211_channel b43_2ghz_chantable[] = {
 198        CHAN2G(1, 2412, 0),
 199        CHAN2G(2, 2417, 0),
 200        CHAN2G(3, 2422, 0),
 201        CHAN2G(4, 2427, 0),
 202        CHAN2G(5, 2432, 0),
 203        CHAN2G(6, 2437, 0),
 204        CHAN2G(7, 2442, 0),
 205        CHAN2G(8, 2447, 0),
 206        CHAN2G(9, 2452, 0),
 207        CHAN2G(10, 2457, 0),
 208        CHAN2G(11, 2462, 0),
 209        CHAN2G(12, 2467, 0),
 210        CHAN2G(13, 2472, 0),
 211        CHAN2G(14, 2484, 0),
 212};
 213
 214/* No support for the last 3 channels (12, 13, 14) */
 215#define b43_2ghz_chantable_limited_size         11
 216#undef CHAN2G
 217
 218#define CHAN4G(_channel, _flags) {                              \
 219        .band                   = IEEE80211_BAND_5GHZ,          \
 220        .center_freq            = 4000 + (5 * (_channel)),      \
 221        .hw_value               = (_channel),                   \
 222        .flags                  = (_flags),                     \
 223        .max_antenna_gain       = 0,                            \
 224        .max_power              = 30,                           \
 225}
 226#define CHAN5G(_channel, _flags) {                              \
 227        .band                   = IEEE80211_BAND_5GHZ,          \
 228        .center_freq            = 5000 + (5 * (_channel)),      \
 229        .hw_value               = (_channel),                   \
 230        .flags                  = (_flags),                     \
 231        .max_antenna_gain       = 0,                            \
 232        .max_power              = 30,                           \
 233}
 234static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 235        CHAN4G(184, 0),         CHAN4G(186, 0),
 236        CHAN4G(188, 0),         CHAN4G(190, 0),
 237        CHAN4G(192, 0),         CHAN4G(194, 0),
 238        CHAN4G(196, 0),         CHAN4G(198, 0),
 239        CHAN4G(200, 0),         CHAN4G(202, 0),
 240        CHAN4G(204, 0),         CHAN4G(206, 0),
 241        CHAN4G(208, 0),         CHAN4G(210, 0),
 242        CHAN4G(212, 0),         CHAN4G(214, 0),
 243        CHAN4G(216, 0),         CHAN4G(218, 0),
 244        CHAN4G(220, 0),         CHAN4G(222, 0),
 245        CHAN4G(224, 0),         CHAN4G(226, 0),
 246        CHAN4G(228, 0),
 247        CHAN5G(32, 0),          CHAN5G(34, 0),
 248        CHAN5G(36, 0),          CHAN5G(38, 0),
 249        CHAN5G(40, 0),          CHAN5G(42, 0),
 250        CHAN5G(44, 0),          CHAN5G(46, 0),
 251        CHAN5G(48, 0),          CHAN5G(50, 0),
 252        CHAN5G(52, 0),          CHAN5G(54, 0),
 253        CHAN5G(56, 0),          CHAN5G(58, 0),
 254        CHAN5G(60, 0),          CHAN5G(62, 0),
 255        CHAN5G(64, 0),          CHAN5G(66, 0),
 256        CHAN5G(68, 0),          CHAN5G(70, 0),
 257        CHAN5G(72, 0),          CHAN5G(74, 0),
 258        CHAN5G(76, 0),          CHAN5G(78, 0),
 259        CHAN5G(80, 0),          CHAN5G(82, 0),
 260        CHAN5G(84, 0),          CHAN5G(86, 0),
 261        CHAN5G(88, 0),          CHAN5G(90, 0),
 262        CHAN5G(92, 0),          CHAN5G(94, 0),
 263        CHAN5G(96, 0),          CHAN5G(98, 0),
 264        CHAN5G(100, 0),         CHAN5G(102, 0),
 265        CHAN5G(104, 0),         CHAN5G(106, 0),
 266        CHAN5G(108, 0),         CHAN5G(110, 0),
 267        CHAN5G(112, 0),         CHAN5G(114, 0),
 268        CHAN5G(116, 0),         CHAN5G(118, 0),
 269        CHAN5G(120, 0),         CHAN5G(122, 0),
 270        CHAN5G(124, 0),         CHAN5G(126, 0),
 271        CHAN5G(128, 0),         CHAN5G(130, 0),
 272        CHAN5G(132, 0),         CHAN5G(134, 0),
 273        CHAN5G(136, 0),         CHAN5G(138, 0),
 274        CHAN5G(140, 0),         CHAN5G(142, 0),
 275        CHAN5G(144, 0),         CHAN5G(145, 0),
 276        CHAN5G(146, 0),         CHAN5G(147, 0),
 277        CHAN5G(148, 0),         CHAN5G(149, 0),
 278        CHAN5G(150, 0),         CHAN5G(151, 0),
 279        CHAN5G(152, 0),         CHAN5G(153, 0),
 280        CHAN5G(154, 0),         CHAN5G(155, 0),
 281        CHAN5G(156, 0),         CHAN5G(157, 0),
 282        CHAN5G(158, 0),         CHAN5G(159, 0),
 283        CHAN5G(160, 0),         CHAN5G(161, 0),
 284        CHAN5G(162, 0),         CHAN5G(163, 0),
 285        CHAN5G(164, 0),         CHAN5G(165, 0),
 286        CHAN5G(166, 0),         CHAN5G(168, 0),
 287        CHAN5G(170, 0),         CHAN5G(172, 0),
 288        CHAN5G(174, 0),         CHAN5G(176, 0),
 289        CHAN5G(178, 0),         CHAN5G(180, 0),
 290        CHAN5G(182, 0),
 291};
 292
 293static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
 294        CHAN5G(36, 0),          CHAN5G(40, 0),
 295        CHAN5G(44, 0),          CHAN5G(48, 0),
 296        CHAN5G(149, 0),         CHAN5G(153, 0),
 297        CHAN5G(157, 0),         CHAN5G(161, 0),
 298        CHAN5G(165, 0),
 299};
 300
 301static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 302        CHAN5G(34, 0),          CHAN5G(36, 0),
 303        CHAN5G(38, 0),          CHAN5G(40, 0),
 304        CHAN5G(42, 0),          CHAN5G(44, 0),
 305        CHAN5G(46, 0),          CHAN5G(48, 0),
 306        CHAN5G(52, 0),          CHAN5G(56, 0),
 307        CHAN5G(60, 0),          CHAN5G(64, 0),
 308        CHAN5G(100, 0),         CHAN5G(104, 0),
 309        CHAN5G(108, 0),         CHAN5G(112, 0),
 310        CHAN5G(116, 0),         CHAN5G(120, 0),
 311        CHAN5G(124, 0),         CHAN5G(128, 0),
 312        CHAN5G(132, 0),         CHAN5G(136, 0),
 313        CHAN5G(140, 0),         CHAN5G(149, 0),
 314        CHAN5G(153, 0),         CHAN5G(157, 0),
 315        CHAN5G(161, 0),         CHAN5G(165, 0),
 316        CHAN5G(184, 0),         CHAN5G(188, 0),
 317        CHAN5G(192, 0),         CHAN5G(196, 0),
 318        CHAN5G(200, 0),         CHAN5G(204, 0),
 319        CHAN5G(208, 0),         CHAN5G(212, 0),
 320        CHAN5G(216, 0),
 321};
 322#undef CHAN4G
 323#undef CHAN5G
 324
 325static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 326        .band           = IEEE80211_BAND_5GHZ,
 327        .channels       = b43_5ghz_nphy_chantable,
 328        .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 329        .bitrates       = b43_a_ratetable,
 330        .n_bitrates     = b43_a_ratetable_size,
 331};
 332
 333static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
 334        .band           = IEEE80211_BAND_5GHZ,
 335        .channels       = b43_5ghz_nphy_chantable_limited,
 336        .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
 337        .bitrates       = b43_a_ratetable,
 338        .n_bitrates     = b43_a_ratetable_size,
 339};
 340
 341static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 342        .band           = IEEE80211_BAND_5GHZ,
 343        .channels       = b43_5ghz_aphy_chantable,
 344        .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 345        .bitrates       = b43_a_ratetable,
 346        .n_bitrates     = b43_a_ratetable_size,
 347};
 348
 349static struct ieee80211_supported_band b43_band_2GHz = {
 350        .band           = IEEE80211_BAND_2GHZ,
 351        .channels       = b43_2ghz_chantable,
 352        .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 353        .bitrates       = b43_g_ratetable,
 354        .n_bitrates     = b43_g_ratetable_size,
 355};
 356
 357static struct ieee80211_supported_band b43_band_2ghz_limited = {
 358        .band           = IEEE80211_BAND_2GHZ,
 359        .channels       = b43_2ghz_chantable,
 360        .n_channels     = b43_2ghz_chantable_limited_size,
 361        .bitrates       = b43_g_ratetable,
 362        .n_bitrates     = b43_g_ratetable_size,
 363};
 364
 365static void b43_wireless_core_exit(struct b43_wldev *dev);
 366static int b43_wireless_core_init(struct b43_wldev *dev);
 367static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 368static int b43_wireless_core_start(struct b43_wldev *dev);
 369static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 370                                    struct ieee80211_vif *vif,
 371                                    struct ieee80211_bss_conf *conf,
 372                                    u32 changed);
 373
 374static int b43_ratelimit(struct b43_wl *wl)
 375{
 376        if (!wl || !wl->current_dev)
 377                return 1;
 378        if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 379                return 1;
 380        /* We are up and running.
 381         * Ratelimit the messages to avoid DoS over the net. */
 382        return net_ratelimit();
 383}
 384
 385void b43info(struct b43_wl *wl, const char *fmt, ...)
 386{
 387        struct va_format vaf;
 388        va_list args;
 389
 390        if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 391                return;
 392        if (!b43_ratelimit(wl))
 393                return;
 394
 395        va_start(args, fmt);
 396
 397        vaf.fmt = fmt;
 398        vaf.va = &args;
 399
 400        printk(KERN_INFO "b43-%s: %pV",
 401               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 402
 403        va_end(args);
 404}
 405
 406void b43err(struct b43_wl *wl, const char *fmt, ...)
 407{
 408        struct va_format vaf;
 409        va_list args;
 410
 411        if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 412                return;
 413        if (!b43_ratelimit(wl))
 414                return;
 415
 416        va_start(args, fmt);
 417
 418        vaf.fmt = fmt;
 419        vaf.va = &args;
 420
 421        printk(KERN_ERR "b43-%s ERROR: %pV",
 422               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 423
 424        va_end(args);
 425}
 426
 427void b43warn(struct b43_wl *wl, const char *fmt, ...)
 428{
 429        struct va_format vaf;
 430        va_list args;
 431
 432        if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 433                return;
 434        if (!b43_ratelimit(wl))
 435                return;
 436
 437        va_start(args, fmt);
 438
 439        vaf.fmt = fmt;
 440        vaf.va = &args;
 441
 442        printk(KERN_WARNING "b43-%s warning: %pV",
 443               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 444
 445        va_end(args);
 446}
 447
 448void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 449{
 450        struct va_format vaf;
 451        va_list args;
 452
 453        if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 454                return;
 455
 456        va_start(args, fmt);
 457
 458        vaf.fmt = fmt;
 459        vaf.va = &args;
 460
 461        printk(KERN_DEBUG "b43-%s debug: %pV",
 462               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 463
 464        va_end(args);
 465}
 466
 467static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 468{
 469        u32 macctl;
 470
 471        B43_WARN_ON(offset % 4 != 0);
 472
 473        macctl = b43_read32(dev, B43_MMIO_MACCTL);
 474        if (macctl & B43_MACCTL_BE)
 475                val = swab32(val);
 476
 477        b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 478        mmiowb();
 479        b43_write32(dev, B43_MMIO_RAM_DATA, val);
 480}
 481
 482static inline void b43_shm_control_word(struct b43_wldev *dev,
 483                                        u16 routing, u16 offset)
 484{
 485        u32 control;
 486
 487        /* "offset" is the WORD offset. */
 488        control = routing;
 489        control <<= 16;
 490        control |= offset;
 491        b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 492}
 493
 494u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 495{
 496        u32 ret;
 497
 498        if (routing == B43_SHM_SHARED) {
 499                B43_WARN_ON(offset & 0x0001);
 500                if (offset & 0x0003) {
 501                        /* Unaligned access */
 502                        b43_shm_control_word(dev, routing, offset >> 2);
 503                        ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 504                        b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 505                        ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 506
 507                        goto out;
 508                }
 509                offset >>= 2;
 510        }
 511        b43_shm_control_word(dev, routing, offset);
 512        ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 513out:
 514        return ret;
 515}
 516
 517u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 518{
 519        u16 ret;
 520
 521        if (routing == B43_SHM_SHARED) {
 522                B43_WARN_ON(offset & 0x0001);
 523                if (offset & 0x0003) {
 524                        /* Unaligned access */
 525                        b43_shm_control_word(dev, routing, offset >> 2);
 526                        ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 527
 528                        goto out;
 529                }
 530                offset >>= 2;
 531        }
 532        b43_shm_control_word(dev, routing, offset);
 533        ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 534out:
 535        return ret;
 536}
 537
 538void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 539{
 540        if (routing == B43_SHM_SHARED) {
 541                B43_WARN_ON(offset & 0x0001);
 542                if (offset & 0x0003) {
 543                        /* Unaligned access */
 544                        b43_shm_control_word(dev, routing, offset >> 2);
 545                        b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 546                                    value & 0xFFFF);
 547                        b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 548                        b43_write16(dev, B43_MMIO_SHM_DATA,
 549                                    (value >> 16) & 0xFFFF);
 550                        return;
 551                }
 552                offset >>= 2;
 553        }
 554        b43_shm_control_word(dev, routing, offset);
 555        b43_write32(dev, B43_MMIO_SHM_DATA, value);
 556}
 557
 558void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 559{
 560        if (routing == B43_SHM_SHARED) {
 561                B43_WARN_ON(offset & 0x0001);
 562                if (offset & 0x0003) {
 563                        /* Unaligned access */
 564                        b43_shm_control_word(dev, routing, offset >> 2);
 565                        b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 566                        return;
 567                }
 568                offset >>= 2;
 569        }
 570        b43_shm_control_word(dev, routing, offset);
 571        b43_write16(dev, B43_MMIO_SHM_DATA, value);
 572}
 573
 574/* Read HostFlags */
 575u64 b43_hf_read(struct b43_wldev *dev)
 576{
 577        u64 ret;
 578
 579        ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
 580        ret <<= 16;
 581        ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
 582        ret <<= 16;
 583        ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
 584
 585        return ret;
 586}
 587
 588/* Write HostFlags */
 589void b43_hf_write(struct b43_wldev *dev, u64 value)
 590{
 591        u16 lo, mi, hi;
 592
 593        lo = (value & 0x00000000FFFFULL);
 594        mi = (value & 0x0000FFFF0000ULL) >> 16;
 595        hi = (value & 0xFFFF00000000ULL) >> 32;
 596        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
 597        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
 598        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
 599}
 600
 601/* Read the firmware capabilities bitmask (Opensource firmware only) */
 602static u16 b43_fwcapa_read(struct b43_wldev *dev)
 603{
 604        B43_WARN_ON(!dev->fw.opensource);
 605        return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 606}
 607
 608void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 609{
 610        u32 low, high;
 611
 612        B43_WARN_ON(dev->dev->core_rev < 3);
 613
 614        /* The hardware guarantees us an atomic read, if we
 615         * read the low register first. */
 616        low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 617        high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 618
 619        *tsf = high;
 620        *tsf <<= 32;
 621        *tsf |= low;
 622}
 623
 624static void b43_time_lock(struct b43_wldev *dev)
 625{
 626        b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
 627        /* Commit the write */
 628        b43_read32(dev, B43_MMIO_MACCTL);
 629}
 630
 631static void b43_time_unlock(struct b43_wldev *dev)
 632{
 633        b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
 634        /* Commit the write */
 635        b43_read32(dev, B43_MMIO_MACCTL);
 636}
 637
 638static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 639{
 640        u32 low, high;
 641
 642        B43_WARN_ON(dev->dev->core_rev < 3);
 643
 644        low = tsf;
 645        high = (tsf >> 32);
 646        /* The hardware guarantees us an atomic write, if we
 647         * write the low register first. */
 648        b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 649        mmiowb();
 650        b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 651        mmiowb();
 652}
 653
 654void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 655{
 656        b43_time_lock(dev);
 657        b43_tsf_write_locked(dev, tsf);
 658        b43_time_unlock(dev);
 659}
 660
 661static
 662void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 663{
 664        static const u8 zero_addr[ETH_ALEN] = { 0 };
 665        u16 data;
 666
 667        if (!mac)
 668                mac = zero_addr;
 669
 670        offset |= 0x0020;
 671        b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 672
 673        data = mac[0];
 674        data |= mac[1] << 8;
 675        b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 676        data = mac[2];
 677        data |= mac[3] << 8;
 678        b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 679        data = mac[4];
 680        data |= mac[5] << 8;
 681        b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 682}
 683
 684static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 685{
 686        const u8 *mac;
 687        const u8 *bssid;
 688        u8 mac_bssid[ETH_ALEN * 2];
 689        int i;
 690        u32 tmp;
 691
 692        bssid = dev->wl->bssid;
 693        mac = dev->wl->mac_addr;
 694
 695        b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 696
 697        memcpy(mac_bssid, mac, ETH_ALEN);
 698        memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 699
 700        /* Write our MAC address and BSSID to template ram */
 701        for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 702                tmp = (u32) (mac_bssid[i + 0]);
 703                tmp |= (u32) (mac_bssid[i + 1]) << 8;
 704                tmp |= (u32) (mac_bssid[i + 2]) << 16;
 705                tmp |= (u32) (mac_bssid[i + 3]) << 24;
 706                b43_ram_write(dev, 0x20 + i, tmp);
 707        }
 708}
 709
 710static void b43_upload_card_macaddress(struct b43_wldev *dev)
 711{
 712        b43_write_mac_bssid_templates(dev);
 713        b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 714}
 715
 716static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 717{
 718        /* slot_time is in usec. */
 719        /* This test used to exit for all but a G PHY. */
 720        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 721                return;
 722        b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 723        /* Shared memory location 0x0010 is the slot time and should be
 724         * set to slot_time; however, this register is initially 0 and changing
 725         * the value adversely affects the transmit rate for BCM4311
 726         * devices. Until this behavior is unterstood, delete this step
 727         *
 728         * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 729         */
 730}
 731
 732static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 733{
 734        b43_set_slot_time(dev, 9);
 735}
 736
 737static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 738{
 739        b43_set_slot_time(dev, 20);
 740}
 741
 742/* DummyTransmission function, as documented on
 743 * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 744 */
 745void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 746{
 747        struct b43_phy *phy = &dev->phy;
 748        unsigned int i, max_loop;
 749        u16 value;
 750        u32 buffer[5] = {
 751                0x00000000,
 752                0x00D40000,
 753                0x00000000,
 754                0x01000000,
 755                0x00000000,
 756        };
 757
 758        if (ofdm) {
 759                max_loop = 0x1E;
 760                buffer[0] = 0x000201CC;
 761        } else {
 762                max_loop = 0xFA;
 763                buffer[0] = 0x000B846E;
 764        }
 765
 766        for (i = 0; i < 5; i++)
 767                b43_ram_write(dev, i * 4, buffer[i]);
 768
 769        b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
 770
 771        if (dev->dev->core_rev < 11)
 772                b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
 773        else
 774                b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
 775
 776        value = (ofdm ? 0x41 : 0x40);
 777        b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
 778        if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
 779            phy->type == B43_PHYTYPE_LCN)
 780                b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
 781
 782        b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
 783        b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
 784
 785        b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
 786        b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
 787        b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
 788        b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
 789
 790        if (!pa_on && phy->type == B43_PHYTYPE_N)
 791                ; /*b43_nphy_pa_override(dev, false) */
 792
 793        switch (phy->type) {
 794        case B43_PHYTYPE_N:
 795        case B43_PHYTYPE_LCN:
 796                b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
 797                break;
 798        case B43_PHYTYPE_LP:
 799                b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
 800                break;
 801        default:
 802                b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
 803        }
 804        b43_read16(dev, B43_MMIO_TXE0_AUX);
 805
 806        if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 807                b43_radio_write16(dev, 0x0051, 0x0017);
 808        for (i = 0x00; i < max_loop; i++) {
 809                value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 810                if (value & 0x0080)
 811                        break;
 812                udelay(10);
 813        }
 814        for (i = 0x00; i < 0x0A; i++) {
 815                value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 816                if (value & 0x0400)
 817                        break;
 818                udelay(10);
 819        }
 820        for (i = 0x00; i < 0x19; i++) {
 821                value = b43_read16(dev, B43_MMIO_IFSSTAT);
 822                if (!(value & 0x0100))
 823                        break;
 824                udelay(10);
 825        }
 826        if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 827                b43_radio_write16(dev, 0x0051, 0x0037);
 828}
 829
 830static void key_write(struct b43_wldev *dev,
 831                      u8 index, u8 algorithm, const u8 *key)
 832{
 833        unsigned int i;
 834        u32 offset;
 835        u16 value;
 836        u16 kidx;
 837
 838        /* Key index/algo block */
 839        kidx = b43_kidx_to_fw(dev, index);
 840        value = ((kidx << 4) | algorithm);
 841        b43_shm_write16(dev, B43_SHM_SHARED,
 842                        B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 843
 844        /* Write the key to the Key Table Pointer offset */
 845        offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 846        for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 847                value = key[i];
 848                value |= (u16) (key[i + 1]) << 8;
 849                b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 850        }
 851}
 852
 853static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 854{
 855        u32 addrtmp[2] = { 0, 0, };
 856        u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 857
 858        if (b43_new_kidx_api(dev))
 859                pairwise_keys_start = B43_NR_GROUP_KEYS;
 860
 861        B43_WARN_ON(index < pairwise_keys_start);
 862        /* We have four default TX keys and possibly four default RX keys.
 863         * Physical mac 0 is mapped to physical key 4 or 8, depending
 864         * on the firmware version.
 865         * So we must adjust the index here.
 866         */
 867        index -= pairwise_keys_start;
 868        B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 869
 870        if (addr) {
 871                addrtmp[0] = addr[0];
 872                addrtmp[0] |= ((u32) (addr[1]) << 8);
 873                addrtmp[0] |= ((u32) (addr[2]) << 16);
 874                addrtmp[0] |= ((u32) (addr[3]) << 24);
 875                addrtmp[1] = addr[4];
 876                addrtmp[1] |= ((u32) (addr[5]) << 8);
 877        }
 878
 879        /* Receive match transmitter address (RCMTA) mechanism */
 880        b43_shm_write32(dev, B43_SHM_RCMTA,
 881                        (index * 2) + 0, addrtmp[0]);
 882        b43_shm_write16(dev, B43_SHM_RCMTA,
 883                        (index * 2) + 1, addrtmp[1]);
 884}
 885
 886/* The ucode will use phase1 key with TEK key to decrypt rx packets.
