main.c revision 92d6128e1766bb7a7b6dc58f012fdf772fdf1100
1/*
2
3  Broadcom B43 wireless driver
4
5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11  Some parts of the code in this file are derived from the ipw2200
12  driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14  This program is free software; you can redistribute it and/or modify
15  it under the terms of the GNU General Public License as published by
16  the Free Software Foundation; either version 2 of the License, or
17  (at your option) any later version.
18
19  This program is distributed in the hope that it will be useful,
20  but WITHOUT ANY WARRANTY; without even the implied warranty of
21  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  GNU General Public License for more details.
23
24  You should have received a copy of the GNU General Public License
25  along with this program; see the file COPYING.  If not, write to
26  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27  Boston, MA 02110-1301, USA.
28
29*/
30
31#include <linux/delay.h>
32#include <linux/init.h>
33#include <linux/moduleparam.h>
34#include <linux/if_arp.h>
35#include <linux/etherdevice.h>
36#include <linux/firmware.h>
37#include <linux/wireless.h>
38#include <linux/workqueue.h>
39#include <linux/skbuff.h>
40#include <linux/io.h>
41#include <linux/dma-mapping.h>
42#include <asm/unaligned.h>
43
44#include "b43.h"
45#include "main.h"
46#include "debugfs.h"
47#include "phy_common.h"
48#include "phy_g.h"
49#include "phy_n.h"
50#include "dma.h"
51#include "pio.h"
52#include "sysfs.h"
53#include "xmit.h"
54#include "lo.h"
55#include "pcmcia.h"
56
57MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58MODULE_AUTHOR("Martin Langer");
59MODULE_AUTHOR("Stefano Brivio");
60MODULE_AUTHOR("Michael Buesch");
61MODULE_LICENSE("GPL");
62
63MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66static int modparam_bad_frames_preempt;
67module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68MODULE_PARM_DESC(bad_frames_preempt,
69		 "enable(1) / disable(0) Bad Frames Preemption");
70
71static char modparam_fwpostfix[16];
72module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75static int modparam_hwpctl;
76module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79static int modparam_nohwcrypt;
80module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83int b43_modparam_qos = 1;
84module_param_named(qos, b43_modparam_qos, int, 0444);
85MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
86
87static int modparam_btcoex = 1;
88module_param_named(btcoex, modparam_btcoex, int, 0444);
89MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
90
91
92static const struct ssb_device_id b43_ssb_tbl[] = {
93	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
94	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
95	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
96	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
97	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
98	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
99	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
100	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
101	SSB_DEVTABLE_END
102};
103
104MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
105
106/* Channel and ratetables are shared for all devices.
107 * They can't be const, because ieee80211 puts some precalculated
108 * data in there. This data is the same for all devices, so we don't
109 * get concurrency issues */
110#define RATETAB_ENT(_rateid, _flags) \
111	{								\
112		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
113		.hw_value	= (_rateid),				\
