main.c revision 53c068566dde708cb28a4dfc06ae3d7fd7434397
1/*
2
3  Broadcom B43 wireless driver
4
5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11  Some parts of the code in this file are derived from the ipw2200
12  driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14  This program is free software; you can redistribute it and/or modify
15  it under the terms of the GNU General Public License as published by
16  the Free Software Foundation; either version 2 of the License, or
17  (at your option) any later version.
18
19  This program is distributed in the hope that it will be useful,
20  but WITHOUT ANY WARRANTY; without even the implied warranty of
21  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  GNU General Public License for more details.
23
24  You should have received a copy of the GNU General Public License
25  along with this program; see the file COPYING.  If not, write to
26  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27  Boston, MA 02110-1301, USA.
28
29*/
30
31#include <linux/delay.h>
32#include <linux/init.h>
33#include <linux/moduleparam.h>
34#include <linux/if_arp.h>
35#include <linux/etherdevice.h>
36#include <linux/version.h>
37#include <linux/firmware.h>
38#include <linux/wireless.h>
39#include <linux/workqueue.h>
40#include <linux/skbuff.h>
41#include <linux/io.h>
42#include <linux/dma-mapping.h>
43#include <asm/unaligned.h>
44
45#include "b43.h"
46#include "main.h"
47#include "debugfs.h"
48#include "phy.h"
49#include "nphy.h"
50#include "dma.h"
51#include "pio.h"
52#include "sysfs.h"
53#include "xmit.h"
54#include "lo.h"
55#include "pcmcia.h"
56
57MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58MODULE_AUTHOR("Martin Langer");
59MODULE_AUTHOR("Stefano Brivio");
60MODULE_AUTHOR("Michael Buesch");
61MODULE_LICENSE("GPL");
62
63MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66static int modparam_bad_frames_preempt;
67module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68MODULE_PARM_DESC(bad_frames_preempt,
69		 "enable(1) / disable(0) Bad Frames Preemption");
70
71static char modparam_fwpostfix[16];
72module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75static int modparam_hwpctl;
76module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79static int modparam_nohwcrypt;
80module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83int b43_modparam_qos = 1;
84module_param_named(qos, b43_modparam_qos, int, 0444);
85MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
86
87static int modparam_btcoex = 1;
88module_param_named(btcoex, modparam_btcoex, int, 0444);
89MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
90
91
92static const struct ssb_device_id b43_ssb_tbl[] = {
93	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
94	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
95	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
96	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
97	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
98	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
99	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
100	SSB_DEVTABLE_END
101};
102
103MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
104
105/* Channel and ratetables are shared for all devices.
106 * They can't be const, because ieee80211 puts some precalculated
107 * data in there. This data is the same for all devices, so we don't
108 * get concurrency issues */
109#define RATETAB_ENT(_rateid, _flags) \
110	{								\
111		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
112		.hw_value	= (_rateid),				\
113		.flags		= (_flags),				\
114	}
115
116/*
117 * NOTE: When changing this, sync with xmit.c's
118 *	 b43_plcp_get_bitrate_idx_* functions!
119 */
120static struct ieee80211_rate __b43_ratetable[] = {
121	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
122	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
123	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
124	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
125	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
126	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
127	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
128	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
129	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
130	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
131	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
132	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
133};
134
135#define b43_a_ratetable		(__b43_ratetable + 4)
136#define b43_a_ratetable_size	8
137#define b43_b_ratetable		(__b43_ratetable + 0)
138#define b43_b_ratetable_size	4
139#define b43_g_ratetable		(__b43_ratetable + 0)
140#define b43_g_ratetable_size	12
141
142#define CHAN4G(_channel, _freq, _flags) {			\
143	.band			= IEEE80211_BAND_2GHZ,		\
144	.center_freq		= (_freq),			\
145	.hw_value		= (_channel),			\
146	.flags			= (_flags),			\
147	.max_antenna_gain	= 0,				\
148	.max_power		= 30,				\
149}
150static struct ieee80211_channel b43_2ghz_chantable[] = {
151	CHAN4G(1, 2412, 0),
152	CHAN4G(2, 2417, 0),
153	CHAN4G(3, 2422, 0),
154	CHAN4G(4, 2427, 0),
155	CHAN4G(5, 2432, 0),
156	CHAN4G(6, 2437, 0),
157	CHAN4G(7, 2442, 0),
158	CHAN4G(8, 2447, 0),
159	CHAN4G(9, 2452, 0),
160	CHAN4G(10, 2457, 0),
161	CHAN4G(11, 2462, 0),
162	CHAN4G(12, 2467, 0),
163	CHAN4G(13, 2472, 0),
164	CHAN4G(14, 2484, 0),
165};
166#undef CHAN4G
167
168#define CHAN5G(_channel, _flags) {				\
169	.band			= IEEE80211_BAND_5GHZ,		\
170	.center_freq		= 5000 + (5 * (_channel)),	\
171	.hw_value		= (_channel),			\
172	.flags			= (_flags),			\
173	.max_antenna_gain	= 0,				\
174	.max_power		= 30,				\
175}
176static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
177	CHAN5G(32, 0),		CHAN5G(34, 0),
178	CHAN5G(36, 0),		CHAN5G(38, 0),
179	CHAN5G(40, 0),		CHAN5G(42, 0),
180	CHAN5G(44, 0),		CHAN5G(46, 0),
181	CHAN5G(48, 0),		CHAN5G(50, 0),
182	CHAN5G(52, 0),		CHAN5G(54, 0),
183	CHAN5G(56, 0),		CHAN5G(58, 0),
184	CHAN5G(60, 0),		CHAN5G(62, 0),
185	CHAN5G(64, 0),		CHAN5G(66, 0),
186	CHAN5G(68, 0),		CHAN5G(70, 0),
187	CHAN5G(72, 0),		CHAN5G(74, 0),
188	CHAN5G(76, 0),		CHAN5G(78, 0),
189	CHAN5G(80, 0),		CHAN5G(82, 0),
190	CHAN5G(84, 0),		CHAN5G(86, 0),
191	CHAN5G(88, 0),		CHAN5G(90, 0),
192	CHAN5G(92, 0),		CHAN5G(94, 0),
193	CHAN5G(96, 0),		CHAN5G(98, 0),
194	CHAN5G(100, 0),		CHAN5G(102, 0),
195	CHAN5G(104, 0),		CHAN5G(106, 0),
196	CHAN5G(108, 0),		CHAN5G(110, 0),
197	CHAN5G(112, 0),		CHAN5G(114, 0),
198	CHAN5G(116, 0),		CHAN5G(118, 0),
199	CHAN5G(120, 0),		CHAN5G(122, 0),
200	CHAN5G(124, 0),		CHAN5G(126, 0),
201	CHAN5G(128, 0),		CHAN5G(130, 0),
202	CHAN5G(132, 0),		CHAN5G(134, 0),
203	CHAN5G(136, 0),		CHAN5G(138, 0),
204	CHAN5G(140, 0),		CHAN5G(142, 0),
205	CHAN5G(144, 0),		CHAN5G(145, 0),
206	CHAN5G(146, 0),		CHAN5G(147, 0),
207	CHAN5G(148, 0),		CHAN5G(149, 0),
208	CHAN5G(150, 0),		CHAN5G(151, 0),
209	CHAN5G(152, 0),		CHAN5G(153, 0),
210	CHAN5G(154, 0),		CHAN5G(155, 0),
211	CHAN5G(156, 0),		CHAN5G(157, 0),
212	CHAN5G(158, 0),		CHAN5G(159, 0),
213	CHAN5G(160, 0),		CHAN5G(161, 0),
214	CHAN5G(162, 0),		CHAN5G(163, 0),
215	CHAN5G(164, 0),		CHAN5G(165, 0),
216	CHAN5G(166, 0),		CHAN5G(168, 0),
217	CHAN5G(170, 0),		CHAN5G(172, 0),
218	CHAN5G(174, 0),		CHAN5G(176, 0),
219	CHAN5G(178, 0),		CHAN5G(180, 0),
220	CHAN5G(182, 0),		CHAN5G(184, 0),
221	CHAN5G(186, 0),		CHAN5G(188, 0),
222	CHAN5G(190, 0),		CHAN5G(192, 0),
223	CHAN5G(194, 0),		CHAN5G(196, 0),
224	CHAN5G(198, 0),		CHAN5G(200, 0),
225	CHAN5G(202, 0),		CHAN5G(204, 0),
226	CHAN5G(206, 0),		CHAN5G(208, 0),
227	CHAN5G(210, 0),		CHAN5G(212, 0),
228	CHAN5G(214, 0),		CHAN5G(216, 0),
229	CHAN5G(218, 0),		CHAN5G(220, 0),
230	CHAN5G(222, 0),		CHAN5G(224, 0),
231	CHAN5G(226, 0),		CHAN5G(228, 0),
232};
233
234static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
235	CHAN5G(34, 0),		CHAN5G(36, 0),
236	CHAN5G(38, 0),		CHAN5G(40, 0),
237	CHAN5G(42, 0),		CHAN5G(44, 0),
238	CHAN5G(46, 0),		CHAN5G(48, 0),
239	CHAN5G(52, 0),		CHAN5G(56, 0),
240	CHAN5G(60, 0),		CHAN5G(64, 0),
241	CHAN5G(100, 0),		CHAN5G(104, 0),
242	CHAN5G(108, 0),		CHAN5G(112, 0),
243	CHAN5G(116, 0),		CHAN5G(120, 0),
244	CHAN5G(124, 0),		CHAN5G(128, 0),
245	CHAN5G(132, 0),		CHAN5G(136, 0),
246	CHAN5G(140, 0),		CHAN5G(149, 0),
247	CHAN5G(153, 0),		CHAN5G(157, 0),
248	CHAN5G(161, 0),		CHAN5G(165, 0),
249	CHAN5G(184, 0),		CHAN5G(188, 0),
250	CHAN5G(192, 0),		CHAN5G(196, 0),
251	CHAN5G(200, 0),		CHAN5G(204, 0),
252	CHAN5G(208, 0),		CHAN5G(212, 0),
253	CHAN5G(216, 0),
254};
255#undef CHAN5G
256
257static struct ieee80211_supported_band b43_band_5GHz_nphy = {
258	.band		= IEEE80211_BAND_5GHZ,
259	.channels	= b43_5ghz_nphy_chantable,
260	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
261	.bitrates	= b43_a_ratetable,
262	.n_bitrates	= b43_a_ratetable_size,
263};
264
265static struct ieee80211_supported_band b43_band_5GHz_aphy = {
266	.band		= IEEE80211_BAND_5GHZ,
267	.channels	= b43_5ghz_aphy_chantable,
268	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
269	.bitrates	= b43_a_ratetable,
270	.n_bitrates	= b43_a_ratetable_size,
271};
272
273static struct ieee80211_supported_band b43_band_2GHz = {
274	.band		= IEEE80211_BAND_2GHZ,
275	.channels	= b43_2ghz_chantable,
276	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
277	.bitrates	= b43_g_ratetable,
278	.n_bitrates	= b43_g_ratetable_size,
279};
280
281static void b43_wireless_core_exit(struct b43_wldev *dev);
282static int b43_wireless_core_init(struct b43_wldev *dev);
283static void b43_wireless_core_stop(struct b43_wldev *dev);
284static int b43_wireless_core_start(struct b43_wldev *dev);
285
286static int b43_ratelimit(struct b43_wl *wl)
287{
288	if (!wl || !wl->current_dev)
289		return 1;
290	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
291		return 1;
292	/* We are up and running.
293	 * Ratelimit the messages to avoid DoS over the net. */
294	return net_ratelimit();
295}
296
297void b43info(struct b43_wl *wl, const char *fmt, ...)
298{
299	va_list args;
300
301	if (!b43_ratelimit(wl))
302		return;
303	va_start(args, fmt);
304	printk(KERN_INFO "b43-%s: ",
305	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
306	vprintk(fmt, args);
307	va_end(args);
308}
309
310void b43err(struct b43_wl *wl, const char *fmt, ...)
311{
312	va_list args;
313
314	if (!b43_ratelimit(wl))
315		return;
316	va_start(args, fmt);
317	printk(KERN_ERR "b43-%s ERROR: ",
318	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
319	vprintk(fmt, args);
320	va_end(args);
321}
322
323void b43warn(struct b43_wl *wl, const char *fmt, ...)
324{
325	va_list args;
326
327	if (!b43_ratelimit(wl))
328		return;
329	va_start(args, fmt);
330	printk(KERN_WARNING "b43-%s warning: ",
331	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
332	vprintk(fmt, args);
333	va_end(args);
334}
335
336#if B43_DEBUG
337void b43dbg(struct b43_wl *wl, const char *fmt, ...)
338{
339	va_list args;
340
341	va_start(args, fmt);
342	printk(KERN_DEBUG "b43-%s debug: ",
343	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
344	vprintk(fmt, args);
345	va_end(args);
346}
347#endif /* DEBUG */
348
349static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
350{
351	u32 macctl;
352
353	B43_WARN_ON(offset % 4 != 0);
354
355	macctl = b43_read32(dev, B43_MMIO_MACCTL);
356	if (macctl & B43_MACCTL_BE)
357		val = swab32(val);
358
359	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
360	mmiowb();
361	b43_write32(dev, B43_MMIO_RAM_DATA, val);
362}
363
364static inline void b43_shm_control_word(struct b43_wldev *dev,
365					u16 routing, u16 offset)
366{
367	u32 control;
368
369	/* "offset" is the WORD offset. */
370	control = routing;
371	control <<= 16;
372	control |= offset;
373	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
374}
375
376u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
377{
378	struct b43_wl *wl = dev->wl;
379	unsigned long flags;
380	u32 ret;
381
382	spin_lock_irqsave(&wl->shm_lock, flags);
383	if (routing == B43_SHM_SHARED) {
384		B43_WARN_ON(offset & 0x0001);
385		if (offset & 0x0003) {
386			/* Unaligned access */
387			b43_shm_control_word(dev, routing, offset >> 2);
388			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
389			ret <<= 16;
390			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
391			ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
392
393			goto out;
394		}
395		offset >>= 2;
396	}
397	b43_shm_control_word(dev, routing, offset);
398	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
399out:
400	spin_unlock_irqrestore(&wl->shm_lock, flags);
401
402	return ret;
403}
404
405u16 b43_shm_read16(struct b43_wldev * dev, u16 routing, u16 offset)
406{
407	struct b43_wl *wl = dev->wl;
408	unsigned long flags;
409	u16 ret;
410
411	spin_lock_irqsave(&wl->shm_lock, flags);
412	if (routing == B43_SHM_SHARED) {
413		B43_WARN_ON(offset & 0x0001);
414		if (offset & 0x0003) {
415			/* Unaligned access */
416			b43_shm_control_word(dev, routing, offset >> 2);
417			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
418
419			goto out;
420		}
421		offset >>= 2;
422	}
423	b43_shm_control_word(dev, routing, offset);
424	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
425out:
426	spin_unlock_irqrestore(&wl->shm_lock, flags);
427
428	return ret;
429}
430
431void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
432{
433	struct b43_wl *wl = dev->wl;
434	unsigned long flags;
435
436	spin_lock_irqsave(&wl->shm_lock, flags);
437	if (routing == B43_SHM_SHARED) {
438		B43_WARN_ON(offset & 0x0001);
439		if (offset & 0x0003) {
440			/* Unaligned access */
441			b43_shm_control_word(dev, routing, offset >> 2);
442			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
443				    (value >> 16) & 0xffff);
444			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
445			b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
446			goto out;
447		}
448		offset >>= 2;
449	}
450	b43_shm_control_word(dev, routing, offset);
451	b43_write32(dev, B43_MMIO_SHM_DATA, value);
452out:
453	spin_unlock_irqrestore(&wl->shm_lock, flags);
454}
455
456void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
457{
458	struct b43_wl *wl = dev->wl;
459	unsigned long flags;
460
461	spin_lock_irqsave(&wl->shm_lock, flags);
462	if (routing == B43_SHM_SHARED) {
463		B43_WARN_ON(offset & 0x0001);
464		if (offset & 0x0003) {
465			/* Unaligned access */
466			b43_shm_control_word(dev, routing, offset >> 2);
467			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
468			goto out;
469		}
470		offset >>= 2;
471	}
472	b43_shm_control_word(dev, routing, offset);
473	b43_write16(dev, B43_MMIO_SHM_DATA, value);
474out:
475	spin_unlock_irqrestore(&wl->shm_lock, flags);
476}
477
478/* Read HostFlags */
479u64 b43_hf_read(struct b43_wldev * dev)
480{
481	u64 ret;
482
483	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
484	ret <<= 16;
485	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
486	ret <<= 16;
487	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
488
489	return ret;
490}
491
492/* Write HostFlags */
493void b43_hf_write(struct b43_wldev *dev, u64 value)
494{
495	u16 lo, mi, hi;
496
497	lo = (value & 0x00000000FFFFULL);
498	mi = (value & 0x0000FFFF0000ULL) >> 16;
499	hi = (value & 0xFFFF00000000ULL) >> 32;
500	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
501	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
502	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
503}
504
505void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
506{
507	/* We need to be careful. As we read the TSF from multiple
508	 * registers, we should take care of register overflows.
509	 * In theory, the whole tsf read process should be atomic.
510	 * We try to be atomic here, by restaring the read process,
511	 * if any of the high registers changed (overflew).
512	 */
513	if (dev->dev->id.revision >= 3) {
514		u32 low, high, high2;
515
516		do {
517			high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
518			low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
519			high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
520		} while (unlikely(high != high2));
521
522		*tsf = high;
523		*tsf <<= 32;
524		*tsf |= low;
525	} else {
526		u64 tmp;
527		u16 v0, v1, v2, v3;
528		u16 test1, test2, test3;
529
530		do {
531			v3 = b43_read16(dev, B43_MMIO_TSF_3);
532			v2 = b43_read16(dev, B43_MMIO_TSF_2);
533			v1 = b43_read16(dev, B43_MMIO_TSF_1);
534			v0 = b43_read16(dev, B43_MMIO_TSF_0);
535
536			test3 = b43_read16(dev, B43_MMIO_TSF_3);
537			test2 = b43_read16(dev, B43_MMIO_TSF_2);
538			test1 = b43_read16(dev, B43_MMIO_TSF_1);
539		} while (v3 != test3 || v2 != test2 || v1 != test1);
540
541		*tsf = v3;
542		*tsf <<= 48;
543		tmp = v2;
544		tmp <<= 32;
545		*tsf |= tmp;
546		tmp = v1;
547		tmp <<= 16;
548		*tsf |= tmp;
549		*tsf |= v0;
550	}
551}
552
553static void b43_time_lock(struct b43_wldev *dev)
554{
555	u32 macctl;
556
557	macctl = b43_read32(dev, B43_MMIO_MACCTL);
558	macctl |= B43_MACCTL_TBTTHOLD;
559	b43_write32(dev, B43_MMIO_MACCTL, macctl);
560	/* Commit the write */
561	b43_read32(dev, B43_MMIO_MACCTL);
562}
563
564static void b43_time_unlock(struct b43_wldev *dev)
565{
566	u32 macctl;
567
568	macctl = b43_read32(dev, B43_MMIO_MACCTL);
569	macctl &= ~B43_MACCTL_TBTTHOLD;
570	b43_write32(dev, B43_MMIO_MACCTL, macctl);
571	/* Commit the write */
572	b43_read32(dev, B43_MMIO_MACCTL);
573}
574
575static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
576{
577	/* Be careful with the in-progress timer.
