drivers/net/wireless/bcm43xx/bcm43xx_main.c

   1 /*
   2
   3   Broadcom BCM43xx wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>,
   6                      Stefano Brivio <st3@riseup.net>
   7                      Michael Buesch <mbuesch@freenet.de>
   8                      Danny van Dyk <kugelfang@gentoo.org>
   9                      Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   Some parts of the code in this file are derived from the ipw2200
  12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  13
  14   This program is free software; you can redistribute it and/or modify
  15   it under the terms of the GNU General Public License as published by
  16   the Free Software Foundation; either version 2 of the License, or
  17   (at your option) any later version.
  18
  19   This program is distributed in the hope that it will be useful,
  20   but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22   GNU General Public License for more details.
  23
  24   You should have received a copy of the GNU General Public License
  25   along with this program; see the file COPYING.  If not, write to
  26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  27   Boston, MA 02110-1301, USA.
  28
  29 */
  30
  31 #include <linux/delay.h>
  32 #include <linux/init.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/if_arp.h>
  35 #include <linux/etherdevice.h>
  36 #include <linux/version.h>
  37 #include <linux/firmware.h>
  38 #include <linux/wireless.h>
  39 #include <linux/workqueue.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/dma-mapping.h>
  42 #include <net/iw_handler.h>
  43
  44 #include "bcm43xx.h"
  45 #include "bcm43xx_main.h"
  46 #include "bcm43xx_debugfs.h"
  47 #include "bcm43xx_radio.h"
  48 #include "bcm43xx_phy.h"
  49 #include "bcm43xx_dma.h"
  50 #include "bcm43xx_pio.h"
  51 #include "bcm43xx_power.h"
  52 #include "bcm43xx_wx.h"
  53 #include "bcm43xx_ethtool.h"
  54 #include "bcm43xx_xmit.h"
  55 #include "bcm43xx_sysfs.h"
  56
  57
  58 MODULE_DESCRIPTION("Broadcom BCM43xx wireless driver");
  59 MODULE_AUTHOR("Martin Langer");
  60 MODULE_AUTHOR("Stefano Brivio");
  61 MODULE_AUTHOR("Michael Buesch");
  62 MODULE_LICENSE("GPL");
  63
  64 #ifdef CONFIG_BCM947XX
  65 extern char *nvram_get(char *name);
  66 #endif
  67
  68 #if defined(CONFIG_BCM43XX_DMA) && defined(CONFIG_BCM43XX_PIO)
  69 static int modparam_pio;
  70 module_param_named(pio, modparam_pio, int, 0444);
  71 MODULE_PARM_DESC(pio, "enable(1) / disable(0) PIO mode");
  72 #elif defined(CONFIG_BCM43XX_DMA)
  73 # define modparam_pio   0
  74 #elif defined(CONFIG_BCM43XX_PIO)
  75 # define modparam_pio   1
  76 #endif
  77
  78 static int modparam_bad_frames_preempt;
  79 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  80 MODULE_PARM_DESC(bad_frames_preempt, "enable(1) / disable(0) Bad Frames Preemption");
  81
  82 static int modparam_short_retry = BCM43xx_DEFAULT_SHORT_RETRY_LIMIT;
  83 module_param_named(short_retry, modparam_short_retry, int, 0444);
  84 MODULE_PARM_DESC(short_retry, "Short-Retry-Limit (0 - 15)");
  85
  86 static int modparam_long_retry = BCM43xx_DEFAULT_LONG_RETRY_LIMIT;
  87 module_param_named(long_retry, modparam_long_retry, int, 0444);
  88 MODULE_PARM_DESC(long_retry, "Long-Retry-Limit (0 - 15)");
  89
  90 static int modparam_locale = -1;
  91 module_param_named(locale, modparam_locale, int, 0444);
  92 MODULE_PARM_DESC(country, "Select LocaleCode 0-11 (For travelers)");
  93
  94 static int modparam_noleds;
  95 module_param_named(noleds, modparam_noleds, int, 0444);
  96 MODULE_PARM_DESC(noleds, "Turn off all LED activity");
  97
  98 #ifdef CONFIG_BCM43XX_DEBUG
  99 static char modparam_fwpostfix[64];
 100 module_param_string(fwpostfix, modparam_fwpostfix, 64, 0444);
 101 MODULE_PARM_DESC(fwpostfix, "Postfix for .fw files. Useful for debugging.");
 102 #else
 103 # define modparam_fwpostfix  ""
 104 #endif /* CONFIG_BCM43XX_DEBUG*/
 105
 106
 107 /* If you want to debug with just a single device, enable this,
 108  * where the string is the pci device ID (as given by the kernel's
 109  * pci_name function) of the device to be used.
 110  */
 111 //#define DEBUG_SINGLE_DEVICE_ONLY      "0001:11:00.0"
 112
 113 /* If you want to enable printing of each MMIO access, enable this. */
 114 //#define DEBUG_ENABLE_MMIO_PRINT
 115
 116 /* If you want to enable printing of MMIO access within
 117  * ucode/pcm upload, initvals write, enable this.
 118  */
 119 //#define DEBUG_ENABLE_UCODE_MMIO_PRINT
 120
 121 /* If you want to enable printing of PCI Config Space access, enable this */
 122 //#define DEBUG_ENABLE_PCILOG
 123
 124
 125 /* Detailed list maintained at:
 126  * http://openfacts.berlios.de/index-en.phtml?title=Bcm43xxDevices
 127  */
 128         static struct pci_device_id bcm43xx_pci_tbl[] = {
 129         /* Broadcom 4303 802.11b */
 130         { PCI_VENDOR_ID_BROADCOM, 0x4301, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 131         /* Broadcom 4307 802.11b */
 132         { PCI_VENDOR_ID_BROADCOM, 0x4307, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 133         /* Broadcom 4318 802.11b/g */
 134         { PCI_VENDOR_ID_BROADCOM, 0x4318, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 135         /* Broadcom 4319 802.11a/b/g */
 136         { PCI_VENDOR_ID_BROADCOM, 0x4319, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 137         /* Broadcom 4306 802.11b/g */
 138         { PCI_VENDOR_ID_BROADCOM, 0x4320, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 139         /* Broadcom 4306 802.11a */
 140 //      { PCI_VENDOR_ID_BROADCOM, 0x4321, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 141         /* Broadcom 4309 802.11a/b/g */
 142         { PCI_VENDOR_ID_BROADCOM, 0x4324, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 143         /* Broadcom 43XG 802.11b/g */
 144         { PCI_VENDOR_ID_BROADCOM, 0x4325, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 145 #ifdef CONFIG_BCM947XX
 146         /* SB bus on BCM947xx */
 147         { PCI_VENDOR_ID_BROADCOM, 0x0800, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 148 #endif
 149         { 0 },
 150 };
 151 MODULE_DEVICE_TABLE(pci, bcm43xx_pci_tbl);
 152
 153 static void bcm43xx_ram_write(struct bcm43xx_private *bcm, u16 offset, u32 val)
 154 {
 155         u32 status;
 156
 157         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
 158         if (!(status & BCM43xx_SBF_XFER_REG_BYTESWAP))
 159                 val = swab32(val);
 160
 161         bcm43xx_write32(bcm, BCM43xx_MMIO_RAM_CONTROL, offset);
 162         mmiowb();
 163         bcm43xx_write32(bcm, BCM43xx_MMIO_RAM_DATA, val);
 164 }
 165
 166 static inline
 167 void bcm43xx_shm_control_word(struct bcm43xx_private *bcm,
 168                               u16 routing, u16 offset)
 169 {
 170         u32 control;
 171
 172         /* "offset" is the WORD offset. */
 173
 174         control = routing;
 175         control <<= 16;
 176         control |= offset;
 177         bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_CONTROL, control);
 178 }
 179
 180 u32 bcm43xx_shm_read32(struct bcm43xx_private *bcm,
 181                        u16 routing, u16 offset)
 182 {
 183         u32 ret;
 184
 185         if (routing == BCM43xx_SHM_SHARED) {
 186                 if (offset & 0x0003) {
 187                         /* Unaligned access */
 188                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
 189                         ret = bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED);
 190                         ret <<= 16;
 191                         bcm43xx_shm_control_word(bcm, routing, (offset >> 2) + 1);
 192                         ret |= bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA);
 193
 194                         return ret;
 195                 }
 196                 offset >>= 2;
 197         }
 198         bcm43xx_shm_control_word(bcm, routing, offset);
 199         ret = bcm43xx_read32(bcm, BCM43xx_MMIO_SHM_DATA);
 200
 201         return ret;
 202 }
 203
 204 u16 bcm43xx_shm_read16(struct bcm43xx_private *bcm,
 205                        u16 routing, u16 offset)
 206 {
 207         u16 ret;
 208
 209         if (routing == BCM43xx_SHM_SHARED) {
 210                 if (offset & 0x0003) {
 211                         /* Unaligned access */
 212                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
 213                         ret = bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED);
 214
 215                         return ret;
 216                 }
 217                 offset >>= 2;
 218         }
 219         bcm43xx_shm_control_word(bcm, routing, offset);
 220         ret = bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA);
 221
 222         return ret;
 223 }
 224
 225 void bcm43xx_shm_write32(struct bcm43xx_private *bcm,
 226                          u16 routing, u16 offset,
 227                          u32 value)
 228 {
 229         if (routing == BCM43xx_SHM_SHARED) {
 230                 if (offset & 0x0003) {
 231                         /* Unaligned access */
 232                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
 233                         mmiowb();
 234                         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED,
 235                                         (value >> 16) & 0xffff);
 236                         mmiowb();
 237                         bcm43xx_shm_control_word(bcm, routing, (offset >> 2) + 1);
 238                         mmiowb();
 239                         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA,
 240                                         value & 0xffff);
 241                         return;
 242                 }
 243                 offset >>= 2;
 244         }
 245         bcm43xx_shm_control_word(bcm, routing, offset);
 246         mmiowb();
 247         bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA, value);
 248 }
 249
 250 void bcm43xx_shm_write16(struct bcm43xx_private *bcm,
 251                          u16 routing, u16 offset,
 252                          u16 value)
 253 {
 254         if (routing == BCM43xx_SHM_SHARED) {
 255                 if (offset & 0x0003) {
 256                         /* Unaligned access */
 257                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
 258                         mmiowb();
 259                         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED,
 260                                         value);
 261                         return;
 262                 }
 263                 offset >>= 2;
 264         }
 265         bcm43xx_shm_control_word(bcm, routing, offset);
 266         mmiowb();
 267         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA, value);
 268 }
 269
 270 void bcm43xx_tsf_read(struct bcm43xx_private *bcm, u64 *tsf)
 271 {
 272         /* We need to be careful. As we read the TSF from multiple
 273          * registers, we should take care of register overflows.
 274          * In theory, the whole tsf read process should be atomic.
 275          * We try to be atomic here, by restaring the read process,
 276          * if any of the high registers changed (overflew).
 277          */
 278         if (bcm->current_core->rev >= 3) {
 279                 u32 low, high, high2;
 280
 281                 do {
 282                         high = bcm43xx_read32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_HIGH);
 283                         low = bcm43xx_read32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW);
 284                         high2 = bcm43xx_read32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_HIGH);
 285                 } while (unlikely(high != high2));
 286
 287                 *tsf = high;
 288                 *tsf <<= 32;
 289                 *tsf |= low;
 290         } else {
 291                 u64 tmp;
 292                 u16 v0, v1, v2, v3;
 293                 u16 test1, test2, test3;
 294
 295                 do {
 296                         v3 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_3);
 297                         v2 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_2);
 298                         v1 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_1);
 299                         v0 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_0);
 300
 301                         test3 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_3);
 302                         test2 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_2);
 303                         test1 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_1);
 304                 } while (v3 != test3 || v2 != test2 || v1 != test1);
 305
 306                 *tsf = v3;
 307                 *tsf <<= 48;
 308                 tmp = v2;
 309                 tmp <<= 32;
 310                 *tsf |= tmp;
 311                 tmp = v1;
 312                 tmp <<= 16;
 313                 *tsf |= tmp;
 314                 *tsf |= v0;
 315         }
 316 }
 317
 318 void bcm43xx_tsf_write(struct bcm43xx_private *bcm, u64 tsf)
 319 {
 320         u32 status;
 321
 322         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
 323         status |= BCM43xx_SBF_TIME_UPDATE;
 324         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
 325         mmiowb();
 326
 327         /* Be careful with the in-progress timer.
 328          * First zero out the low register, so we have a full
 329          * register-overflow duration to complete the operation.
 330          */
 331         if (bcm->current_core->rev >= 3) {
 332                 u32 lo = (tsf & 0x00000000FFFFFFFFULL);
 333                 u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
 334
 335                 bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW, 0);
 336                 mmiowb();
 337                 bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_HIGH, hi);
 338                 mmiowb();
 339                 bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW, lo);
 340         } else {
 341                 u16 v0 = (tsf & 0x000000000000FFFFULL);
 342                 u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
 343                 u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
 344                 u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
 345
 346                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_0, 0);
 347                 mmiowb();
 348                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_3, v3);
 349                 mmiowb();
 350                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_2, v2);
 351                 mmiowb();
 352                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_1, v1);
 353                 mmiowb();
 354                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_0, v0);
 355         }
 356
 357         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
 358         status &= ~BCM43xx_SBF_TIME_UPDATE;
 359         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
 360 }
 361
 362 static
 363 void bcm43xx_macfilter_set(struct bcm43xx_private *bcm,
 364                            u16 offset,
 365                            const u8 *mac)
 366 {
 367         u16 data;
 368
 369         offset |= 0x0020;
 370         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_CONTROL, offset);
 371
 372         data = mac[0];
 373         data |= mac[1] << 8;
 374         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_DATA, data);
 375         data = mac[2];
 376         data |= mac[3] << 8;
 377         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_DATA, data);
 378         data = mac[4];
 379         data |= mac[5] << 8;
 380         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_DATA, data);
 381 }
 382
 383 static void bcm43xx_macfilter_clear(struct bcm43xx_private *bcm,
 384                                     u16 offset)
 385 {
 386         const u8 zero_addr[ETH_ALEN] = { 0 };
 387
 388         bcm43xx_macfilter_set(bcm, offset, zero_addr);
 389 }
 390
 391 static void bcm43xx_write_mac_bssid_templates(struct bcm43xx_private *bcm)
 392 {
 393         const u8 *mac = (const u8 *)(bcm->net_dev->dev_addr);
 394         const u8 *bssid = (const u8 *)(bcm->ieee->bssid);
 395         u8 mac_bssid[ETH_ALEN * 2];
 396         int i;
 397
 398         memcpy(mac_bssid, mac, ETH_ALEN);
 399         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 400
 401         /* Write our MAC address and BSSID to template ram */
 402         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32))
 403                 bcm43xx_ram_write(bcm, 0x20 + i, *((u32 *)(mac_bssid + i)));
 404         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32))
 405                 bcm43xx_ram_write(bcm, 0x78 + i, *((u32 *)(mac_bssid + i)));
 406         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32))
 407                 bcm43xx_ram_write(bcm, 0x478 + i, *((u32 *)(mac_bssid + i)));
 408 }
 409
 410 //FIXME: Well, we should probably call them from somewhere.
 411 #if 0
 412 static void bcm43xx_set_slot_time(struct bcm43xx_private *bcm, u16 slot_time)
 413 {
 414         /* slot_time is in usec. */
 415         if (bcm43xx_current_phy(bcm)->type != BCM43xx_PHYTYPE_G)
 416                 return;
 417         bcm43xx_write16(bcm, 0x684, 510 + slot_time);
 418         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0010, slot_time);
 419 }
 420
 421 static void bcm43xx_short_slot_timing_enable(struct bcm43xx_private *bcm)
 422 {
 423         bcm43xx_set_slot_time(bcm, 9);
 424 }
 425
 426 static void bcm43xx_short_slot_timing_disable(struct bcm43xx_private *bcm)
 427 {
 428         bcm43xx_set_slot_time(bcm, 20);
 429 }
 430 #endif
 431
 432 /* FIXME: To get the MAC-filter working, we need to implement the
 433  *        following functions (and rename them :)
 434  */
 435 #if 0
 436 static void bcm43xx_disassociate(struct bcm43xx_private *bcm)
 437 {
 438         bcm43xx_mac_suspend(bcm);
 439         bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
 440
 441         bcm43xx_ram_write(bcm, 0x0026, 0x0000);
 442         bcm43xx_ram_write(bcm, 0x0028, 0x0000);
 443         bcm43xx_ram_write(bcm, 0x007E, 0x0000);
 444         bcm43xx_ram_write(bcm, 0x0080, 0x0000);
 445         bcm43xx_ram_write(bcm, 0x047E, 0x0000);
 446         bcm43xx_ram_write(bcm, 0x0480, 0x0000);
 447
 448         if (bcm->current_core->rev < 3) {
 449                 bcm43xx_write16(bcm, 0x0610, 0x8000);
 450                 bcm43xx_write16(bcm, 0x060E, 0x0000);
 451         } else
 452                 bcm43xx_write32(bcm, 0x0188, 0x80000000);
 453
 454         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0004, 0x000003ff);
 455
 456         if (bcm43xx_current_phy(bcm)->type == BCM43xx_PHYTYPE_G &&
 457             ieee80211_is_ofdm_rate(bcm->softmac->txrates.default_rate))
 458                 bcm43xx_short_slot_timing_enable(bcm);
 459
 460         bcm43xx_mac_enable(bcm);
 461 }
 462
 463 static void bcm43xx_associate(struct bcm43xx_private *bcm,
 464                               const u8 *mac)
 465 {
 466         memcpy(bcm->ieee->bssid, mac, ETH_ALEN);
 467
 468         bcm43xx_mac_suspend(bcm);
 469         bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_ASSOC, mac);
 470         bcm43xx_write_mac_bssid_templates(bcm);
 471         bcm43xx_mac_enable(bcm);
 472 }
 473 #endif
 474
 475 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
 476  * Returns the _previously_ enabled IRQ mask.
 477  */
 478 static inline u32 bcm43xx_interrupt_enable(struct bcm43xx_private *bcm, u32 mask)
 479 {
 480         u32 old_mask;
 481
 482         old_mask = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
 483         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK, old_mask | mask);
 484
 485         return old_mask;
 486 }
 487
 488 /* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
 489  * Returns the _previously_ enabled IRQ mask.
 490  */
 491 static inline u32 bcm43xx_interrupt_disable(struct bcm43xx_private *bcm, u32 mask)
 492 {
 493         u32 old_mask;
 494
 495         old_mask = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
 496         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
 497
 498         return old_mask;
 499 }
 500
 501 /* Synchronize IRQ top- and bottom-half.
 502  * IRQs must be masked before calling this.
 503  * This must not be called with the irq_lock held.
 504  */
 505 static void bcm43xx_synchronize_irq(struct bcm43xx_private *bcm)
 506 {
 507         synchronize_irq(bcm->irq);
 508         tasklet_disable(&bcm->isr_tasklet);
 509 }
 510
 511 /* Make sure we don't receive more data from the device. */
 512 static int bcm43xx_disable_interrupts_sync(struct bcm43xx_private *bcm)
 513 {
 514         unsigned long flags;
 515
 516         spin_lock_irqsave(&bcm->irq_lock, flags);
 517         if (unlikely(bcm43xx_status(bcm) != BCM43xx_STAT_INITIALIZED)) {
 518                 spin_unlock_irqrestore(&bcm->irq_lock, flags);
 519                 return -EBUSY;
 520         }
 521         bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
 522         spin_unlock_irqrestore(&bcm->irq_lock, flags);
 523         bcm43xx_synchronize_irq(bcm);
 524
 525         return 0;
 526 }
 527
 528 static int bcm43xx_read_radioinfo(struct bcm43xx_private *bcm)
 529 {
 530         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
 531         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
 532         u32 radio_id;
 533         u16 manufact;
 534         u16 version;
 535         u8 revision;
 536
 537         if (bcm->chip_id == 0x4317) {
 538                 if (bcm->chip_rev == 0x00)
 539                         radio_id = 0x3205017F;
 540                 else if (bcm->chip_rev == 0x01)
 541                         radio_id = 0x4205017F;
 542                 else
 543                         radio_id = 0x5205017F;
 544         } else {
 545                 bcm43xx_write16(bcm, BCM43xx_MMIO_RADIO_CONTROL, BCM43xx_RADIOCTL_ID);
 546                 radio_id = bcm43xx_read16(bcm, BCM43xx_MMIO_RADIO_DATA_HIGH);
 547                 radio_id <<= 16;
 548                 bcm43xx_write16(bcm, BCM43xx_MMIO_RADIO_CONTROL, BCM43xx_RADIOCTL_ID);
 549                 radio_id |= bcm43xx_read16(bcm, BCM43xx_MMIO_RADIO_DATA_LOW);
 550         }
 551
 552         manufact = (radio_id & 0x00000FFF);
 553         version = (radio_id & 0x0FFFF000) >> 12;
 554         revision = (radio_id & 0xF0000000) >> 28;
 555
 556         dprintk(KERN_INFO PFX "Detected Radio: ID: %x (Manuf: %x Ver: %x Rev: %x)\n",
 557                 radio_id, manufact, version, revision);
 558
 559         switch (phy->type) {
 560         case BCM43xx_PHYTYPE_A:
 561                 if ((version != 0x2060) || (revision != 1) || (manufact != 0x17f))
 562                         goto err_unsupported_radio;
 563                 break;
 564         case BCM43xx_PHYTYPE_B:
 565                 if ((version & 0xFFF0) != 0x2050)
 566                         goto err_unsupported_radio;
 567                 break;
 568         case BCM43xx_PHYTYPE_G:
 569                 if (version != 0x2050)
 570                         goto err_unsupported_radio;
 571                 break;
 572         }
 573
 574         radio->manufact = manufact;
 575         radio->version = version;
 576         radio->revision = revision;
 577
 578         if (phy->type == BCM43xx_PHYTYPE_A)
 579                 radio->txpower_desired = bcm->sprom.maxpower_aphy;
 580         else
 581                 radio->txpower_desired = bcm->sprom.maxpower_bgphy;
 582
 583         return 0;
 584
 585 err_unsupported_radio:
 586         printk(KERN_ERR PFX "Unsupported Radio connected to the PHY!\n");
 587         return -ENODEV;
 588 }
 589
 590 static const char * bcm43xx_locale_iso(u8 locale)
 591 {
 592         /* ISO 3166-1 country codes.
