main.c revision 8b9bda759e5b7c042c2b3ae852aaa332c0ee4495
1/*
2
3  Broadcom B43 wireless driver
4
5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7  Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11  SDIO support
12  Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
13
14  Some parts of the code in this file are derived from the ipw2200
15  driver  Copyright(c) 2003 - 2004 Intel Corporation.
16
17  This program is free software; you can redistribute it and/or modify
18  it under the terms of the GNU General Public License as published by
19  the Free Software Foundation; either version 2 of the License, or
20  (at your option) any later version.
21
22  This program is distributed in the hope that it will be useful,
23  but WITHOUT ANY WARRANTY; without even the implied warranty of
24  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25  GNU General Public License for more details.
26
27  You should have received a copy of the GNU General Public License
28  along with this program; see the file COPYING.  If not, write to
29  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
30  Boston, MA 02110-1301, USA.
31
32*/
33
34#include <linux/delay.h>
35#include <linux/init.h>
36#include <linux/moduleparam.h>
37#include <linux/if_arp.h>
38#include <linux/etherdevice.h>
39#include <linux/firmware.h>
40#include <linux/wireless.h>
41#include <linux/workqueue.h>
42#include <linux/skbuff.h>
43#include <linux/io.h>
44#include <linux/dma-mapping.h>
45#include <linux/slab.h>
46#include <asm/unaligned.h>
47
48#include "b43.h"
49#include "main.h"
50#include "debugfs.h"
51#include "phy_common.h"
52#include "phy_g.h"
53#include "phy_n.h"
54#include "dma.h"
55#include "pio.h"
56#include "sysfs.h"
57#include "xmit.h"
58#include "lo.h"
59#include "pcmcia.h"
60#include "sdio.h"
61#include <linux/mmc/sdio_func.h>
62
63MODULE_DESCRIPTION("Broadcom B43 wireless driver");
64MODULE_AUTHOR("Martin Langer");
65MODULE_AUTHOR("Stefano Brivio");
66MODULE_AUTHOR("Michael Buesch");
67MODULE_AUTHOR("Gábor Stefanik");
68MODULE_LICENSE("GPL");
69
70MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
71MODULE_FIRMWARE("b43/ucode11.fw");
72MODULE_FIRMWARE("b43/ucode13.fw");
73MODULE_FIRMWARE("b43/ucode14.fw");
74MODULE_FIRMWARE("b43/ucode15.fw");
75MODULE_FIRMWARE("b43/ucode16_mimo.fw");
76MODULE_FIRMWARE("b43/ucode5.fw");
77MODULE_FIRMWARE("b43/ucode9.fw");
78
79static int modparam_bad_frames_preempt;
80module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
81MODULE_PARM_DESC(bad_frames_preempt,
82		 "enable(1) / disable(0) Bad Frames Preemption");
83
84static char modparam_fwpostfix[16];
85module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
86MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
87
88static int modparam_hwpctl;
89module_param_named(hwpctl, modparam_hwpctl, int, 0444);
90MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
91
92static int modparam_nohwcrypt;
93module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
94MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
95
96static int modparam_hwtkip;
97module_param_named(hwtkip, modparam_hwtkip, int, 0444);
98MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
99
100static int modparam_qos = 1;
101module_param_named(qos, modparam_qos, int, 0444);
102MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
103
104static int modparam_btcoex = 1;
105module_param_named(btcoex, modparam_btcoex, int, 0444);
106MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
107
108int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
109module_param_named(verbose, b43_modparam_verbose, int, 0644);
110MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
111
112static int b43_modparam_pio = B43_PIO_DEFAULT;
113module_param_named(pio, b43_modparam_pio, int, 0644);
114MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
115
116#ifdef CONFIG_B43_BCMA
117static const struct bcma_device_id b43_bcma_tbl[] = {
118	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
119	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
120	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
121	BCMA_CORETABLE_END
122};
123MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
124#endif
125
126#ifdef CONFIG_B43_SSB
127static const struct ssb_device_id b43_ssb_tbl[] = {
128	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
129	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
130	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
131	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
132	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
133	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
134	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
135	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
136	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
137	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
138	SSB_DEVTABLE_END
139};
140MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
141#endif
142
143/* Channel and ratetables are shared for all devices.
144 * They can't be const, because ieee80211 puts some precalculated
145 * data in there. This data is the same for all devices, so we don't
146 * get concurrency issues */
147#define RATETAB_ENT(_rateid, _flags) \
148	{								\
149		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
150		.hw_value	= (_rateid),				\
151		.flags		= (_flags),				\
152	}
153
154/*
155 * NOTE: When changing this, sync with xmit.c's
156 *	 b43_plcp_get_bitrate_idx_* functions!
157 */
158static struct ieee80211_rate __b43_ratetable[] = {
159	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
160	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
161	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
162	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
163	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
164	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
165	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
166	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
167	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
168	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
169	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
170	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
171};
172
173#define b43_a_ratetable		(__b43_ratetable + 4)
174#define b43_a_ratetable_size	8
175#define b43_b_ratetable		(__b43_ratetable + 0)
176#define b43_b_ratetable_size	4
177#define b43_g_ratetable		(__b43_ratetable + 0)
178#define b43_g_ratetable_size	12
179
180#define CHAN4G(_channel, _freq, _flags) {			\
181	.band			= IEEE80211_BAND_2GHZ,		\
182	.center_freq		= (_freq),			\
183	.hw_value		= (_channel),			\
184	.flags			= (_flags),			\
185	.max_antenna_gain	= 0,				\
186	.max_power		= 30,				\
187}
188static struct ieee80211_channel b43_2ghz_chantable[] = {
189	CHAN4G(1, 2412, 0),
190	CHAN4G(2, 2417, 0),
191	CHAN4G(3, 2422, 0),
192	CHAN4G(4, 2427, 0),
193	CHAN4G(5, 2432, 0),
194	CHAN4G(6, 2437, 0),
195	CHAN4G(7, 2442, 0),
196	CHAN4G(8, 2447, 0),
197	CHAN4G(9, 2452, 0),
198	CHAN4G(10, 2457, 0),
199	CHAN4G(11, 2462, 0),
200	CHAN4G(12, 2467, 0),
201	CHAN4G(13, 2472, 0),
202	CHAN4G(14, 2484, 0),
203};
204#undef CHAN4G
205
206#define CHAN5G(_channel, _flags) {				\
207	.band			= IEEE80211_BAND_5GHZ,		\
208	.center_freq		= 5000 + (5 * (_channel)),	\
209	.hw_value		= (_channel),			\
210	.flags			= (_flags),			\
211	.max_antenna_gain	= 0,				\
212	.max_power		= 30,				\
213}
214static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
215	CHAN5G(32, 0),		CHAN5G(34, 0),
216	CHAN5G(36, 0),		CHAN5G(38, 0),
217	CHAN5G(40, 0),		CHAN5G(42, 0),
218	CHAN5G(44, 0),		CHAN5G(46, 0),
219	CHAN5G(48, 0),		CHAN5G(50, 0),
220	CHAN5G(52, 0),		CHAN5G(54, 0),
221	CHAN5G(56, 0),		CHAN5G(58, 0),
222	CHAN5G(60, 0),		CHAN5G(62, 0),
223	CHAN5G(64, 0),		CHAN5G(66, 0),
224	CHAN5G(68, 0),		CHAN5G(70, 0),
225	CHAN5G(72, 0),		CHAN5G(74, 0),
226	CHAN5G(76, 0),		CHAN5G(78, 0),
227	CHAN5G(80, 0),		CHAN5G(82, 0),
228	CHAN5G(84, 0),		CHAN5G(86, 0),
229	CHAN5G(88, 0),		CHAN5G(90, 0),
230	CHAN5G(92, 0),		CHAN5G(94, 0),
231	CHAN5G(96, 0),		CHAN5G(98, 0),
232	CHAN5G(100, 0),		CHAN5G(102, 0),
233	CHAN5G(104, 0),		CHAN5G(106, 0),
234	CHAN5G(108, 0),		CHAN5G(110, 0),
235	CHAN5G(112, 0),		CHAN5G(114, 0),
236	CHAN5G(116, 0),		CHAN5G(118, 0),
237	CHAN5G(120, 0),		CHAN5G(122, 0),
238	CHAN5G(124, 0),		CHAN5G(126, 0),
239	CHAN5G(128, 0),		CHAN5G(130, 0),
240	CHAN5G(132, 0),		CHAN5G(134, 0),
241	CHAN5G(136, 0),		CHAN5G(138, 0),
242	CHAN5G(140, 0),		CHAN5G(142, 0),
243	CHAN5G(144, 0),		CHAN5G(145, 0),
244	CHAN5G(146, 0),		CHAN5G(147, 0),
245	CHAN5G(148, 0),		CHAN5G(149, 0),
246	CHAN5G(150, 0),		CHAN5G(151, 0),
247	CHAN5G(152, 0),		CHAN5G(153, 0),
248	CHAN5G(154, 0),		CHAN5G(155, 0),
249	CHAN5G(156, 0),		CHAN5G(157, 0),
250	CHAN5G(158, 0),		CHAN5G(159, 0),
251	CHAN5G(160, 0),		CHAN5G(161, 0),
252	CHAN5G(162, 0),		CHAN5G(163, 0),
253	CHAN5G(164, 0),		CHAN5G(165, 0),
254	CHAN5G(166, 0),		CHAN5G(168, 0),
255	CHAN5G(170, 0),		CHAN5G(172, 0),
256	CHAN5G(174, 0),		CHAN5G(176, 0),
257	CHAN5G(178, 0),		CHAN5G(180, 0),
258	CHAN5G(182, 0),		CHAN5G(184, 0),
259	CHAN5G(186, 0),		CHAN5G(188, 0),
260	CHAN5G(190, 0),		CHAN5G(192, 0),
261	CHAN5G(194, 0),		CHAN5G(196, 0),
262	CHAN5G(198, 0),		CHAN5G(200, 0),
263	CHAN5G(202, 0),		CHAN5G(204, 0),
264	CHAN5G(206, 0),		CHAN5G(208, 0),
265	CHAN5G(210, 0),		CHAN5G(212, 0),
266	CHAN5G(214, 0),		CHAN5G(216, 0),
267	CHAN5G(218, 0),		CHAN5G(220, 0),
268	CHAN5G(222, 0),		CHAN5G(224, 0),
269	CHAN5G(226, 0),		CHAN5G(228, 0),
270};
271
272static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
273	CHAN5G(34, 0),		CHAN5G(36, 0),
274	CHAN5G(38, 0),		CHAN5G(40, 0),
275	CHAN5G(42, 0),		CHAN5G(44, 0),
276	CHAN5G(46, 0),		CHAN5G(48, 0),
277	CHAN5G(52, 0),		CHAN5G(56, 0),
278	CHAN5G(60, 0),		CHAN5G(64, 0),
279	CHAN5G(100, 0),		CHAN5G(104, 0),
280	CHAN5G(108, 0),		CHAN5G(112, 0),
281	CHAN5G(116, 0),		CHAN5G(120, 0),
282	CHAN5G(124, 0),		CHAN5G(128, 0),
283	CHAN5G(132, 0),		CHAN5G(136, 0),
284	CHAN5G(140, 0),		CHAN5G(149, 0),
285	CHAN5G(153, 0),		CHAN5G(157, 0),
286	CHAN5G(161, 0),		CHAN5G(165, 0),
287	CHAN5G(184, 0),		CHAN5G(188, 0),
288	CHAN5G(192, 0),		CHAN5G(196, 0),
289	CHAN5G(200, 0),		CHAN5G(204, 0),
290	CHAN5G(208, 0),		CHAN5G(212, 0),
291	CHAN5G(216, 0),
292};
293#undef CHAN5G
294
295static struct ieee80211_supported_band b43_band_5GHz_nphy = {
296	.band		= IEEE80211_BAND_5GHZ,
297	.channels	= b43_5ghz_nphy_chantable,
298	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
299	.bitrates	= b43_a_ratetable,
300	.n_bitrates	= b43_a_ratetable_size,
301};
302
303static struct ieee80211_supported_band b43_band_5GHz_aphy = {
304	.band		= IEEE80211_BAND_5GHZ,
305	.channels	= b43_5ghz_aphy_chantable,
306	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
307	.bitrates	= b43_a_ratetable,
308	.n_bitrates	= b43_a_ratetable_size,
309};
310
311static struct ieee80211_supported_band b43_band_2GHz = {
312	.band		= IEEE80211_BAND_2GHZ,
313	.channels	= b43_2ghz_chantable,
314	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
315	.bitrates	= b43_g_ratetable,
316	.n_bitrates	= b43_g_ratetable_size,
317};
318
319static void b43_wireless_core_exit(struct b43_wldev *dev);
320static int b43_wireless_core_init(struct b43_wldev *dev);
321static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
322static int b43_wireless_core_start(struct b43_wldev *dev);
323
324static int b43_ratelimit(struct b43_wl *wl)
325{
326	if (!wl || !wl->current_dev)
327		return 1;
328	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
329		return 1;
330	/* We are up and running.
331	 * Ratelimit the messages to avoid DoS over the net. */
332	return net_ratelimit();
333}
334
335void b43info(struct b43_wl *wl, const char *fmt, ...)
336{
337	struct va_format vaf;
338	va_list args;
339
340	if (b43_modparam_verbose < B43_VERBOSITY_INFO)
341		return;
342	if (!b43_ratelimit(wl))
343		return;
344
345	va_start(args, fmt);
346
347	vaf.fmt = fmt;
348	vaf.va = &args;
349
350	printk(KERN_INFO "b43-%s: %pV",
351	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
352
353	va_end(args);
354}
355
356void b43err(struct b43_wl *wl, const char *fmt, ...)
357{
358	struct va_format vaf;
359	va_list args;
360
361	if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
362		return;
363	if (!b43_ratelimit(wl))
364		return;
365
366	va_start(args, fmt);
367
368	vaf.fmt = fmt;
369	vaf.va = &args;
370
371	printk(KERN_ERR "b43-%s ERROR: %pV",
372	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
373
374	va_end(args);
375}
376
377void b43warn(struct b43_wl *wl, const char *fmt, ...)
378{
379	struct va_format vaf;
380	va_list args;
381
382	if (b43_modparam_verbose < B43_VERBOSITY_WARN)
383		return;
384	if (!b43_ratelimit(wl))
385		return;
386
387	va_start(args, fmt);
388
389	vaf.fmt = fmt;
390	vaf.va = &args;
391
392	printk(KERN_WARNING "b43-%s warning: %pV",
393	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
394
395	va_end(args);
396}
397
398void b43dbg(struct b43_wl *wl, const char *fmt, ...)
399{
400	struct va_format vaf;
401	va_list args;
402
403	if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
404		return;
405
406	va_start(args, fmt);
407
408	vaf.fmt = fmt;
409	vaf.va = &args;
410
411	printk(KERN_DEBUG "b43-%s debug: %pV",
412	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
413
414	va_end(args);
415}
416
417static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
418{
419	u32 macctl;
420
421	B43_WARN_ON(offset % 4 != 0);
422
423	macctl = b43_read32(dev, B43_MMIO_MACCTL);
424	if (macctl & B43_MACCTL_BE)
425		val = swab32(val);
426
427	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
428	mmiowb();
429	b43_write32(dev, B43_MMIO_RAM_DATA, val);
430}
431
432static inline void b43_shm_control_word(struct b43_wldev *dev,
433					u16 routing, u16 offset)
434{
435	u32 control;
436
437	/* "offset" is the WORD offset. */
438	control = routing;
439	control <<= 16;
440	control |= offset;
441	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
442}
443
444u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
445{
446	u32 ret;
447
448	if (routing == B43_SHM_SHARED) {
449		B43_WARN_ON(offset & 0x0001);
450		if (offset & 0x0003) {
451			/* Unaligned access */
452			b43_shm_control_word(dev, routing, offset >> 2);
453			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
454			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
455			ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
456
457			goto out;
458		}
459		offset >>= 2;
460	}
461	b43_shm_control_word(dev, routing, offset);
462	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
463out:
464	return ret;
465}
466
467u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
468{
469	u16 ret;
470
471	if (routing == B43_SHM_SHARED) {
472		B43_WARN_ON(offset & 0x0001);
473		if (offset & 0x0003) {
474			/* Unaligned access */
475			b43_shm_control_word(dev, routing, offset >> 2);
476			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
477
478			goto out;
479		}
480		offset >>= 2;
481	}
482	b43_shm_control_word(dev, routing, offset);
483	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
484out:
485	return ret;
486}
487
488void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
489{
490	if (routing == B43_SHM_SHARED) {
491		B43_WARN_ON(offset & 0x0001);
492		if (offset & 0x0003) {
493			/* Unaligned access */
494			b43_shm_control_word(dev, routing, offset >> 2);
495			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
496				    value & 0xFFFF);
497			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
498			b43_write16(dev, B43_MMIO_SHM_DATA,
499				    (value >> 16) & 0xFFFF);
500			return;
501		}
502		offset >>= 2;
503	}
504	b43_shm_control_word(dev, routing, offset);
505	b43_write32(dev, B43_MMIO_SHM_DATA, value);
506}
507
508void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
509{
510	if (routing == B43_SHM_SHARED) {
511		B43_WARN_ON(offset & 0x0001);
512		if (offset & 0x0003) {
513			/* Unaligned access */
514			b43_shm_control_word(dev, routing, offset >> 2);
515			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
516			return;
517		}
518		offset >>= 2;
519	}
520	b43_shm_control_word(dev, routing, offset);
521	b43_write16(dev, B43_MMIO_SHM_DATA, value);
522}
523
524/* Read HostFlags */
525u64 b43_hf_read(struct b43_wldev *dev)
526{
527	u64 ret;
528
529	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
530	ret <<= 16;
531	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
532	ret <<= 16;
533	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
534
535	return ret;
536}
537
538/* Write HostFlags */
539void b43_hf_write(struct b43_wldev *dev, u64 value)
540{
541	u16 lo, mi, hi;
542
543	lo = (value & 0x00000000FFFFULL);
544	mi = (value & 0x0000FFFF0000ULL) >> 16;
545	hi = (value & 0xFFFF00000000ULL) >> 32;
546	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
547	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
548	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
549}
550
551/* Read the firmware capabilities bitmask (Opensource firmware only) */
552static u16 b43_fwcapa_read(struct b43_wldev *dev)
553{
554	B43_WARN_ON(!dev->fw.opensource);
555	return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
556}
557
558void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
559{
560	u32 low, high;
561
562	B43_WARN_ON(dev->dev->core_rev < 3);
563
564	/* The hardware guarantees us an atomic read, if we
565	 * read the low register first. */
566	low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
567	high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
568
569	*tsf = high;
570	*tsf <<= 32;
571	*tsf |= low;
572}
573
574static void b43_time_lock(struct b43_wldev *dev)
575{
576	u32 macctl;
577
578	macctl = b43_read32(dev, B43_MMIO_MACCTL);
579	macctl |= B43_MACCTL_TBTTHOLD;
580	b43_write32(dev, B43_MMIO_MACCTL, macctl);
581	/* Commit the write */
582	b43_read32(dev, B43_MMIO_MACCTL);
583}
584
585static void b43_time_unlock(struct b43_wldev *dev)
586{
587	u32 macctl;
588
589	macctl = b43_read32(dev, B43_MMIO_MACCTL);
590	macctl &= ~B43_MACCTL_TBTTHOLD;
591	b43_write32(dev, B43_MMIO_MACCTL, macctl);
592	/* Commit the write */
593	b43_read32(dev, B43_MMIO_MACCTL);
594}
595
596static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
597{
598	u32 low, high;
599
600	B43_WARN_ON(dev->dev->core_rev < 3);
601
602	low = tsf;
603	high = (tsf >> 32);
604	/* The hardware guarantees us an atomic write, if we
605	 * write the low register first. */
606	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
607	mmiowb();
608	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
609	mmiowb();
610}
611
612void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
613{
614	b43_time_lock(dev);
615	b43_tsf_write_locked(dev, tsf);
616	b43_time_unlock(dev);
617}
618
619static
620void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
621{
622	static const u8 zero_addr[ETH_ALEN] = { 0 };
623	u16 data;
624
625	if (!mac)
626		mac = zero_addr;
627
628	offset |= 0x0020;
629	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
630
631	data = mac[0];
632	data |= mac[1] << 8;
633	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
634	data = mac[2];
635	data |= mac[3] << 8;
636	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
637	data = mac[4];
638	data |= mac[5] << 8;
639	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
640}
641
642static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
643{
644	const u8 *mac;
645	const u8 *bssid;
646	u8 mac_bssid[ETH_ALEN * 2];
647	int i;
648	u32 tmp;
649
650	bssid = dev->wl->bssid;
651	mac = dev->wl->mac_addr;
652
653	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
654
655	memcpy(mac_bssid, mac, ETH_ALEN);
656	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
657
658	/* Write our MAC address and BSSID to template ram */
659	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
660		tmp = (u32) (mac_bssid[i + 0]);
661		tmp |= (u32) (mac_bssid[i + 1]) << 8;
662		tmp |= (u32) (mac_bssid[i + 2]) << 16;
663		tmp |= (u32) (mac_bssid[i + 3]) << 24;
664		b43_ram_write(dev, 0x20 + i, tmp);
665	}
666}
667
668static void b43_upload_card_macaddress(struct b43_wldev *dev)
669{
670	b43_write_mac_bssid_templates(dev);
671	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
672}
673
674static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
675{
676	/* slot_time is in usec. */
677	/* This test used to exit for all but a G PHY. */
678	if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
679		return;
680	b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
681	/* Shared memory location 0x0010 is the slot time and should be
682	 * set to slot_time; however, this register is initially 0 and changing
683	 * the value adversely affects the transmit rate for BCM4311
684	 * devices. Until this behavior is unterstood, delete this step
685	 *
686	 * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
687	 */
688}
689
690static void b43_short_slot_timing_enable(struct b43_wldev *dev)
691{
692	b43_set_slot_time(dev, 9);
693}
694
695static void b43_short_slot_timing_disable(struct b43_wldev *dev)
696{
697	b43_set_slot_time(dev, 20);
698}
699
700/* DummyTransmission function, as documented on
701 * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
702 */
703void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
704{
705	struct b43_phy *phy = &dev->phy;
706	unsigned int i, max_loop;
707	u16 value;
708	u32 buffer[5] = {
709		0x00000000,
710		0x00D40000,
711		0x00000000,
712		0x01000000,
713		0x00000000,
714	};
715
716	if (ofdm) {
717		max_loop = 0x1E;
718		buffer[0] = 0x000201CC;
719	} else {
720		max_loop = 0xFA;
721		buffer[0] = 0x000B846E;
722	}
723
724	for (i = 0; i < 5; i++)
725		b43_ram_write(dev, i * 4, buffer[i]);
726
727	b43_write16(dev, 0x0568, 0x0000);
728	if (dev->dev->core_rev < 11)
729		b43_write16(dev, 0x07C0, 0x0000);
730	else
731		b43_write16(dev, 0x07C0, 0x0100);
732	value = (ofdm ? 0x41 : 0x40);
733	b43_write16(dev, 0x050C, value);
734	if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
735		b43_write16(dev, 0x0514, 0x1A02);
736	b43_write16(dev, 0x0508, 0x0000);
737	b43_write16(dev, 0x050A, 0x0000);
738	b43_write16(dev, 0x054C, 0x0000);
739	b43_write16(dev, 0x056A, 0x0014);
740	b43_write16(dev, 0x0568, 0x0826);
741	b43_write16(dev, 0x0500, 0x0000);
742	if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
743		//SPEC TODO
744	}
745
746	switch (phy->type) {
747	case B43_PHYTYPE_N:
748		b43_write16(dev, 0x0502, 0x00D0);
749		break;
750	case B43_PHYTYPE_LP:
751		b43_write16(dev, 0x0502, 0x0050);
752		break;
753	default:
754		b43_write16(dev, 0x0502, 0x0030);
755	}
756
757	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
758		b43_radio_write16(dev, 0x0051, 0x0017);
759	for (i = 0x00; i < max_loop; i++) {
760		value = b43_read16(dev, 0x050E);
761		if (value & 0x0080)
762			break;
763		udelay(10);
764	}
765	for (i = 0x00; i < 0x0A; i++) {
766		value = b43_read16(dev, 0x050E);
767		if (value & 0x0400)
768			break;
769		udelay(10);
770	}
771	for (i = 0x00; i < 0x19; i++) {
772		value = b43_read16(dev, 0x0690);
773		if (!(value & 0x0100))
774			break;
775		udelay(10);
776	}
777	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
778		b43_radio_write16(dev, 0x0051, 0x0037);
779}
780
781static void key_write(struct b43_wldev *dev,
782		      u8 index, u8 algorithm, const u8 *key)
783{
784	unsigned int i;
785	u32 offset;
786	u16 value;
787	u16 kidx;
788
789	/* Key index/algo block */
790	kidx = b43_kidx_to_fw(dev, index);
791	value = ((kidx << 4) | algorithm);
792	b43_shm_write16(dev, B43_SHM_SHARED,
793			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
794
795	/* Write the key to the Key Table Pointer offset */
796	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
797	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
798		value = key[i];
799		value |= (u16) (key[i + 1]) << 8;
800		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
801	}
802}
803
804static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
805{
806	u32 addrtmp[2] = { 0, 0, };
807	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
808
809	if (b43_new_kidx_api(dev))
810		pairwise_keys_start = B43_NR_GROUP_KEYS;
811
812	B43_WARN_ON(index < pairwise_keys_start);
813	/* We have four default TX keys and possibly four default RX keys.
