root/drivers/net/wireless/broadcom/b43/main.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. b43_ratelimit
  2. b43info
  3. b43err
  4. b43warn
  5. b43dbg
  6. b43_ram_write
  7. b43_shm_control_word
  8. b43_shm_read32
  9. b43_shm_read16
  10. b43_shm_write32
  11. b43_shm_write16
  12. b43_hf_read
  13. b43_hf_write
  14. b43_fwcapa_read
  15. b43_tsf_read
  16. b43_time_lock
  17. b43_time_unlock
  18. b43_tsf_write_locked
  19. b43_tsf_write
  20. b43_macfilter_set
  21. b43_write_mac_bssid_templates
  22. b43_upload_card_macaddress
  23. b43_set_slot_time
  24. b43_short_slot_timing_enable
  25. b43_short_slot_timing_disable
  26. b43_dummy_transmission
  27. key_write
  28. keymac_write
  29. rx_tkip_phase1_write
  30. b43_op_update_tkip_key
  31. do_key_write
  32. b43_key_write
  33. b43_key_clear
  34. b43_clear_keys
  35. b43_dump_keymemory
  36. b43_power_saving_ctl_bits
  37. b43_wireless_core_phy_pll_reset
  38. b43_bcma_phy_reset
  39. b43_bcma_wireless_core_reset
  40. b43_ssb_wireless_core_reset
  41. b43_wireless_core_reset
  42. handle_irq_transmit_status
  43. drain_txstatus_queue
  44. b43_jssi_read
  45. b43_jssi_write
  46. b43_generate_noise_sample
  47. b43_calculate_link_quality
  48. handle_irq_noise
  49. handle_irq_tbtt_indication
  50. handle_irq_atim_end
  51. handle_irq_pmq
  52. b43_write_template_common
  53. b43_ieee80211_antenna_sanitize
  54. b43_antenna_to_phyctl
  55. b43_write_beacon_template
  56. b43_upload_beacon0
  57. b43_upload_beacon1
  58. handle_irq_beacon
  59. b43_do_beacon_update_trigger_work
  60. b43_beacon_update_trigger_work
  61. b43_update_templates
  62. b43_set_beacon_int
  63. b43_handle_firmware_panic
  64. handle_irq_ucode_debug
  65. b43_do_interrupt_thread
  66. b43_interrupt_thread_handler
  67. b43_do_interrupt
  68. b43_interrupt_handler
  69. b43_sdio_interrupt_handler
  70. b43_do_release_fw
  71. b43_release_firmware
  72. b43_print_fw_helptext
  73. b43_fw_cb
  74. b43_do_request_fw
  75. b43_try_request_fw
  76. b43_request_firmware
  77. b43_upload_microcode
  78. b43_write_initvals
  79. b43_upload_initvals
  80. b43_upload_initvals_band
  81. b43_ssb_gpio_dev
  82. b43_gpio_init
  83. b43_gpio_cleanup
  84. b43_mac_enable
  85. b43_mac_suspend
  86. b43_mac_phy_clock_set
  87. b43_mac_switch_freq
  88. b43_adjust_opmode
  89. b43_rate_memory_write
  90. b43_rate_memory_init
  91. b43_set_phytxctl_defaults
  92. b43_mgmtframe_txantenna
  93. b43_chip_exit
  94. b43_chip_init
  95. b43_periodic_every60sec
  96. b43_periodic_every30sec
  97. b43_periodic_every15sec
  98. do_periodic_work
  99. b43_periodic_work_handler
  100. b43_periodic_tasks_setup
  101. b43_validate_chipaccess
  102. b43_security_init
  103. b43_rng_read
  104. b43_rng_exit
  105. b43_rng_init
  106. b43_tx_work
  107. b43_op_tx
  108. b43_qos_params_upload
  109. b43_qos_upload_all
  110. b43_qos_clear
  111. b43_qos_init
  112. b43_op_conf_tx
  113. b43_op_get_stats
  114. b43_op_get_tsf
  115. b43_op_set_tsf
  116. band_to_string
  117. b43_switch_band
  118. b43_set_beacon_listen_interval
  119. b43_set_retry_limits
  120. b43_op_config
  121. b43_update_basic_rates
  122. b43_op_bss_info_changed
  123. b43_op_set_key
  124. b43_op_configure_filter
  125. b43_wireless_core_stop
  126. b43_wireless_core_start
  127. b43_phy_name
  128. b43_phy_versioning
  129. setup_struct_phy_for_init
  130. setup_struct_wldev_for_init
  131. b43_bluetooth_coext_enable
  132. b43_bluetooth_coext_disable
  133. b43_imcfglo_timeouts_workaround
  134. b43_set_synth_pu_delay
  135. b43_set_pretbtt
  136. b43_wireless_core_exit
  137. b43_wireless_core_init
  138. b43_op_add_interface
  139. b43_op_remove_interface
  140. b43_op_start
  141. b43_op_stop
  142. b43_op_beacon_set_tim
  143. b43_op_sta_notify
  144. b43_op_sw_scan_start_notifier
  145. b43_op_sw_scan_complete_notifier
  146. b43_op_get_survey
  147. b43_chip_reset
  148. b43_setup_bands
  149. b43_wireless_core_detach
  150. b43_supported_bands
  151. b43_wireless_core_attach
  152. b43_one_core_detach
  153. b43_one_core_attach
  154. b43_sprom_fixup
  155. b43_wireless_exit
  156. b43_wireless_init
  157. b43_bcma_probe
  158. b43_bcma_remove
  159. b43_ssb_probe
  160. b43_ssb_remove
  161. b43_controller_restart
  162. b43_print_driverinfo
  163. b43_init
  164. b43_exit

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3 
   4   Broadcom B43 wireless driver
   5 
   6   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   7   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   8   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   9   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
  10   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  11   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
  12 
  13   SDIO support
  14   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  15 
  16   Some parts of the code in this file are derived from the ipw2200
  17   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  18 
  19 
  20 */
  21 
  22 #include <linux/delay.h>
  23 #include <linux/init.h>
  24 #include <linux/module.h>
  25 #include <linux/if_arp.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/firmware.h>
  28 #include <linux/workqueue.h>
  29 #include <linux/skbuff.h>
  30 #include <linux/io.h>
  31 #include <linux/dma-mapping.h>
  32 #include <linux/slab.h>
  33 #include <asm/unaligned.h>
  34 
  35 #include "b43.h"
  36 #include "main.h"
  37 #include "debugfs.h"
  38 #include "phy_common.h"
  39 #include "phy_g.h"
  40 #include "phy_n.h"
  41 #include "dma.h"
  42 #include "pio.h"
  43 #include "sysfs.h"
  44 #include "xmit.h"
  45 #include "lo.h"
  46 #include "sdio.h"
  47 #include <linux/mmc/sdio_func.h>
  48 
  49 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  50 MODULE_AUTHOR("Martin Langer");
  51 MODULE_AUTHOR("Stefano Brivio");
  52 MODULE_AUTHOR("Michael Buesch");
  53 MODULE_AUTHOR("Gábor Stefanik");
  54 MODULE_AUTHOR("Rafał Miłecki");
  55 MODULE_LICENSE("GPL");
  56 
  57 MODULE_FIRMWARE("b43/ucode11.fw");
  58 MODULE_FIRMWARE("b43/ucode13.fw");
  59 MODULE_FIRMWARE("b43/ucode14.fw");
  60 MODULE_FIRMWARE("b43/ucode15.fw");
  61 MODULE_FIRMWARE("b43/ucode16_lp.fw");
  62 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  63 MODULE_FIRMWARE("b43/ucode24_lcn.fw");
  64 MODULE_FIRMWARE("b43/ucode25_lcn.fw");
  65 MODULE_FIRMWARE("b43/ucode25_mimo.fw");
  66 MODULE_FIRMWARE("b43/ucode26_mimo.fw");
  67 MODULE_FIRMWARE("b43/ucode29_mimo.fw");
  68 MODULE_FIRMWARE("b43/ucode33_lcn40.fw");
  69 MODULE_FIRMWARE("b43/ucode30_mimo.fw");
  70 MODULE_FIRMWARE("b43/ucode5.fw");
  71 MODULE_FIRMWARE("b43/ucode40.fw");
  72 MODULE_FIRMWARE("b43/ucode42.fw");
  73 MODULE_FIRMWARE("b43/ucode9.fw");
  74 
  75 static int modparam_bad_frames_preempt;
  76 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  77 MODULE_PARM_DESC(bad_frames_preempt,
  78                  "enable(1) / disable(0) Bad Frames Preemption");
  79 
  80 static char modparam_fwpostfix[16];
  81 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  82 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  83 
  84 static int modparam_hwpctl;
  85 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  86 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  87 
  88 static int modparam_nohwcrypt;
  89 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  90 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  91 
  92 static int modparam_hwtkip;
  93 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  94 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  95 
  96 static int modparam_qos = 1;
  97 module_param_named(qos, modparam_qos, int, 0444);
  98 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
  99 
 100 static int modparam_btcoex = 1;
 101 module_param_named(btcoex, modparam_btcoex, int, 0444);
 102 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 103 
 104 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 105 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 106 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 107 
 108 static int b43_modparam_pio = 0;
 109 module_param_named(pio, b43_modparam_pio, int, 0644);
 110 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 111 
 112 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
 113 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
 114 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
 115 
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 121         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 122         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
 123         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 124         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
 125         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
 126         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
 127         {},
 128 };
 129 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 130 #endif
 131 
 132 #ifdef CONFIG_B43_SSB
 133 static const struct ssb_device_id b43_ssb_tbl[] = {
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 138         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 139         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 140         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 141         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 142         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 143         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 144         {},
 145 };
 146 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 147 #endif
 148 
 149 /* Channel and ratetables are shared for all devices.
 150  * They can't be const, because ieee80211 puts some precalculated
 151  * data in there. This data is the same for all devices, so we don't
 152  * get concurrency issues */
 153 #define RATETAB_ENT(_rateid, _flags) \
 154         {                                                               \
 155                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 156                 .hw_value       = (_rateid),                            \
 157                 .flags          = (_flags),                             \
 158         }
 159 
 160 /*
 161  * NOTE: When changing this, sync with xmit.c's
 162  *       b43_plcp_get_bitrate_idx_* functions!
 163  */
 164 static struct ieee80211_rate __b43_ratetable[] = {
 165         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 166         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 167         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 168         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 169         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 171         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 172         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 173         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 174         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 175         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 176         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 177 };
 178 
 179 #define b43_a_ratetable         (__b43_ratetable + 4)
 180 #define b43_a_ratetable_size    8
 181 #define b43_b_ratetable         (__b43_ratetable + 0)
 182 #define b43_b_ratetable_size    4
 183 #define b43_g_ratetable         (__b43_ratetable + 0)
 184 #define b43_g_ratetable_size    12
 185 
 186 #define CHAN2G(_channel, _freq, _flags) {                       \
 187         .band                   = NL80211_BAND_2GHZ,            \
 188         .center_freq            = (_freq),                      \
 189         .hw_value               = (_channel),                   \
 190         .flags                  = (_flags),                     \
 191         .max_antenna_gain       = 0,                            \
 192         .max_power              = 30,                           \
 193 }
 194 static struct ieee80211_channel b43_2ghz_chantable[] = {
 195         CHAN2G(1, 2412, 0),
 196         CHAN2G(2, 2417, 0),
 197         CHAN2G(3, 2422, 0),
 198         CHAN2G(4, 2427, 0),
 199         CHAN2G(5, 2432, 0),
 200         CHAN2G(6, 2437, 0),
 201         CHAN2G(7, 2442, 0),
 202         CHAN2G(8, 2447, 0),
 203         CHAN2G(9, 2452, 0),
 204         CHAN2G(10, 2457, 0),
 205         CHAN2G(11, 2462, 0),
 206         CHAN2G(12, 2467, 0),
 207         CHAN2G(13, 2472, 0),
 208         CHAN2G(14, 2484, 0),
 209 };
 210 
 211 /* No support for the last 3 channels (12, 13, 14) */
 212 #define b43_2ghz_chantable_limited_size         11
 213 #undef CHAN2G
 214 
 215 #define CHAN4G(_channel, _flags) {                              \
 216         .band                   = NL80211_BAND_5GHZ,            \
 217         .center_freq            = 4000 + (5 * (_channel)),      \
 218         .hw_value               = (_channel),                   \
 219         .flags                  = (_flags),                     \
 220         .max_antenna_gain       = 0,                            \
 221         .max_power              = 30,                           \
 222 }
 223 #define CHAN5G(_channel, _flags) {                              \
 224         .band                   = NL80211_BAND_5GHZ,            \
 225         .center_freq            = 5000 + (5 * (_channel)),      \
 226         .hw_value               = (_channel),                   \
 227         .flags                  = (_flags),                     \
 228         .max_antenna_gain       = 0,                            \
 229         .max_power              = 30,                           \
 230 }
 231 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 232         CHAN4G(184, 0),         CHAN4G(186, 0),
 233         CHAN4G(188, 0),         CHAN4G(190, 0),
 234         CHAN4G(192, 0),         CHAN4G(194, 0),
 235         CHAN4G(196, 0),         CHAN4G(198, 0),
 236         CHAN4G(200, 0),         CHAN4G(202, 0),
 237         CHAN4G(204, 0),         CHAN4G(206, 0),
 238         CHAN4G(208, 0),         CHAN4G(210, 0),
 239         CHAN4G(212, 0),         CHAN4G(214, 0),
 240         CHAN4G(216, 0),         CHAN4G(218, 0),
 241         CHAN4G(220, 0),         CHAN4G(222, 0),
 242         CHAN4G(224, 0),         CHAN4G(226, 0),
 243         CHAN4G(228, 0),
 244         CHAN5G(32, 0),          CHAN5G(34, 0),
 245         CHAN5G(36, 0),          CHAN5G(38, 0),
 246         CHAN5G(40, 0),          CHAN5G(42, 0),
 247         CHAN5G(44, 0),          CHAN5G(46, 0),
 248         CHAN5G(48, 0),          CHAN5G(50, 0),
 249         CHAN5G(52, 0),          CHAN5G(54, 0),
 250         CHAN5G(56, 0),          CHAN5G(58, 0),
 251         CHAN5G(60, 0),          CHAN5G(62, 0),
 252         CHAN5G(64, 0),          CHAN5G(66, 0),
 253         CHAN5G(68, 0),          CHAN5G(70, 0),
 254         CHAN5G(72, 0),          CHAN5G(74, 0),
 255         CHAN5G(76, 0),          CHAN5G(78, 0),
 256         CHAN5G(80, 0),          CHAN5G(82, 0),
 257         CHAN5G(84, 0),          CHAN5G(86, 0),
 258         CHAN5G(88, 0),          CHAN5G(90, 0),
 259         CHAN5G(92, 0),          CHAN5G(94, 0),
 260         CHAN5G(96, 0),          CHAN5G(98, 0),
 261         CHAN5G(100, 0),         CHAN5G(102, 0),
 262         CHAN5G(104, 0),         CHAN5G(106, 0),
 263         CHAN5G(108, 0),         CHAN5G(110, 0),
 264         CHAN5G(112, 0),         CHAN5G(114, 0),
 265         CHAN5G(116, 0),         CHAN5G(118, 0),
 266         CHAN5G(120, 0),         CHAN5G(122, 0),
 267         CHAN5G(124, 0),         CHAN5G(126, 0),
 268         CHAN5G(128, 0),         CHAN5G(130, 0),
 269         CHAN5G(132, 0),         CHAN5G(134, 0),
 270         CHAN5G(136, 0),         CHAN5G(138, 0),
 271         CHAN5G(140, 0),         CHAN5G(142, 0),
 272         CHAN5G(144, 0),         CHAN5G(145, 0),
 273         CHAN5G(146, 0),         CHAN5G(147, 0),
 274         CHAN5G(148, 0),         CHAN5G(149, 0),
 275         CHAN5G(150, 0),         CHAN5G(151, 0),
 276         CHAN5G(152, 0),         CHAN5G(153, 0),
 277         CHAN5G(154, 0),         CHAN5G(155, 0),
 278         CHAN5G(156, 0),         CHAN5G(157, 0),
 279         CHAN5G(158, 0),         CHAN5G(159, 0),
 280         CHAN5G(160, 0),         CHAN5G(161, 0),
 281         CHAN5G(162, 0),         CHAN5G(163, 0),
 282         CHAN5G(164, 0),         CHAN5G(165, 0),
 283         CHAN5G(166, 0),         CHAN5G(168, 0),
 284         CHAN5G(170, 0),         CHAN5G(172, 0),
 285         CHAN5G(174, 0),         CHAN5G(176, 0),
 286         CHAN5G(178, 0),         CHAN5G(180, 0),
 287         CHAN5G(182, 0),
 288 };
 289 
 290 static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
 291         CHAN5G(36, 0),          CHAN5G(40, 0),
 292         CHAN5G(44, 0),          CHAN5G(48, 0),
 293         CHAN5G(149, 0),         CHAN5G(153, 0),
 294         CHAN5G(157, 0),         CHAN5G(161, 0),
 295         CHAN5G(165, 0),
 296 };
 297 
 298 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 299         CHAN5G(34, 0),          CHAN5G(36, 0),
 300         CHAN5G(38, 0),          CHAN5G(40, 0),
 301         CHAN5G(42, 0),          CHAN5G(44, 0),
 302         CHAN5G(46, 0),          CHAN5G(48, 0),
 303         CHAN5G(52, 0),          CHAN5G(56, 0),
 304         CHAN5G(60, 0),          CHAN5G(64, 0),
 305         CHAN5G(100, 0),         CHAN5G(104, 0),
 306         CHAN5G(108, 0),         CHAN5G(112, 0),
 307         CHAN5G(116, 0),         CHAN5G(120, 0),
 308         CHAN5G(124, 0),         CHAN5G(128, 0),
 309         CHAN5G(132, 0),         CHAN5G(136, 0),
 310         CHAN5G(140, 0),         CHAN5G(149, 0),
 311         CHAN5G(153, 0),         CHAN5G(157, 0),
 312         CHAN5G(161, 0),         CHAN5G(165, 0),
 313         CHAN5G(184, 0),         CHAN5G(188, 0),
 314         CHAN5G(192, 0),         CHAN5G(196, 0),
 315         CHAN5G(200, 0),         CHAN5G(204, 0),
 316         CHAN5G(208, 0),         CHAN5G(212, 0),
 317         CHAN5G(216, 0),
 318 };
 319 #undef CHAN4G
 320 #undef CHAN5G
 321 
 322 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 323         .band           = NL80211_BAND_5GHZ,
 324         .channels       = b43_5ghz_nphy_chantable,
 325         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 326         .bitrates       = b43_a_ratetable,
 327         .n_bitrates     = b43_a_ratetable_size,
 328 };
 329 
 330 static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
 331         .band           = NL80211_BAND_5GHZ,
 332         .channels       = b43_5ghz_nphy_chantable_limited,
 333         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
 334         .bitrates       = b43_a_ratetable,
 335         .n_bitrates     = b43_a_ratetable_size,
 336 };
 337 
 338 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 339         .band           = NL80211_BAND_5GHZ,
 340         .channels       = b43_5ghz_aphy_chantable,
 341         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 342         .bitrates       = b43_a_ratetable,
 343         .n_bitrates     = b43_a_ratetable_size,
 344 };
 345 
 346 static struct ieee80211_supported_band b43_band_2GHz = {
 347         .band           = NL80211_BAND_2GHZ,
 348         .channels       = b43_2ghz_chantable,
 349         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 350         .bitrates       = b43_g_ratetable,
 351         .n_bitrates     = b43_g_ratetable_size,
 352 };
 353 
 354 static struct ieee80211_supported_band b43_band_2ghz_limited = {
 355         .band           = NL80211_BAND_2GHZ,
 356         .channels       = b43_2ghz_chantable,
 357         .n_channels     = b43_2ghz_chantable_limited_size,
 358         .bitrates       = b43_g_ratetable,
 359         .n_bitrates     = b43_g_ratetable_size,
 360 };
 361 
 362 static void b43_wireless_core_exit(struct b43_wldev *dev);
 363 static int b43_wireless_core_init(struct b43_wldev *dev);
 364 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 365 static int b43_wireless_core_start(struct b43_wldev *dev);
 366 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
 367                                     struct ieee80211_vif *vif,
 368                                     struct ieee80211_bss_conf *conf,
 369                                     u32 changed);
 370 
 371 static int b43_ratelimit(struct b43_wl *wl)
 372 {
 373         if (!wl || !wl->current_dev)
 374                 return 1;
 375         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 376                 return 1;
 377         /* We are up and running.
 378          * Ratelimit the messages to avoid DoS over the net. */
 379         return net_ratelimit();
 380 }
 381 
 382 void b43info(struct b43_wl *wl, const char *fmt, ...)
 383 {
 384         struct va_format vaf;
 385         va_list args;
 386 
 387         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 388                 return;
 389         if (!b43_ratelimit(wl))
 390                 return;
 391 
 392         va_start(args, fmt);
 393 
 394         vaf.fmt = fmt;
 395         vaf.va = &args;
 396 
 397         printk(KERN_INFO "b43-%s: %pV",
 398                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 399 
 400         va_end(args);
 401 }
 402 
 403 void b43err(struct b43_wl *wl, const char *fmt, ...)
