main.c revision 605a0bd66d9d55e9ba46da1a9e5140c68bdf6d85
1/*
2
3  Broadcom B43 wireless driver
4
5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11  Some parts of the code in this file are derived from the ipw2200
12  driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14  This program is free software; you can redistribute it and/or modify
15  it under the terms of the GNU General Public License as published by
16  the Free Software Foundation; either version 2 of the License, or
17  (at your option) any later version.
18
19  This program is distributed in the hope that it will be useful,
20  but WITHOUT ANY WARRANTY; without even the implied warranty of
21  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  GNU General Public License for more details.
23
24  You should have received a copy of the GNU General Public License
25  along with this program; see the file COPYING.  If not, write to
26  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27  Boston, MA 02110-1301, USA.
28
29*/
30
31#include <linux/delay.h>
32#include <linux/init.h>
33#include <linux/moduleparam.h>
34#include <linux/if_arp.h>
35#include <linux/etherdevice.h>
36#include <linux/version.h>
37#include <linux/firmware.h>
38#include <linux/wireless.h>
39#include <linux/workqueue.h>
40#include <linux/skbuff.h>
41#include <linux/io.h>
42#include <linux/dma-mapping.h>
43#include <asm/unaligned.h>
44
45#include "b43.h"
46#include "main.h"
47#include "debugfs.h"
48#include "phy.h"
49#include "nphy.h"
50#include "dma.h"
51#include "pio.h"
52#include "sysfs.h"
53#include "xmit.h"
54#include "lo.h"
55#include "pcmcia.h"
56
57MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58MODULE_AUTHOR("Martin Langer");
59MODULE_AUTHOR("Stefano Brivio");
60MODULE_AUTHOR("Michael Buesch");
61MODULE_LICENSE("GPL");
62
63MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66static int modparam_bad_frames_preempt;
67module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68MODULE_PARM_DESC(bad_frames_preempt,
69		 "enable(1) / disable(0) Bad Frames Preemption");
70
71static char modparam_fwpostfix[16];
72module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75static int modparam_hwpctl;
76module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79static int modparam_nohwcrypt;
80module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83int b43_modparam_qos = 1;
84module_param_named(qos, b43_modparam_qos, int, 0444);
85MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
86
87static int modparam_btcoex = 1;
88module_param_named(btcoex, modparam_btcoex, int, 0444);
89MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
90
91
92static const struct ssb_device_id b43_ssb_tbl[] = {
93	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
94	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
95	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
96	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
97	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
98	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
99	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
100	SSB_DEVTABLE_END
101};
102
103MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
104
105/* Channel and ratetables are shared for all devices.
106 * They can't be const, because ieee80211 puts some precalculated
107 * data in there. This data is the same for all devices, so we don't
108 * get concurrency issues */
109#define RATETAB_ENT(_rateid, _flags) \
110	{								\
111		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
112		.hw_value	= (_rateid),				\
113		.flags		= (_flags),				\
114	}
115
116/*
117 * NOTE: When changing this, sync with xmit.c's
118 *	 b43_plcp_get_bitrate_idx_* functions!
119 */
120static struct ieee80211_rate __b43_ratetable[] = {
121	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
122	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
123	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
124	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
125	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
126	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
127	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
128	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
129	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
130	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
131	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
132	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
133};
134
135#define b43_a_ratetable		(__b43_ratetable + 4)
136#define b43_a_ratetable_size	8
137#define b43_b_ratetable		(__b43_ratetable + 0)
138#define b43_b_ratetable_size	4
139#define b43_g_ratetable		(__b43_ratetable + 0)
140#define b43_g_ratetable_size	12
141
142#define CHAN4G(_channel, _freq, _flags) {			\
143	.band			= IEEE80211_BAND_2GHZ,		\
144	.center_freq		= (_freq),			\
145	.hw_value		= (_channel),			\
146	.flags			= (_flags),			\
147	.max_antenna_gain	= 0,				\
148	.max_power		= 30,				\
149}
150static struct ieee80211_channel b43_2ghz_chantable[] = {
151	CHAN4G(1, 2412, 0),
152	CHAN4G(2, 2417, 0),
153	CHAN4G(3, 2422, 0),
154	CHAN4G(4, 2427, 0),
155	CHAN4G(5, 2432, 0),
156	CHAN4G(6, 2437, 0),
157	CHAN4G(7, 2442, 0),
158	CHAN4G(8, 2447, 0),
159	CHAN4G(9, 2452, 0),
160	CHAN4G(10, 2457, 0),
161	CHAN4G(11, 2462, 0),
162	CHAN4G(12, 2467, 0),
163	CHAN4G(13, 2472, 0),
164	CHAN4G(14, 2484, 0),
165};
166#undef CHAN4G
167
168#define CHAN5G(_channel, _flags) {				\
169	.band			= IEEE80211_BAND_5GHZ,		\
170	.center_freq		= 5000 + (5 * (_channel)),	\
171	.hw_value		= (_channel),			\
172	.flags			= (_flags),			\
173	.max_antenna_gain	= 0,				\
174	.max_power		= 30,				\
175}
176static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
177	CHAN5G(32, 0),		CHAN5G(34, 0),
178	CHAN5G(36, 0),		CHAN5G(38, 0),
179	CHAN5G(40, 0),		CHAN5G(42, 0),
180	CHAN5G(44, 0),		CHAN5G(46, 0),
181	CHAN5G(48, 0),		CHAN5G(50, 0),
182	CHAN5G(52, 0),		CHAN5G(54, 0),
183	CHAN5G(56, 0),		CHAN5G(58, 0),
184	CHAN5G(60, 0),		CHAN5G(62, 0),
185	CHAN5G(64, 0),		CHAN5G(66, 0),
186	CHAN5G(68, 0),		CHAN5G(70, 0),
187	CHAN5G(72, 0),		CHAN5G(74, 0),
188	CHAN5G(76, 0),		CHAN5G(78, 0),
189	CHAN5G(80, 0),		CHAN5G(82, 0),
190	CHAN5G(84, 0),		CHAN5G(86, 0),
191	CHAN5G(88, 0),		CHAN5G(90, 0),
192	CHAN5G(92, 0),		CHAN5G(94, 0),
193	CHAN5G(96, 0),		CHAN5G(98, 0),
194	CHAN5G(100, 0),		CHAN5G(102, 0),
195	CHAN5G(104, 0),		CHAN5G(106, 0),
196	CHAN5G(108, 0),		CHAN5G(110, 0),
197	CHAN5G(112, 0),		CHAN5G(114, 0),
198	CHAN5G(116, 0),		CHAN5G(118, 0),
199	CHAN5G(120, 0),		CHAN5G(122, 0),
200	CHAN5G(124, 0),		CHAN5G(126, 0),
201	CHAN5G(128, 0),		CHAN5G(130, 0),
202	CHAN5G(132, 0),		CHAN5G(134, 0),
203	CHAN5G(136, 0),		CHAN5G(138, 0),
204	CHAN5G(140, 0),		CHAN5G(142, 0),
205	CHAN5G(144, 0),		CHAN5G(145, 0),
206	CHAN5G(146, 0),		CHAN5G(147, 0),
207	CHAN5G(148, 0),		CHAN5G(149, 0),
208	CHAN5G(150, 0),		CHAN5G(151, 0),
209	CHAN5G(152, 0),		CHAN5G(153, 0),
210	CHAN5G(154, 0),		CHAN5G(155, 0),
211	CHAN5G(156, 0),		CHAN5G(157, 0),
212	CHAN5G(158, 0),		CHAN5G(159, 0),
213	CHAN5G(160, 0),		CHAN5G(161, 0),
214	CHAN5G(162, 0),		CHAN5G(163, 0),
215	CHAN5G(164, 0),		CHAN5G(165, 0),
216	CHAN5G(166, 0),		CHAN5G(168, 0),
217	CHAN5G(170, 0),		CHAN5G(172, 0),
218	CHAN5G(174, 0),		CHAN5G(176, 0),
219	CHAN5G(178, 0),		CHAN5G(180, 0),
220	CHAN5G(182, 0),		CHAN5G(184, 0),
221	CHAN5G(186, 0),		CHAN5G(188, 0),
222	CHAN5G(190, 0),		CHAN5G(192, 0),
223	CHAN5G(194, 0),		CHAN5G(196, 0),
224	CHAN5G(198, 0),		CHAN5G(200, 0),
225	CHAN5G(202, 0),		CHAN5G(204, 0),
226	CHAN5G(206, 0),		CHAN5G(208, 0),
227	CHAN5G(210, 0),		CHAN5G(212, 0),
228	CHAN5G(214, 0),		CHAN5G(216, 0),
229	CHAN5G(218, 0),		CHAN5G(220, 0),
230	CHAN5G(222, 0),		CHAN5G(224, 0),
231	CHAN5G(226, 0),		CHAN5G(228, 0),
232};
233
234static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
235	CHAN5G(34, 0),		CHAN5G(36, 0),
236	CHAN5G(38, 0),		CHAN5G(40, 0),
237	CHAN5G(42, 0),		CHAN5G(44, 0),
238	CHAN5G(46, 0),		CHAN5G(48, 0),
239	CHAN5G(52, 0),		CHAN5G(56, 0),
240	CHAN5G(60, 0),		CHAN5G(64, 0),
241	CHAN5G(100, 0),		CHAN5G(104, 0),
242	CHAN5G(108, 0),		CHAN5G(112, 0),
243	CHAN5G(116, 0),		CHAN5G(120, 0),
244	CHAN5G(124, 0),		CHAN5G(128, 0),
245	CHAN5G(132, 0),		CHAN5G(136, 0),
246	CHAN5G(140, 0),		CHAN5G(149, 0),
247	CHAN5G(153, 0),		CHAN5G(157, 0),
248	CHAN5G(161, 0),		CHAN5G(165, 0),
249	CHAN5G(184, 0),		CHAN5G(188, 0),
250	CHAN5G(192, 0),		CHAN5G(196, 0),
251	CHAN5G(200, 0),		CHAN5G(204, 0),
252	CHAN5G(208, 0),		CHAN5G(212, 0),
253	CHAN5G(216, 0),
254};
255#undef CHAN5G
256
257static struct ieee80211_supported_band b43_band_5GHz_nphy = {
258	.band		= IEEE80211_BAND_5GHZ,
259	.channels	= b43_5ghz_nphy_chantable,
260	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
261	.bitrates	= b43_a_ratetable,
262	.n_bitrates	= b43_a_ratetable_size,
263};
264
265static struct ieee80211_supported_band b43_band_5GHz_aphy = {
266	.band		= IEEE80211_BAND_5GHZ,
267	.channels	= b43_5ghz_aphy_chantable,
268	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
269	.bitrates	= b43_a_ratetable,
270	.n_bitrates	= b43_a_ratetable_size,
271};
272
273static struct ieee80211_supported_band b43_band_2GHz = {
274	.band		= IEEE80211_BAND_2GHZ,
275	.channels	= b43_2ghz_chantable,
276	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
277	.bitrates	= b43_g_ratetable,
278	.n_bitrates	= b43_g_ratetable_size,
279};
280
281static void b43_wireless_core_exit(struct b43_wldev *dev);
282static int b43_wireless_core_init(struct b43_wldev *dev);
283static void b43_wireless_core_stop(struct b43_wldev *dev);
284static int b43_wireless_core_start(struct b43_wldev *dev);
285
286static int b43_ratelimit(struct b43_wl *wl)
287{
288	if (!wl || !wl->current_dev)
289		return 1;
290	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
291		return 1;
292	/* We are up and running.
293	 * Ratelimit the messages to avoid DoS over the net. */
294	return net_ratelimit();
295}
296
297void b43info(struct b43_wl *wl, const char *fmt, ...)
298{
299	va_list args;
300
301	if (!b43_ratelimit(wl))
302		return;
303	va_start(args, fmt);
304	printk(KERN_INFO "b43-%s: ",
305	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
306	vprintk(fmt, args);
307	va_end(args);
308}
309
310void b43err(struct b43_wl *wl, const char *fmt, ...)
311{
312	va_list args;
313
314	if (!b43_ratelimit(wl))
315		return;
316	va_start(args, fmt);
317	printk(KERN_ERR "b43-%s ERROR: ",
318	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
319	vprintk(fmt, args);
320	va_end(args);
321}
322
323void b43warn(struct b43_wl *wl, const char *fmt, ...)
324{
325	va_list args;
326
327	if (!b43_ratelimit(wl))
328		return;
329	va_start(args, fmt);
330	printk(KERN_WARNING "b43-%s warning: ",
331	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
332	vprintk(fmt, args);
333	va_end(args);
334}
335
336#if B43_DEBUG
337void b43dbg(struct b43_wl *wl, const char *fmt, ...)
338{
339	va_list args;
340
341	va_start(args, fmt);
342	printk(KERN_DEBUG "b43-%s debug: ",
343	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
344	vprintk(fmt, args);
345	va_end(args);
346}
347#endif /* DEBUG */
348
349static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
350{
351	u32 macctl;
352
353	B43_WARN_ON(offset % 4 != 0);
354
355	macctl = b43_read32(dev, B43_MMIO_MACCTL);
356	if (macctl & B43_MACCTL_BE)
357		val = swab32(val);
358
359	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
360	mmiowb();
361	b43_write32(dev, B43_MMIO_RAM_DATA, val);
362}
363
364static inline void b43_shm_control_word(struct b43_wldev *dev,
365					u16 routing, u16 offset)
366{
367	u32 control;
368
369	/* "offset" is the WORD offset. */
370	control = routing;
371	control <<= 16;
372	control |= offset;
373	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
374}
375
376u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
377{
378	u32 ret;
379
380	if (routing == B43_SHM_SHARED) {
381		B43_WARN_ON(offset & 0x0001);
382		if (offset & 0x0003) {
383			/* Unaligned access */
384			b43_shm_control_word(dev, routing, offset >> 2);
385			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
386			ret <<= 16;
387			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
388			ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
389
390			goto out;
391		}
392		offset >>= 2;
393	}
394	b43_shm_control_word(dev, routing, offset);
395	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
396out:
397	return ret;
398}
399
400u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
401{
402	struct b43_wl *wl = dev->wl;
403	unsigned long flags;
404	u32 ret;
405
406	spin_lock_irqsave(&wl->shm_lock, flags);
407	ret = __b43_shm_read32(dev, routing, offset);
408	spin_unlock_irqrestore(&wl->shm_lock, flags);
409
410	return ret;
411}
412
413u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
414{
415	u16 ret;
416
417	if (routing == B43_SHM_SHARED) {
418		B43_WARN_ON(offset & 0x0001);
419		if (offset & 0x0003) {
420			/* Unaligned access */
421			b43_shm_control_word(dev, routing, offset >> 2);
422			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
423
424			goto out;
425		}
426		offset >>= 2;
427	}
428	b43_shm_control_word(dev, routing, offset);
429	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
430out:
431	return ret;
432}
433
434u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
435{
436	struct b43_wl *wl = dev->wl;
437	unsigned long flags;
438	u16 ret;
439
440	spin_lock_irqsave(&wl->shm_lock, flags);
441	ret = __b43_shm_read16(dev, routing, offset);
442	spin_unlock_irqrestore(&wl->shm_lock, flags);
443
444	return ret;
445}
446
447void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
448{
449	if (routing == B43_SHM_SHARED) {
450		B43_WARN_ON(offset & 0x0001);
451		if (offset & 0x0003) {
452			/* Unaligned access */
453			b43_shm_control_word(dev, routing, offset >> 2);
454			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
455				    (value >> 16) & 0xffff);
456			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
457			b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
458			return;
459		}
460		offset >>= 2;
461	}
462	b43_shm_control_word(dev, routing, offset);
463	b43_write32(dev, B43_MMIO_SHM_DATA, value);
464}
465
466void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
467{
468	struct b43_wl *wl = dev->wl;
469	unsigned long flags;
470
471	spin_lock_irqsave(&wl->shm_lock, flags);
472	__b43_shm_write32(dev, routing, offset, value);
473	spin_unlock_irqrestore(&wl->shm_lock, flags);
474}
475
476void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
477{
478	if (routing == B43_SHM_SHARED) {
479		B43_WARN_ON(offset & 0x0001);
480		if (offset & 0x0003) {
481			/* Unaligned access */
482			b43_shm_control_word(dev, routing, offset >> 2);
483			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
484			return;
485		}
486		offset >>= 2;
487	}
488	b43_shm_control_word(dev, routing, offset);
489	b43_write16(dev, B43_MMIO_SHM_DATA, value);
490}
491
492void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
493{
494	struct b43_wl *wl = dev->wl;
495	unsigned long flags;
496
497	spin_lock_irqsave(&wl->shm_lock, flags);
498	__b43_shm_write16(dev, routing, offset, value);
499	spin_unlock_irqrestore(&wl->shm_lock, flags);
500}
501
502/* Read HostFlags */
503u64 b43_hf_read(struct b43_wldev * dev)
504{
505	u64 ret;
506
507	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
508	ret <<= 16;
509	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
510	ret <<= 16;
511	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
512
513	return ret;
514}
515
516/* Write HostFlags */
517void b43_hf_write(struct b43_wldev *dev, u64 value)
518{
519	u16 lo, mi, hi;
520
521	lo = (value & 0x00000000FFFFULL);
522	mi = (value & 0x0000FFFF0000ULL) >> 16;
523	hi = (value & 0xFFFF00000000ULL) >> 32;
524	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
525	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
526	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
527}
528
529void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
530{
531	/* We need to be careful. As we read the TSF from multiple
532	 * registers, we should take care of register overflows.
533	 * In theory, the whole tsf read process should be atomic.
534	 * We try to be atomic here, by restaring the read process,
535	 * if any of the high registers changed (overflew).
536	 */
537	if (dev->dev->id.revision >= 3) {
538		u32 low, high, high2;
539
540		do {
541			high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
542			low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
543			high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
544		} while (unlikely(high != high2));
545
546		*tsf = high;
547		*tsf <<= 32;
548		*tsf |= low;
549	} else {
550		u64 tmp;
551		u16 v0, v1, v2, v3;
552		u16 test1, test2, test3;
553
554		do {
555			v3 = b43_read16(dev, B43_MMIO_TSF_3);
556			v2 = b43_read16(dev, B43_MMIO_TSF_2);
557			v1 = b43_read16(dev, B43_MMIO_TSF_1);
558			v0 = b43_read16(dev, B43_MMIO_TSF_0);
559
560			test3 = b43_read16(dev, B43_MMIO_TSF_3);
561			test2 = b43_read16(dev, B43_MMIO_TSF_2);
562			test1 = b43_read16(dev, B43_MMIO_TSF_1);
563		} while (v3 != test3 || v2 != test2 || v1 != test1);
564
565		*tsf = v3;
566		*tsf <<= 48;
567		tmp = v2;
568		tmp <<= 32;
569		*tsf |= tmp;
570		tmp = v1;
571		tmp <<= 16;
572		*tsf |= tmp;
573		*tsf |= v0;
574	}
575}
576
577static void b43_time_lock(struct b43_wldev *dev)
578{
579	u32 macctl;
580
581	macctl = b43_read32(dev, B43_MMIO_MACCTL);
582	macctl |= B43_MACCTL_TBTTHOLD;
583	b43_write32(dev, B43_MMIO_MACCTL, macctl);
584	/* Commit the write */
585	b43_read32(dev, B43_MMIO_MACCTL);
586}
587
588static void b43_time_unlock(struct b43_wldev *dev)
589{
590	u32 macctl;
591
592	macctl = b43_read32(dev, B43_MMIO_MACCTL);
593	macctl &= ~B43_MACCTL_TBTTHOLD;
594	b43_write32(dev, B43_MMIO_MACCTL, macctl);
595	/* Commit the write */
596	b43_read32(dev, B43_MMIO_MACCTL);
597}
598
599static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
600{
601	/* Be careful with the in-progress timer.