578	 * First zero out the low register, so we have a full
579	 * register-overflow duration to complete the operation.
580	 */
581	if (dev->dev->id.revision >= 3) {
582		u32 lo = (tsf & 0x00000000FFFFFFFFULL);
583		u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
584
585		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
586		mmiowb();
587		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
588		mmiowb();
589		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
590	} else {
591		u16 v0 = (tsf & 0x000000000000FFFFULL);
592		u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
593		u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
594		u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
595
596		b43_write16(dev, B43_MMIO_TSF_0, 0);
597		mmiowb();
598		b43_write16(dev, B43_MMIO_TSF_3, v3);
599		mmiowb();
600		b43_write16(dev, B43_MMIO_TSF_2, v2);
601		mmiowb();
602		b43_write16(dev, B43_MMIO_TSF_1, v1);
603		mmiowb();
604		b43_write16(dev, B43_MMIO_TSF_0, v0);
605	}
606}
607
608void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
609{
610	b43_time_lock(dev);
611	b43_tsf_write_locked(dev, tsf);
612	b43_time_unlock(dev);
613}
614
615static
616void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
617{
618	static const u8 zero_addr[ETH_ALEN] = { 0 };
619	u16 data;
620
621	if (!mac)
622		mac = zero_addr;
623
624	offset |= 0x0020;
625	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
626
627	data = mac[0];
628	data |= mac[1] << 8;
629	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
630	data = mac[2];
631	data |= mac[3] << 8;
632	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
633	data = mac[4];
634	data |= mac[5] << 8;
635	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
636}
637
638static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
639{
640	const u8 *mac;
641	const u8 *bssid;
642	u8 mac_bssid[ETH_ALEN * 2];
643	int i;
644	u32 tmp;
645
646	bssid = dev->wl->bssid;
647	mac = dev->wl->mac_addr;
648
649	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
650
651	memcpy(mac_bssid, mac, ETH_ALEN);
652	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
653
654	/* Write our MAC address and BSSID to template ram */
655	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
656		tmp = (u32) (mac_bssid[i + 0]);
657		tmp |= (u32) (mac_bssid[i + 1]) << 8;
658		tmp |= (u32) (mac_bssid[i + 2]) << 16;
659		tmp |= (u32) (mac_bssid[i + 3]) << 24;
660		b43_ram_write(dev, 0x20 + i, tmp);
661	}
662}
663
664static void b43_upload_card_macaddress(struct b43_wldev *dev)
665{
666	b43_write_mac_bssid_templates(dev);
667	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
668}
669
670static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
671{
672	/* slot_time is in usec. */
673	if (dev->phy.type != B43_PHYTYPE_G)
674		return;
675	b43_write16(dev, 0x684, 510 + slot_time);
676	b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
677}
678
679static void b43_short_slot_timing_enable(struct b43_wldev *dev)
680{
681	b43_set_slot_time(dev, 9);
682	dev->short_slot = 1;
683}
684
685static void b43_short_slot_timing_disable(struct b43_wldev *dev)
686{
687	b43_set_slot_time(dev, 20);
688	dev->short_slot = 0;
689}
690
691/* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
692 * Returns the _previously_ enabled IRQ mask.
693 */
694static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
695{
696	u32 old_mask;
697
698	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
699	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
700
701	return old_mask;
702}
703
704/* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
705 * Returns the _previously_ enabled IRQ mask.
706 */
707static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
708{
709	u32 old_mask;
710
711	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
712	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
713
714	return old_mask;
715}
716
717/* Synchronize IRQ top- and bottom-half.
718 * IRQs must be masked before calling this.
719 * This must not be called with the irq_lock held.
720 */
721static void b43_synchronize_irq(struct b43_wldev *dev)
722{
723	synchronize_irq(dev->dev->irq);
724	tasklet_kill(&dev->isr_tasklet);
725}
726
727/* DummyTransmission function, as documented on
728 * http://bcm-specs.sipsolutions.net/DummyTransmission
729 */
730void b43_dummy_transmission(struct b43_wldev *dev)
731{
732	struct b43_wl *wl = dev->wl;
733	struct b43_phy *phy = &dev->phy;
734	unsigned int i, max_loop;
735	u16 value;
736	u32 buffer[5] = {
737		0x00000000,
738		0x00D40000,
739		0x00000000,
740		0x01000000,
741		0x00000000,
742	};
743
744	switch (phy->type) {
745	case B43_PHYTYPE_A:
746		max_loop = 0x1E;
747		buffer[0] = 0x000201CC;
748		break;
749	case B43_PHYTYPE_B:
750	case B43_PHYTYPE_G:
751		max_loop = 0xFA;
752		buffer[0] = 0x000B846E;
753		break;
754	default:
755		B43_WARN_ON(1);
756		return;
757	}
758
759	spin_lock_irq(&wl->irq_lock);
760	write_lock(&wl->tx_lock);
761
762	for (i = 0; i < 5; i++)
763		b43_ram_write(dev, i * 4, buffer[i]);
764
765	/* Commit writes */
766	b43_read32(dev, B43_MMIO_MACCTL);
767
768	b43_write16(dev, 0x0568, 0x0000);
769	b43_write16(dev, 0x07C0, 0x0000);
770	value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
771	b43_write16(dev, 0x050C, value);
772	b43_write16(dev, 0x0508, 0x0000);
773	b43_write16(dev, 0x050A, 0x0000);
774	b43_write16(dev, 0x054C, 0x0000);
775	b43_write16(dev, 0x056A, 0x0014);
776	b43_write16(dev, 0x0568, 0x0826);
777	b43_write16(dev, 0x0500, 0x0000);
778	b43_write16(dev, 0x0502, 0x0030);
779
780	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
781		b43_radio_write16(dev, 0x0051, 0x0017);
782	for (i = 0x00; i < max_loop; i++) {
783		value = b43_read16(dev, 0x050E);
784		if (value & 0x0080)
785			break;
786		udelay(10);
787	}
788	for (i = 0x00; i < 0x0A; i++) {
789		value = b43_read16(dev, 0x050E);
790		if (value & 0x0400)
791			break;
792		udelay(10);
793	}
794	for (i = 0x00; i < 0x0A; i++) {
795		value = b43_read16(dev, 0x0690);
796		if (!(value & 0x0100))
797			break;
798		udelay(10);
799	}
800	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
801		b43_radio_write16(dev, 0x0051, 0x0037);
802
803	write_unlock(&wl->tx_lock);
804	spin_unlock_irq(&wl->irq_lock);
805}
806
807static void key_write(struct b43_wldev *dev,
808		      u8 index, u8 algorithm, const u8 * key)
809{
810	unsigned int i;
811	u32 offset;
812	u16 value;
813	u16 kidx;
814
815	/* Key index/algo block */
816	kidx = b43_kidx_to_fw(dev, index);
817	value = ((kidx << 4) | algorithm);
818	b43_shm_write16(dev, B43_SHM_SHARED,
819			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
820
821	/* Write the key to the Key Table Pointer offset */
822	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
823	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
824		value = key[i];
825		value |= (u16) (key[i + 1]) << 8;
826		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
827	}
828}
829
830static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
831{
832	u32 addrtmp[2] = { 0, 0, };
833	u8 per_sta_keys_start = 8;
834
835	if (b43_new_kidx_api(dev))
836		per_sta_keys_start = 4;
837
838	B43_WARN_ON(index < per_sta_keys_start);
839	/* We have two default TX keys and possibly two default RX keys.
840	 * Physical mac 0 is mapped to physical key 4 or 8, depending
841	 * on the firmware version.
842	 * So we must adjust the index here.
843	 */
844	index -= per_sta_keys_start;
845
846	if (addr) {
847		addrtmp[0] = addr[0];
848		addrtmp[0] |= ((u32) (addr[1]) << 8);
849		addrtmp[0] |= ((u32) (addr[2]) << 16);
850		addrtmp[0] |= ((u32) (addr[3]) << 24);
851		addrtmp[1] = addr[4];
852		addrtmp[1] |= ((u32) (addr[5]) << 8);
853	}
854
855	if (dev->dev->id.revision >= 5) {
856		/* Receive match transmitter address mechanism */
857		b43_shm_write32(dev, B43_SHM_RCMTA,
858				(index * 2) + 0, addrtmp[0]);
859		b43_shm_write16(dev, B43_SHM_RCMTA,
860				(index * 2) + 1, addrtmp[1]);
861	} else {
862		/* RXE (Receive Engine) and
863		 * PSM (Programmable State Machine) mechanism
864		 */
865		if (index < 8) {
866			/* TODO write to RCM 16, 19, 22 and 25 */
867		} else {
868			b43_shm_write32(dev, B43_SHM_SHARED,
869					B43_SHM_SH_PSM + (index * 6) + 0,
870					addrtmp[0]);
871			b43_shm_write16(dev, B43_SHM_SHARED,
872					B43_SHM_SH_PSM + (index * 6) + 4,
873					addrtmp[1]);
874		}
875	}
876}
877
878static void do_key_write(struct b43_wldev *dev,
879			 u8 index, u8 algorithm,
880			 const u8 * key, size_t key_len, const u8 * mac_addr)
881{
882	u8 buf[B43_SEC_KEYSIZE] = { 0, };
883	u8 per_sta_keys_start = 8;
884
885	if (b43_new_kidx_api(dev))
886		per_sta_keys_start = 4;
887
888	B43_WARN_ON(index >= dev->max_nr_keys);
889	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
890
891	if (index >= per_sta_keys_start)
892		keymac_write(dev, index, NULL);	/* First zero out mac. */
893	if (key)
894		memcpy(buf, key, key_len);
895	key_write(dev, index, algorithm, buf);
896	if (index >= per_sta_keys_start)
897		keymac_write(dev, index, mac_addr);
898
899	dev->key[index].algorithm = algorithm;
900}
901
902static int b43_key_write(struct b43_wldev *dev,
903			 int index, u8 algorithm,
904			 const u8 * key, size_t key_len,
905			 const u8 * mac_addr,
906			 struct ieee80211_key_conf *keyconf)
907{
908	int i;
909	int sta_keys_start;
910
911	if (key_len > B43_SEC_KEYSIZE)
912		return -EINVAL;
913	for (i = 0; i < dev->max_nr_keys; i++) {
914		/* Check that we don't already have this key. */
915		B43_WARN_ON(dev->key[i].keyconf == keyconf);
916	}
917	if (index < 0) {
918		/* Either pairwise key or address is 00:00:00:00:00:00
919		 * for transmit-only keys. Search the index. */
920		if (b43_new_kidx_api(dev))
921			sta_keys_start = 4;
922		else
923			sta_keys_start = 8;
924		for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
925			if (!dev->key[i].keyconf) {
926				/* found empty */
927				index = i;
928				break;
929			}
930		}
931		if (index < 0) {
932			b43err(dev->wl, "Out of hardware key memory\n");
933			return -ENOSPC;
934		}
935	} else
936		B43_WARN_ON(index > 3);
937
938	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
939	if ((index <= 3) && !b43_new_kidx_api(dev)) {
940		/* Default RX key */
941		B43_WARN_ON(mac_addr);
942		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
943	}
944	keyconf->hw_key_idx = index;
945	dev->key[index].keyconf = keyconf;
946
947	return 0;
948}
949
950static int b43_key_clear(struct b43_wldev *dev, int index)
951{
952	if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
953		return -EINVAL;
954	do_key_write(dev, index, B43_SEC_ALGO_NONE,
955		     NULL, B43_SEC_KEYSIZE, NULL);
956	if ((index <= 3) && !b43_new_kidx_api(dev)) {
957		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
958			     NULL, B43_SEC_KEYSIZE, NULL);
959	}
960	dev->key[index].keyconf = NULL;
961
962	return 0;
963}
964
965static void b43_clear_keys(struct b43_wldev *dev)
966{
967	int i;
968
969	for (i = 0; i < dev->max_nr_keys; i++)
970		b43_key_clear(dev, i);
971}
972
973void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
974{
975	u32 macctl;
976	u16 ucstat;
977	bool hwps;
978	bool awake;
979	int i;
980
981	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
982		    (ps_flags & B43_PS_DISABLED));
983	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
984
985	if (ps_flags & B43_PS_ENABLED) {
986		hwps = 1;
987	} else if (ps_flags & B43_PS_DISABLED) {
988		hwps = 0;
989	} else {
990		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
991		//      and thus is not an AP and we are associated, set bit 25
992	}
993	if (ps_flags & B43_PS_AWAKE) {
994		awake = 1;
995	} else if (ps_flags & B43_PS_ASLEEP) {
996		awake = 0;
997	} else {
998		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
999		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1000		//      successful, set bit26
1001	}
1002
1003/* FIXME: For now we force awake-on and hwps-off */
1004	hwps = 0;
1005	awake = 1;
1006
1007	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1008	if (hwps)
1009		macctl |= B43_MACCTL_HWPS;
1010	else
1011		macctl &= ~B43_MACCTL_HWPS;
1012	if (awake)
1013		macctl |= B43_MACCTL_AWAKE;
1014	else
1015		macctl &= ~B43_MACCTL_AWAKE;
1016	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1017	/* Commit write */
1018	b43_read32(dev, B43_MMIO_MACCTL);
1019	if (awake && dev->dev->id.revision >= 5) {
1020		/* Wait for the microcode to wake up. */
1021		for (i = 0; i < 100; i++) {
1022			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1023						B43_SHM_SH_UCODESTAT);
1024			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1025				break;
1026			udelay(10);
1027		}
1028	}
1029}
1030
1031/* Turn the Analog ON/OFF */
1032static void b43_switch_analog(struct b43_wldev *dev, int on)
1033{
1034	switch (dev->phy.type) {
1035	case B43_PHYTYPE_A:
1036	case B43_PHYTYPE_G:
1037		b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
1038		break;
1039	case B43_PHYTYPE_N:
1040		b43_phy_write(dev, B43_NPHY_AFECTL_OVER,
1041			      on ? 0 : 0x7FFF);
1042		break;
1043	default:
1044		B43_WARN_ON(1);
1045	}
1046}
1047
1048void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1049{
1050	u32 tmslow;
1051	u32 macctl;
1052
1053	flags |= B43_TMSLOW_PHYCLKEN;
1054	flags |= B43_TMSLOW_PHYRESET;
1055	ssb_device_enable(dev->dev, flags);
1056	msleep(2);		/* Wait for the PLL to turn on. */
1057
1058	/* Now take the PHY out of Reset again */
1059	tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1060	tmslow |= SSB_TMSLOW_FGC;
1061	tmslow &= ~B43_TMSLOW_PHYRESET;
1062	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1063	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1064	msleep(1);
1065	tmslow &= ~SSB_TMSLOW_FGC;
1066	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1067	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1068	msleep(1);
1069
1070	/* Turn Analog ON */
1071	b43_switch_analog(dev, 1);
1072
1073	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1074	macctl &= ~B43_MACCTL_GMODE;
1075	if (flags & B43_TMSLOW_GMODE)
1076		macctl |= B43_MACCTL_GMODE;
1077	macctl |= B43_MACCTL_IHR_ENABLED;
1078	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1079}
1080
1081static void handle_irq_transmit_status(struct b43_wldev *dev)
1082{
1083	u32 v0, v1;
1084	u16 tmp;
1085	struct b43_txstatus stat;
1086
1087	while (1) {
1088		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1089		if (!(v0 & 0x00000001))
1090			break;
1091		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1092
1093		stat.cookie = (v0 >> 16);
1094		stat.seq = (v1 & 0x0000FFFF);
1095		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1096		tmp = (v0 & 0x0000FFFF);
1097		stat.frame_count = ((tmp & 0xF000) >> 12);
1098		stat.rts_count = ((tmp & 0x0F00) >> 8);
1099		stat.supp_reason = ((tmp & 0x001C) >> 2);
1100		stat.pm_indicated = !!(tmp & 0x0080);
1101		stat.intermediate = !!(tmp & 0x0040);
1102		stat.for_ampdu = !!(tmp & 0x0020);
1103		stat.acked = !!(tmp & 0x0002);
1104
1105		b43_handle_txstatus(dev, &stat);
1106	}
1107}
1108
1109static void drain_txstatus_queue(struct b43_wldev *dev)
1110{
1111	u32 dummy;
1112
1113	if (dev->dev->id.revision < 5)
1114		return;
1115	/* Read all entries from the microcode TXstatus FIFO
1116	 * and throw them away.
1117	 */
1118	while (1) {
1119		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1120		if (!(dummy & 0x00000001))
1121			break;
1122		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1123	}
1124}
1125
1126static u32 b43_jssi_read(struct b43_wldev *dev)
1127{
1128	u32 val = 0;
1129
1130	val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1131	val <<= 16;
1132	val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1133
1134	return val;
1135}
1136
1137static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1138{
1139	b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1140	b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1141}
1142
1143static void b43_generate_noise_sample(struct b43_wldev *dev)
1144{
1145	b43_jssi_write(dev, 0x7F7F7F7F);
1146	b43_write32(dev, B43_MMIO_MACCMD,
1147		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1148	B43_WARN_ON(dev->noisecalc.channel_at_start != dev->phy.channel);
1149}
1150
1151static void b43_calculate_link_quality(struct b43_wldev *dev)
1152{
1153	/* Top half of Link Quality calculation. */
1154
1155	if (dev->noisecalc.calculation_running)
1156		return;
1157	dev->noisecalc.channel_at_start = dev->phy.channel;
1158	dev->noisecalc.calculation_running = 1;
1159	dev->noisecalc.nr_samples = 0;
1160
1161	b43_generate_noise_sample(dev);
1162}
1163
1164static void handle_irq_noise(struct b43_wldev *dev)
1165{
1166	struct b43_phy *phy = &dev->phy;
1167	u16 tmp;
1168	u8 noise[4];
1169	u8 i, j;
1170	s32 average;
1171
1172	/* Bottom half of Link Quality calculation. */
1173
1174	B43_WARN_ON(!dev->noisecalc.calculation_running);
1175	if (dev->noisecalc.channel_at_start != phy->channel)
1176		goto drop_calculation;
1177	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1178	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1179	    noise[2] == 0x7F || noise[3] == 0x7F)
1180		goto generate_new;
1181
1182	/* Get the noise samples. */
1183	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1184	i = dev->noisecalc.nr_samples;
1185	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1186	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1187	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1188	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1189	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1190	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1191	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1192	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1193	dev->noisecalc.nr_samples++;
1194	if (dev->noisecalc.nr_samples == 8) {
1195		/* Calculate the Link Quality by the noise samples. */
1196		average = 0;
1197		for (i = 0; i < 8; i++) {
1198			for (j = 0; j < 4; j++)
1199				average += dev->noisecalc.samples[i][j];
1200		}
1201		average /= (8 * 4);
1202		average *= 125;
1203		average += 64;
1204		average /= 128;
1205		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1206		tmp = (tmp / 128) & 0x1F;
1207		if (tmp >= 8)
1208			average += 2;
1209		else
1210			average -= 25;
1211		if (tmp == 8)
1212			average -= 72;
1213		else
1214			average -= 48;
1215
1216		dev->stats.link_noise = average;
1217	      drop_calculation:
1218		dev->noisecalc.calculation_running = 0;
1219		return;
1220	}
1221      generate_new:
1222	b43_generate_noise_sample(dev);
1223}
1224
1225static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1226{
1227	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP)) {
1228		///TODO: PS TBTT
1229	} else {
1230		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1231			b43_power_saving_ctl_bits(dev, 0);
1232	}
1233	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
1234		dev->dfq_valid = 1;
1235}
1236
1237static void handle_irq_atim_end(struct b43_wldev *dev)
1238{
1239	if (dev->dfq_valid) {
1240		b43_write32(dev, B43_MMIO_MACCMD,
1241			    b43_read32(dev, B43_MMIO_MACCMD)
1242			    | B43_MACCMD_DFQ_VALID);
1243		dev->dfq_valid = 0;
1244	}
1245}
1246
1247static void handle_irq_pmq(struct b43_wldev *dev)
1248{
1249	u32 tmp;
1250
1251	//TODO: AP mode.