 404 {
 405         struct va_format vaf;
 406         va_list args;
 407 
 408         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 409                 return;
 410         if (!b43_ratelimit(wl))
 411                 return;
 412 
 413         va_start(args, fmt);
 414 
 415         vaf.fmt = fmt;
 416         vaf.va = &args;
 417 
 418         printk(KERN_ERR "b43-%s ERROR: %pV",
 419                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 420 
 421         va_end(args);
 422 }
 423 
 424 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 425 {
 426         struct va_format vaf;
 427         va_list args;
 428 
 429         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 430                 return;
 431         if (!b43_ratelimit(wl))
 432                 return;
 433 
 434         va_start(args, fmt);
 435 
 436         vaf.fmt = fmt;
 437         vaf.va = &args;
 438 
 439         printk(KERN_WARNING "b43-%s warning: %pV",
 440                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 441 
 442         va_end(args);
 443 }
 444 
 445 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 446 {
 447         struct va_format vaf;
 448         va_list args;
 449 
 450         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 451                 return;
 452 
 453         va_start(args, fmt);
 454 
 455         vaf.fmt = fmt;
 456         vaf.va = &args;
 457 
 458         printk(KERN_DEBUG "b43-%s debug: %pV",
 459                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 460 
 461         va_end(args);
 462 }
 463 
 464 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 465 {
 466         u32 macctl;
 467 
 468         B43_WARN_ON(offset % 4 != 0);
 469 
 470         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 471         if (macctl & B43_MACCTL_BE)
 472                 val = swab32(val);
 473 
 474         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 475         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 476 }
 477 
 478 static inline void b43_shm_control_word(struct b43_wldev *dev,
 479                                         u16 routing, u16 offset)
 480 {
 481         u32 control;
 482 
 483         /* "offset" is the WORD offset. */
 484         control = routing;
 485         control <<= 16;
 486         control |= offset;
 487         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 488 }
 489 
 490 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 491 {
 492         u32 ret;
 493 
 494         if (routing == B43_SHM_SHARED) {
 495                 B43_WARN_ON(offset & 0x0001);
 496                 if (offset & 0x0003) {
 497                         /* Unaligned access */
 498                         b43_shm_control_word(dev, routing, offset >> 2);
 499                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 500                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 501                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 502 
 503                         goto out;
 504                 }
 505                 offset >>= 2;
 506         }
 507         b43_shm_control_word(dev, routing, offset);
 508         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 509 out:
 510         return ret;
 511 }
 512 
 513 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 514 {
 515         u16 ret;
 516 
 517         if (routing == B43_SHM_SHARED) {
 518                 B43_WARN_ON(offset & 0x0001);
 519                 if (offset & 0x0003) {
 520                         /* Unaligned access */
 521                         b43_shm_control_word(dev, routing, offset >> 2);
 522                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 523 
 524                         goto out;
 525                 }
 526                 offset >>= 2;
 527         }
 528         b43_shm_control_word(dev, routing, offset);
 529         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 530 out:
 531         return ret;
 532 }
 533 
 534 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 535 {
 536         if (routing == B43_SHM_SHARED) {
 537                 B43_WARN_ON(offset & 0x0001);
 538                 if (offset & 0x0003) {
 539                         /* Unaligned access */
 540                         b43_shm_control_word(dev, routing, offset >> 2);
 541                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 542                                     value & 0xFFFF);
 543                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 544                         b43_write16(dev, B43_MMIO_SHM_DATA,
 545                                     (value >> 16) & 0xFFFF);
 546                         return;
 547                 }
 548                 offset >>= 2;
 549         }
 550         b43_shm_control_word(dev, routing, offset);
 551         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 552 }
 553 
 554 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 555 {
 556         if (routing == B43_SHM_SHARED) {
 557                 B43_WARN_ON(offset & 0x0001);
 558                 if (offset & 0x0003) {
 559                         /* Unaligned access */
 560                         b43_shm_control_word(dev, routing, offset >> 2);
 561                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 562                         return;
 563                 }
 564                 offset >>= 2;
 565         }
 566         b43_shm_control_word(dev, routing, offset);
 567         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 568 }
 569 
 570 /* Read HostFlags */
 571 u64 b43_hf_read(struct b43_wldev *dev)
 572 {
 573         u64 ret;
 574 
 575         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
 576         ret <<= 16;
 577         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
 578         ret <<= 16;
 579         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
 580 
 581         return ret;
 582 }
 583 
 584 /* Write HostFlags */
 585 void b43_hf_write(struct b43_wldev *dev, u64 value)
 586 {
 587         u16 lo, mi, hi;
 588 
 589         lo = (value & 0x00000000FFFFULL);
 590         mi = (value & 0x0000FFFF0000ULL) >> 16;
 591         hi = (value & 0xFFFF00000000ULL) >> 32;
 592         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
 593         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
 594         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
 595 }
 596 
 597 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 598 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 599 {
 600         B43_WARN_ON(!dev->fw.opensource);
 601         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 602 }
 603 
 604 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 605 {
 606         u32 low, high;
 607 
 608         B43_WARN_ON(dev->dev->core_rev < 3);
 609 
 610         /* The hardware guarantees us an atomic read, if we
 611          * read the low register first. */
 612         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 613         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 614 
 615         *tsf = high;
 616         *tsf <<= 32;
 617         *tsf |= low;
 618 }
 619 
 620 static void b43_time_lock(struct b43_wldev *dev)
 621 {
 622         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
 623         /* Commit the write */
 624         b43_read32(dev, B43_MMIO_MACCTL);
 625 }
 626 
 627 static void b43_time_unlock(struct b43_wldev *dev)
 628 {
 629         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
 630         /* Commit the write */
 631         b43_read32(dev, B43_MMIO_MACCTL);
 632 }
 633 
 634 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 635 {
 636         u32 low, high;
 637 
 638         B43_WARN_ON(dev->dev->core_rev < 3);
 639 
 640         low = tsf;
 641         high = (tsf >> 32);
 642         /* The hardware guarantees us an atomic write, if we
 643          * write the low register first. */
 644         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 645         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 646 }
 647 
 648 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 649 {
 650         b43_time_lock(dev);
 651         b43_tsf_write_locked(dev, tsf);
 652         b43_time_unlock(dev);
 653 }
 654 
 655 static
 656 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 657 {
 658         static const u8 zero_addr[ETH_ALEN] = { 0 };
 659         u16 data;
 660 
 661         if (!mac)
 662                 mac = zero_addr;
 663 
 664         offset |= 0x0020;
 665         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 666 
 667         data = mac[0];
 668         data |= mac[1] << 8;
 669         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 670         data = mac[2];
 671         data |= mac[3] << 8;
 672         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 673         data = mac[4];
 674         data |= mac[5] << 8;
 675         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 676 }
 677 
 678 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 679 {
 680         const u8 *mac;
 681         const u8 *bssid;
 682         u8 mac_bssid[ETH_ALEN * 2];
 683         int i;
 684         u32 tmp;
 685 
 686         bssid = dev->wl->bssid;
 687         mac = dev->wl->mac_addr;
 688 
 689         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 690 
 691         memcpy(mac_bssid, mac, ETH_ALEN);
 692         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 693 
 694         /* Write our MAC address and BSSID to template ram */
 695         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 696                 tmp = (u32) (mac_bssid[i + 0]);
 697                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 698                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 699                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 700                 b43_ram_write(dev, 0x20 + i, tmp);
 701         }
 702 }
 703 
 704 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 705 {
 706         b43_write_mac_bssid_templates(dev);
 707         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 708 }
 709 
 710 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 711 {
 712         /* slot_time is in usec. */
 713         /* This test used to exit for all but a G PHY. */
 714         if (b43_current_band(dev->wl) == NL80211_BAND_5GHZ)
 715                 return;
 716         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 717         /* Shared memory location 0x0010 is the slot time and should be
 718          * set to slot_time; however, this register is initially 0 and changing
 719          * the value adversely affects the transmit rate for BCM4311
 720          * devices. Until this behavior is unterstood, delete this step
 721          *
 722          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 723          */
 724 }
 725 
 726 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 727 {
 728         b43_set_slot_time(dev, 9);
 729 }
 730 
 731 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 732 {
 733         b43_set_slot_time(dev, 20);
 734 }
 735 
 736 /* DummyTransmission function, as documented on
 737  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 738  */
 739 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 740 {
 741         struct b43_phy *phy = &dev->phy;
 742         unsigned int i, max_loop;
 743         u16 value;
 744         u32 buffer[5] = {
 745                 0x00000000,
 746                 0x00D40000,
 747                 0x00000000,
 748                 0x01000000,
 749                 0x00000000,
 750         };
 751 
 752         if (ofdm) {
 753                 max_loop = 0x1E;
 754                 buffer[0] = 0x000201CC;
 755         } else {
 756                 max_loop = 0xFA;
 757                 buffer[0] = 0x000B846E;
 758         }
 759 
 760         for (i = 0; i < 5; i++)
 761                 b43_ram_write(dev, i * 4, buffer[i]);
 762 
 763         b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
 764 
 765         if (dev->dev->core_rev < 11)
 766                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
 767         else
 768                 b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
 769 
 770         value = (ofdm ? 0x41 : 0x40);
 771         b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
 772         if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
 773             phy->type == B43_PHYTYPE_LCN)
 774                 b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
 775 
 776         b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
 777         b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
 778 
 779         b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
 780         b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
 781         b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
 782         b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
 783 
 784         if (!pa_on && phy->type == B43_PHYTYPE_N)
 785                 ; /*b43_nphy_pa_override(dev, false) */
 786 
 787         switch (phy->type) {
 788         case B43_PHYTYPE_N:
 789         case B43_PHYTYPE_LCN:
 790                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
 791                 break;
 792         case B43_PHYTYPE_LP:
 793                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
 794                 break;
 795         default:
 796                 b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
 797         }
 798         b43_read16(dev, B43_MMIO_TXE0_AUX);
 799 
 800         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 801                 b43_radio_write16(dev, 0x0051, 0x0017);
 802         for (i = 0x00; i < max_loop; i++) {
 803                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 804                 if (value & 0x0080)
 805                         break;
 806                 udelay(10);
 807         }
 808         for (i = 0x00; i < 0x0A; i++) {
 809                 value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
 810                 if (value & 0x0400)
 811                         break;
 812                 udelay(10);
 813         }
 814         for (i = 0x00; i < 0x19; i++) {
 815                 value = b43_read16(dev, B43_MMIO_IFSSTAT);
 816                 if (!(value & 0x0100))
 817                         break;
 818                 udelay(10);
 819         }
 820         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 821                 b43_radio_write16(dev, 0x0051, 0x0037);
 822 }
 823 
 824 static void key_write(struct b43_wldev *dev,
 825                       u8 index, u8 algorithm, const u8 *key)
 826 {
 827         unsigned int i;
 828         u32 offset;
 829         u16 value;
 830         u16 kidx;
 831 
 832         /* Key index/algo block */
 833         kidx = b43_kidx_to_fw(dev, index);
 834         value = ((kidx << 4) | algorithm);
 835         b43_shm_write16(dev, B43_SHM_SHARED,
 836                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 837 
 838         /* Write the key to the Key Table Pointer offset */
 839         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 840         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 841                 value = key[i];
 842                 value |= (u16) (key[i + 1]) << 8;
 843                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 844         }
 845 }
 846 
 847 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 848 {
 849         u32 addrtmp[2] = { 0, 0, };
 850         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 851 
 852         if (b43_new_kidx_api(dev))
 853                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 854 
 855         B43_WARN_ON(index < pairwise_keys_start);
 856         /* We have four default TX keys and possibly four default RX keys.
 857          * Physical mac 0 is mapped to physical key 4 or 8, depending
 858          * on the firmware version.
 859          * So we must adjust the index here.
 860          */
 861         index -= pairwise_keys_start;
 862         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 863 
 864         if (addr) {
 865                 addrtmp[0] = addr[0];
 866                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 867                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 868                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 869                 addrtmp[1] = addr[4];
 870                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 871         }
 872 
 873         /* Receive match transmitter address (RCMTA) mechanism */
 874         b43_shm_write32(dev, B43_SHM_RCMTA,
 875                         (index * 2) + 0, addrtmp[0]);
 876         b43_shm_write16(dev, B43_SHM_RCMTA,
 877                         (index * 2) + 1, addrtmp[1]);
 878 }
 879 
 880 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 881  * When a packet is received, the iv32 is checked.
 882  * - if it doesn't the packet is returned without modification (and software
 883  *   decryption can be done). That's what happen when iv16 wrap.
 884  * - if it does, the rc4 key is computed, and decryption is tried.
 885  *   Either it will success and B43_RX_MAC_DEC is returned,
 886  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 887  *   and the packet is not usable (it got modified by the ucode).
 888  * So in order to never have B43_RX_MAC_DECERR, we should provide
 889  * a iv32 and phase1key that match. Because we drop packets in case of
 890  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 891  * packets will be lost without higher layer knowing (ie no resync possible
 892  * until next wrap).
 893  *
 894  * NOTE : this should support 50 key like RCMTA because
 895  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 896  */
 897 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 898                 u16 *phase1key)
 899 {
 900         unsigned int i;
 901         u32 offset;
 902         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 903 
 904         if (!modparam_hwtkip)
 905                 return;
 906 
 907         if (b43_new_kidx_api(dev))
 908                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 909 
 910         B43_WARN_ON(index < pairwise_keys_start);
 911         /* We have four default TX keys and possibly four default RX keys.
 912          * Physical mac 0 is mapped to physical key 4 or 8, depending
 913          * on the firmware version.
 914          * So we must adjust the index here.
 915          */
 916         index -= pairwise_keys_start;
 917         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 918 
 919         if (b43_debug(dev, B43_DBG_KEYS)) {
 920                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 921                                 index, iv32);
 922         }
 923         /* Write the key to the  RX tkip shared mem */
 924         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 925         for (i = 0; i < 10; i += 2) {
 926                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 927                                 phase1key ? phase1key[i / 2] : 0);
 928         }
 929         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 930         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 931 }
 932 
 933 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 934                                    struct ieee80211_vif *vif,
 935                                    struct ieee80211_key_conf *keyconf,
 936                                    struct ieee80211_sta *sta,
 937                                    u32 iv32, u16 *phase1key)
 938 {
 939         struct b43_wl *wl = hw_to_b43_wl(hw);
 940         struct b43_wldev *dev;
 941         int index = keyconf->hw_key_idx;
 942 
 943         if (B43_WARN_ON(!modparam_hwtkip))
 944                 return;
 945 
 946         /* This is only called from the RX path through mac80211, where
 947          * our mutex is already locked. */
 948         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 949         dev = wl->current_dev;
 950         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 951 
 952         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 953 
 954         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 955         /* only pairwise TKIP keys are supported right now */
 956         if (WARN_ON(!sta))
 957                 return;
 958         keymac_write(dev, index, sta->addr);
 959 }
 960 
 961 static void do_key_write(struct b43_wldev *dev,
 962                          u8 index, u8 algorithm,
 963                          const u8 *key, size_t key_len, const u8 *mac_addr)
 964 {
 965         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 966         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 967 
 968         if (b43_new_kidx_api(dev))
 969                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 970 
 971         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 972         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 973 
 974         if (index >= pairwise_keys_start)
 975                 keymac_write(dev, index, NULL); /* First zero out mac. */
 976         if (algorithm == B43_SEC_ALGO_TKIP) {
 977                 /*
 978                  * We should provide an initial iv32, phase1key pair.
 979                  * We could start with iv32=0 and compute the corresponding
 980                  * phase1key, but this means calling ieee80211_get_tkip_key
 981                  * with a fake skb (or export other tkip function).
 982                  * Because we are lazy we hope iv32 won't start with
 983                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 984                  * correct pair.
 985                  */
 986                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 987         } else if (index >= pairwise_keys_start) /* clear it */
 988                 rx_tkip_phase1_write(dev, index, 0, NULL);
 989         if (key)
 990                 memcpy(buf, key, key_len);
 991         key_write(dev, index, algorithm, buf);
 992         if (index >= pairwise_keys_start)
 993                 keymac_write(dev, index, mac_addr);
 994 
 995         dev->key[index].algorithm = algorithm;
 996 }
 997 
 998 static int b43_key_write(struct b43_wldev *dev,
 999                          int index, u8 algorithm,
1000                          const u8 *key, size_t key_len,
1001                          const u8 *mac_addr,
1002                          struct ieee80211_key_conf *keyconf)
1003 {
1004         int i;
1005         int pairwise_keys_start;
1006 
1007         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1008          *      - Temporal Encryption Key (128 bits)
1009          *      - Temporal Authenticator Tx MIC Key (64 bits)
1010          *      - Temporal Authenticator Rx MIC Key (64 bits)
1011          *
1012          *      Hardware only store TEK
1013          */
1014         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1015                 key_len = 16;
1016         if (key_len > B43_SEC_KEYSIZE)
1017                 return -EINVAL;
1018         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1019                 /* Check that we don't already have this key. */
1020                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
1021         }
1022         if (index < 0) {
1023                 /* Pairwise key. Get an empty slot for the key. */
1024                 if (b43_new_kidx_api(dev))
1025                         pairwise_keys_start = B43_NR_GROUP_KEYS;
1026                 else
1027                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1028                 for (i = pairwise_keys_start;
1029                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1030                      i++) {
1031                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1032                         if (!dev->key[i].keyconf) {
1033                                 /* found empty */
1034                                 index = i;
1035                                 break;
1036                         }
1037                 }
1038                 if (index < 0) {
1039                         b43warn(dev->wl, "Out of hardware key memory\n");
1040                         return -ENOSPC;
1041                 }
1042         } else
1043                 B43_WARN_ON(index > 3);
1044 
1045         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1046         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1047                 /* Default RX key */
1048                 B43_WARN_ON(mac_addr);
1049                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1050         }
1051         keyconf->hw_key_idx = index;
1052         dev->key[index].keyconf = keyconf;
1053 
1054         return 0;
1055 }
1056 
1057 static int b43_key_clear(struct b43_wldev *dev, int index)
1058 {
1059         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1060                 return -EINVAL;
1061         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1062                      NULL, B43_SEC_KEYSIZE, NULL);
1063         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1064                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1065                              NULL, B43_SEC_KEYSIZE, NULL);
1066         }
1067         dev->key[index].keyconf = NULL;
1068 
1069         return 0;
1070 }
1071 
1072 static void b43_clear_keys(struct b43_wldev *dev)
1073 {
1074         int i, count;
1075 
1076         if (b43_new_kidx_api(dev))
1077                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1078         else
1079                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1080         for (i = 0; i < count; i++)
1081                 b43_key_clear(dev, i);
1082 }
1083 
1084 static void b43_dump_keymemory(struct b43_wldev *dev)
1085 {
1086         unsigned int i, index, count, offset, pairwise_keys_start;
1087         u8 mac[ETH_ALEN];
1088         u16 algo;
1089         u32 rcmta0;
1090         u16 rcmta1;
1091         u64 hf;
1092         struct b43_key *key;
1093 
1094         if (!b43_debug(dev, B43_DBG_KEYS))
1095                 return;
1096 
1097         hf = b43_hf_read(dev);
1098         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1099                !!(hf & B43_HF_USEDEFKEYS));
1100         if (b43_new_kidx_api(dev)) {
1101                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1102                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1103         } else {
1104                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1105                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1106         }
1107         for (index = 0; index < count; index++) {
1108                 key = &(dev->key[index]);
1109                 printk(KERN_DEBUG "Key slot %02u: %s",
1110                        index, (key->keyconf == NULL) ? " " : "*");
1111                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1112                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1113                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1114                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1115                 }
1116 
1117                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1118                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1119                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1120 
1121                 if (index >= pairwise_keys_start) {
1122                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1123                                 printk("   TKIP: ");
1124                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1125                                 for (i = 0; i < 14; i += 2) {
1126                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1127                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1128                                 }
1129                         }
1130                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1131                                                 ((index - pairwise_keys_start) * 2) + 0);
1132                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1133                                                 ((index - pairwise_keys_start) * 2) + 1);
1134                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1135                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1136                         printk("   MAC: %pM", mac);
1137                 } else
1138                         printk("   DEFAULT KEY");
1139                 printk("\n");
1140         }
1141 }
1142 
1143 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1144 {
1145         u32 macctl;
1146         u16 ucstat;
1147         bool hwps;
1148         bool awake;
1149         int i;
1150 
1151         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1152                     (ps_flags & B43_PS_DISABLED));
1153         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1154 
1155         if (ps_flags & B43_PS_ENABLED) {
1156                 hwps = true;
1157         } else if (ps_flags & B43_PS_DISABLED) {
1158                 hwps = false;
1159         } else {
1160                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1161                 //      and thus is not an AP and we are associated, set bit 25
1162         }
1163         if (ps_flags & B43_PS_AWAKE) {
1164                 awake = true;
1165         } else if (ps_flags & B43_PS_ASLEEP) {
1166                 awake = false;
1167         } else {
1168                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1169                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1170                 //      successful, set bit26
1171         }
1172 
1173 /* FIXME: For now we force awake-on and hwps-off */
1174         hwps = false;
1175         awake = true;
1176 
1177         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1178         if (hwps)
1179                 macctl |= B43_MACCTL_HWPS;
1180         else
1181                 macctl &= ~B43_MACCTL_HWPS;
1182         if (awake)
1183                 macctl |= B43_MACCTL_AWAKE;
1184         else
1185                 macctl &= ~B43_MACCTL_AWAKE;
1186         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1187         /* Commit write */
1188         b43_read32(dev, B43_MMIO_MACCTL);
1189         if (awake && dev->dev->core_rev >= 5) {
1190                 /* Wait for the microcode to wake up. */
1191                 for (i = 0; i < 100; i++) {
1192                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1193                                                 B43_SHM_SH_UCODESTAT);
1194                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1195                                 break;
1196                         udelay(10);
1197                 }
1198         }
1199 }
1200 
1201 /* http://bcm-v4.sipsolutions.net/802.11/PHY/BmacCorePllReset */
1202 void b43_wireless_core_phy_pll_reset(struct b43_wldev *dev)
1203 {
1204         struct bcma_drv_cc *bcma_cc __maybe_unused;
1205         struct ssb_chipcommon *ssb_cc __maybe_unused;
1206 
1207         switch (dev->dev->bus_type) {
1208 #ifdef CONFIG_B43_BCMA
1209         case B43_BUS_BCMA:
1210                 bcma_cc = &dev->dev->bdev->bus->drv_cc;
1211 
1212                 bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
1213                 bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1214                 bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
1215                 bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1216                 break;
1217 #endif
1218 #ifdef CONFIG_B43_SSB
1219         case B43_BUS_SSB:
1220                 ssb_cc = &dev->dev->sdev->bus->chipco;
1221 
1222                 chipco_write32(ssb_cc, SSB_CHIPCO_CHIPCTL_ADDR, 0);
1223                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1224                 chipco_set32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, 0x4);
1225                 chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1226                 break;
1227 #endif
1228         }
1229 }
1230 
1231 #ifdef CONFIG_B43_BCMA
1232 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1233 {
1234         u32 flags;
1235 
1236         /* Put PHY into reset */
1237         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1238         flags |= B43_BCMA_IOCTL_PHY_RESET;
1239         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1240         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1241         udelay(2);
1242 
1243         b43_phy_take_out_of_reset(dev);
1244 }
1245 
1246 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1247 {
1248         u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1249                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1250         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1251                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
1252         u32 flags;
1253 
1254         flags = B43_BCMA_IOCTL_PHY_CLKEN;
1255         if (gmode)
1256                 flags |= B43_BCMA_IOCTL_GMODE;
1257         b43_device_enable(dev, flags);
1258 
1259         if (dev->phy.type == B43_PHYTYPE_AC) {
1260                 u16 tmp;
1261 
1262                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1263                 tmp &= ~B43_BCMA_IOCTL_DAC;
1264                 tmp |= 0x100;
1265                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1266 
1267                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1268                 tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
1269                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1270 
1271                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1272                 tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
1273                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1274         }
1275 
1276         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1277         b43_bcma_phy_reset(dev);
1278         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1279 }
1280 #endif
1281 
1282 #ifdef CONFIG_B43_SSB
1283 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1284 {
1285         u32 flags = 0;
1286 
1287         if (gmode)
1288                 flags |= B43_TMSLOW_GMODE;
1289         flags |= B43_TMSLOW_PHYCLKEN;
1290         flags |= B43_TMSLOW_PHYRESET;
1291         if (dev->phy.type == B43_PHYTYPE_N)
1292                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1293         b43_device_enable(dev, flags);
1294         msleep(2);              /* Wait for the PLL to turn on. */
1295 
1296         b43_phy_take_out_of_reset(dev);
1297 }
1298 #endif
1299 
1300 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1301 {
1302         u32 macctl;
1303 
1304         switch (dev->dev->bus_type) {
1305 #ifdef CONFIG_B43_BCMA
1306         case B43_BUS_BCMA:
1307                 b43_bcma_wireless_core_reset(dev, gmode);
1308                 break;
1309 #endif
1310 #ifdef CONFIG_B43_SSB
1311         case B43_BUS_SSB:
1312                 b43_ssb_wireless_core_reset(dev, gmode);
1313                 break;
1314 #endif
1315         }
1316 
1317         /* Turn Analog ON, but only if we already know the PHY-type.
1318          * This protects against very early setup where we don't know the
1319          * PHY-type, yet. wireless_core_reset will be called once again later,
1320          * when we know the PHY-type. */
1321         if (dev->phy.ops)
1322                 dev->phy.ops->switch_analog(dev, 1);
1323 
1324         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1325         macctl &= ~B43_MACCTL_GMODE;
1326         if (gmode)
1327                 macctl |= B43_MACCTL_GMODE;
1328         macctl |= B43_MACCTL_IHR_ENABLED;
1329         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1330 }
1331 
1332 static void handle_irq_transmit_status(struct b43_wldev *dev)
1333 {
1334         u32 v0, v1;
1335         u16 tmp;
1336         struct b43_txstatus stat;
1337 
1338         while (1) {
1339                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1340                 if (!(v0 & 0x00000001))
1341                         break;
1342                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1343 
1344                 stat.cookie = (v0 >> 16);
1345                 stat.seq = (v1 & 0x0000FFFF);
1346                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1347                 tmp = (v0 & 0x0000FFFF);
1348                 stat.frame_count = ((tmp & 0xF000) >> 12);
1349                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1350                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1351                 stat.pm_indicated = !!(tmp & 0x0080);
1352                 stat.intermediate = !!(tmp & 0x0040);
1353                 stat.for_ampdu = !!(tmp & 0x0020);
1354                 stat.acked = !!(tmp & 0x0002);
1355 
1356                 b43_handle_txstatus(dev, &stat);
1357         }
1358 }
1359 
1360 static void drain_txstatus_queue(struct b43_wldev *dev)
1361 {
1362         u32 dummy;
1363 
1364         if (dev->dev->core_rev < 5)
1365                 return;
1366         /* Read all entries from the microcode TXstatus FIFO
1367          * and throw them away.