602	 * First zero out the low register, so we have a full
603	 * register-overflow duration to complete the operation.
604	 */
605	if (dev->dev->id.revision >= 3) {
606		u32 lo = (tsf & 0x00000000FFFFFFFFULL);
607		u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
608
609		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
610		mmiowb();
611		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
612		mmiowb();
613		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
614	} else {
615		u16 v0 = (tsf & 0x000000000000FFFFULL);
616		u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
617		u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
618		u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
619
620		b43_write16(dev, B43_MMIO_TSF_0, 0);
621		mmiowb();
622		b43_write16(dev, B43_MMIO_TSF_3, v3);
623		mmiowb();
624		b43_write16(dev, B43_MMIO_TSF_2, v2);
625		mmiowb();
626		b43_write16(dev, B43_MMIO_TSF_1, v1);
627		mmiowb();
628		b43_write16(dev, B43_MMIO_TSF_0, v0);
629	}
630}
631
632void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
633{
634	b43_time_lock(dev);
635	b43_tsf_write_locked(dev, tsf);
636	b43_time_unlock(dev);
637}
638
639static
640void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
641{
642	static const u8 zero_addr[ETH_ALEN] = { 0 };
643	u16 data;
644
645	if (!mac)
646		mac = zero_addr;
647
648	offset |= 0x0020;
649	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
650
651	data = mac[0];
652	data |= mac[1] << 8;
653	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
654	data = mac[2];
655	data |= mac[3] << 8;
656	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
657	data = mac[4];
658	data |= mac[5] << 8;
659	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
660}
661
662static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
663{
664	const u8 *mac;
665	const u8 *bssid;
666	u8 mac_bssid[ETH_ALEN * 2];
667	int i;
668	u32 tmp;
669
670	bssid = dev->wl->bssid;
671	mac = dev->wl->mac_addr;
672
673	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
674
675	memcpy(mac_bssid, mac, ETH_ALEN);
676	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
677
678	/* Write our MAC address and BSSID to template ram */
679	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
680		tmp = (u32) (mac_bssid[i + 0]);
681		tmp |= (u32) (mac_bssid[i + 1]) << 8;
682		tmp |= (u32) (mac_bssid[i + 2]) << 16;
683		tmp |= (u32) (mac_bssid[i + 3]) << 24;
684		b43_ram_write(dev, 0x20 + i, tmp);
685	}
686}
687
688static void b43_upload_card_macaddress(struct b43_wldev *dev)
689{
690	b43_write_mac_bssid_templates(dev);
691	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
692}
693
694static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
695{
696	/* slot_time is in usec. */
697	if (dev->phy.type != B43_PHYTYPE_G)
698		return;
699	b43_write16(dev, 0x684, 510 + slot_time);
700	b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
701}
702
703static void b43_short_slot_timing_enable(struct b43_wldev *dev)
704{
705	b43_set_slot_time(dev, 9);
706	dev->short_slot = 1;
707}
708
709static void b43_short_slot_timing_disable(struct b43_wldev *dev)
710{
711	b43_set_slot_time(dev, 20);
712	dev->short_slot = 0;
713}
714
715/* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
716 * Returns the _previously_ enabled IRQ mask.
717 */
718static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
719{
720	u32 old_mask;
721
722	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
723	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
724
725	return old_mask;
726}
727
728/* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
729 * Returns the _previously_ enabled IRQ mask.
730 */
731static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
732{
733	u32 old_mask;
734
735	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
736	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
737
738	return old_mask;
739}
740
741/* Synchronize IRQ top- and bottom-half.
742 * IRQs must be masked before calling this.
743 * This must not be called with the irq_lock held.
744 */
745static void b43_synchronize_irq(struct b43_wldev *dev)
746{
747	synchronize_irq(dev->dev->irq);
748	tasklet_kill(&dev->isr_tasklet);
749}
750
751/* DummyTransmission function, as documented on
752 * http://bcm-specs.sipsolutions.net/DummyTransmission
753 */
754void b43_dummy_transmission(struct b43_wldev *dev)
755{
756	struct b43_wl *wl = dev->wl;
757	struct b43_phy *phy = &dev->phy;
758	unsigned int i, max_loop;
759	u16 value;
760	u32 buffer[5] = {
761		0x00000000,
762		0x00D40000,
763		0x00000000,
764		0x01000000,
765		0x00000000,
766	};
767
768	switch (phy->type) {
769	case B43_PHYTYPE_A:
770		max_loop = 0x1E;
771		buffer[0] = 0x000201CC;
772		break;
773	case B43_PHYTYPE_B:
774	case B43_PHYTYPE_G:
775		max_loop = 0xFA;
776		buffer[0] = 0x000B846E;
777		break;
778	default:
779		B43_WARN_ON(1);
780		return;
781	}
782
783	spin_lock_irq(&wl->irq_lock);
784	write_lock(&wl->tx_lock);
785
786	for (i = 0; i < 5; i++)
787		b43_ram_write(dev, i * 4, buffer[i]);
788
789	/* Commit writes */
790	b43_read32(dev, B43_MMIO_MACCTL);
791
792	b43_write16(dev, 0x0568, 0x0000);
793	b43_write16(dev, 0x07C0, 0x0000);
794	value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
795	b43_write16(dev, 0x050C, value);
796	b43_write16(dev, 0x0508, 0x0000);
797	b43_write16(dev, 0x050A, 0x0000);
798	b43_write16(dev, 0x054C, 0x0000);
799	b43_write16(dev, 0x056A, 0x0014);
800	b43_write16(dev, 0x0568, 0x0826);
801	b43_write16(dev, 0x0500, 0x0000);
802	b43_write16(dev, 0x0502, 0x0030);
803
804	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
805		b43_radio_write16(dev, 0x0051, 0x0017);
806	for (i = 0x00; i < max_loop; i++) {
807		value = b43_read16(dev, 0x050E);
808		if (value & 0x0080)
809			break;
810		udelay(10);
811	}
812	for (i = 0x00; i < 0x0A; i++) {
813		value = b43_read16(dev, 0x050E);
814		if (value & 0x0400)
815			break;
816		udelay(10);
817	}
818	for (i = 0x00; i < 0x0A; i++) {
819		value = b43_read16(dev, 0x0690);
820		if (!(value & 0x0100))
821			break;
822		udelay(10);
823	}
824	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
825		b43_radio_write16(dev, 0x0051, 0x0037);
826
827	write_unlock(&wl->tx_lock);
828	spin_unlock_irq(&wl->irq_lock);
829}
830
831static void key_write(struct b43_wldev *dev,
832		      u8 index, u8 algorithm, const u8 * key)
833{
834	unsigned int i;
835	u32 offset;
836	u16 value;
837	u16 kidx;
838
839	/* Key index/algo block */
840	kidx = b43_kidx_to_fw(dev, index);
841	value = ((kidx << 4) | algorithm);
842	b43_shm_write16(dev, B43_SHM_SHARED,
843			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
844
845	/* Write the key to the Key Table Pointer offset */
846	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
847	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
848		value = key[i];
849		value |= (u16) (key[i + 1]) << 8;
850		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
851	}
852}
853
854static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
855{
856	u32 addrtmp[2] = { 0, 0, };
857	u8 per_sta_keys_start = 8;
858
859	if (b43_new_kidx_api(dev))
860		per_sta_keys_start = 4;
861
862	B43_WARN_ON(index < per_sta_keys_start);
863	/* We have two default TX keys and possibly two default RX keys.
864	 * Physical mac 0 is mapped to physical key 4 or 8, depending
865	 * on the firmware version.
866	 * So we must adjust the index here.
867	 */
868	index -= per_sta_keys_start;
869
870	if (addr) {
871		addrtmp[0] = addr[0];
872		addrtmp[0] |= ((u32) (addr[1]) << 8);
873		addrtmp[0] |= ((u32) (addr[2]) << 16);
874		addrtmp[0] |= ((u32) (addr[3]) << 24);
875		addrtmp[1] = addr[4];
876		addrtmp[1] |= ((u32) (addr[5]) << 8);
877	}
878
879	if (dev->dev->id.revision >= 5) {
880		/* Receive match transmitter address mechanism */
881		b43_shm_write32(dev, B43_SHM_RCMTA,
882				(index * 2) + 0, addrtmp[0]);
883		b43_shm_write16(dev, B43_SHM_RCMTA,
884				(index * 2) + 1, addrtmp[1]);
885	} else {
886		/* RXE (Receive Engine) and
887		 * PSM (Programmable State Machine) mechanism
888		 */
889		if (index < 8) {
890			/* TODO write to RCM 16, 19, 22 and 25 */
891		} else {
892			b43_shm_write32(dev, B43_SHM_SHARED,
893					B43_SHM_SH_PSM + (index * 6) + 0,
894					addrtmp[0]);
895			b43_shm_write16(dev, B43_SHM_SHARED,
896					B43_SHM_SH_PSM + (index * 6) + 4,
897					addrtmp[1]);
898		}
899	}
900}
901
902static void do_key_write(struct b43_wldev *dev,
903			 u8 index, u8 algorithm,
904			 const u8 * key, size_t key_len, const u8 * mac_addr)
905{
906	u8 buf[B43_SEC_KEYSIZE] = { 0, };
907	u8 per_sta_keys_start = 8;
908
909	if (b43_new_kidx_api(dev))
910		per_sta_keys_start = 4;
911
912	B43_WARN_ON(index >= dev->max_nr_keys);
913	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
914
915	if (index >= per_sta_keys_start)
916		keymac_write(dev, index, NULL);	/* First zero out mac. */
917	if (key)
918		memcpy(buf, key, key_len);
919	key_write(dev, index, algorithm, buf);
920	if (index >= per_sta_keys_start)
921		keymac_write(dev, index, mac_addr);
922
923	dev->key[index].algorithm = algorithm;
924}
925
926static int b43_key_write(struct b43_wldev *dev,
927			 int index, u8 algorithm,
928			 const u8 * key, size_t key_len,
929			 const u8 * mac_addr,
930			 struct ieee80211_key_conf *keyconf)
931{
932	int i;
933	int sta_keys_start;
934
935	if (key_len > B43_SEC_KEYSIZE)
936		return -EINVAL;
937	for (i = 0; i < dev->max_nr_keys; i++) {
938		/* Check that we don't already have this key. */
939		B43_WARN_ON(dev->key[i].keyconf == keyconf);
940	}
941	if (index < 0) {
942		/* Either pairwise key or address is 00:00:00:00:00:00
943		 * for transmit-only keys. Search the index. */
944		if (b43_new_kidx_api(dev))
945			sta_keys_start = 4;
946		else
947			sta_keys_start = 8;
948		for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
949			if (!dev->key[i].keyconf) {
950				/* found empty */
951				index = i;
952				break;
953			}
954		}
955		if (index < 0) {
956			b43err(dev->wl, "Out of hardware key memory\n");
957			return -ENOSPC;
958		}
959	} else
960		B43_WARN_ON(index > 3);
961
962	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
963	if ((index <= 3) && !b43_new_kidx_api(dev)) {
964		/* Default RX key */
965		B43_WARN_ON(mac_addr);
966		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
967	}
968	keyconf->hw_key_idx = index;
969	dev->key[index].keyconf = keyconf;
970
971	return 0;
972}
973
974static int b43_key_clear(struct b43_wldev *dev, int index)
975{
976	if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
977		return -EINVAL;
978	do_key_write(dev, index, B43_SEC_ALGO_NONE,
979		     NULL, B43_SEC_KEYSIZE, NULL);
980	if ((index <= 3) && !b43_new_kidx_api(dev)) {
981		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
982			     NULL, B43_SEC_KEYSIZE, NULL);
983	}
984	dev->key[index].keyconf = NULL;
985
986	return 0;
987}
988
989static void b43_clear_keys(struct b43_wldev *dev)
990{
991	int i;
992
993	for (i = 0; i < dev->max_nr_keys; i++)
994		b43_key_clear(dev, i);
995}
996
997void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
998{
999	u32 macctl;
1000	u16 ucstat;
1001	bool hwps;
1002	bool awake;
1003	int i;
1004
1005	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1006		    (ps_flags & B43_PS_DISABLED));
1007	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1008
1009	if (ps_flags & B43_PS_ENABLED) {
1010		hwps = 1;
1011	} else if (ps_flags & B43_PS_DISABLED) {
1012		hwps = 0;
1013	} else {
1014		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1015		//      and thus is not an AP and we are associated, set bit 25
1016	}
1017	if (ps_flags & B43_PS_AWAKE) {
1018		awake = 1;
1019	} else if (ps_flags & B43_PS_ASLEEP) {
1020		awake = 0;
1021	} else {
1022		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1023		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1024		//      successful, set bit26
1025	}
1026
1027/* FIXME: For now we force awake-on and hwps-off */
1028	hwps = 0;
1029	awake = 1;
1030
1031	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1032	if (hwps)
1033		macctl |= B43_MACCTL_HWPS;
1034	else
1035		macctl &= ~B43_MACCTL_HWPS;
1036	if (awake)
1037		macctl |= B43_MACCTL_AWAKE;
1038	else
1039		macctl &= ~B43_MACCTL_AWAKE;
1040	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1041	/* Commit write */
1042	b43_read32(dev, B43_MMIO_MACCTL);
1043	if (awake && dev->dev->id.revision >= 5) {
1044		/* Wait for the microcode to wake up. */
1045		for (i = 0; i < 100; i++) {
1046			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1047						B43_SHM_SH_UCODESTAT);
1048			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1049				break;
1050			udelay(10);
1051		}
1052	}
1053}
1054
1055/* Turn the Analog ON/OFF */
1056static void b43_switch_analog(struct b43_wldev *dev, int on)
1057{
1058	switch (dev->phy.type) {
1059	case B43_PHYTYPE_A:
1060	case B43_PHYTYPE_G:
1061		b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
1062		break;
1063	case B43_PHYTYPE_N:
1064		b43_phy_write(dev, B43_NPHY_AFECTL_OVER,
1065			      on ? 0 : 0x7FFF);
1066		break;
1067	default:
1068		B43_WARN_ON(1);
1069	}
1070}
1071
1072void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1073{
1074	u32 tmslow;
1075	u32 macctl;
1076
1077	flags |= B43_TMSLOW_PHYCLKEN;
1078	flags |= B43_TMSLOW_PHYRESET;
1079	ssb_device_enable(dev->dev, flags);
1080	msleep(2);		/* Wait for the PLL to turn on. */
1081
1082	/* Now take the PHY out of Reset again */
1083	tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1084	tmslow |= SSB_TMSLOW_FGC;
1085	tmslow &= ~B43_TMSLOW_PHYRESET;
1086	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1087	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1088	msleep(1);
1089	tmslow &= ~SSB_TMSLOW_FGC;
1090	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1091	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1092	msleep(1);
1093
1094	/* Turn Analog ON */
1095	b43_switch_analog(dev, 1);
1096
1097	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1098	macctl &= ~B43_MACCTL_GMODE;
1099	if (flags & B43_TMSLOW_GMODE)
1100		macctl |= B43_MACCTL_GMODE;
1101	macctl |= B43_MACCTL_IHR_ENABLED;
1102	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1103}
1104
1105static void handle_irq_transmit_status(struct b43_wldev *dev)
1106{
1107	u32 v0, v1;
1108	u16 tmp;
1109	struct b43_txstatus stat;
1110
1111	while (1) {
1112		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1113		if (!(v0 & 0x00000001))
1114			break;
1115		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1116
1117		stat.cookie = (v0 >> 16);
1118		stat.seq = (v1 & 0x0000FFFF);
1119		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1120		tmp = (v0 & 0x0000FFFF);
1121		stat.frame_count = ((tmp & 0xF000) >> 12);
1122		stat.rts_count = ((tmp & 0x0F00) >> 8);
1123		stat.supp_reason = ((tmp & 0x001C) >> 2);
1124		stat.pm_indicated = !!(tmp & 0x0080);
1125		stat.intermediate = !!(tmp & 0x0040);
1126		stat.for_ampdu = !!(tmp & 0x0020);
1127		stat.acked = !!(tmp & 0x0002);
1128
1129		b43_handle_txstatus(dev, &stat);
1130	}
1131}
1132
1133static void drain_txstatus_queue(struct b43_wldev *dev)
1134{
1135	u32 dummy;
1136
1137	if (dev->dev->id.revision < 5)
1138		return;
1139	/* Read all entries from the microcode TXstatus FIFO
1140	 * and throw them away.
1141	 */
1142	while (1) {
1143		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1144		if (!(dummy & 0x00000001))
1145			break;
1146		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1147	}
1148}
1149
1150static u32 b43_jssi_read(struct b43_wldev *dev)
1151{
1152	u32 val = 0;
1153
1154	val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1155	val <<= 16;
1156	val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1157
1158	return val;
1159}
1160
1161static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1162{
1163	b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1164	b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1165}
1166
1167static void b43_generate_noise_sample(struct b43_wldev *dev)
1168{
1169	b43_jssi_write(dev, 0x7F7F7F7F);
1170	b43_write32(dev, B43_MMIO_MACCMD,
1171		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1172}
1173
1174static void b43_calculate_link_quality(struct b43_wldev *dev)
1175{
1176	/* Top half of Link Quality calculation. */
1177
1178	if (dev->noisecalc.calculation_running)
1179		return;
1180	dev->noisecalc.calculation_running = 1;
1181	dev->noisecalc.nr_samples = 0;
1182
1183	b43_generate_noise_sample(dev);
1184}
1185
1186static void handle_irq_noise(struct b43_wldev *dev)
1187{
1188	struct b43_phy *phy = &dev->phy;
1189	u16 tmp;
1190	u8 noise[4];
1191	u8 i, j;
1192	s32 average;
1193
1194	/* Bottom half of Link Quality calculation. */
1195
1196	/* Possible race condition: It might be possible that the user
1197	 * changed to a different channel in the meantime since we
1198	 * started the calculation. We ignore that fact, since it's
1199	 * not really that much of a problem. The background noise is
1200	 * an estimation only anyway. Slightly wrong results will get damped
1201	 * by the averaging of the 8 sample rounds. Additionally the
1202	 * value is shortlived. So it will be replaced by the next noise
1203	 * calculation round soon. */
1204
1205	B43_WARN_ON(!dev->noisecalc.calculation_running);
1206	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1207	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1208	    noise[2] == 0x7F || noise[3] == 0x7F)
1209		goto generate_new;
1210
1211	/* Get the noise samples. */
1212	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1213	i = dev->noisecalc.nr_samples;
1214	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1215	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1216	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1217	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1218	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1219	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1220	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1221	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1222	dev->noisecalc.nr_samples++;
1223	if (dev->noisecalc.nr_samples == 8) {
1224		/* Calculate the Link Quality by the noise samples. */
1225		average = 0;
1226		for (i = 0; i < 8; i++) {
1227			for (j = 0; j < 4; j++)
1228				average += dev->noisecalc.samples[i][j];
1229		}
1230		average /= (8 * 4);
1231		average *= 125;
1232		average += 64;
1233		average /= 128;
1234		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1235		tmp = (tmp / 128) & 0x1F;
1236		if (tmp >= 8)
1237			average += 2;
1238		else
1239			average -= 25;
1240		if (tmp == 8)
1241			average -= 72;
1242		else
1243			average -= 48;
1244
1245		dev->stats.link_noise = average;
1246		dev->noisecalc.calculation_running = 0;
1247		return;
1248	}
1249generate_new:
1250	b43_generate_noise_sample(dev);
1251}
1252
1253static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1254{
1255	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP)) {
1256		///TODO: PS TBTT
1257	} else {
1258		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1259			b43_power_saving_ctl_bits(dev, 0);
1260	}
1261	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
1262		dev->dfq_valid = 1;
1263}
1264
1265static void handle_irq_atim_end(struct b43_wldev *dev)
1266{
1267	if (dev->dfq_valid) {
1268		b43_write32(dev, B43_MMIO_MACCMD,
1269			    b43_read32(dev, B43_MMIO_MACCMD)
1270			    | B43_MACCMD_DFQ_VALID);
1271		dev->dfq_valid = 0;
1272	}
1273}
1274
1275static void handle_irq_pmq(struct b43_wldev *dev)
1276{
1277	u32 tmp;
1278
1279	//TODO: AP mode.
