main.c revision 3ebbbb56a162b8f9b9a77bc7810b9d4e0868e039
1/*
2
3  Broadcom B43 wireless driver
4
5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11  Some parts of the code in this file are derived from the ipw2200
12  driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14  This program is free software; you can redistribute it and/or modify
15  it under the terms of the GNU General Public License as published by
16  the Free Software Foundation; either version 2 of the License, or
17  (at your option) any later version.
18
19  This program is distributed in the hope that it will be useful,
20  but WITHOUT ANY WARRANTY; without even the implied warranty of
21  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  GNU General Public License for more details.
23
24  You should have received a copy of the GNU General Public License
25  along with this program; see the file COPYING.  If not, write to
26  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27  Boston, MA 02110-1301, USA.
28
29*/
30
31#include <linux/delay.h>
32#include <linux/init.h>
33#include <linux/moduleparam.h>
34#include <linux/if_arp.h>
35#include <linux/etherdevice.h>
36#include <linux/firmware.h>
37#include <linux/wireless.h>
38#include <linux/workqueue.h>
39#include <linux/skbuff.h>
40#include <linux/io.h>
41#include <linux/dma-mapping.h>
42#include <asm/unaligned.h>
43
44#include "b43.h"
45#include "main.h"
46#include "debugfs.h"
47#include "phy_common.h"
48#include "phy_g.h"
49#include "phy_n.h"
50#include "dma.h"
51#include "pio.h"
52#include "sysfs.h"
53#include "xmit.h"
54#include "lo.h"
55#include "pcmcia.h"
56
57MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58MODULE_AUTHOR("Martin Langer");
59MODULE_AUTHOR("Stefano Brivio");
60MODULE_AUTHOR("Michael Buesch");
61MODULE_LICENSE("GPL");
62
63MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66static int modparam_bad_frames_preempt;
67module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68MODULE_PARM_DESC(bad_frames_preempt,
69		 "enable(1) / disable(0) Bad Frames Preemption");
70
71static char modparam_fwpostfix[16];
72module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75static int modparam_hwpctl;
76module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79static int modparam_nohwcrypt;
80module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83int b43_modparam_qos = 1;
84module_param_named(qos, b43_modparam_qos, int, 0444);
85MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
86
87static int modparam_btcoex = 1;
88module_param_named(btcoex, modparam_btcoex, int, 0444);
89MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
90
91
92static const struct ssb_device_id b43_ssb_tbl[] = {
93	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
94	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
95	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
96	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
97	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
98	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
99	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
100	SSB_DEVTABLE_END
101};
102
103MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
104
105/* Channel and ratetables are shared for all devices.
106 * They can't be const, because ieee80211 puts some precalculated
107 * data in there. This data is the same for all devices, so we don't
108 * get concurrency issues */
109#define RATETAB_ENT(_rateid, _flags) \
110	{								\
111		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
112		.hw_value	= (_rateid),				\
113		.flags		= (_flags),				\
114	}
115
116/*
117 * NOTE: When changing this, sync with xmit.c's
118 *	 b43_plcp_get_bitrate_idx_* functions!
119 */
120static struct ieee80211_rate __b43_ratetable[] = {
121	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
122	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
123	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
124	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
125	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
126	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
127	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
128	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
129	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
130	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
131	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
132	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
133};
134
135#define b43_a_ratetable		(__b43_ratetable + 4)
136#define b43_a_ratetable_size	8
137#define b43_b_ratetable		(__b43_ratetable + 0)
138#define b43_b_ratetable_size	4
139#define b43_g_ratetable		(__b43_ratetable + 0)
140#define b43_g_ratetable_size	12
141
142#define CHAN4G(_channel, _freq, _flags) {			\
143	.band			= IEEE80211_BAND_2GHZ,		\
144	.center_freq		= (_freq),			\
145	.hw_value		= (_channel),			\
146	.flags			= (_flags),			\
147	.max_antenna_gain	= 0,				\
148	.max_power		= 30,				\
149}
150static struct ieee80211_channel b43_2ghz_chantable[] = {
151	CHAN4G(1, 2412, 0),
152	CHAN4G(2, 2417, 0),
153	CHAN4G(3, 2422, 0),
154	CHAN4G(4, 2427, 0),
155	CHAN4G(5, 2432, 0),
156	CHAN4G(6, 2437, 0),
157	CHAN4G(7, 2442, 0),
158	CHAN4G(8, 2447, 0),
159	CHAN4G(9, 2452, 0),
160	CHAN4G(10, 2457, 0),
161	CHAN4G(11, 2462, 0),
162	CHAN4G(12, 2467, 0),
163	CHAN4G(13, 2472, 0),
164	CHAN4G(14, 2484, 0),
165};
166#undef CHAN4G
167
168#define CHAN5G(_channel, _flags) {				\
169	.band			= IEEE80211_BAND_5GHZ,		\
170	.center_freq		= 5000 + (5 * (_channel)),	\
171	.hw_value		= (_channel),			\
172	.flags			= (_flags),			\
173	.max_antenna_gain	= 0,				\
174	.max_power		= 30,				\
175}
176static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
177	CHAN5G(32, 0),		CHAN5G(34, 0),
178	CHAN5G(36, 0),		CHAN5G(38, 0),
179	CHAN5G(40, 0),		CHAN5G(42, 0),
180	CHAN5G(44, 0),		CHAN5G(46, 0),
181	CHAN5G(48, 0),		CHAN5G(50, 0),
182	CHAN5G(52, 0),		CHAN5G(54, 0),
183	CHAN5G(56, 0),		CHAN5G(58, 0),
184	CHAN5G(60, 0),		CHAN5G(62, 0),
185	CHAN5G(64, 0),		CHAN5G(66, 0),
186	CHAN5G(68, 0),		CHAN5G(70, 0),
187	CHAN5G(72, 0),		CHAN5G(74, 0),
188	CHAN5G(76, 0),		CHAN5G(78, 0),
189	CHAN5G(80, 0),		CHAN5G(82, 0),
190	CHAN5G(84, 0),		CHAN5G(86, 0),
191	CHAN5G(88, 0),		CHAN5G(90, 0),
192	CHAN5G(92, 0),		CHAN5G(94, 0),
193	CHAN5G(96, 0),		CHAN5G(98, 0),
194	CHAN5G(100, 0),		CHAN5G(102, 0),
195	CHAN5G(104, 0),		CHAN5G(106, 0),
196	CHAN5G(108, 0),		CHAN5G(110, 0),
197	CHAN5G(112, 0),		CHAN5G(114, 0),
198	CHAN5G(116, 0),		CHAN5G(118, 0),
199	CHAN5G(120, 0),		CHAN5G(122, 0),
200	CHAN5G(124, 0),		CHAN5G(126, 0),
201	CHAN5G(128, 0),		CHAN5G(130, 0),
202	CHAN5G(132, 0),		CHAN5G(134, 0),
203	CHAN5G(136, 0),		CHAN5G(138, 0),
204	CHAN5G(140, 0),		CHAN5G(142, 0),
205	CHAN5G(144, 0),		CHAN5G(145, 0),
206	CHAN5G(146, 0),		CHAN5G(147, 0),
207	CHAN5G(148, 0),		CHAN5G(149, 0),
208	CHAN5G(150, 0),		CHAN5G(151, 0),
209	CHAN5G(152, 0),		CHAN5G(153, 0),
210	CHAN5G(154, 0),		CHAN5G(155, 0),
211	CHAN5G(156, 0),		CHAN5G(157, 0),
212	CHAN5G(158, 0),		CHAN5G(159, 0),
213	CHAN5G(160, 0),		CHAN5G(161, 0),
214	CHAN5G(162, 0),		CHAN5G(163, 0),
215	CHAN5G(164, 0),		CHAN5G(165, 0),
216	CHAN5G(166, 0),		CHAN5G(168, 0),
217	CHAN5G(170, 0),		CHAN5G(172, 0),
218	CHAN5G(174, 0),		CHAN5G(176, 0),
219	CHAN5G(178, 0),		CHAN5G(180, 0),
220	CHAN5G(182, 0),		CHAN5G(184, 0),
221	CHAN5G(186, 0),		CHAN5G(188, 0),
222	CHAN5G(190, 0),		CHAN5G(192, 0),
223	CHAN5G(194, 0),		CHAN5G(196, 0),
224	CHAN5G(198, 0),		CHAN5G(200, 0),
225	CHAN5G(202, 0),		CHAN5G(204, 0),
226	CHAN5G(206, 0),		CHAN5G(208, 0),
227	CHAN5G(210, 0),		CHAN5G(212, 0),
228	CHAN5G(214, 0),		CHAN5G(216, 0),
229	CHAN5G(218, 0),		CHAN5G(220, 0),
230	CHAN5G(222, 0),		CHAN5G(224, 0),
231	CHAN5G(226, 0),		CHAN5G(228, 0),
232};
233
234static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
235	CHAN5G(34, 0),		CHAN5G(36, 0),
236	CHAN5G(38, 0),		CHAN5G(40, 0),
237	CHAN5G(42, 0),		CHAN5G(44, 0),
238	CHAN5G(46, 0),		CHAN5G(48, 0),
239	CHAN5G(52, 0),		CHAN5G(56, 0),
240	CHAN5G(60, 0),		CHAN5G(64, 0),
241	CHAN5G(100, 0),		CHAN5G(104, 0),
242	CHAN5G(108, 0),		CHAN5G(112, 0),
243	CHAN5G(116, 0),		CHAN5G(120, 0),
244	CHAN5G(124, 0),		CHAN5G(128, 0),
245	CHAN5G(132, 0),		CHAN5G(136, 0),
246	CHAN5G(140, 0),		CHAN5G(149, 0),
247	CHAN5G(153, 0),		CHAN5G(157, 0),
248	CHAN5G(161, 0),		CHAN5G(165, 0),
249	CHAN5G(184, 0),		CHAN5G(188, 0),
250	CHAN5G(192, 0),		CHAN5G(196, 0),
251	CHAN5G(200, 0),		CHAN5G(204, 0),
252	CHAN5G(208, 0),		CHAN5G(212, 0),
253	CHAN5G(216, 0),
254};
255#undef CHAN5G
256
257static struct ieee80211_supported_band b43_band_5GHz_nphy = {
258	.band		= IEEE80211_BAND_5GHZ,
259	.channels	= b43_5ghz_nphy_chantable,
260	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
261	.bitrates	= b43_a_ratetable,
262	.n_bitrates	= b43_a_ratetable_size,
263};
264
265static struct ieee80211_supported_band b43_band_5GHz_aphy = {
266	.band		= IEEE80211_BAND_5GHZ,
267	.channels	= b43_5ghz_aphy_chantable,
268	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
269	.bitrates	= b43_a_ratetable,
270	.n_bitrates	= b43_a_ratetable_size,
271};
272
273static struct ieee80211_supported_band b43_band_2GHz = {
274	.band		= IEEE80211_BAND_2GHZ,
275	.channels	= b43_2ghz_chantable,
276	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
277	.bitrates	= b43_g_ratetable,
278	.n_bitrates	= b43_g_ratetable_size,
279};
280
281static void b43_wireless_core_exit(struct b43_wldev *dev);
282static int b43_wireless_core_init(struct b43_wldev *dev);
283static void b43_wireless_core_stop(struct b43_wldev *dev);
284static int b43_wireless_core_start(struct b43_wldev *dev);
285
286static int b43_ratelimit(struct b43_wl *wl)
287{
288	if (!wl || !wl->current_dev)
289		return 1;
290	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
291		return 1;
292	/* We are up and running.
293	 * Ratelimit the messages to avoid DoS over the net. */
294	return net_ratelimit();
295}
296
297void b43info(struct b43_wl *wl, const char *fmt, ...)
298{
299	va_list args;
300
301	if (!b43_ratelimit(wl))
302		return;
303	va_start(args, fmt);
304	printk(KERN_INFO "b43-%s: ",
305	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
306	vprintk(fmt, args);
307	va_end(args);
308}
309
310void b43err(struct b43_wl *wl, const char *fmt, ...)
311{
312	va_list args;
313
314	if (!b43_ratelimit(wl))
315		return;
316	va_start(args, fmt);
317	printk(KERN_ERR "b43-%s ERROR: ",
318	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
319	vprintk(fmt, args);
320	va_end(args);
321}
322
323void b43warn(struct b43_wl *wl, const char *fmt, ...)
324{
325	va_list args;
326
327	if (!b43_ratelimit(wl))
328		return;
329	va_start(args, fmt);
330	printk(KERN_WARNING "b43-%s warning: ",
331	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
332	vprintk(fmt, args);
333	va_end(args);
334}
335
336#if B43_DEBUG
337void b43dbg(struct b43_wl *wl, const char *fmt, ...)
338{
339	va_list args;
340
341	va_start(args, fmt);
342	printk(KERN_DEBUG "b43-%s debug: ",
343	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
344	vprintk(fmt, args);
345	va_end(args);
346}
347#endif /* DEBUG */
348
349static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
350{
351	u32 macctl;
352
353	B43_WARN_ON(offset % 4 != 0);
354
355	macctl = b43_read32(dev, B43_MMIO_MACCTL);
356	if (macctl & B43_MACCTL_BE)
357		val = swab32(val);
358
359	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
360	mmiowb();
361	b43_write32(dev, B43_MMIO_RAM_DATA, val);
362}
363
364static inline void b43_shm_control_word(struct b43_wldev *dev,
365					u16 routing, u16 offset)
366{
367	u32 control;
368
369	/* "offset" is the WORD offset. */
370	control = routing;
371	control <<= 16;
372	control |= offset;
373	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
374}
375
376u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
377{
378	u32 ret;
379
380	if (routing == B43_SHM_SHARED) {
381		B43_WARN_ON(offset & 0x0001);
382		if (offset & 0x0003) {
383			/* Unaligned access */
384			b43_shm_control_word(dev, routing, offset >> 2);
385			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
386			ret <<= 16;
387			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
388			ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
389
390			goto out;
391		}
392		offset >>= 2;
393	}
394	b43_shm_control_word(dev, routing, offset);
395	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
396out:
397	return ret;
398}
399
400u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
401{
402	struct b43_wl *wl = dev->wl;
403	unsigned long flags;
404	u32 ret;
405
406	spin_lock_irqsave(&wl->shm_lock, flags);
407	ret = __b43_shm_read32(dev, routing, offset);
408	spin_unlock_irqrestore(&wl->shm_lock, flags);
409
410	return ret;
411}
412
413u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
414{
415	u16 ret;
416
417	if (routing == B43_SHM_SHARED) {
418		B43_WARN_ON(offset & 0x0001);
419		if (offset & 0x0003) {
420			/* Unaligned access */
421			b43_shm_control_word(dev, routing, offset >> 2);
422			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
423
424			goto out;
425		}
426		offset >>= 2;
427	}
428	b43_shm_control_word(dev, routing, offset);
429	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
430out:
431	return ret;
432}
433
434u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
435{
436	struct b43_wl *wl = dev->wl;
437	unsigned long flags;
438	u16 ret;
439
440	spin_lock_irqsave(&wl->shm_lock, flags);
441	ret = __b43_shm_read16(dev, routing, offset);
442	spin_unlock_irqrestore(&wl->shm_lock, flags);
443
444	return ret;
445}
446
447void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
448{
449	if (routing == B43_SHM_SHARED) {
450		B43_WARN_ON(offset & 0x0001);
451		if (offset & 0x0003) {
452			/* Unaligned access */
453			b43_shm_control_word(dev, routing, offset >> 2);
454			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
455				    (value >> 16) & 0xffff);
456			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
457			b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
458			return;
459		}
460		offset >>= 2;
461	}
462	b43_shm_control_word(dev, routing, offset);
463	b43_write32(dev, B43_MMIO_SHM_DATA, value);
464}
465
466void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
467{
468	struct b43_wl *wl = dev->wl;
469	unsigned long flags;
470
471	spin_lock_irqsave(&wl->shm_lock, flags);
472	__b43_shm_write32(dev, routing, offset, value);
473	spin_unlock_irqrestore(&wl->shm_lock, flags);
474}
475
476void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
477{
478	if (routing == B43_SHM_SHARED) {
479		B43_WARN_ON(offset & 0x0001);
480		if (offset & 0x0003) {
481			/* Unaligned access */
482			b43_shm_control_word(dev, routing, offset >> 2);
483			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
484			return;
485		}
486		offset >>= 2;
487	}
488	b43_shm_control_word(dev, routing, offset);
489	b43_write16(dev, B43_MMIO_SHM_DATA, value);
490}
491
492void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
493{
494	struct b43_wl *wl = dev->wl;
495	unsigned long flags;
496
497	spin_lock_irqsave(&wl->shm_lock, flags);
498	__b43_shm_write16(dev, routing, offset, value);
499	spin_unlock_irqrestore(&wl->shm_lock, flags);
500}
501
502/* Read HostFlags */
503u64 b43_hf_read(struct b43_wldev * dev)
504{
505	u64 ret;
506
507	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
508	ret <<= 16;
509	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
510	ret <<= 16;
511	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
512
513	return ret;
514}
515
516/* Write HostFlags */
517void b43_hf_write(struct b43_wldev *dev, u64 value)
518{
519	u16 lo, mi, hi;
520
521	lo = (value & 0x00000000FFFFULL);
522	mi = (value & 0x0000FFFF0000ULL) >> 16;
523	hi = (value & 0xFFFF00000000ULL) >> 32;
524	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
525	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
526	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
527}
528
529void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
530{
531	u32 low, high;
532
533	B43_WARN_ON(dev->dev->id.revision < 3);
534
535	/* The hardware guarantees us an atomic read, if we
536	 * read the low register first. */
537	low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
538	high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
539
540	*tsf = high;
541	*tsf <<= 32;
542	*tsf |= low;
543}
544
545static void b43_time_lock(struct b43_wldev *dev)
546{
547	u32 macctl;
548
549	macctl = b43_read32(dev, B43_MMIO_MACCTL);
550	macctl |= B43_MACCTL_TBTTHOLD;
551	b43_write32(dev, B43_MMIO_MACCTL, macctl);
552	/* Commit the write */
553	b43_read32(dev, B43_MMIO_MACCTL);
554}
555
556static void b43_time_unlock(struct b43_wldev *dev)
557{
558	u32 macctl;
559
560	macctl = b43_read32(dev, B43_MMIO_MACCTL);
561	macctl &= ~B43_MACCTL_TBTTHOLD;
562	b43_write32(dev, B43_MMIO_MACCTL, macctl);
563	/* Commit the write */
564	b43_read32(dev, B43_MMIO_MACCTL);
565}
566
567static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
568{
569	u32 low, high;
570
571	B43_WARN_ON(dev->dev->id.revision < 3);
572
573	low = tsf;
574	high = (tsf >> 32);
575	/* The hardware guarantees us an atomic write, if we
576	 * write the low register first. */
577	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
578	mmiowb();
579	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
580	mmiowb();
581}
582
583void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
584{
585	b43_time_lock(dev);
586	b43_tsf_write_locked(dev, tsf);
587	b43_time_unlock(dev);
588}
589
590static
591void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
592{
593	static const u8 zero_addr[ETH_ALEN] = { 0 };
594	u16 data;
595
596	if (!mac)
597		mac = zero_addr;
598
599	offset |= 0x0020;
600	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
601
602	data = mac[0];
603	data |= mac[1] << 8;
604	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
605	data = mac[2];
606	data |= mac[3] << 8;
607	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
608	data = mac[4];
609	data |= mac[5] << 8;
610	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
611}
612
613static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
614{
615	const u8 *mac;
616	const u8 *bssid;
617	u8 mac_bssid[ETH_ALEN * 2];
618	int i;
619	u32 tmp;
620
621	bssid = dev->wl->bssid;
622	mac = dev->wl->mac_addr;
623
624	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
625
626	memcpy(mac_bssid, mac, ETH_ALEN);
627	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
628
629	/* Write our MAC address and BSSID to template ram */
630	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
631		tmp = (u32) (mac_bssid[i + 0]);
632		tmp |= (u32) (mac_bssid[i + 1]) << 8;
633		tmp |= (u32) (mac_bssid[i + 2]) << 16;
634		tmp |= (u32) (mac_bssid[i + 3]) << 24;
635		b43_ram_write(dev, 0x20 + i, tmp);
636	}
637}
638
639static void b43_upload_card_macaddress(struct b43_wldev *dev)
640{
641	b43_write_mac_bssid_templates(dev);
642	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
643}
644
645static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
646{
647	/* slot_time is in usec. */
648	if (dev->phy.type != B43_PHYTYPE_G)
649		return;
650	b43_write16(dev, 0x684, 510 + slot_time);
651	b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
652}
653
654static void b43_short_slot_timing_enable(struct b43_wldev *dev)
655{
656	b43_set_slot_time(dev, 9);
657}
658
659static void b43_short_slot_timing_disable(struct b43_wldev *dev)
660{
661	b43_set_slot_time(dev, 20);
662}
663
664/* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
665 * Returns the _previously_ enabled IRQ mask.
