NetXen: Updates for ethtool support
[sfrench/cifs-2.6.git] / drivers / net / wireless / bcm43xx / bcm43xx_main.c
1 /*
2
3   Broadcom BCM43xx wireless driver
4
5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>,
6                      Stefano Brivio <st3@riseup.net>
7                      Michael Buesch <mbuesch@freenet.de>
8                      Danny van Dyk <kugelfang@gentoo.org>
9                      Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11   Some parts of the code in this file are derived from the ipw2200
12   driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14   This program is free software; you can redistribute it and/or modify
15   it under the terms of the GNU General Public License as published by
16   the Free Software Foundation; either version 2 of the License, or
17   (at your option) any later version.
18
19   This program is distributed in the hope that it will be useful,
20   but WITHOUT ANY WARRANTY; without even the implied warranty of
21   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22   GNU General Public License for more details.
23
24   You should have received a copy of the GNU General Public License
25   along with this program; see the file COPYING.  If not, write to
26   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27   Boston, MA 02110-1301, USA.
28
29 */
30
31 #include <linux/delay.h>
32 #include <linux/init.h>
33 #include <linux/moduleparam.h>
34 #include <linux/if_arp.h>
35 #include <linux/etherdevice.h>
36 #include <linux/version.h>
37 #include <linux/firmware.h>
38 #include <linux/wireless.h>
39 #include <linux/workqueue.h>
40 #include <linux/skbuff.h>
41 #include <linux/dma-mapping.h>
42 #include <net/iw_handler.h>
43
44 #include "bcm43xx.h"
45 #include "bcm43xx_main.h"
46 #include "bcm43xx_debugfs.h"
47 #include "bcm43xx_radio.h"
48 #include "bcm43xx_phy.h"
49 #include "bcm43xx_dma.h"
50 #include "bcm43xx_pio.h"
51 #include "bcm43xx_power.h"
52 #include "bcm43xx_wx.h"
53 #include "bcm43xx_ethtool.h"
54 #include "bcm43xx_xmit.h"
55 #include "bcm43xx_sysfs.h"
56
57
58 MODULE_DESCRIPTION("Broadcom BCM43xx wireless driver");
59 MODULE_AUTHOR("Martin Langer");
60 MODULE_AUTHOR("Stefano Brivio");
61 MODULE_AUTHOR("Michael Buesch");
62 MODULE_LICENSE("GPL");
63
64 #ifdef CONFIG_BCM947XX
65 extern char *nvram_get(char *name);
66 #endif
67
68 #if defined(CONFIG_BCM43XX_DMA) && defined(CONFIG_BCM43XX_PIO)
69 static int modparam_pio;
70 module_param_named(pio, modparam_pio, int, 0444);
71 MODULE_PARM_DESC(pio, "enable(1) / disable(0) PIO mode");
72 #elif defined(CONFIG_BCM43XX_DMA)
73 # define modparam_pio   0
74 #elif defined(CONFIG_BCM43XX_PIO)
75 # define modparam_pio   1
76 #endif
77
78 static int modparam_bad_frames_preempt;
79 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
80 MODULE_PARM_DESC(bad_frames_preempt, "enable(1) / disable(0) Bad Frames Preemption");
81
82 static int modparam_short_retry = BCM43xx_DEFAULT_SHORT_RETRY_LIMIT;
83 module_param_named(short_retry, modparam_short_retry, int, 0444);
84 MODULE_PARM_DESC(short_retry, "Short-Retry-Limit (0 - 15)");
85
86 static int modparam_long_retry = BCM43xx_DEFAULT_LONG_RETRY_LIMIT;
87 module_param_named(long_retry, modparam_long_retry, int, 0444);
88 MODULE_PARM_DESC(long_retry, "Long-Retry-Limit (0 - 15)");
89
90 static int modparam_locale = -1;
91 module_param_named(locale, modparam_locale, int, 0444);
92 MODULE_PARM_DESC(country, "Select LocaleCode 0-11 (For travelers)");
93
94 static int modparam_noleds;
95 module_param_named(noleds, modparam_noleds, int, 0444);
96 MODULE_PARM_DESC(noleds, "Turn off all LED activity");
97
98 #ifdef CONFIG_BCM43XX_DEBUG
99 static char modparam_fwpostfix[64];
100 module_param_string(fwpostfix, modparam_fwpostfix, 64, 0444);
101 MODULE_PARM_DESC(fwpostfix, "Postfix for .fw files. Useful for debugging.");
102 #else
103 # define modparam_fwpostfix  ""
104 #endif /* CONFIG_BCM43XX_DEBUG*/
105
106
107 /* If you want to debug with just a single device, enable this,
108  * where the string is the pci device ID (as given by the kernel's
109  * pci_name function) of the device to be used.
110  */
111 //#define DEBUG_SINGLE_DEVICE_ONLY      "0001:11:00.0"
112
113 /* If you want to enable printing of each MMIO access, enable this. */
114 //#define DEBUG_ENABLE_MMIO_PRINT
115
116 /* If you want to enable printing of MMIO access within
117  * ucode/pcm upload, initvals write, enable this.
118  */
119 //#define DEBUG_ENABLE_UCODE_MMIO_PRINT
120
121 /* If you want to enable printing of PCI Config Space access, enable this */
122 //#define DEBUG_ENABLE_PCILOG
123
124
125 /* Detailed list maintained at:
126  * http://openfacts.berlios.de/index-en.phtml?title=Bcm43xxDevices
127  */
128         static struct pci_device_id bcm43xx_pci_tbl[] = {
129         /* Broadcom 4303 802.11b */
130         { PCI_VENDOR_ID_BROADCOM, 0x4301, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
131         /* Broadcom 4307 802.11b */
132         { PCI_VENDOR_ID_BROADCOM, 0x4307, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
133         /* Broadcom 4311 802.11(a)/b/g */
134         { PCI_VENDOR_ID_BROADCOM, 0x4311, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
135         /* Broadcom 4312 802.11a/b/g */
136         { PCI_VENDOR_ID_BROADCOM, 0x4312, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
137         /* Broadcom 4318 802.11b/g */
138         { PCI_VENDOR_ID_BROADCOM, 0x4318, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
139         /* Broadcom 4319 802.11a/b/g */
140         { PCI_VENDOR_ID_BROADCOM, 0x4319, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
141         /* Broadcom 4306 802.11b/g */
142         { PCI_VENDOR_ID_BROADCOM, 0x4320, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
143         /* Broadcom 4306 802.11a */
144 //      { PCI_VENDOR_ID_BROADCOM, 0x4321, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
145         /* Broadcom 4309 802.11a/b/g */
146         { PCI_VENDOR_ID_BROADCOM, 0x4324, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
147         /* Broadcom 43XG 802.11b/g */
148         { PCI_VENDOR_ID_BROADCOM, 0x4325, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
149 #ifdef CONFIG_BCM947XX
150         /* SB bus on BCM947xx */
151         { PCI_VENDOR_ID_BROADCOM, 0x0800, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
152 #endif
153         { 0 },
154 };
155 MODULE_DEVICE_TABLE(pci, bcm43xx_pci_tbl);
156
157 static void bcm43xx_ram_write(struct bcm43xx_private *bcm, u16 offset, u32 val)
158 {
159         u32 status;
160
161         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
162         if (!(status & BCM43xx_SBF_XFER_REG_BYTESWAP))
163                 val = swab32(val);
164
165         bcm43xx_write32(bcm, BCM43xx_MMIO_RAM_CONTROL, offset);
166         mmiowb();
167         bcm43xx_write32(bcm, BCM43xx_MMIO_RAM_DATA, val);
168 }
169
170 static inline
171 void bcm43xx_shm_control_word(struct bcm43xx_private *bcm,
172                               u16 routing, u16 offset)
173 {
174         u32 control;
175
176         /* "offset" is the WORD offset. */
177
178         control = routing;
179         control <<= 16;
180         control |= offset;
181         bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_CONTROL, control);
182 }
183
184 u32 bcm43xx_shm_read32(struct bcm43xx_private *bcm,
185                        u16 routing, u16 offset)
186 {
187         u32 ret;
188
189         if (routing == BCM43xx_SHM_SHARED) {
190                 if (offset & 0x0003) {
191                         /* Unaligned access */
192                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
193                         ret = bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED);
194                         ret <<= 16;
195                         bcm43xx_shm_control_word(bcm, routing, (offset >> 2) + 1);
196                         ret |= bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA);
197
198                         return ret;
199                 }
200                 offset >>= 2;
201         }
202         bcm43xx_shm_control_word(bcm, routing, offset);
203         ret = bcm43xx_read32(bcm, BCM43xx_MMIO_SHM_DATA);
204
205         return ret;
206 }
207
208 u16 bcm43xx_shm_read16(struct bcm43xx_private *bcm,
209                        u16 routing, u16 offset)
210 {
211         u16 ret;
212
213         if (routing == BCM43xx_SHM_SHARED) {
214                 if (offset & 0x0003) {
215                         /* Unaligned access */
216                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
217                         ret = bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED);
218
219                         return ret;
220                 }
221                 offset >>= 2;
222         }
223         bcm43xx_shm_control_word(bcm, routing, offset);
224         ret = bcm43xx_read16(bcm, BCM43xx_MMIO_SHM_DATA);
225
226         return ret;
227 }
228
229 void bcm43xx_shm_write32(struct bcm43xx_private *bcm,
230                          u16 routing, u16 offset,
231                          u32 value)
232 {
233         if (routing == BCM43xx_SHM_SHARED) {
234                 if (offset & 0x0003) {
235                         /* Unaligned access */
236                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
237                         mmiowb();
238                         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED,
239                                         (value >> 16) & 0xffff);
240                         mmiowb();
241                         bcm43xx_shm_control_word(bcm, routing, (offset >> 2) + 1);
242                         mmiowb();
243                         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA,
244                                         value & 0xffff);
245                         return;
246                 }
247                 offset >>= 2;
248         }
249         bcm43xx_shm_control_word(bcm, routing, offset);
250         mmiowb();
251         bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA, value);
252 }
253
254 void bcm43xx_shm_write16(struct bcm43xx_private *bcm,
255                          u16 routing, u16 offset,
256                          u16 value)
257 {
258         if (routing == BCM43xx_SHM_SHARED) {
259                 if (offset & 0x0003) {
260                         /* Unaligned access */
261                         bcm43xx_shm_control_word(bcm, routing, offset >> 2);
262                         mmiowb();
263                         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED,
264                                         value);
265                         return;
266                 }
267                 offset >>= 2;
268         }
269         bcm43xx_shm_control_word(bcm, routing, offset);
270         mmiowb();
271         bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA, value);
272 }
273
274 void bcm43xx_tsf_read(struct bcm43xx_private *bcm, u64 *tsf)
275 {
276         /* We need to be careful. As we read the TSF from multiple
277          * registers, we should take care of register overflows.
278          * In theory, the whole tsf read process should be atomic.
279          * We try to be atomic here, by restaring the read process,
280          * if any of the high registers changed (overflew).
281          */
282         if (bcm->current_core->rev >= 3) {
283                 u32 low, high, high2;
284
285                 do {
286                         high = bcm43xx_read32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_HIGH);
287                         low = bcm43xx_read32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW);
288                         high2 = bcm43xx_read32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_HIGH);
289                 } while (unlikely(high != high2));
290
291                 *tsf = high;
292                 *tsf <<= 32;
293                 *tsf |= low;
294         } else {
295                 u64 tmp;
296                 u16 v0, v1, v2, v3;
297                 u16 test1, test2, test3;
298
299                 do {
300                         v3 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_3);
301                         v2 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_2);
302                         v1 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_1);
303                         v0 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_0);
304
305                         test3 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_3);
306                         test2 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_2);
307                         test1 = bcm43xx_read16(bcm, BCM43xx_MMIO_TSF_1);
308                 } while (v3 != test3 || v2 != test2 || v1 != test1);
309
310                 *tsf = v3;
311                 *tsf <<= 48;
312                 tmp = v2;
313                 tmp <<= 32;
314                 *tsf |= tmp;
315                 tmp = v1;
316                 tmp <<= 16;
317                 *tsf |= tmp;
318                 *tsf |= v0;
319         }
320 }
321
322 void bcm43xx_tsf_write(struct bcm43xx_private *bcm, u64 tsf)
323 {
324         u32 status;
325
326         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
327         status |= BCM43xx_SBF_TIME_UPDATE;
328         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
329         mmiowb();
330
331         /* Be careful with the in-progress timer.
332          * First zero out the low register, so we have a full
333          * register-overflow duration to complete the operation.
334          */
335         if (bcm->current_core->rev >= 3) {
336                 u32 lo = (tsf & 0x00000000FFFFFFFFULL);
337                 u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
338
339                 bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW, 0);
340                 mmiowb();
341                 bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_HIGH, hi);
342                 mmiowb();
343                 bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW, lo);
344         } else {
345                 u16 v0 = (tsf & 0x000000000000FFFFULL);
346                 u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
347                 u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
348                 u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
349
350                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_0, 0);
351                 mmiowb();
352                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_3, v3);
353                 mmiowb();
354                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_2, v2);
355                 mmiowb();
356                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_1, v1);
357                 mmiowb();
358                 bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_0, v0);
359         }
360
361         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
362         status &= ~BCM43xx_SBF_TIME_UPDATE;
363         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
364 }
365
366 static
367 void bcm43xx_macfilter_set(struct bcm43xx_private *bcm,
368                            u16 offset,
369                            const u8 *mac)
370 {
371         u16 data;
372
373         offset |= 0x0020;
374         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_CONTROL, offset);
375
376         data = mac[0];
377         data |= mac[1] << 8;
378         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_DATA, data);
379         data = mac[2];
380         data |= mac[3] << 8;
381         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_DATA, data);
382         data = mac[4];
383         data |= mac[5] << 8;
384         bcm43xx_write16(bcm, BCM43xx_MMIO_MACFILTER_DATA, data);
385 }
386
387 static void bcm43xx_macfilter_clear(struct bcm43xx_private *bcm,
388                                     u16 offset)
389 {
390         const u8 zero_addr[ETH_ALEN] = { 0 };
391
392         bcm43xx_macfilter_set(bcm, offset, zero_addr);
393 }
394
395 static void bcm43xx_write_mac_bssid_templates(struct bcm43xx_private *bcm)
396 {
397         const u8 *mac = (const u8 *)(bcm->net_dev->dev_addr);
398         const u8 *bssid = (const u8 *)(bcm->ieee->bssid);
399         u8 mac_bssid[ETH_ALEN * 2];
400         int i;
401
402         memcpy(mac_bssid, mac, ETH_ALEN);
403         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
404
405         /* Write our MAC address and BSSID to template ram */
406         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32))
407                 bcm43xx_ram_write(bcm, 0x20 + i, *((u32 *)(mac_bssid + i)));
408         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32))
409                 bcm43xx_ram_write(bcm, 0x78 + i, *((u32 *)(mac_bssid + i)));
410         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32))
411                 bcm43xx_ram_write(bcm, 0x478 + i, *((u32 *)(mac_bssid + i)));
412 }
413
414 //FIXME: Well, we should probably call them from somewhere.