 887 * When a packet is received, the iv32 is checked.
 888 * - if it doesn't the packet is returned without modification (and software
 889 *   decryption can be done). That's what happen when iv16 wrap.
 890 * - if it does, the rc4 key is computed, and decryption is tried.
 891 *   Either it will success and B43_RX_MAC_DEC is returned,
 892 *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 893 *   and the packet is not usable (it got modified by the ucode).
 894 * So in order to never have B43_RX_MAC_DECERR, we should provide
 895 * a iv32 and phase1key that match. Because we drop packets in case of
 896 * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 897 * packets will be lost without higher layer knowing (ie no resync possible
 898 * until next wrap).
 899 *
 900 * NOTE : this should support 50 key like RCMTA because
 901 * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 902 */
 903static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 904                u16 *phase1key)
 905{
 906        unsigned int i;
 907        u32 offset;
 908        u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 909
 910        if (!modparam_hwtkip)
 911                return;
 912
 913        if (b43_new_kidx_api(dev))
 914                pairwise_keys_start = B43_NR_GROUP_KEYS;
 915
 916        B43_WARN_ON(index < pairwise_keys_start);
 917        /* We have four default TX keys and possibly four default RX keys.
 918         * Physical mac 0 is mapped to physical key 4 or 8, depending
 919         * on the firmware version.
 920         * So we must adjust the index here.
 921         */
 922        index -= pairwise_keys_start;
 923        B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 924
 925        if (b43_debug(dev, B43_DBG_KEYS)) {
 926                b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 927                                index, iv32);
 928        }
 929        /* Write the key to the  RX tkip shared mem */
 930        offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 931        for (i = 0; i < 10; i += 2) {
 932                b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 933                                phase1key ? phase1key[i / 2] : 0);
 934        }
 935        b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 936        b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 937}
 938
 939static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 940                                   struct ieee80211_vif *vif,
 941                                   struct ieee80211_key_conf *keyconf,
 942                                   struct ieee80211_sta *sta,
 943                                   u32 iv32, u16 *phase1key)
 944{
 945        struct b43_wl *wl = hw_to_b43_wl(hw);
 946        struct b43_wldev *dev;
 947        int index = keyconf->hw_key_idx;
 948
 949        if (B43_WARN_ON(!modparam_hwtkip))
 950                return;
 951
 952        /* This is only called from the RX path through mac80211, where
 953         * our mutex is already locked. */
 954        B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 955        dev = wl->current_dev;
 956        B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 957
 958        keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 959
 960        rx_tkip_phase1_write(dev, index, iv32, phase1key);
 961        /* only pairwise TKIP keys are supported right now */
 962        if (WARN_ON(!sta))
 963                return;
 964        keymac_write(dev, index, sta->addr);
 965}
 966
 967static void do_key_write(struct b43_wldev *dev,
 968                         u8 index, u8 algorithm,
 969                         const u8 *key, size_t key_len, const u8 *mac_addr)
 970{
 971        u8 buf[B43_SEC_KEYSIZE] = { 0, };
 972        u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 973
 974        if (b43_new_kidx_api(dev))
 975                pairwise_keys_start = B43_NR_GROUP_KEYS;
 976
 977        B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 978        B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 979
 980        if (index >= pairwise_keys_start)
 981                keymac_write(dev, index, NULL); /* First zero out mac. */
 982        if (algorithm == B43_SEC_ALGO_TKIP) {
 983                /*
 984                 * We should provide an initial iv32, phase1key pair.
 985                 * We could start with iv32=0 and compute the corresponding
 986                 * phase1key, but this means calling ieee80211_get_tkip_key
 987                 * with a fake skb (or export other tkip function).
 988                 * Because we are lazy we hope iv32 won't start with
 989                 * 0xffffffff and let's b43_op_update_tkip_key provide a
 990                 * correct pair.
 991                 */
 992                rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 993        } else if (index >= pairwise_keys_start) /* clear it */
 994                rx_tkip_phase1_write(dev, index, 0, NULL);
 995        if (key)
 996                memcpy(buf, key, key_len);
 997        key_write(dev, index, algorithm, buf);
 998        if (index >= pairwise_keys_start)
 999                keymac_write(dev, index, mac_addr);
1000
1001        dev->key[index].algorithm = algorithm;
1002}
1003
1004static int b43_key_write(struct b43_wldev *dev,
1005                         int index, u8 algorithm,
1006                         const u8 *key, size_t key_len,
1007                         const u8 *mac_addr,
1008                         struct ieee80211_key_conf *keyconf)
1009{
1010        int i;
1011        int pairwise_keys_start;
1012
1013        /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1014         *      - Temporal Encryption Key (128 bits)
1015         *      - Temporal Authenticator Tx MIC Key (64 bits)
1016         *      - Temporal Authenticator Rx MIC Key (64 bits)
1017         *
1018         *      Hardware only store TEK
1019         */
1020        if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1021                key_len = 16;
1022        if (key_len > B43_SEC_KEYSIZE)
1023                return -EINVAL;
1024        for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1025                /* Check that we don't already have this key. */
1026                B43_WARN_ON(dev->key[i].keyconf == keyconf);
1027        }
1028        if (index < 0) {
1029                /* Pairwise key. Get an empty slot for the key. */
1030                if (b43_new_kidx_api(dev))
1031                        pairwise_keys_start = B43_NR_GROUP_KEYS;
1032                else
1033                        pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1034                for (i = pairwise_keys_start;
1035                     i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1036                     i++) {
1037                        B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1038                        if (!dev->key[i].keyconf) {
1039                                /* found empty */
1040                                index = i;
1041                                break;
1042                        }
1043                }
1044                if (index < 0) {
1045                        b43warn(dev->wl, "Out of hardware key memory\n");
1046                        return -ENOSPC;
1047                }
1048        } else
1049                B43_WARN_ON(index > 3);
1050
1051        do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1052        if ((index <= 3) && !b43_new_kidx_api(dev)) {
1053                /* Default RX key */
1054                B43_WARN_ON(mac_addr);
1055                do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1056        }
1057        keyconf->hw_key_idx = index;
1058        dev->key[index].keyconf = keyconf;
1059
1060        return 0;
1061}
1062
1063static int b43_key_clear(struct b43_wldev *dev, int index)
1064{
1065        if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1066                return -EINVAL;
1067        do_key_write(dev, index, B43_SEC_ALGO_NONE,
1068                     NULL, B43_SEC_KEYSIZE, NULL);
1069        if ((index <= 3) && !b43_new_kidx_api(dev)) {
1070                do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1071                             NULL, B43_SEC_KEYSIZE, NULL);
1072        }
1073        dev->key[index].keyconf = NULL;
1074
1075        return 0;
1076}
1077
1078static void b43_clear_keys(struct b43_wldev *dev)
1079{
1080        int i, count;
1081
1082        if (b43_new_kidx_api(dev))
1083                count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1084        else
1085                count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1086        for (i = 0; i < count; i++)
1087                b43_key_clear(dev, i);
1088}
1089
1090static void b43_dump_keymemory(struct b43_wldev *dev)
1091{
1092        unsigned int i, index, count, offset, pairwise_keys_start;
1093        u8 mac[ETH_ALEN];
1094        u16 algo;
1095        u32 rcmta0;
1096        u16 rcmta1;
1097        u64 hf;
1098        struct b43_key *key;
1099
1100        if (!b43_debug(dev, B43_DBG_KEYS))
1101                return;
1102
1103        hf = b43_hf_read(dev);
1104        b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1105               !!(hf & B43_HF_USEDEFKEYS));
1106        if (b43_new_kidx_api(dev)) {
1107                pairwise_keys_start = B43_NR_GROUP_KEYS;
1108                count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1109        } else {
1110                pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1111                count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1112        }
1113        for (index = 0; index < count; index++) {
1114                key = &(dev->key[index]);
1115                printk(KERN_DEBUG "Key slot %02u: %s",
1116                       index, (key->keyconf == NULL) ? " " : "*");
1117                offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1118                for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1119                        u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1120                        printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1121                }
1122
1123                algo = b43_shm_read16(dev, B43_SHM_SHARED,
1124                                      B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1125                printk("   Algo: %04X/%02X", algo, key->algorithm);
1126
1127                if (index >= pairwise_keys_start) {
1128                        if (key->algorithm == B43_SEC_ALGO_TKIP) {
1129                                printk("   TKIP: ");
1130                                offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1131                                for (i = 0; i < 14; i += 2) {
1132                                        u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1133                                        printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1134                                }
1135                        }
1136                        rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1137                                                ((index - pairwise_keys_start) * 2) + 0);
1138                        rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1139                                                ((index - pairwise_keys_start) * 2) + 1);
1140                        *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1141                        *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1142                        printk("   MAC: %pM", mac);
1143                } else
1144                        printk("   DEFAULT KEY");
1145                printk("\n");
1146        }
1147}
1148
1149void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1150{
1151        u32 macctl;
1152        u16 ucstat;
1153        bool hwps;
1154        bool awake;
1155        int i;
1156
1157        B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1158                    (ps_flags & B43_PS_DISABLED));
1159        B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1160
1161        if (ps_flags & B43_PS_ENABLED) {
1162                hwps = true;
1163        } else if (ps_flags & B43_PS_DISABLED) {
1164                hwps = false;
1165        } else {
1166                //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1167                //      and thus is not an AP and we are associated, set bit 25
1168        }
1169        if (ps_flags & B43_PS_AWAKE) {
1170                awake = true;
1171        } else if (ps_flags & B43_PS_ASLEEP) {
1172                awake = false;
1173        } else {
1174                //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1175                //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1176                //      successful, set bit26
1177        }
1178
1179/* FIXME: For now we force awake-on and hwps-off */
1180        hwps = false;
1181        awake = true;
1182
1183        macctl = b43_read32(dev, B43_MMIO_MACCTL);
1184        if (hwps)
1185                macctl |= B43_MACCTL_HWPS;
1186        else
1187                macctl &= ~B43_MACCTL_HWPS;
1188        if (awake)
1189                macctl |= B43_MACCTL_AWAKE;
1190        else
1191                macctl &= ~B43_MACCTL_AWAKE;
1192        b43_write32(dev, B43_MMIO_MACCTL, macctl);
1193        /* Commit write */
1194        b43_read32(dev, B43_MMIO_MACCTL);
1195        if (awake && dev->dev->core_rev >= 5) {
1196                /* Wait for the microcode to wake up. */
1197                for (i = 0; i < 100; i++) {
1198                        ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1199                                                B43_SHM_SH_UCODESTAT);
1200                        if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1201                                break;
1202                        udelay(10);
1203                }
1204        }
1205}
1206
1207/* http://bcm-v4.sipsolutions.net/802.11/PHY/BmacCorePllReset */
1208void b43_wireless_core_phy_pll_reset(struct b43_wldev *dev)
1209{
1210        struct bcma_drv_cc *bcma_cc __maybe_unused;
1211        struct ssb_chipcommon *ssb_cc __maybe_unused;
1212
1213        switch (dev->dev->bus_type) {
1214#ifdef CONFIG_B43_BCMA
1215        case B43_BUS_BCMA:
1216                bcma_cc = &dev->dev->bdev->bus->drv_cc;
1217
1218                bcma_cc_write32(bcma_cc, BCMA_CC_CHIPCTL_ADDR, 0);
1219                bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
1220                bcma_cc_set32(bcma_cc, BCMA_CC_CHIPCTL_DATA, 0x4);
1221                bcma_cc_mask32(bcma_cc, BCMA_CC_CHIPCTL_DATA, ~0x4);
1222                break;
1223#endif
1224#ifdef CONFIG_B43_SSB
1225        case B43_BUS_SSB:
1226                ssb_cc = &dev->dev->sdev->bus->chipco;
1227
1228                chipco_write32(ssb_cc, SSB_CHIPCO_CHIPCTL_ADDR, 0);
1229                chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1230                chipco_set32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, 0x4);
1231                chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1232                break;
1233#endif
1234        }
1235}
1236
1237#ifdef CONFIG_B43_BCMA
1238static void b43_bcma_phy_reset(struct b43_wldev *dev)
1239{
1240        u32 flags;
1241
1242        /* Put PHY into reset */
1243        flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1244        flags |= B43_BCMA_IOCTL_PHY_RESET;
1245        flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1246        bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1247        udelay(2);
1248
1249        b43_phy_take_out_of_reset(dev);
1250}
1251
1252static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1253{
1254        u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1255                  B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1256        u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1257                     B43_BCMA_CLKCTLST_PHY_PLL_ST;
1258        u32 flags;
1259
1260        flags = B43_BCMA_IOCTL_PHY_CLKEN;
1261        if (gmode)
1262                flags |= B43_BCMA_IOCTL_GMODE;
1263        b43_device_enable(dev, flags);
1264
1265        bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1266        b43_bcma_phy_reset(dev);
1267        bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1268}
1269#endif
1270
1271#ifdef CONFIG_B43_SSB
1272static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1273{
1274        u32 flags = 0;
1275
1276        if (gmode)
1277                flags |= B43_TMSLOW_GMODE;
1278        flags |= B43_TMSLOW_PHYCLKEN;
1279        flags |= B43_TMSLOW_PHYRESET;
1280        if (dev->phy.type == B43_PHYTYPE_N)
1281                flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1282        b43_device_enable(dev, flags);
1283        msleep(2);              /* Wait for the PLL to turn on. */
1284
1285        b43_phy_take_out_of_reset(dev);
1286}
1287#endif
1288
1289void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1290{
1291        u32 macctl;
1292
1293        switch (dev->dev->bus_type) {
1294#ifdef CONFIG_B43_BCMA
1295        case B43_BUS_BCMA:
1296                b43_bcma_wireless_core_reset(dev, gmode);
1297                break;
1298#endif
1299#ifdef CONFIG_B43_SSB
1300        case B43_BUS_SSB:
1301                b43_ssb_wireless_core_reset(dev, gmode);
1302                break;
1303#endif
1304        }
1305
1306        /* Turn Analog ON, but only if we already know the PHY-type.
1307         * This protects against very early setup where we don't know the
1308         * PHY-type, yet. wireless_core_reset will be called once again later,
1309         * when we know the PHY-type. */
1310        if (dev->phy.ops)
1311                dev->phy.ops->switch_analog(dev, 1);
1312
1313        macctl = b43_read32(dev, B43_MMIO_MACCTL);
1314        macctl &= ~B43_MACCTL_GMODE;
1315        if (gmode)
1316                macctl |= B43_MACCTL_GMODE;
1317        macctl |= B43_MACCTL_IHR_ENABLED;
1318        b43_write32(dev, B43_MMIO_MACCTL, macctl);
1319}
1320
1321static void handle_irq_transmit_status(struct b43_wldev *dev)
1322{
1323        u32 v0, v1;
1324        u16 tmp;
1325        struct b43_txstatus stat;
1326
1327        while (1) {
1328                v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1329                if (!(v0 & 0x00000001))
1330                        break;
1331                v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1332
1333                stat.cookie = (v0 >> 16);
1334                stat.seq = (v1 & 0x0000FFFF);
1335                stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1336                tmp = (v0 & 0x0000FFFF);
1337                stat.frame_count = ((tmp & 0xF000) >> 12);
1338                stat.rts_count = ((tmp & 0x0F00) >> 8);
1339                stat.supp_reason = ((tmp & 0x001C) >> 2);
1340                stat.pm_indicated = !!(tmp & 0x0080);
1341                stat.intermediate = !!(tmp & 0x0040);
1342                stat.for_ampdu = !!(tmp & 0x0020);
1343                stat.acked = !!(tmp & 0x0002);
1344
1345                b43_handle_txstatus(dev, &stat);
1346        }
1347}
1348
1349static void drain_txstatus_queue(struct b43_wldev *dev)
1350{
1351        u32 dummy;
1352
1353        if (dev->dev->core_rev < 5)
1354                return;
1355        /* Read all entries from the microcode TXstatus FIFO
1356         * and throw them away.
1357         */
1358        while (1) {
1359                dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1360                if (!(dummy & 0x00000001))
1361                        break;
1362                dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1363        }
1364}
1365
1366static u32 b43_jssi_read(struct b43_wldev *dev)
1367{
1368        u32 val = 0;
1369
1370        val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1371        val <<= 16;
1372        val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1373
1374        return val;
1375}
1376
1377static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1378{
1379        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1380                        (jssi & 0x0000FFFF));
1381        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1382                        (jssi & 0xFFFF0000) >> 16);
1383}
1384
1385static void b43_generate_noise_sample(struct b43_wldev *dev)
1386{
1387        b43_jssi_write(dev, 0x7F7F7F7F);
1388        b43_write32(dev, B43_MMIO_MACCMD,
1389                    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1390}
1391
1392static void b43_calculate_link_quality(struct b43_wldev *dev)
1393{
1394        /* Top half of Link Quality calculation. */
1395
1396        if (dev->phy.type != B43_PHYTYPE_G)
1397                return;
1398        if (dev->noisecalc.calculation_running)
1399                return;
1400        dev->noisecalc.calculation_running = true;
1401        dev->noisecalc.nr_samples = 0;
1402
1403        b43_generate_noise_sample(dev);
1404}
1405
1406static void handle_irq_noise(struct b43_wldev *dev)
1407{
1408        struct b43_phy_g *phy = dev->phy.g;
1409        u16 tmp;
1410        u8 noise[4];
1411        u8 i, j;
1412        s32 average;
1413
1414        /* Bottom half of Link Quality calculation. */
1415
1416        if (dev->phy.type != B43_PHYTYPE_G)
1417                return;
1418
1419        /* Possible race condition: It might be possible that the user
1420         * changed to a different channel in the meantime since we
1421         * started the calculation. We ignore that fact, since it's
1422         * not really that much of a problem. The background noise is
1423         * an estimation only anyway. Slightly wrong results will get damped
1424         * by the averaging of the 8 sample rounds. Additionally the
1425         * value is shortlived. So it will be replaced by the next noise
1426         * calculation round soon. */
1427
1428        B43_WARN_ON(!dev->noisecalc.calculation_running);
1429        *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1430        if (noise[0] == 0x7F || noise[1] == 0x7F ||
1431            noise[2] == 0x7F || noise[3] == 0x7F)
1432                goto generate_new;
1433
1434        /* Get the noise samples. */
1435        B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1436        i = dev->noisecalc.nr_samples;
1437        noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1438        noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1439        noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1440        noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1441        dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1442        dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1443        dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1444        dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1445        dev->noisecalc.nr_samples++;
1446        if (dev->noisecalc.nr_samples == 8) {
1447                /* Calculate the Link Quality by the noise samples. */
1448                average = 0;
1449                for (i = 0; i < 8; i++) {
1450                        for (j = 0; j < 4; j++)
1451                                average += dev->noisecalc.samples[i][j];
1452                }
1453                average /= (8 * 4);
1454                average *= 125;
1455                average += 64;
1456                average /= 128;
1457                tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1458                tmp = (tmp / 128) & 0x1F;
1459                if (tmp >= 8)
1460                        average += 2;
1461                else
1462                        average -= 25;
1463                if (tmp == 8)
1464                        average -= 72;
1465                else
1466                        average -= 48;
1467
1468                dev->stats.link_noise = average;
1469                dev->noisecalc.calculation_running = false;
1470                return;
1471        }
1472generate_new:
1473        b43_generate_noise_sample(dev);
1474}
1475
1476static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1477{
1478        if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1479                ///TODO: PS TBTT
1480        } else {
1481                if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1482                        b43_power_saving_ctl_bits(dev, 0);
1483        }
1484        if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1485                dev->dfq_valid = true;
1486}
1487
1488static void handle_irq_atim_end(struct b43_wldev *dev)
1489{
1490        if (dev->dfq_valid) {
1491                b43_write32(dev, B43_MMIO_MACCMD,
1492                            b43_read32(dev, B43_MMIO_MACCMD)
1493                            | B43_MACCMD_DFQ_VALID);
1494                dev->dfq_valid = false;
1495        }
1496}
1497
1498static void handle_irq_pmq(struct b43_wldev *dev)
1499{
1500        u32 tmp;
1501
1502        //TODO: AP mode.
1503
1504        while (1) {
1505                tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1506                if (!(tmp & 0x00000008))
1507                        break;
1508        }
1509        /* 16bit write is odd, but correct. */
1510        b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1511}
1512
1513static void b43_write_template_common(struct b43_wldev *dev,
1514                                      const u8 *data, u16 size,
1515                                      u16 ram_offset,
1516                                      u16 shm_size_offset, u8 rate)
1517{
1518        u32 i, tmp;
1519        struct b43_plcp_hdr4 plcp;
1520
1521        plcp.data = 0;
1522        b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1523        b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1524        ram_offset += sizeof(u32);
1525        /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1526         * So leave the first two bytes of the next write blank.
1527         */
1528        tmp = (u32) (data[0]) << 16;
1529        tmp |= (u32) (data[1]) << 24;
1530        b43_ram_write(dev, ram_offset, tmp);
1531        ram_offset += sizeof(u32);
1532        for (i = 2; i < size; i += sizeof(u32)) {
1533                tmp = (u32) (data[i + 0]);
1534                if (i + 1 < size)
1535                        tmp |= (u32) (data[i + 1]) << 8;
1536                if (i + 2 < size)
1537                        tmp |= (u32) (data[i + 2]) << 16;
1538                if (i + 3 < size)
1539                        tmp |= (u32) (data[i + 3]) << 24;
1540                b43_ram_write(dev, ram_offset + i - 2, tmp);
1541        }
1542        b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1543                        size + sizeof(struct b43_plcp_hdr6));
1544}
1545
1546/* Check if the use of the antenna that ieee80211 told us to
1547 * use is possible. This will fall back to DEFAULT.