 593          * Note that there aren't ISO 3166-1 codes for
 594          * all or locales. (Not all locales are countries)
 595          */
 596         switch (locale) {
 597         case BCM43xx_LOCALE_WORLD:
 598         case BCM43xx_LOCALE_ALL:
 599                 return "XX";
 600         case BCM43xx_LOCALE_THAILAND:
 601                 return "TH";
 602         case BCM43xx_LOCALE_ISRAEL:
 603                 return "IL";
 604         case BCM43xx_LOCALE_JORDAN:
 605                 return "JO";
 606         case BCM43xx_LOCALE_CHINA:
 607                 return "CN";
 608         case BCM43xx_LOCALE_JAPAN:
 609         case BCM43xx_LOCALE_JAPAN_HIGH:
 610                 return "JP";
 611         case BCM43xx_LOCALE_USA_CANADA_ANZ:
 612         case BCM43xx_LOCALE_USA_LOW:
 613                 return "US";
 614         case BCM43xx_LOCALE_EUROPE:
 615                 return "EU";
 616         case BCM43xx_LOCALE_NONE:
 617                 return "  ";
 618         }
 619         assert(0);
 620         return "  ";
 621 }
 622
 623 static const char * bcm43xx_locale_string(u8 locale)
 624 {
 625         switch (locale) {
 626         case BCM43xx_LOCALE_WORLD:
 627                 return "World";
 628         case BCM43xx_LOCALE_THAILAND:
 629                 return "Thailand";
 630         case BCM43xx_LOCALE_ISRAEL:
 631                 return "Israel";
 632         case BCM43xx_LOCALE_JORDAN:
 633                 return "Jordan";
 634         case BCM43xx_LOCALE_CHINA:
 635                 return "China";
 636         case BCM43xx_LOCALE_JAPAN:
 637                 return "Japan";
 638         case BCM43xx_LOCALE_USA_CANADA_ANZ:
 639                 return "USA/Canada/ANZ";
 640         case BCM43xx_LOCALE_EUROPE:
 641                 return "Europe";
 642         case BCM43xx_LOCALE_USA_LOW:
 643                 return "USAlow";
 644         case BCM43xx_LOCALE_JAPAN_HIGH:
 645                 return "JapanHigh";
 646         case BCM43xx_LOCALE_ALL:
 647                 return "All";
 648         case BCM43xx_LOCALE_NONE:
 649                 return "None";
 650         }
 651         assert(0);
 652         return "";
 653 }
 654
 655 static inline u8 bcm43xx_crc8(u8 crc, u8 data)
 656 {
 657         static const u8 t[] = {
 658                 0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
 659                 0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
 660                 0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
 661                 0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
 662                 0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
 663                 0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
 664                 0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
 665                 0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
 666                 0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
 667                 0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
 668                 0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
 669                 0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
 670                 0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
 671                 0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
 672                 0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
 673                 0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
 674                 0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
 675                 0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
 676                 0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
 677                 0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
 678                 0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
 679                 0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
 680                 0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
 681                 0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
 682                 0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
 683                 0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
 684                 0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
 685                 0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
 686                 0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
 687                 0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
 688                 0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
 689                 0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F,
 690         };
 691         return t[crc ^ data];
 692 }
 693
 694 static u8 bcm43xx_sprom_crc(const u16 *sprom)
 695 {
 696         int word;
 697         u8 crc = 0xFF;
 698
 699         for (word = 0; word < BCM43xx_SPROM_SIZE - 1; word++) {
 700                 crc = bcm43xx_crc8(crc, sprom[word] & 0x00FF);
 701                 crc = bcm43xx_crc8(crc, (sprom[word] & 0xFF00) >> 8);
 702         }
 703         crc = bcm43xx_crc8(crc, sprom[BCM43xx_SPROM_VERSION] & 0x00FF);
 704         crc ^= 0xFF;
 705
 706         return crc;
 707 }
 708
 709 int bcm43xx_sprom_read(struct bcm43xx_private *bcm, u16 *sprom)
 710 {
 711         int i;
 712         u8 crc, expected_crc;
 713
 714         for (i = 0; i < BCM43xx_SPROM_SIZE; i++)
 715                 sprom[i] = bcm43xx_read16(bcm, BCM43xx_SPROM_BASE + (i * 2));
 716         /* CRC-8 check. */
 717         crc = bcm43xx_sprom_crc(sprom);
 718         expected_crc = (sprom[BCM43xx_SPROM_VERSION] & 0xFF00) >> 8;
 719         if (crc != expected_crc) {
 720                 printk(KERN_WARNING PFX "WARNING: Invalid SPROM checksum "
 721                                         "(0x%02X, expected: 0x%02X)\n",
 722                        crc, expected_crc);
 723                 return -EINVAL;
 724         }
 725
 726         return 0;
 727 }
 728
 729 int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
 730 {
 731         int i, err;
 732         u8 crc, expected_crc;
 733         u32 spromctl;
 734
 735         /* CRC-8 validation of the input data. */
 736         crc = bcm43xx_sprom_crc(sprom);
 737         expected_crc = (sprom[BCM43xx_SPROM_VERSION] & 0xFF00) >> 8;
 738         if (crc != expected_crc) {
 739                 printk(KERN_ERR PFX "SPROM input data: Invalid CRC\n");
 740                 return -EINVAL;
 741         }
 742
 743         printk(KERN_INFO PFX "Writing SPROM. Do NOT turn off the power! Please stand by...\n");
 744         err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCICFG_SPROMCTL, &spromctl);
 745         if (err)
 746                 goto err_ctlreg;
 747         spromctl |= 0x10; /* SPROM WRITE enable. */
 748         bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
 749         if (err)
 750                 goto err_ctlreg;
 751         /* We must burn lots of CPU cycles here, but that does not
 752          * really matter as one does not write the SPROM every other minute...
 753          */
 754         printk(KERN_INFO PFX "[ 0%%");
 755         mdelay(500);
 756         for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
 757                 if (i == 16)
 758                         printk("25%%");
 759                 else if (i == 32)
 760                         printk("50%%");
 761                 else if (i == 48)
 762                         printk("75%%");
 763                 else if (i % 2)
 764                         printk(".");
 765                 bcm43xx_write16(bcm, BCM43xx_SPROM_BASE + (i * 2), sprom[i]);
 766                 mmiowb();
 767                 mdelay(20);
 768         }
 769         spromctl &= ~0x10; /* SPROM WRITE enable. */
 770         bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
 771         if (err)
 772                 goto err_ctlreg;
 773         mdelay(500);
 774         printk("100%% ]\n");
 775         printk(KERN_INFO PFX "SPROM written.\n");
 776         bcm43xx_controller_restart(bcm, "SPROM update");
 777
 778         return 0;
 779 err_ctlreg:
 780         printk(KERN_ERR PFX "Could not access SPROM control register.\n");
 781         return -ENODEV;
 782 }
 783
 784 static int bcm43xx_sprom_extract(struct bcm43xx_private *bcm)
 785 {
 786         u16 value;
 787         u16 *sprom;
 788 #ifdef CONFIG_BCM947XX
 789         char *c;
 790 #endif
 791
 792         sprom = kzalloc(BCM43xx_SPROM_SIZE * sizeof(u16),
 793                         GFP_KERNEL);
 794         if (!sprom) {
 795                 printk(KERN_ERR PFX "sprom_extract OOM\n");
 796                 return -ENOMEM;
 797         }
 798 #ifdef CONFIG_BCM947XX
 799         sprom[BCM43xx_SPROM_BOARDFLAGS2] = atoi(nvram_get("boardflags2"));
 800         sprom[BCM43xx_SPROM_BOARDFLAGS] = atoi(nvram_get("boardflags"));
 801
 802         if ((c = nvram_get("il0macaddr")) != NULL)
 803                 e_aton(c, (char *) &(sprom[BCM43xx_SPROM_IL0MACADDR]));
 804
 805         if ((c = nvram_get("et1macaddr")) != NULL)
 806                 e_aton(c, (char *) &(sprom[BCM43xx_SPROM_ET1MACADDR]));
 807
 808         sprom[BCM43xx_SPROM_PA0B0] = atoi(nvram_get("pa0b0"));
 809         sprom[BCM43xx_SPROM_PA0B1] = atoi(nvram_get("pa0b1"));
 810         sprom[BCM43xx_SPROM_PA0B2] = atoi(nvram_get("pa0b2"));
 811
 812         sprom[BCM43xx_SPROM_PA1B0] = atoi(nvram_get("pa1b0"));
 813         sprom[BCM43xx_SPROM_PA1B1] = atoi(nvram_get("pa1b1"));
 814         sprom[BCM43xx_SPROM_PA1B2] = atoi(nvram_get("pa1b2"));
 815
 816         sprom[BCM43xx_SPROM_BOARDREV] = atoi(nvram_get("boardrev"));
 817 #else
 818         bcm43xx_sprom_read(bcm, sprom);
 819 #endif
 820
 821         /* boardflags2 */
 822         value = sprom[BCM43xx_SPROM_BOARDFLAGS2];
 823         bcm->sprom.boardflags2 = value;
 824
 825         /* il0macaddr */
 826         value = sprom[BCM43xx_SPROM_IL0MACADDR + 0];
 827         *(((u16 *)bcm->sprom.il0macaddr) + 0) = cpu_to_be16(value);
 828         value = sprom[BCM43xx_SPROM_IL0MACADDR + 1];
 829         *(((u16 *)bcm->sprom.il0macaddr) + 1) = cpu_to_be16(value);
 830         value = sprom[BCM43xx_SPROM_IL0MACADDR + 2];
 831         *(((u16 *)bcm->sprom.il0macaddr) + 2) = cpu_to_be16(value);
 832
 833         /* et0macaddr */
 834         value = sprom[BCM43xx_SPROM_ET0MACADDR + 0];
 835         *(((u16 *)bcm->sprom.et0macaddr) + 0) = cpu_to_be16(value);
 836         value = sprom[BCM43xx_SPROM_ET0MACADDR + 1];
 837         *(((u16 *)bcm->sprom.et0macaddr) + 1) = cpu_to_be16(value);
 838         value = sprom[BCM43xx_SPROM_ET0MACADDR + 2];
 839         *(((u16 *)bcm->sprom.et0macaddr) + 2) = cpu_to_be16(value);
 840
 841         /* et1macaddr */
 842         value = sprom[BCM43xx_SPROM_ET1MACADDR + 0];
 843         *(((u16 *)bcm->sprom.et1macaddr) + 0) = cpu_to_be16(value);
 844         value = sprom[BCM43xx_SPROM_ET1MACADDR + 1];
 845         *(((u16 *)bcm->sprom.et1macaddr) + 1) = cpu_to_be16(value);
 846         value = sprom[BCM43xx_SPROM_ET1MACADDR + 2];
 847         *(((u16 *)bcm->sprom.et1macaddr) + 2) = cpu_to_be16(value);
 848
 849         /* ethernet phy settings */
 850         value = sprom[BCM43xx_SPROM_ETHPHY];
 851         bcm->sprom.et0phyaddr = (value & 0x001F);
 852         bcm->sprom.et1phyaddr = (value & 0x03E0) >> 5;
 853         bcm->sprom.et0mdcport = (value & (1 << 14)) >> 14;
 854         bcm->sprom.et1mdcport = (value & (1 << 15)) >> 15;
 855
 856         /* boardrev, antennas, locale */
 857         value = sprom[BCM43xx_SPROM_BOARDREV];
 858         bcm->sprom.boardrev = (value & 0x00FF);
 859         bcm->sprom.locale = (value & 0x0F00) >> 8;
 860         bcm->sprom.antennas_aphy = (value & 0x3000) >> 12;
 861         bcm->sprom.antennas_bgphy = (value & 0xC000) >> 14;
 862         if (modparam_locale != -1) {
 863                 if (modparam_locale >= 0 && modparam_locale <= 11) {
 864                         bcm->sprom.locale = modparam_locale;
 865                         printk(KERN_WARNING PFX "Operating with modified "
 866                                                 "LocaleCode %u (%s)\n",
 867                                bcm->sprom.locale,
 868                                bcm43xx_locale_string(bcm->sprom.locale));
 869                 } else {
 870                         printk(KERN_WARNING PFX "Module parameter \"locale\" "
 871                                                 "invalid value. (0 - 11)\n");
 872                 }
 873         }
 874
 875         /* pa0b* */
 876         value = sprom[BCM43xx_SPROM_PA0B0];
 877         bcm->sprom.pa0b0 = value;
 878         value = sprom[BCM43xx_SPROM_PA0B1];
 879         bcm->sprom.pa0b1 = value;
 880         value = sprom[BCM43xx_SPROM_PA0B2];
 881         bcm->sprom.pa0b2 = value;
 882
 883         /* wl0gpio* */
 884         value = sprom[BCM43xx_SPROM_WL0GPIO0];
 885         if (value == 0x0000)
 886                 value = 0xFFFF;
 887         bcm->sprom.wl0gpio0 = value & 0x00FF;
 888         bcm->sprom.wl0gpio1 = (value & 0xFF00) >> 8;
 889         value = sprom[BCM43xx_SPROM_WL0GPIO2];
 890         if (value == 0x0000)
 891                 value = 0xFFFF;
 892         bcm->sprom.wl0gpio2 = value & 0x00FF;
 893         bcm->sprom.wl0gpio3 = (value & 0xFF00) >> 8;
 894
 895         /* maxpower */
 896         value = sprom[BCM43xx_SPROM_MAXPWR];
 897         bcm->sprom.maxpower_aphy = (value & 0xFF00) >> 8;
 898         bcm->sprom.maxpower_bgphy = value & 0x00FF;
 899
 900         /* pa1b* */
 901         value = sprom[BCM43xx_SPROM_PA1B0];
 902         bcm->sprom.pa1b0 = value;
 903         value = sprom[BCM43xx_SPROM_PA1B1];
 904         bcm->sprom.pa1b1 = value;
 905         value = sprom[BCM43xx_SPROM_PA1B2];
 906         bcm->sprom.pa1b2 = value;
 907
 908         /* idle tssi target */
 909         value = sprom[BCM43xx_SPROM_IDL_TSSI_TGT];
 910         bcm->sprom.idle_tssi_tgt_aphy = value & 0x00FF;
 911         bcm->sprom.idle_tssi_tgt_bgphy = (value & 0xFF00) >> 8;
 912
 913         /* boardflags */
 914         value = sprom[BCM43xx_SPROM_BOARDFLAGS];
 915         if (value == 0xFFFF)
 916                 value = 0x0000;
 917         bcm->sprom.boardflags = value;
 918         /* boardflags workarounds */
 919         if (bcm->board_vendor == PCI_VENDOR_ID_DELL &&
 920             bcm->chip_id == 0x4301 &&
 921             bcm->board_revision == 0x74)
 922                 bcm->sprom.boardflags |= BCM43xx_BFL_BTCOEXIST;
 923         if (bcm->board_vendor == PCI_VENDOR_ID_APPLE &&
 924             bcm->board_type == 0x4E &&
 925             bcm->board_revision > 0x40)
 926                 bcm->sprom.boardflags |= BCM43xx_BFL_PACTRL;
 927
 928         /* antenna gain */
 929         value = sprom[BCM43xx_SPROM_ANTENNA_GAIN];
 930         if (value == 0x0000 || value == 0xFFFF)
 931                 value = 0x0202;
 932         /* convert values to Q5.2 */
 933         bcm->sprom.antennagain_aphy = ((value & 0xFF00) >> 8) * 4;
 934         bcm->sprom.antennagain_bgphy = (value & 0x00FF) * 4;
 935
 936         kfree(sprom);
 937
 938         return 0;
 939 }
 940
 941 static int bcm43xx_geo_init(struct bcm43xx_private *bcm)
 942 {
 943         struct ieee80211_geo *geo;
 944         struct ieee80211_channel *chan;
 945         int have_a = 0, have_bg = 0;
 946         int i;
 947         u8 channel;
 948         struct bcm43xx_phyinfo *phy;
 949         const char *iso_country;
 950
 951         geo = kzalloc(sizeof(*geo), GFP_KERNEL);
 952         if (!geo)
 953                 return -ENOMEM;
 954
 955         for (i = 0; i < bcm->nr_80211_available; i++) {
 956                 phy = &(bcm->core_80211_ext[i].phy);
 957                 switch (phy->type) {
 958                 case BCM43xx_PHYTYPE_B:
 959                 case BCM43xx_PHYTYPE_G:
 960                         have_bg = 1;
 961                         break;
 962                 case BCM43xx_PHYTYPE_A:
 963                         have_a = 1;
 964                         break;
 965                 default:
 966                         assert(0);
 967                 }
 968         }
 969         iso_country = bcm43xx_locale_iso(bcm->sprom.locale);
 970
 971         if (have_a) {
 972                 for (i = 0, channel = IEEE80211_52GHZ_MIN_CHANNEL;
 973                       channel <= IEEE80211_52GHZ_MAX_CHANNEL; channel++) {
 974                         chan = &geo->a[i++];
 975                         chan->freq = bcm43xx_channel_to_freq_a(channel);
 976                         chan->channel = channel;
 977                 }
 978                 geo->a_channels = i;
 979         }
 980         if (have_bg) {
 981                 for (i = 0, channel = IEEE80211_24GHZ_MIN_CHANNEL;
 982                       channel <= IEEE80211_24GHZ_MAX_CHANNEL; channel++) {
 983                         chan = &geo->bg[i++];
 984                         chan->freq = bcm43xx_channel_to_freq_bg(channel);
 985                         chan->channel = channel;
 986                 }
 987                 geo->bg_channels = i;
 988         }
 989         memcpy(geo->name, iso_country, 2);
 990         if (0 /*TODO: Outdoor use only */)
 991                 geo->name[2] = 'O';
 992         else if (0 /*TODO: Indoor use only */)
 993                 geo->name[2] = 'I';
 994         else
 995                 geo->name[2] = ' ';
 996         geo->name[3] = '\0';
 997
 998         ieee80211_set_geo(bcm->ieee, geo);
 999         kfree(geo);
1000
1001         return 0;
1002 }
1003
1004 /* DummyTransmission function, as documented on
1005  * http://bcm-specs.sipsolutions.net/DummyTransmission
1006  */
1007 void bcm43xx_dummy_transmission(struct bcm43xx_private *bcm)
1008 {
1009         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
1010         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
1011         unsigned int i, max_loop;
1012         u16 value = 0;
1013         u32 buffer[5] = {
1014                 0x00000000,
1015                 0x0000D400,
1016                 0x00000000,
1017                 0x00000001,
1018                 0x00000000,
1019         };
1020
1021         switch (phy->type) {
1022         case BCM43xx_PHYTYPE_A:
1023                 max_loop = 0x1E;
1024                 buffer[0] = 0xCC010200;
1025                 break;
1026         case BCM43xx_PHYTYPE_B:
1027         case BCM43xx_PHYTYPE_G:
1028                 max_loop = 0xFA;
1029                 buffer[0] = 0x6E840B00;
1030                 break;
1031         default:
1032                 assert(0);
1033                 return;
1034         }
1035
1036         for (i = 0; i < 5; i++)
1037                 bcm43xx_ram_write(bcm, i * 4, buffer[i]);
1038
1039         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD); /* dummy read */
1040
1041         bcm43xx_write16(bcm, 0x0568, 0x0000);
1042         bcm43xx_write16(bcm, 0x07C0, 0x0000);
1043         bcm43xx_write16(bcm, 0x050C, ((phy->type == BCM43xx_PHYTYPE_A) ? 1 : 0));
1044         bcm43xx_write16(bcm, 0x0508, 0x0000);
1045         bcm43xx_write16(bcm, 0x050A, 0x0000);
1046         bcm43xx_write16(bcm, 0x054C, 0x0000);
1047         bcm43xx_write16(bcm, 0x056A, 0x0014);
1048         bcm43xx_write16(bcm, 0x0568, 0x0826);
1049         bcm43xx_write16(bcm, 0x0500, 0x0000);
1050         bcm43xx_write16(bcm, 0x0502, 0x0030);
1051
1052         if (radio->version == 0x2050 && radio->revision <= 0x5)
1053                 bcm43xx_radio_write16(bcm, 0x0051, 0x0017);
1054         for (i = 0x00; i < max_loop; i++) {
1055                 value = bcm43xx_read16(bcm, 0x050E);
1056                 if (value & 0x0080)
1057                         break;
1058                 udelay(10);
1059         }
1060         for (i = 0x00; i < 0x0A; i++) {
1061                 value = bcm43xx_read16(bcm, 0x050E);
1062                 if (value & 0x0400)
1063                         break;
1064                 udelay(10);
1065         }
1066         for (i = 0x00; i < 0x0A; i++) {
1067                 value = bcm43xx_read16(bcm, 0x0690);
1068                 if (!(value & 0x0100))
1069                         break;
1070                 udelay(10);
1071         }
1072         if (radio->version == 0x2050 && radio->revision <= 0x5)
1073                 bcm43xx_radio_write16(bcm, 0x0051, 0x0037);
1074 }
1075
1076 static void key_write(struct bcm43xx_private *bcm,
1077                       u8 index, u8 algorithm, const u16 *key)
1078 {
1079         unsigned int i, basic_wep = 0;
1080         u32 offset;
1081         u16 value;
1082
1083         /* Write associated key information */
1084         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x100 + (index * 2),
1085                             ((index << 4) | (algorithm & 0x0F)));
1086
1087         /* The first 4 WEP keys need extra love */
1088         if (((algorithm == BCM43xx_SEC_ALGO_WEP) ||
1089             (algorithm == BCM43xx_SEC_ALGO_WEP104)) && (index < 4))
1090                 basic_wep = 1;
1091
1092         /* Write key payload, 8 little endian words */
1093         offset = bcm->security_offset + (index * BCM43xx_SEC_KEYSIZE);
1094         for (i = 0; i < (BCM43xx_SEC_KEYSIZE / sizeof(u16)); i++) {
1095                 value = cpu_to_le16(key[i]);
1096                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1097                                     offset + (i * 2), value);
1098
1099                 if (!basic_wep)
1100                         continue;
1101
1102                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1103                                     offset + (i * 2) + 4 * BCM43xx_SEC_KEYSIZE,
1104                                     value);
1105         }
1106 }
1107
1108 static void keymac_write(struct bcm43xx_private *bcm,
1109                          u8 index, const u32 *addr)
1110 {
1111         /* for keys 0-3 there is no associated mac address */
1112         if (index < 4)
1113                 return;
1114
1115         index -= 4;
1116         if (bcm->current_core->rev >= 5) {
1117                 bcm43xx_shm_write32(bcm,
1118                                     BCM43xx_SHM_HWMAC,
1119                                     index * 2,
1120                                     cpu_to_be32(*addr));
1121                 bcm43xx_shm_write16(bcm,
1122                                     BCM43xx_SHM_HWMAC,
1123                                     (index * 2) + 1,
1124                                     cpu_to_be16(*((u16 *)(addr + 1))));
1125         } else {
1126                 if (index < 8) {
1127                         TODO(); /* Put them in the macaddress filter */
1128                 } else {
1129                         TODO();
1130                         /* Put them BCM43xx_SHM_SHARED, stating index 0x0120.