814	 * Physical mac 0 is mapped to physical key 4 or 8, depending
815	 * on the firmware version.
816	 * So we must adjust the index here.
817	 */
818	index -= pairwise_keys_start;
819	B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
820
821	if (addr) {
822		addrtmp[0] = addr[0];
823		addrtmp[0] |= ((u32) (addr[1]) << 8);
824		addrtmp[0] |= ((u32) (addr[2]) << 16);
825		addrtmp[0] |= ((u32) (addr[3]) << 24);
826		addrtmp[1] = addr[4];
827		addrtmp[1] |= ((u32) (addr[5]) << 8);
828	}
829
830	/* Receive match transmitter address (RCMTA) mechanism */
831	b43_shm_write32(dev, B43_SHM_RCMTA,
832			(index * 2) + 0, addrtmp[0]);
833	b43_shm_write16(dev, B43_SHM_RCMTA,
834			(index * 2) + 1, addrtmp[1]);
835}
836
837/* The ucode will use phase1 key with TEK key to decrypt rx packets.
838 * When a packet is received, the iv32 is checked.
839 * - if it doesn't the packet is returned without modification (and software
840 *   decryption can be done). That's what happen when iv16 wrap.
841 * - if it does, the rc4 key is computed, and decryption is tried.
842 *   Either it will success and B43_RX_MAC_DEC is returned,
843 *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
844 *   and the packet is not usable (it got modified by the ucode).
845 * So in order to never have B43_RX_MAC_DECERR, we should provide
846 * a iv32 and phase1key that match. Because we drop packets in case of
847 * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
848 * packets will be lost without higher layer knowing (ie no resync possible
849 * until next wrap).
850 *
851 * NOTE : this should support 50 key like RCMTA because
852 * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
853 */
854static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
855		u16 *phase1key)
856{
857	unsigned int i;
858	u32 offset;
859	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
860
861	if (!modparam_hwtkip)
862		return;
863
864	if (b43_new_kidx_api(dev))
865		pairwise_keys_start = B43_NR_GROUP_KEYS;
866
867	B43_WARN_ON(index < pairwise_keys_start);
868	/* We have four default TX keys and possibly four default RX keys.
869	 * Physical mac 0 is mapped to physical key 4 or 8, depending
870	 * on the firmware version.
871	 * So we must adjust the index here.
872	 */
873	index -= pairwise_keys_start;
874	B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
875
876	if (b43_debug(dev, B43_DBG_KEYS)) {
877		b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
878				index, iv32);
879	}
880	/* Write the key to the  RX tkip shared mem */
881	offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
882	for (i = 0; i < 10; i += 2) {
883		b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
884				phase1key ? phase1key[i / 2] : 0);
885	}
886	b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
887	b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
888}
889
890static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
891				   struct ieee80211_vif *vif,
892				   struct ieee80211_key_conf *keyconf,
893				   struct ieee80211_sta *sta,
894				   u32 iv32, u16 *phase1key)
895{
896	struct b43_wl *wl = hw_to_b43_wl(hw);
897	struct b43_wldev *dev;
898	int index = keyconf->hw_key_idx;
899
900	if (B43_WARN_ON(!modparam_hwtkip))
901		return;
902
903	/* This is only called from the RX path through mac80211, where
904	 * our mutex is already locked. */
905	B43_WARN_ON(!mutex_is_locked(&wl->mutex));
906	dev = wl->current_dev;
907	B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
908
909	keymac_write(dev, index, NULL);	/* First zero out mac to avoid race */
910
911	rx_tkip_phase1_write(dev, index, iv32, phase1key);
912	/* only pairwise TKIP keys are supported right now */
913	if (WARN_ON(!sta))
914		return;
915	keymac_write(dev, index, sta->addr);
916}
917
918static void do_key_write(struct b43_wldev *dev,
919			 u8 index, u8 algorithm,
920			 const u8 *key, size_t key_len, const u8 *mac_addr)
921{
922	u8 buf[B43_SEC_KEYSIZE] = { 0, };
923	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
924
925	if (b43_new_kidx_api(dev))
926		pairwise_keys_start = B43_NR_GROUP_KEYS;
927
928	B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
929	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
930
931	if (index >= pairwise_keys_start)
932		keymac_write(dev, index, NULL);	/* First zero out mac. */
933	if (algorithm == B43_SEC_ALGO_TKIP) {
934		/*
935		 * We should provide an initial iv32, phase1key pair.
936		 * We could start with iv32=0 and compute the corresponding
937		 * phase1key, but this means calling ieee80211_get_tkip_key
938		 * with a fake skb (or export other tkip function).
939		 * Because we are lazy we hope iv32 won't start with
940		 * 0xffffffff and let's b43_op_update_tkip_key provide a
941		 * correct pair.
942		 */
943		rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
944	} else if (index >= pairwise_keys_start) /* clear it */
945		rx_tkip_phase1_write(dev, index, 0, NULL);
946	if (key)
947		memcpy(buf, key, key_len);
948	key_write(dev, index, algorithm, buf);
949	if (index >= pairwise_keys_start)
950		keymac_write(dev, index, mac_addr);
951
952	dev->key[index].algorithm = algorithm;
953}
954
955static int b43_key_write(struct b43_wldev *dev,
956			 int index, u8 algorithm,
957			 const u8 *key, size_t key_len,
958			 const u8 *mac_addr,
959			 struct ieee80211_key_conf *keyconf)
960{
961	int i;
962	int pairwise_keys_start;
963
964	/* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
965	 * 	- Temporal Encryption Key (128 bits)
966	 * 	- Temporal Authenticator Tx MIC Key (64 bits)
967	 * 	- Temporal Authenticator Rx MIC Key (64 bits)
968	 *
969	 * 	Hardware only store TEK
970	 */
971	if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
972		key_len = 16;
973	if (key_len > B43_SEC_KEYSIZE)
974		return -EINVAL;
975	for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
976		/* Check that we don't already have this key. */
977		B43_WARN_ON(dev->key[i].keyconf == keyconf);
978	}
979	if (index < 0) {
980		/* Pairwise key. Get an empty slot for the key. */
981		if (b43_new_kidx_api(dev))
982			pairwise_keys_start = B43_NR_GROUP_KEYS;
983		else
984			pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
985		for (i = pairwise_keys_start;
986		     i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
987		     i++) {
988			B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
989			if (!dev->key[i].keyconf) {
990				/* found empty */
991				index = i;
992				break;
993			}
994		}
995		if (index < 0) {
996			b43warn(dev->wl, "Out of hardware key memory\n");
997			return -ENOSPC;
998		}
999	} else
1000		B43_WARN_ON(index > 3);
1001
1002	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003	if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004		/* Default RX key */
1005		B43_WARN_ON(mac_addr);
1006		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007	}
1008	keyconf->hw_key_idx = index;
1009	dev->key[index].keyconf = keyconf;
1010
1011	return 0;
1012}
1013
1014static int b43_key_clear(struct b43_wldev *dev, int index)
1015{
1016	if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017		return -EINVAL;
1018	do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019		     NULL, B43_SEC_KEYSIZE, NULL);
1020	if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022			     NULL, B43_SEC_KEYSIZE, NULL);
1023	}
1024	dev->key[index].keyconf = NULL;
1025
1026	return 0;
1027}
1028
1029static void b43_clear_keys(struct b43_wldev *dev)
1030{
1031	int i, count;
1032
1033	if (b43_new_kidx_api(dev))
1034		count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035	else
1036		count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037	for (i = 0; i < count; i++)
1038		b43_key_clear(dev, i);
1039}
1040
1041static void b43_dump_keymemory(struct b43_wldev *dev)
1042{
1043	unsigned int i, index, count, offset, pairwise_keys_start;
1044	u8 mac[ETH_ALEN];
1045	u16 algo;
1046	u32 rcmta0;
1047	u16 rcmta1;
1048	u64 hf;
1049	struct b43_key *key;
1050
1051	if (!b43_debug(dev, B43_DBG_KEYS))
1052		return;
1053
1054	hf = b43_hf_read(dev);
1055	b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056	       !!(hf & B43_HF_USEDEFKEYS));
1057	if (b43_new_kidx_api(dev)) {
1058		pairwise_keys_start = B43_NR_GROUP_KEYS;
1059		count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060	} else {
1061		pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062		count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063	}
1064	for (index = 0; index < count; index++) {
1065		key = &(dev->key[index]);
1066		printk(KERN_DEBUG "Key slot %02u: %s",
1067		       index, (key->keyconf == NULL) ? " " : "*");
1068		offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069		for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071			printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072		}
1073
1074		algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075				      B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076		printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078		if (index >= pairwise_keys_start) {
1079			if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080				printk("   TKIP: ");
1081				offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082				for (i = 0; i < 14; i += 2) {
1083					u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084					printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085				}
1086			}
1087			rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088						((index - pairwise_keys_start) * 2) + 0);
1089			rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090						((index - pairwise_keys_start) * 2) + 1);
1091			*((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092			*((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093			printk("   MAC: %pM", mac);
1094		} else
1095			printk("   DEFAULT KEY");
1096		printk("\n");
1097	}
1098}
1099
1100void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101{
1102	u32 macctl;
1103	u16 ucstat;
1104	bool hwps;
1105	bool awake;
1106	int i;
1107
1108	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109		    (ps_flags & B43_PS_DISABLED));
1110	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112	if (ps_flags & B43_PS_ENABLED) {
1113		hwps = 1;
1114	} else if (ps_flags & B43_PS_DISABLED) {
1115		hwps = 0;
1116	} else {
1117		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118		//      and thus is not an AP and we are associated, set bit 25
1119	}
1120	if (ps_flags & B43_PS_AWAKE) {
1121		awake = 1;
1122	} else if (ps_flags & B43_PS_ASLEEP) {
1123		awake = 0;
1124	} else {
1125		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127		//      successful, set bit26
1128	}
1129
1130/* FIXME: For now we force awake-on and hwps-off */
1131	hwps = 0;
1132	awake = 1;
1133
1134	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135	if (hwps)
1136		macctl |= B43_MACCTL_HWPS;
1137	else
1138		macctl &= ~B43_MACCTL_HWPS;
1139	if (awake)
1140		macctl |= B43_MACCTL_AWAKE;
1141	else
1142		macctl &= ~B43_MACCTL_AWAKE;
1143	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144	/* Commit write */
1145	b43_read32(dev, B43_MMIO_MACCTL);
1146	if (awake && dev->dev->core_rev >= 5) {
1147		/* Wait for the microcode to wake up. */
1148		for (i = 0; i < 100; i++) {
1149			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150						B43_SHM_SH_UCODESTAT);
1151			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152				break;
1153			udelay(10);
1154		}
1155	}
1156}
1157
1158#ifdef CONFIG_B43_BCMA
1159static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1160{
1161	u32 flags = 0;
1162
1163	if (gmode)
1164		flags = B43_BCMA_IOCTL_GMODE;
1165	flags |= B43_BCMA_IOCTL_PHY_CLKEN;
1166	flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1167	b43_device_enable(dev, flags);
1168
1169	/* TODO: reset PHY */
1170}
1171#endif
1172
1173static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1174{
1175	struct ssb_device *sdev = dev->dev->sdev;
1176	u32 tmslow;
1177	u32 flags = 0;
1178
1179	if (gmode)
1180		flags |= B43_TMSLOW_GMODE;
1181	flags |= B43_TMSLOW_PHYCLKEN;
1182	flags |= B43_TMSLOW_PHYRESET;
1183	if (dev->phy.type == B43_PHYTYPE_N)
1184		flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1185	b43_device_enable(dev, flags);
1186	msleep(2);		/* Wait for the PLL to turn on. */
1187
1188	/* Now take the PHY out of Reset again */
1189	tmslow = ssb_read32(sdev, SSB_TMSLOW);
1190	tmslow |= SSB_TMSLOW_FGC;
1191	tmslow &= ~B43_TMSLOW_PHYRESET;
1192	ssb_write32(sdev, SSB_TMSLOW, tmslow);
1193	ssb_read32(sdev, SSB_TMSLOW);	/* flush */
1194	msleep(1);
1195	tmslow &= ~SSB_TMSLOW_FGC;
1196	ssb_write32(sdev, SSB_TMSLOW, tmslow);
1197	ssb_read32(sdev, SSB_TMSLOW);	/* flush */
1198	msleep(1);
1199}
1200
1201void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1202{
1203	u32 macctl;
1204
1205	switch (dev->dev->bus_type) {
1206#ifdef CONFIG_B43_BCMA
1207	case B43_BUS_BCMA:
1208		b43_bcma_wireless_core_reset(dev, gmode);
1209		break;
1210#endif
1211#ifdef CONFIG_B43_SSB
1212	case B43_BUS_SSB:
1213		b43_ssb_wireless_core_reset(dev, gmode);
1214		break;
1215#endif
1216	}
1217
1218	/* Turn Analog ON, but only if we already know the PHY-type.
1219	 * This protects against very early setup where we don't know the
1220	 * PHY-type, yet. wireless_core_reset will be called once again later,
1221	 * when we know the PHY-type. */
1222	if (dev->phy.ops)
1223		dev->phy.ops->switch_analog(dev, 1);
1224
1225	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1226	macctl &= ~B43_MACCTL_GMODE;
1227	if (gmode)
1228		macctl |= B43_MACCTL_GMODE;
1229	macctl |= B43_MACCTL_IHR_ENABLED;
1230	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1231}
1232
1233static void handle_irq_transmit_status(struct b43_wldev *dev)
1234{
1235	u32 v0, v1;
1236	u16 tmp;
1237	struct b43_txstatus stat;
1238
1239	while (1) {
1240		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1241		if (!(v0 & 0x00000001))
1242			break;
1243		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1244
1245		stat.cookie = (v0 >> 16);
1246		stat.seq = (v1 & 0x0000FFFF);
1247		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1248		tmp = (v0 & 0x0000FFFF);
1249		stat.frame_count = ((tmp & 0xF000) >> 12);
1250		stat.rts_count = ((tmp & 0x0F00) >> 8);
1251		stat.supp_reason = ((tmp & 0x001C) >> 2);
1252		stat.pm_indicated = !!(tmp & 0x0080);
1253		stat.intermediate = !!(tmp & 0x0040);
1254		stat.for_ampdu = !!(tmp & 0x0020);
1255		stat.acked = !!(tmp & 0x0002);
1256
1257		b43_handle_txstatus(dev, &stat);
1258	}
1259}
1260
1261static void drain_txstatus_queue(struct b43_wldev *dev)
1262{
1263	u32 dummy;
1264
1265	if (dev->dev->core_rev < 5)
1266		return;
1267	/* Read all entries from the microcode TXstatus FIFO
1268	 * and throw them away.
1269	 */
1270	while (1) {
1271		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1272		if (!(dummy & 0x00000001))
1273			break;
1274		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1275	}
1276}
1277
1278static u32 b43_jssi_read(struct b43_wldev *dev)
1279{
1280	u32 val = 0;
1281
1282	val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1283	val <<= 16;
1284	val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1285
1286	return val;
1287}
1288
1289static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1290{
1291	b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1292	b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1293}
1294
1295static void b43_generate_noise_sample(struct b43_wldev *dev)
1296{
1297	b43_jssi_write(dev, 0x7F7F7F7F);
1298	b43_write32(dev, B43_MMIO_MACCMD,
1299		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1300}
1301
1302static void b43_calculate_link_quality(struct b43_wldev *dev)
1303{
1304	/* Top half of Link Quality calculation. */
1305
1306	if (dev->phy.type != B43_PHYTYPE_G)
1307		return;
1308	if (dev->noisecalc.calculation_running)
1309		return;
1310	dev->noisecalc.calculation_running = 1;
1311	dev->noisecalc.nr_samples = 0;
1312
1313	b43_generate_noise_sample(dev);
1314}
1315
1316static void handle_irq_noise(struct b43_wldev *dev)
1317{
1318	struct b43_phy_g *phy = dev->phy.g;
1319	u16 tmp;
1320	u8 noise[4];
1321	u8 i, j;
1322	s32 average;
1323
1324	/* Bottom half of Link Quality calculation. */
1325
1326	if (dev->phy.type != B43_PHYTYPE_G)
1327		return;
1328
1329	/* Possible race condition: It might be possible that the user
1330	 * changed to a different channel in the meantime since we
1331	 * started the calculation. We ignore that fact, since it's
1332	 * not really that much of a problem. The background noise is
1333	 * an estimation only anyway. Slightly wrong results will get damped
1334	 * by the averaging of the 8 sample rounds. Additionally the
1335	 * value is shortlived. So it will be replaced by the next noise
1336	 * calculation round soon. */
1337
1338	B43_WARN_ON(!dev->noisecalc.calculation_running);
1339	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1340	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1341	    noise[2] == 0x7F || noise[3] == 0x7F)
1342		goto generate_new;
1343
1344	/* Get the noise samples. */
1345	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1346	i = dev->noisecalc.nr_samples;
1347	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1348	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1349	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1350	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1351	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1352	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1353	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1354	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1355	dev->noisecalc.nr_samples++;
1356	if (dev->noisecalc.nr_samples == 8) {
1357		/* Calculate the Link Quality by the noise samples. */
1358		average = 0;
1359		for (i = 0; i < 8; i++) {
1360			for (j = 0; j < 4; j++)
1361				average += dev->noisecalc.samples[i][j];
1362		}
1363		average /= (8 * 4);
1364		average *= 125;
1365		average += 64;
1366		average /= 128;
1367		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1368		tmp = (tmp / 128) & 0x1F;
1369		if (tmp >= 8)
1370			average += 2;
1371		else
1372			average -= 25;
1373		if (tmp == 8)
1374			average -= 72;
1375		else
1376			average -= 48;
1377
1378		dev->stats.link_noise = average;
1379		dev->noisecalc.calculation_running = 0;
1380		return;
1381	}
1382generate_new:
1383	b43_generate_noise_sample(dev);
1384}
1385
1386static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1387{
1388	if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1389		///TODO: PS TBTT
1390	} else {
1391		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1392			b43_power_saving_ctl_bits(dev, 0);
1393	}
1394	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1395		dev->dfq_valid = 1;
1396}
1397
1398static void handle_irq_atim_end(struct b43_wldev *dev)
1399{
1400	if (dev->dfq_valid) {
1401		b43_write32(dev, B43_MMIO_MACCMD,
1402			    b43_read32(dev, B43_MMIO_MACCMD)
1403			    | B43_MACCMD_DFQ_VALID);
1404		dev->dfq_valid = 0;
1405	}
1406}
1407
1408static void handle_irq_pmq(struct b43_wldev *dev)
1409{
1410	u32 tmp;
1411
1412	//TODO: AP mode.