1548 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1549u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1550                                  u8 antenna_nr)
1551{
1552        u8 antenna_mask;
1553
1554        if (antenna_nr == 0) {
1555                /* Zero means "use default antenna". That's always OK. */
1556                return 0;
1557        }
1558
1559        /* Get the mask of available antennas. */
1560        if (dev->phy.gmode)
1561                antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1562        else
1563                antenna_mask = dev->dev->bus_sprom->ant_available_a;
1564
1565        if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1566                /* This antenna is not available. Fall back to default. */
1567                return 0;
1568        }
1569
1570        return antenna_nr;
1571}
1572
1573/* Convert a b43 antenna number value to the PHY TX control value. */
1574static u16 b43_antenna_to_phyctl(int antenna)
1575{
1576        switch (antenna) {
1577        case B43_ANTENNA0:
1578                return B43_TXH_PHY_ANT0;
1579        case B43_ANTENNA1:
1580                return B43_TXH_PHY_ANT1;
1581        case B43_ANTENNA2:
1582                return B43_TXH_PHY_ANT2;
1583        case B43_ANTENNA3:
1584                return B43_TXH_PHY_ANT3;
1585        case B43_ANTENNA_AUTO0:
1586        case B43_ANTENNA_AUTO1:
1587                return B43_TXH_PHY_ANT01AUTO;
1588        }
1589        B43_WARN_ON(1);
1590        return 0;
1591}
1592
1593static void b43_write_beacon_template(struct b43_wldev *dev,
1594                                      u16 ram_offset,
1595                                      u16 shm_size_offset)
1596{
1597        unsigned int i, len, variable_len;
1598        const struct ieee80211_mgmt *bcn;
1599        const u8 *ie;
1600        bool tim_found = false;
1601        unsigned int rate;
1602        u16 ctl;
1603        int antenna;
1604        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1605
1606        bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1607        len = min_t(size_t, dev->wl->current_beacon->len,
1608                  0x200 - sizeof(struct b43_plcp_hdr6));
1609        rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1610
1611        b43_write_template_common(dev, (const u8 *)bcn,
1612                                  len, ram_offset, shm_size_offset, rate);
1613
1614        /* Write the PHY TX control parameters. */
1615        antenna = B43_ANTENNA_DEFAULT;
1616        antenna = b43_antenna_to_phyctl(antenna);
1617        ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1618        /* We can't send beacons with short preamble. Would get PHY errors. */
1619        ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1620        ctl &= ~B43_TXH_PHY_ANT;
1621        ctl &= ~B43_TXH_PHY_ENC;
1622        ctl |= antenna;
1623        if (b43_is_cck_rate(rate))
1624                ctl |= B43_TXH_PHY_ENC_CCK;
1625        else
1626                ctl |= B43_TXH_PHY_ENC_OFDM;
1627        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1628
1629        /* Find the position of the TIM and the DTIM_period value
1630         * and write them to SHM. */
1631        ie = bcn->u.beacon.variable;
1632        variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1633        for (i = 0; i < variable_len - 2; ) {
1634                uint8_t ie_id, ie_len;
1635
1636                ie_id = ie[i];
1637                ie_len = ie[i + 1];
1638                if (ie_id == 5) {
1639                        u16 tim_position;
1640                        u16 dtim_period;
1641                        /* This is the TIM Information Element */
1642
1643                        /* Check whether the ie_len is in the beacon data range. */
1644                        if (variable_len < ie_len + 2 + i)
1645                                break;
1646                        /* A valid TIM is at least 4 bytes long. */
1647                        if (ie_len < 4)
1648                                break;
1649                        tim_found = true;
1650
1651                        tim_position = sizeof(struct b43_plcp_hdr6);
1652                        tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1653                        tim_position += i;
1654
1655                        dtim_period = ie[i + 3];
1656
1657                        b43_shm_write16(dev, B43_SHM_SHARED,
1658                                        B43_SHM_SH_TIMBPOS, tim_position);
1659                        b43_shm_write16(dev, B43_SHM_SHARED,
1660                                        B43_SHM_SH_DTIMPER, dtim_period);
1661                        break;
1662                }
1663                i += ie_len + 2;
1664        }
1665        if (!tim_found) {
1666                /*
1667                 * If ucode wants to modify TIM do it behind the beacon, this
1668                 * will happen, for example, when doing mesh networking.
1669                 */
1670                b43_shm_write16(dev, B43_SHM_SHARED,
1671                                B43_SHM_SH_TIMBPOS,
1672                                len + sizeof(struct b43_plcp_hdr6));
1673                b43_shm_write16(dev, B43_SHM_SHARED,
1674                                B43_SHM_SH_DTIMPER, 0);
1675        }
1676        b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1677}
1678
1679static void b43_upload_beacon0(struct b43_wldev *dev)
1680{
1681        struct b43_wl *wl = dev->wl;
1682
1683        if (wl->beacon0_uploaded)
1684                return;
1685        b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1686        wl->beacon0_uploaded = true;
1687}
1688
1689static void b43_upload_beacon1(struct b43_wldev *dev)
1690{
1691        struct b43_wl *wl = dev->wl;
1692
1693        if (wl->beacon1_uploaded)
1694                return;
1695        b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1696        wl->beacon1_uploaded = true;
1697}
1698
1699static void handle_irq_beacon(struct b43_wldev *dev)
1700{
1701        struct b43_wl *wl = dev->wl;
1702        u32 cmd, beacon0_valid, beacon1_valid;
1703
1704        if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1705            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1706            !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1707                return;
1708
1709        /* This is the bottom half of the asynchronous beacon update. */
1710
1711        /* Ignore interrupt in the future. */
1712        dev->irq_mask &= ~B43_IRQ_BEACON;
1713
1714        cmd = b43_read32(dev, B43_MMIO_MACCMD);
1715        beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1716        beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1717
1718        /* Schedule interrupt manually, if busy. */
1719        if (beacon0_valid && beacon1_valid) {
1720                b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1721                dev->irq_mask |= B43_IRQ_BEACON;
1722                return;
1723        }
1724
1725        if (unlikely(wl->beacon_templates_virgin)) {
1726                /* We never uploaded a beacon before.
1727                 * Upload both templates now, but only mark one valid. */
1728                wl->beacon_templates_virgin = false;
1729                b43_upload_beacon0(dev);
1730                b43_upload_beacon1(dev);
1731                cmd = b43_read32(dev, B43_MMIO_MACCMD);
1732                cmd |= B43_MACCMD_BEACON0_VALID;
1733                b43_write32(dev, B43_MMIO_MACCMD, cmd);
1734        } else {
1735                if (!beacon0_valid) {
1736                        b43_upload_beacon0(dev);
1737                        cmd = b43_read32(dev, B43_MMIO_MACCMD);
1738                        cmd |= B43_MACCMD_BEACON0_VALID;
1739                        b43_write32(dev, B43_MMIO_MACCMD, cmd);
1740                } else if (!beacon1_valid) {
1741                        b43_upload_beacon1(dev);
1742                        cmd = b43_read32(dev, B43_MMIO_MACCMD);
1743                        cmd |= B43_MACCMD_BEACON1_VALID;
1744                        b43_write32(dev, B43_MMIO_MACCMD, cmd);
1745                }
1746        }
1747}
1748
1749static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1750{
1751        u32 old_irq_mask = dev->irq_mask;
1752
1753        /* update beacon right away or defer to irq */
1754        handle_irq_beacon(dev);
1755        if (old_irq_mask != dev->irq_mask) {
1756                /* The handler updated the IRQ mask. */
1757                B43_WARN_ON(!dev->irq_mask);
1758                if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1759                        b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1760                } else {
1761                        /* Device interrupts are currently disabled. That means
1762                         * we just ran the hardirq handler and scheduled the
1763                         * IRQ thread. The thread will write the IRQ mask when
1764                         * it finished, so there's nothing to do here. Writing
1765                         * the mask _here_ would incorrectly re-enable IRQs. */
1766                }
1767        }
1768}
1769
1770static void b43_beacon_update_trigger_work(struct work_struct *work)
1771{
1772        struct b43_wl *wl = container_of(work, struct b43_wl,
1773                                         beacon_update_trigger);
1774        struct b43_wldev *dev;
1775
1776        mutex_lock(&wl->mutex);
1777        dev = wl->current_dev;
1778        if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1779                if (b43_bus_host_is_sdio(dev->dev)) {
1780                        /* wl->mutex is enough. */
1781                        b43_do_beacon_update_trigger_work(dev);
1782                        mmiowb();
1783                } else {
1784                        spin_lock_irq(&wl->hardirq_lock);
1785                        b43_do_beacon_update_trigger_work(dev);
1786                        mmiowb();
1787                        spin_unlock_irq(&wl->hardirq_lock);
1788                }
1789        }
1790        mutex_unlock(&wl->mutex);
1791}
1792
1793/* Asynchronously update the packet templates in template RAM.
1794 * Locking: Requires wl->mutex to be locked. */
1795static void b43_update_templates(struct b43_wl *wl)
1796{
1797        struct sk_buff *beacon;
1798
1799        /* This is the top half of the ansynchronous beacon update.
1800         * The bottom half is the beacon IRQ.
1801         * Beacon update must be asynchronous to avoid sending an
1802         * invalid beacon. This can happen for example, if the firmware
1803         * transmits a beacon while we are updating it. */
1804
1805        /* We could modify the existing beacon and set the aid bit in
1806         * the TIM field, but that would probably require resizing and
1807         * moving of data within the beacon template.
1808         * Simply request a new beacon and let mac80211 do the hard work. */
1809        beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1810        if (unlikely(!beacon))
1811                return;
1812
1813        if (wl->current_beacon)
1814                dev_kfree_skb_any(wl->current_beacon);
1815        wl->current_beacon = beacon;
1816        wl->beacon0_uploaded = false;
1817        wl->beacon1_uploaded = false;
1818        ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1819}
1820
1821static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1822{
1823        b43_time_lock(dev);
1824        if (dev->dev->core_rev >= 3) {
1825                b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1826                b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1827        } else {
1828                b43_write16(dev, 0x606, (beacon_int >> 6));
1829                b43_write16(dev, 0x610, beacon_int);
1830        }
1831        b43_time_unlock(dev);
1832        b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1833}
1834
1835static void b43_handle_firmware_panic(struct b43_wldev *dev)
1836{
1837        u16 reason;
1838
1839        /* Read the register that contains the reason code for the panic. */
1840        reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1841        b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1842
1843        switch (reason) {
1844        default:
1845                b43dbg(dev->wl, "The panic reason is unknown.\n");
1846                /* fallthrough */
1847        case B43_FWPANIC_DIE:
1848                /* Do not restart the controller or firmware.
1849                 * The device is nonfunctional from now on.
1850                 * Restarting would result in this panic to trigger again,
1851                 * so we avoid that recursion. */
1852                break;
1853        case B43_FWPANIC_RESTART:
1854                b43_controller_restart(dev, "Microcode panic");
1855                break;
1856        }
1857}
1858
1859static void handle_irq_ucode_debug(struct b43_wldev *dev)
1860{
1861        unsigned int i, cnt;
1862        u16 reason, marker_id, marker_line;
1863        __le16 *buf;
1864
1865        /* The proprietary firmware doesn't have this IRQ. */
1866        if (!dev->fw.opensource)
1867                return;
1868
1869        /* Read the register that contains the reason code for this IRQ. */
1870        reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1871
1872        switch (reason) {
1873        case B43_DEBUGIRQ_PANIC:
1874                b43_handle_firmware_panic(dev);
1875                break;
1876        case B43_DEBUGIRQ_DUMP_SHM:
1877                if (!B43_DEBUG)
1878                        break; /* Only with driver debugging enabled. */
1879                buf = kmalloc(4096, GFP_ATOMIC);
1880                if (!buf) {
1881                        b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1882                        goto out;
1883                }
1884                for (i = 0; i < 4096; i += 2) {
1885                        u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1886                        buf[i / 2] = cpu_to_le16(tmp);
1887                }
1888                b43info(dev->wl, "Shared memory dump:\n");
1889                print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1890                               16, 2, buf, 4096, 1);
1891                kfree(buf);
1892                break;
1893        case B43_DEBUGIRQ_DUMP_REGS:
1894                if (!B43_DEBUG)
1895                        break; /* Only with driver debugging enabled. */
1896                b43info(dev->wl, "Microcode register dump:\n");
1897                for (i = 0, cnt = 0; i < 64; i++) {
1898                        u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1899                        if (cnt == 0)
1900                                printk(KERN_INFO);
1901                        printk("r%02u: 0x%04X  ", i, tmp);
1902                        cnt++;
1903                        if (cnt == 6) {
1904                                printk("\n");
1905                                cnt = 0;
1906                        }
1907                }
1908                printk("\n");
1909                break;
1910        case B43_DEBUGIRQ_MARKER:
1911                if (!B43_DEBUG)
1912                        break; /* Only with driver debugging enabled. */
1913                marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1914                                           B43_MARKER_ID_REG);
1915                marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1916                                             B43_MARKER_LINE_REG);
1917                b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1918                        "at line number %u\n",
1919                        marker_id, marker_line);
1920                break;
1921        default:
1922                b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1923                       reason);
1924        }
1925out:
1926        /* Acknowledge the debug-IRQ, so the firmware can continue. */
1927        b43_shm_write16(dev, B43_SHM_SCRATCH,
1928                        B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1929}
1930
1931static void b43_do_interrupt_thread(struct b43_wldev *dev)
1932{
1933        u32 reason;
1934        u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1935        u32 merged_dma_reason = 0;
1936        int i;
1937
1938        if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1939                return;
1940
1941        reason = dev->irq_reason;
1942        for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1943                dma_reason[i] = dev->dma_reason[i];
1944                merged_dma_reason |= dma_reason[i];
1945        }
1946
1947        if (unlikely(reason & B43_IRQ_MAC_TXERR))
1948                b43err(dev->wl, "MAC transmission error\n");
1949
1950        if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1951                b43err(dev->wl, "PHY transmission error\n");
1952                rmb();
1953                if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1954                        atomic_set(&dev->phy.txerr_cnt,
1955                                   B43_PHY_TX_BADNESS_LIMIT);
1956                        b43err(dev->wl, "Too many PHY TX errors, "
1957                                        "restarting the controller\n");
1958                        b43_controller_restart(dev, "PHY TX errors");
1959                }
1960        }
1961
1962        if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
1963                b43err(dev->wl,
1964                        "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1965                        dma_reason[0], dma_reason[1],
1966                        dma_reason[2], dma_reason[3],
1967                        dma_reason[4], dma_reason[5]);
1968                b43err(dev->wl, "This device does not support DMA "
1969                               "on your system. It will now be switched to PIO.\n");
1970                /* Fall back to PIO transfers if we get fatal DMA errors! */
1971                dev->use_pio = true;
1972                b43_controller_restart(dev, "DMA error");
1973                return;
1974        }
1975
1976        if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1977                handle_irq_ucode_debug(dev);
1978        if (reason & B43_IRQ_TBTT_INDI)
1979                handle_irq_tbtt_indication(dev);
1980        if (reason & B43_IRQ_ATIM_END)
1981                handle_irq_atim_end(dev);
1982        if (reason & B43_IRQ_BEACON)
1983                handle_irq_beacon(dev);
1984        if (reason & B43_IRQ_PMQ)
1985                handle_irq_pmq(dev);
1986        if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1987                ;/* TODO */
1988        if (reason & B43_IRQ_NOISESAMPLE_OK)
1989                handle_irq_noise(dev);
1990
1991        /* Check the DMA reason registers for received data. */
1992        if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
1993                if (B43_DEBUG)
1994                        b43warn(dev->wl, "RX descriptor underrun\n");
1995                b43_dma_handle_rx_overflow(dev->dma.rx_ring);
1996        }
1997        if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1998                if (b43_using_pio_transfers(dev))
1999                        b43_pio_rx(dev->pio.rx_queue);
2000                else
2001                        b43_dma_rx(dev->dma.rx_ring);
2002        }
2003        B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
2004        B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
2005        B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
2006        B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
2007        B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
2008
2009        if (reason & B43_IRQ_TX_OK)
2010                handle_irq_transmit_status(dev);
2011
2012        /* Re-enable interrupts on the device by restoring the current interrupt mask. */
2013        b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2014
2015#if B43_DEBUG
2016        if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2017                dev->irq_count++;
2018                for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2019                        if (reason & (1 << i))
2020                                dev->irq_bit_count[i]++;
2021                }
2022        }
2023#endif
2024}
2025
2026/* Interrupt thread handler. Handles device interrupts in thread context. */
2027static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
2028{
2029        struct b43_wldev *dev = dev_id;
2030
2031        mutex_lock(&dev->wl->mutex);
2032        b43_do_interrupt_thread(dev);
2033        mmiowb();
2034        mutex_unlock(&dev->wl->mutex);
2035
2036        return IRQ_HANDLED;
2037}
2038
2039static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2040{
2041        u32 reason;
2042
2043        /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2044         * On SDIO, this runs under wl->mutex. */
2045
2046        reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2047        if (reason == 0xffffffff)       /* shared IRQ */
2048                return IRQ_NONE;
2049        reason &= dev->irq_mask;
2050        if (!reason)
2051                return IRQ_NONE;
2052
2053        dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2054            & 0x0001FC00;
2055        dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2056            & 0x0000DC00;
2057        dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2058            & 0x0000DC00;
2059        dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2060            & 0x0001DC00;
2061        dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2062            & 0x0000DC00;
2063/* Unused ring
2064        dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2065            & 0x0000DC00;
2066*/
2067
2068        /* ACK the interrupt. */
2069        b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2070        b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2071        b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2072        b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2073        b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2074        b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2075/* Unused ring
2076        b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2077*/
2078
2079        /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2080        b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2081        /* Save the reason bitmasks for the IRQ thread handler. */
2082        dev->irq_reason = reason;
2083
2084        return IRQ_WAKE_THREAD;
2085}
2086
2087/* Interrupt handler top-half. This runs with interrupts disabled. */
2088static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2089{
2090        struct b43_wldev *dev = dev_id;
2091        irqreturn_t ret;
2092
2093        if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2094                return IRQ_NONE;
2095
2096        spin_lock(&dev->wl->hardirq_lock);
2097        ret = b43_do_interrupt(dev);
2098        mmiowb();
2099        spin_unlock(&dev->wl->hardirq_lock);
2100
2101        return ret;
2102}
2103
2104/* SDIO interrupt handler. This runs in process context. */
2105static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2106{
2107        struct b43_wl *wl = dev->wl;
2108        irqreturn_t ret;
2109
2110        mutex_lock(&wl->mutex);
2111
2112        ret = b43_do_interrupt(dev);
2113        if (ret == IRQ_WAKE_THREAD)
2114                b43_do_interrupt_thread(dev);
2115
2116        mutex_unlock(&wl->mutex);
2117}
2118
2119void b43_do_release_fw(struct b43_firmware_file *fw)
2120{
2121        release_firmware(fw->data);
2122        fw->data = NULL;
2123        fw->filename = NULL;
2124}
2125
2126static void b43_release_firmware(struct b43_wldev *dev)
2127{
2128        complete(&dev->fw_load_complete);
2129        b43_do_release_fw(&dev->fw.ucode);
2130        b43_do_release_fw(&dev->fw.pcm);
2131        b43_do_release_fw(&dev->fw.initvals);
2132        b43_do_release_fw(&dev->fw.initvals_band);
2133}
2134
2135static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2136{
2137        const char text[] =
2138                "You must go to " \
2139                "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2140                "and download the correct firmware for this driver version. " \
2141                "Please carefully read all instructions on this website.\n";
2142
2143        if (error)
2144                b43err(wl, text);
2145        else
2146                b43warn(wl, text);
2147}
2148
2149static void b43_fw_cb(const struct firmware *firmware, void *context)
2150{
2151        struct b43_request_fw_context *ctx = context;
2152
2153        ctx->blob = firmware;
2154        complete(&ctx->dev->fw_load_complete);
2155}
2156
2157int b43_do_request_fw(struct b43_request_fw_context *ctx,
2158                      const char *name,
2159                      struct b43_firmware_file *fw, bool async)
2160{
2161        struct b43_fw_header *hdr;
2162        u32 size;
2163        int err;
2164
2165        if (!name) {
2166                /* Don't fetch anything. Free possibly cached firmware. */
2167                /* FIXME: We should probably keep it anyway, to save some headache
2168                 * on suspend/resume with multiband devices. */
2169                b43_do_release_fw(fw);
2170                return 0;
2171        }
2172        if (fw->filename) {
2173                if ((fw->type == ctx->req_type) &&
2174                    (strcmp(fw->filename, name) == 0))
2175                        return 0; /* Already have this fw. */
2176                /* Free the cached firmware first. */
2177                /* FIXME: We should probably do this later after we successfully
2178                 * got the new fw. This could reduce headache with multiband devices.