1280
1281	while (1) {
1282		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1283		if (!(tmp & 0x00000008))
1284			break;
1285	}
1286	/* 16bit write is odd, but correct. */
1287	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1288}
1289
1290static void b43_write_template_common(struct b43_wldev *dev,
1291				      const u8 * data, u16 size,
1292				      u16 ram_offset,
1293				      u16 shm_size_offset, u8 rate)
1294{
1295	u32 i, tmp;
1296	struct b43_plcp_hdr4 plcp;
1297
1298	plcp.data = 0;
1299	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1300	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1301	ram_offset += sizeof(u32);
1302	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1303	 * So leave the first two bytes of the next write blank.
1304	 */
1305	tmp = (u32) (data[0]) << 16;
1306	tmp |= (u32) (data[1]) << 24;
1307	b43_ram_write(dev, ram_offset, tmp);
1308	ram_offset += sizeof(u32);
1309	for (i = 2; i < size; i += sizeof(u32)) {
1310		tmp = (u32) (data[i + 0]);
1311		if (i + 1 < size)
1312			tmp |= (u32) (data[i + 1]) << 8;
1313		if (i + 2 < size)
1314			tmp |= (u32) (data[i + 2]) << 16;
1315		if (i + 3 < size)
1316			tmp |= (u32) (data[i + 3]) << 24;
1317		b43_ram_write(dev, ram_offset + i - 2, tmp);
1318	}
1319	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1320			size + sizeof(struct b43_plcp_hdr6));
1321}
1322
1323/* Check if the use of the antenna that ieee80211 told us to
1324 * use is possible. This will fall back to DEFAULT.
1325 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1326u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1327				  u8 antenna_nr)
1328{
1329	u8 antenna_mask;
1330
1331	if (antenna_nr == 0) {
1332		/* Zero means "use default antenna". That's always OK. */
1333		return 0;
1334	}
1335
1336	/* Get the mask of available antennas. */
1337	if (dev->phy.gmode)
1338		antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1339	else
1340		antenna_mask = dev->dev->bus->sprom.ant_available_a;
1341
1342	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1343		/* This antenna is not available. Fall back to default. */
1344		return 0;
1345	}
1346
1347	return antenna_nr;
1348}
1349
1350static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
1351{
1352	antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
1353	switch (antenna) {
1354	case 0:		/* default/diversity */
1355		return B43_ANTENNA_DEFAULT;
1356	case 1:		/* Antenna 0 */
1357		return B43_ANTENNA0;
1358	case 2:		/* Antenna 1 */
1359		return B43_ANTENNA1;
1360	case 3:		/* Antenna 2 */
1361		return B43_ANTENNA2;
1362	case 4:		/* Antenna 3 */
1363		return B43_ANTENNA3;
1364	default:
1365		return B43_ANTENNA_DEFAULT;
1366	}
1367}
1368
1369/* Convert a b43 antenna number value to the PHY TX control value. */
1370static u16 b43_antenna_to_phyctl(int antenna)
1371{
1372	switch (antenna) {
1373	case B43_ANTENNA0:
1374		return B43_TXH_PHY_ANT0;
1375	case B43_ANTENNA1:
1376		return B43_TXH_PHY_ANT1;
1377	case B43_ANTENNA2:
1378		return B43_TXH_PHY_ANT2;
1379	case B43_ANTENNA3:
1380		return B43_TXH_PHY_ANT3;
1381	case B43_ANTENNA_AUTO:
1382		return B43_TXH_PHY_ANT01AUTO;
1383	}
1384	B43_WARN_ON(1);
1385	return 0;
1386}
1387
1388static void b43_write_beacon_template(struct b43_wldev *dev,
1389				      u16 ram_offset,
1390				      u16 shm_size_offset)
1391{
1392	unsigned int i, len, variable_len;
1393	const struct ieee80211_mgmt *bcn;
1394	const u8 *ie;
1395	bool tim_found = 0;
1396	unsigned int rate;
1397	u16 ctl;
1398	int antenna;
1399	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1400
1401	bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1402	len = min((size_t) dev->wl->current_beacon->len,
1403		  0x200 - sizeof(struct b43_plcp_hdr6));
1404	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1405
1406	b43_write_template_common(dev, (const u8 *)bcn,
1407				  len, ram_offset, shm_size_offset, rate);
1408
1409	/* Write the PHY TX control parameters. */
1410	antenna = b43_antenna_from_ieee80211(dev, info->antenna_sel_tx);
1411	antenna = b43_antenna_to_phyctl(antenna);
1412	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1413	/* We can't send beacons with short preamble. Would get PHY errors. */
1414	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1415	ctl &= ~B43_TXH_PHY_ANT;
1416	ctl &= ~B43_TXH_PHY_ENC;
1417	ctl |= antenna;
1418	if (b43_is_cck_rate(rate))
1419		ctl |= B43_TXH_PHY_ENC_CCK;
1420	else
1421		ctl |= B43_TXH_PHY_ENC_OFDM;
1422	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1423
1424	/* Find the position of the TIM and the DTIM_period value
1425	 * and write them to SHM. */
1426	ie = bcn->u.beacon.variable;
1427	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1428	for (i = 0; i < variable_len - 2; ) {
1429		uint8_t ie_id, ie_len;
1430
1431		ie_id = ie[i];
1432		ie_len = ie[i + 1];
1433		if (ie_id == 5) {
1434			u16 tim_position;
1435			u16 dtim_period;
1436			/* This is the TIM Information Element */
1437
1438			/* Check whether the ie_len is in the beacon data range. */
1439			if (variable_len < ie_len + 2 + i)
1440				break;
1441			/* A valid TIM is at least 4 bytes long. */
1442			if (ie_len < 4)
1443				break;
1444			tim_found = 1;
1445
1446			tim_position = sizeof(struct b43_plcp_hdr6);
1447			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1448			tim_position += i;
1449
1450			dtim_period = ie[i + 3];
1451
1452			b43_shm_write16(dev, B43_SHM_SHARED,
1453					B43_SHM_SH_TIMBPOS, tim_position);
1454			b43_shm_write16(dev, B43_SHM_SHARED,
1455					B43_SHM_SH_DTIMPER, dtim_period);
1456			break;
1457		}
1458		i += ie_len + 2;
1459	}
1460	if (!tim_found) {
1461		/*
1462		 * If ucode wants to modify TIM do it behind the beacon, this
1463		 * will happen, for example, when doing mesh networking.
1464		 */
1465		b43_shm_write16(dev, B43_SHM_SHARED,
1466				B43_SHM_SH_TIMBPOS,
1467				len + sizeof(struct b43_plcp_hdr6));
1468		b43_shm_write16(dev, B43_SHM_SHARED,
1469				B43_SHM_SH_DTIMPER, 0);
1470	}
1471	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1472}
1473
1474static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1475				      u16 shm_offset, u16 size,
1476				      struct ieee80211_rate *rate)
1477{
1478	struct b43_plcp_hdr4 plcp;
1479	u32 tmp;
1480	__le16 dur;
1481
1482	plcp.data = 0;
1483	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1484	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1485					       dev->wl->vif, size,
1486					       rate);
1487	/* Write PLCP in two parts and timing for packet transfer */
1488	tmp = le32_to_cpu(plcp.data);
1489	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1490	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1491	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1492}
1493
1494/* Instead of using custom probe response template, this function
1495 * just patches custom beacon template by:
1496 * 1) Changing packet type
1497 * 2) Patching duration field
1498 * 3) Stripping TIM
1499 */
1500static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1501					  u16 *dest_size,
1502					  struct ieee80211_rate *rate)
1503{
1504	const u8 *src_data;
1505	u8 *dest_data;
1506	u16 src_size, elem_size, src_pos, dest_pos;
1507	__le16 dur;
1508	struct ieee80211_hdr *hdr;
1509	size_t ie_start;
1510
1511	src_size = dev->wl->current_beacon->len;
1512	src_data = (const u8 *)dev->wl->current_beacon->data;
1513
1514	/* Get the start offset of the variable IEs in the packet. */
1515	ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1516	B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1517
1518	if (B43_WARN_ON(src_size < ie_start))
1519		return NULL;
1520
1521	dest_data = kmalloc(src_size, GFP_ATOMIC);
1522	if (unlikely(!dest_data))
1523		return NULL;
1524
1525	/* Copy the static data and all Information Elements, except the TIM. */
1526	memcpy(dest_data, src_data, ie_start);
1527	src_pos = ie_start;
1528	dest_pos = ie_start;
1529	for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1530		elem_size = src_data[src_pos + 1] + 2;
1531		if (src_data[src_pos] == 5) {
1532			/* This is the TIM. */
1533			continue;
1534		}
1535		memcpy(dest_data + dest_pos, src_data + src_pos,
1536		       elem_size);
1537		dest_pos += elem_size;
1538	}
1539	*dest_size = dest_pos;
1540	hdr = (struct ieee80211_hdr *)dest_data;
1541
1542	/* Set the frame control. */
1543	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1544					 IEEE80211_STYPE_PROBE_RESP);
1545	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1546					       dev->wl->vif, *dest_size,
1547					       rate);
1548	hdr->duration_id = dur;
1549
1550	return dest_data;
1551}
1552
1553static void b43_write_probe_resp_template(struct b43_wldev *dev,
1554					  u16 ram_offset,
1555					  u16 shm_size_offset,
1556					  struct ieee80211_rate *rate)
1557{
1558	const u8 *probe_resp_data;
1559	u16 size;
1560
1561	size = dev->wl->current_beacon->len;
1562	probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1563	if (unlikely(!probe_resp_data))
1564		return;
1565
1566	/* Looks like PLCP headers plus packet timings are stored for
1567	 * all possible basic rates
1568	 */
1569	b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1570	b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1571	b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1572	b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1573
1574	size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1575	b43_write_template_common(dev, probe_resp_data,
1576				  size, ram_offset, shm_size_offset,
1577				  rate->hw_value);
1578	kfree(probe_resp_data);
1579}
1580
1581static void b43_upload_beacon0(struct b43_wldev *dev)
1582{
1583	struct b43_wl *wl = dev->wl;
1584
1585	if (wl->beacon0_uploaded)
1586		return;
1587	b43_write_beacon_template(dev, 0x68, 0x18);
1588	/* FIXME: Probe resp upload doesn't really belong here,
1589	 *        but we don't use that feature anyway. */
1590	b43_write_probe_resp_template(dev, 0x268, 0x4A,
1591				      &__b43_ratetable[3]);
1592	wl->beacon0_uploaded = 1;
1593}
1594
1595static void b43_upload_beacon1(struct b43_wldev *dev)
1596{
1597	struct b43_wl *wl = dev->wl;
1598
1599	if (wl->beacon1_uploaded)
1600		return;
1601	b43_write_beacon_template(dev, 0x468, 0x1A);
1602	wl->beacon1_uploaded = 1;
1603}
1604
1605static void handle_irq_beacon(struct b43_wldev *dev)
1606{
1607	struct b43_wl *wl = dev->wl;
1608	u32 cmd, beacon0_valid, beacon1_valid;
1609
1610	if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP) &&
1611	    !b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
1612		return;
1613
1614	/* This is the bottom half of the asynchronous beacon update. */
1615
1616	/* Ignore interrupt in the future. */
1617	dev->irq_savedstate &= ~B43_IRQ_BEACON;
1618
1619	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1620	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1621	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1622
1623	/* Schedule interrupt manually, if busy. */
1624	if (beacon0_valid && beacon1_valid) {
1625		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1626		dev->irq_savedstate |= B43_IRQ_BEACON;
1627		return;
1628	}
1629
1630	if (unlikely(wl->beacon_templates_virgin)) {
1631		/* We never uploaded a beacon before.
1632		 * Upload both templates now, but only mark one valid. */
1633		wl->beacon_templates_virgin = 0;
1634		b43_upload_beacon0(dev);
1635		b43_upload_beacon1(dev);
1636		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1637		cmd |= B43_MACCMD_BEACON0_VALID;
1638		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1639	} else {
1640		if (!beacon0_valid) {
1641			b43_upload_beacon0(dev);
1642			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1643			cmd |= B43_MACCMD_BEACON0_VALID;
1644			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1645		} else if (!beacon1_valid) {
1646			b43_upload_beacon1(dev);
1647			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1648			cmd |= B43_MACCMD_BEACON1_VALID;
1649			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1650		}
1651	}
1652}
1653
1654static void b43_beacon_update_trigger_work(struct work_struct *work)
1655{
1656	struct b43_wl *wl = container_of(work, struct b43_wl,
1657					 beacon_update_trigger);
1658	struct b43_wldev *dev;
1659
1660	mutex_lock(&wl->mutex);
1661	dev = wl->current_dev;
1662	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1663		spin_lock_irq(&wl->irq_lock);
1664		/* update beacon right away or defer to irq */
1665		dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1666		handle_irq_beacon(dev);
1667		/* The handler might have updated the IRQ mask. */
1668		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1669			    dev->irq_savedstate);
1670		mmiowb();
1671		spin_unlock_irq(&wl->irq_lock);
1672	}
1673	mutex_unlock(&wl->mutex);
1674}
1675
1676/* Asynchronously update the packet templates in template RAM.
1677 * Locking: Requires wl->irq_lock to be locked. */
1678static void b43_update_templates(struct b43_wl *wl)
1679{
1680	struct sk_buff *beacon;
1681
1682	/* This is the top half of the ansynchronous beacon update.
1683	 * The bottom half is the beacon IRQ.
1684	 * Beacon update must be asynchronous to avoid sending an
1685	 * invalid beacon. This can happen for example, if the firmware
1686	 * transmits a beacon while we are updating it. */
1687
1688	/* We could modify the existing beacon and set the aid bit in
1689	 * the TIM field, but that would probably require resizing and
1690	 * moving of data within the beacon template.
1691	 * Simply request a new beacon and let mac80211 do the hard work. */
1692	beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1693	if (unlikely(!beacon))
1694		return;
1695
1696	if (wl->current_beacon)
1697		dev_kfree_skb_any(wl->current_beacon);
1698	wl->current_beacon = beacon;
1699	wl->beacon0_uploaded = 0;
1700	wl->beacon1_uploaded = 0;
1701	queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1702}
1703
1704static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
1705{
1706	u32 tmp;
1707	u16 i, len;
1708
1709	len = min((u16) ssid_len, (u16) 0x100);
1710	for (i = 0; i < len; i += sizeof(u32)) {
1711		tmp = (u32) (ssid[i + 0]);
1712		if (i + 1 < len)
1713			tmp |= (u32) (ssid[i + 1]) << 8;
1714		if (i + 2 < len)
1715			tmp |= (u32) (ssid[i + 2]) << 16;
1716		if (i + 3 < len)
1717			tmp |= (u32) (ssid[i + 3]) << 24;
1718		b43_shm_write32(dev, B43_SHM_SHARED, 0x380 + i, tmp);
1719	}
1720	b43_shm_write16(dev, B43_SHM_SHARED, 0x48, len);
1721}
1722
1723static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1724{
1725	b43_time_lock(dev);
1726	if (dev->dev->id.revision >= 3) {
1727		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1728		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1729	} else {
1730		b43_write16(dev, 0x606, (beacon_int >> 6));
1731		b43_write16(dev, 0x610, beacon_int);
1732	}
1733	b43_time_unlock(dev);
1734	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1735}
1736
1737static void b43_handle_firmware_panic(struct b43_wldev *dev)
1738{
1739	u16 reason;
1740
1741	/* Read the register that contains the reason code for the panic. */
1742	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1743	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1744
1745	switch (reason) {
1746	default:
1747		b43dbg(dev->wl, "The panic reason is unknown.\n");
1748		/* fallthrough */
1749	case B43_FWPANIC_DIE:
1750		/* Do not restart the controller or firmware.
1751		 * The device is nonfunctional from now on.
