linux/drivers/net/wireless/b43legacy/main.c
<<
>>
Prefs
   1/*
   2 *
   3 *  Broadcom B43legacy wireless driver
   4 *
   5 *  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6 *  Copyright (c) 2005-2008 Stefano Brivio <stefano.brivio@polimi.it>
   7 *  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   8 *  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9 *  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10 *  Copyright (c) 2007 Larry Finger <Larry.Finger@lwfinger.net>
  11 *
  12 *  Some parts of the code in this file are derived from the ipw2200
  13 *  driver  Copyright(c) 2003 - 2004 Intel Corporation.
  14
  15 *  This program is free software; you can redistribute it and/or modify
  16 *  it under the terms of the GNU General Public License as published by
  17 *  the Free Software Foundation; either version 2 of the License, or
  18 *  (at your option) any later version.
  19 *
  20 *  This program is distributed in the hope that it will be useful,
  21 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  22 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23 *  GNU General Public License for more details.
  24 *
  25 *  You should have received a copy of the GNU General Public License
  26 *  along with this program; see the file COPYING.  If not, write to
  27 *  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  28 *  Boston, MA 02110-1301, USA.
  29 *
  30 */
  31
  32#include <linux/delay.h>
  33#include <linux/init.h>
  34#include <linux/moduleparam.h>
  35#include <linux/if_arp.h>
  36#include <linux/etherdevice.h>
  37#include <linux/firmware.h>
  38#include <linux/wireless.h>
  39#include <linux/workqueue.h>
  40#include <linux/skbuff.h>
  41#include <linux/dma-mapping.h>
  42#include <net/dst.h>
  43#include <asm/unaligned.h>
  44
  45#include "b43legacy.h"
  46#include "main.h"
  47#include "debugfs.h"
  48#include "phy.h"
  49#include "dma.h"
  50#include "pio.h"
  51#include "sysfs.h"
  52#include "xmit.h"
  53#include "radio.h"
  54
  55
  56MODULE_DESCRIPTION("Broadcom B43legacy wireless driver");
  57MODULE_AUTHOR("Martin Langer");
  58MODULE_AUTHOR("Stefano Brivio");
  59MODULE_AUTHOR("Michael Buesch");
  60MODULE_LICENSE("GPL");
  61
  62MODULE_FIRMWARE(B43legacy_SUPPORTED_FIRMWARE_ID);
  63
  64#if defined(CONFIG_B43LEGACY_DMA) && defined(CONFIG_B43LEGACY_PIO)
  65static int modparam_pio;
  66module_param_named(pio, modparam_pio, int, 0444);
  67MODULE_PARM_DESC(pio, "enable(1) / disable(0) PIO mode");
  68#elif defined(CONFIG_B43LEGACY_DMA)
  69# define modparam_pio   0
  70#elif defined(CONFIG_B43LEGACY_PIO)
  71# define modparam_pio   1
  72#endif
  73
  74static int modparam_bad_frames_preempt;
  75module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  76MODULE_PARM_DESC(bad_frames_preempt, "enable(1) / disable(0) Bad Frames"
  77                 " Preemption");
  78
  79static char modparam_fwpostfix[16];
  80module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  81MODULE_PARM_DESC(fwpostfix, "Postfix for the firmware files to load.");
  82
  83/* The following table supports BCM4301, BCM4303 and BCM4306/2 devices. */
  84static const struct ssb_device_id b43legacy_ssb_tbl[] = {
  85        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 2),
  86        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 4),
  87        SSB_DEVTABLE_END
  88};
  89MODULE_DEVICE_TABLE(ssb, b43legacy_ssb_tbl);
  90
  91
  92/* Channel and ratetables are shared for all devices.
  93 * They can't be const, because ieee80211 puts some precalculated
  94 * data in there. This data is the same for all devices, so we don't
  95 * get concurrency issues */
  96#define RATETAB_ENT(_rateid, _flags) \
  97        {                                                               \
  98                .bitrate        = B43legacy_RATE_TO_100KBPS(_rateid),   \
  99                .hw_value       = (_rateid),                            \
 100                .flags          = (_flags),                             \
 101        }
 102/*
 103 * NOTE: When changing this, sync with xmit.c's
 104 *       b43legacy_plcp_get_bitrate_idx_* functions!
 105 */
 106static struct ieee80211_rate __b43legacy_ratetable[] = {
 107        RATETAB_ENT(B43legacy_CCK_RATE_1MB, 0),
 108        RATETAB_ENT(B43legacy_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 109        RATETAB_ENT(B43legacy_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 110        RATETAB_ENT(B43legacy_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 111        RATETAB_ENT(B43legacy_OFDM_RATE_6MB, 0),
 112        RATETAB_ENT(B43legacy_OFDM_RATE_9MB, 0),
 113        RATETAB_ENT(B43legacy_OFDM_RATE_12MB, 0),
 114        RATETAB_ENT(B43legacy_OFDM_RATE_18MB, 0),
 115        RATETAB_ENT(B43legacy_OFDM_RATE_24MB, 0),
 116        RATETAB_ENT(B43legacy_OFDM_RATE_36MB, 0),
 117        RATETAB_ENT(B43legacy_OFDM_RATE_48MB, 0),
 118        RATETAB_ENT(B43legacy_OFDM_RATE_54MB, 0),
 119};
 120#define b43legacy_b_ratetable           (__b43legacy_ratetable + 0)
 121#define b43legacy_b_ratetable_size      4
 122#define b43legacy_g_ratetable           (__b43legacy_ratetable + 0)
 123#define b43legacy_g_ratetable_size      12
 124
 125#define CHANTAB_ENT(_chanid, _freq) \
 126        {                                                       \
 127                .center_freq    = (_freq),                      \
 128                .hw_value       = (_chanid),                    \
 129        }
 130static struct ieee80211_channel b43legacy_bg_chantable[] = {
 131        CHANTAB_ENT(1, 2412),
 132        CHANTAB_ENT(2, 2417),
 133        CHANTAB_ENT(3, 2422),
 134        CHANTAB_ENT(4, 2427),
 135        CHANTAB_ENT(5, 2432),
 136        CHANTAB_ENT(6, 2437),
 137        CHANTAB_ENT(7, 2442),
 138        CHANTAB_ENT(8, 2447),
 139        CHANTAB_ENT(9, 2452),
 140        CHANTAB_ENT(10, 2457),
 141        CHANTAB_ENT(11, 2462),
 142        CHANTAB_ENT(12, 2467),
 143        CHANTAB_ENT(13, 2472),
 144        CHANTAB_ENT(14, 2484),
 145};
 146
 147static struct ieee80211_supported_band b43legacy_band_2GHz_BPHY = {
 148        .channels = b43legacy_bg_chantable,
 149        .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
 150        .bitrates = b43legacy_b_ratetable,
 151        .n_bitrates = b43legacy_b_ratetable_size,
 152};
 153
 154static struct ieee80211_supported_band b43legacy_band_2GHz_GPHY = {
 155        .channels = b43legacy_bg_chantable,
 156        .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
 157        .bitrates = b43legacy_g_ratetable,
 158        .n_bitrates = b43legacy_g_ratetable_size,
 159};
 160
 161static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev);
 162static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev);
 163static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev);
 164static int b43legacy_wireless_core_start(struct b43legacy_wldev *dev);
 165
 166
 167static int b43legacy_ratelimit(struct b43legacy_wl *wl)
 168{
 169        if (!wl || !wl->current_dev)
 170                return 1;
 171        if (b43legacy_status(wl->current_dev) < B43legacy_STAT_STARTED)
 172                return 1;
 173        /* We are up and running.
 174         * Ratelimit the messages to avoid DoS over the net. */
 175        return net_ratelimit();
 176}
 177
 178void b43legacyinfo(struct b43legacy_wl *wl, const char *fmt, ...)
 179{
 180        va_list args;
 181
 182        if (!b43legacy_ratelimit(wl))
 183                return;
 184        va_start(args, fmt);
 185        printk(KERN_INFO "b43legacy-%s: ",
 186               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 187        vprintk(fmt, args);
 188        va_end(args);
 189}
 190
 191void b43legacyerr(struct b43legacy_wl *wl, const char *fmt, ...)
 192{
 193        va_list args;
 194
 195        if (!b43legacy_ratelimit(wl))
 196                return;
 197        va_start(args, fmt);
 198        printk(KERN_ERR "b43legacy-%s ERROR: ",
 199               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 200        vprintk(fmt, args);
 201        va_end(args);
 202}
 203
 204void b43legacywarn(struct b43legacy_wl *wl, const char *fmt, ...)
 205{
 206        va_list args;
 207
 208        if (!b43legacy_ratelimit(wl))
 209                return;
 210        va_start(args, fmt);
 211        printk(KERN_WARNING "b43legacy-%s warning: ",
 212               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 213        vprintk(fmt, args);
 214        va_end(args);
 215}
 216
 217#if B43legacy_DEBUG
 218void b43legacydbg(struct b43legacy_wl *wl, const char *fmt, ...)
 219{
 220        va_list args;
 221
 222        va_start(args, fmt);
 223        printk(KERN_DEBUG "b43legacy-%s debug: ",
 224               (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
 225        vprintk(fmt, args);
 226        va_end(args);
 227}
 228#endif /* DEBUG */
 229
 230static void b43legacy_ram_write(struct b43legacy_wldev *dev, u16 offset,
 231                                u32 val)
 232{
 233        u32 status;
 234
 235        B43legacy_WARN_ON(offset % 4 != 0);
 236
 237        status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
 238        if (status & B43legacy_MACCTL_BE)
 239                val = swab32(val);
 240
 241        b43legacy_write32(dev, B43legacy_MMIO_RAM_CONTROL, offset);
 242        mmiowb();
 243        b43legacy_write32(dev, B43legacy_MMIO_RAM_DATA, val);
 244}
 245
 246static inline
 247void b43legacy_shm_control_word(struct b43legacy_wldev *dev,
 248                                u16 routing, u16 offset)
 249{
 250        u32 control;
 251
 252        /* "offset" is the WORD offset. */
 253
 254        control = routing;
 255        control <<= 16;
 256        control |= offset;
 257        b43legacy_write32(dev, B43legacy_MMIO_SHM_CONTROL, control);
 258}
 259
 260u32 b43legacy_shm_read32(struct b43legacy_wldev *dev,
 261                       u16 routing, u16 offset)
 262{
 263        u32 ret;
 264
 265        if (routing == B43legacy_SHM_SHARED) {
 266                B43legacy_WARN_ON((offset & 0x0001) != 0);
 267                if (offset & 0x0003) {
 268                        /* Unaligned access */
 269                        b43legacy_shm_control_word(dev, routing, offset >> 2);
 270                        ret = b43legacy_read16(dev,
 271                                B43legacy_MMIO_SHM_DATA_UNALIGNED);
 272                        ret <<= 16;
 273                        b43legacy_shm_control_word(dev, routing,
 274                                                     (offset >> 2) + 1);
 275                        ret |= b43legacy_read16(dev, B43legacy_MMIO_SHM_DATA);
 276
 277                        return ret;
 278                }
 279                offset >>= 2;
 280        }
 281        b43legacy_shm_control_word(dev, routing, offset);
 282        ret = b43legacy_read32(dev, B43legacy_MMIO_SHM_DATA);
 283
 284        return ret;
 285}
 286
 287u16 b43legacy_shm_read16(struct b43legacy_wldev *dev,
 288                           u16 routing, u16 offset)
 289{
 290        u16 ret;
 291
 292        if (routing == B43legacy_SHM_SHARED) {
 293                B43legacy_WARN_ON((offset & 0x0001) != 0);
 294                if (offset & 0x0003) {
 295                        /* Unaligned access */
 296                        b43legacy_shm_control_word(dev, routing, offset >> 2);
 297                        ret = b43legacy_read16(dev,
 298                                             B43legacy_MMIO_SHM_DATA_UNALIGNED);
 299
 300                        return ret;
 301                }
 302                offset >>= 2;
 303        }
 304        b43legacy_shm_control_word(dev, routing, offset);
 305        ret = b43legacy_read16(dev, B43legacy_MMIO_SHM_DATA);
 306
 307        return ret;
 308}
 309
 310void b43legacy_shm_write32(struct b43legacy_wldev *dev,
 311                           u16 routing, u16 offset,
 312                           u32 value)
 313{
 314        if (routing == B43legacy_SHM_SHARED) {
 315                B43legacy_WARN_ON((offset & 0x0001) != 0);
 316                if (offset & 0x0003) {
 317                        /* Unaligned access */
 318                        b43legacy_shm_control_word(dev, routing, offset >> 2);
 319                        mmiowb();
 320                        b43legacy_write16(dev,
 321                                          B43legacy_MMIO_SHM_DATA_UNALIGNED,
 322                                          (value >> 16) & 0xffff);
 323                        mmiowb();
 324                        b43legacy_shm_control_word(dev, routing,
 325                                                   (offset >> 2) + 1);
 326                        mmiowb();
 327                        b43legacy_write16(dev, B43legacy_MMIO_SHM_DATA,
 328                                          value & 0xffff);
 329                        return;
 330                }
 331                offset >>= 2;
 332        }
 333        b43legacy_shm_control_word(dev, routing, offset);
 334        mmiowb();
 335        b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA, value);
 336}
 337
 338void b43legacy_shm_write16(struct b43legacy_wldev *dev, u16 routing, u16 offset,
 339                           u16 value)
 340{
 341        if (routing == B43legacy_SHM_SHARED) {
 342                B43legacy_WARN_ON((offset & 0x0001) != 0);
 343                if (offset & 0x0003) {
 344                        /* Unaligned access */
 345                        b43legacy_shm_control_word(dev, routing, offset >> 2);
 346                        mmiowb();
 347                        b43legacy_write16(dev,
 348                                          B43legacy_MMIO_SHM_DATA_UNALIGNED,
 349                                          value);
 350                        return;
 351                }
 352                offset >>= 2;
 353        }
 354        b43legacy_shm_control_word(dev, routing, offset);
 355        mmiowb();
 356        b43legacy_write16(dev, B43legacy_MMIO_SHM_DATA, value);
 357}
 358
 359/* Read HostFlags */
 360u32 b43legacy_hf_read(struct b43legacy_wldev *dev)
 361{
 362        u32 ret;
 363
 364        ret = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
 365                                   B43legacy_SHM_SH_HOSTFHI);
 366        ret <<= 16;
 367        ret |= b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
 368                                    B43legacy_SHM_SH_HOSTFLO);
 369
 370        return ret;
 371}
 372
 373/* Write HostFlags */
 374void b43legacy_hf_write(struct b43legacy_wldev *dev, u32 value)
 375{
 376        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
 377                              B43legacy_SHM_SH_HOSTFLO,
 378                              (value & 0x0000FFFF));
 379        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
 380                              B43legacy_SHM_SH_HOSTFHI,
 381                              ((value & 0xFFFF0000) >> 16));
 382}
 383
 384void b43legacy_tsf_read(struct b43legacy_wldev *dev, u64 *tsf)
 385{
 386        /* We need to be careful. As we read the TSF from multiple
 387         * registers, we should take care of register overflows.
 388         * In theory, the whole tsf read process should be atomic.
 389         * We try to be atomic here, by restaring the read process,
 390         * if any of the high registers changed (overflew).
 391         */
 392        if (dev->dev->id.revision >= 3) {
 393                u32 low;
 394                u32 high;
 395                u32 high2;
 396
 397                do {
 398                        high = b43legacy_read32(dev,
 399                                        B43legacy_MMIO_REV3PLUS_TSF_HIGH);
 400                        low = b43legacy_read32(dev,
 401                                        B43legacy_MMIO_REV3PLUS_TSF_LOW);
 402                        high2 = b43legacy_read32(dev,
 403                                        B43legacy_MMIO_REV3PLUS_TSF_HIGH);
 404                } while (unlikely(high != high2));
 405
 406                *tsf = high;
 407                *tsf <<= 32;
 408                *tsf |= low;
 409        } else {
 410                u64 tmp;
 411                u16 v0;
 412                u16 v1;
 413                u16 v2;
 414                u16 v3;
 415                u16 test1;
 416                u16 test2;
 417                u16 test3;
 418
 419                do {
 420                        v3 = b43legacy_read16(dev, B43legacy_MMIO_TSF_3);
 421                        v2 = b43legacy_read16(dev, B43legacy_MMIO_TSF_2);
 422                        v1 = b43legacy_read16(dev, B43legacy_MMIO_TSF_1);
 423                        v0 = b43legacy_read16(dev, B43legacy_MMIO_TSF_0);
 424
 425                        test3 = b43legacy_read16(dev, B43legacy_MMIO_TSF_3);
 426                        test2 = b43legacy_read16(dev, B43legacy_MMIO_TSF_2);
 427                        test1 = b43legacy_read16(dev, B43legacy_MMIO_TSF_1);
 428                } while (v3 != test3 || v2 != test2 || v1 != test1);
 429
 430                *tsf = v3;
 431                *tsf <<= 48;
 432                tmp = v2;
 433                tmp <<= 32;
 434                *tsf |= tmp;
 435                tmp = v1;
 436                tmp <<= 16;
 437                *tsf |= tmp;
 438                *tsf |= v0;
 439        }
 440}
 441
 442static void b43legacy_time_lock(struct b43legacy_wldev *dev)
 443{
 444        u32 status;
 445
 446        status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
 447        status |= B43legacy_MACCTL_TBTTHOLD;
 448        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, status);
 449        mmiowb();
 450}
 451
 452static void b43legacy_time_unlock(struct b43legacy_wldev *dev)
 453{
 454        u32 status;
 455
 456        status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
 457        status &= ~B43legacy_MACCTL_TBTTHOLD;
 458        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, status);
 459}
 460
 461static void b43legacy_tsf_write_locked(struct b43legacy_wldev *dev, u64 tsf)
 462{
 463        /* Be careful with the in-progress timer.
 464         * First zero out the low register, so we have a full
 465         * register-overflow duration to complete the operation.