114		.flags		= (_flags),				\
115	}
116
117/*
118 * NOTE: When changing this, sync with xmit.c's
119 *	 b43_plcp_get_bitrate_idx_* functions!
120 */
121static struct ieee80211_rate __b43_ratetable[] = {
122	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
123	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
124	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
125	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
126	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
127	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
128	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
129	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
130	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
131	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
132	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
133	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
134};
135
136#define b43_a_ratetable		(__b43_ratetable + 4)
137#define b43_a_ratetable_size	8
138#define b43_b_ratetable		(__b43_ratetable + 0)
139#define b43_b_ratetable_size	4
140#define b43_g_ratetable		(__b43_ratetable + 0)
141#define b43_g_ratetable_size	12
142
143#define CHAN4G(_channel, _freq, _flags) {			\
144	.band			= IEEE80211_BAND_2GHZ,		\
145	.center_freq		= (_freq),			\
146	.hw_value		= (_channel),			\
147	.flags			= (_flags),			\
148	.max_antenna_gain	= 0,				\
149	.max_power		= 30,				\
150}
151static struct ieee80211_channel b43_2ghz_chantable[] = {
152	CHAN4G(1, 2412, 0),
153	CHAN4G(2, 2417, 0),
154	CHAN4G(3, 2422, 0),
155	CHAN4G(4, 2427, 0),
156	CHAN4G(5, 2432, 0),
157	CHAN4G(6, 2437, 0),
158	CHAN4G(7, 2442, 0),
159	CHAN4G(8, 2447, 0),
160	CHAN4G(9, 2452, 0),
161	CHAN4G(10, 2457, 0),
162	CHAN4G(11, 2462, 0),
163	CHAN4G(12, 2467, 0),
164	CHAN4G(13, 2472, 0),
165	CHAN4G(14, 2484, 0),
166};
167#undef CHAN4G
168
169#define CHAN5G(_channel, _flags) {				\
170	.band			= IEEE80211_BAND_5GHZ,		\
171	.center_freq		= 5000 + (5 * (_channel)),	\
172	.hw_value		= (_channel),			\
173	.flags			= (_flags),			\
174	.max_antenna_gain	= 0,				\
175	.max_power		= 30,				\
176}
177static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
178	CHAN5G(32, 0),		CHAN5G(34, 0),
179	CHAN5G(36, 0),		CHAN5G(38, 0),
180	CHAN5G(40, 0),		CHAN5G(42, 0),
181	CHAN5G(44, 0),		CHAN5G(46, 0),
182	CHAN5G(48, 0),		CHAN5G(50, 0),
183	CHAN5G(52, 0),		CHAN5G(54, 0),
184	CHAN5G(56, 0),		CHAN5G(58, 0),
185	CHAN5G(60, 0),		CHAN5G(62, 0),
186	CHAN5G(64, 0),		CHAN5G(66, 0),
187	CHAN5G(68, 0),		CHAN5G(70, 0),
188	CHAN5G(72, 0),		CHAN5G(74, 0),
189	CHAN5G(76, 0),		CHAN5G(78, 0),
190	CHAN5G(80, 0),		CHAN5G(82, 0),
191	CHAN5G(84, 0),		CHAN5G(86, 0),
192	CHAN5G(88, 0),		CHAN5G(90, 0),
193	CHAN5G(92, 0),		CHAN5G(94, 0),
194	CHAN5G(96, 0),		CHAN5G(98, 0),
195	CHAN5G(100, 0),		CHAN5G(102, 0),
196	CHAN5G(104, 0),		CHAN5G(106, 0),
197	CHAN5G(108, 0),		CHAN5G(110, 0),
198	CHAN5G(112, 0),		CHAN5G(114, 0),
199	CHAN5G(116, 0),		CHAN5G(118, 0),
200	CHAN5G(120, 0),		CHAN5G(122, 0),
201	CHAN5G(124, 0),		CHAN5G(126, 0),
202	CHAN5G(128, 0),		CHAN5G(130, 0),
203	CHAN5G(132, 0),		CHAN5G(134, 0),
204	CHAN5G(136, 0),		CHAN5G(138, 0),
205	CHAN5G(140, 0),		CHAN5G(142, 0),
206	CHAN5G(144, 0),		CHAN5G(145, 0),
207	CHAN5G(146, 0),		CHAN5G(147, 0),
208	CHAN5G(148, 0),		CHAN5G(149, 0),
209	CHAN5G(150, 0),		CHAN5G(151, 0),
210	CHAN5G(152, 0),		CHAN5G(153, 0),
211	CHAN5G(154, 0),		CHAN5G(155, 0),
212	CHAN5G(156, 0),		CHAN5G(157, 0),
213	CHAN5G(158, 0),		CHAN5G(159, 0),
214	CHAN5G(160, 0),		CHAN5G(161, 0),
215	CHAN5G(162, 0),		CHAN5G(163, 0),
216	CHAN5G(164, 0),		CHAN5G(165, 0),
217	CHAN5G(166, 0),		CHAN5G(168, 0),
218	CHAN5G(170, 0),		CHAN5G(172, 0),