1413
1414	while (1) {
1415		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1416		if (!(tmp & 0x00000008))
1417			break;
1418	}
1419	/* 16bit write is odd, but correct. */
1420	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1421}
1422
1423static void b43_write_template_common(struct b43_wldev *dev,
1424				      const u8 *data, u16 size,
1425				      u16 ram_offset,
1426				      u16 shm_size_offset, u8 rate)
1427{
1428	u32 i, tmp;
1429	struct b43_plcp_hdr4 plcp;
1430
1431	plcp.data = 0;
1432	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1433	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1434	ram_offset += sizeof(u32);
1435	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1436	 * So leave the first two bytes of the next write blank.
1437	 */
1438	tmp = (u32) (data[0]) << 16;
1439	tmp |= (u32) (data[1]) << 24;
1440	b43_ram_write(dev, ram_offset, tmp);
1441	ram_offset += sizeof(u32);
1442	for (i = 2; i < size; i += sizeof(u32)) {
1443		tmp = (u32) (data[i + 0]);
1444		if (i + 1 < size)
1445			tmp |= (u32) (data[i + 1]) << 8;
1446		if (i + 2 < size)
1447			tmp |= (u32) (data[i + 2]) << 16;
1448		if (i + 3 < size)
1449			tmp |= (u32) (data[i + 3]) << 24;
1450		b43_ram_write(dev, ram_offset + i - 2, tmp);
1451	}
1452	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1453			size + sizeof(struct b43_plcp_hdr6));
1454}
1455
1456/* Check if the use of the antenna that ieee80211 told us to
1457 * use is possible. This will fall back to DEFAULT.
1458 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1459u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1460				  u8 antenna_nr)
1461{
1462	u8 antenna_mask;
1463
1464	if (antenna_nr == 0) {
1465		/* Zero means "use default antenna". That's always OK. */
1466		return 0;
1467	}
1468
1469	/* Get the mask of available antennas. */
1470	if (dev->phy.gmode)
1471		antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1472	else
1473		antenna_mask = dev->dev->bus_sprom->ant_available_a;
1474
1475	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1476		/* This antenna is not available. Fall back to default. */
1477		return 0;
1478	}
1479
1480	return antenna_nr;
1481}
1482
1483/* Convert a b43 antenna number value to the PHY TX control value. */
1484static u16 b43_antenna_to_phyctl(int antenna)
1485{
1486	switch (antenna) {
1487	case B43_ANTENNA0:
1488		return B43_TXH_PHY_ANT0;
1489	case B43_ANTENNA1:
1490		return B43_TXH_PHY_ANT1;
1491	case B43_ANTENNA2:
1492		return B43_TXH_PHY_ANT2;
1493	case B43_ANTENNA3:
1494		return B43_TXH_PHY_ANT3;
1495	case B43_ANTENNA_AUTO0:
1496	case B43_ANTENNA_AUTO1:
1497		return B43_TXH_PHY_ANT01AUTO;
1498	}
1499	B43_WARN_ON(1);
1500	return 0;
1501}
1502
1503static void b43_write_beacon_template(struct b43_wldev *dev,
1504				      u16 ram_offset,
1505				      u16 shm_size_offset)
1506{
1507	unsigned int i, len, variable_len;
1508	const struct ieee80211_mgmt *bcn;
1509	const u8 *ie;
1510	bool tim_found = 0;
1511	unsigned int rate;
1512	u16 ctl;
1513	int antenna;
1514	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1515
1516	bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1517	len = min((size_t) dev->wl->current_beacon->len,
1518		  0x200 - sizeof(struct b43_plcp_hdr6));
1519	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1520
1521	b43_write_template_common(dev, (const u8 *)bcn,
1522				  len, ram_offset, shm_size_offset, rate);
1523
1524	/* Write the PHY TX control parameters. */
1525	antenna = B43_ANTENNA_DEFAULT;
1526	antenna = b43_antenna_to_phyctl(antenna);
1527	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1528	/* We can't send beacons with short preamble. Would get PHY errors. */
1529	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1530	ctl &= ~B43_TXH_PHY_ANT;
1531	ctl &= ~B43_TXH_PHY_ENC;
1532	ctl |= antenna;
1533	if (b43_is_cck_rate(rate))
1534		ctl |= B43_TXH_PHY_ENC_CCK;
1535	else
1536		ctl |= B43_TXH_PHY_ENC_OFDM;
1537	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1538
1539	/* Find the position of the TIM and the DTIM_period value
1540	 * and write them to SHM. */
1541	ie = bcn->u.beacon.variable;
1542	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1543	for (i = 0; i < variable_len - 2; ) {
1544		uint8_t ie_id, ie_len;
1545
1546		ie_id = ie[i];
1547		ie_len = ie[i + 1];
1548		if (ie_id == 5) {
1549			u16 tim_position;
1550			u16 dtim_period;
1551			/* This is the TIM Information Element */
1552
1553			/* Check whether the ie_len is in the beacon data range. */
1554			if (variable_len < ie_len + 2 + i)
1555				break;
1556			/* A valid TIM is at least 4 bytes long. */
1557			if (ie_len < 4)
1558				break;
1559			tim_found = 1;
1560
1561			tim_position = sizeof(struct b43_plcp_hdr6);
1562			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1563			tim_position += i;
1564
1565			dtim_period = ie[i + 3];
1566
1567			b43_shm_write16(dev, B43_SHM_SHARED,
1568					B43_SHM_SH_TIMBPOS, tim_position);
1569			b43_shm_write16(dev, B43_SHM_SHARED,
1570					B43_SHM_SH_DTIMPER, dtim_period);
1571			break;
1572		}
1573		i += ie_len + 2;
1574	}
1575	if (!tim_found) {
1576		/*
1577		 * If ucode wants to modify TIM do it behind the beacon, this
1578		 * will happen, for example, when doing mesh networking.
1579		 */
1580		b43_shm_write16(dev, B43_SHM_SHARED,
1581				B43_SHM_SH_TIMBPOS,
1582				len + sizeof(struct b43_plcp_hdr6));
1583		b43_shm_write16(dev, B43_SHM_SHARED,
1584				B43_SHM_SH_DTIMPER, 0);
1585	}
1586	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1587}
1588
1589static void b43_upload_beacon0(struct b43_wldev *dev)
1590{
1591	struct b43_wl *wl = dev->wl;
1592
1593	if (wl->beacon0_uploaded)
1594		return;
1595	b43_write_beacon_template(dev, 0x68, 0x18);
1596	wl->beacon0_uploaded = 1;
1597}
1598
1599static void b43_upload_beacon1(struct b43_wldev *dev)
1600{
1601	struct b43_wl *wl = dev->wl;
1602
1603	if (wl->beacon1_uploaded)
1604		return;
1605	b43_write_beacon_template(dev, 0x468, 0x1A);
1606	wl->beacon1_uploaded = 1;
1607}
1608
1609static void handle_irq_beacon(struct b43_wldev *dev)
1610{
1611	struct b43_wl *wl = dev->wl;
1612	u32 cmd, beacon0_valid, beacon1_valid;
1613
1614	if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1615	    !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1616		return;
1617
1618	/* This is the bottom half of the asynchronous beacon update. */
1619
1620	/* Ignore interrupt in the future. */
1621	dev->irq_mask &= ~B43_IRQ_BEACON;
1622
1623	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1624	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1625	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1626
1627	/* Schedule interrupt manually, if busy. */
1628	if (beacon0_valid && beacon1_valid) {
1629		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1630		dev->irq_mask |= B43_IRQ_BEACON;
1631		return;
1632	}
1633
1634	if (unlikely(wl->beacon_templates_virgin)) {
1635		/* We never uploaded a beacon before.
1636		 * Upload both templates now, but only mark one valid. */
1637		wl->beacon_templates_virgin = 0;
1638		b43_upload_beacon0(dev);
1639		b43_upload_beacon1(dev);
1640		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1641		cmd |= B43_MACCMD_BEACON0_VALID;
1642		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1643	} else {
1644		if (!beacon0_valid) {
1645			b43_upload_beacon0(dev);
1646			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1647			cmd |= B43_MACCMD_BEACON0_VALID;
1648			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1649		} else if (!beacon1_valid) {
1650			b43_upload_beacon1(dev);
1651			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1652			cmd |= B43_MACCMD_BEACON1_VALID;
1653			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1654		}
1655	}
1656}
1657
1658static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1659{
1660	u32 old_irq_mask = dev->irq_mask;
1661
1662	/* update beacon right away or defer to irq */
1663	handle_irq_beacon(dev);
1664	if (old_irq_mask != dev->irq_mask) {
1665		/* The handler updated the IRQ mask. */
1666		B43_WARN_ON(!dev->irq_mask);
1667		if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1668			b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1669		} else {
1670			/* Device interrupts are currently disabled. That means
1671			 * we just ran the hardirq handler and scheduled the
1672			 * IRQ thread. The thread will write the IRQ mask when
1673			 * it finished, so there's nothing to do here. Writing
1674			 * the mask _here_ would incorrectly re-enable IRQs. */
1675		}
1676	}
1677}
1678
1679static void b43_beacon_update_trigger_work(struct work_struct *work)
1680{
1681	struct b43_wl *wl = container_of(work, struct b43_wl,
1682					 beacon_update_trigger);
1683	struct b43_wldev *dev;
1684
1685	mutex_lock(&wl->mutex);
1686	dev = wl->current_dev;
1687	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1688		if (b43_bus_host_is_sdio(dev->dev)) {
1689			/* wl->mutex is enough. */
1690			b43_do_beacon_update_trigger_work(dev);
1691			mmiowb();
1692		} else {
1693			spin_lock_irq(&wl->hardirq_lock);
1694			b43_do_beacon_update_trigger_work(dev);
1695			mmiowb();
1696			spin_unlock_irq(&wl->hardirq_lock);
1697		}
1698	}
1699	mutex_unlock(&wl->mutex);
1700}
1701
1702/* Asynchronously update the packet templates in template RAM.
1703 * Locking: Requires wl->mutex to be locked. */
1704static void b43_update_templates(struct b43_wl *wl)
1705{
1706	struct sk_buff *beacon;
1707
1708	/* This is the top half of the ansynchronous beacon update.
1709	 * The bottom half is the beacon IRQ.
1710	 * Beacon update must be asynchronous to avoid sending an
1711	 * invalid beacon. This can happen for example, if the firmware
1712	 * transmits a beacon while we are updating it. */
1713
1714	/* We could modify the existing beacon and set the aid bit in
1715	 * the TIM field, but that would probably require resizing and
1716	 * moving of data within the beacon template.
1717	 * Simply request a new beacon and let mac80211 do the hard work. */
1718	beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1719	if (unlikely(!beacon))
1720		return;
1721
1722	if (wl->current_beacon)
1723		dev_kfree_skb_any(wl->current_beacon);
1724	wl->current_beacon = beacon;
1725	wl->beacon0_uploaded = 0;
1726	wl->beacon1_uploaded = 0;
1727	ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1728}
1729
1730static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1731{
1732	b43_time_lock(dev);
1733	if (dev->dev->core_rev >= 3) {
1734		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1735		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1736	} else {
1737		b43_write16(dev, 0x606, (beacon_int >> 6));
1738		b43_write16(dev, 0x610, beacon_int);
1739	}
1740	b43_time_unlock(dev);
1741	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1742}
1743
1744static void b43_handle_firmware_panic(struct b43_wldev *dev)
1745{
1746	u16 reason;
1747
1748	/* Read the register that contains the reason code for the panic. */
1749	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1750	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1751
1752	switch (reason) {
1753	default:
1754		b43dbg(dev->wl, "The panic reason is unknown.\n");
1755		/* fallthrough */
1756	case B43_FWPANIC_DIE:
1757		/* Do not restart the controller or firmware.
1758		 * The device is nonfunctional from now on.
1759		 * Restarting would result in this panic to trigger again,
1760		 * so we avoid that recursion. */
1761		break;
1762	case B43_FWPANIC_RESTART:
1763		b43_controller_restart(dev, "Microcode panic");
1764		break;
1765	}
1766}
1767
1768static void handle_irq_ucode_debug(struct b43_wldev *dev)
1769{
1770	unsigned int i, cnt;
1771	u16 reason, marker_id, marker_line;
1772	__le16 *buf;
1773
1774	/* The proprietary firmware doesn't have this IRQ. */
1775	if (!dev->fw.opensource)
1776		return;
1777
1778	/* Read the register that contains the reason code for this IRQ. */
1779	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1780
1781	switch (reason) {
1782	case B43_DEBUGIRQ_PANIC:
1783		b43_handle_firmware_panic(dev);
1784		break;
1785	case B43_DEBUGIRQ_DUMP_SHM:
1786		if (!B43_DEBUG)
1787			break; /* Only with driver debugging enabled. */
1788		buf = kmalloc(4096, GFP_ATOMIC);
1789		if (!buf) {
1790			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1791			goto out;
1792		}
1793		for (i = 0; i < 4096; i += 2) {
1794			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1795			buf[i / 2] = cpu_to_le16(tmp);
1796		}
1797		b43info(dev->wl, "Shared memory dump:\n");
1798		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1799			       16, 2, buf, 4096, 1);
1800		kfree(buf);
1801		break;
1802	case B43_DEBUGIRQ_DUMP_REGS:
1803		if (!B43_DEBUG)
1804			break; /* Only with driver debugging enabled. */
1805		b43info(dev->wl, "Microcode register dump:\n");
1806		for (i = 0, cnt = 0; i < 64; i++) {
1807			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1808			if (cnt == 0)
1809				printk(KERN_INFO);
1810			printk("r%02u: 0x%04X  ", i, tmp);
1811			cnt++;
1812			if (cnt == 6) {
1813				printk("\n");
1814				cnt = 0;
1815			}
1816		}
1817		printk("\n");
1818		break;
1819	case B43_DEBUGIRQ_MARKER:
1820		if (!B43_DEBUG)
1821			break; /* Only with driver debugging enabled. */
1822		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1823					   B43_MARKER_ID_REG);
1824		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1825					     B43_MARKER_LINE_REG);
1826		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1827			"at line number %u\n",
1828			marker_id, marker_line);
1829		break;
1830	default:
1831		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1832		       reason);
1833	}
1834out:
1835	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1836	b43_shm_write16(dev, B43_SHM_SCRATCH,
1837			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1838}
1839
1840static void b43_do_interrupt_thread(struct b43_wldev *dev)
1841{
1842	u32 reason;
1843	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1844	u32 merged_dma_reason = 0;
1845	int i;
1846
1847	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1848		return;
1849
1850	reason = dev->irq_reason;
1851	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1852		dma_reason[i] = dev->dma_reason[i];
1853		merged_dma_reason |= dma_reason[i];
1854	}
1855
1856	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1857		b43err(dev->wl, "MAC transmission error\n");
1858
1859	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1860		b43err(dev->wl, "PHY transmission error\n");
1861		rmb();
1862		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1863			atomic_set(&dev->phy.txerr_cnt,
1864				   B43_PHY_TX_BADNESS_LIMIT);
1865			b43err(dev->wl, "Too many PHY TX errors, "
1866					"restarting the controller\n");
1867			b43_controller_restart(dev, "PHY TX errors");
1868		}
1869	}
1870
1871	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1872					  B43_DMAIRQ_NONFATALMASK))) {
1873		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1874			b43err(dev->wl, "Fatal DMA error: "
1875			       "0x%08X, 0x%08X, 0x%08X, "
1876			       "0x%08X, 0x%08X, 0x%08X\n",
1877			       dma_reason[0], dma_reason[1],
1878			       dma_reason[2], dma_reason[3],
1879			       dma_reason[4], dma_reason[5]);
1880			b43err(dev->wl, "This device does not support DMA "
1881			       "on your system. It will now be switched to PIO.\n");
1882			/* Fall back to PIO transfers if we get fatal DMA errors! */
1883			dev->use_pio = 1;
1884			b43_controller_restart(dev, "DMA error");
1885			return;
1886		}
1887		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1888			b43err(dev->wl, "DMA error: "
1889			       "0x%08X, 0x%08X, 0x%08X, "
1890			       "0x%08X, 0x%08X, 0x%08X\n",
1891			       dma_reason[0], dma_reason[1],
1892			       dma_reason[2], dma_reason[3],
1893			       dma_reason[4], dma_reason[5]);
1894		}
1895	}
1896
1897	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1898		handle_irq_ucode_debug(dev);
1899	if (reason & B43_IRQ_TBTT_INDI)
1900		handle_irq_tbtt_indication(dev);
1901	if (reason & B43_IRQ_ATIM_END)
1902		handle_irq_atim_end(dev);
1903	if (reason & B43_IRQ_BEACON)
1904		handle_irq_beacon(dev);
1905	if (reason & B43_IRQ_PMQ)
1906		handle_irq_pmq(dev);
1907	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1908		;/* TODO */
1909	if (reason & B43_IRQ_NOISESAMPLE_OK)
1910		handle_irq_noise(dev);
1911
1912	/* Check the DMA reason registers for received data. */
1913	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1914		if (b43_using_pio_transfers(dev))
1915			b43_pio_rx(dev->pio.rx_queue);
1916		else
1917			b43_dma_rx(dev->dma.rx_ring);
1918	}
1919	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1920	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1921	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1922	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1923	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1924
1925	if (reason & B43_IRQ_TX_OK)
1926		handle_irq_transmit_status(dev);
1927
1928	/* Re-enable interrupts on the device by restoring the current interrupt mask. */
1929	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1930
1931#if B43_DEBUG
1932	if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1933		dev->irq_count++;
1934		for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1935			if (reason & (1 << i))
1936				dev->irq_bit_count[i]++;
1937		}
1938	}
1939#endif
1940}
1941
1942/* Interrupt thread handler. Handles device interrupts in thread context. */
1943static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1944{
1945	struct b43_wldev *dev = dev_id;
1946
1947	mutex_lock(&dev->wl->mutex);
1948	b43_do_interrupt_thread(dev);
1949	mmiowb();
1950	mutex_unlock(&dev->wl->mutex);
1951
1952	return IRQ_HANDLED;
1953}
1954
1955static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1956{
1957	u32 reason;
1958
1959	/* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1960	 * On SDIO, this runs under wl->mutex. */
1961
1962	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1963	if (reason == 0xffffffff)	/* shared IRQ */
1964		return IRQ_NONE;
1965	reason &= dev->irq_mask;
1966	if (!reason)
1967		return IRQ_HANDLED;
1968
1969	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1970	    & 0x0001DC00;
1971	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1972	    & 0x0000DC00;
1973	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1974	    & 0x0000DC00;
1975	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1976	    & 0x0001DC00;
1977	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1978	    & 0x0000DC00;
1979/* Unused ring
1980	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1981	    & 0x0000DC00;
1982*/
1983
1984	/* ACK the interrupt. */
1985	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1986	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1987	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1988	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1989	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1990	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1991/* Unused ring
1992	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1993*/
1994
1995	/* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1996	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1997	/* Save the reason bitmasks for the IRQ thread handler. */
1998	dev->irq_reason = reason;
1999
2000	return IRQ_WAKE_THREAD;
2001}
2002
2003/* Interrupt handler top-half. This runs with interrupts disabled. */
2004static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2005{
2006	struct b43_wldev *dev = dev_id;
2007	irqreturn_t ret;
2008
2009	if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2010		return IRQ_NONE;
2011
2012	spin_lock(&dev->wl->hardirq_lock);
2013	ret = b43_do_interrupt(dev);
2014	mmiowb();
2015	spin_unlock(&dev->wl->hardirq_lock);
2016
2017	return ret;
2018}
2019
2020/* SDIO interrupt handler. This runs in process context. */
2021static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2022{
2023	struct b43_wl *wl = dev->wl;
2024	irqreturn_t ret;
2025
2026	mutex_lock(&wl->mutex);
2027
2028	ret = b43_do_interrupt(dev);
2029	if (ret == IRQ_WAKE_THREAD)
2030		b43_do_interrupt_thread(dev);
2031
2032	mutex_unlock(&wl->mutex);
2033}
2034
2035void b43_do_release_fw(struct b43_firmware_file *fw)
2036{
2037	release_firmware(fw->data);
2038	fw->data = NULL;
2039	fw->filename = NULL;
2040}
2041
2042static void b43_release_firmware(struct b43_wldev *dev)
2043{
2044	b43_do_release_fw(&dev->fw.ucode);
2045	b43_do_release_fw(&dev->fw.pcm);
2046	b43_do_release_fw(&dev->fw.initvals);
2047	b43_do_release_fw(&dev->fw.initvals_band);
2048}
2049
2050static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2051{
2052	const char text[] =
2053		"You must go to " \
2054		"http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2055		"and download the correct firmware for this driver version. " \
2056		"Please carefully read all instructions on this website.\n";
2057
2058	if (error)
2059		b43err(wl, text);
2060	else
2061		b43warn(wl, text);
2062}
2063
2064int b43_do_request_fw(struct b43_request_fw_context *ctx,
2065		      const char *name,
2066		      struct b43_firmware_file *fw)
2067{
2068	const struct firmware *blob;
2069	struct b43_fw_header *hdr;
2070	u32 size;
2071	int err;
2072
2073	if (!name) {
2074		/* Don't fetch anything. Free possibly cached firmware. */
2075		/* FIXME: We should probably keep it anyway, to save some headache
2076		 * on suspend/resume with multiband devices. */
2077		b43_do_release_fw(fw);
2078		return 0;
2079	}
2080	if (fw->filename) {
2081		if ((fw->type == ctx->req_type) &&
2082		    (strcmp(fw->filename, name) == 0))
2083			return 0; /* Already have this fw. */
2084		/* Free the cached firmware first. */
2085		/* FIXME: We should probably do this later after we successfully
2086		 * got the new fw. This could reduce headache with multiband devices.