2179                 * We could also redesign this to cache the firmware for all possible
2180                 * bands all the time. */
2181                b43_do_release_fw(fw);
2182        }
2183
2184        switch (ctx->req_type) {
2185        case B43_FWTYPE_PROPRIETARY:
2186                snprintf(ctx->fwname, sizeof(ctx->fwname),
2187                         "b43%s/%s.fw",
2188                         modparam_fwpostfix, name);
2189                break;
2190        case B43_FWTYPE_OPENSOURCE:
2191                snprintf(ctx->fwname, sizeof(ctx->fwname),
2192                         "b43-open%s/%s.fw",
2193                         modparam_fwpostfix, name);
2194                break;
2195        default:
2196                B43_WARN_ON(1);
2197                return -ENOSYS;
2198        }
2199        if (async) {
2200                /* do this part asynchronously */
2201                init_completion(&ctx->dev->fw_load_complete);
2202                err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2203                                              ctx->dev->dev->dev, GFP_KERNEL,
2204                                              ctx, b43_fw_cb);
2205                if (err < 0) {
2206                        pr_err("Unable to load firmware\n");
2207                        return err;
2208                }
2209                wait_for_completion(&ctx->dev->fw_load_complete);
2210                if (ctx->blob)
2211                        goto fw_ready;
2212        /* On some ARM systems, the async request will fail, but the next sync
2213         * request works. For this reason, we fall through here
2214         */
2215        }
2216        err = request_firmware(&ctx->blob, ctx->fwname,
2217                               ctx->dev->dev->dev);
2218        if (err == -ENOENT) {
2219                snprintf(ctx->errors[ctx->req_type],
2220                         sizeof(ctx->errors[ctx->req_type]),
2221                         "Firmware file \"%s\" not found\n",
2222                         ctx->fwname);
2223                return err;
2224        } else if (err) {
2225                snprintf(ctx->errors[ctx->req_type],
2226                         sizeof(ctx->errors[ctx->req_type]),
2227                         "Firmware file \"%s\" request failed (err=%d)\n",
2228                         ctx->fwname, err);
2229                return err;
2230        }
2231fw_ready:
2232        if (ctx->blob->size < sizeof(struct b43_fw_header))
2233                goto err_format;
2234        hdr = (struct b43_fw_header *)(ctx->blob->data);
2235        switch (hdr->type) {
2236        case B43_FW_TYPE_UCODE:
2237        case B43_FW_TYPE_PCM:
2238                size = be32_to_cpu(hdr->size);
2239                if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2240                        goto err_format;
2241                /* fallthrough */
2242        case B43_FW_TYPE_IV:
2243                if (hdr->ver != 1)
2244                        goto err_format;
2245                break;
2246        default:
2247                goto err_format;
2248        }
2249
2250        fw->data = ctx->blob;
2251        fw->filename = name;
2252        fw->type = ctx->req_type;
2253
2254        return 0;
2255
2256err_format:
2257        snprintf(ctx->errors[ctx->req_type],
2258                 sizeof(ctx->errors[ctx->req_type]),
2259                 "Firmware file \"%s\" format error.\n", ctx->fwname);
2260        release_firmware(ctx->blob);
2261
2262        return -EPROTO;
2263}
2264
2265/* http://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2266static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2267{
2268        struct b43_wldev *dev = ctx->dev;
2269        struct b43_firmware *fw = &ctx->dev->fw;
2270        struct b43_phy *phy = &dev->phy;
2271        const u8 rev = ctx->dev->dev->core_rev;
2272        const char *filename;
2273        int err;
2274
2275        /* Get microcode */
2276        filename = NULL;
2277        switch (rev) {
2278        case 42:
2279                if (phy->type == B43_PHYTYPE_AC)
2280                        filename = "ucode42";
2281                break;
2282        case 40:
2283                if (phy->type == B43_PHYTYPE_AC)
2284                        filename = "ucode40";
2285                break;
2286        case 33:
2287                if (phy->type == B43_PHYTYPE_LCN40)
2288                        filename = "ucode33_lcn40";
2289                break;
2290        case 30:
2291                if (phy->type == B43_PHYTYPE_N)
2292                        filename = "ucode30_mimo";
2293                break;
2294        case 29:
2295                if (phy->type == B43_PHYTYPE_HT)
2296                        filename = "ucode29_mimo";
2297                break;
2298        case 26:
2299                if (phy->type == B43_PHYTYPE_HT)
2300                        filename = "ucode26_mimo";
2301                break;
2302        case 28:
2303        case 25:
2304                if (phy->type == B43_PHYTYPE_N)
2305                        filename = "ucode25_mimo";
2306                else if (phy->type == B43_PHYTYPE_LCN)
2307                        filename = "ucode25_lcn";
2308                break;
2309        case 24:
2310                if (phy->type == B43_PHYTYPE_LCN)
2311                        filename = "ucode24_lcn";
2312                break;
2313        case 23:
2314                if (phy->type == B43_PHYTYPE_N)
2315                        filename = "ucode16_mimo";
2316                break;
2317        case 16 ... 19:
2318                if (phy->type == B43_PHYTYPE_N)
2319                        filename = "ucode16_mimo";
2320                else if (phy->type == B43_PHYTYPE_LP)
2321                        filename = "ucode16_lp";
2322                break;
2323        case 15:
2324                filename = "ucode15";
2325                break;
2326        case 14:
2327                filename = "ucode14";
2328                break;
2329        case 13:
2330                filename = "ucode13";
2331                break;
2332        case 11 ... 12:
2333                filename = "ucode11";
2334                break;
2335        case 5 ... 10:
2336                filename = "ucode5";
2337                break;
2338        }
2339        if (!filename)
2340                goto err_no_ucode;
2341        err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2342        if (err)
2343                goto err_load;
2344
2345        /* Get PCM code */
2346        if ((rev >= 5) && (rev <= 10))
2347                filename = "pcm5";
2348        else if (rev >= 11)
2349                filename = NULL;
2350        else
2351                goto err_no_pcm;
2352        fw->pcm_request_failed = false;
2353        err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2354        if (err == -ENOENT) {
2355                /* We did not find a PCM file? Not fatal, but
2356                 * core rev <= 10 must do without hwcrypto then. */
2357                fw->pcm_request_failed = true;
2358        } else if (err)
2359                goto err_load;
2360
2361        /* Get initvals */
2362        filename = NULL;
2363        switch (dev->phy.type) {
2364        case B43_PHYTYPE_G:
2365                if (rev == 13)
2366                        filename = "b0g0initvals13";
2367                else if (rev >= 5 && rev <= 10)
2368                        filename = "b0g0initvals5";
2369                break;
2370        case B43_PHYTYPE_N:
2371                if (rev == 30)
2372                        filename = "n16initvals30";
2373                else if (rev == 28 || rev == 25)
2374                        filename = "n0initvals25";
2375                else if (rev == 24)
2376                        filename = "n0initvals24";
2377                else if (rev == 23)
2378                        filename = "n0initvals16"; /* What about n0initvals22? */
2379                else if (rev >= 16 && rev <= 18)
2380                        filename = "n0initvals16";
2381                else if (rev >= 11 && rev <= 12)
2382                        filename = "n0initvals11";
2383                break;
2384        case B43_PHYTYPE_LP:
2385                if (rev >= 16 && rev <= 18)
2386                        filename = "lp0initvals16";
2387                else if (rev == 15)
2388                        filename = "lp0initvals15";
2389                else if (rev == 14)
2390                        filename = "lp0initvals14";
2391                else if (rev == 13)
2392                        filename = "lp0initvals13";
2393                break;
2394        case B43_PHYTYPE_HT:
2395                if (rev == 29)
2396                        filename = "ht0initvals29";
2397                else if (rev == 26)
2398                        filename = "ht0initvals26";
2399                break;
2400        case B43_PHYTYPE_LCN:
2401                if (rev == 24)
2402                        filename = "lcn0initvals24";
2403                break;
2404        case B43_PHYTYPE_LCN40:
2405                if (rev == 33)
2406                        filename = "lcn400initvals33";
2407                break;
2408        case B43_PHYTYPE_AC:
2409                if (rev == 42)
2410                        filename = "ac1initvals42";
2411                else if (rev == 40)
2412                        filename = "ac0initvals40";
2413                break;
2414        }
2415        if (!filename)
2416                goto err_no_initvals;
2417        err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2418        if (err)
2419                goto err_load;
2420
2421        /* Get bandswitch initvals */
2422        filename = NULL;
2423        switch (dev->phy.type) {
2424        case B43_PHYTYPE_G:
2425                if (rev == 13)
2426                        filename = "b0g0bsinitvals13";
2427                else if (rev >= 5 && rev <= 10)
2428                        filename = "b0g0bsinitvals5";
2429                break;
2430        case B43_PHYTYPE_N:
2431                if (rev == 30)
2432                        filename = "n16bsinitvals30";
2433                else if (rev == 28 || rev == 25)
2434                        filename = "n0bsinitvals25";
2435                else if (rev == 24)
2436                        filename = "n0bsinitvals24";
2437                else if (rev == 23)
2438                        filename = "n0bsinitvals16"; /* What about n0bsinitvals22? */
2439                else if (rev >= 16 && rev <= 18)
2440                        filename = "n0bsinitvals16";
2441                else if (rev >= 11 && rev <= 12)
2442                        filename = "n0bsinitvals11";
2443                break;
2444        case B43_PHYTYPE_LP:
2445                if (rev >= 16 && rev <= 18)
2446                        filename = "lp0bsinitvals16";
2447                else if (rev == 15)
2448                        filename = "lp0bsinitvals15";
2449                else if (rev == 14)
2450                        filename = "lp0bsinitvals14";
2451                else if (rev == 13)
2452                        filename = "lp0bsinitvals13";
2453                break;
2454        case B43_PHYTYPE_HT:
2455                if (rev == 29)
2456                        filename = "ht0bsinitvals29";
2457                else if (rev == 26)
2458                        filename = "ht0bsinitvals26";
2459                break;
2460        case B43_PHYTYPE_LCN:
2461                if (rev == 24)
2462                        filename = "lcn0bsinitvals24";
2463                break;
2464        case B43_PHYTYPE_LCN40:
2465                if (rev == 33)
2466                        filename = "lcn400bsinitvals33";
2467                break;
2468        case B43_PHYTYPE_AC:
2469                if (rev == 42)
2470                        filename = "ac1bsinitvals42";
2471                else if (rev == 40)
2472                        filename = "ac0bsinitvals40";
2473                break;
2474        }
2475        if (!filename)
2476                goto err_no_initvals;
2477        err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2478        if (err)
2479                goto err_load;
2480
2481        fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2482
2483        return 0;
2484
2485err_no_ucode:
2486        err = ctx->fatal_failure = -EOPNOTSUPP;
2487        b43err(dev->wl, "The driver does not know which firmware (ucode) "
2488               "is required for your device (wl-core rev %u)\n", rev);
2489        goto error;
2490
2491err_no_pcm:
2492        err = ctx->fatal_failure = -EOPNOTSUPP;
2493        b43err(dev->wl, "The driver does not know which firmware (PCM) "
2494               "is required for your device (wl-core rev %u)\n", rev);
2495        goto error;
2496
2497err_no_initvals:
2498        err = ctx->fatal_failure = -EOPNOTSUPP;
2499        b43err(dev->wl, "The driver does not know which firmware (initvals) "
2500               "is required for your device (wl-core rev %u)\n", rev);
2501        goto error;
2502
2503err_load:
2504        /* We failed to load this firmware image. The error message
2505         * already is in ctx->errors. Return and let our caller decide
2506         * what to do. */
2507        goto error;
2508
2509error:
2510        b43_release_firmware(dev);
2511        return err;
2512}
2513
2514static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2515static void b43_one_core_detach(struct b43_bus_dev *dev);
2516static int b43_rng_init(struct b43_wl *wl);
2517
2518static void b43_request_firmware(struct work_struct *work)
2519{
2520        struct b43_wl *wl = container_of(work,
2521                            struct b43_wl, firmware_load);
2522        struct b43_wldev *dev = wl->current_dev;
2523        struct b43_request_fw_context *ctx;
2524        unsigned int i;
2525        int err;
2526        const char *errmsg;
2527
2528        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2529        if (!ctx)
2530                return;
2531        ctx->dev = dev;
2532
2533        ctx->req_type = B43_FWTYPE_PROPRIETARY;
2534        err = b43_try_request_fw(ctx);
2535        if (!err)
2536                goto start_ieee80211; /* Successfully loaded it. */
2537        /* Was fw version known? */
2538        if (ctx->fatal_failure)
2539                goto out;
2540
2541        /* proprietary fw not found, try open source */
2542        ctx->req_type = B43_FWTYPE_OPENSOURCE;
2543        err = b43_try_request_fw(ctx);
2544        if (!err)
2545                goto start_ieee80211; /* Successfully loaded it. */
2546        if(ctx->fatal_failure)
2547                goto out;
2548
2549        /* Could not find a usable firmware. Print the errors. */
2550        for (i = 0; i < B43_NR_FWTYPES; i++) {
2551                errmsg = ctx->errors[i];
2552                if (strlen(errmsg))
2553                        b43err(dev->wl, "%s", errmsg);
2554        }
2555        b43_print_fw_helptext(dev->wl, 1);
2556        goto out;
2557
2558start_ieee80211:
2559        wl->hw->queues = B43_QOS_QUEUE_NUM;
2560        if (!modparam_qos || dev->fw.opensource)
2561                wl->hw->queues = 1;
2562
2563        err = ieee80211_register_hw(wl->hw);
2564        if (err)
2565                goto err_one_core_detach;
2566        wl->hw_registred = true;
2567        b43_leds_register(wl->current_dev);
2568
2569        /* Register HW RNG driver */
2570        b43_rng_init(wl);
2571
2572        goto out;
2573
2574err_one_core_detach:
2575        b43_one_core_detach(dev->dev);
2576
2577out:
2578        kfree(ctx);
2579}
2580
2581static int b43_upload_microcode(struct b43_wldev *dev)
2582{
2583        struct wiphy *wiphy = dev->wl->hw->wiphy;
2584        const size_t hdr_len = sizeof(struct b43_fw_header);
2585        const __be32 *data;
2586        unsigned int i, len;
2587        u16 fwrev, fwpatch, fwdate, fwtime;
2588        u32 tmp, macctl;
2589        int err = 0;
2590
2591        /* Jump the microcode PSM to offset 0 */
2592        macctl = b43_read32(dev, B43_MMIO_MACCTL);
2593        B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2594        macctl |= B43_MACCTL_PSM_JMP0;
2595        b43_write32(dev, B43_MMIO_MACCTL, macctl);
2596        /* Zero out all microcode PSM registers and shared memory. */
2597        for (i = 0; i < 64; i++)
2598                b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2599        for (i = 0; i < 4096; i += 2)
2600                b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2601
2602        /* Upload Microcode. */
2603        data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2604        len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2605        b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2606        for (i = 0; i < len; i++) {
2607                b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2608                udelay(10);
2609        }
2610
2611        if (dev->fw.pcm.data) {
2612                /* Upload PCM data. */
2613                data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2614                len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2615                b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2616                b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2617                /* No need for autoinc bit in SHM_HW */
2618                b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2619                for (i = 0; i < len; i++) {
2620                        b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2621                        udelay(10);
2622                }
2623        }
2624
2625        b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2626
2627        /* Start the microcode PSM */
2628        b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2629                      B43_MACCTL_PSM_RUN);
2630
2631        /* Wait for the microcode to load and respond */
2632        i = 0;
2633        while (1) {
2634                tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2635                if (tmp == B43_IRQ_MAC_SUSPENDED)
2636                        break;
2637                i++;
2638                if (i >= 20) {
2639                        b43err(dev->wl, "Microcode not responding\n");
2640                        b43_print_fw_helptext(dev->wl, 1);
2641                        err = -ENODEV;
2642                        goto error;
2643                }
2644                msleep(50);
2645        }
2646        b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2647
2648        /* Get and check the revisions. */
2649        fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2650        fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2651        fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2652        fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2653
2654        if (fwrev <= 0x128) {
2655                b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2656                       "binary drivers older than version 4.x is unsupported. "
2657                       "You must upgrade your firmware files.\n");
2658                b43_print_fw_helptext(dev->wl, 1);
2659                err = -EOPNOTSUPP;
2660                goto error;
2661        }
2662        dev->fw.rev = fwrev;
2663        dev->fw.patch = fwpatch;
2664        if (dev->fw.rev >= 598)
2665                dev->fw.hdr_format = B43_FW_HDR_598;
2666        else if (dev->fw.rev >= 410)
2667                dev->fw.hdr_format = B43_FW_HDR_410;
2668        else
2669                dev->fw.hdr_format = B43_FW_HDR_351;
2670        WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2671
2672        dev->qos_enabled = dev->wl->hw->queues > 1;
2673        /* Default to firmware/hardware crypto acceleration. */
2674        dev->hwcrypto_enabled = true;
2675
2676        if (dev->fw.opensource) {
2677                u16 fwcapa;
2678
2679                /* Patchlevel info is encoded in the "time" field. */
2680                dev->fw.patch = fwtime;
2681                b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2682                        dev->fw.rev, dev->fw.patch);
2683
2684                fwcapa = b43_fwcapa_read(dev);
2685                if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2686                        b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2687                        /* Disable hardware crypto and fall back to software crypto. */
2688                        dev->hwcrypto_enabled = false;
2689                }
2690                /* adding QoS support should use an offline discovery mechanism */
2691                WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2692        } else {
2693                b43info(dev->wl, "Loading firmware version %u.%u "
2694                        "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2695                        fwrev, fwpatch,
2696                        (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2697                        (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2698                if (dev->fw.pcm_request_failed) {
2699                        b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2700                                "Hardware accelerated cryptography is disabled.\n");
2701                        b43_print_fw_helptext(dev->wl, 0);
2702                }
2703        }
2704
2705        snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2706                        dev->fw.rev, dev->fw.patch);
2707        wiphy->hw_version = dev->dev->core_id;
2708
2709        if (dev->fw.hdr_format == B43_FW_HDR_351) {
2710                /* We're over the deadline, but we keep support for old fw
2711                 * until it turns out to be in major conflict with something new. */
2712                b43warn(dev->wl, "You are using an old firmware image. "
2713                        "Support for old firmware will be removed soon "
2714                        "(official deadline was July 2008).\n");
2715                b43_print_fw_helptext(dev->wl, 0);
2716        }
2717
2718        return 0;
2719
2720error:
2721        /* Stop the microcode PSM. */
2722        b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2723                      B43_MACCTL_PSM_JMP0);
2724
2725        return err;
2726}
2727
2728static int b43_write_initvals(struct b43_wldev *dev,
2729                              const struct b43_iv *ivals,
2730                              size_t count,
2731                              size_t array_size)
2732{
2733        const struct b43_iv *iv;
2734        u16 offset;
2735        size_t i;
2736        bool bit32;
2737
2738        BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2739        iv = ivals;
2740        for (i = 0; i < count; i++) {
2741                if (array_size < sizeof(iv->offset_size))
2742                        goto err_format;
2743                array_size -= sizeof(iv->offset_size);
2744                offset = be16_to_cpu(iv->offset_size);
2745                bit32 = !!(offset & B43_IV_32BIT);
2746                offset &= B43_IV_OFFSET_MASK;
2747                if (offset >= 0x1000)
2748                        goto err_format;
2749                if (bit32) {
2750                        u32 value;
2751
2752                        if (array_size < sizeof(iv->data.d32))
2753                                goto err_format;
2754                        array_size -= sizeof(iv->data.d32);
2755
2756                        value = get_unaligned_be32(&iv->data.d32);
2757                        b43_write32(dev, offset, value);
2758
2759                        iv = (const struct b43_iv *)((const uint8_t *)iv +
2760                                                        sizeof(__be16) +
2761                                                        sizeof(__be32));
2762                } else {
2763                        u16 value;
2764
2765                        if (array_size < sizeof(iv->data.d16))
2766                                goto err_format;
2767                        array_size -= sizeof(iv->data.d16);
2768
2769                        value = be16_to_cpu(iv->data.d16);
2770                        b43_write16(dev, offset, value);
2771
2772                        iv = (const struct b43_iv *)((const uint8_t *)iv +
2773                                                        sizeof(__be16) +
2774                                                        sizeof(__be16));
2775                }
2776        }
2777        if (array_size)
2778                goto err_format;
2779
2780        return 0;
2781
2782err_format:
2783        b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2784        b43_print_fw_helptext(dev->wl, 1);
2785
2786        return -EPROTO;
2787}
2788
2789static int b43_upload_initvals(struct b43_wldev *dev)
2790{
2791        const size_t hdr_len = sizeof(struct b43_fw_header);
2792        const struct b43_fw_header *hdr;
2793        struct b43_firmware *fw = &dev->fw;
2794        const struct b43_iv *ivals;
2795        size_t count;
2796
2797        hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2798        ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2799        count = be32_to_cpu(hdr->size);
2800        return b43_write_initvals(dev, ivals, count,
2801                                 fw->initvals.data->size - hdr_len);
2802}
2803
2804static int b43_upload_initvals_band(struct b43_wldev *dev)
2805{
2806        const size_t hdr_len = sizeof(struct b43_fw_header);
2807        const struct b43_fw_header *hdr;
2808        struct b43_firmware *fw = &dev->fw;
2809        const struct b43_iv *ivals;
2810        size_t count;
2811
2812        if (!fw->initvals_band.data)
2813                return 0;
2814
2815        hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2816        ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2817        count = be32_to_cpu(hdr->size);
2818        return b43_write_initvals(dev, ivals, count,
2819                                  fw->initvals_band.data->size - hdr_len);
2820}
2821
2822/* Initialize the GPIOs
2823 * http://bcm-specs.sipsolutions.net/GPIO
2824 */
2825
2826#ifdef CONFIG_B43_SSB
2827static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2828{
2829        struct ssb_bus *bus = dev->dev->sdev->bus;
2830
2831#ifdef CONFIG_SSB_DRIVER_PCICORE
2832        return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2833#else
2834        return bus->chipco.dev;
2835#endif
2836}
2837#endif
2838
2839static int b43_gpio_init(struct b43_wldev *dev)
2840{
2841#ifdef CONFIG_B43_SSB
2842        struct ssb_device *gpiodev;
2843#endif
2844        u32 mask, set;
2845
2846        b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2847        b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2848
2849        mask = 0x0000001F;
2850        set = 0x0000000F;
2851        if (dev->dev->chip_id == 0x4301) {
2852                mask |= 0x0060;
2853                set |= 0x0060;
2854        } else if (dev->dev->chip_id == 0x5354) {
2855                /* Don't allow overtaking buttons GPIOs */
2856                set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2857        }
2858
2859        if (0 /* FIXME: conditional unknown */ ) {
2860                b43_write16(dev, B43_MMIO_GPIO_MASK,
2861                            b43_read16(dev, B43_MMIO_GPIO_MASK)
2862                            | 0x0100);
2863                /* BT Coexistance Input */
2864                mask |= 0x0080;
2865                set |= 0x0080;
2866                /* BT Coexistance Out */
2867                mask |= 0x0100;
2868                set |= 0x0100;
2869        }
2870        if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2871                /* PA is controlled by gpio 9, let ucode handle it */
2872                b43_write16(dev, B43_MMIO_GPIO_MASK,
2873                            b43_read16(dev, B43_MMIO_GPIO_MASK)
2874                            | 0x0200);
2875                mask |= 0x0200;
2876                set |= 0x0200;
2877        }
2878
2879        switch (dev->dev->bus_type) {
2880#ifdef CONFIG_B43_BCMA
2881        case B43_BUS_BCMA:
2882                bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2883                break;
2884#endif
2885#ifdef CONFIG_B43_SSB
2886        case B43_BUS_SSB:
2887                gpiodev = b43_ssb_gpio_dev(dev);
2888                if (gpiodev)
2889                        ssb_write32(gpiodev, B43_GPIO_CONTROL,
2890                                    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2891                                    & ~mask) | set);
2892                break;
2893#endif
2894        }
2895
2896        return 0;
2897}
2898
2899/* Turn off all GPIO stuff. Call this on module unload, for example. */
2900static void b43_gpio_cleanup(struct b43_wldev *dev)
2901{
2902#ifdef CONFIG_B43_SSB
2903        struct ssb_device *gpiodev;
2904#endif
2905
2906        switch (dev->dev->bus_type) {
2907#ifdef CONFIG_B43_BCMA
2908        case B43_BUS_BCMA:
2909                bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2910                break;
2911#endif
2912#ifdef CONFIG_B43_SSB
2913        case B43_BUS_SSB:
2914                gpiodev = b43_ssb_gpio_dev(dev);
2915                if (gpiodev)
2916                        ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2917                break;
2918#endif
2919        }
2920}
2921
2922/* http://bcm-specs.sipsolutions.net/EnableMac */
2923void b43_mac_enable(struct b43_wldev *dev)
2924{
2925        if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2926                u16 fwstate;
2927
2928                fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2929                                         B43_SHM_SH_UCODESTAT);
2930                if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2931                    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2932                        b43err(dev->wl, "b43_mac_enable(): The firmware "
2933                               "should be suspended, but current state is %u\n",
2934                               fwstate);
2935                }
2936        }
2937
2938        dev->mac_suspended--;
2939        B43_WARN_ON(dev->mac_suspended < 0);
2940        if (dev->mac_suspended == 0) {
2941                b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2942                b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2943                            B43_IRQ_MAC_SUSPENDED);
2944                /* Commit writes */
2945                b43_read32(dev, B43_MMIO_MACCTL);
2946                b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2947                b43_power_saving_ctl_bits(dev, 0);
2948        }
2949}
2950
2951/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2952void b43_mac_suspend(struct b43_wldev *dev)
2953{
2954        int i;
2955        u32 tmp;
2956
2957        might_sleep();
2958        B43_WARN_ON(dev->mac_suspended < 0);
2959
2960        if (dev->mac_suspended == 0) {
2961                b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2962                b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
2963                /* force pci to flush the write */
2964                b43_read32(dev, B43_MMIO_MACCTL);
2965                for (i = 35; i; i--) {
2966                        tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2967                        if (tmp & B43_IRQ_MAC_SUSPENDED)
2968                                goto out;
2969                        udelay(10);
2970                }
2971                /* Hm, it seems this will take some time. Use msleep(). */
2972                for (i = 40; i; i--) {
2973                        tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2974                        if (tmp & B43_IRQ_MAC_SUSPENDED)
2975                                goto out;
2976                        msleep(1);
2977                }
2978                b43err(dev->wl, "MAC suspend failed\n");
2979        }
2980out:
2981        dev->mac_suspended++;
2982}
2983
2984/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2985void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2986{
2987        u32 tmp;
2988
2989        switch (dev->dev->bus_type) {
2990#ifdef CONFIG_B43_BCMA
2991        case B43_BUS_BCMA:
2992                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
2993                if (on)
2994                        tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2995                else
2996                        tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2997                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
2998                break;
2999#endif
3000#ifdef CONFIG_B43_SSB
3001        case B43_BUS_SSB:
3002                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3003                if (on)
3004                        tmp |= B43_TMSLOW_MACPHYCLKEN;
3005                else
3006                        tmp &= ~B43_TMSLOW_MACPHYCLKEN;
3007                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3008                break;
3009#endif
3010        }
3011}
3012
3013/* brcms_b_switch_macfreq */
3014void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
3015{
3016        u16 chip_id = dev->dev->chip_id;
3017
3018        if (chip_id == BCMA_CHIP_ID_BCM4331) {
3019                switch (spurmode) {
3020                case 2: /* 168 Mhz: 2^26/168 = 0x61862 */
3021                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x1862);
3022                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3023                        break;
3024                case 1: /* 164 Mhz: 2^26/164 = 0x63e70 */
3025                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x3e70);
3026                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3027                        break;
3028                default: /* 160 Mhz: 2^26/160 = 0x66666 */
3029                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x6666);
3030                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3031                        break;
3032                }
3033        } else if (chip_id == BCMA_CHIP_ID_BCM43131 ||
3034            chip_id == BCMA_CHIP_ID_BCM43217 ||
3035            chip_id == BCMA_CHIP_ID_BCM43222 ||
3036            chip_id == BCMA_CHIP_ID_BCM43224 ||
3037            chip_id == BCMA_CHIP_ID_BCM43225 ||
3038            chip_id == BCMA_CHIP_ID_BCM43227 ||
3039            chip_id == BCMA_CHIP_ID_BCM43228) {
3040                switch (spurmode) {
3041                case 2: /* 126 Mhz */
3042                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
3043                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3044                        break;
3045                case 1: /* 123 Mhz */
3046                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3047                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3048                        break;
3049                default: /* 120 Mhz */
3050                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3051                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3052                        break;
3053                }
3054        } else if (dev->phy.type == B43_PHYTYPE_LCN) {
3055                switch (spurmode) {
3056                case 1: /* 82 Mhz */
3057                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3058                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3059                        break;
3060                default: /* 80 Mhz */
3061                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3062                        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3063                        break;
3064                }
3065        }
3066}
3067
3068static void b43_adjust_opmode(struct b43_wldev *dev)
3069{
3070        struct b43_wl *wl = dev->wl;
3071        u32 ctl;
3072        u16 cfp_pretbtt;
3073
3074        ctl = b43_read32(dev, B43_MMIO_MACCTL);
3075        /* Reset status to STA infrastructure mode. */
3076        ctl &= ~B43_MACCTL_AP;
3077        ctl &= ~B43_MACCTL_KEEP_CTL;
3078        ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3079        ctl &= ~B43_MACCTL_KEEP_BAD;
3080        ctl &= ~B43_MACCTL_PROMISC;
3081        ctl &= ~B43_MACCTL_BEACPROMISC;
3082        ctl |= B43_MACCTL_INFRA;
3083
3084        if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3085            b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3086                ctl |= B43_MACCTL_AP;
3087        else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3088                ctl &= ~B43_MACCTL_INFRA;
3089
3090        if (wl->filter_flags & FIF_CONTROL)
3091                ctl |= B43_MACCTL_KEEP_CTL;
3092        if (wl->filter_flags & FIF_FCSFAIL)
3093                ctl |= B43_MACCTL_KEEP_BAD;
3094        if (wl->filter_flags & FIF_PLCPFAIL)
3095                ctl |= B43_MACCTL_KEEP_BADPLCP;
3096        if (wl->filter_flags & FIF_PROMISC_IN_BSS)
3097                ctl |= B43_MACCTL_PROMISC;
3098        if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3099                ctl |= B43_MACCTL_BEACPROMISC;
3100
3101        /* Workaround: On old hardware the HW-MAC-address-filter
3102         * doesn't work properly, so always run promisc in filter
3103         * it in software. */
3104        if (dev->dev->core_rev <= 4)
3105                ctl |= B43_MACCTL_PROMISC;
3106
3107        b43_write32(dev, B43_MMIO_MACCTL, ctl);
3108
3109        cfp_pretbtt = 2;
3110        if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3111                if (dev->dev->chip_id == 0x4306 &&
3112                    dev->dev->chip_rev == 3)
3113                        cfp_pretbtt = 100;
3114                else
3115                        cfp_pretbtt = 50;
3116        }
3117        b43_write16(dev, 0x612, cfp_pretbtt);
3118
3119        /* FIXME: We don't currently implement the PMQ mechanism,
3120         *        so always disable it. If we want to implement PMQ,
3121         *        we need to enable it here (clear DISCPMQ) in AP mode.