 466         */
 467        if (dev->dev->id.revision >= 3) {
 468                u32 lo = (tsf & 0x00000000FFFFFFFFULL);
 469                u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
 470
 471                b43legacy_write32(dev, B43legacy_MMIO_REV3PLUS_TSF_LOW, 0);
 472                mmiowb();
 473                b43legacy_write32(dev, B43legacy_MMIO_REV3PLUS_TSF_HIGH,
 474                                    hi);
 475                mmiowb();
 476                b43legacy_write32(dev, B43legacy_MMIO_REV3PLUS_TSF_LOW,
 477                                    lo);
 478        } else {
 479                u16 v0 = (tsf & 0x000000000000FFFFULL);
 480                u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
 481                u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
 482                u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
 483
 484                b43legacy_write16(dev, B43legacy_MMIO_TSF_0, 0);
 485                mmiowb();
 486                b43legacy_write16(dev, B43legacy_MMIO_TSF_3, v3);
 487                mmiowb();
 488                b43legacy_write16(dev, B43legacy_MMIO_TSF_2, v2);
 489                mmiowb();
 490                b43legacy_write16(dev, B43legacy_MMIO_TSF_1, v1);
 491                mmiowb();
 492                b43legacy_write16(dev, B43legacy_MMIO_TSF_0, v0);
 493        }
 494}
 495
 496void b43legacy_tsf_write(struct b43legacy_wldev *dev, u64 tsf)
 497{
 498        b43legacy_time_lock(dev);
 499        b43legacy_tsf_write_locked(dev, tsf);
 500        b43legacy_time_unlock(dev);
 501}
 502
 503static
 504void b43legacy_macfilter_set(struct b43legacy_wldev *dev,
 505                             u16 offset, const u8 *mac)
 506{
 507        static const u8 zero_addr[ETH_ALEN] = { 0 };
 508        u16 data;
 509
 510        if (!mac)
 511                mac = zero_addr;
 512
 513        offset |= 0x0020;
 514        b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_CONTROL, offset);
 515
 516        data = mac[0];
 517        data |= mac[1] << 8;
 518        b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_DATA, data);
 519        data = mac[2];
 520        data |= mac[3] << 8;
 521        b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_DATA, data);
 522        data = mac[4];
 523        data |= mac[5] << 8;
 524        b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_DATA, data);
 525}
 526
 527static void b43legacy_write_mac_bssid_templates(struct b43legacy_wldev *dev)
 528{
 529        static const u8 zero_addr[ETH_ALEN] = { 0 };
 530        const u8 *mac = dev->wl->mac_addr;
 531        const u8 *bssid = dev->wl->bssid;
 532        u8 mac_bssid[ETH_ALEN * 2];
 533        int i;
 534        u32 tmp;
 535
 536        if (!bssid)
 537                bssid = zero_addr;
 538        if (!mac)
 539                mac = zero_addr;
 540
 541        b43legacy_macfilter_set(dev, B43legacy_MACFILTER_BSSID, bssid);
 542
 543        memcpy(mac_bssid, mac, ETH_ALEN);
 544        memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 545
 546        /* Write our MAC address and BSSID to template ram */
 547        for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 548                tmp =  (u32)(mac_bssid[i + 0]);
 549                tmp |= (u32)(mac_bssid[i + 1]) << 8;
 550                tmp |= (u32)(mac_bssid[i + 2]) << 16;
 551                tmp |= (u32)(mac_bssid[i + 3]) << 24;
 552                b43legacy_ram_write(dev, 0x20 + i, tmp);
 553                b43legacy_ram_write(dev, 0x78 + i, tmp);
 554                b43legacy_ram_write(dev, 0x478 + i, tmp);
 555        }
 556}
 557
 558static void b43legacy_upload_card_macaddress(struct b43legacy_wldev *dev)
 559{
 560        b43legacy_write_mac_bssid_templates(dev);
 561        b43legacy_macfilter_set(dev, B43legacy_MACFILTER_SELF,
 562                                dev->wl->mac_addr);
 563}
 564
 565static void b43legacy_set_slot_time(struct b43legacy_wldev *dev,
 566                                    u16 slot_time)
 567{
 568        /* slot_time is in usec. */
 569        if (dev->phy.type != B43legacy_PHYTYPE_G)
 570                return;
 571        b43legacy_write16(dev, 0x684, 510 + slot_time);
 572        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0010,
 573                              slot_time);
 574}
 575
 576static void b43legacy_short_slot_timing_enable(struct b43legacy_wldev *dev)
 577{
 578        b43legacy_set_slot_time(dev, 9);
 579}
 580
 581static void b43legacy_short_slot_timing_disable(struct b43legacy_wldev *dev)
 582{
 583        b43legacy_set_slot_time(dev, 20);
 584}
 585
 586/* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
 587 * Returns the _previously_ enabled IRQ mask.
 588 */
 589static inline u32 b43legacy_interrupt_enable(struct b43legacy_wldev *dev,
 590                                             u32 mask)
 591{
 592        u32 old_mask;
 593
 594        old_mask = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK);
 595        b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, old_mask |
 596                          mask);
 597
 598        return old_mask;
 599}
 600
 601/* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
 602 * Returns the _previously_ enabled IRQ mask.
 603 */
 604static inline u32 b43legacy_interrupt_disable(struct b43legacy_wldev *dev,
 605                                              u32 mask)
 606{
 607        u32 old_mask;
 608
 609        old_mask = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK);
 610        b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
 611
 612        return old_mask;
 613}
 614
 615/* Synchronize IRQ top- and bottom-half.
 616 * IRQs must be masked before calling this.
 617 * This must not be called with the irq_lock held.
 618 */
 619static void b43legacy_synchronize_irq(struct b43legacy_wldev *dev)
 620{
 621        synchronize_irq(dev->dev->irq);
 622        tasklet_kill(&dev->isr_tasklet);
 623}
 624
 625/* DummyTransmission function, as documented on
 626 * http://bcm-specs.sipsolutions.net/DummyTransmission
 627 */
 628void b43legacy_dummy_transmission(struct b43legacy_wldev *dev)
 629{
 630        struct b43legacy_phy *phy = &dev->phy;
 631        unsigned int i;
 632        unsigned int max_loop;
 633        u16 value;
 634        u32 buffer[5] = {
 635                0x00000000,
 636                0x00D40000,
 637                0x00000000,
 638                0x01000000,
 639                0x00000000,
 640        };
 641
 642        switch (phy->type) {
 643        case B43legacy_PHYTYPE_B:
 644        case B43legacy_PHYTYPE_G:
 645                max_loop = 0xFA;
 646                buffer[0] = 0x000B846E;
 647                break;
 648        default:
 649                B43legacy_BUG_ON(1);
 650                return;
 651        }
 652
 653        for (i = 0; i < 5; i++)
 654                b43legacy_ram_write(dev, i * 4, buffer[i]);
 655
 656        /* dummy read follows */
 657        b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
 658
 659        b43legacy_write16(dev, 0x0568, 0x0000);
 660        b43legacy_write16(dev, 0x07C0, 0x0000);
 661        b43legacy_write16(dev, 0x050C, 0x0000);
 662        b43legacy_write16(dev, 0x0508, 0x0000);
 663        b43legacy_write16(dev, 0x050A, 0x0000);
 664        b43legacy_write16(dev, 0x054C, 0x0000);
 665        b43legacy_write16(dev, 0x056A, 0x0014);
 666        b43legacy_write16(dev, 0x0568, 0x0826);
 667        b43legacy_write16(dev, 0x0500, 0x0000);
 668        b43legacy_write16(dev, 0x0502, 0x0030);
 669
 670        if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 671                b43legacy_radio_write16(dev, 0x0051, 0x0017);
 672        for (i = 0x00; i < max_loop; i++) {
 673                value = b43legacy_read16(dev, 0x050E);
 674                if (value & 0x0080)
 675                        break;
 676                udelay(10);
 677        }
 678        for (i = 0x00; i < 0x0A; i++) {
 679                value = b43legacy_read16(dev, 0x050E);
 680                if (value & 0x0400)
 681                        break;
 682                udelay(10);
 683        }
 684        for (i = 0x00; i < 0x0A; i++) {
 685                value = b43legacy_read16(dev, 0x0690);
 686                if (!(value & 0x0100))
 687                        break;
 688                udelay(10);
 689        }
 690        if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 691                b43legacy_radio_write16(dev, 0x0051, 0x0037);
 692}
 693
 694/* Turn the Analog ON/OFF */
 695static void b43legacy_switch_analog(struct b43legacy_wldev *dev, int on)
 696{
 697        b43legacy_write16(dev, B43legacy_MMIO_PHY0, on ? 0 : 0xF4);
 698}
 699
 700void b43legacy_wireless_core_reset(struct b43legacy_wldev *dev, u32 flags)
 701{
 702        u32 tmslow;
 703        u32 macctl;
 704
 705        flags |= B43legacy_TMSLOW_PHYCLKEN;
 706        flags |= B43legacy_TMSLOW_PHYRESET;
 707        ssb_device_enable(dev->dev, flags);
 708        msleep(2); /* Wait for the PLL to turn on. */
 709
 710        /* Now take the PHY out of Reset again */
 711        tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
 712        tmslow |= SSB_TMSLOW_FGC;
 713        tmslow &= ~B43legacy_TMSLOW_PHYRESET;
 714        ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
 715        ssb_read32(dev->dev, SSB_TMSLOW); /* flush */
 716        msleep(1);
 717        tmslow &= ~SSB_TMSLOW_FGC;
 718        ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
 719        ssb_read32(dev->dev, SSB_TMSLOW); /* flush */
 720        msleep(1);
 721
 722        /* Turn Analog ON */
 723        b43legacy_switch_analog(dev, 1);
 724
 725        macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
 726        macctl &= ~B43legacy_MACCTL_GMODE;
 727        if (flags & B43legacy_TMSLOW_GMODE) {
 728                macctl |= B43legacy_MACCTL_GMODE;
 729                dev->phy.gmode = 1;
 730        } else
 731                dev->phy.gmode = 0;
 732        macctl |= B43legacy_MACCTL_IHR_ENABLED;
 733        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
 734}
 735
 736static void handle_irq_transmit_status(struct b43legacy_wldev *dev)
 737{
 738        u32 v0;
 739        u32 v1;
 740        u16 tmp;
 741        struct b43legacy_txstatus stat;
 742
 743        while (1) {
 744                v0 = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_0);
 745                if (!(v0 & 0x00000001))
 746                        break;
 747                v1 = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_1);
 748
 749                stat.cookie = (v0 >> 16);
 750                stat.seq = (v1 & 0x0000FFFF);
 751                stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
 752                tmp = (v0 & 0x0000FFFF);
 753                stat.frame_count = ((tmp & 0xF000) >> 12);
 754                stat.rts_count = ((tmp & 0x0F00) >> 8);
 755                stat.supp_reason = ((tmp & 0x001C) >> 2);
 756                stat.pm_indicated = !!(tmp & 0x0080);
 757                stat.intermediate = !!(tmp & 0x0040);
 758                stat.for_ampdu = !!(tmp & 0x0020);
 759                stat.acked = !!(tmp & 0x0002);
 760
 761                b43legacy_handle_txstatus(dev, &stat);
 762        }
 763}
 764
 765static void drain_txstatus_queue(struct b43legacy_wldev *dev)
 766{
 767        u32 dummy;
 768
 769        if (dev->dev->id.revision < 5)
 770                return;
 771        /* Read all entries from the microcode TXstatus FIFO
 772         * and throw them away.
 773         */
 774        while (1) {
 775                dummy = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_0);
 776                if (!(dummy & 0x00000001))
 777                        break;
 778                dummy = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_1);
 779        }
 780}
 781
 782static u32 b43legacy_jssi_read(struct b43legacy_wldev *dev)
 783{
 784        u32 val = 0;
 785
 786        val = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED, 0x40A);
 787        val <<= 16;
 788        val |= b43legacy_shm_read16(dev, B43legacy_SHM_SHARED, 0x408);
 789
 790        return val;
 791}
 792
 793static void b43legacy_jssi_write(struct b43legacy_wldev *dev, u32 jssi)
 794{
 795        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x408,
 796                              (jssi & 0x0000FFFF));
 797        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x40A,
 798                              (jssi & 0xFFFF0000) >> 16);
 799}
 800
 801static void b43legacy_generate_noise_sample(struct b43legacy_wldev *dev)
 802{
 803        b43legacy_jssi_write(dev, 0x7F7F7F7F);
 804        b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
 805                          b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
 806                          | B43legacy_MACCMD_BGNOISE);
 807        B43legacy_WARN_ON(dev->noisecalc.channel_at_start !=
 808                            dev->phy.channel);
 809}
 810
 811static void b43legacy_calculate_link_quality(struct b43legacy_wldev *dev)
 812{
 813        /* Top half of Link Quality calculation. */
 814
 815        if (dev->noisecalc.calculation_running)
 816                return;
 817        dev->noisecalc.channel_at_start = dev->phy.channel;
 818        dev->noisecalc.calculation_running = 1;
 819        dev->noisecalc.nr_samples = 0;
 820
 821        b43legacy_generate_noise_sample(dev);
 822}
 823
 824static void handle_irq_noise(struct b43legacy_wldev *dev)
 825{
 826        struct b43legacy_phy *phy = &dev->phy;
 827        u16 tmp;
 828        u8 noise[4];
 829        u8 i;
 830        u8 j;
 831        s32 average;
 832
 833        /* Bottom half of Link Quality calculation. */
 834
 835        B43legacy_WARN_ON(!dev->noisecalc.calculation_running);
 836        if (dev->noisecalc.channel_at_start != phy->channel)
 837                goto drop_calculation;
 838        *((__le32 *)noise) = cpu_to_le32(b43legacy_jssi_read(dev));
 839        if (noise[0] == 0x7F || noise[1] == 0x7F ||
 840            noise[2] == 0x7F || noise[3] == 0x7F)
 841                goto generate_new;
 842
 843        /* Get the noise samples. */
 844        B43legacy_WARN_ON(dev->noisecalc.nr_samples >= 8);
 845        i = dev->noisecalc.nr_samples;
 846        noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
 847        noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
 848        noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
 849        noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
 850        dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
 851        dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
 852        dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
 853        dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
 854        dev->noisecalc.nr_samples++;
 855        if (dev->noisecalc.nr_samples == 8) {
 856                /* Calculate the Link Quality by the noise samples. */
 857                average = 0;
 858                for (i = 0; i < 8; i++) {
 859                        for (j = 0; j < 4; j++)
 860                                average += dev->noisecalc.samples[i][j];
 861                }
 862                average /= (8 * 4);
 863                average *= 125;
 864                average += 64;
 865                average /= 128;
 866                tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
 867                                             0x40C);
 868                tmp = (tmp / 128) & 0x1F;
 869                if (tmp >= 8)
 870                        average += 2;
 871                else
 872                        average -= 25;
 873                if (tmp == 8)
 874                        average -= 72;
 875                else
 876                        average -= 48;
 877
 878                dev->stats.link_noise = average;
 879drop_calculation:
 880                dev->noisecalc.calculation_running = 0;
 881                return;
 882        }
 883generate_new:
 884        b43legacy_generate_noise_sample(dev);
 885}
 886
 887static void handle_irq_tbtt_indication(struct b43legacy_wldev *dev)
 888{
 889        if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
 890                /* TODO: PS TBTT */
 891        } else {
 892                if (1/*FIXME: the last PSpoll frame was sent successfully */)
 893                        b43legacy_power_saving_ctl_bits(dev, -1, -1);
 894        }
 895        if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
 896                dev->dfq_valid = 1;
 897}
 898
 899static void handle_irq_atim_end(struct b43legacy_wldev *dev)
 900{
 901        if (dev->dfq_valid) {
 902                b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
 903                                  b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
 904                                  | B43legacy_MACCMD_DFQ_VALID);
 905                dev->dfq_valid = 0;
 906        }
 907}
 908
 909static void handle_irq_pmq(struct b43legacy_wldev *dev)
 910{
 911        u32 tmp;
 912
 913        /* TODO: AP mode. */
 914
 915        while (1) {
 916                tmp = b43legacy_read32(dev, B43legacy_MMIO_PS_STATUS);
 917                if (!(tmp & 0x00000008))
 918                        break;
 919        }
 920        /* 16bit write is odd, but correct. */
 921        b43legacy_write16(dev, B43legacy_MMIO_PS_STATUS, 0x0002);
 922}
 923
 924static void b43legacy_write_template_common(struct b43legacy_wldev *dev,
 925                                            const u8 *data, u16 size,
 926                                            u16 ram_offset,
 927                                            u16 shm_size_offset, u8 rate)
 928{
 929        u32 i;
 930        u32 tmp;
 931        struct b43legacy_plcp_hdr4 plcp;
 932
 933        plcp.data = 0;
 934        b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
 935        b43legacy_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
 936        ram_offset += sizeof(u32);
 937        /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
 938         * So leave the first two bytes of the next write blank.