1368          */
1369         while (1) {
1370                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1371                 if (!(dummy & 0x00000001))
1372                         break;
1373                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1374         }
1375 }
1376 
1377 static u32 b43_jssi_read(struct b43_wldev *dev)
1378 {
1379         u32 val = 0;
1380 
1381         val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1382         val <<= 16;
1383         val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1384 
1385         return val;
1386 }
1387 
1388 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1389 {
1390         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1391                         (jssi & 0x0000FFFF));
1392         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1393                         (jssi & 0xFFFF0000) >> 16);
1394 }
1395 
1396 static void b43_generate_noise_sample(struct b43_wldev *dev)
1397 {
1398         b43_jssi_write(dev, 0x7F7F7F7F);
1399         b43_write32(dev, B43_MMIO_MACCMD,
1400                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1401 }
1402 
1403 static void b43_calculate_link_quality(struct b43_wldev *dev)
1404 {
1405         /* Top half of Link Quality calculation. */
1406 
1407         if (dev->phy.type != B43_PHYTYPE_G)
1408                 return;
1409         if (dev->noisecalc.calculation_running)
1410                 return;
1411         dev->noisecalc.calculation_running = true;
1412         dev->noisecalc.nr_samples = 0;
1413 
1414         b43_generate_noise_sample(dev);
1415 }
1416 
1417 static void handle_irq_noise(struct b43_wldev *dev)
1418 {
1419         struct b43_phy_g *phy = dev->phy.g;
1420         u16 tmp;
1421         u8 noise[4];
1422         u8 i, j;
1423         s32 average;
1424 
1425         /* Bottom half of Link Quality calculation. */
1426 
1427         if (dev->phy.type != B43_PHYTYPE_G)
1428                 return;
1429 
1430         /* Possible race condition: It might be possible that the user
1431          * changed to a different channel in the meantime since we
1432          * started the calculation. We ignore that fact, since it's
1433          * not really that much of a problem. The background noise is
1434          * an estimation only anyway. Slightly wrong results will get damped
1435          * by the averaging of the 8 sample rounds. Additionally the
1436          * value is shortlived. So it will be replaced by the next noise
1437          * calculation round soon. */
1438 
1439         B43_WARN_ON(!dev->noisecalc.calculation_running);
1440         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1441         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1442             noise[2] == 0x7F || noise[3] == 0x7F)
1443                 goto generate_new;
1444 
1445         /* Get the noise samples. */
1446         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1447         i = dev->noisecalc.nr_samples;
1448         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1449         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1450         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1451         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1452         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1453         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1454         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1455         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1456         dev->noisecalc.nr_samples++;
1457         if (dev->noisecalc.nr_samples == 8) {
1458                 /* Calculate the Link Quality by the noise samples. */
1459                 average = 0;
1460                 for (i = 0; i < 8; i++) {
1461                         for (j = 0; j < 4; j++)
1462                                 average += dev->noisecalc.samples[i][j];
1463                 }
1464                 average /= (8 * 4);
1465                 average *= 125;
1466                 average += 64;
1467                 average /= 128;
1468                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1469                 tmp = (tmp / 128) & 0x1F;
1470                 if (tmp >= 8)
1471                         average += 2;
1472                 else
1473                         average -= 25;
1474                 if (tmp == 8)
1475                         average -= 72;
1476                 else
1477                         average -= 48;
1478 
1479                 dev->stats.link_noise = average;
1480                 dev->noisecalc.calculation_running = false;
1481                 return;
1482         }
1483 generate_new:
1484         b43_generate_noise_sample(dev);
1485 }
1486 
1487 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1488 {
1489         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1490                 ///TODO: PS TBTT
1491         } else {
1492                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1493                         b43_power_saving_ctl_bits(dev, 0);
1494         }
1495         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1496                 dev->dfq_valid = true;
1497 }
1498 
1499 static void handle_irq_atim_end(struct b43_wldev *dev)
1500 {
1501         if (dev->dfq_valid) {
1502                 b43_write32(dev, B43_MMIO_MACCMD,
1503                             b43_read32(dev, B43_MMIO_MACCMD)
1504                             | B43_MACCMD_DFQ_VALID);
1505                 dev->dfq_valid = false;
1506         }
1507 }
1508 
1509 static void handle_irq_pmq(struct b43_wldev *dev)
1510 {
1511         u32 tmp;
1512 
1513         //TODO: AP mode.
1514 
1515         while (1) {
1516                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1517                 if (!(tmp & 0x00000008))
1518                         break;
1519         }
1520         /* 16bit write is odd, but correct. */
1521         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1522 }
1523 
1524 static void b43_write_template_common(struct b43_wldev *dev,
1525                                       const u8 *data, u16 size,
1526                                       u16 ram_offset,
1527                                       u16 shm_size_offset, u8 rate)
1528 {
1529         u32 i, tmp;
1530         struct b43_plcp_hdr4 plcp;
1531 
1532         plcp.data = 0;
1533         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1534         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1535         ram_offset += sizeof(u32);
1536         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1537          * So leave the first two bytes of the next write blank.
1538          */
1539         tmp = (u32) (data[0]) << 16;
1540         tmp |= (u32) (data[1]) << 24;
1541         b43_ram_write(dev, ram_offset, tmp);
1542         ram_offset += sizeof(u32);
1543         for (i = 2; i < size; i += sizeof(u32)) {
1544                 tmp = (u32) (data[i + 0]);
1545                 if (i + 1 < size)
1546                         tmp |= (u32) (data[i + 1]) << 8;
1547                 if (i + 2 < size)
1548                         tmp |= (u32) (data[i + 2]) << 16;
1549                 if (i + 3 < size)
1550                         tmp |= (u32) (data[i + 3]) << 24;
1551                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1552         }
1553         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1554                         size + sizeof(struct b43_plcp_hdr6));
1555 }
1556 
1557 /* Check if the use of the antenna that ieee80211 told us to
1558  * use is possible. This will fall back to DEFAULT.
1559  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1560 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1561                                   u8 antenna_nr)
1562 {
1563         u8 antenna_mask;
1564 
1565         if (antenna_nr == 0) {
1566                 /* Zero means "use default antenna". That's always OK. */
1567                 return 0;
1568         }
1569 
1570         /* Get the mask of available antennas. */
1571         if (dev->phy.gmode)
1572                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1573         else
1574                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1575 
1576         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1577                 /* This antenna is not available. Fall back to default. */
1578                 return 0;
1579         }
1580 
1581         return antenna_nr;
1582 }
1583 
1584 /* Convert a b43 antenna number value to the PHY TX control value. */
1585 static u16 b43_antenna_to_phyctl(int antenna)
1586 {
1587         switch (antenna) {
1588         case B43_ANTENNA0:
1589                 return B43_TXH_PHY_ANT0;
1590         case B43_ANTENNA1:
1591                 return B43_TXH_PHY_ANT1;
1592         case B43_ANTENNA2:
1593                 return B43_TXH_PHY_ANT2;
1594         case B43_ANTENNA3:
1595                 return B43_TXH_PHY_ANT3;
1596         case B43_ANTENNA_AUTO0:
1597         case B43_ANTENNA_AUTO1:
1598                 return B43_TXH_PHY_ANT01AUTO;
1599         }
1600         B43_WARN_ON(1);
1601         return 0;
1602 }
1603 
1604 static void b43_write_beacon_template(struct b43_wldev *dev,
1605                                       u16 ram_offset,
1606                                       u16 shm_size_offset)
1607 {
1608         unsigned int i, len, variable_len;
1609         const struct ieee80211_mgmt *bcn;
1610         const u8 *ie;
1611         bool tim_found = false;
1612         unsigned int rate;
1613         u16 ctl;
1614         int antenna;
1615         struct ieee80211_tx_info *info;
1616         unsigned long flags;
1617         struct sk_buff *beacon_skb;
1618 
1619         spin_lock_irqsave(&dev->wl->beacon_lock, flags);
1620         info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1621         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1622         /* Clone the beacon, so it cannot go away, while we write it to hw. */
1623         beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
1624         spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
1625 
1626         if (!beacon_skb) {
1627                 b43dbg(dev->wl, "Could not upload beacon. "
1628                        "Failed to clone beacon skb.");
1629                 return;
1630         }
1631 
1632         bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
1633         len = min_t(size_t, beacon_skb->len,
1634                     0x200 - sizeof(struct b43_plcp_hdr6));
1635 
1636         b43_write_template_common(dev, (const u8 *)bcn,
1637                                   len, ram_offset, shm_size_offset, rate);
1638 
1639         /* Write the PHY TX control parameters. */
1640         antenna = B43_ANTENNA_DEFAULT;
1641         antenna = b43_antenna_to_phyctl(antenna);
1642         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1643         /* We can't send beacons with short preamble. Would get PHY errors. */
1644         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1645         ctl &= ~B43_TXH_PHY_ANT;
1646         ctl &= ~B43_TXH_PHY_ENC;
1647         ctl |= antenna;
1648         if (b43_is_cck_rate(rate))
1649                 ctl |= B43_TXH_PHY_ENC_CCK;
1650         else
1651                 ctl |= B43_TXH_PHY_ENC_OFDM;
1652         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1653 
1654         /* Find the position of the TIM and the DTIM_period value
1655          * and write them to SHM. */
1656         ie = bcn->u.beacon.variable;
1657         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1658         for (i = 0; i < variable_len - 2; ) {
1659                 uint8_t ie_id, ie_len;
1660 
1661                 ie_id = ie[i];
1662                 ie_len = ie[i + 1];
1663                 if (ie_id == 5) {
1664                         u16 tim_position;
1665                         u16 dtim_period;
1666                         /* This is the TIM Information Element */
1667 
1668                         /* Check whether the ie_len is in the beacon data range. */
1669                         if (variable_len < ie_len + 2 + i)
1670                                 break;
1671                         /* A valid TIM is at least 4 bytes long. */
1672                         if (ie_len < 4)
1673                                 break;
1674                         tim_found = true;
1675 
1676                         tim_position = sizeof(struct b43_plcp_hdr6);
1677                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1678                         tim_position += i;
1679 
1680                         dtim_period = ie[i + 3];
1681 
1682                         b43_shm_write16(dev, B43_SHM_SHARED,
1683                                         B43_SHM_SH_TIMBPOS, tim_position);
1684                         b43_shm_write16(dev, B43_SHM_SHARED,
1685                                         B43_SHM_SH_DTIMPER, dtim_period);
1686                         break;
1687                 }
1688                 i += ie_len + 2;
1689         }
1690         if (!tim_found) {
1691                 /*
1692                  * If ucode wants to modify TIM do it behind the beacon, this
1693                  * will happen, for example, when doing mesh networking.
1694                  */
1695                 b43_shm_write16(dev, B43_SHM_SHARED,
1696                                 B43_SHM_SH_TIMBPOS,
1697                                 len + sizeof(struct b43_plcp_hdr6));
1698                 b43_shm_write16(dev, B43_SHM_SHARED,
1699                                 B43_SHM_SH_DTIMPER, 0);
1700         }
1701         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1702 
1703         dev_kfree_skb_any(beacon_skb);
1704 }
1705 
1706 static void b43_upload_beacon0(struct b43_wldev *dev)
1707 {
1708         struct b43_wl *wl = dev->wl;
1709 
1710         if (wl->beacon0_uploaded)
1711                 return;
1712         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1713         wl->beacon0_uploaded = true;
1714 }
1715 
1716 static void b43_upload_beacon1(struct b43_wldev *dev)
1717 {
1718         struct b43_wl *wl = dev->wl;
1719 
1720         if (wl->beacon1_uploaded)
1721                 return;
1722         b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1723         wl->beacon1_uploaded = true;
1724 }
1725 
1726 static void handle_irq_beacon(struct b43_wldev *dev)
1727 {
1728         struct b43_wl *wl = dev->wl;
1729         u32 cmd, beacon0_valid, beacon1_valid;
1730 
1731         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1732             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1733             !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1734                 return;
1735 
1736         /* This is the bottom half of the asynchronous beacon update. */
1737 
1738         /* Ignore interrupt in the future. */
1739         dev->irq_mask &= ~B43_IRQ_BEACON;
1740 
1741         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1742         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1743         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1744 
1745         /* Schedule interrupt manually, if busy. */
1746         if (beacon0_valid && beacon1_valid) {
1747                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1748                 dev->irq_mask |= B43_IRQ_BEACON;
1749                 return;
1750         }
1751 
1752         if (unlikely(wl->beacon_templates_virgin)) {
1753                 /* We never uploaded a beacon before.
1754                  * Upload both templates now, but only mark one valid. */
1755                 wl->beacon_templates_virgin = false;
1756                 b43_upload_beacon0(dev);
1757                 b43_upload_beacon1(dev);
1758                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1759                 cmd |= B43_MACCMD_BEACON0_VALID;
1760                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1761         } else {
1762                 if (!beacon0_valid) {
1763                         b43_upload_beacon0(dev);
1764                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1765                         cmd |= B43_MACCMD_BEACON0_VALID;
1766                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1767                 } else if (!beacon1_valid) {
1768                         b43_upload_beacon1(dev);
1769                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1770                         cmd |= B43_MACCMD_BEACON1_VALID;
1771                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1772                 }
1773         }
1774 }
1775 
1776 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1777 {
1778         u32 old_irq_mask = dev->irq_mask;
1779 
1780         /* update beacon right away or defer to irq */
1781         handle_irq_beacon(dev);
1782         if (old_irq_mask != dev->irq_mask) {
1783                 /* The handler updated the IRQ mask. */
1784                 B43_WARN_ON(!dev->irq_mask);
1785                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1786                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1787                 } else {
1788                         /* Device interrupts are currently disabled. That means
1789                          * we just ran the hardirq handler and scheduled the
1790                          * IRQ thread. The thread will write the IRQ mask when
1791                          * it finished, so there's nothing to do here. Writing
1792                          * the mask _here_ would incorrectly re-enable IRQs. */
1793                 }
1794         }
1795 }
1796 
1797 static void b43_beacon_update_trigger_work(struct work_struct *work)
1798 {
1799         struct b43_wl *wl = container_of(work, struct b43_wl,
1800                                          beacon_update_trigger);
1801         struct b43_wldev *dev;
1802 
1803         mutex_lock(&wl->mutex);
1804         dev = wl->current_dev;
1805         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1806                 if (b43_bus_host_is_sdio(dev->dev)) {
1807                         /* wl->mutex is enough. */
1808                         b43_do_beacon_update_trigger_work(dev);
1809                 } else {
1810                         spin_lock_irq(&wl->hardirq_lock);
1811                         b43_do_beacon_update_trigger_work(dev);
1812                         spin_unlock_irq(&wl->hardirq_lock);
1813                 }
1814         }
1815         mutex_unlock(&wl->mutex);
1816 }
1817 
1818 /* Asynchronously update the packet templates in template RAM. */
1819 static void b43_update_templates(struct b43_wl *wl)
1820 {
1821         struct sk_buff *beacon, *old_beacon;
1822         unsigned long flags;
1823 
1824         /* This is the top half of the asynchronous beacon update.
1825          * The bottom half is the beacon IRQ.
1826          * Beacon update must be asynchronous to avoid sending an
1827          * invalid beacon. This can happen for example, if the firmware
1828          * transmits a beacon while we are updating it. */
1829 
1830         /* We could modify the existing beacon and set the aid bit in
1831          * the TIM field, but that would probably require resizing and
1832          * moving of data within the beacon template.
1833          * Simply request a new beacon and let mac80211 do the hard work. */
1834         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1835         if (unlikely(!beacon))
1836                 return;
1837 
1838         spin_lock_irqsave(&wl->beacon_lock, flags);
1839         old_beacon = wl->current_beacon;
1840         wl->current_beacon = beacon;
1841         wl->beacon0_uploaded = false;
1842         wl->beacon1_uploaded = false;
1843         spin_unlock_irqrestore(&wl->beacon_lock, flags);
1844 
1845         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1846 
1847         if (old_beacon)
1848                 dev_kfree_skb_any(old_beacon);
1849 }
1850 
1851 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1852 {
1853         b43_time_lock(dev);
1854         if (dev->dev->core_rev >= 3) {
1855                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1856                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1857         } else {
1858                 b43_write16(dev, 0x606, (beacon_int >> 6));
1859                 b43_write16(dev, 0x610, beacon_int);
1860         }
1861         b43_time_unlock(dev);
1862         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1863 }
1864 
1865 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1866 {
1867         u16 reason;
1868 
1869         /* Read the register that contains the reason code for the panic. */
1870         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1871         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1872 
1873         switch (reason) {
1874         default:
1875                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1876                 /* fallthrough */
1877         case B43_FWPANIC_DIE:
1878                 /* Do not restart the controller or firmware.
1879                  * The device is nonfunctional from now on.
1880                  * Restarting would result in this panic to trigger again,
1881                  * so we avoid that recursion. */
1882                 break;
1883         case B43_FWPANIC_RESTART:
1884                 b43_controller_restart(dev, "Microcode panic");
1885                 break;
1886         }
1887 }
1888 
1889 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1890 {
1891         unsigned int i, cnt;
1892         u16 reason, marker_id, marker_line;
1893         __le16 *buf;
1894 
1895         /* The proprietary firmware doesn't have this IRQ. */
1896         if (!dev->fw.opensource)
1897                 return;
1898 
1899         /* Read the register that contains the reason code for this IRQ. */
1900         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1901 
1902         switch (reason) {
1903         case B43_DEBUGIRQ_PANIC:
1904                 b43_handle_firmware_panic(dev);
1905                 break;
1906         case B43_DEBUGIRQ_DUMP_SHM:
1907                 if (!B43_DEBUG)
1908                         break; /* Only with driver debugging enabled. */
1909                 buf = kmalloc(4096, GFP_ATOMIC);
1910                 if (!buf) {
1911                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1912                         goto out;
1913                 }
1914                 for (i = 0; i < 4096; i += 2) {
1915                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1916                         buf[i / 2] = cpu_to_le16(tmp);
1917                 }
1918                 b43info(dev->wl, "Shared memory dump:\n");
1919                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1920                                16, 2, buf, 4096, 1);
1921                 kfree(buf);
1922                 break;
1923         case B43_DEBUGIRQ_DUMP_REGS:
1924                 if (!B43_DEBUG)
1925                         break; /* Only with driver debugging enabled. */
1926                 b43info(dev->wl, "Microcode register dump:\n");
1927                 for (i = 0, cnt = 0; i < 64; i++) {
1928                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1929                         if (cnt == 0)
1930                                 printk(KERN_INFO);
1931                         printk("r%02u: 0x%04X  ", i, tmp);
1932                         cnt++;
1933                         if (cnt == 6) {
1934                                 printk("\n");
1935                                 cnt = 0;
1936                         }
1937                 }
1938                 printk("\n");
1939                 break;
1940         case B43_DEBUGIRQ_MARKER:
1941                 if (!B43_DEBUG)
1942                         break; /* Only with driver debugging enabled. */
1943                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1944                                            B43_MARKER_ID_REG);
1945                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1946                                              B43_MARKER_LINE_REG);
1947                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1948                         "at line number %u\n",
1949                         marker_id, marker_line);
1950                 break;
1951         default:
1952                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1953                        reason);
1954         }
1955 out:
1956         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1957         b43_shm_write16(dev, B43_SHM_SCRATCH,
1958                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1959 }
1960 
1961 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1962 {
1963         u32 reason;
1964         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1965         u32 merged_dma_reason = 0;
1966         int i;
1967 
1968         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1969                 return;
1970 
1971         reason = dev->irq_reason;
1972         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1973                 dma_reason[i] = dev->dma_reason[i];
1974                 merged_dma_reason |= dma_reason[i];
1975         }
1976 
1977         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1978                 b43err(dev->wl, "MAC transmission error\n");
1979 
1980         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1981                 b43err(dev->wl, "PHY transmission error\n");
1982                 rmb();
1983                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1984                         atomic_set(&dev->phy.txerr_cnt,
1985                                    B43_PHY_TX_BADNESS_LIMIT);
1986                         b43err(dev->wl, "Too many PHY TX errors, "
1987                                         "restarting the controller\n");
1988                         b43_controller_restart(dev, "PHY TX errors");
1989                 }
1990         }
1991 
1992         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
1993                 b43err(dev->wl,
1994                         "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1995                         dma_reason[0], dma_reason[1],
1996                         dma_reason[2], dma_reason[3],
1997                         dma_reason[4], dma_reason[5]);
1998                 b43err(dev->wl, "This device does not support DMA "
1999                                "on your system. It will now be switched to PIO.\n");
2000                 /* Fall back to PIO transfers if we get fatal DMA errors! */
2001                 dev->use_pio = true;
2002                 b43_controller_restart(dev, "DMA error");
2003                 return;
2004         }
2005 
2006         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
2007                 handle_irq_ucode_debug(dev);
2008         if (reason & B43_IRQ_TBTT_INDI)
2009                 handle_irq_tbtt_indication(dev);
2010         if (reason & B43_IRQ_ATIM_END)
2011                 handle_irq_atim_end(dev);
2012         if (reason & B43_IRQ_BEACON)
2013                 handle_irq_beacon(dev);
2014         if (reason & B43_IRQ_PMQ)
2015                 handle_irq_pmq(dev);
2016         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
2017                 ;/* TODO */
2018         if (reason & B43_IRQ_NOISESAMPLE_OK)
2019                 handle_irq_noise(dev);
2020 
2021         /* Check the DMA reason registers for received data. */
2022         if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
2023                 if (B43_DEBUG)
2024                         b43warn(dev->wl, "RX descriptor underrun\n");
2025                 b43_dma_handle_rx_overflow(dev->dma.rx_ring);
2026         }
2027         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
2028                 if (b43_using_pio_transfers(dev))
2029                         b43_pio_rx(dev->pio.rx_queue);
2030                 else
2031                         b43_dma_rx(dev->dma.rx_ring);
2032         }
2033         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
2034         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
2035         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
2036         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
2037         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
2038 
2039         if (reason & B43_IRQ_TX_OK)
2040                 handle_irq_transmit_status(dev);
2041 
2042         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
2043         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2044 
2045 #if B43_DEBUG
2046         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2047                 dev->irq_count++;
2048                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2049                         if (reason & (1 << i))
2050                                 dev->irq_bit_count[i]++;
2051                 }
2052         }
2053 #endif
2054 }
2055 
2056 /* Interrupt thread handler. Handles device interrupts in thread context. */
2057 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
2058 {
2059         struct b43_wldev *dev = dev_id;
2060 
2061         mutex_lock(&dev->wl->mutex);
2062         b43_do_interrupt_thread(dev);
2063         mutex_unlock(&dev->wl->mutex);
2064 
2065         return IRQ_HANDLED;
2066 }
2067 
2068 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2069 {
2070         u32 reason;
2071 
2072         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2073          * On SDIO, this runs under wl->mutex. */
2074 
2075         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2076         if (reason == 0xffffffff)       /* shared IRQ */
2077                 return IRQ_NONE;
2078         reason &= dev->irq_mask;
2079         if (!reason)
2080                 return IRQ_NONE;
2081 
2082         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2083             & 0x0001FC00;
2084         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2085             & 0x0000DC00;
2086         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2087             & 0x0000DC00;
2088         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2089             & 0x0001DC00;
2090         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2091             & 0x0000DC00;
2092 /* Unused ring
2093         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2094             & 0x0000DC00;
2095 */
2096 
2097         /* ACK the interrupt. */
2098         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2099         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2100         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2101         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2102         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2103         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2104 /* Unused ring
2105         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2106 */
2107 
2108         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2109         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2110         /* Save the reason bitmasks for the IRQ thread handler. */
2111         dev->irq_reason = reason;
2112 
2113         return IRQ_WAKE_THREAD;
2114 }
2115 
2116 /* Interrupt handler top-half. This runs with interrupts disabled. */
2117 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2118 {
2119         struct b43_wldev *dev = dev_id;
2120         irqreturn_t ret;
2121 
2122         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2123                 return IRQ_NONE;
2124 
2125         spin_lock(&dev->wl->hardirq_lock);
2126         ret = b43_do_interrupt(dev);
2127         spin_unlock(&dev->wl->hardirq_lock);
2128 
2129         return ret;
2130 }
2131 
2132 /* SDIO interrupt handler. This runs in process context. */
2133 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2134 {
2135         struct b43_wl *wl = dev->wl;
2136         irqreturn_t ret;
2137 
2138         mutex_lock(&wl->mutex);
2139 
2140         ret = b43_do_interrupt(dev);
2141         if (ret == IRQ_WAKE_THREAD)
2142                 b43_do_interrupt_thread(dev);
2143 
2144         mutex_unlock(&wl->mutex);
2145 }
2146 
2147 void b43_do_release_fw(struct b43_firmware_file *fw)
2148 {
2149         release_firmware(fw->data);
2150         fw->data = NULL;
2151         fw->filename = NULL;
2152 }
2153 
2154 static void b43_release_firmware(struct b43_wldev *dev)
2155 {
2156         complete(&dev->fw_load_complete);
2157         b43_do_release_fw(&dev->fw.ucode);
2158         b43_do_release_fw(&dev->fw.pcm);
2159         b43_do_release_fw(&dev->fw.initvals);
2160         b43_do_release_fw(&dev->fw.initvals_band);
2161 }
2162 
2163 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2164 {
2165         const char text[] =
2166                 "You must go to " \
2167                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2168                 "and download the correct firmware for this driver version. " \
2169                 "Please carefully read all instructions on this website.\n";
2170 
2171         if (error)
2172                 b43err(wl, text);
2173         else
2174                 b43warn(wl, text);
2175 }
2176 
2177 static void b43_fw_cb(const struct firmware *firmware, void *context)
2178 {
2179         struct b43_request_fw_context *ctx = context;
2180 
2181         ctx->blob = firmware;
2182         complete(&ctx->dev->fw_load_complete);
2183 }
2184 
2185 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2186                       const char *name,
2187                       struct b43_firmware_file *fw, bool async)
2188 {
2189         struct b43_fw_header *hdr;
2190         u32 size;
2191         int err;
2192 
2193         if (!name) {
2194                 /* Don't fetch anything. Free possibly cached firmware. */
2195                 /* FIXME: We should probably keep it anyway, to save some headache
2196                  * on suspend/resume with multiband devices. */
2197                 b43_do_release_fw(fw);
2198                 return 0;
2199         }
2200         if (fw->filename) {
2201                 if ((fw->type == ctx->req_type) &&
2202                     (strcmp(fw->filename, name) == 0))
2203                         return 0; /* Already have this fw. */
2204                 /* Free the cached firmware first. */
2205                 /* FIXME: We should probably do this later after we successfully
2206                  * got the new fw. This could reduce headache with multiband devices.