1131                            Keep in mind to update the count of keymacs in 0x003E as well! */
1132                 }
1133         }
1134 }
1135
1136 static int bcm43xx_key_write(struct bcm43xx_private *bcm,
1137                              u8 index, u8 algorithm,
1138                              const u8 *_key, int key_len,
1139                              const u8 *mac_addr)
1140 {
1141         u8 key[BCM43xx_SEC_KEYSIZE] = { 0 };
1142
1143         if (index >= ARRAY_SIZE(bcm->key))
1144                 return -EINVAL;
1145         if (key_len > ARRAY_SIZE(key))
1146                 return -EINVAL;
1147         if (algorithm < 1 || algorithm > 5)
1148                 return -EINVAL;
1149
1150         memcpy(key, _key, key_len);
1151         key_write(bcm, index, algorithm, (const u16 *)key);
1152         keymac_write(bcm, index, (const u32 *)mac_addr);
1153
1154         bcm->key[index].algorithm = algorithm;
1155
1156         return 0;
1157 }
1158
1159 static void bcm43xx_clear_keys(struct bcm43xx_private *bcm)
1160 {
1161         static const u32 zero_mac[2] = { 0 };
1162         unsigned int i,j, nr_keys = 54;
1163         u16 offset;
1164
1165         if (bcm->current_core->rev < 5)
1166                 nr_keys = 16;
1167         assert(nr_keys <= ARRAY_SIZE(bcm->key));
1168
1169         for (i = 0; i < nr_keys; i++) {
1170                 bcm->key[i].enabled = 0;
1171                 /* returns for i < 4 immediately */
1172                 keymac_write(bcm, i, zero_mac);
1173                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1174                                     0x100 + (i * 2), 0x0000);
1175                 for (j = 0; j < 8; j++) {
1176                         offset = bcm->security_offset + (j * 4) + (i * BCM43xx_SEC_KEYSIZE);
1177                         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1178                                             offset, 0x0000);
1179                 }
1180         }
1181         dprintk(KERN_INFO PFX "Keys cleared\n");
1182 }
1183
1184 /* Lowlevel core-switch function. This is only to be used in
1185  * bcm43xx_switch_core() and bcm43xx_probe_cores()
1186  */
1187 static int _switch_core(struct bcm43xx_private *bcm, int core)
1188 {
1189         int err;
1190         int attempts = 0;
1191         u32 current_core;
1192
1193         assert(core >= 0);
1194         while (1) {
1195                 err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_ACTIVE_CORE,
1196                                                  (core * 0x1000) + 0x18000000);
1197                 if (unlikely(err))
1198                         goto error;
1199                 err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCICFG_ACTIVE_CORE,
1200                                                 &current_core);
1201                 if (unlikely(err))
1202                         goto error;
1203                 current_core = (current_core - 0x18000000) / 0x1000;
1204                 if (current_core == core)
1205                         break;
1206
1207                 if (unlikely(attempts++ > BCM43xx_SWITCH_CORE_MAX_RETRIES))
1208                         goto error;
1209                 udelay(10);
1210         }
1211 #ifdef CONFIG_BCM947XX
1212         if (bcm->pci_dev->bus->number == 0)
1213                 bcm->current_core_offset = 0x1000 * core;
1214         else
1215                 bcm->current_core_offset = 0;
1216 #endif
1217
1218         return 0;
1219 error:
1220         printk(KERN_ERR PFX "Failed to switch to core %d\n", core);
1221         return -ENODEV;
1222 }
1223
1224 int bcm43xx_switch_core(struct bcm43xx_private *bcm, struct bcm43xx_coreinfo *new_core)
1225 {
1226         int err;
1227
1228         if (unlikely(!new_core))
1229                 return 0;
1230         if (!new_core->available)
1231                 return -ENODEV;
1232         if (bcm->current_core == new_core)
1233                 return 0;
1234         err = _switch_core(bcm, new_core->index);
1235         if (unlikely(err))
1236                 goto out;
1237
1238         bcm->current_core = new_core;
1239 out:
1240         return err;
1241 }
1242
1243 static int bcm43xx_core_enabled(struct bcm43xx_private *bcm)
1244 {
1245         u32 value;
1246
1247         value = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1248         value &= BCM43xx_SBTMSTATELOW_CLOCK | BCM43xx_SBTMSTATELOW_RESET
1249                  | BCM43xx_SBTMSTATELOW_REJECT;
1250
1251         return (value == BCM43xx_SBTMSTATELOW_CLOCK);
1252 }
1253
1254 /* disable current core */
1255 static int bcm43xx_core_disable(struct bcm43xx_private *bcm, u32 core_flags)
1256 {
1257         u32 sbtmstatelow;
1258         u32 sbtmstatehigh;
1259         int i;
1260
1261         /* fetch sbtmstatelow from core information registers */
1262         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1263
1264         /* core is already in reset */
1265         if (sbtmstatelow & BCM43xx_SBTMSTATELOW_RESET)
1266                 goto out;
1267
1268         if (sbtmstatelow & BCM43xx_SBTMSTATELOW_CLOCK) {
1269                 sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK |
1270                                BCM43xx_SBTMSTATELOW_REJECT;
1271                 bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1272
1273                 for (i = 0; i < 1000; i++) {
1274                         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1275                         if (sbtmstatelow & BCM43xx_SBTMSTATELOW_REJECT) {
1276                                 i = -1;
1277                                 break;
1278                         }
1279                         udelay(10);
1280                 }
1281                 if (i != -1) {
1282                         printk(KERN_ERR PFX "Error: core_disable() REJECT timeout!\n");
1283                         return -EBUSY;
1284                 }
1285
1286                 for (i = 0; i < 1000; i++) {
1287                         sbtmstatehigh = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH);
1288                         if (!(sbtmstatehigh & BCM43xx_SBTMSTATEHIGH_BUSY)) {
1289                                 i = -1;
1290                                 break;
1291                         }
1292                         udelay(10);
1293                 }
1294                 if (i != -1) {
1295                         printk(KERN_ERR PFX "Error: core_disable() BUSY timeout!\n");
1296                         return -EBUSY;
1297                 }
1298
1299                 sbtmstatelow = BCM43xx_SBTMSTATELOW_FORCE_GATE_CLOCK |
1300                                BCM43xx_SBTMSTATELOW_REJECT |
1301                                BCM43xx_SBTMSTATELOW_RESET |
1302                                BCM43xx_SBTMSTATELOW_CLOCK |
1303                                core_flags;
1304                 bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1305                 udelay(10);
1306         }
1307
1308         sbtmstatelow = BCM43xx_SBTMSTATELOW_RESET |
1309                        BCM43xx_SBTMSTATELOW_REJECT |
1310                        core_flags;
1311         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1312
1313 out:
1314         bcm->current_core->enabled = 0;
1315
1316         return 0;
1317 }
1318
1319 /* enable (reset) current core */
1320 static int bcm43xx_core_enable(struct bcm43xx_private *bcm, u32 core_flags)
1321 {
1322         u32 sbtmstatelow;
1323         u32 sbtmstatehigh;
1324         u32 sbimstate;
1325         int err;
1326
1327         err = bcm43xx_core_disable(bcm, core_flags);
1328         if (err)
1329                 goto out;
1330
1331         sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK |
1332                        BCM43xx_SBTMSTATELOW_RESET |
1333                        BCM43xx_SBTMSTATELOW_FORCE_GATE_CLOCK |
1334                        core_flags;
1335         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1336         udelay(1);
1337
1338         sbtmstatehigh = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH);
1339         if (sbtmstatehigh & BCM43xx_SBTMSTATEHIGH_SERROR) {
1340                 sbtmstatehigh = 0x00000000;
1341                 bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATEHIGH, sbtmstatehigh);
1342         }
1343
1344         sbimstate = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMSTATE);
1345         if (sbimstate & (BCM43xx_SBIMSTATE_IB_ERROR | BCM43xx_SBIMSTATE_TIMEOUT)) {
1346                 sbimstate &= ~(BCM43xx_SBIMSTATE_IB_ERROR | BCM43xx_SBIMSTATE_TIMEOUT);
1347                 bcm43xx_write32(bcm, BCM43xx_CIR_SBIMSTATE, sbimstate);
1348         }
1349
1350         sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK |
1351                        BCM43xx_SBTMSTATELOW_FORCE_GATE_CLOCK |
1352                        core_flags;
1353         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1354         udelay(1);
1355
1356         sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK | core_flags;
1357         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1358         udelay(1);
1359
1360         bcm->current_core->enabled = 1;
1361         assert(err == 0);
1362 out:
1363         return err;
1364 }
1365
1366 /* http://bcm-specs.sipsolutions.net/80211CoreReset */
1367 void bcm43xx_wireless_core_reset(struct bcm43xx_private *bcm, int connect_phy)
1368 {
1369         u32 flags = 0x00040000;
1370
1371         if ((bcm43xx_core_enabled(bcm)) &&
1372             !bcm43xx_using_pio(bcm)) {
1373 //FIXME: Do we _really_ want #ifndef CONFIG_BCM947XX here?
1374 #ifndef CONFIG_BCM947XX
1375                 /* reset all used DMA controllers. */
1376                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA1_BASE);
1377                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA2_BASE);
1378                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA3_BASE);
1379                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA4_BASE);
1380                 bcm43xx_dmacontroller_rx_reset(bcm, BCM43xx_MMIO_DMA1_BASE);
1381                 if (bcm->current_core->rev < 5)
1382                         bcm43xx_dmacontroller_rx_reset(bcm, BCM43xx_MMIO_DMA4_BASE);
1383 #endif
1384         }
1385         if (bcm43xx_status(bcm) == BCM43xx_STAT_SHUTTINGDOWN) {
1386                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
1387                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
1388                                 & ~(BCM43xx_SBF_MAC_ENABLED | 0x00000002));
1389         } else {
1390                 if (connect_phy)
1391                         flags |= 0x20000000;
1392                 bcm43xx_phy_connect(bcm, connect_phy);
1393                 bcm43xx_core_enable(bcm, flags);
1394                 bcm43xx_write16(bcm, 0x03E6, 0x0000);
1395                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
1396                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
1397                                 | BCM43xx_SBF_400);
1398         }
1399 }
1400
1401 static void bcm43xx_wireless_core_disable(struct bcm43xx_private *bcm)
1402 {
1403         bcm43xx_radio_turn_off(bcm);
1404         bcm43xx_write16(bcm, 0x03E6, 0x00F4);
1405         bcm43xx_core_disable(bcm, 0);
1406 }
1407
1408 /* Mark the current 80211 core inactive. */
1409 static void bcm43xx_wireless_core_mark_inactive(struct bcm43xx_private *bcm)
1410 {
1411         u32 sbtmstatelow;
1412
1413         bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
1414         bcm43xx_radio_turn_off(bcm);
1415         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1416         sbtmstatelow &= 0xDFF5FFFF;
1417         sbtmstatelow |= 0x000A0000;
1418         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1419         udelay(1);
1420         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1421         sbtmstatelow &= 0xFFF5FFFF;
1422         sbtmstatelow |= 0x00080000;
1423         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1424         udelay(1);
1425 }
1426
1427 static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
1428 {
1429         u32 v0, v1;
1430         u16 tmp;
1431         struct bcm43xx_xmitstatus stat;
1432
1433         while (1) {
1434                 v0 = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
1435                 if (!v0)
1436                         break;
1437                 v1 = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
1438
1439                 stat.cookie = (v0 >> 16) & 0x0000FFFF;
1440                 tmp = (u16)((v0 & 0xFFF0) | ((v0 & 0xF) >> 1));
1441                 stat.flags = tmp & 0xFF;
1442                 stat.cnt1 = (tmp & 0x0F00) >> 8;
1443                 stat.cnt2 = (tmp & 0xF000) >> 12;
1444                 stat.seq = (u16)(v1 & 0xFFFF);
1445                 stat.unknown = (u16)((v1 >> 16) & 0xFF);
1446
1447                 bcm43xx_debugfs_log_txstat(bcm, &stat);
1448
1449                 if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE)
1450                         continue;
1451                 if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) {
1452                         //TODO: packet was not acked (was lost)
1453                 }
1454                 //TODO: There are more (unknown) flags to test. see bcm43xx_main.h
1455
1456                 if (bcm43xx_using_pio(bcm))
1457                         bcm43xx_pio_handle_xmitstatus(bcm, &stat);
1458                 else
1459                         bcm43xx_dma_handle_xmitstatus(bcm, &stat);
1460         }
1461 }
1462
1463 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
1464 {
1465         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
1466         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x40A, 0x7F7F);
1467         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD,
1468                         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD) | (1 << 4));
1469         assert(bcm->noisecalc.core_at_start == bcm->current_core);
1470         assert(bcm->noisecalc.channel_at_start == bcm43xx_current_radio(bcm)->channel);
1471 }
1472
1473 static void bcm43xx_calculate_link_quality(struct bcm43xx_private *bcm)
1474 {
1475         /* Top half of Link Quality calculation. */
1476
1477         if (bcm->noisecalc.calculation_running)
1478                 return;
1479         bcm->noisecalc.core_at_start = bcm->current_core;
1480         bcm->noisecalc.channel_at_start = bcm43xx_current_radio(bcm)->channel;
1481         bcm->noisecalc.calculation_running = 1;
1482         bcm->noisecalc.nr_samples = 0;
1483
1484         bcm43xx_generate_noise_sample(bcm);
1485 }
1486
1487 static void handle_irq_noise(struct bcm43xx_private *bcm)
1488 {
1489         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
1490         u16 tmp;
1491         u8 noise[4];
1492         u8 i, j;
1493         s32 average;
1494
1495         /* Bottom half of Link Quality calculation. */
1496
1497         assert(bcm->noisecalc.calculation_running);
1498         if (bcm->noisecalc.core_at_start != bcm->current_core ||
1499             bcm->noisecalc.channel_at_start != radio->channel)
1500                 goto drop_calculation;
1501         tmp = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, 0x408);
1502         noise[0] = (tmp & 0x00FF);
1503         noise[1] = (tmp & 0xFF00) >> 8;
1504         tmp = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, 0x40A);
1505         noise[2] = (tmp & 0x00FF);
1506         noise[3] = (tmp & 0xFF00) >> 8;
1507         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1508             noise[2] == 0x7F || noise[3] == 0x7F)
1509                 goto generate_new;
1510
1511         /* Get the noise samples. */
1512         assert(bcm->noisecalc.nr_samples < 8);
1513         i = bcm->noisecalc.nr_samples;
1514         noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1515         noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1516         noise[2] = limit_value(noise[2], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1517         noise[3] = limit_value(noise[3], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1518         bcm->noisecalc.samples[i][0] = radio->nrssi_lt[noise[0]];
1519         bcm->noisecalc.samples[i][1] = radio->nrssi_lt[noise[1]];
1520         bcm->noisecalc.samples[i][2] = radio->nrssi_lt[noise[2]];
1521         bcm->noisecalc.samples[i][3] = radio->nrssi_lt[noise[3]];
1522         bcm->noisecalc.nr_samples++;
1523         if (bcm->noisecalc.nr_samples == 8) {
1524                 /* Calculate the Link Quality by the noise samples. */
1525                 average = 0;
1526                 for (i = 0; i < 8; i++) {
1527                         for (j = 0; j < 4; j++)
1528                                 average += bcm->noisecalc.samples[i][j];
1529                 }
1530                 average /= (8 * 4);
1531                 average *= 125;
1532                 average += 64;
1533                 average /= 128;
1534
1535                 tmp = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, 0x40C);
1536                 tmp = (tmp / 128) & 0x1F;
1537                 if (tmp >= 8)
1538                         average += 2;
1539                 else
1540                         average -= 25;
1541                 if (tmp == 8)
1542                         average -= 72;
1543                 else
1544                         average -= 48;
1545
1546 /* FIXME: This is wrong, but people want fancy stats. well... */
1547 bcm->stats.noise = average;
1548                 if (average > -65)
1549                         bcm->stats.link_quality = 0;
1550                 else if (average > -75)
1551                         bcm->stats.link_quality = 1;
1552                 else if (average > -85)
1553                         bcm->stats.link_quality = 2;
1554                 else
1555                         bcm->stats.link_quality = 3;
1556 //              dprintk(KERN_INFO PFX "Link Quality: %u (avg was %d)\n", bcm->stats.link_quality, average);
1557 drop_calculation:
1558                 bcm->noisecalc.calculation_running = 0;
1559                 return;
1560         }
1561 generate_new:
1562         bcm43xx_generate_noise_sample(bcm);
1563 }
1564
1565 static void handle_irq_ps(struct bcm43xx_private *bcm)
1566 {
1567         if (bcm->ieee->iw_mode == IW_MODE_MASTER) {
1568                 ///TODO: PS TBTT
1569         } else {
1570                 if (1/*FIXME: the last PSpoll frame was sent successfully */)
1571                         bcm43xx_power_saving_ctl_bits(bcm, -1, -1);
1572         }
1573         if (bcm->ieee->iw_mode == IW_MODE_ADHOC)
1574                 bcm->reg124_set_0x4 = 1;
1575         //FIXME else set to false?