3122         */
3123        if (0  /* ctl & B43_MACCTL_AP */)
3124                b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3125        else
3126                b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3127}
3128
3129static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3130{
3131        u16 offset;
3132
3133        if (is_ofdm) {
3134                offset = 0x480;
3135                offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3136        } else {
3137                offset = 0x4C0;
3138                offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3139        }
3140        b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3141                        b43_shm_read16(dev, B43_SHM_SHARED, offset));
3142}
3143
3144static void b43_rate_memory_init(struct b43_wldev *dev)
3145{
3146        switch (dev->phy.type) {
3147        case B43_PHYTYPE_A:
3148        case B43_PHYTYPE_G:
3149        case B43_PHYTYPE_N:
3150        case B43_PHYTYPE_LP:
3151        case B43_PHYTYPE_HT:
3152        case B43_PHYTYPE_LCN:
3153                b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3154                b43_rate_memory_write(dev, B43_OFDM_RATE_9MB, 1);
3155                b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3156                b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3157                b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3158                b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3159                b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3160                b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3161                if (dev->phy.type == B43_PHYTYPE_A)
3162                        break;
3163                /* fallthrough */
3164        case B43_PHYTYPE_B:
3165                b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3166                b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3167                b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3168                b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3169                break;
3170        default:
3171                B43_WARN_ON(1);
3172        }
3173}
3174
3175/* Set the default values for the PHY TX Control Words. */
3176static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3177{
3178        u16 ctl = 0;
3179
3180        ctl |= B43_TXH_PHY_ENC_CCK;
3181        ctl |= B43_TXH_PHY_ANT01AUTO;
3182        ctl |= B43_TXH_PHY_TXPWR;
3183
3184        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3185        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3186        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3187}
3188
3189/* Set the TX-Antenna for management frames sent by firmware. */
3190static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3191{
3192        u16 ant;
3193        u16 tmp;
3194
3195        ant = b43_antenna_to_phyctl(antenna);
3196
3197        /* For ACK/CTS */
3198        tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3199        tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3200        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3201        /* For Probe Resposes */
3202        tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3203        tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3204        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3205}
3206
3207/* This is the opposite of b43_chip_init() */
3208static void b43_chip_exit(struct b43_wldev *dev)
3209{
3210        b43_phy_exit(dev);
3211        b43_gpio_cleanup(dev);
3212        /* firmware is released later */
3213}
3214
3215/* Initialize the chip
3216 * http://bcm-specs.sipsolutions.net/ChipInit
3217 */
3218static int b43_chip_init(struct b43_wldev *dev)
3219{
3220        struct b43_phy *phy = &dev->phy;
3221        int err;
3222        u32 macctl;
3223        u16 value16;
3224
3225        /* Initialize the MAC control */
3226        macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3227        if (dev->phy.gmode)
3228                macctl |= B43_MACCTL_GMODE;
3229        macctl |= B43_MACCTL_INFRA;
3230        b43_write32(dev, B43_MMIO_MACCTL, macctl);
3231
3232        err = b43_upload_microcode(dev);
3233        if (err)
3234                goto out;       /* firmware is released later */
3235
3236        err = b43_gpio_init(dev);
3237        if (err)
3238                goto out;       /* firmware is released later */
3239
3240        err = b43_upload_initvals(dev);
3241        if (err)
3242                goto err_gpio_clean;
3243
3244        err = b43_upload_initvals_band(dev);
3245        if (err)
3246                goto err_gpio_clean;
3247
3248        /* Turn the Analog on and initialize the PHY. */
3249        phy->ops->switch_analog(dev, 1);
3250        err = b43_phy_init(dev);
3251        if (err)
3252                goto err_gpio_clean;
3253
3254        /* Disable Interference Mitigation. */
3255        if (phy->ops->interf_mitigation)
3256                phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3257
3258        /* Select the antennae */
3259        if (phy->ops->set_rx_antenna)
3260                phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3261        b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3262
3263        if (phy->type == B43_PHYTYPE_B) {
3264                value16 = b43_read16(dev, 0x005E);
3265                value16 |= 0x0004;
3266                b43_write16(dev, 0x005E, value16);
3267        }
3268        b43_write32(dev, 0x0100, 0x01000000);
3269        if (dev->dev->core_rev < 5)
3270                b43_write32(dev, 0x010C, 0x01000000);
3271
3272        b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3273        b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3274
3275        /* Probe Response Timeout value */
3276        /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3277        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3278
3279        /* Initially set the wireless operation mode. */
3280        b43_adjust_opmode(dev);
3281
3282        if (dev->dev->core_rev < 3) {
3283                b43_write16(dev, 0x060E, 0x0000);
3284                b43_write16(dev, 0x0610, 0x8000);
3285                b43_write16(dev, 0x0604, 0x0000);
3286                b43_write16(dev, 0x0606, 0x0200);
3287        } else {
3288                b43_write32(dev, 0x0188, 0x80000000);
3289                b43_write32(dev, 0x018C, 0x02000000);
3290        }
3291        b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3292        b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3293        b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3294        b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3295        b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3296        b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3297        b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3298
3299        b43_mac_phy_clock_set(dev, true);
3300
3301        switch (dev->dev->bus_type) {
3302#ifdef CONFIG_B43_BCMA
3303        case B43_BUS_BCMA:
3304                /* FIXME: 0xE74 is quite common, but should be read from CC */
3305                b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3306                break;
3307#endif
3308#ifdef CONFIG_B43_SSB
3309        case B43_BUS_SSB:
3310                b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3311                            dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3312                break;
3313#endif
3314        }
3315
3316        err = 0;
3317        b43dbg(dev->wl, "Chip initialized\n");
3318out:
3319        return err;
3320
3321err_gpio_clean:
3322        b43_gpio_cleanup(dev);
3323        return err;
3324}
3325
3326static void b43_periodic_every60sec(struct b43_wldev *dev)
3327{
3328        const struct b43_phy_operations *ops = dev->phy.ops;
3329
3330        if (ops->pwork_60sec)
3331                ops->pwork_60sec(dev);
3332
3333        /* Force check the TX power emission now. */
3334        b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3335}
3336
3337static void b43_periodic_every30sec(struct b43_wldev *dev)
3338{
3339        /* Update device statistics. */
3340        b43_calculate_link_quality(dev);
3341}
3342
3343static void b43_periodic_every15sec(struct b43_wldev *dev)
3344{
3345        struct b43_phy *phy = &dev->phy;
3346        u16 wdr;
3347
3348        if (dev->fw.opensource) {
3349                /* Check if the firmware is still alive.
3350                 * It will reset the watchdog counter to 0 in its idle loop. */
3351                wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3352                if (unlikely(wdr)) {
3353                        b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3354                        b43_controller_restart(dev, "Firmware watchdog");
3355                        return;
3356                } else {
3357                        b43_shm_write16(dev, B43_SHM_SCRATCH,
3358                                        B43_WATCHDOG_REG, 1);
3359                }
3360        }
3361
3362        if (phy->ops->pwork_15sec)
3363                phy->ops->pwork_15sec(dev);
3364
3365        atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3366        wmb();
3367
3368#if B43_DEBUG
3369        if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3370                unsigned int i;
3371
3372                b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3373                       dev->irq_count / 15,
3374                       dev->tx_count / 15,
3375                       dev->rx_count / 15);
3376                dev->irq_count = 0;
3377                dev->tx_count = 0;
3378                dev->rx_count = 0;
3379                for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3380                        if (dev->irq_bit_count[i]) {
3381                                b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3382                                       dev->irq_bit_count[i] / 15, i, (1 << i));
3383                                dev->irq_bit_count[i] = 0;
3384                        }
3385                }
3386        }
3387#endif
3388}
3389
3390static void do_periodic_work(struct b43_wldev *dev)
3391{
3392        unsigned int state;
3393
3394        state = dev->periodic_state;
3395        if (state % 4 == 0)
3396                b43_periodic_every60sec(dev);
3397        if (state % 2 == 0)
3398                b43_periodic_every30sec(dev);
3399        b43_periodic_every15sec(dev);
3400}
3401
3402/* Periodic work locking policy:
3403 *      The whole periodic work handler is protected by
3404 *      wl->mutex. If another lock is needed somewhere in the
3405 *      pwork callchain, it's acquired in-place, where it's needed.
3406 */
3407static void b43_periodic_work_handler(struct work_struct *work)
3408{
3409        struct b43_wldev *dev = container_of(work, struct b43_wldev,
3410                                             periodic_work.work);
3411        struct b43_wl *wl = dev->wl;
3412        unsigned long delay;
3413
3414        mutex_lock(&wl->mutex);
3415
3416        if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3417                goto out;
3418        if (b43_debug(dev, B43_DBG_PWORK_STOP))
3419                goto out_requeue;
3420
3421        do_periodic_work(dev);
3422
3423        dev->periodic_state++;
3424out_requeue:
3425        if (b43_debug(dev, B43_DBG_PWORK_FAST))
3426                delay = msecs_to_jiffies(50);
3427        else
3428                delay = round_jiffies_relative(HZ * 15);
3429        ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3430out:
3431        mutex_unlock(&wl->mutex);
3432}
3433
3434static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3435{
3436        struct delayed_work *work = &dev->periodic_work;
3437
3438        dev->periodic_state = 0;
3439        INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3440        ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3441}
3442
3443/* Check if communication with the device works correctly. */
3444static int b43_validate_chipaccess(struct b43_wldev *dev)
3445{
3446        u32 v, backup0, backup4;
3447
3448        backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3449        backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3450
3451        /* Check for read/write and endianness problems. */
3452        b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3453        if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3454                goto error;
3455        b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3456        if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3457                goto error;
3458
3459        /* Check if unaligned 32bit SHM_SHARED access works properly.
3460         * However, don't bail out on failure, because it's noncritical. */
3461        b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3462        b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3463        b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3464        b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3465        if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3466                b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3467        b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3468        if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3469            b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3470            b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3471            b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3472                b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3473
3474        b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3475        b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3476
3477        if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3478                /* The 32bit register shadows the two 16bit registers
3479                 * with update sideeffects. Validate this. */
3480                b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3481                b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3482                if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3483                        goto error;
3484                if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3485                        goto error;
3486        }
3487        b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3488
3489        v = b43_read32(dev, B43_MMIO_MACCTL);
3490        v |= B43_MACCTL_GMODE;
3491        if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3492                goto error;
3493
3494        return 0;
3495error:
3496        b43err(dev->wl, "Failed to validate the chipaccess\n");
3497        return -ENODEV;
3498}
3499
3500static void b43_security_init(struct b43_wldev *dev)
3501{
3502        dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3503        /* KTP is a word address, but we address SHM bytewise.
3504         * So multiply by two.