 939         */
 940        tmp = (u32)(data[0]) << 16;
 941        tmp |= (u32)(data[1]) << 24;
 942        b43legacy_ram_write(dev, ram_offset, tmp);
 943        ram_offset += sizeof(u32);
 944        for (i = 2; i < size; i += sizeof(u32)) {
 945                tmp = (u32)(data[i + 0]);
 946                if (i + 1 < size)
 947                        tmp |= (u32)(data[i + 1]) << 8;
 948                if (i + 2 < size)
 949                        tmp |= (u32)(data[i + 2]) << 16;
 950                if (i + 3 < size)
 951                        tmp |= (u32)(data[i + 3]) << 24;
 952                b43legacy_ram_write(dev, ram_offset + i - 2, tmp);
 953        }
 954        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_size_offset,
 955                              size + sizeof(struct b43legacy_plcp_hdr6));
 956}
 957
 958static void b43legacy_write_beacon_template(struct b43legacy_wldev *dev,
 959                                            u16 ram_offset,
 960                                            u16 shm_size_offset, u8 rate)
 961{
 962
 963        unsigned int i, len, variable_len;
 964        const struct ieee80211_mgmt *bcn;
 965        const u8 *ie;
 966        bool tim_found = 0;
 967
 968        bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
 969        len = min((size_t)dev->wl->current_beacon->len,
 970                  0x200 - sizeof(struct b43legacy_plcp_hdr6));
 971
 972        b43legacy_write_template_common(dev, (const u8 *)bcn, len, ram_offset,
 973                                        shm_size_offset, rate);
 974
 975        /* Find the position of the TIM and the DTIM_period value
 976         * and write them to SHM. */
 977        ie = bcn->u.beacon.variable;
 978        variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
 979        for (i = 0; i < variable_len - 2; ) {
 980                uint8_t ie_id, ie_len;
 981
 982                ie_id = ie[i];
 983                ie_len = ie[i + 1];
 984                if (ie_id == 5) {
 985                        u16 tim_position;
 986                        u16 dtim_period;
 987                        /* This is the TIM Information Element */
 988
 989                        /* Check whether the ie_len is in the beacon data range. */
 990                        if (variable_len < ie_len + 2 + i)
 991                                break;
 992                        /* A valid TIM is at least 4 bytes long. */
 993                        if (ie_len < 4)
 994                                break;
 995                        tim_found = 1;
 996
 997                        tim_position = sizeof(struct b43legacy_plcp_hdr6);
 998                        tim_position += offsetof(struct ieee80211_mgmt,
 999                                                 u.beacon.variable);
1000                        tim_position += i;
1001
1002                        dtim_period = ie[i + 3];
1003
1004                        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
1005                                        B43legacy_SHM_SH_TIMPOS, tim_position);
1006                        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
1007                                        B43legacy_SHM_SH_DTIMP, dtim_period);
1008                        break;
1009                }
1010                i += ie_len + 2;
1011        }
1012        if (!tim_found) {
1013                b43legacywarn(dev->wl, "Did not find a valid TIM IE in the "
1014                              "beacon template packet. AP or IBSS operation "
1015                              "may be broken.\n");
1016        }
1017}
1018
1019static void b43legacy_write_probe_resp_plcp(struct b43legacy_wldev *dev,
1020                                            u16 shm_offset, u16 size,
1021                                            struct ieee80211_rate *rate)
1022{
1023        struct b43legacy_plcp_hdr4 plcp;
1024        u32 tmp;
1025        __le16 dur;
1026
1027        plcp.data = 0;
1028        b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->bitrate);
1029        dur = ieee80211_generic_frame_duration(dev->wl->hw,
1030                                               dev->wl->vif,
1031                                               size,
1032                                               rate);
1033        /* Write PLCP in two parts and timing for packet transfer */
1034        tmp = le32_to_cpu(plcp.data);
1035        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset,
1036                              tmp & 0xFFFF);
1037        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset + 2,
1038                              tmp >> 16);
1039        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset + 6,
1040                              le16_to_cpu(dur));
1041}
1042
1043/* Instead of using custom probe response template, this function
1044 * just patches custom beacon template by:
1045 * 1) Changing packet type
1046 * 2) Patching duration field
1047 * 3) Stripping TIM
1048 */
1049static const u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
1050                                               u16 *dest_size,
1051                                               struct ieee80211_rate *rate)
1052{
1053        const u8 *src_data;
1054        u8 *dest_data;
1055        u16 src_size, elem_size, src_pos, dest_pos;
1056        __le16 dur;
1057        struct ieee80211_hdr *hdr;
1058        size_t ie_start;
1059
1060        src_size = dev->wl->current_beacon->len;
1061        src_data = (const u8 *)dev->wl->current_beacon->data;
1062
1063        /* Get the start offset of the variable IEs in the packet. */
1064        ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1065        B43legacy_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt,
1066                                               u.beacon.variable));
1067
1068        if (B43legacy_WARN_ON(src_size < ie_start))
1069                return NULL;
1070
1071        dest_data = kmalloc(src_size, GFP_ATOMIC);
1072        if (unlikely(!dest_data))
1073                return NULL;
1074
1075        /* Copy the static data and all Information Elements, except the TIM. */
1076        memcpy(dest_data, src_data, ie_start);
1077        src_pos = ie_start;
1078        dest_pos = ie_start;
1079        for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1080                elem_size = src_data[src_pos + 1] + 2;
1081                if (src_data[src_pos] == 5) {
1082                        /* This is the TIM. */
1083                        continue;
1084                }
1085                memcpy(dest_data + dest_pos, src_data + src_pos, elem_size);
1086                dest_pos += elem_size;
1087        }
1088        *dest_size = dest_pos;
1089        hdr = (struct ieee80211_hdr *)dest_data;
1090
1091        /* Set the frame control. */
1092        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1093                                         IEEE80211_STYPE_PROBE_RESP);
1094        dur = ieee80211_generic_frame_duration(dev->wl->hw,
1095                                               dev->wl->vif,
1096                                               *dest_size,
1097                                               rate);
1098        hdr->duration_id = dur;
1099
1100        return dest_data;
1101}
1102
1103static void b43legacy_write_probe_resp_template(struct b43legacy_wldev *dev,
1104                                                u16 ram_offset,
1105                                                u16 shm_size_offset,
1106                                                struct ieee80211_rate *rate)
1107{
1108        const u8 *probe_resp_data;
1109        u16 size;
1110
1111        size = dev->wl->current_beacon->len;
1112        probe_resp_data = b43legacy_generate_probe_resp(dev, &size, rate);
1113        if (unlikely(!probe_resp_data))
1114                return;
1115
1116        /* Looks like PLCP headers plus packet timings are stored for
1117         * all possible basic rates
1118         */
1119        b43legacy_write_probe_resp_plcp(dev, 0x31A, size,
1120                                        &b43legacy_b_ratetable[0]);
1121        b43legacy_write_probe_resp_plcp(dev, 0x32C, size,
1122                                        &b43legacy_b_ratetable[1]);
1123        b43legacy_write_probe_resp_plcp(dev, 0x33E, size,
1124                                        &b43legacy_b_ratetable[2]);
1125        b43legacy_write_probe_resp_plcp(dev, 0x350, size,
1126                                        &b43legacy_b_ratetable[3]);
1127
1128        size = min((size_t)size,
1129                   0x200 - sizeof(struct b43legacy_plcp_hdr6));
1130        b43legacy_write_template_common(dev, probe_resp_data,
1131                                        size, ram_offset,
1132                                        shm_size_offset, rate->bitrate);
1133        kfree(probe_resp_data);
1134}
1135
1136/* Asynchronously update the packet templates in template RAM.
1137 * Locking: Requires wl->irq_lock to be locked. */
1138static void b43legacy_update_templates(struct b43legacy_wl *wl)
1139{
1140        struct sk_buff *beacon;
1141        /* This is the top half of the ansynchronous beacon update. The bottom
1142         * half is the beacon IRQ. Beacon update must be asynchronous to avoid
1143         * sending an invalid beacon. This can happen for example, if the
1144         * firmware transmits a beacon while we are updating it. */
1145
1146        /* We could modify the existing beacon and set the aid bit in the TIM
1147         * field, but that would probably require resizing and moving of data
1148         * within the beacon template. Simply request a new beacon and let
1149         * mac80211 do the hard work. */
1150        beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1151        if (unlikely(!beacon))
1152                return;
1153
1154        if (wl->current_beacon)
1155                dev_kfree_skb_any(wl->current_beacon);
1156        wl->current_beacon = beacon;
1157        wl->beacon0_uploaded = 0;
1158        wl->beacon1_uploaded = 0;
1159}
1160
1161static void b43legacy_set_beacon_int(struct b43legacy_wldev *dev,
1162                                     u16 beacon_int)
1163{
1164        b43legacy_time_lock(dev);
1165        if (dev->dev->id.revision >= 3)
1166                b43legacy_write32(dev, 0x188, (beacon_int << 16));
1167        else {
1168                b43legacy_write16(dev, 0x606, (beacon_int >> 6));
1169                b43legacy_write16(dev, 0x610, beacon_int);
1170        }
1171        b43legacy_time_unlock(dev);
1172}
1173
1174static void handle_irq_beacon(struct b43legacy_wldev *dev)
1175{
1176        struct b43legacy_wl *wl = dev->wl;
1177        u32 cmd;
1178
1179        if (!b43legacy_is_mode(wl, NL80211_IFTYPE_AP))
1180                return;
1181
1182        /* This is the bottom half of the asynchronous beacon update. */
1183
1184        cmd = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
1185        if (!(cmd & B43legacy_MACCMD_BEACON0_VALID)) {
1186                if (!wl->beacon0_uploaded) {
1187                        b43legacy_write_beacon_template(dev, 0x68,
1188                                                        B43legacy_SHM_SH_BTL0,
1189                                                        B43legacy_CCK_RATE_1MB);
1190                        b43legacy_write_probe_resp_template(dev, 0x268,
1191                                                            B43legacy_SHM_SH_PRTLEN,
1192                                                            &__b43legacy_ratetable[3]);
1193                        wl->beacon0_uploaded = 1;
1194                }
1195                cmd |= B43legacy_MACCMD_BEACON0_VALID;
1196        }
1197        if (!(cmd & B43legacy_MACCMD_BEACON1_VALID)) {
1198                if (!wl->beacon1_uploaded) {
1199                        b43legacy_write_beacon_template(dev, 0x468,
1200                                                        B43legacy_SHM_SH_BTL1,
1201                                                        B43legacy_CCK_RATE_1MB);
1202                        wl->beacon1_uploaded = 1;
1203                }
1204                cmd |= B43legacy_MACCMD_BEACON1_VALID;
1205        }
1206        b43legacy_write32(dev, B43legacy_MMIO_MACCMD, cmd);
1207}
1208
1209static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
1210{
1211}
1212
1213/* Interrupt handler bottom-half */
1214static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
1215{
1216        u32 reason;
1217        u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1218        u32 merged_dma_reason = 0;
1219        int i;
1220        unsigned long flags;
1221
1222        spin_lock_irqsave(&dev->wl->irq_lock, flags);
1223
1224        B43legacy_WARN_ON(b43legacy_status(dev) <
1225                          B43legacy_STAT_INITIALIZED);
1226
1227        reason = dev->irq_reason;
1228        for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1229                dma_reason[i] = dev->dma_reason[i];
1230                merged_dma_reason |= dma_reason[i];
1231        }
1232
1233        if (unlikely(reason & B43legacy_IRQ_MAC_TXERR))
1234                b43legacyerr(dev->wl, "MAC transmission error\n");
1235
1236        if (unlikely(reason & B43legacy_IRQ_PHY_TXERR)) {
1237                b43legacyerr(dev->wl, "PHY transmission error\n");
1238                rmb();
1239                if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1240                        b43legacyerr(dev->wl, "Too many PHY TX errors, "
1241                                              "restarting the controller\n");
1242                        b43legacy_controller_restart(dev, "PHY TX errors");
1243                }
1244        }
1245
1246        if (unlikely(merged_dma_reason & (B43legacy_DMAIRQ_FATALMASK |
1247                                          B43legacy_DMAIRQ_NONFATALMASK))) {
1248                if (merged_dma_reason & B43legacy_DMAIRQ_FATALMASK) {
1249                        b43legacyerr(dev->wl, "Fatal DMA error: "
1250                               "0x%08X, 0x%08X, 0x%08X, "
1251                               "0x%08X, 0x%08X, 0x%08X\n",
1252                               dma_reason[0], dma_reason[1],
1253                               dma_reason[2], dma_reason[3],
1254                               dma_reason[4], dma_reason[5]);
1255                        b43legacy_controller_restart(dev, "DMA error");
1256                        mmiowb();
1257                        spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1258                        return;
1259                }
1260                if (merged_dma_reason & B43legacy_DMAIRQ_NONFATALMASK)
1261                        b43legacyerr(dev->wl, "DMA error: "
1262                               "0x%08X, 0x%08X, 0x%08X, "
1263                               "0x%08X, 0x%08X, 0x%08X\n",
1264                               dma_reason[0], dma_reason[1],
1265                               dma_reason[2], dma_reason[3],
1266                               dma_reason[4], dma_reason[5]);
1267        }
1268
1269        if (unlikely(reason & B43legacy_IRQ_UCODE_DEBUG))
1270                handle_irq_ucode_debug(dev);
1271        if (reason & B43legacy_IRQ_TBTT_INDI)
1272                handle_irq_tbtt_indication(dev);
1273        if (reason & B43legacy_IRQ_ATIM_END)
1274                handle_irq_atim_end(dev);
1275        if (reason & B43legacy_IRQ_BEACON)
1276                handle_irq_beacon(dev);
1277        if (reason & B43legacy_IRQ_PMQ)
1278                handle_irq_pmq(dev);
1279        if (reason & B43legacy_IRQ_TXFIFO_FLUSH_OK)
1280                ;/*TODO*/
1281        if (reason & B43legacy_IRQ_NOISESAMPLE_OK)
1282                handle_irq_noise(dev);
1283
1284        /* Check the DMA reason registers for received data. */
1285        if (dma_reason[0] & B43legacy_DMAIRQ_RX_DONE) {
1286                if (b43legacy_using_pio(dev))
1287                        b43legacy_pio_rx(dev->pio.queue0);
1288                else
1289                        b43legacy_dma_rx(dev->dma.rx_ring0);
1290        }
1291        B43legacy_WARN_ON(dma_reason[1] & B43legacy_DMAIRQ_RX_DONE);
1292        B43legacy_WARN_ON(dma_reason[2] & B43legacy_DMAIRQ_RX_DONE);
1293        if (dma_reason[3] & B43legacy_DMAIRQ_RX_DONE) {
1294                if (b43legacy_using_pio(dev))
1295                        b43legacy_pio_rx(dev->pio.queue3);
1296                else
1297                        b43legacy_dma_rx(dev->dma.rx_ring3);
1298        }
1299        B43legacy_WARN_ON(dma_reason[4] & B43legacy_DMAIRQ_RX_DONE);
1300        B43legacy_WARN_ON(dma_reason[5] & B43legacy_DMAIRQ_RX_DONE);
1301
1302        if (reason & B43legacy_IRQ_TX_OK)
1303                handle_irq_transmit_status(dev);
1304
1305        b43legacy_interrupt_enable(dev, dev->irq_savedstate);
1306        mmiowb();
1307        spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1308}
1309
1310static void pio_irq_workaround(struct b43legacy_wldev *dev,
1311                               u16 base, int queueidx)
1312{
1313        u16 rxctl;
1314
1315        rxctl = b43legacy_read16(dev, base + B43legacy_PIO_RXCTL);
1316        if (rxctl & B43legacy_PIO_RXCTL_DATAAVAILABLE)
1317                dev->dma_reason[queueidx] |= B43legacy_DMAIRQ_RX_DONE;
1318        else
1319                dev->dma_reason[queueidx] &= ~B43legacy_DMAIRQ_RX_DONE;
1320}
1321
1322static void b43legacy_interrupt_ack(struct b43legacy_wldev *dev, u32 reason)
1323{
1324        if (b43legacy_using_pio(dev) &&
1325            (dev->dev->id.revision < 3) &&
1326            (!(reason & B43legacy_IRQ_PIO_WORKAROUND))) {
1327                /* Apply a PIO specific workaround to the dma_reasons */
1328                pio_irq_workaround(dev, B43legacy_MMIO_PIO1_BASE, 0);
1329                pio_irq_workaround(dev, B43legacy_MMIO_PIO2_BASE, 1);
1330                pio_irq_workaround(dev, B43legacy_MMIO_PIO3_BASE, 2);
1331                pio_irq_workaround(dev, B43legacy_MMIO_PIO4_BASE, 3);
1332        }
1333
1334        b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON, reason);
1335
1336        b43legacy_write32(dev, B43legacy_MMIO_DMA0_REASON,
1337                          dev->dma_reason[0]);
1338        b43legacy_write32(dev, B43legacy_MMIO_DMA1_REASON,
1339                          dev->dma_reason[1]);
1340        b43legacy_write32(dev, B43legacy_MMIO_DMA2_REASON,
1341                          dev->dma_reason[2]);
1342        b43legacy_write32(dev, B43legacy_MMIO_DMA3_REASON,
1343                          dev->dma_reason[3]);
1344        b43legacy_write32(dev, B43legacy_MMIO_DMA4_REASON,
1345                          dev->dma_reason[4]);
1346        b43legacy_write32(dev, B43legacy_MMIO_DMA5_REASON,
1347                          dev->dma_reason[5]);
1348}
1349
1350/* Interrupt handler top-half */
1351static irqreturn_t b43legacy_interrupt_handler(int irq, void *dev_id)
1352{
1353        irqreturn_t ret = IRQ_NONE;
1354        struct b43legacy_wldev *dev = dev_id;
1355        u32 reason;
1356
1357        if (!dev)
1358                return IRQ_NONE;
1359
1360        spin_lock(&dev->wl->irq_lock);
1361
1362        if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
1363                goto out;
1364        reason = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1365        if (reason == 0xffffffff) /* shared IRQ */
1366                goto out;
1367        ret = IRQ_HANDLED;
1368        reason &= b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK);
1369        if (!reason)
1370                goto out;
1371
1372        dev->dma_reason[0] = b43legacy_read32(dev,
1373                                              B43legacy_MMIO_DMA0_REASON)
1374                                              & 0x0001DC00;
1375        dev->dma_reason[1] = b43legacy_read32(dev,
1376                                              B43legacy_MMIO_DMA1_REASON)
1377                                              & 0x0000DC00;
1378        dev->dma_reason[2] = b43legacy_read32(dev,
1379                                              B43legacy_MMIO_DMA2_REASON)
1380                                              & 0x0000DC00;
1381        dev->dma_reason[3] = b43legacy_read32(dev,
1382                                              B43legacy_MMIO_DMA3_REASON)
1383                                              & 0x0001DC00;
1384        dev->dma_reason[4] = b43legacy_read32(dev,
1385                                              B43legacy_MMIO_DMA4_REASON)
1386                                              & 0x0000DC00;
1387        dev->dma_reason[5] = b43legacy_read32(dev,
1388                                              B43legacy_MMIO_DMA5_REASON)
1389                                              & 0x0000DC00;
1390
1391        b43legacy_interrupt_ack(dev, reason);
1392        /* disable all IRQs. They are enabled again in the bottom half. */
1393        dev->irq_savedstate = b43legacy_interrupt_disable(dev,
1394                                                          B43legacy_IRQ_ALL);