2207                  * We could also redesign this to cache the firmware for all possible
2208                  * bands all the time. */
2209                 b43_do_release_fw(fw);
2210         }
2211 
2212         switch (ctx->req_type) {
2213         case B43_FWTYPE_PROPRIETARY:
2214                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2215                          "b43%s/%s.fw",
2216                          modparam_fwpostfix, name);
2217                 break;
2218         case B43_FWTYPE_OPENSOURCE:
2219                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2220                          "b43-open%s/%s.fw",
2221                          modparam_fwpostfix, name);
2222                 break;
2223         default:
2224                 B43_WARN_ON(1);
2225                 return -ENOSYS;
2226         }
2227         if (async) {
2228                 /* do this part asynchronously */
2229                 init_completion(&ctx->dev->fw_load_complete);
2230                 err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2231                                               ctx->dev->dev->dev, GFP_KERNEL,
2232                                               ctx, b43_fw_cb);
2233                 if (err < 0) {
2234                         pr_err("Unable to load firmware\n");
2235                         return err;
2236                 }
2237                 wait_for_completion(&ctx->dev->fw_load_complete);
2238                 if (ctx->blob)
2239                         goto fw_ready;
2240         /* On some ARM systems, the async request will fail, but the next sync
2241          * request works. For this reason, we fall through here
2242          */
2243         }
2244         err = request_firmware(&ctx->blob, ctx->fwname,
2245                                ctx->dev->dev->dev);
2246         if (err == -ENOENT) {
2247                 snprintf(ctx->errors[ctx->req_type],
2248                          sizeof(ctx->errors[ctx->req_type]),
2249                          "Firmware file \"%s\" not found\n",
2250                          ctx->fwname);
2251                 return err;
2252         } else if (err) {
2253                 snprintf(ctx->errors[ctx->req_type],
2254                          sizeof(ctx->errors[ctx->req_type]),
2255                          "Firmware file \"%s\" request failed (err=%d)\n",
2256                          ctx->fwname, err);
2257                 return err;
2258         }
2259 fw_ready:
2260         if (ctx->blob->size < sizeof(struct b43_fw_header))
2261                 goto err_format;
2262         hdr = (struct b43_fw_header *)(ctx->blob->data);
2263         switch (hdr->type) {
2264         case B43_FW_TYPE_UCODE:
2265         case B43_FW_TYPE_PCM:
2266                 size = be32_to_cpu(hdr->size);
2267                 if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2268                         goto err_format;
2269                 /* fallthrough */
2270         case B43_FW_TYPE_IV:
2271                 if (hdr->ver != 1)
2272                         goto err_format;
2273                 break;
2274         default:
2275                 goto err_format;
2276         }
2277 
2278         fw->data = ctx->blob;
2279         fw->filename = name;
2280         fw->type = ctx->req_type;
2281 
2282         return 0;
2283 
2284 err_format:
2285         snprintf(ctx->errors[ctx->req_type],
2286                  sizeof(ctx->errors[ctx->req_type]),
2287                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2288         release_firmware(ctx->blob);
2289 
2290         return -EPROTO;
2291 }
2292 
2293 /* http://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2294 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2295 {
2296         struct b43_wldev *dev = ctx->dev;
2297         struct b43_firmware *fw = &ctx->dev->fw;
2298         struct b43_phy *phy = &dev->phy;
2299         const u8 rev = ctx->dev->dev->core_rev;
2300         const char *filename;
2301         int err;
2302 
2303         /* Get microcode */
2304         filename = NULL;
2305         switch (rev) {
2306         case 42:
2307                 if (phy->type == B43_PHYTYPE_AC)
2308                         filename = "ucode42";
2309                 break;
2310         case 40:
2311                 if (phy->type == B43_PHYTYPE_AC)
2312                         filename = "ucode40";
2313                 break;
2314         case 33:
2315                 if (phy->type == B43_PHYTYPE_LCN40)
2316                         filename = "ucode33_lcn40";
2317                 break;
2318         case 30:
2319                 if (phy->type == B43_PHYTYPE_N)
2320                         filename = "ucode30_mimo";
2321                 break;
2322         case 29:
2323                 if (phy->type == B43_PHYTYPE_HT)
2324                         filename = "ucode29_mimo";
2325                 break;
2326         case 26:
2327                 if (phy->type == B43_PHYTYPE_HT)
2328                         filename = "ucode26_mimo";
2329                 break;
2330         case 28:
2331         case 25:
2332                 if (phy->type == B43_PHYTYPE_N)
2333                         filename = "ucode25_mimo";
2334                 else if (phy->type == B43_PHYTYPE_LCN)
2335                         filename = "ucode25_lcn";
2336                 break;
2337         case 24:
2338                 if (phy->type == B43_PHYTYPE_LCN)
2339                         filename = "ucode24_lcn";
2340                 break;
2341         case 23:
2342                 if (phy->type == B43_PHYTYPE_N)
2343                         filename = "ucode16_mimo";
2344                 break;
2345         case 16 ... 19:
2346                 if (phy->type == B43_PHYTYPE_N)
2347                         filename = "ucode16_mimo";
2348                 else if (phy->type == B43_PHYTYPE_LP)
2349                         filename = "ucode16_lp";
2350                 break;
2351         case 15:
2352                 filename = "ucode15";
2353                 break;
2354         case 14:
2355                 filename = "ucode14";
2356                 break;
2357         case 13:
2358                 filename = "ucode13";
2359                 break;
2360         case 11 ... 12:
2361                 filename = "ucode11";
2362                 break;
2363         case 5 ... 10:
2364                 filename = "ucode5";
2365                 break;
2366         }
2367         if (!filename)
2368                 goto err_no_ucode;
2369         err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2370         if (err)
2371                 goto err_load;
2372 
2373         /* Get PCM code */
2374         if ((rev >= 5) && (rev <= 10))
2375                 filename = "pcm5";
2376         else if (rev >= 11)
2377                 filename = NULL;
2378         else
2379                 goto err_no_pcm;
2380         fw->pcm_request_failed = false;
2381         err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2382         if (err == -ENOENT) {
2383                 /* We did not find a PCM file? Not fatal, but
2384                  * core rev <= 10 must do without hwcrypto then. */
2385                 fw->pcm_request_failed = true;
2386         } else if (err)
2387                 goto err_load;
2388 
2389         /* Get initvals */
2390         filename = NULL;
2391         switch (dev->phy.type) {
2392         case B43_PHYTYPE_G:
2393                 if (rev == 13)
2394                         filename = "b0g0initvals13";
2395                 else if (rev >= 5 && rev <= 10)
2396                         filename = "b0g0initvals5";
2397                 break;
2398         case B43_PHYTYPE_N:
2399                 if (rev == 30)
2400                         filename = "n16initvals30";
2401                 else if (rev == 28 || rev == 25)
2402                         filename = "n0initvals25";
2403                 else if (rev == 24)
2404                         filename = "n0initvals24";
2405                 else if (rev == 23)
2406                         filename = "n0initvals16"; /* What about n0initvals22? */
2407                 else if (rev >= 16 && rev <= 18)
2408                         filename = "n0initvals16";
2409                 else if (rev >= 11 && rev <= 12)
2410                         filename = "n0initvals11";
2411                 break;
2412         case B43_PHYTYPE_LP:
2413                 if (rev >= 16 && rev <= 18)
2414                         filename = "lp0initvals16";
2415                 else if (rev == 15)
2416                         filename = "lp0initvals15";
2417                 else if (rev == 14)
2418                         filename = "lp0initvals14";
2419                 else if (rev == 13)
2420                         filename = "lp0initvals13";
2421                 break;
2422         case B43_PHYTYPE_HT:
2423                 if (rev == 29)
2424                         filename = "ht0initvals29";
2425                 else if (rev == 26)
2426                         filename = "ht0initvals26";
2427                 break;
2428         case B43_PHYTYPE_LCN:
2429                 if (rev == 24)
2430                         filename = "lcn0initvals24";
2431                 break;
2432         case B43_PHYTYPE_LCN40:
2433                 if (rev == 33)
2434                         filename = "lcn400initvals33";
2435                 break;
2436         case B43_PHYTYPE_AC:
2437                 if (rev == 42)
2438                         filename = "ac1initvals42";
2439                 else if (rev == 40)
2440                         filename = "ac0initvals40";
2441                 break;
2442         }
2443         if (!filename)
2444                 goto err_no_initvals;
2445         err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2446         if (err)
2447                 goto err_load;
2448 
2449         /* Get bandswitch initvals */
2450         filename = NULL;
2451         switch (dev->phy.type) {
2452         case B43_PHYTYPE_G:
2453                 if (rev == 13)
2454                         filename = "b0g0bsinitvals13";
2455                 else if (rev >= 5 && rev <= 10)
2456                         filename = "b0g0bsinitvals5";
2457                 break;
2458         case B43_PHYTYPE_N:
2459                 if (rev == 30)
2460                         filename = "n16bsinitvals30";
2461                 else if (rev == 28 || rev == 25)
2462                         filename = "n0bsinitvals25";
2463                 else if (rev == 24)
2464                         filename = "n0bsinitvals24";
2465                 else if (rev == 23)
2466                         filename = "n0bsinitvals16"; /* What about n0bsinitvals22? */
2467                 else if (rev >= 16 && rev <= 18)
2468                         filename = "n0bsinitvals16";
2469                 else if (rev >= 11 && rev <= 12)
2470                         filename = "n0bsinitvals11";
2471                 break;
2472         case B43_PHYTYPE_LP:
2473                 if (rev >= 16 && rev <= 18)
2474                         filename = "lp0bsinitvals16";
2475                 else if (rev == 15)
2476                         filename = "lp0bsinitvals15";
2477                 else if (rev == 14)
2478                         filename = "lp0bsinitvals14";
2479                 else if (rev == 13)
2480                         filename = "lp0bsinitvals13";
2481                 break;
2482         case B43_PHYTYPE_HT:
2483                 if (rev == 29)
2484                         filename = "ht0bsinitvals29";
2485                 else if (rev == 26)
2486                         filename = "ht0bsinitvals26";
2487                 break;
2488         case B43_PHYTYPE_LCN:
2489                 if (rev == 24)
2490                         filename = "lcn0bsinitvals24";
2491                 break;
2492         case B43_PHYTYPE_LCN40:
2493                 if (rev == 33)
2494                         filename = "lcn400bsinitvals33";
2495                 break;
2496         case B43_PHYTYPE_AC:
2497                 if (rev == 42)
2498                         filename = "ac1bsinitvals42";
2499                 else if (rev == 40)
2500                         filename = "ac0bsinitvals40";
2501                 break;
2502         }
2503         if (!filename)
2504                 goto err_no_initvals;
2505         err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2506         if (err)
2507                 goto err_load;
2508 
2509         fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2510 
2511         return 0;
2512 
2513 err_no_ucode:
2514         err = ctx->fatal_failure = -EOPNOTSUPP;
2515         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2516                "is required for your device (wl-core rev %u)\n", rev);
2517         goto error;
2518 
2519 err_no_pcm:
2520         err = ctx->fatal_failure = -EOPNOTSUPP;
2521         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2522                "is required for your device (wl-core rev %u)\n", rev);
2523         goto error;
2524 
2525 err_no_initvals:
2526         err = ctx->fatal_failure = -EOPNOTSUPP;
2527         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2528                "is required for your device (wl-core rev %u)\n", rev);
2529         goto error;
2530 
2531 err_load:
2532         /* We failed to load this firmware image. The error message
2533          * already is in ctx->errors. Return and let our caller decide
2534          * what to do. */
2535         goto error;
2536 
2537 error:
2538         b43_release_firmware(dev);
2539         return err;
2540 }
2541 
2542 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2543 static void b43_one_core_detach(struct b43_bus_dev *dev);
2544 static int b43_rng_init(struct b43_wl *wl);
2545 
2546 static void b43_request_firmware(struct work_struct *work)
2547 {
2548         struct b43_wl *wl = container_of(work,
2549                             struct b43_wl, firmware_load);
2550         struct b43_wldev *dev = wl->current_dev;
2551         struct b43_request_fw_context *ctx;
2552         unsigned int i;
2553         int err;
2554         const char *errmsg;
2555 
2556         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2557         if (!ctx)
2558                 return;
2559         ctx->dev = dev;
2560 
2561         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2562         err = b43_try_request_fw(ctx);
2563         if (!err)
2564                 goto start_ieee80211; /* Successfully loaded it. */
2565         /* Was fw version known? */
2566         if (ctx->fatal_failure)
2567                 goto out;
2568 
2569         /* proprietary fw not found, try open source */
2570         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2571         err = b43_try_request_fw(ctx);
2572         if (!err)
2573                 goto start_ieee80211; /* Successfully loaded it. */
2574         if(ctx->fatal_failure)
2575                 goto out;
2576 
2577         /* Could not find a usable firmware. Print the errors. */
2578         for (i = 0; i < B43_NR_FWTYPES; i++) {
2579                 errmsg = ctx->errors[i];
2580                 if (strlen(errmsg))
2581                         b43err(dev->wl, "%s", errmsg);
2582         }
2583         b43_print_fw_helptext(dev->wl, 1);
2584         goto out;
2585 
2586 start_ieee80211:
2587         wl->hw->queues = B43_QOS_QUEUE_NUM;
2588         if (!modparam_qos || dev->fw.opensource)
2589                 wl->hw->queues = 1;
2590 
2591         err = ieee80211_register_hw(wl->hw);
2592         if (err)
2593                 goto out;
2594         wl->hw_registered = true;
2595         b43_leds_register(wl->current_dev);
2596 
2597         /* Register HW RNG driver */
2598         b43_rng_init(wl);
2599 
2600 out:
2601         kfree(ctx);
2602 }
2603 
2604 static int b43_upload_microcode(struct b43_wldev *dev)
2605 {
2606         struct wiphy *wiphy = dev->wl->hw->wiphy;
2607         const size_t hdr_len = sizeof(struct b43_fw_header);
2608         const __be32 *data;
2609         unsigned int i, len;
2610         u16 fwrev, fwpatch, fwdate, fwtime;
2611         u32 tmp, macctl;
2612         int err = 0;
2613 
2614         /* Jump the microcode PSM to offset 0 */
2615         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2616         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2617         macctl |= B43_MACCTL_PSM_JMP0;
2618         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2619         /* Zero out all microcode PSM registers and shared memory. */
2620         for (i = 0; i < 64; i++)
2621                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2622         for (i = 0; i < 4096; i += 2)
2623                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2624 
2625         /* Upload Microcode. */
2626         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2627         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2628         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2629         for (i = 0; i < len; i++) {
2630                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2631                 udelay(10);
2632         }
2633 
2634         if (dev->fw.pcm.data) {
2635                 /* Upload PCM data. */
2636                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2637                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2638                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2639                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2640                 /* No need for autoinc bit in SHM_HW */
2641                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2642                 for (i = 0; i < len; i++) {
2643                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2644                         udelay(10);
2645                 }
2646         }
2647 
2648         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2649 
2650         /* Start the microcode PSM */
2651         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2652                       B43_MACCTL_PSM_RUN);
2653 
2654         /* Wait for the microcode to load and respond */
2655         i = 0;
2656         while (1) {
2657                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2658                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2659                         break;
2660                 i++;
2661                 if (i >= 20) {
2662                         b43err(dev->wl, "Microcode not responding\n");
2663                         b43_print_fw_helptext(dev->wl, 1);
2664                         err = -ENODEV;
2665                         goto error;
2666                 }
2667                 msleep(50);
2668         }
2669         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2670 
2671         /* Get and check the revisions. */
2672         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2673         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2674         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2675         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2676 
2677         if (fwrev <= 0x128) {
2678                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2679                        "binary drivers older than version 4.x is unsupported. "
2680                        "You must upgrade your firmware files.\n");
2681                 b43_print_fw_helptext(dev->wl, 1);
2682                 err = -EOPNOTSUPP;
2683                 goto error;
2684         }
2685         dev->fw.rev = fwrev;
2686         dev->fw.patch = fwpatch;
2687         if (dev->fw.rev >= 598)
2688                 dev->fw.hdr_format = B43_FW_HDR_598;
2689         else if (dev->fw.rev >= 410)
2690                 dev->fw.hdr_format = B43_FW_HDR_410;
2691         else
2692                 dev->fw.hdr_format = B43_FW_HDR_351;
2693         WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2694 
2695         dev->qos_enabled = dev->wl->hw->queues > 1;
2696         /* Default to firmware/hardware crypto acceleration. */
2697         dev->hwcrypto_enabled = true;
2698 
2699         if (dev->fw.opensource) {
2700                 u16 fwcapa;
2701 
2702                 /* Patchlevel info is encoded in the "time" field. */
2703                 dev->fw.patch = fwtime;
2704                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2705                         dev->fw.rev, dev->fw.patch);
2706 
2707                 fwcapa = b43_fwcapa_read(dev);
2708                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2709                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2710                         /* Disable hardware crypto and fall back to software crypto. */
2711                         dev->hwcrypto_enabled = false;
2712                 }
2713                 /* adding QoS support should use an offline discovery mechanism */
2714                 WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2715         } else {
2716                 b43info(dev->wl, "Loading firmware version %u.%u "
2717                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2718                         fwrev, fwpatch,
2719                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2720                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2721                 if (dev->fw.pcm_request_failed) {
2722                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2723                                 "Hardware accelerated cryptography is disabled.\n");
2724                         b43_print_fw_helptext(dev->wl, 0);
2725                 }
2726         }
2727 
2728         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2729                         dev->fw.rev, dev->fw.patch);
2730         wiphy->hw_version = dev->dev->core_id;
2731 
2732         if (dev->fw.hdr_format == B43_FW_HDR_351) {
2733                 /* We're over the deadline, but we keep support for old fw
2734                  * until it turns out to be in major conflict with something new. */
2735                 b43warn(dev->wl, "You are using an old firmware image. "
2736                         "Support for old firmware will be removed soon "
2737                         "(official deadline was July 2008).\n");
2738                 b43_print_fw_helptext(dev->wl, 0);
2739         }
2740 
2741         return 0;
2742 
2743 error:
2744         /* Stop the microcode PSM. */
2745         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2746                       B43_MACCTL_PSM_JMP0);
2747 
2748         return err;
2749 }
2750 
2751 static int b43_write_initvals(struct b43_wldev *dev,
2752                               const struct b43_iv *ivals,
2753                               size_t count,
2754                               size_t array_size)
2755 {
2756         const struct b43_iv *iv;
2757         u16 offset;
2758         size_t i;
2759         bool bit32;
2760 
2761         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2762         iv = ivals;
2763         for (i = 0; i < count; i++) {
2764                 if (array_size < sizeof(iv->offset_size))
2765                         goto err_format;
2766                 array_size -= sizeof(iv->offset_size);
2767                 offset = be16_to_cpu(iv->offset_size);
2768                 bit32 = !!(offset & B43_IV_32BIT);
2769                 offset &= B43_IV_OFFSET_MASK;
2770                 if (offset >= 0x1000)
2771                         goto err_format;
2772                 if (bit32) {
2773                         u32 value;
2774 
2775                         if (array_size < sizeof(iv->data.d32))
2776                                 goto err_format;
2777                         array_size -= sizeof(iv->data.d32);
2778 
2779                         value = get_unaligned_be32(&iv->data.d32);
2780                         b43_write32(dev, offset, value);
2781 
2782                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2783                                                         sizeof(__be16) +
2784                                                         sizeof(__be32));
2785                 } else {
2786                         u16 value;
2787 
2788                         if (array_size < sizeof(iv->data.d16))
2789                                 goto err_format;
2790                         array_size -= sizeof(iv->data.d16);
2791 
2792                         value = be16_to_cpu(iv->data.d16);
2793                         b43_write16(dev, offset, value);
2794 
2795                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2796                                                         sizeof(__be16) +
2797                                                         sizeof(__be16));
2798                 }
2799         }
2800         if (array_size)
2801                 goto err_format;
2802 
2803         return 0;
2804 
2805 err_format:
2806         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2807         b43_print_fw_helptext(dev->wl, 1);
2808 
2809         return -EPROTO;
2810 }
2811 
2812 static int b43_upload_initvals(struct b43_wldev *dev)
2813 {
2814         const size_t hdr_len = sizeof(struct b43_fw_header);
2815         const struct b43_fw_header *hdr;
2816         struct b43_firmware *fw = &dev->fw;
2817         const struct b43_iv *ivals;
2818         size_t count;
2819 
2820         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2821         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2822         count = be32_to_cpu(hdr->size);
2823         return b43_write_initvals(dev, ivals, count,
2824                                  fw->initvals.data->size - hdr_len);
2825 }
2826 
2827 static int b43_upload_initvals_band(struct b43_wldev *dev)
2828 {
2829         const size_t hdr_len = sizeof(struct b43_fw_header);
2830         const struct b43_fw_header *hdr;
2831         struct b43_firmware *fw = &dev->fw;
2832         const struct b43_iv *ivals;
2833         size_t count;
2834 
2835         if (!fw->initvals_band.data)
2836                 return 0;
2837 
2838         hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2839         ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2840         count = be32_to_cpu(hdr->size);
2841         return b43_write_initvals(dev, ivals, count,
2842                                   fw->initvals_band.data->size - hdr_len);
2843 }
2844 
2845 /* Initialize the GPIOs
2846  * http://bcm-specs.sipsolutions.net/GPIO
2847  */
2848 
2849 #ifdef CONFIG_B43_SSB
2850 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2851 {
2852         struct ssb_bus *bus = dev->dev->sdev->bus;
2853 
2854 #ifdef CONFIG_SSB_DRIVER_PCICORE
2855         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2856 #else
2857         return bus->chipco.dev;
2858 #endif
2859 }
2860 #endif
2861 
2862 static int b43_gpio_init(struct b43_wldev *dev)