415 #if 0
416 static void bcm43xx_set_slot_time(struct bcm43xx_private *bcm, u16 slot_time)
417 {
418         /* slot_time is in usec. */
419         if (bcm43xx_current_phy(bcm)->type != BCM43xx_PHYTYPE_G)
420                 return;
421         bcm43xx_write16(bcm, 0x684, 510 + slot_time);
422         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0010, slot_time);
423 }
424
425 static void bcm43xx_short_slot_timing_enable(struct bcm43xx_private *bcm)
426 {
427         bcm43xx_set_slot_time(bcm, 9);
428 }
429
430 static void bcm43xx_short_slot_timing_disable(struct bcm43xx_private *bcm)
431 {
432         bcm43xx_set_slot_time(bcm, 20);
433 }
434 #endif
435
436 /* FIXME: To get the MAC-filter working, we need to implement the
437  *        following functions (and rename them :)
438  */
439 #if 0
440 static void bcm43xx_disassociate(struct bcm43xx_private *bcm)
441 {
442         bcm43xx_mac_suspend(bcm);
443         bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
444
445         bcm43xx_ram_write(bcm, 0x0026, 0x0000);
446         bcm43xx_ram_write(bcm, 0x0028, 0x0000);
447         bcm43xx_ram_write(bcm, 0x007E, 0x0000);
448         bcm43xx_ram_write(bcm, 0x0080, 0x0000);
449         bcm43xx_ram_write(bcm, 0x047E, 0x0000);
450         bcm43xx_ram_write(bcm, 0x0480, 0x0000);
451
452         if (bcm->current_core->rev < 3) {
453                 bcm43xx_write16(bcm, 0x0610, 0x8000);
454                 bcm43xx_write16(bcm, 0x060E, 0x0000);
455         } else
456                 bcm43xx_write32(bcm, 0x0188, 0x80000000);
457
458         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0004, 0x000003ff);
459
460         if (bcm43xx_current_phy(bcm)->type == BCM43xx_PHYTYPE_G &&
461             ieee80211_is_ofdm_rate(bcm->softmac->txrates.default_rate))
462                 bcm43xx_short_slot_timing_enable(bcm);
463
464         bcm43xx_mac_enable(bcm);
465 }
466
467 static void bcm43xx_associate(struct bcm43xx_private *bcm,
468                               const u8 *mac)
469 {
470         memcpy(bcm->ieee->bssid, mac, ETH_ALEN);
471
472         bcm43xx_mac_suspend(bcm);
473         bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_ASSOC, mac);
474         bcm43xx_write_mac_bssid_templates(bcm);
475         bcm43xx_mac_enable(bcm);
476 }
477 #endif
478
479 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
480  * Returns the _previously_ enabled IRQ mask.
481  */
482 static inline u32 bcm43xx_interrupt_enable(struct bcm43xx_private *bcm, u32 mask)
483 {
484         u32 old_mask;
485
486         old_mask = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
487         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK, old_mask | mask);
488
489         return old_mask;
490 }
491
492 /* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
493  * Returns the _previously_ enabled IRQ mask.
494  */
495 static inline u32 bcm43xx_interrupt_disable(struct bcm43xx_private *bcm, u32 mask)
496 {
497         u32 old_mask;
498
499         old_mask = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
500         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
501
502         return old_mask;
503 }
504
505 /* Synchronize IRQ top- and bottom-half.
506  * IRQs must be masked before calling this.
507  * This must not be called with the irq_lock held.
508  */
509 static void bcm43xx_synchronize_irq(struct bcm43xx_private *bcm)
510 {
511         synchronize_irq(bcm->irq);
512         tasklet_disable(&bcm->isr_tasklet);
513 }
514
515 /* Make sure we don't receive more data from the device. */
516 static int bcm43xx_disable_interrupts_sync(struct bcm43xx_private *bcm)
517 {
518         unsigned long flags;
519
520         spin_lock_irqsave(&bcm->irq_lock, flags);
521         if (unlikely(bcm43xx_status(bcm) != BCM43xx_STAT_INITIALIZED)) {
522                 spin_unlock_irqrestore(&bcm->irq_lock, flags);
523                 return -EBUSY;
524         }
525         bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
526         bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK); /* flush */
527         spin_unlock_irqrestore(&bcm->irq_lock, flags);
528         bcm43xx_synchronize_irq(bcm);
529
530         return 0;
531 }
532
533 static int bcm43xx_read_radioinfo(struct bcm43xx_private *bcm)
534 {
535         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
536         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
537         u32 radio_id;
538         u16 manufact;
539         u16 version;
540         u8 revision;
541
542         if (bcm->chip_id == 0x4317) {
543                 if (bcm->chip_rev == 0x00)
544                         radio_id = 0x3205017F;
545                 else if (bcm->chip_rev == 0x01)
546                         radio_id = 0x4205017F;
547                 else
548                         radio_id = 0x5205017F;
549         } else {
550                 bcm43xx_write16(bcm, BCM43xx_MMIO_RADIO_CONTROL, BCM43xx_RADIOCTL_ID);
551                 radio_id = bcm43xx_read16(bcm, BCM43xx_MMIO_RADIO_DATA_HIGH);
552                 radio_id <<= 16;
553                 bcm43xx_write16(bcm, BCM43xx_MMIO_RADIO_CONTROL, BCM43xx_RADIOCTL_ID);
554                 radio_id |= bcm43xx_read16(bcm, BCM43xx_MMIO_RADIO_DATA_LOW);
555         }
556
557         manufact = (radio_id & 0x00000FFF);
558         version = (radio_id & 0x0FFFF000) >> 12;
559         revision = (radio_id & 0xF0000000) >> 28;
560
561         dprintk(KERN_INFO PFX "Detected Radio: ID: %x (Manuf: %x Ver: %x Rev: %x)\n",
562                 radio_id, manufact, version, revision);
563
564         switch (phy->type) {
565         case BCM43xx_PHYTYPE_A:
566                 if ((version != 0x2060) || (revision != 1) || (manufact != 0x17f))
567                         goto err_unsupported_radio;
568                 break;
569         case BCM43xx_PHYTYPE_B:
570                 if ((version & 0xFFF0) != 0x2050)
571                         goto err_unsupported_radio;
572                 break;
573         case BCM43xx_PHYTYPE_G:
574                 if (version != 0x2050)
575                         goto err_unsupported_radio;
576                 break;
577         }
578
579         radio->manufact = manufact;
580         radio->version = version;
581         radio->revision = revision;
582
583         if (phy->type == BCM43xx_PHYTYPE_A)
584                 radio->txpower_desired = bcm->sprom.maxpower_aphy;
585         else
586                 radio->txpower_desired = bcm->sprom.maxpower_bgphy;
587
588         return 0;
589
590 err_unsupported_radio:
591         printk(KERN_ERR PFX "Unsupported Radio connected to the PHY!\n");
592         return -ENODEV;
593 }
594
595 static const char * bcm43xx_locale_iso(u8 locale)
596 {
597         /* ISO 3166-1 country codes.
598          * Note that there aren't ISO 3166-1 codes for
599          * all or locales. (Not all locales are countries)
600          */
601         switch (locale) {
602         case BCM43xx_LOCALE_WORLD:
603         case BCM43xx_LOCALE_ALL:
604                 return "XX";
605         case BCM43xx_LOCALE_THAILAND:
606                 return "TH";
607         case BCM43xx_LOCALE_ISRAEL:
608                 return "IL";
609         case BCM43xx_LOCALE_JORDAN:
610                 return "JO";
611         case BCM43xx_LOCALE_CHINA:
612                 return "CN";
613         case BCM43xx_LOCALE_JAPAN:
614         case BCM43xx_LOCALE_JAPAN_HIGH:
615                 return "JP";
616         case BCM43xx_LOCALE_USA_CANADA_ANZ:
617         case BCM43xx_LOCALE_USA_LOW:
618                 return "US";
619         case BCM43xx_LOCALE_EUROPE:
620                 return "EU";
621         case BCM43xx_LOCALE_NONE:
622                 return "  ";
623         }
624         assert(0);
625         return "  ";
626 }
627
628 static const char * bcm43xx_locale_string(u8 locale)
629 {
630         switch (locale) {
631         case BCM43xx_LOCALE_WORLD:
632                 return "World";
633         case BCM43xx_LOCALE_THAILAND:
634                 return "Thailand";
635         case BCM43xx_LOCALE_ISRAEL:
636                 return "Israel";
637         case BCM43xx_LOCALE_JORDAN:
638                 return "Jordan";
639         case BCM43xx_LOCALE_CHINA:
640                 return "China";
641         case BCM43xx_LOCALE_JAPAN:
642                 return "Japan";
643         case BCM43xx_LOCALE_USA_CANADA_ANZ:
644                 return "USA/Canada/ANZ";
645         case BCM43xx_LOCALE_EUROPE:
646                 return "Europe";
647         case BCM43xx_LOCALE_USA_LOW:
648                 return "USAlow";
649         case BCM43xx_LOCALE_JAPAN_HIGH:
650                 return "JapanHigh";
651         case BCM43xx_LOCALE_ALL:
652                 return "All";
653         case BCM43xx_LOCALE_NONE:
654                 return "None";
655         }
656         assert(0);
657         return "";
658 }
659
660 static inline u8 bcm43xx_crc8(u8 crc, u8 data)
661 {
662         static const u8 t[] = {
663                 0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
664                 0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
665                 0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
666                 0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
667                 0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
668                 0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
669                 0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
670                 0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
671                 0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
672                 0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
673                 0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
674                 0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
675                 0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
676                 0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
677                 0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
678                 0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
679                 0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
680                 0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
681                 0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
682                 0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
683                 0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
684                 0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
685                 0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
686                 0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
687                 0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
688                 0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
689                 0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
690                 0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
691                 0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
692                 0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
693                 0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
694                 0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F,
695         };
696         return t[crc ^ data];
697 }
698
699 static u8 bcm43xx_sprom_crc(const u16 *sprom)
700 {
701         int word;
702         u8 crc = 0xFF;
703
704         for (word = 0; word < BCM43xx_SPROM_SIZE - 1; word++) {
705                 crc = bcm43xx_crc8(crc, sprom[word] & 0x00FF);
706                 crc = bcm43xx_crc8(crc, (sprom[word] & 0xFF00) >> 8);
707         }
708         crc = bcm43xx_crc8(crc, sprom[BCM43xx_SPROM_VERSION] & 0x00FF);
709         crc ^= 0xFF;
710
711         return crc;
712 }
713
714 int bcm43xx_sprom_read(struct bcm43xx_private *bcm, u16 *sprom)
715 {
716         int i;
717         u8 crc, expected_crc;
718
719         for (i = 0; i < BCM43xx_SPROM_SIZE; i++)
720                 sprom[i] = bcm43xx_read16(bcm, BCM43xx_SPROM_BASE + (i * 2));
721         /* CRC-8 check. */
722         crc = bcm43xx_sprom_crc(sprom);
723         expected_crc = (sprom[BCM43xx_SPROM_VERSION] & 0xFF00) >> 8;
724         if (crc != expected_crc) {
725                 printk(KERN_WARNING PFX "WARNING: Invalid SPROM checksum "
726                                         "(0x%02X, expected: 0x%02X)\n",
727                        crc, expected_crc);
728                 return -EINVAL;
729         }
730
731         return 0;
732 }
733
734 int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
735 {
736         int i, err;
737         u8 crc, expected_crc;
738         u32 spromctl;
739
740         /* CRC-8 validation of the input data. */
741         crc = bcm43xx_sprom_crc(sprom);
742         expected_crc = (sprom[BCM43xx_SPROM_VERSION] & 0xFF00) >> 8;
743         if (crc != expected_crc) {
744                 printk(KERN_ERR PFX "SPROM input data: Invalid CRC\n");
745                 return -EINVAL;
746         }
747
748         printk(KERN_INFO PFX "Writing SPROM. Do NOT turn off the power! Please stand by...\n");
749         err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCICFG_SPROMCTL, &spromctl);
750         if (err)
751                 goto err_ctlreg;
752         spromctl |= 0x10; /* SPROM WRITE enable. */
753         err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
754         if (err)
755                 goto err_ctlreg;
756         /* We must burn lots of CPU cycles here, but that does not
757          * really matter as one does not write the SPROM every other minute...