1752		 * Restarting would result in this panic to trigger again,
1753		 * so we avoid that recursion. */
1754		break;
1755	case B43_FWPANIC_RESTART:
1756		b43_controller_restart(dev, "Microcode panic");
1757		break;
1758	}
1759}
1760
1761static void handle_irq_ucode_debug(struct b43_wldev *dev)
1762{
1763	unsigned int i, cnt;
1764	u16 reason, marker_id, marker_line;
1765	__le16 *buf;
1766
1767	/* The proprietary firmware doesn't have this IRQ. */
1768	if (!dev->fw.opensource)
1769		return;
1770
1771	/* Read the register that contains the reason code for this IRQ. */
1772	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1773
1774	switch (reason) {
1775	case B43_DEBUGIRQ_PANIC:
1776		b43_handle_firmware_panic(dev);
1777		break;
1778	case B43_DEBUGIRQ_DUMP_SHM:
1779		if (!B43_DEBUG)
1780			break; /* Only with driver debugging enabled. */
1781		buf = kmalloc(4096, GFP_ATOMIC);
1782		if (!buf) {
1783			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1784			goto out;
1785		}
1786		for (i = 0; i < 4096; i += 2) {
1787			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1788			buf[i / 2] = cpu_to_le16(tmp);
1789		}
1790		b43info(dev->wl, "Shared memory dump:\n");
1791		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1792			       16, 2, buf, 4096, 1);
1793		kfree(buf);
1794		break;
1795	case B43_DEBUGIRQ_DUMP_REGS:
1796		if (!B43_DEBUG)
1797			break; /* Only with driver debugging enabled. */
1798		b43info(dev->wl, "Microcode register dump:\n");
1799		for (i = 0, cnt = 0; i < 64; i++) {
1800			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1801			if (cnt == 0)
1802				printk(KERN_INFO);
1803			printk("r%02u: 0x%04X  ", i, tmp);
1804			cnt++;
1805			if (cnt == 6) {
1806				printk("\n");
1807				cnt = 0;
1808			}
1809		}
1810		printk("\n");
1811		break;
1812	case B43_DEBUGIRQ_MARKER:
1813		if (!B43_DEBUG)
1814			break; /* Only with driver debugging enabled. */
1815		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1816					   B43_MARKER_ID_REG);
1817		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1818					     B43_MARKER_LINE_REG);
1819		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1820			"at line number %u\n",
1821			marker_id, marker_line);
1822		break;
1823	default:
1824		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1825		       reason);
1826	}
1827out:
1828	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1829	b43_shm_write16(dev, B43_SHM_SCRATCH,
1830			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1831}
1832
1833/* Interrupt handler bottom-half */
1834static void b43_interrupt_tasklet(struct b43_wldev *dev)
1835{
1836	u32 reason;
1837	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1838	u32 merged_dma_reason = 0;
1839	int i;
1840	unsigned long flags;
1841
1842	spin_lock_irqsave(&dev->wl->irq_lock, flags);
1843
1844	B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1845
1846	reason = dev->irq_reason;
1847	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1848		dma_reason[i] = dev->dma_reason[i];
1849		merged_dma_reason |= dma_reason[i];
1850	}
1851
1852	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1853		b43err(dev->wl, "MAC transmission error\n");
1854
1855	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1856		b43err(dev->wl, "PHY transmission error\n");
1857		rmb();
1858		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1859			atomic_set(&dev->phy.txerr_cnt,
1860				   B43_PHY_TX_BADNESS_LIMIT);
1861			b43err(dev->wl, "Too many PHY TX errors, "
1862					"restarting the controller\n");
1863			b43_controller_restart(dev, "PHY TX errors");
1864		}
1865	}
1866
1867	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1868					  B43_DMAIRQ_NONFATALMASK))) {
1869		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1870			b43err(dev->wl, "Fatal DMA error: "
1871			       "0x%08X, 0x%08X, 0x%08X, "
1872			       "0x%08X, 0x%08X, 0x%08X\n",
1873			       dma_reason[0], dma_reason[1],
1874			       dma_reason[2], dma_reason[3],
1875			       dma_reason[4], dma_reason[5]);
1876			b43_controller_restart(dev, "DMA error");
1877			mmiowb();
1878			spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1879			return;
1880		}
1881		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1882			b43err(dev->wl, "DMA error: "
1883			       "0x%08X, 0x%08X, 0x%08X, "
1884			       "0x%08X, 0x%08X, 0x%08X\n",
1885			       dma_reason[0], dma_reason[1],
1886			       dma_reason[2], dma_reason[3],
1887			       dma_reason[4], dma_reason[5]);
1888		}
1889	}
1890
1891	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1892		handle_irq_ucode_debug(dev);
1893	if (reason & B43_IRQ_TBTT_INDI)
1894		handle_irq_tbtt_indication(dev);
1895	if (reason & B43_IRQ_ATIM_END)
1896		handle_irq_atim_end(dev);
1897	if (reason & B43_IRQ_BEACON)
1898		handle_irq_beacon(dev);
1899	if (reason & B43_IRQ_PMQ)
1900		handle_irq_pmq(dev);
1901	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1902		;/* TODO */
1903	if (reason & B43_IRQ_NOISESAMPLE_OK)
1904		handle_irq_noise(dev);
1905
1906	/* Check the DMA reason registers for received data. */
1907	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1908		if (b43_using_pio_transfers(dev))
1909			b43_pio_rx(dev->pio.rx_queue);
1910		else
1911			b43_dma_rx(dev->dma.rx_ring);
1912	}
1913	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1914	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1915	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1916	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1917	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1918
1919	if (reason & B43_IRQ_TX_OK)
1920		handle_irq_transmit_status(dev);
1921
1922	b43_interrupt_enable(dev, dev->irq_savedstate);
1923	mmiowb();
1924	spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1925}
1926
1927static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1928{
1929	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1930
1931	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1932	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1933	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1934	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1935	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1936	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1937}
1938
1939/* Interrupt handler top-half */
1940static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1941{
1942	irqreturn_t ret = IRQ_NONE;
1943	struct b43_wldev *dev = dev_id;
1944	u32 reason;
1945
1946	if (!dev)
1947		return IRQ_NONE;
1948
1949	spin_lock(&dev->wl->irq_lock);
1950
1951	if (b43_status(dev) < B43_STAT_STARTED)
1952		goto out;
1953	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1954	if (reason == 0xffffffff)	/* shared IRQ */
1955		goto out;
1956	ret = IRQ_HANDLED;
1957	reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1958	if (!reason)
1959		goto out;
1960
1961	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1962	    & 0x0001DC00;
1963	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1964	    & 0x0000DC00;
1965	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1966	    & 0x0000DC00;
1967	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1968	    & 0x0001DC00;
1969	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1970	    & 0x0000DC00;
1971	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1972	    & 0x0000DC00;
1973
1974	b43_interrupt_ack(dev, reason);
1975	/* disable all IRQs. They are enabled again in the bottom half. */
1976	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1977	/* save the reason code and call our bottom half. */
1978	dev->irq_reason = reason;
1979	tasklet_schedule(&dev->isr_tasklet);
1980      out:
1981	mmiowb();
1982	spin_unlock(&dev->wl->irq_lock);
1983
1984	return ret;
1985}
1986
1987static void do_release_fw(struct b43_firmware_file *fw)
1988{
1989	release_firmware(fw->data);
1990	fw->data = NULL;
1991	fw->filename = NULL;
1992}
1993
1994static void b43_release_firmware(struct b43_wldev *dev)
1995{
1996	do_release_fw(&dev->fw.ucode);
1997	do_release_fw(&dev->fw.pcm);
1998	do_release_fw(&dev->fw.initvals);
1999	do_release_fw(&dev->fw.initvals_band);
2000}
2001
2002static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2003{
2004	const char *text;
2005
2006	text = "You must go to "
2007	       "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
2008	       "and download the latest firmware (version 4).\n";
2009	if (error)
2010		b43err(wl, text);
2011	else
2012		b43warn(wl, text);
2013}
2014
2015static int do_request_fw(struct b43_wldev *dev,
2016			 const char *name,
2017			 struct b43_firmware_file *fw,
2018			 bool silent)
2019{
2020	char path[sizeof(modparam_fwpostfix) + 32];
2021	const struct firmware *blob;
2022	struct b43_fw_header *hdr;
2023	u32 size;
2024	int err;
2025
2026	if (!name) {
2027		/* Don't fetch anything. Free possibly cached firmware. */
2028		do_release_fw(fw);
2029		return 0;
2030	}
2031	if (fw->filename) {
2032		if (strcmp(fw->filename, name) == 0)
2033			return 0; /* Already have this fw. */
2034		/* Free the cached firmware first. */
2035		do_release_fw(fw);
2036	}
2037
2038	snprintf(path, ARRAY_SIZE(path),
2039		 "b43%s/%s.fw",
2040		 modparam_fwpostfix, name);
2041	err = request_firmware(&blob, path, dev->dev->dev);
2042	if (err == -ENOENT) {
2043		if (!silent) {
2044			b43err(dev->wl, "Firmware file \"%s\" not found\n",
2045			       path);
2046		}
2047		return err;
2048	} else if (err) {
2049		b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
2050		       path, err);
2051		return err;
2052	}
2053	if (blob->size < sizeof(struct b43_fw_header))
2054		goto err_format;
2055	hdr = (struct b43_fw_header *)(blob->data);
2056	switch (hdr->type) {
2057	case B43_FW_TYPE_UCODE:
2058	case B43_FW_TYPE_PCM:
2059		size = be32_to_cpu(hdr->size);
2060		if (size != blob->size - sizeof(struct b43_fw_header))
2061			goto err_format;
2062		/* fallthrough */
2063	case B43_FW_TYPE_IV:
2064		if (hdr->ver != 1)
2065			goto err_format;
2066		break;
2067	default:
2068		goto err_format;
2069	}
2070
2071	fw->data = blob;
2072	fw->filename = name;
2073
2074	return 0;
2075
2076err_format:
2077	b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2078	release_firmware(blob);
2079
2080	return -EPROTO;
2081}
2082
2083static int b43_request_firmware(struct b43_wldev *dev)
2084{
2085	struct b43_firmware *fw = &dev->fw;
2086	const u8 rev = dev->dev->id.revision;
2087	const char *filename;
2088	u32 tmshigh;
2089	int err;
2090
2091	/* Get microcode */
2092	tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2093	if ((rev >= 5) && (rev <= 10))
2094		filename = "ucode5";
2095	else if ((rev >= 11) && (rev <= 12))
2096		filename = "ucode11";
2097	else if (rev >= 13)
2098		filename = "ucode13";
2099	else
2100		goto err_no_ucode;
2101	err = do_request_fw(dev, filename, &fw->ucode, 0);
2102	if (err)
2103		goto err_load;
2104
2105	/* Get PCM code */
2106	if ((rev >= 5) && (rev <= 10))
2107		filename = "pcm5";
2108	else if (rev >= 11)
2109		filename = NULL;
2110	else
2111		goto err_no_pcm;
2112	fw->pcm_request_failed = 0;
2113	err = do_request_fw(dev, filename, &fw->pcm, 1);
2114	if (err == -ENOENT) {
2115		/* We did not find a PCM file? Not fatal, but
2116		 * core rev <= 10 must do without hwcrypto then. */
2117		fw->pcm_request_failed = 1;
2118	} else if (err)
2119		goto err_load;
2120
2121	/* Get initvals */
2122	switch (dev->phy.type) {
2123	case B43_PHYTYPE_A:
2124		if ((rev >= 5) && (rev <= 10)) {
2125			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2126				filename = "a0g1initvals5";
2127			else
2128				filename = "a0g0initvals5";
2129		} else
2130			goto err_no_initvals;
2131		break;
2132	case B43_PHYTYPE_G:
2133		if ((rev >= 5) && (rev <= 10))
2134			filename = "b0g0initvals5";
2135		else if (rev >= 13)
2136			filename = "b0g0initvals13";
2137		else
2138			goto err_no_initvals;
2139		break;
2140	case B43_PHYTYPE_N:
2141		if ((rev >= 11) && (rev <= 12))
2142			filename = "n0initvals11";
2143		else
2144			goto err_no_initvals;
2145		break;
2146	default:
2147		goto err_no_initvals;
2148	}
2149	err = do_request_fw(dev, filename, &fw->initvals, 0);
2150	if (err)
2151		goto err_load;
2152
2153	/* Get bandswitch initvals */
2154	switch (dev->phy.type) {
2155	case B43_PHYTYPE_A:
2156		if ((rev >= 5) && (rev <= 10)) {
2157			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2158				filename = "a0g1bsinitvals5";
2159			else
2160				filename = "a0g0bsinitvals5";
2161		} else if (rev >= 11)
2162			filename = NULL;
2163		else
2164			goto err_no_initvals;
2165		break;
2166	case B43_PHYTYPE_G:
2167		if ((rev >= 5) && (rev <= 10))
2168			filename = "b0g0bsinitvals5";
2169		else if (rev >= 11)
2170			filename = NULL;
2171		else
2172			goto err_no_initvals;
2173		break;
2174	case B43_PHYTYPE_N:
2175		if ((rev >= 11) && (rev <= 12))
2176			filename = "n0bsinitvals11";
2177		else
2178			goto err_no_initvals;
2179		break;
2180	default:
2181		goto err_no_initvals;
2182	}
2183	err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2184	if (err)
2185		goto err_load;
2186
2187	return 0;
2188
2189err_load:
2190	b43_print_fw_helptext(dev->wl, 1);
2191	goto error;
2192
2193err_no_ucode:
2194	err = -ENODEV;
2195	b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2196	goto error;
2197
2198err_no_pcm:
2199	err = -ENODEV;
2200	b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2201	goto error;
2202
2203err_no_initvals:
2204	err = -ENODEV;
2205	b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2206	       "core rev %u\n", dev->phy.type, rev);
2207	goto error;
2208
2209error:
2210	b43_release_firmware(dev);
2211	return err;
2212}
2213
2214static int b43_upload_microcode(struct b43_wldev *dev)
2215{
2216	const size_t hdr_len = sizeof(struct b43_fw_header);
2217	const __be32 *data;
2218	unsigned int i, len;
2219	u16 fwrev, fwpatch, fwdate, fwtime;
2220	u32 tmp, macctl;
2221	int err = 0;
2222
2223	/* Jump the microcode PSM to offset 0 */
2224	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2225	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2226	macctl |= B43_MACCTL_PSM_JMP0;
2227	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2228	/* Zero out all microcode PSM registers and shared memory. */
2229	for (i = 0; i < 64; i++)
2230		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2231	for (i = 0; i < 4096; i += 2)
2232		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2233
2234	/* Upload Microcode. */
2235	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2236	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2237	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2238	for (i = 0; i < len; i++) {
2239		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2240		udelay(10);
2241	}
2242
2243	if (dev->fw.pcm.data) {
2244		/* Upload PCM data. */
2245		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2246		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2247		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2248		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2249		/* No need for autoinc bit in SHM_HW */
2250		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2251		for (i = 0; i < len; i++) {
2252			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2253			udelay(10);
2254		}
2255	}
2256
2257	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2258
2259	/* Start the microcode PSM */
2260	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2261	macctl &= ~B43_MACCTL_PSM_JMP0;
2262	macctl |= B43_MACCTL_PSM_RUN;
2263	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2264
2265	/* Wait for the microcode to load and respond */
2266	i = 0;
2267	while (1) {
2268		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2269		if (tmp == B43_IRQ_MAC_SUSPENDED)
2270			break;
2271		i++;
2272		if (i >= 20) {
2273			b43err(dev->wl, "Microcode not responding\n");
2274			b43_print_fw_helptext(dev->wl, 1);
2275			err = -ENODEV;
2276			goto error;
2277		}
2278		msleep_interruptible(50);
2279		if (signal_pending(current)) {
2280			err = -EINTR;
2281			goto error;
2282		}
2283	}
2284	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2285
2286	/* Get and check the revisions. */
2287	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2288	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2289	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2290	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2291
2292	if (fwrev <= 0x128) {
2293		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2294		       "binary drivers older than version 4.x is unsupported. "
2295		       "You must upgrade your firmware files.\n");
2296		b43_print_fw_helptext(dev->wl, 1);
2297		err = -EOPNOTSUPP;
2298		goto error;
2299	}
2300	dev->fw.rev = fwrev;
2301	dev->fw.patch = fwpatch;
2302	dev->fw.opensource = (fwdate == 0xFFFF);
2303
2304	if (dev->fw.opensource) {
2305		/* Patchlevel info is encoded in the "time" field. */
2306		dev->fw.patch = fwtime;
2307		b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2308			dev->fw.rev, dev->fw.patch,
2309			dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2310	} else {
2311		b43info(dev->wl, "Loading firmware version %u.%u "
2312			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2313			fwrev, fwpatch,
2314			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2315			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2316		if (dev->fw.pcm_request_failed) {
2317			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2318				"Hardware accelerated cryptography is disabled.\n");
2319			b43_print_fw_helptext(dev->wl, 0);
2320		}
2321	}
2322
2323	if (b43_is_old_txhdr_format(dev)) {
2324		b43warn(dev->wl, "You are using an old firmware image. "
2325			"Support for old firmware will be removed in July 2008.\n");
2326		b43_print_fw_helptext(dev->wl, 0);
2327	}
2328
2329	return 0;
2330
2331error:
2332	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2333	macctl &= ~B43_MACCTL_PSM_RUN;
2334	macctl |= B43_MACCTL_PSM_JMP0;
2335	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2336
2337	return err;
2338}
2339
2340static int b43_write_initvals(struct b43_wldev *dev,
2341			      const struct b43_iv *ivals,
2342			      size_t count,
2343			      size_t array_size)
2344{
2345	const struct b43_iv *iv;
2346	u16 offset;
2347	size_t i;
2348	bool bit32;
2349
2350	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2351	iv = ivals;
2352	for (i = 0; i < count; i++) {
2353		if (array_size < sizeof(iv->offset_size))
2354			goto err_format;
2355		array_size -= sizeof(iv->offset_size);
2356		offset = be16_to_cpu(iv->offset_size);
2357		bit32 = !!(offset & B43_IV_32BIT);
2358		offset &= B43_IV_OFFSET_MASK;
2359		if (offset >= 0x1000)
2360			goto err_format;
2361		if (bit32) {
2362			u32 value;
2363
2364			if (array_size < sizeof(iv->data.d32))
2365				goto err_format;
2366			array_size -= sizeof(iv->data.d32);
2367
2368			value = get_unaligned_be32(&iv->data.d32);
2369			b43_write32(dev, offset, value);
2370
2371			iv = (const struct b43_iv *)((const uint8_t *)iv +