1252
1253	while (1) {
1254		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1255		if (!(tmp & 0x00000008))
1256			break;
1257	}
1258	/* 16bit write is odd, but correct. */
1259	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1260}
1261
1262static void b43_write_template_common(struct b43_wldev *dev,
1263				      const u8 * data, u16 size,
1264				      u16 ram_offset,
1265				      u16 shm_size_offset, u8 rate)
1266{
1267	u32 i, tmp;
1268	struct b43_plcp_hdr4 plcp;
1269
1270	plcp.data = 0;
1271	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1272	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1273	ram_offset += sizeof(u32);
1274	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1275	 * So leave the first two bytes of the next write blank.
1276	 */
1277	tmp = (u32) (data[0]) << 16;
1278	tmp |= (u32) (data[1]) << 24;
1279	b43_ram_write(dev, ram_offset, tmp);
1280	ram_offset += sizeof(u32);
1281	for (i = 2; i < size; i += sizeof(u32)) {
1282		tmp = (u32) (data[i + 0]);
1283		if (i + 1 < size)
1284			tmp |= (u32) (data[i + 1]) << 8;
1285		if (i + 2 < size)
1286			tmp |= (u32) (data[i + 2]) << 16;
1287		if (i + 3 < size)
1288			tmp |= (u32) (data[i + 3]) << 24;
1289		b43_ram_write(dev, ram_offset + i - 2, tmp);
1290	}
1291	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1292			size + sizeof(struct b43_plcp_hdr6));
1293}
1294
1295/* Check if the use of the antenna that ieee80211 told us to
1296 * use is possible. This will fall back to DEFAULT.
1297 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1298u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1299				  u8 antenna_nr)
1300{
1301	u8 antenna_mask;
1302
1303	if (antenna_nr == 0) {
1304		/* Zero means "use default antenna". That's always OK. */
1305		return 0;
1306	}
1307
1308	/* Get the mask of available antennas. */
1309	if (dev->phy.gmode)
1310		antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1311	else
1312		antenna_mask = dev->dev->bus->sprom.ant_available_a;
1313
1314	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1315		/* This antenna is not available. Fall back to default. */
1316		return 0;
1317	}
1318
1319	return antenna_nr;
1320}
1321
1322static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
1323{
1324	antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
1325	switch (antenna) {
1326	case 0:		/* default/diversity */
1327		return B43_ANTENNA_DEFAULT;
1328	case 1:		/* Antenna 0 */
1329		return B43_ANTENNA0;
1330	case 2:		/* Antenna 1 */
1331		return B43_ANTENNA1;
1332	case 3:		/* Antenna 2 */
1333		return B43_ANTENNA2;
1334	case 4:		/* Antenna 3 */
1335		return B43_ANTENNA3;
1336	default:
1337		return B43_ANTENNA_DEFAULT;
1338	}
1339}
1340
1341/* Convert a b43 antenna number value to the PHY TX control value. */
1342static u16 b43_antenna_to_phyctl(int antenna)
1343{
1344	switch (antenna) {
1345	case B43_ANTENNA0:
1346		return B43_TXH_PHY_ANT0;
1347	case B43_ANTENNA1:
1348		return B43_TXH_PHY_ANT1;
1349	case B43_ANTENNA2:
1350		return B43_TXH_PHY_ANT2;
1351	case B43_ANTENNA3:
1352		return B43_TXH_PHY_ANT3;
1353	case B43_ANTENNA_AUTO:
1354		return B43_TXH_PHY_ANT01AUTO;
1355	}
1356	B43_WARN_ON(1);
1357	return 0;
1358}
1359
1360static void b43_write_beacon_template(struct b43_wldev *dev,
1361				      u16 ram_offset,
1362				      u16 shm_size_offset)
1363{
1364	unsigned int i, len, variable_len;
1365	const struct ieee80211_mgmt *bcn;
1366	const u8 *ie;
1367	bool tim_found = 0;
1368	unsigned int rate;
1369	u16 ctl;
1370	int antenna;
1371	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1372
1373	bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1374	len = min((size_t) dev->wl->current_beacon->len,
1375		  0x200 - sizeof(struct b43_plcp_hdr6));
1376	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1377
1378	b43_write_template_common(dev, (const u8 *)bcn,
1379				  len, ram_offset, shm_size_offset, rate);
1380
1381	/* Write the PHY TX control parameters. */
1382	antenna = b43_antenna_from_ieee80211(dev, info->antenna_sel_tx);
1383	antenna = b43_antenna_to_phyctl(antenna);
1384	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1385	/* We can't send beacons with short preamble. Would get PHY errors. */
1386	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1387	ctl &= ~B43_TXH_PHY_ANT;
1388	ctl &= ~B43_TXH_PHY_ENC;
1389	ctl |= antenna;
1390	if (b43_is_cck_rate(rate))
1391		ctl |= B43_TXH_PHY_ENC_CCK;
1392	else
1393		ctl |= B43_TXH_PHY_ENC_OFDM;
1394	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1395
1396	/* Find the position of the TIM and the DTIM_period value
1397	 * and write them to SHM. */
1398	ie = bcn->u.beacon.variable;
1399	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1400	for (i = 0; i < variable_len - 2; ) {
1401		uint8_t ie_id, ie_len;
1402
1403		ie_id = ie[i];
1404		ie_len = ie[i + 1];
1405		if (ie_id == 5) {
1406			u16 tim_position;
1407			u16 dtim_period;
1408			/* This is the TIM Information Element */
1409
1410			/* Check whether the ie_len is in the beacon data range. */
1411			if (variable_len < ie_len + 2 + i)
1412				break;
1413			/* A valid TIM is at least 4 bytes long. */
1414			if (ie_len < 4)
1415				break;
1416			tim_found = 1;
1417
1418			tim_position = sizeof(struct b43_plcp_hdr6);
1419			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1420			tim_position += i;
1421
1422			dtim_period = ie[i + 3];
1423
1424			b43_shm_write16(dev, B43_SHM_SHARED,
1425					B43_SHM_SH_TIMBPOS, tim_position);
1426			b43_shm_write16(dev, B43_SHM_SHARED,
1427					B43_SHM_SH_DTIMPER, dtim_period);
1428			break;
1429		}
1430		i += ie_len + 2;
1431	}
1432	if (!tim_found) {
1433		b43warn(dev->wl, "Did not find a valid TIM IE in "
1434			"the beacon template packet. AP or IBSS operation "
1435			"may be broken.\n");
1436	} else
1437		b43dbg(dev->wl, "Updated beacon template\n");
1438}
1439
1440static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1441				      u16 shm_offset, u16 size,
1442				      struct ieee80211_rate *rate)
1443{
1444	struct b43_plcp_hdr4 plcp;
1445	u32 tmp;
1446	__le16 dur;
1447
1448	plcp.data = 0;
1449	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1450	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1451					       dev->wl->vif, size,
1452					       rate);
1453	/* Write PLCP in two parts and timing for packet transfer */
1454	tmp = le32_to_cpu(plcp.data);
1455	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1456	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1457	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1458}
1459
1460/* Instead of using custom probe response template, this function
1461 * just patches custom beacon template by:
1462 * 1) Changing packet type
1463 * 2) Patching duration field
1464 * 3) Stripping TIM
1465 */
1466static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1467					  u16 *dest_size,
1468					  struct ieee80211_rate *rate)
1469{
1470	const u8 *src_data;
1471	u8 *dest_data;
1472	u16 src_size, elem_size, src_pos, dest_pos;
1473	__le16 dur;
1474	struct ieee80211_hdr *hdr;
1475	size_t ie_start;
1476
1477	src_size = dev->wl->current_beacon->len;
1478	src_data = (const u8 *)dev->wl->current_beacon->data;
1479
1480	/* Get the start offset of the variable IEs in the packet. */
1481	ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1482	B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1483
1484	if (B43_WARN_ON(src_size < ie_start))
1485		return NULL;
1486
1487	dest_data = kmalloc(src_size, GFP_ATOMIC);
1488	if (unlikely(!dest_data))
1489		return NULL;
1490
1491	/* Copy the static data and all Information Elements, except the TIM. */
1492	memcpy(dest_data, src_data, ie_start);
1493	src_pos = ie_start;
1494	dest_pos = ie_start;
1495	for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1496		elem_size = src_data[src_pos + 1] + 2;
1497		if (src_data[src_pos] == 5) {
1498			/* This is the TIM. */
1499			continue;
1500		}
1501		memcpy(dest_data + dest_pos, src_data + src_pos,
1502		       elem_size);
1503		dest_pos += elem_size;
1504	}
1505	*dest_size = dest_pos;
1506	hdr = (struct ieee80211_hdr *)dest_data;
1507
1508	/* Set the frame control. */
1509	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1510					 IEEE80211_STYPE_PROBE_RESP);
1511	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1512					       dev->wl->vif, *dest_size,
1513					       rate);
1514	hdr->duration_id = dur;
1515
1516	return dest_data;
1517}
1518
1519static void b43_write_probe_resp_template(struct b43_wldev *dev,
1520					  u16 ram_offset,
1521					  u16 shm_size_offset,
1522					  struct ieee80211_rate *rate)
1523{
1524	const u8 *probe_resp_data;
1525	u16 size;
1526
1527	size = dev->wl->current_beacon->len;
1528	probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1529	if (unlikely(!probe_resp_data))
1530		return;
1531
1532	/* Looks like PLCP headers plus packet timings are stored for
1533	 * all possible basic rates
1534	 */
1535	b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1536	b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1537	b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1538	b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1539
1540	size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1541	b43_write_template_common(dev, probe_resp_data,
1542				  size, ram_offset, shm_size_offset,
1543				  rate->hw_value);
1544	kfree(probe_resp_data);
1545}
1546
1547static void handle_irq_beacon(struct b43_wldev *dev)
1548{
1549	struct b43_wl *wl = dev->wl;
1550	u32 cmd, beacon0_valid, beacon1_valid;
1551
1552	if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
1553		return;
1554
1555	/* This is the bottom half of the asynchronous beacon update. */
1556
1557	/* Ignore interrupt in the future. */
1558	dev->irq_savedstate &= ~B43_IRQ_BEACON;
1559
1560	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1561	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1562	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1563
1564	/* Schedule interrupt manually, if busy. */
1565	if (beacon0_valid && beacon1_valid) {
1566		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1567		dev->irq_savedstate |= B43_IRQ_BEACON;
1568		return;
1569	}
1570
1571	if (!beacon0_valid) {
1572		if (!wl->beacon0_uploaded) {
1573			b43_write_beacon_template(dev, 0x68, 0x18);
1574			b43_write_probe_resp_template(dev, 0x268, 0x4A,
1575						      &__b43_ratetable[3]);
1576			wl->beacon0_uploaded = 1;
1577		}
1578		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1579		cmd |= B43_MACCMD_BEACON0_VALID;
1580		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1581	} else if (!beacon1_valid) {
1582		if (!wl->beacon1_uploaded) {
1583			b43_write_beacon_template(dev, 0x468, 0x1A);
1584			wl->beacon1_uploaded = 1;
1585		}
1586		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1587		cmd |= B43_MACCMD_BEACON1_VALID;
1588		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1589	}
1590}
1591
1592static void b43_beacon_update_trigger_work(struct work_struct *work)
1593{
1594	struct b43_wl *wl = container_of(work, struct b43_wl,
1595					 beacon_update_trigger);
1596	struct b43_wldev *dev;
1597
1598	mutex_lock(&wl->mutex);
1599	dev = wl->current_dev;
1600	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1601		spin_lock_irq(&wl->irq_lock);
1602		/* update beacon right away or defer to irq */
1603		dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1604		handle_irq_beacon(dev);
1605		/* The handler might have updated the IRQ mask. */
1606		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1607			    dev->irq_savedstate);
1608		mmiowb();
1609		spin_unlock_irq(&wl->irq_lock);
1610	}
1611	mutex_unlock(&wl->mutex);
1612}
1613
1614/* Asynchronously update the packet templates in template RAM.
1615 * Locking: Requires wl->irq_lock to be locked. */
1616static void b43_update_templates(struct b43_wl *wl, struct sk_buff *beacon)
1617{
1618	/* This is the top half of the ansynchronous beacon update.
1619	 * The bottom half is the beacon IRQ.
1620	 * Beacon update must be asynchronous to avoid sending an
1621	 * invalid beacon. This can happen for example, if the firmware
1622	 * transmits a beacon while we are updating it. */
1623
1624	if (wl->current_beacon)
1625		dev_kfree_skb_any(wl->current_beacon);
1626	wl->current_beacon = beacon;
1627	wl->beacon0_uploaded = 0;
1628	wl->beacon1_uploaded = 0;
1629	queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1630}
1631
1632static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
1633{
1634	u32 tmp;
1635	u16 i, len;
1636
1637	len = min((u16) ssid_len, (u16) 0x100);
1638	for (i = 0; i < len; i += sizeof(u32)) {
1639		tmp = (u32) (ssid[i + 0]);
1640		if (i + 1 < len)
1641			tmp |= (u32) (ssid[i + 1]) << 8;
1642		if (i + 2 < len)
1643			tmp |= (u32) (ssid[i + 2]) << 16;
1644		if (i + 3 < len)
1645			tmp |= (u32) (ssid[i + 3]) << 24;
1646		b43_shm_write32(dev, B43_SHM_SHARED, 0x380 + i, tmp);
1647	}
1648	b43_shm_write16(dev, B43_SHM_SHARED, 0x48, len);
1649}
1650
1651static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1652{
1653	b43_time_lock(dev);
1654	if (dev->dev->id.revision >= 3) {
1655		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1656		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1657	} else {
1658		b43_write16(dev, 0x606, (beacon_int >> 6));
1659		b43_write16(dev, 0x610, beacon_int);
1660	}
1661	b43_time_unlock(dev);
1662	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1663}
1664
1665static void b43_handle_firmware_panic(struct b43_wldev *dev)
1666{
1667	u16 reason;
1668
1669	/* Read the register that contains the reason code for the panic. */
1670	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1671	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1672
1673	switch (reason) {
1674	default:
1675		b43dbg(dev->wl, "The panic reason is unknown.\n");
1676		/* fallthrough */
1677	case B43_FWPANIC_DIE:
1678		/* Do not restart the controller or firmware.
1679		 * The device is nonfunctional from now on.