1395        /* save the reason code and call our bottom half. */
1396        dev->irq_reason = reason;
1397        tasklet_schedule(&dev->isr_tasklet);
1398out:
1399        mmiowb();
1400        spin_unlock(&dev->wl->irq_lock);
1401
1402        return ret;
1403}
1404
1405static void b43legacy_release_firmware(struct b43legacy_wldev *dev)
1406{
1407        release_firmware(dev->fw.ucode);
1408        dev->fw.ucode = NULL;
1409        release_firmware(dev->fw.pcm);
1410        dev->fw.pcm = NULL;
1411        release_firmware(dev->fw.initvals);
1412        dev->fw.initvals = NULL;
1413        release_firmware(dev->fw.initvals_band);
1414        dev->fw.initvals_band = NULL;
1415}
1416
1417static void b43legacy_print_fw_helptext(struct b43legacy_wl *wl)
1418{
1419        b43legacyerr(wl, "You must go to http://linuxwireless.org/en/users/"
1420                     "Drivers/b43#devicefirmware "
1421                     "and download the correct firmware (version 3).\n");
1422}
1423
1424static int do_request_fw(struct b43legacy_wldev *dev,
1425                         const char *name,
1426                         const struct firmware **fw)
1427{
1428        char path[sizeof(modparam_fwpostfix) + 32];
1429        struct b43legacy_fw_header *hdr;
1430        u32 size;
1431        int err;
1432
1433        if (!name)
1434                return 0;
1435
1436        snprintf(path, ARRAY_SIZE(path),
1437                 "b43legacy%s/%s.fw",
1438                 modparam_fwpostfix, name);
1439        err = request_firmware(fw, path, dev->dev->dev);
1440        if (err) {
1441                b43legacyerr(dev->wl, "Firmware file \"%s\" not found "
1442                       "or load failed.\n", path);
1443                return err;
1444        }
1445        if ((*fw)->size < sizeof(struct b43legacy_fw_header))
1446                goto err_format;
1447        hdr = (struct b43legacy_fw_header *)((*fw)->data);
1448        switch (hdr->type) {
1449        case B43legacy_FW_TYPE_UCODE:
1450        case B43legacy_FW_TYPE_PCM:
1451                size = be32_to_cpu(hdr->size);
1452                if (size != (*fw)->size - sizeof(struct b43legacy_fw_header))
1453                        goto err_format;
1454                /* fallthrough */
1455        case B43legacy_FW_TYPE_IV:
1456                if (hdr->ver != 1)
1457                        goto err_format;
1458                break;
1459        default:
1460                goto err_format;
1461        }
1462
1463        return err;
1464
1465err_format:
1466        b43legacyerr(dev->wl, "Firmware file \"%s\" format error.\n", path);
1467        return -EPROTO;
1468}
1469
1470static int b43legacy_request_firmware(struct b43legacy_wldev *dev)
1471{
1472        struct b43legacy_firmware *fw = &dev->fw;
1473        const u8 rev = dev->dev->id.revision;
1474        const char *filename;
1475        u32 tmshigh;
1476        int err;
1477
1478        tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
1479        if (!fw->ucode) {
1480                if (rev == 2)
1481                        filename = "ucode2";
1482                else if (rev == 4)
1483                        filename = "ucode4";
1484                else
1485                        filename = "ucode5";
1486                err = do_request_fw(dev, filename, &fw->ucode);
1487                if (err)
1488                        goto err_load;
1489        }
1490        if (!fw->pcm) {
1491                if (rev < 5)
1492                        filename = "pcm4";
1493                else
1494                        filename = "pcm5";
1495                err = do_request_fw(dev, filename, &fw->pcm);
1496                if (err)
1497                        goto err_load;
1498        }
1499        if (!fw->initvals) {
1500                switch (dev->phy.type) {
1501                case B43legacy_PHYTYPE_B:
1502                case B43legacy_PHYTYPE_G:
1503                        if ((rev >= 5) && (rev <= 10))
1504                                filename = "b0g0initvals5";
1505                        else if (rev == 2 || rev == 4)
1506                                filename = "b0g0initvals2";
1507                        else
1508                                goto err_no_initvals;
1509                        break;
1510                default:
1511                        goto err_no_initvals;
1512                }
1513                err = do_request_fw(dev, filename, &fw->initvals);
1514                if (err)
1515                        goto err_load;
1516        }
1517        if (!fw->initvals_band) {
1518                switch (dev->phy.type) {
1519                case B43legacy_PHYTYPE_B:
1520                case B43legacy_PHYTYPE_G:
1521                        if ((rev >= 5) && (rev <= 10))
1522                                filename = "b0g0bsinitvals5";
1523                        else if (rev >= 11)
1524                                filename = NULL;
1525                        else if (rev == 2 || rev == 4)
1526                                filename = NULL;
1527                        else
1528                                goto err_no_initvals;
1529                        break;
1530                default:
1531                        goto err_no_initvals;
1532                }
1533                err = do_request_fw(dev, filename, &fw->initvals_band);
1534                if (err)
1535                        goto err_load;
1536        }
1537
1538        return 0;
1539
1540err_load:
1541        b43legacy_print_fw_helptext(dev->wl);
1542        goto error;
1543
1544err_no_initvals:
1545        err = -ENODEV;
1546        b43legacyerr(dev->wl, "No Initial Values firmware file for PHY %u, "
1547               "core rev %u\n", dev->phy.type, rev);
1548        goto error;
1549
1550error:
1551        b43legacy_release_firmware(dev);
1552        return err;
1553}
1554
1555static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
1556{
1557        const size_t hdr_len = sizeof(struct b43legacy_fw_header);
1558        const __be32 *data;
1559        unsigned int i;
1560        unsigned int len;
1561        u16 fwrev;
1562        u16 fwpatch;
1563        u16 fwdate;
1564        u16 fwtime;
1565        u32 tmp, macctl;
1566        int err = 0;
1567
1568        /* Jump the microcode PSM to offset 0 */
1569        macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1570        B43legacy_WARN_ON(macctl & B43legacy_MACCTL_PSM_RUN);
1571        macctl |= B43legacy_MACCTL_PSM_JMP0;
1572        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
1573        /* Zero out all microcode PSM registers and shared memory. */
1574        for (i = 0; i < 64; i++)
1575                b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, i, 0);
1576        for (i = 0; i < 4096; i += 2)
1577                b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, i, 0);
1578
1579        /* Upload Microcode. */
1580        data = (__be32 *) (dev->fw.ucode->data + hdr_len);
1581        len = (dev->fw.ucode->size - hdr_len) / sizeof(__be32);
1582        b43legacy_shm_control_word(dev,
1583                                   B43legacy_SHM_UCODE |
1584                                   B43legacy_SHM_AUTOINC_W,
1585                                   0x0000);
1586        for (i = 0; i < len; i++) {
1587                b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA,
1588                                    be32_to_cpu(data[i]));
1589                udelay(10);
1590        }
1591
1592        if (dev->fw.pcm) {
1593                /* Upload PCM data. */
1594                data = (__be32 *) (dev->fw.pcm->data + hdr_len);
1595                len = (dev->fw.pcm->size - hdr_len) / sizeof(__be32);
1596                b43legacy_shm_control_word(dev, B43legacy_SHM_HW, 0x01EA);
1597                b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA, 0x00004000);
1598                /* No need for autoinc bit in SHM_HW */
1599                b43legacy_shm_control_word(dev, B43legacy_SHM_HW, 0x01EB);
1600                for (i = 0; i < len; i++) {
1601                        b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA,
1602                                          be32_to_cpu(data[i]));
1603                        udelay(10);
1604                }
1605        }
1606
1607        b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
1608                          B43legacy_IRQ_ALL);
1609
1610        /* Start the microcode PSM */
1611        macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1612        macctl &= ~B43legacy_MACCTL_PSM_JMP0;
1613        macctl |= B43legacy_MACCTL_PSM_RUN;
1614        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
1615
1616        /* Wait for the microcode to load and respond */
1617        i = 0;
1618        while (1) {
1619                tmp = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1620                if (tmp == B43legacy_IRQ_MAC_SUSPENDED)
1621                        break;
1622                i++;
1623                if (i >= B43legacy_IRQWAIT_MAX_RETRIES) {
1624                        b43legacyerr(dev->wl, "Microcode not responding\n");
1625                        b43legacy_print_fw_helptext(dev->wl);
1626                        err = -ENODEV;
1627                        goto error;
1628                }
1629                msleep_interruptible(50);
1630                if (signal_pending(current)) {
1631                        err = -EINTR;
1632                        goto error;
1633                }
1634        }
1635        /* dummy read follows */
1636        b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1637
1638        /* Get and check the revisions. */
1639        fwrev = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1640                                     B43legacy_SHM_SH_UCODEREV);
1641        fwpatch = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1642                                       B43legacy_SHM_SH_UCODEPATCH);
1643        fwdate = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1644                                      B43legacy_SHM_SH_UCODEDATE);
1645        fwtime = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1646                                      B43legacy_SHM_SH_UCODETIME);
1647
1648        if (fwrev > 0x128) {
1649                b43legacyerr(dev->wl, "YOU ARE TRYING TO LOAD V4 FIRMWARE."
1650                             " Only firmware from binary drivers version 3.x"
1651                             " is supported. You must change your firmware"
1652                             " files.\n");
1653                b43legacy_print_fw_helptext(dev->wl);
1654                err = -EOPNOTSUPP;
1655                goto error;
1656        }
1657        b43legacyinfo(dev->wl, "Loading firmware version 0x%X, patch level %u "
1658                      "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n", fwrev, fwpatch,
1659                      (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
1660                      (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F,
1661                      fwtime & 0x1F);
1662
1663        dev->fw.rev = fwrev;
1664        dev->fw.patch = fwpatch;
1665
1666        return 0;
1667
1668error:
1669        macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1670        macctl &= ~B43legacy_MACCTL_PSM_RUN;
1671        macctl |= B43legacy_MACCTL_PSM_JMP0;
1672        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
1673
1674        return err;
1675}
1676
1677static int b43legacy_write_initvals(struct b43legacy_wldev *dev,
1678                                    const struct b43legacy_iv *ivals,
1679                                    size_t count,
1680                                    size_t array_size)
1681{
1682        const struct b43legacy_iv *iv;
1683        u16 offset;
1684        size_t i;
1685        bool bit32;
1686
1687        BUILD_BUG_ON(sizeof(struct b43legacy_iv) != 6);
1688        iv = ivals;
1689        for (i = 0; i < count; i++) {
1690                if (array_size < sizeof(iv->offset_size))
1691                        goto err_format;
1692                array_size -= sizeof(iv->offset_size);
1693                offset = be16_to_cpu(iv->offset_size);
1694                bit32 = !!(offset & B43legacy_IV_32BIT);
1695                offset &= B43legacy_IV_OFFSET_MASK;
1696                if (offset >= 0x1000)
1697                        goto err_format;
1698                if (bit32) {
1699                        u32 value;
1700
1701                        if (array_size < sizeof(iv->data.d32))
1702                                goto err_format;
1703                        array_size -= sizeof(iv->data.d32);
1704
1705                        value = get_unaligned_be32(&iv->data.d32);
1706                        b43legacy_write32(dev, offset, value);
1707
1708                        iv = (const struct b43legacy_iv *)((const uint8_t *)iv +
1709                                                        sizeof(__be16) +
1710                                                        sizeof(__be32));
1711                } else {
1712                        u16 value;
1713
1714                        if (array_size < sizeof(iv->data.d16))
1715                                goto err_format;
1716                        array_size -= sizeof(iv->data.d16);
1717
1718                        value = be16_to_cpu(iv->data.d16);
1719                        b43legacy_write16(dev, offset, value);
1720
1721                        iv = (const struct b43legacy_iv *)((const uint8_t *)iv +
1722                                                        sizeof(__be16) +
1723                                                        sizeof(__be16));
1724                }
1725        }
1726        if (array_size)
1727                goto err_format;
1728
1729        return 0;
1730
1731err_format:
1732        b43legacyerr(dev->wl, "Initial Values Firmware file-format error.\n");
1733        b43legacy_print_fw_helptext(dev->wl);
1734
1735        return -EPROTO;
1736}
1737
1738static int b43legacy_upload_initvals(struct b43legacy_wldev *dev)
1739{
1740        const size_t hdr_len = sizeof(struct b43legacy_fw_header);
1741        const struct b43legacy_fw_header *hdr;
1742        struct b43legacy_firmware *fw = &dev->fw;
1743        const struct b43legacy_iv *ivals;
1744        size_t count;
1745        int err;
1746
1747        hdr = (const struct b43legacy_fw_header *)(fw->initvals->data);
1748        ivals = (const struct b43legacy_iv *)(fw->initvals->data + hdr_len);
1749        count = be32_to_cpu(hdr->size);
1750        err = b43legacy_write_initvals(dev, ivals, count,
1751                                 fw->initvals->size - hdr_len);
1752        if (err)
1753                goto out;
1754        if (fw->initvals_band) {
1755                hdr = (const struct b43legacy_fw_header *)
1756                      (fw->initvals_band->data);
1757                ivals = (const struct b43legacy_iv *)(fw->initvals_band->data
1758                        + hdr_len);
1759                count = be32_to_cpu(hdr->size);
1760                err = b43legacy_write_initvals(dev, ivals, count,
1761                                         fw->initvals_band->size - hdr_len);
1762                if (err)
1763                        goto out;
1764        }
1765out:
1766
1767        return err;
1768}
1769
1770/* Initialize the GPIOs
1771 * http://bcm-specs.sipsolutions.net/GPIO
1772 */
1773static int b43legacy_gpio_init(struct b43legacy_wldev *dev)
1774{
1775        struct ssb_bus *bus = dev->dev->bus;
1776        struct ssb_device *gpiodev, *pcidev = NULL;
1777        u32 mask;
1778        u32 set;
1779
1780        b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
1781                          b43legacy_read32(dev,
1782                          B43legacy_MMIO_MACCTL)
1783                          & 0xFFFF3FFF);
1784
1785        b43legacy_write16(dev, B43legacy_MMIO_GPIO_MASK,
1786                          b43legacy_read16(dev,
1787                          B43legacy_MMIO_GPIO_MASK)
1788                          | 0x000F);
1789
1790        mask = 0x0000001F;
1791        set = 0x0000000F;
1792        if (dev->dev->bus->chip_id == 0x4301) {
1793                mask |= 0x0060;
1794                set |= 0x0060;
1795        }
1796        if (dev->dev->bus->sprom.boardflags_lo & B43legacy_BFL_PACTRL) {
1797                b43legacy_write16(dev, B43legacy_MMIO_GPIO_MASK,
1798                                  b43legacy_read16(dev,
1799                                  B43legacy_MMIO_GPIO_MASK)
1800                                  | 0x0200);
1801                mask |= 0x0200;
1802                set |= 0x0200;
1803        }
1804        if (dev->dev->id.revision >= 2)
1805                mask  |= 0x0010; /* FIXME: This is redundant. */
1806
1807#ifdef CONFIG_SSB_DRIVER_PCICORE
1808        pcidev = bus->pcicore.dev;
1809#endif
1810        gpiodev = bus->chipco.dev ? : pcidev;
1811        if (!gpiodev)
1812                return 0;
1813        ssb_write32(gpiodev, B43legacy_GPIO_CONTROL,
1814                    (ssb_read32(gpiodev, B43legacy_GPIO_CONTROL)
1815                     & mask) | set);
1816
1817        return 0;
1818}
1819
1820/* Turn off all GPIO stuff. Call this on module unload, for example. */
1821static void b43legacy_gpio_cleanup(struct b43legacy_wldev *dev)
1822{
1823        struct ssb_bus *bus = dev->dev->bus;
1824        struct ssb_device *gpiodev, *pcidev = NULL;
1825
1826#ifdef CONFIG_SSB_DRIVER_PCICORE
1827        pcidev = bus->pcicore.dev;
1828#endif
1829        gpiodev = bus->chipco.dev ? : pcidev;
1830        if (!gpiodev)
1831                return;
1832        ssb_write32(gpiodev, B43legacy_GPIO_CONTROL, 0);
1833}
1834
1835/* http://bcm-specs.sipsolutions.net/EnableMac */
1836void b43legacy_mac_enable(struct b43legacy_wldev *dev)
1837{
1838        dev->mac_suspended--;
1839        B43legacy_WARN_ON(dev->mac_suspended < 0);
1840        B43legacy_WARN_ON(irqs_disabled());
1841        if (dev->mac_suspended == 0) {
1842                b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
1843                                  b43legacy_read32(dev,
1844                                  B43legacy_MMIO_MACCTL)
1845                                  | B43legacy_MACCTL_ENABLED);
1846                b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
1847                                  B43legacy_IRQ_MAC_SUSPENDED);
1848                /* the next two are dummy reads */
1849                b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1850                b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1851                b43legacy_power_saving_ctl_bits(dev, -1, -1);
1852
1853                /* Re-enable IRQs. */
1854                spin_lock_irq(&dev->wl->irq_lock);
1855                b43legacy_interrupt_enable(dev, dev->irq_savedstate);
1856                spin_unlock_irq(&dev->wl->irq_lock);
1857        }
1858}
1859
1860/* http://bcm-specs.sipsolutions.net/SuspendMAC */
1861void b43legacy_mac_suspend(struct b43legacy_wldev *dev)
1862{
1863        int i;
1864        u32 tmp;
1865
1866        might_sleep();
1867        B43legacy_WARN_ON(irqs_disabled());
1868        B43legacy_WARN_ON(dev->mac_suspended < 0);
1869
1870        if (dev->mac_suspended == 0) {
1871                /* Mask IRQs before suspending MAC. Otherwise
1872                 * the MAC stays busy and won't suspend. */
1873                spin_lock_irq(&dev->wl->irq_lock);
1874                tmp = b43legacy_interrupt_disable(dev, B43legacy_IRQ_ALL);
1875                spin_unlock_irq(&dev->wl->irq_lock);
1876                b43legacy_synchronize_irq(dev);
1877                dev->irq_savedstate = tmp;
1878
1879                b43legacy_power_saving_ctl_bits(dev, -1, 1);
1880                b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
1881                                  b43legacy_read32(dev,
1882                                  B43legacy_MMIO_MACCTL)
1883                                  & ~B43legacy_MACCTL_ENABLED);
1884                b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1885                for (i = 40; i; i--) {
1886                        tmp = b43legacy_read32(dev,
1887                                               B43legacy_MMIO_GEN_IRQ_REASON);
1888                        if (tmp & B43legacy_IRQ_MAC_SUSPENDED)
1889                                goto out;
1890                        msleep(1);
1891                }
1892                b43legacyerr(dev->wl, "MAC suspend failed\n");
1893        }
1894out:
1895        dev->mac_suspended++;
1896}
1897
1898static void b43legacy_adjust_opmode(struct b43legacy_wldev *dev)
1899{
1900        struct b43legacy_wl *wl = dev->wl;
1901        u32 ctl;
1902        u16 cfp_pretbtt;
1903
1904        ctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1905        /* Reset status to STA infrastructure mode. */
1906        ctl &= ~B43legacy_MACCTL_AP;
1907        ctl &= ~B43legacy_MACCTL_KEEP_CTL;
1908        ctl &= ~B43legacy_MACCTL_KEEP_BADPLCP;
1909        ctl &= ~B43legacy_MACCTL_KEEP_BAD;