666 */
667static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
668{
669	u32 old_mask;
670
671	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
672	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
673
674	return old_mask;
675}
676
677/* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
678 * Returns the _previously_ enabled IRQ mask.
679 */
680static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
681{
682	u32 old_mask;
683
684	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
685	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
686
687	return old_mask;
688}
689
690/* Synchronize IRQ top- and bottom-half.
691 * IRQs must be masked before calling this.
692 * This must not be called with the irq_lock held.
693 */
694static void b43_synchronize_irq(struct b43_wldev *dev)
695{
696	synchronize_irq(dev->dev->irq);
697	tasklet_kill(&dev->isr_tasklet);
698}
699
700/* DummyTransmission function, as documented on
701 * http://bcm-specs.sipsolutions.net/DummyTransmission
702 */
703void b43_dummy_transmission(struct b43_wldev *dev)
704{
705	struct b43_wl *wl = dev->wl;
706	struct b43_phy *phy = &dev->phy;
707	unsigned int i, max_loop;
708	u16 value;
709	u32 buffer[5] = {
710		0x00000000,
711		0x00D40000,
712		0x00000000,
713		0x01000000,
714		0x00000000,
715	};
716
717	switch (phy->type) {
718	case B43_PHYTYPE_A:
719		max_loop = 0x1E;
720		buffer[0] = 0x000201CC;
721		break;
722	case B43_PHYTYPE_B:
723	case B43_PHYTYPE_G:
724		max_loop = 0xFA;
725		buffer[0] = 0x000B846E;
726		break;
727	default:
728		B43_WARN_ON(1);
729		return;
730	}
731
732	spin_lock_irq(&wl->irq_lock);
733	write_lock(&wl->tx_lock);
734
735	for (i = 0; i < 5; i++)
736		b43_ram_write(dev, i * 4, buffer[i]);
737
738	/* Commit writes */
739	b43_read32(dev, B43_MMIO_MACCTL);
740
741	b43_write16(dev, 0x0568, 0x0000);
742	b43_write16(dev, 0x07C0, 0x0000);
743	value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
744	b43_write16(dev, 0x050C, value);
745	b43_write16(dev, 0x0508, 0x0000);
746	b43_write16(dev, 0x050A, 0x0000);
747	b43_write16(dev, 0x054C, 0x0000);
748	b43_write16(dev, 0x056A, 0x0014);
749	b43_write16(dev, 0x0568, 0x0826);
750	b43_write16(dev, 0x0500, 0x0000);
751	b43_write16(dev, 0x0502, 0x0030);
752
753	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
754		b43_radio_write16(dev, 0x0051, 0x0017);
755	for (i = 0x00; i < max_loop; i++) {
756		value = b43_read16(dev, 0x050E);
757		if (value & 0x0080)
758			break;
759		udelay(10);
760	}
761	for (i = 0x00; i < 0x0A; i++) {
762		value = b43_read16(dev, 0x050E);
763		if (value & 0x0400)
764			break;
765		udelay(10);
766	}
767	for (i = 0x00; i < 0x19; i++) {
768		value = b43_read16(dev, 0x0690);
769		if (!(value & 0x0100))
770			break;
771		udelay(10);
772	}
773	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
774		b43_radio_write16(dev, 0x0051, 0x0037);
775
776	write_unlock(&wl->tx_lock);
777	spin_unlock_irq(&wl->irq_lock);
778}
779
780static void key_write(struct b43_wldev *dev,
781		      u8 index, u8 algorithm, const u8 * key)
782{
783	unsigned int i;
784	u32 offset;
785	u16 value;
786	u16 kidx;
787
788	/* Key index/algo block */
789	kidx = b43_kidx_to_fw(dev, index);
790	value = ((kidx << 4) | algorithm);
791	b43_shm_write16(dev, B43_SHM_SHARED,
792			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
793
794	/* Write the key to the Key Table Pointer offset */
795	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
796	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
797		value = key[i];
798		value |= (u16) (key[i + 1]) << 8;
799		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
800	}
801}
802
803static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
804{
805	u32 addrtmp[2] = { 0, 0, };
806	u8 per_sta_keys_start = 8;
807
808	if (b43_new_kidx_api(dev))
809		per_sta_keys_start = 4;
810
811	B43_WARN_ON(index < per_sta_keys_start);
812	/* We have two default TX keys and possibly two default RX keys.
813	 * Physical mac 0 is mapped to physical key 4 or 8, depending
814	 * on the firmware version.
815	 * So we must adjust the index here.
816	 */
817	index -= per_sta_keys_start;
818
819	if (addr) {
820		addrtmp[0] = addr[0];
821		addrtmp[0] |= ((u32) (addr[1]) << 8);
822		addrtmp[0] |= ((u32) (addr[2]) << 16);
823		addrtmp[0] |= ((u32) (addr[3]) << 24);
824		addrtmp[1] = addr[4];
825		addrtmp[1] |= ((u32) (addr[5]) << 8);
826	}
827
828	if (dev->dev->id.revision >= 5) {
829		/* Receive match transmitter address mechanism */
830		b43_shm_write32(dev, B43_SHM_RCMTA,
831				(index * 2) + 0, addrtmp[0]);
832		b43_shm_write16(dev, B43_SHM_RCMTA,
833				(index * 2) + 1, addrtmp[1]);
834	} else {
835		/* RXE (Receive Engine) and
836		 * PSM (Programmable State Machine) mechanism
837		 */
838		if (index < 8) {
839			/* TODO write to RCM 16, 19, 22 and 25 */
840		} else {
841			b43_shm_write32(dev, B43_SHM_SHARED,
842					B43_SHM_SH_PSM + (index * 6) + 0,
843					addrtmp[0]);
844			b43_shm_write16(dev, B43_SHM_SHARED,
845					B43_SHM_SH_PSM + (index * 6) + 4,
846					addrtmp[1]);
847		}
848	}
849}
850
851static void do_key_write(struct b43_wldev *dev,
852			 u8 index, u8 algorithm,
853			 const u8 * key, size_t key_len, const u8 * mac_addr)
854{
855	u8 buf[B43_SEC_KEYSIZE] = { 0, };
856	u8 per_sta_keys_start = 8;
857
858	if (b43_new_kidx_api(dev))
859		per_sta_keys_start = 4;
860
861	B43_WARN_ON(index >= dev->max_nr_keys);
862	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
863
864	if (index >= per_sta_keys_start)
865		keymac_write(dev, index, NULL);	/* First zero out mac. */
866	if (key)
867		memcpy(buf, key, key_len);
868	key_write(dev, index, algorithm, buf);
869	if (index >= per_sta_keys_start)
870		keymac_write(dev, index, mac_addr);
871
872	dev->key[index].algorithm = algorithm;
873}
874
875static int b43_key_write(struct b43_wldev *dev,
876			 int index, u8 algorithm,
877			 const u8 * key, size_t key_len,
878			 const u8 * mac_addr,
879			 struct ieee80211_key_conf *keyconf)
880{
881	int i;
882	int sta_keys_start;
883
884	if (key_len > B43_SEC_KEYSIZE)
885		return -EINVAL;
886	for (i = 0; i < dev->max_nr_keys; i++) {
887		/* Check that we don't already have this key. */
888		B43_WARN_ON(dev->key[i].keyconf == keyconf);
889	}
890	if (index < 0) {
891		/* Pairwise key. Get an empty slot for the key. */
892		if (b43_new_kidx_api(dev))
893			sta_keys_start = 4;
894		else
895			sta_keys_start = 8;
896		for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
897			if (!dev->key[i].keyconf) {
898				/* found empty */
899				index = i;
900				break;
901			}
902		}
903		if (index < 0) {
904			b43warn(dev->wl, "Out of hardware key memory\n");
905			return -ENOSPC;
906		}
907	} else
908		B43_WARN_ON(index > 3);
909
910	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
911	if ((index <= 3) && !b43_new_kidx_api(dev)) {
912		/* Default RX key */
913		B43_WARN_ON(mac_addr);
914		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
915	}
916	keyconf->hw_key_idx = index;
917	dev->key[index].keyconf = keyconf;
918
919	return 0;
920}
921
922static int b43_key_clear(struct b43_wldev *dev, int index)
923{
924	if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
925		return -EINVAL;
926	do_key_write(dev, index, B43_SEC_ALGO_NONE,
927		     NULL, B43_SEC_KEYSIZE, NULL);
928	if ((index <= 3) && !b43_new_kidx_api(dev)) {
929		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
930			     NULL, B43_SEC_KEYSIZE, NULL);
931	}
932	dev->key[index].keyconf = NULL;
933
934	return 0;
935}
936
937static void b43_clear_keys(struct b43_wldev *dev)
938{
939	int i;
940
941	for (i = 0; i < dev->max_nr_keys; i++)
942		b43_key_clear(dev, i);
943}
944
945static void b43_dump_keymemory(struct b43_wldev *dev)
946{
947	unsigned int i, index, offset;
948	DECLARE_MAC_BUF(macbuf);
949	u8 mac[ETH_ALEN];
950	u16 algo;
951	u32 rcmta0;
952	u16 rcmta1;
953	u64 hf;
954	struct b43_key *key;
955
956	if (!b43_debug(dev, B43_DBG_KEYS))
957		return;
958
959	hf = b43_hf_read(dev);
960	b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
961	       !!(hf & B43_HF_USEDEFKEYS));
962	for (index = 0; index < dev->max_nr_keys; index++) {
963		key = &(dev->key[index]);
964		printk(KERN_DEBUG "Key slot %02u: %s",
965		       index, (key->keyconf == NULL) ? " " : "*");
966		offset = dev->ktp + (index * B43_SEC_KEYSIZE);
967		for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
968			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
969			printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
970		}
971
972		algo = b43_shm_read16(dev, B43_SHM_SHARED,
973				      B43_SHM_SH_KEYIDXBLOCK + (index * 2));
974		printk("   Algo: %04X/%02X", algo, key->algorithm);
975
976		if (index >= 4) {
977			rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
978						((index - 4) * 2) + 0);
979			rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
980						((index - 4) * 2) + 1);
981			*((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
982			*((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
983			printk("   MAC: %s",
984			       print_mac(macbuf, mac));
985		} else
986			printk("   DEFAULT KEY");
987		printk("\n");
988	}
989}
990
991void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
992{
993	u32 macctl;
994	u16 ucstat;
995	bool hwps;
996	bool awake;
997	int i;
998
999	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1000		    (ps_flags & B43_PS_DISABLED));
1001	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1002
1003	if (ps_flags & B43_PS_ENABLED) {
1004		hwps = 1;
1005	} else if (ps_flags & B43_PS_DISABLED) {
1006		hwps = 0;
1007	} else {
1008		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1009		//      and thus is not an AP and we are associated, set bit 25
1010	}
1011	if (ps_flags & B43_PS_AWAKE) {
1012		awake = 1;
1013	} else if (ps_flags & B43_PS_ASLEEP) {
1014		awake = 0;
1015	} else {
1016		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1017		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1018		//      successful, set bit26
1019	}
1020
1021/* FIXME: For now we force awake-on and hwps-off */
1022	hwps = 0;
1023	awake = 1;
1024
1025	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1026	if (hwps)
1027		macctl |= B43_MACCTL_HWPS;
1028	else
1029		macctl &= ~B43_MACCTL_HWPS;
1030	if (awake)
1031		macctl |= B43_MACCTL_AWAKE;
1032	else
1033		macctl &= ~B43_MACCTL_AWAKE;
1034	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1035	/* Commit write */
1036	b43_read32(dev, B43_MMIO_MACCTL);
1037	if (awake && dev->dev->id.revision >= 5) {
1038		/* Wait for the microcode to wake up. */
1039		for (i = 0; i < 100; i++) {
1040			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1041						B43_SHM_SH_UCODESTAT);
1042			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1043				break;
1044			udelay(10);
1045		}
1046	}
1047}
1048
1049void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1050{
1051	u32 tmslow;
1052	u32 macctl;
1053
1054	flags |= B43_TMSLOW_PHYCLKEN;
1055	flags |= B43_TMSLOW_PHYRESET;
1056	ssb_device_enable(dev->dev, flags);
1057	msleep(2);		/* Wait for the PLL to turn on. */
1058
1059	/* Now take the PHY out of Reset again */
1060	tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1061	tmslow |= SSB_TMSLOW_FGC;
1062	tmslow &= ~B43_TMSLOW_PHYRESET;
1063	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1064	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1065	msleep(1);
1066	tmslow &= ~SSB_TMSLOW_FGC;
1067	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1068	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1069	msleep(1);
1070
1071	/* Turn Analog ON, but only if we already know the PHY-type.
1072	 * This protects against very early setup where we don't know the
1073	 * PHY-type, yet. wireless_core_reset will be called once again later,
1074	 * when we know the PHY-type. */
1075	if (dev->phy.ops)
1076		dev->phy.ops->switch_analog(dev, 1);
1077
1078	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1079	macctl &= ~B43_MACCTL_GMODE;
1080	if (flags & B43_TMSLOW_GMODE)
1081		macctl |= B43_MACCTL_GMODE;
1082	macctl |= B43_MACCTL_IHR_ENABLED;
1083	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1084}
1085
1086static void handle_irq_transmit_status(struct b43_wldev *dev)
1087{
1088	u32 v0, v1;
1089	u16 tmp;
1090	struct b43_txstatus stat;
1091
1092	while (1) {
1093		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1094		if (!(v0 & 0x00000001))
1095			break;
1096		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1097
1098		stat.cookie = (v0 >> 16);
1099		stat.seq = (v1 & 0x0000FFFF);
1100		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1101		tmp = (v0 & 0x0000FFFF);
1102		stat.frame_count = ((tmp & 0xF000) >> 12);
1103		stat.rts_count = ((tmp & 0x0F00) >> 8);
1104		stat.supp_reason = ((tmp & 0x001C) >> 2);
1105		stat.pm_indicated = !!(tmp & 0x0080);
1106		stat.intermediate = !!(tmp & 0x0040);
1107		stat.for_ampdu = !!(tmp & 0x0020);
1108		stat.acked = !!(tmp & 0x0002);
1109
1110		b43_handle_txstatus(dev, &stat);
1111	}
1112}
1113
1114static void drain_txstatus_queue(struct b43_wldev *dev)
1115{
1116	u32 dummy;
1117
1118	if (dev->dev->id.revision < 5)
1119		return;
1120	/* Read all entries from the microcode TXstatus FIFO
1121	 * and throw them away.
1122	 */
1123	while (1) {
1124		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1125		if (!(dummy & 0x00000001))
1126			break;
1127		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1128	}
1129}
1130
1131static u32 b43_jssi_read(struct b43_wldev *dev)
1132{
1133	u32 val = 0;
1134
1135	val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1136	val <<= 16;
1137	val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1138
1139	return val;
1140}
1141
1142static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1143{
1144	b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1145	b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1146}
1147
1148static void b43_generate_noise_sample(struct b43_wldev *dev)
1149{
1150	b43_jssi_write(dev, 0x7F7F7F7F);
1151	b43_write32(dev, B43_MMIO_MACCMD,
1152		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1153}
1154
1155static void b43_calculate_link_quality(struct b43_wldev *dev)
1156{
1157	/* Top half of Link Quality calculation. */
1158
1159	if (dev->phy.type != B43_PHYTYPE_G)
1160		return;
1161	if (dev->noisecalc.calculation_running)
1162		return;
1163	dev->noisecalc.calculation_running = 1;
1164	dev->noisecalc.nr_samples = 0;
1165
1166	b43_generate_noise_sample(dev);
1167}
1168
1169static void handle_irq_noise(struct b43_wldev *dev)
1170{
1171	struct b43_phy_g *phy = dev->phy.g;
1172	u16 tmp;
1173	u8 noise[4];
1174	u8 i, j;
1175	s32 average;
1176
1177	/* Bottom half of Link Quality calculation. */
1178
1179	if (dev->phy.type != B43_PHYTYPE_G)
1180		return;
1181
1182	/* Possible race condition: It might be possible that the user
1183	 * changed to a different channel in the meantime since we
1184	 * started the calculation. We ignore that fact, since it's
1185	 * not really that much of a problem. The background noise is
1186	 * an estimation only anyway. Slightly wrong results will get damped
1187	 * by the averaging of the 8 sample rounds. Additionally the
1188	 * value is shortlived. So it will be replaced by the next noise
1189	 * calculation round soon. */
1190
1191	B43_WARN_ON(!dev->noisecalc.calculation_running);
1192	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1193	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1194	    noise[2] == 0x7F || noise[3] == 0x7F)
1195		goto generate_new;
1196
1197	/* Get the noise samples. */
1198	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1199	i = dev->noisecalc.nr_samples;
1200	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1201	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1202	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1203	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1204	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1205	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1206	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1207	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1208	dev->noisecalc.nr_samples++;
1209	if (dev->noisecalc.nr_samples == 8) {
1210		/* Calculate the Link Quality by the noise samples. */
1211		average = 0;
1212		for (i = 0; i < 8; i++) {
1213			for (j = 0; j < 4; j++)
1214				average += dev->noisecalc.samples[i][j];
1215		}
1216		average /= (8 * 4);
1217		average *= 125;
1218		average += 64;
1219		average /= 128;
1220		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1221		tmp = (tmp / 128) & 0x1F;
1222		if (tmp >= 8)
1223			average += 2;
1224		else
1225			average -= 25;
1226		if (tmp == 8)
1227			average -= 72;
1228		else
1229			average -= 48;
1230
1231		dev->stats.link_noise = average;
1232		dev->noisecalc.calculation_running = 0;
1233		return;
1234	}
1235generate_new:
1236	b43_generate_noise_sample(dev);
1237}
1238
1239static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1240{
1241	if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1242		///TODO: PS TBTT
1243	} else {
1244		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1245			b43_power_saving_ctl_bits(dev, 0);
1246	}
1247	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1248		dev->dfq_valid = 1;
1249}
1250
1251static void handle_irq_atim_end(struct b43_wldev *dev)
1252{
1253	if (dev->dfq_valid) {
1254		b43_write32(dev, B43_MMIO_MACCMD,
1255			    b43_read32(dev, B43_MMIO_MACCMD)
1256			    | B43_MACCMD_DFQ_VALID);
1257		dev->dfq_valid = 0;
1258	}
1259}
1260
1261static void handle_irq_pmq(struct b43_wldev *dev)
1262{
1263	u32 tmp;
1264
1265	//TODO: AP mode.