3505         */
3506        dev->ktp *= 2;
3507        /* Number of RCMTA address slots */
3508        b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3509        /* Clear the key memory. */
3510        b43_clear_keys(dev);
3511}
3512
3513#ifdef CONFIG_B43_HWRNG
3514static int b43_rng_read(struct hwrng *rng, u32 *data)
3515{
3516        struct b43_wl *wl = (struct b43_wl *)rng->priv;
3517        struct b43_wldev *dev;
3518        int count = -ENODEV;
3519
3520        mutex_lock(&wl->mutex);
3521        dev = wl->current_dev;
3522        if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3523                *data = b43_read16(dev, B43_MMIO_RNG);
3524                count = sizeof(u16);
3525        }
3526        mutex_unlock(&wl->mutex);
3527
3528        return count;
3529}
3530#endif /* CONFIG_B43_HWRNG */
3531
3532static void b43_rng_exit(struct b43_wl *wl)
3533{
3534#ifdef CONFIG_B43_HWRNG
3535        if (wl->rng_initialized)
3536                hwrng_unregister(&wl->rng);
3537#endif /* CONFIG_B43_HWRNG */
3538}
3539
3540static int b43_rng_init(struct b43_wl *wl)
3541{
3542        int err = 0;
3543
3544#ifdef CONFIG_B43_HWRNG
3545        snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3546                 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3547        wl->rng.name = wl->rng_name;
3548        wl->rng.data_read = b43_rng_read;
3549        wl->rng.priv = (unsigned long)wl;
3550        wl->rng_initialized = true;
3551        err = hwrng_register(&wl->rng);
3552        if (err) {
3553                wl->rng_initialized = false;
3554                b43err(wl, "Failed to register the random "
3555                       "number generator (%d)\n", err);
3556        }
3557#endif /* CONFIG_B43_HWRNG */
3558
3559        return err;
3560}
3561
3562static void b43_tx_work(struct work_struct *work)
3563{
3564        struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3565        struct b43_wldev *dev;
3566        struct sk_buff *skb;
3567        int queue_num;
3568        int err = 0;
3569
3570        mutex_lock(&wl->mutex);
3571        dev = wl->current_dev;
3572        if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3573                mutex_unlock(&wl->mutex);
3574                return;
3575        }
3576
3577        for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3578                while (skb_queue_len(&wl->tx_queue[queue_num])) {
3579                        skb = skb_dequeue(&wl->tx_queue[queue_num]);
3580                        if (b43_using_pio_transfers(dev))
3581                                err = b43_pio_tx(dev, skb);
3582                        else
3583                                err = b43_dma_tx(dev, skb);
3584                        if (err == -ENOSPC) {
3585                                wl->tx_queue_stopped[queue_num] = 1;
3586                                ieee80211_stop_queue(wl->hw, queue_num);
3587                                skb_queue_head(&wl->tx_queue[queue_num], skb);
3588                                break;
3589                        }
3590                        if (unlikely(err))
3591                                ieee80211_free_txskb(wl->hw, skb);
3592                        err = 0;
3593                }
3594
3595                if (!err)
3596                        wl->tx_queue_stopped[queue_num] = 0;
3597        }
3598
3599#if B43_DEBUG
3600        dev->tx_count++;
3601#endif
3602        mutex_unlock(&wl->mutex);
3603}
3604
3605static void b43_op_tx(struct ieee80211_hw *hw,
3606                      struct ieee80211_tx_control *control,
3607                      struct sk_buff *skb)
3608{
3609        struct b43_wl *wl = hw_to_b43_wl(hw);
3610
3611        if (unlikely(skb->len < 2 + 2 + 6)) {
3612                /* Too short, this can't be a valid frame. */
3613                ieee80211_free_txskb(hw, skb);
3614                return;
3615        }
3616        B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3617
3618        skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3619        if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3620                ieee80211_queue_work(wl->hw, &wl->tx_work);
3621        } else {
3622                ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3623        }
3624}
3625
3626static void b43_qos_params_upload(struct b43_wldev *dev,
3627                                  const struct ieee80211_tx_queue_params *p,
3628                                  u16 shm_offset)
3629{
3630        u16 params[B43_NR_QOSPARAMS];
3631        int bslots, tmp;
3632        unsigned int i;
3633
3634        if (!dev->qos_enabled)
3635                return;
3636
3637        bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3638
3639        memset(&params, 0, sizeof(params));
3640
3641        params[B43_QOSPARAM_TXOP] = p->txop * 32;
3642        params[B43_QOSPARAM_CWMIN] = p->cw_min;
3643        params[B43_QOSPARAM_CWMAX] = p->cw_max;
3644        params[B43_QOSPARAM_CWCUR] = p->cw_min;
3645        params[B43_QOSPARAM_AIFS] = p->aifs;
3646        params[B43_QOSPARAM_BSLOTS] = bslots;
3647        params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3648
3649        for (i = 0; i < ARRAY_SIZE(params); i++) {
3650                if (i == B43_QOSPARAM_STATUS) {
3651                        tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3652                                             shm_offset + (i * 2));
3653                        /* Mark the parameters as updated. */
3654                        tmp |= 0x100;
3655                        b43_shm_write16(dev, B43_SHM_SHARED,
3656                                        shm_offset + (i * 2),
3657                                        tmp);
3658                } else {
3659                        b43_shm_write16(dev, B43_SHM_SHARED,
3660                                        shm_offset + (i * 2),
3661                                        params[i]);
3662                }
3663        }
3664}
3665
3666/* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3667static const u16 b43_qos_shm_offsets[] = {
3668        /* [mac80211-queue-nr] = SHM_OFFSET, */
3669        [0] = B43_QOS_VOICE,
3670        [1] = B43_QOS_VIDEO,
3671        [2] = B43_QOS_BESTEFFORT,
3672        [3] = B43_QOS_BACKGROUND,
3673};
3674
3675/* Update all QOS parameters in hardware. */
3676static void b43_qos_upload_all(struct b43_wldev *dev)
3677{
3678        struct b43_wl *wl = dev->wl;
3679        struct b43_qos_params *params;
3680        unsigned int i;
3681
3682        if (!dev->qos_enabled)
3683                return;
3684
3685        BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3686                     ARRAY_SIZE(wl->qos_params));
3687
3688        b43_mac_suspend(dev);
3689        for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3690                params = &(wl->qos_params[i]);
3691                b43_qos_params_upload(dev, &(params->p),
3692                                      b43_qos_shm_offsets[i]);
3693        }
3694        b43_mac_enable(dev);
3695}
3696
3697static void b43_qos_clear(struct b43_wl *wl)
3698{
3699        struct b43_qos_params *params;
3700        unsigned int i;
3701
3702        /* Initialize QoS parameters to sane defaults. */
3703
3704        BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3705                     ARRAY_SIZE(wl->qos_params));
3706
3707        for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3708                params = &(wl->qos_params[i]);
3709
3710                switch (b43_qos_shm_offsets[i]) {
3711                case B43_QOS_VOICE:
3712                        params->p.txop = 0;
3713                        params->p.aifs = 2;
3714                        params->p.cw_min = 0x0001;
3715                        params->p.cw_max = 0x0001;
3716                        break;
3717                case B43_QOS_VIDEO:
3718                        params->p.txop = 0;
3719                        params->p.aifs = 2;
3720                        params->p.cw_min = 0x0001;
3721                        params->p.cw_max = 0x0001;
3722                        break;
3723                case B43_QOS_BESTEFFORT:
3724                        params->p.txop = 0;
3725                        params->p.aifs = 3;
3726                        params->p.cw_min = 0x0001;
3727                        params->p.cw_max = 0x03FF;
3728                        break;
3729                case B43_QOS_BACKGROUND:
3730                        params->p.txop = 0;
3731                        params->p.aifs = 7;
3732                        params->p.cw_min = 0x0001;
3733                        params->p.cw_max = 0x03FF;
3734                        break;
3735                default:
3736                        B43_WARN_ON(1);
3737                }
3738        }
3739}
3740
3741/* Initialize the core's QOS capabilities */
3742static void b43_qos_init(struct b43_wldev *dev)
3743{
3744        if (!dev->qos_enabled) {
3745                /* Disable QOS support. */
3746                b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3747                b43_write16(dev, B43_MMIO_IFSCTL,
3748                            b43_read16(dev, B43_MMIO_IFSCTL)
3749                            & ~B43_MMIO_IFSCTL_USE_EDCF);
3750                b43dbg(dev->wl, "QoS disabled\n");
3751                return;
3752        }
3753
3754        /* Upload the current QOS parameters. */
3755        b43_qos_upload_all(dev);
3756
3757        /* Enable QOS support. */
3758        b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3759        b43_write16(dev, B43_MMIO_IFSCTL,
3760                    b43_read16(dev, B43_MMIO_IFSCTL)
3761                    | B43_MMIO_IFSCTL_USE_EDCF);
3762        b43dbg(dev->wl, "QoS enabled\n");
3763}
3764
3765static int b43_op_conf_tx(struct ieee80211_hw *hw,
3766                          struct ieee80211_vif *vif, u16 _queue,
3767                          const struct ieee80211_tx_queue_params *params)
3768{
3769        struct b43_wl *wl = hw_to_b43_wl(hw);
3770        struct b43_wldev *dev;
3771        unsigned int queue = (unsigned int)_queue;
3772        int err = -ENODEV;
3773
3774        if (queue >= ARRAY_SIZE(wl->qos_params)) {
3775                /* Queue not available or don't support setting
3776                 * params on this queue. Return success to not
3777                 * confuse mac80211. */
3778                return 0;
3779        }
3780        BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3781                     ARRAY_SIZE(wl->qos_params));
3782
3783        mutex_lock(&wl->mutex);
3784        dev = wl->current_dev;
3785        if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3786                goto out_unlock;
3787
3788        memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3789        b43_mac_suspend(dev);
3790        b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3791                              b43_qos_shm_offsets[queue]);
3792        b43_mac_enable(dev);
3793        err = 0;
3794
3795out_unlock:
3796        mutex_unlock(&wl->mutex);
3797
3798        return err;
3799}
3800
3801static int b43_op_get_stats(struct ieee80211_hw *hw,
3802                            struct ieee80211_low_level_stats *stats)
3803{
3804        struct b43_wl *wl = hw_to_b43_wl(hw);
3805
3806        mutex_lock(&wl->mutex);
3807        memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3808        mutex_unlock(&wl->mutex);
3809
3810        return 0;
3811}
3812
3813static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3814{
3815        struct b43_wl *wl = hw_to_b43_wl(hw);
3816        struct b43_wldev *dev;
3817        u64 tsf;
3818
3819        mutex_lock(&wl->mutex);
3820        dev = wl->current_dev;
3821
3822        if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3823                b43_tsf_read(dev, &tsf);
3824        else
3825                tsf = 0;
3826
3827        mutex_unlock(&wl->mutex);
3828
3829        return tsf;
3830}
3831
3832static void b43_op_set_tsf(struct ieee80211_hw *hw,
3833                           struct ieee80211_vif *vif, u64 tsf)
3834{
3835        struct b43_wl *wl = hw_to_b43_wl(hw);
3836        struct b43_wldev *dev;
3837
3838        mutex_lock(&wl->mutex);
3839        dev = wl->current_dev;
3840
3841        if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3842                b43_tsf_write(dev, tsf);
3843
3844        mutex_unlock(&wl->mutex);
3845}
3846
3847static const char *band_to_string(enum ieee80211_band band)
3848{
3849        switch (band) {
3850        case IEEE80211_BAND_5GHZ:
3851                return "5";
3852        case IEEE80211_BAND_2GHZ:
3853                return "2.4";
3854        default:
3855                break;
3856        }
3857        B43_WARN_ON(1);
3858        return "";
3859}
3860
3861/* Expects wl->mutex locked */
3862static int b43_switch_band(struct b43_wldev *dev,
3863                           struct ieee80211_channel *chan)
3864{
3865        struct b43_phy *phy = &dev->phy;
3866        bool gmode;
3867        u32 tmp;
3868
3869        switch (chan->band) {
3870        case IEEE80211_BAND_5GHZ:
3871                gmode = false;
3872                break;
3873        case IEEE80211_BAND_2GHZ:
3874                gmode = true;
3875                break;
3876        default:
3877                B43_WARN_ON(1);
3878                return -EINVAL;
3879        }
3880
3881        if (!((gmode && phy->supports_2ghz) ||
3882              (!gmode && phy->supports_5ghz))) {
3883                b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3884                       band_to_string(chan->band));
3885                return -ENODEV;
3886        }
3887
3888        if (!!phy->gmode == !!gmode) {
3889                /* This device is already running. */
3890                return 0;
3891        }
3892
3893        b43dbg(dev->wl, "Switching to %s GHz band\n",
3894               band_to_string(chan->band));
3895
3896        /* Some new devices don't need disabling radio for band switching */
3897        if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3898                b43_software_rfkill(dev, true);
3899
3900        phy->gmode = gmode;
3901        b43_phy_put_into_reset(dev);
3902        switch (dev->dev->bus_type) {
3903#ifdef CONFIG_B43_BCMA
3904        case B43_BUS_BCMA:
3905                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3906                if (gmode)
3907                        tmp |= B43_BCMA_IOCTL_GMODE;
3908                else
3909                        tmp &= ~B43_BCMA_IOCTL_GMODE;
3910                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3911                break;
3912#endif
3913#ifdef CONFIG_B43_SSB
3914        case B43_BUS_SSB:
3915                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3916                if (gmode)
3917                        tmp |= B43_TMSLOW_GMODE;
3918                else
3919                        tmp &= ~B43_TMSLOW_GMODE;
3920                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3921                break;
3922#endif
3923        }
3924        b43_phy_take_out_of_reset(dev);
3925
3926        b43_upload_initvals_band(dev);
3927
3928        b43_phy_init(dev);
3929
3930        return 0;
3931}
3932
3933static void b43_set_beacon_listen_interval(struct b43_wldev *dev, u16 interval)
3934{
3935        interval = min_t(u16, interval, (u16)0xFF);
3936        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BCN_LI, interval);
3937}
3938
3939/* Write the short and long frame retry limit values. */
3940static void b43_set_retry_limits(struct b43_wldev *dev,
3941                                 unsigned int short_retry,
3942                                 unsigned int long_retry)
3943{
3944        /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3945         * the chip-internal counter. */
3946        short_retry = min(short_retry, (unsigned int)0xF);
3947        long_retry = min(long_retry, (unsigned int)0xF);
3948
3949        b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3950                        short_retry);
3951        b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3952                        long_retry);
3953}
3954
3955static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3956{
3957        struct b43_wl *wl = hw_to_b43_wl(hw);
3958        struct b43_wldev *dev = wl->current_dev;
3959        struct b43_phy *phy = &dev->phy;
3960        struct ieee80211_conf *conf = &hw->conf;
3961        int antenna;
3962        int err = 0;
3963
3964        mutex_lock(&wl->mutex);
3965        b43_mac_suspend(dev);
3966
3967        if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL)
3968                b43_set_beacon_listen_interval(dev, conf->listen_interval);
3969
3970        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
3971                phy->chandef = &conf->chandef;
3972                phy->channel = conf->chandef.chan->hw_value;
3973
3974                /* Switch the band (if necessary). */
3975                err = b43_switch_band(dev, conf->chandef.chan);
3976                if (err)
3977                        goto out_mac_enable;
3978
3979                /* Switch to the requested channel.
3980                 * The firmware takes care of races with the TX handler.
3981                 */
3982                b43_switch_channel(dev, phy->channel);
3983        }
3984
3985        if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3986                b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3987                                          conf->long_frame_max_tx_count);
3988        changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3989        if (!changed)
3990                goto out_mac_enable;
3991
3992        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3993
3994        /* Adjust the desired TX power level. */
3995        if (conf->power_level != 0) {
3996                if (conf->power_level != phy->desired_txpower) {
3997                        phy->desired_txpower = conf->power_level;
3998                        b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3999                                                   B43_TXPWR_IGNORE_TSSI);
4000                }
4001        }
4002
4003        /* Antennas for RX and management frame TX. */
4004        antenna = B43_ANTENNA_DEFAULT;
4005        b43_mgmtframe_txantenna(dev, antenna);
4006        antenna = B43_ANTENNA_DEFAULT;
4007        if (phy->ops->set_rx_antenna)
4008                phy->ops->set_rx_antenna(dev, antenna);
4009
4010        if (wl->radio_enabled != phy->radio_on) {
4011                if (wl->radio_enabled) {
4012                        b43_software_rfkill(dev, false);
4013                        b43info(dev->wl, "Radio turned on by software\n");
4014                        if (!dev->radio_hw_enable) {
4015                                b43info(dev->wl, "The hardware RF-kill button "
4016                                        "still turns the radio physically off. "
4017                                        "Press the button to turn it on.\n");
4018                        }
4019                } else {
4020                        b43_software_rfkill(dev, true);
4021                        b43info(dev->wl, "Radio turned off by software\n");
4022                }
4023        }
4024
4025out_mac_enable:
4026        b43_mac_enable(dev);
4027        mutex_unlock(&wl->mutex);
4028
4029        return err;
4030}
4031
4032static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
4033{
4034        struct ieee80211_supported_band *sband =
4035                dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
4036        struct ieee80211_rate *rate;
4037        int i;
4038        u16 basic, direct, offset, basic_offset, rateptr;
4039
4040        for (i = 0; i < sband->n_bitrates; i++) {
4041                rate = &sband->bitrates[i];
4042
4043                if (b43_is_cck_rate(rate->hw_value)) {
4044                        direct = B43_SHM_SH_CCKDIRECT;
4045                        basic = B43_SHM_SH_CCKBASIC;
4046                        offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4047                        offset &= 0xF;
4048                } else {
4049                        direct = B43_SHM_SH_OFDMDIRECT;
4050                        basic = B43_SHM_SH_OFDMBASIC;
4051                        offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4052                        offset &= 0xF;
4053                }
4054
4055                rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4056
4057                if (b43_is_cck_rate(rate->hw_value)) {
4058                        basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4059                        basic_offset &= 0xF;
4060                } else {
4061                        basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4062                        basic_offset &= 0xF;
4063                }
4064
4065                /*
4066                 * Get the pointer that we need to point to
4067                 * from the direct map
4068                 */
4069                rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4070                                         direct + 2 * basic_offset);
4071                /* and write it to the basic map */
4072                b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4073                                rateptr);
4074        }
4075}
4076
4077static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4078                                    struct ieee80211_vif *vif,
4079                                    struct ieee80211_bss_conf *conf,
4080                                    u32 changed)
4081{
4082        struct b43_wl *wl = hw_to_b43_wl(hw);
4083        struct b43_wldev *dev;
4084
4085        mutex_lock(&wl->mutex);
4086
4087        dev = wl->current_dev;
4088        if (!dev || b43_status(dev) < B43_STAT_STARTED)
4089                goto out_unlock_mutex;
4090
4091        B43_WARN_ON(wl->vif != vif);
4092
4093        if (changed & BSS_CHANGED_BSSID) {
4094                if (conf->bssid)
4095                        memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4096                else
4097                        memset(wl->bssid, 0, ETH_ALEN);
4098        }
4099
4100        if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4101                if (changed & BSS_CHANGED_BEACON &&
4102                    (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4103                     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4104                     b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4105                        b43_update_templates(wl);
4106
4107                if (changed & BSS_CHANGED_BSSID)
4108                        b43_write_mac_bssid_templates(dev);
4109        }
4110
4111        b43_mac_suspend(dev);
4112
4113        /* Update templates for AP/mesh mode. */
4114        if (changed & BSS_CHANGED_BEACON_INT &&
4115            (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4116             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4117             b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4118            conf->beacon_int)
4119                b43_set_beacon_int(dev, conf->beacon_int);
4120
4121        if (changed & BSS_CHANGED_BASIC_RATES)
4122                b43_update_basic_rates(dev, conf->basic_rates);
4123
4124        if (changed & BSS_CHANGED_ERP_SLOT) {
4125                if (conf->use_short_slot)
4126                        b43_short_slot_timing_enable(dev);
4127                else
4128                        b43_short_slot_timing_disable(dev);
4129        }
4130
4131        b43_mac_enable(dev);
4132out_unlock_mutex:
4133        mutex_unlock(&wl->mutex);
4134}
4135
4136static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4137                          struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4138                          struct ieee80211_key_conf *key)
4139{
4140        struct b43_wl *wl = hw_to_b43_wl(hw);
4141        struct b43_wldev *dev;
4142        u8 algorithm;
4143        u8 index;
4144        int err;
4145        static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4146
4147        if (modparam_nohwcrypt)
4148                return -ENOSPC; /* User disabled HW-crypto */
4149
4150        if ((vif->type == NL80211_IFTYPE_ADHOC ||
4151             vif->type == NL80211_IFTYPE_MESH_POINT) &&
4152            (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4153             key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4154            !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4155                /*
4156                 * For now, disable hw crypto for the RSN IBSS group keys. This
4157                 * could be optimized in the future, but until that gets
4158                 * implemented, use of software crypto for group addressed
4159                 * frames is a acceptable to allow RSN IBSS to be used.
4160                 */
4161                return -EOPNOTSUPP;
4162        }
4163
4164        mutex_lock(&wl->mutex);
4165
4166        dev = wl->current_dev;
4167        err = -ENODEV;
4168        if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4169                goto out_unlock;
4170
4171        if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4172                /* We don't have firmware for the crypto engine.
4173                 * Must use software-crypto. */
4174                err = -EOPNOTSUPP;
4175                goto out_unlock;
4176        }
4177
4178        err = -EINVAL;
4179        switch (key->cipher) {
4180        case WLAN_CIPHER_SUITE_WEP40:
4181                algorithm = B43_SEC_ALGO_WEP40;
4182                break;
4183        case WLAN_CIPHER_SUITE_WEP104:
4184                algorithm = B43_SEC_ALGO_WEP104;
4185                break;
4186        case WLAN_CIPHER_SUITE_TKIP:
4187                algorithm = B43_SEC_ALGO_TKIP;
4188                break;
4189        case WLAN_CIPHER_SUITE_CCMP:
4190                algorithm = B43_SEC_ALGO_AES;
4191                break;
4192        default:
4193                B43_WARN_ON(1);
4194                goto out_unlock;
4195        }
4196        index = (u8) (key->keyidx);
4197        if (index > 3)
4198                goto out_unlock;
4199
4200        switch (cmd) {
4201        case SET_KEY:
4202                if (algorithm == B43_SEC_ALGO_TKIP &&
4203                    (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4204                    !modparam_hwtkip)) {
4205                        /* We support only pairwise key */
4206                        err = -EOPNOTSUPP;
4207                        goto out_unlock;
4208                }
4209
4210                if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4211                        if (WARN_ON(!sta)) {
4212                                err = -EOPNOTSUPP;
4213                                goto out_unlock;
4214                        }
4215                        /* Pairwise key with an assigned MAC address. */
4216                        err = b43_key_write(dev, -1, algorithm,
4217                                            key->key, key->keylen,
4218                                            sta->addr, key);
4219                } else {
4220                        /* Group key */
4221                        err = b43_key_write(dev, index, algorithm,
4222                                            key->key, key->keylen, NULL, key);
4223                }
4224                if (err)
4225                        goto out_unlock;
4226
4227                if (algorithm == B43_SEC_ALGO_WEP40 ||
4228                    algorithm == B43_SEC_ALGO_WEP104) {
4229                        b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4230                } else {
4231                        b43_hf_write(dev,
4232                                     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4233                }
4234                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4235                if (algorithm == B43_SEC_ALGO_TKIP)
4236                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4237                break;
4238        case DISABLE_KEY: {
4239                err = b43_key_clear(dev, key->hw_key_idx);
4240                if (err)
4241                        goto out_unlock;
4242                break;
4243        }
4244        default:
4245                B43_WARN_ON(1);
4246        }
4247
4248out_unlock:
4249        if (!err) {
4250                b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4251                       "mac: %pM\n",
4252                       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4253                       sta ? sta->addr : bcast_addr);
4254                b43_dump_keymemory(dev);
4255        }
4256        mutex_unlock(&wl->mutex);
4257
4258        return err;
4259}
4260
4261static void b43_op_configure_filter(struct ieee80211_hw *hw,
4262                                    unsigned int changed, unsigned int *fflags,
4263                                    u64 multicast)
4264{
4265        struct b43_wl *wl = hw_to_b43_wl(hw);
4266        struct b43_wldev *dev;
4267
4268        mutex_lock(&wl->mutex);
4269        dev = wl->current_dev;
4270        if (!dev) {
4271                *fflags = 0;
4272                goto out_unlock;
4273        }
4274
4275        *fflags &= FIF_PROMISC_IN_BSS |
4276                  FIF_ALLMULTI |
4277                  FIF_FCSFAIL |
4278                  FIF_PLCPFAIL |
4279                  FIF_CONTROL |
4280                  FIF_OTHER_BSS |
4281                  FIF_BCN_PRBRESP_PROMISC;
4282
4283        changed &= FIF_PROMISC_IN_BSS |
4284                   FIF_ALLMULTI |
4285                   FIF_FCSFAIL |
4286                   FIF_PLCPFAIL |
4287                   FIF_CONTROL |
4288                   FIF_OTHER_BSS |
4289                   FIF_BCN_PRBRESP_PROMISC;
4290
4291        wl->filter_flags = *fflags;
4292
4293        if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4294                b43_adjust_opmode(dev);
4295
4296out_unlock:
4297        mutex_unlock(&wl->mutex);
4298}
4299
4300/* Locking: wl->mutex
4301 * Returns the current dev. This might be different from the passed in dev,
4302 * because the core might be gone away while we unlocked the mutex. */
4303static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4304{
4305        struct b43_wl *wl;
4306        struct b43_wldev *orig_dev;
4307        u32 mask;
4308        int queue_num;
4309
4310        if (!dev)
4311                return NULL;
4312        wl = dev->wl;
4313redo:
4314        if (!dev || b43_status(dev) < B43_STAT_STARTED)
4315                return dev;
4316
4317        /* Cancel work. Unlock to avoid deadlocks. */
4318        mutex_unlock(&wl->mutex);
4319        cancel_delayed_work_sync(&dev->periodic_work);
4320        cancel_work_sync(&wl->tx_work);
4321        mutex_lock(&wl->mutex);
4322        dev = wl->current_dev;
4323        if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4324                /* Whoops, aliens ate up the device while we were unlocked. */
4325                return dev;
4326        }
4327
4328        /* Disable interrupts on the device. */