2863 {
2864 #ifdef CONFIG_B43_SSB
2865         struct ssb_device *gpiodev;
2866 #endif
2867         u32 mask, set;
2868 
2869         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2870         b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2871 
2872         mask = 0x0000001F;
2873         set = 0x0000000F;
2874         if (dev->dev->chip_id == 0x4301) {
2875                 mask |= 0x0060;
2876                 set |= 0x0060;
2877         } else if (dev->dev->chip_id == 0x5354) {
2878                 /* Don't allow overtaking buttons GPIOs */
2879                 set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2880         }
2881 
2882         if (0 /* FIXME: conditional unknown */ ) {
2883                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2884                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2885                             | 0x0100);
2886                 /* BT Coexistance Input */
2887                 mask |= 0x0080;
2888                 set |= 0x0080;
2889                 /* BT Coexistance Out */
2890                 mask |= 0x0100;
2891                 set |= 0x0100;
2892         }
2893         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2894                 /* PA is controlled by gpio 9, let ucode handle it */
2895                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2896                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2897                             | 0x0200);
2898                 mask |= 0x0200;
2899                 set |= 0x0200;
2900         }
2901 
2902         switch (dev->dev->bus_type) {
2903 #ifdef CONFIG_B43_BCMA
2904         case B43_BUS_BCMA:
2905                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2906                 break;
2907 #endif
2908 #ifdef CONFIG_B43_SSB
2909         case B43_BUS_SSB:
2910                 gpiodev = b43_ssb_gpio_dev(dev);
2911                 if (gpiodev)
2912                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2913                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2914                                     & ~mask) | set);
2915                 break;
2916 #endif
2917         }
2918 
2919         return 0;
2920 }
2921 
2922 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2923 static void b43_gpio_cleanup(struct b43_wldev *dev)
2924 {
2925 #ifdef CONFIG_B43_SSB
2926         struct ssb_device *gpiodev;
2927 #endif
2928 
2929         switch (dev->dev->bus_type) {
2930 #ifdef CONFIG_B43_BCMA
2931         case B43_BUS_BCMA:
2932                 bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2933                 break;
2934 #endif
2935 #ifdef CONFIG_B43_SSB
2936         case B43_BUS_SSB:
2937                 gpiodev = b43_ssb_gpio_dev(dev);
2938                 if (gpiodev)
2939                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2940                 break;
2941 #endif
2942         }
2943 }
2944 
2945 /* http://bcm-specs.sipsolutions.net/EnableMac */
2946 void b43_mac_enable(struct b43_wldev *dev)
2947 {
2948         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2949                 u16 fwstate;
2950 
2951                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2952                                          B43_SHM_SH_UCODESTAT);
2953                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2954                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2955                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2956                                "should be suspended, but current state is %u\n",
2957                                fwstate);
2958                 }
2959         }
2960 
2961         dev->mac_suspended--;
2962         B43_WARN_ON(dev->mac_suspended < 0);
2963         if (dev->mac_suspended == 0) {
2964                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2965                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2966                             B43_IRQ_MAC_SUSPENDED);
2967                 /* Commit writes */
2968                 b43_read32(dev, B43_MMIO_MACCTL);
2969                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2970                 b43_power_saving_ctl_bits(dev, 0);
2971         }
2972 }
2973 
2974 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2975 void b43_mac_suspend(struct b43_wldev *dev)
2976 {
2977         int i;
2978         u32 tmp;
2979 
2980         might_sleep();
2981         B43_WARN_ON(dev->mac_suspended < 0);
2982 
2983         if (dev->mac_suspended == 0) {
2984                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2985                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
2986                 /* force pci to flush the write */
2987                 b43_read32(dev, B43_MMIO_MACCTL);
2988                 for (i = 35; i; i--) {
2989                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2990                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2991                                 goto out;
2992                         udelay(10);
2993                 }
2994                 /* Hm, it seems this will take some time. Use msleep(). */
2995                 for (i = 40; i; i--) {
2996                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2997                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2998                                 goto out;
2999                         msleep(1);
3000                 }
3001                 b43err(dev->wl, "MAC suspend failed\n");
3002         }
3003 out:
3004         dev->mac_suspended++;
3005 }
3006 
3007 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
3008 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
3009 {
3010         u32 tmp;
3011 
3012         switch (dev->dev->bus_type) {
3013 #ifdef CONFIG_B43_BCMA
3014         case B43_BUS_BCMA:
3015                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3016                 if (on)
3017                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
3018                 else
3019                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
3020                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3021                 break;
3022 #endif
3023 #ifdef CONFIG_B43_SSB
3024         case B43_BUS_SSB:
3025                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3026                 if (on)
3027                         tmp |= B43_TMSLOW_MACPHYCLKEN;
3028                 else
3029                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
3030                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3031                 break;
3032 #endif
3033         }
3034 }
3035 
3036 /* brcms_b_switch_macfreq */
3037 void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
3038 {
3039         u16 chip_id = dev->dev->chip_id;
3040 
3041         if (chip_id == BCMA_CHIP_ID_BCM4331) {
3042                 switch (spurmode) {
3043                 case 2: /* 168 Mhz: 2^26/168 = 0x61862 */
3044                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x1862);
3045                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3046                         break;
3047                 case 1: /* 164 Mhz: 2^26/164 = 0x63e70 */
3048                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x3e70);
3049                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3050                         break;
3051                 default: /* 160 Mhz: 2^26/160 = 0x66666 */
3052                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x6666);
3053                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3054                         break;
3055                 }
3056         } else if (chip_id == BCMA_CHIP_ID_BCM43131 ||
3057             chip_id == BCMA_CHIP_ID_BCM43217 ||
3058             chip_id == BCMA_CHIP_ID_BCM43222 ||
3059             chip_id == BCMA_CHIP_ID_BCM43224 ||
3060             chip_id == BCMA_CHIP_ID_BCM43225 ||
3061             chip_id == BCMA_CHIP_ID_BCM43227 ||
3062             chip_id == BCMA_CHIP_ID_BCM43228) {
3063                 switch (spurmode) {
3064                 case 2: /* 126 Mhz */
3065                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
3066                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3067                         break;
3068                 case 1: /* 123 Mhz */
3069                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3070                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3071                         break;
3072                 default: /* 120 Mhz */
3073                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3074                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3075                         break;
3076                 }
3077         } else if (dev->phy.type == B43_PHYTYPE_LCN) {
3078                 switch (spurmode) {
3079                 case 1: /* 82 Mhz */
3080                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3081                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3082                         break;
3083                 default: /* 80 Mhz */
3084                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3085                         b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3086                         break;
3087                 }
3088         }
3089 }
3090 
3091 static void b43_adjust_opmode(struct b43_wldev *dev)
3092 {
3093         struct b43_wl *wl = dev->wl;
3094         u32 ctl;
3095         u16 cfp_pretbtt;
3096 
3097         ctl = b43_read32(dev, B43_MMIO_MACCTL);
3098         /* Reset status to STA infrastructure mode. */
3099         ctl &= ~B43_MACCTL_AP;
3100         ctl &= ~B43_MACCTL_KEEP_CTL;
3101         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3102         ctl &= ~B43_MACCTL_KEEP_BAD;
3103         ctl &= ~B43_MACCTL_PROMISC;
3104         ctl &= ~B43_MACCTL_BEACPROMISC;
3105         ctl |= B43_MACCTL_INFRA;
3106 
3107         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3108             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3109                 ctl |= B43_MACCTL_AP;
3110         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3111                 ctl &= ~B43_MACCTL_INFRA;
3112 
3113         if (wl->filter_flags & FIF_CONTROL)
3114                 ctl |= B43_MACCTL_KEEP_CTL;
3115         if (wl->filter_flags & FIF_FCSFAIL)
3116                 ctl |= B43_MACCTL_KEEP_BAD;
3117         if (wl->filter_flags & FIF_PLCPFAIL)
3118                 ctl |= B43_MACCTL_KEEP_BADPLCP;
3119         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3120                 ctl |= B43_MACCTL_BEACPROMISC;
3121 
3122         /* Workaround: On old hardware the HW-MAC-address-filter
3123          * doesn't work properly, so always run promisc in filter
3124          * it in software. */
3125         if (dev->dev->core_rev <= 4)
3126                 ctl |= B43_MACCTL_PROMISC;
3127 
3128         b43_write32(dev, B43_MMIO_MACCTL, ctl);
3129 
3130         cfp_pretbtt = 2;
3131         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3132                 if (dev->dev->chip_id == 0x4306 &&
3133                     dev->dev->chip_rev == 3)
3134                         cfp_pretbtt = 100;
3135                 else
3136                         cfp_pretbtt = 50;
3137         }
3138         b43_write16(dev, 0x612, cfp_pretbtt);
3139 
3140         /* FIXME: We don't currently implement the PMQ mechanism,
3141          *        so always disable it. If we want to implement PMQ,
3142          *        we need to enable it here (clear DISCPMQ) in AP mode.
3143          */
3144         if (0  /* ctl & B43_MACCTL_AP */)
3145                 b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3146         else
3147                 b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3148 }
3149 
3150 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3151 {
3152         u16 offset;
3153 
3154         if (is_ofdm) {
3155                 offset = 0x480;
3156                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3157         } else {
3158                 offset = 0x4C0;
3159                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3160         }
3161         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3162                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
3163 }
3164 
3165 static void b43_rate_memory_init(struct b43_wldev *dev)
3166 {
3167         switch (dev->phy.type) {
3168         case B43_PHYTYPE_G:
3169         case B43_PHYTYPE_N:
3170         case B43_PHYTYPE_LP:
3171         case B43_PHYTYPE_HT:
3172         case B43_PHYTYPE_LCN:
3173                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3174                 b43_rate_memory_write(dev, B43_OFDM_RATE_9MB, 1);
3175                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3176                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3177                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3178                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3179                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3180                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3181                 /* fallthrough */
3182         case B43_PHYTYPE_B:
3183                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3184                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3185                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3186                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3187                 break;
3188         default:
3189                 B43_WARN_ON(1);
3190         }
3191 }
3192 
3193 /* Set the default values for the PHY TX Control Words. */
3194 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3195 {
3196         u16 ctl = 0;
3197 
3198         ctl |= B43_TXH_PHY_ENC_CCK;
3199         ctl |= B43_TXH_PHY_ANT01AUTO;
3200         ctl |= B43_TXH_PHY_TXPWR;
3201 
3202         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3203         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3204         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3205 }
3206 
3207 /* Set the TX-Antenna for management frames sent by firmware. */
3208 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3209 {
3210         u16 ant;
3211         u16 tmp;
3212 
3213         ant = b43_antenna_to_phyctl(antenna);
3214 
3215         /* For ACK/CTS */
3216         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3217         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3218         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3219         /* For Probe Resposes */
3220         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3221         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3222         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3223 }
3224 
3225 /* This is the opposite of b43_chip_init() */
3226 static void b43_chip_exit(struct b43_wldev *dev)
3227 {
3228         b43_phy_exit(dev);
3229         b43_gpio_cleanup(dev);
3230         /* firmware is released later */
3231 }
3232 
3233 /* Initialize the chip
3234  * http://bcm-specs.sipsolutions.net/ChipInit
3235  */
3236 static int b43_chip_init(struct b43_wldev *dev)
3237 {
3238         struct b43_phy *phy = &dev->phy;
3239         int err;
3240         u32 macctl;
3241         u16 value16;
3242 
3243         /* Initialize the MAC control */
3244         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3245         if (dev->phy.gmode)
3246                 macctl |= B43_MACCTL_GMODE;
3247         macctl |= B43_MACCTL_INFRA;
3248         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3249 
3250         err = b43_upload_microcode(dev);
3251         if (err)
3252                 goto out;       /* firmware is released later */
3253 
3254         err = b43_gpio_init(dev);
3255         if (err)
3256                 goto out;       /* firmware is released later */
3257 
3258         err = b43_upload_initvals(dev);
3259         if (err)
3260                 goto err_gpio_clean;
3261 
3262         err = b43_upload_initvals_band(dev);
3263         if (err)
3264                 goto err_gpio_clean;
3265 
3266         /* Turn the Analog on and initialize the PHY. */
3267         phy->ops->switch_analog(dev, 1);
3268         err = b43_phy_init(dev);
3269         if (err)
3270                 goto err_gpio_clean;
3271 
3272         /* Disable Interference Mitigation. */
3273         if (phy->ops->interf_mitigation)
3274                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3275 
3276         /* Select the antennae */
3277         if (phy->ops->set_rx_antenna)
3278                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3279         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3280 
3281         if (phy->type == B43_PHYTYPE_B) {
3282                 value16 = b43_read16(dev, 0x005E);
3283                 value16 |= 0x0004;
3284                 b43_write16(dev, 0x005E, value16);
3285         }
3286         b43_write32(dev, 0x0100, 0x01000000);
3287         if (dev->dev->core_rev < 5)
3288                 b43_write32(dev, 0x010C, 0x01000000);
3289 
3290         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3291         b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3292 
3293         /* Probe Response Timeout value */
3294         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3295         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3296 
3297         /* Initially set the wireless operation mode. */
3298         b43_adjust_opmode(dev);
3299 
3300         if (dev->dev->core_rev < 3) {
3301                 b43_write16(dev, 0x060E, 0x0000);
3302                 b43_write16(dev, 0x0610, 0x8000);
3303                 b43_write16(dev, 0x0604, 0x0000);
3304                 b43_write16(dev, 0x0606, 0x0200);
3305         } else {
3306                 b43_write32(dev, 0x0188, 0x80000000);
3307                 b43_write32(dev, 0x018C, 0x02000000);
3308         }
3309         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3310         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3311         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3312         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3313         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3314         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3315         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3316 
3317         b43_mac_phy_clock_set(dev, true);
3318 
3319         switch (dev->dev->bus_type) {
3320 #ifdef CONFIG_B43_BCMA
3321         case B43_BUS_BCMA:
3322                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3323                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3324                 break;
3325 #endif
3326 #ifdef CONFIG_B43_SSB
3327         case B43_BUS_SSB:
3328                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3329                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3330                 break;
3331 #endif
3332         }
3333 
3334         err = 0;
3335         b43dbg(dev->wl, "Chip initialized\n");
3336 out:
3337         return err;
3338 
3339 err_gpio_clean:
3340         b43_gpio_cleanup(dev);
3341         return err;
3342 }
3343 
3344 static void b43_periodic_every60sec(struct b43_wldev *dev)
3345 {
3346         const struct b43_phy_operations *ops = dev->phy.ops;
3347 
3348         if (ops->pwork_60sec)
3349                 ops->pwork_60sec(dev);
3350 
3351         /* Force check the TX power emission now. */
3352         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3353 }
3354 
3355 static void b43_periodic_every30sec(struct b43_wldev *dev)
3356 {
3357         /* Update device statistics. */
3358         b43_calculate_link_quality(dev);
3359 }
3360 
3361 static void b43_periodic_every15sec(struct b43_wldev *dev)
3362 {
3363         struct b43_phy *phy = &dev->phy;
3364         u16 wdr;
3365 
3366         if (dev->fw.opensource) {
3367                 /* Check if the firmware is still alive.
3368                  * It will reset the watchdog counter to 0 in its idle loop. */
3369                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3370                 if (unlikely(wdr)) {
3371                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3372                         b43_controller_restart(dev, "Firmware watchdog");
3373                         return;
3374                 } else {
3375                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3376                                         B43_WATCHDOG_REG, 1);
3377                 }
3378         }
3379 
3380         if (phy->ops->pwork_15sec)
3381                 phy->ops->pwork_15sec(dev);
3382 
3383         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3384         wmb();
3385 
3386 #if B43_DEBUG
3387         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3388                 unsigned int i;
3389 
3390                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3391                        dev->irq_count / 15,
3392                        dev->tx_count / 15,
3393                        dev->rx_count / 15);
3394                 dev->irq_count = 0;
3395                 dev->tx_count = 0;
3396                 dev->rx_count = 0;
3397                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3398                         if (dev->irq_bit_count[i]) {
3399                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3400                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3401                                 dev->irq_bit_count[i] = 0;
3402                         }
3403                 }
3404         }
3405 #endif
3406 }
3407 
3408 static void do_periodic_work(struct b43_wldev *dev)
3409 {
3410         unsigned int state;
3411 
3412         state = dev->periodic_state;
3413         if (state % 4 == 0)
3414                 b43_periodic_every60sec(dev);
3415         if (state % 2 == 0)
3416                 b43_periodic_every30sec(dev);
3417         b43_periodic_every15sec(dev);
3418 }
3419 
3420 /* Periodic work locking policy:
3421  *      The whole periodic work handler is protected by
3422  *      wl->mutex. If another lock is needed somewhere in the
3423  *      pwork callchain, it's acquired in-place, where it's needed.
3424  */
3425 static void b43_periodic_work_handler(struct work_struct *work)
3426 {
3427         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3428                                              periodic_work.work);
3429         struct b43_wl *wl = dev->wl;
3430         unsigned long delay;
3431 
3432         mutex_lock(&wl->mutex);
3433 
3434         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3435                 goto out;
3436         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3437                 goto out_requeue;
3438 
3439         do_periodic_work(dev);
3440 
3441         dev->periodic_state++;
3442 out_requeue:
3443         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3444                 delay = msecs_to_jiffies(50);
3445         else
3446                 delay = round_jiffies_relative(HZ * 15);
3447         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3448 out:
3449         mutex_unlock(&wl->mutex);
3450 }
3451 
3452 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3453 {
3454         struct delayed_work *work = &dev->periodic_work;
3455 
3456         dev->periodic_state = 0;
3457         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3458         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3459 }
3460 
3461 /* Check if communication with the device works correctly. */
3462 static int b43_validate_chipaccess(struct b43_wldev *dev)
3463 {
3464         u32 v, backup0, backup4;
3465 
3466         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3467         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3468 
3469         /* Check for read/write and endianness problems. */
3470         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3471         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3472                 goto error;
3473         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3474         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3475                 goto error;
3476 
3477         /* Check if unaligned 32bit SHM_SHARED access works properly.
3478          * However, don't bail out on failure, because it's noncritical. */
3479         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3480         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3481         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3482         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3483         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3484                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3485         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3486         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3487             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3488             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3489             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3490                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3491 
3492         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3493         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3494 
3495         if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3496                 /* The 32bit register shadows the two 16bit registers
3497                  * with update sideeffects. Validate this. */
3498                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3499                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3500                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3501                         goto error;
3502                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3503                         goto error;
3504         }
3505         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3506 
3507         v = b43_read32(dev, B43_MMIO_MACCTL);
3508         v |= B43_MACCTL_GMODE;
3509         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3510                 goto error;
3511 
3512         return 0;
3513 error:
3514         b43err(dev->wl, "Failed to validate the chipaccess\n");
3515         return -ENODEV;
3516 }
3517 
3518 static void b43_security_init(struct b43_wldev *dev)
3519 {
3520         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3521         /* KTP is a word address, but we address SHM bytewise.
3522          * So multiply by two.