758          */
759         printk(KERN_INFO PFX "[ 0%%");
760         mdelay(500);
761         for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
762                 if (i == 16)
763                         printk("25%%");
764                 else if (i == 32)
765                         printk("50%%");
766                 else if (i == 48)
767                         printk("75%%");
768                 else if (i % 2)
769                         printk(".");
770                 bcm43xx_write16(bcm, BCM43xx_SPROM_BASE + (i * 2), sprom[i]);
771                 mmiowb();
772                 mdelay(20);
773         }
774         spromctl &= ~0x10; /* SPROM WRITE enable. */
775         err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
776         if (err)
777                 goto err_ctlreg;
778         mdelay(500);
779         printk("100%% ]\n");
780         printk(KERN_INFO PFX "SPROM written.\n");
781         bcm43xx_controller_restart(bcm, "SPROM update");
782
783         return 0;
784 err_ctlreg:
785         printk(KERN_ERR PFX "Could not access SPROM control register.\n");
786         return -ENODEV;
787 }
788
789 static int bcm43xx_sprom_extract(struct bcm43xx_private *bcm)
790 {
791         u16 value;
792         u16 *sprom;
793 #ifdef CONFIG_BCM947XX
794         char *c;
795 #endif
796
797         sprom = kzalloc(BCM43xx_SPROM_SIZE * sizeof(u16),
798                         GFP_KERNEL);
799         if (!sprom) {
800                 printk(KERN_ERR PFX "sprom_extract OOM\n");
801                 return -ENOMEM;
802         }
803 #ifdef CONFIG_BCM947XX
804         sprom[BCM43xx_SPROM_BOARDFLAGS2] = atoi(nvram_get("boardflags2"));
805         sprom[BCM43xx_SPROM_BOARDFLAGS] = atoi(nvram_get("boardflags"));
806
807         if ((c = nvram_get("il0macaddr")) != NULL)
808                 e_aton(c, (char *) &(sprom[BCM43xx_SPROM_IL0MACADDR]));
809
810         if ((c = nvram_get("et1macaddr")) != NULL)
811                 e_aton(c, (char *) &(sprom[BCM43xx_SPROM_ET1MACADDR]));
812
813         sprom[BCM43xx_SPROM_PA0B0] = atoi(nvram_get("pa0b0"));
814         sprom[BCM43xx_SPROM_PA0B1] = atoi(nvram_get("pa0b1"));
815         sprom[BCM43xx_SPROM_PA0B2] = atoi(nvram_get("pa0b2"));
816
817         sprom[BCM43xx_SPROM_PA1B0] = atoi(nvram_get("pa1b0"));
818         sprom[BCM43xx_SPROM_PA1B1] = atoi(nvram_get("pa1b1"));
819         sprom[BCM43xx_SPROM_PA1B2] = atoi(nvram_get("pa1b2"));
820
821         sprom[BCM43xx_SPROM_BOARDREV] = atoi(nvram_get("boardrev"));
822 #else
823         bcm43xx_sprom_read(bcm, sprom);
824 #endif
825
826         /* boardflags2 */
827         value = sprom[BCM43xx_SPROM_BOARDFLAGS2];
828         bcm->sprom.boardflags2 = value;
829
830         /* il0macaddr */
831         value = sprom[BCM43xx_SPROM_IL0MACADDR + 0];
832         *(((u16 *)bcm->sprom.il0macaddr) + 0) = cpu_to_be16(value);
833         value = sprom[BCM43xx_SPROM_IL0MACADDR + 1];
834         *(((u16 *)bcm->sprom.il0macaddr) + 1) = cpu_to_be16(value);
835         value = sprom[BCM43xx_SPROM_IL0MACADDR + 2];
836         *(((u16 *)bcm->sprom.il0macaddr) + 2) = cpu_to_be16(value);
837
838         /* et0macaddr */
839         value = sprom[BCM43xx_SPROM_ET0MACADDR + 0];
840         *(((u16 *)bcm->sprom.et0macaddr) + 0) = cpu_to_be16(value);
841         value = sprom[BCM43xx_SPROM_ET0MACADDR + 1];
842         *(((u16 *)bcm->sprom.et0macaddr) + 1) = cpu_to_be16(value);
843         value = sprom[BCM43xx_SPROM_ET0MACADDR + 2];
844         *(((u16 *)bcm->sprom.et0macaddr) + 2) = cpu_to_be16(value);
845
846         /* et1macaddr */
847         value = sprom[BCM43xx_SPROM_ET1MACADDR + 0];
848         *(((u16 *)bcm->sprom.et1macaddr) + 0) = cpu_to_be16(value);
849         value = sprom[BCM43xx_SPROM_ET1MACADDR + 1];
850         *(((u16 *)bcm->sprom.et1macaddr) + 1) = cpu_to_be16(value);
851         value = sprom[BCM43xx_SPROM_ET1MACADDR + 2];
852         *(((u16 *)bcm->sprom.et1macaddr) + 2) = cpu_to_be16(value);
853
854         /* ethernet phy settings */
855         value = sprom[BCM43xx_SPROM_ETHPHY];
856         bcm->sprom.et0phyaddr = (value & 0x001F);
857         bcm->sprom.et1phyaddr = (value & 0x03E0) >> 5;
858         bcm->sprom.et0mdcport = (value & (1 << 14)) >> 14;
859         bcm->sprom.et1mdcport = (value & (1 << 15)) >> 15;
860
861         /* boardrev, antennas, locale */
862         value = sprom[BCM43xx_SPROM_BOARDREV];
863         bcm->sprom.boardrev = (value & 0x00FF);
864         bcm->sprom.locale = (value & 0x0F00) >> 8;
865         bcm->sprom.antennas_aphy = (value & 0x3000) >> 12;
866         bcm->sprom.antennas_bgphy = (value & 0xC000) >> 14;
867         if (modparam_locale != -1) {
868                 if (modparam_locale >= 0 && modparam_locale <= 11) {
869                         bcm->sprom.locale = modparam_locale;
870                         printk(KERN_WARNING PFX "Operating with modified "
871                                                 "LocaleCode %u (%s)\n",
872                                bcm->sprom.locale,
873                                bcm43xx_locale_string(bcm->sprom.locale));
874                 } else {
875                         printk(KERN_WARNING PFX "Module parameter \"locale\" "
876                                                 "invalid value. (0 - 11)\n");
877                 }
878         }
879
880         /* pa0b* */
881         value = sprom[BCM43xx_SPROM_PA0B0];
882         bcm->sprom.pa0b0 = value;
883         value = sprom[BCM43xx_SPROM_PA0B1];
884         bcm->sprom.pa0b1 = value;
885         value = sprom[BCM43xx_SPROM_PA0B2];
886         bcm->sprom.pa0b2 = value;
887
888         /* wl0gpio* */
889         value = sprom[BCM43xx_SPROM_WL0GPIO0];
890         if (value == 0x0000)
891                 value = 0xFFFF;
892         bcm->sprom.wl0gpio0 = value & 0x00FF;
893         bcm->sprom.wl0gpio1 = (value & 0xFF00) >> 8;
894         value = sprom[BCM43xx_SPROM_WL0GPIO2];
895         if (value == 0x0000)
896                 value = 0xFFFF;
897         bcm->sprom.wl0gpio2 = value & 0x00FF;
898         bcm->sprom.wl0gpio3 = (value & 0xFF00) >> 8;
899
900         /* maxpower */
901         value = sprom[BCM43xx_SPROM_MAXPWR];
902         bcm->sprom.maxpower_aphy = (value & 0xFF00) >> 8;
903         bcm->sprom.maxpower_bgphy = value & 0x00FF;
904
905         /* pa1b* */
906         value = sprom[BCM43xx_SPROM_PA1B0];
907         bcm->sprom.pa1b0 = value;
908         value = sprom[BCM43xx_SPROM_PA1B1];
909         bcm->sprom.pa1b1 = value;
910         value = sprom[BCM43xx_SPROM_PA1B2];
911         bcm->sprom.pa1b2 = value;
912
913         /* idle tssi target */
914         value = sprom[BCM43xx_SPROM_IDL_TSSI_TGT];
915         bcm->sprom.idle_tssi_tgt_aphy = value & 0x00FF;
916         bcm->sprom.idle_tssi_tgt_bgphy = (value & 0xFF00) >> 8;
917
918         /* boardflags */
919         value = sprom[BCM43xx_SPROM_BOARDFLAGS];
920         if (value == 0xFFFF)
921                 value = 0x0000;
922         bcm->sprom.boardflags = value;
923         /* boardflags workarounds */
924         if (bcm->board_vendor == PCI_VENDOR_ID_DELL &&
925             bcm->chip_id == 0x4301 &&
926             bcm->board_revision == 0x74)
927                 bcm->sprom.boardflags |= BCM43xx_BFL_BTCOEXIST;
928         if (bcm->board_vendor == PCI_VENDOR_ID_APPLE &&
929             bcm->board_type == 0x4E &&
930             bcm->board_revision > 0x40)
931                 bcm->sprom.boardflags |= BCM43xx_BFL_PACTRL;
932
933         /* antenna gain */
934         value = sprom[BCM43xx_SPROM_ANTENNA_GAIN];
935         if (value == 0x0000 || value == 0xFFFF)
936                 value = 0x0202;
937         /* convert values to Q5.2 */
938         bcm->sprom.antennagain_aphy = ((value & 0xFF00) >> 8) * 4;
939         bcm->sprom.antennagain_bgphy = (value & 0x00FF) * 4;
940
941         kfree(sprom);
942
943         return 0;
944 }
945
946 static int bcm43xx_geo_init(struct bcm43xx_private *bcm)
947 {
948         struct ieee80211_geo *geo;
949         struct ieee80211_channel *chan;
950         int have_a = 0, have_bg = 0;
951         int i;
952         u8 channel;
953         struct bcm43xx_phyinfo *phy;
954         const char *iso_country;
955
956         geo = kzalloc(sizeof(*geo), GFP_KERNEL);
957         if (!geo)
958                 return -ENOMEM;
959
960         for (i = 0; i < bcm->nr_80211_available; i++) {
961                 phy = &(bcm->core_80211_ext[i].phy);
962                 switch (phy->type) {
963                 case BCM43xx_PHYTYPE_B:
964                 case BCM43xx_PHYTYPE_G:
965                         have_bg = 1;
966                         break;
967                 case BCM43xx_PHYTYPE_A:
968                         have_a = 1;
969                         break;
970                 default:
971                         assert(0);
972                 }
973         }
974         iso_country = bcm43xx_locale_iso(bcm->sprom.locale);
975
976         if (have_a) {
977                 for (i = 0, channel = IEEE80211_52GHZ_MIN_CHANNEL;
978                       channel <= IEEE80211_52GHZ_MAX_CHANNEL; channel++) {
979                         chan = &geo->a[i++];
980                         chan->freq = bcm43xx_channel_to_freq_a(channel);
981                         chan->channel = channel;
982                 }
983                 geo->a_channels = i;
984         }
985         if (have_bg) {
986                 for (i = 0, channel = IEEE80211_24GHZ_MIN_CHANNEL;
987                       channel <= IEEE80211_24GHZ_MAX_CHANNEL; channel++) {
988                         chan = &geo->bg[i++];
989                         chan->freq = bcm43xx_channel_to_freq_bg(channel);
990                         chan->channel = channel;
991                 }
992                 geo->bg_channels = i;
993         }
994         memcpy(geo->name, iso_country, 2);
995         if (0 /*TODO: Outdoor use only */)
996                 geo->name[2] = 'O';
997         else if (0 /*TODO: Indoor use only */)
998                 geo->name[2] = 'I';
999         else
1000                 geo->name[2] = ' ';
1001         geo->name[3] = '\0';
1002
1003         ieee80211_set_geo(bcm->ieee, geo);
1004         kfree(geo);
1005
1006         return 0;
1007 }
1008
1009 /* DummyTransmission function, as documented on 
1010  * http://bcm-specs.sipsolutions.net/DummyTransmission
1011  */
1012 void bcm43xx_dummy_transmission(struct bcm43xx_private *bcm)
1013 {
1014         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
1015         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
1016         unsigned int i, max_loop;
1017         u16 value = 0;
1018         u32 buffer[5] = {
1019                 0x00000000,
1020                 0x0000D400,
1021                 0x00000000,
1022                 0x00000001,
1023                 0x00000000,
1024         };
1025
1026         switch (phy->type) {
1027         case BCM43xx_PHYTYPE_A:
1028                 max_loop = 0x1E;
1029                 buffer[0] = 0xCC010200;
1030                 break;
1031         case BCM43xx_PHYTYPE_B:
1032         case BCM43xx_PHYTYPE_G:
1033                 max_loop = 0xFA;
1034                 buffer[0] = 0x6E840B00; 
1035                 break;
1036         default:
1037                 assert(0);
1038                 return;
1039         }
1040
1041         for (i = 0; i < 5; i++)
1042                 bcm43xx_ram_write(bcm, i * 4, buffer[i]);
1043
1044         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD); /* dummy read */
1045
1046         bcm43xx_write16(bcm, 0x0568, 0x0000);
1047         bcm43xx_write16(bcm, 0x07C0, 0x0000);
1048         bcm43xx_write16(bcm, 0x050C, ((phy->type == BCM43xx_PHYTYPE_A) ? 1 : 0));
1049         bcm43xx_write16(bcm, 0x0508, 0x0000);
1050         bcm43xx_write16(bcm, 0x050A, 0x0000);
1051         bcm43xx_write16(bcm, 0x054C, 0x0000);
1052         bcm43xx_write16(bcm, 0x056A, 0x0014);
1053         bcm43xx_write16(bcm, 0x0568, 0x0826);
1054         bcm43xx_write16(bcm, 0x0500, 0x0000);
1055         bcm43xx_write16(bcm, 0x0502, 0x0030);
1056
1057         if (radio->version == 0x2050 && radio->revision <= 0x5)
1058                 bcm43xx_radio_write16(bcm, 0x0051, 0x0017);
1059         for (i = 0x00; i < max_loop; i++) {
1060                 value = bcm43xx_read16(bcm, 0x050E);
1061                 if (value & 0x0080)
1062                         break;
1063                 udelay(10);
1064         }
1065         for (i = 0x00; i < 0x0A; i++) {
1066                 value = bcm43xx_read16(bcm, 0x050E);
1067                 if (value & 0x0400)
1068                         break;
1069                 udelay(10);
1070         }
1071         for (i = 0x00; i < 0x0A; i++) {
1072                 value = bcm43xx_read16(bcm, 0x0690);
1073                 if (!(value & 0x0100))
1074                         break;
1075                 udelay(10);
1076         }
1077         if (radio->version == 0x2050 && radio->revision <= 0x5)
1078                 bcm43xx_radio_write16(bcm, 0x0051, 0x0037);
1079 }
1080
1081 static void key_write(struct bcm43xx_private *bcm,
1082                       u8 index, u8 algorithm, const u16 *key)
1083 {
1084         unsigned int i, basic_wep = 0;
1085         u32 offset;
1086         u16 value;
1087  
1088         /* Write associated key information */
1089         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x100 + (index * 2),
1090                             ((index << 4) | (algorithm & 0x0F)));
1091  
1092         /* The first 4 WEP keys need extra love */
1093         if (((algorithm == BCM43xx_SEC_ALGO_WEP) ||
1094             (algorithm == BCM43xx_SEC_ALGO_WEP104)) && (index < 4))
1095                 basic_wep = 1;
1096  
1097         /* Write key payload, 8 little endian words */
1098         offset = bcm->security_offset + (index * BCM43xx_SEC_KEYSIZE);
1099         for (i = 0; i < (BCM43xx_SEC_KEYSIZE / sizeof(u16)); i++) {
1100                 value = cpu_to_le16(key[i]);
1101                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1102                                     offset + (i * 2), value);
1103  
1104                 if (!basic_wep)
1105                         continue;
1106  
1107                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1108                                     offset + (i * 2) + 4 * BCM43xx_SEC_KEYSIZE,
1109                                     value);
1110         }
1111 }
1112
1113 static void keymac_write(struct bcm43xx_private *bcm,
1114                          u8 index, const u32 *addr)
1115 {
1116         /* for keys 0-3 there is no associated mac address */
1117         if (index < 4)
1118                 return;
1119
1120         index -= 4;
1121         if (bcm->current_core->rev >= 5) {
1122                 bcm43xx_shm_write32(bcm,
1123                                     BCM43xx_SHM_HWMAC,
1124                                     index * 2,
1125                                     cpu_to_be32(*addr));
1126                 bcm43xx_shm_write16(bcm,
1127                                     BCM43xx_SHM_HWMAC,
1128                                     (index * 2) + 1,
1129                                     cpu_to_be16(*((u16 *)(addr + 1))));
1130         } else {
1131                 if (index < 8) {
1132                         TODO(); /* Put them in the macaddress filter */
1133                 } else {
1134                         TODO();
1135                         /* Put them BCM43xx_SHM_SHARED, stating index 0x0120.