2087		 * We could also redesign this to cache the firmware for all possible
2088		 * bands all the time. */
2089		b43_do_release_fw(fw);
2090	}
2091
2092	switch (ctx->req_type) {
2093	case B43_FWTYPE_PROPRIETARY:
2094		snprintf(ctx->fwname, sizeof(ctx->fwname),
2095			 "b43%s/%s.fw",
2096			 modparam_fwpostfix, name);
2097		break;
2098	case B43_FWTYPE_OPENSOURCE:
2099		snprintf(ctx->fwname, sizeof(ctx->fwname),
2100			 "b43-open%s/%s.fw",
2101			 modparam_fwpostfix, name);
2102		break;
2103	default:
2104		B43_WARN_ON(1);
2105		return -ENOSYS;
2106	}
2107	err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2108	if (err == -ENOENT) {
2109		snprintf(ctx->errors[ctx->req_type],
2110			 sizeof(ctx->errors[ctx->req_type]),
2111			 "Firmware file \"%s\" not found\n", ctx->fwname);
2112		return err;
2113	} else if (err) {
2114		snprintf(ctx->errors[ctx->req_type],
2115			 sizeof(ctx->errors[ctx->req_type]),
2116			 "Firmware file \"%s\" request failed (err=%d)\n",
2117			 ctx->fwname, err);
2118		return err;
2119	}
2120	if (blob->size < sizeof(struct b43_fw_header))
2121		goto err_format;
2122	hdr = (struct b43_fw_header *)(blob->data);
2123	switch (hdr->type) {
2124	case B43_FW_TYPE_UCODE:
2125	case B43_FW_TYPE_PCM:
2126		size = be32_to_cpu(hdr->size);
2127		if (size != blob->size - sizeof(struct b43_fw_header))
2128			goto err_format;
2129		/* fallthrough */
2130	case B43_FW_TYPE_IV:
2131		if (hdr->ver != 1)
2132			goto err_format;
2133		break;
2134	default:
2135		goto err_format;
2136	}
2137
2138	fw->data = blob;
2139	fw->filename = name;
2140	fw->type = ctx->req_type;
2141
2142	return 0;
2143
2144err_format:
2145	snprintf(ctx->errors[ctx->req_type],
2146		 sizeof(ctx->errors[ctx->req_type]),
2147		 "Firmware file \"%s\" format error.\n", ctx->fwname);
2148	release_firmware(blob);
2149
2150	return -EPROTO;
2151}
2152
2153static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2154{
2155	struct b43_wldev *dev = ctx->dev;
2156	struct b43_firmware *fw = &ctx->dev->fw;
2157	const u8 rev = ctx->dev->dev->core_rev;
2158	const char *filename;
2159	u32 tmshigh;
2160	int err;
2161
2162	/* Files for HT and LCN were found by trying one by one */
2163
2164	/* Get microcode */
2165	if ((rev >= 5) && (rev <= 10)) {
2166		filename = "ucode5";
2167	} else if ((rev >= 11) && (rev <= 12)) {
2168		filename = "ucode11";
2169	} else if (rev == 13) {
2170		filename = "ucode13";
2171	} else if (rev == 14) {
2172		filename = "ucode14";
2173	} else if (rev == 15) {
2174		filename = "ucode15";
2175	} else {
2176		switch (dev->phy.type) {
2177		case B43_PHYTYPE_N:
2178			if (rev >= 16)
2179				filename = "ucode16_mimo";
2180			else
2181				goto err_no_ucode;
2182			break;
2183		case B43_PHYTYPE_HT:
2184			if (rev == 29)
2185				filename = "ucode29_mimo";
2186			else
2187				goto err_no_ucode;
2188			break;
2189		case B43_PHYTYPE_LCN:
2190			if (rev == 24)
2191				filename = "ucode24_mimo";
2192			else
2193				goto err_no_ucode;
2194			break;
2195		default:
2196			goto err_no_ucode;
2197		}
2198	}
2199	err = b43_do_request_fw(ctx, filename, &fw->ucode);
2200	if (err)
2201		goto err_load;
2202
2203	/* Get PCM code */
2204	if ((rev >= 5) && (rev <= 10))
2205		filename = "pcm5";
2206	else if (rev >= 11)
2207		filename = NULL;
2208	else
2209		goto err_no_pcm;
2210	fw->pcm_request_failed = 0;
2211	err = b43_do_request_fw(ctx, filename, &fw->pcm);
2212	if (err == -ENOENT) {
2213		/* We did not find a PCM file? Not fatal, but
2214		 * core rev <= 10 must do without hwcrypto then. */
2215		fw->pcm_request_failed = 1;
2216	} else if (err)
2217		goto err_load;
2218
2219	/* Get initvals */
2220	switch (dev->phy.type) {
2221	case B43_PHYTYPE_A:
2222		if ((rev >= 5) && (rev <= 10)) {
2223			tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2224			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2225				filename = "a0g1initvals5";
2226			else
2227				filename = "a0g0initvals5";
2228		} else
2229			goto err_no_initvals;
2230		break;
2231	case B43_PHYTYPE_G:
2232		if ((rev >= 5) && (rev <= 10))
2233			filename = "b0g0initvals5";
2234		else if (rev >= 13)
2235			filename = "b0g0initvals13";
2236		else
2237			goto err_no_initvals;
2238		break;
2239	case B43_PHYTYPE_N:
2240		if (rev >= 16)
2241			filename = "n0initvals16";
2242		else if ((rev >= 11) && (rev <= 12))
2243			filename = "n0initvals11";
2244		else
2245			goto err_no_initvals;
2246		break;
2247	case B43_PHYTYPE_LP:
2248		if (rev == 13)
2249			filename = "lp0initvals13";
2250		else if (rev == 14)
2251			filename = "lp0initvals14";
2252		else if (rev >= 15)
2253			filename = "lp0initvals15";
2254		else
2255			goto err_no_initvals;
2256		break;
2257	case B43_PHYTYPE_HT:
2258		if (rev == 29)
2259			filename = "ht0initvals29";
2260		else
2261			goto err_no_initvals;
2262		break;
2263	case B43_PHYTYPE_LCN:
2264		if (rev == 24)
2265			filename = "lcn0initvals24";
2266		else
2267			goto err_no_initvals;
2268		break;
2269	default:
2270		goto err_no_initvals;
2271	}
2272	err = b43_do_request_fw(ctx, filename, &fw->initvals);
2273	if (err)
2274		goto err_load;
2275
2276	/* Get bandswitch initvals */
2277	switch (dev->phy.type) {
2278	case B43_PHYTYPE_A:
2279		if ((rev >= 5) && (rev <= 10)) {
2280			tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2281			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2282				filename = "a0g1bsinitvals5";
2283			else
2284				filename = "a0g0bsinitvals5";
2285		} else if (rev >= 11)
2286			filename = NULL;
2287		else
2288			goto err_no_initvals;
2289		break;
2290	case B43_PHYTYPE_G:
2291		if ((rev >= 5) && (rev <= 10))
2292			filename = "b0g0bsinitvals5";
2293		else if (rev >= 11)
2294			filename = NULL;
2295		else
2296			goto err_no_initvals;
2297		break;
2298	case B43_PHYTYPE_N:
2299		if (rev >= 16)
2300			filename = "n0bsinitvals16";
2301		else if ((rev >= 11) && (rev <= 12))
2302			filename = "n0bsinitvals11";
2303		else
2304			goto err_no_initvals;
2305		break;
2306	case B43_PHYTYPE_LP:
2307		if (rev == 13)
2308			filename = "lp0bsinitvals13";
2309		else if (rev == 14)
2310			filename = "lp0bsinitvals14";
2311		else if (rev >= 15)
2312			filename = "lp0bsinitvals15";
2313		else
2314			goto err_no_initvals;
2315		break;
2316	case B43_PHYTYPE_HT:
2317		if (rev == 29)
2318			filename = "ht0bsinitvals29";
2319		else
2320			goto err_no_initvals;
2321		break;
2322	case B43_PHYTYPE_LCN:
2323		if (rev == 24)
2324			filename = "lcn0bsinitvals24";
2325		else
2326			goto err_no_initvals;
2327		break;
2328	default:
2329		goto err_no_initvals;
2330	}
2331	err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2332	if (err)
2333		goto err_load;
2334
2335	return 0;
2336
2337err_no_ucode:
2338	err = ctx->fatal_failure = -EOPNOTSUPP;
2339	b43err(dev->wl, "The driver does not know which firmware (ucode) "
2340	       "is required for your device (wl-core rev %u)\n", rev);
2341	goto error;
2342
2343err_no_pcm:
2344	err = ctx->fatal_failure = -EOPNOTSUPP;
2345	b43err(dev->wl, "The driver does not know which firmware (PCM) "
2346	       "is required for your device (wl-core rev %u)\n", rev);
2347	goto error;
2348
2349err_no_initvals:
2350	err = ctx->fatal_failure = -EOPNOTSUPP;
2351	b43err(dev->wl, "The driver does not know which firmware (initvals) "
2352	       "is required for your device (wl-core rev %u)\n", rev);
2353	goto error;
2354
2355err_load:
2356	/* We failed to load this firmware image. The error message
2357	 * already is in ctx->errors. Return and let our caller decide
2358	 * what to do. */
2359	goto error;
2360
2361error:
2362	b43_release_firmware(dev);
2363	return err;
2364}
2365
2366static int b43_request_firmware(struct b43_wldev *dev)
2367{
2368	struct b43_request_fw_context *ctx;
2369	unsigned int i;
2370	int err;
2371	const char *errmsg;
2372
2373	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2374	if (!ctx)
2375		return -ENOMEM;
2376	ctx->dev = dev;
2377
2378	ctx->req_type = B43_FWTYPE_PROPRIETARY;
2379	err = b43_try_request_fw(ctx);
2380	if (!err)
2381		goto out; /* Successfully loaded it. */
2382	err = ctx->fatal_failure;
2383	if (err)
2384		goto out;
2385
2386	ctx->req_type = B43_FWTYPE_OPENSOURCE;
2387	err = b43_try_request_fw(ctx);
2388	if (!err)
2389		goto out; /* Successfully loaded it. */
2390	err = ctx->fatal_failure;
2391	if (err)
2392		goto out;
2393
2394	/* Could not find a usable firmware. Print the errors. */
2395	for (i = 0; i < B43_NR_FWTYPES; i++) {
2396		errmsg = ctx->errors[i];
2397		if (strlen(errmsg))
2398			b43err(dev->wl, errmsg);
2399	}
2400	b43_print_fw_helptext(dev->wl, 1);
2401	err = -ENOENT;
2402
2403out:
2404	kfree(ctx);
2405	return err;
2406}
2407
2408static int b43_upload_microcode(struct b43_wldev *dev)
2409{
2410	struct wiphy *wiphy = dev->wl->hw->wiphy;
2411	const size_t hdr_len = sizeof(struct b43_fw_header);
2412	const __be32 *data;
2413	unsigned int i, len;
2414	u16 fwrev, fwpatch, fwdate, fwtime;
2415	u32 tmp, macctl;
2416	int err = 0;
2417
2418	/* Jump the microcode PSM to offset 0 */
2419	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2420	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2421	macctl |= B43_MACCTL_PSM_JMP0;
2422	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2423	/* Zero out all microcode PSM registers and shared memory. */
2424	for (i = 0; i < 64; i++)
2425		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2426	for (i = 0; i < 4096; i += 2)
2427		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2428
2429	/* Upload Microcode. */
2430	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2431	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2432	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2433	for (i = 0; i < len; i++) {
2434		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2435		udelay(10);
2436	}
2437
2438	if (dev->fw.pcm.data) {
2439		/* Upload PCM data. */
2440		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2441		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2442		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2443		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2444		/* No need for autoinc bit in SHM_HW */
2445		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2446		for (i = 0; i < len; i++) {
2447			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2448			udelay(10);
2449		}
2450	}
2451
2452	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2453
2454	/* Start the microcode PSM */
2455	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2456	macctl &= ~B43_MACCTL_PSM_JMP0;
2457	macctl |= B43_MACCTL_PSM_RUN;
2458	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2459
2460	/* Wait for the microcode to load and respond */
2461	i = 0;
2462	while (1) {
2463		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2464		if (tmp == B43_IRQ_MAC_SUSPENDED)
2465			break;
2466		i++;
2467		if (i >= 20) {
2468			b43err(dev->wl, "Microcode not responding\n");
2469			b43_print_fw_helptext(dev->wl, 1);
2470			err = -ENODEV;
2471			goto error;
2472		}
2473		msleep(50);
2474	}
2475	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2476
2477	/* Get and check the revisions. */
2478	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2479	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2480	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2481	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2482
2483	if (fwrev <= 0x128) {
2484		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2485		       "binary drivers older than version 4.x is unsupported. "
2486		       "You must upgrade your firmware files.\n");
2487		b43_print_fw_helptext(dev->wl, 1);
2488		err = -EOPNOTSUPP;
2489		goto error;
2490	}
2491	dev->fw.rev = fwrev;
2492	dev->fw.patch = fwpatch;
2493	dev->fw.opensource = (fwdate == 0xFFFF);
2494
2495	/* Default to use-all-queues. */
2496	dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2497	dev->qos_enabled = !!modparam_qos;
2498	/* Default to firmware/hardware crypto acceleration. */
2499	dev->hwcrypto_enabled = 1;
2500
2501	if (dev->fw.opensource) {
2502		u16 fwcapa;
2503
2504		/* Patchlevel info is encoded in the "time" field. */
2505		dev->fw.patch = fwtime;
2506		b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2507			dev->fw.rev, dev->fw.patch);
2508
2509		fwcapa = b43_fwcapa_read(dev);
2510		if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2511			b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2512			/* Disable hardware crypto and fall back to software crypto. */
2513			dev->hwcrypto_enabled = 0;
2514		}
2515		if (!(fwcapa & B43_FWCAPA_QOS)) {
2516			b43info(dev->wl, "QoS not supported by firmware\n");
2517			/* Disable QoS. Tweak hw->queues to 1. It will be restored before
2518			 * ieee80211_unregister to make sure the networking core can
2519			 * properly free possible resources. */
2520			dev->wl->hw->queues = 1;
2521			dev->qos_enabled = 0;
2522		}
2523	} else {
2524		b43info(dev->wl, "Loading firmware version %u.%u "
2525			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2526			fwrev, fwpatch,
2527			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2528			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2529		if (dev->fw.pcm_request_failed) {
2530			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2531				"Hardware accelerated cryptography is disabled.\n");
2532			b43_print_fw_helptext(dev->wl, 0);
2533		}
2534	}
2535
2536	snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2537			dev->fw.rev, dev->fw.patch);
2538	wiphy->hw_version = dev->dev->core_id;
2539
2540	if (b43_is_old_txhdr_format(dev)) {
2541		/* We're over the deadline, but we keep support for old fw
2542		 * until it turns out to be in major conflict with something new. */
2543		b43warn(dev->wl, "You are using an old firmware image. "
2544			"Support for old firmware will be removed soon "
2545			"(official deadline was July 2008).\n");
2546		b43_print_fw_helptext(dev->wl, 0);
2547	}
2548
2549	return 0;
2550
2551error:
2552	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2553	macctl &= ~B43_MACCTL_PSM_RUN;
2554	macctl |= B43_MACCTL_PSM_JMP0;
2555	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2556
2557	return err;
2558}
2559
2560static int b43_write_initvals(struct b43_wldev *dev,
2561			      const struct b43_iv *ivals,
2562			      size_t count,
2563			      size_t array_size)
2564{
2565	const struct b43_iv *iv;
2566	u16 offset;
2567	size_t i;
2568	bool bit32;
2569
2570	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2571	iv = ivals;
2572	for (i = 0; i < count; i++) {
2573		if (array_size < sizeof(iv->offset_size))
2574			goto err_format;
2575		array_size -= sizeof(iv->offset_size);
2576		offset = be16_to_cpu(iv->offset_size);
2577		bit32 = !!(offset & B43_IV_32BIT);
2578		offset &= B43_IV_OFFSET_MASK;
2579		if (offset >= 0x1000)
2580			goto err_format;
2581		if (bit32) {
2582			u32 value;
2583
2584			if (array_size < sizeof(iv->data.d32))
2585				goto err_format;
2586			array_size -= sizeof(iv->data.d32);
2587
2588			value = get_unaligned_be32(&iv->data.d32);
2589			b43_write32(dev, offset, value);
2590
2591			iv = (const struct b43_iv *)((const uint8_t *)iv +
2592							sizeof(__be16) +
2593							sizeof(__be32));
2594		} else {
2595			u16 value;
2596
2597			if (array_size < sizeof(iv->data.d16))
2598				goto err_format;
2599			array_size -= sizeof(iv->data.d16);
2600
2601			value = be16_to_cpu(iv->data.d16);
2602			b43_write16(dev, offset, value);
2603
2604			iv = (const struct b43_iv *)((const uint8_t *)iv +
2605							sizeof(__be16) +
2606							sizeof(__be16));
2607		}
2608	}
2609	if (array_size)
2610		goto err_format;
2611
2612	return 0;
2613
2614err_format:
2615	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2616	b43_print_fw_helptext(dev->wl, 1);
2617
2618	return -EPROTO;
2619}
2620
2621static int b43_upload_initvals(struct b43_wldev *dev)
2622{
2623	const size_t hdr_len = sizeof(struct b43_fw_header);
2624	const struct b43_fw_header *hdr;
2625	struct b43_firmware *fw = &dev->fw;
2626	const struct b43_iv *ivals;
2627	size_t count;
2628	int err;
2629
2630	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2631	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2632	count = be32_to_cpu(hdr->size);
2633	err = b43_write_initvals(dev, ivals, count,
2634				 fw->initvals.data->size - hdr_len);
2635	if (err)
2636		goto out;
2637	if (fw->initvals_band.data) {
2638		hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2639		ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2640		count = be32_to_cpu(hdr->size);
2641		err = b43_write_initvals(dev, ivals, count,
2642					 fw->initvals_band.data->size - hdr_len);
2643		if (err)
2644			goto out;
2645	}
2646out:
2647
2648	return err;
2649}
2650
2651/* Initialize the GPIOs
2652 * http://bcm-specs.sipsolutions.net/GPIO
2653 */
2654static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2655{
2656	struct ssb_bus *bus = dev->dev->sdev->bus;
2657
2658#ifdef CONFIG_SSB_DRIVER_PCICORE
2659	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2660#else
2661	return bus->chipco.dev;
2662#endif
2663}
2664
2665static int b43_gpio_init(struct b43_wldev *dev)
2666{
2667	struct ssb_device *gpiodev;
2668	u32 mask, set;
2669
2670	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2671		    & ~B43_MACCTL_GPOUTSMSK);
2672
2673	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2674		    | 0x000F);
2675
2676	mask = 0x0000001F;
2677	set = 0x0000000F;
2678	if (dev->dev->chip_id == 0x4301) {
2679		mask |= 0x0060;
2680		set |= 0x0060;
2681	}
2682	if (0 /* FIXME: conditional unknown */ ) {
2683		b43_write16(dev, B43_MMIO_GPIO_MASK,
2684			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2685			    | 0x0100);
2686		mask |= 0x0180;
2687		set |= 0x0180;
2688	}
2689	if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2690		b43_write16(dev, B43_MMIO_GPIO_MASK,
2691			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2692			    | 0x0200);
2693		mask |= 0x0200;
2694		set |= 0x0200;
2695	}
2696	if (dev->dev->core_rev >= 2)
2697		mask |= 0x0010;	/* FIXME: This is redundant. */
2698
2699	switch (dev->dev->bus_type) {
2700#ifdef CONFIG_B43_BCMA
2701	case B43_BUS_BCMA:
2702		bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2703				(bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2704					BCMA_CC_GPIOCTL) & mask) | set);