2372							sizeof(__be16) +
2373							sizeof(__be32));
2374		} else {
2375			u16 value;
2376
2377			if (array_size < sizeof(iv->data.d16))
2378				goto err_format;
2379			array_size -= sizeof(iv->data.d16);
2380
2381			value = be16_to_cpu(iv->data.d16);
2382			b43_write16(dev, offset, value);
2383
2384			iv = (const struct b43_iv *)((const uint8_t *)iv +
2385							sizeof(__be16) +
2386							sizeof(__be16));
2387		}
2388	}
2389	if (array_size)
2390		goto err_format;
2391
2392	return 0;
2393
2394err_format:
2395	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2396	b43_print_fw_helptext(dev->wl, 1);
2397
2398	return -EPROTO;
2399}
2400
2401static int b43_upload_initvals(struct b43_wldev *dev)
2402{
2403	const size_t hdr_len = sizeof(struct b43_fw_header);
2404	const struct b43_fw_header *hdr;
2405	struct b43_firmware *fw = &dev->fw;
2406	const struct b43_iv *ivals;
2407	size_t count;
2408	int err;
2409
2410	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2411	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2412	count = be32_to_cpu(hdr->size);
2413	err = b43_write_initvals(dev, ivals, count,
2414				 fw->initvals.data->size - hdr_len);
2415	if (err)
2416		goto out;
2417	if (fw->initvals_band.data) {
2418		hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2419		ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2420		count = be32_to_cpu(hdr->size);
2421		err = b43_write_initvals(dev, ivals, count,
2422					 fw->initvals_band.data->size - hdr_len);
2423		if (err)
2424			goto out;
2425	}
2426out:
2427
2428	return err;
2429}
2430
2431/* Initialize the GPIOs
2432 * http://bcm-specs.sipsolutions.net/GPIO
2433 */
2434static int b43_gpio_init(struct b43_wldev *dev)
2435{
2436	struct ssb_bus *bus = dev->dev->bus;
2437	struct ssb_device *gpiodev, *pcidev = NULL;
2438	u32 mask, set;
2439
2440	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2441		    & ~B43_MACCTL_GPOUTSMSK);
2442
2443	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2444		    | 0x000F);
2445
2446	mask = 0x0000001F;
2447	set = 0x0000000F;
2448	if (dev->dev->bus->chip_id == 0x4301) {
2449		mask |= 0x0060;
2450		set |= 0x0060;
2451	}
2452	if (0 /* FIXME: conditional unknown */ ) {
2453		b43_write16(dev, B43_MMIO_GPIO_MASK,
2454			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2455			    | 0x0100);
2456		mask |= 0x0180;
2457		set |= 0x0180;
2458	}
2459	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2460		b43_write16(dev, B43_MMIO_GPIO_MASK,
2461			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2462			    | 0x0200);
2463		mask |= 0x0200;
2464		set |= 0x0200;
2465	}
2466	if (dev->dev->id.revision >= 2)
2467		mask |= 0x0010;	/* FIXME: This is redundant. */
2468
2469#ifdef CONFIG_SSB_DRIVER_PCICORE
2470	pcidev = bus->pcicore.dev;
2471#endif
2472	gpiodev = bus->chipco.dev ? : pcidev;
2473	if (!gpiodev)
2474		return 0;
2475	ssb_write32(gpiodev, B43_GPIO_CONTROL,
2476		    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2477		     & mask) | set);
2478
2479	return 0;
2480}
2481
2482/* Turn off all GPIO stuff. Call this on module unload, for example. */
2483static void b43_gpio_cleanup(struct b43_wldev *dev)
2484{
2485	struct ssb_bus *bus = dev->dev->bus;
2486	struct ssb_device *gpiodev, *pcidev = NULL;
2487
2488#ifdef CONFIG_SSB_DRIVER_PCICORE
2489	pcidev = bus->pcicore.dev;
2490#endif
2491	gpiodev = bus->chipco.dev ? : pcidev;
2492	if (!gpiodev)
2493		return;
2494	ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2495}
2496
2497/* http://bcm-specs.sipsolutions.net/EnableMac */
2498void b43_mac_enable(struct b43_wldev *dev)
2499{
2500	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2501		u16 fwstate;
2502
2503		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2504					 B43_SHM_SH_UCODESTAT);
2505		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2506		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2507			b43err(dev->wl, "b43_mac_enable(): The firmware "
2508			       "should be suspended, but current state is %u\n",
2509			       fwstate);
2510		}
2511	}
2512
2513	dev->mac_suspended--;
2514	B43_WARN_ON(dev->mac_suspended < 0);
2515	if (dev->mac_suspended == 0) {
2516		b43_write32(dev, B43_MMIO_MACCTL,
2517			    b43_read32(dev, B43_MMIO_MACCTL)
2518			    | B43_MACCTL_ENABLED);
2519		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2520			    B43_IRQ_MAC_SUSPENDED);
2521		/* Commit writes */
2522		b43_read32(dev, B43_MMIO_MACCTL);
2523		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2524		b43_power_saving_ctl_bits(dev, 0);
2525	}
2526}
2527
2528/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2529void b43_mac_suspend(struct b43_wldev *dev)
2530{
2531	int i;
2532	u32 tmp;
2533
2534	might_sleep();
2535	B43_WARN_ON(dev->mac_suspended < 0);
2536
2537	if (dev->mac_suspended == 0) {
2538		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2539		b43_write32(dev, B43_MMIO_MACCTL,
2540			    b43_read32(dev, B43_MMIO_MACCTL)
2541			    & ~B43_MACCTL_ENABLED);
2542		/* force pci to flush the write */
2543		b43_read32(dev, B43_MMIO_MACCTL);
2544		for (i = 35; i; i--) {
2545			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2546			if (tmp & B43_IRQ_MAC_SUSPENDED)
2547				goto out;
2548			udelay(10);
2549		}
2550		/* Hm, it seems this will take some time. Use msleep(). */
2551		for (i = 40; i; i--) {
2552			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2553			if (tmp & B43_IRQ_MAC_SUSPENDED)
2554				goto out;
2555			msleep(1);
2556		}
2557		b43err(dev->wl, "MAC suspend failed\n");
2558	}
2559out:
2560	dev->mac_suspended++;
2561}
2562
2563static void b43_adjust_opmode(struct b43_wldev *dev)
2564{
2565	struct b43_wl *wl = dev->wl;
2566	u32 ctl;
2567	u16 cfp_pretbtt;
2568
2569	ctl = b43_read32(dev, B43_MMIO_MACCTL);
2570	/* Reset status to STA infrastructure mode. */
2571	ctl &= ~B43_MACCTL_AP;
2572	ctl &= ~B43_MACCTL_KEEP_CTL;
2573	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2574	ctl &= ~B43_MACCTL_KEEP_BAD;
2575	ctl &= ~B43_MACCTL_PROMISC;
2576	ctl &= ~B43_MACCTL_BEACPROMISC;
2577	ctl |= B43_MACCTL_INFRA;
2578
2579	if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
2580	    b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
2581		ctl |= B43_MACCTL_AP;
2582	else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS))
2583		ctl &= ~B43_MACCTL_INFRA;
2584
2585	if (wl->filter_flags & FIF_CONTROL)
2586		ctl |= B43_MACCTL_KEEP_CTL;
2587	if (wl->filter_flags & FIF_FCSFAIL)
2588		ctl |= B43_MACCTL_KEEP_BAD;
2589	if (wl->filter_flags & FIF_PLCPFAIL)
2590		ctl |= B43_MACCTL_KEEP_BADPLCP;
2591	if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2592		ctl |= B43_MACCTL_PROMISC;
2593	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2594		ctl |= B43_MACCTL_BEACPROMISC;
2595
2596	/* Workaround: On old hardware the HW-MAC-address-filter
2597	 * doesn't work properly, so always run promisc in filter
2598	 * it in software. */
2599	if (dev->dev->id.revision <= 4)
2600		ctl |= B43_MACCTL_PROMISC;
2601
2602	b43_write32(dev, B43_MMIO_MACCTL, ctl);
2603
2604	cfp_pretbtt = 2;
2605	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2606		if (dev->dev->bus->chip_id == 0x4306 &&
2607		    dev->dev->bus->chip_rev == 3)
2608			cfp_pretbtt = 100;
2609		else
2610			cfp_pretbtt = 50;
2611	}
2612	b43_write16(dev, 0x612, cfp_pretbtt);
2613}
2614
2615static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2616{
2617	u16 offset;
2618
2619	if (is_ofdm) {
2620		offset = 0x480;
2621		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2622	} else {
2623		offset = 0x4C0;
2624		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2625	}
2626	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2627			b43_shm_read16(dev, B43_SHM_SHARED, offset));
2628}
2629
2630static void b43_rate_memory_init(struct b43_wldev *dev)
2631{
2632	switch (dev->phy.type) {
2633	case B43_PHYTYPE_A:
2634	case B43_PHYTYPE_G:
2635	case B43_PHYTYPE_N:
2636		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2637		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2638		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2639		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2640		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2641		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2642		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2643		if (dev->phy.type == B43_PHYTYPE_A)
2644			break;
2645		/* fallthrough */
2646	case B43_PHYTYPE_B:
2647		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2648		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2649		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2650		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2651		break;
2652	default:
2653		B43_WARN_ON(1);
2654	}
2655}
2656
2657/* Set the default values for the PHY TX Control Words. */
2658static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2659{
2660	u16 ctl = 0;
2661
2662	ctl |= B43_TXH_PHY_ENC_CCK;
2663	ctl |= B43_TXH_PHY_ANT01AUTO;
2664	ctl |= B43_TXH_PHY_TXPWR;
2665
2666	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2667	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2668	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2669}
2670
2671/* Set the TX-Antenna for management frames sent by firmware. */
2672static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2673{
2674	u16 ant;
2675	u16 tmp;
2676
2677	ant = b43_antenna_to_phyctl(antenna);
2678
2679	/* For ACK/CTS */
2680	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2681	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2682	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2683	/* For Probe Resposes */
2684	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2685	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2686	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2687}
2688
2689/* This is the opposite of b43_chip_init() */
2690static void b43_chip_exit(struct b43_wldev *dev)
2691{
2692	b43_radio_turn_off(dev, 1);
2693	b43_gpio_cleanup(dev);
2694	b43_lo_g_cleanup(dev);
2695	/* firmware is released later */
2696}
2697
2698/* Initialize the chip
2699 * http://bcm-specs.sipsolutions.net/ChipInit
2700 */
2701static int b43_chip_init(struct b43_wldev *dev)
2702{
2703	struct b43_phy *phy = &dev->phy;
2704	int err, tmp;
2705	u32 value32, macctl;
2706	u16 value16;
2707
2708	/* Initialize the MAC control */
2709	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2710	if (dev->phy.gmode)
2711		macctl |= B43_MACCTL_GMODE;
2712	macctl |= B43_MACCTL_INFRA;
2713	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2714
2715	err = b43_request_firmware(dev);
2716	if (err)
2717		goto out;
2718	err = b43_upload_microcode(dev);
2719	if (err)
2720		goto out;	/* firmware is released later */
2721
2722	err = b43_gpio_init(dev);
2723	if (err)
2724		goto out;	/* firmware is released later */
2725
2726	err = b43_upload_initvals(dev);
2727	if (err)
2728		goto err_gpio_clean;
2729	b43_radio_turn_on(dev);
2730
2731	b43_write16(dev, 0x03E6, 0x0000);
2732	err = b43_phy_init(dev);
2733	if (err)
2734		goto err_radio_off;
2735
2736	/* Select initial Interference Mitigation. */
2737	tmp = phy->interfmode;
2738	phy->interfmode = B43_INTERFMODE_NONE;
2739	b43_radio_set_interference_mitigation(dev, tmp);
2740
2741	b43_set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2742	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2743
2744	if (phy->type == B43_PHYTYPE_B) {
2745		value16 = b43_read16(dev, 0x005E);
2746		value16 |= 0x0004;
2747		b43_write16(dev, 0x005E, value16);
2748	}
2749	b43_write32(dev, 0x0100, 0x01000000);
2750	if (dev->dev->id.revision < 5)
2751		b43_write32(dev, 0x010C, 0x01000000);
2752
2753	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2754		    & ~B43_MACCTL_INFRA);
2755	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2756		    | B43_MACCTL_INFRA);
2757
2758	/* Probe Response Timeout value */
2759	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2760	b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2761
2762	/* Initially set the wireless operation mode. */
2763	b43_adjust_opmode(dev);
2764
2765	if (dev->dev->id.revision < 3) {
2766		b43_write16(dev, 0x060E, 0x0000);
2767		b43_write16(dev, 0x0610, 0x8000);
2768		b43_write16(dev, 0x0604, 0x0000);
2769		b43_write16(dev, 0x0606, 0x0200);
2770	} else {
2771		b43_write32(dev, 0x0188, 0x80000000);
2772		b43_write32(dev, 0x018C, 0x02000000);
2773	}
2774	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2775	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2776	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2777	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2778	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2779	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2780	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2781
2782	value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2783	value32 |= 0x00100000;
2784	ssb_write32(dev->dev, SSB_TMSLOW, value32);
2785
2786	b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2787		    dev->dev->bus->chipco.fast_pwrup_delay);
2788
2789	err = 0;
2790	b43dbg(dev->wl, "Chip initialized\n");
2791out:
2792	return err;
2793
2794err_radio_off:
2795	b43_radio_turn_off(dev, 1);
2796err_gpio_clean:
2797	b43_gpio_cleanup(dev);
2798	return err;
2799}
2800
2801static void b43_periodic_every60sec(struct b43_wldev *dev)
2802{
2803	struct b43_phy *phy = &dev->phy;
2804
2805	if (phy->type != B43_PHYTYPE_G)
2806		return;
2807	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_RSSI) {
2808		b43_mac_suspend(dev);
2809		b43_calc_nrssi_slope(dev);
2810		if ((phy->radio_ver == 0x2050) && (phy->radio_rev == 8)) {
2811			u8 old_chan = phy->channel;
2812
2813			/* VCO Calibration */
2814			if (old_chan >= 8)
2815				b43_radio_selectchannel(dev, 1, 0);
2816			else
2817				b43_radio_selectchannel(dev, 13, 0);
2818			b43_radio_selectchannel(dev, old_chan, 0);
2819		}
2820		b43_mac_enable(dev);
2821	}
2822}
2823
2824static void b43_periodic_every30sec(struct b43_wldev *dev)
2825{
2826	/* Update device statistics. */
2827	b43_calculate_link_quality(dev);
2828}
2829
2830static void b43_periodic_every15sec(struct b43_wldev *dev)
2831{
2832	struct b43_phy *phy = &dev->phy;
2833	u16 wdr;
2834
2835	if (dev->fw.opensource) {
2836		/* Check if the firmware is still alive.
2837		 * It will reset the watchdog counter to 0 in its idle loop. */
2838		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2839		if (unlikely(wdr)) {
2840			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2841			b43_controller_restart(dev, "Firmware watchdog");
2842			return;
2843		} else {
2844			b43_shm_write16(dev, B43_SHM_SCRATCH,
2845					B43_WATCHDOG_REG, 1);
2846		}
2847	}
2848
2849	if (phy->type == B43_PHYTYPE_G) {
2850		//TODO: update_aci_moving_average
2851		if (phy->aci_enable && phy->aci_wlan_automatic) {
2852			b43_mac_suspend(dev);
2853			if (!phy->aci_enable && 1 /*TODO: not scanning? */ ) {
2854				if (0 /*TODO: bunch of conditions */ ) {
2855					b43_radio_set_interference_mitigation
2856					    (dev, B43_INTERFMODE_MANUALWLAN);
2857				}
2858			} else if (1 /*TODO*/) {
2859				/*
2860				   if ((aci_average > 1000) && !(b43_radio_aci_scan(dev))) {
2861				   b43_radio_set_interference_mitigation(dev,
2862				   B43_INTERFMODE_NONE);
2863				   }
2864				 */
2865			}
2866			b43_mac_enable(dev);
2867		} else if (phy->interfmode == B43_INTERFMODE_NONWLAN &&
2868			   phy->rev == 1) {
2869			//TODO: implement rev1 workaround
2870		}
2871	}
2872	b43_phy_xmitpower(dev);	//FIXME: unless scanning?
2873	b43_lo_g_maintanance_work(dev);
2874	//TODO for APHY (temperature?)
2875
2876	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2877	wmb();
2878}
2879
2880static void do_periodic_work(struct b43_wldev *dev)
2881{
2882	unsigned int state;
2883
2884	state = dev->periodic_state;
2885	if (state % 4 == 0)
2886		b43_periodic_every60sec(dev);
2887	if (state % 2 == 0)
2888		b43_periodic_every30sec(dev);
2889	b43_periodic_every15sec(dev);
2890}
2891
2892/* Periodic work locking policy:
2893 * 	The whole periodic work handler is protected by
2894 * 	wl->mutex. If another lock is needed somewhere in the
2895 * 	pwork callchain, it's aquired in-place, where it's needed.
2896 */
2897static void b43_periodic_work_handler(struct work_struct *work)
2898{
2899	struct b43_wldev *dev = container_of(work, struct b43_wldev,
2900					     periodic_work.work);
2901	struct b43_wl *wl = dev->wl;
2902	unsigned long delay;
2903
2904	mutex_lock(&wl->mutex);
2905
2906	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2907		goto out;
2908	if (b43_debug(dev, B43_DBG_PWORK_STOP))
2909		goto out_requeue;
2910
2911	do_periodic_work(dev);
2912
2913	dev->periodic_state++;
2914out_requeue:
2915	if (b43_debug(dev, B43_DBG_PWORK_FAST))
2916		delay = msecs_to_jiffies(50);
2917	else
2918		delay = round_jiffies_relative(HZ * 15);
2919	queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2920out:
2921	mutex_unlock(&wl->mutex);
2922}
2923
2924static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2925{
2926	struct delayed_work *work = &dev->periodic_work;
2927
2928	dev->periodic_state = 0;
2929	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2930	queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2931}
2932
2933/* Check if communication with the device works correctly. */
2934static int b43_validate_chipaccess(struct b43_wldev *dev)
2935{
2936	u32 v, backup;
2937
2938	backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2939
2940	/* Check for read/write and endianness problems. */
2941	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2942	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2943		goto error;
2944	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2945	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2946		goto error;
2947
2948	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2949
2950	if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2951		/* The 32bit register shadows the two 16bit registers
2952		 * with update sideeffects. Validate this. */
2953		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2954		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2955		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2956			goto error;
2957		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2958			goto error;
2959	}
2960	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2961
2962	v = b43_read32(dev, B43_MMIO_MACCTL);
2963	v |= B43_MACCTL_GMODE;
2964	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2965		goto error;
2966
2967	return 0;
2968error:
2969	b43err(dev->wl, "Failed to validate the chipaccess\n");
2970	return -ENODEV;
2971}
2972
2973static void b43_security_init(struct b43_wldev *dev)
2974{
2975	dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2976	B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2977	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2978	/* KTP is a word address, but we address SHM bytewise.
2979	 * So multiply by two.