1910        ctl &= ~B43legacy_MACCTL_PROMISC;
1911        ctl &= ~B43legacy_MACCTL_BEACPROMISC;
1912        ctl |= B43legacy_MACCTL_INFRA;
1913
1914        if (b43legacy_is_mode(wl, NL80211_IFTYPE_AP))
1915                ctl |= B43legacy_MACCTL_AP;
1916        else if (b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC))
1917                ctl &= ~B43legacy_MACCTL_INFRA;
1918
1919        if (wl->filter_flags & FIF_CONTROL)
1920                ctl |= B43legacy_MACCTL_KEEP_CTL;
1921        if (wl->filter_flags & FIF_FCSFAIL)
1922                ctl |= B43legacy_MACCTL_KEEP_BAD;
1923        if (wl->filter_flags & FIF_PLCPFAIL)
1924                ctl |= B43legacy_MACCTL_KEEP_BADPLCP;
1925        if (wl->filter_flags & FIF_PROMISC_IN_BSS)
1926                ctl |= B43legacy_MACCTL_PROMISC;
1927        if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
1928                ctl |= B43legacy_MACCTL_BEACPROMISC;
1929
1930        /* Workaround: On old hardware the HW-MAC-address-filter
1931         * doesn't work properly, so always run promisc in filter
1932         * it in software. */
1933        if (dev->dev->id.revision <= 4)
1934                ctl |= B43legacy_MACCTL_PROMISC;
1935
1936        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, ctl);
1937
1938        cfp_pretbtt = 2;
1939        if ((ctl & B43legacy_MACCTL_INFRA) &&
1940            !(ctl & B43legacy_MACCTL_AP)) {
1941                if (dev->dev->bus->chip_id == 0x4306 &&
1942                    dev->dev->bus->chip_rev == 3)
1943                        cfp_pretbtt = 100;
1944                else
1945                        cfp_pretbtt = 50;
1946        }
1947        b43legacy_write16(dev, 0x612, cfp_pretbtt);
1948}
1949
1950static void b43legacy_rate_memory_write(struct b43legacy_wldev *dev,
1951                                        u16 rate,
1952                                        int is_ofdm)
1953{
1954        u16 offset;
1955
1956        if (is_ofdm) {
1957                offset = 0x480;
1958                offset += (b43legacy_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
1959        } else {
1960                offset = 0x4C0;
1961                offset += (b43legacy_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
1962        }
1963        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, offset + 0x20,
1964                              b43legacy_shm_read16(dev,
1965                              B43legacy_SHM_SHARED, offset));
1966}
1967
1968static void b43legacy_rate_memory_init(struct b43legacy_wldev *dev)
1969{
1970        switch (dev->phy.type) {
1971        case B43legacy_PHYTYPE_G:
1972                b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_6MB, 1);
1973                b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_12MB, 1);
1974                b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_18MB, 1);
1975                b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_24MB, 1);
1976                b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_36MB, 1);
1977                b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_48MB, 1);
1978                b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_54MB, 1);
1979                /* fallthrough */
1980        case B43legacy_PHYTYPE_B:
1981                b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_1MB, 0);
1982                b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_2MB, 0);
1983                b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_5MB, 0);
1984                b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_11MB, 0);
1985                break;
1986        default:
1987                B43legacy_BUG_ON(1);
1988        }
1989}
1990
1991/* Set the TX-Antenna for management frames sent by firmware. */
1992static void b43legacy_mgmtframe_txantenna(struct b43legacy_wldev *dev,
1993                                          int antenna)
1994{
1995        u16 ant = 0;
1996        u16 tmp;
1997
1998        switch (antenna) {
1999        case B43legacy_ANTENNA0:
2000                ant |= B43legacy_TX4_PHY_ANT0;
2001                break;
2002        case B43legacy_ANTENNA1:
2003                ant |= B43legacy_TX4_PHY_ANT1;
2004                break;
2005        case B43legacy_ANTENNA_AUTO:
2006                ant |= B43legacy_TX4_PHY_ANTLAST;
2007                break;
2008        default:
2009                B43legacy_BUG_ON(1);
2010        }
2011
2012        /* FIXME We also need to set the other flags of the PHY control
2013         * field somewhere. */
2014
2015        /* For Beacons */
2016        tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2017                                   B43legacy_SHM_SH_BEACPHYCTL);
2018        tmp = (tmp & ~B43legacy_TX4_PHY_ANT) | ant;
2019        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2020                              B43legacy_SHM_SH_BEACPHYCTL, tmp);
2021        /* For ACK/CTS */
2022        tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2023                                   B43legacy_SHM_SH_ACKCTSPHYCTL);
2024        tmp = (tmp & ~B43legacy_TX4_PHY_ANT) | ant;
2025        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2026                              B43legacy_SHM_SH_ACKCTSPHYCTL, tmp);
2027        /* For Probe Resposes */
2028        tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2029                                   B43legacy_SHM_SH_PRPHYCTL);
2030        tmp = (tmp & ~B43legacy_TX4_PHY_ANT) | ant;
2031        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2032                              B43legacy_SHM_SH_PRPHYCTL, tmp);
2033}
2034
2035/* This is the opposite of b43legacy_chip_init() */
2036static void b43legacy_chip_exit(struct b43legacy_wldev *dev)
2037{
2038        b43legacy_radio_turn_off(dev, 1);
2039        b43legacy_gpio_cleanup(dev);
2040        /* firmware is released later */
2041}
2042
2043/* Initialize the chip
2044 * http://bcm-specs.sipsolutions.net/ChipInit
2045 */
2046static int b43legacy_chip_init(struct b43legacy_wldev *dev)
2047{
2048        struct b43legacy_phy *phy = &dev->phy;
2049        int err;
2050        int tmp;
2051        u32 value32, macctl;
2052        u16 value16;
2053
2054        /* Initialize the MAC control */
2055        macctl = B43legacy_MACCTL_IHR_ENABLED | B43legacy_MACCTL_SHM_ENABLED;
2056        if (dev->phy.gmode)
2057                macctl |= B43legacy_MACCTL_GMODE;
2058        macctl |= B43legacy_MACCTL_INFRA;
2059        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
2060
2061        err = b43legacy_request_firmware(dev);
2062        if (err)
2063                goto out;
2064        err = b43legacy_upload_microcode(dev);
2065        if (err)
2066                goto out; /* firmware is released later */
2067
2068        err = b43legacy_gpio_init(dev);
2069        if (err)
2070                goto out; /* firmware is released later */
2071
2072        err = b43legacy_upload_initvals(dev);
2073        if (err)
2074                goto err_gpio_clean;
2075        b43legacy_radio_turn_on(dev);
2076
2077        b43legacy_write16(dev, 0x03E6, 0x0000);
2078        err = b43legacy_phy_init(dev);
2079        if (err)
2080                goto err_radio_off;
2081
2082        /* Select initial Interference Mitigation. */
2083        tmp = phy->interfmode;
2084        phy->interfmode = B43legacy_INTERFMODE_NONE;
2085        b43legacy_radio_set_interference_mitigation(dev, tmp);
2086
2087        b43legacy_phy_set_antenna_diversity(dev);
2088        b43legacy_mgmtframe_txantenna(dev, B43legacy_ANTENNA_DEFAULT);
2089
2090        if (phy->type == B43legacy_PHYTYPE_B) {
2091                value16 = b43legacy_read16(dev, 0x005E);
2092                value16 |= 0x0004;
2093                b43legacy_write16(dev, 0x005E, value16);
2094        }
2095        b43legacy_write32(dev, 0x0100, 0x01000000);
2096        if (dev->dev->id.revision < 5)
2097                b43legacy_write32(dev, 0x010C, 0x01000000);
2098
2099        value32 = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
2100        value32 &= ~B43legacy_MACCTL_INFRA;
2101        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, value32);
2102        value32 = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
2103        value32 |= B43legacy_MACCTL_INFRA;
2104        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, value32);
2105
2106        if (b43legacy_using_pio(dev)) {
2107                b43legacy_write32(dev, 0x0210, 0x00000100);
2108                b43legacy_write32(dev, 0x0230, 0x00000100);
2109                b43legacy_write32(dev, 0x0250, 0x00000100);
2110                b43legacy_write32(dev, 0x0270, 0x00000100);
2111                b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0034,
2112                                      0x0000);
2113        }
2114
2115        /* Probe Response Timeout value */
2116        /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2117        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0074, 0x0000);
2118
2119        /* Initially set the wireless operation mode. */
2120        b43legacy_adjust_opmode(dev);
2121
2122        if (dev->dev->id.revision < 3) {
2123                b43legacy_write16(dev, 0x060E, 0x0000);
2124                b43legacy_write16(dev, 0x0610, 0x8000);
2125                b43legacy_write16(dev, 0x0604, 0x0000);
2126                b43legacy_write16(dev, 0x0606, 0x0200);
2127        } else {
2128                b43legacy_write32(dev, 0x0188, 0x80000000);
2129                b43legacy_write32(dev, 0x018C, 0x02000000);
2130        }
2131        b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON, 0x00004000);
2132        b43legacy_write32(dev, B43legacy_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2133        b43legacy_write32(dev, B43legacy_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2134        b43legacy_write32(dev, B43legacy_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2135        b43legacy_write32(dev, B43legacy_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2136        b43legacy_write32(dev, B43legacy_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2137        b43legacy_write32(dev, B43legacy_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2138
2139        value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2140        value32 |= 0x00100000;
2141        ssb_write32(dev->dev, SSB_TMSLOW, value32);
2142
2143        b43legacy_write16(dev, B43legacy_MMIO_POWERUP_DELAY,
2144                          dev->dev->bus->chipco.fast_pwrup_delay);
2145
2146        /* PHY TX errors counter. */
2147        atomic_set(&phy->txerr_cnt, B43legacy_PHY_TX_BADNESS_LIMIT);
2148
2149        B43legacy_WARN_ON(err != 0);
2150        b43legacydbg(dev->wl, "Chip initialized\n");
2151out:
2152        return err;
2153
2154err_radio_off:
2155        b43legacy_radio_turn_off(dev, 1);
2156err_gpio_clean:
2157        b43legacy_gpio_cleanup(dev);
2158        goto out;
2159}
2160
2161static void b43legacy_periodic_every120sec(struct b43legacy_wldev *dev)
2162{
2163        struct b43legacy_phy *phy = &dev->phy;
2164
2165        if (phy->type != B43legacy_PHYTYPE_G || phy->rev < 2)
2166                return;
2167
2168        b43legacy_mac_suspend(dev);
2169        b43legacy_phy_lo_g_measure(dev);
2170        b43legacy_mac_enable(dev);
2171}
2172
2173static void b43legacy_periodic_every60sec(struct b43legacy_wldev *dev)
2174{
2175        b43legacy_phy_lo_mark_all_unused(dev);
2176        if (dev->dev->bus->sprom.boardflags_lo & B43legacy_BFL_RSSI) {
2177                b43legacy_mac_suspend(dev);
2178                b43legacy_calc_nrssi_slope(dev);
2179                b43legacy_mac_enable(dev);
2180        }
2181}
2182
2183static void b43legacy_periodic_every30sec(struct b43legacy_wldev *dev)
2184{
2185        /* Update device statistics. */
2186        b43legacy_calculate_link_quality(dev);
2187}
2188
2189static void b43legacy_periodic_every15sec(struct b43legacy_wldev *dev)
2190{
2191        b43legacy_phy_xmitpower(dev); /* FIXME: unless scanning? */
2192
2193        atomic_set(&dev->phy.txerr_cnt, B43legacy_PHY_TX_BADNESS_LIMIT);
2194        wmb();
2195}
2196
2197static void do_periodic_work(struct b43legacy_wldev *dev)
2198{
2199        unsigned int state;
2200
2201        state = dev->periodic_state;
2202        if (state % 8 == 0)
2203                b43legacy_periodic_every120sec(dev);
2204        if (state % 4 == 0)
2205                b43legacy_periodic_every60sec(dev);
2206        if (state % 2 == 0)
2207                b43legacy_periodic_every30sec(dev);
2208        b43legacy_periodic_every15sec(dev);
2209}
2210
2211/* Periodic work locking policy:
2212 *      The whole periodic work handler is protected by
2213 *      wl->mutex. If another lock is needed somewhere in the
2214 *      pwork callchain, it's aquired in-place, where it's needed.
2215 */
2216static void b43legacy_periodic_work_handler(struct work_struct *work)
2217{
2218        struct b43legacy_wldev *dev = container_of(work, struct b43legacy_wldev,
2219                                             periodic_work.work);
2220        struct b43legacy_wl *wl = dev->wl;
2221        unsigned long delay;
2222
2223        mutex_lock(&wl->mutex);
2224
2225        if (unlikely(b43legacy_status(dev) != B43legacy_STAT_STARTED))
2226                goto out;
2227        if (b43legacy_debug(dev, B43legacy_DBG_PWORK_STOP))
2228                goto out_requeue;
2229
2230        do_periodic_work(dev);
2231
2232        dev->periodic_state++;
2233out_requeue:
2234        if (b43legacy_debug(dev, B43legacy_DBG_PWORK_FAST))
2235                delay = msecs_to_jiffies(50);
2236        else
2237                delay = round_jiffies_relative(HZ * 15);
2238        queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2239out:
2240        mutex_unlock(&wl->mutex);
2241}
2242
2243static void b43legacy_periodic_tasks_setup(struct b43legacy_wldev *dev)
2244{
2245        struct delayed_work *work = &dev->periodic_work;
2246
2247        dev->periodic_state = 0;
2248        INIT_DELAYED_WORK(work, b43legacy_periodic_work_handler);
2249        queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2250}
2251
2252/* Validate access to the chip (SHM) */
2253static int b43legacy_validate_chipaccess(struct b43legacy_wldev *dev)
2254{
2255        u32 value;
2256        u32 shm_backup;
2257
2258        shm_backup = b43legacy_shm_read32(dev, B43legacy_SHM_SHARED, 0);
2259        b43legacy_shm_write32(dev, B43legacy_SHM_SHARED, 0, 0xAA5555AA);
2260        if (b43legacy_shm_read32(dev, B43legacy_SHM_SHARED, 0) !=
2261                                 0xAA5555AA)
2262                goto error;
2263        b43legacy_shm_write32(dev, B43legacy_SHM_SHARED, 0, 0x55AAAA55);
2264        if (b43legacy_shm_read32(dev, B43legacy_SHM_SHARED, 0) !=
2265                                 0x55AAAA55)
2266                goto error;
2267        b43legacy_shm_write32(dev, B43legacy_SHM_SHARED, 0, shm_backup);
2268
2269        value = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
2270        if ((value | B43legacy_MACCTL_GMODE) !=
2271            (B43legacy_MACCTL_GMODE | B43legacy_MACCTL_IHR_ENABLED))
2272                goto error;
2273
2274        value = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
2275        if (value)
2276                goto error;
2277
2278        return 0;
2279error:
2280        b43legacyerr(dev->wl, "Failed to validate the chipaccess\n");
2281        return -ENODEV;
2282}
2283
2284static void b43legacy_security_init(struct b43legacy_wldev *dev)
2285{
2286        dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2287        B43legacy_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2288        dev->ktp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2289                                        0x0056);
2290        /* KTP is a word address, but we address SHM bytewise.
2291         * So multiply by two.
2292         */
2293        dev->ktp *= 2;
2294        if (dev->dev->id.revision >= 5)
2295                /* Number of RCMTA address slots */
2296                b43legacy_write16(dev, B43legacy_MMIO_RCMTA_COUNT,
2297                                  dev->max_nr_keys - 8);
2298}
2299
2300static int b43legacy_rng_read(struct hwrng *rng, u32 *data)
2301{
2302        struct b43legacy_wl *wl = (struct b43legacy_wl *)rng->priv;
2303        unsigned long flags;
2304
2305        /* Don't take wl->mutex here, as it could deadlock with
2306         * hwrng internal locking. It's not needed to take
2307         * wl->mutex here, anyway. */
2308
2309        spin_lock_irqsave(&wl->irq_lock, flags);
2310        *data = b43legacy_read16(wl->current_dev, B43legacy_MMIO_RNG);
2311        spin_unlock_irqrestore(&wl->irq_lock, flags);
2312
2313        return (sizeof(u16));
2314}
2315
2316static void b43legacy_rng_exit(struct b43legacy_wl *wl)
2317{
2318        if (wl->rng_initialized)
2319                hwrng_unregister(&wl->rng);
2320}
2321
2322static int b43legacy_rng_init(struct b43legacy_wl *wl)
2323{
2324        int err;
2325
2326        snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2327                 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2328        wl->rng.name = wl->rng_name;
2329        wl->rng.data_read = b43legacy_rng_read;
2330        wl->rng.priv = (unsigned long)wl;
2331        wl->rng_initialized = 1;
2332        err = hwrng_register(&wl->rng);
2333        if (err) {
2334                wl->rng_initialized = 0;
2335                b43legacyerr(wl, "Failed to register the random "
2336                       "number generator (%d)\n", err);
2337        }
2338
2339        return err;
2340}
2341
2342static int b43legacy_op_tx(struct ieee80211_hw *hw,
2343                           struct sk_buff *skb)
2344{
2345        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2346        struct b43legacy_wldev *dev = wl->current_dev;
2347        int err = -ENODEV;
2348        unsigned long flags;
2349
2350        if (unlikely(!dev))
2351                goto out;
2352        if (unlikely(b43legacy_status(dev) < B43legacy_STAT_STARTED))
2353                goto out;
2354        /* DMA-TX is done without a global lock. */
2355        if (b43legacy_using_pio(dev)) {
2356                spin_lock_irqsave(&wl->irq_lock, flags);
2357                err = b43legacy_pio_tx(dev, skb);
2358                spin_unlock_irqrestore(&wl->irq_lock, flags);
2359        } else
2360                err = b43legacy_dma_tx(dev, skb);
2361out:
2362        if (unlikely(err)) {
2363                /* Drop the packet. */
2364                dev_kfree_skb_any(skb);
2365        }
2366        return NETDEV_TX_OK;
2367}
2368
2369static int b43legacy_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
2370                                const struct ieee80211_tx_queue_params *params)
2371{
2372        return 0;
2373}
2374
2375static int b43legacy_op_get_tx_stats(struct ieee80211_hw *hw,
2376                                     struct ieee80211_tx_queue_stats *stats)
2377{
2378        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2379        struct b43legacy_wldev *dev = wl->current_dev;
2380        unsigned long flags;
2381        int err = -ENODEV;
2382
2383        if (!dev)
2384                goto out;
2385        spin_lock_irqsave(&wl->irq_lock, flags);
2386        if (likely(b43legacy_status(dev) >= B43legacy_STAT_STARTED)) {
2387                if (b43legacy_using_pio(dev))
2388                        b43legacy_pio_get_tx_stats(dev, stats);
2389                else
2390                        b43legacy_dma_get_tx_stats(dev, stats);
2391                err = 0;
2392        }
2393        spin_unlock_irqrestore(&wl->irq_lock, flags);
2394out:
2395        return err;
2396}
2397
2398static int b43legacy_op_get_stats(struct ieee80211_hw *hw,
2399                                  struct ieee80211_low_level_stats *stats)
2400{
2401        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2402        unsigned long flags;
2403
2404        spin_lock_irqsave(&wl->irq_lock, flags);
2405        memcpy(stats, &wl->ieee_stats, sizeof(*stats));
2406        spin_unlock_irqrestore(&wl->irq_lock, flags);
2407
2408        return 0;
2409}
2410
2411static const char *phymode_to_string(unsigned int phymode)
2412{
2413        switch (phymode) {
2414        case B43legacy_PHYMODE_B:
2415                return "B";
2416        case B43legacy_PHYMODE_G:
2417                return "G";
2418        default:
2419                B43legacy_BUG_ON(1);
2420        }
2421        return "";
2422}
2423
2424static int find_wldev_for_phymode(struct b43legacy_wl *wl,
2425                                  unsigned int phymode,
2426                                  struct b43legacy_wldev **dev,
2427                                  bool *gmode)
2428{
2429        struct b43legacy_wldev *d;
2430
2431        list_for_each_entry(d, &wl->devlist, list) {
2432                if (d->phy.possible_phymodes & phymode) {
2433                        /* Ok, this device supports the PHY-mode.