3523          */
3524         dev->ktp *= 2;
3525         /* Number of RCMTA address slots */
3526         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3527         /* Clear the key memory. */
3528         b43_clear_keys(dev);
3529 }
3530 
3531 #ifdef CONFIG_B43_HWRNG
3532 static int b43_rng_read(struct hwrng *rng, u32 *data)
3533 {
3534         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3535         struct b43_wldev *dev;
3536         int count = -ENODEV;
3537 
3538         mutex_lock(&wl->mutex);
3539         dev = wl->current_dev;
3540         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3541                 *data = b43_read16(dev, B43_MMIO_RNG);
3542                 count = sizeof(u16);
3543         }
3544         mutex_unlock(&wl->mutex);
3545 
3546         return count;
3547 }
3548 #endif /* CONFIG_B43_HWRNG */
3549 
3550 static void b43_rng_exit(struct b43_wl *wl)
3551 {
3552 #ifdef CONFIG_B43_HWRNG
3553         if (wl->rng_initialized)
3554                 hwrng_unregister(&wl->rng);
3555 #endif /* CONFIG_B43_HWRNG */
3556 }
3557 
3558 static int b43_rng_init(struct b43_wl *wl)
3559 {
3560         int err = 0;
3561 
3562 #ifdef CONFIG_B43_HWRNG
3563         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3564                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3565         wl->rng.name = wl->rng_name;
3566         wl->rng.data_read = b43_rng_read;
3567         wl->rng.priv = (unsigned long)wl;
3568         wl->rng_initialized = true;
3569         err = hwrng_register(&wl->rng);
3570         if (err) {
3571                 wl->rng_initialized = false;
3572                 b43err(wl, "Failed to register the random "
3573                        "number generator (%d)\n", err);
3574         }
3575 #endif /* CONFIG_B43_HWRNG */
3576 
3577         return err;
3578 }
3579 
3580 static void b43_tx_work(struct work_struct *work)
3581 {
3582         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3583         struct b43_wldev *dev;
3584         struct sk_buff *skb;
3585         int queue_num;
3586         int err = 0;
3587 
3588         mutex_lock(&wl->mutex);
3589         dev = wl->current_dev;
3590         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3591                 mutex_unlock(&wl->mutex);
3592                 return;
3593         }
3594 
3595         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3596                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
3597                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
3598                         if (b43_using_pio_transfers(dev))
3599                                 err = b43_pio_tx(dev, skb);
3600                         else
3601                                 err = b43_dma_tx(dev, skb);
3602                         if (err == -ENOSPC) {
3603                                 wl->tx_queue_stopped[queue_num] = 1;
3604                                 ieee80211_stop_queue(wl->hw, queue_num);
3605                                 skb_queue_head(&wl->tx_queue[queue_num], skb);
3606                                 break;
3607                         }
3608                         if (unlikely(err))
3609                                 ieee80211_free_txskb(wl->hw, skb);
3610                         err = 0;
3611                 }
3612 
3613                 if (!err)
3614                         wl->tx_queue_stopped[queue_num] = 0;
3615         }
3616 
3617 #if B43_DEBUG
3618         dev->tx_count++;
3619 #endif
3620         mutex_unlock(&wl->mutex);
3621 }
3622 
3623 static void b43_op_tx(struct ieee80211_hw *hw,
3624                       struct ieee80211_tx_control *control,
3625                       struct sk_buff *skb)
3626 {
3627         struct b43_wl *wl = hw_to_b43_wl(hw);
3628 
3629         if (unlikely(skb->len < 2 + 2 + 6)) {
3630                 /* Too short, this can't be a valid frame. */
3631                 ieee80211_free_txskb(hw, skb);
3632                 return;
3633         }
3634         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3635 
3636         skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3637         if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3638                 ieee80211_queue_work(wl->hw, &wl->tx_work);
3639         } else {
3640                 ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3641         }
3642 }
3643 
3644 static void b43_qos_params_upload(struct b43_wldev *dev,
3645                                   const struct ieee80211_tx_queue_params *p,
3646                                   u16 shm_offset)
3647 {
3648         u16 params[B43_NR_QOSPARAMS];
3649         int bslots, tmp;
3650         unsigned int i;
3651 
3652         if (!dev->qos_enabled)
3653                 return;
3654 
3655         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3656 
3657         memset(&params, 0, sizeof(params));
3658 
3659         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3660         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3661         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3662         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3663         params[B43_QOSPARAM_AIFS] = p->aifs;
3664         params[B43_QOSPARAM_BSLOTS] = bslots;
3665         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3666 
3667         for (i = 0; i < ARRAY_SIZE(params); i++) {
3668                 if (i == B43_QOSPARAM_STATUS) {
3669                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3670                                              shm_offset + (i * 2));
3671                         /* Mark the parameters as updated. */
3672                         tmp |= 0x100;
3673                         b43_shm_write16(dev, B43_SHM_SHARED,
3674                                         shm_offset + (i * 2),
3675                                         tmp);
3676                 } else {
3677                         b43_shm_write16(dev, B43_SHM_SHARED,
3678                                         shm_offset + (i * 2),
3679                                         params[i]);
3680                 }
3681         }
3682 }
3683 
3684 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3685 static const u16 b43_qos_shm_offsets[] = {
3686         /* [mac80211-queue-nr] = SHM_OFFSET, */
3687         [0] = B43_QOS_VOICE,
3688         [1] = B43_QOS_VIDEO,
3689         [2] = B43_QOS_BESTEFFORT,
3690         [3] = B43_QOS_BACKGROUND,
3691 };
3692 
3693 /* Update all QOS parameters in hardware. */
3694 static void b43_qos_upload_all(struct b43_wldev *dev)
3695 {
3696         struct b43_wl *wl = dev->wl;
3697         struct b43_qos_params *params;
3698         unsigned int i;
3699 
3700         if (!dev->qos_enabled)
3701                 return;
3702 
3703         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3704                      ARRAY_SIZE(wl->qos_params));
3705 
3706         b43_mac_suspend(dev);
3707         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3708                 params = &(wl->qos_params[i]);
3709                 b43_qos_params_upload(dev, &(params->p),
3710                                       b43_qos_shm_offsets[i]);
3711         }
3712         b43_mac_enable(dev);
3713 }
3714 
3715 static void b43_qos_clear(struct b43_wl *wl)
3716 {
3717         struct b43_qos_params *params;
3718         unsigned int i;
3719 
3720         /* Initialize QoS parameters to sane defaults. */
3721 
3722         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3723                      ARRAY_SIZE(wl->qos_params));
3724 
3725         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3726                 params = &(wl->qos_params[i]);
3727 
3728                 switch (b43_qos_shm_offsets[i]) {
3729                 case B43_QOS_VOICE:
3730                         params->p.txop = 0;
3731                         params->p.aifs = 2;
3732                         params->p.cw_min = 0x0001;
3733                         params->p.cw_max = 0x0001;
3734                         break;
3735                 case B43_QOS_VIDEO:
3736                         params->p.txop = 0;
3737                         params->p.aifs = 2;
3738                         params->p.cw_min = 0x0001;
3739                         params->p.cw_max = 0x0001;
3740                         break;
3741                 case B43_QOS_BESTEFFORT:
3742                         params->p.txop = 0;
3743                         params->p.aifs = 3;
3744                         params->p.cw_min = 0x0001;
3745                         params->p.cw_max = 0x03FF;
3746                         break;
3747                 case B43_QOS_BACKGROUND:
3748                         params->p.txop = 0;
3749                         params->p.aifs = 7;
3750                         params->p.cw_min = 0x0001;
3751                         params->p.cw_max = 0x03FF;
3752                         break;
3753                 default:
3754                         B43_WARN_ON(1);
3755                 }
3756         }
3757 }
3758 
3759 /* Initialize the core's QOS capabilities */
3760 static void b43_qos_init(struct b43_wldev *dev)
3761 {
3762         if (!dev->qos_enabled) {
3763                 /* Disable QOS support. */
3764                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3765                 b43_write16(dev, B43_MMIO_IFSCTL,
3766                             b43_read16(dev, B43_MMIO_IFSCTL)
3767                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3768                 b43dbg(dev->wl, "QoS disabled\n");
3769                 return;
3770         }
3771 
3772         /* Upload the current QOS parameters. */
3773         b43_qos_upload_all(dev);
3774 
3775         /* Enable QOS support. */
3776         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3777         b43_write16(dev, B43_MMIO_IFSCTL,
3778                     b43_read16(dev, B43_MMIO_IFSCTL)
3779                     | B43_MMIO_IFSCTL_USE_EDCF);
3780         b43dbg(dev->wl, "QoS enabled\n");
3781 }
3782 
3783 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3784                           struct ieee80211_vif *vif, u16 _queue,
3785                           const struct ieee80211_tx_queue_params *params)
3786 {
3787         struct b43_wl *wl = hw_to_b43_wl(hw);
3788         struct b43_wldev *dev;
3789         unsigned int queue = (unsigned int)_queue;
3790         int err = -ENODEV;
3791 
3792         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3793                 /* Queue not available or don't support setting
3794                  * params on this queue. Return success to not
3795                  * confuse mac80211. */
3796                 return 0;
3797         }
3798         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3799                      ARRAY_SIZE(wl->qos_params));
3800 
3801         mutex_lock(&wl->mutex);
3802         dev = wl->current_dev;
3803         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3804                 goto out_unlock;
3805 
3806         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3807         b43_mac_suspend(dev);
3808         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3809                               b43_qos_shm_offsets[queue]);
3810         b43_mac_enable(dev);
3811         err = 0;
3812 
3813 out_unlock:
3814         mutex_unlock(&wl->mutex);
3815 
3816         return err;
3817 }
3818 
3819 static int b43_op_get_stats(struct ieee80211_hw *hw,
3820                             struct ieee80211_low_level_stats *stats)
3821 {
3822         struct b43_wl *wl = hw_to_b43_wl(hw);
3823 
3824         mutex_lock(&wl->mutex);
3825         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3826         mutex_unlock(&wl->mutex);
3827 
3828         return 0;
3829 }
3830 
3831 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3832 {
3833         struct b43_wl *wl = hw_to_b43_wl(hw);
3834         struct b43_wldev *dev;
3835         u64 tsf;
3836 
3837         mutex_lock(&wl->mutex);
3838         dev = wl->current_dev;
3839 
3840         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3841                 b43_tsf_read(dev, &tsf);
3842         else
3843                 tsf = 0;
3844 
3845         mutex_unlock(&wl->mutex);
3846 
3847         return tsf;
3848 }
3849 
3850 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3851                            struct ieee80211_vif *vif, u64 tsf)
3852 {
3853         struct b43_wl *wl = hw_to_b43_wl(hw);
3854         struct b43_wldev *dev;
3855 
3856         mutex_lock(&wl->mutex);
3857         dev = wl->current_dev;
3858 
3859         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3860                 b43_tsf_write(dev, tsf);
3861 
3862         mutex_unlock(&wl->mutex);
3863 }
3864 
3865 static const char *band_to_string(enum nl80211_band band)
3866 {
3867         switch (band) {
3868         case NL80211_BAND_5GHZ:
3869                 return "5";
3870         case NL80211_BAND_2GHZ:
3871                 return "2.4";
3872         default:
3873                 break;
3874         }
3875         B43_WARN_ON(1);
3876         return "";
3877 }
3878 
3879 /* Expects wl->mutex locked */
3880 static int b43_switch_band(struct b43_wldev *dev,
3881                            struct ieee80211_channel *chan)
3882 {
3883         struct b43_phy *phy = &dev->phy;
3884         bool gmode;
3885         u32 tmp;
3886 
3887         switch (chan->band) {
3888         case NL80211_BAND_5GHZ:
3889                 gmode = false;
3890                 break;
3891         case NL80211_BAND_2GHZ:
3892                 gmode = true;
3893                 break;
3894         default:
3895                 B43_WARN_ON(1);
3896                 return -EINVAL;
3897         }
3898 
3899         if (!((gmode && phy->supports_2ghz) ||
3900               (!gmode && phy->supports_5ghz))) {
3901                 b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3902                        band_to_string(chan->band));
3903                 return -ENODEV;
3904         }
3905 
3906         if (!!phy->gmode == !!gmode) {
3907                 /* This device is already running. */
3908                 return 0;
3909         }
3910 
3911         b43dbg(dev->wl, "Switching to %s GHz band\n",
3912                band_to_string(chan->band));
3913 
3914         /* Some new devices don't need disabling radio for band switching */
3915         if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3916                 b43_software_rfkill(dev, true);
3917 
3918         phy->gmode = gmode;
3919         b43_phy_put_into_reset(dev);
3920         switch (dev->dev->bus_type) {
3921 #ifdef CONFIG_B43_BCMA
3922         case B43_BUS_BCMA:
3923                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3924                 if (gmode)
3925                         tmp |= B43_BCMA_IOCTL_GMODE;
3926                 else
3927                         tmp &= ~B43_BCMA_IOCTL_GMODE;
3928                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3929                 break;
3930 #endif
3931 #ifdef CONFIG_B43_SSB
3932         case B43_BUS_SSB:
3933                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3934                 if (gmode)
3935                         tmp |= B43_TMSLOW_GMODE;
3936                 else
3937                         tmp &= ~B43_TMSLOW_GMODE;
3938                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3939                 break;
3940 #endif
3941         }
3942         b43_phy_take_out_of_reset(dev);
3943 
3944         b43_upload_initvals_band(dev);
3945 
3946         b43_phy_init(dev);
3947 
3948         return 0;
3949 }
3950 
3951 static void b43_set_beacon_listen_interval(struct b43_wldev *dev, u16 interval)
3952 {
3953         interval = min_t(u16, interval, (u16)0xFF);
3954         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BCN_LI, interval);
3955 }
3956 
3957 /* Write the short and long frame retry limit values. */
3958 static void b43_set_retry_limits(struct b43_wldev *dev,
3959                                  unsigned int short_retry,
3960                                  unsigned int long_retry)
3961 {
3962         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3963          * the chip-internal counter. */
3964         short_retry = min(short_retry, (unsigned int)0xF);
3965         long_retry = min(long_retry, (unsigned int)0xF);
3966 
3967         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3968                         short_retry);
3969         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3970                         long_retry);
3971 }
3972 
3973 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3974 {
3975         struct b43_wl *wl = hw_to_b43_wl(hw);
3976         struct b43_wldev *dev = wl->current_dev;
3977         struct b43_phy *phy = &dev->phy;
3978         struct ieee80211_conf *conf = &hw->conf;
3979         int antenna;
3980         int err = 0;
3981 
3982         mutex_lock(&wl->mutex);
3983         b43_mac_suspend(dev);
3984 
3985         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL)
3986                 b43_set_beacon_listen_interval(dev, conf->listen_interval);
3987 
3988         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
3989                 phy->chandef = &conf->chandef;
3990                 phy->channel = conf->chandef.chan->hw_value;
3991 
3992                 /* Switch the band (if necessary). */
3993                 err = b43_switch_band(dev, conf->chandef.chan);
3994                 if (err)
3995                         goto out_mac_enable;
3996 
3997                 /* Switch to the requested channel.
3998                  * The firmware takes care of races with the TX handler.
3999                  */
4000                 b43_switch_channel(dev, phy->channel);
4001         }
4002 
4003         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
4004                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
4005                                           conf->long_frame_max_tx_count);
4006         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
4007         if (!changed)
4008                 goto out_mac_enable;
4009 
4010         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
4011 
4012         /* Adjust the desired TX power level. */
4013         if (conf->power_level != 0) {
4014                 if (conf->power_level != phy->desired_txpower) {
4015                         phy->desired_txpower = conf->power_level;
4016                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
4017                                                    B43_TXPWR_IGNORE_TSSI);
4018                 }
4019         }
4020 
4021         /* Antennas for RX and management frame TX. */
4022         antenna = B43_ANTENNA_DEFAULT;
4023         b43_mgmtframe_txantenna(dev, antenna);
4024         antenna = B43_ANTENNA_DEFAULT;
4025         if (phy->ops->set_rx_antenna)
4026                 phy->ops->set_rx_antenna(dev, antenna);
4027 
4028         if (wl->radio_enabled != phy->radio_on) {
4029                 if (wl->radio_enabled) {
4030                         b43_software_rfkill(dev, false);
4031                         b43info(dev->wl, "Radio turned on by software\n");
4032                         if (!dev->radio_hw_enable) {
4033                                 b43info(dev->wl, "The hardware RF-kill button "
4034                                         "still turns the radio physically off. "
4035                                         "Press the button to turn it on.\n");
4036                         }
4037                 } else {
4038                         b43_software_rfkill(dev, true);
4039                         b43info(dev->wl, "Radio turned off by software\n");
4040                 }
4041         }
4042 
4043 out_mac_enable:
4044         b43_mac_enable(dev);
4045         mutex_unlock(&wl->mutex);
4046 
4047         return err;
4048 }
4049 
4050 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
4051 {
4052         struct ieee80211_supported_band *sband =
4053                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
4054         struct ieee80211_rate *rate;
4055         int i;
4056         u16 basic, direct, offset, basic_offset, rateptr;
4057 
4058         for (i = 0; i < sband->n_bitrates; i++) {
4059                 rate = &sband->bitrates[i];
4060 
4061                 if (b43_is_cck_rate(rate->hw_value)) {
4062                         direct = B43_SHM_SH_CCKDIRECT;
4063                         basic = B43_SHM_SH_CCKBASIC;
4064                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4065                         offset &= 0xF;
4066                 } else {
4067                         direct = B43_SHM_SH_OFDMDIRECT;
4068                         basic = B43_SHM_SH_OFDMBASIC;
4069                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4070                         offset &= 0xF;
4071                 }
4072 
4073                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4074 
4075                 if (b43_is_cck_rate(rate->hw_value)) {
4076                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4077                         basic_offset &= 0xF;
4078                 } else {
4079                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4080                         basic_offset &= 0xF;
4081                 }
4082 
4083                 /*
4084                  * Get the pointer that we need to point to
4085                  * from the direct map
4086                  */
4087                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4088                                          direct + 2 * basic_offset);
4089                 /* and write it to the basic map */
4090                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4091                                 rateptr);
4092         }
4093 }
4094 
4095 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4096                                     struct ieee80211_vif *vif,
4097                                     struct ieee80211_bss_conf *conf,
4098                                     u32 changed)
4099 {
4100         struct b43_wl *wl = hw_to_b43_wl(hw);
4101         struct b43_wldev *dev;
4102 
4103         mutex_lock(&wl->mutex);
4104 
4105         dev = wl->current_dev;
4106         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4107                 goto out_unlock_mutex;
4108 
4109         B43_WARN_ON(wl->vif != vif);
4110 
4111         if (changed & BSS_CHANGED_BSSID) {
4112                 if (conf->bssid)
4113                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4114                 else
4115                         eth_zero_addr(wl->bssid);
4116         }
4117 
4118         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4119                 if (changed & BSS_CHANGED_BEACON &&
4120                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4121                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4122                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4123                         b43_update_templates(wl);
4124 
4125                 if (changed & BSS_CHANGED_BSSID)
4126                         b43_write_mac_bssid_templates(dev);
4127         }
4128 
4129         b43_mac_suspend(dev);
4130 
4131         /* Update templates for AP/mesh mode. */
4132         if (changed & BSS_CHANGED_BEACON_INT &&
4133             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4134              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4135              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4136             conf->beacon_int)
4137                 b43_set_beacon_int(dev, conf->beacon_int);
4138 
4139         if (changed & BSS_CHANGED_BASIC_RATES)
4140                 b43_update_basic_rates(dev, conf->basic_rates);
4141 
4142         if (changed & BSS_CHANGED_ERP_SLOT) {
4143                 if (conf->use_short_slot)
4144                         b43_short_slot_timing_enable(dev);
4145                 else
4146                         b43_short_slot_timing_disable(dev);
4147         }
4148 
4149         b43_mac_enable(dev);
4150 out_unlock_mutex:
4151         mutex_unlock(&wl->mutex);
4152 }
4153 
4154 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4155                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4156                           struct ieee80211_key_conf *key)
4157 {
4158         struct b43_wl *wl = hw_to_b43_wl(hw);
4159         struct b43_wldev *dev;
4160         u8 algorithm;
4161         u8 index;
4162         int err;
4163         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4164 
4165         if (modparam_nohwcrypt)
4166                 return -ENOSPC; /* User disabled HW-crypto */
4167 
4168         if ((vif->type == NL80211_IFTYPE_ADHOC ||
4169              vif->type == NL80211_IFTYPE_MESH_POINT) &&
4170             (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4171              key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4172             !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4173                 /*
4174                  * For now, disable hw crypto for the RSN IBSS group keys. This
4175                  * could be optimized in the future, but until that gets
4176                  * implemented, use of software crypto for group addressed
4177                  * frames is a acceptable to allow RSN IBSS to be used.
4178                  */
4179                 return -EOPNOTSUPP;
4180         }
4181 
4182         mutex_lock(&wl->mutex);
4183 
4184         dev = wl->current_dev;
4185         err = -ENODEV;
4186         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4187                 goto out_unlock;
4188 
4189         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4190                 /* We don't have firmware for the crypto engine.