219	CHAN5G(174, 0),		CHAN5G(176, 0),
220	CHAN5G(178, 0),		CHAN5G(180, 0),
221	CHAN5G(182, 0),		CHAN5G(184, 0),
222	CHAN5G(186, 0),		CHAN5G(188, 0),
223	CHAN5G(190, 0),		CHAN5G(192, 0),
224	CHAN5G(194, 0),		CHAN5G(196, 0),
225	CHAN5G(198, 0),		CHAN5G(200, 0),
226	CHAN5G(202, 0),		CHAN5G(204, 0),
227	CHAN5G(206, 0),		CHAN5G(208, 0),
228	CHAN5G(210, 0),		CHAN5G(212, 0),
229	CHAN5G(214, 0),		CHAN5G(216, 0),
230	CHAN5G(218, 0),		CHAN5G(220, 0),
231	CHAN5G(222, 0),		CHAN5G(224, 0),
232	CHAN5G(226, 0),		CHAN5G(228, 0),
233};
234
235static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
236	CHAN5G(34, 0),		CHAN5G(36, 0),
237	CHAN5G(38, 0),		CHAN5G(40, 0),
238	CHAN5G(42, 0),		CHAN5G(44, 0),
239	CHAN5G(46, 0),		CHAN5G(48, 0),
240	CHAN5G(52, 0),		CHAN5G(56, 0),
241	CHAN5G(60, 0),		CHAN5G(64, 0),
242	CHAN5G(100, 0),		CHAN5G(104, 0),
243	CHAN5G(108, 0),		CHAN5G(112, 0),
244	CHAN5G(116, 0),		CHAN5G(120, 0),
245	CHAN5G(124, 0),		CHAN5G(128, 0),
246	CHAN5G(132, 0),		CHAN5G(136, 0),
247	CHAN5G(140, 0),		CHAN5G(149, 0),
248	CHAN5G(153, 0),		CHAN5G(157, 0),
249	CHAN5G(161, 0),		CHAN5G(165, 0),
250	CHAN5G(184, 0),		CHAN5G(188, 0),
251	CHAN5G(192, 0),		CHAN5G(196, 0),
252	CHAN5G(200, 0),		CHAN5G(204, 0),
253	CHAN5G(208, 0),		CHAN5G(212, 0),
254	CHAN5G(216, 0),
255};
256#undef CHAN5G
257
258static struct ieee80211_supported_band b43_band_5GHz_nphy = {
259	.band		= IEEE80211_BAND_5GHZ,
260	.channels	= b43_5ghz_nphy_chantable,
261	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
262	.bitrates	= b43_a_ratetable,
263	.n_bitrates	= b43_a_ratetable_size,
264};
265
266static struct ieee80211_supported_band b43_band_5GHz_aphy = {
267	.band		= IEEE80211_BAND_5GHZ,
268	.channels	= b43_5ghz_aphy_chantable,
269	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
270	.bitrates	= b43_a_ratetable,
271	.n_bitrates	= b43_a_ratetable_size,
272};
273
274static struct ieee80211_supported_band b43_band_2GHz = {
275	.band		= IEEE80211_BAND_2GHZ,
276	.channels	= b43_2ghz_chantable,
277	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
278	.bitrates	= b43_g_ratetable,
279	.n_bitrates	= b43_g_ratetable_size,
280};
281
282static void b43_wireless_core_exit(struct b43_wldev *dev);
283static int b43_wireless_core_init(struct b43_wldev *dev);
284static void b43_wireless_core_stop(struct b43_wldev *dev);
285static int b43_wireless_core_start(struct b43_wldev *dev);
286
287static int b43_ratelimit(struct b43_wl *wl)
288{
289	if (!wl || !wl->current_dev)
290		return 1;
291	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
292		return 1;
293	/* We are up and running.
294	 * Ratelimit the messages to avoid DoS over the net. */
295	return net_ratelimit();
296}
297
298void b43info(struct b43_wl *wl, const char *fmt, ...)
299{
300	va_list args;
301
302	if (!b43_ratelimit(wl))
303		return;
304	va_start(args, fmt);
305	printk(KERN_INFO "b43-%s: ",
306	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
307	vprintk(fmt, args);
308	va_end(args);
309}
310
311void b43err(struct b43_wl *wl, const char *fmt, ...)
312{
313	va_list args;
314
315	if (!b43_ratelimit(wl))
316		return;
317	va_start(args, fmt);
318	printk(KERN_ERR "b43-%s ERROR: ",
319	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
320	vprintk(fmt, args);
321	va_end(args);
322}
323
324void b43warn(struct b43_wl *wl, const char *fmt, ...)
325{
326	va_list args;
327
328	if (!b43_ratelimit(wl))
329		return;
330	va_start(args, fmt);
331	printk(KERN_WARNING "b43-%s warning: ",
332	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
333	vprintk(fmt, args);
334	va_end(args);
335}
336
337#if B43_DEBUG
338void b43dbg(struct b43_wl *wl, const char *fmt, ...)