2705		break;
2706#endif
2707#ifdef CONFIG_B43_SSB
2708	case B43_BUS_SSB:
2709		gpiodev = b43_ssb_gpio_dev(dev);
2710		if (gpiodev)
2711			ssb_write32(gpiodev, B43_GPIO_CONTROL,
2712				    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2713				    & mask) | set);
2714		break;
2715#endif
2716	}
2717
2718	return 0;
2719}
2720
2721/* Turn off all GPIO stuff. Call this on module unload, for example. */
2722static void b43_gpio_cleanup(struct b43_wldev *dev)
2723{
2724	struct ssb_device *gpiodev;
2725
2726	switch (dev->dev->bus_type) {
2727#ifdef CONFIG_B43_BCMA
2728	case B43_BUS_BCMA:
2729		bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2730				0);
2731		break;
2732#endif
2733#ifdef CONFIG_B43_SSB
2734	case B43_BUS_SSB:
2735		gpiodev = b43_ssb_gpio_dev(dev);
2736		if (gpiodev)
2737			ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2738		break;
2739#endif
2740	}
2741}
2742
2743/* http://bcm-specs.sipsolutions.net/EnableMac */
2744void b43_mac_enable(struct b43_wldev *dev)
2745{
2746	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2747		u16 fwstate;
2748
2749		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2750					 B43_SHM_SH_UCODESTAT);
2751		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2752		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2753			b43err(dev->wl, "b43_mac_enable(): The firmware "
2754			       "should be suspended, but current state is %u\n",
2755			       fwstate);
2756		}
2757	}
2758
2759	dev->mac_suspended--;
2760	B43_WARN_ON(dev->mac_suspended < 0);
2761	if (dev->mac_suspended == 0) {
2762		b43_write32(dev, B43_MMIO_MACCTL,
2763			    b43_read32(dev, B43_MMIO_MACCTL)
2764			    | B43_MACCTL_ENABLED);
2765		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2766			    B43_IRQ_MAC_SUSPENDED);
2767		/* Commit writes */
2768		b43_read32(dev, B43_MMIO_MACCTL);
2769		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2770		b43_power_saving_ctl_bits(dev, 0);
2771	}
2772}
2773
2774/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2775void b43_mac_suspend(struct b43_wldev *dev)
2776{
2777	int i;
2778	u32 tmp;
2779
2780	might_sleep();
2781	B43_WARN_ON(dev->mac_suspended < 0);
2782
2783	if (dev->mac_suspended == 0) {
2784		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2785		b43_write32(dev, B43_MMIO_MACCTL,
2786			    b43_read32(dev, B43_MMIO_MACCTL)
2787			    & ~B43_MACCTL_ENABLED);
2788		/* force pci to flush the write */
2789		b43_read32(dev, B43_MMIO_MACCTL);
2790		for (i = 35; i; i--) {
2791			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2792			if (tmp & B43_IRQ_MAC_SUSPENDED)
2793				goto out;
2794			udelay(10);
2795		}
2796		/* Hm, it seems this will take some time. Use msleep(). */
2797		for (i = 40; i; i--) {
2798			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2799			if (tmp & B43_IRQ_MAC_SUSPENDED)
2800				goto out;
2801			msleep(1);
2802		}
2803		b43err(dev->wl, "MAC suspend failed\n");
2804	}
2805out:
2806	dev->mac_suspended++;
2807}
2808
2809/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2810void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2811{
2812	u32 tmp;
2813
2814	switch (dev->dev->bus_type) {
2815#ifdef CONFIG_B43_BCMA
2816	case B43_BUS_BCMA:
2817		tmp = bcma_read32(dev->dev->bdev, BCMA_IOCTL);
2818		if (on)
2819			tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2820		else
2821			tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2822		bcma_write32(dev->dev->bdev, BCMA_IOCTL, tmp);
2823		break;
2824#endif
2825#ifdef CONFIG_B43_SSB
2826	case B43_BUS_SSB:
2827		tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2828		if (on)
2829			tmp |= B43_TMSLOW_MACPHYCLKEN;
2830		else
2831			tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2832		ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2833		break;
2834#endif
2835	}
2836}
2837
2838static void b43_adjust_opmode(struct b43_wldev *dev)
2839{
2840	struct b43_wl *wl = dev->wl;
2841	u32 ctl;
2842	u16 cfp_pretbtt;
2843
2844	ctl = b43_read32(dev, B43_MMIO_MACCTL);
2845	/* Reset status to STA infrastructure mode. */
2846	ctl &= ~B43_MACCTL_AP;
2847	ctl &= ~B43_MACCTL_KEEP_CTL;
2848	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2849	ctl &= ~B43_MACCTL_KEEP_BAD;
2850	ctl &= ~B43_MACCTL_PROMISC;
2851	ctl &= ~B43_MACCTL_BEACPROMISC;
2852	ctl |= B43_MACCTL_INFRA;
2853
2854	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2855	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2856		ctl |= B43_MACCTL_AP;
2857	else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2858		ctl &= ~B43_MACCTL_INFRA;
2859
2860	if (wl->filter_flags & FIF_CONTROL)
2861		ctl |= B43_MACCTL_KEEP_CTL;
2862	if (wl->filter_flags & FIF_FCSFAIL)
2863		ctl |= B43_MACCTL_KEEP_BAD;
2864	if (wl->filter_flags & FIF_PLCPFAIL)
2865		ctl |= B43_MACCTL_KEEP_BADPLCP;
2866	if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2867		ctl |= B43_MACCTL_PROMISC;
2868	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2869		ctl |= B43_MACCTL_BEACPROMISC;
2870
2871	/* Workaround: On old hardware the HW-MAC-address-filter
2872	 * doesn't work properly, so always run promisc in filter
2873	 * it in software. */
2874	if (dev->dev->core_rev <= 4)
2875		ctl |= B43_MACCTL_PROMISC;
2876
2877	b43_write32(dev, B43_MMIO_MACCTL, ctl);
2878
2879	cfp_pretbtt = 2;
2880	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2881		if (dev->dev->chip_id == 0x4306 &&
2882		    dev->dev->chip_rev == 3)
2883			cfp_pretbtt = 100;
2884		else
2885			cfp_pretbtt = 50;
2886	}
2887	b43_write16(dev, 0x612, cfp_pretbtt);
2888
2889	/* FIXME: We don't currently implement the PMQ mechanism,
2890	 *        so always disable it. If we want to implement PMQ,
2891	 *        we need to enable it here (clear DISCPMQ) in AP mode.
2892	 */
2893	if (0  /* ctl & B43_MACCTL_AP */) {
2894		b43_write32(dev, B43_MMIO_MACCTL,
2895			    b43_read32(dev, B43_MMIO_MACCTL)
2896			    & ~B43_MACCTL_DISCPMQ);
2897	} else {
2898		b43_write32(dev, B43_MMIO_MACCTL,
2899			    b43_read32(dev, B43_MMIO_MACCTL)
2900			    | B43_MACCTL_DISCPMQ);
2901	}
2902}
2903
2904static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2905{
2906	u16 offset;
2907
2908	if (is_ofdm) {
2909		offset = 0x480;
2910		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2911	} else {
2912		offset = 0x4C0;
2913		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2914	}
2915	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2916			b43_shm_read16(dev, B43_SHM_SHARED, offset));
2917}
2918
2919static void b43_rate_memory_init(struct b43_wldev *dev)
2920{
2921	switch (dev->phy.type) {
2922	case B43_PHYTYPE_A:
2923	case B43_PHYTYPE_G:
2924	case B43_PHYTYPE_N:
2925	case B43_PHYTYPE_LP:
2926		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2927		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2928		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2929		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2930		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2931		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2932		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2933		if (dev->phy.type == B43_PHYTYPE_A)
2934			break;
2935		/* fallthrough */
2936	case B43_PHYTYPE_B:
2937		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2938		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2939		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2940		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2941		break;
2942	default:
2943		B43_WARN_ON(1);
2944	}
2945}
2946
2947/* Set the default values for the PHY TX Control Words. */
2948static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2949{
2950	u16 ctl = 0;
2951
2952	ctl |= B43_TXH_PHY_ENC_CCK;
2953	ctl |= B43_TXH_PHY_ANT01AUTO;
2954	ctl |= B43_TXH_PHY_TXPWR;
2955
2956	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2957	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2958	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2959}
2960
2961/* Set the TX-Antenna for management frames sent by firmware. */
2962static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2963{
2964	u16 ant;
2965	u16 tmp;
2966
2967	ant = b43_antenna_to_phyctl(antenna);
2968
2969	/* For ACK/CTS */
2970	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2971	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2972	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2973	/* For Probe Resposes */
2974	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2975	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2976	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2977}
2978
2979/* This is the opposite of b43_chip_init() */
2980static void b43_chip_exit(struct b43_wldev *dev)
2981{
2982	b43_phy_exit(dev);
2983	b43_gpio_cleanup(dev);
2984	/* firmware is released later */
2985}
2986
2987/* Initialize the chip
2988 * http://bcm-specs.sipsolutions.net/ChipInit
2989 */
2990static int b43_chip_init(struct b43_wldev *dev)
2991{
2992	struct b43_phy *phy = &dev->phy;
2993	int err;
2994	u32 macctl;
2995	u16 value16;
2996
2997	/* Initialize the MAC control */
2998	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2999	if (dev->phy.gmode)
3000		macctl |= B43_MACCTL_GMODE;
3001	macctl |= B43_MACCTL_INFRA;
3002	b43_write32(dev, B43_MMIO_MACCTL, macctl);
3003
3004	err = b43_request_firmware(dev);
3005	if (err)
3006		goto out;
3007	err = b43_upload_microcode(dev);
3008	if (err)
3009		goto out;	/* firmware is released later */
3010
3011	err = b43_gpio_init(dev);
3012	if (err)
3013		goto out;	/* firmware is released later */
3014
3015	err = b43_upload_initvals(dev);
3016	if (err)
3017		goto err_gpio_clean;
3018
3019	/* Turn the Analog on and initialize the PHY. */
3020	phy->ops->switch_analog(dev, 1);
3021	err = b43_phy_init(dev);
3022	if (err)
3023		goto err_gpio_clean;
3024
3025	/* Disable Interference Mitigation. */
3026	if (phy->ops->interf_mitigation)
3027		phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3028
3029	/* Select the antennae */
3030	if (phy->ops->set_rx_antenna)
3031		phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3032	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3033
3034	if (phy->type == B43_PHYTYPE_B) {
3035		value16 = b43_read16(dev, 0x005E);
3036		value16 |= 0x0004;
3037		b43_write16(dev, 0x005E, value16);
3038	}
3039	b43_write32(dev, 0x0100, 0x01000000);
3040	if (dev->dev->core_rev < 5)
3041		b43_write32(dev, 0x010C, 0x01000000);
3042
3043	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3044		    & ~B43_MACCTL_INFRA);
3045	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3046		    | B43_MACCTL_INFRA);
3047
3048	/* Probe Response Timeout value */
3049	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3050	b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3051
3052	/* Initially set the wireless operation mode. */
3053	b43_adjust_opmode(dev);
3054
3055	if (dev->dev->core_rev < 3) {
3056		b43_write16(dev, 0x060E, 0x0000);
3057		b43_write16(dev, 0x0610, 0x8000);
3058		b43_write16(dev, 0x0604, 0x0000);
3059		b43_write16(dev, 0x0606, 0x0200);
3060	} else {
3061		b43_write32(dev, 0x0188, 0x80000000);
3062		b43_write32(dev, 0x018C, 0x02000000);
3063	}
3064	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3065	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3066	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3067	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3068	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3069	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3070	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3071
3072	b43_mac_phy_clock_set(dev, true);
3073
3074	switch (dev->dev->bus_type) {
3075#ifdef CONFIG_B43_BCMA
3076	case B43_BUS_BCMA:
3077		/* FIXME: 0xE74 is quite common, but should be read from CC */
3078		b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3079		break;
3080#endif
3081#ifdef CONFIG_B43_SSB
3082	case B43_BUS_SSB:
3083		b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3084			    dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3085		break;
3086#endif
3087	}
3088
3089	err = 0;
3090	b43dbg(dev->wl, "Chip initialized\n");
3091out:
3092	return err;
3093
3094err_gpio_clean:
3095	b43_gpio_cleanup(dev);
3096	return err;
3097}
3098
3099static void b43_periodic_every60sec(struct b43_wldev *dev)
3100{
3101	const struct b43_phy_operations *ops = dev->phy.ops;
3102
3103	if (ops->pwork_60sec)
3104		ops->pwork_60sec(dev);
3105
3106	/* Force check the TX power emission now. */
3107	b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3108}
3109
3110static void b43_periodic_every30sec(struct b43_wldev *dev)
3111{
3112	/* Update device statistics. */
3113	b43_calculate_link_quality(dev);
3114}
3115
3116static void b43_periodic_every15sec(struct b43_wldev *dev)
3117{
3118	struct b43_phy *phy = &dev->phy;
3119	u16 wdr;
3120
3121	if (dev->fw.opensource) {
3122		/* Check if the firmware is still alive.
3123		 * It will reset the watchdog counter to 0 in its idle loop. */
3124		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3125		if (unlikely(wdr)) {
3126			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3127			b43_controller_restart(dev, "Firmware watchdog");
3128			return;
3129		} else {
3130			b43_shm_write16(dev, B43_SHM_SCRATCH,
3131					B43_WATCHDOG_REG, 1);
3132		}
3133	}
3134
3135	if (phy->ops->pwork_15sec)
3136		phy->ops->pwork_15sec(dev);
3137
3138	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3139	wmb();
3140
3141#if B43_DEBUG
3142	if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3143		unsigned int i;
3144
3145		b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3146		       dev->irq_count / 15,
3147		       dev->tx_count / 15,
3148		       dev->rx_count / 15);
3149		dev->irq_count = 0;
3150		dev->tx_count = 0;
3151		dev->rx_count = 0;
3152		for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3153			if (dev->irq_bit_count[i]) {
3154				b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3155				       dev->irq_bit_count[i] / 15, i, (1 << i));
3156				dev->irq_bit_count[i] = 0;
3157			}
3158		}
3159	}
3160#endif
3161}
3162
3163static void do_periodic_work(struct b43_wldev *dev)
3164{
3165	unsigned int state;
3166
3167	state = dev->periodic_state;
3168	if (state % 4 == 0)
3169		b43_periodic_every60sec(dev);
3170	if (state % 2 == 0)
3171		b43_periodic_every30sec(dev);
3172	b43_periodic_every15sec(dev);
3173}
3174
3175/* Periodic work locking policy:
3176 * 	The whole periodic work handler is protected by
3177 * 	wl->mutex. If another lock is needed somewhere in the
3178 * 	pwork callchain, it's acquired in-place, where it's needed.
3179 */
3180static void b43_periodic_work_handler(struct work_struct *work)
3181{
3182	struct b43_wldev *dev = container_of(work, struct b43_wldev,
3183					     periodic_work.work);
3184	struct b43_wl *wl = dev->wl;
3185	unsigned long delay;
3186
3187	mutex_lock(&wl->mutex);
3188
3189	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3190		goto out;
3191	if (b43_debug(dev, B43_DBG_PWORK_STOP))
3192		goto out_requeue;
3193
3194	do_periodic_work(dev);
3195
3196	dev->periodic_state++;
3197out_requeue:
3198	if (b43_debug(dev, B43_DBG_PWORK_FAST))
3199		delay = msecs_to_jiffies(50);
3200	else
3201		delay = round_jiffies_relative(HZ * 15);
3202	ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3203out:
3204	mutex_unlock(&wl->mutex);
3205}
3206
3207static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3208{
3209	struct delayed_work *work = &dev->periodic_work;
3210
3211	dev->periodic_state = 0;
3212	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3213	ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3214}
3215
3216/* Check if communication with the device works correctly. */
3217static int b43_validate_chipaccess(struct b43_wldev *dev)
3218{
3219	u32 v, backup0, backup4;
3220
3221	backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3222	backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3223
3224	/* Check for read/write and endianness problems. */
3225	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3226	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3227		goto error;
3228	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3229	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3230		goto error;
3231
3232	/* Check if unaligned 32bit SHM_SHARED access works properly.
3233	 * However, don't bail out on failure, because it's noncritical. */
3234	b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3235	b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3236	b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3237	b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3238	if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3239		b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3240	b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3241	if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3242	    b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3243	    b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3244	    b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3245		b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3246
3247	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3248	b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3249
3250	if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3251		/* The 32bit register shadows the two 16bit registers
3252		 * with update sideeffects. Validate this. */
3253		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3254		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3255		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3256			goto error;
3257		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3258			goto error;
3259	}
3260	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3261
3262	v = b43_read32(dev, B43_MMIO_MACCTL);
3263	v |= B43_MACCTL_GMODE;
3264	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3265		goto error;
3266
3267	return 0;
3268error:
3269	b43err(dev->wl, "Failed to validate the chipaccess\n");
3270	return -ENODEV;
3271}
3272
3273static void b43_security_init(struct b43_wldev *dev)
3274{
3275	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3276	/* KTP is a word address, but we address SHM bytewise.
3277	 * So multiply by two.