4191                  * Must use software-crypto. */
4192                 err = -EOPNOTSUPP;
4193                 goto out_unlock;
4194         }
4195 
4196         err = -EINVAL;
4197         switch (key->cipher) {
4198         case WLAN_CIPHER_SUITE_WEP40:
4199                 algorithm = B43_SEC_ALGO_WEP40;
4200                 break;
4201         case WLAN_CIPHER_SUITE_WEP104:
4202                 algorithm = B43_SEC_ALGO_WEP104;
4203                 break;
4204         case WLAN_CIPHER_SUITE_TKIP:
4205                 algorithm = B43_SEC_ALGO_TKIP;
4206                 break;
4207         case WLAN_CIPHER_SUITE_CCMP:
4208                 algorithm = B43_SEC_ALGO_AES;
4209                 break;
4210         default:
4211                 B43_WARN_ON(1);
4212                 goto out_unlock;
4213         }
4214         index = (u8) (key->keyidx);
4215         if (index > 3)
4216                 goto out_unlock;
4217 
4218         switch (cmd) {
4219         case SET_KEY:
4220                 if (algorithm == B43_SEC_ALGO_TKIP &&
4221                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4222                     !modparam_hwtkip)) {
4223                         /* We support only pairwise key */
4224                         err = -EOPNOTSUPP;
4225                         goto out_unlock;
4226                 }
4227 
4228                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4229                         if (WARN_ON(!sta)) {
4230                                 err = -EOPNOTSUPP;
4231                                 goto out_unlock;
4232                         }
4233                         /* Pairwise key with an assigned MAC address. */
4234                         err = b43_key_write(dev, -1, algorithm,
4235                                             key->key, key->keylen,
4236                                             sta->addr, key);
4237                 } else {
4238                         /* Group key */
4239                         err = b43_key_write(dev, index, algorithm,
4240                                             key->key, key->keylen, NULL, key);
4241                 }
4242                 if (err)
4243                         goto out_unlock;
4244 
4245                 if (algorithm == B43_SEC_ALGO_WEP40 ||
4246                     algorithm == B43_SEC_ALGO_WEP104) {
4247                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4248                 } else {
4249                         b43_hf_write(dev,
4250                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4251                 }
4252                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4253                 if (algorithm == B43_SEC_ALGO_TKIP)
4254                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4255                 break;
4256         case DISABLE_KEY: {
4257                 err = b43_key_clear(dev, key->hw_key_idx);
4258                 if (err)
4259                         goto out_unlock;
4260                 break;
4261         }
4262         default:
4263                 B43_WARN_ON(1);
4264         }
4265 
4266 out_unlock:
4267         if (!err) {
4268                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4269                        "mac: %pM\n",
4270                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4271                        sta ? sta->addr : bcast_addr);
4272                 b43_dump_keymemory(dev);
4273         }
4274         mutex_unlock(&wl->mutex);
4275 
4276         return err;
4277 }
4278 
4279 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4280                                     unsigned int changed, unsigned int *fflags,
4281                                     u64 multicast)
4282 {
4283         struct b43_wl *wl = hw_to_b43_wl(hw);
4284         struct b43_wldev *dev;
4285 
4286         mutex_lock(&wl->mutex);
4287         dev = wl->current_dev;
4288         if (!dev) {
4289                 *fflags = 0;
4290                 goto out_unlock;
4291         }
4292 
4293         *fflags &= FIF_ALLMULTI |
4294                   FIF_FCSFAIL |
4295                   FIF_PLCPFAIL |
4296                   FIF_CONTROL |
4297                   FIF_OTHER_BSS |
4298                   FIF_BCN_PRBRESP_PROMISC;
4299 
4300         changed &= FIF_ALLMULTI |
4301                    FIF_FCSFAIL |
4302                    FIF_PLCPFAIL |
4303                    FIF_CONTROL |
4304                    FIF_OTHER_BSS |
4305                    FIF_BCN_PRBRESP_PROMISC;
4306 
4307         wl->filter_flags = *fflags;
4308 
4309         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4310                 b43_adjust_opmode(dev);
4311 
4312 out_unlock:
4313         mutex_unlock(&wl->mutex);
4314 }
4315 
4316 /* Locking: wl->mutex
4317  * Returns the current dev. This might be different from the passed in dev,
4318  * because the core might be gone away while we unlocked the mutex. */
4319 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4320 {
4321         struct b43_wl *wl;
4322         struct b43_wldev *orig_dev;
4323         u32 mask;
4324         int queue_num;
4325 
4326         if (!dev)
4327                 return NULL;
4328         wl = dev->wl;
4329 redo:
4330         if (!dev || b43_status(dev) < B43_STAT_STARTED)
4331                 return dev;
4332 
4333         /* Cancel work. Unlock to avoid deadlocks. */
4334         mutex_unlock(&wl->mutex);
4335         cancel_delayed_work_sync(&dev->periodic_work);
4336         cancel_work_sync(&wl->tx_work);
4337         b43_leds_stop(dev);
4338         mutex_lock(&wl->mutex);
4339         dev = wl->current_dev;
4340         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4341                 /* Whoops, aliens ate up the device while we were unlocked. */
4342                 return dev;
4343         }
4344 
4345         /* Disable interrupts on the device. */
4346         b43_set_status(dev, B43_STAT_INITIALIZED);
4347         if (b43_bus_host_is_sdio(dev->dev)) {
4348                 /* wl->mutex is locked. That is enough. */
4349                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4350                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4351         } else {
4352                 spin_lock_irq(&wl->hardirq_lock);
4353                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4354                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
4355                 spin_unlock_irq(&wl->hardirq_lock);
4356         }
4357         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4358         orig_dev = dev;
4359         mutex_unlock(&wl->mutex);
4360         if (b43_bus_host_is_sdio(dev->dev))
4361                 b43_sdio_free_irq(dev);
4362         else
4363                 free_irq(dev->dev->irq, dev);
4364         mutex_lock(&wl->mutex);
4365         dev = wl->current_dev;
4366         if (!dev)
4367                 return dev;
4368         if (dev != orig_dev) {
4369                 if (b43_status(dev) >= B43_STAT_STARTED)
4370                         goto redo;
4371                 return dev;
4372         }
4373         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4374         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4375 
4376         /* Drain all TX queues. */
4377         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4378                 while (skb_queue_len(&wl->tx_queue[queue_num])) {
4379                         struct sk_buff *skb;
4380 
4381                         skb = skb_dequeue(&wl->tx_queue[queue_num]);
4382                         ieee80211_free_txskb(wl->hw, skb);
4383                 }
4384         }
4385 
4386         b43_mac_suspend(dev);
4387         b43_leds_exit(dev);
4388         b43dbg(wl, "Wireless interface stopped\n");
4389 
4390         return dev;
4391 }
4392 
4393 /* Locking: wl->mutex */
4394 static int b43_wireless_core_start(struct b43_wldev *dev)
4395 {
4396         int err;
4397 
4398         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4399 
4400         drain_txstatus_queue(dev);
4401         if (b43_bus_host_is_sdio(dev->dev)) {
4402                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4403                 if (err) {
4404                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4405                         goto out;
4406                 }
4407         } else {
4408                 err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4409                                            b43_interrupt_thread_handler,
4410                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4411                 if (err) {
4412                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4413                                dev->dev->irq);
4414                         goto out;
4415                 }
4416         }
4417 
4418         /* We are ready to run. */
4419         ieee80211_wake_queues(dev->wl->hw);
4420         b43_set_status(dev, B43_STAT_STARTED);
4421 
4422         /* Start data flow (TX/RX). */
4423         b43_mac_enable(dev);
4424         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4425 
4426         /* Start maintenance work */
4427         b43_periodic_tasks_setup(dev);
4428 
4429         b43_leds_init(dev);
4430 
4431         b43dbg(dev->wl, "Wireless interface started\n");
4432 out:
4433         return err;
4434 }
4435 
4436 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4437 {
4438         switch (phy_type) {
4439         case B43_PHYTYPE_A:
4440                 return "A";
4441         case B43_PHYTYPE_B:
4442                 return "B";
4443         case B43_PHYTYPE_G:
4444                 return "G";
4445         case B43_PHYTYPE_N:
4446                 return "N";
4447         case B43_PHYTYPE_LP:
4448                 return "LP";
4449         case B43_PHYTYPE_SSLPN:
4450                 return "SSLPN";
4451         case B43_PHYTYPE_HT:
4452                 return "HT";
4453         case B43_PHYTYPE_LCN:
4454                 return "LCN";
4455         case B43_PHYTYPE_LCNXN:
4456                 return "LCNXN";
4457         case B43_PHYTYPE_LCN40:
4458                 return "LCN40";
4459         case B43_PHYTYPE_AC:
4460                 return "AC";
4461         }
4462         return "UNKNOWN";
4463 }
4464 
4465 /* Get PHY and RADIO versioning numbers */
4466 static int b43_phy_versioning(struct b43_wldev *dev)
4467 {
4468         struct b43_phy *phy = &dev->phy;
4469         const u8 core_rev = dev->dev->core_rev;
4470         u32 tmp;
4471         u8 analog_type;
4472         u8 phy_type;
4473         u8 phy_rev;
4474         u16 radio_manuf;
4475         u16 radio_id;
4476         u16 radio_rev;
4477         u8 radio_ver;
4478         int unsupported = 0;
4479 
4480         /* Get PHY versioning */
4481         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4482         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4483         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4484         phy_rev = (tmp & B43_PHYVER_VERSION);
4485 
4486         /* LCNXN is continuation of N which run out of revisions */
4487         if (phy_type == B43_PHYTYPE_LCNXN) {
4488                 phy_type = B43_PHYTYPE_N;
4489                 phy_rev += 16;
4490         }
4491 
4492         switch (phy_type) {
4493 #ifdef CONFIG_B43_PHY_G
4494         case B43_PHYTYPE_G:
4495                 if (phy_rev > 9)
4496                         unsupported = 1;
4497                 break;
4498 #endif
4499 #ifdef CONFIG_B43_PHY_N
4500         case B43_PHYTYPE_N:
4501                 if (phy_rev >= 19)
4502                         unsupported = 1;
4503                 break;
4504 #endif
4505 #ifdef CONFIG_B43_PHY_LP
4506         case B43_PHYTYPE_LP:
4507                 if (phy_rev > 2)
4508                         unsupported = 1;
4509                 break;
4510 #endif
4511 #ifdef CONFIG_B43_PHY_HT
4512         case B43_PHYTYPE_HT:
4513                 if (phy_rev > 1)
4514                         unsupported = 1;
4515                 break;
4516 #endif
4517 #ifdef CONFIG_B43_PHY_LCN
4518         case B43_PHYTYPE_LCN:
4519                 if (phy_rev > 1)
4520                         unsupported = 1;
4521                 break;
4522 #endif
4523 #ifdef CONFIG_B43_PHY_AC
4524         case B43_PHYTYPE_AC:
4525                 if (phy_rev > 1)
4526                         unsupported = 1;
4527                 break;
4528 #endif
4529         default:
4530                 unsupported = 1;
4531         }
4532         if (unsupported) {
4533                 b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4534                        analog_type, phy_type, b43_phy_name(dev, phy_type),
4535                        phy_rev);
4536                 return -EOPNOTSUPP;
4537         }
4538         b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4539                 analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4540 
4541         /* Get RADIO versioning */
4542         if (core_rev == 40 || core_rev == 42) {
4543                 radio_manuf = 0x17F;
4544 
4545                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 0);
4546                 radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4547 
4548                 b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 1);
4549                 radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4550 
4551                 radio_ver = 0; /* Is there version somewhere? */
4552         } else if (core_rev >= 24) {
4553                 u16 radio24[3];
4554 
4555                 for (tmp = 0; tmp < 3; tmp++) {
4556                         b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4557                         radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4558                 }
4559 
4560                 radio_manuf = 0x17F;
4561                 radio_id = (radio24[2] << 8) | radio24[1];
4562                 radio_rev = (radio24[0] & 0xF);
4563                 radio_ver = (radio24[0] & 0xF0) >> 4;
4564         } else {
4565                 if (dev->dev->chip_id == 0x4317) {
4566                         if (dev->dev->chip_rev == 0)
4567                                 tmp = 0x3205017F;
4568                         else if (dev->dev->chip_rev == 1)
4569                                 tmp = 0x4205017F;
4570                         else
4571                                 tmp = 0x5205017F;
4572                 } else {
4573                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4574                                      B43_RADIOCTL_ID);
4575                         tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4576                         b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4577                                      B43_RADIOCTL_ID);
4578                         tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4579                 }
4580                 radio_manuf = (tmp & 0x00000FFF);
4581                 radio_id = (tmp & 0x0FFFF000) >> 12;
4582                 radio_rev = (tmp & 0xF0000000) >> 28;
4583                 radio_ver = 0; /* Probably not available on old hw */
4584         }
4585 
4586         if (radio_manuf != 0x17F /* Broadcom */)
4587                 unsupported = 1;
4588         switch (phy_type) {
4589         case B43_PHYTYPE_B:
4590                 if ((radio_id & 0xFFF0) != 0x2050)
4591                         unsupported = 1;
4592                 break;
4593         case B43_PHYTYPE_G:
4594                 if (radio_id != 0x2050)
4595                         unsupported = 1;
4596                 break;
4597         case B43_PHYTYPE_N:
4598                 if (radio_id != 0x2055 && radio_id != 0x2056 &&
4599                     radio_id != 0x2057)
4600                         unsupported = 1;
4601                 if (radio_id == 0x2057 &&
4602                     !(radio_rev == 9 || radio_rev == 14))
4603                         unsupported = 1;
4604                 break;
4605         case B43_PHYTYPE_LP:
4606                 if (radio_id != 0x2062 && radio_id != 0x2063)
4607                         unsupported = 1;
4608                 break;
4609         case B43_PHYTYPE_HT:
4610                 if (radio_id != 0x2059)
4611                         unsupported = 1;
4612                 break;
4613         case B43_PHYTYPE_LCN:
4614                 if (radio_id != 0x2064)
4615                         unsupported = 1;
4616                 break;
4617         case B43_PHYTYPE_AC:
4618                 if (radio_id != 0x2069)
4619                         unsupported = 1;
4620                 break;
4621         default:
4622                 B43_WARN_ON(1);
4623         }
4624         if (unsupported) {
4625                 b43err(dev->wl,
4626                        "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4627                        radio_manuf, radio_id, radio_rev, radio_ver);
4628                 return -EOPNOTSUPP;
4629         }
4630         b43info(dev->wl,
4631                 "Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4632                 radio_manuf, radio_id, radio_rev, radio_ver);
4633 
4634         /* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4635         phy->radio_manuf = radio_manuf;
4636         phy->radio_ver = radio_id;
4637         phy->radio_rev = radio_rev;
4638 
4639         phy->analog = analog_type;
4640         phy->type = phy_type;
4641         phy->rev = phy_rev;
4642 
4643         return 0;
4644 }
4645 
4646 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4647                                       struct b43_phy *phy)
4648 {
4649         phy->hardware_power_control = !!modparam_hwpctl;
4650         phy->next_txpwr_check_time = jiffies;
4651         /* PHY TX errors counter. */
4652         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4653 
4654 #if B43_DEBUG
4655         phy->phy_locked = false;
4656         phy->radio_locked = false;
4657 #endif
4658 }
4659 
4660 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4661 {
4662         dev->dfq_valid = false;
4663 
4664         /* Assume the radio is enabled. If it's not enabled, the state will
4665          * immediately get fixed on the first periodic work run. */
4666         dev->radio_hw_enable = true;
4667 
4668         /* Stats */
4669         memset(&dev->stats, 0, sizeof(dev->stats));
4670 
4671         setup_struct_phy_for_init(dev, &dev->phy);
4672 
4673         /* IRQ related flags */
4674         dev->irq_reason = 0;
4675         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4676         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4677         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4678                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4679 
4680         dev->mac_suspended = 1;
4681 
4682         /* Noise calculation context */
4683         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4684 }
4685 
4686 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4687 {
4688         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4689         u64 hf;
4690 
4691         if (!modparam_btcoex)
4692                 return;
4693         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4694                 return;
4695         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4696                 return;
4697 
4698         hf = b43_hf_read(dev);
4699         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4700                 hf |= B43_HF_BTCOEXALT;
4701         else
4702                 hf |= B43_HF_BTCOEX;
4703         b43_hf_write(dev, hf);
4704 }
4705 
4706 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4707 {
4708         if (!modparam_btcoex)
4709                 return;
4710         //TODO
4711 }
4712 
4713 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4714 {
4715         struct ssb_bus *bus;
4716         u32 tmp;
4717 
4718 #ifdef CONFIG_B43_SSB
4719         if (dev->dev->bus_type != B43_BUS_SSB)
4720                 return;
4721 #else
4722         return;
4723 #endif
4724 
4725         bus = dev->dev->sdev->bus;
4726 
4727         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4728             (bus->chip_id == 0x4312)) {
4729                 tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4730                 tmp &= ~SSB_IMCFGLO_REQTO;
4731                 tmp &= ~SSB_IMCFGLO_SERTO;
4732                 tmp |= 0x3;
4733                 ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4734                 ssb_commit_settings(bus);
4735         }
4736 }
4737 
4738 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4739 {
4740         u16 pu_delay;
4741 
4742         /* The time value is in microseconds. */
4743         pu_delay = 1050;
4744         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4745                 pu_delay = 500;
4746         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4747                 pu_delay = max(pu_delay, (u16)2400);
4748 
4749         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4750 }
4751 
4752 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4753 static void b43_set_pretbtt(struct b43_wldev *dev)
4754 {
4755         u16 pretbtt;
4756 
4757         /* The time value is in microseconds. */
4758         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
4759                 pretbtt = 2;
4760         else
4761                 pretbtt = 250;
4762         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4763         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4764 }
4765 
4766 /* Shutdown a wireless core */
4767 /* Locking: wl->mutex */
4768 static void b43_wireless_core_exit(struct b43_wldev *dev)
4769 {
4770         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4771         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4772                 return;
4773 
4774         b43_set_status(dev, B43_STAT_UNINIT);
4775 
4776         /* Stop the microcode PSM. */
4777         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4778                       B43_MACCTL_PSM_JMP0);
4779 
4780         switch (dev->dev->bus_type) {
4781 #ifdef CONFIG_B43_BCMA
4782         case B43_BUS_BCMA:
4783                 bcma_host_pci_down(dev->dev->bdev->bus);
4784                 break;
4785 #endif
4786 #ifdef CONFIG_B43_SSB
4787         case B43_BUS_SSB:
4788                 /* TODO */
4789                 break;
4790 #endif
4791         }
4792 
4793         b43_dma_free(dev);
4794         b43_pio_free(dev);
4795         b43_chip_exit(dev);
4796         dev->phy.ops->switch_analog(dev, 0);
4797         if (dev->wl->current_beacon) {
4798                 dev_kfree_skb_any(dev->wl->current_beacon);
4799                 dev->wl->current_beacon = NULL;
4800         }
4801 
4802         b43_device_disable(dev, 0);
4803         b43_bus_may_powerdown(dev);
4804 }
4805 
4806 /* Initialize a wireless core */
4807 static int b43_wireless_core_init(struct b43_wldev *dev)
4808 {
4809         struct ssb_sprom *sprom = dev->dev->bus_sprom;
4810         struct b43_phy *phy = &dev->phy;
4811         int err;
4812         u64 hf;
4813 
4814         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4815 
4816         err = b43_bus_powerup(dev, 0);
4817         if (err)
4818                 goto out;
4819         if (!b43_device_is_enabled(dev))
4820                 b43_wireless_core_reset(dev, phy->gmode);
4821 
4822         /* Reset all data structures. */
4823         setup_struct_wldev_for_init(dev);
4824         phy->ops->prepare_structs(dev);
4825 
4826         /* Enable IRQ routing to this device. */
4827         switch (dev->dev->bus_type) {
4828 #ifdef CONFIG_B43_BCMA
4829         case B43_BUS_BCMA:
4830                 bcma_host_pci_irq_ctl(dev->dev->bdev->bus,
4831                                       dev->dev->bdev, true);
4832                 bcma_host_pci_up(dev->dev->bdev->bus);
4833                 break;
4834 #endif
4835 #ifdef CONFIG_B43_SSB
4836         case B43_BUS_SSB:
4837                 ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4838                                                dev->dev->sdev);
4839                 break;
4840 #endif
4841         }
4842 
4843         b43_imcfglo_timeouts_workaround(dev);
4844         b43_bluetooth_coext_disable(dev);
4845         if (phy->ops->prepare_hardware) {
4846                 err = phy->ops->prepare_hardware(dev);
4847                 if (err)
4848                         goto err_busdown;
4849         }
4850         err = b43_chip_init(dev);
4851         if (err)
4852                 goto err_busdown;
4853         b43_shm_write16(dev, B43_SHM_SHARED,
4854                         B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4855         hf = b43_hf_read(dev);
4856         if (phy->type == B43_PHYTYPE_G) {
4857                 hf |= B43_HF_SYMW;
4858                 if (phy->rev == 1)
4859                         hf |= B43_HF_GDCW;
4860                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4861                         hf |= B43_HF_OFDMPABOOST;
4862         }
4863         if (phy->radio_ver == 0x2050) {
4864                 if (phy->radio_rev == 6)
4865                         hf |= B43_HF_4318TSSI;
4866                 if (phy->radio_rev < 6)
4867                         hf |= B43_HF_VCORECALC;
4868         }
4869         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4870                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4871 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4872         if (dev->dev->bus_type == B43_BUS_SSB &&
4873             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4874             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4875                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4876 #endif
4877         hf &= ~B43_HF_SKCFPUP;
4878         b43_hf_write(dev, hf);
4879 
4880         /* tell the ucode MAC capabilities */
4881         if (dev->dev->core_rev >= 13) {
4882                 u32 mac_hw_cap = b43_read32(dev, B43_MMIO_MAC_HW_CAP);
4883 
4884                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_L,
4885                                 mac_hw_cap & 0xffff);
4886                 b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_H,
4887                                 (mac_hw_cap >> 16) & 0xffff);
4888         }
4889 
4890         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4891                              B43_DEFAULT_LONG_RETRY_LIMIT);
4892         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4893         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4894 
4895         /* Disable sending probe responses from firmware.
4896          * Setting the MaxTime to one usec will always trigger
4897          * a timeout, so we never send any probe resp.
4898          * A timeout of zero is infinite. */
4899         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4900 
4901         b43_rate_memory_init(dev);
4902         b43_set_phytxctl_defaults(dev);
4903 
4904         /* Minimum Contention Window */
4905         if (phy->type == B43_PHYTYPE_B)
4906                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4907         else
4908                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4909         /* Maximum Contention Window */
4910         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4911 
4912         /* write phytype and phyvers */
4913         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYTYPE, phy->type);
4914         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYVER, phy->rev);
4915 
4916         if (b43_bus_host_is_pcmcia(dev->dev) ||
4917             b43_bus_host_is_sdio(dev->dev)) {
4918                 dev->__using_pio_transfers = true;
4919                 err = b43_pio_init(dev);
4920         } else if (dev->use_pio) {
4921                 b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4922                         "This should not be needed and will result in lower "
4923                         "performance.\n");
4924                 dev->__using_pio_transfers = true;
4925                 err = b43_pio_init(dev);
4926         } else {
4927                 dev->__using_pio_transfers = false;
4928                 err = b43_dma_init(dev);
4929         }
4930         if (err)
4931                 goto err_chip_exit;
4932         b43_qos_init(dev);
4933         b43_set_synth_pu_delay(dev, 1);
4934         b43_bluetooth_coext_enable(dev);
4935 
4936         b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4937         b43_upload_card_macaddress(dev);
4938         b43_security_init(dev);
4939 
4940         ieee80211_wake_queues(dev->wl->hw);
4941 
4942         b43_set_status(dev, B43_STAT_INITIALIZED);
4943 
4944 out:
4945         return err;
4946 
4947 err_chip_exit:
4948         b43_chip_exit(dev);
4949 err_busdown:
4950         b43_bus_may_powerdown(dev);
4951         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4952         return err;
4953 }
4954 
4955 static int b43_op_add_interface(struct ieee80211_hw *hw,
4956                                 struct ieee80211_vif *vif)
4957 {
4958         struct b43_wl *wl = hw_to_b43_wl(hw);
4959         struct b43_wldev *dev;
4960         int err = -EOPNOTSUPP;
4961 
4962         /* TODO: allow WDS/AP devices to coexist */
4963 
4964         if (vif->type != NL80211_IFTYPE_AP &&
4965             vif->type != NL80211_IFTYPE_MESH_POINT &&
4966             vif->type != NL80211_IFTYPE_STATION &&
4967             vif->type != NL80211_IFTYPE_WDS &&
4968             vif->type != NL80211_IFTYPE_ADHOC)
4969                 return -EOPNOTSUPP;
4970 
4971         mutex_lock(&wl->mutex);
4972         if (wl->operating)
4973                 goto out_mutex_unlock;
4974 
4975         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4976 
4977         dev = wl->current_dev;
4978         wl->operating = true;
4979         wl->vif = vif;
4980         wl->if_type = vif->type;
4981         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4982 
4983         b43_adjust_opmode(dev);
4984         b43_set_pretbtt(dev);
4985         b43_set_synth_pu_delay(dev, 0);
4986         b43_upload_card_macaddress(dev);
4987 
4988         err = 0;
4989  out_mutex_unlock:
4990         mutex_unlock(&wl->mutex);
4991 
4992         if (err == 0)
4993                 b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
4994 
4995         return err;
4996 }
4997 
4998 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4999                                     struct ieee80211_vif *vif)
5000 {
5001         struct b43_wl *wl = hw_to_b43_wl(hw);
5002         struct b43_wldev *dev = wl->current_dev;
5003 
5004         b43dbg(wl, "Removing Interface type %d\n", vif->type);
5005 
5006         mutex_lock(&wl->mutex);
5007 
5008         B43_WARN_ON(!wl->operating);
5009         B43_WARN_ON(wl->vif != vif);
5010         wl->vif = NULL;
5011 
5012         wl->operating = false;
5013 
5014         b43_adjust_opmode(dev);
5015         eth_zero_addr(wl->mac_addr);
5016         b43_upload_card_macaddress(dev);
5017 
5018         mutex_unlock(&wl->mutex);
5019 }
5020 
5021 static int b43_op_start(struct ieee80211_hw *hw)
5022 {
5023         struct b43_wl *wl = hw_to_b43_wl(hw);
5024         struct b43_wldev *dev = wl->current_dev;
5025         int did_init = 0;
5026         int err = 0;
5027 
5028         /* Kill all old instance specific information to make sure
5029          * the card won't use it in the short timeframe between start
5030          * and mac80211 reconfiguring it. */
5031         eth_zero_addr(wl->bssid);
5032         eth_zero_addr(wl->mac_addr);
5033         wl->filter_flags = 0;
5034         wl->radiotap_enabled = false;
5035         b43_qos_clear(wl);
5036         wl->beacon0_uploaded = false;
5037         wl->beacon1_uploaded = false;
5038         wl->beacon_templates_virgin = true;
5039         wl->radio_enabled = true;
5040 
5041         mutex_lock(&wl->mutex);
5042 
5043         if (b43_status(dev) < B43_STAT_INITIALIZED) {
5044                 err = b43_wireless_core_init(dev);
5045                 if (err)
5046                         goto out_mutex_unlock;
5047                 did_init = 1;
5048         }
5049 
5050         if (b43_status(dev) < B43_STAT_STARTED) {
5051                 err = b43_wireless_core_start(dev);
5052                 if (err) {
5053                         if (did_init)
5054                                 b43_wireless_core_exit(dev);
5055                         goto out_mutex_unlock;
5056                 }
5057         }
5058 
5059         /* XXX: only do if device doesn't support rfkill irq */
5060         wiphy_rfkill_start_polling(hw->wiphy);
5061 
5062  out_mutex_unlock:
5063         mutex_unlock(&wl->mutex);
5064 
5065         /*
5066          * Configuration may have been overwritten during initialization.
5067          * Reload the configuration, but only if initialization was
5068          * successful. Reloading the configuration after a failed init
5069          * may hang the system.
5070          */
5071         if (!err)
5072                 b43_op_config(hw, ~0);
5073 
5074         return err;
5075 }
5076 
5077 static void b43_op_stop(struct ieee80211_hw *hw)
5078 {
5079         struct b43_wl *wl = hw_to_b43_wl(hw);
5080         struct b43_wldev *dev = wl->current_dev;
5081 
5082         cancel_work_sync(&(wl->beacon_update_trigger));
5083 
5084         if (!dev)
5085                 goto out;
5086 
5087         mutex_lock(&wl->mutex);
5088         if (b43_status(dev) >= B43_STAT_STARTED) {
5089                 dev = b43_wireless_core_stop(dev);
5090                 if (!dev)
5091                         goto out_unlock;
5092         }
5093         b43_wireless_core_exit(dev);
5094         wl->radio_enabled = false;
5095 
5096 out_unlock:
5097         mutex_unlock(&wl->mutex);
5098 out:
5099         cancel_work_sync(&(wl->txpower_adjust_work));
5100 }
5101 
5102 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5103                                  struct ieee80211_sta *sta, bool set)
5104 {
5105         struct b43_wl *wl = hw_to_b43_wl(hw);
5106 
5107         b43_update_templates(wl);
5108 
5109         return 0;
5110 }
5111 
5112 static void b43_op_sta_notify(struct ieee80211_hw *hw,
5113                               struct ieee80211_vif *vif,
5114                               enum sta_notify_cmd notify_cmd,
5115                               struct ieee80211_sta *sta)
5116 {
5117         struct b43_wl *wl = hw_to_b43_wl(hw);
5118 
5119         B43_WARN_ON(!vif || wl->vif != vif);
5120 }
5121 
5122 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw,
5123                                           struct ieee80211_vif *vif,
5124                                           const u8 *mac_addr)
5125 {
5126         struct b43_wl *wl = hw_to_b43_wl(hw);
5127         struct b43_wldev *dev;
5128 
5129         mutex_lock(&wl->mutex);
5130         dev = wl->current_dev;
5131         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5132                 /* Disable CFP update during scan on other channels. */
5133                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5134         }
5135         mutex_unlock(&wl->mutex);
5136 }
5137 
5138 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw,
5139                                              struct ieee80211_vif *vif)
5140 {
5141         struct b43_wl *wl = hw_to_b43_wl(hw);
5142         struct b43_wldev *dev;
5143 
5144         mutex_lock(&wl->mutex);
5145         dev = wl->current_dev;
5146         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5147                 /* Re-enable CFP update. */
5148                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5149         }
5150         mutex_unlock(&wl->mutex);
5151 }
5152 
5153 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5154                              struct survey_info *survey)
5155 {
5156         struct b43_wl *wl = hw_to_b43_wl(hw);
5157         struct b43_wldev *dev = wl->current_dev;
5158         struct ieee80211_conf *conf = &hw->conf;
5159 
5160         if (idx != 0)
5161                 return -ENOENT;
5162 
5163         survey->channel = conf->chandef.chan;
5164         survey->filled = SURVEY_INFO_NOISE_DBM;
5165         survey->noise = dev->stats.link_noise;
5166 
5167         return 0;
5168 }
5169 
5170 static const struct ieee80211_ops b43_hw_ops = {
5171         .tx                     = b43_op_tx,
5172         .conf_tx                = b43_op_conf_tx,
5173         .add_interface          = b43_op_add_interface,
5174         .remove_interface       = b43_op_remove_interface,
5175         .config                 = b43_op_config,
5176         .bss_info_changed       = b43_op_bss_info_changed,
5177         .configure_filter       = b43_op_configure_filter,
5178         .set_key                = b43_op_set_key,
5179         .update_tkip_key        = b43_op_update_tkip_key,
5180         .get_stats              = b43_op_get_stats,
5181         .get_tsf                = b43_op_get_tsf,
5182         .set_tsf                = b43_op_set_tsf,
5183         .start                  = b43_op_start,
5184         .stop                   = b43_op_stop,
5185         .set_tim                = b43_op_beacon_set_tim,
5186         .sta_notify             = b43_op_sta_notify,
5187         .sw_scan_start          = b43_op_sw_scan_start_notifier,
5188         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
5189         .get_survey             = b43_op_get_survey,
5190         .rfkill_poll            = b43_rfkill_poll,
5191 };
5192 
5193 /* Hard-reset the chip. Do not call this directly.