339{
340	va_list args;
341
342	va_start(args, fmt);
343	printk(KERN_DEBUG "b43-%s debug: ",
344	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
345	vprintk(fmt, args);
346	va_end(args);
347}
348#endif /* DEBUG */
349
350static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
351{
352	u32 macctl;
353
354	B43_WARN_ON(offset % 4 != 0);
355
356	macctl = b43_read32(dev, B43_MMIO_MACCTL);
357	if (macctl & B43_MACCTL_BE)
358		val = swab32(val);
359
360	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
361	mmiowb();
362	b43_write32(dev, B43_MMIO_RAM_DATA, val);
363}
364
365static inline void b43_shm_control_word(struct b43_wldev *dev,
366					u16 routing, u16 offset)
367{
368	u32 control;
369
370	/* "offset" is the WORD offset. */
371	control = routing;
372	control <<= 16;
373	control |= offset;
374	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
375}
376
377u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
378{
379	u32 ret;
380
381	if (routing == B43_SHM_SHARED) {
382		B43_WARN_ON(offset & 0x0001);
383		if (offset & 0x0003) {
384			/* Unaligned access */
385			b43_shm_control_word(dev, routing, offset >> 2);
386			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
387			ret <<= 16;
388			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
389			ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
390
391			goto out;
392		}
393		offset >>= 2;
394	}
395	b43_shm_control_word(dev, routing, offset);
396	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
397out:
398	return ret;
399}
400
401u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
402{
403	struct b43_wl *wl = dev->wl;
404	unsigned long flags;
405	u32 ret;
406
407	spin_lock_irqsave(&wl->shm_lock, flags);
408	ret = __b43_shm_read32(dev, routing, offset);
409	spin_unlock_irqrestore(&wl->shm_lock, flags);
410
411	return ret;
412}
413
414u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
415{
416	u16 ret;
417
418	if (routing == B43_SHM_SHARED) {
419		B43_WARN_ON(offset & 0x0001);
420		if (offset & 0x0003) {
421			/* Unaligned access */
422			b43_shm_control_word(dev, routing, offset >> 2);
423			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
424
425			goto out;
426		}
427		offset >>= 2;
428	}
429	b43_shm_control_word(dev, routing, offset);
430	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
431out:
432	return ret;
433}
434
435u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
436{
437	struct b43_wl *wl = dev->wl;
438	unsigned long flags;
439	u16 ret;
440
441	spin_lock_irqsave(&wl->shm_lock, flags);
442	ret = __b43_shm_read16(dev, routing, offset);
443	spin_unlock_irqrestore(&wl->shm_lock, flags);
444
445	return ret;
446}
447
448void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
449{
450	if (routing == B43_SHM_SHARED) {
451		B43_WARN_ON(offset & 0x0001);
452		if (offset & 0x0003) {
453			/* Unaligned access */
454			b43_shm_control_word(dev, routing, offset >> 2);
455			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
456				    (value >> 16) & 0xffff);
457			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
458			b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
459			return;
460		}
461		offset >>= 2;
462	}
463	b43_shm_control_word(dev, routing, offset);
464	b43_write32(dev, B43_MMIO_SHM_DATA, value);
465}
466
467void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
468{
469	struct b43_wl *wl = dev->wl;
470	unsigned long flags;
471
472	spin_lock_irqsave(&wl->shm_lock, flags);
473	__b43_shm_write32(dev, routing, offset, value);
474	spin_unlock_irqrestore(&wl->shm_lock, flags);
475}
476
477void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
478{
479	if (routing == B43_SHM_SHARED) {
480		B43_WARN_ON(offset & 0x0001);
481		if (offset & 0x0003) {
482			/* Unaligned access */
483			b43_shm_control_word(dev, routing, offset >> 2);
484			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
485			return;
486		}
487		offset >>= 2;
488	}
489	b43_shm_control_word(dev, routing, offset);
490	b43_write16(dev, B43_MMIO_SHM_DATA, value);
491}
492
493void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
494{
495	struct b43_wl *wl = dev->wl;
496	unsigned long flags;
497
498	spin_lock_irqsave(&wl->shm_lock, flags);
499	__b43_shm_write16(dev, routing, offset, value);
500	spin_unlock_irqrestore(&wl->shm_lock, flags);
501}
502
503/* Read HostFlags */
504u64 b43_hf_read(struct b43_wldev * dev)
505{
506	u64 ret;
507
508	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
509	ret <<= 16;
510	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
511	ret <<= 16;
512	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
513
514	return ret;
515}
516
517/* Write HostFlags */
518void b43_hf_write(struct b43_wldev *dev, u64 value)
519{
520	u16 lo, mi, hi;
521
522	lo = (value & 0x00000000FFFFULL);
523	mi = (value & 0x0000FFFF0000ULL) >> 16;
524	hi = (value & 0xFFFF00000000ULL) >> 32;
525	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
526	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