2434                         * Set the gmode bit. */
2435                        *gmode = 1;
2436                        *dev = d;
2437
2438                        return 0;
2439                }
2440        }
2441
2442        return -ESRCH;
2443}
2444
2445static void b43legacy_put_phy_into_reset(struct b43legacy_wldev *dev)
2446{
2447        struct ssb_device *sdev = dev->dev;
2448        u32 tmslow;
2449
2450        tmslow = ssb_read32(sdev, SSB_TMSLOW);
2451        tmslow &= ~B43legacy_TMSLOW_GMODE;
2452        tmslow |= B43legacy_TMSLOW_PHYRESET;
2453        tmslow |= SSB_TMSLOW_FGC;
2454        ssb_write32(sdev, SSB_TMSLOW, tmslow);
2455        msleep(1);
2456
2457        tmslow = ssb_read32(sdev, SSB_TMSLOW);
2458        tmslow &= ~SSB_TMSLOW_FGC;
2459        tmslow |= B43legacy_TMSLOW_PHYRESET;
2460        ssb_write32(sdev, SSB_TMSLOW, tmslow);
2461        msleep(1);
2462}
2463
2464/* Expects wl->mutex locked */
2465static int b43legacy_switch_phymode(struct b43legacy_wl *wl,
2466                                      unsigned int new_mode)
2467{
2468        struct b43legacy_wldev *uninitialized_var(up_dev);
2469        struct b43legacy_wldev *down_dev;
2470        int err;
2471        bool gmode = 0;
2472        int prev_status;
2473
2474        err = find_wldev_for_phymode(wl, new_mode, &up_dev, &gmode);
2475        if (err) {
2476                b43legacyerr(wl, "Could not find a device for %s-PHY mode\n",
2477                       phymode_to_string(new_mode));
2478                return err;
2479        }
2480        if ((up_dev == wl->current_dev) &&
2481            (!!wl->current_dev->phy.gmode == !!gmode))
2482                /* This device is already running. */
2483                return 0;
2484        b43legacydbg(wl, "Reconfiguring PHYmode to %s-PHY\n",
2485               phymode_to_string(new_mode));
2486        down_dev = wl->current_dev;
2487
2488        prev_status = b43legacy_status(down_dev);
2489        /* Shutdown the currently running core. */
2490        if (prev_status >= B43legacy_STAT_STARTED)
2491                b43legacy_wireless_core_stop(down_dev);
2492        if (prev_status >= B43legacy_STAT_INITIALIZED)
2493                b43legacy_wireless_core_exit(down_dev);
2494
2495        if (down_dev != up_dev)
2496                /* We switch to a different core, so we put PHY into
2497                 * RESET on the old core. */
2498                b43legacy_put_phy_into_reset(down_dev);
2499
2500        /* Now start the new core. */
2501        up_dev->phy.gmode = gmode;
2502        if (prev_status >= B43legacy_STAT_INITIALIZED) {
2503                err = b43legacy_wireless_core_init(up_dev);
2504                if (err) {
2505                        b43legacyerr(wl, "Fatal: Could not initialize device"
2506                                     " for newly selected %s-PHY mode\n",
2507                                     phymode_to_string(new_mode));
2508                        goto init_failure;
2509                }
2510        }
2511        if (prev_status >= B43legacy_STAT_STARTED) {
2512                err = b43legacy_wireless_core_start(up_dev);
2513                if (err) {
2514                        b43legacyerr(wl, "Fatal: Coult not start device for "
2515                               "newly selected %s-PHY mode\n",
2516                               phymode_to_string(new_mode));
2517                        b43legacy_wireless_core_exit(up_dev);
2518                        goto init_failure;
2519                }
2520        }
2521        B43legacy_WARN_ON(b43legacy_status(up_dev) != prev_status);
2522
2523        b43legacy_shm_write32(up_dev, B43legacy_SHM_SHARED, 0x003E, 0);
2524
2525        wl->current_dev = up_dev;
2526
2527        return 0;
2528init_failure:
2529        /* Whoops, failed to init the new core. No core is operating now. */
2530        wl->current_dev = NULL;
2531        return err;
2532}
2533
2534/* Write the short and long frame retry limit values. */
2535static void b43legacy_set_retry_limits(struct b43legacy_wldev *dev,
2536                                       unsigned int short_retry,
2537                                       unsigned int long_retry)
2538{
2539        /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
2540         * the chip-internal counter. */
2541        short_retry = min(short_retry, (unsigned int)0xF);
2542        long_retry = min(long_retry, (unsigned int)0xF);
2543
2544        b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, 0x0006, short_retry);
2545        b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, 0x0007, long_retry);
2546}
2547
2548static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
2549                                   u32 changed)
2550{
2551        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2552        struct b43legacy_wldev *dev;
2553        struct b43legacy_phy *phy;
2554        struct ieee80211_conf *conf = &hw->conf;
2555        unsigned long flags;
2556        unsigned int new_phymode = 0xFFFF;
2557        int antenna_tx;
2558        int antenna_rx;
2559        int err = 0;
2560        u32 savedirqs;
2561
2562        antenna_tx = B43legacy_ANTENNA_DEFAULT;
2563        antenna_rx = B43legacy_ANTENNA_DEFAULT;
2564
2565        mutex_lock(&wl->mutex);
2566        dev = wl->current_dev;
2567        phy = &dev->phy;
2568
2569        if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
2570                b43legacy_set_retry_limits(dev,
2571                                           conf->short_frame_max_tx_count,
2572                                           conf->long_frame_max_tx_count);
2573        changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
2574        if (!changed)
2575                goto out_unlock_mutex;
2576
2577        /* Switch the PHY mode (if necessary). */
2578        switch (conf->channel->band) {
2579        case IEEE80211_BAND_2GHZ:
2580                if (phy->type == B43legacy_PHYTYPE_B)
2581                        new_phymode = B43legacy_PHYMODE_B;
2582                else
2583                        new_phymode = B43legacy_PHYMODE_G;
2584                break;
2585        default:
2586                B43legacy_WARN_ON(1);
2587        }
2588        err = b43legacy_switch_phymode(wl, new_phymode);
2589        if (err)
2590                goto out_unlock_mutex;
2591
2592        /* Disable IRQs while reconfiguring the device.
2593         * This makes it possible to drop the spinlock throughout
2594         * the reconfiguration process. */
2595        spin_lock_irqsave(&wl->irq_lock, flags);
2596        if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
2597                spin_unlock_irqrestore(&wl->irq_lock, flags);
2598                goto out_unlock_mutex;
2599        }
2600        savedirqs = b43legacy_interrupt_disable(dev, B43legacy_IRQ_ALL);
2601        spin_unlock_irqrestore(&wl->irq_lock, flags);
2602        b43legacy_synchronize_irq(dev);
2603
2604        /* Switch to the requested channel.
2605         * The firmware takes care of races with the TX handler. */
2606        if (conf->channel->hw_value != phy->channel)
2607                b43legacy_radio_selectchannel(dev, conf->channel->hw_value, 0);
2608
2609        dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
2610
2611        /* Adjust the desired TX power level. */
2612        if (conf->power_level != 0) {
2613                if (conf->power_level != phy->power_level) {
2614                        phy->power_level = conf->power_level;
2615                        b43legacy_phy_xmitpower(dev);
2616                }
2617        }
2618
2619        /* Antennas for RX and management frame TX. */
2620        b43legacy_mgmtframe_txantenna(dev, antenna_tx);
2621
2622        /* Update templates for AP mode. */
2623        if (b43legacy_is_mode(wl, NL80211_IFTYPE_AP))
2624                b43legacy_set_beacon_int(dev, conf->beacon_int);
2625
2626
2627        if (!!conf->radio_enabled != phy->radio_on) {
2628                if (conf->radio_enabled) {
2629                        b43legacy_radio_turn_on(dev);
2630                        b43legacyinfo(dev->wl, "Radio turned on by software\n");
2631                        if (!dev->radio_hw_enable)
2632                                b43legacyinfo(dev->wl, "The hardware RF-kill"
2633                                              " button still turns the radio"
2634                                              " physically off. Press the"
2635                                              " button to turn it on.\n");
2636                } else {
2637                        b43legacy_radio_turn_off(dev, 0);
2638                        b43legacyinfo(dev->wl, "Radio turned off by"
2639                                      " software\n");
2640                }
2641        }
2642
2643        spin_lock_irqsave(&wl->irq_lock, flags);
2644        b43legacy_interrupt_enable(dev, savedirqs);
2645        mmiowb();
2646        spin_unlock_irqrestore(&wl->irq_lock, flags);
2647out_unlock_mutex:
2648        mutex_unlock(&wl->mutex);
2649
2650        return err;
2651}
2652
2653static void b43legacy_update_basic_rates(struct b43legacy_wldev *dev, u64 brates)
2654{
2655        struct ieee80211_supported_band *sband =
2656                dev->wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ];
2657        struct ieee80211_rate *rate;
2658        int i;
2659        u16 basic, direct, offset, basic_offset, rateptr;
2660
2661        for (i = 0; i < sband->n_bitrates; i++) {
2662                rate = &sband->bitrates[i];
2663
2664                if (b43legacy_is_cck_rate(rate->hw_value)) {
2665                        direct = B43legacy_SHM_SH_CCKDIRECT;
2666                        basic = B43legacy_SHM_SH_CCKBASIC;
2667                        offset = b43legacy_plcp_get_ratecode_cck(rate->hw_value);
2668                        offset &= 0xF;
2669                } else {
2670                        direct = B43legacy_SHM_SH_OFDMDIRECT;
2671                        basic = B43legacy_SHM_SH_OFDMBASIC;
2672                        offset = b43legacy_plcp_get_ratecode_ofdm(rate->hw_value);
2673                        offset &= 0xF;
2674                }
2675
2676                rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
2677
2678                if (b43legacy_is_cck_rate(rate->hw_value)) {
2679                        basic_offset = b43legacy_plcp_get_ratecode_cck(rate->hw_value);
2680                        basic_offset &= 0xF;
2681                } else {
2682                        basic_offset = b43legacy_plcp_get_ratecode_ofdm(rate->hw_value);
2683                        basic_offset &= 0xF;
2684                }
2685
2686                /*
2687                 * Get the pointer that we need to point to
2688                 * from the direct map
2689                 */
2690                rateptr = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2691                                               direct + 2 * basic_offset);
2692                /* and write it to the basic map */
2693                b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2694                                      basic + 2 * offset, rateptr);
2695        }
2696}
2697
2698static void b43legacy_op_bss_info_changed(struct ieee80211_hw *hw,
2699                                    struct ieee80211_vif *vif,
2700                                    struct ieee80211_bss_conf *conf,
2701                                    u32 changed)
2702{
2703        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2704        struct b43legacy_wldev *dev;
2705        struct b43legacy_phy *phy;
2706        unsigned long flags;
2707        u32 savedirqs;
2708
2709        mutex_lock(&wl->mutex);
2710
2711        dev = wl->current_dev;
2712        phy = &dev->phy;
2713
2714        /* Disable IRQs while reconfiguring the device.
2715         * This makes it possible to drop the spinlock throughout
2716         * the reconfiguration process. */
2717        spin_lock_irqsave(&wl->irq_lock, flags);
2718        if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
2719                spin_unlock_irqrestore(&wl->irq_lock, flags);
2720                goto out_unlock_mutex;
2721        }
2722        savedirqs = b43legacy_interrupt_disable(dev, B43legacy_IRQ_ALL);
2723        spin_unlock_irqrestore(&wl->irq_lock, flags);
2724        b43legacy_synchronize_irq(dev);
2725
2726        b43legacy_mac_suspend(dev);
2727
2728        if (changed & BSS_CHANGED_BASIC_RATES)
2729                b43legacy_update_basic_rates(dev, conf->basic_rates);
2730
2731        if (changed & BSS_CHANGED_ERP_SLOT) {
2732                if (conf->use_short_slot)
2733                        b43legacy_short_slot_timing_enable(dev);
2734                else
2735                        b43legacy_short_slot_timing_disable(dev);
2736        }
2737
2738        b43legacy_mac_enable(dev);
2739
2740        spin_lock_irqsave(&wl->irq_lock, flags);
2741        b43legacy_interrupt_enable(dev, savedirqs);
2742        /* XXX: why? */
2743        mmiowb();
2744        spin_unlock_irqrestore(&wl->irq_lock, flags);
2745 out_unlock_mutex:
2746        mutex_unlock(&wl->mutex);
2747
2748        return;
2749}
2750
2751static void b43legacy_op_configure_filter(struct ieee80211_hw *hw,
2752                                          unsigned int changed,
2753                                          unsigned int *fflags,
2754                                          int mc_count,
2755                                          struct dev_addr_list *mc_list)
2756{
2757        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2758        struct b43legacy_wldev *dev = wl->current_dev;
2759        unsigned long flags;
2760
2761        if (!dev) {
2762                *fflags = 0;
2763                return;
2764        }
2765
2766        spin_lock_irqsave(&wl->irq_lock, flags);
2767        *fflags &= FIF_PROMISC_IN_BSS |
2768                  FIF_ALLMULTI |
2769                  FIF_FCSFAIL |
2770                  FIF_PLCPFAIL |
2771                  FIF_CONTROL |
2772                  FIF_OTHER_BSS |
2773                  FIF_BCN_PRBRESP_PROMISC;
2774
2775        changed &= FIF_PROMISC_IN_BSS |
2776                   FIF_ALLMULTI |
2777                   FIF_FCSFAIL |
2778                   FIF_PLCPFAIL |
2779                   FIF_CONTROL |
2780                   FIF_OTHER_BSS |
2781                   FIF_BCN_PRBRESP_PROMISC;
2782
2783        wl->filter_flags = *fflags;
2784
2785        if (changed && b43legacy_status(dev) >= B43legacy_STAT_INITIALIZED)
2786                b43legacy_adjust_opmode(dev);
2787        spin_unlock_irqrestore(&wl->irq_lock, flags);
2788}
2789
2790static int b43legacy_op_config_interface(struct ieee80211_hw *hw,
2791                                         struct ieee80211_vif *vif,
2792                                         struct ieee80211_if_conf *conf)
2793{
2794        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2795        struct b43legacy_wldev *dev = wl->current_dev;
2796        unsigned long flags;
2797
2798        if (!dev)
2799                return -ENODEV;
2800        mutex_lock(&wl->mutex);
2801        spin_lock_irqsave(&wl->irq_lock, flags);
2802        B43legacy_WARN_ON(wl->vif != vif);
2803        if (conf->bssid)
2804                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
2805        else
2806                memset(wl->bssid, 0, ETH_ALEN);
2807        if (b43legacy_status(dev) >= B43legacy_STAT_INITIALIZED) {
2808                if (b43legacy_is_mode(wl, NL80211_IFTYPE_AP)) {
2809                        B43legacy_WARN_ON(vif->type != NL80211_IFTYPE_AP);
2810                        if (conf->changed & IEEE80211_IFCC_BEACON)
2811                                b43legacy_update_templates(wl);
2812                } else if (b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
2813                        if (conf->changed & IEEE80211_IFCC_BEACON)
2814                                b43legacy_update_templates(wl);
2815                }
2816                b43legacy_write_mac_bssid_templates(dev);
2817        }
2818        spin_unlock_irqrestore(&wl->irq_lock, flags);
2819        mutex_unlock(&wl->mutex);
2820
2821        return 0;
2822}
2823
2824/* Locking: wl->mutex */
2825static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev)
2826{
2827        struct b43legacy_wl *wl = dev->wl;
2828        unsigned long flags;
2829
2830        if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
2831                return;
2832
2833        /* Disable and sync interrupts. We must do this before than
2834         * setting the status to INITIALIZED, as the interrupt handler
2835         * won't care about IRQs then. */
2836        spin_lock_irqsave(&wl->irq_lock, flags);
2837        dev->irq_savedstate = b43legacy_interrupt_disable(dev,
2838                                                          B43legacy_IRQ_ALL);
2839        b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK); /* flush */
2840        spin_unlock_irqrestore(&wl->irq_lock, flags);
2841        b43legacy_synchronize_irq(dev);
2842
2843        b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
2844
2845        mutex_unlock(&wl->mutex);
2846        /* Must unlock as it would otherwise deadlock. No races here.