1680		 * Restarting would result in this panic to trigger again,
1681		 * so we avoid that recursion. */
1682		break;
1683	case B43_FWPANIC_RESTART:
1684		b43_controller_restart(dev, "Microcode panic");
1685		break;
1686	}
1687}
1688
1689static void handle_irq_ucode_debug(struct b43_wldev *dev)
1690{
1691	unsigned int i, cnt;
1692	u16 reason, marker_id, marker_line;
1693	__le16 *buf;
1694
1695	/* The proprietary firmware doesn't have this IRQ. */
1696	if (!dev->fw.opensource)
1697		return;
1698
1699	/* Read the register that contains the reason code for this IRQ. */
1700	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1701
1702	switch (reason) {
1703	case B43_DEBUGIRQ_PANIC:
1704		b43_handle_firmware_panic(dev);
1705		break;
1706	case B43_DEBUGIRQ_DUMP_SHM:
1707		if (!B43_DEBUG)
1708			break; /* Only with driver debugging enabled. */
1709		buf = kmalloc(4096, GFP_ATOMIC);
1710		if (!buf) {
1711			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1712			goto out;
1713		}
1714		for (i = 0; i < 4096; i += 2) {
1715			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1716			buf[i / 2] = cpu_to_le16(tmp);
1717		}
1718		b43info(dev->wl, "Shared memory dump:\n");
1719		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1720			       16, 2, buf, 4096, 1);
1721		kfree(buf);
1722		break;
1723	case B43_DEBUGIRQ_DUMP_REGS:
1724		if (!B43_DEBUG)
1725			break; /* Only with driver debugging enabled. */
1726		b43info(dev->wl, "Microcode register dump:\n");
1727		for (i = 0, cnt = 0; i < 64; i++) {
1728			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1729			if (cnt == 0)
1730				printk(KERN_INFO);
1731			printk("r%02u: 0x%04X  ", i, tmp);
1732			cnt++;
1733			if (cnt == 6) {
1734				printk("\n");
1735				cnt = 0;
1736			}
1737		}
1738		printk("\n");
1739		break;
1740	case B43_DEBUGIRQ_MARKER:
1741		if (!B43_DEBUG)
1742			break; /* Only with driver debugging enabled. */
1743		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1744					   B43_MARKER_ID_REG);
1745		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1746					     B43_MARKER_LINE_REG);
1747		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1748			"at line number %u\n",
1749			marker_id, marker_line);
1750		break;
1751	default:
1752		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1753		       reason);
1754	}
1755out:
1756	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1757	b43_shm_write16(dev, B43_SHM_SCRATCH,
1758			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1759}
1760
1761/* Interrupt handler bottom-half */
1762static void b43_interrupt_tasklet(struct b43_wldev *dev)
1763{
1764	u32 reason;
1765	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1766	u32 merged_dma_reason = 0;
1767	int i;
1768	unsigned long flags;
1769
1770	spin_lock_irqsave(&dev->wl->irq_lock, flags);
1771
1772	B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1773
1774	reason = dev->irq_reason;
1775	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1776		dma_reason[i] = dev->dma_reason[i];
1777		merged_dma_reason |= dma_reason[i];
1778	}
1779
1780	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1781		b43err(dev->wl, "MAC transmission error\n");
1782
1783	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1784		b43err(dev->wl, "PHY transmission error\n");
1785		rmb();
1786		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1787			atomic_set(&dev->phy.txerr_cnt,
1788				   B43_PHY_TX_BADNESS_LIMIT);
1789			b43err(dev->wl, "Too many PHY TX errors, "
1790					"restarting the controller\n");
1791			b43_controller_restart(dev, "PHY TX errors");
1792		}
1793	}
1794
1795	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1796					  B43_DMAIRQ_NONFATALMASK))) {
1797		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1798			b43err(dev->wl, "Fatal DMA error: "
1799			       "0x%08X, 0x%08X, 0x%08X, "
1800			       "0x%08X, 0x%08X, 0x%08X\n",
1801			       dma_reason[0], dma_reason[1],
1802			       dma_reason[2], dma_reason[3],
1803			       dma_reason[4], dma_reason[5]);
1804			b43_controller_restart(dev, "DMA error");
1805			mmiowb();
1806			spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1807			return;
1808		}
1809		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1810			b43err(dev->wl, "DMA error: "
1811			       "0x%08X, 0x%08X, 0x%08X, "
1812			       "0x%08X, 0x%08X, 0x%08X\n",
1813			       dma_reason[0], dma_reason[1],
1814			       dma_reason[2], dma_reason[3],
1815			       dma_reason[4], dma_reason[5]);
1816		}
1817	}
1818
1819	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1820		handle_irq_ucode_debug(dev);
1821	if (reason & B43_IRQ_TBTT_INDI)
1822		handle_irq_tbtt_indication(dev);
1823	if (reason & B43_IRQ_ATIM_END)
1824		handle_irq_atim_end(dev);
1825	if (reason & B43_IRQ_BEACON)
1826		handle_irq_beacon(dev);
1827	if (reason & B43_IRQ_PMQ)
1828		handle_irq_pmq(dev);
1829	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1830		;/* TODO */
1831	if (reason & B43_IRQ_NOISESAMPLE_OK)
1832		handle_irq_noise(dev);
1833
1834	/* Check the DMA reason registers for received data. */
1835	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1836		if (b43_using_pio_transfers(dev))
1837			b43_pio_rx(dev->pio.rx_queue);
1838		else
1839			b43_dma_rx(dev->dma.rx_ring);
1840	}
1841	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1842	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1843	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1844	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1845	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1846
1847	if (reason & B43_IRQ_TX_OK)
1848		handle_irq_transmit_status(dev);
1849
1850	b43_interrupt_enable(dev, dev->irq_savedstate);
1851	mmiowb();
1852	spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1853}
1854
1855static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1856{
1857	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1858
1859	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1860	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1861	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1862	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1863	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1864	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1865}
1866
1867/* Interrupt handler top-half */
1868static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1869{
1870	irqreturn_t ret = IRQ_NONE;
1871	struct b43_wldev *dev = dev_id;
1872	u32 reason;
1873
1874	if (!dev)
1875		return IRQ_NONE;
1876
1877	spin_lock(&dev->wl->irq_lock);
1878
1879	if (b43_status(dev) < B43_STAT_STARTED)
1880		goto out;
1881	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1882	if (reason == 0xffffffff)	/* shared IRQ */
1883		goto out;
1884	ret = IRQ_HANDLED;
1885	reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1886	if (!reason)
1887		goto out;
1888
1889	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1890	    & 0x0001DC00;
1891	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1892	    & 0x0000DC00;
1893	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1894	    & 0x0000DC00;
1895	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1896	    & 0x0001DC00;
1897	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1898	    & 0x0000DC00;
1899	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1900	    & 0x0000DC00;
1901
1902	b43_interrupt_ack(dev, reason);
1903	/* disable all IRQs. They are enabled again in the bottom half. */
1904	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1905	/* save the reason code and call our bottom half. */
1906	dev->irq_reason = reason;
1907	tasklet_schedule(&dev->isr_tasklet);
1908      out:
1909	mmiowb();
1910	spin_unlock(&dev->wl->irq_lock);
1911
1912	return ret;
1913}
1914
1915static void do_release_fw(struct b43_firmware_file *fw)
1916{
1917	release_firmware(fw->data);
1918	fw->data = NULL;
1919	fw->filename = NULL;
1920}
1921
1922static void b43_release_firmware(struct b43_wldev *dev)
1923{
1924	do_release_fw(&dev->fw.ucode);
1925	do_release_fw(&dev->fw.pcm);
1926	do_release_fw(&dev->fw.initvals);
1927	do_release_fw(&dev->fw.initvals_band);
1928}
1929
1930static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1931{
1932	const char *text;
1933
1934	text = "You must go to "
1935	       "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1936	       "and download the latest firmware (version 4).\n";
1937	if (error)
1938		b43err(wl, text);
1939	else
1940		b43warn(wl, text);
1941}
1942
1943static int do_request_fw(struct b43_wldev *dev,
1944			 const char *name,
1945			 struct b43_firmware_file *fw,
1946			 bool silent)
1947{
1948	char path[sizeof(modparam_fwpostfix) + 32];
1949	const struct firmware *blob;
1950	struct b43_fw_header *hdr;
1951	u32 size;
1952	int err;
1953
1954	if (!name) {
1955		/* Don't fetch anything. Free possibly cached firmware. */
1956		do_release_fw(fw);
1957		return 0;
1958	}
1959	if (fw->filename) {
1960		if (strcmp(fw->filename, name) == 0)
1961			return 0; /* Already have this fw. */
1962		/* Free the cached firmware first. */
1963		do_release_fw(fw);
1964	}
1965
1966	snprintf(path, ARRAY_SIZE(path),
1967		 "b43%s/%s.fw",
1968		 modparam_fwpostfix, name);
1969	err = request_firmware(&blob, path, dev->dev->dev);
1970	if (err == -ENOENT) {
1971		if (!silent) {
1972			b43err(dev->wl, "Firmware file \"%s\" not found\n",
1973			       path);
1974		}
1975		return err;
1976	} else if (err) {
1977		b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
1978		       path, err);
1979		return err;
1980	}
1981	if (blob->size < sizeof(struct b43_fw_header))
1982		goto err_format;
1983	hdr = (struct b43_fw_header *)(blob->data);
1984	switch (hdr->type) {
1985	case B43_FW_TYPE_UCODE:
1986	case B43_FW_TYPE_PCM:
1987		size = be32_to_cpu(hdr->size);
1988		if (size != blob->size - sizeof(struct b43_fw_header))
1989			goto err_format;
1990		/* fallthrough */
1991	case B43_FW_TYPE_IV:
1992		if (hdr->ver != 1)
1993			goto err_format;
1994		break;
1995	default:
1996		goto err_format;
1997	}
1998
1999	fw->data = blob;
2000	fw->filename = name;
2001
2002	return 0;
2003
2004err_format:
2005	b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2006	release_firmware(blob);
2007
2008	return -EPROTO;
2009}
2010
2011static int b43_request_firmware(struct b43_wldev *dev)
2012{
2013	struct b43_firmware *fw = &dev->fw;
2014	const u8 rev = dev->dev->id.revision;
2015	const char *filename;
2016	u32 tmshigh;
2017	int err;
2018
2019	/* Get microcode */
2020	tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2021	if ((rev >= 5) && (rev <= 10))
2022		filename = "ucode5";
2023	else if ((rev >= 11) && (rev <= 12))
2024		filename = "ucode11";
2025	else if (rev >= 13)
2026		filename = "ucode13";
2027	else
2028		goto err_no_ucode;
2029	err = do_request_fw(dev, filename, &fw->ucode, 0);
2030	if (err)
2031		goto err_load;
2032
2033	/* Get PCM code */
2034	if ((rev >= 5) && (rev <= 10))
2035		filename = "pcm5";
2036	else if (rev >= 11)
2037		filename = NULL;
2038	else
2039		goto err_no_pcm;
2040	fw->pcm_request_failed = 0;
2041	err = do_request_fw(dev, filename, &fw->pcm, 1);
2042	if (err == -ENOENT) {
2043		/* We did not find a PCM file? Not fatal, but
2044		 * core rev <= 10 must do without hwcrypto then. */
2045		fw->pcm_request_failed = 1;
2046	} else if (err)
2047		goto err_load;
2048
2049	/* Get initvals */
2050	switch (dev->phy.type) {
2051	case B43_PHYTYPE_A:
2052		if ((rev >= 5) && (rev <= 10)) {
2053			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2054				filename = "a0g1initvals5";
2055			else
2056				filename = "a0g0initvals5";
2057		} else
2058			goto err_no_initvals;
2059		break;
2060	case B43_PHYTYPE_G:
2061		if ((rev >= 5) && (rev <= 10))
2062			filename = "b0g0initvals5";
2063		else if (rev >= 13)
2064			filename = "b0g0initvals13";
2065		else
2066			goto err_no_initvals;
2067		break;
2068	case B43_PHYTYPE_N:
2069		if ((rev >= 11) && (rev <= 12))
2070			filename = "n0initvals11";
2071		else
2072			goto err_no_initvals;
2073		break;
2074	default:
2075		goto err_no_initvals;
2076	}
2077	err = do_request_fw(dev, filename, &fw->initvals, 0);
2078	if (err)
2079		goto err_load;
2080
2081	/* Get bandswitch initvals */
2082	switch (dev->phy.type) {
2083	case B43_PHYTYPE_A:
2084		if ((rev >= 5) && (rev <= 10)) {
2085			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2086				filename = "a0g1bsinitvals5";
2087			else
2088				filename = "a0g0bsinitvals5";
2089		} else if (rev >= 11)
2090			filename = NULL;
2091		else
2092			goto err_no_initvals;
2093		break;
2094	case B43_PHYTYPE_G:
2095		if ((rev >= 5) && (rev <= 10))
2096			filename = "b0g0bsinitvals5";
2097		else if (rev >= 11)
2098			filename = NULL;
2099		else
2100			goto err_no_initvals;
2101		break;
2102	case B43_PHYTYPE_N:
2103		if ((rev >= 11) && (rev <= 12))
2104			filename = "n0bsinitvals11";
2105		else
2106			goto err_no_initvals;
2107		break;
2108	default:
2109		goto err_no_initvals;
2110	}
2111	err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2112	if (err)
2113		goto err_load;
2114
2115	return 0;
2116
2117err_load:
2118	b43_print_fw_helptext(dev->wl, 1);
2119	goto error;
2120
2121err_no_ucode:
2122	err = -ENODEV;
2123	b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2124	goto error;
2125
2126err_no_pcm:
2127	err = -ENODEV;
2128	b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2129	goto error;
2130
2131err_no_initvals:
2132	err = -ENODEV;
2133	b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2134	       "core rev %u\n", dev->phy.type, rev);
2135	goto error;
2136
2137error:
2138	b43_release_firmware(dev);
2139	return err;
2140}
2141
2142static int b43_upload_microcode(struct b43_wldev *dev)
2143{
2144	const size_t hdr_len = sizeof(struct b43_fw_header);
2145	const __be32 *data;
2146	unsigned int i, len;
2147	u16 fwrev, fwpatch, fwdate, fwtime;
2148	u32 tmp, macctl;
2149	int err = 0;
2150
2151	/* Jump the microcode PSM to offset 0 */
2152	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2153	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2154	macctl |= B43_MACCTL_PSM_JMP0;
2155	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2156	/* Zero out all microcode PSM registers and shared memory. */
2157	for (i = 0; i < 64; i++)
2158		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2159	for (i = 0; i < 4096; i += 2)
2160		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2161
2162	/* Upload Microcode. */
2163	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2164	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2165	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2166	for (i = 0; i < len; i++) {
2167		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2168		udelay(10);
2169	}
2170
2171	if (dev->fw.pcm.data) {
2172		/* Upload PCM data. */
2173		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2174		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2175		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2176		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2177		/* No need for autoinc bit in SHM_HW */
2178		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2179		for (i = 0; i < len; i++) {
2180			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2181			udelay(10);
2182		}
2183	}
2184
2185	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2186
2187	/* Start the microcode PSM */
2188	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2189	macctl &= ~B43_MACCTL_PSM_JMP0;
2190	macctl |= B43_MACCTL_PSM_RUN;
2191	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2192
2193	/* Wait for the microcode to load and respond */
2194	i = 0;
2195	while (1) {
2196		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2197		if (tmp == B43_IRQ_MAC_SUSPENDED)
2198			break;
2199		i++;
2200		if (i >= 20) {
2201			b43err(dev->wl, "Microcode not responding\n");
2202			b43_print_fw_helptext(dev->wl, 1);
2203			err = -ENODEV;
2204			goto error;
2205		}
2206		msleep_interruptible(50);
2207		if (signal_pending(current)) {
2208			err = -EINTR;
2209			goto error;
2210		}
2211	}
2212	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2213
2214	/* Get and check the revisions. */
2215	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2216	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2217	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2218	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2219
2220	if (fwrev <= 0x128) {
2221		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2222		       "binary drivers older than version 4.x is unsupported. "
2223		       "You must upgrade your firmware files.\n");
2224		b43_print_fw_helptext(dev->wl, 1);
2225		err = -EOPNOTSUPP;
2226		goto error;
2227	}
2228	dev->fw.rev = fwrev;
2229	dev->fw.patch = fwpatch;
2230	dev->fw.opensource = (fwdate == 0xFFFF);
2231
2232	if (dev->fw.opensource) {
2233		/* Patchlevel info is encoded in the "time" field. */
2234		dev->fw.patch = fwtime;
2235		b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2236			dev->fw.rev, dev->fw.patch,
2237			dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2238	} else {
2239		b43info(dev->wl, "Loading firmware version %u.%u "
2240			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2241			fwrev, fwpatch,
2242			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2243			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2244		if (dev->fw.pcm_request_failed) {
2245			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2246				"Hardware accelerated cryptography is disabled.\n");
2247			b43_print_fw_helptext(dev->wl, 0);
2248		}
2249	}
2250
2251	if (b43_is_old_txhdr_format(dev)) {
2252		b43warn(dev->wl, "You are using an old firmware image. "
2253			"Support for old firmware will be removed in July 2008.\n");
2254		b43_print_fw_helptext(dev->wl, 0);
2255	}
2256
2257	return 0;
2258
2259error:
2260	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2261	macctl &= ~B43_MACCTL_PSM_RUN;
2262	macctl |= B43_MACCTL_PSM_JMP0;
2263	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2264
2265	return err;
2266}
2267
2268static int b43_write_initvals(struct b43_wldev *dev,
2269			      const struct b43_iv *ivals,
2270			      size_t count,
2271			      size_t array_size)
2272{
2273	const struct b43_iv *iv;
2274	u16 offset;
2275	size_t i;
2276	bool bit32;
2277
2278	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2279	iv = ivals;
2280	for (i = 0; i < count; i++) {
2281		if (array_size < sizeof(iv->offset_size))
2282			goto err_format;
2283		array_size -= sizeof(iv->offset_size);
2284		offset = be16_to_cpu(iv->offset_size);
2285		bit32 = !!(offset & B43_IV_32BIT);
2286		offset &= B43_IV_OFFSET_MASK;
2287		if (offset >= 0x1000)
2288			goto err_format;
2289		if (bit32) {
2290			u32 value;
2291
2292			if (array_size < sizeof(iv->data.d32))
2293				goto err_format;
2294			array_size -= sizeof(iv->data.d32);
2295
2296			value = get_unaligned_be32(&iv->data.d32);
2297			b43_write32(dev, offset, value);
2298
2299			iv = (const struct b43_iv *)((const uint8_t *)iv +
2300							sizeof(__be16) +
2301							sizeof(__be32));
2302		} else {
2303			u16 value;
2304
2305			if (array_size < sizeof(iv->data.d16))
2306				goto err_format;
2307			array_size -= sizeof(iv->data.d16);
2308
2309			value = be16_to_cpu(iv->data.d16);
2310			b43_write16(dev, offset, value);
2311