1266
1267	while (1) {
1268		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1269		if (!(tmp & 0x00000008))
1270			break;
1271	}
1272	/* 16bit write is odd, but correct. */
1273	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1274}
1275
1276static void b43_write_template_common(struct b43_wldev *dev,
1277				      const u8 * data, u16 size,
1278				      u16 ram_offset,
1279				      u16 shm_size_offset, u8 rate)
1280{
1281	u32 i, tmp;
1282	struct b43_plcp_hdr4 plcp;
1283
1284	plcp.data = 0;
1285	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1286	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1287	ram_offset += sizeof(u32);
1288	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1289	 * So leave the first two bytes of the next write blank.
1290	 */
1291	tmp = (u32) (data[0]) << 16;
1292	tmp |= (u32) (data[1]) << 24;
1293	b43_ram_write(dev, ram_offset, tmp);
1294	ram_offset += sizeof(u32);
1295	for (i = 2; i < size; i += sizeof(u32)) {
1296		tmp = (u32) (data[i + 0]);
1297		if (i + 1 < size)
1298			tmp |= (u32) (data[i + 1]) << 8;
1299		if (i + 2 < size)
1300			tmp |= (u32) (data[i + 2]) << 16;
1301		if (i + 3 < size)
1302			tmp |= (u32) (data[i + 3]) << 24;
1303		b43_ram_write(dev, ram_offset + i - 2, tmp);
1304	}
1305	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1306			size + sizeof(struct b43_plcp_hdr6));
1307}
1308
1309/* Check if the use of the antenna that ieee80211 told us to
1310 * use is possible. This will fall back to DEFAULT.
1311 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1312u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1313				  u8 antenna_nr)
1314{
1315	u8 antenna_mask;
1316
1317	if (antenna_nr == 0) {
1318		/* Zero means "use default antenna". That's always OK. */
1319		return 0;
1320	}
1321
1322	/* Get the mask of available antennas. */
1323	if (dev->phy.gmode)
1324		antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1325	else
1326		antenna_mask = dev->dev->bus->sprom.ant_available_a;
1327
1328	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1329		/* This antenna is not available. Fall back to default. */
1330		return 0;
1331	}
1332
1333	return antenna_nr;
1334}
1335
1336/* Convert a b43 antenna number value to the PHY TX control value. */
1337static u16 b43_antenna_to_phyctl(int antenna)
1338{
1339	switch (antenna) {
1340	case B43_ANTENNA0:
1341		return B43_TXH_PHY_ANT0;
1342	case B43_ANTENNA1:
1343		return B43_TXH_PHY_ANT1;
1344	case B43_ANTENNA2:
1345		return B43_TXH_PHY_ANT2;
1346	case B43_ANTENNA3:
1347		return B43_TXH_PHY_ANT3;
1348	case B43_ANTENNA_AUTO:
1349		return B43_TXH_PHY_ANT01AUTO;
1350	}
1351	B43_WARN_ON(1);
1352	return 0;
1353}
1354
1355static void b43_write_beacon_template(struct b43_wldev *dev,
1356				      u16 ram_offset,
1357				      u16 shm_size_offset)
1358{
1359	unsigned int i, len, variable_len;
1360	const struct ieee80211_mgmt *bcn;
1361	const u8 *ie;
1362	bool tim_found = 0;
1363	unsigned int rate;
1364	u16 ctl;
1365	int antenna;
1366	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1367
1368	bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1369	len = min((size_t) dev->wl->current_beacon->len,
1370		  0x200 - sizeof(struct b43_plcp_hdr6));
1371	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1372
1373	b43_write_template_common(dev, (const u8 *)bcn,
1374				  len, ram_offset, shm_size_offset, rate);
1375
1376	/* Write the PHY TX control parameters. */
1377	antenna = B43_ANTENNA_DEFAULT;
1378	antenna = b43_antenna_to_phyctl(antenna);
1379	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1380	/* We can't send beacons with short preamble. Would get PHY errors. */
1381	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1382	ctl &= ~B43_TXH_PHY_ANT;
1383	ctl &= ~B43_TXH_PHY_ENC;
1384	ctl |= antenna;
1385	if (b43_is_cck_rate(rate))
1386		ctl |= B43_TXH_PHY_ENC_CCK;
1387	else
1388		ctl |= B43_TXH_PHY_ENC_OFDM;
1389	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1390
1391	/* Find the position of the TIM and the DTIM_period value
1392	 * and write them to SHM. */
1393	ie = bcn->u.beacon.variable;
1394	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1395	for (i = 0; i < variable_len - 2; ) {
1396		uint8_t ie_id, ie_len;
1397
1398		ie_id = ie[i];
1399		ie_len = ie[i + 1];
1400		if (ie_id == 5) {
1401			u16 tim_position;
1402			u16 dtim_period;
1403			/* This is the TIM Information Element */
1404
1405			/* Check whether the ie_len is in the beacon data range. */
1406			if (variable_len < ie_len + 2 + i)
1407				break;
1408			/* A valid TIM is at least 4 bytes long. */
1409			if (ie_len < 4)
1410				break;
1411			tim_found = 1;
1412
1413			tim_position = sizeof(struct b43_plcp_hdr6);
1414			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1415			tim_position += i;
1416
1417			dtim_period = ie[i + 3];
1418
1419			b43_shm_write16(dev, B43_SHM_SHARED,
1420					B43_SHM_SH_TIMBPOS, tim_position);
1421			b43_shm_write16(dev, B43_SHM_SHARED,
1422					B43_SHM_SH_DTIMPER, dtim_period);
1423			break;
1424		}
1425		i += ie_len + 2;
1426	}
1427	if (!tim_found) {
1428		/*
1429		 * If ucode wants to modify TIM do it behind the beacon, this
1430		 * will happen, for example, when doing mesh networking.
1431		 */
1432		b43_shm_write16(dev, B43_SHM_SHARED,
1433				B43_SHM_SH_TIMBPOS,
1434				len + sizeof(struct b43_plcp_hdr6));
1435		b43_shm_write16(dev, B43_SHM_SHARED,
1436				B43_SHM_SH_DTIMPER, 0);
1437	}
1438	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1439}
1440
1441static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1442				      u16 shm_offset, u16 size,
1443				      struct ieee80211_rate *rate)
1444{
1445	struct b43_plcp_hdr4 plcp;
1446	u32 tmp;
1447	__le16 dur;
1448
1449	plcp.data = 0;
1450	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1451	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1452					       dev->wl->vif, size,
1453					       rate);
1454	/* Write PLCP in two parts and timing for packet transfer */
1455	tmp = le32_to_cpu(plcp.data);
1456	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1457	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1458	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1459}
1460
1461/* Instead of using custom probe response template, this function
1462 * just patches custom beacon template by:
1463 * 1) Changing packet type
1464 * 2) Patching duration field
1465 * 3) Stripping TIM
1466 */
1467static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1468					  u16 *dest_size,
1469					  struct ieee80211_rate *rate)
1470{
1471	const u8 *src_data;
1472	u8 *dest_data;
1473	u16 src_size, elem_size, src_pos, dest_pos;
1474	__le16 dur;
1475	struct ieee80211_hdr *hdr;
1476	size_t ie_start;
1477
1478	src_size = dev->wl->current_beacon->len;
1479	src_data = (const u8 *)dev->wl->current_beacon->data;
1480
1481	/* Get the start offset of the variable IEs in the packet. */
1482	ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1483	B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1484
1485	if (B43_WARN_ON(src_size < ie_start))
1486		return NULL;
1487
1488	dest_data = kmalloc(src_size, GFP_ATOMIC);
1489	if (unlikely(!dest_data))
1490		return NULL;
1491
1492	/* Copy the static data and all Information Elements, except the TIM. */
1493	memcpy(dest_data, src_data, ie_start);
1494	src_pos = ie_start;
1495	dest_pos = ie_start;
1496	for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1497		elem_size = src_data[src_pos + 1] + 2;
1498		if (src_data[src_pos] == 5) {
1499			/* This is the TIM. */
1500			continue;
1501		}
1502		memcpy(dest_data + dest_pos, src_data + src_pos,
1503		       elem_size);
1504		dest_pos += elem_size;
1505	}
1506	*dest_size = dest_pos;
1507	hdr = (struct ieee80211_hdr *)dest_data;
1508
1509	/* Set the frame control. */
1510	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1511					 IEEE80211_STYPE_PROBE_RESP);
1512	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1513					       dev->wl->vif, *dest_size,
1514					       rate);
1515	hdr->duration_id = dur;
1516
1517	return dest_data;
1518}
1519
1520static void b43_write_probe_resp_template(struct b43_wldev *dev,
1521					  u16 ram_offset,
1522					  u16 shm_size_offset,
1523					  struct ieee80211_rate *rate)
1524{
1525	const u8 *probe_resp_data;
1526	u16 size;
1527
1528	size = dev->wl->current_beacon->len;
1529	probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1530	if (unlikely(!probe_resp_data))
1531		return;
1532
1533	/* Looks like PLCP headers plus packet timings are stored for
1534	 * all possible basic rates
1535	 */
1536	b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1537	b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1538	b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1539	b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1540
1541	size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1542	b43_write_template_common(dev, probe_resp_data,
1543				  size, ram_offset, shm_size_offset,
1544				  rate->hw_value);
1545	kfree(probe_resp_data);
1546}
1547
1548static void b43_upload_beacon0(struct b43_wldev *dev)
1549{
1550	struct b43_wl *wl = dev->wl;
1551
1552	if (wl->beacon0_uploaded)
1553		return;
1554	b43_write_beacon_template(dev, 0x68, 0x18);
1555	/* FIXME: Probe resp upload doesn't really belong here,
1556	 *        but we don't use that feature anyway. */
1557	b43_write_probe_resp_template(dev, 0x268, 0x4A,
1558				      &__b43_ratetable[3]);
1559	wl->beacon0_uploaded = 1;
1560}
1561
1562static void b43_upload_beacon1(struct b43_wldev *dev)
1563{
1564	struct b43_wl *wl = dev->wl;
1565
1566	if (wl->beacon1_uploaded)
1567		return;
1568	b43_write_beacon_template(dev, 0x468, 0x1A);
1569	wl->beacon1_uploaded = 1;
1570}
1571
1572static void handle_irq_beacon(struct b43_wldev *dev)
1573{
1574	struct b43_wl *wl = dev->wl;
1575	u32 cmd, beacon0_valid, beacon1_valid;
1576
1577	if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1578	    !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1579		return;
1580
1581	/* This is the bottom half of the asynchronous beacon update. */
1582
1583	/* Ignore interrupt in the future. */
1584	dev->irq_savedstate &= ~B43_IRQ_BEACON;
1585
1586	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1587	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1588	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1589
1590	/* Schedule interrupt manually, if busy. */
1591	if (beacon0_valid && beacon1_valid) {
1592		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1593		dev->irq_savedstate |= B43_IRQ_BEACON;
1594		return;
1595	}
1596
1597	if (unlikely(wl->beacon_templates_virgin)) {
1598		/* We never uploaded a beacon before.
1599		 * Upload both templates now, but only mark one valid. */
1600		wl->beacon_templates_virgin = 0;
1601		b43_upload_beacon0(dev);
1602		b43_upload_beacon1(dev);
1603		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1604		cmd |= B43_MACCMD_BEACON0_VALID;
1605		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1606	} else {
1607		if (!beacon0_valid) {
1608			b43_upload_beacon0(dev);
1609			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1610			cmd |= B43_MACCMD_BEACON0_VALID;
1611			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1612		} else if (!beacon1_valid) {
1613			b43_upload_beacon1(dev);
1614			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1615			cmd |= B43_MACCMD_BEACON1_VALID;
1616			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1617		}
1618	}
1619}
1620
1621static void b43_beacon_update_trigger_work(struct work_struct *work)
1622{
1623	struct b43_wl *wl = container_of(work, struct b43_wl,
1624					 beacon_update_trigger);
1625	struct b43_wldev *dev;
1626
1627	mutex_lock(&wl->mutex);
1628	dev = wl->current_dev;
1629	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1630		spin_lock_irq(&wl->irq_lock);
1631		/* update beacon right away or defer to irq */
1632		dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1633		handle_irq_beacon(dev);
1634		/* The handler might have updated the IRQ mask. */
1635		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1636			    dev->irq_savedstate);
1637		mmiowb();
1638		spin_unlock_irq(&wl->irq_lock);
1639	}
1640	mutex_unlock(&wl->mutex);
1641}
1642
1643/* Asynchronously update the packet templates in template RAM.
1644 * Locking: Requires wl->irq_lock to be locked. */
1645static void b43_update_templates(struct b43_wl *wl)
1646{
1647	struct sk_buff *beacon;
1648
1649	/* This is the top half of the ansynchronous beacon update.
1650	 * The bottom half is the beacon IRQ.
1651	 * Beacon update must be asynchronous to avoid sending an
1652	 * invalid beacon. This can happen for example, if the firmware
1653	 * transmits a beacon while we are updating it. */
1654
1655	/* We could modify the existing beacon and set the aid bit in
1656	 * the TIM field, but that would probably require resizing and
1657	 * moving of data within the beacon template.
1658	 * Simply request a new beacon and let mac80211 do the hard work. */
1659	beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1660	if (unlikely(!beacon))
1661		return;
1662
1663	if (wl->current_beacon)
1664		dev_kfree_skb_any(wl->current_beacon);
1665	wl->current_beacon = beacon;
1666	wl->beacon0_uploaded = 0;
1667	wl->beacon1_uploaded = 0;
1668	queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1669}
1670
1671static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1672{
1673	b43_time_lock(dev);
1674	if (dev->dev->id.revision >= 3) {
1675		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1676		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1677	} else {
1678		b43_write16(dev, 0x606, (beacon_int >> 6));
1679		b43_write16(dev, 0x610, beacon_int);
1680	}
1681	b43_time_unlock(dev);
1682	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1683}
1684
1685static void b43_handle_firmware_panic(struct b43_wldev *dev)
1686{
1687	u16 reason;
1688
1689	/* Read the register that contains the reason code for the panic. */
1690	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1691	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1692
1693	switch (reason) {
1694	default:
1695		b43dbg(dev->wl, "The panic reason is unknown.\n");
1696		/* fallthrough */
1697	case B43_FWPANIC_DIE:
1698		/* Do not restart the controller or firmware.
1699		 * The device is nonfunctional from now on.