2847         * Cancel the possibly running self-rearming periodic work. */
2848        cancel_delayed_work_sync(&dev->periodic_work);
2849        mutex_lock(&wl->mutex);
2850
2851        ieee80211_stop_queues(wl->hw); /* FIXME this could cause a deadlock */
2852
2853        b43legacy_mac_suspend(dev);
2854        free_irq(dev->dev->irq, dev);
2855        b43legacydbg(wl, "Wireless interface stopped\n");
2856}
2857
2858/* Locking: wl->mutex */
2859static int b43legacy_wireless_core_start(struct b43legacy_wldev *dev)
2860{
2861        int err;
2862
2863        B43legacy_WARN_ON(b43legacy_status(dev) != B43legacy_STAT_INITIALIZED);
2864
2865        drain_txstatus_queue(dev);
2866        err = request_irq(dev->dev->irq, b43legacy_interrupt_handler,
2867                          IRQF_SHARED, KBUILD_MODNAME, dev);
2868        if (err) {
2869                b43legacyerr(dev->wl, "Cannot request IRQ-%d\n",
2870                       dev->dev->irq);
2871                goto out;
2872        }
2873        /* We are ready to run. */
2874        b43legacy_set_status(dev, B43legacy_STAT_STARTED);
2875
2876        /* Start data flow (TX/RX) */
2877        b43legacy_mac_enable(dev);
2878        b43legacy_interrupt_enable(dev, dev->irq_savedstate);
2879
2880        /* Start maintenance work */
2881        b43legacy_periodic_tasks_setup(dev);
2882
2883        b43legacydbg(dev->wl, "Wireless interface started\n");
2884out:
2885        return err;
2886}
2887
2888/* Get PHY and RADIO versioning numbers */
2889static int b43legacy_phy_versioning(struct b43legacy_wldev *dev)
2890{
2891        struct b43legacy_phy *phy = &dev->phy;
2892        u32 tmp;
2893        u8 analog_type;
2894        u8 phy_type;
2895        u8 phy_rev;
2896        u16 radio_manuf;
2897        u16 radio_ver;
2898        u16 radio_rev;
2899        int unsupported = 0;
2900
2901        /* Get PHY versioning */
2902        tmp = b43legacy_read16(dev, B43legacy_MMIO_PHY_VER);
2903        analog_type = (tmp & B43legacy_PHYVER_ANALOG)
2904                      >> B43legacy_PHYVER_ANALOG_SHIFT;
2905        phy_type = (tmp & B43legacy_PHYVER_TYPE) >> B43legacy_PHYVER_TYPE_SHIFT;
2906        phy_rev = (tmp & B43legacy_PHYVER_VERSION);
2907        switch (phy_type) {
2908        case B43legacy_PHYTYPE_B:
2909                if (phy_rev != 2 && phy_rev != 4
2910                    && phy_rev != 6 && phy_rev != 7)
2911                        unsupported = 1;
2912                break;
2913        case B43legacy_PHYTYPE_G:
2914                if (phy_rev > 8)
2915                        unsupported = 1;
2916                break;
2917        default:
2918                unsupported = 1;
2919        };
2920        if (unsupported) {
2921                b43legacyerr(dev->wl, "FOUND UNSUPPORTED PHY "
2922                       "(Analog %u, Type %u, Revision %u)\n",
2923                       analog_type, phy_type, phy_rev);
2924                return -EOPNOTSUPP;
2925        }
2926        b43legacydbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
2927               analog_type, phy_type, phy_rev);
2928
2929
2930        /* Get RADIO versioning */
2931        if (dev->dev->bus->chip_id == 0x4317) {
2932                if (dev->dev->bus->chip_rev == 0)
2933                        tmp = 0x3205017F;
2934                else if (dev->dev->bus->chip_rev == 1)
2935                        tmp = 0x4205017F;
2936                else
2937                        tmp = 0x5205017F;
2938        } else {
2939                b43legacy_write16(dev, B43legacy_MMIO_RADIO_CONTROL,
2940                                  B43legacy_RADIOCTL_ID);
2941                tmp = b43legacy_read16(dev, B43legacy_MMIO_RADIO_DATA_HIGH);
2942                tmp <<= 16;
2943                b43legacy_write16(dev, B43legacy_MMIO_RADIO_CONTROL,
2944                                  B43legacy_RADIOCTL_ID);
2945                tmp |= b43legacy_read16(dev, B43legacy_MMIO_RADIO_DATA_LOW);
2946        }
2947        radio_manuf = (tmp & 0x00000FFF);
2948        radio_ver = (tmp & 0x0FFFF000) >> 12;
2949        radio_rev = (tmp & 0xF0000000) >> 28;
2950        switch (phy_type) {
2951        case B43legacy_PHYTYPE_B:
2952                if ((radio_ver & 0xFFF0) != 0x2050)
2953                        unsupported = 1;
2954                break;
2955        case B43legacy_PHYTYPE_G:
2956                if (radio_ver != 0x2050)
2957                        unsupported = 1;
2958                break;
2959        default:
2960                B43legacy_BUG_ON(1);
2961        }
2962        if (unsupported) {
2963                b43legacyerr(dev->wl, "FOUND UNSUPPORTED RADIO "
2964                       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
2965                       radio_manuf, radio_ver, radio_rev);
2966                return -EOPNOTSUPP;
2967        }
2968        b43legacydbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X,"
2969                     " Revision %u\n", radio_manuf, radio_ver, radio_rev);
2970
2971
2972        phy->radio_manuf = radio_manuf;
2973        phy->radio_ver = radio_ver;
2974        phy->radio_rev = radio_rev;
2975
2976        phy->analog = analog_type;
2977        phy->type = phy_type;
2978        phy->rev = phy_rev;
2979
2980        return 0;
2981}
2982
2983static void setup_struct_phy_for_init(struct b43legacy_wldev *dev,
2984                                      struct b43legacy_phy *phy)
2985{
2986        struct b43legacy_lopair *lo;
2987        int i;
2988
2989        memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
2990        memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
2991
2992        /* Assume the radio is enabled. If it's not enabled, the state will
2993         * immediately get fixed on the first periodic work run. */
2994        dev->radio_hw_enable = 1;
2995
2996        phy->savedpctlreg = 0xFFFF;
2997        phy->aci_enable = 0;
2998        phy->aci_wlan_automatic = 0;
2999        phy->aci_hw_rssi = 0;
3000
3001        lo = phy->_lo_pairs;
3002        if (lo)
3003                memset(lo, 0, sizeof(struct b43legacy_lopair) *
3004                                     B43legacy_LO_COUNT);
3005        phy->max_lb_gain = 0;
3006        phy->trsw_rx_gain = 0;
3007
3008        /* Set default attenuation values. */
3009        phy->bbatt = b43legacy_default_baseband_attenuation(dev);
3010        phy->rfatt = b43legacy_default_radio_attenuation(dev);
3011        phy->txctl1 = b43legacy_default_txctl1(dev);
3012        phy->txpwr_offset = 0;
3013
3014        /* NRSSI */
3015        phy->nrssislope = 0;
3016        for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3017                phy->nrssi[i] = -1000;
3018        for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3019                phy->nrssi_lt[i] = i;
3020
3021        phy->lofcal = 0xFFFF;
3022        phy->initval = 0xFFFF;
3023
3024        phy->interfmode = B43legacy_INTERFMODE_NONE;
3025        phy->channel = 0xFF;
3026}
3027
3028static void setup_struct_wldev_for_init(struct b43legacy_wldev *dev)
3029{
3030        /* Flags */
3031        dev->dfq_valid = 0;
3032
3033        /* Stats */
3034        memset(&dev->stats, 0, sizeof(dev->stats));
3035
3036        setup_struct_phy_for_init(dev, &dev->phy);
3037
3038        /* IRQ related flags */
3039        dev->irq_reason = 0;
3040        memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3041        dev->irq_savedstate = B43legacy_IRQ_MASKTEMPLATE;
3042
3043        dev->mac_suspended = 1;
3044
3045        /* Noise calculation context */
3046        memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3047}
3048
3049static void b43legacy_imcfglo_timeouts_workaround(struct b43legacy_wldev *dev)
3050{
3051#ifdef CONFIG_SSB_DRIVER_PCICORE
3052        struct ssb_bus *bus = dev->dev->bus;
3053        u32 tmp;
3054
3055        if (bus->pcicore.dev &&
3056            bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3057            bus->pcicore.dev->id.revision <= 5) {
3058                /* IMCFGLO timeouts workaround. */
3059                tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3060                tmp &= ~SSB_IMCFGLO_REQTO;
3061                tmp &= ~SSB_IMCFGLO_SERTO;
3062                switch (bus->bustype) {
3063                case SSB_BUSTYPE_PCI:
3064                case SSB_BUSTYPE_PCMCIA:
3065                        tmp |= 0x32;
3066                        break;
3067                case SSB_BUSTYPE_SSB:
3068                        tmp |= 0x53;
3069                        break;
3070                }
3071                ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3072        }
3073#endif /* CONFIG_SSB_DRIVER_PCICORE */
3074}
3075
3076static void b43legacy_set_synth_pu_delay(struct b43legacy_wldev *dev,
3077                                          bool idle) {
3078        u16 pu_delay = 1050;
3079
3080        if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3081                pu_delay = 500;
3082        if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3083                pu_delay = max(pu_delay, (u16)2400);
3084
3085        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3086                              B43legacy_SHM_SH_SPUWKUP, pu_delay);
3087}
3088
3089/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3090static void b43legacy_set_pretbtt(struct b43legacy_wldev *dev)
3091{
3092        u16 pretbtt;
3093
3094        /* The time value is in microseconds. */
3095        if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
3096                pretbtt = 2;
3097        else
3098                pretbtt = 250;
3099        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3100                              B43legacy_SHM_SH_PRETBTT, pretbtt);
3101        b43legacy_write16(dev, B43legacy_MMIO_TSF_CFP_PRETBTT, pretbtt);
3102}
3103
3104/* Shutdown a wireless core */
3105/* Locking: wl->mutex */
3106static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
3107{
3108        struct b43legacy_phy *phy = &dev->phy;
3109        u32 macctl;
3110
3111        B43legacy_WARN_ON(b43legacy_status(dev) > B43legacy_STAT_INITIALIZED);
3112        if (b43legacy_status(dev) != B43legacy_STAT_INITIALIZED)
3113                return;
3114        b43legacy_set_status(dev, B43legacy_STAT_UNINIT);
3115
3116        /* Stop the microcode PSM. */
3117        macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
3118        macctl &= ~B43legacy_MACCTL_PSM_RUN;
3119        macctl |= B43legacy_MACCTL_PSM_JMP0;
3120        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
3121
3122        b43legacy_leds_exit(dev);
3123        b43legacy_rng_exit(dev->wl);
3124        b43legacy_pio_free(dev);
3125        b43legacy_dma_free(dev);
3126        b43legacy_chip_exit(dev);
3127        b43legacy_radio_turn_off(dev, 1);
3128        b43legacy_switch_analog(dev, 0);
3129        if (phy->dyn_tssi_tbl)
3130                kfree(phy->tssi2dbm);
3131        kfree(phy->lo_control);
3132        phy->lo_control = NULL;
3133        if (dev->wl->current_beacon) {
3134                dev_kfree_skb_any(dev->wl->current_beacon);
3135                dev->wl->current_beacon = NULL;
3136        }
3137
3138        ssb_device_disable(dev->dev, 0);
3139        ssb_bus_may_powerdown(dev->dev->bus);
3140}
3141
3142static void prepare_phy_data_for_init(struct b43legacy_wldev *dev)
3143{
3144        struct b43legacy_phy *phy = &dev->phy;
3145        int i;
3146
3147        /* Set default attenuation values. */
3148        phy->bbatt = b43legacy_default_baseband_attenuation(dev);
3149        phy->rfatt = b43legacy_default_radio_attenuation(dev);
3150        phy->txctl1 = b43legacy_default_txctl1(dev);
3151        phy->txctl2 = 0xFFFF;
3152        phy->txpwr_offset = 0;
3153
3154        /* NRSSI */
3155        phy->nrssislope = 0;
3156        for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3157                phy->nrssi[i] = -1000;
3158        for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3159                phy->nrssi_lt[i] = i;
3160
3161        phy->lofcal = 0xFFFF;
3162        phy->initval = 0xFFFF;
3163
3164        phy->aci_enable = 0;
3165        phy->aci_wlan_automatic = 0;
3166        phy->aci_hw_rssi = 0;
3167
3168        phy->antenna_diversity = 0xFFFF;
3169        memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3170        memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3171
3172        /* Flags */
3173        phy->calibrated = 0;
3174
3175        if (phy->_lo_pairs)
3176                memset(phy->_lo_pairs, 0,
3177                       sizeof(struct b43legacy_lopair) * B43legacy_LO_COUNT);
3178        memset(phy->loopback_gain, 0, sizeof(phy->loopback_gain));
3179}
3180
3181/* Initialize a wireless core */
3182static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
3183{
3184        struct b43legacy_wl *wl = dev->wl;
3185        struct ssb_bus *bus = dev->dev->bus;
3186        struct b43legacy_phy *phy = &dev->phy;
3187        struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3188        int err;
3189        u32 hf;
3190        u32 tmp;
3191
3192        B43legacy_WARN_ON(b43legacy_status(dev) != B43legacy_STAT_UNINIT);
3193
3194        err = ssb_bus_powerup(bus, 0);
3195        if (err)
3196                goto out;
3197        if (!ssb_device_is_enabled(dev->dev)) {
3198                tmp = phy->gmode ? B43legacy_TMSLOW_GMODE : 0;
3199                b43legacy_wireless_core_reset(dev, tmp);
3200        }
3201
3202        if ((phy->type == B43legacy_PHYTYPE_B) ||
3203            (phy->type == B43legacy_PHYTYPE_G)) {
3204                phy->_lo_pairs = kzalloc(sizeof(struct b43legacy_lopair)
3205                                         * B43legacy_LO_COUNT,
3206                                         GFP_KERNEL);
3207                if (!phy->_lo_pairs)
3208                        return -ENOMEM;
3209        }
3210        setup_struct_wldev_for_init(dev);
3211
3212        err = b43legacy_phy_init_tssi2dbm_table(dev);
3213        if (err)
3214                goto err_kfree_lo_control;
3215
3216        /* Enable IRQ routing to this device. */
3217        ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
3218
3219        b43legacy_imcfglo_timeouts_workaround(dev);
3220        prepare_phy_data_for_init(dev);
3221        b43legacy_phy_calibrate(dev);
3222        err = b43legacy_chip_init(dev);
3223        if (err)
3224                goto err_kfree_tssitbl;
3225        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3226                              B43legacy_SHM_SH_WLCOREREV,
3227                              dev->dev->id.revision);
3228        hf = b43legacy_hf_read(dev);
3229        if (phy->type == B43legacy_PHYTYPE_G) {
3230                hf |= B43legacy_HF_SYMW;
3231                if (phy->rev == 1)
3232                        hf |= B43legacy_HF_GDCW;
3233                if (sprom->boardflags_lo & B43legacy_BFL_PACTRL)
3234                        hf |= B43legacy_HF_OFDMPABOOST;
3235        } else if (phy->type == B43legacy_PHYTYPE_B) {
3236                hf |= B43legacy_HF_SYMW;
3237                if (phy->rev >= 2 && phy->radio_ver == 0x2050)
3238                        hf &= ~B43legacy_HF_GDCW;
3239        }
3240        b43legacy_hf_write(dev, hf);
3241
3242        b43legacy_set_retry_limits(dev,
3243                                   B43legacy_DEFAULT_SHORT_RETRY_LIMIT,
3244                                   B43legacy_DEFAULT_LONG_RETRY_LIMIT);
3245
3246        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3247                              0x0044, 3);
3248        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3249                              0x0046, 2);
3250
3251        /* Disable sending probe responses from firmware.
3252         * Setting the MaxTime to one usec will always trigger
3253         * a timeout, so we never send any probe resp.
3254         * A timeout of zero is infinite. */
3255        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3256                              B43legacy_SHM_SH_PRMAXTIME, 1);
3257
3258        b43legacy_rate_memory_init(dev);
3259
3260        /* Minimum Contention Window */
3261        if (phy->type == B43legacy_PHYTYPE_B)
3262                b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
3263                                      0x0003, 31);
3264        else
3265                b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
3266                                      0x0003, 15);
3267        /* Maximum Contention Window */
3268        b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
3269                              0x0004, 1023);
3270
3271        do {
3272                if (b43legacy_using_pio(dev))
3273                        err = b43legacy_pio_init(dev);
3274                else {
3275                        err = b43legacy_dma_init(dev);
3276                        if (!err)
3277                                b43legacy_qos_init(dev);
3278                }
3279        } while (err == -EAGAIN);
3280        if (err)
3281                goto err_chip_exit;
3282
3283        b43legacy_set_synth_pu_delay(dev, 1);
3284
3285        ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
3286        b43legacy_upload_card_macaddress(dev);
3287        b43legacy_security_init(dev);
3288        b43legacy_rng_init(wl);
3289
3290        b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
3291
3292        b43legacy_leds_init(dev);
3293out:
3294        return err;
3295
3296err_chip_exit:
3297        b43legacy_chip_exit(dev);
3298err_kfree_tssitbl:
3299        if (phy->dyn_tssi_tbl)
3300                kfree(phy->tssi2dbm);
3301err_kfree_lo_control:
3302        kfree(phy->lo_control);
3303        phy->lo_control = NULL;
3304        ssb_bus_may_powerdown(bus);
3305        B43legacy_WARN_ON(b43legacy_status(dev) != B43legacy_STAT_UNINIT);
3306        return err;
3307}
3308
3309static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
3310                                      struct ieee80211_if_init_conf *conf)
3311{
3312        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3313        struct b43legacy_wldev *dev;
3314        unsigned long flags;
3315        int err = -EOPNOTSUPP;
3316
3317        /* TODO: allow WDS/AP devices to coexist */
3318
3319        if (conf->type != NL80211_IFTYPE_AP &&
3320            conf->type != NL80211_IFTYPE_STATION &&
3321            conf->type != NL80211_IFTYPE_WDS &&
3322            conf->type != NL80211_IFTYPE_ADHOC)
3323                return -EOPNOTSUPP;
3324
3325        mutex_lock(&wl->mutex);
3326        if (wl->operating)
3327                goto out_mutex_unlock;
3328
3329        b43legacydbg(wl, "Adding Interface type %d\n", conf->type);
3330
3331        dev = wl->current_dev;
3332        wl->operating = 1;
3333        wl->vif = conf->vif;
3334        wl->if_type = conf->type;
3335        memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
3336
3337        spin_lock_irqsave(&wl->irq_lock, flags);
3338        b43legacy_adjust_opmode(dev);
3339        b43legacy_set_pretbtt(dev);
3340        b43legacy_set_synth_pu_delay(dev, 0);
3341        b43legacy_upload_card_macaddress(dev);
3342        spin_unlock_irqrestore(&wl->irq_lock, flags);
3343
3344        err = 0;
3345 out_mutex_unlock:
3346        mutex_unlock(&wl->mutex);
3347
3348        return err;
3349}
3350
3351static void b43legacy_op_remove_interface(struct ieee80211_hw *hw,
3352                                          struct ieee80211_if_init_conf *conf)
3353{
3354        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3355        struct b43legacy_wldev *dev = wl->current_dev;
3356        unsigned long flags;
3357
3358        b43legacydbg(wl, "Removing Interface type %d\n", conf->type);
3359
3360        mutex_lock(&wl->mutex);
3361
3362        B43legacy_WARN_ON(!wl->operating);
3363        B43legacy_WARN_ON(wl->vif != conf->vif);
3364        wl->vif = NULL;
3365
3366        wl->operating = 0;
3367
3368        spin_lock_irqsave(&wl->irq_lock, flags);
3369        b43legacy_adjust_opmode(dev);
3370        memset(wl->mac_addr, 0, ETH_ALEN);
3371        b43legacy_upload_card_macaddress(dev);
3372        spin_unlock_irqrestore(&wl->irq_lock, flags);
3373
3374        mutex_unlock(&wl->mutex);
3375}
3376
3377static int b43legacy_op_start(struct ieee80211_hw *hw)
3378{
3379        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3380        struct b43legacy_wldev *dev = wl->current_dev;
3381        int did_init = 0;
3382        int err = 0;
3383        bool do_rfkill_exit = 0;
3384
3385        /* First register RFkill.
3386         * LEDs that are registered later depend on it. */
3387        b43legacy_rfkill_init(dev);
3388
3389        /* Kill all old instance specific information to make sure
3390         * the card won't use it in the short timeframe between start
3391         * and mac80211 reconfiguring it. */
3392        memset(wl->bssid, 0, ETH_ALEN);
3393        memset(wl->mac_addr, 0, ETH_ALEN);
3394        wl->filter_flags = 0;
3395
3396        mutex_lock(&wl->mutex);
3397
3398        if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
3399                err = b43legacy_wireless_core_init(dev);
3400                if (err) {
3401                        do_rfkill_exit = 1;
3402                        goto out_mutex_unlock;
3403                }
3404                did_init = 1;
3405        }
3406
3407        if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
3408                err = b43legacy_wireless_core_start(dev);
3409                if (err) {
3410                        if (did_init)
3411                                b43legacy_wireless_core_exit(dev);
3412                        do_rfkill_exit = 1;
3413                        goto out_mutex_unlock;
3414                }
3415        }
3416
3417out_mutex_unlock:
3418        mutex_unlock(&wl->mutex);
3419
3420        if (do_rfkill_exit)
3421                b43legacy_rfkill_exit(dev);
3422
3423        return err;
3424}
3425
3426static void b43legacy_op_stop(struct ieee80211_hw *hw)
3427{
3428        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3429        struct b43legacy_wldev *dev = wl->current_dev;
3430
3431        b43legacy_rfkill_exit(dev);
3432
3433        mutex_lock(&wl->mutex);
3434        if (b43legacy_status(dev) >= B43legacy_STAT_STARTED)
3435                b43legacy_wireless_core_stop(dev);
3436        b43legacy_wireless_core_exit(dev);
3437        mutex_unlock(&wl->mutex);
3438}
3439
3440static int b43legacy_op_beacon_set_tim(struct ieee80211_hw *hw,
3441                                       struct ieee80211_sta *sta, bool set)
3442{
3443        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3444        unsigned long flags;
3445
3446        spin_lock_irqsave(&wl->irq_lock, flags);
3447        b43legacy_update_templates(wl);
3448        spin_unlock_irqrestore(&wl->irq_lock, flags);
3449
3450        return 0;
3451}
3452
3453static const struct ieee80211_ops b43legacy_hw_ops = {
3454        .tx                     = b43legacy_op_tx,
3455        .conf_tx                = b43legacy_op_conf_tx,
3456        .add_interface          = b43legacy_op_add_interface,
3457        .remove_interface       = b43legacy_op_remove_interface,
3458        .config                 = b43legacy_op_dev_config,
3459        .bss_info_changed       = b43legacy_op_bss_info_changed,
3460        .config_interface       = b43legacy_op_config_interface,
3461        .configure_filter       = b43legacy_op_configure_filter,
3462        .get_stats              = b43legacy_op_get_stats,
3463        .get_tx_stats           = b43legacy_op_get_tx_stats,
3464        .start                  = b43legacy_op_start,
3465        .stop                   = b43legacy_op_stop,
3466        .set_tim                = b43legacy_op_beacon_set_tim,
3467};
3468
3469/* Hard-reset the chip. Do not call this directly.