1136                            Keep in mind to update the count of keymacs in 0x003E as well! */
1137                 }
1138         }
1139 }
1140
1141 static int bcm43xx_key_write(struct bcm43xx_private *bcm,
1142                              u8 index, u8 algorithm,
1143                              const u8 *_key, int key_len,
1144                              const u8 *mac_addr)
1145 {
1146         u8 key[BCM43xx_SEC_KEYSIZE] = { 0 };
1147
1148         if (index >= ARRAY_SIZE(bcm->key))
1149                 return -EINVAL;
1150         if (key_len > ARRAY_SIZE(key))
1151                 return -EINVAL;
1152         if (algorithm < 1 || algorithm > 5)
1153                 return -EINVAL;
1154
1155         memcpy(key, _key, key_len);
1156         key_write(bcm, index, algorithm, (const u16 *)key);
1157         keymac_write(bcm, index, (const u32 *)mac_addr);
1158
1159         bcm->key[index].algorithm = algorithm;
1160
1161         return 0;
1162 }
1163
1164 static void bcm43xx_clear_keys(struct bcm43xx_private *bcm)
1165 {
1166         static const u32 zero_mac[2] = { 0 };
1167         unsigned int i,j, nr_keys = 54;
1168         u16 offset;
1169
1170         if (bcm->current_core->rev < 5)
1171                 nr_keys = 16;
1172         assert(nr_keys <= ARRAY_SIZE(bcm->key));
1173
1174         for (i = 0; i < nr_keys; i++) {
1175                 bcm->key[i].enabled = 0;
1176                 /* returns for i < 4 immediately */
1177                 keymac_write(bcm, i, zero_mac);
1178                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1179                                     0x100 + (i * 2), 0x0000);
1180                 for (j = 0; j < 8; j++) {
1181                         offset = bcm->security_offset + (j * 4) + (i * BCM43xx_SEC_KEYSIZE);
1182                         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED,
1183                                             offset, 0x0000);
1184                 }
1185         }
1186         dprintk(KERN_INFO PFX "Keys cleared\n");
1187 }
1188
1189 /* Lowlevel core-switch function. This is only to be used in
1190  * bcm43xx_switch_core() and bcm43xx_probe_cores()
1191  */
1192 static int _switch_core(struct bcm43xx_private *bcm, int core)
1193 {
1194         int err;
1195         int attempts = 0;
1196         u32 current_core;
1197
1198         assert(core >= 0);
1199         while (1) {
1200                 err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_ACTIVE_CORE,
1201                                                  (core * 0x1000) + 0x18000000);
1202                 if (unlikely(err))
1203                         goto error;
1204                 err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCICFG_ACTIVE_CORE,
1205                                                 &current_core);
1206                 if (unlikely(err))
1207                         goto error;
1208                 current_core = (current_core - 0x18000000) / 0x1000;
1209                 if (current_core == core)
1210                         break;
1211
1212                 if (unlikely(attempts++ > BCM43xx_SWITCH_CORE_MAX_RETRIES))
1213                         goto error;
1214                 udelay(10);
1215         }
1216 #ifdef CONFIG_BCM947XX
1217         if (bcm->pci_dev->bus->number == 0)
1218                 bcm->current_core_offset = 0x1000 * core;
1219         else
1220                 bcm->current_core_offset = 0;
1221 #endif
1222
1223         return 0;
1224 error:
1225         printk(KERN_ERR PFX "Failed to switch to core %d\n", core);
1226         return -ENODEV;
1227 }
1228
1229 int bcm43xx_switch_core(struct bcm43xx_private *bcm, struct bcm43xx_coreinfo *new_core)
1230 {
1231         int err;
1232
1233         if (unlikely(!new_core))
1234                 return 0;
1235         if (!new_core->available)
1236                 return -ENODEV;
1237         if (bcm->current_core == new_core)
1238                 return 0;
1239         err = _switch_core(bcm, new_core->index);
1240         if (unlikely(err))
1241                 goto out;
1242
1243         bcm->current_core = new_core;
1244 out:
1245         return err;
1246 }
1247
1248 static int bcm43xx_core_enabled(struct bcm43xx_private *bcm)
1249 {
1250         u32 value;
1251
1252         value = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1253         value &= BCM43xx_SBTMSTATELOW_CLOCK | BCM43xx_SBTMSTATELOW_RESET
1254                  | BCM43xx_SBTMSTATELOW_REJECT;
1255
1256         return (value == BCM43xx_SBTMSTATELOW_CLOCK);
1257 }
1258
1259 /* disable current core */
1260 static int bcm43xx_core_disable(struct bcm43xx_private *bcm, u32 core_flags)
1261 {
1262         u32 sbtmstatelow;
1263         u32 sbtmstatehigh;
1264         int i;
1265
1266         /* fetch sbtmstatelow from core information registers */
1267         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1268
1269         /* core is already in reset */
1270         if (sbtmstatelow & BCM43xx_SBTMSTATELOW_RESET)
1271                 goto out;
1272
1273         if (sbtmstatelow & BCM43xx_SBTMSTATELOW_CLOCK) {
1274                 sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK |
1275                                BCM43xx_SBTMSTATELOW_REJECT;
1276                 bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1277
1278                 for (i = 0; i < 1000; i++) {
1279                         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1280                         if (sbtmstatelow & BCM43xx_SBTMSTATELOW_REJECT) {
1281                                 i = -1;
1282                                 break;
1283                         }
1284                         udelay(10);
1285                 }
1286                 if (i != -1) {
1287                         printk(KERN_ERR PFX "Error: core_disable() REJECT timeout!\n");
1288                         return -EBUSY;
1289                 }
1290
1291                 for (i = 0; i < 1000; i++) {
1292                         sbtmstatehigh = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH);
1293                         if (!(sbtmstatehigh & BCM43xx_SBTMSTATEHIGH_BUSY)) {
1294                                 i = -1;
1295                                 break;
1296                         }
1297                         udelay(10);
1298                 }
1299                 if (i != -1) {
1300                         printk(KERN_ERR PFX "Error: core_disable() BUSY timeout!\n");
1301                         return -EBUSY;
1302                 }
1303
1304                 sbtmstatelow = BCM43xx_SBTMSTATELOW_FORCE_GATE_CLOCK |
1305                                BCM43xx_SBTMSTATELOW_REJECT |
1306                                BCM43xx_SBTMSTATELOW_RESET |
1307                                BCM43xx_SBTMSTATELOW_CLOCK |
1308                                core_flags;
1309                 bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1310                 udelay(10);
1311         }
1312
1313         sbtmstatelow = BCM43xx_SBTMSTATELOW_RESET |
1314                        BCM43xx_SBTMSTATELOW_REJECT |
1315                        core_flags;
1316         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1317
1318 out:
1319         bcm->current_core->enabled = 0;
1320
1321         return 0;
1322 }
1323
1324 /* enable (reset) current core */
1325 static int bcm43xx_core_enable(struct bcm43xx_private *bcm, u32 core_flags)
1326 {
1327         u32 sbtmstatelow;
1328         u32 sbtmstatehigh;
1329         u32 sbimstate;
1330         int err;
1331
1332         err = bcm43xx_core_disable(bcm, core_flags);
1333         if (err)
1334                 goto out;
1335
1336         sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK |
1337                        BCM43xx_SBTMSTATELOW_RESET |
1338                        BCM43xx_SBTMSTATELOW_FORCE_GATE_CLOCK |
1339                        core_flags;
1340         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1341         udelay(1);
1342
1343         sbtmstatehigh = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH);
1344         if (sbtmstatehigh & BCM43xx_SBTMSTATEHIGH_SERROR) {
1345                 sbtmstatehigh = 0x00000000;
1346                 bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATEHIGH, sbtmstatehigh);
1347         }
1348
1349         sbimstate = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMSTATE);
1350         if (sbimstate & (BCM43xx_SBIMSTATE_IB_ERROR | BCM43xx_SBIMSTATE_TIMEOUT)) {
1351                 sbimstate &= ~(BCM43xx_SBIMSTATE_IB_ERROR | BCM43xx_SBIMSTATE_TIMEOUT);
1352                 bcm43xx_write32(bcm, BCM43xx_CIR_SBIMSTATE, sbimstate);
1353         }
1354
1355         sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK |
1356                        BCM43xx_SBTMSTATELOW_FORCE_GATE_CLOCK |
1357                        core_flags;
1358         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1359         udelay(1);
1360
1361         sbtmstatelow = BCM43xx_SBTMSTATELOW_CLOCK | core_flags;
1362         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1363         udelay(1);
1364
1365         bcm->current_core->enabled = 1;
1366         assert(err == 0);
1367 out:
1368         return err;
1369 }
1370
1371 /* http://bcm-specs.sipsolutions.net/80211CoreReset */
1372 void bcm43xx_wireless_core_reset(struct bcm43xx_private *bcm, int connect_phy)
1373 {
1374         u32 flags = 0x00040000;
1375
1376         if ((bcm43xx_core_enabled(bcm)) &&
1377             !bcm43xx_using_pio(bcm)) {
1378 //FIXME: Do we _really_ want #ifndef CONFIG_BCM947XX here?
1379 #if 0
1380 #ifndef CONFIG_BCM947XX
1381                 /* reset all used DMA controllers. */
1382                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA1_BASE);
1383                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA2_BASE);
1384                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA3_BASE);
1385                 bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA4_BASE);
1386                 bcm43xx_dmacontroller_rx_reset(bcm, BCM43xx_MMIO_DMA1_BASE);
1387                 if (bcm->current_core->rev < 5)
1388                         bcm43xx_dmacontroller_rx_reset(bcm, BCM43xx_MMIO_DMA4_BASE);
1389 #endif
1390 #endif
1391         }
1392         if (bcm43xx_status(bcm) == BCM43xx_STAT_SHUTTINGDOWN) {
1393                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
1394                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
1395                                 & ~(BCM43xx_SBF_MAC_ENABLED | 0x00000002));
1396         } else {
1397                 if (connect_phy)
1398                         flags |= 0x20000000;
1399                 bcm43xx_phy_connect(bcm, connect_phy);
1400                 bcm43xx_core_enable(bcm, flags);
1401                 bcm43xx_write16(bcm, 0x03E6, 0x0000);
1402                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
1403                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
1404                                 | BCM43xx_SBF_400);
1405         }
1406 }
1407
1408 static void bcm43xx_wireless_core_disable(struct bcm43xx_private *bcm)
1409 {
1410         bcm43xx_radio_turn_off(bcm);
1411         bcm43xx_write16(bcm, 0x03E6, 0x00F4);
1412         bcm43xx_core_disable(bcm, 0);
1413 }
1414
1415 /* Mark the current 80211 core inactive. */
1416 static void bcm43xx_wireless_core_mark_inactive(struct bcm43xx_private *bcm)
1417 {
1418         u32 sbtmstatelow;
1419
1420         bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
1421         bcm43xx_radio_turn_off(bcm);
1422         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1423         sbtmstatelow &= 0xDFF5FFFF;
1424         sbtmstatelow |= 0x000A0000;
1425         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1426         udelay(1);
1427         sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
1428         sbtmstatelow &= 0xFFF5FFFF;
1429         sbtmstatelow |= 0x00080000;
1430         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
1431         udelay(1);
1432 }
1433
1434 static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
1435 {
1436         u32 v0, v1;
1437         u16 tmp;
1438         struct bcm43xx_xmitstatus stat;
1439
1440         while (1) {
1441                 v0 = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
1442                 if (!v0)
1443                         break;
1444                 v1 = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
1445
1446                 stat.cookie = (v0 >> 16) & 0x0000FFFF;
1447                 tmp = (u16)((v0 & 0xFFF0) | ((v0 & 0xF) >> 1));
1448                 stat.flags = tmp & 0xFF;
1449                 stat.cnt1 = (tmp & 0x0F00) >> 8;
1450                 stat.cnt2 = (tmp & 0xF000) >> 12;
1451                 stat.seq = (u16)(v1 & 0xFFFF);
1452                 stat.unknown = (u16)((v1 >> 16) & 0xFF);
1453
1454                 bcm43xx_debugfs_log_txstat(bcm, &stat);
1455
1456                 if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE)
1457                         continue;
1458                 if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) {
1459                         //TODO: packet was not acked (was lost)
1460                 }
1461                 //TODO: There are more (unknown) flags to test. see bcm43xx_main.h
1462
1463                 if (bcm43xx_using_pio(bcm))
1464                         bcm43xx_pio_handle_xmitstatus(bcm, &stat);
1465                 else
1466                         bcm43xx_dma_handle_xmitstatus(bcm, &stat);
1467         }
1468 }
1469
1470 static void drain_txstatus_queue(struct bcm43xx_private *bcm)
1471 {
1472         u32 dummy;
1473
1474         if (bcm->current_core->rev < 5)
1475                 return;
1476         /* Read all entries from the microcode TXstatus FIFO
1477          * and throw them away.