1700		 * Restarting would result in this panic to trigger again,
1701		 * so we avoid that recursion. */
1702		break;
1703	case B43_FWPANIC_RESTART:
1704		b43_controller_restart(dev, "Microcode panic");
1705		break;
1706	}
1707}
1708
1709static void handle_irq_ucode_debug(struct b43_wldev *dev)
1710{
1711	unsigned int i, cnt;
1712	u16 reason, marker_id, marker_line;
1713	__le16 *buf;
1714
1715	/* The proprietary firmware doesn't have this IRQ. */
1716	if (!dev->fw.opensource)
1717		return;
1718
1719	/* Read the register that contains the reason code for this IRQ. */
1720	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1721
1722	switch (reason) {
1723	case B43_DEBUGIRQ_PANIC:
1724		b43_handle_firmware_panic(dev);
1725		break;
1726	case B43_DEBUGIRQ_DUMP_SHM:
1727		if (!B43_DEBUG)
1728			break; /* Only with driver debugging enabled. */
1729		buf = kmalloc(4096, GFP_ATOMIC);
1730		if (!buf) {
1731			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1732			goto out;
1733		}
1734		for (i = 0; i < 4096; i += 2) {
1735			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1736			buf[i / 2] = cpu_to_le16(tmp);
1737		}
1738		b43info(dev->wl, "Shared memory dump:\n");
1739		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1740			       16, 2, buf, 4096, 1);
1741		kfree(buf);
1742		break;
1743	case B43_DEBUGIRQ_DUMP_REGS:
1744		if (!B43_DEBUG)
1745			break; /* Only with driver debugging enabled. */
1746		b43info(dev->wl, "Microcode register dump:\n");
1747		for (i = 0, cnt = 0; i < 64; i++) {
1748			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1749			if (cnt == 0)
1750				printk(KERN_INFO);
1751			printk("r%02u: 0x%04X  ", i, tmp);
1752			cnt++;
1753			if (cnt == 6) {
1754				printk("\n");
1755				cnt = 0;
1756			}
1757		}
1758		printk("\n");
1759		break;
1760	case B43_DEBUGIRQ_MARKER:
1761		if (!B43_DEBUG)
1762			break; /* Only with driver debugging enabled. */
1763		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1764					   B43_MARKER_ID_REG);
1765		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1766					     B43_MARKER_LINE_REG);
1767		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1768			"at line number %u\n",
1769			marker_id, marker_line);
1770		break;
1771	default:
1772		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1773		       reason);
1774	}
1775out:
1776	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1777	b43_shm_write16(dev, B43_SHM_SCRATCH,
1778			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1779}
1780
1781/* Interrupt handler bottom-half */
1782static void b43_interrupt_tasklet(struct b43_wldev *dev)
1783{
1784	u32 reason;
1785	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1786	u32 merged_dma_reason = 0;
1787	int i;
1788	unsigned long flags;
1789
1790	spin_lock_irqsave(&dev->wl->irq_lock, flags);
1791
1792	B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1793
1794	reason = dev->irq_reason;
1795	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1796		dma_reason[i] = dev->dma_reason[i];
1797		merged_dma_reason |= dma_reason[i];
1798	}
1799
1800	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1801		b43err(dev->wl, "MAC transmission error\n");
1802
1803	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1804		b43err(dev->wl, "PHY transmission error\n");
1805		rmb();
1806		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1807			atomic_set(&dev->phy.txerr_cnt,
1808				   B43_PHY_TX_BADNESS_LIMIT);
1809			b43err(dev->wl, "Too many PHY TX errors, "
1810					"restarting the controller\n");
1811			b43_controller_restart(dev, "PHY TX errors");
1812		}
1813	}
1814
1815	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1816					  B43_DMAIRQ_NONFATALMASK))) {
1817		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1818			b43err(dev->wl, "Fatal DMA error: "
1819			       "0x%08X, 0x%08X, 0x%08X, "
1820			       "0x%08X, 0x%08X, 0x%08X\n",
1821			       dma_reason[0], dma_reason[1],
1822			       dma_reason[2], dma_reason[3],
1823			       dma_reason[4], dma_reason[5]);
1824			b43_controller_restart(dev, "DMA error");
1825			mmiowb();
1826			spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1827			return;
1828		}
1829		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1830			b43err(dev->wl, "DMA error: "
1831			       "0x%08X, 0x%08X, 0x%08X, "
1832			       "0x%08X, 0x%08X, 0x%08X\n",
1833			       dma_reason[0], dma_reason[1],
1834			       dma_reason[2], dma_reason[3],
1835			       dma_reason[4], dma_reason[5]);
1836		}
1837	}
1838
1839	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1840		handle_irq_ucode_debug(dev);
1841	if (reason & B43_IRQ_TBTT_INDI)
1842		handle_irq_tbtt_indication(dev);
1843	if (reason & B43_IRQ_ATIM_END)
1844		handle_irq_atim_end(dev);
1845	if (reason & B43_IRQ_BEACON)
1846		handle_irq_beacon(dev);
1847	if (reason & B43_IRQ_PMQ)
1848		handle_irq_pmq(dev);
1849	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1850		;/* TODO */
1851	if (reason & B43_IRQ_NOISESAMPLE_OK)
1852		handle_irq_noise(dev);
1853
1854	/* Check the DMA reason registers for received data. */
1855	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1856		if (b43_using_pio_transfers(dev))
1857			b43_pio_rx(dev->pio.rx_queue);
1858		else
1859			b43_dma_rx(dev->dma.rx_ring);
1860	}
1861	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1862	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1863	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1864	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1865	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1866
1867	if (reason & B43_IRQ_TX_OK)
1868		handle_irq_transmit_status(dev);
1869
1870	b43_interrupt_enable(dev, dev->irq_savedstate);
1871	mmiowb();
1872	spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1873}
1874
1875static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1876{
1877	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1878
1879	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1880	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1881	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1882	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1883	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1884	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1885}
1886
1887/* Interrupt handler top-half */
1888static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1889{
1890	irqreturn_t ret = IRQ_NONE;
1891	struct b43_wldev *dev = dev_id;
1892	u32 reason;
1893
1894	if (!dev)
1895		return IRQ_NONE;
1896
1897	spin_lock(&dev->wl->irq_lock);
1898
1899	if (b43_status(dev) < B43_STAT_STARTED)
1900		goto out;
1901	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1902	if (reason == 0xffffffff)	/* shared IRQ */
1903		goto out;
1904	ret = IRQ_HANDLED;
1905	reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1906	if (!reason)
1907		goto out;
1908
1909	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1910	    & 0x0001DC00;
1911	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1912	    & 0x0000DC00;
1913	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1914	    & 0x0000DC00;
1915	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1916	    & 0x0001DC00;
1917	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1918	    & 0x0000DC00;
1919	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1920	    & 0x0000DC00;
1921
1922	b43_interrupt_ack(dev, reason);
1923	/* disable all IRQs. They are enabled again in the bottom half. */
1924	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1925	/* save the reason code and call our bottom half. */
1926	dev->irq_reason = reason;
1927	tasklet_schedule(&dev->isr_tasklet);
1928      out:
1929	mmiowb();
1930	spin_unlock(&dev->wl->irq_lock);
1931
1932	return ret;
1933}
1934
1935static void do_release_fw(struct b43_firmware_file *fw)
1936{
1937	release_firmware(fw->data);
1938	fw->data = NULL;
1939	fw->filename = NULL;
1940}
1941
1942static void b43_release_firmware(struct b43_wldev *dev)
1943{
1944	do_release_fw(&dev->fw.ucode);
1945	do_release_fw(&dev->fw.pcm);
1946	do_release_fw(&dev->fw.initvals);
1947	do_release_fw(&dev->fw.initvals_band);
1948}
1949
1950static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1951{
1952	const char *text;
1953
1954	text = "You must go to "
1955	       "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1956	       "and download the latest firmware (version 4).\n";
1957	if (error)
1958		b43err(wl, text);
1959	else
1960		b43warn(wl, text);
1961}
1962
1963static int do_request_fw(struct b43_wldev *dev,
1964			 const char *name,
1965			 struct b43_firmware_file *fw,
1966			 bool silent)
1967{
1968	char path[sizeof(modparam_fwpostfix) + 32];
1969	const struct firmware *blob;
1970	struct b43_fw_header *hdr;
1971	u32 size;
1972	int err;
1973
1974	if (!name) {
1975		/* Don't fetch anything. Free possibly cached firmware. */
1976		do_release_fw(fw);
1977		return 0;
1978	}
1979	if (fw->filename) {
1980		if (strcmp(fw->filename, name) == 0)
1981			return 0; /* Already have this fw. */
1982		/* Free the cached firmware first. */
1983		do_release_fw(fw);
1984	}
1985
1986	snprintf(path, ARRAY_SIZE(path),
1987		 "b43%s/%s.fw",
1988		 modparam_fwpostfix, name);
1989	err = request_firmware(&blob, path, dev->dev->dev);
1990	if (err == -ENOENT) {
1991		if (!silent) {
1992			b43err(dev->wl, "Firmware file \"%s\" not found\n",
1993			       path);
1994		}
1995		return err;
1996	} else if (err) {
1997		b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
1998		       path, err);
1999		return err;
2000	}
2001	if (blob->size < sizeof(struct b43_fw_header))
2002		goto err_format;
2003	hdr = (struct b43_fw_header *)(blob->data);
2004	switch (hdr->type) {
2005	case B43_FW_TYPE_UCODE:
2006	case B43_FW_TYPE_PCM:
2007		size = be32_to_cpu(hdr->size);
2008		if (size != blob->size - sizeof(struct b43_fw_header))
2009			goto err_format;
2010		/* fallthrough */
2011	case B43_FW_TYPE_IV:
2012		if (hdr->ver != 1)
2013			goto err_format;
2014		break;
2015	default:
2016		goto err_format;
2017	}
2018
2019	fw->data = blob;
2020	fw->filename = name;
2021
2022	return 0;
2023
2024err_format:
2025	b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2026	release_firmware(blob);
2027
2028	return -EPROTO;
2029}
2030
2031static int b43_request_firmware(struct b43_wldev *dev)
2032{
2033	struct b43_firmware *fw = &dev->fw;
2034	const u8 rev = dev->dev->id.revision;
2035	const char *filename;
2036	u32 tmshigh;
2037	int err;
2038
2039	/* Get microcode */
2040	tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2041	if ((rev >= 5) && (rev <= 10))
2042		filename = "ucode5";
2043	else if ((rev >= 11) && (rev <= 12))
2044		filename = "ucode11";
2045	else if (rev >= 13)
2046		filename = "ucode13";
2047	else
2048		goto err_no_ucode;
2049	err = do_request_fw(dev, filename, &fw->ucode, 0);
2050	if (err)
2051		goto err_load;
2052
2053	/* Get PCM code */
2054	if ((rev >= 5) && (rev <= 10))
2055		filename = "pcm5";
2056	else if (rev >= 11)
2057		filename = NULL;
2058	else
2059		goto err_no_pcm;
2060	fw->pcm_request_failed = 0;
2061	err = do_request_fw(dev, filename, &fw->pcm, 1);
2062	if (err == -ENOENT) {
2063		/* We did not find a PCM file? Not fatal, but
2064		 * core rev <= 10 must do without hwcrypto then. */
2065		fw->pcm_request_failed = 1;
2066	} else if (err)
2067		goto err_load;
2068
2069	/* Get initvals */
2070	switch (dev->phy.type) {
2071	case B43_PHYTYPE_A:
2072		if ((rev >= 5) && (rev <= 10)) {
2073			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2074				filename = "a0g1initvals5";
2075			else
2076				filename = "a0g0initvals5";
2077		} else
2078			goto err_no_initvals;
2079		break;
2080	case B43_PHYTYPE_G:
2081		if ((rev >= 5) && (rev <= 10))
2082			filename = "b0g0initvals5";
2083		else if (rev >= 13)
2084			filename = "b0g0initvals13";
2085		else
2086			goto err_no_initvals;
2087		break;
2088	case B43_PHYTYPE_N:
2089		if ((rev >= 11) && (rev <= 12))
2090			filename = "n0initvals11";
2091		else
2092			goto err_no_initvals;
2093		break;
2094	default:
2095		goto err_no_initvals;
2096	}
2097	err = do_request_fw(dev, filename, &fw->initvals, 0);
2098	if (err)
2099		goto err_load;
2100
2101	/* Get bandswitch initvals */
2102	switch (dev->phy.type) {
2103	case B43_PHYTYPE_A:
2104		if ((rev >= 5) && (rev <= 10)) {
2105			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2106				filename = "a0g1bsinitvals5";
2107			else
2108				filename = "a0g0bsinitvals5";
2109		} else if (rev >= 11)
2110			filename = NULL;
2111		else
2112			goto err_no_initvals;
2113		break;
2114	case B43_PHYTYPE_G:
2115		if ((rev >= 5) && (rev <= 10))
2116			filename = "b0g0bsinitvals5";
2117		else if (rev >= 11)
2118			filename = NULL;
2119		else
2120			goto err_no_initvals;
2121		break;
2122	case B43_PHYTYPE_N:
2123		if ((rev >= 11) && (rev <= 12))
2124			filename = "n0bsinitvals11";
2125		else
2126			goto err_no_initvals;
2127		break;
2128	default:
2129		goto err_no_initvals;
2130	}
2131	err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2132	if (err)
2133		goto err_load;
2134
2135	return 0;
2136
2137err_load:
2138	b43_print_fw_helptext(dev->wl, 1);
2139	goto error;
2140
2141err_no_ucode:
2142	err = -ENODEV;
2143	b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2144	goto error;
2145
2146err_no_pcm:
2147	err = -ENODEV;
2148	b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2149	goto error;
2150
2151err_no_initvals:
2152	err = -ENODEV;
2153	b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2154	       "core rev %u\n", dev->phy.type, rev);
2155	goto error;
2156
2157error:
2158	b43_release_firmware(dev);
2159	return err;
2160}
2161
2162static int b43_upload_microcode(struct b43_wldev *dev)
2163{
2164	const size_t hdr_len = sizeof(struct b43_fw_header);
2165	const __be32 *data;
2166	unsigned int i, len;
2167	u16 fwrev, fwpatch, fwdate, fwtime;
2168	u32 tmp, macctl;
2169	int err = 0;
2170
2171	/* Jump the microcode PSM to offset 0 */
2172	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2173	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2174	macctl |= B43_MACCTL_PSM_JMP0;
2175	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2176	/* Zero out all microcode PSM registers and shared memory. */
2177	for (i = 0; i < 64; i++)
2178		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2179	for (i = 0; i < 4096; i += 2)
2180		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2181
2182	/* Upload Microcode. */
2183	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2184	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2185	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2186	for (i = 0; i < len; i++) {
2187		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2188		udelay(10);
2189	}
2190
2191	if (dev->fw.pcm.data) {
2192		/* Upload PCM data. */
2193		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2194		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2195		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2196		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2197		/* No need for autoinc bit in SHM_HW */
2198		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2199		for (i = 0; i < len; i++) {
2200			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2201			udelay(10);
2202		}
2203	}
2204
2205	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2206
2207	/* Start the microcode PSM */
2208	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2209	macctl &= ~B43_MACCTL_PSM_JMP0;
2210	macctl |= B43_MACCTL_PSM_RUN;
2211	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2212
2213	/* Wait for the microcode to load and respond */
2214	i = 0;
2215	while (1) {
2216		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2217		if (tmp == B43_IRQ_MAC_SUSPENDED)
2218			break;
2219		i++;
2220		if (i >= 20) {
2221			b43err(dev->wl, "Microcode not responding\n");
2222			b43_print_fw_helptext(dev->wl, 1);
2223			err = -ENODEV;
2224			goto error;
2225		}
2226		msleep_interruptible(50);
2227		if (signal_pending(current)) {
2228			err = -EINTR;
2229			goto error;
2230		}
2231	}
2232	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2233
2234	/* Get and check the revisions. */
2235	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2236	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2237	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2238	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2239
2240	if (fwrev <= 0x128) {
2241		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2242		       "binary drivers older than version 4.x is unsupported. "
2243		       "You must upgrade your firmware files.\n");
2244		b43_print_fw_helptext(dev->wl, 1);
2245		err = -EOPNOTSUPP;
2246		goto error;
2247	}
2248	dev->fw.rev = fwrev;
2249	dev->fw.patch = fwpatch;
2250	dev->fw.opensource = (fwdate == 0xFFFF);
2251
2252	if (dev->fw.opensource) {
2253		/* Patchlevel info is encoded in the "time" field. */
2254		dev->fw.patch = fwtime;
2255		b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2256			dev->fw.rev, dev->fw.patch,
2257			dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2258	} else {
2259		b43info(dev->wl, "Loading firmware version %u.%u "
2260			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2261			fwrev, fwpatch,
2262			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2263			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2264		if (dev->fw.pcm_request_failed) {
2265			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2266				"Hardware accelerated cryptography is disabled.\n");
2267			b43_print_fw_helptext(dev->wl, 0);
2268		}
2269	}
2270
2271	if (b43_is_old_txhdr_format(dev)) {
2272		b43warn(dev->wl, "You are using an old firmware image. "
2273			"Support for old firmware will be removed in July 2008.\n");
2274		b43_print_fw_helptext(dev->wl, 0);
2275	}
2276
2277	return 0;
2278
2279error:
2280	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2281	macctl &= ~B43_MACCTL_PSM_RUN;
2282	macctl |= B43_MACCTL_PSM_JMP0;
2283	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2284
2285	return err;
2286}
2287
2288static int b43_write_initvals(struct b43_wldev *dev,
2289			      const struct b43_iv *ivals,
2290			      size_t count,
2291			      size_t array_size)
2292{
2293	const struct b43_iv *iv;
2294	u16 offset;
2295	size_t i;
2296	bool bit32;
2297
2298	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2299	iv = ivals;