2980	 */
2981	dev->ktp *= 2;
2982	if (dev->dev->id.revision >= 5) {
2983		/* Number of RCMTA address slots */
2984		b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2985	}
2986	b43_clear_keys(dev);
2987}
2988
2989static int b43_rng_read(struct hwrng *rng, u32 * data)
2990{
2991	struct b43_wl *wl = (struct b43_wl *)rng->priv;
2992	unsigned long flags;
2993
2994	/* Don't take wl->mutex here, as it could deadlock with
2995	 * hwrng internal locking. It's not needed to take
2996	 * wl->mutex here, anyway. */
2997
2998	spin_lock_irqsave(&wl->irq_lock, flags);
2999	*data = b43_read16(wl->current_dev, B43_MMIO_RNG);
3000	spin_unlock_irqrestore(&wl->irq_lock, flags);
3001
3002	return (sizeof(u16));
3003}
3004
3005static void b43_rng_exit(struct b43_wl *wl)
3006{
3007	if (wl->rng_initialized)
3008		hwrng_unregister(&wl->rng);
3009}
3010
3011static int b43_rng_init(struct b43_wl *wl)
3012{
3013	int err;
3014
3015	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3016		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3017	wl->rng.name = wl->rng_name;
3018	wl->rng.data_read = b43_rng_read;
3019	wl->rng.priv = (unsigned long)wl;
3020	wl->rng_initialized = 1;
3021	err = hwrng_register(&wl->rng);
3022	if (err) {
3023		wl->rng_initialized = 0;
3024		b43err(wl, "Failed to register the random "
3025		       "number generator (%d)\n", err);
3026	}
3027
3028	return err;
3029}
3030
3031static int b43_op_tx(struct ieee80211_hw *hw,
3032		     struct sk_buff *skb)
3033{
3034	struct b43_wl *wl = hw_to_b43_wl(hw);
3035	struct b43_wldev *dev = wl->current_dev;
3036	unsigned long flags;
3037	int err;
3038
3039	if (unlikely(skb->len < 2 + 2 + 6)) {
3040		/* Too short, this can't be a valid frame. */
3041		goto drop_packet;
3042	}
3043	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3044	if (unlikely(!dev))
3045		goto drop_packet;
3046
3047	/* Transmissions on seperate queues can run concurrently. */
3048	read_lock_irqsave(&wl->tx_lock, flags);
3049
3050	err = -ENODEV;
3051	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3052		if (b43_using_pio_transfers(dev))
3053			err = b43_pio_tx(dev, skb);
3054		else
3055			err = b43_dma_tx(dev, skb);
3056	}
3057
3058	read_unlock_irqrestore(&wl->tx_lock, flags);
3059
3060	if (unlikely(err))
3061		goto drop_packet;
3062	return NETDEV_TX_OK;
3063
3064drop_packet:
3065	/* We can not transmit this packet. Drop it. */
3066	dev_kfree_skb_any(skb);
3067	return NETDEV_TX_OK;
3068}
3069
3070/* Locking: wl->irq_lock */
3071static void b43_qos_params_upload(struct b43_wldev *dev,
3072				  const struct ieee80211_tx_queue_params *p,
3073				  u16 shm_offset)
3074{
3075	u16 params[B43_NR_QOSPARAMS];
3076	int bslots, tmp;
3077	unsigned int i;
3078
3079	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3080
3081	memset(&params, 0, sizeof(params));
3082
3083	params[B43_QOSPARAM_TXOP] = p->txop * 32;
3084	params[B43_QOSPARAM_CWMIN] = p->cw_min;
3085	params[B43_QOSPARAM_CWMAX] = p->cw_max;
3086	params[B43_QOSPARAM_CWCUR] = p->cw_min;
3087	params[B43_QOSPARAM_AIFS] = p->aifs;
3088	params[B43_QOSPARAM_BSLOTS] = bslots;
3089	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3090
3091	for (i = 0; i < ARRAY_SIZE(params); i++) {
3092		if (i == B43_QOSPARAM_STATUS) {
3093			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3094					     shm_offset + (i * 2));
3095			/* Mark the parameters as updated. */
3096			tmp |= 0x100;
3097			b43_shm_write16(dev, B43_SHM_SHARED,
3098					shm_offset + (i * 2),
3099					tmp);
3100		} else {
3101			b43_shm_write16(dev, B43_SHM_SHARED,
3102					shm_offset + (i * 2),
3103					params[i]);
3104		}
3105	}
3106}
3107
3108/* Update the QOS parameters in hardware. */
3109static void b43_qos_update(struct b43_wldev *dev)
3110{
3111	struct b43_wl *wl = dev->wl;
3112	struct b43_qos_params *params;
3113	unsigned long flags;
3114	unsigned int i;
3115
3116	/* Mapping of mac80211 queues to b43 SHM offsets. */
3117	static const u16 qos_shm_offsets[] = {
3118		[0] = B43_QOS_VOICE,
3119		[1] = B43_QOS_VIDEO,
3120		[2] = B43_QOS_BESTEFFORT,
3121		[3] = B43_QOS_BACKGROUND,
3122	};
3123	BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
3124
3125	b43_mac_suspend(dev);
3126	spin_lock_irqsave(&wl->irq_lock, flags);
3127
3128	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3129		params = &(wl->qos_params[i]);
3130		if (params->need_hw_update) {
3131			b43_qos_params_upload(dev, &(params->p),
3132					      qos_shm_offsets[i]);
3133			params->need_hw_update = 0;
3134		}
3135	}
3136
3137	spin_unlock_irqrestore(&wl->irq_lock, flags);
3138	b43_mac_enable(dev);
3139}
3140
3141static void b43_qos_clear(struct b43_wl *wl)
3142{
3143	struct b43_qos_params *params;
3144	unsigned int i;
3145
3146	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3147		params = &(wl->qos_params[i]);
3148
3149		memset(&(params->p), 0, sizeof(params->p));
3150		params->p.aifs = -1;
3151		params->need_hw_update = 1;
3152	}
3153}
3154
3155/* Initialize the core's QOS capabilities */
3156static void b43_qos_init(struct b43_wldev *dev)
3157{
3158	struct b43_wl *wl = dev->wl;
3159	unsigned int i;
3160
3161	/* Upload the current QOS parameters. */
3162	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
3163		wl->qos_params[i].need_hw_update = 1;
3164	b43_qos_update(dev);
3165
3166	/* Enable QOS support. */
3167	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3168	b43_write16(dev, B43_MMIO_IFSCTL,
3169		    b43_read16(dev, B43_MMIO_IFSCTL)
3170		    | B43_MMIO_IFSCTL_USE_EDCF);
3171}
3172
3173static void b43_qos_update_work(struct work_struct *work)
3174{
3175	struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
3176	struct b43_wldev *dev;
3177
3178	mutex_lock(&wl->mutex);
3179	dev = wl->current_dev;
3180	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
3181		b43_qos_update(dev);
3182	mutex_unlock(&wl->mutex);
3183}
3184
3185static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3186			  const struct ieee80211_tx_queue_params *params)
3187{
3188	struct b43_wl *wl = hw_to_b43_wl(hw);
3189	unsigned long flags;
3190	unsigned int queue = (unsigned int)_queue;
3191	struct b43_qos_params *p;
3192
3193	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3194		/* Queue not available or don't support setting
3195		 * params on this queue. Return success to not
3196		 * confuse mac80211. */
3197		return 0;
3198	}
3199
3200	spin_lock_irqsave(&wl->irq_lock, flags);
3201	p = &(wl->qos_params[queue]);
3202	memcpy(&(p->p), params, sizeof(p->p));
3203	p->need_hw_update = 1;
3204	spin_unlock_irqrestore(&wl->irq_lock, flags);
3205
3206	queue_work(hw->workqueue, &wl->qos_update_work);
3207
3208	return 0;
3209}
3210
3211static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3212			       struct ieee80211_tx_queue_stats *stats)
3213{
3214	struct b43_wl *wl = hw_to_b43_wl(hw);
3215	struct b43_wldev *dev = wl->current_dev;
3216	unsigned long flags;
3217	int err = -ENODEV;
3218
3219	if (!dev)
3220		goto out;
3221	spin_lock_irqsave(&wl->irq_lock, flags);
3222	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3223		if (b43_using_pio_transfers(dev))
3224			b43_pio_get_tx_stats(dev, stats);
3225		else
3226			b43_dma_get_tx_stats(dev, stats);
3227		err = 0;
3228	}
3229	spin_unlock_irqrestore(&wl->irq_lock, flags);
3230out:
3231	return err;
3232}
3233
3234static int b43_op_get_stats(struct ieee80211_hw *hw,
3235			    struct ieee80211_low_level_stats *stats)
3236{
3237	struct b43_wl *wl = hw_to_b43_wl(hw);
3238	unsigned long flags;
3239
3240	spin_lock_irqsave(&wl->irq_lock, flags);
3241	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3242	spin_unlock_irqrestore(&wl->irq_lock, flags);
3243
3244	return 0;
3245}
3246
3247static void b43_put_phy_into_reset(struct b43_wldev *dev)
3248{
3249	struct ssb_device *sdev = dev->dev;
3250	u32 tmslow;
3251
3252	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3253	tmslow &= ~B43_TMSLOW_GMODE;
3254	tmslow |= B43_TMSLOW_PHYRESET;
3255	tmslow |= SSB_TMSLOW_FGC;
3256	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3257	msleep(1);
3258
3259	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3260	tmslow &= ~SSB_TMSLOW_FGC;
3261	tmslow |= B43_TMSLOW_PHYRESET;
3262	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3263	msleep(1);
3264}
3265
3266static const char * band_to_string(enum ieee80211_band band)
3267{
3268	switch (band) {
3269	case IEEE80211_BAND_5GHZ:
3270		return "5";
3271	case IEEE80211_BAND_2GHZ:
3272		return "2.4";
3273	default:
3274		break;
3275	}
3276	B43_WARN_ON(1);
3277	return "";
3278}
3279
3280/* Expects wl->mutex locked */
3281static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3282{
3283	struct b43_wldev *up_dev = NULL;
3284	struct b43_wldev *down_dev;
3285	struct b43_wldev *d;
3286	int err;
3287	bool gmode;
3288	int prev_status;
3289
3290	/* Find a device and PHY which supports the band. */
3291	list_for_each_entry(d, &wl->devlist, list) {
3292		switch (chan->band) {
3293		case IEEE80211_BAND_5GHZ:
3294			if (d->phy.supports_5ghz) {
3295				up_dev = d;
3296				gmode = 0;
3297			}
3298			break;
3299		case IEEE80211_BAND_2GHZ:
3300			if (d->phy.supports_2ghz) {
3301				up_dev = d;
3302				gmode = 1;
3303			}
3304			break;
3305		default:
3306			B43_WARN_ON(1);
3307			return -EINVAL;
3308		}
3309		if (up_dev)
3310			break;
3311	}
3312	if (!up_dev) {
3313		b43err(wl, "Could not find a device for %s-GHz band operation\n",
3314		       band_to_string(chan->band));
3315		return -ENODEV;
3316	}
3317	if ((up_dev == wl->current_dev) &&
3318	    (!!wl->current_dev->phy.gmode == !!gmode)) {
3319		/* This device is already running. */
3320		return 0;
3321	}
3322	b43dbg(wl, "Switching to %s-GHz band\n",
3323	       band_to_string(chan->band));
3324	down_dev = wl->current_dev;
3325
3326	prev_status = b43_status(down_dev);
3327	/* Shutdown the currently running core. */
3328	if (prev_status >= B43_STAT_STARTED)
3329		b43_wireless_core_stop(down_dev);
3330	if (prev_status >= B43_STAT_INITIALIZED)
3331		b43_wireless_core_exit(down_dev);
3332
3333	if (down_dev != up_dev) {
3334		/* We switch to a different core, so we put PHY into
3335		 * RESET on the old core. */
3336		b43_put_phy_into_reset(down_dev);
3337	}
3338
3339	/* Now start the new core. */
3340	up_dev->phy.gmode = gmode;
3341	if (prev_status >= B43_STAT_INITIALIZED) {
3342		err = b43_wireless_core_init(up_dev);
3343		if (err) {
3344			b43err(wl, "Fatal: Could not initialize device for "
3345			       "selected %s-GHz band\n",
3346			       band_to_string(chan->band));
3347			goto init_failure;
3348		}
3349	}
3350	if (prev_status >= B43_STAT_STARTED) {
3351		err = b43_wireless_core_start(up_dev);
3352		if (err) {
3353			b43err(wl, "Fatal: Coult not start device for "
3354			       "selected %s-GHz band\n",
3355			       band_to_string(chan->band));
3356			b43_wireless_core_exit(up_dev);
3357			goto init_failure;
3358		}
3359	}
3360	B43_WARN_ON(b43_status(up_dev) != prev_status);
3361
3362	wl->current_dev = up_dev;
3363
3364	return 0;
3365init_failure:
3366	/* Whoops, failed to init the new core. No core is operating now. */
3367	wl->current_dev = NULL;
3368	return err;
3369}
3370
3371static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
3372{
3373	struct b43_wl *wl = hw_to_b43_wl(hw);
3374	struct b43_wldev *dev;
3375	struct b43_phy *phy;
3376	unsigned long flags;
3377	int antenna;
3378	int err = 0;
3379	u32 savedirqs;
3380
3381	mutex_lock(&wl->mutex);
3382
3383	/* Switch the band (if necessary). This might change the active core. */
3384	err = b43_switch_band(wl, conf->channel);
3385	if (err)
3386		goto out_unlock_mutex;
3387	dev = wl->current_dev;
3388	phy = &dev->phy;
3389
3390	/* Disable IRQs while reconfiguring the device.
3391	 * This makes it possible to drop the spinlock throughout
3392	 * the reconfiguration process. */
3393	spin_lock_irqsave(&wl->irq_lock, flags);
3394	if (b43_status(dev) < B43_STAT_STARTED) {
3395		spin_unlock_irqrestore(&wl->irq_lock, flags);
3396		goto out_unlock_mutex;
3397	}
3398	savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3399	spin_unlock_irqrestore(&wl->irq_lock, flags);
3400	b43_synchronize_irq(dev);
3401
3402	/* Switch to the requested channel.
3403	 * The firmware takes care of races with the TX handler. */
3404	if (conf->channel->hw_value != phy->channel)
3405		b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
3406
3407	/* Enable/Disable ShortSlot timing. */
3408	if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
3409	    dev->short_slot) {
3410		B43_WARN_ON(phy->type != B43_PHYTYPE_G);
3411		if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)
3412			b43_short_slot_timing_enable(dev);
3413		else
3414			b43_short_slot_timing_disable(dev);
3415	}
3416
3417	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3418
3419	/* Adjust the desired TX power level. */
3420	if (conf->power_level != 0) {
3421		if (conf->power_level != phy->power_level) {
3422			phy->power_level = conf->power_level;
3423			b43_phy_xmitpower(dev);
3424		}
3425	}
3426
3427	/* Antennas for RX and management frame TX. */
3428	antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
3429	b43_mgmtframe_txantenna(dev, antenna);
3430	antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
3431	b43_set_rx_antenna(dev, antenna);
3432
3433	/* Update templates for AP/mesh mode. */
3434	if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3435	    b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
3436		b43_set_beacon_int(dev, conf->beacon_int);
3437
3438	if (!!conf->radio_enabled != phy->radio_on) {
3439		if (conf->radio_enabled) {
3440			b43_radio_turn_on(dev);
3441			b43info(dev->wl, "Radio turned on by software\n");
3442			if (!dev->radio_hw_enable) {
3443				b43info(dev->wl, "The hardware RF-kill button "
3444					"still turns the radio physically off. "
3445					"Press the button to turn it on.\n");
3446			}
3447		} else {
3448			b43_radio_turn_off(dev, 0);
3449			b43info(dev->wl, "Radio turned off by software\n");
3450		}
3451	}
3452
3453	spin_lock_irqsave(&wl->irq_lock, flags);
3454	b43_interrupt_enable(dev, savedirqs);
3455	mmiowb();
3456	spin_unlock_irqrestore(&wl->irq_lock, flags);
3457      out_unlock_mutex:
3458	mutex_unlock(&wl->mutex);
3459
3460	return err;
3461}
3462
3463static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3464			   const u8 *local_addr, const u8 *addr,
3465			   struct ieee80211_key_conf *key)
3466{
3467	struct b43_wl *wl = hw_to_b43_wl(hw);
3468	struct b43_wldev *dev;
3469	unsigned long flags;
3470	u8 algorithm;
3471	u8 index;
3472	int err;
3473	DECLARE_MAC_BUF(mac);
3474
3475	if (modparam_nohwcrypt)
3476		return -ENOSPC; /* User disabled HW-crypto */
3477
3478	mutex_lock(&wl->mutex);
3479	spin_lock_irqsave(&wl->irq_lock, flags);
3480
3481	dev = wl->current_dev;
3482	err = -ENODEV;
3483	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3484		goto out_unlock;
3485
3486	if (dev->fw.pcm_request_failed) {
3487		/* We don't have firmware for the crypto engine.
3488		 * Must use software-crypto. */
3489		err = -EOPNOTSUPP;
3490		goto out_unlock;
3491	}
3492
3493	err = -EINVAL;
3494	switch (key->alg) {
3495	case ALG_WEP:
3496		if (key->keylen == 5)
3497			algorithm = B43_SEC_ALGO_WEP40;
3498		else
3499			algorithm = B43_SEC_ALGO_WEP104;
3500		break;
3501	case ALG_TKIP:
3502		algorithm = B43_SEC_ALGO_TKIP;
3503		break;
3504	case ALG_CCMP:
3505		algorithm = B43_SEC_ALGO_AES;
3506		break;
3507	default:
3508		B43_WARN_ON(1);
3509		goto out_unlock;
3510	}
3511	index = (u8) (key->keyidx);
3512	if (index > 3)
3513		goto out_unlock;
3514
3515	switch (cmd) {
3516	case SET_KEY:
3517		if (algorithm == B43_SEC_ALGO_TKIP) {
3518			/* FIXME: No TKIP hardware encryption for now. */
3519			err = -EOPNOTSUPP;
3520			goto out_unlock;
3521		}
3522
3523		if (is_broadcast_ether_addr(addr)) {
3524			/* addr is FF:FF:FF:FF:FF:FF for default keys */
3525			err = b43_key_write(dev, index, algorithm,
3526					    key->key, key->keylen, NULL, key);
3527		} else {
3528			/*
3529			 * either pairwise key or address is 00:00:00:00:00:00
3530			 * for transmit-only keys
3531			 */
3532			err = b43_key_write(dev, -1, algorithm,
3533					    key->key, key->keylen, addr, key);
3534		}
3535		if (err)
3536			goto out_unlock;
3537
3538		if (algorithm == B43_SEC_ALGO_WEP40 ||
3539		    algorithm == B43_SEC_ALGO_WEP104) {
3540			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3541		} else {
3542			b43_hf_write(dev,
3543				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3544		}
3545		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3546		break;
3547	case DISABLE_KEY: {
3548		err = b43_key_clear(dev, key->hw_key_idx);
3549		if (err)
3550			goto out_unlock;
3551		break;
3552	}
3553	default:
3554		B43_WARN_ON(1);
3555	}
3556out_unlock:
3557	spin_unlock_irqrestore(&wl->irq_lock, flags);
3558	mutex_unlock(&wl->mutex);
3559	if (!err) {
3560		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3561		       "mac: %s\n",
3562		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3563		       print_mac(mac, addr));
3564	}
3565	return err;
3566}
3567
3568static void b43_op_configure_filter(struct ieee80211_hw *hw,
3569				    unsigned int changed, unsigned int *fflags,
3570				    int mc_count, struct dev_addr_list *mc_list)
3571{
3572	struct b43_wl *wl = hw_to_b43_wl(hw);
3573	struct b43_wldev *dev = wl->current_dev;
3574	unsigned long flags;
3575
3576	if (!dev) {
3577		*fflags = 0;
3578		return;
3579	}
3580
3581	spin_lock_irqsave(&wl->irq_lock, flags);
3582	*fflags &= FIF_PROMISC_IN_BSS |
3583		  FIF_ALLMULTI |
3584		  FIF_FCSFAIL |
3585		  FIF_PLCPFAIL |
3586		  FIF_CONTROL |
3587		  FIF_OTHER_BSS |
3588		  FIF_BCN_PRBRESP_PROMISC;
3589
3590	changed &= FIF_PROMISC_IN_BSS |
3591		   FIF_ALLMULTI |
3592		   FIF_FCSFAIL |
3593		   FIF_PLCPFAIL |
3594		   FIF_CONTROL |
3595		   FIF_OTHER_BSS |
3596		   FIF_BCN_PRBRESP_PROMISC;
3597
3598	wl->filter_flags = *fflags;
3599
3600	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3601		b43_adjust_opmode(dev);
3602	spin_unlock_irqrestore(&wl->irq_lock, flags);
3603}
3604
3605static int b43_op_config_interface(struct ieee80211_hw *hw,
3606				   struct ieee80211_vif *vif,
3607				   struct ieee80211_if_conf *conf)
3608{
3609	struct b43_wl *wl = hw_to_b43_wl(hw);
3610	struct b43_wldev *dev = wl->current_dev;
3611	unsigned long flags;
3612
3613	if (!dev)
3614		return -ENODEV;
3615	mutex_lock(&wl->mutex);
3616	spin_lock_irqsave(&wl->irq_lock, flags);
3617	B43_WARN_ON(wl->vif != vif);
3618	if (conf->bssid)
3619		memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3620	else
3621		memset(wl->bssid, 0, ETH_ALEN);
3622	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3623		if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3624		    b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT)) {
3625			B43_WARN_ON(vif->type != wl->if_type);
3626			if (conf->changed & IEEE80211_IFCC_SSID)
3627				b43_set_ssid(dev, conf->ssid, conf->ssid_len);
3628			if (conf->changed & IEEE80211_IFCC_BEACON)
3629				b43_update_templates(wl);
3630		} else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS)) {
3631			if (conf->changed & IEEE80211_IFCC_BEACON)
3632				b43_update_templates(wl);
3633		}
3634		b43_write_mac_bssid_templates(dev);
3635	}
3636	spin_unlock_irqrestore(&wl->irq_lock, flags);
3637	mutex_unlock(&wl->mutex);
3638
3639	return 0;
3640}
3641
3642/* Locking: wl->mutex */
3643static void b43_wireless_core_stop(struct b43_wldev *dev)
3644{
3645	struct b43_wl *wl = dev->wl;
3646	unsigned long flags;
3647
3648	if (b43_status(dev) < B43_STAT_STARTED)
3649		return;
3650
3651	/* Disable and sync interrupts. We must do this before than
3652	 * setting the status to INITIALIZED, as the interrupt handler
3653	 * won't care about IRQs then. */
3654	spin_lock_irqsave(&wl->irq_lock, flags);
3655	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3656	b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* flush */
3657	spin_unlock_irqrestore(&wl->irq_lock, flags);
3658	b43_synchronize_irq(dev);
3659
3660	write_lock_irqsave(&wl->tx_lock, flags);
3661	b43_set_status(dev, B43_STAT_INITIALIZED);
3662	write_unlock_irqrestore(&wl->tx_lock, flags);
3663
3664	b43_pio_stop(dev);
3665	mutex_unlock(&wl->mutex);
3666	/* Must unlock as it would otherwise deadlock. No races here.