1478          */
1479         while (1) {
1480                 dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
1481                 if (!dummy)
1482                         break;
1483                 dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
1484         }
1485 }
1486
1487 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
1488 {
1489         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
1490         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x40A, 0x7F7F);
1491         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD,
1492                         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD) | (1 << 4));
1493         assert(bcm->noisecalc.core_at_start == bcm->current_core);
1494         assert(bcm->noisecalc.channel_at_start == bcm43xx_current_radio(bcm)->channel);
1495 }
1496
1497 static void bcm43xx_calculate_link_quality(struct bcm43xx_private *bcm)
1498 {
1499         /* Top half of Link Quality calculation. */
1500
1501         if (bcm->noisecalc.calculation_running)
1502                 return;
1503         bcm->noisecalc.core_at_start = bcm->current_core;
1504         bcm->noisecalc.channel_at_start = bcm43xx_current_radio(bcm)->channel;
1505         bcm->noisecalc.calculation_running = 1;
1506         bcm->noisecalc.nr_samples = 0;
1507
1508         bcm43xx_generate_noise_sample(bcm);
1509 }
1510
1511 static void handle_irq_noise(struct bcm43xx_private *bcm)
1512 {
1513         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
1514         u16 tmp;
1515         u8 noise[4];
1516         u8 i, j;
1517         s32 average;
1518
1519         /* Bottom half of Link Quality calculation. */
1520
1521         assert(bcm->noisecalc.calculation_running);
1522         if (bcm->noisecalc.core_at_start != bcm->current_core ||
1523             bcm->noisecalc.channel_at_start != radio->channel)
1524                 goto drop_calculation;
1525         tmp = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, 0x408);
1526         noise[0] = (tmp & 0x00FF);
1527         noise[1] = (tmp & 0xFF00) >> 8;
1528         tmp = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, 0x40A);
1529         noise[2] = (tmp & 0x00FF);
1530         noise[3] = (tmp & 0xFF00) >> 8;
1531         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1532             noise[2] == 0x7F || noise[3] == 0x7F)
1533                 goto generate_new;
1534
1535         /* Get the noise samples. */
1536         assert(bcm->noisecalc.nr_samples < 8);
1537         i = bcm->noisecalc.nr_samples;
1538         noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1539         noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1540         noise[2] = limit_value(noise[2], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1541         noise[3] = limit_value(noise[3], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
1542         bcm->noisecalc.samples[i][0] = radio->nrssi_lt[noise[0]];
1543         bcm->noisecalc.samples[i][1] = radio->nrssi_lt[noise[1]];
1544         bcm->noisecalc.samples[i][2] = radio->nrssi_lt[noise[2]];
1545         bcm->noisecalc.samples[i][3] = radio->nrssi_lt[noise[3]];
1546         bcm->noisecalc.nr_samples++;
1547         if (bcm->noisecalc.nr_samples == 8) {
1548                 /* Calculate the Link Quality by the noise samples. */
1549                 average = 0;
1550                 for (i = 0; i < 8; i++) {
1551                         for (j = 0; j < 4; j++)
1552                                 average += bcm->noisecalc.samples[i][j];
1553                 }
1554                 average /= (8 * 4);
1555                 average *= 125;
1556                 average += 64;
1557                 average /= 128;
1558
1559                 tmp = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, 0x40C);
1560                 tmp = (tmp / 128) & 0x1F;
1561                 if (tmp >= 8)
1562                         average += 2;
1563                 else
1564                         average -= 25;
1565                 if (tmp == 8)
1566                         average -= 72;
1567                 else
1568                         average -= 48;
1569
1570                 bcm->stats.noise = average;
1571 drop_calculation:
1572                 bcm->noisecalc.calculation_running = 0;
1573                 return;
1574         }
1575 generate_new:
1576         bcm43xx_generate_noise_sample(bcm);
1577 }
1578
1579 static void handle_irq_ps(struct bcm43xx_private *bcm)
1580 {
1581         if (bcm->ieee->iw_mode == IW_MODE_MASTER) {
1582                 ///TODO: PS TBTT
1583         } else {
1584                 if (1/*FIXME: the last PSpoll frame was sent successfully */)
1585                         bcm43xx_power_saving_ctl_bits(bcm, -1, -1);
1586         }
1587         if (bcm->ieee->iw_mode == IW_MODE_ADHOC)
1588                 bcm->reg124_set_0x4 = 1;
1589         //FIXME else set to false?
1590 }
1591
1592 static void handle_irq_reg124(struct bcm43xx_private *bcm)
1593 {
1594         if (!bcm->reg124_set_0x4)
1595                 return;
1596         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD,
1597                         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD)
1598                         | 0x4);
1599         //FIXME: reset reg124_set_0x4 to false?
1600 }
1601
1602 static void handle_irq_pmq(struct bcm43xx_private *bcm)
1603 {
1604         u32 tmp;
1605
1606         //TODO: AP mode.
1607
1608         while (1) {
1609                 tmp = bcm43xx_read32(bcm, BCM43xx_MMIO_PS_STATUS);
1610                 if (!(tmp & 0x00000008))
1611                         break;
1612         }
1613         /* 16bit write is odd, but correct. */
1614         bcm43xx_write16(bcm, BCM43xx_MMIO_PS_STATUS, 0x0002);
1615 }
1616
1617 static void bcm43xx_generate_beacon_template(struct bcm43xx_private *bcm,
1618                                              u16 ram_offset, u16 shm_size_offset)
1619 {
1620         u32 value;
1621         u16 size = 0;
1622
1623         /* Timestamp. */
1624         //FIXME: assumption: The chip sets the timestamp
1625         value = 0;
1626         bcm43xx_ram_write(bcm, ram_offset++, value);
1627         bcm43xx_ram_write(bcm, ram_offset++, value);
1628         size += 8;
1629
1630         /* Beacon Interval / Capability Information */
1631         value = 0x0000;//FIXME: Which interval?
1632         value |= (1 << 0) << 16; /* ESS */
1633         value |= (1 << 2) << 16; /* CF Pollable */      //FIXME?
1634         value |= (1 << 3) << 16; /* CF Poll Request */  //FIXME?
1635         if (!bcm->ieee->open_wep)
1636                 value |= (1 << 4) << 16; /* Privacy */
1637         bcm43xx_ram_write(bcm, ram_offset++, value);
1638         size += 4;
1639
1640         /* SSID */
1641         //TODO
1642
1643         /* FH Parameter Set */
1644         //TODO
1645
1646         /* DS Parameter Set */
1647         //TODO
1648
1649         /* CF Parameter Set */
1650         //TODO
1651
1652         /* TIM */
1653         //TODO
1654
1655         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, shm_size_offset, size);
1656 }
1657
1658 static void handle_irq_beacon(struct bcm43xx_private *bcm)
1659 {
1660         u32 status;
1661
1662         bcm->irq_savedstate &= ~BCM43xx_IRQ_BEACON;
1663         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD);
1664
1665         if ((status & 0x1) && (status & 0x2)) {
1666                 /* ACK beacon IRQ. */
1667                 bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON,
1668                                 BCM43xx_IRQ_BEACON);
1669                 bcm->irq_savedstate |= BCM43xx_IRQ_BEACON;
1670                 return;
1671         }
1672         if (!(status & 0x1)) {
1673                 bcm43xx_generate_beacon_template(bcm, 0x68, 0x18);
1674                 status |= 0x1;
1675                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD, status);
1676         }
1677         if (!(status & 0x2)) {
1678                 bcm43xx_generate_beacon_template(bcm, 0x468, 0x1A);
1679                 status |= 0x2;
1680                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD, status);
1681         }
1682 }
1683
1684 /* Interrupt handler bottom-half */
1685 static void bcm43xx_interrupt_tasklet(struct bcm43xx_private *bcm)
1686 {
1687         u32 reason;
1688         u32 dma_reason[6];
1689         u32 merged_dma_reason = 0;
1690         int i, activity = 0;
1691         unsigned long flags;
1692
1693 #ifdef CONFIG_BCM43XX_DEBUG
1694         u32 _handled = 0x00000000;
1695 # define bcmirq_handled(irq)    do { _handled |= (irq); } while (0)
1696 #else
1697 # define bcmirq_handled(irq)    do { /* nothing */ } while (0)
1698 #endif /* CONFIG_BCM43XX_DEBUG*/
1699
1700         spin_lock_irqsave(&bcm->irq_lock, flags);
1701         reason = bcm->irq_reason;
1702         for (i = 5; i >= 0; i--) {
1703                 dma_reason[i] = bcm->dma_reason[i];
1704                 merged_dma_reason |= dma_reason[i];
1705         }
1706
1707         if (unlikely(reason & BCM43xx_IRQ_XMIT_ERROR)) {
1708                 /* TX error. We get this when Template Ram is written in wrong endianess
1709                  * in dummy_tx(). We also get this if something is wrong with the TX header
1710                  * on DMA or PIO queues.
1711                  * Maybe we get this in other error conditions, too.
1712                  */
1713                 printkl(KERN_ERR PFX "FATAL ERROR: BCM43xx_IRQ_XMIT_ERROR\n");
1714                 bcmirq_handled(BCM43xx_IRQ_XMIT_ERROR);
1715         }
1716         if (unlikely(merged_dma_reason & BCM43xx_DMAIRQ_FATALMASK)) {
1717                 printkl(KERN_ERR PFX "FATAL ERROR: Fatal DMA error: "
1718                                      "0x%08X, 0x%08X, 0x%08X, "
1719                                      "0x%08X, 0x%08X, 0x%08X\n",
1720                         dma_reason[0], dma_reason[1],
1721                         dma_reason[2], dma_reason[3],
1722                         dma_reason[4], dma_reason[5]);
1723                 bcm43xx_controller_restart(bcm, "DMA error");
1724                 mmiowb();
1725                 spin_unlock_irqrestore(&bcm->irq_lock, flags);
1726                 return;
1727         }
1728         if (unlikely(merged_dma_reason & BCM43xx_DMAIRQ_NONFATALMASK)) {
1729                 printkl(KERN_ERR PFX "DMA error: "
1730                                      "0x%08X, 0x%08X, 0x%08X, "
1731                                      "0x%08X, 0x%08X, 0x%08X\n",
1732                         dma_reason[0], dma_reason[1],
1733                         dma_reason[2], dma_reason[3],
1734                         dma_reason[4], dma_reason[5]);
1735         }
1736
1737         if (reason & BCM43xx_IRQ_PS) {
1738                 handle_irq_ps(bcm);
1739                 bcmirq_handled(BCM43xx_IRQ_PS);
1740         }
1741
1742         if (reason & BCM43xx_IRQ_REG124) {
1743                 handle_irq_reg124(bcm);
1744                 bcmirq_handled(BCM43xx_IRQ_REG124);
1745         }
1746
1747         if (reason & BCM43xx_IRQ_BEACON) {
1748                 if (bcm->ieee->iw_mode == IW_MODE_MASTER)
1749                         handle_irq_beacon(bcm);
1750                 bcmirq_handled(BCM43xx_IRQ_BEACON);
1751         }
1752
1753         if (reason & BCM43xx_IRQ_PMQ) {
1754                 handle_irq_pmq(bcm);
1755                 bcmirq_handled(BCM43xx_IRQ_PMQ);
1756         }
1757
1758         if (reason & BCM43xx_IRQ_SCAN) {
1759                 /*TODO*/
1760                 //bcmirq_handled(BCM43xx_IRQ_SCAN);
1761         }
1762
1763         if (reason & BCM43xx_IRQ_NOISE) {
1764                 handle_irq_noise(bcm);
1765                 bcmirq_handled(BCM43xx_IRQ_NOISE);
1766         }
1767
1768         /* Check the DMA reason registers for received data. */
1769         if (dma_reason[0] & BCM43xx_DMAIRQ_RX_DONE) {
1770                 if (bcm43xx_using_pio(bcm))
1771                         bcm43xx_pio_rx(bcm43xx_current_pio(bcm)->queue0);
1772                 else
1773                         bcm43xx_dma_rx(bcm43xx_current_dma(bcm)->rx_ring0);
1774                 /* We intentionally don't set "activity" to 1, here. */
1775         }
1776         assert(!(dma_reason[1] & BCM43xx_DMAIRQ_RX_DONE));
1777         assert(!(dma_reason[2] & BCM43xx_DMAIRQ_RX_DONE));
1778         if (dma_reason[3] & BCM43xx_DMAIRQ_RX_DONE) {
1779                 if (bcm43xx_using_pio(bcm))
1780                         bcm43xx_pio_rx(bcm43xx_current_pio(bcm)->queue3);
1781                 else
1782                         bcm43xx_dma_rx(bcm43xx_current_dma(bcm)->rx_ring3);
1783                 activity = 1;
1784         }
1785         assert(!(dma_reason[4] & BCM43xx_DMAIRQ_RX_DONE));
1786         assert(!(dma_reason[5] & BCM43xx_DMAIRQ_RX_DONE));
1787         bcmirq_handled(BCM43xx_IRQ_RX);
1788
1789         if (reason & BCM43xx_IRQ_XMIT_STATUS) {
1790                 handle_irq_transmit_status(bcm);
1791                 activity = 1;
1792                 //TODO: In AP mode, this also causes sending of powersave responses.