2300	for (i = 0; i < count; i++) {
2301		if (array_size < sizeof(iv->offset_size))
2302			goto err_format;
2303		array_size -= sizeof(iv->offset_size);
2304		offset = be16_to_cpu(iv->offset_size);
2305		bit32 = !!(offset & B43_IV_32BIT);
2306		offset &= B43_IV_OFFSET_MASK;
2307		if (offset >= 0x1000)
2308			goto err_format;
2309		if (bit32) {
2310			u32 value;
2311
2312			if (array_size < sizeof(iv->data.d32))
2313				goto err_format;
2314			array_size -= sizeof(iv->data.d32);
2315
2316			value = get_unaligned_be32(&iv->data.d32);
2317			b43_write32(dev, offset, value);
2318
2319			iv = (const struct b43_iv *)((const uint8_t *)iv +
2320							sizeof(__be16) +
2321							sizeof(__be32));
2322		} else {
2323			u16 value;
2324
2325			if (array_size < sizeof(iv->data.d16))
2326				goto err_format;
2327			array_size -= sizeof(iv->data.d16);
2328
2329			value = be16_to_cpu(iv->data.d16);
2330			b43_write16(dev, offset, value);
2331
2332			iv = (const struct b43_iv *)((const uint8_t *)iv +
2333							sizeof(__be16) +
2334							sizeof(__be16));
2335		}
2336	}
2337	if (array_size)
2338		goto err_format;
2339
2340	return 0;
2341
2342err_format:
2343	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2344	b43_print_fw_helptext(dev->wl, 1);
2345
2346	return -EPROTO;
2347}
2348
2349static int b43_upload_initvals(struct b43_wldev *dev)
2350{
2351	const size_t hdr_len = sizeof(struct b43_fw_header);
2352	const struct b43_fw_header *hdr;
2353	struct b43_firmware *fw = &dev->fw;
2354	const struct b43_iv *ivals;
2355	size_t count;
2356	int err;
2357
2358	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2359	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2360	count = be32_to_cpu(hdr->size);
2361	err = b43_write_initvals(dev, ivals, count,
2362				 fw->initvals.data->size - hdr_len);
2363	if (err)
2364		goto out;
2365	if (fw->initvals_band.data) {
2366		hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2367		ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2368		count = be32_to_cpu(hdr->size);
2369		err = b43_write_initvals(dev, ivals, count,
2370					 fw->initvals_band.data->size - hdr_len);
2371		if (err)
2372			goto out;
2373	}
2374out:
2375
2376	return err;
2377}
2378
2379/* Initialize the GPIOs
2380 * http://bcm-specs.sipsolutions.net/GPIO
2381 */
2382static int b43_gpio_init(struct b43_wldev *dev)
2383{
2384	struct ssb_bus *bus = dev->dev->bus;
2385	struct ssb_device *gpiodev, *pcidev = NULL;
2386	u32 mask, set;
2387
2388	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2389		    & ~B43_MACCTL_GPOUTSMSK);
2390
2391	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2392		    | 0x000F);
2393
2394	mask = 0x0000001F;
2395	set = 0x0000000F;
2396	if (dev->dev->bus->chip_id == 0x4301) {
2397		mask |= 0x0060;
2398		set |= 0x0060;
2399	}
2400	if (0 /* FIXME: conditional unknown */ ) {
2401		b43_write16(dev, B43_MMIO_GPIO_MASK,
2402			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2403			    | 0x0100);
2404		mask |= 0x0180;
2405		set |= 0x0180;
2406	}
2407	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2408		b43_write16(dev, B43_MMIO_GPIO_MASK,
2409			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2410			    | 0x0200);
2411		mask |= 0x0200;
2412		set |= 0x0200;
2413	}
2414	if (dev->dev->id.revision >= 2)
2415		mask |= 0x0010;	/* FIXME: This is redundant. */
2416
2417#ifdef CONFIG_SSB_DRIVER_PCICORE
2418	pcidev = bus->pcicore.dev;
2419#endif
2420	gpiodev = bus->chipco.dev ? : pcidev;
2421	if (!gpiodev)
2422		return 0;
2423	ssb_write32(gpiodev, B43_GPIO_CONTROL,
2424		    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2425		     & mask) | set);
2426
2427	return 0;
2428}
2429
2430/* Turn off all GPIO stuff. Call this on module unload, for example. */
2431static void b43_gpio_cleanup(struct b43_wldev *dev)
2432{
2433	struct ssb_bus *bus = dev->dev->bus;
2434	struct ssb_device *gpiodev, *pcidev = NULL;
2435
2436#ifdef CONFIG_SSB_DRIVER_PCICORE
2437	pcidev = bus->pcicore.dev;
2438#endif
2439	gpiodev = bus->chipco.dev ? : pcidev;
2440	if (!gpiodev)
2441		return;
2442	ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2443}
2444
2445/* http://bcm-specs.sipsolutions.net/EnableMac */
2446void b43_mac_enable(struct b43_wldev *dev)
2447{
2448	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2449		u16 fwstate;
2450
2451		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2452					 B43_SHM_SH_UCODESTAT);
2453		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2454		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2455			b43err(dev->wl, "b43_mac_enable(): The firmware "
2456			       "should be suspended, but current state is %u\n",
2457			       fwstate);
2458		}
2459	}
2460
2461	dev->mac_suspended--;
2462	B43_WARN_ON(dev->mac_suspended < 0);
2463	if (dev->mac_suspended == 0) {
2464		b43_write32(dev, B43_MMIO_MACCTL,
2465			    b43_read32(dev, B43_MMIO_MACCTL)
2466			    | B43_MACCTL_ENABLED);
2467		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2468			    B43_IRQ_MAC_SUSPENDED);
2469		/* Commit writes */
2470		b43_read32(dev, B43_MMIO_MACCTL);
2471		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2472		b43_power_saving_ctl_bits(dev, 0);
2473	}
2474}
2475
2476/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2477void b43_mac_suspend(struct b43_wldev *dev)
2478{
2479	int i;
2480	u32 tmp;
2481
2482	might_sleep();
2483	B43_WARN_ON(dev->mac_suspended < 0);
2484
2485	if (dev->mac_suspended == 0) {
2486		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2487		b43_write32(dev, B43_MMIO_MACCTL,
2488			    b43_read32(dev, B43_MMIO_MACCTL)
2489			    & ~B43_MACCTL_ENABLED);
2490		/* force pci to flush the write */
2491		b43_read32(dev, B43_MMIO_MACCTL);
2492		for (i = 35; i; i--) {
2493			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2494			if (tmp & B43_IRQ_MAC_SUSPENDED)
2495				goto out;
2496			udelay(10);
2497		}
2498		/* Hm, it seems this will take some time. Use msleep(). */
2499		for (i = 40; i; i--) {
2500			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2501			if (tmp & B43_IRQ_MAC_SUSPENDED)
2502				goto out;
2503			msleep(1);
2504		}
2505		b43err(dev->wl, "MAC suspend failed\n");
2506	}
2507out:
2508	dev->mac_suspended++;
2509}
2510
2511static void b43_adjust_opmode(struct b43_wldev *dev)
2512{
2513	struct b43_wl *wl = dev->wl;
2514	u32 ctl;
2515	u16 cfp_pretbtt;
2516
2517	ctl = b43_read32(dev, B43_MMIO_MACCTL);
2518	/* Reset status to STA infrastructure mode. */
2519	ctl &= ~B43_MACCTL_AP;
2520	ctl &= ~B43_MACCTL_KEEP_CTL;
2521	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2522	ctl &= ~B43_MACCTL_KEEP_BAD;
2523	ctl &= ~B43_MACCTL_PROMISC;
2524	ctl &= ~B43_MACCTL_BEACPROMISC;
2525	ctl |= B43_MACCTL_INFRA;
2526
2527	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2528	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2529		ctl |= B43_MACCTL_AP;
2530	else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2531		ctl &= ~B43_MACCTL_INFRA;
2532
2533	if (wl->filter_flags & FIF_CONTROL)
2534		ctl |= B43_MACCTL_KEEP_CTL;
2535	if (wl->filter_flags & FIF_FCSFAIL)
2536		ctl |= B43_MACCTL_KEEP_BAD;
2537	if (wl->filter_flags & FIF_PLCPFAIL)
2538		ctl |= B43_MACCTL_KEEP_BADPLCP;
2539	if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2540		ctl |= B43_MACCTL_PROMISC;
2541	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2542		ctl |= B43_MACCTL_BEACPROMISC;
2543
2544	/* Workaround: On old hardware the HW-MAC-address-filter
2545	 * doesn't work properly, so always run promisc in filter
2546	 * it in software. */
2547	if (dev->dev->id.revision <= 4)
2548		ctl |= B43_MACCTL_PROMISC;
2549
2550	b43_write32(dev, B43_MMIO_MACCTL, ctl);
2551
2552	cfp_pretbtt = 2;
2553	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2554		if (dev->dev->bus->chip_id == 0x4306 &&
2555		    dev->dev->bus->chip_rev == 3)
2556			cfp_pretbtt = 100;
2557		else
2558			cfp_pretbtt = 50;
2559	}
2560	b43_write16(dev, 0x612, cfp_pretbtt);
2561}
2562
2563static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2564{
2565	u16 offset;
2566
2567	if (is_ofdm) {
2568		offset = 0x480;
2569		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2570	} else {
2571		offset = 0x4C0;
2572		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2573	}
2574	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2575			b43_shm_read16(dev, B43_SHM_SHARED, offset));
2576}
2577
2578static void b43_rate_memory_init(struct b43_wldev *dev)
2579{
2580	switch (dev->phy.type) {
2581	case B43_PHYTYPE_A:
2582	case B43_PHYTYPE_G:
2583	case B43_PHYTYPE_N:
2584		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2585		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2586		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2587		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2588		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2589		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2590		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2591		if (dev->phy.type == B43_PHYTYPE_A)
2592			break;
2593		/* fallthrough */
2594	case B43_PHYTYPE_B:
2595		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2596		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2597		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2598		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2599		break;
2600	default:
2601		B43_WARN_ON(1);
2602	}
2603}
2604
2605/* Set the default values for the PHY TX Control Words. */
2606static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2607{
2608	u16 ctl = 0;
2609
2610	ctl |= B43_TXH_PHY_ENC_CCK;
2611	ctl |= B43_TXH_PHY_ANT01AUTO;
2612	ctl |= B43_TXH_PHY_TXPWR;
2613
2614	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2615	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2616	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2617}
2618
2619/* Set the TX-Antenna for management frames sent by firmware. */
2620static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2621{
2622	u16 ant;
2623	u16 tmp;
2624
2625	ant = b43_antenna_to_phyctl(antenna);
2626
2627	/* For ACK/CTS */
2628	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2629	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2630	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2631	/* For Probe Resposes */
2632	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2633	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2634	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2635}
2636
2637/* This is the opposite of b43_chip_init() */
2638static void b43_chip_exit(struct b43_wldev *dev)
2639{
2640	b43_phy_exit(dev);
2641	b43_gpio_cleanup(dev);
2642	/* firmware is released later */
2643}
2644
2645/* Initialize the chip
2646 * http://bcm-specs.sipsolutions.net/ChipInit
2647 */
2648static int b43_chip_init(struct b43_wldev *dev)
2649{
2650	struct b43_phy *phy = &dev->phy;
2651	int err;
2652	u32 value32, macctl;
2653	u16 value16;
2654
2655	/* Initialize the MAC control */
2656	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2657	if (dev->phy.gmode)
2658		macctl |= B43_MACCTL_GMODE;
2659	macctl |= B43_MACCTL_INFRA;
2660	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2661
2662	err = b43_request_firmware(dev);
2663	if (err)
2664		goto out;
2665	err = b43_upload_microcode(dev);
2666	if (err)
2667		goto out;	/* firmware is released later */
2668
2669	err = b43_gpio_init(dev);
2670	if (err)
2671		goto out;	/* firmware is released later */
2672
2673	err = b43_upload_initvals(dev);
2674	if (err)
2675		goto err_gpio_clean;
2676
2677	/* Turn the Analog on and initialize the PHY. */
2678	phy->ops->switch_analog(dev, 1);
2679	err = b43_phy_init(dev);
2680	if (err)
2681		goto err_gpio_clean;
2682
2683	/* Disable Interference Mitigation. */
2684	if (phy->ops->interf_mitigation)
2685		phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2686
2687	/* Select the antennae */
2688	if (phy->ops->set_rx_antenna)
2689		phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2690	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2691
2692	if (phy->type == B43_PHYTYPE_B) {
2693		value16 = b43_read16(dev, 0x005E);
2694		value16 |= 0x0004;
2695		b43_write16(dev, 0x005E, value16);
2696	}
2697	b43_write32(dev, 0x0100, 0x01000000);
2698	if (dev->dev->id.revision < 5)
2699		b43_write32(dev, 0x010C, 0x01000000);
2700
2701	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2702		    & ~B43_MACCTL_INFRA);
2703	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2704		    | B43_MACCTL_INFRA);
2705
2706	/* Probe Response Timeout value */
2707	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2708	b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2709
2710	/* Initially set the wireless operation mode. */
2711	b43_adjust_opmode(dev);
2712
2713	if (dev->dev->id.revision < 3) {
2714		b43_write16(dev, 0x060E, 0x0000);
2715		b43_write16(dev, 0x0610, 0x8000);
2716		b43_write16(dev, 0x0604, 0x0000);
2717		b43_write16(dev, 0x0606, 0x0200);
2718	} else {
2719		b43_write32(dev, 0x0188, 0x80000000);
2720		b43_write32(dev, 0x018C, 0x02000000);
2721	}
2722	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2723	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2724	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2725	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2726	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2727	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2728	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2729
2730	value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2731	value32 |= 0x00100000;
2732	ssb_write32(dev->dev, SSB_TMSLOW, value32);
2733
2734	b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2735		    dev->dev->bus->chipco.fast_pwrup_delay);
2736
2737	err = 0;
2738	b43dbg(dev->wl, "Chip initialized\n");
2739out:
2740	return err;
2741
2742err_gpio_clean:
2743	b43_gpio_cleanup(dev);
2744	return err;
2745}
2746
2747static void b43_periodic_every60sec(struct b43_wldev *dev)
2748{
2749	const struct b43_phy_operations *ops = dev->phy.ops;
2750
2751	if (ops->pwork_60sec)
2752		ops->pwork_60sec(dev);
2753
2754	/* Force check the TX power emission now. */
2755	b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2756}
2757
2758static void b43_periodic_every30sec(struct b43_wldev *dev)
2759{
2760	/* Update device statistics. */
2761	b43_calculate_link_quality(dev);
2762}
2763
2764static void b43_periodic_every15sec(struct b43_wldev *dev)
2765{
2766	struct b43_phy *phy = &dev->phy;
2767	u16 wdr;
2768
2769	if (dev->fw.opensource) {
2770		/* Check if the firmware is still alive.
2771		 * It will reset the watchdog counter to 0 in its idle loop. */
2772		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2773		if (unlikely(wdr)) {
2774			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2775			b43_controller_restart(dev, "Firmware watchdog");
2776			return;
2777		} else {
2778			b43_shm_write16(dev, B43_SHM_SCRATCH,
2779					B43_WATCHDOG_REG, 1);
2780		}
2781	}
2782
2783	if (phy->ops->pwork_15sec)
2784		phy->ops->pwork_15sec(dev);
2785
2786	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2787	wmb();
2788}
2789
2790static void do_periodic_work(struct b43_wldev *dev)
2791{
2792	unsigned int state;
2793
2794	state = dev->periodic_state;
2795	if (state % 4 == 0)
2796		b43_periodic_every60sec(dev);
2797	if (state % 2 == 0)
2798		b43_periodic_every30sec(dev);
2799	b43_periodic_every15sec(dev);
2800}
2801
2802/* Periodic work locking policy:
2803 * 	The whole periodic work handler is protected by
2804 * 	wl->mutex. If another lock is needed somewhere in the
2805 * 	pwork callchain, it's aquired in-place, where it's needed.
2806 */
2807static void b43_periodic_work_handler(struct work_struct *work)
2808{
2809	struct b43_wldev *dev = container_of(work, struct b43_wldev,
2810					     periodic_work.work);
2811	struct b43_wl *wl = dev->wl;
2812	unsigned long delay;
2813
2814	mutex_lock(&wl->mutex);
2815
2816	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2817		goto out;
2818	if (b43_debug(dev, B43_DBG_PWORK_STOP))
2819		goto out_requeue;
2820
2821	do_periodic_work(dev);
2822
2823	dev->periodic_state++;
2824out_requeue:
2825	if (b43_debug(dev, B43_DBG_PWORK_FAST))
2826		delay = msecs_to_jiffies(50);
2827	else
2828		delay = round_jiffies_relative(HZ * 15);
2829	queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2830out:
2831	mutex_unlock(&wl->mutex);
2832}
2833
2834static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2835{
2836	struct delayed_work *work = &dev->periodic_work;
2837
2838	dev->periodic_state = 0;
2839	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2840	queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2841}
2842
2843/* Check if communication with the device works correctly. */
2844static int b43_validate_chipaccess(struct b43_wldev *dev)
2845{
2846	u32 v, backup;
2847
2848	backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2849
2850	/* Check for read/write and endianness problems. */
2851	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2852	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2853		goto error;
2854	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2855	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2856		goto error;
2857
2858	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2859
2860	if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2861		/* The 32bit register shadows the two 16bit registers
2862		 * with update sideeffects. Validate this. */
2863		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2864		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2865		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2866			goto error;
2867		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2868			goto error;
2869	}
2870	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2871
2872	v = b43_read32(dev, B43_MMIO_MACCTL);
2873	v |= B43_MACCTL_GMODE;
2874	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2875		goto error;
2876
2877	return 0;
2878error:
2879	b43err(dev->wl, "Failed to validate the chipaccess\n");
2880	return -ENODEV;
2881}
2882
2883static void b43_security_init(struct b43_wldev *dev)
2884{
2885	dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2886	B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2887	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2888	/* KTP is a word address, but we address SHM bytewise.
2889	 * So multiply by two.