3667	 * Cancel the possibly running self-rearming periodic work. */
3668	cancel_delayed_work_sync(&dev->periodic_work);
3669	mutex_lock(&wl->mutex);
3670
3671	b43_mac_suspend(dev);
3672	free_irq(dev->dev->irq, dev);
3673	b43dbg(wl, "Wireless interface stopped\n");
3674}
3675
3676/* Locking: wl->mutex */
3677static int b43_wireless_core_start(struct b43_wldev *dev)
3678{
3679	int err;
3680
3681	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3682
3683	drain_txstatus_queue(dev);
3684	err = request_irq(dev->dev->irq, b43_interrupt_handler,
3685			  IRQF_SHARED, KBUILD_MODNAME, dev);
3686	if (err) {
3687		b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3688		goto out;
3689	}
3690
3691	/* We are ready to run. */
3692	b43_set_status(dev, B43_STAT_STARTED);
3693
3694	/* Start data flow (TX/RX). */
3695	b43_mac_enable(dev);
3696	b43_interrupt_enable(dev, dev->irq_savedstate);
3697
3698	/* Start maintainance work */
3699	b43_periodic_tasks_setup(dev);
3700
3701	b43dbg(dev->wl, "Wireless interface started\n");
3702      out:
3703	return err;
3704}
3705
3706/* Get PHY and RADIO versioning numbers */
3707static int b43_phy_versioning(struct b43_wldev *dev)
3708{
3709	struct b43_phy *phy = &dev->phy;
3710	u32 tmp;
3711	u8 analog_type;
3712	u8 phy_type;
3713	u8 phy_rev;
3714	u16 radio_manuf;
3715	u16 radio_ver;
3716	u16 radio_rev;
3717	int unsupported = 0;
3718
3719	/* Get PHY versioning */
3720	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3721	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3722	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3723	phy_rev = (tmp & B43_PHYVER_VERSION);
3724	switch (phy_type) {
3725	case B43_PHYTYPE_A:
3726		if (phy_rev >= 4)
3727			unsupported = 1;
3728		break;
3729	case B43_PHYTYPE_B:
3730		if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3731		    && phy_rev != 7)
3732			unsupported = 1;
3733		break;
3734	case B43_PHYTYPE_G:
3735		if (phy_rev > 9)
3736			unsupported = 1;
3737		break;
3738#ifdef CONFIG_B43_NPHY
3739	case B43_PHYTYPE_N:
3740		if (phy_rev > 1)
3741			unsupported = 1;
3742		break;
3743#endif
3744	default:
3745		unsupported = 1;
3746	};
3747	if (unsupported) {
3748		b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3749		       "(Analog %u, Type %u, Revision %u)\n",
3750		       analog_type, phy_type, phy_rev);
3751		return -EOPNOTSUPP;
3752	}
3753	b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3754	       analog_type, phy_type, phy_rev);
3755
3756	/* Get RADIO versioning */
3757	if (dev->dev->bus->chip_id == 0x4317) {
3758		if (dev->dev->bus->chip_rev == 0)
3759			tmp = 0x3205017F;
3760		else if (dev->dev->bus->chip_rev == 1)
3761			tmp = 0x4205017F;
3762		else
3763			tmp = 0x5205017F;
3764	} else {
3765		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3766		tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3767		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3768		tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3769	}
3770	radio_manuf = (tmp & 0x00000FFF);
3771	radio_ver = (tmp & 0x0FFFF000) >> 12;
3772	radio_rev = (tmp & 0xF0000000) >> 28;
3773	if (radio_manuf != 0x17F /* Broadcom */)
3774		unsupported = 1;
3775	switch (phy_type) {
3776	case B43_PHYTYPE_A:
3777		if (radio_ver != 0x2060)
3778			unsupported = 1;
3779		if (radio_rev != 1)
3780			unsupported = 1;
3781		if (radio_manuf != 0x17F)
3782			unsupported = 1;
3783		break;
3784	case B43_PHYTYPE_B:
3785		if ((radio_ver & 0xFFF0) != 0x2050)
3786			unsupported = 1;
3787		break;
3788	case B43_PHYTYPE_G:
3789		if (radio_ver != 0x2050)
3790			unsupported = 1;
3791		break;
3792	case B43_PHYTYPE_N:
3793		if (radio_ver != 0x2055)
3794			unsupported = 1;
3795		break;
3796	default:
3797		B43_WARN_ON(1);
3798	}
3799	if (unsupported) {
3800		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3801		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3802		       radio_manuf, radio_ver, radio_rev);
3803		return -EOPNOTSUPP;
3804	}
3805	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3806	       radio_manuf, radio_ver, radio_rev);
3807
3808	phy->radio_manuf = radio_manuf;
3809	phy->radio_ver = radio_ver;
3810	phy->radio_rev = radio_rev;
3811
3812	phy->analog = analog_type;
3813	phy->type = phy_type;
3814	phy->rev = phy_rev;
3815
3816	return 0;
3817}
3818
3819static void setup_struct_phy_for_init(struct b43_wldev *dev,
3820				      struct b43_phy *phy)
3821{
3822	struct b43_txpower_lo_control *lo;
3823	int i;
3824
3825	memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3826	memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3827
3828	phy->aci_enable = 0;
3829	phy->aci_wlan_automatic = 0;
3830	phy->aci_hw_rssi = 0;
3831
3832	phy->radio_off_context.valid = 0;
3833
3834	lo = phy->lo_control;
3835	if (lo) {
3836		memset(lo, 0, sizeof(*(phy->lo_control)));
3837		lo->tx_bias = 0xFF;
3838		INIT_LIST_HEAD(&lo->calib_list);
3839	}
3840	phy->max_lb_gain = 0;
3841	phy->trsw_rx_gain = 0;
3842	phy->txpwr_offset = 0;
3843
3844	/* NRSSI */
3845	phy->nrssislope = 0;
3846	for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3847		phy->nrssi[i] = -1000;
3848	for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3849		phy->nrssi_lt[i] = i;
3850
3851	phy->lofcal = 0xFFFF;
3852	phy->initval = 0xFFFF;
3853
3854	phy->interfmode = B43_INTERFMODE_NONE;
3855	phy->channel = 0xFF;
3856
3857	phy->hardware_power_control = !!modparam_hwpctl;
3858
3859	/* PHY TX errors counter. */
3860	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3861
3862	/* OFDM-table address caching. */
3863	phy->ofdmtab_addr_direction = B43_OFDMTAB_DIRECTION_UNKNOWN;
3864}
3865
3866static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3867{
3868	dev->dfq_valid = 0;
3869
3870	/* Assume the radio is enabled. If it's not enabled, the state will
3871	 * immediately get fixed on the first periodic work run. */
3872	dev->radio_hw_enable = 1;
3873
3874	/* Stats */
3875	memset(&dev->stats, 0, sizeof(dev->stats));
3876
3877	setup_struct_phy_for_init(dev, &dev->phy);
3878
3879	/* IRQ related flags */
3880	dev->irq_reason = 0;
3881	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3882	dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3883
3884	dev->mac_suspended = 1;
3885
3886	/* Noise calculation context */
3887	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3888}
3889
3890static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3891{
3892	struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3893	u64 hf;
3894
3895	if (!modparam_btcoex)
3896		return;
3897	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3898		return;
3899	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3900		return;
3901
3902	hf = b43_hf_read(dev);
3903	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3904		hf |= B43_HF_BTCOEXALT;
3905	else
3906		hf |= B43_HF_BTCOEX;
3907	b43_hf_write(dev, hf);
3908}
3909
3910static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3911{
3912	if (!modparam_btcoex)
3913		return;
3914	//TODO
3915}
3916
3917static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3918{
3919#ifdef CONFIG_SSB_DRIVER_PCICORE
3920	struct ssb_bus *bus = dev->dev->bus;
3921	u32 tmp;
3922
3923	if (bus->pcicore.dev &&
3924	    bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3925	    bus->pcicore.dev->id.revision <= 5) {
3926		/* IMCFGLO timeouts workaround. */
3927		tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3928		tmp &= ~SSB_IMCFGLO_REQTO;
3929		tmp &= ~SSB_IMCFGLO_SERTO;
3930		switch (bus->bustype) {
3931		case SSB_BUSTYPE_PCI:
3932		case SSB_BUSTYPE_PCMCIA:
3933			tmp |= 0x32;
3934			break;
3935		case SSB_BUSTYPE_SSB:
3936			tmp |= 0x53;
3937			break;
3938		}
3939		ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3940	}
3941#endif /* CONFIG_SSB_DRIVER_PCICORE */
3942}
3943
3944/* Write the short and long frame retry limit values. */
3945static void b43_set_retry_limits(struct b43_wldev *dev,
3946				 unsigned int short_retry,
3947				 unsigned int long_retry)
3948{
3949	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3950	 * the chip-internal counter. */
3951	short_retry = min(short_retry, (unsigned int)0xF);
3952	long_retry = min(long_retry, (unsigned int)0xF);
3953
3954	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3955			short_retry);
3956	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3957			long_retry);
3958}
3959
3960static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3961{
3962	u16 pu_delay;
3963
3964	/* The time value is in microseconds. */
3965	if (dev->phy.type == B43_PHYTYPE_A)
3966		pu_delay = 3700;
3967	else
3968		pu_delay = 1050;
3969	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS) || idle)
3970		pu_delay = 500;
3971	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3972		pu_delay = max(pu_delay, (u16)2400);
3973
3974	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3975}
3976
3977/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3978static void b43_set_pretbtt(struct b43_wldev *dev)
3979{
3980	u16 pretbtt;
3981
3982	/* The time value is in microseconds. */
3983	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS)) {
3984		pretbtt = 2;
3985	} else {
3986		if (dev->phy.type == B43_PHYTYPE_A)
3987			pretbtt = 120;
3988		else
3989			pretbtt = 250;
3990	}
3991	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3992	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3993}
3994
3995/* Shutdown a wireless core */
3996/* Locking: wl->mutex */
3997static void b43_wireless_core_exit(struct b43_wldev *dev)
3998{
3999	struct b43_phy *phy = &dev->phy;
4000	u32 macctl;
4001
4002	B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
4003	if (b43_status(dev) != B43_STAT_INITIALIZED)
4004		return;
4005	b43_set_status(dev, B43_STAT_UNINIT);
4006
4007	/* Stop the microcode PSM. */
4008	macctl = b43_read32(dev, B43_MMIO_MACCTL);
4009	macctl &= ~B43_MACCTL_PSM_RUN;
4010	macctl |= B43_MACCTL_PSM_JMP0;
4011	b43_write32(dev, B43_MMIO_MACCTL, macctl);
4012
4013	if (!dev->suspend_in_progress) {
4014		b43_leds_exit(dev);
4015		b43_rng_exit(dev->wl);
4016	}
4017	b43_dma_free(dev);
4018	b43_pio_free(dev);
4019	b43_chip_exit(dev);
4020	b43_radio_turn_off(dev, 1);
4021	b43_switch_analog(dev, 0);
4022	if (phy->dyn_tssi_tbl)
4023		kfree(phy->tssi2dbm);
4024	kfree(phy->lo_control);
4025	phy->lo_control = NULL;
4026	if (dev->wl->current_beacon) {
4027		dev_kfree_skb_any(dev->wl->current_beacon);
4028		dev->wl->current_beacon = NULL;
4029	}
4030
4031	ssb_device_disable(dev->dev, 0);
4032	ssb_bus_may_powerdown(dev->dev->bus);
4033}
4034
4035/* Initialize a wireless core */
4036static int b43_wireless_core_init(struct b43_wldev *dev)
4037{
4038	struct b43_wl *wl = dev->wl;
4039	struct ssb_bus *bus = dev->dev->bus;
4040	struct ssb_sprom *sprom = &bus->sprom;
4041	struct b43_phy *phy = &dev->phy;
4042	int err;
4043	u64 hf;
4044	u32 tmp;
4045
4046	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4047
4048	err = ssb_bus_powerup(bus, 0);
4049	if (err)
4050		goto out;
4051	if (!ssb_device_is_enabled(dev->dev)) {
4052		tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4053		b43_wireless_core_reset(dev, tmp);
4054	}
4055
4056	if ((phy->type == B43_PHYTYPE_B) || (phy->type == B43_PHYTYPE_G)) {
4057		phy->lo_control =
4058		    kzalloc(sizeof(*(phy->lo_control)), GFP_KERNEL);
4059		if (!phy->lo_control) {
4060			err = -ENOMEM;
4061			goto err_busdown;
4062		}
4063	}
4064	setup_struct_wldev_for_init(dev);
4065
4066	err = b43_phy_init_tssi2dbm_table(dev);
4067	if (err)
4068		goto err_kfree_lo_control;
4069
4070	/* Enable IRQ routing to this device. */
4071	ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4072
4073	b43_imcfglo_timeouts_workaround(dev);
4074	b43_bluetooth_coext_disable(dev);
4075	b43_phy_early_init(dev);
4076	err = b43_chip_init(dev);
4077	if (err)
4078		goto err_kfree_tssitbl;
4079	b43_shm_write16(dev, B43_SHM_SHARED,
4080			B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4081	hf = b43_hf_read(dev);
4082	if (phy->type == B43_PHYTYPE_G) {
4083		hf |= B43_HF_SYMW;
4084		if (phy->rev == 1)
4085			hf |= B43_HF_GDCW;
4086		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4087			hf |= B43_HF_OFDMPABOOST;
4088	} else if (phy->type == B43_PHYTYPE_B) {
4089		hf |= B43_HF_SYMW;
4090		if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4091			hf &= ~B43_HF_GDCW;
4092	}
4093	b43_hf_write(dev, hf);
4094
4095	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4096			     B43_DEFAULT_LONG_RETRY_LIMIT);
4097	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4098	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4099
4100	/* Disable sending probe responses from firmware.
4101	 * Setting the MaxTime to one usec will always trigger
4102	 * a timeout, so we never send any probe resp.
4103	 * A timeout of zero is infinite. */
4104	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4105
4106	b43_rate_memory_init(dev);
4107	b43_set_phytxctl_defaults(dev);
4108
4109	/* Minimum Contention Window */
4110	if (phy->type == B43_PHYTYPE_B) {
4111		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4112	} else {
4113		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4114	}
4115	/* Maximum Contention Window */
4116	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4117
4118	if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4119		dev->__using_pio_transfers = 1;
4120		err = b43_pio_init(dev);
4121	} else {
4122		dev->__using_pio_transfers = 0;
4123		err = b43_dma_init(dev);
4124	}
4125	if (err)
4126		goto err_chip_exit;
4127	b43_qos_init(dev);
4128	b43_set_synth_pu_delay(dev, 1);
4129	b43_bluetooth_coext_enable(dev);
4130
4131	ssb_bus_powerup(bus, 1);	/* Enable dynamic PCTL */
4132	b43_upload_card_macaddress(dev);
4133	b43_security_init(dev);
4134	if (!dev->suspend_in_progress)
4135		b43_rng_init(wl);
4136
4137	b43_set_status(dev, B43_STAT_INITIALIZED);
4138
4139	if (!dev->suspend_in_progress)
4140		b43_leds_init(dev);
4141out:
4142	return err;
4143
4144      err_chip_exit:
4145	b43_chip_exit(dev);
4146      err_kfree_tssitbl:
4147	if (phy->dyn_tssi_tbl)
4148		kfree(phy->tssi2dbm);
4149      err_kfree_lo_control:
4150	kfree(phy->lo_control);
4151	phy->lo_control = NULL;
4152      err_busdown:
4153	ssb_bus_may_powerdown(bus);
4154	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4155	return err;
4156}
4157
4158static int b43_op_add_interface(struct ieee80211_hw *hw,
4159				struct ieee80211_if_init_conf *conf)
4160{
4161	struct b43_wl *wl = hw_to_b43_wl(hw);
4162	struct b43_wldev *dev;
4163	unsigned long flags;
4164	int err = -EOPNOTSUPP;
4165
4166	/* TODO: allow WDS/AP devices to coexist */
4167
4168	if (conf->type != IEEE80211_IF_TYPE_AP &&
4169	    conf->type != IEEE80211_IF_TYPE_MESH_POINT &&
4170	    conf->type != IEEE80211_IF_TYPE_STA &&
4171	    conf->type != IEEE80211_IF_TYPE_WDS &&
4172	    conf->type != IEEE80211_IF_TYPE_IBSS)
4173		return -EOPNOTSUPP;
4174
4175	mutex_lock(&wl->mutex);
4176	if (wl->operating)
4177		goto out_mutex_unlock;
4178
4179	b43dbg(wl, "Adding Interface type %d\n", conf->type);
4180
4181	dev = wl->current_dev;
4182	wl->operating = 1;
4183	wl->vif = conf->vif;
4184	wl->if_type = conf->type;
4185	memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4186
4187	spin_lock_irqsave(&wl->irq_lock, flags);
4188	b43_adjust_opmode(dev);
4189	b43_set_pretbtt(dev);
4190	b43_set_synth_pu_delay(dev, 0);
4191	b43_upload_card_macaddress(dev);
4192	spin_unlock_irqrestore(&wl->irq_lock, flags);
4193
4194	err = 0;
4195 out_mutex_unlock:
4196	mutex_unlock(&wl->mutex);
4197
4198	return err;
4199}
4200
4201static void b43_op_remove_interface(struct ieee80211_hw *hw,
4202				    struct ieee80211_if_init_conf *conf)
4203{
4204	struct b43_wl *wl = hw_to_b43_wl(hw);
4205	struct b43_wldev *dev = wl->current_dev;
4206	unsigned long flags;
4207
4208	b43dbg(wl, "Removing Interface type %d\n", conf->type);
4209
4210	mutex_lock(&wl->mutex);
4211
4212	B43_WARN_ON(!wl->operating);
4213	B43_WARN_ON(wl->vif != conf->vif);
4214	wl->vif = NULL;
4215
4216	wl->operating = 0;
4217
4218	spin_lock_irqsave(&wl->irq_lock, flags);
4219	b43_adjust_opmode(dev);
4220	memset(wl->mac_addr, 0, ETH_ALEN);
4221	b43_upload_card_macaddress(dev);
4222	spin_unlock_irqrestore(&wl->irq_lock, flags);
4223
4224	mutex_unlock(&wl->mutex);
4225}
4226
4227static int b43_op_start(struct ieee80211_hw *hw)
4228{
4229	struct b43_wl *wl = hw_to_b43_wl(hw);
4230	struct b43_wldev *dev = wl->current_dev;
4231	int did_init = 0;
4232	int err = 0;
4233	bool do_rfkill_exit = 0;
4234
4235	/* Kill all old instance specific information to make sure
4236	 * the card won't use it in the short timeframe between start
4237	 * and mac80211 reconfiguring it. */
4238	memset(wl->bssid, 0, ETH_ALEN);
4239	memset(wl->mac_addr, 0, ETH_ALEN);
4240	wl->filter_flags = 0;
4241	wl->radiotap_enabled = 0;
4242	b43_qos_clear(wl);
4243	wl->beacon0_uploaded = 0;
4244	wl->beacon1_uploaded = 0;
4245	wl->beacon_templates_virgin = 1;
4246
4247	/* First register RFkill.