5194  * Use b43_controller_restart()
5195  */
5196 static void b43_chip_reset(struct work_struct *work)
5197 {
5198         struct b43_wldev *dev =
5199             container_of(work, struct b43_wldev, restart_work);
5200         struct b43_wl *wl = dev->wl;
5201         int err = 0;
5202         int prev_status;
5203 
5204         mutex_lock(&wl->mutex);
5205 
5206         prev_status = b43_status(dev);
5207         /* Bring the device down... */
5208         if (prev_status >= B43_STAT_STARTED) {
5209                 dev = b43_wireless_core_stop(dev);
5210                 if (!dev) {
5211                         err = -ENODEV;
5212                         goto out;
5213                 }
5214         }
5215         if (prev_status >= B43_STAT_INITIALIZED)
5216                 b43_wireless_core_exit(dev);
5217 
5218         /* ...and up again. */
5219         if (prev_status >= B43_STAT_INITIALIZED) {
5220                 err = b43_wireless_core_init(dev);
5221                 if (err)
5222                         goto out;
5223         }
5224         if (prev_status >= B43_STAT_STARTED) {
5225                 err = b43_wireless_core_start(dev);
5226                 if (err) {
5227                         b43_wireless_core_exit(dev);
5228                         goto out;
5229                 }
5230         }
5231 out:
5232         if (err)
5233                 wl->current_dev = NULL; /* Failed to init the dev. */
5234         mutex_unlock(&wl->mutex);
5235 
5236         if (err) {
5237                 b43err(wl, "Controller restart FAILED\n");
5238                 return;
5239         }
5240 
5241         /* reload configuration */
5242         b43_op_config(wl->hw, ~0);
5243         if (wl->vif)
5244                 b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5245 
5246         b43info(wl, "Controller restarted\n");
5247 }
5248 
5249 static int b43_setup_bands(struct b43_wldev *dev,
5250                            bool have_2ghz_phy, bool have_5ghz_phy)
5251 {
5252         struct ieee80211_hw *hw = dev->wl->hw;
5253         struct b43_phy *phy = &dev->phy;
5254         bool limited_2g;
5255         bool limited_5g;
5256 
5257         /* We don't support all 2 GHz channels on some devices */
5258         limited_2g = phy->radio_ver == 0x2057 &&
5259                      (phy->radio_rev == 9 || phy->radio_rev == 14);
5260         limited_5g = phy->radio_ver == 0x2057 &&
5261                      phy->radio_rev == 9;
5262 
5263         if (have_2ghz_phy)
5264                 hw->wiphy->bands[NL80211_BAND_2GHZ] = limited_2g ?
5265                         &b43_band_2ghz_limited : &b43_band_2GHz;
5266         if (dev->phy.type == B43_PHYTYPE_N) {
5267                 if (have_5ghz_phy)
5268                         hw->wiphy->bands[NL80211_BAND_5GHZ] = limited_5g ?
5269                                 &b43_band_5GHz_nphy_limited :
5270                                 &b43_band_5GHz_nphy;
5271         } else {
5272                 if (have_5ghz_phy)
5273                         hw->wiphy->bands[NL80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5274         }
5275 
5276         dev->phy.supports_2ghz = have_2ghz_phy;
5277         dev->phy.supports_5ghz = have_5ghz_phy;
5278 
5279         return 0;
5280 }
5281 
5282 static void b43_wireless_core_detach(struct b43_wldev *dev)
5283 {
5284         /* We release firmware that late to not be required to re-request
5285          * is all the time when we reinit the core. */
5286         b43_release_firmware(dev);
5287         b43_phy_free(dev);
5288 }
5289 
5290 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5291                                 bool *have_5ghz_phy)
5292 {
5293         u16 dev_id = 0;
5294 
5295 #ifdef CONFIG_B43_BCMA
5296         if (dev->dev->bus_type == B43_BUS_BCMA &&
5297             dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5298                 dev_id = dev->dev->bdev->bus->host_pci->device;
5299 #endif
5300 #ifdef CONFIG_B43_SSB
5301         if (dev->dev->bus_type == B43_BUS_SSB &&
5302             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5303                 dev_id = dev->dev->sdev->bus->host_pci->device;
5304 #endif
5305         /* Override with SPROM value if available */
5306         if (dev->dev->bus_sprom->dev_id)
5307                 dev_id = dev->dev->bus_sprom->dev_id;
5308 
5309         /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5310         switch (dev_id) {
5311         case 0x4324: /* BCM4306 */
5312         case 0x4312: /* BCM4311 */
5313         case 0x4319: /* BCM4318 */
5314         case 0x4328: /* BCM4321 */
5315         case 0x432b: /* BCM4322 */
5316         case 0x4350: /* BCM43222 */
5317         case 0x4353: /* BCM43224 */
5318         case 0x0576: /* BCM43224 */
5319         case 0x435f: /* BCM6362 */
5320         case 0x4331: /* BCM4331 */
5321         case 0x4359: /* BCM43228 */
5322         case 0x43a0: /* BCM4360 */
5323         case 0x43b1: /* BCM4352 */
5324                 /* Dual band devices */
5325                 *have_2ghz_phy = true;
5326                 *have_5ghz_phy = true;
5327                 return;
5328         case 0x4321: /* BCM4306 */
5329                 /* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
5330                 if (dev->phy.type != B43_PHYTYPE_G)
5331                         break;
5332                 /* fall through */
5333         case 0x4313: /* BCM4311 */
5334         case 0x431a: /* BCM4318 */
5335         case 0x432a: /* BCM4321 */
5336         case 0x432d: /* BCM4322 */
5337         case 0x4352: /* BCM43222 */
5338         case 0x435a: /* BCM43228 */
5339         case 0x4333: /* BCM4331 */
5340         case 0x43a2: /* BCM4360 */
5341         case 0x43b3: /* BCM4352 */
5342                 /* 5 GHz only devices */
5343                 *have_2ghz_phy = false;
5344                 *have_5ghz_phy = true;
5345                 return;
5346         }
5347 
5348         /* As a fallback, try to guess using PHY type */
5349         switch (dev->phy.type) {
5350         case B43_PHYTYPE_G:
5351         case B43_PHYTYPE_N:
5352         case B43_PHYTYPE_LP:
5353         case B43_PHYTYPE_HT:
5354         case B43_PHYTYPE_LCN:
5355                 *have_2ghz_phy = true;
5356                 *have_5ghz_phy = false;
5357                 return;
5358         }
5359 
5360         B43_WARN_ON(1);
5361 }
5362 
5363 static int b43_wireless_core_attach(struct b43_wldev *dev)
5364 {
5365         struct b43_wl *wl = dev->wl;
5366         struct b43_phy *phy = &dev->phy;
5367         int err;
5368         u32 tmp;
5369         bool have_2ghz_phy = false, have_5ghz_phy = false;
5370 
5371         /* Do NOT do any device initialization here.
5372          * Do it in wireless_core_init() instead.
5373          * This function is for gathering basic information about the HW, only.
5374          * Also some structs may be set up here. But most likely you want to have
5375          * that in core_init(), too.
5376          */
5377 
5378         err = b43_bus_powerup(dev, 0);
5379         if (err) {
5380                 b43err(wl, "Bus powerup failed\n");
5381                 goto out;
5382         }
5383 
5384         phy->do_full_init = true;
5385 
5386         /* Try to guess supported bands for the first init needs */
5387         switch (dev->dev->bus_type) {
5388 #ifdef CONFIG_B43_BCMA
5389         case B43_BUS_BCMA:
5390                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5391                 have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5392                 have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5393                 break;
5394 #endif
5395 #ifdef CONFIG_B43_SSB
5396         case B43_BUS_SSB:
5397                 if (dev->dev->core_rev >= 5) {
5398                         tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5399                         have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5400                         have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5401                 } else
5402                         B43_WARN_ON(1);
5403                 break;
5404 #endif
5405         }
5406 
5407         dev->phy.gmode = have_2ghz_phy;
5408         b43_wireless_core_reset(dev, dev->phy.gmode);
5409 
5410         /* Get the PHY type. */
5411         err = b43_phy_versioning(dev);
5412         if (err)
5413                 goto err_powerdown;
5414 
5415         /* Get real info about supported bands */
5416         b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5417 
5418         /* We don't support 5 GHz on some PHYs yet */
5419         if (have_5ghz_phy) {
5420                 switch (dev->phy.type) {
5421                 case B43_PHYTYPE_G:
5422                 case B43_PHYTYPE_LP:
5423                 case B43_PHYTYPE_HT:
5424                         b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5425                         have_5ghz_phy = false;
5426                 }
5427         }
5428 
5429         if (!have_2ghz_phy && !have_5ghz_phy) {
5430                 b43err(wl, "b43 can't support any band on this device\n");
5431                 err = -EOPNOTSUPP;
5432                 goto err_powerdown;
5433         }
5434 
5435         err = b43_phy_allocate(dev);
5436         if (err)
5437                 goto err_powerdown;
5438 
5439         dev->phy.gmode = have_2ghz_phy;
5440         b43_wireless_core_reset(dev, dev->phy.gmode);
5441 
5442         err = b43_validate_chipaccess(dev);
5443         if (err)
5444                 goto err_phy_free;
5445         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5446         if (err)
5447                 goto err_phy_free;
5448 
5449         /* Now set some default "current_dev" */
5450         if (!wl->current_dev)
5451                 wl->current_dev = dev;
5452         INIT_WORK(&dev->restart_work, b43_chip_reset);
5453 
5454         dev->phy.ops->switch_analog(dev, 0);
5455         b43_device_disable(dev, 0);
5456         b43_bus_may_powerdown(dev);
5457 
5458 out:
5459         return err;
5460 
5461 err_phy_free:
5462         b43_phy_free(dev);
5463 err_powerdown:
5464         b43_bus_may_powerdown(dev);
5465         return err;
5466 }
5467 
5468 static void b43_one_core_detach(struct b43_bus_dev *dev)
5469 {
5470         struct b43_wldev *wldev;
5471 
5472         /* Do not cancel ieee80211-workqueue based work here.
5473          * See comment in b43_remove(). */
5474 
5475         wldev = b43_bus_get_wldev(dev);
5476         b43_debugfs_remove_device(wldev);
5477         b43_wireless_core_detach(wldev);
5478         list_del(&wldev->list);
5479         b43_bus_set_wldev(dev, NULL);
5480         kfree(wldev);
5481 }
5482 
5483 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5484 {
5485         struct b43_wldev *wldev;
5486         int err = -ENOMEM;
5487 
5488         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5489         if (!wldev)
5490                 goto out;
5491 
5492         wldev->use_pio = b43_modparam_pio;
5493         wldev->dev = dev;
5494         wldev->wl = wl;
5495         b43_set_status(wldev, B43_STAT_UNINIT);
5496         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5497         INIT_LIST_HEAD(&wldev->list);
5498 
5499         err = b43_wireless_core_attach(wldev);
5500         if (err)
5501                 goto err_kfree_wldev;
5502 
5503         b43_bus_set_wldev(dev, wldev);
5504         b43_debugfs_add_device(wldev);
5505 
5506       out:
5507         return err;
5508 
5509       err_kfree_wldev:
5510         kfree(wldev);
5511         return err;
5512 }
5513 
5514 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
5515         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
5516         (pdev->device == _device) &&                                    \
5517         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
5518         (pdev->subsystem_device == _subdevice)                          )
5519 
5520 #ifdef CONFIG_B43_SSB
5521 static void b43_sprom_fixup(struct ssb_bus *bus)
5522 {
5523         struct pci_dev *pdev;
5524 
5525         /* boardflags workarounds */
5526         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5527             bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5528                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5529         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5530             bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5531                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5532         if (bus->bustype == SSB_BUSTYPE_PCI) {
5533                 pdev = bus->host_pci;
5534                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5535                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5536                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5537                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5538                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5539                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5540                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5541                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5542         }
5543 }
5544 
5545 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5546 {
5547         struct ieee80211_hw *hw = wl->hw;
5548 
5549         ssb_set_devtypedata(dev->sdev, NULL);
5550         ieee80211_free_hw(hw);
5551 }
5552 #endif
5553 
5554 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5555 {
5556         struct ssb_sprom *sprom = dev->bus_sprom;
5557         struct ieee80211_hw *hw;
5558         struct b43_wl *wl;
5559         char chip_name[6];
5560         int queue_num;
5561 
5562         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5563         if (!hw) {
5564                 b43err(NULL, "Could not allocate ieee80211 device\n");
5565                 return ERR_PTR(-ENOMEM);
5566         }
5567         wl = hw_to_b43_wl(hw);
5568 
5569         /* fill hw info */
5570         ieee80211_hw_set(hw, RX_INCLUDES_FCS);
5571         ieee80211_hw_set(hw, SIGNAL_DBM);
5572 
5573         hw->wiphy->interface_modes =
5574                 BIT(NL80211_IFTYPE_AP) |
5575                 BIT(NL80211_IFTYPE_MESH_POINT) |
5576                 BIT(NL80211_IFTYPE_STATION) |
5577 #ifdef CONFIG_WIRELESS_WDS
5578                 BIT(NL80211_IFTYPE_WDS) |
5579 #endif
5580                 BIT(NL80211_IFTYPE_ADHOC);
5581 
5582         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5583 
5584         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5585 
5586         wl->hw_registered = false;
5587         hw->max_rates = 2;
5588         SET_IEEE80211_DEV(hw, dev->dev);
5589         if (is_valid_ether_addr(sprom->et1mac))
5590                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5591         else
5592                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5593 
5594         /* Initialize struct b43_wl */
5595         wl->hw = hw;
5596         mutex_init(&wl->mutex);
5597         spin_lock_init(&wl->hardirq_lock);
5598         spin_lock_init(&wl->beacon_lock);
5599         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5600         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5601         INIT_WORK(&wl->tx_work, b43_tx_work);
5602 
5603         /* Initialize queues and flags. */
5604         for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5605                 skb_queue_head_init(&wl->tx_queue[queue_num]);
5606                 wl->tx_queue_stopped[queue_num] = 0;
5607         }
5608 
5609         snprintf(chip_name, ARRAY_SIZE(chip_name),
5610                  (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5611         b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5612                 dev->core_rev);
5613         return wl;
5614 }
5615 
5616 #ifdef CONFIG_B43_BCMA
5617 static int b43_bcma_probe(struct bcma_device *core)
5618 {
5619         struct b43_bus_dev *dev;
5620         struct b43_wl *wl;
5621         int err;
5622 
5623         if (!modparam_allhwsupport &&
5624             (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5625                 pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5626                 return -ENOTSUPP;
5627         }
5628 
5629         dev = b43_bus_dev_bcma_init(core);
5630         if (!dev)
5631                 return -ENODEV;
5632 
5633         wl = b43_wireless_init(dev);
5634         if (IS_ERR(wl)) {
5635                 err = PTR_ERR(wl);
5636                 goto bcma_out;
5637         }
5638 
5639         err = b43_one_core_attach(dev, wl);
5640         if (err)
5641                 goto bcma_err_wireless_exit;
5642 
5643         /* setup and start work to load firmware */
5644         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5645         schedule_work(&wl->firmware_load);
5646 
5647         return err;
5648 
5649 bcma_err_wireless_exit:
5650         ieee80211_free_hw(wl->hw);
5651 bcma_out:
5652         kfree(dev);
5653         return err;
5654 }
5655 
5656 static void b43_bcma_remove(struct bcma_device *core)
5657 {
5658         struct b43_wldev *wldev = bcma_get_drvdata(core);
5659         struct b43_wl *wl = wldev->wl;
5660 
5661         /* We must cancel any work here before unregistering from ieee80211,
5662          * as the ieee80211 unreg will destroy the workqueue. */
5663         cancel_work_sync(&wldev->restart_work);
5664         cancel_work_sync(&wl->firmware_load);
5665 
5666         B43_WARN_ON(!wl);
5667         if (!wldev->fw.ucode.data)
5668                 return;                 /* NULL if firmware never loaded */
5669         if (wl->current_dev == wldev && wl->hw_registered) {
5670                 b43_leds_stop(wldev);
5671                 ieee80211_unregister_hw(wl->hw);
5672         }
5673 
5674         b43_one_core_detach(wldev->dev);
5675 
5676         /* Unregister HW RNG driver */
5677         b43_rng_exit(wl);
5678 
5679         b43_leds_unregister(wl);
5680         ieee80211_free_hw(wl->hw);
5681         kfree(wldev->dev);
5682 }
5683 
5684 static struct bcma_driver b43_bcma_driver = {
5685         .name           = KBUILD_MODNAME,
5686         .id_table       = b43_bcma_tbl,
5687         .probe          = b43_bcma_probe,
5688         .remove         = b43_bcma_remove,
5689 };
5690 #endif
5691 
5692 #ifdef CONFIG_B43_SSB
5693 static
5694 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5695 {
5696         struct b43_bus_dev *dev;
5697         struct b43_wl *wl;
5698         int err;
5699 
5700         dev = b43_bus_dev_ssb_init(sdev);
5701         if (!dev)
5702                 return -ENOMEM;
5703 
5704         wl = ssb_get_devtypedata(sdev);
5705         if (wl) {
5706                 b43err(NULL, "Dual-core devices are not supported\n");
5707                 err = -ENOTSUPP;
5708                 goto err_ssb_kfree_dev;
5709         }
5710 
5711         b43_sprom_fixup(sdev->bus);
5712 
5713         wl = b43_wireless_init(dev);
5714         if (IS_ERR(wl)) {
5715                 err = PTR_ERR(wl);
5716                 goto err_ssb_kfree_dev;
5717         }
5718         ssb_set_devtypedata(sdev, wl);
5719         B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5720 
5721         err = b43_one_core_attach(dev, wl);
5722         if (err)
5723                 goto err_ssb_wireless_exit;
5724 
5725         /* setup and start work to load firmware */
5726         INIT_WORK(&wl->firmware_load, b43_request_firmware);
5727         schedule_work(&wl->firmware_load);
5728 
5729         return err;
5730 
5731 err_ssb_wireless_exit:
5732         b43_wireless_exit(dev, wl);
5733 err_ssb_kfree_dev:
5734         kfree(dev);
5735         return err;
5736 }
5737 
5738 static void b43_ssb_remove(struct ssb_device *sdev)
5739 {
5740         struct b43_wl *wl = ssb_get_devtypedata(sdev);
5741         struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5742         struct b43_bus_dev *dev = wldev->dev;
5743 
5744         /* We must cancel any work here before unregistering from ieee80211,
5745          * as the ieee80211 unreg will destroy the workqueue. */
5746         cancel_work_sync(&wldev->restart_work);
5747         cancel_work_sync(&wl->firmware_load);
5748 
5749         B43_WARN_ON(!wl);
5750         if (!wldev->fw.ucode.data)
5751                 return;                 /* NULL if firmware never loaded */
5752         if (wl->current_dev == wldev && wl->hw_registered) {
5753                 b43_leds_stop(wldev);
5754                 ieee80211_unregister_hw(wl->hw);
5755         }
5756 
5757         b43_one_core_detach(dev);
5758 
5759         /* Unregister HW RNG driver */
5760         b43_rng_exit(wl);
5761 
5762         b43_leds_unregister(wl);
5763         b43_wireless_exit(dev, wl);
5764         kfree(dev);
5765 }
5766 
5767 static struct ssb_driver b43_ssb_driver = {
5768         .name           = KBUILD_MODNAME,
5769         .id_table       = b43_ssb_tbl,
5770         .probe          = b43_ssb_probe,
5771         .remove         = b43_ssb_remove,
5772 };
5773 #endif /* CONFIG_B43_SSB */
5774 
5775 /* Perform a hardware reset. This can be called from any context. */
5776 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5777 {
5778         /* Must avoid requeueing, if we are in shutdown. */
5779         if (b43_status(dev) < B43_STAT_INITIALIZED)
5780                 return;
5781         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5782         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5783 }
5784 
5785 static void b43_print_driverinfo(void)
5786 {
5787         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5788                    *feat_leds = "", *feat_sdio = "";
5789 
5790 #ifdef CONFIG_B43_PCI_AUTOSELECT
5791         feat_pci = "P";
5792 #endif
5793 #ifdef CONFIG_B43_PCMCIA
5794         feat_pcmcia = "M";
5795 #endif
5796 #ifdef CONFIG_B43_PHY_N
5797         feat_nphy = "N";
5798 #endif
5799 #ifdef CONFIG_B43_LEDS
5800         feat_leds = "L";
5801 #endif
5802 #ifdef CONFIG_B43_SDIO
5803         feat_sdio = "S";
5804 #endif
5805         printk(KERN_INFO "Broadcom 43xx driver loaded "
5806                "[ Features: %s%s%s%s%s ]\n",
5807                feat_pci, feat_pcmcia, feat_nphy,
5808                feat_leds, feat_sdio);
5809 }
5810 
5811 static int __init b43_init(void)
5812 {
5813         int err;
5814 
5815         b43_debugfs_init();
5816         err = b43_sdio_init();
5817         if (err)
5818                 goto err_dfs_exit;
5819 #ifdef CONFIG_B43_BCMA
5820         err = bcma_driver_register(&b43_bcma_driver);
5821         if (err)
5822                 goto err_sdio_exit;
5823 #endif
5824 #ifdef CONFIG_B43_SSB
5825         err = ssb_driver_register(&b43_ssb_driver);
5826         if (err)
5827                 goto err_bcma_driver_exit;
5828 #endif
5829         b43_print_driverinfo();
5830 
5831         return err;
5832 
5833 #ifdef CONFIG_B43_SSB
5834 err_bcma_driver_exit:
5835 #endif
5836 #ifdef CONFIG_B43_BCMA
5837         bcma_driver_unregister(&b43_bcma_driver);
5838 err_sdio_exit:
5839 #endif
5840         b43_sdio_exit();
5841 err_dfs_exit:
5842         b43_debugfs_exit();
5843         return err;
5844 }
5845 
5846 static void __exit b43_exit(void)
5847 {
5848 #ifdef CONFIG_B43_SSB
5849         ssb_driver_unregister(&b43_ssb_driver);
5850 #endif
5851 #ifdef CONFIG_B43_BCMA
5852         bcma_driver_unregister(&b43_bcma_driver);
5853 #endif
5854         b43_sdio_exit();
5855         b43_debugfs_exit();
5856 }
5857 
5858 module_init(b43_init)
5859 module_exit(b43_exit)

/* [<][>][^][v][top][bottom][index][help] */