3278	 */
3279	dev->ktp *= 2;
3280	/* Number of RCMTA address slots */
3281	b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3282	/* Clear the key memory. */
3283	b43_clear_keys(dev);
3284}
3285
3286#ifdef CONFIG_B43_HWRNG
3287static int b43_rng_read(struct hwrng *rng, u32 *data)
3288{
3289	struct b43_wl *wl = (struct b43_wl *)rng->priv;
3290	struct b43_wldev *dev;
3291	int count = -ENODEV;
3292
3293	mutex_lock(&wl->mutex);
3294	dev = wl->current_dev;
3295	if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3296		*data = b43_read16(dev, B43_MMIO_RNG);
3297		count = sizeof(u16);
3298	}
3299	mutex_unlock(&wl->mutex);
3300
3301	return count;
3302}
3303#endif /* CONFIG_B43_HWRNG */
3304
3305static void b43_rng_exit(struct b43_wl *wl)
3306{
3307#ifdef CONFIG_B43_HWRNG
3308	if (wl->rng_initialized)
3309		hwrng_unregister(&wl->rng);
3310#endif /* CONFIG_B43_HWRNG */
3311}
3312
3313static int b43_rng_init(struct b43_wl *wl)
3314{
3315	int err = 0;
3316
3317#ifdef CONFIG_B43_HWRNG
3318	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3319		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3320	wl->rng.name = wl->rng_name;
3321	wl->rng.data_read = b43_rng_read;
3322	wl->rng.priv = (unsigned long)wl;
3323	wl->rng_initialized = 1;
3324	err = hwrng_register(&wl->rng);
3325	if (err) {
3326		wl->rng_initialized = 0;
3327		b43err(wl, "Failed to register the random "
3328		       "number generator (%d)\n", err);
3329	}
3330#endif /* CONFIG_B43_HWRNG */
3331
3332	return err;
3333}
3334
3335static void b43_tx_work(struct work_struct *work)
3336{
3337	struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3338	struct b43_wldev *dev;
3339	struct sk_buff *skb;
3340	int err = 0;
3341
3342	mutex_lock(&wl->mutex);
3343	dev = wl->current_dev;
3344	if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3345		mutex_unlock(&wl->mutex);
3346		return;
3347	}
3348
3349	while (skb_queue_len(&wl->tx_queue)) {
3350		skb = skb_dequeue(&wl->tx_queue);
3351
3352		if (b43_using_pio_transfers(dev))
3353			err = b43_pio_tx(dev, skb);
3354		else
3355			err = b43_dma_tx(dev, skb);
3356		if (unlikely(err))
3357			dev_kfree_skb(skb); /* Drop it */
3358	}
3359
3360#if B43_DEBUG
3361	dev->tx_count++;
3362#endif
3363	mutex_unlock(&wl->mutex);
3364}
3365
3366static void b43_op_tx(struct ieee80211_hw *hw,
3367		     struct sk_buff *skb)
3368{
3369	struct b43_wl *wl = hw_to_b43_wl(hw);
3370
3371	if (unlikely(skb->len < 2 + 2 + 6)) {
3372		/* Too short, this can't be a valid frame. */
3373		dev_kfree_skb_any(skb);
3374		return;
3375	}
3376	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3377
3378	skb_queue_tail(&wl->tx_queue, skb);
3379	ieee80211_queue_work(wl->hw, &wl->tx_work);
3380}
3381
3382static void b43_qos_params_upload(struct b43_wldev *dev,
3383				  const struct ieee80211_tx_queue_params *p,
3384				  u16 shm_offset)
3385{
3386	u16 params[B43_NR_QOSPARAMS];
3387	int bslots, tmp;
3388	unsigned int i;
3389
3390	if (!dev->qos_enabled)
3391		return;
3392
3393	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3394
3395	memset(&params, 0, sizeof(params));
3396
3397	params[B43_QOSPARAM_TXOP] = p->txop * 32;
3398	params[B43_QOSPARAM_CWMIN] = p->cw_min;
3399	params[B43_QOSPARAM_CWMAX] = p->cw_max;
3400	params[B43_QOSPARAM_CWCUR] = p->cw_min;
3401	params[B43_QOSPARAM_AIFS] = p->aifs;
3402	params[B43_QOSPARAM_BSLOTS] = bslots;
3403	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3404
3405	for (i = 0; i < ARRAY_SIZE(params); i++) {
3406		if (i == B43_QOSPARAM_STATUS) {
3407			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3408					     shm_offset + (i * 2));
3409			/* Mark the parameters as updated. */
3410			tmp |= 0x100;
3411			b43_shm_write16(dev, B43_SHM_SHARED,
3412					shm_offset + (i * 2),
3413					tmp);
3414		} else {
3415			b43_shm_write16(dev, B43_SHM_SHARED,
3416					shm_offset + (i * 2),
3417					params[i]);
3418		}
3419	}
3420}
3421
3422/* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3423static const u16 b43_qos_shm_offsets[] = {
3424	/* [mac80211-queue-nr] = SHM_OFFSET, */
3425	[0] = B43_QOS_VOICE,
3426	[1] = B43_QOS_VIDEO,
3427	[2] = B43_QOS_BESTEFFORT,
3428	[3] = B43_QOS_BACKGROUND,
3429};
3430
3431/* Update all QOS parameters in hardware. */
3432static void b43_qos_upload_all(struct b43_wldev *dev)
3433{
3434	struct b43_wl *wl = dev->wl;
3435	struct b43_qos_params *params;
3436	unsigned int i;
3437
3438	if (!dev->qos_enabled)
3439		return;
3440
3441	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3442		     ARRAY_SIZE(wl->qos_params));
3443
3444	b43_mac_suspend(dev);
3445	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3446		params = &(wl->qos_params[i]);
3447		b43_qos_params_upload(dev, &(params->p),
3448				      b43_qos_shm_offsets[i]);
3449	}
3450	b43_mac_enable(dev);
3451}
3452
3453static void b43_qos_clear(struct b43_wl *wl)
3454{
3455	struct b43_qos_params *params;
3456	unsigned int i;
3457
3458	/* Initialize QoS parameters to sane defaults. */
3459
3460	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3461		     ARRAY_SIZE(wl->qos_params));
3462
3463	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3464		params = &(wl->qos_params[i]);
3465
3466		switch (b43_qos_shm_offsets[i]) {
3467		case B43_QOS_VOICE:
3468			params->p.txop = 0;
3469			params->p.aifs = 2;
3470			params->p.cw_min = 0x0001;
3471			params->p.cw_max = 0x0001;
3472			break;
3473		case B43_QOS_VIDEO:
3474			params->p.txop = 0;
3475			params->p.aifs = 2;
3476			params->p.cw_min = 0x0001;
3477			params->p.cw_max = 0x0001;
3478			break;
3479		case B43_QOS_BESTEFFORT:
3480			params->p.txop = 0;
3481			params->p.aifs = 3;
3482			params->p.cw_min = 0x0001;
3483			params->p.cw_max = 0x03FF;
3484			break;
3485		case B43_QOS_BACKGROUND:
3486			params->p.txop = 0;
3487			params->p.aifs = 7;
3488			params->p.cw_min = 0x0001;
3489			params->p.cw_max = 0x03FF;
3490			break;
3491		default:
3492			B43_WARN_ON(1);
3493		}
3494	}
3495}
3496
3497/* Initialize the core's QOS capabilities */
3498static void b43_qos_init(struct b43_wldev *dev)
3499{
3500	if (!dev->qos_enabled) {
3501		/* Disable QOS support. */
3502		b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3503		b43_write16(dev, B43_MMIO_IFSCTL,
3504			    b43_read16(dev, B43_MMIO_IFSCTL)
3505			    & ~B43_MMIO_IFSCTL_USE_EDCF);
3506		b43dbg(dev->wl, "QoS disabled\n");
3507		return;
3508	}
3509
3510	/* Upload the current QOS parameters. */
3511	b43_qos_upload_all(dev);
3512
3513	/* Enable QOS support. */
3514	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3515	b43_write16(dev, B43_MMIO_IFSCTL,
3516		    b43_read16(dev, B43_MMIO_IFSCTL)
3517		    | B43_MMIO_IFSCTL_USE_EDCF);
3518	b43dbg(dev->wl, "QoS enabled\n");
3519}
3520
3521static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3522			  const struct ieee80211_tx_queue_params *params)
3523{
3524	struct b43_wl *wl = hw_to_b43_wl(hw);
3525	struct b43_wldev *dev;
3526	unsigned int queue = (unsigned int)_queue;
3527	int err = -ENODEV;
3528
3529	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3530		/* Queue not available or don't support setting
3531		 * params on this queue. Return success to not
3532		 * confuse mac80211. */
3533		return 0;
3534	}
3535	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3536		     ARRAY_SIZE(wl->qos_params));
3537
3538	mutex_lock(&wl->mutex);
3539	dev = wl->current_dev;
3540	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3541		goto out_unlock;
3542
3543	memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3544	b43_mac_suspend(dev);
3545	b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3546			      b43_qos_shm_offsets[queue]);
3547	b43_mac_enable(dev);
3548	err = 0;
3549
3550out_unlock:
3551	mutex_unlock(&wl->mutex);
3552
3553	return err;
3554}
3555
3556static int b43_op_get_stats(struct ieee80211_hw *hw,
3557			    struct ieee80211_low_level_stats *stats)
3558{
3559	struct b43_wl *wl = hw_to_b43_wl(hw);
3560
3561	mutex_lock(&wl->mutex);
3562	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3563	mutex_unlock(&wl->mutex);
3564
3565	return 0;
3566}
3567
3568static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3569{
3570	struct b43_wl *wl = hw_to_b43_wl(hw);
3571	struct b43_wldev *dev;
3572	u64 tsf;
3573
3574	mutex_lock(&wl->mutex);
3575	dev = wl->current_dev;
3576
3577	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3578		b43_tsf_read(dev, &tsf);
3579	else
3580		tsf = 0;
3581
3582	mutex_unlock(&wl->mutex);
3583
3584	return tsf;
3585}
3586
3587static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3588{
3589	struct b43_wl *wl = hw_to_b43_wl(hw);
3590	struct b43_wldev *dev;
3591
3592	mutex_lock(&wl->mutex);
3593	dev = wl->current_dev;
3594
3595	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3596		b43_tsf_write(dev, tsf);
3597
3598	mutex_unlock(&wl->mutex);
3599}
3600
3601static void b43_put_phy_into_reset(struct b43_wldev *dev)
3602{
3603	u32 tmp;
3604
3605	switch (dev->dev->bus_type) {
3606#ifdef CONFIG_B43_BCMA
3607	case B43_BUS_BCMA:
3608		b43err(dev->wl,
3609		       "Putting PHY into reset not supported on BCMA\n");
3610		break;
3611#endif
3612#ifdef CONFIG_B43_SSB
3613	case B43_BUS_SSB:
3614		tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3615		tmp &= ~B43_TMSLOW_GMODE;
3616		tmp |= B43_TMSLOW_PHYRESET;
3617		tmp |= SSB_TMSLOW_FGC;
3618		ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3619		msleep(1);
3620
3621		tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3622		tmp &= ~SSB_TMSLOW_FGC;
3623		tmp |= B43_TMSLOW_PHYRESET;
3624		ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3625		msleep(1);
3626
3627		break;
3628#endif
3629	}
3630}
3631
3632static const char *band_to_string(enum ieee80211_band band)
3633{
3634	switch (band) {
3635	case IEEE80211_BAND_5GHZ:
3636		return "5";
3637	case IEEE80211_BAND_2GHZ:
3638		return "2.4";
3639	default:
3640		break;
3641	}
3642	B43_WARN_ON(1);
3643	return "";
3644}
3645
3646/* Expects wl->mutex locked */
3647static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3648{
3649	struct b43_wldev *up_dev = NULL;
3650	struct b43_wldev *down_dev;
3651	struct b43_wldev *d;
3652	int err;
3653	bool uninitialized_var(gmode);
3654	int prev_status;
3655
3656	/* Find a device and PHY which supports the band. */
3657	list_for_each_entry(d, &wl->devlist, list) {
3658		switch (chan->band) {
3659		case IEEE80211_BAND_5GHZ:
3660			if (d->phy.supports_5ghz) {
3661				up_dev = d;
3662				gmode = 0;
3663			}
3664			break;
3665		case IEEE80211_BAND_2GHZ:
3666			if (d->phy.supports_2ghz) {
3667				up_dev = d;
3668				gmode = 1;
3669			}
3670			break;
3671		default:
3672			B43_WARN_ON(1);
3673			return -EINVAL;
3674		}
3675		if (up_dev)
3676			break;
3677	}
3678	if (!up_dev) {
3679		b43err(wl, "Could not find a device for %s-GHz band operation\n",
3680		       band_to_string(chan->band));
3681		return -ENODEV;
3682	}
3683	if ((up_dev == wl->current_dev) &&
3684	    (!!wl->current_dev->phy.gmode == !!gmode)) {
3685		/* This device is already running. */
3686		return 0;
3687	}
3688	b43dbg(wl, "Switching to %s-GHz band\n",
3689	       band_to_string(chan->band));
3690	down_dev = wl->current_dev;
3691
3692	prev_status = b43_status(down_dev);
3693	/* Shutdown the currently running core. */
3694	if (prev_status >= B43_STAT_STARTED)
3695		down_dev = b43_wireless_core_stop(down_dev);
3696	if (prev_status >= B43_STAT_INITIALIZED)
3697		b43_wireless_core_exit(down_dev);
3698
3699	if (down_dev != up_dev) {
3700		/* We switch to a different core, so we put PHY into
3701		 * RESET on the old core. */
3702		b43_put_phy_into_reset(down_dev);
3703	}
3704
3705	/* Now start the new core. */
3706	up_dev->phy.gmode = gmode;
3707	if (prev_status >= B43_STAT_INITIALIZED) {
3708		err = b43_wireless_core_init(up_dev);
3709		if (err) {
3710			b43err(wl, "Fatal: Could not initialize device for "
3711			       "selected %s-GHz band\n",
3712			       band_to_string(chan->band));
3713			goto init_failure;
3714		}
3715	}
3716	if (prev_status >= B43_STAT_STARTED) {
3717		err = b43_wireless_core_start(up_dev);
3718		if (err) {
3719			b43err(wl, "Fatal: Coult not start device for "
3720			       "selected %s-GHz band\n",
3721			       band_to_string(chan->band));
3722			b43_wireless_core_exit(up_dev);
3723			goto init_failure;
3724		}
3725	}
3726	B43_WARN_ON(b43_status(up_dev) != prev_status);
3727
3728	wl->current_dev = up_dev;
3729
3730	return 0;
3731init_failure:
3732	/* Whoops, failed to init the new core. No core is operating now. */
3733	wl->current_dev = NULL;
3734	return err;
3735}
3736
3737/* Write the short and long frame retry limit values. */
3738static void b43_set_retry_limits(struct b43_wldev *dev,
3739				 unsigned int short_retry,
3740				 unsigned int long_retry)
3741{
3742	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3743	 * the chip-internal counter. */
3744	short_retry = min(short_retry, (unsigned int)0xF);
3745	long_retry = min(long_retry, (unsigned int)0xF);
3746
3747	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3748			short_retry);
3749	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3750			long_retry);
3751}
3752
3753static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3754{
3755	struct b43_wl *wl = hw_to_b43_wl(hw);
3756	struct b43_wldev *dev;
3757	struct b43_phy *phy;
3758	struct ieee80211_conf *conf = &hw->conf;
3759	int antenna;
3760	int err = 0;
3761
3762	mutex_lock(&wl->mutex);
3763
3764	/* Switch the band (if necessary). This might change the active core. */
3765	err = b43_switch_band(wl, conf->channel);
3766	if (err)
3767		goto out_unlock_mutex;
3768	dev = wl->current_dev;
3769	phy = &dev->phy;
3770
3771	if (conf_is_ht(conf))
3772		phy->is_40mhz =
3773			(conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3774	else
3775		phy->is_40mhz = false;
3776
3777	b43_mac_suspend(dev);
3778
3779	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3780		b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3781					  conf->long_frame_max_tx_count);
3782	changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3783	if (!changed)
3784		goto out_mac_enable;
3785
3786	/* Switch to the requested channel.
3787	 * The firmware takes care of races with the TX handler. */
3788	if (conf->channel->hw_value != phy->channel)
3789		b43_switch_channel(dev, conf->channel->hw_value);
3790
3791	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3792
3793	/* Adjust the desired TX power level. */
3794	if (conf->power_level != 0) {
3795		if (conf->power_level != phy->desired_txpower) {
3796			phy->desired_txpower = conf->power_level;
3797			b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3798						   B43_TXPWR_IGNORE_TSSI);
3799		}
3800	}
3801
3802	/* Antennas for RX and management frame TX. */
3803	antenna = B43_ANTENNA_DEFAULT;
3804	b43_mgmtframe_txantenna(dev, antenna);
3805	antenna = B43_ANTENNA_DEFAULT;
3806	if (phy->ops->set_rx_antenna)
3807		phy->ops->set_rx_antenna(dev, antenna);
3808
3809	if (wl->radio_enabled != phy->radio_on) {
3810		if (wl->radio_enabled) {
3811			b43_software_rfkill(dev, false);
3812			b43info(dev->wl, "Radio turned on by software\n");
3813			if (!dev->radio_hw_enable) {
3814				b43info(dev->wl, "The hardware RF-kill button "
3815					"still turns the radio physically off. "
3816					"Press the button to turn it on.\n");
3817			}
3818		} else {
3819			b43_software_rfkill(dev, true);
3820			b43info(dev->wl, "Radio turned off by software\n");
3821		}
3822	}
3823
3824out_mac_enable:
3825	b43_mac_enable(dev);
3826out_unlock_mutex:
3827	mutex_unlock(&wl->mutex);
3828
3829	return err;
3830}
3831
3832static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3833{
3834	struct ieee80211_supported_band *sband =
3835		dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3836	struct ieee80211_rate *rate;
3837	int i;
3838	u16 basic, direct, offset, basic_offset, rateptr;
3839
3840	for (i = 0; i < sband->n_bitrates; i++) {
3841		rate = &sband->bitrates[i];
3842
3843		if (b43_is_cck_rate(rate->hw_value)) {
3844			direct = B43_SHM_SH_CCKDIRECT;
3845			basic = B43_SHM_SH_CCKBASIC;
3846			offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3847			offset &= 0xF;
3848		} else {
3849			direct = B43_SHM_SH_OFDMDIRECT;
3850			basic = B43_SHM_SH_OFDMBASIC;
3851			offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3852			offset &= 0xF;
3853		}
3854
3855		rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3856
3857		if (b43_is_cck_rate(rate->hw_value)) {
3858			basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3859			basic_offset &= 0xF;
3860		} else {
3861			basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3862			basic_offset &= 0xF;
3863		}
3864
3865		/*
3866		 * Get the pointer that we need to point to
3867		 * from the direct map
3868		 */
3869		rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3870					 direct + 2 * basic_offset);
3871		/* and write it to the basic map */
3872		b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3873				rateptr);
3874	}
3875}
3876
3877static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3878				    struct ieee80211_vif *vif,
3879				    struct ieee80211_bss_conf *conf,
3880				    u32 changed)
3881{
3882	struct b43_wl *wl = hw_to_b43_wl(hw);
3883	struct b43_wldev *dev;
3884
3885	mutex_lock(&wl->mutex);
3886
3887	dev = wl->current_dev;
3888	if (!dev || b43_status(dev) < B43_STAT_STARTED)
3889		goto out_unlock_mutex;
3890
3891	B43_WARN_ON(wl->vif != vif);
3892
3893	if (changed & BSS_CHANGED_BSSID) {
3894		if (conf->bssid)
3895			memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3896		else
3897			memset(wl->bssid, 0, ETH_ALEN);
3898	}
3899
3900	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3901		if (changed & BSS_CHANGED_BEACON &&
3902		    (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3903		     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3904		     b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3905			b43_update_templates(wl);
3906
3907		if (changed & BSS_CHANGED_BSSID)
3908			b43_write_mac_bssid_templates(dev);
3909	}
3910
3911	b43_mac_suspend(dev);
3912
3913	/* Update templates for AP/mesh mode. */
3914	if (changed & BSS_CHANGED_BEACON_INT &&
3915	    (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3916	     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3917	     b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3918		b43_set_beacon_int(dev, conf->beacon_int);
3919
3920	if (changed & BSS_CHANGED_BASIC_RATES)
3921		b43_update_basic_rates(dev, conf->basic_rates);
3922
3923	if (changed & BSS_CHANGED_ERP_SLOT) {
3924		if (conf->use_short_slot)
3925			b43_short_slot_timing_enable(dev);
3926		else
3927			b43_short_slot_timing_disable(dev);
3928	}
3929
3930	b43_mac_enable(dev);
3931out_unlock_mutex:
3932	mutex_unlock(&wl->mutex);
3933}
3934
3935static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3936			  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3937			  struct ieee80211_key_conf *key)
3938{
3939	struct b43_wl *wl = hw_to_b43_wl(hw);
3940	struct b43_wldev *dev;
3941	u8 algorithm;
3942	u8 index;
3943	int err;
3944	static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3945
3946	if (modparam_nohwcrypt)
3947		return -ENOSPC; /* User disabled HW-crypto */
3948
3949	mutex_lock(&wl->mutex);
3950
3951	dev = wl->current_dev;
3952	err = -ENODEV;
3953	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3954		goto out_unlock;
3955
3956	if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3957		/* We don't have firmware for the crypto engine.