1793                 bcmirq_handled(BCM43xx_IRQ_XMIT_STATUS);
1794         }
1795
1796         /* IRQ_PIO_WORKAROUND is handled in the top-half. */
1797         bcmirq_handled(BCM43xx_IRQ_PIO_WORKAROUND);
1798 #ifdef CONFIG_BCM43XX_DEBUG
1799         if (unlikely(reason & ~_handled)) {
1800                 printkl(KERN_WARNING PFX
1801                         "Unhandled IRQ! Reason: 0x%08x,  Unhandled: 0x%08x,  "
1802                         "DMA: 0x%08x, 0x%08x, 0x%08x, 0x%08x\n",
1803                         reason, (reason & ~_handled),
1804                         dma_reason[0], dma_reason[1],
1805                         dma_reason[2], dma_reason[3]);
1806         }
1807 #endif
1808 #undef bcmirq_handled
1809
1810         if (!modparam_noleds)
1811                 bcm43xx_leds_update(bcm, activity);
1812         bcm43xx_interrupt_enable(bcm, bcm->irq_savedstate);
1813         mmiowb();
1814         spin_unlock_irqrestore(&bcm->irq_lock, flags);
1815 }
1816
1817 static void pio_irq_workaround(struct bcm43xx_private *bcm,
1818                                u16 base, int queueidx)
1819 {
1820         u16 rxctl;
1821
1822         rxctl = bcm43xx_read16(bcm, base + BCM43xx_PIO_RXCTL);
1823         if (rxctl & BCM43xx_PIO_RXCTL_DATAAVAILABLE)
1824                 bcm->dma_reason[queueidx] |= BCM43xx_DMAIRQ_RX_DONE;
1825         else
1826                 bcm->dma_reason[queueidx] &= ~BCM43xx_DMAIRQ_RX_DONE;
1827 }
1828
1829 static void bcm43xx_interrupt_ack(struct bcm43xx_private *bcm, u32 reason)
1830 {
1831         if (bcm43xx_using_pio(bcm) &&
1832             (bcm->current_core->rev < 3) &&
1833             (!(reason & BCM43xx_IRQ_PIO_WORKAROUND))) {
1834                 /* Apply a PIO specific workaround to the dma_reasons */
1835                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO1_BASE, 0);
1836                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO2_BASE, 1);
1837                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO3_BASE, 2);
1838                 pio_irq_workaround(bcm, BCM43xx_MMIO_PIO4_BASE, 3);
1839         }
1840
1841         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, reason);
1842
1843         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA0_REASON,
1844                         bcm->dma_reason[0]);
1845         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_REASON,
1846                         bcm->dma_reason[1]);
1847         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA2_REASON,
1848                         bcm->dma_reason[2]);
1849         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_REASON,
1850                         bcm->dma_reason[3]);
1851         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_REASON,
1852                         bcm->dma_reason[4]);
1853         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA5_REASON,
1854                         bcm->dma_reason[5]);
1855 }
1856
1857 /* Interrupt handler top-half */
1858 static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id)
1859 {
1860         irqreturn_t ret = IRQ_HANDLED;
1861         struct bcm43xx_private *bcm = dev_id;
1862         u32 reason;
1863
1864         if (!bcm)
1865                 return IRQ_NONE;
1866
1867         spin_lock(&bcm->irq_lock);
1868
1869         assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
1870         assert(bcm->current_core->id == BCM43xx_COREID_80211);
1871
1872         reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
1873         if (reason == 0xffffffff) {
1874                 /* irq not for us (shared irq) */
1875                 ret = IRQ_NONE;
1876                 goto out;
1877         }
1878         reason &= bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
1879         if (!reason)
1880                 goto out;
1881
1882         bcm->dma_reason[0] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA0_REASON)
1883                              & 0x0001DC00;
1884         bcm->dma_reason[1] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_REASON)
1885                              & 0x0000DC00;
1886         bcm->dma_reason[2] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA2_REASON)
1887                              & 0x0000DC00;
1888         bcm->dma_reason[3] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA3_REASON)
1889                              & 0x0001DC00;
1890         bcm->dma_reason[4] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA4_REASON)
1891                              & 0x0000DC00;
1892         bcm->dma_reason[5] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA5_REASON)
1893                              & 0x0000DC00;
1894
1895         bcm43xx_interrupt_ack(bcm, reason);
1896
1897         /* disable all IRQs. They are enabled again in the bottom half. */
1898         bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
1899         /* save the reason code and call our bottom half. */
1900         bcm->irq_reason = reason;
1901         tasklet_schedule(&bcm->isr_tasklet);
1902
1903 out:
1904         mmiowb();
1905         spin_unlock(&bcm->irq_lock);
1906
1907         return ret;
1908 }
1909
1910 static void bcm43xx_release_firmware(struct bcm43xx_private *bcm, int force)
1911 {
1912         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
1913
1914         if (bcm->firmware_norelease && !force)
1915                 return; /* Suspending or controller reset. */
1916         release_firmware(phy->ucode);
1917         phy->ucode = NULL;
1918         release_firmware(phy->pcm);
1919         phy->pcm = NULL;
1920         release_firmware(phy->initvals0);
1921         phy->initvals0 = NULL;
1922         release_firmware(phy->initvals1);
1923         phy->initvals1 = NULL;
1924 }
1925
1926 static int bcm43xx_request_firmware(struct bcm43xx_private *bcm)
1927 {
1928         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
1929         u8 rev = bcm->current_core->rev;
1930         int err = 0;
1931         int nr;
1932         char buf[22 + sizeof(modparam_fwpostfix) - 1] = { 0 };
1933
1934         if (!phy->ucode) {
1935                 snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_microcode%d%s.fw",
1936                          (rev >= 5 ? 5 : rev),
1937                          modparam_fwpostfix);
1938                 err = request_firmware(&phy->ucode, buf, &bcm->pci_dev->dev);
1939                 if (err) {
1940                         printk(KERN_ERR PFX 
1941                                "Error: Microcode \"%s\" not available or load failed.\n",
1942                                 buf);
1943                         goto error;
1944                 }
1945         }
1946
1947         if (!phy->pcm) {
1948                 snprintf(buf, ARRAY_SIZE(buf),
1949                          "bcm43xx_pcm%d%s.fw",
1950                          (rev < 5 ? 4 : 5),
1951                          modparam_fwpostfix);
1952                 err = request_firmware(&phy->pcm, buf, &bcm->pci_dev->dev);
1953                 if (err) {
1954                         printk(KERN_ERR PFX
1955                                "Error: PCM \"%s\" not available or load failed.\n",
1956                                buf);
1957                         goto error;
1958                 }
1959         }
1960
1961         if (!phy->initvals0) {
1962                 if (rev == 2 || rev == 4) {
1963                         switch (phy->type) {
1964                         case BCM43xx_PHYTYPE_A:
1965                                 nr = 3;
1966                                 break;
1967                         case BCM43xx_PHYTYPE_B:
1968                         case BCM43xx_PHYTYPE_G:
1969                                 nr = 1;
1970                                 break;
1971                         default:
1972                                 goto err_noinitval;
1973                         }
1974                 
1975                 } else if (rev >= 5) {
1976                         switch (phy->type) {
1977                         case BCM43xx_PHYTYPE_A:
1978                                 nr = 7;
1979                                 break;
1980                         case BCM43xx_PHYTYPE_B:
1981                         case BCM43xx_PHYTYPE_G:
1982                                 nr = 5;
1983                                 break;
1984                         default:
1985                                 goto err_noinitval;
1986                         }
1987                 } else
1988                         goto err_noinitval;
1989                 snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_initval%02d%s.fw",
1990                          nr, modparam_fwpostfix);
1991
1992                 err = request_firmware(&phy->initvals0, buf, &bcm->pci_dev->dev);
1993                 if (err) {
1994                         printk(KERN_ERR PFX 
1995                                "Error: InitVals \"%s\" not available or load failed.\n",
1996                                 buf);
1997                         goto error;
1998                 }
1999                 if (phy->initvals0->size % sizeof(struct bcm43xx_initval)) {
2000                         printk(KERN_ERR PFX "InitVals fileformat error.\n");
2001                         goto error;
2002                 }
2003         }
2004
2005         if (!phy->initvals1) {
2006                 if (rev >= 5) {
2007                         u32 sbtmstatehigh;
2008
2009                         switch (phy->type) {
2010                         case BCM43xx_PHYTYPE_A:
2011                                 sbtmstatehigh = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH);
2012                                 if (sbtmstatehigh & 0x00010000)
2013                                         nr = 9;
2014                                 else
2015                                         nr = 10;
2016                                 break;
2017                         case BCM43xx_PHYTYPE_B:
2018                         case BCM43xx_PHYTYPE_G:
2019                                         nr = 6;
2020                                 break;
2021                         default:
2022                                 goto err_noinitval;
2023                         }
2024                         snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_initval%02d%s.fw",
2025                                  nr, modparam_fwpostfix);
2026
2027                         err = request_firmware(&phy->initvals1, buf, &bcm->pci_dev->dev);
2028                         if (err) {
2029                                 printk(KERN_ERR PFX 
2030                                        "Error: InitVals \"%s\" not available or load failed.\n",
2031                                         buf);
2032                                 goto error;
2033                         }
2034                         if (phy->initvals1->size % sizeof(struct bcm43xx_initval)) {
2035                                 printk(KERN_ERR PFX "InitVals fileformat error.\n");
2036                                 goto error;
2037                         }
2038                 }
2039         }
2040
2041 out:
2042         return err;
2043 error:
2044         bcm43xx_release_firmware(bcm, 1);
2045         goto out;
2046 err_noinitval:
2047         printk(KERN_ERR PFX "Error: No InitVals available!\n");
2048         err = -ENOENT;
2049         goto error;
2050 }
2051
2052 static void bcm43xx_upload_microcode(struct bcm43xx_private *bcm)
2053 {
2054         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2055         const u32 *data;
2056         unsigned int i, len;
2057
2058         /* Upload Microcode. */
2059         data = (u32 *)(phy->ucode->data);
2060         len = phy->ucode->size / sizeof(u32);
2061         bcm43xx_shm_control_word(bcm, BCM43xx_SHM_UCODE, 0x0000);
2062         for (i = 0; i < len; i++) {
2063                 bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA,
2064                                 be32_to_cpu(data[i]));
2065                 udelay(10);
2066         }
2067
2068         /* Upload PCM data. */
2069         data = (u32 *)(phy->pcm->data);
2070         len = phy->pcm->size / sizeof(u32);
2071         bcm43xx_shm_control_word(bcm, BCM43xx_SHM_PCM, 0x01ea);
2072         bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA, 0x00004000);
2073         bcm43xx_shm_control_word(bcm, BCM43xx_SHM_PCM, 0x01eb);
2074         for (i = 0; i < len; i++) {
2075                 bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA,
2076                                 be32_to_cpu(data[i]));
2077                 udelay(10);
2078         }
2079 }
2080
2081 static int bcm43xx_write_initvals(struct bcm43xx_private *bcm,
2082                                   const struct bcm43xx_initval *data,
2083                                   const unsigned int len)
2084 {
2085         u16 offset, size;
2086         u32 value;
2087         unsigned int i;
2088
2089         for (i = 0; i < len; i++) {
2090                 offset = be16_to_cpu(data[i].offset);
2091                 size = be16_to_cpu(data[i].size);
2092                 value = be32_to_cpu(data[i].value);
2093
2094                 if (unlikely(offset >= 0x1000))
2095                         goto err_format;
2096                 if (size == 2) {
2097                         if (unlikely(value & 0xFFFF0000))
2098                                 goto err_format;
2099                         bcm43xx_write16(bcm, offset, (u16)value);
2100                 } else if (size == 4) {
2101                         bcm43xx_write32(bcm, offset, value);
2102                 } else
2103                         goto err_format;
2104         }
2105
2106         return 0;
2107
2108 err_format:
2109         printk(KERN_ERR PFX "InitVals (bcm43xx_initvalXX.fw) file-format error. "
2110                             "Please fix your bcm43xx firmware files.\n");
2111         return -EPROTO;
2112 }
2113
2114 static int bcm43xx_upload_initvals(struct bcm43xx_private *bcm)
2115 {
2116         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2117         int err;
2118
2119         err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)phy->initvals0->data,
2120                                      phy->initvals0->size / sizeof(struct bcm43xx_initval));
2121         if (err)
2122                 goto out;
2123         if (phy->initvals1) {
2124                 err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)phy->initvals1->data,
2125                                              phy->initvals1->size / sizeof(struct bcm43xx_initval));
2126                 if (err)
2127                         goto out;
2128         }
2129 out:
2130         return err;
2131 }
2132
2133 #ifdef CONFIG_BCM947XX
2134 static struct pci_device_id bcm43xx_47xx_ids[] = {
2135         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4324) },
2136         { 0 }
2137 };
2138 #endif
2139
2140 static int bcm43xx_initialize_irq(struct bcm43xx_private *bcm)
2141 {
2142         int err;
2143
2144         bcm->irq = bcm->pci_dev->irq;
2145 #ifdef CONFIG_BCM947XX
2146         if (bcm->pci_dev->bus->number == 0) {
2147                 struct pci_dev *d;
2148                 struct pci_device_id *id;
2149                 for (id = bcm43xx_47xx_ids; id->vendor; id++) {
2150                         d = pci_get_device(id->vendor, id->device, NULL);
2151                         if (d != NULL) {
2152                                 bcm->irq = d->irq;
2153                                 pci_dev_put(d);
2154                                 break;
2155                         }
2156                 }
2157         }
2158 #endif
2159         err = request_irq(bcm->irq, bcm43xx_interrupt_handler,
2160                           IRQF_SHARED, KBUILD_MODNAME, bcm);
2161         if (err)
2162                 printk(KERN_ERR PFX "Cannot register IRQ%d\n", bcm->irq);
2163
2164         return err;
2165 }
2166
2167 /* Switch to the core used to write the GPIO register.
2168  * This is either the ChipCommon, or the PCI core.
2169  */
2170 static int switch_to_gpio_core(struct bcm43xx_private *bcm)
2171 {
2172         int err;
2173
2174         /* Where to find the GPIO register depends on the chipset.
2175          * If it has a ChipCommon, its register at offset 0x6c is the GPIO
2176          * control register. Otherwise the register at offset 0x6c in the
2177          * PCI core is the GPIO control register.