3470 * Use b43legacy_controller_restart()
3471 */
3472static void b43legacy_chip_reset(struct work_struct *work)
3473{
3474        struct b43legacy_wldev *dev =
3475                container_of(work, struct b43legacy_wldev, restart_work);
3476        struct b43legacy_wl *wl = dev->wl;
3477        int err = 0;
3478        int prev_status;
3479
3480        mutex_lock(&wl->mutex);
3481
3482        prev_status = b43legacy_status(dev);
3483        /* Bring the device down... */
3484        if (prev_status >= B43legacy_STAT_STARTED)
3485                b43legacy_wireless_core_stop(dev);
3486        if (prev_status >= B43legacy_STAT_INITIALIZED)
3487                b43legacy_wireless_core_exit(dev);
3488
3489        /* ...and up again. */
3490        if (prev_status >= B43legacy_STAT_INITIALIZED) {
3491                err = b43legacy_wireless_core_init(dev);
3492                if (err)
3493                        goto out;
3494        }
3495        if (prev_status >= B43legacy_STAT_STARTED) {
3496                err = b43legacy_wireless_core_start(dev);
3497                if (err) {
3498                        b43legacy_wireless_core_exit(dev);
3499                        goto out;
3500                }
3501        }
3502out:
3503        if (err)
3504                wl->current_dev = NULL; /* Failed to init the dev. */
3505        mutex_unlock(&wl->mutex);
3506        if (err)
3507                b43legacyerr(wl, "Controller restart FAILED\n");
3508        else
3509                b43legacyinfo(wl, "Controller restarted\n");
3510}
3511
3512static int b43legacy_setup_modes(struct b43legacy_wldev *dev,
3513                                 int have_bphy,
3514                                 int have_gphy)
3515{
3516        struct ieee80211_hw *hw = dev->wl->hw;
3517        struct b43legacy_phy *phy = &dev->phy;
3518
3519        phy->possible_phymodes = 0;
3520        if (have_bphy) {
3521                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
3522                        &b43legacy_band_2GHz_BPHY;
3523                phy->possible_phymodes |= B43legacy_PHYMODE_B;
3524        }
3525
3526        if (have_gphy) {
3527                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
3528                        &b43legacy_band_2GHz_GPHY;
3529                phy->possible_phymodes |= B43legacy_PHYMODE_G;
3530        }
3531
3532        return 0;
3533}
3534
3535static void b43legacy_wireless_core_detach(struct b43legacy_wldev *dev)
3536{
3537        /* We release firmware that late to not be required to re-request
3538         * is all the time when we reinit the core. */
3539        b43legacy_release_firmware(dev);
3540}
3541
3542static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
3543{
3544        struct b43legacy_wl *wl = dev->wl;
3545        struct ssb_bus *bus = dev->dev->bus;
3546        struct pci_dev *pdev = bus->host_pci;
3547        int err;
3548        int have_bphy = 0;
3549        int have_gphy = 0;
3550        u32 tmp;
3551
3552        /* Do NOT do any device initialization here.
3553         * Do it in wireless_core_init() instead.
3554         * This function is for gathering basic information about the HW, only.
3555         * Also some structs may be set up here. But most likely you want to
3556         * have that in core_init(), too.
3557         */
3558
3559        err = ssb_bus_powerup(bus, 0);
3560        if (err) {
3561                b43legacyerr(wl, "Bus powerup failed\n");
3562                goto out;
3563        }
3564        /* Get the PHY type. */
3565        if (dev->dev->id.revision >= 5) {
3566                u32 tmshigh;
3567
3568                tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
3569                have_gphy = !!(tmshigh & B43legacy_TMSHIGH_GPHY);
3570                if (!have_gphy)
3571                        have_bphy = 1;
3572        } else if (dev->dev->id.revision == 4)
3573                have_gphy = 1;
3574        else
3575                have_bphy = 1;
3576
3577        dev->phy.gmode = (have_gphy || have_bphy);
3578        tmp = dev->phy.gmode ? B43legacy_TMSLOW_GMODE : 0;
3579        b43legacy_wireless_core_reset(dev, tmp);
3580
3581        err = b43legacy_phy_versioning(dev);
3582        if (err)
3583                goto err_powerdown;
3584        /* Check if this device supports multiband. */
3585        if (!pdev ||
3586            (pdev->device != 0x4312 &&
3587             pdev->device != 0x4319 &&
3588             pdev->device != 0x4324)) {
3589                /* No multiband support. */
3590                have_bphy = 0;
3591                have_gphy = 0;
3592                switch (dev->phy.type) {
3593                case B43legacy_PHYTYPE_B:
3594                        have_bphy = 1;
3595                        break;
3596                case B43legacy_PHYTYPE_G:
3597                        have_gphy = 1;
3598                        break;
3599                default:
3600                        B43legacy_BUG_ON(1);
3601                }
3602        }
3603        dev->phy.gmode = (have_gphy || have_bphy);
3604        tmp = dev->phy.gmode ? B43legacy_TMSLOW_GMODE : 0;
3605        b43legacy_wireless_core_reset(dev, tmp);
3606
3607        err = b43legacy_validate_chipaccess(dev);
3608        if (err)
3609                goto err_powerdown;
3610        err = b43legacy_setup_modes(dev, have_bphy, have_gphy);
3611        if (err)
3612                goto err_powerdown;
3613
3614        /* Now set some default "current_dev" */
3615        if (!wl->current_dev)
3616                wl->current_dev = dev;
3617        INIT_WORK(&dev->restart_work, b43legacy_chip_reset);
3618
3619        b43legacy_radio_turn_off(dev, 1);
3620        b43legacy_switch_analog(dev, 0);
3621        ssb_device_disable(dev->dev, 0);
3622        ssb_bus_may_powerdown(bus);
3623
3624out:
3625        return err;
3626
3627err_powerdown:
3628        ssb_bus_may_powerdown(bus);
3629        return err;
3630}
3631
3632static void b43legacy_one_core_detach(struct ssb_device *dev)
3633{
3634        struct b43legacy_wldev *wldev;
3635        struct b43legacy_wl *wl;
3636
3637        /* Do not cancel ieee80211-workqueue based work here.
3638         * See comment in b43legacy_remove(). */
3639
3640        wldev = ssb_get_drvdata(dev);
3641        wl = wldev->wl;
3642        b43legacy_debugfs_remove_device(wldev);
3643        b43legacy_wireless_core_detach(wldev);
3644        list_del(&wldev->list);
3645        wl->nr_devs--;
3646        ssb_set_drvdata(dev, NULL);
3647        kfree(wldev);
3648}
3649
3650static int b43legacy_one_core_attach(struct ssb_device *dev,
3651                                     struct b43legacy_wl *wl)
3652{
3653        struct b43legacy_wldev *wldev;
3654        struct pci_dev *pdev;
3655        int err = -ENOMEM;
3656
3657        if (!list_empty(&wl->devlist)) {
3658                /* We are not the first core on this chip. */
3659                pdev = dev->bus->host_pci;
3660                /* Only special chips support more than one wireless
3661                 * core, although some of the other chips have more than
3662                 * one wireless core as well. Check for this and
3663                 * bail out early.
3664                 */
3665                if (!pdev ||
3666                    ((pdev->device != 0x4321) &&
3667                     (pdev->device != 0x4313) &&
3668                     (pdev->device != 0x431A))) {
3669                        b43legacydbg(wl, "Ignoring unconnected 802.11 core\n");
3670                        return -ENODEV;
3671                }
3672        }
3673
3674        wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
3675        if (!wldev)
3676                goto out;
3677
3678        wldev->dev = dev;
3679        wldev->wl = wl;
3680        b43legacy_set_status(wldev, B43legacy_STAT_UNINIT);
3681        wldev->bad_frames_preempt = modparam_bad_frames_preempt;
3682        tasklet_init(&wldev->isr_tasklet,
3683                     (void (*)(unsigned long))b43legacy_interrupt_tasklet,
3684                     (unsigned long)wldev);
3685        if (modparam_pio)
3686                wldev->__using_pio = 1;
3687        INIT_LIST_HEAD(&wldev->list);
3688
3689        err = b43legacy_wireless_core_attach(wldev);
3690        if (err)
3691                goto err_kfree_wldev;
3692
3693        list_add(&wldev->list, &wl->devlist);
3694        wl->nr_devs++;
3695        ssb_set_drvdata(dev, wldev);
3696        b43legacy_debugfs_add_device(wldev);
3697out:
3698        return err;
3699
3700err_kfree_wldev:
3701        kfree(wldev);
3702        return err;
3703}
3704
3705static void b43legacy_sprom_fixup(struct ssb_bus *bus)
3706{
3707        /* boardflags workarounds */
3708        if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
3709            bus->boardinfo.type == 0x4E &&
3710            bus->boardinfo.rev > 0x40)
3711                bus->sprom.boardflags_lo |= B43legacy_BFL_PACTRL;
3712}
3713
3714static void b43legacy_wireless_exit(struct ssb_device *dev,
3715                                  struct b43legacy_wl *wl)
3716{
3717        struct ieee80211_hw *hw = wl->hw;
3718
3719        ssb_set_devtypedata(dev, NULL);
3720        ieee80211_free_hw(hw);
3721}
3722
3723static int b43legacy_wireless_init(struct ssb_device *dev)
3724{
3725        struct ssb_sprom *sprom = &dev->bus->sprom;
3726        struct ieee80211_hw *hw;
3727        struct b43legacy_wl *wl;
3728        int err = -ENOMEM;
3729
3730        b43legacy_sprom_fixup(dev->bus);
3731
3732        hw = ieee80211_alloc_hw(sizeof(*wl), &b43legacy_hw_ops);
3733        if (!hw) {
3734                b43legacyerr(NULL, "Could not allocate ieee80211 device\n");
3735                goto out;
3736        }
3737
3738        /* fill hw info */
3739        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
3740                    IEEE80211_HW_SIGNAL_DBM |
3741                    IEEE80211_HW_NOISE_DBM;
3742        hw->wiphy->interface_modes =
3743                BIT(NL80211_IFTYPE_AP) |
3744                BIT(NL80211_IFTYPE_STATION) |
3745                BIT(NL80211_IFTYPE_WDS) |
3746                BIT(NL80211_IFTYPE_ADHOC);
3747        hw->queues = 1; /* FIXME: hardware has more queues */
3748        hw->max_rates = 2;
3749        SET_IEEE80211_DEV(hw, dev->dev);
3750        if (is_valid_ether_addr(sprom->et1mac))
3751                SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
3752        else
3753                SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
3754
3755        /* Get and initialize struct b43legacy_wl */
3756        wl = hw_to_b43legacy_wl(hw);
3757        memset(wl, 0, sizeof(*wl));
3758        wl->hw = hw;
3759        spin_lock_init(&wl->irq_lock);
3760        spin_lock_init(&wl->leds_lock);
3761        mutex_init(&wl->mutex);
3762        INIT_LIST_HEAD(&wl->devlist);
3763
3764        ssb_set_devtypedata(dev, wl);
3765        b43legacyinfo(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
3766        err = 0;
3767out:
3768        return err;
3769}
3770
3771static int b43legacy_probe(struct ssb_device *dev,
3772                         const struct ssb_device_id *id)
3773{
3774        struct b43legacy_wl *wl;
3775        int err;
3776        int first = 0;
3777
3778        wl = ssb_get_devtypedata(dev);
3779        if (!wl) {
3780                /* Probing the first core - setup common struct b43legacy_wl */
3781                first = 1;
3782                err = b43legacy_wireless_init(dev);
3783                if (err)
3784                        goto out;
3785                wl = ssb_get_devtypedata(dev);
3786                B43legacy_WARN_ON(!wl);
3787        }
3788        err = b43legacy_one_core_attach(dev, wl);
3789        if (err)
3790                goto err_wireless_exit;
3791
3792        if (first) {
3793                err = ieee80211_register_hw(wl->hw);
3794                if (err)
3795                        goto err_one_core_detach;
3796        }
3797
3798out:
3799        return err;
3800
3801err_one_core_detach:
3802        b43legacy_one_core_detach(dev);
3803err_wireless_exit:
3804        if (first)
3805                b43legacy_wireless_exit(dev, wl);
3806        return err;
3807}
3808
3809static void b43legacy_remove(struct ssb_device *dev)
3810{
3811        struct b43legacy_wl *wl = ssb_get_devtypedata(dev);
3812        struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
3813
3814        /* We must cancel any work here before unregistering from ieee80211,
3815         * as the ieee80211 unreg will destroy the workqueue. */
3816        cancel_work_sync(&wldev->restart_work);
3817
3818        B43legacy_WARN_ON(!wl);
3819        if (wl->current_dev == wldev)
3820                ieee80211_unregister_hw(wl->hw);
3821
3822        b43legacy_one_core_detach(dev);
3823
3824        if (list_empty(&wl->devlist))
3825                /* Last core on the chip unregistered.
3826                 * We can destroy common struct b43legacy_wl.
3827                 */
3828                b43legacy_wireless_exit(dev, wl);
3829}
3830
3831/* Perform a hardware reset. This can be called from any context. */
3832void b43legacy_controller_restart(struct b43legacy_wldev *dev,
3833                                  const char *reason)
3834{
3835        /* Must avoid requeueing, if we are in shutdown. */
3836        if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED)
3837                return;
3838        b43legacyinfo(dev->wl, "Controller RESET (%s) ...\n", reason);
3839        queue_work(dev->wl->hw->workqueue, &dev->restart_work);
3840}
3841
3842#ifdef CONFIG_PM
3843
3844static int b43legacy_suspend(struct ssb_device *dev, pm_message_t state)
3845{
3846        struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
3847        struct b43legacy_wl *wl = wldev->wl;
3848
3849        b43legacydbg(wl, "Suspending...\n");
3850
3851        mutex_lock(&wl->mutex);
3852        wldev->suspend_init_status = b43legacy_status(wldev);
3853        if (wldev->suspend_init_status >= B43legacy_STAT_STARTED)
3854                b43legacy_wireless_core_stop(wldev);
3855        if (wldev->suspend_init_status >= B43legacy_STAT_INITIALIZED)
3856                b43legacy_wireless_core_exit(wldev);
3857        mutex_unlock(&wl->mutex);
3858
3859        b43legacydbg(wl, "Device suspended.\n");
3860
3861        return 0;
3862}
3863
3864static int b43legacy_resume(struct ssb_device *dev)
3865{
3866        struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
3867        struct b43legacy_wl *wl = wldev->wl;
3868        int err = 0;
3869
3870        b43legacydbg(wl, "Resuming...\n");
3871
3872        mutex_lock(&wl->mutex);
3873        if (wldev->suspend_init_status >= B43legacy_STAT_INITIALIZED) {
3874                err = b43legacy_wireless_core_init(wldev);
3875                if (err) {
3876                        b43legacyerr(wl, "Resume failed at core init\n");
3877                        goto out;
3878                }
3879        }
3880        if (wldev->suspend_init_status >= B43legacy_STAT_STARTED) {
3881                err = b43legacy_wireless_core_start(wldev);
3882                if (err) {
3883                        b43legacy_wireless_core_exit(wldev);
3884                        b43legacyerr(wl, "Resume failed at core start\n");
3885                        goto out;
3886                }
3887        }
3888
3889        b43legacydbg(wl, "Device resumed.\n");
3890out:
3891        mutex_unlock(&wl->mutex);
3892        return err;
3893}
3894
3895#else   /* CONFIG_PM */
3896# define b43legacy_suspend      NULL
3897# define b43legacy_resume               NULL
3898#endif  /* CONFIG_PM */
3899
3900static struct ssb_driver b43legacy_ssb_driver = {
3901        .name           = KBUILD_MODNAME,
3902        .id_table       = b43legacy_ssb_tbl,
3903        .probe          = b43legacy_probe,
3904        .remove         = b43legacy_remove,
3905        .suspend        = b43legacy_suspend,
3906        .resume         = b43legacy_resume,
3907};
3908
3909static void b43legacy_print_driverinfo(void)
3910{
3911        const char *feat_pci = "", *feat_leds = "", *feat_rfkill = "",
3912                   *feat_pio = "", *feat_dma = "";
3913
3914#ifdef CONFIG_B43LEGACY_PCI_AUTOSELECT
3915        feat_pci = "P";
3916#endif
3917#ifdef CONFIG_B43LEGACY_LEDS
3918        feat_leds = "L";
3919#endif
3920#ifdef CONFIG_B43LEGACY_RFKILL
3921        feat_rfkill = "R";
3922#endif
3923#ifdef CONFIG_B43LEGACY_PIO
3924        feat_pio = "I";
3925#endif
3926#ifdef CONFIG_B43LEGACY_DMA
3927        feat_dma = "D";
3928#endif
3929        printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
3930               "[ Features: %s%s%s%s%s, Firmware-ID: "
3931               B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
3932               feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
3933}
3934
3935static int __init b43legacy_init(void)
3936{
3937        int err;
3938
3939        b43legacy_debugfs_init();
3940
3941        err = ssb_driver_register(&b43legacy_ssb_driver);
3942        if (err)
3943                goto err_dfs_exit;
3944
3945        b43legacy_print_driverinfo();
3946
3947        return err;
3948
3949err_dfs_exit:
3950        b43legacy_debugfs_exit();
3951        return err;
3952}
3953
3954static void __exit b43legacy_exit(void)
3955{
3956        ssb_driver_unregister(&b43legacy_ssb_driver);
3957        b43legacy_debugfs_exit();
3958}
3959
3960module_init(b43legacy_init)
3961module_exit(b43legacy_exit)
3962
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.