4248	 * LEDs that are registered later depend on it. */
4249	b43_rfkill_init(dev);
4250
4251	mutex_lock(&wl->mutex);
4252
4253	if (b43_status(dev) < B43_STAT_INITIALIZED) {
4254		err = b43_wireless_core_init(dev);
4255		if (err) {
4256			do_rfkill_exit = 1;
4257			goto out_mutex_unlock;
4258		}
4259		did_init = 1;
4260	}
4261
4262	if (b43_status(dev) < B43_STAT_STARTED) {
4263		err = b43_wireless_core_start(dev);
4264		if (err) {
4265			if (did_init)
4266				b43_wireless_core_exit(dev);
4267			do_rfkill_exit = 1;
4268			goto out_mutex_unlock;
4269		}
4270	}
4271
4272 out_mutex_unlock:
4273	mutex_unlock(&wl->mutex);
4274
4275	if (do_rfkill_exit)
4276		b43_rfkill_exit(dev);
4277
4278	return err;
4279}
4280
4281static void b43_op_stop(struct ieee80211_hw *hw)
4282{
4283	struct b43_wl *wl = hw_to_b43_wl(hw);
4284	struct b43_wldev *dev = wl->current_dev;
4285
4286	b43_rfkill_exit(dev);
4287	cancel_work_sync(&(wl->qos_update_work));
4288	cancel_work_sync(&(wl->beacon_update_trigger));
4289
4290	mutex_lock(&wl->mutex);
4291	if (b43_status(dev) >= B43_STAT_STARTED)
4292		b43_wireless_core_stop(dev);
4293	b43_wireless_core_exit(dev);
4294	mutex_unlock(&wl->mutex);
4295}
4296
4297static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
4298				  u32 short_retry_limit, u32 long_retry_limit)
4299{
4300	struct b43_wl *wl = hw_to_b43_wl(hw);
4301	struct b43_wldev *dev;
4302	int err = 0;
4303
4304	mutex_lock(&wl->mutex);
4305	dev = wl->current_dev;
4306	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
4307		err = -ENODEV;
4308		goto out_unlock;
4309	}
4310	b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
4311out_unlock:
4312	mutex_unlock(&wl->mutex);
4313
4314	return err;
4315}
4316
4317static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
4318{
4319	struct b43_wl *wl = hw_to_b43_wl(hw);
4320	unsigned long flags;
4321
4322	spin_lock_irqsave(&wl->irq_lock, flags);
4323	b43_update_templates(wl);
4324	spin_unlock_irqrestore(&wl->irq_lock, flags);
4325
4326	return 0;
4327}
4328
4329static void b43_op_sta_notify(struct ieee80211_hw *hw,
4330			      struct ieee80211_vif *vif,
4331			      enum sta_notify_cmd notify_cmd,
4332			      const u8 *addr)
4333{
4334	struct b43_wl *wl = hw_to_b43_wl(hw);
4335
4336	B43_WARN_ON(!vif || wl->vif != vif);
4337}
4338
4339static const struct ieee80211_ops b43_hw_ops = {
4340	.tx			= b43_op_tx,
4341	.conf_tx		= b43_op_conf_tx,
4342	.add_interface		= b43_op_add_interface,
4343	.remove_interface	= b43_op_remove_interface,
4344	.config			= b43_op_config,
4345	.config_interface	= b43_op_config_interface,
4346	.configure_filter	= b43_op_configure_filter,
4347	.set_key		= b43_op_set_key,
4348	.get_stats		= b43_op_get_stats,
4349	.get_tx_stats		= b43_op_get_tx_stats,
4350	.start			= b43_op_start,
4351	.stop			= b43_op_stop,
4352	.set_retry_limit	= b43_op_set_retry_limit,
4353	.set_tim		= b43_op_beacon_set_tim,
4354	.sta_notify		= b43_op_sta_notify,
4355};
4356
4357/* Hard-reset the chip. Do not call this directly.
4358 * Use b43_controller_restart()
4359 */
4360static void b43_chip_reset(struct work_struct *work)
4361{
4362	struct b43_wldev *dev =
4363	    container_of(work, struct b43_wldev, restart_work);
4364	struct b43_wl *wl = dev->wl;
4365	int err = 0;
4366	int prev_status;
4367
4368	mutex_lock(&wl->mutex);
4369
4370	prev_status = b43_status(dev);
4371	/* Bring the device down... */
4372	if (prev_status >= B43_STAT_STARTED)
4373		b43_wireless_core_stop(dev);
4374	if (prev_status >= B43_STAT_INITIALIZED)
4375		b43_wireless_core_exit(dev);
4376
4377	/* ...and up again. */
4378	if (prev_status >= B43_STAT_INITIALIZED) {
4379		err = b43_wireless_core_init(dev);
4380		if (err)
4381			goto out;
4382	}
4383	if (prev_status >= B43_STAT_STARTED) {
4384		err = b43_wireless_core_start(dev);
4385		if (err) {
4386			b43_wireless_core_exit(dev);
4387			goto out;
4388		}
4389	}
4390out:
4391	if (err)
4392		wl->current_dev = NULL; /* Failed to init the dev. */
4393	mutex_unlock(&wl->mutex);
4394	if (err)
4395		b43err(wl, "Controller restart FAILED\n");
4396	else
4397		b43info(wl, "Controller restarted\n");
4398}
4399
4400static int b43_setup_bands(struct b43_wldev *dev,
4401			   bool have_2ghz_phy, bool have_5ghz_phy)
4402{
4403	struct ieee80211_hw *hw = dev->wl->hw;
4404
4405	if (have_2ghz_phy)
4406		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4407	if (dev->phy.type == B43_PHYTYPE_N) {
4408		if (have_5ghz_phy)
4409			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4410	} else {
4411		if (have_5ghz_phy)
4412			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4413	}
4414
4415	dev->phy.supports_2ghz = have_2ghz_phy;
4416	dev->phy.supports_5ghz = have_5ghz_phy;
4417
4418	return 0;
4419}
4420
4421static void b43_wireless_core_detach(struct b43_wldev *dev)
4422{
4423	/* We release firmware that late to not be required to re-request
4424	 * is all the time when we reinit the core. */
4425	b43_release_firmware(dev);
4426}
4427
4428static int b43_wireless_core_attach(struct b43_wldev *dev)
4429{
4430	struct b43_wl *wl = dev->wl;
4431	struct ssb_bus *bus = dev->dev->bus;
4432	struct pci_dev *pdev = bus->host_pci;
4433	int err;
4434	bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4435	u32 tmp;
4436
4437	/* Do NOT do any device initialization here.
4438	 * Do it in wireless_core_init() instead.
4439	 * This function is for gathering basic information about the HW, only.
4440	 * Also some structs may be set up here. But most likely you want to have
4441	 * that in core_init(), too.
4442	 */
4443
4444	err = ssb_bus_powerup(bus, 0);
4445	if (err) {
4446		b43err(wl, "Bus powerup failed\n");
4447		goto out;
4448	}
4449	/* Get the PHY type. */
4450	if (dev->dev->id.revision >= 5) {
4451		u32 tmshigh;
4452
4453		tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4454		have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4455		have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4456	} else
4457		B43_WARN_ON(1);
4458
4459	dev->phy.gmode = have_2ghz_phy;
4460	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4461	b43_wireless_core_reset(dev, tmp);
4462
4463	err = b43_phy_versioning(dev);
4464	if (err)
4465		goto err_powerdown;
4466	/* Check if this device supports multiband. */
4467	if (!pdev ||
4468	    (pdev->device != 0x4312 &&
4469	     pdev->device != 0x4319 && pdev->device != 0x4324)) {
4470		/* No multiband support. */
4471		have_2ghz_phy = 0;
4472		have_5ghz_phy = 0;
4473		switch (dev->phy.type) {
4474		case B43_PHYTYPE_A:
4475			have_5ghz_phy = 1;
4476			break;
4477		case B43_PHYTYPE_G:
4478		case B43_PHYTYPE_N:
4479			have_2ghz_phy = 1;
4480			break;
4481		default:
4482			B43_WARN_ON(1);
4483		}
4484	}
4485	if (dev->phy.type == B43_PHYTYPE_A) {
4486		/* FIXME */
4487		b43err(wl, "IEEE 802.11a devices are unsupported\n");
4488		err = -EOPNOTSUPP;
4489		goto err_powerdown;
4490	}
4491	if (1 /* disable A-PHY */) {
4492		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4493		if (dev->phy.type != B43_PHYTYPE_N) {
4494			have_2ghz_phy = 1;
4495			have_5ghz_phy = 0;
4496		}
4497	}
4498
4499	dev->phy.gmode = have_2ghz_phy;
4500	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4501	b43_wireless_core_reset(dev, tmp);
4502
4503	err = b43_validate_chipaccess(dev);
4504	if (err)
4505		goto err_powerdown;
4506	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4507	if (err)
4508		goto err_powerdown;
4509
4510	/* Now set some default "current_dev" */
4511	if (!wl->current_dev)
4512		wl->current_dev = dev;
4513	INIT_WORK(&dev->restart_work, b43_chip_reset);
4514
4515	b43_radio_turn_off(dev, 1);
4516	b43_switch_analog(dev, 0);
4517	ssb_device_disable(dev->dev, 0);
4518	ssb_bus_may_powerdown(bus);
4519
4520out:
4521	return err;
4522
4523err_powerdown:
4524	ssb_bus_may_powerdown(bus);
4525	return err;
4526}
4527
4528static void b43_one_core_detach(struct ssb_device *dev)
4529{
4530	struct b43_wldev *wldev;
4531	struct b43_wl *wl;
4532
4533	/* Do not cancel ieee80211-workqueue based work here.
4534	 * See comment in b43_remove(). */
4535
4536	wldev = ssb_get_drvdata(dev);
4537	wl = wldev->wl;
4538	b43_debugfs_remove_device(wldev);
4539	b43_wireless_core_detach(wldev);
4540	list_del(&wldev->list);
4541	wl->nr_devs--;
4542	ssb_set_drvdata(dev, NULL);
4543	kfree(wldev);
4544}
4545
4546static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4547{
4548	struct b43_wldev *wldev;
4549	struct pci_dev *pdev;
4550	int err = -ENOMEM;
4551
4552	if (!list_empty(&wl->devlist)) {
4553		/* We are not the first core on this chip. */
4554		pdev = dev->bus->host_pci;
4555		/* Only special chips support more than one wireless
4556		 * core, although some of the other chips have more than
4557		 * one wireless core as well. Check for this and
4558		 * bail out early.
4559		 */
4560		if (!pdev ||
4561		    ((pdev->device != 0x4321) &&
4562		     (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4563			b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4564			return -ENODEV;
4565		}
4566	}
4567
4568	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4569	if (!wldev)
4570		goto out;
4571
4572	wldev->dev = dev;
4573	wldev->wl = wl;
4574	b43_set_status(wldev, B43_STAT_UNINIT);
4575	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4576	tasklet_init(&wldev->isr_tasklet,
4577		     (void (*)(unsigned long))b43_interrupt_tasklet,
4578		     (unsigned long)wldev);
4579	INIT_LIST_HEAD(&wldev->list);
4580
4581	err = b43_wireless_core_attach(wldev);
4582	if (err)
4583		goto err_kfree_wldev;
4584
4585	list_add(&wldev->list, &wl->devlist);
4586	wl->nr_devs++;
4587	ssb_set_drvdata(dev, wldev);
4588	b43_debugfs_add_device(wldev);
4589
4590      out:
4591	return err;
4592
4593      err_kfree_wldev:
4594	kfree(wldev);
4595	return err;
4596}
4597
4598#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
4599	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
4600	(pdev->device == _device) &&					\
4601	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
4602	(pdev->subsystem_device == _subdevice)				)
4603
4604static void b43_sprom_fixup(struct ssb_bus *bus)
4605{
4606	struct pci_dev *pdev;
4607
4608	/* boardflags workarounds */
4609	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4610	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4611		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4612	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4613	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4614		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4615	if (bus->bustype == SSB_BUSTYPE_PCI) {
4616		pdev = bus->host_pci;
4617		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4618		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4619		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
4620			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4621	}
4622}
4623
4624static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4625{
4626	struct ieee80211_hw *hw = wl->hw;
4627
4628	ssb_set_devtypedata(dev, NULL);
4629	ieee80211_free_hw(hw);
4630}
4631
4632static int b43_wireless_init(struct ssb_device *dev)
4633{
4634	struct ssb_sprom *sprom = &dev->bus->sprom;
4635	struct ieee80211_hw *hw;
4636	struct b43_wl *wl;
4637	int err = -ENOMEM;
4638
4639	b43_sprom_fixup(dev->bus);
4640
4641	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4642	if (!hw) {
4643		b43err(NULL, "Could not allocate ieee80211 device\n");
4644		goto out;
4645	}
4646
4647	/* fill hw info */
4648	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4649		    IEEE80211_HW_SIGNAL_DBM |
4650		    IEEE80211_HW_NOISE_DBM;
4651
4652	hw->queues = b43_modparam_qos ? 4 : 1;
4653	SET_IEEE80211_DEV(hw, dev->dev);
4654	if (is_valid_ether_addr(sprom->et1mac))
4655		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4656	else
4657		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4658
4659	/* Get and initialize struct b43_wl */
4660	wl = hw_to_b43_wl(hw);
4661	memset(wl, 0, sizeof(*wl));
4662	wl->hw = hw;
4663	spin_lock_init(&wl->irq_lock);
4664	rwlock_init(&wl->tx_lock);
4665	spin_lock_init(&wl->leds_lock);
4666	spin_lock_init(&wl->shm_lock);
4667	mutex_init(&wl->mutex);
4668	INIT_LIST_HEAD(&wl->devlist);
4669	INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
4670	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4671
4672	ssb_set_devtypedata(dev, wl);
4673	b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4674	err = 0;
4675      out:
4676	return err;
4677}
4678
4679static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4680{
4681	struct b43_wl *wl;
4682	int err;
4683	int first = 0;
4684
4685	wl = ssb_get_devtypedata(dev);
4686	if (!wl) {
4687		/* Probing the first core. Must setup common struct b43_wl */
4688		first = 1;
4689		err = b43_wireless_init(dev);
4690		if (err)
4691			goto out;
4692		wl = ssb_get_devtypedata(dev);
4693		B43_WARN_ON(!wl);
4694	}
4695	err = b43_one_core_attach(dev, wl);
4696	if (err)
4697		goto err_wireless_exit;
4698
4699	if (first) {
4700		err = ieee80211_register_hw(wl->hw);
4701		if (err)
4702			goto err_one_core_detach;
4703	}
4704
4705      out:
4706	return err;
4707
4708      err_one_core_detach:
4709	b43_one_core_detach(dev);
4710      err_wireless_exit:
4711	if (first)
4712		b43_wireless_exit(dev, wl);
4713	return err;
4714}
4715
4716static void b43_remove(struct ssb_device *dev)
4717{
4718	struct b43_wl *wl = ssb_get_devtypedata(dev);
4719	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4720
4721	/* We must cancel any work here before unregistering from ieee80211,
4722	 * as the ieee80211 unreg will destroy the workqueue. */
4723	cancel_work_sync(&wldev->restart_work);
4724
4725	B43_WARN_ON(!wl);
4726	if (wl->current_dev == wldev)
4727		ieee80211_unregister_hw(wl->hw);
4728
4729	b43_one_core_detach(dev);
4730
4731	if (list_empty(&wl->devlist)) {
4732		/* Last core on the chip unregistered.
4733		 * We can destroy common struct b43_wl.
4734		 */
4735		b43_wireless_exit(dev, wl);
4736	}
4737}
4738
4739/* Perform a hardware reset. This can be called from any context. */
4740void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4741{
4742	/* Must avoid requeueing, if we are in shutdown. */
4743	if (b43_status(dev) < B43_STAT_INITIALIZED)
4744		return;
4745	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4746	queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4747}
4748
4749#ifdef CONFIG_PM
4750
4751static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4752{
4753	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4754	struct b43_wl *wl = wldev->wl;
4755
4756	b43dbg(wl, "Suspending...\n");
4757
4758	mutex_lock(&wl->mutex);
4759	wldev->suspend_in_progress = true;
4760	wldev->suspend_init_status = b43_status(wldev);
4761	if (wldev->suspend_init_status >= B43_STAT_STARTED)
4762		b43_wireless_core_stop(wldev);
4763	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4764		b43_wireless_core_exit(wldev);
4765	mutex_unlock(&wl->mutex);
4766
4767	b43dbg(wl, "Device suspended.\n");
4768
4769	return 0;
4770}
4771
4772static int b43_resume(struct ssb_device *dev)
4773{
4774	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4775	struct b43_wl *wl = wldev->wl;
4776	int err = 0;
4777
4778	b43dbg(wl, "Resuming...\n");
4779
4780	mutex_lock(&wl->mutex);
4781	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4782		err = b43_wireless_core_init(wldev);
4783		if (err) {
4784			b43err(wl, "Resume failed at core init\n");
4785			goto out;
4786		}
4787	}
4788	if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4789		err = b43_wireless_core_start(wldev);
4790		if (err) {
4791			b43_leds_exit(wldev);
4792			b43_rng_exit(wldev->wl);
4793			b43_wireless_core_exit(wldev);
4794			b43err(wl, "Resume failed at core start\n");
4795			goto out;
4796		}
4797	}
4798	b43dbg(wl, "Device resumed.\n");
4799 out:
4800	wldev->suspend_in_progress = false;
4801	mutex_unlock(&wl->mutex);
4802	return err;
4803}
4804
4805#else /* CONFIG_PM */
4806# define b43_suspend	NULL
4807# define b43_resume	NULL
4808#endif /* CONFIG_PM */
4809
4810static struct ssb_driver b43_ssb_driver = {
4811	.name		= KBUILD_MODNAME,
4812	.id_table	= b43_ssb_tbl,
4813	.probe		= b43_probe,
4814	.remove		= b43_remove,
4815	.suspend	= b43_suspend,
4816	.resume		= b43_resume,
4817};
4818
4819static void b43_print_driverinfo(void)
4820{
4821	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4822		   *feat_leds = "", *feat_rfkill = "";
4823
4824#ifdef CONFIG_B43_PCI_AUTOSELECT
4825	feat_pci = "P";
4826#endif
4827#ifdef CONFIG_B43_PCMCIA
4828	feat_pcmcia = "M";
4829#endif
4830#ifdef CONFIG_B43_NPHY
4831	feat_nphy = "N";
4832#endif
4833#ifdef CONFIG_B43_LEDS
4834	feat_leds = "L";
4835#endif
4836#ifdef CONFIG_B43_RFKILL
4837	feat_rfkill = "R";
4838#endif
4839	printk(KERN_INFO "Broadcom 43xx driver loaded "
4840	       "[ Features: %s%s%s%s%s, Firmware-ID: "
4841	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
4842	       feat_pci, feat_pcmcia, feat_nphy,
4843	       feat_leds, feat_rfkill);
4844}
4845
4846static int __init b43_init(void)
4847{
4848	int err;
4849
4850	b43_debugfs_init();
4851	err = b43_pcmcia_init();
4852	if (err)
4853		goto err_dfs_exit;
4854	err = ssb_driver_register(&b43_ssb_driver);
4855	if (err)
4856		goto err_pcmcia_exit;
4857	b43_print_driverinfo();
4858
4859	return err;
4860
4861err_pcmcia_exit:
4862	b43_pcmcia_exit();
4863err_dfs_exit:
4864	b43_debugfs_exit();
4865	return err;
4866}
4867
4868static void __exit b43_exit(void)
4869{
4870	ssb_driver_unregister(&b43_ssb_driver);
4871	b43_pcmcia_exit();
4872	b43_debugfs_exit();
4873}
4874
4875module_init(b43_init)
4876module_exit(b43_exit)
4877