1576 }
1577
1578 static void handle_irq_reg124(struct bcm43xx_private *bcm)
1579 {
1580         if (!bcm->reg124_set_0x4)
1581                 return;
1582         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD,
1583                         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD)
1584                         | 0x4);
1585         //FIXME: reset reg124_set_0x4 to false?
1586 }
1587
1588 static void handle_irq_pmq(struct bcm43xx_private *bcm)
1589 {
1590         u32 tmp;
1591
1592         //TODO: AP mode.
1593
1594         while (1) {
1595                 tmp = bcm43xx_read32(bcm, BCM43xx_MMIO_PS_STATUS);
1596                 if (!(tmp & 0x00000008))
1597                         break;
1598         }
1599         /* 16bit write is odd, but correct. */
1600         bcm43xx_write16(bcm, BCM43xx_MMIO_PS_STATUS, 0x0002);
1601 }
1602
1603 static void bcm43xx_generate_beacon_template(struct bcm43xx_private *bcm,
1604                                              u16 ram_offset, u16 shm_size_offset)
1605 {
1606         u32 value;
1607         u16 size = 0;
1608
1609         /* Timestamp. */
1610         //FIXME: assumption: The chip sets the timestamp
1611         value = 0;
1612         bcm43xx_ram_write(bcm, ram_offset++, value);
1613         bcm43xx_ram_write(bcm, ram_offset++, value);
1614         size += 8;
1615
1616         /* Beacon Interval / Capability Information */
1617         value = 0x0000;//FIXME: Which interval?
1618         value |= (1 << 0) << 16; /* ESS */
1619         value |= (1 << 2) << 16; /* CF Pollable */      //FIXME?
1620         value |= (1 << 3) << 16; /* CF Poll Request */  //FIXME?
1621         if (!bcm->ieee->open_wep)
1622                 value |= (1 << 4) << 16; /* Privacy */
1623         bcm43xx_ram_write(bcm, ram_offset++, value);
1624         size += 4;
1625
1626         /* SSID */
1627         //TODO
1628
1629         /* FH Parameter Set */
1630         //TODO
1631
1632         /* DS Parameter Set */
1633         //TODO
1634
1635         /* CF Parameter Set */
1636         //TODO
1637
1638         /* TIM */
1639         //TODO
1640
1641         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, shm_size_offset, size);
1642 }
1643
1644 static void handle_irq_beacon(struct bcm43xx_private *bcm)
1645 {
1646         u32 status;
1647
1648         bcm->irq_savedstate &= ~BCM43xx_IRQ_BEACON;
1649         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD);
1650
1651         if ((status & 0x1) && (status & 0x2)) {
1652                 /* ACK beacon IRQ. */
1653                 bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON,
1654                                 BCM43xx_IRQ_BEACON);
1655                 bcm->irq_savedstate |= BCM43xx_IRQ_BEACON;
1656                 return;
1657         }
1658         if (!(status & 0x1)) {
1659                 bcm43xx_generate_beacon_template(bcm, 0x68, 0x18);
1660                 status |= 0x1;
1661                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD, status);
1662         }
1663         if (!(status & 0x2)) {
1664                 bcm43xx_generate_beacon_template(bcm, 0x468, 0x1A);
1665                 status |= 0x2;
1666                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD, status);
1667         }
1668 }
1669
1670 /* Interrupt handler bottom-half */
1671 static void bcm43xx_interrupt_tasklet(struct bcm43xx_private *bcm)
1672 {
1673         u32 reason;
1674         u32 dma_reason[4];
1675         int activity = 0;
1676         unsigned long flags;
1677
1678 #ifdef CONFIG_BCM43XX_DEBUG
1679         u32 _handled = 0x00000000;
1680 # define bcmirq_handled(irq)    do { _handled |= (irq); } while (0)
1681 #else
1682 # define bcmirq_handled(irq)    do { /* nothing */ } while (0)
1683 #endif /* CONFIG_BCM43XX_DEBUG*/
1684
1685         spin_lock_irqsave(&bcm->irq_lock, flags);
1686         reason = bcm->irq_reason;
1687         dma_reason[0] = bcm->dma_reason[0];
1688         dma_reason[1] = bcm->dma_reason[1];
1689         dma_reason[2] = bcm->dma_reason[2];
1690         dma_reason[3] = bcm->dma_reason[3];
1691
1692         if (unlikely(reason & BCM43xx_IRQ_XMIT_ERROR)) {
1693                 /* TX error. We get this when Template Ram is written in wrong endianess
1694                  * in dummy_tx(). We also get this if something is wrong with the TX header
1695                  * on DMA or PIO queues.
1696                  * Maybe we get this in other error conditions, too.
1697                  */
1698                 printkl(KERN_ERR PFX "FATAL ERROR: BCM43xx_IRQ_XMIT_ERROR\n");
1699                 bcmirq_handled(BCM43xx_IRQ_XMIT_ERROR);
1700         }
1701         if (unlikely((dma_reason[0] & BCM43xx_DMAIRQ_FATALMASK) |
1702                      (dma_reason[1] & BCM43xx_DMAIRQ_FATALMASK) |
1703                      (dma_reason[2] & BCM43xx_DMAIRQ_FATALMASK) |
1704                      (dma_reason[3] & BCM43xx_DMAIRQ_FATALMASK))) {
1705                 printkl(KERN_ERR PFX "FATAL ERROR: Fatal DMA error: "
1706                                      "0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1707                         dma_reason[0], dma_reason[1],
1708                         dma_reason[2], dma_reason[3]);
1709                 bcm43xx_controller_restart(bcm, "DMA error");
1710                 mmiowb();
1711                 spin_unlock_irqrestore(&bcm->irq_lock, flags);
1712                 return;
1713         }
1714         if (unlikely((dma_reason[0] & BCM43xx_DMAIRQ_NONFATALMASK) |
1715                      (dma_reason[1] & BCM43xx_DMAIRQ_NONFATALMASK) |
1716                      (dma_reason[2] & BCM43xx_DMAIRQ_NONFATALMASK) |
1717                      (dma_reason[3] & BCM43xx_DMAIRQ_NONFATALMASK))) {
1718                 printkl(KERN_ERR PFX "DMA error: "
1719                                      "0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1720                         dma_reason[0], dma_reason[1],
1721                         dma_reason[2], dma_reason[3]);
1722         }
1723
1724         if (reason & BCM43xx_IRQ_PS) {
1725                 handle_irq_ps(bcm);
1726                 bcmirq_handled(BCM43xx_IRQ_PS);
1727         }
1728
1729         if (reason & BCM43xx_IRQ_REG124) {
1730                 handle_irq_reg124(bcm);
1731                 bcmirq_handled(BCM43xx_IRQ_REG124);
1732         }
1733
1734         if (reason & BCM43xx_IRQ_BEACON) {
1735                 if (bcm->ieee->iw_mode == IW_MODE_MASTER)
1736                         handle_irq_beacon(bcm);
1737                 bcmirq_handled(BCM43xx_IRQ_BEACON);
1738         }
1739
1740         if (reason & BCM43xx_IRQ_PMQ) {
1741                 handle_irq_pmq(bcm);
1742                 bcmirq_handled(BCM43xx_IRQ_PMQ);
1743         }
1744
1745         if (reason & BCM43xx_IRQ_SCAN) {
1746                 /*TODO*/
1747                 //bcmirq_handled(BCM43xx_IRQ_SCAN);
1748         }
1749
1750         if (reason & BCM43xx_IRQ_NOISE) {
1751                 handle_irq_noise(bcm);
1752                 bcmirq_handled(BCM43xx_IRQ_NOISE);
1753         }
1754
1755         /* Check the DMA reason registers for received data. */
1756         assert(!(dma_reason[1] & BCM43xx_DMAIRQ_RX_DONE));
1757         assert(!(dma_reason[2] & BCM43xx_DMAIRQ_RX_DONE));
1758         if (dma_reason[0] & BCM43xx_DMAIRQ_RX_DONE) {
1759                 if (bcm43xx_using_pio(bcm))
1760                         bcm43xx_pio_rx(bcm43xx_current_pio(bcm)->queue0);
1761                 else
1762                         bcm43xx_dma_rx(bcm43xx_current_dma(bcm)->rx_ring0);
1763                 /* We intentionally don't set "activity" to 1, here. */
1764         }
1765         if (dma_reason[3] & BCM43xx_DMAIRQ_RX_DONE) {
1766                 if (bcm43xx_using_pio(bcm))
1767                         bcm43xx_pio_rx(bcm43xx_current_pio(bcm)->queue3);
1768                 else
1769                         bcm43xx_dma_rx(bcm43xx_current_dma(bcm)->rx_ring1);
1770                 activity = 1;
1771         }
1772         bcmirq_handled(BCM43xx_IRQ_RX);
1773
1774         if (reason & BCM43xx_IRQ_XMIT_STATUS) {
1775                 handle_irq_transmit_status(bcm);
1776                 activity = 1;
1777                 //TODO: In AP mode, this also causes sending of powersave responses.
1778                 bcmirq_handled(BCM43xx_IRQ_XMIT_STATUS);
1779         }
1780
1781         /* IRQ_PIO_WORKAROUND is handled in the top-half. */
1782         bcmirq_handled(BCM43xx_IRQ_PIO_WORKAROUND);
1783 #ifdef CONFIG_BCM43XX_DEBUG
1784         if (unlikely(reason & ~_handled)) {
1785                 printkl(KERN_WARNING PFX
1786                         "Unhandled IRQ! Reason: 0x%08x,  Unhandled: 0x%08x,  "
1787                         "DMA: 0x%08x, 0x%08x, 0x%08x, 0x%08x\n",
1788                         reason, (reason & ~_handled),
1789                         dma_reason[0], dma_reason[1],
1790                         dma_reason[2], dma_reason[3]);
1791         }
1792 #endif
1793 #undef bcmirq_handled
1794
1795         if (!modparam_noleds)
1796                 bcm43xx_leds_update(bcm, activity);
1797         bcm43xx_interrupt_enable(bcm, bcm->irq_savedstate);
1798         mmiowb();
1799         spin_unlock_irqrestore(&bcm->irq_lock, flags);
1800 }
1801
1802 static void pio_irq_workaround(struct bcm43xx_private *bcm,
1803                                u16 base, int queueidx)
1804 {
1805         u16 rxctl;
1806
1807         rxctl = bcm43xx_read16(bcm, base + BCM43xx_PIO_RXCTL);
1808         if (rxctl & BCM43xx_PIO_RXCTL_DATAAVAILABLE)
1809                 bcm->dma_reason[queueidx] |= BCM43xx_DMAIRQ_RX_DONE;
1810         else
1811                 bcm->dma_reason[queueidx] &= ~BCM43xx_DMAIRQ_RX_DONE;
1812 }
1813
1814 static void bcm43xx_interrupt_ack(struct bcm43xx_private *bcm, u32 reason)
1815 {
1816         if (bcm43xx_using_pio(bcm) &&
1817             (bcm->current_core->rev < 3) &&
1818             (!(reason & BCM43xx_IRQ_PIO_WORKAROUND))) {
1819                 /* Apply a PIO specific workaround to the dma_reasons */
1820                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO1_BASE, 0);
1821                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO2_BASE, 1);
1822                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO3_BASE, 2);
1823                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO4_BASE, 3);
1824         }
1825
1826         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, reason);
1827
1828         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_REASON,
1829                         bcm->dma_reason[0]);
1830         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA2_REASON,
1831                         bcm->dma_reason[1]);
1832         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_REASON,
1833                         bcm->dma_reason[2]);
1834         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_REASON,
1835                         bcm->dma_reason[3]);
1836 }
1837
1838 /* Interrupt handler top-half */
1839 static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id, struct pt_regs *regs)
1840 {
1841         irqreturn_t ret = IRQ_HANDLED;
1842         struct bcm43xx_private *bcm = dev_id;
1843         u32 reason;
1844
1845         if (!bcm)
1846                 return IRQ_NONE;
1847
1848         spin_lock(&bcm->irq_lock);
1849
1850         assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
1851         assert(bcm->current_core->id == BCM43xx_COREID_80211);
1852
1853         reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
1854         if (reason == 0xffffffff) {
1855                 /* irq not for us (shared irq) */
1856                 ret = IRQ_NONE;
1857                 goto out;
1858         }
1859         reason &= bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
1860         if (!reason)
1861                 goto out;
1862
1863         bcm->dma_reason[0] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_REASON)
1864                              & 0x0001dc00;
1865         bcm->dma_reason[1] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA2_REASON)
1866                              & 0x0000dc00;
1867         bcm->dma_reason[2] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA3_REASON)
1868                              & 0x0000dc00;
1869         bcm->dma_reason[3] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA4_REASON)
1870                              & 0x0001dc00;
1871
1872         bcm43xx_interrupt_ack(bcm, reason);
1873
1874         /* disable all IRQs. They are enabled again in the bottom half. */
1875         bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
1876         /* save the reason code and call our bottom half. */
1877         bcm->irq_reason = reason;
1878         tasklet_schedule(&bcm->isr_tasklet);
1879
1880 out:
1881         mmiowb();
1882         spin_unlock(&bcm->irq_lock);
1883
1884         return ret;
1885 }
1886
1887 static void bcm43xx_release_firmware(struct bcm43xx_private *bcm, int force)
1888 {
1889         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
1890
1891         if (bcm->firmware_norelease && !force)
1892                 return; /* Suspending or controller reset. */
1893         release_firmware(phy->ucode);
1894         phy->ucode = NULL;
1895         release_firmware(phy->pcm);
1896         phy->pcm = NULL;
1897         release_firmware(phy->initvals0);
1898         phy->initvals0 = NULL;
1899         release_firmware(phy->initvals1);
1900         phy->initvals1 = NULL;
1901 }
1902
1903 static int bcm43xx_request_firmware(struct bcm43xx_private *bcm)
1904 {
1905         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
1906         u8 rev = bcm->current_core->rev;
1907         int err = 0;
1908         int nr;
1909         char buf[22 + sizeof(modparam_fwpostfix) - 1] = { 0 };
1910
1911         if (!phy->ucode) {
1912                 snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_microcode%d%s.fw",
1913                          (rev >= 5 ? 5 : rev),
1914                          modparam_fwpostfix);
1915                 err = request_firmware(&phy->ucode, buf, &bcm->pci_dev->dev);
1916                 if (err) {
1917                         printk(KERN_ERR PFX
1918                                "Error: Microcode \"%s\" not available or load failed.\n",
1919                                 buf);
1920                         goto error;
1921                 }
1922         }
1923
1924         if (!phy->pcm) {
1925                 snprintf(buf, ARRAY_SIZE(buf),
1926                          "bcm43xx_pcm%d%s.fw",
1927                          (rev < 5 ? 4 : 5),
1928                          modparam_fwpostfix);
1929                 err = request_firmware(&phy->pcm, buf, &bcm->pci_dev->dev);
1930                 if (err) {
1931                         printk(KERN_ERR PFX
1932                                "Error: PCM \"%s\" not available or load failed.\n",
1933                                buf);
1934                         goto error;
1935                 }
1936         }
1937
1938         if (!phy->initvals0) {
1939                 if (rev == 2 || rev == 4) {
1940                         switch (phy->type) {
1941                         case BCM43xx_PHYTYPE_A:
1942                                 nr = 3;
1943                                 break;
1944                         case BCM43xx_PHYTYPE_B:
1945                         case BCM43xx_PHYTYPE_G:
1946                                 nr = 1;
1947                                 break;
1948                         default:
1949                                 goto err_noinitval;
1950                         }
1951
1952                 } else if (rev >= 5) {
1953                         switch (phy->type) {
1954                         case BCM43xx_PHYTYPE_A:
1955                                 nr = 7;
1956                                 break;
1957                         case BCM43xx_PHYTYPE_B:
1958                         case BCM43xx_PHYTYPE_G:
1959                                 nr = 5;
1960                                 break;
1961                         default:
1962                                 goto err_noinitval;
1963                         }
1964                 } else
1965                         goto err_noinitval;
1966                 snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_initval%02d%s.fw",
1967                          nr, modparam_fwpostfix);
1968
1969                 err = request_firmware(&phy->initvals0, buf, &bcm->pci_dev->dev);
1970                 if (err) {
1971                         printk(KERN_ERR PFX
1972                                "Error: InitVals \"%s\" not available or load failed.\n",
1973                                 buf);
1974                         goto error;
1975                 }
1976                 if (phy->initvals0->size % sizeof(struct bcm43xx_initval)) {
1977                         printk(KERN_ERR PFX "InitVals fileformat error.\n");
1978                         goto error;
1979                 }
1980         }
1981
1982         if (!phy->initvals1) {
1983                 if (rev >= 5) {
1984                         u32 sbtmstatehigh;
1985
1986                         switch (phy->type) {
1987                         case BCM43xx_PHYTYPE_A:
1988                                 sbtmstatehigh = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH);
1989                                 if (sbtmstatehigh & 0x00010000)
1990                                         nr = 9;
1991                                 else
1992                                         nr = 10;
1993                                 break;
1994                         case BCM43xx_PHYTYPE_B:
1995                         case BCM43xx_PHYTYPE_G:
1996                                         nr = 6;
1997                                 break;
1998                         default:
1999                                 goto err_noinitval;
2000                         }
2001                         snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_initval%02d%s.fw",
2002                                  nr, modparam_fwpostfix);
2003
2004                         err = request_firmware(&phy->initvals1, buf, &bcm->pci_dev->dev);
2005                         if (err) {
2006                                 printk(KERN_ERR PFX
2007                                        "Error: InitVals \"%s\" not available or load failed.\n",
2008                                         buf);
2009                                 goto error;
2010                         }
2011                         if (phy->initvals1->size % sizeof(struct bcm43xx_initval)) {
2012                                 printk(KERN_ERR PFX "InitVals fileformat error.\n");
2013                                 goto error;
2014                         }
2015                 }
2016         }
2017
2018 out:
2019         return err;
2020 error:
2021         bcm43xx_release_firmware(bcm, 1);
2022         goto out;
2023 err_noinitval:
2024         printk(KERN_ERR PFX "Error: No InitVals available!\n");
2025         err = -ENOENT;
2026         goto error;
2027 }
2028
2029 static void bcm43xx_upload_microcode(struct bcm43xx_private *bcm)
2030 {
2031         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2032         const u32 *data;
2033         unsigned int i, len;
2034
2035         /* Upload Microcode. */
2036         data = (u32 *)(phy->ucode->data);
2037         len = phy->ucode->size / sizeof(u32);
2038         bcm43xx_shm_control_word(bcm, BCM43xx_SHM_UCODE, 0x0000);
2039         for (i = 0; i < len; i++) {
2040                 bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA,
2041                                 be32_to_cpu(data[i]));
2042                 udelay(10);
2043         }
2044
2045         /* Upload PCM data. */
2046         data = (u32 *)(phy->pcm->data);
2047         len = phy->pcm->size / sizeof(u32);
2048         bcm43xx_shm_control_word(bcm, BCM43xx_SHM_PCM, 0x01ea);
2049         bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA, 0x00004000);
2050         bcm43xx_shm_control_word(bcm, BCM43xx_SHM_PCM, 0x01eb);
2051         for (i = 0; i < len; i++) {
2052                 bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA,
2053                                 be32_to_cpu(data[i]));
2054                 udelay(10);
2055         }
2056 }
2057
2058 static int bcm43xx_write_initvals(struct bcm43xx_private *bcm,
2059                                   const struct bcm43xx_initval *data,
2060                                   const unsigned int len)
2061 {
2062         u16 offset, size;
2063         u32 value;
2064         unsigned int i;
2065
2066         for (i = 0; i < len; i++) {
2067                 offset = be16_to_cpu(data[i].offset);
2068                 size = be16_to_cpu(data[i].size);
2069                 value = be32_to_cpu(data[i].value);
2070
2071                 if (unlikely(offset >= 0x1000))
2072                         goto err_format;
2073                 if (size == 2) {
2074                         if (unlikely(value & 0xFFFF0000))
2075                                 goto err_format;
2076                         bcm43xx_write16(bcm, offset, (u16)value);
2077                 } else if (size == 4) {
2078                         bcm43xx_write32(bcm, offset, value);
2079                 } else
2080                         goto err_format;
2081         }
2082
2083         return 0;
2084
2085 err_format:
2086         printk(KERN_ERR PFX "InitVals (bcm43xx_initvalXX.fw) file-format error. "
2087                             "Please fix your bcm43xx firmware files.\n");
2088         return -EPROTO;
2089 }
2090
2091 static int bcm43xx_upload_initvals(struct bcm43xx_private *bcm)
2092 {
2093         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2094         int err;
2095
2096         err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)phy->initvals0->data,
2097                                      phy->initvals0->size / sizeof(struct bcm43xx_initval));
2098         if (err)
2099                 goto out;
2100         if (phy->initvals1) {
2101                 err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)phy->initvals1->data,
2102                                              phy->initvals1->size / sizeof(struct bcm43xx_initval));
2103                 if (err)
2104                         goto out;
2105         }
2106 out:
2107         return err;
2108 }
2109
2110 #ifdef CONFIG_BCM947XX
2111 static struct pci_device_id bcm43xx_47xx_ids[] = {
2112         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4324) },
2113         { 0 }
2114 };
2115 #endif
2116
2117 static int bcm43xx_initialize_irq(struct bcm43xx_private *bcm)
2118 {
2119         int err;
2120
2121         bcm->irq = bcm->pci_dev->irq;
2122 #ifdef CONFIG_BCM947XX
2123         if (bcm->pci_dev->bus->number == 0) {
2124                 struct pci_dev *d;
2125                 struct pci_device_id *id;
2126                 for (id = bcm43xx_47xx_ids; id->vendor; id++) {
2127                         d = pci_get_device(id->vendor, id->device, NULL);
2128                         if (d != NULL) {
2129                                 bcm->irq = d->irq;
2130                                 pci_dev_put(d);
2131                                 break;
2132                         }
2133                 }
2134         }
2135 #endif
2136         err = request_irq(bcm->irq, bcm43xx_interrupt_handler,
2137                           IRQF_SHARED, KBUILD_MODNAME, bcm);
2138         if (err)
2139                 printk(KERN_ERR PFX "Cannot register IRQ%d\n", bcm->irq);
2140
2141         return err;
2142 }
2143
2144 /* Switch to the core used to write the GPIO register.