2312			iv = (const struct b43_iv *)((const uint8_t *)iv +
2313							sizeof(__be16) +
2314							sizeof(__be16));
2315		}
2316	}
2317	if (array_size)
2318		goto err_format;
2319
2320	return 0;
2321
2322err_format:
2323	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2324	b43_print_fw_helptext(dev->wl, 1);
2325
2326	return -EPROTO;
2327}
2328
2329static int b43_upload_initvals(struct b43_wldev *dev)
2330{
2331	const size_t hdr_len = sizeof(struct b43_fw_header);
2332	const struct b43_fw_header *hdr;
2333	struct b43_firmware *fw = &dev->fw;
2334	const struct b43_iv *ivals;
2335	size_t count;
2336	int err;
2337
2338	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2339	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2340	count = be32_to_cpu(hdr->size);
2341	err = b43_write_initvals(dev, ivals, count,
2342				 fw->initvals.data->size - hdr_len);
2343	if (err)
2344		goto out;
2345	if (fw->initvals_band.data) {
2346		hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2347		ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2348		count = be32_to_cpu(hdr->size);
2349		err = b43_write_initvals(dev, ivals, count,
2350					 fw->initvals_band.data->size - hdr_len);
2351		if (err)
2352			goto out;
2353	}
2354out:
2355
2356	return err;
2357}
2358
2359/* Initialize the GPIOs
2360 * http://bcm-specs.sipsolutions.net/GPIO
2361 */
2362static int b43_gpio_init(struct b43_wldev *dev)
2363{
2364	struct ssb_bus *bus = dev->dev->bus;
2365	struct ssb_device *gpiodev, *pcidev = NULL;
2366	u32 mask, set;
2367
2368	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2369		    & ~B43_MACCTL_GPOUTSMSK);
2370
2371	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2372		    | 0x000F);
2373
2374	mask = 0x0000001F;
2375	set = 0x0000000F;
2376	if (dev->dev->bus->chip_id == 0x4301) {
2377		mask |= 0x0060;
2378		set |= 0x0060;
2379	}
2380	if (0 /* FIXME: conditional unknown */ ) {
2381		b43_write16(dev, B43_MMIO_GPIO_MASK,
2382			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2383			    | 0x0100);
2384		mask |= 0x0180;
2385		set |= 0x0180;
2386	}
2387	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2388		b43_write16(dev, B43_MMIO_GPIO_MASK,
2389			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2390			    | 0x0200);
2391		mask |= 0x0200;
2392		set |= 0x0200;
2393	}
2394	if (dev->dev->id.revision >= 2)
2395		mask |= 0x0010;	/* FIXME: This is redundant. */
2396
2397#ifdef CONFIG_SSB_DRIVER_PCICORE
2398	pcidev = bus->pcicore.dev;
2399#endif
2400	gpiodev = bus->chipco.dev ? : pcidev;
2401	if (!gpiodev)
2402		return 0;
2403	ssb_write32(gpiodev, B43_GPIO_CONTROL,
2404		    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2405		     & mask) | set);
2406
2407	return 0;
2408}
2409
2410/* Turn off all GPIO stuff. Call this on module unload, for example. */
2411static void b43_gpio_cleanup(struct b43_wldev *dev)
2412{
2413	struct ssb_bus *bus = dev->dev->bus;
2414	struct ssb_device *gpiodev, *pcidev = NULL;
2415
2416#ifdef CONFIG_SSB_DRIVER_PCICORE
2417	pcidev = bus->pcicore.dev;
2418#endif
2419	gpiodev = bus->chipco.dev ? : pcidev;
2420	if (!gpiodev)
2421		return;
2422	ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2423}
2424
2425/* http://bcm-specs.sipsolutions.net/EnableMac */
2426void b43_mac_enable(struct b43_wldev *dev)
2427{
2428	dev->mac_suspended--;
2429	B43_WARN_ON(dev->mac_suspended < 0);
2430	if (dev->mac_suspended == 0) {
2431		b43_write32(dev, B43_MMIO_MACCTL,
2432			    b43_read32(dev, B43_MMIO_MACCTL)
2433			    | B43_MACCTL_ENABLED);
2434		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2435			    B43_IRQ_MAC_SUSPENDED);
2436		/* Commit writes */
2437		b43_read32(dev, B43_MMIO_MACCTL);
2438		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2439		b43_power_saving_ctl_bits(dev, 0);
2440	}
2441}
2442
2443/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2444void b43_mac_suspend(struct b43_wldev *dev)
2445{
2446	int i;
2447	u32 tmp;
2448
2449	might_sleep();
2450	B43_WARN_ON(dev->mac_suspended < 0);
2451
2452	if (dev->mac_suspended == 0) {
2453		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2454		b43_write32(dev, B43_MMIO_MACCTL,
2455			    b43_read32(dev, B43_MMIO_MACCTL)
2456			    & ~B43_MACCTL_ENABLED);
2457		/* force pci to flush the write */
2458		b43_read32(dev, B43_MMIO_MACCTL);
2459		for (i = 35; i; i--) {
2460			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2461			if (tmp & B43_IRQ_MAC_SUSPENDED)
2462				goto out;
2463			udelay(10);
2464		}
2465		/* Hm, it seems this will take some time. Use msleep(). */
2466		for (i = 40; i; i--) {
2467			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2468			if (tmp & B43_IRQ_MAC_SUSPENDED)
2469				goto out;
2470			msleep(1);
2471		}
2472		b43err(dev->wl, "MAC suspend failed\n");
2473	}
2474out:
2475	dev->mac_suspended++;
2476}
2477
2478static void b43_adjust_opmode(struct b43_wldev *dev)
2479{
2480	struct b43_wl *wl = dev->wl;
2481	u32 ctl;
2482	u16 cfp_pretbtt;
2483
2484	ctl = b43_read32(dev, B43_MMIO_MACCTL);
2485	/* Reset status to STA infrastructure mode. */
2486	ctl &= ~B43_MACCTL_AP;
2487	ctl &= ~B43_MACCTL_KEEP_CTL;
2488	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2489	ctl &= ~B43_MACCTL_KEEP_BAD;
2490	ctl &= ~B43_MACCTL_PROMISC;
2491	ctl &= ~B43_MACCTL_BEACPROMISC;
2492	ctl |= B43_MACCTL_INFRA;
2493
2494	if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
2495		ctl |= B43_MACCTL_AP;
2496	else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS))
2497		ctl &= ~B43_MACCTL_INFRA;
2498
2499	if (wl->filter_flags & FIF_CONTROL)
2500		ctl |= B43_MACCTL_KEEP_CTL;
2501	if (wl->filter_flags & FIF_FCSFAIL)
2502		ctl |= B43_MACCTL_KEEP_BAD;
2503	if (wl->filter_flags & FIF_PLCPFAIL)
2504		ctl |= B43_MACCTL_KEEP_BADPLCP;
2505	if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2506		ctl |= B43_MACCTL_PROMISC;
2507	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2508		ctl |= B43_MACCTL_BEACPROMISC;
2509
2510	/* Workaround: On old hardware the HW-MAC-address-filter
2511	 * doesn't work properly, so always run promisc in filter
2512	 * it in software. */
2513	if (dev->dev->id.revision <= 4)
2514		ctl |= B43_MACCTL_PROMISC;
2515
2516	b43_write32(dev, B43_MMIO_MACCTL, ctl);
2517
2518	cfp_pretbtt = 2;
2519	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2520		if (dev->dev->bus->chip_id == 0x4306 &&
2521		    dev->dev->bus->chip_rev == 3)
2522			cfp_pretbtt = 100;
2523		else
2524			cfp_pretbtt = 50;
2525	}
2526	b43_write16(dev, 0x612, cfp_pretbtt);
2527}
2528
2529static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2530{
2531	u16 offset;
2532
2533	if (is_ofdm) {
2534		offset = 0x480;
2535		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2536	} else {
2537		offset = 0x4C0;
2538		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2539	}
2540	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2541			b43_shm_read16(dev, B43_SHM_SHARED, offset));
2542}
2543
2544static void b43_rate_memory_init(struct b43_wldev *dev)
2545{
2546	switch (dev->phy.type) {
2547	case B43_PHYTYPE_A:
2548	case B43_PHYTYPE_G:
2549	case B43_PHYTYPE_N:
2550		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2551		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2552		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2553		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2554		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2555		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2556		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2557		if (dev->phy.type == B43_PHYTYPE_A)
2558			break;
2559		/* fallthrough */
2560	case B43_PHYTYPE_B:
2561		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2562		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2563		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2564		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2565		break;
2566	default:
2567		B43_WARN_ON(1);
2568	}
2569}
2570
2571/* Set the default values for the PHY TX Control Words. */
2572static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2573{
2574	u16 ctl = 0;
2575
2576	ctl |= B43_TXH_PHY_ENC_CCK;
2577	ctl |= B43_TXH_PHY_ANT01AUTO;
2578	ctl |= B43_TXH_PHY_TXPWR;
2579
2580	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2581	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2582	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2583}
2584
2585/* Set the TX-Antenna for management frames sent by firmware. */
2586static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2587{
2588	u16 ant;
2589	u16 tmp;
2590
2591	ant = b43_antenna_to_phyctl(antenna);
2592
2593	/* For ACK/CTS */
2594	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2595	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2596	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2597	/* For Probe Resposes */
2598	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2599	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2600	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2601}
2602
2603/* This is the opposite of b43_chip_init() */
2604static void b43_chip_exit(struct b43_wldev *dev)
2605{
2606	b43_radio_turn_off(dev, 1);
2607	b43_gpio_cleanup(dev);
2608	b43_lo_g_cleanup(dev);
2609	/* firmware is released later */
2610}
2611
2612/* Initialize the chip
2613 * http://bcm-specs.sipsolutions.net/ChipInit
2614 */
2615static int b43_chip_init(struct b43_wldev *dev)
2616{
2617	struct b43_phy *phy = &dev->phy;
2618	int err, tmp;
2619	u32 value32, macctl;
2620	u16 value16;
2621
2622	/* Initialize the MAC control */
2623	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2624	if (dev->phy.gmode)
2625		macctl |= B43_MACCTL_GMODE;
2626	macctl |= B43_MACCTL_INFRA;
2627	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2628
2629	err = b43_request_firmware(dev);
2630	if (err)
2631		goto out;
2632	err = b43_upload_microcode(dev);
2633	if (err)
2634		goto out;	/* firmware is released later */
2635
2636	err = b43_gpio_init(dev);
2637	if (err)
2638		goto out;	/* firmware is released later */
2639
2640	err = b43_upload_initvals(dev);
2641	if (err)
2642		goto err_gpio_clean;
2643	b43_radio_turn_on(dev);
2644
2645	b43_write16(dev, 0x03E6, 0x0000);
2646	err = b43_phy_init(dev);
2647	if (err)
2648		goto err_radio_off;
2649
2650	/* Select initial Interference Mitigation. */
2651	tmp = phy->interfmode;
2652	phy->interfmode = B43_INTERFMODE_NONE;
2653	b43_radio_set_interference_mitigation(dev, tmp);
2654
2655	b43_set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2656	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2657
2658	if (phy->type == B43_PHYTYPE_B) {
2659		value16 = b43_read16(dev, 0x005E);
2660		value16 |= 0x0004;
2661		b43_write16(dev, 0x005E, value16);
2662	}
2663	b43_write32(dev, 0x0100, 0x01000000);
2664	if (dev->dev->id.revision < 5)
2665		b43_write32(dev, 0x010C, 0x01000000);
2666
2667	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2668		    & ~B43_MACCTL_INFRA);
2669	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2670		    | B43_MACCTL_INFRA);
2671
2672	/* Probe Response Timeout value */
2673	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2674	b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2675
2676	/* Initially set the wireless operation mode. */
2677	b43_adjust_opmode(dev);
2678
2679	if (dev->dev->id.revision < 3) {
2680		b43_write16(dev, 0x060E, 0x0000);
2681		b43_write16(dev, 0x0610, 0x8000);
2682		b43_write16(dev, 0x0604, 0x0000);
2683		b43_write16(dev, 0x0606, 0x0200);
2684	} else {
2685		b43_write32(dev, 0x0188, 0x80000000);
2686		b43_write32(dev, 0x018C, 0x02000000);
2687	}
2688	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2689	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2690	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2691	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2692	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2693	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2694	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2695
2696	value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2697	value32 |= 0x00100000;
2698	ssb_write32(dev->dev, SSB_TMSLOW, value32);
2699
2700	b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2701		    dev->dev->bus->chipco.fast_pwrup_delay);
2702
2703	err = 0;
2704	b43dbg(dev->wl, "Chip initialized\n");
2705out:
2706	return err;
2707
2708err_radio_off:
2709	b43_radio_turn_off(dev, 1);
2710err_gpio_clean:
2711	b43_gpio_cleanup(dev);
2712	return err;
2713}
2714
2715static void b43_periodic_every60sec(struct b43_wldev *dev)
2716{
2717	struct b43_phy *phy = &dev->phy;
2718
2719	if (phy->type != B43_PHYTYPE_G)
2720		return;
2721	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_RSSI) {
2722		b43_mac_suspend(dev);
2723		b43_calc_nrssi_slope(dev);
2724		if ((phy->radio_ver == 0x2050) && (phy->radio_rev == 8)) {
2725			u8 old_chan = phy->channel;
2726
2727			/* VCO Calibration */
2728			if (old_chan >= 8)
2729				b43_radio_selectchannel(dev, 1, 0);
2730			else
2731				b43_radio_selectchannel(dev, 13, 0);
2732			b43_radio_selectchannel(dev, old_chan, 0);
2733		}
2734		b43_mac_enable(dev);
2735	}
2736}
2737
2738static void b43_periodic_every30sec(struct b43_wldev *dev)
2739{
2740	/* Update device statistics. */
2741	b43_calculate_link_quality(dev);
2742}
2743
2744static void b43_periodic_every15sec(struct b43_wldev *dev)
2745{
2746	struct b43_phy *phy = &dev->phy;
2747
2748	if (phy->type == B43_PHYTYPE_G) {
2749		//TODO: update_aci_moving_average
2750		if (phy->aci_enable && phy->aci_wlan_automatic) {
2751			b43_mac_suspend(dev);
2752			if (!phy->aci_enable && 1 /*TODO: not scanning? */ ) {
2753				if (0 /*TODO: bunch of conditions */ ) {
2754					b43_radio_set_interference_mitigation
2755					    (dev, B43_INTERFMODE_MANUALWLAN);
2756				}
2757			} else if (1 /*TODO*/) {
2758				/*
2759				   if ((aci_average > 1000) && !(b43_radio_aci_scan(dev))) {
2760				   b43_radio_set_interference_mitigation(dev,
2761				   B43_INTERFMODE_NONE);
2762				   }
2763				 */
2764			}
2765			b43_mac_enable(dev);
2766		} else if (phy->interfmode == B43_INTERFMODE_NONWLAN &&
2767			   phy->rev == 1) {
2768			//TODO: implement rev1 workaround
2769		}
2770	}
2771	b43_phy_xmitpower(dev);	//FIXME: unless scanning?
2772	b43_lo_g_maintanance_work(dev);
2773	//TODO for APHY (temperature?)
2774
2775	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2776	wmb();
2777}
2778
2779static void do_periodic_work(struct b43_wldev *dev)
2780{
2781	unsigned int state;
2782
2783	state = dev->periodic_state;
2784	if (state % 4 == 0)
2785		b43_periodic_every60sec(dev);
2786	if (state % 2 == 0)
2787		b43_periodic_every30sec(dev);
2788	b43_periodic_every15sec(dev);
2789}
2790
2791/* Periodic work locking policy:
2792 * 	The whole periodic work handler is protected by
2793 * 	wl->mutex. If another lock is needed somewhere in the
2794 * 	pwork callchain, it's aquired in-place, where it's needed.
2795 */
2796static void b43_periodic_work_handler(struct work_struct *work)
2797{
2798	struct b43_wldev *dev = container_of(work, struct b43_wldev,
2799					     periodic_work.work);
2800	struct b43_wl *wl = dev->wl;
2801	unsigned long delay;
2802
2803	mutex_lock(&wl->mutex);
2804
2805	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2806		goto out;
2807	if (b43_debug(dev, B43_DBG_PWORK_STOP))
2808		goto out_requeue;
2809
2810	do_periodic_work(dev);
2811
2812	dev->periodic_state++;
2813out_requeue:
2814	if (b43_debug(dev, B43_DBG_PWORK_FAST))
2815		delay = msecs_to_jiffies(50);
2816	else
2817		delay = round_jiffies_relative(HZ * 15);
2818	queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2819out:
2820	mutex_unlock(&wl->mutex);
2821}
2822
2823static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2824{
2825	struct delayed_work *work = &dev->periodic_work;
2826
2827	dev->periodic_state = 0;
2828	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2829	queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2830}
2831
2832/* Check if communication with the device works correctly. */
2833static int b43_validate_chipaccess(struct b43_wldev *dev)
2834{
2835	u32 v, backup;
2836
2837	backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2838
2839	/* Check for read/write and endianness problems. */
2840	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2841	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2842		goto error;
2843	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2844	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2845		goto error;
2846
2847	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2848
2849	if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2850		/* The 32bit register shadows the two 16bit registers
2851		 * with update sideeffects. Validate this. */
2852		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2853		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2854		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2855			goto error;
2856		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2857			goto error;
2858	}
2859	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2860
2861	v = b43_read32(dev, B43_MMIO_MACCTL);
2862	v |= B43_MACCTL_GMODE;
2863	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2864		goto error;
2865
2866	return 0;
2867error:
2868	b43err(dev->wl, "Failed to validate the chipaccess\n");
2869	return -ENODEV;
2870}
2871
2872static void b43_security_init(struct b43_wldev *dev)
2873{
2874	dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2875	B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2876	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2877	/* KTP is a word address, but we address SHM bytewise.
2878	 * So multiply by two.
2879	 */
2880	dev->ktp *= 2;
2881	if (dev->dev->id.revision >= 5) {
2882		/* Number of RCMTA address slots */
2883		b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2884	}
2885	b43_clear_keys(dev);
2886}
2887
2888static int b43_rng_read(struct hwrng *rng, u32 * data)
2889{
2890	struct b43_wl *wl = (struct b43_wl *)rng->priv;
2891	unsigned long flags;
2892
2893	/* Don't take wl->mutex here, as it could deadlock with
2894	 * hwrng internal locking. It's not needed to take
2895	 * wl->mutex here, anyway. */
2896
2897	spin_lock_irqsave(&wl->irq_lock, flags);
2898	*data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2899	spin_unlock_irqrestore(&wl->irq_lock, flags);
2900
2901	return (sizeof(u16));
2902}
2903
2904static void b43_rng_exit(struct b43_wl *wl)
2905{
2906	if (wl->rng_initialized)
2907		hwrng_unregister(&wl->rng);
2908}
2909
2910static int b43_rng_init(struct b43_wl *wl)
2911{
2912	int err;
2913
2914	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2915		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2916	wl->rng.name = wl->rng_name;
2917	wl->rng.data_read = b43_rng_read;
2918	wl->rng.priv = (unsigned long)wl;
2919	wl->rng_initialized = 1;
2920	err = hwrng_register(&wl->rng);
2921	if (err) {
2922		wl->rng_initialized = 0;
2923		b43err(wl, "Failed to register the random "
2924		       "number generator (%d)\n", err);
2925	}
2926
2927	return err;
2928}
2929
2930static int b43_op_tx(struct ieee80211_hw *hw,
2931		     struct sk_buff *skb)
2932{
2933	struct b43_wl *wl = hw_to_b43_wl(hw);
2934	struct b43_wldev *dev = wl->current_dev;
2935	unsigned long flags;
2936	int err;
2937
2938	if (unlikely(skb->len < 2 + 2 + 6)) {