4329        b43_set_status(dev, B43_STAT_INITIALIZED);
4330        if (b43_bus_host_is_sdio(dev->dev)) {
4331                /* wl->mutex is locked. That is enough. */
4332                b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4333                b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4334        } else {
4335                spin_lock_irq(&wl->hardirq_lock);
4336                b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4337                b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4338                spin_unlock_irq(&wl->hardirq_lock);
4339        }
4340        /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4341        orig_dev = dev;
4342        mutex_unlock(&wl->mutex);
4343        if (b43_bus_host_is_sdio(dev->dev)) {
4344                b43_sdio_free_irq(dev);
4345        } else {
4346                synchronize_irq(dev->dev->irq);
4347                free_irq(dev->dev->irq, dev);
4348        }
4349        mutex_lock(&wl->mutex);
4350        dev = wl->current_dev;
4351        if (!dev)
4352                return dev;
4353        if (dev != orig_dev) {
4354                if (b43_status(dev) >= B43_STAT_STARTED)
4355                        goto redo;
4356                return dev;
4357        }
4358        mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4359        B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4360
4361        /* Drain all TX queues. */
4362        for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4363                while (skb_queue_len(&wl->tx_queue[queue_num])) {
4364                        struct sk_buff *skb;
4365
4366                        skb = skb_dequeue(&wl->tx_queue[queue_num]);
4367                        ieee80211_free_txskb(wl->hw, skb);
4368                }
4369        }
4370
4371        b43_mac_suspend(dev);
4372        b43_leds_exit(dev);
4373        b43dbg(wl, "Wireless interface stopped\n");
4374
4375        return dev;
4376}
4377
4378/* Locking: wl->mutex */
4379static int b43_wireless_core_start(struct b43_wldev *dev)
4380{
4381        int err;
4382
4383        B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4384
4385        drain_txstatus_queue(dev);
4386        if (b43_bus_host_is_sdio(dev->dev)) {
4387                err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4388                if (err) {
4389                        b43err(dev->wl, "Cannot request SDIO IRQ\n");
4390                        goto out;
4391                }
4392        } else {
4393                err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4394                                           b43_interrupt_thread_handler,
4395                                           IRQF_SHARED, KBUILD_MODNAME, dev);
4396                if (err) {
4397                        b43err(dev->wl, "Cannot request IRQ-%d\n",
4398                               dev->dev->irq);
4399                        goto out;
4400                }
4401        }
4402
4403        /* We are ready to run. */
4404        ieee80211_wake_queues(dev->wl->hw);
4405        b43_set_status(dev, B43_STAT_STARTED);
4406
4407        /* Start data flow (TX/RX). */
4408        b43_mac_enable(dev);
4409        b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4410
4411        /* Start maintenance work */
4412        b43_periodic_tasks_setup(dev);
4413
4414        b43_leds_init(dev);
4415
4416        b43dbg(dev->wl, "Wireless interface started\n");
4417out:
4418        return err;
4419}
4420
4421static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4422{
4423        switch (phy_type) {
4424        case B43_PHYTYPE_A:
4425                return "A";
4426        case B43_PHYTYPE_B:
4427                return "B";
4428        case B43_PHYTYPE_G:
4429                return "G";
4430        case B43_PHYTYPE_N:
4431                return "N";
4432        case B43_PHYTYPE_LP:
4433                return "LP";
4434        case B43_PHYTYPE_SSLPN:
4435                return "SSLPN";
4436        case B43_PHYTYPE_HT:
4437                return "HT";
4438        case B43_PHYTYPE_LCN:
4439                return "LCN";
4440        case B43_PHYTYPE_LCNXN:
4441                return "LCNXN";
4442        case B43_PHYTYPE_LCN40:
4443                return "LCN40";
4444        case B43_PHYTYPE_AC:
4445                return "AC";
4446        }
4447        return "UNKNOWN";
4448}
4449
4450/* Get PHY and RADIO versioning numbers */
4451static int b43_phy_versioning(struct b43_wldev *dev)
4452{
4453        struct b43_phy *phy = &dev->phy;
4454        const u8 core_rev = dev->dev->core_rev;
4455        u32 tmp;
4456        u8 analog_type;
4457        u8 phy_type;
4458        u8 phy_rev;
4459        u16 radio_manuf;
4460        u16 radio_id;
4461        u16 radio_rev;
4462        u8 radio_ver;
4463        int unsupported = 0;
4464
4465        /* Get PHY versioning */
4466        tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4467        analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4468        phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4469        phy_rev = (tmp & B43_PHYVER_VERSION);
4470
4471        /* LCNXN is continuation of N which run out of revisions */
4472        if (phy_type == B43_PHYTYPE_LCNXN) {
4473                phy_type = B43_PHYTYPE_N;
4474                phy_rev += 16;
4475        }
4476
4477        switch (phy_type) {
4478#ifdef CONFIG_B43_PHY_G
4479        case B43_PHYTYPE_G:
4480                if (phy_rev > 9)
4481                        unsupported = 1;
4482                break;
4483#endif
4484#ifdef CONFIG_B43_PHY_N
4485        case B43_PHYTYPE_N:
4486                if (phy_rev >= 19)
4487                        unsupported = 1;
4488                break;
4489#endif
4490#ifdef CONFIG_B43_PHY_LP
4491        case B43_PHYTYPE_LP:
4492                if (phy_rev > 2)
4493                        unsupported = 1;
4494                break;
4495#endif
4496#ifdef CONFIG_B43_PHY_HT
4497        case B43_PHYTYPE_HT:
4498                if (phy_rev > 1)
4499                        unsupported = 1;
4500                break;
4501#endif
4502#ifdef CONFIG_B43_PHY_LCN
4503        case B43_PHYTYPE_LCN:
4504                if (phy_rev > 1)
4505                        unsupported = 1;
4506                break;
4507#endif
4508        default:
4509                unsupported = 1;
4510        }
4511        if (unsupported) {
4512                b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4513                       analog_type, phy_type, b43_phy_name(dev, phy_type),
4514                       phy_rev);
4515                return -EOPNOTSUPP;
4516        }
4517        b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4518                analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4519
4520        /* Get RADIO versioning */
4521        if (core_rev == 40 || core_rev == 42) {
4522                radio_manuf = 0x17F;
4523
4524                b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 0);
4525                radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4526
4527                b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 1);
4528                radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4529
4530                radio_ver = 0; /* Is there version somewhere? */
4531        } else if (core_rev >= 24) {
4532                u16 radio24[3];
4533
4534                for (tmp = 0; tmp < 3; tmp++) {
4535                        b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4536                        radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4537                }
4538
4539                radio_manuf = 0x17F;
4540                radio_id = (radio24[2] << 8) | radio24[1];
4541                radio_rev = (radio24[0] & 0xF);
4542                radio_ver = (radio24[0] & 0xF0) >> 4;
4543        } else {
4544                if (dev->dev->chip_id == 0x4317) {
4545                        if (dev->dev->chip_rev == 0)
4546                                tmp = 0x3205017F;
4547                        else if (dev->dev->chip_rev == 1)
4548                                tmp = 0x4205017F;
4549                        else
4550                                tmp = 0x5205017F;
4551                } else {
4552                        b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4553                                     B43_RADIOCTL_ID);
4554                        tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4555                        b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4556                                     B43_RADIOCTL_ID);
4557                        tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4558                }
4559                radio_manuf = (tmp & 0x00000FFF);
4560                radio_id = (tmp & 0x0FFFF000) >> 12;
4561                radio_rev = (tmp & 0xF0000000) >> 28;
4562                radio_ver = 0; /* Probably not available on old hw */
4563        }
4564
4565        if (radio_manuf != 0x17F /* Broadcom */)
4566                unsupported = 1;
4567        switch (phy_type) {
4568        case B43_PHYTYPE_A:
4569                if (radio_id != 0x2060)
4570                        unsupported = 1;
4571                if (radio_rev != 1)
4572                        unsupported = 1;
4573                if (radio_manuf != 0x17F)
4574                        unsupported = 1;
4575                break;
4576        case B43_PHYTYPE_B:
4577                if ((radio_id & 0xFFF0) != 0x2050)
4578                        unsupported = 1;
4579                break;
4580        case B43_PHYTYPE_G:
4581                if (radio_id != 0x2050)
4582                        unsupported = 1;
4583                break;
4584        case B43_PHYTYPE_N:
4585                if (radio_id != 0x2055 && radio_id != 0x2056 &&
4586                    radio_id != 0x2057)
4587                        unsupported = 1;
4588                if (radio_id == 0x2057 &&
4589                    !(radio_rev == 9 || radio_rev == 14))
4590                        unsupported = 1;
4591                break;
4592        case B43_PHYTYPE_LP:
4593                if (radio_id != 0x2062 && radio_id != 0x2063)
4594                        unsupported = 1;
4595                break;
4596        case B43_PHYTYPE_HT:
4597                if (radio_id != 0x2059)
4598                        unsupported = 1;
4599                break;
4600        case B43_PHYTYPE_LCN:
4601                if (radio_id != 0x2064)
4602                        unsupported = 1;
4603                break;
4604        default:
4605                B43_WARN_ON(1);
4606        }
4607        if (unsupported) {
4608                b43err(dev->wl,
4609                       "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4610                       radio_manuf, radio_id, radio_rev, radio_ver);
4611                return -EOPNOTSUPP;
4612        }
4613        b43info(dev->wl,
4614                "Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4615                radio_manuf, radio_id, radio_rev, radio_ver);
4616
4617        /* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4618        phy->radio_manuf = radio_manuf;
4619        phy->radio_ver = radio_id;
4620        phy->radio_rev = radio_rev;
4621
4622        phy->analog = analog_type;
4623        phy->type = phy_type;
4624        phy->rev = phy_rev;
4625
4626        return 0;
4627}
4628
4629static void setup_struct_phy_for_init(struct b43_wldev *dev,
4630                                      struct b43_phy *phy)
4631{
4632        phy->hardware_power_control = !!modparam_hwpctl;
4633        phy->next_txpwr_check_time = jiffies;
4634        /* PHY TX errors counter. */
4635        atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4636
4637#if B43_DEBUG
4638        phy->phy_locked = false;
4639        phy->radio_locked = false;
4640#endif
4641}
4642
4643static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4644{
4645        dev->dfq_valid = false;
4646
4647        /* Assume the radio is enabled. If it's not enabled, the state will
4648         * immediately get fixed on the first periodic work run. */
4649        dev->radio_hw_enable = true;
4650
4651        /* Stats */
4652        memset(&dev->stats, 0, sizeof(dev->stats));
4653
4654        setup_struct_phy_for_init(dev, &dev->phy);
4655
4656        /* IRQ related flags */
4657        dev->irq_reason = 0;
4658        memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4659        dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4660        if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4661                dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4662
4663        dev->mac_suspended = 1;
4664
4665        /* Noise calculation context */
4666        memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4667}
4668
4669static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4670{
4671        struct ssb_sprom *sprom = dev->dev->bus_sprom;
4672        u64 hf;
4673
4674        if (!modparam_btcoex)
4675                return;
4676        if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4677                return;
4678        if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4679                return;
4680
4681        hf = b43_hf_read(dev);
4682        if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4683                hf |= B43_HF_BTCOEXALT;
4684        else
4685                hf |= B43_HF_BTCOEX;
4686        b43_hf_write(dev, hf);
4687}
4688
4689static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4690{
4691        if (!modparam_btcoex)
4692                return;
4693        //TODO
4694}
4695
4696static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4697{
4698        struct ssb_bus *bus;
4699        u32 tmp;
4700
4701#ifdef CONFIG_B43_SSB
4702        if (dev->dev->bus_type != B43_BUS_SSB)
4703                return;
4704#else
4705        return;
4706#endif
4707
4708        bus = dev->dev->sdev->bus;
4709
4710        if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4711            (bus->chip_id == 0x4312)) {
4712                tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4713                tmp &= ~SSB_IMCFGLO_REQTO;
4714                tmp &= ~SSB_IMCFGLO_SERTO;
4715                tmp |= 0x3;
4716                ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4717                ssb_commit_settings(bus);
4718        }
4719}
4720
4721static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4722{
4723        u16 pu_delay;
4724
4725        /* The time value is in microseconds. */
4726        if (dev->phy.type == B43_PHYTYPE_A)
4727                pu_delay = 3700;
4728        else
4729                pu_delay = 1050;
4730        if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4731                pu_delay = 500;
4732        if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4733                pu_delay = max(pu_delay, (u16)2400);
4734
4735        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4736}
4737
4738/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4739static void b43_set_pretbtt(struct b43_wldev *dev)
4740{
4741        u16 pretbtt;
4742
4743        /* The time value is in microseconds. */
4744        if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4745                pretbtt = 2;
4746        } else {
4747                if (dev->phy.type == B43_PHYTYPE_A)
4748                        pretbtt = 120;
4749                else
4750                        pretbtt = 250;
4751        }
4752        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4753        b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4754}
4755
4756/* Shutdown a wireless core */
4757/* Locking: wl->mutex */
4758static void b43_wireless_core_exit(struct b43_wldev *dev)
4759{
4760        B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4761        if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4762                return;
4763
4764        b43_set_status(dev, B43_STAT_UNINIT);
4765
4766        /* Stop the microcode PSM. */
4767        b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4768                      B43_MACCTL_PSM_JMP0);
4769
4770        switch (dev->dev->bus_type) {
4771#ifdef CONFIG_B43_BCMA
4772        case B43_BUS_BCMA:
4773                bcma_core_pci_down(dev->dev->bdev->bus);
4774                break;
4775#endif
4776#ifdef CONFIG_B43_SSB
4777        case B43_BUS_SSB:
4778                /* TODO */
4779                break;
4780#endif
4781        }
4782
4783        b43_dma_free(dev);
4784        b43_pio_free(dev);
4785        b43_chip_exit(dev);
4786        dev->phy.ops->switch_analog(dev, 0);
4787        if (dev->wl->current_beacon) {
4788                dev_kfree_skb_any(dev->wl->current_beacon);
4789                dev->wl->current_beacon = NULL;
4790        }
4791
4792        b43_device_disable(dev, 0);
4793        b43_bus_may_powerdown(dev);
4794}
4795
4796/* Initialize a wireless core */
4797static int b43_wireless_core_init(struct b43_wldev *dev)
4798{
4799        struct ssb_sprom *sprom = dev->dev->bus_sprom;
4800        struct b43_phy *phy = &dev->phy;
4801        int err;
4802        u64 hf;
4803
4804        B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4805
4806        err = b43_bus_powerup(dev, 0);
4807        if (err)
4808                goto out;
4809        if (!b43_device_is_enabled(dev))
4810                b43_wireless_core_reset(dev, phy->gmode);
4811
4812        /* Reset all data structures. */
4813        setup_struct_wldev_for_init(dev);
4814        phy->ops->prepare_structs(dev);
4815
4816        /* Enable IRQ routing to this device. */
4817        switch (dev->dev->bus_type) {
4818#ifdef CONFIG_B43_BCMA
4819        case B43_BUS_BCMA:
4820                bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci[0],
4821                                      dev->dev->bdev, true);
4822                bcma_core_pci_up(dev->dev->bdev->bus);
4823                break;
4824#endif
4825#ifdef CONFIG_B43_SSB
4826        case B43_BUS_SSB:
4827                ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4828                                               dev->dev->sdev);
4829                break;
4830#endif
4831        }
4832
4833        b43_imcfglo_timeouts_workaround(dev);
4834        b43_bluetooth_coext_disable(dev);
4835        if (phy->ops->prepare_hardware) {
4836                err = phy->ops->prepare_hardware(dev);
4837                if (err)
4838                        goto err_busdown;
4839        }
4840        err = b43_chip_init(dev);
4841        if (err)
4842                goto err_busdown;
4843        b43_shm_write16(dev, B43_SHM_SHARED,
4844                        B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4845        hf = b43_hf_read(dev);
4846        if (phy->type == B43_PHYTYPE_G) {
4847                hf |= B43_HF_SYMW;
4848                if (phy->rev == 1)
4849                        hf |= B43_HF_GDCW;
4850                if (sprom->boardflags_lo & B43_BFL_PACTRL)
4851                        hf |= B43_HF_OFDMPABOOST;
4852        }
4853        if (phy->radio_ver == 0x2050) {
4854                if (phy->radio_rev == 6)
4855                        hf |= B43_HF_4318TSSI;
4856                if (phy->radio_rev < 6)
4857                        hf |= B43_HF_VCORECALC;
4858        }
4859        if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4860                hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4861#if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4862        if (dev->dev->bus_type == B43_BUS_SSB &&
4863            dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4864            dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4865                hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4866#endif
4867        hf &= ~B43_HF_SKCFPUP;
4868        b43_hf_write(dev, hf);
4869
4870        /* tell the ucode MAC capabilities */
4871        if (dev->dev->core_rev >= 13) {
4872                u32 mac_hw_cap = b43_read32(dev, B43_MMIO_MAC_HW_CAP);
4873
4874                b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_L,
4875                                mac_hw_cap & 0xffff);
4876                b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_H,
4877                                (mac_hw_cap >> 16) & 0xffff);
4878        }
4879
4880        b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4881                             B43_DEFAULT_LONG_RETRY_LIMIT);
4882        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4883        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4884
4885        /* Disable sending probe responses from firmware.
4886         * Setting the MaxTime to one usec will always trigger
4887         * a timeout, so we never send any probe resp.
4888         * A timeout of zero is infinite. */
4889        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4890
4891        b43_rate_memory_init(dev);
4892        b43_set_phytxctl_defaults(dev);
4893
4894        /* Minimum Contention Window */
4895        if (phy->type == B43_PHYTYPE_B)
4896                b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4897        else
4898                b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4899        /* Maximum Contention Window */
4900        b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4901
4902        /* write phytype and phyvers */
4903        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYTYPE, phy->type);
4904        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYVER, phy->rev);
4905
4906        if (b43_bus_host_is_pcmcia(dev->dev) ||
4907            b43_bus_host_is_sdio(dev->dev)) {
4908                dev->__using_pio_transfers = true;
4909                err = b43_pio_init(dev);
4910        } else if (dev->use_pio) {
4911                b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4912                        "This should not be needed and will result in lower "
4913                        "performance.\n");
4914                dev->__using_pio_transfers = true;
4915                err = b43_pio_init(dev);
4916        } else {
4917                dev->__using_pio_transfers = false;
4918                err = b43_dma_init(dev);
4919        }
4920        if (err)
4921                goto err_chip_exit;
4922        b43_qos_init(dev);
4923        b43_set_synth_pu_delay(dev, 1);
4924        b43_bluetooth_coext_enable(dev);
4925
4926        b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4927        b43_upload_card_macaddress(dev);
4928        b43_security_init(dev);
4929
4930        ieee80211_wake_queues(dev->wl->hw);
4931
4932        b43_set_status(dev, B43_STAT_INITIALIZED);
4933
4934out:
4935        return err;
4936
4937err_chip_exit:
4938        b43_chip_exit(dev);
4939err_busdown:
4940        b43_bus_may_powerdown(dev);
4941        B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4942        return err;
4943}
4944
4945static int b43_op_add_interface(struct ieee80211_hw *hw,
4946                                struct ieee80211_vif *vif)
4947{
4948        struct b43_wl *wl = hw_to_b43_wl(hw);
4949        struct b43_wldev *dev;
4950        int err = -EOPNOTSUPP;
4951
4952        /* TODO: allow WDS/AP devices to coexist */
4953
4954        if (vif->type != NL80211_IFTYPE_AP &&
4955            vif->type != NL80211_IFTYPE_MESH_POINT &&
4956            vif->type != NL80211_IFTYPE_STATION &&
4957            vif->type != NL80211_IFTYPE_WDS &&
4958            vif->type != NL80211_IFTYPE_ADHOC)
4959                return -EOPNOTSUPP;
4960
4961        mutex_lock(&wl->mutex);
4962        if (wl->operating)
4963                goto out_mutex_unlock;
4964
4965        b43dbg(wl, "Adding Interface type %d\n", vif->type);
4966
4967        dev = wl->current_dev;
4968        wl->operating = true;
4969        wl->vif = vif;
4970        wl->if_type = vif->type;
4971        memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4972
4973        b43_adjust_opmode(dev);
4974        b43_set_pretbtt(dev);
4975        b43_set_synth_pu_delay(dev, 0);
4976        b43_upload_card_macaddress(dev);
4977
4978        err = 0;
4979 out_mutex_unlock:
4980        mutex_unlock(&wl->mutex);
4981
4982        if (err == 0)
4983                b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
4984
4985        return err;
4986}
4987
4988static void b43_op_remove_interface(struct ieee80211_hw *hw,
4989                                    struct ieee80211_vif *vif)
4990{
4991        struct b43_wl *wl = hw_to_b43_wl(hw);
4992        struct b43_wldev *dev = wl->current_dev;
4993
4994        b43dbg(wl, "Removing Interface type %d\n", vif->type);
4995
4996        mutex_lock(&wl->mutex);
4997
4998        B43_WARN_ON(!wl->operating);
4999        B43_WARN_ON(wl->vif != vif);
5000        wl->vif = NULL;
5001
5002        wl->operating = false;
5003
5004        b43_adjust_opmode(dev);
5005        memset(wl->mac_addr, 0, ETH_ALEN);
5006        b43_upload_card_macaddress(dev);
5007
5008        mutex_unlock(&wl->mutex);
5009}
5010
5011static int b43_op_start(struct ieee80211_hw *hw)
5012{
5013        struct b43_wl *wl = hw_to_b43_wl(hw);
5014        struct b43_wldev *dev = wl->current_dev;
5015        int did_init = 0;
5016        int err = 0;
5017
5018        /* Kill all old instance specific information to make sure
5019         * the card won't use it in the short timeframe between start
5020         * and mac80211 reconfiguring it. */
5021        memset(wl->bssid, 0, ETH_ALEN);
5022        memset(wl->mac_addr, 0, ETH_ALEN);
5023        wl->filter_flags = 0;
5024        wl->radiotap_enabled = false;
5025        b43_qos_clear(wl);
5026        wl->beacon0_uploaded = false;
5027        wl->beacon1_uploaded = false;
5028        wl->beacon_templates_virgin = true;
5029        wl->radio_enabled = true;
5030
5031        mutex_lock(&wl->mutex);
5032
5033        if (b43_status(dev) < B43_STAT_INITIALIZED) {
5034                err = b43_wireless_core_init(dev);
5035                if (err)
5036                        goto out_mutex_unlock;
5037                did_init = 1;
5038        }
5039
5040        if (b43_status(dev) < B43_STAT_STARTED) {
5041                err = b43_wireless_core_start(dev);
5042                if (err) {
5043                        if (did_init)
5044                                b43_wireless_core_exit(dev);
5045                        goto out_mutex_unlock;
5046                }
5047        }
5048
5049        /* XXX: only do if device doesn't support rfkill irq */
5050        wiphy_rfkill_start_polling(hw->wiphy);
5051
5052 out_mutex_unlock:
5053        mutex_unlock(&wl->mutex);
5054
5055        /*
5056         * Configuration may have been overwritten during initialization.
5057         * Reload the configuration, but only if initialization was
5058         * successful. Reloading the configuration after a failed init
5059         * may hang the system.
5060         */
5061        if (!err)
5062                b43_op_config(hw, ~0);
5063
5064        return err;
5065}
5066
5067static void b43_op_stop(struct ieee80211_hw *hw)
5068{
5069        struct b43_wl *wl = hw_to_b43_wl(hw);
5070        struct b43_wldev *dev = wl->current_dev;
5071
5072        cancel_work_sync(&(wl->beacon_update_trigger));
5073
5074        if (!dev)
5075                goto out;
5076
5077        mutex_lock(&wl->mutex);
5078        if (b43_status(dev) >= B43_STAT_STARTED) {
5079                dev = b43_wireless_core_stop(dev);
5080                if (!dev)
5081                        goto out_unlock;
5082        }
5083        b43_wireless_core_exit(dev);
5084        wl->radio_enabled = false;
5085
5086out_unlock:
5087        mutex_unlock(&wl->mutex);
5088out:
5089        cancel_work_sync(&(wl->txpower_adjust_work));
5090}
5091
5092static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5093                                 struct ieee80211_sta *sta, bool set)
5094{
5095        struct b43_wl *wl = hw_to_b43_wl(hw);
5096
5097        /* FIXME: add locking */
5098        b43_update_templates(wl);
5099
5100        return 0;
5101}
5102
5103static void b43_op_sta_notify(struct ieee80211_hw *hw,
5104                              struct ieee80211_vif *vif,
5105                              enum sta_notify_cmd notify_cmd,
5106                              struct ieee80211_sta *sta)
5107{
5108        struct b43_wl *wl = hw_to_b43_wl(hw);
5109
5110        B43_WARN_ON(!vif || wl->vif != vif);
5111}
5112
5113static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
5114{
5115        struct b43_wl *wl = hw_to_b43_wl(hw);
5116        struct b43_wldev *dev;
5117
5118        mutex_lock(&wl->mutex);
5119        dev = wl->current_dev;
5120        if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5121                /* Disable CFP update during scan on other channels. */
5122                b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5123        }
5124        mutex_unlock(&wl->mutex);
5125}
5126
5127static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
5128{
5129        struct b43_wl *wl = hw_to_b43_wl(hw);
5130        struct b43_wldev *dev;
5131
5132        mutex_lock(&wl->mutex);
5133        dev = wl->current_dev;
5134        if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5135                /* Re-enable CFP update. */
5136                b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5137        }
5138        mutex_unlock(&wl->mutex);
5139}
5140
5141static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5142                             struct survey_info *survey)
5143{
5144        struct b43_wl *wl = hw_to_b43_wl(hw);
5145        struct b43_wldev *dev = wl->current_dev;
5146        struct ieee80211_conf *conf = &hw->conf;
5147
5148        if (idx != 0)
5149                return -ENOENT;
5150
5151        survey->channel = conf->chandef.chan;
5152        survey->filled = SURVEY_INFO_NOISE_DBM;
5153        survey->noise = dev->stats.link_noise;
5154
5155        return 0;
5156}
5157
5158static const struct ieee80211_ops b43_hw_ops = {
5159        .tx                     = b43_op_tx,
5160        .conf_tx                = b43_op_conf_tx,
5161        .add_interface          = b43_op_add_interface,
5162        .remove_interface       = b43_op_remove_interface,
5163        .config                 = b43_op_config,
5164        .bss_info_changed       = b43_op_bss_info_changed,
5165        .configure_filter       = b43_op_configure_filter,
5166        .set_key                = b43_op_set_key,
5167        .update_tkip_key        = b43_op_update_tkip_key,
5168        .get_stats              = b43_op_get_stats,
5169        .get_tsf                = b43_op_get_tsf,
5170        .set_tsf                = b43_op_set_tsf,
5171        .start                  = b43_op_start,
5172        .stop                   = b43_op_stop,
5173        .set_tim                = b43_op_beacon_set_tim,
5174        .sta_notify             = b43_op_sta_notify,
5175        .sw_scan_start          = b43_op_sw_scan_start_notifier,
5176        .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
5177        .get_survey             = b43_op_get_survey,
5178        .rfkill_poll            = b43_rfkill_poll,
5179};
5180
5181/* Hard-reset the chip. Do not call this directly.