2145  * This is either the ChipCommon, or the PCI core.
2146  */
2147 static int switch_to_gpio_core(struct bcm43xx_private *bcm)
2148 {
2149         int err;
2150
2151         /* Where to find the GPIO register depends on the chipset.
2152          * If it has a ChipCommon, its register at offset 0x6c is the GPIO
2153          * control register. Otherwise the register at offset 0x6c in the
2154          * PCI core is the GPIO control register.
2155          */
2156         err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
2157         if (err == -ENODEV) {
2158                 err = bcm43xx_switch_core(bcm, &bcm->core_pci);
2159                 if (unlikely(err == -ENODEV)) {
2160                         printk(KERN_ERR PFX "gpio error: "
2161                                "Neither ChipCommon nor PCI core available!\n");
2162                 }
2163         }
2164
2165         return err;
2166 }
2167
2168 /* Initialize the GPIOs
2169  * http://bcm-specs.sipsolutions.net/GPIO
2170  */
2171 static int bcm43xx_gpio_init(struct bcm43xx_private *bcm)
2172 {
2173         struct bcm43xx_coreinfo *old_core;
2174         int err;
2175         u32 mask, set;
2176
2177         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2178                         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
2179                         & 0xFFFF3FFF);
2180
2181         bcm43xx_leds_switch_all(bcm, 0);
2182         bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
2183                         bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK) | 0x000F);
2184
2185         mask = 0x0000001F;
2186         set = 0x0000000F;
2187         if (bcm->chip_id == 0x4301) {
2188                 mask |= 0x0060;
2189                 set |= 0x0060;
2190         }
2191         if (0 /* FIXME: conditional unknown */) {
2192                 bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
2193                                 bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK)
2194                                 | 0x0100);
2195                 mask |= 0x0180;
2196                 set |= 0x0180;
2197         }
2198         if (bcm->sprom.boardflags & BCM43xx_BFL_PACTRL) {
2199                 bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
2200                                 bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK)
2201                                 | 0x0200);
2202                 mask |= 0x0200;
2203                 set |= 0x0200;
2204         }
2205         if (bcm->current_core->rev >= 2)
2206                 mask  |= 0x0010; /* FIXME: This is redundant. */
2207
2208         old_core = bcm->current_core;
2209         err = switch_to_gpio_core(bcm);
2210         if (err)
2211                 goto out;
2212         bcm43xx_write32(bcm, BCM43xx_GPIO_CONTROL,
2213                         (bcm43xx_read32(bcm, BCM43xx_GPIO_CONTROL) & mask) | set);
2214         err = bcm43xx_switch_core(bcm, old_core);
2215 out:
2216         return err;
2217 }
2218
2219 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2220 static int bcm43xx_gpio_cleanup(struct bcm43xx_private *bcm)
2221 {
2222         struct bcm43xx_coreinfo *old_core;
2223         int err;
2224
2225         old_core = bcm->current_core;
2226         err = switch_to_gpio_core(bcm);
2227         if (err)
2228                 return err;
2229         bcm43xx_write32(bcm, BCM43xx_GPIO_CONTROL, 0x00000000);
2230         err = bcm43xx_switch_core(bcm, old_core);
2231         assert(err == 0);
2232
2233         return 0;
2234 }
2235
2236 /* http://bcm-specs.sipsolutions.net/EnableMac */
2237 void bcm43xx_mac_enable(struct bcm43xx_private *bcm)
2238 {
2239         bcm->mac_suspended--;
2240         assert(bcm->mac_suspended >= 0);
2241         if (bcm->mac_suspended == 0) {
2242                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2243                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
2244                                 | BCM43xx_SBF_MAC_ENABLED);
2245                 bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, BCM43xx_IRQ_READY);
2246                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD); /* dummy read */
2247                 bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
2248                 bcm43xx_power_saving_ctl_bits(bcm, -1, -1);
2249         }
2250 }
2251
2252 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2253 void bcm43xx_mac_suspend(struct bcm43xx_private *bcm)
2254 {
2255         int i;
2256         u32 tmp;
2257
2258         assert(bcm->mac_suspended >= 0);
2259         if (bcm->mac_suspended == 0) {
2260                 bcm43xx_power_saving_ctl_bits(bcm, -1, 1);
2261                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2262                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
2263                                 & ~BCM43xx_SBF_MAC_ENABLED);
2264                 bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
2265                 for (i = 10000; i; i--) {
2266                         tmp = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
2267                         if (tmp & BCM43xx_IRQ_READY)
2268                                 goto out;
2269                         udelay(1);
2270                 }
2271                 printkl(KERN_ERR PFX "MAC suspend failed\n");
2272         }
2273 out:
2274         bcm->mac_suspended++;
2275 }
2276
2277 void bcm43xx_set_iwmode(struct bcm43xx_private *bcm,
2278                         int iw_mode)
2279 {
2280         unsigned long flags;
2281         struct net_device *net_dev = bcm->net_dev;
2282         u32 status;
2283         u16 value;
2284
2285         spin_lock_irqsave(&bcm->ieee->lock, flags);
2286         bcm->ieee->iw_mode = iw_mode;
2287         spin_unlock_irqrestore(&bcm->ieee->lock, flags);
2288         if (iw_mode == IW_MODE_MONITOR)
2289                 net_dev->type = ARPHRD_IEEE80211;
2290         else
2291                 net_dev->type = ARPHRD_ETHER;
2292
2293         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2294         /* Reset status to infrastructured mode */
2295         status &= ~(BCM43xx_SBF_MODE_AP | BCM43xx_SBF_MODE_MONITOR);
2296         status &= ~BCM43xx_SBF_MODE_PROMISC;
2297         status |= BCM43xx_SBF_MODE_NOTADHOC;
2298
2299 /* FIXME: Always enable promisc mode, until we get the MAC filters working correctly. */
2300 status |= BCM43xx_SBF_MODE_PROMISC;
2301
2302         switch (iw_mode) {
2303         case IW_MODE_MONITOR:
2304                 status |= BCM43xx_SBF_MODE_MONITOR;
2305                 status |= BCM43xx_SBF_MODE_PROMISC;
2306                 break;
2307         case IW_MODE_ADHOC:
2308                 status &= ~BCM43xx_SBF_MODE_NOTADHOC;
2309                 break;
2310         case IW_MODE_MASTER:
2311                 status |= BCM43xx_SBF_MODE_AP;
2312                 break;
2313         case IW_MODE_SECOND:
2314         case IW_MODE_REPEAT:
2315                 TODO(); /* TODO */
2316                 break;
2317         case IW_MODE_INFRA:
2318                 /* nothing to be done here... */
2319                 break;
2320         default:
2321                 dprintk(KERN_ERR PFX "Unknown mode in set_iwmode: %d\n", iw_mode);
2322         }
2323         if (net_dev->flags & IFF_PROMISC)
2324                 status |= BCM43xx_SBF_MODE_PROMISC;
2325         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
2326
2327         value = 0x0002;
2328         if (iw_mode != IW_MODE_ADHOC && iw_mode != IW_MODE_MASTER) {
2329                 if (bcm->chip_id == 0x4306 && bcm->chip_rev == 3)
2330                         value = 0x0064;
2331                 else
2332                         value = 0x0032;
2333         }
2334         bcm43xx_write16(bcm, 0x0612, value);
2335 }
2336
2337 /* This is the opposite of bcm43xx_chip_init() */
2338 static void bcm43xx_chip_cleanup(struct bcm43xx_private *bcm)
2339 {
2340         bcm43xx_radio_turn_off(bcm);
2341         if (!modparam_noleds)
2342                 bcm43xx_leds_exit(bcm);
2343         bcm43xx_gpio_cleanup(bcm);
2344         bcm43xx_release_firmware(bcm, 0);
2345 }
2346
2347 /* Initialize the chip
2348  * http://bcm-specs.sipsolutions.net/ChipInit
2349  */
2350 static int bcm43xx_chip_init(struct bcm43xx_private *bcm)
2351 {
2352         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
2353         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2354         int err;
2355         int i, tmp;
2356         u32 value32;
2357         u16 value16;
2358
2359         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2360                         BCM43xx_SBF_CORE_READY
2361                         | BCM43xx_SBF_400);
2362
2363         err = bcm43xx_request_firmware(bcm);
2364         if (err)
2365                 goto out;
2366         bcm43xx_upload_microcode(bcm);
2367
2368         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, 0xFFFFFFFF);
2369         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, 0x00020402);
2370         i = 0;
2371         while (1) {
2372                 value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
2373                 if (value32 == BCM43xx_IRQ_READY)
2374                         break;
2375                 i++;
2376                 if (i >= BCM43xx_IRQWAIT_MAX_RETRIES) {
2377                         printk(KERN_ERR PFX "IRQ_READY timeout\n");
2378                         err = -ENODEV;
2379                         goto err_release_fw;
2380                 }
2381                 udelay(10);
2382         }
2383         bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
2384
2385         err = bcm43xx_gpio_init(bcm);
2386         if (err)
2387                 goto err_release_fw;
2388
2389         err = bcm43xx_upload_initvals(bcm);
2390         if (err)
2391                 goto err_gpio_cleanup;
2392         bcm43xx_radio_turn_on(bcm);
2393
2394         bcm43xx_write16(bcm, 0x03E6, 0x0000);
2395         err = bcm43xx_phy_init(bcm);
2396         if (err)
2397                 goto err_radio_off;
2398
2399         /* Select initial Interference Mitigation. */
2400         tmp = radio->interfmode;
2401         radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
2402         bcm43xx_radio_set_interference_mitigation(bcm, tmp);
2403
2404         bcm43xx_phy_set_antenna_diversity(bcm);
2405         bcm43xx_radio_set_txantenna(bcm, BCM43xx_RADIO_TXANTENNA_DEFAULT);
2406         if (phy->type == BCM43xx_PHYTYPE_B) {
2407                 value16 = bcm43xx_read16(bcm, 0x005E);
2408                 value16 |= 0x0004;
2409                 bcm43xx_write16(bcm, 0x005E, value16);
2410         }
2411         bcm43xx_write32(bcm, 0x0100, 0x01000000);
2412         if (bcm->current_core->rev < 5)
2413                 bcm43xx_write32(bcm, 0x010C, 0x01000000);
2414
2415         value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2416         value32 &= ~ BCM43xx_SBF_MODE_NOTADHOC;
2417         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
2418         value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2419         value32 |= BCM43xx_SBF_MODE_NOTADHOC;
2420         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
2421
2422         value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2423         value32 |= 0x100000;
2424         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
2425
2426         if (bcm43xx_using_pio(bcm)) {
2427                 bcm43xx_write32(bcm, 0x0210, 0x00000100);
2428                 bcm43xx_write32(bcm, 0x0230, 0x00000100);
2429                 bcm43xx_write32(bcm, 0x0250, 0x00000100);
2430                 bcm43xx_write32(bcm, 0x0270, 0x00000100);
2431                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0034, 0x0000);
2432         }
2433
2434         /* Probe Response Timeout value */
2435         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2436         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0074, 0x0000);
2437
2438         /* Initially set the wireless operation mode. */
2439         bcm43xx_set_iwmode(bcm, bcm->ieee->iw_mode);
2440
2441         if (bcm->current_core->rev < 3) {
2442                 bcm43xx_write16(bcm, 0x060E, 0x0000);
2443                 bcm43xx_write16(bcm, 0x0610, 0x8000);
2444                 bcm43xx_write16(bcm, 0x0604, 0x0000);
2445                 bcm43xx_write16(bcm, 0x0606, 0x0200);
2446         } else {
2447                 bcm43xx_write32(bcm, 0x0188, 0x80000000);
2448                 bcm43xx_write32(bcm, 0x018C, 0x02000000);
2449         }
2450         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, 0x00004000);
2451         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_IRQ_MASK, 0x0001DC00);
2452         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2453         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_IRQ_MASK, 0x0000DC00);
2454         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_IRQ_MASK, 0x0001DC00);
2455
2456         value32 = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
2457         value32 |= 0x00100000;
2458         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, value32);
2459
2460         bcm43xx_write16(bcm, BCM43xx_MMIO_POWERUP_DELAY, bcm43xx_pctl_powerup_delay(bcm));
2461
2462         assert(err == 0);
2463         dprintk(KERN_INFO PFX "Chip initialized\n");
2464 out:
2465         return err;
2466
2467 err_radio_off:
2468         bcm43xx_radio_turn_off(bcm);
2469 err_gpio_cleanup:
2470         bcm43xx_gpio_cleanup(bcm);
2471 err_release_fw:
2472         bcm43xx_release_firmware(bcm, 1);
2473         goto out;
2474 }
2475
2476 /* Validate chip access
2477  * http://bcm-specs.sipsolutions.net/ValidateChipAccess */
2478 static int bcm43xx_validate_chip(struct bcm43xx_private *bcm)
2479 {
2480         u32 value;
2481         u32 shm_backup;
2482
2483         shm_backup = bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, 0x0000);
2484         bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED, 0x0000, 0xAA5555AA);
2485         if (bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, 0x0000) != 0xAA5555AA)
2486                 goto error;
2487         bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED, 0x0000, 0x55AAAA55);
2488         if (bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, 0x0000) != 0x55AAAA55)
2489                 goto error;
2490         bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED, 0x0000, shm_backup);
2491
2492         value = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2493         if ((value | 0x80000000) != 0x80000400)
2494                 goto error;
2495
2496         value = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
2497         if (value != 0x00000000)
2498                 goto error;
2499
2500         return 0;
2501 error:
2502         printk(KERN_ERR PFX "Failed to validate the chipaccess\n");
2503         return -ENODEV;
2504 }
2505
2506 static void bcm43xx_init_struct_phyinfo(struct bcm43xx_phyinfo *phy)
2507 {
2508         /* Initialize a "phyinfo" structure. The structure is already
2509          * zeroed out.
2510          * This is called on insmod time to initialize members.
2511          */
2512         phy->savedpctlreg = 0xFFFF;
2513         spin_lock_init(&phy->lock);
2514 }
2515
2516 static void bcm43xx_init_struct_radioinfo(struct bcm43xx_radioinfo *radio)
2517 {
2518         /* Initialize a "radioinfo" structure. The structure is already
2519          * zeroed out.
2520          * This is called on insmod time to initialize members.
2521          */
2522         radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
2523         radio->channel = 0xFF;
2524         radio->initial_channel = 0xFF;
2525 }
2526
2527 static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
2528 {
2529         int err, i;
2530         int current_core;
2531         u32 core_vendor, core_id, core_rev;
2532         u32 sb_id_hi, chip_id_32 = 0;
2533         u16 pci_device, chip_id_16;
2534         u8 core_count;
2535
2536         memset(&bcm->core_chipcommon, 0, sizeof(struct bcm43xx_coreinfo));
2537         memset(&bcm->core_pci, 0, sizeof(struct bcm43xx_coreinfo));
2538         memset(&bcm->core_80211, 0, sizeof(struct bcm43xx_coreinfo)
2539                                     * BCM43xx_MAX_80211_CORES);
2540         memset(&bcm->core_80211_ext, 0, sizeof(struct bcm43xx_coreinfo_80211)
2541                                         * BCM43xx_MAX_80211_CORES);
2542         bcm->nr_80211_available = 0;
2543         bcm->current_core = NULL;
2544         bcm->active_80211_core = NULL;
2545
2546         /* map core 0 */
2547         err = _switch_core(bcm, 0);
2548         if (err)
2549                 goto out;
2550
2551         /* fetch sb_id_hi from core information registers */
2552         sb_id_hi = bcm43xx_read32(bcm, BCM43xx_CIR_SB_ID_HI);
2553
2554         core_id = (sb_id_hi & 0xFFF0) >> 4;
2555         core_rev = (sb_id_hi & 0xF);
2556         core_vendor = (sb_id_hi & 0xFFFF0000) >> 16;
2557
2558         /* if present, chipcommon is always core 0; read the chipid from it */
2559         if (core_id == BCM43xx_COREID_CHIPCOMMON) {
2560                 chip_id_32 = bcm43xx_read32(bcm, 0);
2561                 chip_id_16 = chip_id_32 & 0xFFFF;
2562                 bcm->core_chipcommon.available = 1;
2563                 bcm->core_chipcommon.id = core_id;
2564                 bcm->core_chipcommon.rev = core_rev;
2565                 bcm->core_chipcommon.index = 0;
2566                 /* While we are at it, also read the capabilities. */
2567                 bcm->chipcommon_capabilities = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_CAPABILITIES);
2568         } else {
2569                 /* without a chipCommon, use a hard coded table. */
2570                 pci_device = bcm->pci_dev->device;
2571                 if (pci_device == 0x4301)
2572                         chip_id_16 = 0x4301;
2573                 else if ((pci_device >= 0x4305) && (pci_device <= 0x4307))
2574                         chip_id_16 = 0x4307;
2575                 else if ((pci_device >= 0x4402) && (pci_device <= 0x4403))
2576                         chip_id_16 = 0x4402;
2577                 else if ((pci_device >= 0x4610) && (pci_device <= 0x4615))
2578                         chip_id_16 = 0x4610;
2579                 else if ((pci_device >= 0x4710) && (pci_device <= 0x4715))
2580                         chip_id_16 = 0x4710;
2581 #ifdef CONFIG_BCM947XX
2582                 else if ((pci_device >= 0x4320) && (pci_device <= 0x4325))
2583                         chip_id_16 = 0x4309;
2584 #endif
2585                 else {
2586                         printk(KERN_ERR PFX "Could not determine Chip ID\n");
2587                         return -ENODEV;
2588                 }
2589         }
2590
2591         /* ChipCommon with Core Rev >=4 encodes number of cores,
2592          * otherwise consult hardcoded table */
2593         if ((core_id == BCM43xx_COREID_CHIPCOMMON) && (core_rev >= 4)) {
2594                 core_count = (chip_id_32 & 0x0F000000) >> 24;
2595         } else {
2596                 switch (chip_id_16) {
2597                         case 0x4610:
2598                         case 0x4704:
2599                         case 0x4710:
2600                                 core_count = 9;
2601                                 break;
2602                         case 0x4310:
2603                                 core_count = 8;
2604                                 break;
2605                         case 0x5365:
2606                                 core_count = 7;
2607                                 break;
2608                         case 0x4306:
2609                                 core_count = 6;
2610                                 break;
2611                         case 0x4301:
2612                         case 0x4307:
2613                                 core_count = 5;
2614                                 break;
2615                         case 0x4402:
2616                                 core_count = 3;
2617                                 break;
2618                         default:
2619                                 /* SOL if we get here */
2620                                 assert(0);
2621                                 core_count = 1;
2622                 }
2623         }
2624
2625         bcm->chip_id = chip_id_16;
2626         bcm->chip_rev = (chip_id_32 & 0x000F0000) >> 16;
2627         bcm->chip_package = (chip_id_32 & 0x00F00000) >> 20;
2628
2629         dprintk(KERN_INFO PFX "Chip ID 0x%x, rev 0x%x\n",
2630                 bcm->chip_id, bcm->chip_rev);
2631         dprintk(KERN_INFO PFX "Number of cores: %d\n", core_count);
2632         if (bcm->core_chipcommon.available) {
2633                 dprintk(KERN_INFO PFX "Core 0: ID 0x%x, rev 0x%x, vendor 0x%x, %s\n",
2634                         core_id, core_rev, core_vendor,
2635                         bcm43xx_core_enabled(bcm) ? "enabled" : "disabled");
2636         }
2637
2638         if (bcm->core_chipcommon.available)
2639                 current_core = 1;
2640         else
2641                 current_core = 0;
2642         for ( ; current_core < core_count; current_core++) {
2643                 struct bcm43xx_coreinfo *core;
2644                 struct bcm43xx_coreinfo_80211 *ext_80211;
2645
2646                 err = _switch_core(bcm, current_core);
2647                 if (err)
2648                         goto out;
2649                 /* Gather information */
2650                 /* fetch sb_id_hi from core information registers */
2651                 sb_id_hi = bcm43xx_read32(bcm, BCM43xx_CIR_SB_ID_HI);
2652
2653                 /* extract core_id, core_rev, core_vendor */
2654                 core_id = (sb_id_hi & 0xFFF0) >> 4;
2655                 core_rev = (sb_id_hi & 0xF);
2656                 core_vendor = (sb_id_hi & 0xFFFF0000) >> 16;
2657
2658                 dprintk(KERN_INFO PFX "Core %d: ID 0x%x, rev 0x%x, vendor 0x%x, %s\n",
2659                         current_core, core_id, core_rev, core_vendor,
2660                         bcm43xx_core_enabled(bcm) ? "enabled" : "disabled" );
2661
2662                 core = NULL;
2663                 switch (core_id) {
2664                 case BCM43xx_COREID_PCI:
2665                         core = &bcm->core_pci;
2666                         if (core->available) {
2667                                 printk(KERN_WARNING PFX "Multiple PCI cores found.\n");
2668                                 continue;
2669                         }
2670                         break;
2671                 case BCM43xx_COREID_80211:
2672                         for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
2673                                 core = &(bcm->core_80211[i]);
2674                                 ext_80211 = &(bcm->core_80211_ext[i]);
2675                                 if (!core->available)
2676                                         break;
2677                                 core = NULL;
2678                         }
2679                         if (!core) {
2680                                 printk(KERN_WARNING PFX "More than %d cores of type 802.11 found.\n",
2681                                        BCM43xx_MAX_80211_CORES);
2682                                 continue;
2683                         }
2684                         if (i != 0) {
2685                                 /* More than one 80211 core is only supported
2686                                  * by special chips.