2178          */
2179         err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
2180         if (err == -ENODEV) {
2181                 err = bcm43xx_switch_core(bcm, &bcm->core_pci);
2182                 if (unlikely(err == -ENODEV)) {
2183                         printk(KERN_ERR PFX "gpio error: "
2184                                "Neither ChipCommon nor PCI core available!\n");
2185                 }
2186         }
2187
2188         return err;
2189 }
2190
2191 /* Initialize the GPIOs
2192  * http://bcm-specs.sipsolutions.net/GPIO
2193  */
2194 static int bcm43xx_gpio_init(struct bcm43xx_private *bcm)
2195 {
2196         struct bcm43xx_coreinfo *old_core;
2197         int err;
2198         u32 mask, set;
2199
2200         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2201                         bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
2202                         & 0xFFFF3FFF);
2203
2204         bcm43xx_leds_switch_all(bcm, 0);
2205         bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
2206                         bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK) | 0x000F);
2207
2208         mask = 0x0000001F;
2209         set = 0x0000000F;
2210         if (bcm->chip_id == 0x4301) {
2211                 mask |= 0x0060;
2212                 set |= 0x0060;
2213         }
2214         if (0 /* FIXME: conditional unknown */) {
2215                 bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
2216                                 bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK)
2217                                 | 0x0100);
2218                 mask |= 0x0180;
2219                 set |= 0x0180;
2220         }
2221         if (bcm->sprom.boardflags & BCM43xx_BFL_PACTRL) {
2222                 bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
2223                                 bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK)
2224                                 | 0x0200);
2225                 mask |= 0x0200;
2226                 set |= 0x0200;
2227         }
2228         if (bcm->current_core->rev >= 2)
2229                 mask  |= 0x0010; /* FIXME: This is redundant. */
2230
2231         old_core = bcm->current_core;
2232         err = switch_to_gpio_core(bcm);
2233         if (err)
2234                 goto out;
2235         bcm43xx_write32(bcm, BCM43xx_GPIO_CONTROL,
2236                         (bcm43xx_read32(bcm, BCM43xx_GPIO_CONTROL) & mask) | set);
2237         err = bcm43xx_switch_core(bcm, old_core);
2238 out:
2239         return err;
2240 }
2241
2242 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2243 static int bcm43xx_gpio_cleanup(struct bcm43xx_private *bcm)
2244 {
2245         struct bcm43xx_coreinfo *old_core;
2246         int err;
2247
2248         old_core = bcm->current_core;
2249         err = switch_to_gpio_core(bcm);
2250         if (err)
2251                 return err;
2252         bcm43xx_write32(bcm, BCM43xx_GPIO_CONTROL, 0x00000000);
2253         err = bcm43xx_switch_core(bcm, old_core);
2254         assert(err == 0);
2255
2256         return 0;
2257 }
2258
2259 /* http://bcm-specs.sipsolutions.net/EnableMac */
2260 void bcm43xx_mac_enable(struct bcm43xx_private *bcm)
2261 {
2262         bcm->mac_suspended--;
2263         assert(bcm->mac_suspended >= 0);
2264         if (bcm->mac_suspended == 0) {
2265                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2266                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
2267                                 | BCM43xx_SBF_MAC_ENABLED);
2268                 bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, BCM43xx_IRQ_READY);
2269                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD); /* dummy read */
2270                 bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
2271                 bcm43xx_power_saving_ctl_bits(bcm, -1, -1);
2272         }
2273 }
2274
2275 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2276 void bcm43xx_mac_suspend(struct bcm43xx_private *bcm)
2277 {
2278         int i;
2279         u32 tmp;
2280
2281         assert(bcm->mac_suspended >= 0);
2282         if (bcm->mac_suspended == 0) {
2283                 bcm43xx_power_saving_ctl_bits(bcm, -1, 1);
2284                 bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2285                                 bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
2286                                 & ~BCM43xx_SBF_MAC_ENABLED);
2287                 bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
2288                 for (i = 10000; i; i--) {
2289                         tmp = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
2290                         if (tmp & BCM43xx_IRQ_READY)
2291                                 goto out;
2292                         udelay(1);
2293                 }
2294                 printkl(KERN_ERR PFX "MAC suspend failed\n");
2295         }
2296 out:
2297         bcm->mac_suspended++;
2298 }
2299
2300 void bcm43xx_set_iwmode(struct bcm43xx_private *bcm,
2301                         int iw_mode)
2302 {
2303         unsigned long flags;
2304         struct net_device *net_dev = bcm->net_dev;
2305         u32 status;
2306         u16 value;
2307
2308         spin_lock_irqsave(&bcm->ieee->lock, flags);
2309         bcm->ieee->iw_mode = iw_mode;
2310         spin_unlock_irqrestore(&bcm->ieee->lock, flags);
2311         if (iw_mode == IW_MODE_MONITOR)
2312                 net_dev->type = ARPHRD_IEEE80211;
2313         else
2314                 net_dev->type = ARPHRD_ETHER;
2315
2316         status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2317         /* Reset status to infrastructured mode */
2318         status &= ~(BCM43xx_SBF_MODE_AP | BCM43xx_SBF_MODE_MONITOR);
2319         status &= ~BCM43xx_SBF_MODE_PROMISC;
2320         status |= BCM43xx_SBF_MODE_NOTADHOC;
2321
2322 /* FIXME: Always enable promisc mode, until we get the MAC filters working correctly. */
2323 status |= BCM43xx_SBF_MODE_PROMISC;
2324
2325         switch (iw_mode) {
2326         case IW_MODE_MONITOR:
2327                 status |= BCM43xx_SBF_MODE_MONITOR;
2328                 status |= BCM43xx_SBF_MODE_PROMISC;
2329                 break;
2330         case IW_MODE_ADHOC:
2331                 status &= ~BCM43xx_SBF_MODE_NOTADHOC;
2332                 break;
2333         case IW_MODE_MASTER:
2334                 status |= BCM43xx_SBF_MODE_AP;
2335                 break;
2336         case IW_MODE_SECOND:
2337         case IW_MODE_REPEAT:
2338                 TODO(); /* TODO */
2339                 break;
2340         case IW_MODE_INFRA:
2341                 /* nothing to be done here... */
2342                 break;
2343         default:
2344                 dprintk(KERN_ERR PFX "Unknown mode in set_iwmode: %d\n", iw_mode);
2345         }
2346         if (net_dev->flags & IFF_PROMISC)
2347                 status |= BCM43xx_SBF_MODE_PROMISC;
2348         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
2349
2350         value = 0x0002;
2351         if (iw_mode != IW_MODE_ADHOC && iw_mode != IW_MODE_MASTER) {
2352                 if (bcm->chip_id == 0x4306 && bcm->chip_rev == 3)
2353                         value = 0x0064;
2354                 else
2355                         value = 0x0032;
2356         }
2357         bcm43xx_write16(bcm, 0x0612, value);
2358 }
2359
2360 /* This is the opposite of bcm43xx_chip_init() */
2361 static void bcm43xx_chip_cleanup(struct bcm43xx_private *bcm)
2362 {
2363         bcm43xx_radio_turn_off(bcm);
2364         if (!modparam_noleds)
2365                 bcm43xx_leds_exit(bcm);
2366         bcm43xx_gpio_cleanup(bcm);
2367         bcm43xx_release_firmware(bcm, 0);
2368 }
2369
2370 /* Initialize the chip
2371  * http://bcm-specs.sipsolutions.net/ChipInit
2372  */
2373 static int bcm43xx_chip_init(struct bcm43xx_private *bcm)
2374 {
2375         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
2376         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2377         int err;
2378         int i, tmp;
2379         u32 value32;
2380         u16 value16;
2381
2382         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
2383                         BCM43xx_SBF_CORE_READY
2384                         | BCM43xx_SBF_400);
2385
2386         err = bcm43xx_request_firmware(bcm);
2387         if (err)
2388                 goto out;
2389         bcm43xx_upload_microcode(bcm);
2390
2391         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, 0xFFFFFFFF);
2392         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, 0x00020402);
2393         i = 0;
2394         while (1) {
2395                 value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
2396                 if (value32 == BCM43xx_IRQ_READY)
2397                         break;
2398                 i++;
2399                 if (i >= BCM43xx_IRQWAIT_MAX_RETRIES) {
2400                         printk(KERN_ERR PFX "IRQ_READY timeout\n");
2401                         err = -ENODEV;
2402                         goto err_release_fw;
2403                 }
2404                 udelay(10);
2405         }
2406         bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
2407
2408         value16 = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2409                                      BCM43xx_UCODE_REVISION);
2410
2411         dprintk(KERN_INFO PFX "Microcode rev 0x%x, pl 0x%x "
2412                 "(20%.2i-%.2i-%.2i  %.2i:%.2i:%.2i)\n", value16,
2413                 bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2414                                    BCM43xx_UCODE_PATCHLEVEL),
2415                 (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2416                                     BCM43xx_UCODE_DATE) >> 12) & 0xf,
2417                 (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2418                                     BCM43xx_UCODE_DATE) >> 8) & 0xf,
2419                 bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2420                                    BCM43xx_UCODE_DATE) & 0xff,
2421                 (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2422                                    BCM43xx_UCODE_TIME) >> 11) & 0x1f,
2423                 (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2424                                    BCM43xx_UCODE_TIME) >> 5) & 0x3f,
2425                 bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
2426                                    BCM43xx_UCODE_TIME) & 0x1f);
2427
2428         if ( value16 > 0x128 ) {
2429                 printk(KERN_ERR PFX
2430                         "Firmware: no support for microcode extracted "
2431                         "from version 4.x binary drivers.\n");
2432                 err = -EOPNOTSUPP;
2433                 goto err_release_fw;
2434         }
2435
2436         err = bcm43xx_gpio_init(bcm);
2437         if (err)
2438                 goto err_release_fw;
2439
2440         err = bcm43xx_upload_initvals(bcm);
2441         if (err)
2442                 goto err_gpio_cleanup;
2443         bcm43xx_radio_turn_on(bcm);
2444         bcm->radio_hw_enable = bcm43xx_is_hw_radio_enabled(bcm);
2445         dprintk(KERN_INFO PFX "Radio %s by hardware\n",
2446                 (bcm->radio_hw_enable == 0) ? "disabled" : "enabled");
2447
2448         bcm43xx_write16(bcm, 0x03E6, 0x0000);
2449         err = bcm43xx_phy_init(bcm);
2450         if (err)
2451                 goto err_radio_off;
2452
2453         /* Select initial Interference Mitigation. */
2454         tmp = radio->interfmode;
2455         radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
2456         bcm43xx_radio_set_interference_mitigation(bcm, tmp);
2457
2458         bcm43xx_phy_set_antenna_diversity(bcm);
2459         bcm43xx_radio_set_txantenna(bcm, BCM43xx_RADIO_TXANTENNA_DEFAULT);
2460         if (phy->type == BCM43xx_PHYTYPE_B) {
2461                 value16 = bcm43xx_read16(bcm, 0x005E);
2462                 value16 |= 0x0004;
2463                 bcm43xx_write16(bcm, 0x005E, value16);
2464         }
2465         bcm43xx_write32(bcm, 0x0100, 0x01000000);
2466         if (bcm->current_core->rev < 5)
2467                 bcm43xx_write32(bcm, 0x010C, 0x01000000);
2468
2469         value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2470         value32 &= ~ BCM43xx_SBF_MODE_NOTADHOC;
2471         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
2472         value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2473         value32 |= BCM43xx_SBF_MODE_NOTADHOC;
2474         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
2475
2476         value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2477         value32 |= 0x100000;
2478         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
2479
2480         if (bcm43xx_using_pio(bcm)) {
2481                 bcm43xx_write32(bcm, 0x0210, 0x00000100);
2482                 bcm43xx_write32(bcm, 0x0230, 0x00000100);
2483                 bcm43xx_write32(bcm, 0x0250, 0x00000100);
2484                 bcm43xx_write32(bcm, 0x0270, 0x00000100);
2485                 bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0034, 0x0000);
2486         }
2487
2488         /* Probe Response Timeout value */
2489         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2490         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0074, 0x0000);
2491
2492         /* Initially set the wireless operation mode. */
2493         bcm43xx_set_iwmode(bcm, bcm->ieee->iw_mode);
2494
2495         if (bcm->current_core->rev < 3) {
2496                 bcm43xx_write16(bcm, 0x060E, 0x0000);
2497                 bcm43xx_write16(bcm, 0x0610, 0x8000);
2498                 bcm43xx_write16(bcm, 0x0604, 0x0000);
2499                 bcm43xx_write16(bcm, 0x0606, 0x0200);
2500         } else {
2501                 bcm43xx_write32(bcm, 0x0188, 0x80000000);
2502                 bcm43xx_write32(bcm, 0x018C, 0x02000000);
2503         }
2504         bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, 0x00004000);
2505         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2506         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2507         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2508         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2509         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2510         bcm43xx_write32(bcm, BCM43xx_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2511
2512         value32 = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
2513         value32 |= 0x00100000;
2514         bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, value32);
2515
2516         bcm43xx_write16(bcm, BCM43xx_MMIO_POWERUP_DELAY, bcm43xx_pctl_powerup_delay(bcm));
2517
2518         assert(err == 0);
2519         dprintk(KERN_INFO PFX "Chip initialized\n");
2520 out:
2521         return err;
2522
2523 err_radio_off:
2524         bcm43xx_radio_turn_off(bcm);
2525 err_gpio_cleanup:
2526         bcm43xx_gpio_cleanup(bcm);
2527 err_release_fw:
2528         bcm43xx_release_firmware(bcm, 1);
2529         goto out;
2530 }
2531         
2532 /* Validate chip access
2533  * http://bcm-specs.sipsolutions.net/ValidateChipAccess */
2534 static int bcm43xx_validate_chip(struct bcm43xx_private *bcm)
2535 {
2536         u32 value;
2537         u32 shm_backup;
2538
2539         shm_backup = bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, 0x0000);
2540         bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED, 0x0000, 0xAA5555AA);
2541         if (bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, 0x0000) != 0xAA5555AA)
2542                 goto error;
2543         bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED, 0x0000, 0x55AAAA55);
2544         if (bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, 0x0000) != 0x55AAAA55)
2545                 goto error;
2546         bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED, 0x0000, shm_backup);
2547
2548         value = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
2549         if ((value | 0x80000000) != 0x80000400)
2550                 goto error;
2551
2552         value = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
2553         if (value != 0x00000000)
2554                 goto error;
2555
2556         return 0;
2557 error:
2558         printk(KERN_ERR PFX "Failed to validate the chipaccess\n");
2559         return -ENODEV;
2560 }
2561
2562 static void bcm43xx_init_struct_phyinfo(struct bcm43xx_phyinfo *phy)
2563 {
2564         /* Initialize a "phyinfo" structure. The structure is already
2565          * zeroed out.
2566          * This is called on insmod time to initialize members.
2567          */
2568         phy->savedpctlreg = 0xFFFF;
2569         spin_lock_init(&phy->lock);
2570 }
2571
2572 static void bcm43xx_init_struct_radioinfo(struct bcm43xx_radioinfo *radio)
2573 {
2574         /* Initialize a "radioinfo" structure. The structure is already
2575          * zeroed out.
2576          * This is called on insmod time to initialize members.