2939		/* Too short, this can't be a valid frame. */
2940		dev_kfree_skb_any(skb);
2941		return NETDEV_TX_OK;
2942	}
2943	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2944	if (unlikely(!dev))
2945		return NETDEV_TX_BUSY;
2946
2947	/* Transmissions on seperate queues can run concurrently. */
2948	read_lock_irqsave(&wl->tx_lock, flags);
2949
2950	err = -ENODEV;
2951	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2952		if (b43_using_pio_transfers(dev))
2953			err = b43_pio_tx(dev, skb);
2954		else
2955			err = b43_dma_tx(dev, skb);
2956	}
2957
2958	read_unlock_irqrestore(&wl->tx_lock, flags);
2959
2960	if (unlikely(err))
2961		return NETDEV_TX_BUSY;
2962	return NETDEV_TX_OK;
2963}
2964
2965/* Locking: wl->irq_lock */
2966static void b43_qos_params_upload(struct b43_wldev *dev,
2967				  const struct ieee80211_tx_queue_params *p,
2968				  u16 shm_offset)
2969{
2970	u16 params[B43_NR_QOSPARAMS];
2971	int cw_min, cw_max, aifs, bslots, tmp;
2972	unsigned int i;
2973
2974	const u16 aCWmin = 0x0001;
2975	const u16 aCWmax = 0x03FF;
2976
2977	/* Calculate the default values for the parameters, if needed. */
2978	switch (shm_offset) {
2979	case B43_QOS_VOICE:
2980		aifs = (p->aifs == -1) ? 2 : p->aifs;
2981		cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 4 - 1) : p->cw_min;
2982		cw_max = (p->cw_max == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_max;
2983		break;
2984	case B43_QOS_VIDEO:
2985		aifs = (p->aifs == -1) ? 2 : p->aifs;
2986		cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_min;
2987		cw_max = (p->cw_max == 0) ? aCWmin : p->cw_max;
2988		break;
2989	case B43_QOS_BESTEFFORT:
2990		aifs = (p->aifs == -1) ? 3 : p->aifs;
2991		cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
2992		cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
2993		break;
2994	case B43_QOS_BACKGROUND:
2995		aifs = (p->aifs == -1) ? 7 : p->aifs;
2996		cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
2997		cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
2998		break;
2999	default:
3000		B43_WARN_ON(1);
3001		return;
3002	}
3003	if (cw_min <= 0)
3004		cw_min = aCWmin;
3005	if (cw_max <= 0)
3006		cw_max = aCWmin;
3007	bslots = b43_read16(dev, B43_MMIO_RNG) % cw_min;
3008
3009	memset(&params, 0, sizeof(params));
3010
3011	params[B43_QOSPARAM_TXOP] = p->txop * 32;
3012	params[B43_QOSPARAM_CWMIN] = cw_min;
3013	params[B43_QOSPARAM_CWMAX] = cw_max;
3014	params[B43_QOSPARAM_CWCUR] = cw_min;
3015	params[B43_QOSPARAM_AIFS] = aifs;
3016	params[B43_QOSPARAM_BSLOTS] = bslots;
3017	params[B43_QOSPARAM_REGGAP] = bslots + aifs;
3018
3019	for (i = 0; i < ARRAY_SIZE(params); i++) {
3020		if (i == B43_QOSPARAM_STATUS) {
3021			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3022					     shm_offset + (i * 2));
3023			/* Mark the parameters as updated. */
3024			tmp |= 0x100;
3025			b43_shm_write16(dev, B43_SHM_SHARED,
3026					shm_offset + (i * 2),
3027					tmp);
3028		} else {
3029			b43_shm_write16(dev, B43_SHM_SHARED,
3030					shm_offset + (i * 2),
3031					params[i]);
3032		}
3033	}
3034}
3035
3036/* Update the QOS parameters in hardware. */
3037static void b43_qos_update(struct b43_wldev *dev)
3038{
3039	struct b43_wl *wl = dev->wl;
3040	struct b43_qos_params *params;
3041	unsigned long flags;
3042	unsigned int i;
3043
3044	/* Mapping of mac80211 queues to b43 SHM offsets. */
3045	static const u16 qos_shm_offsets[] = {
3046		[0] = B43_QOS_VOICE,
3047		[1] = B43_QOS_VIDEO,
3048		[2] = B43_QOS_BESTEFFORT,
3049		[3] = B43_QOS_BACKGROUND,
3050	};
3051	BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
3052
3053	b43_mac_suspend(dev);
3054	spin_lock_irqsave(&wl->irq_lock, flags);
3055
3056	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3057		params = &(wl->qos_params[i]);
3058		if (params->need_hw_update) {
3059			b43_qos_params_upload(dev, &(params->p),
3060					      qos_shm_offsets[i]);
3061			params->need_hw_update = 0;
3062		}
3063	}
3064
3065	spin_unlock_irqrestore(&wl->irq_lock, flags);
3066	b43_mac_enable(dev);
3067}
3068
3069static void b43_qos_clear(struct b43_wl *wl)
3070{
3071	struct b43_qos_params *params;
3072	unsigned int i;
3073
3074	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3075		params = &(wl->qos_params[i]);
3076
3077		memset(&(params->p), 0, sizeof(params->p));
3078		params->p.aifs = -1;
3079		params->need_hw_update = 1;
3080	}
3081}
3082
3083/* Initialize the core's QOS capabilities */
3084static void b43_qos_init(struct b43_wldev *dev)
3085{
3086	struct b43_wl *wl = dev->wl;
3087	unsigned int i;
3088
3089	/* Upload the current QOS parameters. */
3090	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
3091		wl->qos_params[i].need_hw_update = 1;
3092	b43_qos_update(dev);
3093
3094	/* Enable QOS support. */
3095	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3096	b43_write16(dev, B43_MMIO_IFSCTL,
3097		    b43_read16(dev, B43_MMIO_IFSCTL)
3098		    | B43_MMIO_IFSCTL_USE_EDCF);
3099}
3100
3101static void b43_qos_update_work(struct work_struct *work)
3102{
3103	struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
3104	struct b43_wldev *dev;
3105
3106	mutex_lock(&wl->mutex);
3107	dev = wl->current_dev;
3108	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
3109		b43_qos_update(dev);
3110	mutex_unlock(&wl->mutex);
3111}
3112
3113static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3114			  const struct ieee80211_tx_queue_params *params)
3115{
3116	struct b43_wl *wl = hw_to_b43_wl(hw);
3117	unsigned long flags;
3118	unsigned int queue = (unsigned int)_queue;
3119	struct b43_qos_params *p;
3120
3121	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3122		/* Queue not available or don't support setting
3123		 * params on this queue. Return success to not
3124		 * confuse mac80211. */
3125		return 0;
3126	}
3127
3128	spin_lock_irqsave(&wl->irq_lock, flags);
3129	p = &(wl->qos_params[queue]);
3130	memcpy(&(p->p), params, sizeof(p->p));
3131	p->need_hw_update = 1;
3132	spin_unlock_irqrestore(&wl->irq_lock, flags);
3133
3134	queue_work(hw->workqueue, &wl->qos_update_work);
3135
3136	return 0;
3137}
3138
3139static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3140			       struct ieee80211_tx_queue_stats *stats)
3141{
3142	struct b43_wl *wl = hw_to_b43_wl(hw);
3143	struct b43_wldev *dev = wl->current_dev;
3144	unsigned long flags;
3145	int err = -ENODEV;
3146
3147	if (!dev)
3148		goto out;
3149	spin_lock_irqsave(&wl->irq_lock, flags);
3150	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3151		if (b43_using_pio_transfers(dev))
3152			b43_pio_get_tx_stats(dev, stats);
3153		else
3154			b43_dma_get_tx_stats(dev, stats);
3155		err = 0;
3156	}
3157	spin_unlock_irqrestore(&wl->irq_lock, flags);
3158out:
3159	return err;
3160}
3161
3162static int b43_op_get_stats(struct ieee80211_hw *hw,
3163			    struct ieee80211_low_level_stats *stats)
3164{
3165	struct b43_wl *wl = hw_to_b43_wl(hw);
3166	unsigned long flags;
3167
3168	spin_lock_irqsave(&wl->irq_lock, flags);
3169	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3170	spin_unlock_irqrestore(&wl->irq_lock, flags);
3171
3172	return 0;
3173}
3174
3175static void b43_put_phy_into_reset(struct b43_wldev *dev)
3176{
3177	struct ssb_device *sdev = dev->dev;
3178	u32 tmslow;
3179
3180	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3181	tmslow &= ~B43_TMSLOW_GMODE;
3182	tmslow |= B43_TMSLOW_PHYRESET;
3183	tmslow |= SSB_TMSLOW_FGC;
3184	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3185	msleep(1);
3186
3187	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3188	tmslow &= ~SSB_TMSLOW_FGC;
3189	tmslow |= B43_TMSLOW_PHYRESET;
3190	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3191	msleep(1);
3192}
3193
3194static const char * band_to_string(enum ieee80211_band band)
3195{
3196	switch (band) {
3197	case IEEE80211_BAND_5GHZ:
3198		return "5";
3199	case IEEE80211_BAND_2GHZ:
3200		return "2.4";
3201	default:
3202		break;
3203	}
3204	B43_WARN_ON(1);
3205	return "";
3206}
3207
3208/* Expects wl->mutex locked */
3209static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3210{
3211	struct b43_wldev *up_dev = NULL;
3212	struct b43_wldev *down_dev;
3213	struct b43_wldev *d;
3214	int err;
3215	bool gmode;
3216	int prev_status;
3217
3218	/* Find a device and PHY which supports the band. */
3219	list_for_each_entry(d, &wl->devlist, list) {
3220		switch (chan->band) {
3221		case IEEE80211_BAND_5GHZ:
3222			if (d->phy.supports_5ghz) {
3223				up_dev = d;
3224				gmode = 0;
3225			}
3226			break;
3227		case IEEE80211_BAND_2GHZ:
3228			if (d->phy.supports_2ghz) {
3229				up_dev = d;
3230				gmode = 1;
3231			}
3232			break;
3233		default:
3234			B43_WARN_ON(1);
3235			return -EINVAL;
3236		}
3237		if (up_dev)
3238			break;
3239	}
3240	if (!up_dev) {
3241		b43err(wl, "Could not find a device for %s-GHz band operation\n",
3242		       band_to_string(chan->band));
3243		return -ENODEV;
3244	}
3245	if ((up_dev == wl->current_dev) &&
3246	    (!!wl->current_dev->phy.gmode == !!gmode)) {
3247		/* This device is already running. */
3248		return 0;
3249	}
3250	b43dbg(wl, "Switching to %s-GHz band\n",
3251	       band_to_string(chan->band));
3252	down_dev = wl->current_dev;
3253
3254	prev_status = b43_status(down_dev);
3255	/* Shutdown the currently running core. */
3256	if (prev_status >= B43_STAT_STARTED)
3257		b43_wireless_core_stop(down_dev);
3258	if (prev_status >= B43_STAT_INITIALIZED)
3259		b43_wireless_core_exit(down_dev);
3260
3261	if (down_dev != up_dev) {
3262		/* We switch to a different core, so we put PHY into
3263		 * RESET on the old core. */
3264		b43_put_phy_into_reset(down_dev);
3265	}
3266
3267	/* Now start the new core. */
3268	up_dev->phy.gmode = gmode;
3269	if (prev_status >= B43_STAT_INITIALIZED) {
3270		err = b43_wireless_core_init(up_dev);
3271		if (err) {
3272			b43err(wl, "Fatal: Could not initialize device for "
3273			       "selected %s-GHz band\n",
3274			       band_to_string(chan->band));
3275			goto init_failure;
3276		}
3277	}
3278	if (prev_status >= B43_STAT_STARTED) {
3279		err = b43_wireless_core_start(up_dev);
3280		if (err) {
3281			b43err(wl, "Fatal: Coult not start device for "
3282			       "selected %s-GHz band\n",
3283			       band_to_string(chan->band));
3284			b43_wireless_core_exit(up_dev);
3285			goto init_failure;
3286		}
3287	}
3288	B43_WARN_ON(b43_status(up_dev) != prev_status);
3289
3290	wl->current_dev = up_dev;
3291
3292	return 0;
3293init_failure:
3294	/* Whoops, failed to init the new core. No core is operating now. */
3295	wl->current_dev = NULL;
3296	return err;
3297}
3298
3299static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
3300{
3301	struct b43_wl *wl = hw_to_b43_wl(hw);
3302	struct b43_wldev *dev;
3303	struct b43_phy *phy;
3304	unsigned long flags;
3305	int antenna;
3306	int err = 0;
3307	u32 savedirqs;
3308
3309	mutex_lock(&wl->mutex);
3310
3311	/* Switch the band (if necessary). This might change the active core. */
3312	err = b43_switch_band(wl, conf->channel);
3313	if (err)
3314		goto out_unlock_mutex;
3315	dev = wl->current_dev;
3316	phy = &dev->phy;
3317
3318	/* Disable IRQs while reconfiguring the device.
3319	 * This makes it possible to drop the spinlock throughout
3320	 * the reconfiguration process. */
3321	spin_lock_irqsave(&wl->irq_lock, flags);
3322	if (b43_status(dev) < B43_STAT_STARTED) {
3323		spin_unlock_irqrestore(&wl->irq_lock, flags);
3324		goto out_unlock_mutex;
3325	}
3326	savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3327	spin_unlock_irqrestore(&wl->irq_lock, flags);
3328	b43_synchronize_irq(dev);
3329
3330	/* Switch to the requested channel.
3331	 * The firmware takes care of races with the TX handler. */
3332	if (conf->channel->hw_value != phy->channel)
3333		b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
3334
3335	/* Enable/Disable ShortSlot timing. */
3336	if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
3337	    dev->short_slot) {
3338		B43_WARN_ON(phy->type != B43_PHYTYPE_G);
3339		if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)
3340			b43_short_slot_timing_enable(dev);
3341		else
3342			b43_short_slot_timing_disable(dev);
3343	}
3344
3345	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3346
3347	/* Adjust the desired TX power level. */
3348	if (conf->power_level != 0) {
3349		if (conf->power_level != phy->power_level) {
3350			phy->power_level = conf->power_level;
3351			b43_phy_xmitpower(dev);
3352		}
3353	}
3354
3355	/* Antennas for RX and management frame TX. */
3356	antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
3357	b43_mgmtframe_txantenna(dev, antenna);
3358	antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
3359	b43_set_rx_antenna(dev, antenna);
3360
3361	/* Update templates for AP mode. */
3362	if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
3363		b43_set_beacon_int(dev, conf->beacon_int);
3364
3365	if (!!conf->radio_enabled != phy->radio_on) {
3366		if (conf->radio_enabled) {
3367			b43_radio_turn_on(dev);
3368			b43info(dev->wl, "Radio turned on by software\n");
3369			if (!dev->radio_hw_enable) {
3370				b43info(dev->wl, "The hardware RF-kill button "
3371					"still turns the radio physically off. "
3372					"Press the button to turn it on.\n");
3373			}
3374		} else {
3375			b43_radio_turn_off(dev, 0);
3376			b43info(dev->wl, "Radio turned off by software\n");
3377		}
3378	}
3379
3380	spin_lock_irqsave(&wl->irq_lock, flags);
3381	b43_interrupt_enable(dev, savedirqs);
3382	mmiowb();
3383	spin_unlock_irqrestore(&wl->irq_lock, flags);
3384      out_unlock_mutex:
3385	mutex_unlock(&wl->mutex);
3386
3387	return err;
3388}
3389
3390static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3391			   const u8 *local_addr, const u8 *addr,
3392			   struct ieee80211_key_conf *key)
3393{
3394	struct b43_wl *wl = hw_to_b43_wl(hw);
3395	struct b43_wldev *dev;
3396	unsigned long flags;
3397	u8 algorithm;
3398	u8 index;
3399	int err;
3400	DECLARE_MAC_BUF(mac);
3401
3402	if (modparam_nohwcrypt)
3403		return -ENOSPC; /* User disabled HW-crypto */
3404
3405	mutex_lock(&wl->mutex);
3406	spin_lock_irqsave(&wl->irq_lock, flags);
3407
3408	dev = wl->current_dev;
3409	err = -ENODEV;
3410	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3411		goto out_unlock;
3412
3413	if (dev->fw.pcm_request_failed) {
3414		/* We don't have firmware for the crypto engine.
3415		 * Must use software-crypto. */
3416		err = -EOPNOTSUPP;
3417		goto out_unlock;
3418	}
3419
3420	err = -EINVAL;
3421	switch (key->alg) {
3422	case ALG_WEP:
3423		if (key->keylen == 5)
3424			algorithm = B43_SEC_ALGO_WEP40;
3425		else
3426			algorithm = B43_SEC_ALGO_WEP104;
3427		break;
3428	case ALG_TKIP:
3429		algorithm = B43_SEC_ALGO_TKIP;
3430		break;
3431	case ALG_CCMP:
3432		algorithm = B43_SEC_ALGO_AES;
3433		break;
3434	default:
3435		B43_WARN_ON(1);
3436		goto out_unlock;
3437	}
3438	index = (u8) (key->keyidx);
3439	if (index > 3)
3440		goto out_unlock;
3441
3442	switch (cmd) {
3443	case SET_KEY:
3444		if (algorithm == B43_SEC_ALGO_TKIP) {
3445			/* FIXME: No TKIP hardware encryption for now. */
3446			err = -EOPNOTSUPP;
3447			goto out_unlock;
3448		}
3449
3450		if (is_broadcast_ether_addr(addr)) {
3451			/* addr is FF:FF:FF:FF:FF:FF for default keys */
3452			err = b43_key_write(dev, index, algorithm,
3453					    key->key, key->keylen, NULL, key);
3454		} else {
3455			/*
3456			 * either pairwise key or address is 00:00:00:00:00:00
3457			 * for transmit-only keys
3458			 */
3459			err = b43_key_write(dev, -1, algorithm,
3460					    key->key, key->keylen, addr, key);
3461		}
3462		if (err)
3463			goto out_unlock;
3464
3465		if (algorithm == B43_SEC_ALGO_WEP40 ||
3466		    algorithm == B43_SEC_ALGO_WEP104) {
3467			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3468		} else {
3469			b43_hf_write(dev,
3470				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3471		}
3472		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3473		break;
3474	case DISABLE_KEY: {
3475		err = b43_key_clear(dev, key->hw_key_idx);
3476		if (err)
3477			goto out_unlock;
3478		break;
3479	}
3480	default:
3481		B43_WARN_ON(1);
3482	}
3483out_unlock:
3484	spin_unlock_irqrestore(&wl->irq_lock, flags);
3485	mutex_unlock(&wl->mutex);
3486	if (!err) {
3487		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3488		       "mac: %s\n",
3489		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3490		       print_mac(mac, addr));
3491	}
3492	return err;
3493}
3494
3495static void b43_op_configure_filter(struct ieee80211_hw *hw,
3496				    unsigned int changed, unsigned int *fflags,
3497				    int mc_count, struct dev_addr_list *mc_list)
3498{
3499	struct b43_wl *wl = hw_to_b43_wl(hw);
3500	struct b43_wldev *dev = wl->current_dev;
3501	unsigned long flags;
3502
3503	if (!dev) {
3504		*fflags = 0;
3505		return;
3506	}
3507
3508	spin_lock_irqsave(&wl->irq_lock, flags);
3509	*fflags &= FIF_PROMISC_IN_BSS |
3510		  FIF_ALLMULTI |
3511		  FIF_FCSFAIL |
3512		  FIF_PLCPFAIL |
3513		  FIF_CONTROL |
3514		  FIF_OTHER_BSS |
3515		  FIF_BCN_PRBRESP_PROMISC;
3516
3517	changed &= FIF_PROMISC_IN_BSS |
3518		   FIF_ALLMULTI |
3519		   FIF_FCSFAIL |
3520		   FIF_PLCPFAIL |
3521		   FIF_CONTROL |
3522		   FIF_OTHER_BSS |
3523		   FIF_BCN_PRBRESP_PROMISC;
3524
3525	wl->filter_flags = *fflags;
3526
3527	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3528		b43_adjust_opmode(dev);
3529	spin_unlock_irqrestore(&wl->irq_lock, flags);
3530}
3531
3532static int b43_op_config_interface(struct ieee80211_hw *hw,
3533				   struct ieee80211_vif *vif,
3534				   struct ieee80211_if_conf *conf)
3535{
3536	struct b43_wl *wl = hw_to_b43_wl(hw);
3537	struct b43_wldev *dev = wl->current_dev;
3538	unsigned long flags;
3539
3540	if (!dev)
3541		return -ENODEV;
3542	mutex_lock(&wl->mutex);
3543	spin_lock_irqsave(&wl->irq_lock, flags);
3544	B43_WARN_ON(wl->vif != vif);
3545	if (conf->bssid)
3546		memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3547	else
3548		memset(wl->bssid, 0, ETH_ALEN);
3549	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3550		if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP)) {
3551			B43_WARN_ON(conf->type != IEEE80211_IF_TYPE_AP);
3552			b43_set_ssid(dev, conf->ssid, conf->ssid_len);
3553			if (conf->beacon)
3554				b43_update_templates(wl, conf->beacon);
3555		}
3556		b43_write_mac_bssid_templates(dev);
3557	}
3558	spin_unlock_irqrestore(&wl->irq_lock, flags);
3559	mutex_unlock(&wl->mutex);
3560
3561	return 0;
3562}
3563
3564/* Locking: wl->mutex */
3565static void b43_wireless_core_stop(struct b43_wldev *dev)
3566{
3567	struct b43_wl *wl = dev->wl;
3568	unsigned long flags;
3569
3570	if (b43_status(dev) < B43_STAT_STARTED)
3571		return;
3572
3573	/* Disable and sync interrupts. We must do this before than
3574	 * setting the status to INITIALIZED, as the interrupt handler
3575	 * won't care about IRQs then. */
3576	spin_lock_irqsave(&wl->irq_lock, flags);
3577	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3578	b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* flush */
3579	spin_unlock_irqrestore(&wl->irq_lock, flags);
3580	b43_synchronize_irq(dev);
3581
3582	write_lock_irqsave(&wl->tx_lock, flags);
3583	b43_set_status(dev, B43_STAT_INITIALIZED);
3584	write_unlock_irqrestore(&wl->tx_lock, flags);
3585
3586	b43_pio_stop(dev);
3587	mutex_unlock(&wl->mutex);
3588	/* Must unlock as it would otherwise deadlock. No races here.