2687                                  * There are chips with two 80211 cores, but with
2688                                  * dangling pins on the second core. Be careful
2689                                  * and ignore these cores here.
2690                                  */
2691                                 if (bcm->pci_dev->device != 0x4324) {
2692                                         dprintk(KERN_INFO PFX "Ignoring additional 802.11 core.\n");
2693                                         continue;
2694                                 }
2695                         }
2696                         switch (core_rev) {
2697                         case 2:
2698                         case 4:
2699                         case 5:
2700                         case 6:
2701                         case 7:
2702                         case 9:
2703                                 break;
2704                         default:
2705                                 printk(KERN_ERR PFX "Error: Unsupported 80211 core revision %u\n",
2706                                        core_rev);
2707                                 err = -ENODEV;
2708                                 goto out;
2709                         }
2710                         bcm->nr_80211_available++;
2711                         core->priv = ext_80211;
2712                         bcm43xx_init_struct_phyinfo(&ext_80211->phy);
2713                         bcm43xx_init_struct_radioinfo(&ext_80211->radio);
2714                         break;
2715                 case BCM43xx_COREID_CHIPCOMMON:
2716                         printk(KERN_WARNING PFX "Multiple CHIPCOMMON cores found.\n");
2717                         break;
2718                 }
2719                 if (core) {
2720                         core->available = 1;
2721                         core->id = core_id;
2722                         core->rev = core_rev;
2723                         core->index = current_core;
2724                 }
2725         }
2726
2727         if (!bcm->core_80211[0].available) {
2728                 printk(KERN_ERR PFX "Error: No 80211 core found!\n");
2729                 err = -ENODEV;
2730                 goto out;
2731         }
2732
2733         err = bcm43xx_switch_core(bcm, &bcm->core_80211[0]);
2734
2735         assert(err == 0);
2736 out:
2737         return err;
2738 }
2739
2740 static void bcm43xx_gen_bssid(struct bcm43xx_private *bcm)
2741 {
2742         const u8 *mac = (const u8*)(bcm->net_dev->dev_addr);
2743         u8 *bssid = bcm->ieee->bssid;
2744
2745         switch (bcm->ieee->iw_mode) {
2746         case IW_MODE_ADHOC:
2747                 random_ether_addr(bssid);
2748                 break;
2749         case IW_MODE_MASTER:
2750         case IW_MODE_INFRA:
2751         case IW_MODE_REPEAT:
2752         case IW_MODE_SECOND:
2753         case IW_MODE_MONITOR:
2754                 memcpy(bssid, mac, ETH_ALEN);
2755                 break;
2756         default:
2757                 assert(0);
2758         }
2759 }
2760
2761 static void bcm43xx_rate_memory_write(struct bcm43xx_private *bcm,
2762                                       u16 rate,
2763                                       int is_ofdm)
2764 {
2765         u16 offset;
2766
2767         if (is_ofdm) {
2768                 offset = 0x480;
2769                 offset += (bcm43xx_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2770         }
2771         else {
2772                 offset = 0x4C0;
2773                 offset += (bcm43xx_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2774         }
2775         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, offset + 0x20,
2776                             bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, offset));
2777 }
2778
2779 static void bcm43xx_rate_memory_init(struct bcm43xx_private *bcm)
2780 {
2781         switch (bcm43xx_current_phy(bcm)->type) {
2782         case BCM43xx_PHYTYPE_A:
2783         case BCM43xx_PHYTYPE_G:
2784                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_6MB, 1);
2785                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_12MB, 1);
2786                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_18MB, 1);
2787                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_24MB, 1);
2788                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_36MB, 1);
2789                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_48MB, 1);
2790                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_54MB, 1);
2791         case BCM43xx_PHYTYPE_B:
2792                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_1MB, 0);
2793                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_2MB, 0);
2794                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_5MB, 0);
2795                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_11MB, 0);
2796                 break;
2797         default:
2798                 assert(0);
2799         }
2800 }
2801
2802 static void bcm43xx_wireless_core_cleanup(struct bcm43xx_private *bcm)
2803 {
2804         bcm43xx_chip_cleanup(bcm);
2805         bcm43xx_pio_free(bcm);
2806         bcm43xx_dma_free(bcm);
2807
2808         bcm->current_core->initialized = 0;
2809 }
2810
2811 /* http://bcm-specs.sipsolutions.net/80211Init */
2812 static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm,
2813                                       int active_wlcore)
2814 {
2815         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2816         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
2817         u32 ucodeflags;
2818         int err;
2819         u32 sbimconfiglow;
2820         u8 limit;
2821
2822         if (bcm->chip_rev < 5) {
2823                 sbimconfiglow = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMCONFIGLOW);
2824                 sbimconfiglow &= ~ BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_MASK;
2825                 sbimconfiglow &= ~ BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_MASK;
2826                 if (bcm->bustype == BCM43xx_BUSTYPE_PCI)
2827                         sbimconfiglow |= 0x32;
2828                 else if (bcm->bustype == BCM43xx_BUSTYPE_SB)
2829                         sbimconfiglow |= 0x53;
2830                 else
2831                         assert(0);
2832                 bcm43xx_write32(bcm, BCM43xx_CIR_SBIMCONFIGLOW, sbimconfiglow);
2833         }
2834
2835         bcm43xx_phy_calibrate(bcm);
2836         err = bcm43xx_chip_init(bcm);
2837         if (err)
2838                 goto out;
2839
2840         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0016, bcm->current_core->rev);
2841         ucodeflags = bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, BCM43xx_UCODEFLAGS_OFFSET);
2842
2843         if (0 /*FIXME: which condition has to be used here? */)
2844                 ucodeflags |= 0x00000010;
2845
2846         /* HW decryption needs to be set now */
2847         ucodeflags |= 0x40000000;
2848
2849         if (phy->type == BCM43xx_PHYTYPE_G) {
2850                 ucodeflags |= BCM43xx_UCODEFLAG_UNKBGPHY;
2851                 if (phy->rev == 1)
2852                         ucodeflags |= BCM43xx_UCODEFLAG_UNKGPHY;
2853                 if (bcm->sprom.boardflags & BCM43xx_BFL_PACTRL)
2854                         ucodeflags |= BCM43xx_UCODEFLAG_UNKPACTRL;
2855         } else if (phy->type == BCM43xx_PHYTYPE_B) {
2856                 ucodeflags |= BCM43xx_UCODEFLAG_UNKBGPHY;
2857                 if (phy->rev >= 2 && radio->version == 0x2050)
2858                         ucodeflags &= ~BCM43xx_UCODEFLAG_UNKGPHY;
2859         }
2860
2861         if (ucodeflags != bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED,
2862                                              BCM43xx_UCODEFLAGS_OFFSET)) {
2863                 bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED,
2864                                     BCM43xx_UCODEFLAGS_OFFSET, ucodeflags);
2865         }
2866
2867         /* Short/Long Retry Limit.
2868          * The retry-limit is a 4-bit counter. Enforce this to avoid overflowing
2869          * the chip-internal counter.
2870          */
2871         limit = limit_value(modparam_short_retry, 0, 0xF);
2872         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0006, limit);
2873         limit = limit_value(modparam_long_retry, 0, 0xF);
2874         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0007, limit);
2875
2876         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0044, 3);
2877         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0046, 2);
2878
2879         bcm43xx_rate_memory_init(bcm);
2880
2881         /* Minimum Contention Window */
2882         if (phy->type == BCM43xx_PHYTYPE_B)
2883                 bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0003, 0x0000001f);
2884         else
2885                 bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0003, 0x0000000f);
2886         /* Maximum Contention Window */
2887         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0004, 0x000003ff);
2888
2889         bcm43xx_gen_bssid(bcm);
2890         bcm43xx_write_mac_bssid_templates(bcm);
2891
2892         if (bcm->current_core->rev >= 5)
2893                 bcm43xx_write16(bcm, 0x043C, 0x000C);
2894
2895         if (active_wlcore) {
2896                 if (bcm43xx_using_pio(bcm))
2897                         err = bcm43xx_pio_init(bcm);
2898                 else
2899                         err = bcm43xx_dma_init(bcm);
2900                 if (err)
2901                         goto err_chip_cleanup;
2902         }
2903         bcm43xx_write16(bcm, 0x0612, 0x0050);
2904         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0416, 0x0050);
2905         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0414, 0x01F4);
2906
2907         if (active_wlcore) {
2908                 if (radio->initial_channel != 0xFF)
2909                         bcm43xx_radio_selectchannel(bcm, radio->initial_channel, 0);
2910         }
2911
2912         /* Don't enable MAC/IRQ here, as it will race with the IRQ handler.
2913          * We enable it later.
2914          */
2915         bcm->current_core->initialized = 1;
2916 out:
2917         return err;
2918
2919 err_chip_cleanup:
2920         bcm43xx_chip_cleanup(bcm);
2921         goto out;
2922 }
2923
2924 static int bcm43xx_chipset_attach(struct bcm43xx_private *bcm)
2925 {
2926         int err;
2927         u16 pci_status;
2928
2929         err = bcm43xx_pctl_set_crystal(bcm, 1);
2930         if (err)
2931                 goto out;
2932         bcm43xx_pci_read_config16(bcm, PCI_STATUS, &pci_status);
2933         bcm43xx_pci_write_config16(bcm, PCI_STATUS, pci_status & ~PCI_STATUS_SIG_TARGET_ABORT);
2934
2935 out:
2936         return err;
2937 }
2938
2939 static void bcm43xx_chipset_detach(struct bcm43xx_private *bcm)
2940 {
2941         bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_SLOW);
2942         bcm43xx_pctl_set_crystal(bcm, 0);
2943 }
2944
2945 static void bcm43xx_pcicore_broadcast_value(struct bcm43xx_private *bcm,
2946                                             u32 address,
2947                                             u32 data)
2948 {
2949         bcm43xx_write32(bcm, BCM43xx_PCICORE_BCAST_ADDR, address);
2950         bcm43xx_write32(bcm, BCM43xx_PCICORE_BCAST_DATA, data);
2951 }
2952
2953 static int bcm43xx_pcicore_commit_settings(struct bcm43xx_private *bcm)
2954 {
2955         int err;
2956         struct bcm43xx_coreinfo *old_core;
2957
2958         old_core = bcm->current_core;
2959         err = bcm43xx_switch_core(bcm, &bcm->core_pci);
2960         if (err)
2961                 goto out;
2962
2963         bcm43xx_pcicore_broadcast_value(bcm, 0xfd8, 0x00000000);
2964
2965         bcm43xx_switch_core(bcm, old_core);
2966         assert(err == 0);
2967 out:
2968         return err;
2969 }
2970
2971 /* Make an I/O Core usable. "core_mask" is the bitmask of the cores to enable.
2972  * To enable core 0, pass a core_mask of 1<<0
2973  */
2974 static int bcm43xx_setup_backplane_pci_connection(struct bcm43xx_private *bcm,
2975                                                   u32 core_mask)
2976 {
2977         u32 backplane_flag_nr;
2978         u32 value;
2979         struct bcm43xx_coreinfo *old_core;
2980         int err = 0;
2981
2982         value = bcm43xx_read32(bcm, BCM43xx_CIR_SBTPSFLAG);
2983         backplane_flag_nr = value & BCM43xx_BACKPLANE_FLAG_NR_MASK;
2984
2985         old_core = bcm->current_core;
2986         err = bcm43xx_switch_core(bcm, &bcm->core_pci);
2987         if (err)
2988                 goto out;
2989
2990         if (bcm->core_pci.rev < 6) {
2991                 value = bcm43xx_read32(bcm, BCM43xx_CIR_SBINTVEC);
2992                 value |= (1 << backplane_flag_nr);
2993                 bcm43xx_write32(bcm, BCM43xx_CIR_SBINTVEC, value);
2994         } else {
2995                 err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCICFG_ICR, &value);
2996                 if (err) {
2997                         printk(KERN_ERR PFX "Error: ICR setup failure!\n");
2998                         goto out_switch_back;
2999                 }
3000                 value |= core_mask << 8;
3001                 err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_ICR, value);
3002                 if (err) {
3003                         printk(KERN_ERR PFX "Error: ICR setup failure!\n");
3004                         goto out_switch_back;
3005                 }
3006         }
3007
3008         value = bcm43xx_read32(bcm, BCM43xx_PCICORE_SBTOPCI2);
3009         value |= BCM43xx_SBTOPCI2_PREFETCH | BCM43xx_SBTOPCI2_BURST;
3010         bcm43xx_write32(bcm, BCM43xx_PCICORE_SBTOPCI2, value);
3011
3012         if (bcm->core_pci.rev < 5) {
3013                 value = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMCONFIGLOW);
3014                 value |= (2 << BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_SHIFT)
3015                          & BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_MASK;
3016                 value |= (3 << BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_SHIFT)
3017                          & BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_MASK;
3018                 bcm43xx_write32(bcm, BCM43xx_CIR_SBIMCONFIGLOW, value);
3019                 err = bcm43xx_pcicore_commit_settings(bcm);
3020                 assert(err == 0);
3021         }
3022
3023 out_switch_back:
3024         err = bcm43xx_switch_core(bcm, old_core);
3025 out:
3026         return err;
3027 }
3028
3029 static void bcm43xx_periodic_every120sec(struct bcm43xx_private *bcm)
3030 {
3031         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
3032
3033         if (phy->type != BCM43xx_PHYTYPE_G || phy->rev < 2)
3034                 return;
3035
3036         bcm43xx_mac_suspend(bcm);
3037         bcm43xx_phy_lo_g_measure(bcm);
3038         bcm43xx_mac_enable(bcm);
3039 }
3040
3041 static void bcm43xx_periodic_every60sec(struct bcm43xx_private *bcm)
3042 {
3043         bcm43xx_phy_lo_mark_all_unused(bcm);
3044         if (bcm->sprom.boardflags & BCM43xx_BFL_RSSI) {
3045                 bcm43xx_mac_suspend(bcm);
3046                 bcm43xx_calc_nrssi_slope(bcm);
3047                 bcm43xx_mac_enable(bcm);
3048         }
3049 }
3050
3051 static void bcm43xx_periodic_every30sec(struct bcm43xx_private *bcm)
3052 {
3053         /* Update device statistics. */
3054         bcm43xx_calculate_link_quality(bcm);
3055 }
3056
3057 static void bcm43xx_periodic_every15sec(struct bcm43xx_private *bcm)
3058 {
3059         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
3060         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
3061
3062         if (phy->type == BCM43xx_PHYTYPE_G) {
3063                 //TODO: update_aci_moving_average
3064                 if (radio->aci_enable && radio->aci_wlan_automatic) {
3065                         bcm43xx_mac_suspend(bcm);
3066                         if (!radio->aci_enable && 1 /*TODO: not scanning? */) {
3067                                 if (0 /*TODO: bunch of conditions*/) {
3068                                         bcm43xx_radio_set_interference_mitigation(bcm,
3069                                                                                   BCM43xx_RADIO_INTERFMODE_MANUALWLAN);
3070                                 }
3071                         } else if (1/*TODO*/) {
3072                                 /*
3073                                 if ((aci_average > 1000) && !(bcm43xx_radio_aci_scan(bcm))) {
3074                                         bcm43xx_radio_set_interference_mitigation(bcm,
3075                                                                                   BCM43xx_RADIO_INTERFMODE_NONE);
3076                                 }
3077                                 */
3078                         }
3079                         bcm43xx_mac_enable(bcm);
3080                 } else if (radio->interfmode == BCM43xx_RADIO_INTERFMODE_NONWLAN &&
3081                            phy->rev == 1) {
3082                         //TODO: implement rev1 workaround
3083                 }
3084         }
3085         bcm43xx_phy_xmitpower(bcm); //FIXME: unless scanning?
3086         //TODO for APHY (temperature?)
3087 }
3088
3089 static void do_periodic_work(struct bcm43xx_private *bcm)
3090 {
3091         unsigned int state;
3092
3093         state = bcm->periodic_state;
3094         if (state % 8 == 0)
3095                 bcm43xx_periodic_every120sec(bcm);
3096         if (state % 4 == 0)
3097                 bcm43xx_periodic_every60sec(bcm);
3098         if (state % 2 == 0)
3099                 bcm43xx_periodic_every30sec(bcm);
3100         if (state % 1 == 0)
3101                 bcm43xx_periodic_every15sec(bcm);
3102         bcm->periodic_state = state + 1;
3103
3104         schedule_delayed_work(&bcm->periodic_work, HZ * 15);
3105 }
3106
3107 /* Estimate a "Badness" value based on the periodic work
3108  * state-machine state. "Badness" is worse (bigger), if the
3109  * periodic work will take longer.
3110  */
3111 static int estimate_periodic_work_badness(unsigned int state)
3112 {
3113         int badness = 0;
3114
3115         if (state % 8 == 0) /* every 120 sec */
3116                 badness += 10;
3117         if (state % 4 == 0) /* every 60 sec */
3118                 badness += 5;
3119         if (state % 2 == 0) /* every 30 sec */
3120                 badness += 1;
3121         if (state % 1 == 0) /* every 15 sec */
3122                 badness += 1;
3123
3124 #define BADNESS_LIMIT   4
3125         return badness;
3126 }
3127
3128 static void bcm43xx_periodic_work_handler(void *d)
3129 {
3130         struct bcm43xx_private *bcm = d;
3131         unsigned long flags;
3132         u32 savedirqs = 0;
3133         int badness;
3134
3135         badness = estimate_periodic_work_badness(bcm->periodic_state);
3136         if (badness > BADNESS_LIMIT) {
3137                 /* Periodic work will take a long time, so we want it to
3138                  * be preemtible.
3139                  */
3140                 netif_stop_queue(bcm->net_dev);
3141                 synchronize_net();
3142                 spin_lock_irqsave(&bcm->irq_lock, flags);
3143                 bcm43xx_mac_suspend(bcm);
3144                 if (bcm43xx_using_pio(bcm))
3145                         bcm43xx_pio_freeze_txqueues(bcm);
3146                 savedirqs = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
3147                 spin_unlock_irqrestore(&bcm->irq_lock, flags);
3148                 mutex_lock(&bcm->mutex);
3149                 bcm43xx_synchronize_irq(bcm);
3150         } else {
3151                 /* Periodic work should take short time, so we want low
3152                  * locking overhead.