5182 * Use b43_controller_restart()
5183 */
5184static void b43_chip_reset(struct work_struct *work)
5185{
5186        struct b43_wldev *dev =
5187            container_of(work, struct b43_wldev, restart_work);
5188        struct b43_wl *wl = dev->wl;
5189        int err = 0;
5190        int prev_status;
5191
5192        mutex_lock(&wl->mutex);
5193
5194        prev_status = b43_status(dev);
5195        /* Bring the device down... */
5196        if (prev_status >= B43_STAT_STARTED) {
5197                dev = b43_wireless_core_stop(dev);
5198                if (!dev) {
5199                        err = -ENODEV;
5200                        goto out;
5201                }
5202        }
5203        if (prev_status >= B43_STAT_INITIALIZED)
5204                b43_wireless_core_exit(dev);
5205
5206        /* ...and up again. */
5207        if (prev_status >= B43_STAT_INITIALIZED) {
5208                err = b43_wireless_core_init(dev);
5209                if (err)
5210                        goto out;
5211        }
5212        if (prev_status >= B43_STAT_STARTED) {
5213                err = b43_wireless_core_start(dev);
5214                if (err) {
5215                        b43_wireless_core_exit(dev);
5216                        goto out;
5217                }
5218        }
5219out:
5220        if (err)
5221                wl->current_dev = NULL; /* Failed to init the dev. */
5222        mutex_unlock(&wl->mutex);
5223
5224        if (err) {
5225                b43err(wl, "Controller restart FAILED\n");
5226                return;
5227        }
5228
5229        /* reload configuration */
5230        b43_op_config(wl->hw, ~0);
5231        if (wl->vif)
5232                b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5233
5234        b43info(wl, "Controller restarted\n");
5235}
5236
5237static int b43_setup_bands(struct b43_wldev *dev,
5238                           bool have_2ghz_phy, bool have_5ghz_phy)
5239{
5240        struct ieee80211_hw *hw = dev->wl->hw;
5241        struct b43_phy *phy = &dev->phy;
5242        bool limited_2g;
5243        bool limited_5g;
5244
5245        /* We don't support all 2 GHz channels on some devices */
5246        limited_2g = phy->radio_ver == 0x2057 &&
5247                     (phy->radio_rev == 9 || phy->radio_rev == 14);
5248        limited_5g = phy->radio_ver == 0x2057 &&
5249                     phy->radio_rev == 9;
5250
5251        if (have_2ghz_phy)
5252                hw->wiphy->bands[IEEE80211_BAND_2GHZ] = limited_2g ?
5253                        &b43_band_2ghz_limited : &b43_band_2GHz;
5254        if (dev->phy.type == B43_PHYTYPE_N) {
5255                if (have_5ghz_phy)
5256                        hw->wiphy->bands[IEEE80211_BAND_5GHZ] = limited_5g ?
5257                                &b43_band_5GHz_nphy_limited :
5258                                &b43_band_5GHz_nphy;
5259        } else {
5260                if (have_5ghz_phy)
5261                        hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5262        }
5263
5264        dev->phy.supports_2ghz = have_2ghz_phy;
5265        dev->phy.supports_5ghz = have_5ghz_phy;
5266
5267        return 0;
5268}
5269
5270static void b43_wireless_core_detach(struct b43_wldev *dev)
5271{
5272        /* We release firmware that late to not be required to re-request
5273         * is all the time when we reinit the core. */
5274        b43_release_firmware(dev);
5275        b43_phy_free(dev);
5276}
5277
5278static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5279                                bool *have_5ghz_phy)
5280{
5281        u16 dev_id = 0;
5282
5283#ifdef CONFIG_B43_BCMA
5284        if (dev->dev->bus_type == B43_BUS_BCMA &&
5285            dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5286                dev_id = dev->dev->bdev->bus->host_pci->device;
5287#endif
5288#ifdef CONFIG_B43_SSB
5289        if (dev->dev->bus_type == B43_BUS_SSB &&
5290            dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5291                dev_id = dev->dev->sdev->bus->host_pci->device;
5292#endif
5293        /* Override with SPROM value if available */
5294        if (dev->dev->bus_sprom->dev_id)
5295                dev_id = dev->dev->bus_sprom->dev_id;
5296
5297        /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5298        switch (dev_id) {
5299        case 0x4324: /* BCM4306 */
5300        case 0x4312: /* BCM4311 */
5301        case 0x4319: /* BCM4318 */
5302        case 0x4328: /* BCM4321 */
5303        case 0x432b: /* BCM4322 */
5304        case 0x4350: /* BCM43222 */
5305        case 0x4353: /* BCM43224 */
5306        case 0x0576: /* BCM43224 */
5307        case 0x435f: /* BCM6362 */
5308        case 0x4331: /* BCM4331 */
5309        case 0x4359: /* BCM43228 */
5310        case 0x43a0: /* BCM4360 */
5311        case 0x43b1: /* BCM4352 */
5312                /* Dual band devices */
5313                *have_2ghz_phy = true;
5314                *have_5ghz_phy = true;
5315                return;
5316        case 0x4321: /* BCM4306 */
5317        case 0x4313: /* BCM4311 */
5318        case 0x431a: /* BCM4318 */
5319        case 0x432a: /* BCM4321 */
5320        case 0x432d: /* BCM4322 */
5321        case 0x4352: /* BCM43222 */
5322        case 0x4333: /* BCM4331 */
5323        case 0x43a2: /* BCM4360 */
5324        case 0x43b3: /* BCM4352 */
5325                /* 5 GHz only devices */
5326                *have_2ghz_phy = false;
5327                *have_5ghz_phy = true;
5328                return;
5329        }
5330
5331        /* As a fallback, try to guess using PHY type */
5332        switch (dev->phy.type) {
5333        case B43_PHYTYPE_A:
5334                *have_2ghz_phy = false;
5335                *have_5ghz_phy = true;
5336                return;
5337        case B43_PHYTYPE_G:
5338        case B43_PHYTYPE_N:
5339        case B43_PHYTYPE_LP:
5340        case B43_PHYTYPE_HT:
5341        case B43_PHYTYPE_LCN:
5342                *have_2ghz_phy = true;
5343                *have_5ghz_phy = false;
5344                return;
5345        }
5346
5347        B43_WARN_ON(1);
5348}
5349
5350static int b43_wireless_core_attach(struct b43_wldev *dev)
5351{
5352        struct b43_wl *wl = dev->wl;
5353        struct b43_phy *phy = &dev->phy;
5354        int err;
5355        u32 tmp;
5356        bool have_2ghz_phy = false, have_5ghz_phy = false;
5357
5358        /* Do NOT do any device initialization here.
5359         * Do it in wireless_core_init() instead.
5360         * This function is for gathering basic information about the HW, only.
5361         * Also some structs may be set up here. But most likely you want to have
5362         * that in core_init(), too.
5363         */
5364
5365        err = b43_bus_powerup(dev, 0);
5366        if (err) {
5367                b43err(wl, "Bus powerup failed\n");
5368                goto out;
5369        }
5370
5371        phy->do_full_init = true;
5372
5373        /* Try to guess supported bands for the first init needs */
5374        switch (dev->dev->bus_type) {
5375#ifdef CONFIG_B43_BCMA
5376        case B43_BUS_BCMA:
5377                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5378                have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5379                have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5380                break;
5381#endif
5382#ifdef CONFIG_B43_SSB
5383        case B43_BUS_SSB:
5384                if (dev->dev->core_rev >= 5) {
5385                        tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5386                        have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5387                        have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5388                } else
5389                        B43_WARN_ON(1);
5390                break;
5391#endif
5392        }
5393
5394        dev->phy.gmode = have_2ghz_phy;
5395        b43_wireless_core_reset(dev, dev->phy.gmode);
5396
5397        /* Get the PHY type. */
5398        err = b43_phy_versioning(dev);
5399        if (err)
5400                goto err_powerdown;
5401
5402        /* Get real info about supported bands */
5403        b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5404
5405        /* We don't support 5 GHz on some PHYs yet */
5406        if (have_5ghz_phy) {
5407                switch (dev->phy.type) {
5408                case B43_PHYTYPE_A:
5409                case B43_PHYTYPE_G:
5410                case B43_PHYTYPE_LP:
5411                case B43_PHYTYPE_HT:
5412                        b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5413                        have_5ghz_phy = false;
5414                }
5415        }
5416
5417        if (!have_2ghz_phy && !have_5ghz_phy) {
5418                b43err(wl, "b43 can't support any band on this device\n");
5419                err = -EOPNOTSUPP;
5420                goto err_powerdown;
5421        }
5422
5423        err = b43_phy_allocate(dev);
5424        if (err)
5425                goto err_powerdown;
5426
5427        dev->phy.gmode = have_2ghz_phy;
5428        b43_wireless_core_reset(dev, dev->phy.gmode);
5429
5430        err = b43_validate_chipaccess(dev);
5431        if (err)
5432                goto err_phy_free;
5433        err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5434        if (err)
5435                goto err_phy_free;
5436
5437        /* Now set some default "current_dev" */
5438        if (!wl->current_dev)
5439                wl->current_dev = dev;
5440        INIT_WORK(&dev->restart_work, b43_chip_reset);
5441
5442        dev->phy.ops->switch_analog(dev, 0);
5443        b43_device_disable(dev, 0);
5444        b43_bus_may_powerdown(dev);
5445
5446out:
5447        return err;
5448
5449err_phy_free:
5450        b43_phy_free(dev);
5451err_powerdown:
5452        b43_bus_may_powerdown(dev);
5453        return err;
5454}
5455
5456static void b43_one_core_detach(struct b43_bus_dev *dev)
5457{
5458        struct b43_wldev *wldev;
5459        struct b43_wl *wl;
5460
5461        /* Do not cancel ieee80211-workqueue based work here.
5462         * See comment in b43_remove(). */
5463
5464        wldev = b43_bus_get_wldev(dev);
5465        wl = wldev->wl;
5466        b43_debugfs_remove_device(wldev);
5467        b43_wireless_core_detach(wldev);
5468        list_del(&wldev->list);
5469        b43_bus_set_wldev(dev, NULL);
5470        kfree(wldev);
5471}
5472
5473static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5474{
5475        struct b43_wldev *wldev;
5476        int err = -ENOMEM;
5477
5478        wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5479        if (!wldev)
5480                goto out;
5481
5482        wldev->use_pio = b43_modparam_pio;
5483        wldev->dev = dev;
5484        wldev->wl = wl;
5485        b43_set_status(wldev, B43_STAT_UNINIT);
5486        wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5487        INIT_LIST_HEAD(&wldev->list);
5488
5489        err = b43_wireless_core_attach(wldev);
5490        if (err)
5491                goto err_kfree_wldev;
5492
5493        b43_bus_set_wldev(dev, wldev);
5494        b43_debugfs_add_device(wldev);
5495
5496      out:
5497        return err;
5498
5499      err_kfree_wldev:
5500        kfree(wldev);
5501        return err;
5502}
5503
5504#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5505        (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5506        (pdev->device == _device) &&                                    \
5507        (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5508        (pdev->subsystem_device == _subdevice)                          )
5509
5510#ifdef CONFIG_B43_SSB
5511static void b43_sprom_fixup(struct ssb_bus *bus)
5512{
5513        struct pci_dev *pdev;
5514
5515        /* boardflags workarounds */
5516        if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5517            bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5518                bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5519        if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5520            bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5521                bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5522        if (bus->bustype == SSB_BUSTYPE_PCI) {
5523                pdev = bus->host_pci;
5524                if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5525                    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5526                    IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5527                    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5528                    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5529                    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5530                    IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5531                        bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5532        }
5533}
5534
5535static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5536{
5537        struct ieee80211_hw *hw = wl->hw;
5538
5539        ssb_set_devtypedata(dev->sdev, NULL);
5540        ieee80211_free_hw(hw);
5541}
5542#endif
5543
5544static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5545{
5546        struct ssb_sprom *sprom = dev->bus_sprom;
5547        struct ieee80211_hw *hw;
5548        struct b43_wl *wl;
5549        char chip_name[6];
5550        int queue_num;
5551
5552        hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5553        if (!hw) {
5554                b43err(NULL, "Could not allocate ieee80211 device\n");
5555                return ERR_PTR(-ENOMEM);
5556        }
5557        wl = hw_to_b43_wl(hw);
5558
5559        /* fill hw info */
5560        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5561                    IEEE80211_HW_SIGNAL_DBM;
5562
5563        hw->wiphy->interface_modes =
5564                BIT(NL80211_IFTYPE_AP) |
5565                BIT(NL80211_IFTYPE_MESH_POINT) |
5566                BIT(NL80211_IFTYPE_STATION) |
5567                BIT(NL80211_IFTYPE_WDS) |
5568                BIT(NL80211_IFTYPE_ADHOC);
5569
5570        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5571
5572        wl->hw_registred = false;
5573        hw->max_rates = 2;
5574        SET_IEEE80211_DEV(hw, dev->dev);
5575        if (is_valid_ether_addr(sprom->et1mac))
5576                SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5577        else
5578                SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5579
5580        /* Initialize struct b43_wl */
5581        wl->hw = hw;
5582        mutex_init(&wl->mutex);
5583        spin_lock_init(&wl->hardirq_lock);
5584        INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5585        INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5586        INIT_WORK(&wl->tx_work, b43_tx_work);
5587
5588        /* Initialize queues and flags. */
5589        for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5590                skb_queue_head_init(&wl->tx_queue[queue_num]);
5591                wl->tx_queue_stopped[queue_num] = 0;
5592        }
5593
5594        snprintf(chip_name, ARRAY_SIZE(chip_name),
5595                 (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5596        b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5597                dev->core_rev);
5598        return wl;
5599}
5600
5601#ifdef CONFIG_B43_BCMA
5602static int b43_bcma_probe(struct bcma_device *core)
5603{
5604        struct b43_bus_dev *dev;
5605        struct b43_wl *wl;
5606        int err;
5607
5608        if (!modparam_allhwsupport &&
5609            (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5610                pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5611                return -ENOTSUPP;
5612        }
5613
5614        dev = b43_bus_dev_bcma_init(core);
5615        if (!dev)
5616                return -ENODEV;
5617
5618        wl = b43_wireless_init(dev);
5619        if (IS_ERR(wl)) {
5620                err = PTR_ERR(wl);
5621                goto bcma_out;
5622        }
5623
5624        err = b43_one_core_attach(dev, wl);
5625        if (err)
5626                goto bcma_err_wireless_exit;
5627
5628        /* setup and start work to load firmware */
5629        INIT_WORK(&wl->firmware_load, b43_request_firmware);
5630        schedule_work(&wl->firmware_load);
5631
5632bcma_out:
5633        return err;
5634
5635bcma_err_wireless_exit:
5636        ieee80211_free_hw(wl->hw);
5637        return err;
5638}
5639
5640static void b43_bcma_remove(struct bcma_device *core)
5641{
5642        struct b43_wldev *wldev = bcma_get_drvdata(core);
5643        struct b43_wl *wl = wldev->wl;
5644
5645        /* We must cancel any work here before unregistering from ieee80211,
5646         * as the ieee80211 unreg will destroy the workqueue. */
5647        cancel_work_sync(&wldev->restart_work);
5648        cancel_work_sync(&wl->firmware_load);
5649
5650        B43_WARN_ON(!wl);
5651        if (!wldev->fw.ucode.data)
5652                return;                 /* NULL if firmware never loaded */
5653        if (wl->current_dev == wldev && wl->hw_registred) {
5654                b43_leds_stop(wldev);
5655                ieee80211_unregister_hw(wl->hw);
5656        }
5657
5658        b43_one_core_detach(wldev->dev);
5659
5660        /* Unregister HW RNG driver */
5661        b43_rng_exit(wl);
5662
5663        b43_leds_unregister(wl);
5664
5665        ieee80211_free_hw(wl->hw);
5666}
5667
5668static struct bcma_driver b43_bcma_driver = {
5669        .name           = KBUILD_MODNAME,
5670        .id_table       = b43_bcma_tbl,
5671        .probe          = b43_bcma_probe,
5672        .remove         = b43_bcma_remove,
5673};
5674#endif
5675
5676#ifdef CONFIG_B43_SSB
5677static
5678int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5679{
5680        struct b43_bus_dev *dev;
5681        struct b43_wl *wl;
5682        int err;
5683
5684        dev = b43_bus_dev_ssb_init(sdev);
5685        if (!dev)
5686                return -ENOMEM;
5687
5688        wl = ssb_get_devtypedata(sdev);
5689        if (wl) {
5690                b43err(NULL, "Dual-core devices are not supported\n");
5691                err = -ENOTSUPP;
5692                goto err_ssb_kfree_dev;
5693        }
5694
5695        b43_sprom_fixup(sdev->bus);
5696
5697        wl = b43_wireless_init(dev);
5698        if (IS_ERR(wl)) {
5699                err = PTR_ERR(wl);
5700                goto err_ssb_kfree_dev;
5701        }
5702        ssb_set_devtypedata(sdev, wl);
5703        B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5704
5705        err = b43_one_core_attach(dev, wl);
5706        if (err)
5707                goto err_ssb_wireless_exit;
5708
5709        /* setup and start work to load firmware */
5710        INIT_WORK(&wl->firmware_load, b43_request_firmware);
5711        schedule_work(&wl->firmware_load);
5712
5713        return err;
5714
5715err_ssb_wireless_exit:
5716        b43_wireless_exit(dev, wl);
5717err_ssb_kfree_dev:
5718        kfree(dev);
5719        return err;
5720}
5721
5722static void b43_ssb_remove(struct ssb_device *sdev)
5723{
5724        struct b43_wl *wl = ssb_get_devtypedata(sdev);
5725        struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5726        struct b43_bus_dev *dev = wldev->dev;
5727
5728        /* We must cancel any work here before unregistering from ieee80211,
5729         * as the ieee80211 unreg will destroy the workqueue. */
5730        cancel_work_sync(&wldev->restart_work);
5731        cancel_work_sync(&wl->firmware_load);
5732
5733        B43_WARN_ON(!wl);
5734        if (!wldev->fw.ucode.data)
5735                return;                 /* NULL if firmware never loaded */
5736        if (wl->current_dev == wldev && wl->hw_registred) {
5737                b43_leds_stop(wldev);
5738                ieee80211_unregister_hw(wl->hw);
5739        }
5740
5741        b43_one_core_detach(dev);
5742
5743        /* Unregister HW RNG driver */
5744        b43_rng_exit(wl);
5745
5746        b43_leds_unregister(wl);
5747        b43_wireless_exit(dev, wl);
5748}
5749
5750static struct ssb_driver b43_ssb_driver = {
5751        .name           = KBUILD_MODNAME,
5752        .id_table       = b43_ssb_tbl,
5753        .probe          = b43_ssb_probe,
5754        .remove         = b43_ssb_remove,
5755};
5756#endif /* CONFIG_B43_SSB */
5757
5758/* Perform a hardware reset. This can be called from any context. */
5759void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5760{
5761        /* Must avoid requeueing, if we are in shutdown. */
5762        if (b43_status(dev) < B43_STAT_INITIALIZED)
5763                return;
5764        b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5765        ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5766}
5767
5768static void b43_print_driverinfo(void)
5769{
5770        const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5771                   *feat_leds = "", *feat_sdio = "";
5772
5773#ifdef CONFIG_B43_PCI_AUTOSELECT
5774        feat_pci = "P";
5775#endif
5776#ifdef CONFIG_B43_PCMCIA
5777        feat_pcmcia = "M";
5778#endif
5779#ifdef CONFIG_B43_PHY_N
5780        feat_nphy = "N";
5781#endif
5782#ifdef CONFIG_B43_LEDS
5783        feat_leds = "L";
5784#endif
5785#ifdef CONFIG_B43_SDIO
5786        feat_sdio = "S";
5787#endif
5788        printk(KERN_INFO "Broadcom 43xx driver loaded "
5789               "[ Features: %s%s%s%s%s ]\n",
5790               feat_pci, feat_pcmcia, feat_nphy,
5791               feat_leds, feat_sdio);
5792}
5793
5794static int __init b43_init(void)
5795{
5796        int err;
5797
5798        b43_debugfs_init();
5799        err = b43_pcmcia_init();
5800        if (err)
5801                goto err_dfs_exit;
5802        err = b43_sdio_init();
5803        if (err)
5804                goto err_pcmcia_exit;
5805#ifdef CONFIG_B43_BCMA
5806        err = bcma_driver_register(&b43_bcma_driver);
5807        if (err)
5808                goto err_sdio_exit;
5809#endif
5810#ifdef CONFIG_B43_SSB
5811        err = ssb_driver_register(&b43_ssb_driver);
5812        if (err)
5813                goto err_bcma_driver_exit;
5814#endif
5815        b43_print_driverinfo();
5816
5817        return err;
5818
5819#ifdef CONFIG_B43_SSB
5820err_bcma_driver_exit:
5821#endif
5822#ifdef CONFIG_B43_BCMA
5823        bcma_driver_unregister(&b43_bcma_driver);
5824err_sdio_exit:
5825#endif
5826        b43_sdio_exit();
5827err_pcmcia_exit:
5828        b43_pcmcia_exit();
5829err_dfs_exit:
5830        b43_debugfs_exit();
5831        return err;
5832}
5833
5834static void __exit b43_exit(void)
5835{
5836#ifdef CONFIG_B43_SSB
5837        ssb_driver_unregister(&b43_ssb_driver);
5838#endif
5839#ifdef CONFIG_B43_BCMA
5840        bcma_driver_unregister(&b43_bcma_driver);
5841#endif
5842        b43_sdio_exit();
5843        b43_pcmcia_exit();
5844        b43_debugfs_exit();
5845}
5846
5847module_init(b43_init)
5848module_exit(b43_exit)
5849