2890	 */
2891	dev->ktp *= 2;
2892	if (dev->dev->id.revision >= 5) {
2893		/* Number of RCMTA address slots */
2894		b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2895	}
2896	b43_clear_keys(dev);
2897}
2898
2899static int b43_rng_read(struct hwrng *rng, u32 * data)
2900{
2901	struct b43_wl *wl = (struct b43_wl *)rng->priv;
2902	unsigned long flags;
2903
2904	/* Don't take wl->mutex here, as it could deadlock with
2905	 * hwrng internal locking. It's not needed to take
2906	 * wl->mutex here, anyway. */
2907
2908	spin_lock_irqsave(&wl->irq_lock, flags);
2909	*data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2910	spin_unlock_irqrestore(&wl->irq_lock, flags);
2911
2912	return (sizeof(u16));
2913}
2914
2915static void b43_rng_exit(struct b43_wl *wl)
2916{
2917	if (wl->rng_initialized)
2918		hwrng_unregister(&wl->rng);
2919}
2920
2921static int b43_rng_init(struct b43_wl *wl)
2922{
2923	int err;
2924
2925	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2926		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2927	wl->rng.name = wl->rng_name;
2928	wl->rng.data_read = b43_rng_read;
2929	wl->rng.priv = (unsigned long)wl;
2930	wl->rng_initialized = 1;
2931	err = hwrng_register(&wl->rng);
2932	if (err) {
2933		wl->rng_initialized = 0;
2934		b43err(wl, "Failed to register the random "
2935		       "number generator (%d)\n", err);
2936	}
2937
2938	return err;
2939}
2940
2941static int b43_op_tx(struct ieee80211_hw *hw,
2942		     struct sk_buff *skb)
2943{
2944	struct b43_wl *wl = hw_to_b43_wl(hw);
2945	struct b43_wldev *dev = wl->current_dev;
2946	unsigned long flags;
2947	int err;
2948
2949	if (unlikely(skb->len < 2 + 2 + 6)) {
2950		/* Too short, this can't be a valid frame. */
2951		goto drop_packet;
2952	}
2953	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2954	if (unlikely(!dev))
2955		goto drop_packet;
2956
2957	/* Transmissions on seperate queues can run concurrently. */
2958	read_lock_irqsave(&wl->tx_lock, flags);
2959
2960	err = -ENODEV;
2961	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2962		if (b43_using_pio_transfers(dev))
2963			err = b43_pio_tx(dev, skb);
2964		else
2965			err = b43_dma_tx(dev, skb);
2966	}
2967
2968	read_unlock_irqrestore(&wl->tx_lock, flags);
2969
2970	if (unlikely(err))
2971		goto drop_packet;
2972	return NETDEV_TX_OK;
2973
2974drop_packet:
2975	/* We can not transmit this packet. Drop it. */
2976	dev_kfree_skb_any(skb);
2977	return NETDEV_TX_OK;
2978}
2979
2980/* Locking: wl->irq_lock */
2981static void b43_qos_params_upload(struct b43_wldev *dev,
2982				  const struct ieee80211_tx_queue_params *p,
2983				  u16 shm_offset)
2984{
2985	u16 params[B43_NR_QOSPARAMS];
2986	int bslots, tmp;
2987	unsigned int i;
2988
2989	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
2990
2991	memset(&params, 0, sizeof(params));
2992
2993	params[B43_QOSPARAM_TXOP] = p->txop * 32;
2994	params[B43_QOSPARAM_CWMIN] = p->cw_min;
2995	params[B43_QOSPARAM_CWMAX] = p->cw_max;
2996	params[B43_QOSPARAM_CWCUR] = p->cw_min;
2997	params[B43_QOSPARAM_AIFS] = p->aifs;
2998	params[B43_QOSPARAM_BSLOTS] = bslots;
2999	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3000
3001	for (i = 0; i < ARRAY_SIZE(params); i++) {
3002		if (i == B43_QOSPARAM_STATUS) {
3003			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3004					     shm_offset + (i * 2));
3005			/* Mark the parameters as updated. */
3006			tmp |= 0x100;
3007			b43_shm_write16(dev, B43_SHM_SHARED,
3008					shm_offset + (i * 2),
3009					tmp);
3010		} else {
3011			b43_shm_write16(dev, B43_SHM_SHARED,
3012					shm_offset + (i * 2),
3013					params[i]);
3014		}
3015	}
3016}
3017
3018/* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3019static const u16 b43_qos_shm_offsets[] = {
3020	/* [mac80211-queue-nr] = SHM_OFFSET, */
3021	[0] = B43_QOS_VOICE,
3022	[1] = B43_QOS_VIDEO,
3023	[2] = B43_QOS_BESTEFFORT,
3024	[3] = B43_QOS_BACKGROUND,
3025};
3026
3027/* Update all QOS parameters in hardware. */
3028static void b43_qos_upload_all(struct b43_wldev *dev)
3029{
3030	struct b43_wl *wl = dev->wl;
3031	struct b43_qos_params *params;
3032	unsigned int i;
3033
3034	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3035		     ARRAY_SIZE(wl->qos_params));
3036
3037	b43_mac_suspend(dev);
3038	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3039		params = &(wl->qos_params[i]);
3040		b43_qos_params_upload(dev, &(params->p),
3041				      b43_qos_shm_offsets[i]);
3042	}
3043	b43_mac_enable(dev);
3044}
3045
3046static void b43_qos_clear(struct b43_wl *wl)
3047{
3048	struct b43_qos_params *params;
3049	unsigned int i;
3050
3051	/* Initialize QoS parameters to sane defaults. */
3052
3053	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3054		     ARRAY_SIZE(wl->qos_params));
3055
3056	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3057		params = &(wl->qos_params[i]);
3058
3059		switch (b43_qos_shm_offsets[i]) {
3060		case B43_QOS_VOICE:
3061			params->p.txop = 0;
3062			params->p.aifs = 2;
3063			params->p.cw_min = 0x0001;
3064			params->p.cw_max = 0x0001;
3065			break;
3066		case B43_QOS_VIDEO:
3067			params->p.txop = 0;
3068			params->p.aifs = 2;
3069			params->p.cw_min = 0x0001;
3070			params->p.cw_max = 0x0001;
3071			break;
3072		case B43_QOS_BESTEFFORT:
3073			params->p.txop = 0;
3074			params->p.aifs = 3;
3075			params->p.cw_min = 0x0001;
3076			params->p.cw_max = 0x03FF;
3077			break;
3078		case B43_QOS_BACKGROUND:
3079			params->p.txop = 0;
3080			params->p.aifs = 7;
3081			params->p.cw_min = 0x0001;
3082			params->p.cw_max = 0x03FF;
3083			break;
3084		default:
3085			B43_WARN_ON(1);
3086		}
3087	}
3088}
3089
3090/* Initialize the core's QOS capabilities */
3091static void b43_qos_init(struct b43_wldev *dev)
3092{
3093	/* Upload the current QOS parameters. */
3094	b43_qos_upload_all(dev);
3095
3096	/* Enable QOS support. */
3097	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3098	b43_write16(dev, B43_MMIO_IFSCTL,
3099		    b43_read16(dev, B43_MMIO_IFSCTL)
3100		    | B43_MMIO_IFSCTL_USE_EDCF);
3101}
3102
3103static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3104			  const struct ieee80211_tx_queue_params *params)
3105{
3106	struct b43_wl *wl = hw_to_b43_wl(hw);
3107	struct b43_wldev *dev;
3108	unsigned int queue = (unsigned int)_queue;
3109	int err = -ENODEV;
3110
3111	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3112		/* Queue not available or don't support setting
3113		 * params on this queue. Return success to not
3114		 * confuse mac80211. */
3115		return 0;
3116	}
3117	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3118		     ARRAY_SIZE(wl->qos_params));
3119
3120	mutex_lock(&wl->mutex);
3121	dev = wl->current_dev;
3122	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3123		goto out_unlock;
3124
3125	memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3126	b43_mac_suspend(dev);
3127	b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3128			      b43_qos_shm_offsets[queue]);
3129	b43_mac_enable(dev);
3130	err = 0;
3131
3132out_unlock:
3133	mutex_unlock(&wl->mutex);
3134
3135	return err;
3136}
3137
3138static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3139			       struct ieee80211_tx_queue_stats *stats)
3140{
3141	struct b43_wl *wl = hw_to_b43_wl(hw);
3142	struct b43_wldev *dev = wl->current_dev;
3143	unsigned long flags;
3144	int err = -ENODEV;
3145
3146	if (!dev)
3147		goto out;
3148	spin_lock_irqsave(&wl->irq_lock, flags);
3149	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3150		if (b43_using_pio_transfers(dev))
3151			b43_pio_get_tx_stats(dev, stats);
3152		else
3153			b43_dma_get_tx_stats(dev, stats);
3154		err = 0;
3155	}
3156	spin_unlock_irqrestore(&wl->irq_lock, flags);
3157out:
3158	return err;
3159}
3160
3161static int b43_op_get_stats(struct ieee80211_hw *hw,
3162			    struct ieee80211_low_level_stats *stats)
3163{
3164	struct b43_wl *wl = hw_to_b43_wl(hw);
3165	unsigned long flags;
3166
3167	spin_lock_irqsave(&wl->irq_lock, flags);
3168	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3169	spin_unlock_irqrestore(&wl->irq_lock, flags);
3170
3171	return 0;
3172}
3173
3174static void b43_put_phy_into_reset(struct b43_wldev *dev)
3175{
3176	struct ssb_device *sdev = dev->dev;
3177	u32 tmslow;
3178
3179	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3180	tmslow &= ~B43_TMSLOW_GMODE;
3181	tmslow |= B43_TMSLOW_PHYRESET;
3182	tmslow |= SSB_TMSLOW_FGC;
3183	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3184	msleep(1);
3185
3186	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3187	tmslow &= ~SSB_TMSLOW_FGC;
3188	tmslow |= B43_TMSLOW_PHYRESET;
3189	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3190	msleep(1);
3191}
3192
3193static const char * band_to_string(enum ieee80211_band band)
3194{
3195	switch (band) {
3196	case IEEE80211_BAND_5GHZ:
3197		return "5";
3198	case IEEE80211_BAND_2GHZ:
3199		return "2.4";
3200	default:
3201		break;
3202	}
3203	B43_WARN_ON(1);
3204	return "";
3205}
3206
3207/* Expects wl->mutex locked */
3208static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3209{
3210	struct b43_wldev *up_dev = NULL;
3211	struct b43_wldev *down_dev;
3212	struct b43_wldev *d;
3213	int err;
3214	bool uninitialized_var(gmode);
3215	int prev_status;
3216
3217	/* Find a device and PHY which supports the band. */
3218	list_for_each_entry(d, &wl->devlist, list) {
3219		switch (chan->band) {
3220		case IEEE80211_BAND_5GHZ:
3221			if (d->phy.supports_5ghz) {
3222				up_dev = d;
3223				gmode = 0;
3224			}
3225			break;
3226		case IEEE80211_BAND_2GHZ:
3227			if (d->phy.supports_2ghz) {
3228				up_dev = d;
3229				gmode = 1;
3230			}
3231			break;
3232		default:
3233			B43_WARN_ON(1);
3234			return -EINVAL;
3235		}
3236		if (up_dev)
3237			break;
3238	}
3239	if (!up_dev) {
3240		b43err(wl, "Could not find a device for %s-GHz band operation\n",
3241		       band_to_string(chan->band));
3242		return -ENODEV;
3243	}
3244	if ((up_dev == wl->current_dev) &&
3245	    (!!wl->current_dev->phy.gmode == !!gmode)) {
3246		/* This device is already running. */
3247		return 0;
3248	}
3249	b43dbg(wl, "Switching to %s-GHz band\n",
3250	       band_to_string(chan->band));
3251	down_dev = wl->current_dev;
3252
3253	prev_status = b43_status(down_dev);
3254	/* Shutdown the currently running core. */
3255	if (prev_status >= B43_STAT_STARTED)
3256		b43_wireless_core_stop(down_dev);
3257	if (prev_status >= B43_STAT_INITIALIZED)
3258		b43_wireless_core_exit(down_dev);
3259
3260	if (down_dev != up_dev) {
3261		/* We switch to a different core, so we put PHY into
3262		 * RESET on the old core. */
3263		b43_put_phy_into_reset(down_dev);
3264	}
3265
3266	/* Now start the new core. */
3267	up_dev->phy.gmode = gmode;
3268	if (prev_status >= B43_STAT_INITIALIZED) {
3269		err = b43_wireless_core_init(up_dev);
3270		if (err) {
3271			b43err(wl, "Fatal: Could not initialize device for "
3272			       "selected %s-GHz band\n",
3273			       band_to_string(chan->band));
3274			goto init_failure;
3275		}
3276	}
3277	if (prev_status >= B43_STAT_STARTED) {
3278		err = b43_wireless_core_start(up_dev);
3279		if (err) {
3280			b43err(wl, "Fatal: Coult not start device for "
3281			       "selected %s-GHz band\n",
3282			       band_to_string(chan->band));
3283			b43_wireless_core_exit(up_dev);
3284			goto init_failure;
3285		}
3286	}
3287	B43_WARN_ON(b43_status(up_dev) != prev_status);
3288
3289	wl->current_dev = up_dev;
3290
3291	return 0;
3292init_failure:
3293	/* Whoops, failed to init the new core. No core is operating now. */
3294	wl->current_dev = NULL;
3295	return err;
3296}
3297
3298/* Write the short and long frame retry limit values. */
3299static void b43_set_retry_limits(struct b43_wldev *dev,
3300				 unsigned int short_retry,
3301				 unsigned int long_retry)
3302{
3303	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3304	 * the chip-internal counter. */
3305	short_retry = min(short_retry, (unsigned int)0xF);
3306	long_retry = min(long_retry, (unsigned int)0xF);
3307
3308	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3309			short_retry);
3310	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3311			long_retry);
3312}
3313
3314static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3315{
3316	struct b43_wl *wl = hw_to_b43_wl(hw);
3317	struct b43_wldev *dev;
3318	struct b43_phy *phy;
3319	struct ieee80211_conf *conf = &hw->conf;
3320	unsigned long flags;
3321	int antenna;
3322	int err = 0;
3323
3324	mutex_lock(&wl->mutex);
3325
3326	/* Switch the band (if necessary). This might change the active core. */
3327	err = b43_switch_band(wl, conf->channel);
3328	if (err)
3329		goto out_unlock_mutex;
3330	dev = wl->current_dev;
3331	phy = &dev->phy;
3332
3333	b43_mac_suspend(dev);
3334
3335	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3336		b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3337					  conf->long_frame_max_tx_count);
3338	changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3339	if (!changed)
3340		goto out_mac_enable;
3341
3342	/* Switch to the requested channel.
3343	 * The firmware takes care of races with the TX handler. */
3344	if (conf->channel->hw_value != phy->channel)
3345		b43_switch_channel(dev, conf->channel->hw_value);
3346
3347	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3348
3349	/* Adjust the desired TX power level. */
3350	if (conf->power_level != 0) {
3351		spin_lock_irqsave(&wl->irq_lock, flags);
3352		if (conf->power_level != phy->desired_txpower) {
3353			phy->desired_txpower = conf->power_level;
3354			b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3355						   B43_TXPWR_IGNORE_TSSI);
3356		}
3357		spin_unlock_irqrestore(&wl->irq_lock, flags);
3358	}
3359
3360	/* Antennas for RX and management frame TX. */
3361	antenna = B43_ANTENNA_DEFAULT;
3362	b43_mgmtframe_txantenna(dev, antenna);
3363	antenna = B43_ANTENNA_DEFAULT;
3364	if (phy->ops->set_rx_antenna)
3365		phy->ops->set_rx_antenna(dev, antenna);
3366
3367	/* Update templates for AP/mesh mode. */
3368	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3369	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3370		b43_set_beacon_int(dev, conf->beacon_int);
3371
3372	if (!!conf->radio_enabled != phy->radio_on) {
3373		if (conf->radio_enabled) {
3374			b43_software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
3375			b43info(dev->wl, "Radio turned on by software\n");
3376			if (!dev->radio_hw_enable) {
3377				b43info(dev->wl, "The hardware RF-kill button "
3378					"still turns the radio physically off. "
3379					"Press the button to turn it on.\n");
3380			}
3381		} else {
3382			b43_software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
3383			b43info(dev->wl, "Radio turned off by software\n");
3384		}
3385	}
3386
3387out_mac_enable:
3388	b43_mac_enable(dev);
3389out_unlock_mutex:
3390	mutex_unlock(&wl->mutex);
3391
3392	return err;
3393}
3394
3395static void b43_update_basic_rates(struct b43_wldev *dev, u64 brates)
3396{
3397	struct ieee80211_supported_band *sband =
3398		dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3399	struct ieee80211_rate *rate;
3400	int i;
3401	u16 basic, direct, offset, basic_offset, rateptr;
3402
3403	for (i = 0; i < sband->n_bitrates; i++) {
3404		rate = &sband->bitrates[i];
3405
3406		if (b43_is_cck_rate(rate->hw_value)) {
3407			direct = B43_SHM_SH_CCKDIRECT;
3408			basic = B43_SHM_SH_CCKBASIC;
3409			offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3410			offset &= 0xF;
3411		} else {
3412			direct = B43_SHM_SH_OFDMDIRECT;
3413			basic = B43_SHM_SH_OFDMBASIC;
3414			offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3415			offset &= 0xF;
3416		}
3417
3418		rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3419
3420		if (b43_is_cck_rate(rate->hw_value)) {
3421			basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3422			basic_offset &= 0xF;
3423		} else {
3424			basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3425			basic_offset &= 0xF;
3426		}
3427
3428		/*
3429		 * Get the pointer that we need to point to
3430		 * from the direct map
3431		 */
3432		rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3433					 direct + 2 * basic_offset);
3434		/* and write it to the basic map */
3435		b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3436				rateptr);
3437	}
3438}
3439
3440static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3441				    struct ieee80211_vif *vif,
3442				    struct ieee80211_bss_conf *conf,
3443				    u32 changed)
3444{
3445	struct b43_wl *wl = hw_to_b43_wl(hw);
3446	struct b43_wldev *dev;
3447
3448	mutex_lock(&wl->mutex);
3449
3450	dev = wl->current_dev;
3451	if (!dev || b43_status(dev) < B43_STAT_STARTED)
3452		goto out_unlock_mutex;
3453	b43_mac_suspend(dev);
3454
3455	if (changed & BSS_CHANGED_BASIC_RATES)
3456		b43_update_basic_rates(dev, conf->basic_rates);
3457
3458	if (changed & BSS_CHANGED_ERP_SLOT) {
3459		if (conf->use_short_slot)
3460			b43_short_slot_timing_enable(dev);
3461		else
3462			b43_short_slot_timing_disable(dev);
3463	}
3464
3465	b43_mac_enable(dev);
3466out_unlock_mutex:
3467	mutex_unlock(&wl->mutex);
3468
3469	return;
3470}
3471
3472static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3473			   const u8 *local_addr, const u8 *addr,
3474			   struct ieee80211_key_conf *key)
3475{
3476	struct b43_wl *wl = hw_to_b43_wl(hw);
3477	struct b43_wldev *dev;
3478	u8 algorithm;
3479	u8 index;
3480	int err;
3481
3482	if (modparam_nohwcrypt)
3483		return -ENOSPC; /* User disabled HW-crypto */
3484
3485	mutex_lock(&wl->mutex);
3486	spin_lock_irq(&wl->irq_lock);
3487	write_lock(&wl->tx_lock);
3488	/* Why do we need all this locking here?
3489	 * mutex     -> Every config operation must take it.
3490	 * irq_lock  -> We modify the dev->key array, which is accessed
3491	 *              in the IRQ handlers.
3492	 * tx_lock   -> We modify the dev->key array, which is accessed
3493	 *              in the TX handler.
3494	 */
3495
3496	dev = wl->current_dev;
3497	err = -ENODEV;
3498	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3499		goto out_unlock;
3500
3501	if (dev->fw.pcm_request_failed) {
3502		/* We don't have firmware for the crypto engine.
3503		 * Must use software-crypto. */
3504		err = -EOPNOTSUPP;
3505		goto out_unlock;
3506	}
3507
3508	err = -EINVAL;
3509	switch (key->alg) {
3510	case ALG_WEP:
3511		if (key->keylen == LEN_WEP40)
3512			algorithm = B43_SEC_ALGO_WEP40;
3513		else
3514			algorithm = B43_SEC_ALGO_WEP104;
3515		break;
3516	case ALG_TKIP:
3517		algorithm = B43_SEC_ALGO_TKIP;
3518		break;
3519	case ALG_CCMP:
3520		algorithm = B43_SEC_ALGO_AES;
3521		break;
3522	default:
3523		B43_WARN_ON(1);
3524		goto out_unlock;
3525	}
3526	index = (u8) (key->keyidx);
3527	if (index > 3)
3528		goto out_unlock;
3529
3530	switch (cmd) {
3531	case SET_KEY:
3532		if (algorithm == B43_SEC_ALGO_TKIP) {
3533			/* FIXME: No TKIP hardware encryption for now. */
3534			err = -EOPNOTSUPP;
3535			goto out_unlock;
3536		}
3537
3538		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3539			/* Pairwise key with an assigned MAC address. */
3540			err = b43_key_write(dev, -1, algorithm,
3541					    key->key, key->keylen, addr, key);
3542		} else {
3543			/* Group key */
3544			err = b43_key_write(dev, index, algorithm,
3545					    key->key, key->keylen, NULL, key);
3546		}
3547		if (err)
3548			goto out_unlock;
3549
3550		if (algorithm == B43_SEC_ALGO_WEP40 ||
3551		    algorithm == B43_SEC_ALGO_WEP104) {
3552			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3553		} else {
3554			b43_hf_write(dev,
3555				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3556		}
3557		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3558		break;
3559	case DISABLE_KEY: {
3560		err = b43_key_clear(dev, key->hw_key_idx);
3561		if (err)
3562			goto out_unlock;
3563		break;
3564	}
3565	default:
3566		B43_WARN_ON(1);
3567	}
3568
3569out_unlock:
3570	if (!err) {
3571		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3572		       "mac: %pM\n",
3573		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3574		       addr);
3575		b43_dump_keymemory(dev);
3576	}
3577	write_unlock(&wl->tx_lock);
3578	spin_unlock_irq(&wl->irq_lock);
3579	mutex_unlock(&wl->mutex);
3580
3581	return err;
3582}
3583
3584static void b43_op_configure_filter(struct ieee80211_hw *hw,
3585				    unsigned int changed, unsigned int *fflags,
3586				    int mc_count, struct dev_addr_list *mc_list)
3587{
3588	struct b43_wl *wl = hw_to_b43_wl(hw);
3589	struct b43_wldev *dev = wl->current_dev;
3590	unsigned long flags;
3591
3592	if (!dev) {
3593		*fflags = 0;
3594		return;
3595	}
3596
3597	spin_lock_irqsave(&wl->irq_lock, flags);
3598	*fflags &= FIF_PROMISC_IN_BSS |
3599		  FIF_ALLMULTI |
3600		  FIF_FCSFAIL |
3601		  FIF_PLCPFAIL |
3602		  FIF_CONTROL |
3603		  FIF_OTHER_BSS |
3604		  FIF_BCN_PRBRESP_PROMISC;
3605
3606	changed &= FIF_PROMISC_IN_BSS |
3607		   FIF_ALLMULTI |
3608		   FIF_FCSFAIL |
3609		   FIF_PLCPFAIL |
3610		   FIF_CONTROL |
3611		   FIF_OTHER_BSS |
3612		   FIF_BCN_PRBRESP_PROMISC;
3613
3614	wl->filter_flags = *fflags;
3615
3616	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3617		b43_adjust_opmode(dev);
3618	spin_unlock_irqrestore(&wl->irq_lock, flags);
3619}
3620
3621static int b43_op_config_interface(struct ieee80211_hw *hw,
3622				   struct ieee80211_vif *vif,
3623				   struct ieee80211_if_conf *conf)
3624{
3625	struct b43_wl *wl = hw_to_b43_wl(hw);
3626	struct b43_wldev *dev = wl->current_dev;
3627	unsigned long flags;
3628
3629	if (!dev)
3630		return -ENODEV;
3631	mutex_lock(&wl->mutex);
3632	spin_lock_irqsave(&wl->irq_lock, flags);
3633	B43_WARN_ON(wl->vif != vif);
3634	if (conf->bssid)
3635		memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3636	else
3637		memset(wl->bssid, 0, ETH_ALEN);
3638	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3639		if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3640		    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT)) {
3641			B43_WARN_ON(vif->type != wl->if_type);
3642			if (conf->changed & IEEE80211_IFCC_BEACON)
3643				b43_update_templates(wl);
3644		} else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
3645			if (conf->changed & IEEE80211_IFCC_BEACON)
3646				b43_update_templates(wl);
3647		}
3648		b43_write_mac_bssid_templates(dev);
3649	}
3650	spin_unlock_irqrestore(&wl->irq_lock, flags);
3651	mutex_unlock(&wl->mutex);
3652
3653	return 0;
3654}
3655
3656/* Locking: wl->mutex */
3657static void b43_wireless_core_stop(struct b43_wldev *dev)
3658{
3659	struct b43_wl *wl = dev->wl;
3660	unsigned long flags;
3661
3662	if (b43_status(dev) < B43_STAT_STARTED)
3663		return;
3664
3665	/* Disable and sync interrupts. We must do this before than
3666	 * setting the status to INITIALIZED, as the interrupt handler
3667	 * won't care about IRQs then. */
3668	spin_lock_irqsave(&wl->irq_lock, flags);
3669	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3670	b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* flush */
3671	spin_unlock_irqrestore(&wl->irq_lock, flags);
3672	b43_synchronize_irq(dev);
3673
3674	write_lock_irqsave(&wl->tx_lock, flags);
3675	b43_set_status(dev, B43_STAT_INITIALIZED);
3676	write_unlock_irqrestore(&wl->tx_lock, flags);
3677
3678	b43_pio_stop(dev);
3679	mutex_unlock(&wl->mutex);
3680	/* Must unlock as it would otherwise deadlock. No races here.