3153                  */
3154                 mutex_lock(&bcm->mutex);
3155                 spin_lock_irqsave(&bcm->irq_lock, flags);
3156         }
3157
3158         do_periodic_work(bcm);
3159
3160         if (badness > BADNESS_LIMIT) {
3161                 spin_lock_irqsave(&bcm->irq_lock, flags);
3162                 if (likely(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED)) {
3163                         tasklet_enable(&bcm->isr_tasklet);
3164                         bcm43xx_interrupt_enable(bcm, savedirqs);
3165                         if (bcm43xx_using_pio(bcm))
3166                                 bcm43xx_pio_thaw_txqueues(bcm);
3167                         bcm43xx_mac_enable(bcm);
3168                 }
3169                 netif_wake_queue(bcm->net_dev);
3170         }
3171         mmiowb();
3172         spin_unlock_irqrestore(&bcm->irq_lock, flags);
3173         mutex_unlock(&bcm->mutex);
3174 }
3175
3176 static void bcm43xx_periodic_tasks_delete(struct bcm43xx_private *bcm)
3177 {
3178         cancel_rearming_delayed_work(&bcm->periodic_work);
3179 }
3180
3181 static void bcm43xx_periodic_tasks_setup(struct bcm43xx_private *bcm)
3182 {
3183         struct work_struct *work = &(bcm->periodic_work);
3184
3185         assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
3186         INIT_WORK(work, bcm43xx_periodic_work_handler, bcm);
3187         schedule_work(work);
3188 }
3189
3190 static void bcm43xx_security_init(struct bcm43xx_private *bcm)
3191 {
3192         bcm->security_offset = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
3193                                                   0x0056) * 2;
3194         bcm43xx_clear_keys(bcm);
3195 }
3196
3197 static int bcm43xx_rng_read(struct hwrng *rng, u32 *data)
3198 {
3199         struct bcm43xx_private *bcm = (struct bcm43xx_private *)rng->priv;
3200         unsigned long flags;
3201
3202         spin_lock_irqsave(&(bcm)->irq_lock, flags);
3203         *data = bcm43xx_read16(bcm, BCM43xx_MMIO_RNG);
3204         spin_unlock_irqrestore(&(bcm)->irq_lock, flags);
3205
3206         return (sizeof(u16));
3207 }
3208
3209 static void bcm43xx_rng_exit(struct bcm43xx_private *bcm)
3210 {
3211         hwrng_unregister(&bcm->rng);
3212 }
3213
3214 static int bcm43xx_rng_init(struct bcm43xx_private *bcm)
3215 {
3216         int err;
3217
3218         snprintf(bcm->rng_name, ARRAY_SIZE(bcm->rng_name),
3219                  "%s_%s", KBUILD_MODNAME, bcm->net_dev->name);
3220         bcm->rng.name = bcm->rng_name;
3221         bcm->rng.data_read = bcm43xx_rng_read;
3222         bcm->rng.priv = (unsigned long)bcm;
3223         err = hwrng_register(&bcm->rng);
3224         if (err)
3225                 printk(KERN_ERR PFX "RNG init failed (%d)\n", err);
3226
3227         return err;
3228 }
3229
3230 static int bcm43xx_shutdown_all_wireless_cores(struct bcm43xx_private *bcm)
3231 {
3232         int ret = 0;
3233         int i, err;
3234         struct bcm43xx_coreinfo *core;
3235
3236         bcm43xx_set_status(bcm, BCM43xx_STAT_SHUTTINGDOWN);
3237         for (i = 0; i < bcm->nr_80211_available; i++) {
3238                 core = &(bcm->core_80211[i]);
3239                 assert(core->available);
3240                 if (!core->initialized)
3241                         continue;
3242                 err = bcm43xx_switch_core(bcm, core);
3243                 if (err) {
3244                         dprintk(KERN_ERR PFX "shutdown_all_wireless_cores "
3245                                              "switch_core failed (%d)\n", err);
3246                         ret = err;
3247                         continue;
3248                 }
3249                 bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
3250                 bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
3251                 bcm43xx_wireless_core_cleanup(bcm);
3252                 if (core == bcm->active_80211_core)
3253                         bcm->active_80211_core = NULL;
3254         }
3255         free_irq(bcm->irq, bcm);
3256         bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
3257
3258         return ret;
3259 }
3260
3261 /* This is the opposite of bcm43xx_init_board() */
3262 static void bcm43xx_free_board(struct bcm43xx_private *bcm)
3263 {
3264         bcm43xx_sysfs_unregister(bcm);
3265         bcm43xx_periodic_tasks_delete(bcm);
3266
3267         mutex_lock(&(bcm)->mutex);
3268         bcm43xx_shutdown_all_wireless_cores(bcm);
3269         bcm43xx_pctl_set_crystal(bcm, 0);
3270         mutex_unlock(&(bcm)->mutex);
3271 }
3272
3273 static void prepare_phydata_for_init(struct bcm43xx_phyinfo *phy)
3274 {
3275         phy->antenna_diversity = 0xFFFF;
3276         memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3277         memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3278
3279         /* Flags */
3280         phy->calibrated = 0;
3281         phy->is_locked = 0;
3282
3283         if (phy->_lo_pairs) {
3284                 memset(phy->_lo_pairs, 0,
3285                        sizeof(struct bcm43xx_lopair) * BCM43xx_LO_COUNT);
3286         }
3287         memset(phy->loopback_gain, 0, sizeof(phy->loopback_gain));
3288 }
3289
3290 static void prepare_radiodata_for_init(struct bcm43xx_private *bcm,
3291                                        struct bcm43xx_radioinfo *radio)
3292 {
3293         int i;
3294
3295         /* Set default attenuation values. */
3296         radio->baseband_atten = bcm43xx_default_baseband_attenuation(bcm);
3297         radio->radio_atten = bcm43xx_default_radio_attenuation(bcm);
3298         radio->txctl1 = bcm43xx_default_txctl1(bcm);
3299         radio->txctl2 = 0xFFFF;
3300         radio->txpwr_offset = 0;
3301
3302         /* NRSSI */
3303         radio->nrssislope = 0;
3304         for (i = 0; i < ARRAY_SIZE(radio->nrssi); i++)
3305                 radio->nrssi[i] = -1000;
3306         for (i = 0; i < ARRAY_SIZE(radio->nrssi_lt); i++)
3307                 radio->nrssi_lt[i] = i;
3308
3309         radio->lofcal = 0xFFFF;
3310         radio->initval = 0xFFFF;
3311
3312         radio->aci_enable = 0;
3313         radio->aci_wlan_automatic = 0;
3314         radio->aci_hw_rssi = 0;
3315 }
3316
3317 static void prepare_priv_for_init(struct bcm43xx_private *bcm)
3318 {
3319         int i;
3320         struct bcm43xx_coreinfo *core;
3321         struct bcm43xx_coreinfo_80211 *wlext;
3322
3323         assert(!bcm->active_80211_core);
3324
3325         bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZING);
3326
3327         /* Flags */
3328         bcm->was_initialized = 0;
3329         bcm->reg124_set_0x4 = 0;
3330
3331         /* Stats */
3332         memset(&bcm->stats, 0, sizeof(bcm->stats));
3333
3334         /* Wireless core data */
3335         for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
3336                 core = &(bcm->core_80211[i]);
3337                 wlext = core->priv;
3338
3339                 if (!core->available)
3340                         continue;
3341                 assert(wlext == &(bcm->core_80211_ext[i]));
3342
3343                 prepare_phydata_for_init(&wlext->phy);
3344                 prepare_radiodata_for_init(bcm, &wlext->radio);
3345         }
3346
3347         /* IRQ related flags */
3348         bcm->irq_reason = 0;
3349         memset(bcm->dma_reason, 0, sizeof(bcm->dma_reason));
3350         bcm->irq_savedstate = BCM43xx_IRQ_INITIAL;
3351
3352         /* Noise calculation context */
3353         memset(&bcm->noisecalc, 0, sizeof(bcm->noisecalc));
3354
3355         /* Periodic work context */
3356         bcm->periodic_state = 0;
3357 }
3358
3359 static int wireless_core_up(struct bcm43xx_private *bcm,
3360                             int active_wlcore)
3361 {
3362         int err;
3363
3364         if (!bcm43xx_core_enabled(bcm))
3365                 bcm43xx_wireless_core_reset(bcm, 1);
3366         if (!active_wlcore)
3367                 bcm43xx_wireless_core_mark_inactive(bcm);
3368         err = bcm43xx_wireless_core_init(bcm, active_wlcore);
3369         if (err)
3370                 goto out;
3371         if (!active_wlcore)
3372                 bcm43xx_radio_turn_off(bcm);
3373 out:
3374         return err;
3375 }
3376
3377 /* Select and enable the "to be used" wireless core.
3378  * Locking: bcm->mutex must be aquired before calling this.
3379  *          bcm->irq_lock must not be aquired.
3380  */
3381 int bcm43xx_select_wireless_core(struct bcm43xx_private *bcm,
3382                                  int phytype)
3383 {
3384         int i, err;
3385         struct bcm43xx_coreinfo *active_core = NULL;
3386         struct bcm43xx_coreinfo_80211 *active_wlext = NULL;
3387         struct bcm43xx_coreinfo *core;
3388         struct bcm43xx_coreinfo_80211 *wlext;
3389         int adjust_active_sbtmstatelow = 0;
3390
3391         might_sleep();
3392
3393         if (phytype < 0) {
3394                 /* If no phytype is requested, select the first core. */
3395                 assert(bcm->core_80211[0].available);
3396                 wlext = bcm->core_80211[0].priv;
3397                 phytype = wlext->phy.type;
3398         }
3399         /* Find the requested core. */
3400         for (i = 0; i < bcm->nr_80211_available; i++) {
3401                 core = &(bcm->core_80211[i]);
3402                 wlext = core->priv;
3403                 if (wlext->phy.type == phytype) {
3404                         active_core = core;
3405                         active_wlext = wlext;
3406                         break;
3407                 }
3408         }
3409         if (!active_core)
3410                 return -ESRCH; /* No such PHYTYPE on this board. */
3411
3412         if (bcm->active_80211_core) {
3413                 /* We already selected a wl core in the past.
3414                  * So first clean up everything.
3415                  */
3416                 dprintk(KERN_INFO PFX "select_wireless_core: cleanup\n");
3417                 ieee80211softmac_stop(bcm->net_dev);
3418                 bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZED);
3419                 err = bcm43xx_disable_interrupts_sync(bcm);
3420                 assert(!err);
3421                 tasklet_enable(&bcm->isr_tasklet);
3422                 err = bcm43xx_shutdown_all_wireless_cores(bcm);
3423                 if (err)
3424                         goto error;
3425                 /* Ok, everything down, continue to re-initialize. */
3426                 bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZING);
3427         }
3428
3429         /* Reset all data structures. */
3430         prepare_priv_for_init(bcm);
3431
3432         err = bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_FAST);
3433         if (err)
3434                 goto error;
3435
3436         /* Mark all unused cores "inactive". */
3437         for (i = 0; i < bcm->nr_80211_available; i++) {
3438                 core = &(bcm->core_80211[i]);
3439                 wlext = core->priv;
3440
3441                 if (core == active_core)
3442                         continue;
3443                 err = bcm43xx_switch_core(bcm, core);
3444                 if (err) {
3445                         dprintk(KERN_ERR PFX "Could not switch to inactive "
3446                                              "802.11 core (%d)\n", err);
3447                         goto error;
3448                 }
3449                 err = wireless_core_up(bcm, 0);
3450                 if (err) {
3451                         dprintk(KERN_ERR PFX "core_up for inactive 802.11 core "
3452                                              "failed (%d)\n", err);
3453                         goto error;
3454                 }
3455                 adjust_active_sbtmstatelow = 1;
3456         }
3457
3458         /* Now initialize the active 802.11 core. */
3459         err = bcm43xx_switch_core(bcm, active_core);
3460         if (err) {
3461                 dprintk(KERN_ERR PFX "Could not switch to active "
3462                                      "802.11 core (%d)\n", err);
3463                 goto error;
3464         }
3465         if (adjust_active_sbtmstatelow &&
3466             active_wlext->phy.type == BCM43xx_PHYTYPE_G) {
3467                 u32 sbtmstatelow;
3468
3469                 sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
3470                 sbtmstatelow |= 0x20000000;
3471                 bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
3472         }
3473         err = wireless_core_up(bcm, 1);
3474         if (err) {
3475                 dprintk(KERN_ERR PFX "core_up for active 802.11 core "
3476                                      "failed (%d)\n", err);
3477                 goto error;
3478         }
3479         err = bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_DYNAMIC);
3480         if (err)
3481                 goto error;
3482         bcm->active_80211_core = active_core;
3483
3484         bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
3485         bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_SELF, (u8 *)(bcm->net_dev->dev_addr));
3486         bcm43xx_security_init(bcm);
3487         ieee80211softmac_start(bcm->net_dev);
3488
3489         /* Let's go! Be careful after enabling the IRQs.
3490          * Don't switch cores, for example.
3491          */
3492         bcm43xx_mac_enable(bcm);
3493         bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZED);
3494         err = bcm43xx_initialize_irq(bcm);
3495         if (err)
3496                 goto error;
3497         bcm43xx_interrupt_enable(bcm, bcm->irq_savedstate);
3498
3499         dprintk(KERN_INFO PFX "Selected 802.11 core (phytype %d)\n",
3500                 active_wlext->phy.type);
3501
3502         return 0;
3503
3504 error:
3505         bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
3506         bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_SLOW);
3507         return err;
3508 }
3509
3510 static int bcm43xx_init_board(struct bcm43xx_private *bcm)
3511 {
3512         int err;
3513
3514         mutex_lock(&(bcm)->mutex);
3515
3516         tasklet_enable(&bcm->isr_tasklet);
3517         err = bcm43xx_pctl_set_crystal(bcm, 1);
3518         if (err)
3519                 goto err_tasklet;
3520         err = bcm43xx_pctl_init(bcm);
3521         if (err)
3522                 goto err_crystal_off;
3523         err = bcm43xx_select_wireless_core(bcm, -1);
3524         if (err)
3525                 goto err_crystal_off;
3526
3527         bcm43xx_periodic_tasks_setup(bcm);
3528         err = bcm43xx_sysfs_register(bcm);
3529         if (err)
3530                 goto err_wlshutdown;
3531
3532         /*FIXME: This should be handled by softmac instead. */
3533         schedule_work(&bcm->softmac->associnfo.work);
3534
3535 out:
3536         mutex_unlock(&(bcm)->mutex);
3537
3538         return err;
3539
3540 err_wlshutdown:
3541         bcm43xx_shutdown_all_wireless_cores(bcm);
3542 err_crystal_off:
3543         bcm43xx_pctl_set_crystal(bcm, 0);
3544 err_tasklet:
3545         tasklet_disable(&bcm->isr_tasklet);
3546         goto out;
3547 }
3548
3549 static void bcm43xx_detach_board(struct bcm43xx_private *bcm)
3550 {
3551         struct pci_dev *pci_dev = bcm->pci_dev;
3552         int i;
3553
3554         bcm43xx_chipset_detach(bcm);
3555         /* Do _not_ access the chip, after it is detached. */
3556         pci_iounmap(pci_dev, bcm->mmio_addr);
3557         pci_release_regions(pci_dev);
3558         pci_disable_device(pci_dev);
3559
3560         /* Free allocated structures/fields */
3561         for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
3562                 kfree(bcm->core_80211_ext[i].phy._lo_pairs);
3563                 if (bcm->core_80211_ext[i].phy.dyn_tssi_tbl)
3564                         kfree(bcm->core_80211_ext[i].phy.tssi2dbm);
3565         }
3566 }
3567
3568 static int bcm43xx_read_phyinfo(struct bcm43xx_private *bcm)
3569 {
3570         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
3571         u16 value;
3572         u8 phy_version;
3573         u8 phy_type;
3574         u8 phy_rev;
3575         int phy_rev_ok = 1;
3576         void *p;
3577
3578         value = bcm43xx_read16(bcm, BCM43xx_MMIO_PHY_VER);
3579
3580         phy_version = (value & 0xF000) >> 12;
3581         phy_type = (value & 0x0F00) >> 8;
3582         phy_rev = (value & 0x000F);
3583
3584         dprintk(KERN_INFO PFX "Detected PHY: Version: %x, Type %x, Revision %x\n",
3585                 phy_version, phy_type, phy_rev);
3586
3587         switch (phy_type) {
3588         case BCM43xx_PHYTYPE_A:
3589                 if (phy_rev >= 4)
3590                         phy_rev_ok = 0;
3591                 /*FIXME: We need to switch the ieee->modulation, etc.. flags,
3592                  *       if we switch 80211 cores after init is done.
3593                  *       As we do not implement on the fly switching between
3594                  *       wireless cores, I will leave this as a future task.
3595                  */
3596                 bcm->ieee->modulation = IEEE80211_OFDM_MODULATION;
3597                 bcm->ieee->mode = IEEE_A;
3598                 bcm->ieee->freq_band = IEEE80211_52GHZ_BAND |
3599                                        IEEE80211_24GHZ_BAND;
3600                 break;
3601         case BCM43xx_PHYTYPE_B:
3602                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6 && phy_rev != 7)
3603                         phy_rev_ok = 0;
3604                 bcm->ieee->modulation = IEEE80211_CCK_MODULATION;
3605                 bcm->ieee->mode = IEEE_B;
3606                 bcm->ieee->freq_band = IEEE80211_24GHZ_BAND;
3607                 break;
3608         case BCM43xx_PHYTYPE_G:
3609                 if (phy_rev > 7)
3610                         phy_rev_ok = 0;
3611                 bcm->ieee->modulation = IEEE80211_OFDM_MODULATION |
3612                                         IEEE80211_CCK_MODULATION;
3613                 bcm->ieee->mode = IEEE_G;
3614                 bcm->ieee->freq_band = IEEE80211_24GHZ_BAND;
3615                 break;
3616         default:
3617                 printk(KERN_ERR PFX "Error: Unknown PHY Type %x\n",
3618                        phy_type);
3619                 return -ENODEV;
3620         };
3621         if (!phy_rev_ok) {
3622                 printk(KERN_WARNING PFX "Invalid PHY Revision %x\n",
3623                        phy_rev);
3624         }
3625
3626         phy->version = phy_version;
3627         phy->type = phy_type;
3628         phy->rev = phy_rev;
3629         if ((phy_type == BCM43xx_PHYTYPE_B) || (phy_type == BCM43xx_PHYTYPE_G)) {
3630                 p = kzalloc(sizeof(struct bcm43xx_lopair) * BCM43xx_LO_COUNT,
3631                             GFP_KERNEL);
3632                 if (!p)
3633                         return -ENOMEM;
3634                 phy->_lo_pairs = p;
3635         }
3636
3637         return 0;
3638 }
3639
3640 static int bcm43xx_attach_board(struct bcm43xx_private *bcm)
3641 {
3642         struct pci_dev *pci_dev = bcm->pci_dev;
3643         struct net_device *net_dev = bcm->net_dev;
3644         int err;
3645         int i;
3646         u32 coremask;
3647
3648         err = pci_enable_device(pci_dev);
3649         if (err) {
3650                 printk(KERN_ERR PFX "pci_enable_device() failed\n");
3651                 goto out;
3652         }
3653         err = pci_request_regions(pci_dev, KBUILD_MODNAME);
3654         if (err) {
3655                 printk(KERN_ERR PFX "pci_request_regions() failed\n");
3656                 goto err_pci_disable;
3657         }
3658         /* enable PCI bus-mastering */
3659         pci_set_master(pci_dev);
3660         bcm->mmio_addr = pci_iomap(pci_dev, 0, ~0UL);
3661         if (!bcm->mmio_addr) {
3662                 printk(KERN_ERR PFX "pci_iomap() failed\n");
3663                 err = -EIO;
3664                 goto err_pci_release;
3665         }
3666         net_dev->base_addr = (unsigned long)bcm->mmio_addr;
3667
3668         bcm43xx_pci_read_config16(bcm, PCI_SUBSYSTEM_VENDOR_ID,
3669                                   &bcm->board_vendor);
3670         bcm43xx_pci_read_config16(bcm, PCI_SUBSYSTEM_ID,
3671                                   &bcm->board_type);
3672         bcm43xx_pci_read_config16(bcm, PCI_REVISION_ID,
3673                                   &bcm->board_revision);
3674
3675         err = bcm43xx_chipset_attach(bcm);
3676         if (err)
3677                 goto err_iounmap;
3678         err = bcm43xx_pctl_init(bcm);
3679         if (err)
3680                 goto err_chipset_detach;
3681         err = bcm43xx_probe_cores(bcm);
3682         if (err)
3683                 goto err_chipset_detach;
3684
3685         /* Attach all IO cores to the backplane. */
3686         coremask = 0;
3687         for (i = 0; i < bcm->nr_80211_available; i++)
3688                 coremask |= (1 << bcm->core_80211[i].index);
3689         //FIXME: Also attach some non80211 cores?