2577          */
2578         radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
2579         radio->channel = 0xFF;
2580         radio->initial_channel = 0xFF;
2581 }
2582
2583 static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
2584 {
2585         int err, i;
2586         int current_core;
2587         u32 core_vendor, core_id, core_rev;
2588         u32 sb_id_hi, chip_id_32 = 0;
2589         u16 pci_device, chip_id_16;
2590         u8 core_count;
2591
2592         memset(&bcm->core_chipcommon, 0, sizeof(struct bcm43xx_coreinfo));
2593         memset(&bcm->core_pci, 0, sizeof(struct bcm43xx_coreinfo));
2594         memset(&bcm->core_80211, 0, sizeof(struct bcm43xx_coreinfo)
2595                                     * BCM43xx_MAX_80211_CORES);
2596         memset(&bcm->core_80211_ext, 0, sizeof(struct bcm43xx_coreinfo_80211)
2597                                         * BCM43xx_MAX_80211_CORES);
2598         bcm->nr_80211_available = 0;
2599         bcm->current_core = NULL;
2600         bcm->active_80211_core = NULL;
2601
2602         /* map core 0 */
2603         err = _switch_core(bcm, 0);
2604         if (err)
2605                 goto out;
2606
2607         /* fetch sb_id_hi from core information registers */
2608         sb_id_hi = bcm43xx_read32(bcm, BCM43xx_CIR_SB_ID_HI);
2609
2610         core_id = (sb_id_hi & 0x8FF0) >> 4;
2611         core_rev = (sb_id_hi & 0x7000) >> 8;
2612         core_rev |= (sb_id_hi & 0xF);
2613         core_vendor = (sb_id_hi & 0xFFFF0000) >> 16;
2614
2615         /* if present, chipcommon is always core 0; read the chipid from it */
2616         if (core_id == BCM43xx_COREID_CHIPCOMMON) {
2617                 chip_id_32 = bcm43xx_read32(bcm, 0);
2618                 chip_id_16 = chip_id_32 & 0xFFFF;
2619                 bcm->core_chipcommon.available = 1;
2620                 bcm->core_chipcommon.id = core_id;
2621                 bcm->core_chipcommon.rev = core_rev;
2622                 bcm->core_chipcommon.index = 0;
2623                 /* While we are at it, also read the capabilities. */
2624                 bcm->chipcommon_capabilities = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_CAPABILITIES);
2625         } else {
2626                 /* without a chipCommon, use a hard coded table. */
2627                 pci_device = bcm->pci_dev->device;
2628                 if (pci_device == 0x4301)
2629                         chip_id_16 = 0x4301;
2630                 else if ((pci_device >= 0x4305) && (pci_device <= 0x4307))
2631                         chip_id_16 = 0x4307;
2632                 else if ((pci_device >= 0x4402) && (pci_device <= 0x4403))
2633                         chip_id_16 = 0x4402;
2634                 else if ((pci_device >= 0x4610) && (pci_device <= 0x4615))
2635                         chip_id_16 = 0x4610;
2636                 else if ((pci_device >= 0x4710) && (pci_device <= 0x4715))
2637                         chip_id_16 = 0x4710;
2638 #ifdef CONFIG_BCM947XX
2639                 else if ((pci_device >= 0x4320) && (pci_device <= 0x4325))
2640                         chip_id_16 = 0x4309;
2641 #endif
2642                 else {
2643                         printk(KERN_ERR PFX "Could not determine Chip ID\n");
2644                         return -ENODEV;
2645                 }
2646         }
2647
2648         /* ChipCommon with Core Rev >=4 encodes number of cores,
2649          * otherwise consult hardcoded table */
2650         if ((core_id == BCM43xx_COREID_CHIPCOMMON) && (core_rev >= 4)) {
2651                 core_count = (chip_id_32 & 0x0F000000) >> 24;
2652         } else {
2653                 switch (chip_id_16) {
2654                         case 0x4610:
2655                         case 0x4704:
2656                         case 0x4710:
2657                                 core_count = 9;
2658                                 break;
2659                         case 0x4310:
2660                                 core_count = 8;
2661                                 break;
2662                         case 0x5365:
2663                                 core_count = 7;
2664                                 break;
2665                         case 0x4306:
2666                                 core_count = 6;
2667                                 break;
2668                         case 0x4301:
2669                         case 0x4307:
2670                                 core_count = 5;
2671                                 break;
2672                         case 0x4402:
2673                                 core_count = 3;
2674                                 break;
2675                         default:
2676                                 /* SOL if we get here */
2677                                 assert(0);
2678                                 core_count = 1;
2679                 }
2680         }
2681
2682         bcm->chip_id = chip_id_16;
2683         bcm->chip_rev = (chip_id_32 & 0x000F0000) >> 16;
2684         bcm->chip_package = (chip_id_32 & 0x00F00000) >> 20;
2685
2686         dprintk(KERN_INFO PFX "Chip ID 0x%x, rev 0x%x\n",
2687                 bcm->chip_id, bcm->chip_rev);
2688         dprintk(KERN_INFO PFX "Number of cores: %d\n", core_count);
2689         if (bcm->core_chipcommon.available) {
2690                 dprintk(KERN_INFO PFX "Core 0: ID 0x%x, rev 0x%x, vendor 0x%x\n",
2691                         core_id, core_rev, core_vendor);
2692                 current_core = 1;
2693         } else
2694                 current_core = 0;
2695         for ( ; current_core < core_count; current_core++) {
2696                 struct bcm43xx_coreinfo *core;
2697                 struct bcm43xx_coreinfo_80211 *ext_80211;
2698
2699                 err = _switch_core(bcm, current_core);
2700                 if (err)
2701                         goto out;
2702                 /* Gather information */
2703                 /* fetch sb_id_hi from core information registers */
2704                 sb_id_hi = bcm43xx_read32(bcm, BCM43xx_CIR_SB_ID_HI);
2705
2706                 /* extract core_id, core_rev, core_vendor */
2707                 core_id = (sb_id_hi & 0x8FF0) >> 4;
2708                 core_rev = ((sb_id_hi & 0xF) | ((sb_id_hi & 0x7000) >> 8));
2709                 core_vendor = (sb_id_hi & 0xFFFF0000) >> 16;
2710
2711                 dprintk(KERN_INFO PFX "Core %d: ID 0x%x, rev 0x%x, vendor 0x%x\n",
2712                         current_core, core_id, core_rev, core_vendor);
2713
2714                 core = NULL;
2715                 switch (core_id) {
2716                 case BCM43xx_COREID_PCI:
2717                 case BCM43xx_COREID_PCIE:
2718                         core = &bcm->core_pci;
2719                         if (core->available) {
2720                                 printk(KERN_WARNING PFX "Multiple PCI cores found.\n");
2721                                 continue;
2722                         }
2723                         break;
2724                 case BCM43xx_COREID_80211:
2725                         for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
2726                                 core = &(bcm->core_80211[i]);
2727                                 ext_80211 = &(bcm->core_80211_ext[i]);
2728                                 if (!core->available)
2729                                         break;
2730                                 core = NULL;
2731                         }
2732                         if (!core) {
2733                                 printk(KERN_WARNING PFX "More than %d cores of type 802.11 found.\n",
2734                                        BCM43xx_MAX_80211_CORES);
2735                                 continue;
2736                         }
2737                         if (i != 0) {
2738                                 /* More than one 80211 core is only supported
2739                                  * by special chips.
2740                                  * There are chips with two 80211 cores, but with
2741                                  * dangling pins on the second core. Be careful
2742                                  * and ignore these cores here.
2743                                  */
2744                                 if (bcm->pci_dev->device != 0x4324) {
2745                                         dprintk(KERN_INFO PFX "Ignoring additional 802.11 core.\n");
2746                                         continue;
2747                                 }
2748                         }
2749                         switch (core_rev) {
2750                         case 2:
2751                         case 4:
2752                         case 5:
2753                         case 6:
2754                         case 7:
2755                         case 9:
2756                         case 10:
2757                                 break;
2758                         default:
2759                                 printk(KERN_WARNING PFX
2760                                        "Unsupported 80211 core revision %u\n",
2761                                        core_rev);
2762                         }
2763                         bcm->nr_80211_available++;
2764                         core->priv = ext_80211;
2765                         bcm43xx_init_struct_phyinfo(&ext_80211->phy);
2766                         bcm43xx_init_struct_radioinfo(&ext_80211->radio);
2767                         break;
2768                 case BCM43xx_COREID_CHIPCOMMON:
2769                         printk(KERN_WARNING PFX "Multiple CHIPCOMMON cores found.\n");
2770                         break;
2771                 }
2772                 if (core) {
2773                         core->available = 1;
2774                         core->id = core_id;
2775                         core->rev = core_rev;
2776                         core->index = current_core;
2777                 }
2778         }
2779
2780         if (!bcm->core_80211[0].available) {
2781                 printk(KERN_ERR PFX "Error: No 80211 core found!\n");
2782                 err = -ENODEV;
2783                 goto out;
2784         }
2785
2786         err = bcm43xx_switch_core(bcm, &bcm->core_80211[0]);
2787
2788         assert(err == 0);
2789 out:
2790         return err;
2791 }
2792
2793 static void bcm43xx_gen_bssid(struct bcm43xx_private *bcm)
2794 {
2795         const u8 *mac = (const u8*)(bcm->net_dev->dev_addr);
2796         u8 *bssid = bcm->ieee->bssid;
2797
2798         switch (bcm->ieee->iw_mode) {
2799         case IW_MODE_ADHOC:
2800                 random_ether_addr(bssid);
2801                 break;
2802         case IW_MODE_MASTER:
2803         case IW_MODE_INFRA:
2804         case IW_MODE_REPEAT:
2805         case IW_MODE_SECOND:
2806         case IW_MODE_MONITOR:
2807                 memcpy(bssid, mac, ETH_ALEN);
2808                 break;
2809         default:
2810                 assert(0);
2811         }
2812 }
2813
2814 static void bcm43xx_rate_memory_write(struct bcm43xx_private *bcm,
2815                                       u16 rate,
2816                                       int is_ofdm)
2817 {
2818         u16 offset;
2819
2820         if (is_ofdm) {
2821                 offset = 0x480;
2822                 offset += (bcm43xx_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2823         }
2824         else {
2825                 offset = 0x4C0;
2826                 offset += (bcm43xx_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2827         }
2828         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, offset + 0x20,
2829                             bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, offset));
2830 }
2831
2832 static void bcm43xx_rate_memory_init(struct bcm43xx_private *bcm)
2833 {
2834         switch (bcm43xx_current_phy(bcm)->type) {
2835         case BCM43xx_PHYTYPE_A:
2836         case BCM43xx_PHYTYPE_G:
2837                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_6MB, 1);
2838                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_12MB, 1);
2839                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_18MB, 1);
2840                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_24MB, 1);
2841                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_36MB, 1);
2842                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_48MB, 1);
2843                 bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_54MB, 1);
2844         case BCM43xx_PHYTYPE_B:
2845                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_1MB, 0);
2846                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_2MB, 0);
2847                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_5MB, 0);
2848                 bcm43xx_rate_memory_write(bcm, IEEE80211_CCK_RATE_11MB, 0);
2849                 break;
2850         default:
2851                 assert(0);
2852         }
2853 }
2854
2855 static void bcm43xx_wireless_core_cleanup(struct bcm43xx_private *bcm)
2856 {
2857         bcm43xx_chip_cleanup(bcm);
2858         bcm43xx_pio_free(bcm);
2859         bcm43xx_dma_free(bcm);
2860
2861         bcm->current_core->initialized = 0;
2862 }
2863
2864 /* http://bcm-specs.sipsolutions.net/80211Init */
2865 static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm,
2866                                       int active_wlcore)
2867 {
2868         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
2869         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
2870         u32 ucodeflags;
2871         int err;
2872         u32 sbimconfiglow;
2873         u8 limit;
2874
2875         if (bcm->core_pci.rev <= 5 && bcm->core_pci.id != BCM43xx_COREID_PCIE) {
2876                 sbimconfiglow = bcm43xx_read32(bcm, BCM43xx_CIR_SBIMCONFIGLOW);
2877                 sbimconfiglow &= ~ BCM43xx_SBIMCONFIGLOW_REQUEST_TOUT_MASK;
2878                 sbimconfiglow &= ~ BCM43xx_SBIMCONFIGLOW_SERVICE_TOUT_MASK;
2879                 if (bcm->bustype == BCM43xx_BUSTYPE_PCI)
2880                         sbimconfiglow |= 0x32;
2881                 else
2882                         sbimconfiglow |= 0x53;
2883                 bcm43xx_write32(bcm, BCM43xx_CIR_SBIMCONFIGLOW, sbimconfiglow);
2884         }
2885
2886         bcm43xx_phy_calibrate(bcm);
2887         err = bcm43xx_chip_init(bcm);
2888         if (err)
2889                 goto out;
2890
2891         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0016, bcm->current_core->rev);
2892         ucodeflags = bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED, BCM43xx_UCODEFLAGS_OFFSET);
2893
2894         if (0 /*FIXME: which condition has to be used here? */)
2895                 ucodeflags |= 0x00000010;
2896
2897         /* HW decryption needs to be set now */
2898         ucodeflags |= 0x40000000;
2899         
2900         if (phy->type == BCM43xx_PHYTYPE_G) {
2901                 ucodeflags |= BCM43xx_UCODEFLAG_UNKBGPHY;
2902                 if (phy->rev == 1)
2903                         ucodeflags |= BCM43xx_UCODEFLAG_UNKGPHY;
2904                 if (bcm->sprom.boardflags & BCM43xx_BFL_PACTRL)
2905                         ucodeflags |= BCM43xx_UCODEFLAG_UNKPACTRL;
2906         } else if (phy->type == BCM43xx_PHYTYPE_B) {
2907                 ucodeflags |= BCM43xx_UCODEFLAG_UNKBGPHY;
2908                 if (phy->rev >= 2 && radio->version == 0x2050)
2909                         ucodeflags &= ~BCM43xx_UCODEFLAG_UNKGPHY;
2910         }
2911
2912         if (ucodeflags != bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED,
2913                                              BCM43xx_UCODEFLAGS_OFFSET)) {
2914                 bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED,
2915                                     BCM43xx_UCODEFLAGS_OFFSET, ucodeflags);
2916         }
2917
2918         /* Short/Long Retry Limit.
2919          * The retry-limit is a 4-bit counter. Enforce this to avoid overflowing
2920          * the chip-internal counter.
2921          */
2922         limit = limit_value(modparam_short_retry, 0, 0xF);
2923         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0006, limit);
2924         limit = limit_value(modparam_long_retry, 0, 0xF);
2925         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0007, limit);
2926
2927         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0044, 3);
2928         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0046, 2);
2929
2930         bcm43xx_rate_memory_init(bcm);
2931
2932         /* Minimum Contention Window */
2933         if (phy->type == BCM43xx_PHYTYPE_B)
2934                 bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0003, 0x0000001f);
2935         else
2936                 bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0003, 0x0000000f);
2937         /* Maximum Contention Window */
2938         bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0004, 0x000003ff);
2939
2940         bcm43xx_gen_bssid(bcm);
2941         bcm43xx_write_mac_bssid_templates(bcm);
2942
2943         if (bcm->current_core->rev >= 5)
2944                 bcm43xx_write16(bcm, 0x043C, 0x000C);
2945
2946         if (active_wlcore) {
2947                 if (bcm43xx_using_pio(bcm)) {
2948                         err = bcm43xx_pio_init(bcm);
2949                 } else {
2950                         err = bcm43xx_dma_init(bcm);
2951                         if (err == -ENOSYS)
2952                                 err = bcm43xx_pio_init(bcm);
2953                 }
2954                 if (err)
2955                         goto err_chip_cleanup;
2956         }
2957         bcm43xx_write16(bcm, 0x0612, 0x0050);
2958         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0416, 0x0050);
2959         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0414, 0x01F4);
2960
2961         if (active_wlcore) {
2962                 if (radio->initial_channel != 0xFF)
2963                         bcm43xx_radio_selectchannel(bcm, radio->initial_channel, 0);
2964         }
2965
2966         /* Don't enable MAC/IRQ here, as it will race with the IRQ handler.
2967          * We enable it later.
2968          */
2969         bcm->current_core->initialized = 1;
2970 out:
2971         return err;
2972
2973 err_chip_cleanup:
2974         bcm43xx_chip_cleanup(bcm);
2975         goto out;
2976 }
2977
2978 static int bcm43xx_chipset_attach(struct bcm43xx_private *bcm)
2979 {
2980         int err;
2981         u16 pci_status;
2982
2983         err = bcm43xx_pctl_set_crystal(bcm, 1);