3589	 * Cancel the possibly running self-rearming periodic work. */
3590	cancel_delayed_work_sync(&dev->periodic_work);
3591	mutex_lock(&wl->mutex);
3592
3593	b43_mac_suspend(dev);
3594	free_irq(dev->dev->irq, dev);
3595	b43dbg(wl, "Wireless interface stopped\n");
3596}
3597
3598/* Locking: wl->mutex */
3599static int b43_wireless_core_start(struct b43_wldev *dev)
3600{
3601	int err;
3602
3603	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3604
3605	drain_txstatus_queue(dev);
3606	err = request_irq(dev->dev->irq, b43_interrupt_handler,
3607			  IRQF_SHARED, KBUILD_MODNAME, dev);
3608	if (err) {
3609		b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3610		goto out;
3611	}
3612
3613	/* We are ready to run. */
3614	b43_set_status(dev, B43_STAT_STARTED);
3615
3616	/* Start data flow (TX/RX). */
3617	b43_mac_enable(dev);
3618	b43_interrupt_enable(dev, dev->irq_savedstate);
3619
3620	/* Start maintainance work */
3621	b43_periodic_tasks_setup(dev);
3622
3623	b43dbg(dev->wl, "Wireless interface started\n");
3624      out:
3625	return err;
3626}
3627
3628/* Get PHY and RADIO versioning numbers */
3629static int b43_phy_versioning(struct b43_wldev *dev)
3630{
3631	struct b43_phy *phy = &dev->phy;
3632	u32 tmp;
3633	u8 analog_type;
3634	u8 phy_type;
3635	u8 phy_rev;
3636	u16 radio_manuf;
3637	u16 radio_ver;
3638	u16 radio_rev;
3639	int unsupported = 0;
3640
3641	/* Get PHY versioning */
3642	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3643	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3644	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3645	phy_rev = (tmp & B43_PHYVER_VERSION);
3646	switch (phy_type) {
3647	case B43_PHYTYPE_A:
3648		if (phy_rev >= 4)
3649			unsupported = 1;
3650		break;
3651	case B43_PHYTYPE_B:
3652		if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3653		    && phy_rev != 7)
3654			unsupported = 1;
3655		break;
3656	case B43_PHYTYPE_G:
3657		if (phy_rev > 9)
3658			unsupported = 1;
3659		break;
3660#ifdef CONFIG_B43_NPHY
3661	case B43_PHYTYPE_N:
3662		if (phy_rev > 1)
3663			unsupported = 1;
3664		break;
3665#endif
3666	default:
3667		unsupported = 1;
3668	};
3669	if (unsupported) {
3670		b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3671		       "(Analog %u, Type %u, Revision %u)\n",
3672		       analog_type, phy_type, phy_rev);
3673		return -EOPNOTSUPP;
3674	}
3675	b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3676	       analog_type, phy_type, phy_rev);
3677
3678	/* Get RADIO versioning */
3679	if (dev->dev->bus->chip_id == 0x4317) {
3680		if (dev->dev->bus->chip_rev == 0)
3681			tmp = 0x3205017F;
3682		else if (dev->dev->bus->chip_rev == 1)
3683			tmp = 0x4205017F;
3684		else
3685			tmp = 0x5205017F;
3686	} else {
3687		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3688		tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3689		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3690		tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3691	}
3692	radio_manuf = (tmp & 0x00000FFF);
3693	radio_ver = (tmp & 0x0FFFF000) >> 12;
3694	radio_rev = (tmp & 0xF0000000) >> 28;
3695	if (radio_manuf != 0x17F /* Broadcom */)
3696		unsupported = 1;
3697	switch (phy_type) {
3698	case B43_PHYTYPE_A:
3699		if (radio_ver != 0x2060)
3700			unsupported = 1;
3701		if (radio_rev != 1)
3702			unsupported = 1;
3703		if (radio_manuf != 0x17F)
3704			unsupported = 1;
3705		break;
3706	case B43_PHYTYPE_B:
3707		if ((radio_ver & 0xFFF0) != 0x2050)
3708			unsupported = 1;
3709		break;
3710	case B43_PHYTYPE_G:
3711		if (radio_ver != 0x2050)
3712			unsupported = 1;
3713		break;
3714	case B43_PHYTYPE_N:
3715		if (radio_ver != 0x2055)
3716			unsupported = 1;
3717		break;
3718	default:
3719		B43_WARN_ON(1);
3720	}
3721	if (unsupported) {
3722		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3723		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3724		       radio_manuf, radio_ver, radio_rev);
3725		return -EOPNOTSUPP;
3726	}
3727	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3728	       radio_manuf, radio_ver, radio_rev);
3729
3730	phy->radio_manuf = radio_manuf;
3731	phy->radio_ver = radio_ver;
3732	phy->radio_rev = radio_rev;
3733
3734	phy->analog = analog_type;
3735	phy->type = phy_type;
3736	phy->rev = phy_rev;
3737
3738	return 0;
3739}
3740
3741static void setup_struct_phy_for_init(struct b43_wldev *dev,
3742				      struct b43_phy *phy)
3743{
3744	struct b43_txpower_lo_control *lo;
3745	int i;
3746
3747	memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3748	memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3749
3750	phy->aci_enable = 0;
3751	phy->aci_wlan_automatic = 0;
3752	phy->aci_hw_rssi = 0;
3753
3754	phy->radio_off_context.valid = 0;
3755
3756	lo = phy->lo_control;
3757	if (lo) {
3758		memset(lo, 0, sizeof(*(phy->lo_control)));
3759		lo->tx_bias = 0xFF;
3760		INIT_LIST_HEAD(&lo->calib_list);
3761	}
3762	phy->max_lb_gain = 0;
3763	phy->trsw_rx_gain = 0;
3764	phy->txpwr_offset = 0;
3765
3766	/* NRSSI */
3767	phy->nrssislope = 0;
3768	for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3769		phy->nrssi[i] = -1000;
3770	for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3771		phy->nrssi_lt[i] = i;
3772
3773	phy->lofcal = 0xFFFF;
3774	phy->initval = 0xFFFF;
3775
3776	phy->interfmode = B43_INTERFMODE_NONE;
3777	phy->channel = 0xFF;
3778
3779	phy->hardware_power_control = !!modparam_hwpctl;
3780
3781	/* PHY TX errors counter. */
3782	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3783
3784	/* OFDM-table address caching. */
3785	phy->ofdmtab_addr_direction = B43_OFDMTAB_DIRECTION_UNKNOWN;
3786}
3787
3788static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3789{
3790	dev->dfq_valid = 0;
3791
3792	/* Assume the radio is enabled. If it's not enabled, the state will
3793	 * immediately get fixed on the first periodic work run. */
3794	dev->radio_hw_enable = 1;
3795
3796	/* Stats */
3797	memset(&dev->stats, 0, sizeof(dev->stats));
3798
3799	setup_struct_phy_for_init(dev, &dev->phy);
3800
3801	/* IRQ related flags */
3802	dev->irq_reason = 0;
3803	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3804	dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3805
3806	dev->mac_suspended = 1;
3807
3808	/* Noise calculation context */
3809	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3810}
3811
3812static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3813{
3814	struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3815	u64 hf;
3816
3817	if (!modparam_btcoex)
3818		return;
3819	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3820		return;
3821	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3822		return;
3823
3824	hf = b43_hf_read(dev);
3825	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3826		hf |= B43_HF_BTCOEXALT;
3827	else
3828		hf |= B43_HF_BTCOEX;
3829	b43_hf_write(dev, hf);
3830}
3831
3832static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3833{
3834	if (!modparam_btcoex)
3835		return;
3836	//TODO
3837}
3838
3839static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3840{
3841#ifdef CONFIG_SSB_DRIVER_PCICORE
3842	struct ssb_bus *bus = dev->dev->bus;
3843	u32 tmp;
3844
3845	if (bus->pcicore.dev &&
3846	    bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3847	    bus->pcicore.dev->id.revision <= 5) {
3848		/* IMCFGLO timeouts workaround. */
3849		tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3850		tmp &= ~SSB_IMCFGLO_REQTO;
3851		tmp &= ~SSB_IMCFGLO_SERTO;
3852		switch (bus->bustype) {
3853		case SSB_BUSTYPE_PCI:
3854		case SSB_BUSTYPE_PCMCIA:
3855			tmp |= 0x32;
3856			break;
3857		case SSB_BUSTYPE_SSB:
3858			tmp |= 0x53;
3859			break;
3860		}
3861		ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3862	}
3863#endif /* CONFIG_SSB_DRIVER_PCICORE */
3864}
3865
3866/* Write the short and long frame retry limit values. */
3867static void b43_set_retry_limits(struct b43_wldev *dev,
3868				 unsigned int short_retry,
3869				 unsigned int long_retry)
3870{
3871	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3872	 * the chip-internal counter. */
3873	short_retry = min(short_retry, (unsigned int)0xF);
3874	long_retry = min(long_retry, (unsigned int)0xF);
3875
3876	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3877			short_retry);
3878	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3879			long_retry);
3880}
3881
3882static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3883{
3884	u16 pu_delay;
3885
3886	/* The time value is in microseconds. */
3887	if (dev->phy.type == B43_PHYTYPE_A)
3888		pu_delay = 3700;
3889	else
3890		pu_delay = 1050;
3891	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS) || idle)
3892		pu_delay = 500;
3893	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3894		pu_delay = max(pu_delay, (u16)2400);
3895
3896	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3897}
3898
3899/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3900static void b43_set_pretbtt(struct b43_wldev *dev)
3901{
3902	u16 pretbtt;
3903
3904	/* The time value is in microseconds. */
3905	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS)) {
3906		pretbtt = 2;
3907	} else {
3908		if (dev->phy.type == B43_PHYTYPE_A)
3909			pretbtt = 120;
3910		else
3911			pretbtt = 250;
3912	}
3913	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3914	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3915}
3916
3917/* Shutdown a wireless core */
3918/* Locking: wl->mutex */
3919static void b43_wireless_core_exit(struct b43_wldev *dev)
3920{
3921	struct b43_phy *phy = &dev->phy;
3922	u32 macctl;
3923
3924	B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3925	if (b43_status(dev) != B43_STAT_INITIALIZED)
3926		return;
3927	b43_set_status(dev, B43_STAT_UNINIT);
3928
3929	/* Stop the microcode PSM. */
3930	macctl = b43_read32(dev, B43_MMIO_MACCTL);
3931	macctl &= ~B43_MACCTL_PSM_RUN;
3932	macctl |= B43_MACCTL_PSM_JMP0;
3933	b43_write32(dev, B43_MMIO_MACCTL, macctl);
3934
3935	if (!dev->suspend_in_progress) {
3936		b43_leds_exit(dev);
3937		b43_rng_exit(dev->wl);
3938	}
3939	b43_dma_free(dev);
3940	b43_pio_free(dev);
3941	b43_chip_exit(dev);
3942	b43_radio_turn_off(dev, 1);
3943	b43_switch_analog(dev, 0);
3944	if (phy->dyn_tssi_tbl)
3945		kfree(phy->tssi2dbm);
3946	kfree(phy->lo_control);
3947	phy->lo_control = NULL;
3948	if (dev->wl->current_beacon) {
3949		dev_kfree_skb_any(dev->wl->current_beacon);
3950		dev->wl->current_beacon = NULL;
3951	}
3952
3953	ssb_device_disable(dev->dev, 0);
3954	ssb_bus_may_powerdown(dev->dev->bus);
3955}
3956
3957/* Initialize a wireless core */
3958static int b43_wireless_core_init(struct b43_wldev *dev)
3959{
3960	struct b43_wl *wl = dev->wl;
3961	struct ssb_bus *bus = dev->dev->bus;
3962	struct ssb_sprom *sprom = &bus->sprom;
3963	struct b43_phy *phy = &dev->phy;
3964	int err;
3965	u64 hf;
3966	u32 tmp;
3967
3968	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
3969
3970	err = ssb_bus_powerup(bus, 0);
3971	if (err)
3972		goto out;
3973	if (!ssb_device_is_enabled(dev->dev)) {
3974		tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
3975		b43_wireless_core_reset(dev, tmp);
3976	}
3977
3978	if ((phy->type == B43_PHYTYPE_B) || (phy->type == B43_PHYTYPE_G)) {
3979		phy->lo_control =
3980		    kzalloc(sizeof(*(phy->lo_control)), GFP_KERNEL);
3981		if (!phy->lo_control) {
3982			err = -ENOMEM;
3983			goto err_busdown;
3984		}
3985	}
3986	setup_struct_wldev_for_init(dev);
3987
3988	err = b43_phy_init_tssi2dbm_table(dev);
3989	if (err)
3990		goto err_kfree_lo_control;
3991
3992	/* Enable IRQ routing to this device. */
3993	ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
3994
3995	b43_imcfglo_timeouts_workaround(dev);
3996	b43_bluetooth_coext_disable(dev);
3997	b43_phy_early_init(dev);
3998	err = b43_chip_init(dev);
3999	if (err)
4000		goto err_kfree_tssitbl;
4001	b43_shm_write16(dev, B43_SHM_SHARED,
4002			B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4003	hf = b43_hf_read(dev);
4004	if (phy->type == B43_PHYTYPE_G) {
4005		hf |= B43_HF_SYMW;
4006		if (phy->rev == 1)
4007			hf |= B43_HF_GDCW;
4008		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4009			hf |= B43_HF_OFDMPABOOST;
4010	} else if (phy->type == B43_PHYTYPE_B) {
4011		hf |= B43_HF_SYMW;
4012		if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4013			hf &= ~B43_HF_GDCW;
4014	}
4015	b43_hf_write(dev, hf);
4016
4017	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4018			     B43_DEFAULT_LONG_RETRY_LIMIT);
4019	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4020	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4021
4022	/* Disable sending probe responses from firmware.
4023	 * Setting the MaxTime to one usec will always trigger
4024	 * a timeout, so we never send any probe resp.
4025	 * A timeout of zero is infinite. */
4026	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4027
4028	b43_rate_memory_init(dev);
4029	b43_set_phytxctl_defaults(dev);
4030
4031	/* Minimum Contention Window */
4032	if (phy->type == B43_PHYTYPE_B) {
4033		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4034	} else {
4035		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4036	}
4037	/* Maximum Contention Window */
4038	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4039
4040	if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4041		dev->__using_pio_transfers = 1;
4042		err = b43_pio_init(dev);
4043	} else {
4044		dev->__using_pio_transfers = 0;
4045		err = b43_dma_init(dev);
4046	}
4047	if (err)
4048		goto err_chip_exit;
4049	b43_qos_init(dev);
4050	b43_set_synth_pu_delay(dev, 1);
4051	b43_bluetooth_coext_enable(dev);
4052
4053	ssb_bus_powerup(bus, 1);	/* Enable dynamic PCTL */
4054	b43_upload_card_macaddress(dev);
4055	b43_security_init(dev);
4056	if (!dev->suspend_in_progress)
4057		b43_rng_init(wl);
4058
4059	b43_set_status(dev, B43_STAT_INITIALIZED);
4060
4061	if (!dev->suspend_in_progress)
4062		b43_leds_init(dev);
4063out:
4064	return err;
4065
4066      err_chip_exit:
4067	b43_chip_exit(dev);
4068      err_kfree_tssitbl:
4069	if (phy->dyn_tssi_tbl)
4070		kfree(phy->tssi2dbm);
4071      err_kfree_lo_control:
4072	kfree(phy->lo_control);
4073	phy->lo_control = NULL;
4074      err_busdown:
4075	ssb_bus_may_powerdown(bus);
4076	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4077	return err;
4078}
4079
4080static int b43_op_add_interface(struct ieee80211_hw *hw,
4081				struct ieee80211_if_init_conf *conf)
4082{
4083	struct b43_wl *wl = hw_to_b43_wl(hw);
4084	struct b43_wldev *dev;
4085	unsigned long flags;
4086	int err = -EOPNOTSUPP;
4087
4088	/* TODO: allow WDS/AP devices to coexist */
4089
4090	if (conf->type != IEEE80211_IF_TYPE_AP &&
4091	    conf->type != IEEE80211_IF_TYPE_STA &&
4092	    conf->type != IEEE80211_IF_TYPE_WDS &&
4093	    conf->type != IEEE80211_IF_TYPE_IBSS)
4094		return -EOPNOTSUPP;
4095
4096	mutex_lock(&wl->mutex);
4097	if (wl->operating)
4098		goto out_mutex_unlock;
4099
4100	b43dbg(wl, "Adding Interface type %d\n", conf->type);
4101
4102	dev = wl->current_dev;
4103	wl->operating = 1;
4104	wl->vif = conf->vif;
4105	wl->if_type = conf->type;
4106	memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4107
4108	spin_lock_irqsave(&wl->irq_lock, flags);
4109	b43_adjust_opmode(dev);
4110	b43_set_pretbtt(dev);
4111	b43_set_synth_pu_delay(dev, 0);
4112	b43_upload_card_macaddress(dev);
4113	spin_unlock_irqrestore(&wl->irq_lock, flags);
4114
4115	err = 0;
4116 out_mutex_unlock:
4117	mutex_unlock(&wl->mutex);
4118
4119	return err;
4120}
4121
4122static void b43_op_remove_interface(struct ieee80211_hw *hw,
4123				    struct ieee80211_if_init_conf *conf)
4124{
4125	struct b43_wl *wl = hw_to_b43_wl(hw);
4126	struct b43_wldev *dev = wl->current_dev;
4127	unsigned long flags;
4128
4129	b43dbg(wl, "Removing Interface type %d\n", conf->type);
4130
4131	mutex_lock(&wl->mutex);
4132
4133	B43_WARN_ON(!wl->operating);
4134	B43_WARN_ON(wl->vif != conf->vif);
4135	wl->vif = NULL;
4136
4137	wl->operating = 0;
4138
4139	spin_lock_irqsave(&wl->irq_lock, flags);
4140	b43_adjust_opmode(dev);
4141	memset(wl->mac_addr, 0, ETH_ALEN);
4142	b43_upload_card_macaddress(dev);
4143	spin_unlock_irqrestore(&wl->irq_lock, flags);
4144
4145	mutex_unlock(&wl->mutex);
4146}
4147
4148static int b43_op_start(struct ieee80211_hw *hw)
4149{
4150	struct b43_wl *wl = hw_to_b43_wl(hw);
4151	struct b43_wldev *dev = wl->current_dev;
4152	int did_init = 0;
4153	int err = 0;
4154	bool do_rfkill_exit = 0;
4155
4156	/* Kill all old instance specific information to make sure
4157	 * the card won't use it in the short timeframe between start
4158	 * and mac80211 reconfiguring it. */
4159	memset(wl->bssid, 0, ETH_ALEN);
4160	memset(wl->mac_addr, 0, ETH_ALEN);
4161	wl->filter_flags = 0;
4162	wl->radiotap_enabled = 0;
4163	b43_qos_clear(wl);
4164
4165	/* First register RFkill.