3690         err = bcm43xx_setup_backplane_pci_connection(bcm, coremask);
3691         if (err) {
3692                 printk(KERN_ERR PFX "Backplane->PCI connection failed!\n");
3693                 goto err_chipset_detach;
3694         }
3695
3696         err = bcm43xx_sprom_extract(bcm);
3697         if (err)
3698                 goto err_chipset_detach;
3699         err = bcm43xx_leds_init(bcm);
3700         if (err)
3701                 goto err_chipset_detach;
3702
3703         for (i = 0; i < bcm->nr_80211_available; i++) {
3704                 err = bcm43xx_switch_core(bcm, &bcm->core_80211[i]);
3705                 assert(err != -ENODEV);
3706                 if (err)
3707                         goto err_80211_unwind;
3708
3709                 /* Enable the selected wireless core.
3710                  * Connect PHY only on the first core.
3711                  */
3712                 bcm43xx_wireless_core_reset(bcm, (i == 0));
3713
3714                 err = bcm43xx_read_phyinfo(bcm);
3715                 if (err && (i == 0))
3716                         goto err_80211_unwind;
3717
3718                 err = bcm43xx_read_radioinfo(bcm);
3719                 if (err && (i == 0))
3720                         goto err_80211_unwind;
3721
3722                 err = bcm43xx_validate_chip(bcm);
3723                 if (err && (i == 0))
3724                         goto err_80211_unwind;
3725
3726                 bcm43xx_radio_turn_off(bcm);
3727                 err = bcm43xx_phy_init_tssi2dbm_table(bcm);
3728                 if (err)
3729                         goto err_80211_unwind;
3730                 bcm43xx_wireless_core_disable(bcm);
3731         }
3732         err = bcm43xx_geo_init(bcm);
3733         if (err)
3734                 goto err_80211_unwind;
3735         bcm43xx_pctl_set_crystal(bcm, 0);
3736
3737         /* Set the MAC address in the networking subsystem */
3738         if (is_valid_ether_addr(bcm->sprom.et1macaddr))
3739                 memcpy(bcm->net_dev->dev_addr, bcm->sprom.et1macaddr, 6);
3740         else
3741                 memcpy(bcm->net_dev->dev_addr, bcm->sprom.il0macaddr, 6);
3742
3743         snprintf(bcm->nick, IW_ESSID_MAX_SIZE,
3744                  "Broadcom %04X", bcm->chip_id);
3745
3746         assert(err == 0);
3747 out:
3748         return err;
3749
3750 err_80211_unwind:
3751         for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
3752                 kfree(bcm->core_80211_ext[i].phy._lo_pairs);
3753                 if (bcm->core_80211_ext[i].phy.dyn_tssi_tbl)
3754                         kfree(bcm->core_80211_ext[i].phy.tssi2dbm);
3755         }
3756 err_chipset_detach:
3757         bcm43xx_chipset_detach(bcm);
3758 err_iounmap:
3759         pci_iounmap(pci_dev, bcm->mmio_addr);
3760 err_pci_release:
3761         pci_release_regions(pci_dev);
3762 err_pci_disable:
3763         pci_disable_device(pci_dev);
3764         goto out;
3765 }
3766
3767 /* Do the Hardware IO operations to send the txb */
3768 static inline int bcm43xx_tx(struct bcm43xx_private *bcm,
3769                              struct ieee80211_txb *txb)
3770 {
3771         int err = -ENODEV;
3772
3773         if (bcm43xx_using_pio(bcm))
3774                 err = bcm43xx_pio_tx(bcm, txb);
3775         else
3776                 err = bcm43xx_dma_tx(bcm, txb);
3777         bcm->net_dev->trans_start = jiffies;
3778
3779         return err;
3780 }
3781
3782 static void bcm43xx_ieee80211_set_chan(struct net_device *net_dev,
3783                                        u8 channel)
3784 {
3785         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
3786         struct bcm43xx_radioinfo *radio;
3787         unsigned long flags;
3788
3789         mutex_lock(&bcm->mutex);
3790         spin_lock_irqsave(&bcm->irq_lock, flags);
3791         if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED) {
3792                 bcm43xx_mac_suspend(bcm);
3793                 bcm43xx_radio_selectchannel(bcm, channel, 0);
3794                 bcm43xx_mac_enable(bcm);
3795         } else {
3796                 radio = bcm43xx_current_radio(bcm);
3797                 radio->initial_channel = channel;
3798         }
3799         spin_unlock_irqrestore(&bcm->irq_lock, flags);
3800         mutex_unlock(&bcm->mutex);
3801 }
3802
3803 /* set_security() callback in struct ieee80211_device */
3804 static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
3805                                            struct ieee80211_security *sec)
3806 {
3807         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
3808         struct ieee80211_security *secinfo = &bcm->ieee->sec;
3809         unsigned long flags;
3810         int keyidx;
3811
3812         dprintk(KERN_INFO PFX "set security called");
3813
3814         mutex_lock(&bcm->mutex);
3815         spin_lock_irqsave(&bcm->irq_lock, flags);
3816
3817         for (keyidx = 0; keyidx<WEP_KEYS; keyidx++)
3818                 if (sec->flags & (1<<keyidx)) {
3819                         secinfo->encode_alg[keyidx] = sec->encode_alg[keyidx];
3820                         secinfo->key_sizes[keyidx] = sec->key_sizes[keyidx];
3821                         memcpy(secinfo->keys[keyidx], sec->keys[keyidx], SCM_KEY_LEN);
3822                 }
3823
3824         if (sec->flags & SEC_ACTIVE_KEY) {
3825                 secinfo->active_key = sec->active_key;
3826                 dprintk(", .active_key = %d", sec->active_key);
3827         }
3828         if (sec->flags & SEC_UNICAST_GROUP) {
3829                 secinfo->unicast_uses_group = sec->unicast_uses_group;
3830                 dprintk(", .unicast_uses_group = %d", sec->unicast_uses_group);
3831         }
3832         if (sec->flags & SEC_LEVEL) {
3833                 secinfo->level = sec->level;
3834                 dprintk(", .level = %d", sec->level);
3835         }
3836         if (sec->flags & SEC_ENABLED) {
3837                 secinfo->enabled = sec->enabled;
3838                 dprintk(", .enabled = %d", sec->enabled);
3839         }
3840         if (sec->flags & SEC_ENCRYPT) {
3841                 secinfo->encrypt = sec->encrypt;
3842                 dprintk(", .encrypt = %d", sec->encrypt);
3843         }
3844         if (sec->flags & SEC_AUTH_MODE) {
3845                 secinfo->auth_mode = sec->auth_mode;
3846                 dprintk(", .auth_mode = %d", sec->auth_mode);
3847         }
3848         dprintk("\n");
3849         if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED &&
3850             !bcm->ieee->host_encrypt) {
3851                 if (secinfo->enabled) {
3852                         /* upload WEP keys to hardware */
3853                         char null_address[6] = { 0 };
3854                         u8 algorithm = 0;
3855                         for (keyidx = 0; keyidx<WEP_KEYS; keyidx++) {
3856                                 if (!(sec->flags & (1<<keyidx)))
3857                                         continue;
3858                                 switch (sec->encode_alg[keyidx]) {
3859                                         case SEC_ALG_NONE: algorithm = BCM43xx_SEC_ALGO_NONE; break;
3860                                         case SEC_ALG_WEP:
3861                                                 algorithm = BCM43xx_SEC_ALGO_WEP;
3862                                                 if (secinfo->key_sizes[keyidx] == 13)
3863                                                         algorithm = BCM43xx_SEC_ALGO_WEP104;
3864                                                 break;
3865                                         case SEC_ALG_TKIP:
3866                                                 FIXME();
3867                                                 algorithm = BCM43xx_SEC_ALGO_TKIP;
3868                                                 break;
3869                                         case SEC_ALG_CCMP:
3870                                                 FIXME();
3871                                                 algorithm = BCM43xx_SEC_ALGO_AES;
3872                                                 break;
3873                                         default:
3874                                                 assert(0);
3875                                                 break;
3876                                 }
3877                                 bcm43xx_key_write(bcm, keyidx, algorithm, sec->keys[keyidx], secinfo->key_sizes[keyidx], &null_address[0]);
3878                                 bcm->key[keyidx].enabled = 1;
3879                                 bcm->key[keyidx].algorithm = algorithm;
3880                         }
3881                 } else
3882                                 bcm43xx_clear_keys(bcm);
3883         }
3884         spin_unlock_irqrestore(&bcm->irq_lock, flags);
3885         mutex_unlock(&bcm->mutex);
3886 }
3887
3888 /* hard_start_xmit() callback in struct ieee80211_device */
3889 static int bcm43xx_ieee80211_hard_start_xmit(struct ieee80211_txb *txb,
3890                                              struct net_device *net_dev,
3891                                              int pri)
3892 {
3893         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
3894         int err = -ENODEV;
3895         unsigned long flags;
3896
3897         spin_lock_irqsave(&bcm->irq_lock, flags);
3898         if (likely(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED))
3899                 err = bcm43xx_tx(bcm, txb);
3900         spin_unlock_irqrestore(&bcm->irq_lock, flags);
3901
3902         return err;
3903 }
3904
3905 static struct net_device_stats * bcm43xx_net_get_stats(struct net_device *net_dev)
3906 {
3907         return &(bcm43xx_priv(net_dev)->ieee->stats);
3908 }
3909
3910 static void bcm43xx_net_tx_timeout(struct net_device *net_dev)
3911 {
3912         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
3913         unsigned long flags;
3914
3915         spin_lock_irqsave(&bcm->irq_lock, flags);
3916         bcm43xx_controller_restart(bcm, "TX timeout");
3917         spin_unlock_irqrestore(&bcm->irq_lock, flags);
3918 }
3919
3920 #ifdef CONFIG_NET_POLL_CONTROLLER
3921 static void bcm43xx_net_poll_controller(struct net_device *net_dev)
3922 {
3923         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
3924         unsigned long flags;
3925
3926         local_irq_save(flags);
3927         if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED)
3928                 bcm43xx_interrupt_handler(bcm->irq, bcm, NULL);
3929         local_irq_restore(flags);
3930 }
3931 #endif /* CONFIG_NET_POLL_CONTROLLER */
3932
3933 static int bcm43xx_net_open(struct net_device *net_dev)
3934 {
3935         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
3936
3937         return bcm43xx_init_board(bcm);
3938 }
3939
3940 static int bcm43xx_net_stop(struct net_device *net_dev)
3941 {
3942         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
3943         int err;
3944
3945         ieee80211softmac_stop(net_dev);
3946         err = bcm43xx_disable_interrupts_sync(bcm);
3947         assert(!err);
3948         bcm43xx_free_board(bcm);
3949
3950         return 0;
3951 }
3952
3953 static int bcm43xx_init_private(struct bcm43xx_private *bcm,
3954                                 struct net_device *net_dev,
3955                                 struct pci_dev *pci_dev)
3956 {
3957         int err;
3958
3959         bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
3960         bcm->ieee = netdev_priv(net_dev);
3961         bcm->softmac = ieee80211_priv(net_dev);
3962         bcm->softmac->set_channel = bcm43xx_ieee80211_set_chan;
3963
3964         bcm->irq_savedstate = BCM43xx_IRQ_INITIAL;
3965         bcm->mac_suspended = 1;
3966         bcm->pci_dev = pci_dev;
3967         bcm->net_dev = net_dev;
3968         bcm->bad_frames_preempt = modparam_bad_frames_preempt;
3969         spin_lock_init(&bcm->irq_lock);
3970         spin_lock_init(&bcm->leds_lock);
3971         mutex_init(&bcm->mutex);
3972         tasklet_init(&bcm->isr_tasklet,
3973                      (void (*)(unsigned long))bcm43xx_interrupt_tasklet,
3974                      (unsigned long)bcm);
3975         tasklet_disable_nosync(&bcm->isr_tasklet);
3976         if (modparam_pio) {
3977                 bcm->__using_pio = 1;
3978         } else {
3979                 err = pci_set_dma_mask(pci_dev, DMA_30BIT_MASK);
3980                 err |= pci_set_consistent_dma_mask(pci_dev, DMA_30BIT_MASK);
3981                 if (err) {
3982 #ifdef CONFIG_BCM43XX_PIO
3983                         printk(KERN_WARNING PFX "DMA not supported. Falling back to PIO.\n");
3984                         bcm->__using_pio = 1;
3985 #else
3986                         printk(KERN_ERR PFX "FATAL: DMA not supported and PIO not configured. "
3987                                             "Recompile the driver with PIO support, please.\n");
3988                         return -ENODEV;
3989 #endif /* CONFIG_BCM43XX_PIO */
3990                 }
3991         }
3992         bcm->rts_threshold = BCM43xx_DEFAULT_RTS_THRESHOLD;
3993
3994         /* default to sw encryption for now */
3995         bcm->ieee->host_build_iv = 0;
3996         bcm->ieee->host_encrypt = 1;
3997         bcm->ieee->host_decrypt = 1;
3998
3999         bcm->ieee->iw_mode = BCM43xx_INITIAL_IWMODE;
4000         bcm->ieee->tx_headroom = sizeof(struct bcm43xx_txhdr);
4001         bcm->ieee->set_security = bcm43xx_ieee80211_set_security;
4002         bcm->ieee->hard_start_xmit = bcm43xx_ieee80211_hard_start_xmit;
4003
4004         return 0;
4005 }
4006
4007 static int __devinit bcm43xx_init_one(struct pci_dev *pdev,
4008                                       const struct pci_device_id *ent)
4009 {
4010         struct net_device *net_dev;
4011         struct bcm43xx_private *bcm;
4012         int err;
4013
4014 #ifdef CONFIG_BCM947XX
4015         if ((pdev->bus->number == 0) && (pdev->device != 0x0800))
4016                 return -ENODEV;
4017 #endif
4018
4019 #ifdef DEBUG_SINGLE_DEVICE_ONLY
4020         if (strcmp(pci_name(pdev), DEBUG_SINGLE_DEVICE_ONLY))
4021                 return -ENODEV;
4022 #endif
4023
4024         net_dev = alloc_ieee80211softmac(sizeof(*bcm));
4025         if (!net_dev) {
4026                 printk(KERN_ERR PFX
4027                        "could not allocate ieee80211 device %s\n",
4028                        pci_name(pdev));
4029                 err = -ENOMEM;
4030                 goto out;
4031         }
4032         /* initialize the net_device struct */
4033         SET_MODULE_OWNER(net_dev);
4034         SET_NETDEV_DEV(net_dev, &pdev->dev);
4035
4036         net_dev->open = bcm43xx_net_open;
4037         net_dev->stop = bcm43xx_net_stop;
4038         net_dev->get_stats = bcm43xx_net_get_stats;
4039         net_dev->tx_timeout = bcm43xx_net_tx_timeout;
4040 #ifdef CONFIG_NET_POLL_CONTROLLER
4041         net_dev->poll_controller = bcm43xx_net_poll_controller;
4042 #endif
4043         net_dev->wireless_handlers = &bcm43xx_wx_handlers_def;
4044         net_dev->irq = pdev->irq;
4045         SET_ETHTOOL_OPS(net_dev, &bcm43xx_ethtool_ops);
4046
4047         /* initialize the bcm43xx_private struct */
4048         bcm = bcm43xx_priv(net_dev);
4049         memset(bcm, 0, sizeof(*bcm));
4050         err = bcm43xx_init_private(bcm, net_dev, pdev);
4051         if (err)
4052                 goto err_free_netdev;
4053
4054         pci_set_drvdata(pdev, net_dev);
4055
4056         err = bcm43xx_attach_board(bcm);
4057         if (err)
4058                 goto err_free_netdev;
4059
4060         err = register_netdev(net_dev);
4061         if (err) {
4062                 printk(KERN_ERR PFX "Cannot register net device, "
4063                        "aborting.\n");
4064                 err = -ENOMEM;
4065                 goto err_detach_board;
4066         }
4067
4068         bcm43xx_debugfs_add_device(bcm);
4069
4070         assert(err == 0);
4071 out:
4072         return err;
4073
4074 err_detach_board:
4075         bcm43xx_detach_board(bcm);
4076 err_free_netdev:
4077         free_ieee80211softmac(net_dev);
4078         goto out;
4079 }
4080
4081 static void __devexit bcm43xx_remove_one(struct pci_dev *pdev)
4082 {
4083         struct net_device *net_dev = pci_get_drvdata(pdev);
4084         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
4085
4086         bcm43xx_debugfs_remove_device(bcm);
4087         unregister_netdev(net_dev);
4088         bcm43xx_detach_board(bcm);
4089         free_ieee80211softmac(net_dev);
4090 }
4091
4092 /* Hard-reset the chip. Do not call this directly.
4093  * Use bcm43xx_controller_restart()
4094  */
4095 static void bcm43xx_chip_reset(void *_bcm)
4096 {
4097         struct bcm43xx_private *bcm = _bcm;
4098         struct bcm43xx_phyinfo *phy;
4099         int err;
4100
4101         mutex_lock(&(bcm)->mutex);
4102         phy = bcm43xx_current_phy(bcm);
4103         err = bcm43xx_select_wireless_core(bcm, phy->type);
4104         mutex_unlock(&(bcm)->mutex);
4105
4106         printk(KERN_ERR PFX "Controller restart%s\n",
4107                (err == 0) ? "ed" : " failed");
4108 }
4109
4110 /* Hard-reset the chip.
4111  * This can be called from interrupt or process context.
4112  */
4113 void bcm43xx_controller_restart(struct bcm43xx_private *bcm, const char *reason)
4114 {
4115         assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
4116         bcm43xx_set_status(bcm, BCM43xx_STAT_RESTARTING);
4117         printk(KERN_ERR PFX "Controller RESET (%s) ...\n", reason);
4118         INIT_WORK(&bcm->restart_work, bcm43xx_chip_reset, bcm);
4119         schedule_work(&bcm->restart_work);
4120 }
4121
4122 #ifdef CONFIG_PM
4123
4124 static int bcm43xx_suspend(struct pci_dev *pdev, pm_message_t state)
4125 {
4126         struct net_device *net_dev = pci_get_drvdata(pdev);
4127         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
4128         int err;
4129
4130         dprintk(KERN_INFO PFX "Suspending...\n");
4131
4132         netif_device_detach(net_dev);
4133         bcm->was_initialized = 0;
4134         if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED) {
4135                 bcm->was_initialized = 1;
4136                 ieee80211softmac_stop(net_dev);
4137                 err = bcm43xx_disable_interrupts_sync(bcm);
4138                 if (unlikely(err)) {
4139                         dprintk(KERN_ERR PFX "Suspend failed.\n");
4140                         return -EAGAIN;
4141                 }
4142                 bcm->firmware_norelease = 1;
4143                 bcm43xx_free_board(bcm);
4144                 bcm->firmware_norelease = 0;
4145         }
4146         bcm43xx_chipset_detach(bcm);
4147
4148         pci_save_state(pdev);
4149         pci_disable_device(pdev);
4150         pci_set_power_state(pdev, pci_choose_state(pdev, state));
4151
4152         dprintk(KERN_INFO PFX "Device suspended.\n");
4153
4154         return 0;
4155 }
4156
4157 static int bcm43xx_resume(struct pci_dev *pdev)
4158 {
4159         struct net_device *net_dev = pci_get_drvdata(pdev);
4160         struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
4161         int err = 0;
4162
4163         dprintk(KERN_INFO PFX "Resuming...\n");
4164
4165         pci_set_power_state(pdev, 0);
4166         pci_enable_device(pdev);
4167         pci_restore_state(pdev);
4168
4169         bcm43xx_chipset_attach(bcm);
4170         if (bcm->was_initialized)
4171                 err = bcm43xx_init_board(bcm);
4172         if (err) {
4173                 printk(KERN_ERR PFX "Resume failed!\n");
4174                 return err;
4175         }
4176         netif_device_attach(net_dev);
4177
4178         dprintk(KERN_INFO PFX "Device resumed.\n");
4179
4180         return 0;
4181 }
4182
4183 #endif                          /* CONFIG_PM */
4184
4185 static struct pci_driver bcm43xx_pci_driver = {
4186         .name = KBUILD_MODNAME,
4187         .id_table = bcm43xx_pci_tbl,
4188         .probe = bcm43xx_init_one,
4189         .remove = __devexit_p(bcm43xx_remove_one),
4190 #ifdef CONFIG_PM
4191         .suspend = bcm43xx_suspend,
4192         .resume = bcm43xx_resume,
4193 #endif                          /* CONFIG_PM */
4194 };
4195
4196 static int __init bcm43xx_init(void)
4197 {
4198         printk(KERN_INFO KBUILD_MODNAME " driver\n");
4199         bcm43xx_debugfs_init();
4200         return pci_register_driver(&bcm43xx_pci_driver);
4201 }
4202
4203 static void __exit bcm43xx_exit(void)
4204 {
4205         pci_unregister_driver(&bcm43xx_pci_driver);
4206         bcm43xx_debugfs_exit();
4207 }
4208
4209 module_init(bcm43xx_init)
4210 module_exit(bcm43xx_exit)