3681	 * Cancel the possibly running self-rearming periodic work. */
3682	cancel_delayed_work_sync(&dev->periodic_work);
3683	mutex_lock(&wl->mutex);
3684
3685	b43_mac_suspend(dev);
3686	free_irq(dev->dev->irq, dev);
3687	b43dbg(wl, "Wireless interface stopped\n");
3688}
3689
3690/* Locking: wl->mutex */
3691static int b43_wireless_core_start(struct b43_wldev *dev)
3692{
3693	int err;
3694
3695	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3696
3697	drain_txstatus_queue(dev);
3698	err = request_irq(dev->dev->irq, b43_interrupt_handler,
3699			  IRQF_SHARED, KBUILD_MODNAME, dev);
3700	if (err) {
3701		b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3702		goto out;
3703	}
3704
3705	/* We are ready to run. */
3706	b43_set_status(dev, B43_STAT_STARTED);
3707
3708	/* Start data flow (TX/RX). */
3709	b43_mac_enable(dev);
3710	b43_interrupt_enable(dev, dev->irq_savedstate);
3711
3712	/* Start maintainance work */
3713	b43_periodic_tasks_setup(dev);
3714
3715	b43dbg(dev->wl, "Wireless interface started\n");
3716      out:
3717	return err;
3718}
3719
3720/* Get PHY and RADIO versioning numbers */
3721static int b43_phy_versioning(struct b43_wldev *dev)
3722{
3723	struct b43_phy *phy = &dev->phy;
3724	u32 tmp;
3725	u8 analog_type;
3726	u8 phy_type;
3727	u8 phy_rev;
3728	u16 radio_manuf;
3729	u16 radio_ver;
3730	u16 radio_rev;
3731	int unsupported = 0;
3732
3733	/* Get PHY versioning */
3734	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3735	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3736	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3737	phy_rev = (tmp & B43_PHYVER_VERSION);
3738	switch (phy_type) {
3739	case B43_PHYTYPE_A:
3740		if (phy_rev >= 4)
3741			unsupported = 1;
3742		break;
3743	case B43_PHYTYPE_B:
3744		if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3745		    && phy_rev != 7)
3746			unsupported = 1;
3747		break;
3748	case B43_PHYTYPE_G:
3749		if (phy_rev > 9)
3750			unsupported = 1;
3751		break;
3752#ifdef CONFIG_B43_NPHY
3753	case B43_PHYTYPE_N:
3754		if (phy_rev > 1)
3755			unsupported = 1;
3756		break;
3757#endif
3758	default:
3759		unsupported = 1;
3760	};
3761	if (unsupported) {
3762		b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3763		       "(Analog %u, Type %u, Revision %u)\n",
3764		       analog_type, phy_type, phy_rev);
3765		return -EOPNOTSUPP;
3766	}
3767	b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3768	       analog_type, phy_type, phy_rev);
3769
3770	/* Get RADIO versioning */
3771	if (dev->dev->bus->chip_id == 0x4317) {
3772		if (dev->dev->bus->chip_rev == 0)
3773			tmp = 0x3205017F;
3774		else if (dev->dev->bus->chip_rev == 1)
3775			tmp = 0x4205017F;
3776		else
3777			tmp = 0x5205017F;
3778	} else {
3779		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3780		tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3781		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3782		tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3783	}
3784	radio_manuf = (tmp & 0x00000FFF);
3785	radio_ver = (tmp & 0x0FFFF000) >> 12;
3786	radio_rev = (tmp & 0xF0000000) >> 28;
3787	if (radio_manuf != 0x17F /* Broadcom */)
3788		unsupported = 1;
3789	switch (phy_type) {
3790	case B43_PHYTYPE_A:
3791		if (radio_ver != 0x2060)
3792			unsupported = 1;
3793		if (radio_rev != 1)
3794			unsupported = 1;
3795		if (radio_manuf != 0x17F)
3796			unsupported = 1;
3797		break;
3798	case B43_PHYTYPE_B:
3799		if ((radio_ver & 0xFFF0) != 0x2050)
3800			unsupported = 1;
3801		break;
3802	case B43_PHYTYPE_G:
3803		if (radio_ver != 0x2050)
3804			unsupported = 1;
3805		break;
3806	case B43_PHYTYPE_N:
3807		if (radio_ver != 0x2055)
3808			unsupported = 1;
3809		break;
3810	default:
3811		B43_WARN_ON(1);
3812	}
3813	if (unsupported) {
3814		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3815		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3816		       radio_manuf, radio_ver, radio_rev);
3817		return -EOPNOTSUPP;
3818	}
3819	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3820	       radio_manuf, radio_ver, radio_rev);
3821
3822	phy->radio_manuf = radio_manuf;
3823	phy->radio_ver = radio_ver;
3824	phy->radio_rev = radio_rev;
3825
3826	phy->analog = analog_type;
3827	phy->type = phy_type;
3828	phy->rev = phy_rev;
3829
3830	return 0;
3831}
3832
3833static void setup_struct_phy_for_init(struct b43_wldev *dev,
3834				      struct b43_phy *phy)
3835{
3836	phy->hardware_power_control = !!modparam_hwpctl;
3837	phy->next_txpwr_check_time = jiffies;
3838	/* PHY TX errors counter. */
3839	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3840}
3841
3842static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3843{
3844	dev->dfq_valid = 0;
3845
3846	/* Assume the radio is enabled. If it's not enabled, the state will
3847	 * immediately get fixed on the first periodic work run. */
3848	dev->radio_hw_enable = 1;
3849
3850	/* Stats */
3851	memset(&dev->stats, 0, sizeof(dev->stats));
3852
3853	setup_struct_phy_for_init(dev, &dev->phy);
3854
3855	/* IRQ related flags */
3856	dev->irq_reason = 0;
3857	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3858	dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3859
3860	dev->mac_suspended = 1;
3861
3862	/* Noise calculation context */
3863	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3864}
3865
3866static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3867{
3868	struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3869	u64 hf;
3870
3871	if (!modparam_btcoex)
3872		return;
3873	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3874		return;
3875	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3876		return;
3877
3878	hf = b43_hf_read(dev);
3879	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3880		hf |= B43_HF_BTCOEXALT;
3881	else
3882		hf |= B43_HF_BTCOEX;
3883	b43_hf_write(dev, hf);
3884}
3885
3886static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3887{
3888	if (!modparam_btcoex)
3889		return;
3890	//TODO
3891}
3892
3893static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3894{
3895#ifdef CONFIG_SSB_DRIVER_PCICORE
3896	struct ssb_bus *bus = dev->dev->bus;
3897	u32 tmp;
3898
3899	if (bus->pcicore.dev &&
3900	    bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3901	    bus->pcicore.dev->id.revision <= 5) {
3902		/* IMCFGLO timeouts workaround. */
3903		tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3904		tmp &= ~SSB_IMCFGLO_REQTO;
3905		tmp &= ~SSB_IMCFGLO_SERTO;
3906		switch (bus->bustype) {
3907		case SSB_BUSTYPE_PCI:
3908		case SSB_BUSTYPE_PCMCIA:
3909			tmp |= 0x32;
3910			break;
3911		case SSB_BUSTYPE_SSB:
3912			tmp |= 0x53;
3913			break;
3914		}
3915		ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3916	}
3917#endif /* CONFIG_SSB_DRIVER_PCICORE */
3918}
3919
3920static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3921{
3922	u16 pu_delay;
3923
3924	/* The time value is in microseconds. */
3925	if (dev->phy.type == B43_PHYTYPE_A)
3926		pu_delay = 3700;
3927	else
3928		pu_delay = 1050;
3929	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3930		pu_delay = 500;
3931	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3932		pu_delay = max(pu_delay, (u16)2400);
3933
3934	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3935}
3936
3937/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3938static void b43_set_pretbtt(struct b43_wldev *dev)
3939{
3940	u16 pretbtt;
3941
3942	/* The time value is in microseconds. */
3943	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
3944		pretbtt = 2;
3945	} else {
3946		if (dev->phy.type == B43_PHYTYPE_A)
3947			pretbtt = 120;
3948		else
3949			pretbtt = 250;
3950	}
3951	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3952	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3953}
3954
3955/* Shutdown a wireless core */
3956/* Locking: wl->mutex */
3957static void b43_wireless_core_exit(struct b43_wldev *dev)
3958{
3959	u32 macctl;
3960
3961	B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3962	if (b43_status(dev) != B43_STAT_INITIALIZED)
3963		return;
3964	b43_set_status(dev, B43_STAT_UNINIT);
3965
3966	/* Stop the microcode PSM. */
3967	macctl = b43_read32(dev, B43_MMIO_MACCTL);
3968	macctl &= ~B43_MACCTL_PSM_RUN;
3969	macctl |= B43_MACCTL_PSM_JMP0;
3970	b43_write32(dev, B43_MMIO_MACCTL, macctl);
3971
3972	if (!dev->suspend_in_progress) {
3973		b43_leds_exit(dev);
3974		b43_rng_exit(dev->wl);
3975	}
3976	b43_dma_free(dev);
3977	b43_pio_free(dev);
3978	b43_chip_exit(dev);
3979	dev->phy.ops->switch_analog(dev, 0);
3980	if (dev->wl->current_beacon) {
3981		dev_kfree_skb_any(dev->wl->current_beacon);
3982		dev->wl->current_beacon = NULL;
3983	}
3984
3985	ssb_device_disable(dev->dev, 0);
3986	ssb_bus_may_powerdown(dev->dev->bus);
3987}
3988
3989/* Initialize a wireless core */
3990static int b43_wireless_core_init(struct b43_wldev *dev)
3991{
3992	struct b43_wl *wl = dev->wl;
3993	struct ssb_bus *bus = dev->dev->bus;
3994	struct ssb_sprom *sprom = &bus->sprom;
3995	struct b43_phy *phy = &dev->phy;
3996	int err;
3997	u64 hf;
3998	u32 tmp;
3999
4000	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4001
4002	err = ssb_bus_powerup(bus, 0);
4003	if (err)
4004		goto out;
4005	if (!ssb_device_is_enabled(dev->dev)) {
4006		tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4007		b43_wireless_core_reset(dev, tmp);
4008	}
4009
4010	/* Reset all data structures. */
4011	setup_struct_wldev_for_init(dev);
4012	phy->ops->prepare_structs(dev);
4013
4014	/* Enable IRQ routing to this device. */
4015	ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4016
4017	b43_imcfglo_timeouts_workaround(dev);
4018	b43_bluetooth_coext_disable(dev);
4019	if (phy->ops->prepare_hardware) {
4020		err = phy->ops->prepare_hardware(dev);
4021		if (err)
4022			goto err_busdown;
4023	}
4024	err = b43_chip_init(dev);
4025	if (err)
4026		goto err_busdown;
4027	b43_shm_write16(dev, B43_SHM_SHARED,
4028			B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4029	hf = b43_hf_read(dev);
4030	if (phy->type == B43_PHYTYPE_G) {
4031		hf |= B43_HF_SYMW;
4032		if (phy->rev == 1)
4033			hf |= B43_HF_GDCW;
4034		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4035			hf |= B43_HF_OFDMPABOOST;
4036	} else if (phy->type == B43_PHYTYPE_B) {
4037		hf |= B43_HF_SYMW;
4038		if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4039			hf &= ~B43_HF_GDCW;
4040	}
4041	b43_hf_write(dev, hf);
4042
4043	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4044			     B43_DEFAULT_LONG_RETRY_LIMIT);
4045	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4046	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4047
4048	/* Disable sending probe responses from firmware.
4049	 * Setting the MaxTime to one usec will always trigger
4050	 * a timeout, so we never send any probe resp.
4051	 * A timeout of zero is infinite. */
4052	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4053
4054	b43_rate_memory_init(dev);
4055	b43_set_phytxctl_defaults(dev);
4056
4057	/* Minimum Contention Window */
4058	if (phy->type == B43_PHYTYPE_B) {
4059		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4060	} else {
4061		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4062	}
4063	/* Maximum Contention Window */
4064	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4065
4066	if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4067		dev->__using_pio_transfers = 1;
4068		err = b43_pio_init(dev);
4069	} else {
4070		dev->__using_pio_transfers = 0;
4071		err = b43_dma_init(dev);
4072	}
4073	if (err)
4074		goto err_chip_exit;
4075	b43_qos_init(dev);
4076	b43_set_synth_pu_delay(dev, 1);
4077	b43_bluetooth_coext_enable(dev);
4078
4079	ssb_bus_powerup(bus, 1);	/* Enable dynamic PCTL */
4080	b43_upload_card_macaddress(dev);
4081	b43_security_init(dev);
4082	if (!dev->suspend_in_progress)
4083		b43_rng_init(wl);
4084
4085	b43_set_status(dev, B43_STAT_INITIALIZED);
4086
4087	if (!dev->suspend_in_progress)
4088		b43_leds_init(dev);
4089out:
4090	return err;
4091
4092err_chip_exit:
4093	b43_chip_exit(dev);
4094err_busdown:
4095	ssb_bus_may_powerdown(bus);
4096	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4097	return err;
4098}
4099
4100static int b43_op_add_interface(struct ieee80211_hw *hw,
4101				struct ieee80211_if_init_conf *conf)
4102{
4103	struct b43_wl *wl = hw_to_b43_wl(hw);
4104	struct b43_wldev *dev;
4105	unsigned long flags;
4106	int err = -EOPNOTSUPP;
4107
4108	/* TODO: allow WDS/AP devices to coexist */
4109
4110	if (conf->type != NL80211_IFTYPE_AP &&
4111	    conf->type != NL80211_IFTYPE_MESH_POINT &&
4112	    conf->type != NL80211_IFTYPE_STATION &&
4113	    conf->type != NL80211_IFTYPE_WDS &&
4114	    conf->type != NL80211_IFTYPE_ADHOC)
4115		return -EOPNOTSUPP;
4116
4117	mutex_lock(&wl->mutex);
4118	if (wl->operating)
4119		goto out_mutex_unlock;
4120
4121	b43dbg(wl, "Adding Interface type %d\n", conf->type);
4122
4123	dev = wl->current_dev;
4124	wl->operating = 1;
4125	wl->vif = conf->vif;
4126	wl->if_type = conf->type;
4127	memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4128
4129	spin_lock_irqsave(&wl->irq_lock, flags);
4130	b43_adjust_opmode(dev);
4131	b43_set_pretbtt(dev);
4132	b43_set_synth_pu_delay(dev, 0);
4133	b43_upload_card_macaddress(dev);
4134	spin_unlock_irqrestore(&wl->irq_lock, flags);
4135
4136	err = 0;
4137 out_mutex_unlock:
4138	mutex_unlock(&wl->mutex);
4139
4140	return err;
4141}
4142
4143static void b43_op_remove_interface(struct ieee80211_hw *hw,
4144				    struct ieee80211_if_init_conf *conf)
4145{
4146	struct b43_wl *wl = hw_to_b43_wl(hw);
4147	struct b43_wldev *dev = wl->current_dev;
4148	unsigned long flags;
4149
4150	b43dbg(wl, "Removing Interface type %d\n", conf->type);
4151
4152	mutex_lock(&wl->mutex);
4153
4154	B43_WARN_ON(!wl->operating);
4155	B43_WARN_ON(wl->vif != conf->vif);
4156	wl->vif = NULL;
4157
4158	wl->operating = 0;
4159
4160	spin_lock_irqsave(&wl->irq_lock, flags);
4161	b43_adjust_opmode(dev);
4162	memset(wl->mac_addr, 0, ETH_ALEN);
4163	b43_upload_card_macaddress(dev);
4164	spin_unlock_irqrestore(&wl->irq_lock, flags);
4165
4166	mutex_unlock(&wl->mutex);
4167}
4168
4169static int b43_op_start(struct ieee80211_hw *hw)
4170{
4171	struct b43_wl *wl = hw_to_b43_wl(hw);
4172	struct b43_wldev *dev = wl->current_dev;
4173	int did_init = 0;
4174	int err = 0;
4175	bool do_rfkill_exit = 0;
4176
4177	/* Kill all old instance specific information to make sure
4178	 * the card won't use it in the short timeframe between start
4179	 * and mac80211 reconfiguring it. */
4180	memset(wl->bssid, 0, ETH_ALEN);
4181	memset(wl->mac_addr, 0, ETH_ALEN);
4182	wl->filter_flags = 0;
4183	wl->radiotap_enabled = 0;
4184	b43_qos_clear(wl);
4185	wl->beacon0_uploaded = 0;
4186	wl->beacon1_uploaded = 0;
4187	wl->beacon_templates_virgin = 1;
4188
4189	/* First register RFkill.