4166	 * LEDs that are registered later depend on it. */
4167	b43_rfkill_init(dev);
4168
4169	mutex_lock(&wl->mutex);
4170
4171	if (b43_status(dev) < B43_STAT_INITIALIZED) {
4172		err = b43_wireless_core_init(dev);
4173		if (err) {
4174			do_rfkill_exit = 1;
4175			goto out_mutex_unlock;
4176		}
4177		did_init = 1;
4178	}
4179
4180	if (b43_status(dev) < B43_STAT_STARTED) {
4181		err = b43_wireless_core_start(dev);
4182		if (err) {
4183			if (did_init)
4184				b43_wireless_core_exit(dev);
4185			do_rfkill_exit = 1;
4186			goto out_mutex_unlock;
4187		}
4188	}
4189
4190 out_mutex_unlock:
4191	mutex_unlock(&wl->mutex);
4192
4193	if (do_rfkill_exit)
4194		b43_rfkill_exit(dev);
4195
4196	return err;
4197}
4198
4199static void b43_op_stop(struct ieee80211_hw *hw)
4200{
4201	struct b43_wl *wl = hw_to_b43_wl(hw);
4202	struct b43_wldev *dev = wl->current_dev;
4203
4204	b43_rfkill_exit(dev);
4205	cancel_work_sync(&(wl->qos_update_work));
4206	cancel_work_sync(&(wl->beacon_update_trigger));
4207
4208	mutex_lock(&wl->mutex);
4209	if (b43_status(dev) >= B43_STAT_STARTED)
4210		b43_wireless_core_stop(dev);
4211	b43_wireless_core_exit(dev);
4212	mutex_unlock(&wl->mutex);
4213}
4214
4215static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
4216				  u32 short_retry_limit, u32 long_retry_limit)
4217{
4218	struct b43_wl *wl = hw_to_b43_wl(hw);
4219	struct b43_wldev *dev;
4220	int err = 0;
4221
4222	mutex_lock(&wl->mutex);
4223	dev = wl->current_dev;
4224	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
4225		err = -ENODEV;
4226		goto out_unlock;
4227	}
4228	b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
4229out_unlock:
4230	mutex_unlock(&wl->mutex);
4231
4232	return err;
4233}
4234
4235static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
4236{
4237	struct b43_wl *wl = hw_to_b43_wl(hw);
4238	struct sk_buff *beacon;
4239	unsigned long flags;
4240
4241	/* We could modify the existing beacon and set the aid bit in
4242	 * the TIM field, but that would probably require resizing and
4243	 * moving of data within the beacon template.
4244	 * Simply request a new beacon and let mac80211 do the hard work. */
4245	beacon = ieee80211_beacon_get(hw, wl->vif);
4246	if (unlikely(!beacon))
4247		return -ENOMEM;
4248	spin_lock_irqsave(&wl->irq_lock, flags);
4249	b43_update_templates(wl, beacon);
4250	spin_unlock_irqrestore(&wl->irq_lock, flags);
4251
4252	return 0;
4253}
4254
4255static int b43_op_ibss_beacon_update(struct ieee80211_hw *hw,
4256				     struct sk_buff *beacon)
4257{
4258	struct b43_wl *wl = hw_to_b43_wl(hw);
4259	unsigned long flags;
4260
4261	spin_lock_irqsave(&wl->irq_lock, flags);
4262	b43_update_templates(wl, beacon);
4263	spin_unlock_irqrestore(&wl->irq_lock, flags);
4264
4265	return 0;
4266}
4267
4268static void b43_op_sta_notify(struct ieee80211_hw *hw,
4269			      struct ieee80211_vif *vif,
4270			      enum sta_notify_cmd notify_cmd,
4271			      const u8 *addr)
4272{
4273	struct b43_wl *wl = hw_to_b43_wl(hw);
4274
4275	B43_WARN_ON(!vif || wl->vif != vif);
4276}
4277
4278static const struct ieee80211_ops b43_hw_ops = {
4279	.tx			= b43_op_tx,
4280	.conf_tx		= b43_op_conf_tx,
4281	.add_interface		= b43_op_add_interface,
4282	.remove_interface	= b43_op_remove_interface,
4283	.config			= b43_op_config,
4284	.config_interface	= b43_op_config_interface,
4285	.configure_filter	= b43_op_configure_filter,
4286	.set_key		= b43_op_set_key,
4287	.get_stats		= b43_op_get_stats,
4288	.get_tx_stats		= b43_op_get_tx_stats,
4289	.start			= b43_op_start,
4290	.stop			= b43_op_stop,
4291	.set_retry_limit	= b43_op_set_retry_limit,
4292	.set_tim		= b43_op_beacon_set_tim,
4293	.beacon_update		= b43_op_ibss_beacon_update,
4294	.sta_notify		= b43_op_sta_notify,
4295};
4296
4297/* Hard-reset the chip. Do not call this directly.
4298 * Use b43_controller_restart()
4299 */
4300static void b43_chip_reset(struct work_struct *work)
4301{
4302	struct b43_wldev *dev =
4303	    container_of(work, struct b43_wldev, restart_work);
4304	struct b43_wl *wl = dev->wl;
4305	int err = 0;
4306	int prev_status;
4307
4308	mutex_lock(&wl->mutex);
4309
4310	prev_status = b43_status(dev);
4311	/* Bring the device down... */
4312	if (prev_status >= B43_STAT_STARTED)
4313		b43_wireless_core_stop(dev);
4314	if (prev_status >= B43_STAT_INITIALIZED)
4315		b43_wireless_core_exit(dev);
4316
4317	/* ...and up again. */
4318	if (prev_status >= B43_STAT_INITIALIZED) {
4319		err = b43_wireless_core_init(dev);
4320		if (err)
4321			goto out;
4322	}
4323	if (prev_status >= B43_STAT_STARTED) {
4324		err = b43_wireless_core_start(dev);
4325		if (err) {
4326			b43_wireless_core_exit(dev);
4327			goto out;
4328		}
4329	}
4330      out:
4331	mutex_unlock(&wl->mutex);
4332	if (err)
4333		b43err(wl, "Controller restart FAILED\n");
4334	else
4335		b43info(wl, "Controller restarted\n");
4336}
4337
4338static int b43_setup_bands(struct b43_wldev *dev,
4339			   bool have_2ghz_phy, bool have_5ghz_phy)
4340{
4341	struct ieee80211_hw *hw = dev->wl->hw;
4342
4343	if (have_2ghz_phy)
4344		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4345	if (dev->phy.type == B43_PHYTYPE_N) {
4346		if (have_5ghz_phy)
4347			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4348	} else {
4349		if (have_5ghz_phy)
4350			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4351	}
4352
4353	dev->phy.supports_2ghz = have_2ghz_phy;
4354	dev->phy.supports_5ghz = have_5ghz_phy;
4355
4356	return 0;
4357}
4358
4359static void b43_wireless_core_detach(struct b43_wldev *dev)
4360{
4361	/* We release firmware that late to not be required to re-request
4362	 * is all the time when we reinit the core. */
4363	b43_release_firmware(dev);
4364}
4365
4366static int b43_wireless_core_attach(struct b43_wldev *dev)
4367{
4368	struct b43_wl *wl = dev->wl;
4369	struct ssb_bus *bus = dev->dev->bus;
4370	struct pci_dev *pdev = bus->host_pci;
4371	int err;
4372	bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4373	u32 tmp;
4374
4375	/* Do NOT do any device initialization here.
4376	 * Do it in wireless_core_init() instead.
4377	 * This function is for gathering basic information about the HW, only.
4378	 * Also some structs may be set up here. But most likely you want to have
4379	 * that in core_init(), too.
4380	 */
4381
4382	err = ssb_bus_powerup(bus, 0);
4383	if (err) {
4384		b43err(wl, "Bus powerup failed\n");
4385		goto out;
4386	}
4387	/* Get the PHY type. */
4388	if (dev->dev->id.revision >= 5) {
4389		u32 tmshigh;
4390
4391		tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4392		have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4393		have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4394	} else
4395		B43_WARN_ON(1);
4396
4397	dev->phy.gmode = have_2ghz_phy;
4398	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4399	b43_wireless_core_reset(dev, tmp);
4400
4401	err = b43_phy_versioning(dev);
4402	if (err)
4403		goto err_powerdown;
4404	/* Check if this device supports multiband. */
4405	if (!pdev ||
4406	    (pdev->device != 0x4312 &&
4407	     pdev->device != 0x4319 && pdev->device != 0x4324)) {
4408		/* No multiband support. */
4409		have_2ghz_phy = 0;
4410		have_5ghz_phy = 0;
4411		switch (dev->phy.type) {
4412		case B43_PHYTYPE_A:
4413			have_5ghz_phy = 1;
4414			break;
4415		case B43_PHYTYPE_G:
4416		case B43_PHYTYPE_N:
4417			have_2ghz_phy = 1;
4418			break;
4419		default:
4420			B43_WARN_ON(1);
4421		}
4422	}
4423	if (dev->phy.type == B43_PHYTYPE_A) {
4424		/* FIXME */
4425		b43err(wl, "IEEE 802.11a devices are unsupported\n");
4426		err = -EOPNOTSUPP;
4427		goto err_powerdown;
4428	}
4429	if (1 /* disable A-PHY */) {
4430		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4431		if (dev->phy.type != B43_PHYTYPE_N) {
4432			have_2ghz_phy = 1;
4433			have_5ghz_phy = 0;
4434		}
4435	}
4436
4437	dev->phy.gmode = have_2ghz_phy;
4438	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4439	b43_wireless_core_reset(dev, tmp);
4440
4441	err = b43_validate_chipaccess(dev);
4442	if (err)
4443		goto err_powerdown;
4444	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4445	if (err)
4446		goto err_powerdown;
4447
4448	/* Now set some default "current_dev" */
4449	if (!wl->current_dev)
4450		wl->current_dev = dev;
4451	INIT_WORK(&dev->restart_work, b43_chip_reset);
4452
4453	b43_radio_turn_off(dev, 1);
4454	b43_switch_analog(dev, 0);
4455	ssb_device_disable(dev->dev, 0);
4456	ssb_bus_may_powerdown(bus);
4457
4458out:
4459	return err;
4460
4461err_powerdown:
4462	ssb_bus_may_powerdown(bus);
4463	return err;
4464}
4465
4466static void b43_one_core_detach(struct ssb_device *dev)
4467{
4468	struct b43_wldev *wldev;
4469	struct b43_wl *wl;
4470
4471	wldev = ssb_get_drvdata(dev);
4472	wl = wldev->wl;
4473	cancel_work_sync(&wldev->restart_work);
4474	b43_debugfs_remove_device(wldev);
4475	b43_wireless_core_detach(wldev);
4476	list_del(&wldev->list);
4477	wl->nr_devs--;
4478	ssb_set_drvdata(dev, NULL);
4479	kfree(wldev);
4480}
4481
4482static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4483{
4484	struct b43_wldev *wldev;
4485	struct pci_dev *pdev;
4486	int err = -ENOMEM;
4487
4488	if (!list_empty(&wl->devlist)) {
4489		/* We are not the first core on this chip. */
4490		pdev = dev->bus->host_pci;
4491		/* Only special chips support more than one wireless
4492		 * core, although some of the other chips have more than
4493		 * one wireless core as well. Check for this and
4494		 * bail out early.
4495		 */
4496		if (!pdev ||
4497		    ((pdev->device != 0x4321) &&
4498		     (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4499			b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4500			return -ENODEV;
4501		}
4502	}
4503
4504	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4505	if (!wldev)
4506		goto out;
4507
4508	wldev->dev = dev;
4509	wldev->wl = wl;
4510	b43_set_status(wldev, B43_STAT_UNINIT);
4511	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4512	tasklet_init(&wldev->isr_tasklet,
4513		     (void (*)(unsigned long))b43_interrupt_tasklet,
4514		     (unsigned long)wldev);
4515	INIT_LIST_HEAD(&wldev->list);
4516
4517	err = b43_wireless_core_attach(wldev);
4518	if (err)
4519		goto err_kfree_wldev;
4520
4521	list_add(&wldev->list, &wl->devlist);
4522	wl->nr_devs++;
4523	ssb_set_drvdata(dev, wldev);
4524	b43_debugfs_add_device(wldev);
4525
4526      out:
4527	return err;
4528
4529      err_kfree_wldev:
4530	kfree(wldev);
4531	return err;
4532}
4533
4534#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
4535	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
4536	(pdev->device == _device) &&					\
4537	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
4538	(pdev->subsystem_device == _subdevice)				)
4539
4540static void b43_sprom_fixup(struct ssb_bus *bus)
4541{
4542	struct pci_dev *pdev;
4543
4544	/* boardflags workarounds */
4545	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4546	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4547		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4548	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4549	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4550		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4551	if (bus->bustype == SSB_BUSTYPE_PCI) {
4552		pdev = bus->host_pci;
4553		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4554		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4555		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
4556			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4557	}
4558}
4559
4560static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4561{
4562	struct ieee80211_hw *hw = wl->hw;
4563
4564	ssb_set_devtypedata(dev, NULL);
4565	ieee80211_free_hw(hw);
4566}
4567
4568static int b43_wireless_init(struct ssb_device *dev)
4569{
4570	struct ssb_sprom *sprom = &dev->bus->sprom;
4571	struct ieee80211_hw *hw;
4572	struct b43_wl *wl;
4573	int err = -ENOMEM;
4574
4575	b43_sprom_fixup(dev->bus);
4576
4577	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4578	if (!hw) {
4579		b43err(NULL, "Could not allocate ieee80211 device\n");
4580		goto out;
4581	}
4582
4583	/* fill hw info */
4584	hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
4585		    IEEE80211_HW_RX_INCLUDES_FCS |
4586		    IEEE80211_HW_SIGNAL_DBM |
4587		    IEEE80211_HW_NOISE_DBM;
4588
4589	hw->queues = b43_modparam_qos ? 4 : 1;
4590	SET_IEEE80211_DEV(hw, dev->dev);
4591	if (is_valid_ether_addr(sprom->et1mac))
4592		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4593	else
4594		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4595
4596	/* Get and initialize struct b43_wl */
4597	wl = hw_to_b43_wl(hw);
4598	memset(wl, 0, sizeof(*wl));
4599	wl->hw = hw;
4600	spin_lock_init(&wl->irq_lock);
4601	rwlock_init(&wl->tx_lock);
4602	spin_lock_init(&wl->leds_lock);
4603	spin_lock_init(&wl->shm_lock);
4604	mutex_init(&wl->mutex);
4605	INIT_LIST_HEAD(&wl->devlist);
4606	INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
4607	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4608
4609	ssb_set_devtypedata(dev, wl);
4610	b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4611	err = 0;
4612      out:
4613	return err;
4614}
4615
4616static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4617{
4618	struct b43_wl *wl;
4619	int err;
4620	int first = 0;
4621
4622	wl = ssb_get_devtypedata(dev);
4623	if (!wl) {
4624		/* Probing the first core. Must setup common struct b43_wl */
4625		first = 1;
4626		err = b43_wireless_init(dev);
4627		if (err)
4628			goto out;
4629		wl = ssb_get_devtypedata(dev);
4630		B43_WARN_ON(!wl);
4631	}
4632	err = b43_one_core_attach(dev, wl);
4633	if (err)
4634		goto err_wireless_exit;
4635
4636	if (first) {
4637		err = ieee80211_register_hw(wl->hw);
4638		if (err)
4639			goto err_one_core_detach;
4640	}
4641
4642      out:
4643	return err;
4644
4645      err_one_core_detach:
4646	b43_one_core_detach(dev);
4647      err_wireless_exit:
4648	if (first)
4649		b43_wireless_exit(dev, wl);
4650	return err;
4651}
4652
4653static void b43_remove(struct ssb_device *dev)
4654{
4655	struct b43_wl *wl = ssb_get_devtypedata(dev);
4656	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4657
4658	B43_WARN_ON(!wl);
4659	if (wl->current_dev == wldev)
4660		ieee80211_unregister_hw(wl->hw);
4661
4662	b43_one_core_detach(dev);
4663
4664	if (list_empty(&wl->devlist)) {
4665		/* Last core on the chip unregistered.
4666		 * We can destroy common struct b43_wl.
4667		 */
4668		b43_wireless_exit(dev, wl);
4669	}
4670}
4671
4672/* Perform a hardware reset. This can be called from any context. */
4673void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4674{
4675	/* Must avoid requeueing, if we are in shutdown. */
4676	if (b43_status(dev) < B43_STAT_INITIALIZED)
4677		return;
4678	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4679	queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4680}
4681
4682#ifdef CONFIG_PM
4683
4684static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4685{
4686	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4687	struct b43_wl *wl = wldev->wl;
4688
4689	b43dbg(wl, "Suspending...\n");
4690
4691	mutex_lock(&wl->mutex);
4692	wldev->suspend_in_progress = true;
4693	wldev->suspend_init_status = b43_status(wldev);
4694	if (wldev->suspend_init_status >= B43_STAT_STARTED)
4695		b43_wireless_core_stop(wldev);
4696	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4697		b43_wireless_core_exit(wldev);
4698	mutex_unlock(&wl->mutex);
4699
4700	b43dbg(wl, "Device suspended.\n");
4701
4702	return 0;
4703}
4704
4705static int b43_resume(struct ssb_device *dev)
4706{
4707	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4708	struct b43_wl *wl = wldev->wl;
4709	int err = 0;
4710
4711	b43dbg(wl, "Resuming...\n");
4712
4713	mutex_lock(&wl->mutex);
4714	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4715		err = b43_wireless_core_init(wldev);
4716		if (err) {
4717			b43err(wl, "Resume failed at core init\n");
4718			goto out;
4719		}
4720	}
4721	if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4722		err = b43_wireless_core_start(wldev);
4723		if (err) {
4724			b43_leds_exit(wldev);
4725			b43_rng_exit(wldev->wl);
4726			b43_wireless_core_exit(wldev);
4727			b43err(wl, "Resume failed at core start\n");
4728			goto out;
4729		}
4730	}
4731	b43dbg(wl, "Device resumed.\n");
4732 out:
4733	wldev->suspend_in_progress = false;
4734	mutex_unlock(&wl->mutex);
4735	return err;
4736}
4737
4738#else /* CONFIG_PM */
4739# define b43_suspend	NULL
4740# define b43_resume	NULL
4741#endif /* CONFIG_PM */
4742
4743static struct ssb_driver b43_ssb_driver = {
4744	.name		= KBUILD_MODNAME,
4745	.id_table	= b43_ssb_tbl,
4746	.probe		= b43_probe,
4747	.remove		= b43_remove,
4748	.suspend	= b43_suspend,
4749	.resume		= b43_resume,
4750};
4751
4752static void b43_print_driverinfo(void)
4753{
4754	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4755		   *feat_leds = "", *feat_rfkill = "";
4756
4757#ifdef CONFIG_B43_PCI_AUTOSELECT
4758	feat_pci = "P";
4759#endif
4760#ifdef CONFIG_B43_PCMCIA
4761	feat_pcmcia = "M";
4762#endif
4763#ifdef CONFIG_B43_NPHY
4764	feat_nphy = "N";
4765#endif
4766#ifdef CONFIG_B43_LEDS
4767	feat_leds = "L";
4768#endif
4769#ifdef CONFIG_B43_RFKILL
4770	feat_rfkill = "R";
4771#endif
4772	printk(KERN_INFO "Broadcom 43xx driver loaded "
4773	       "[ Features: %s%s%s%s%s, Firmware-ID: "
4774	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
4775	       feat_pci, feat_pcmcia, feat_nphy,
4776	       feat_leds, feat_rfkill);
4777}
4778
4779static int __init b43_init(void)
4780{
4781	int err;
4782
4783	b43_debugfs_init();
4784	err = b43_pcmcia_init();
4785	if (err)
4786		goto err_dfs_exit;
4787	err = ssb_driver_register(&b43_ssb_driver);
4788	if (err)
4789		goto err_pcmcia_exit;
4790	b43_print_driverinfo();
4791
4792	return err;
4793
4794err_pcmcia_exit:
4795	b43_pcmcia_exit();
4796err_dfs_exit:
4797	b43_debugfs_exit();
4798	return err;
4799}
4800
4801static void __exit b43_exit(void)
4802{
4803	ssb_driver_unregister(&b43_ssb_driver);
4804	b43_pcmcia_exit();
4805	b43_debugfs_exit();
4806}
4807
4808module_init(b43_init)
4809module_exit(b43_exit)
4810