3958		 * Must use software-crypto. */
3959		err = -EOPNOTSUPP;
3960		goto out_unlock;
3961	}
3962
3963	err = -EINVAL;
3964	switch (key->cipher) {
3965	case WLAN_CIPHER_SUITE_WEP40:
3966		algorithm = B43_SEC_ALGO_WEP40;
3967		break;
3968	case WLAN_CIPHER_SUITE_WEP104:
3969		algorithm = B43_SEC_ALGO_WEP104;
3970		break;
3971	case WLAN_CIPHER_SUITE_TKIP:
3972		algorithm = B43_SEC_ALGO_TKIP;
3973		break;
3974	case WLAN_CIPHER_SUITE_CCMP:
3975		algorithm = B43_SEC_ALGO_AES;
3976		break;
3977	default:
3978		B43_WARN_ON(1);
3979		goto out_unlock;
3980	}
3981	index = (u8) (key->keyidx);
3982	if (index > 3)
3983		goto out_unlock;
3984
3985	switch (cmd) {
3986	case SET_KEY:
3987		if (algorithm == B43_SEC_ALGO_TKIP &&
3988		    (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3989		    !modparam_hwtkip)) {
3990			/* We support only pairwise key */
3991			err = -EOPNOTSUPP;
3992			goto out_unlock;
3993		}
3994
3995		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3996			if (WARN_ON(!sta)) {
3997				err = -EOPNOTSUPP;
3998				goto out_unlock;
3999			}
4000			/* Pairwise key with an assigned MAC address. */
4001			err = b43_key_write(dev, -1, algorithm,
4002					    key->key, key->keylen,
4003					    sta->addr, key);
4004		} else {
4005			/* Group key */
4006			err = b43_key_write(dev, index, algorithm,
4007					    key->key, key->keylen, NULL, key);
4008		}
4009		if (err)
4010			goto out_unlock;
4011
4012		if (algorithm == B43_SEC_ALGO_WEP40 ||
4013		    algorithm == B43_SEC_ALGO_WEP104) {
4014			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4015		} else {
4016			b43_hf_write(dev,
4017				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4018		}
4019		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4020		if (algorithm == B43_SEC_ALGO_TKIP)
4021			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4022		break;
4023	case DISABLE_KEY: {
4024		err = b43_key_clear(dev, key->hw_key_idx);
4025		if (err)
4026			goto out_unlock;
4027		break;
4028	}
4029	default:
4030		B43_WARN_ON(1);
4031	}
4032
4033out_unlock:
4034	if (!err) {
4035		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4036		       "mac: %pM\n",
4037		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4038		       sta ? sta->addr : bcast_addr);
4039		b43_dump_keymemory(dev);
4040	}
4041	mutex_unlock(&wl->mutex);
4042
4043	return err;
4044}
4045
4046static void b43_op_configure_filter(struct ieee80211_hw *hw,
4047				    unsigned int changed, unsigned int *fflags,
4048				    u64 multicast)
4049{
4050	struct b43_wl *wl = hw_to_b43_wl(hw);
4051	struct b43_wldev *dev;
4052
4053	mutex_lock(&wl->mutex);
4054	dev = wl->current_dev;
4055	if (!dev) {
4056		*fflags = 0;
4057		goto out_unlock;
4058	}
4059
4060	*fflags &= FIF_PROMISC_IN_BSS |
4061		  FIF_ALLMULTI |
4062		  FIF_FCSFAIL |
4063		  FIF_PLCPFAIL |
4064		  FIF_CONTROL |
4065		  FIF_OTHER_BSS |
4066		  FIF_BCN_PRBRESP_PROMISC;
4067
4068	changed &= FIF_PROMISC_IN_BSS |
4069		   FIF_ALLMULTI |
4070		   FIF_FCSFAIL |
4071		   FIF_PLCPFAIL |
4072		   FIF_CONTROL |
4073		   FIF_OTHER_BSS |
4074		   FIF_BCN_PRBRESP_PROMISC;
4075
4076	wl->filter_flags = *fflags;
4077
4078	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4079		b43_adjust_opmode(dev);
4080
4081out_unlock:
4082	mutex_unlock(&wl->mutex);
4083}
4084
4085/* Locking: wl->mutex
4086 * Returns the current dev. This might be different from the passed in dev,
4087 * because the core might be gone away while we unlocked the mutex. */
4088static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4089{
4090	struct b43_wl *wl = dev->wl;
4091	struct b43_wldev *orig_dev;
4092	u32 mask;
4093
4094redo:
4095	if (!dev || b43_status(dev) < B43_STAT_STARTED)
4096		return dev;
4097
4098	/* Cancel work. Unlock to avoid deadlocks. */
4099	mutex_unlock(&wl->mutex);
4100	cancel_delayed_work_sync(&dev->periodic_work);
4101	cancel_work_sync(&wl->tx_work);
4102	mutex_lock(&wl->mutex);
4103	dev = wl->current_dev;
4104	if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4105		/* Whoops, aliens ate up the device while we were unlocked. */
4106		return dev;
4107	}
4108
4109	/* Disable interrupts on the device. */
4110	b43_set_status(dev, B43_STAT_INITIALIZED);
4111	if (b43_bus_host_is_sdio(dev->dev)) {
4112		/* wl->mutex is locked. That is enough. */
4113		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4114		b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* Flush */
4115	} else {
4116		spin_lock_irq(&wl->hardirq_lock);
4117		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4118		b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* Flush */
4119		spin_unlock_irq(&wl->hardirq_lock);
4120	}
4121	/* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4122	orig_dev = dev;
4123	mutex_unlock(&wl->mutex);
4124	if (b43_bus_host_is_sdio(dev->dev)) {
4125		b43_sdio_free_irq(dev);
4126	} else {
4127		synchronize_irq(dev->dev->irq);
4128		free_irq(dev->dev->irq, dev);
4129	}
4130	mutex_lock(&wl->mutex);
4131	dev = wl->current_dev;
4132	if (!dev)
4133		return dev;
4134	if (dev != orig_dev) {
4135		if (b43_status(dev) >= B43_STAT_STARTED)
4136			goto redo;
4137		return dev;
4138	}
4139	mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4140	B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4141
4142	/* Drain the TX queue */
4143	while (skb_queue_len(&wl->tx_queue))
4144		dev_kfree_skb(skb_dequeue(&wl->tx_queue));
4145
4146	b43_mac_suspend(dev);
4147	b43_leds_exit(dev);
4148	b43dbg(wl, "Wireless interface stopped\n");
4149
4150	return dev;
4151}
4152
4153/* Locking: wl->mutex */
4154static int b43_wireless_core_start(struct b43_wldev *dev)
4155{
4156	int err;
4157
4158	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4159
4160	drain_txstatus_queue(dev);
4161	if (b43_bus_host_is_sdio(dev->dev)) {
4162		err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4163		if (err) {
4164			b43err(dev->wl, "Cannot request SDIO IRQ\n");
4165			goto out;
4166		}
4167	} else {
4168		err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4169					   b43_interrupt_thread_handler,
4170					   IRQF_SHARED, KBUILD_MODNAME, dev);
4171		if (err) {
4172			b43err(dev->wl, "Cannot request IRQ-%d\n",
4173			       dev->dev->irq);
4174			goto out;
4175		}
4176	}
4177
4178	/* We are ready to run. */
4179	ieee80211_wake_queues(dev->wl->hw);
4180	b43_set_status(dev, B43_STAT_STARTED);
4181
4182	/* Start data flow (TX/RX). */
4183	b43_mac_enable(dev);
4184	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4185
4186	/* Start maintenance work */
4187	b43_periodic_tasks_setup(dev);
4188
4189	b43_leds_init(dev);
4190
4191	b43dbg(dev->wl, "Wireless interface started\n");
4192out:
4193	return err;
4194}
4195
4196/* Get PHY and RADIO versioning numbers */
4197static int b43_phy_versioning(struct b43_wldev *dev)
4198{
4199	struct b43_phy *phy = &dev->phy;
4200	u32 tmp;
4201	u8 analog_type;
4202	u8 phy_type;
4203	u8 phy_rev;
4204	u16 radio_manuf;
4205	u16 radio_ver;
4206	u16 radio_rev;
4207	int unsupported = 0;
4208
4209	/* Get PHY versioning */
4210	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4211	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4212	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4213	phy_rev = (tmp & B43_PHYVER_VERSION);
4214	switch (phy_type) {
4215	case B43_PHYTYPE_A:
4216		if (phy_rev >= 4)
4217			unsupported = 1;
4218		break;
4219	case B43_PHYTYPE_B:
4220		if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4221		    && phy_rev != 7)
4222			unsupported = 1;
4223		break;
4224	case B43_PHYTYPE_G:
4225		if (phy_rev > 9)
4226			unsupported = 1;
4227		break;
4228#ifdef CONFIG_B43_PHY_N
4229	case B43_PHYTYPE_N:
4230		if (phy_rev > 9)
4231			unsupported = 1;
4232		break;
4233#endif
4234#ifdef CONFIG_B43_PHY_LP
4235	case B43_PHYTYPE_LP:
4236		if (phy_rev > 2)
4237			unsupported = 1;
4238		break;
4239#endif
4240#ifdef CONFIG_B43_PHY_HT
4241	case B43_PHYTYPE_HT:
4242		if (phy_rev > 1)
4243			unsupported = 1;
4244		break;
4245#endif
4246#ifdef CONFIG_B43_PHY_LCN
4247	case B43_PHYTYPE_LCN:
4248		if (phy_rev > 1)
4249			unsupported = 1;
4250		break;
4251#endif
4252	default:
4253		unsupported = 1;
4254	};
4255	if (unsupported) {
4256		b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4257		       "(Analog %u, Type %u, Revision %u)\n",
4258		       analog_type, phy_type, phy_rev);
4259		return -EOPNOTSUPP;
4260	}
4261	b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4262	       analog_type, phy_type, phy_rev);
4263
4264	/* Get RADIO versioning */
4265	if (dev->dev->core_rev >= 24) {
4266		u16 radio24[3];
4267
4268		for (tmp = 0; tmp < 3; tmp++) {
4269			b43_write16(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4270			radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4271		}
4272
4273		/* Broadcom uses "id" for our "ver" and has separated "ver" */
4274		/* radio_ver = (radio24[0] & 0xF0) >> 4; */
4275
4276		radio_manuf = 0x17F;
4277		radio_ver = (radio24[2] << 8) | radio24[1];
4278		radio_rev = (radio24[0] & 0xF);
4279	} else {
4280		if (dev->dev->chip_id == 0x4317) {
4281			if (dev->dev->chip_rev == 0)
4282				tmp = 0x3205017F;
4283			else if (dev->dev->chip_rev == 1)
4284				tmp = 0x4205017F;
4285			else
4286				tmp = 0x5205017F;
4287		} else {
4288			b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4289				    B43_RADIOCTL_ID);
4290			tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4291			b43_write16(dev, B43_MMIO_RADIO_CONTROL,
4292				    B43_RADIOCTL_ID);
4293			tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH)
4294				<< 16;
4295		}
4296		radio_manuf = (tmp & 0x00000FFF);
4297		radio_ver = (tmp & 0x0FFFF000) >> 12;
4298		radio_rev = (tmp & 0xF0000000) >> 28;
4299	}
4300
4301	if (radio_manuf != 0x17F /* Broadcom */)
4302		unsupported = 1;
4303	switch (phy_type) {
4304	case B43_PHYTYPE_A:
4305		if (radio_ver != 0x2060)
4306			unsupported = 1;
4307		if (radio_rev != 1)
4308			unsupported = 1;
4309		if (radio_manuf != 0x17F)
4310			unsupported = 1;
4311		break;
4312	case B43_PHYTYPE_B:
4313		if ((radio_ver & 0xFFF0) != 0x2050)
4314			unsupported = 1;
4315		break;
4316	case B43_PHYTYPE_G:
4317		if (radio_ver != 0x2050)
4318			unsupported = 1;
4319		break;
4320	case B43_PHYTYPE_N:
4321		if (radio_ver != 0x2055 && radio_ver != 0x2056)
4322			unsupported = 1;
4323		break;
4324	case B43_PHYTYPE_LP:
4325		if (radio_ver != 0x2062 && radio_ver != 0x2063)
4326			unsupported = 1;
4327		break;
4328	case B43_PHYTYPE_HT:
4329		if (radio_ver != 0x2059)
4330			unsupported = 1;
4331		break;
4332	case B43_PHYTYPE_LCN:
4333		if (radio_ver != 0x2064)
4334			unsupported = 1;
4335		break;
4336	default:
4337		B43_WARN_ON(1);
4338	}
4339	if (unsupported) {
4340		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4341		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4342		       radio_manuf, radio_ver, radio_rev);
4343		return -EOPNOTSUPP;
4344	}
4345	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4346	       radio_manuf, radio_ver, radio_rev);
4347
4348	phy->radio_manuf = radio_manuf;
4349	phy->radio_ver = radio_ver;
4350	phy->radio_rev = radio_rev;
4351
4352	phy->analog = analog_type;
4353	phy->type = phy_type;
4354	phy->rev = phy_rev;
4355
4356	return 0;
4357}
4358
4359static void setup_struct_phy_for_init(struct b43_wldev *dev,
4360				      struct b43_phy *phy)
4361{
4362	phy->hardware_power_control = !!modparam_hwpctl;
4363	phy->next_txpwr_check_time = jiffies;
4364	/* PHY TX errors counter. */
4365	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4366
4367#if B43_DEBUG
4368	phy->phy_locked = 0;
4369	phy->radio_locked = 0;
4370#endif
4371}
4372
4373static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4374{
4375	dev->dfq_valid = 0;
4376
4377	/* Assume the radio is enabled. If it's not enabled, the state will
4378	 * immediately get fixed on the first periodic work run. */
4379	dev->radio_hw_enable = 1;
4380
4381	/* Stats */
4382	memset(&dev->stats, 0, sizeof(dev->stats));
4383
4384	setup_struct_phy_for_init(dev, &dev->phy);
4385
4386	/* IRQ related flags */
4387	dev->irq_reason = 0;
4388	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4389	dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4390	if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4391		dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4392
4393	dev->mac_suspended = 1;
4394
4395	/* Noise calculation context */
4396	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4397}
4398
4399static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4400{
4401	struct ssb_sprom *sprom = dev->dev->bus_sprom;
4402	u64 hf;
4403
4404	if (!modparam_btcoex)
4405		return;
4406	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4407		return;
4408	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4409		return;
4410
4411	hf = b43_hf_read(dev);
4412	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4413		hf |= B43_HF_BTCOEXALT;
4414	else
4415		hf |= B43_HF_BTCOEX;
4416	b43_hf_write(dev, hf);
4417}
4418
4419static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4420{
4421	if (!modparam_btcoex)
4422		return;
4423	//TODO
4424}
4425
4426static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4427{
4428	struct ssb_bus *bus;
4429	u32 tmp;
4430
4431	if (dev->dev->bus_type != B43_BUS_SSB)
4432		return;
4433
4434	bus = dev->dev->sdev->bus;
4435
4436	if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4437	    (bus->chip_id == 0x4312)) {
4438		tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4439		tmp &= ~SSB_IMCFGLO_REQTO;
4440		tmp &= ~SSB_IMCFGLO_SERTO;
4441		tmp |= 0x3;
4442		ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4443		ssb_commit_settings(bus);
4444	}
4445}
4446
4447static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4448{
4449	u16 pu_delay;
4450
4451	/* The time value is in microseconds. */
4452	if (dev->phy.type == B43_PHYTYPE_A)
4453		pu_delay = 3700;
4454	else
4455		pu_delay = 1050;
4456	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4457		pu_delay = 500;
4458	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4459		pu_delay = max(pu_delay, (u16)2400);
4460
4461	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4462}
4463
4464/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4465static void b43_set_pretbtt(struct b43_wldev *dev)
4466{
4467	u16 pretbtt;
4468
4469	/* The time value is in microseconds. */
4470	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4471		pretbtt = 2;
4472	} else {
4473		if (dev->phy.type == B43_PHYTYPE_A)
4474			pretbtt = 120;
4475		else
4476			pretbtt = 250;
4477	}
4478	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4479	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4480}
4481
4482/* Shutdown a wireless core */
4483/* Locking: wl->mutex */
4484static void b43_wireless_core_exit(struct b43_wldev *dev)
4485{
4486	u32 macctl;
4487
4488	B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4489	if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4490		return;
4491
4492	/* Unregister HW RNG driver */
4493	b43_rng_exit(dev->wl);
4494
4495	b43_set_status(dev, B43_STAT_UNINIT);
4496
4497	/* Stop the microcode PSM. */
4498	macctl = b43_read32(dev, B43_MMIO_MACCTL);
4499	macctl &= ~B43_MACCTL_PSM_RUN;
4500	macctl |= B43_MACCTL_PSM_JMP0;
4501	b43_write32(dev, B43_MMIO_MACCTL, macctl);
4502
4503	b43_dma_free(dev);
4504	b43_pio_free(dev);
4505	b43_chip_exit(dev);
4506	dev->phy.ops->switch_analog(dev, 0);
4507	if (dev->wl->current_beacon) {
4508		dev_kfree_skb_any(dev->wl->current_beacon);
4509		dev->wl->current_beacon = NULL;
4510	}
4511
4512	b43_device_disable(dev, 0);
4513	b43_bus_may_powerdown(dev);
4514}
4515
4516/* Initialize a wireless core */
4517static int b43_wireless_core_init(struct b43_wldev *dev)
4518{
4519	struct ssb_sprom *sprom = dev->dev->bus_sprom;
4520	struct b43_phy *phy = &dev->phy;
4521	int err;
4522	u64 hf;
4523
4524	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4525
4526	err = b43_bus_powerup(dev, 0);
4527	if (err)
4528		goto out;
4529	if (!b43_device_is_enabled(dev))
4530		b43_wireless_core_reset(dev, phy->gmode);
4531
4532	/* Reset all data structures. */
4533	setup_struct_wldev_for_init(dev);
4534	phy->ops->prepare_structs(dev);
4535
4536	/* Enable IRQ routing to this device. */
4537	switch (dev->dev->bus_type) {
4538#ifdef CONFIG_B43_BCMA
4539	case B43_BUS_BCMA:
4540		bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
4541				      dev->dev->bdev, true);
4542		break;
4543#endif
4544#ifdef CONFIG_B43_SSB
4545	case B43_BUS_SSB:
4546		ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4547					       dev->dev->sdev);
4548		break;
4549#endif
4550	}
4551
4552	b43_imcfglo_timeouts_workaround(dev);
4553	b43_bluetooth_coext_disable(dev);
4554	if (phy->ops->prepare_hardware) {
4555		err = phy->ops->prepare_hardware(dev);
4556		if (err)
4557			goto err_busdown;
4558	}
4559	err = b43_chip_init(dev);
4560	if (err)
4561		goto err_busdown;
4562	b43_shm_write16(dev, B43_SHM_SHARED,
4563			B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4564	hf = b43_hf_read(dev);
4565	if (phy->type == B43_PHYTYPE_G) {
4566		hf |= B43_HF_SYMW;
4567		if (phy->rev == 1)
4568			hf |= B43_HF_GDCW;
4569		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4570			hf |= B43_HF_OFDMPABOOST;
4571	}
4572	if (phy->radio_ver == 0x2050) {
4573		if (phy->radio_rev == 6)
4574			hf |= B43_HF_4318TSSI;
4575		if (phy->radio_rev < 6)
4576			hf |= B43_HF_VCORECALC;
4577	}
4578	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4579		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4580#ifdef CONFIG_SSB_DRIVER_PCICORE
4581	if (dev->dev->bus_type == B43_BUS_SSB &&
4582	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4583	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4584		hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4585#endif
4586	hf &= ~B43_HF_SKCFPUP;
4587	b43_hf_write(dev, hf);
4588
4589	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4590			     B43_DEFAULT_LONG_RETRY_LIMIT);
4591	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4592	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4593
4594	/* Disable sending probe responses from firmware.
4595	 * Setting the MaxTime to one usec will always trigger
4596	 * a timeout, so we never send any probe resp.
4597	 * A timeout of zero is infinite. */
4598	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4599
4600	b43_rate_memory_init(dev);
4601	b43_set_phytxctl_defaults(dev);
4602
4603	/* Minimum Contention Window */
4604	if (phy->type == B43_PHYTYPE_B)
4605		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4606	else
4607		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4608	/* Maximum Contention Window */
4609	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4610
4611	if (b43_bus_host_is_pcmcia(dev->dev) ||
4612	    b43_bus_host_is_sdio(dev->dev) ||
4613	    dev->use_pio) {
4614		dev->__using_pio_transfers = 1;
4615		err = b43_pio_init(dev);
4616	} else {
4617		dev->__using_pio_transfers = 0;
4618		err = b43_dma_init(dev);
4619	}
4620	if (err)
4621		goto err_chip_exit;
4622	b43_qos_init(dev);
4623	b43_set_synth_pu_delay(dev, 1);
4624	b43_bluetooth_coext_enable(dev);
4625
4626	b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4627	b43_upload_card_macaddress(dev);
4628	b43_security_init(dev);
4629
4630	ieee80211_wake_queues(dev->wl->hw);
4631
4632	b43_set_status(dev, B43_STAT_INITIALIZED);
4633
4634	/* Register HW RNG driver */
4635	b43_rng_init(dev->wl);
4636
4637out:
4638	return err;
4639
4640err_chip_exit:
4641	b43_chip_exit(dev);
4642err_busdown:
4643	b43_bus_may_powerdown(dev);
4644	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4645	return err;
4646}
4647
4648static int b43_op_add_interface(struct ieee80211_hw *hw,
4649				struct ieee80211_vif *vif)
4650{
4651	struct b43_wl *wl = hw_to_b43_wl(hw);
4652	struct b43_wldev *dev;
4653	int err = -EOPNOTSUPP;
4654
4655	/* TODO: allow WDS/AP devices to coexist */
4656
4657	if (vif->type != NL80211_IFTYPE_AP &&
4658	    vif->type != NL80211_IFTYPE_MESH_POINT &&
4659	    vif->type != NL80211_IFTYPE_STATION &&
4660	    vif->type != NL80211_IFTYPE_WDS &&
4661	    vif->type != NL80211_IFTYPE_ADHOC)
4662		return -EOPNOTSUPP;
4663
4664	mutex_lock(&wl->mutex);
4665	if (wl->operating)
4666		goto out_mutex_unlock;
4667
4668	b43dbg(wl, "Adding Interface type %d\n", vif->type);
4669
4670	dev = wl->current_dev;
4671	wl->operating = 1;
4672	wl->vif = vif;
4673	wl->if_type = vif->type;
4674	memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4675
4676	b43_adjust_opmode(dev);
4677	b43_set_pretbtt(dev);
4678	b43_set_synth_pu_delay(dev, 0);
4679	b43_upload_card_macaddress(dev);
4680
4681	err = 0;
4682 out_mutex_unlock:
4683	mutex_unlock(&wl->mutex);
4684
4685	return err;
4686}
4687
4688static void b43_op_remove_interface(struct ieee80211_hw *hw,
4689				    struct ieee80211_vif *vif)
4690{
4691	struct b43_wl *wl = hw_to_b43_wl(hw);
4692	struct b43_wldev *dev = wl->current_dev;
4693
4694	b43dbg(wl, "Removing Interface type %d\n", vif->type);
4695
4696	mutex_lock(&wl->mutex);
4697
4698	B43_WARN_ON(!wl->operating);
4699	B43_WARN_ON(wl->vif != vif);
4700	wl->vif = NULL;
4701
4702	wl->operating = 0;
4703
4704	b43_adjust_opmode(dev);
4705	memset(wl->mac_addr, 0, ETH_ALEN);
4706	b43_upload_card_macaddress(dev);
4707
4708	mutex_unlock(&wl->mutex);
4709}
4710
4711static int b43_op_start(struct ieee80211_hw *hw)
4712{
4713	struct b43_wl *wl = hw_to_b43_wl(hw);
4714	struct b43_wldev *dev = wl->current_dev;
4715	int did_init = 0;
4716	int err = 0;
4717
4718	/* Kill all old instance specific information to make sure
4719	 * the card won't use it in the short timeframe between start
4720	 * and mac80211 reconfiguring it. */
4721	memset(wl->bssid, 0, ETH_ALEN);
4722	memset(wl->mac_addr, 0, ETH_ALEN);
4723	wl->filter_flags = 0;
4724	wl->radiotap_enabled = 0;
4725	b43_qos_clear(wl);
4726	wl->beacon0_uploaded = 0;
4727	wl->beacon1_uploaded = 0;
4728	wl->beacon_templates_virgin = 1;
4729	wl->radio_enabled = 1;
4730
4731	mutex_lock(&wl->mutex);
4732
4733	if (b43_status(dev) < B43_STAT_INITIALIZED) {
4734		err = b43_wireless_core_init(dev);
4735		if (err)
4736			goto out_mutex_unlock;
4737		did_init = 1;
4738	}
4739
4740	if (b43_status(dev) < B43_STAT_STARTED) {
4741		err = b43_wireless_core_start(dev);
4742		if (err) {
4743			if (did_init)
4744				b43_wireless_core_exit(dev);
4745			goto out_mutex_unlock;
4746		}
4747	}
4748
4749	/* XXX: only do if device doesn't support rfkill irq */
4750	wiphy_rfkill_start_polling(hw->wiphy);
4751
4752 out_mutex_unlock:
4753	mutex_unlock(&wl->mutex);
4754
4755	return err;
4756}
4757
4758static void b43_op_stop(struct ieee80211_hw *hw)
4759{
4760	struct b43_wl *wl = hw_to_b43_wl(hw);
4761	struct b43_wldev *dev = wl->current_dev;
4762
4763	cancel_work_sync(&(wl->beacon_update_trigger));
4764
4765	mutex_lock(&wl->mutex);
4766	if (b43_status(dev) >= B43_STAT_STARTED) {
4767		dev = b43_wireless_core_stop(dev);
4768		if (!dev)
4769			goto out_unlock;
4770	}
4771	b43_wireless_core_exit(dev);
4772	wl->radio_enabled = 0;
4773
4774out_unlock:
4775	mutex_unlock(&wl->mutex);
4776
4777	cancel_work_sync(&(wl->txpower_adjust_work));
4778}
4779
4780static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4781				 struct ieee80211_sta *sta, bool set)
4782{
4783	struct b43_wl *wl = hw_to_b43_wl(hw);
4784
4785	/* FIXME: add locking */
4786	b43_update_templates(wl);
4787
4788	return 0;
4789}
4790
4791static void b43_op_sta_notify(struct ieee80211_hw *hw,
4792			      struct ieee80211_vif *vif,
4793			      enum sta_notify_cmd notify_cmd,
4794			      struct ieee80211_sta *sta)
4795{
4796	struct b43_wl *wl = hw_to_b43_wl(hw);
4797
4798	B43_WARN_ON(!vif || wl->vif != vif);
4799}
4800
4801static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4802{
4803	struct b43_wl *wl = hw_to_b43_wl(hw);
4804	struct b43_wldev *dev;
4805
4806	mutex_lock(&wl->mutex);
4807	dev = wl->current_dev;
4808	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4809		/* Disable CFP update during scan on other channels. */
4810		b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4811	}
4812	mutex_unlock(&wl->mutex);
4813}
4814
4815static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4816{
4817	struct b43_wl *wl = hw_to_b43_wl(hw);
4818	struct b43_wldev *dev;
4819
4820	mutex_lock(&wl->mutex);
4821	dev = wl->current_dev;
4822	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4823		/* Re-enable CFP update. */
4824		b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4825	}
4826	mutex_unlock(&wl->mutex);
4827}
4828
4829static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4830			     struct survey_info *survey)
4831{
4832	struct b43_wl *wl = hw_to_b43_wl(hw);
4833	struct b43_wldev *dev = wl->current_dev;
4834	struct ieee80211_conf *conf = &hw->conf;
4835
4836	if (idx != 0)
4837		return -ENOENT;
4838
4839	survey->channel = conf->channel;
4840	survey->filled = SURVEY_INFO_NOISE_DBM;
4841	survey->noise = dev->stats.link_noise;
4842
4843	return 0;
4844}
4845
4846static const struct ieee80211_ops b43_hw_ops = {
4847	.tx			= b43_op_tx,
4848	.conf_tx		= b43_op_conf_tx,
4849	.add_interface		= b43_op_add_interface,
4850	.remove_interface	= b43_op_remove_interface,
4851	.config			= b43_op_config,
4852	.bss_info_changed	= b43_op_bss_info_changed,
4853	.configure_filter	= b43_op_configure_filter,
4854	.set_key		= b43_op_set_key,
4855	.update_tkip_key	= b43_op_update_tkip_key,
4856	.get_stats		= b43_op_get_stats,
4857	.get_tsf		= b43_op_get_tsf,
4858	.set_tsf		= b43_op_set_tsf,
4859	.start			= b43_op_start,
4860	.stop			= b43_op_stop,
4861	.set_tim		= b43_op_beacon_set_tim,
4862	.sta_notify		= b43_op_sta_notify,
4863	.sw_scan_start		= b43_op_sw_scan_start_notifier,
4864	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
4865	.get_survey		= b43_op_get_survey,
4866	.rfkill_poll		= b43_rfkill_poll,
4867};
4868
4869/* Hard-reset the chip. Do not call this directly.