4190	 * LEDs that are registered later depend on it. */
4191	b43_rfkill_init(dev);
4192
4193	mutex_lock(&wl->mutex);
4194
4195	if (b43_status(dev) < B43_STAT_INITIALIZED) {
4196		err = b43_wireless_core_init(dev);
4197		if (err) {
4198			do_rfkill_exit = 1;
4199			goto out_mutex_unlock;
4200		}
4201		did_init = 1;
4202	}
4203
4204	if (b43_status(dev) < B43_STAT_STARTED) {
4205		err = b43_wireless_core_start(dev);
4206		if (err) {
4207			if (did_init)
4208				b43_wireless_core_exit(dev);
4209			do_rfkill_exit = 1;
4210			goto out_mutex_unlock;
4211		}
4212	}
4213
4214 out_mutex_unlock:
4215	mutex_unlock(&wl->mutex);
4216
4217	if (do_rfkill_exit)
4218		b43_rfkill_exit(dev);
4219
4220	return err;
4221}
4222
4223static void b43_op_stop(struct ieee80211_hw *hw)
4224{
4225	struct b43_wl *wl = hw_to_b43_wl(hw);
4226	struct b43_wldev *dev = wl->current_dev;
4227
4228	b43_rfkill_exit(dev);
4229	cancel_work_sync(&(wl->beacon_update_trigger));
4230
4231	mutex_lock(&wl->mutex);
4232	if (b43_status(dev) >= B43_STAT_STARTED)
4233		b43_wireless_core_stop(dev);
4234	b43_wireless_core_exit(dev);
4235	mutex_unlock(&wl->mutex);
4236
4237	cancel_work_sync(&(wl->txpower_adjust_work));
4238}
4239
4240static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4241				 struct ieee80211_sta *sta, bool set)
4242{
4243	struct b43_wl *wl = hw_to_b43_wl(hw);
4244	unsigned long flags;
4245
4246	spin_lock_irqsave(&wl->irq_lock, flags);
4247	b43_update_templates(wl);
4248	spin_unlock_irqrestore(&wl->irq_lock, flags);
4249
4250	return 0;
4251}
4252
4253static void b43_op_sta_notify(struct ieee80211_hw *hw,
4254			      struct ieee80211_vif *vif,
4255			      enum sta_notify_cmd notify_cmd,
4256			      struct ieee80211_sta *sta)
4257{
4258	struct b43_wl *wl = hw_to_b43_wl(hw);
4259
4260	B43_WARN_ON(!vif || wl->vif != vif);
4261}
4262
4263static const struct ieee80211_ops b43_hw_ops = {
4264	.tx			= b43_op_tx,
4265	.conf_tx		= b43_op_conf_tx,
4266	.add_interface		= b43_op_add_interface,
4267	.remove_interface	= b43_op_remove_interface,
4268	.config			= b43_op_config,
4269	.bss_info_changed	= b43_op_bss_info_changed,
4270	.config_interface	= b43_op_config_interface,
4271	.configure_filter	= b43_op_configure_filter,
4272	.set_key		= b43_op_set_key,
4273	.get_stats		= b43_op_get_stats,
4274	.get_tx_stats		= b43_op_get_tx_stats,
4275	.start			= b43_op_start,
4276	.stop			= b43_op_stop,
4277	.set_tim		= b43_op_beacon_set_tim,
4278	.sta_notify		= b43_op_sta_notify,
4279};
4280
4281/* Hard-reset the chip. Do not call this directly.
4282 * Use b43_controller_restart()
4283 */
4284static void b43_chip_reset(struct work_struct *work)
4285{
4286	struct b43_wldev *dev =
4287	    container_of(work, struct b43_wldev, restart_work);
4288	struct b43_wl *wl = dev->wl;
4289	int err = 0;
4290	int prev_status;
4291
4292	mutex_lock(&wl->mutex);
4293
4294	prev_status = b43_status(dev);
4295	/* Bring the device down... */
4296	if (prev_status >= B43_STAT_STARTED)
4297		b43_wireless_core_stop(dev);
4298	if (prev_status >= B43_STAT_INITIALIZED)
4299		b43_wireless_core_exit(dev);
4300
4301	/* ...and up again. */
4302	if (prev_status >= B43_STAT_INITIALIZED) {
4303		err = b43_wireless_core_init(dev);
4304		if (err)
4305			goto out;
4306	}
4307	if (prev_status >= B43_STAT_STARTED) {
4308		err = b43_wireless_core_start(dev);
4309		if (err) {
4310			b43_wireless_core_exit(dev);
4311			goto out;
4312		}
4313	}
4314out:
4315	if (err)
4316		wl->current_dev = NULL; /* Failed to init the dev. */
4317	mutex_unlock(&wl->mutex);
4318	if (err)
4319		b43err(wl, "Controller restart FAILED\n");
4320	else
4321		b43info(wl, "Controller restarted\n");
4322}
4323
4324static int b43_setup_bands(struct b43_wldev *dev,
4325			   bool have_2ghz_phy, bool have_5ghz_phy)
4326{
4327	struct ieee80211_hw *hw = dev->wl->hw;
4328
4329	if (have_2ghz_phy)
4330		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4331	if (dev->phy.type == B43_PHYTYPE_N) {
4332		if (have_5ghz_phy)
4333			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4334	} else {
4335		if (have_5ghz_phy)
4336			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4337	}
4338
4339	dev->phy.supports_2ghz = have_2ghz_phy;
4340	dev->phy.supports_5ghz = have_5ghz_phy;
4341
4342	return 0;
4343}
4344
4345static void b43_wireless_core_detach(struct b43_wldev *dev)
4346{
4347	/* We release firmware that late to not be required to re-request
4348	 * is all the time when we reinit the core. */
4349	b43_release_firmware(dev);
4350	b43_phy_free(dev);
4351}
4352
4353static int b43_wireless_core_attach(struct b43_wldev *dev)
4354{
4355	struct b43_wl *wl = dev->wl;
4356	struct ssb_bus *bus = dev->dev->bus;
4357	struct pci_dev *pdev = bus->host_pci;
4358	int err;
4359	bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4360	u32 tmp;
4361
4362	/* Do NOT do any device initialization here.
4363	 * Do it in wireless_core_init() instead.
4364	 * This function is for gathering basic information about the HW, only.
4365	 * Also some structs may be set up here. But most likely you want to have
4366	 * that in core_init(), too.
4367	 */
4368
4369	err = ssb_bus_powerup(bus, 0);
4370	if (err) {
4371		b43err(wl, "Bus powerup failed\n");
4372		goto out;
4373	}
4374	/* Get the PHY type. */
4375	if (dev->dev->id.revision >= 5) {
4376		u32 tmshigh;
4377
4378		tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4379		have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4380		have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4381	} else
4382		B43_WARN_ON(1);
4383
4384	dev->phy.gmode = have_2ghz_phy;
4385	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4386	b43_wireless_core_reset(dev, tmp);
4387
4388	err = b43_phy_versioning(dev);
4389	if (err)
4390		goto err_powerdown;
4391	/* Check if this device supports multiband. */
4392	if (!pdev ||
4393	    (pdev->device != 0x4312 &&
4394	     pdev->device != 0x4319 && pdev->device != 0x4324)) {
4395		/* No multiband support. */
4396		have_2ghz_phy = 0;
4397		have_5ghz_phy = 0;
4398		switch (dev->phy.type) {
4399		case B43_PHYTYPE_A:
4400			have_5ghz_phy = 1;
4401			break;
4402		case B43_PHYTYPE_G:
4403		case B43_PHYTYPE_N:
4404			have_2ghz_phy = 1;
4405			break;
4406		default:
4407			B43_WARN_ON(1);
4408		}
4409	}
4410	if (dev->phy.type == B43_PHYTYPE_A) {
4411		/* FIXME */
4412		b43err(wl, "IEEE 802.11a devices are unsupported\n");
4413		err = -EOPNOTSUPP;
4414		goto err_powerdown;
4415	}
4416	if (1 /* disable A-PHY */) {
4417		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4418		if (dev->phy.type != B43_PHYTYPE_N) {
4419			have_2ghz_phy = 1;
4420			have_5ghz_phy = 0;
4421		}
4422	}
4423
4424	err = b43_phy_allocate(dev);
4425	if (err)
4426		goto err_powerdown;
4427
4428	dev->phy.gmode = have_2ghz_phy;
4429	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4430	b43_wireless_core_reset(dev, tmp);
4431
4432	err = b43_validate_chipaccess(dev);
4433	if (err)
4434		goto err_phy_free;
4435	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4436	if (err)
4437		goto err_phy_free;
4438
4439	/* Now set some default "current_dev" */
4440	if (!wl->current_dev)
4441		wl->current_dev = dev;
4442	INIT_WORK(&dev->restart_work, b43_chip_reset);
4443
4444	dev->phy.ops->switch_analog(dev, 0);
4445	ssb_device_disable(dev->dev, 0);
4446	ssb_bus_may_powerdown(bus);
4447
4448out:
4449	return err;
4450
4451err_phy_free:
4452	b43_phy_free(dev);
4453err_powerdown:
4454	ssb_bus_may_powerdown(bus);
4455	return err;
4456}
4457
4458static void b43_one_core_detach(struct ssb_device *dev)
4459{
4460	struct b43_wldev *wldev;
4461	struct b43_wl *wl;
4462
4463	/* Do not cancel ieee80211-workqueue based work here.
4464	 * See comment in b43_remove(). */
4465
4466	wldev = ssb_get_drvdata(dev);
4467	wl = wldev->wl;
4468	b43_debugfs_remove_device(wldev);
4469	b43_wireless_core_detach(wldev);
4470	list_del(&wldev->list);
4471	wl->nr_devs--;
4472	ssb_set_drvdata(dev, NULL);
4473	kfree(wldev);
4474}
4475
4476static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4477{
4478	struct b43_wldev *wldev;
4479	struct pci_dev *pdev;
4480	int err = -ENOMEM;
4481
4482	if (!list_empty(&wl->devlist)) {
4483		/* We are not the first core on this chip. */
4484		pdev = dev->bus->host_pci;
4485		/* Only special chips support more than one wireless
4486		 * core, although some of the other chips have more than
4487		 * one wireless core as well. Check for this and
4488		 * bail out early.
4489		 */
4490		if (!pdev ||
4491		    ((pdev->device != 0x4321) &&
4492		     (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4493			b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4494			return -ENODEV;
4495		}
4496	}
4497
4498	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4499	if (!wldev)
4500		goto out;
4501
4502	wldev->dev = dev;
4503	wldev->wl = wl;
4504	b43_set_status(wldev, B43_STAT_UNINIT);
4505	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4506	tasklet_init(&wldev->isr_tasklet,
4507		     (void (*)(unsigned long))b43_interrupt_tasklet,
4508		     (unsigned long)wldev);
4509	INIT_LIST_HEAD(&wldev->list);
4510
4511	err = b43_wireless_core_attach(wldev);
4512	if (err)
4513		goto err_kfree_wldev;
4514
4515	list_add(&wldev->list, &wl->devlist);
4516	wl->nr_devs++;
4517	ssb_set_drvdata(dev, wldev);
4518	b43_debugfs_add_device(wldev);
4519
4520      out:
4521	return err;
4522
4523      err_kfree_wldev:
4524	kfree(wldev);
4525	return err;
4526}
4527
4528#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
4529	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
4530	(pdev->device == _device) &&					\
4531	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
4532	(pdev->subsystem_device == _subdevice)				)
4533
4534static void b43_sprom_fixup(struct ssb_bus *bus)
4535{
4536	struct pci_dev *pdev;
4537
4538	/* boardflags workarounds */
4539	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4540	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4541		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4542	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4543	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4544		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4545	if (bus->bustype == SSB_BUSTYPE_PCI) {
4546		pdev = bus->host_pci;
4547		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4548		    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4549		    IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4550		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4551		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4552		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4553		    IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4554			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4555	}
4556}
4557
4558static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4559{
4560	struct ieee80211_hw *hw = wl->hw;
4561
4562	ssb_set_devtypedata(dev, NULL);
4563	ieee80211_free_hw(hw);
4564}
4565
4566static int b43_wireless_init(struct ssb_device *dev)
4567{
4568	struct ssb_sprom *sprom = &dev->bus->sprom;
4569	struct ieee80211_hw *hw;
4570	struct b43_wl *wl;
4571	int err = -ENOMEM;
4572
4573	b43_sprom_fixup(dev->bus);
4574
4575	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4576	if (!hw) {
4577		b43err(NULL, "Could not allocate ieee80211 device\n");
4578		goto out;
4579	}
4580
4581	/* fill hw info */
4582	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4583		    IEEE80211_HW_SIGNAL_DBM |
4584		    IEEE80211_HW_NOISE_DBM;
4585
4586	hw->wiphy->interface_modes =
4587		BIT(NL80211_IFTYPE_AP) |
4588		BIT(NL80211_IFTYPE_MESH_POINT) |
4589		BIT(NL80211_IFTYPE_STATION) |
4590		BIT(NL80211_IFTYPE_WDS) |
4591		BIT(NL80211_IFTYPE_ADHOC);
4592
4593	hw->queues = b43_modparam_qos ? 4 : 1;
4594	hw->max_rates = 2;
4595	SET_IEEE80211_DEV(hw, dev->dev);
4596	if (is_valid_ether_addr(sprom->et1mac))
4597		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4598	else
4599		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4600
4601	/* Get and initialize struct b43_wl */
4602	wl = hw_to_b43_wl(hw);
4603	memset(wl, 0, sizeof(*wl));
4604	wl->hw = hw;
4605	spin_lock_init(&wl->irq_lock);
4606	rwlock_init(&wl->tx_lock);
4607	spin_lock_init(&wl->leds_lock);
4608	spin_lock_init(&wl->shm_lock);
4609	mutex_init(&wl->mutex);
4610	INIT_LIST_HEAD(&wl->devlist);
4611	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4612	INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4613
4614	ssb_set_devtypedata(dev, wl);
4615	b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4616	err = 0;
4617      out:
4618	return err;
4619}
4620
4621static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4622{
4623	struct b43_wl *wl;
4624	int err;
4625	int first = 0;
4626
4627	wl = ssb_get_devtypedata(dev);
4628	if (!wl) {
4629		/* Probing the first core. Must setup common struct b43_wl */
4630		first = 1;
4631		err = b43_wireless_init(dev);
4632		if (err)
4633			goto out;
4634		wl = ssb_get_devtypedata(dev);
4635		B43_WARN_ON(!wl);
4636	}
4637	err = b43_one_core_attach(dev, wl);
4638	if (err)
4639		goto err_wireless_exit;
4640
4641	if (first) {
4642		err = ieee80211_register_hw(wl->hw);
4643		if (err)
4644			goto err_one_core_detach;
4645	}
4646
4647      out:
4648	return err;
4649
4650      err_one_core_detach:
4651	b43_one_core_detach(dev);
4652      err_wireless_exit:
4653	if (first)
4654		b43_wireless_exit(dev, wl);
4655	return err;
4656}
4657
4658static void b43_remove(struct ssb_device *dev)
4659{
4660	struct b43_wl *wl = ssb_get_devtypedata(dev);
4661	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4662
4663	/* We must cancel any work here before unregistering from ieee80211,
4664	 * as the ieee80211 unreg will destroy the workqueue. */
4665	cancel_work_sync(&wldev->restart_work);
4666
4667	B43_WARN_ON(!wl);
4668	if (wl->current_dev == wldev)
4669		ieee80211_unregister_hw(wl->hw);
4670
4671	b43_one_core_detach(dev);
4672
4673	if (list_empty(&wl->devlist)) {
4674		/* Last core on the chip unregistered.
4675		 * We can destroy common struct b43_wl.
4676		 */
4677		b43_wireless_exit(dev, wl);
4678	}
4679}
4680
4681/* Perform a hardware reset. This can be called from any context. */
4682void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4683{
4684	/* Must avoid requeueing, if we are in shutdown. */
4685	if (b43_status(dev) < B43_STAT_INITIALIZED)
4686		return;
4687	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4688	queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4689}
4690
4691#ifdef CONFIG_PM
4692
4693static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4694{
4695	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4696	struct b43_wl *wl = wldev->wl;
4697
4698	b43dbg(wl, "Suspending...\n");
4699
4700	mutex_lock(&wl->mutex);
4701	wldev->suspend_in_progress = true;
4702	wldev->suspend_init_status = b43_status(wldev);
4703	if (wldev->suspend_init_status >= B43_STAT_STARTED)
4704		b43_wireless_core_stop(wldev);
4705	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4706		b43_wireless_core_exit(wldev);
4707	mutex_unlock(&wl->mutex);
4708
4709	b43dbg(wl, "Device suspended.\n");
4710
4711	return 0;
4712}
4713
4714static int b43_resume(struct ssb_device *dev)
4715{
4716	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4717	struct b43_wl *wl = wldev->wl;
4718	int err = 0;
4719
4720	b43dbg(wl, "Resuming...\n");
4721
4722	mutex_lock(&wl->mutex);
4723	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4724		err = b43_wireless_core_init(wldev);
4725		if (err) {
4726			b43err(wl, "Resume failed at core init\n");
4727			goto out;
4728		}
4729	}
4730	if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4731		err = b43_wireless_core_start(wldev);
4732		if (err) {
4733			b43_leds_exit(wldev);
4734			b43_rng_exit(wldev->wl);
4735			b43_wireless_core_exit(wldev);
4736			b43err(wl, "Resume failed at core start\n");
4737			goto out;
4738		}
4739	}
4740	b43dbg(wl, "Device resumed.\n");
4741 out:
4742	wldev->suspend_in_progress = false;
4743	mutex_unlock(&wl->mutex);
4744	return err;
4745}
4746
4747#else /* CONFIG_PM */
4748# define b43_suspend	NULL
4749# define b43_resume	NULL
4750#endif /* CONFIG_PM */
4751
4752static struct ssb_driver b43_ssb_driver = {
4753	.name		= KBUILD_MODNAME,
4754	.id_table	= b43_ssb_tbl,
4755	.probe		= b43_probe,
4756	.remove		= b43_remove,
4757	.suspend	= b43_suspend,
4758	.resume		= b43_resume,
4759};
4760
4761static void b43_print_driverinfo(void)
4762{
4763	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4764		   *feat_leds = "", *feat_rfkill = "";
4765
4766#ifdef CONFIG_B43_PCI_AUTOSELECT
4767	feat_pci = "P";
4768#endif
4769#ifdef CONFIG_B43_PCMCIA
4770	feat_pcmcia = "M";
4771#endif
4772#ifdef CONFIG_B43_NPHY
4773	feat_nphy = "N";
4774#endif
4775#ifdef CONFIG_B43_LEDS
4776	feat_leds = "L";
4777#endif
4778#ifdef CONFIG_B43_RFKILL
4779	feat_rfkill = "R";
4780#endif
4781	printk(KERN_INFO "Broadcom 43xx driver loaded "
4782	       "[ Features: %s%s%s%s%s, Firmware-ID: "
4783	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
4784	       feat_pci, feat_pcmcia, feat_nphy,
4785	       feat_leds, feat_rfkill);
4786}
4787
4788static int __init b43_init(void)
4789{
4790	int err;
4791
4792	b43_debugfs_init();
4793	err = b43_pcmcia_init();
4794	if (err)
4795		goto err_dfs_exit;
4796	err = ssb_driver_register(&b43_ssb_driver);
4797	if (err)
4798		goto err_pcmcia_exit;
4799	b43_print_driverinfo();
4800
4801	return err;
4802
4803err_pcmcia_exit:
4804	b43_pcmcia_exit();
4805err_dfs_exit:
4806	b43_debugfs_exit();
4807	return err;
4808}
4809
4810static void __exit b43_exit(void)
4811{
4812	ssb_driver_unregister(&b43_ssb_driver);
4813	b43_pcmcia_exit();
4814	b43_debugfs_exit();
4815}
4816
4817module_init(b43_init)
4818module_exit(b43_exit)
4819