4870 * Use b43_controller_restart()
4871 */
4872static void b43_chip_reset(struct work_struct *work)
4873{
4874	struct b43_wldev *dev =
4875	    container_of(work, struct b43_wldev, restart_work);
4876	struct b43_wl *wl = dev->wl;
4877	int err = 0;
4878	int prev_status;
4879
4880	mutex_lock(&wl->mutex);
4881
4882	prev_status = b43_status(dev);
4883	/* Bring the device down... */
4884	if (prev_status >= B43_STAT_STARTED) {
4885		dev = b43_wireless_core_stop(dev);
4886		if (!dev) {
4887			err = -ENODEV;
4888			goto out;
4889		}
4890	}
4891	if (prev_status >= B43_STAT_INITIALIZED)
4892		b43_wireless_core_exit(dev);
4893
4894	/* ...and up again. */
4895	if (prev_status >= B43_STAT_INITIALIZED) {
4896		err = b43_wireless_core_init(dev);
4897		if (err)
4898			goto out;
4899	}
4900	if (prev_status >= B43_STAT_STARTED) {
4901		err = b43_wireless_core_start(dev);
4902		if (err) {
4903			b43_wireless_core_exit(dev);
4904			goto out;
4905		}
4906	}
4907out:
4908	if (err)
4909		wl->current_dev = NULL; /* Failed to init the dev. */
4910	mutex_unlock(&wl->mutex);
4911	if (err)
4912		b43err(wl, "Controller restart FAILED\n");
4913	else
4914		b43info(wl, "Controller restarted\n");
4915}
4916
4917static int b43_setup_bands(struct b43_wldev *dev,
4918			   bool have_2ghz_phy, bool have_5ghz_phy)
4919{
4920	struct ieee80211_hw *hw = dev->wl->hw;
4921
4922	if (have_2ghz_phy)
4923		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4924	if (dev->phy.type == B43_PHYTYPE_N) {
4925		if (have_5ghz_phy)
4926			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4927	} else {
4928		if (have_5ghz_phy)
4929			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4930	}
4931
4932	dev->phy.supports_2ghz = have_2ghz_phy;
4933	dev->phy.supports_5ghz = have_5ghz_phy;
4934
4935	return 0;
4936}
4937
4938static void b43_wireless_core_detach(struct b43_wldev *dev)
4939{
4940	/* We release firmware that late to not be required to re-request
4941	 * is all the time when we reinit the core. */
4942	b43_release_firmware(dev);
4943	b43_phy_free(dev);
4944}
4945
4946static int b43_wireless_core_attach(struct b43_wldev *dev)
4947{
4948	struct b43_wl *wl = dev->wl;
4949	struct pci_dev *pdev = NULL;
4950	int err;
4951	bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4952
4953	/* Do NOT do any device initialization here.
4954	 * Do it in wireless_core_init() instead.
4955	 * This function is for gathering basic information about the HW, only.
4956	 * Also some structs may be set up here. But most likely you want to have
4957	 * that in core_init(), too.
4958	 */
4959
4960#ifdef CONFIG_B43_SSB
4961	if (dev->dev->bus_type == B43_BUS_SSB &&
4962	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
4963		pdev = dev->dev->sdev->bus->host_pci;
4964#endif
4965
4966	err = b43_bus_powerup(dev, 0);
4967	if (err) {
4968		b43err(wl, "Bus powerup failed\n");
4969		goto out;
4970	}
4971
4972	/* Get the PHY type. */
4973	switch (dev->dev->bus_type) {
4974#ifdef CONFIG_B43_BCMA
4975	case B43_BUS_BCMA:
4976		/* FIXME */
4977		have_2ghz_phy = 1;
4978		have_5ghz_phy = 0;
4979		break;
4980#endif
4981#ifdef CONFIG_B43_SSB
4982	case B43_BUS_SSB:
4983		if (dev->dev->core_rev >= 5) {
4984			u32 tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
4985			have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4986			have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4987		} else
4988			B43_WARN_ON(1);
4989		break;
4990#endif
4991	}
4992
4993	dev->phy.gmode = have_2ghz_phy;
4994	dev->phy.radio_on = 1;
4995	b43_wireless_core_reset(dev, dev->phy.gmode);
4996
4997	err = b43_phy_versioning(dev);
4998	if (err)
4999		goto err_powerdown;
5000	/* Check if this device supports multiband. */
5001	if (!pdev ||
5002	    (pdev->device != 0x4312 &&
5003	     pdev->device != 0x4319 && pdev->device != 0x4324)) {
5004		/* No multiband support. */
5005		have_2ghz_phy = 0;
5006		have_5ghz_phy = 0;
5007		switch (dev->phy.type) {
5008		case B43_PHYTYPE_A:
5009			have_5ghz_phy = 1;
5010			break;
5011		case B43_PHYTYPE_LP: //FIXME not always!
5012#if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
5013			have_5ghz_phy = 1;
5014#endif
5015		case B43_PHYTYPE_G:
5016		case B43_PHYTYPE_N:
5017		case B43_PHYTYPE_HT:
5018		case B43_PHYTYPE_LCN:
5019			have_2ghz_phy = 1;
5020			break;
5021		default:
5022			B43_WARN_ON(1);
5023		}
5024	}
5025	if (dev->phy.type == B43_PHYTYPE_A) {
5026		/* FIXME */
5027		b43err(wl, "IEEE 802.11a devices are unsupported\n");
5028		err = -EOPNOTSUPP;
5029		goto err_powerdown;
5030	}
5031	if (1 /* disable A-PHY */) {
5032		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
5033		if (dev->phy.type != B43_PHYTYPE_N &&
5034		    dev->phy.type != B43_PHYTYPE_LP) {
5035			have_2ghz_phy = 1;
5036			have_5ghz_phy = 0;
5037		}
5038	}
5039
5040	err = b43_phy_allocate(dev);
5041	if (err)
5042		goto err_powerdown;
5043
5044	dev->phy.gmode = have_2ghz_phy;
5045	b43_wireless_core_reset(dev, dev->phy.gmode);
5046
5047	err = b43_validate_chipaccess(dev);
5048	if (err)
5049		goto err_phy_free;
5050	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5051	if (err)
5052		goto err_phy_free;
5053
5054	/* Now set some default "current_dev" */
5055	if (!wl->current_dev)
5056		wl->current_dev = dev;
5057	INIT_WORK(&dev->restart_work, b43_chip_reset);
5058
5059	dev->phy.ops->switch_analog(dev, 0);
5060	b43_device_disable(dev, 0);
5061	b43_bus_may_powerdown(dev);
5062
5063out:
5064	return err;
5065
5066err_phy_free:
5067	b43_phy_free(dev);
5068err_powerdown:
5069	b43_bus_may_powerdown(dev);
5070	return err;
5071}
5072
5073static void b43_one_core_detach(struct b43_bus_dev *dev)
5074{
5075	struct b43_wldev *wldev;
5076	struct b43_wl *wl;
5077
5078	/* Do not cancel ieee80211-workqueue based work here.
5079	 * See comment in b43_remove(). */
5080
5081	wldev = b43_bus_get_wldev(dev);
5082	wl = wldev->wl;
5083	b43_debugfs_remove_device(wldev);
5084	b43_wireless_core_detach(wldev);
5085	list_del(&wldev->list);
5086	wl->nr_devs--;
5087	b43_bus_set_wldev(dev, NULL);
5088	kfree(wldev);
5089}
5090
5091static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5092{
5093	struct b43_wldev *wldev;
5094	int err = -ENOMEM;
5095
5096	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5097	if (!wldev)
5098		goto out;
5099
5100	wldev->use_pio = b43_modparam_pio;
5101	wldev->dev = dev;
5102	wldev->wl = wl;
5103	b43_set_status(wldev, B43_STAT_UNINIT);
5104	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5105	INIT_LIST_HEAD(&wldev->list);
5106
5107	err = b43_wireless_core_attach(wldev);
5108	if (err)
5109		goto err_kfree_wldev;
5110
5111	list_add(&wldev->list, &wl->devlist);
5112	wl->nr_devs++;
5113	b43_bus_set_wldev(dev, wldev);
5114	b43_debugfs_add_device(wldev);
5115
5116      out:
5117	return err;
5118
5119      err_kfree_wldev:
5120	kfree(wldev);
5121	return err;
5122}
5123
5124#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
5125	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
5126	(pdev->device == _device) &&					\
5127	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
5128	(pdev->subsystem_device == _subdevice)				)
5129
5130static void b43_sprom_fixup(struct ssb_bus *bus)
5131{
5132	struct pci_dev *pdev;
5133
5134	/* boardflags workarounds */
5135	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5136	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
5137		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5138	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5139	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
5140		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5141	if (bus->bustype == SSB_BUSTYPE_PCI) {
5142		pdev = bus->host_pci;
5143		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5144		    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5145		    IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5146		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5147		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5148		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5149		    IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5150			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5151	}
5152}
5153
5154static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5155{
5156	struct ieee80211_hw *hw = wl->hw;
5157
5158	ssb_set_devtypedata(dev->sdev, NULL);
5159	ieee80211_free_hw(hw);
5160}
5161
5162static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5163{
5164	struct ssb_sprom *sprom = dev->bus_sprom;
5165	struct ieee80211_hw *hw;
5166	struct b43_wl *wl;
5167
5168	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5169	if (!hw) {
5170		b43err(NULL, "Could not allocate ieee80211 device\n");
5171		return ERR_PTR(-ENOMEM);
5172	}
5173	wl = hw_to_b43_wl(hw);
5174
5175	/* fill hw info */
5176	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
5177		    IEEE80211_HW_SIGNAL_DBM;
5178
5179	hw->wiphy->interface_modes =
5180		BIT(NL80211_IFTYPE_AP) |
5181		BIT(NL80211_IFTYPE_MESH_POINT) |
5182		BIT(NL80211_IFTYPE_STATION) |
5183		BIT(NL80211_IFTYPE_WDS) |
5184		BIT(NL80211_IFTYPE_ADHOC);
5185
5186	hw->queues = modparam_qos ? 4 : 1;
5187	wl->mac80211_initially_registered_queues = hw->queues;
5188	hw->max_rates = 2;
5189	SET_IEEE80211_DEV(hw, dev->dev);
5190	if (is_valid_ether_addr(sprom->et1mac))
5191		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5192	else
5193		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5194
5195	/* Initialize struct b43_wl */
5196	wl->hw = hw;
5197	mutex_init(&wl->mutex);
5198	spin_lock_init(&wl->hardirq_lock);
5199	INIT_LIST_HEAD(&wl->devlist);
5200	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5201	INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5202	INIT_WORK(&wl->tx_work, b43_tx_work);
5203	skb_queue_head_init(&wl->tx_queue);
5204
5205	b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
5206		dev->chip_id, dev->core_rev);
5207	return wl;
5208}
5209
5210#ifdef CONFIG_B43_BCMA
5211static int b43_bcma_probe(struct bcma_device *core)
5212{
5213	struct b43_bus_dev *dev;
5214
5215	dev = b43_bus_dev_bcma_init(core);
5216	if (!dev)
5217		return -ENODEV;
5218
5219	b43err(NULL, "BCMA is not supported yet!");
5220	kfree(dev);
5221	return -EOPNOTSUPP;
5222}
5223
5224static void b43_bcma_remove(struct bcma_device *core)
5225{
5226	/* TODO */
5227}
5228
5229static struct bcma_driver b43_bcma_driver = {
5230	.name		= KBUILD_MODNAME,
5231	.id_table	= b43_bcma_tbl,
5232	.probe		= b43_bcma_probe,
5233	.remove		= b43_bcma_remove,
5234};
5235#endif
5236
5237#ifdef CONFIG_B43_SSB
5238static
5239int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5240{
5241	struct b43_bus_dev *dev;
5242	struct b43_wl *wl;
5243	int err;
5244	int first = 0;
5245
5246	dev = b43_bus_dev_ssb_init(sdev);
5247	if (!dev)
5248		return -ENOMEM;
5249
5250	wl = ssb_get_devtypedata(sdev);
5251	if (!wl) {
5252		/* Probing the first core. Must setup common struct b43_wl */
5253		first = 1;
5254		b43_sprom_fixup(sdev->bus);
5255		wl = b43_wireless_init(dev);
5256		if (IS_ERR(wl)) {
5257			err = PTR_ERR(wl);
5258			goto out;
5259		}
5260		ssb_set_devtypedata(sdev, wl);
5261		B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5262	}
5263	err = b43_one_core_attach(dev, wl);
5264	if (err)
5265		goto err_wireless_exit;
5266
5267	if (first) {
5268		err = ieee80211_register_hw(wl->hw);
5269		if (err)
5270			goto err_one_core_detach;
5271		b43_leds_register(wl->current_dev);
5272	}
5273
5274      out:
5275	return err;
5276
5277      err_one_core_detach:
5278	b43_one_core_detach(dev);
5279      err_wireless_exit:
5280	if (first)
5281		b43_wireless_exit(dev, wl);
5282	return err;
5283}
5284
5285static void b43_ssb_remove(struct ssb_device *sdev)
5286{
5287	struct b43_wl *wl = ssb_get_devtypedata(sdev);
5288	struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5289
5290	/* We must cancel any work here before unregistering from ieee80211,
5291	 * as the ieee80211 unreg will destroy the workqueue. */
5292	cancel_work_sync(&wldev->restart_work);
5293
5294	B43_WARN_ON(!wl);
5295	if (wl->current_dev == wldev) {
5296		/* Restore the queues count before unregistering, because firmware detect
5297		 * might have modified it. Restoring is important, so the networking
5298		 * stack can properly free resources. */
5299		wl->hw->queues = wl->mac80211_initially_registered_queues;
5300		b43_leds_stop(wldev);
5301		ieee80211_unregister_hw(wl->hw);
5302	}
5303
5304	b43_one_core_detach(wldev->dev);
5305
5306	if (list_empty(&wl->devlist)) {
5307		b43_leds_unregister(wl);
5308		/* Last core on the chip unregistered.
5309		 * We can destroy common struct b43_wl.
5310		 */
5311		b43_wireless_exit(wldev->dev, wl);
5312	}
5313}
5314
5315static struct ssb_driver b43_ssb_driver = {
5316	.name		= KBUILD_MODNAME,
5317	.id_table	= b43_ssb_tbl,
5318	.probe		= b43_ssb_probe,
5319	.remove		= b43_ssb_remove,
5320};
5321#endif /* CONFIG_B43_SSB */
5322
5323/* Perform a hardware reset. This can be called from any context. */
5324void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5325{
5326	/* Must avoid requeueing, if we are in shutdown. */
5327	if (b43_status(dev) < B43_STAT_INITIALIZED)
5328		return;
5329	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5330	ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5331}
5332
5333static void b43_print_driverinfo(void)
5334{
5335	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5336		   *feat_leds = "", *feat_sdio = "";
5337
5338#ifdef CONFIG_B43_PCI_AUTOSELECT
5339	feat_pci = "P";
5340#endif
5341#ifdef CONFIG_B43_PCMCIA
5342	feat_pcmcia = "M";
5343#endif
5344#ifdef CONFIG_B43_PHY_N
5345	feat_nphy = "N";
5346#endif
5347#ifdef CONFIG_B43_LEDS
5348	feat_leds = "L";
5349#endif
5350#ifdef CONFIG_B43_SDIO
5351	feat_sdio = "S";
5352#endif
5353	printk(KERN_INFO "Broadcom 43xx driver loaded "
5354	       "[ Features: %s%s%s%s%s, Firmware-ID: "
5355	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
5356	       feat_pci, feat_pcmcia, feat_nphy,
5357	       feat_leds, feat_sdio);
5358}
5359
5360static int __init b43_init(void)
5361{
5362	int err;
5363
5364	b43_debugfs_init();
5365	err = b43_pcmcia_init();
5366	if (err)
5367		goto err_dfs_exit;
5368	err = b43_sdio_init();
5369	if (err)
5370		goto err_pcmcia_exit;
5371#ifdef CONFIG_B43_BCMA
5372	err = bcma_driver_register(&b43_bcma_driver);
5373	if (err)
5374		goto err_sdio_exit;
5375#endif
5376#ifdef CONFIG_B43_SSB
5377	err = ssb_driver_register(&b43_ssb_driver);
5378	if (err)
5379		goto err_bcma_driver_exit;
5380#endif
5381	b43_print_driverinfo();
5382
5383	return err;
5384
5385#ifdef CONFIG_B43_SSB
5386err_bcma_driver_exit:
5387#endif
5388#ifdef CONFIG_B43_BCMA
5389	bcma_driver_unregister(&b43_bcma_driver);
5390err_sdio_exit:
5391#endif
5392	b43_sdio_exit();
5393err_pcmcia_exit:
5394	b43_pcmcia_exit();
5395err_dfs_exit:
5396	b43_debugfs_exit();
5397	return err;
5398}
5399
5400static void __exit b43_exit(void)
5401{
5402#ifdef CONFIG_B43_SSB
5403	ssb_driver_unregister(&b43_ssb_driver);
5404#endif
5405#ifdef CONFIG_B43_BCMA
5406	bcma_driver_unregister(&b43_bcma_driver);
5407#endif
5408	b43_sdio_exit();
5409	b43_pcmcia_exit();
5410	b43_debugfs_exit();
5411}
5412
5413module_init(b43_init)
5414module_exit(b43_exit)
5415