527	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
528}
529
530void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
531{
532	u32 low, high;
533
534	B43_WARN_ON(dev->dev->id.revision < 3);
535
536	/* The hardware guarantees us an atomic read, if we
537	 * read the low register first. */
538	low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
539	high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
540
541	*tsf = high;
542	*tsf <<= 32;
543	*tsf |= low;
544}
545
546static void b43_time_lock(struct b43_wldev *dev)
547{
548	u32 macctl;
549
550	macctl = b43_read32(dev, B43_MMIO_MACCTL);
551	macctl |= B43_MACCTL_TBTTHOLD;
552	b43_write32(dev, B43_MMIO_MACCTL, macctl);
553	/* Commit the write */
554	b43_read32(dev, B43_MMIO_MACCTL);
555}
556
557static void b43_time_unlock(struct b43_wldev *dev)
558{
559	u32 macctl;
560
561	macctl = b43_read32(dev, B43_MMIO_MACCTL);
562	macctl &= ~B43_MACCTL_TBTTHOLD;
563	b43_write32(dev, B43_MMIO_MACCTL, macctl);
564	/* Commit the write */
565	b43_read32(dev, B43_MMIO_MACCTL);
566}
567
568static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
569{
570	u32 low, high;
571
572	B43_WARN_ON(dev->dev->id.revision < 3);
573
574	low = tsf;
575	high = (tsf >> 32);
576	/* The hardware guarantees us an atomic write, if we
577	 * write the low register first. */
578	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
579	mmiowb();
580	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
581	mmiowb();
582}
583
584void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
585{
586	b43_time_lock(dev);
587	b43_tsf_write_locked(dev, tsf);
588	b43_time_unlock(dev);
589}
590
591static
592void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
593{
594	static const u8 zero_addr[ETH_ALEN] = { 0 };
595	u16 data;
596
597	if (!mac)
598		mac = zero_addr;
599
600	offset |= 0x0020;
601	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
602
603	data = mac[0];
604	data |= mac[1] << 8;
605	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
606	data = mac[2];
607	data |= mac[3] << 8;
608	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
609	data = mac[4];
610	data |= mac[5] << 8;
611	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
612}
613
614static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
615{
616	const u8 *mac;
617	const u8 *bssid;
618	u8 mac_bssid[ETH_ALEN * 2];
619	int i;
620	u32 tmp;
621
622	bssid = dev->wl->bssid;
623	mac = dev->wl->mac_addr;
624
625	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
626
627	memcpy(mac_bssid, mac, ETH_ALEN);
628	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
629
630	/* Write our MAC address and BSSID to template ram */
631	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
632		tmp = (u32) (mac_bssid[i + 0]);
633		tmp |= (u32) (mac_bssid[i + 1]) << 8;
634		tmp |= (u32) (mac_bssid[i + 2]) << 16;
635		tmp |= (u32) (mac_bssid[i + 3]) << 24;
636		b43_ram_write(dev, 0x20 + i, tmp);
637	}
638}
639
640static void b43_upload_card_macaddress(struct b43_wldev *dev)
641{
642	b43_write_mac_bssid_templates(dev);
643	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
644}
645
646static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
647{
648	/* slot_time is in usec. */
649	if (dev->phy.type != B43_PHYTYPE_G)
650		return;
651	b43_write16(dev, 0x684, 510 + slot_time);
652	b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
653}
654
655static void b43_short_slot_timing_enable(struct b43_wldev *dev)
656{
657	b43_set_slot_time(dev, 9);
658}
659
660static void b43_short_slot_timing_disable(struct b43_wldev *dev)
661{
662	b43_set_slot_time(dev, 20);
663}
664
665/* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
666 * Returns the _previously_ enabled IRQ mask.
667 */
668static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
669{
670	u32 old_mask;
671
672	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
673	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
674
675	return old_mask;
676}
677
678/* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
679 * Returns the _previously_ enabled IRQ mask.
680 */
681static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
682{
683	u32 old_mask;
684
685	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
686	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
687
688	return old_mask;
689}
690
691/* Synchronize IRQ top- and bottom-half.
692 * IRQs must be masked before calling this.
693 * This must not be called with the irq_lock held.
694 */
695static void b43_synchronize_irq(struct b43_wldev *dev)
696{
697	synchronize_irq(dev->dev->irq);
698	tasklet_kill(&dev->isr_tasklet);
699}
700
701/* DummyTransmission function, as documented on
702 * http://bcm-specs.sipsolutions.net/DummyTransmission
703 */
704void b43_dummy_transmission(struct b43_wldev *dev)
705{
706	struct b43_wl *wl = dev->wl;
707	struct b43_phy *phy = &dev->phy;
708	unsigned int i, max_loop;
709	u16 value;
710	u32 buffer[5] = {
711		0x00000000,
712		0x00D40000,
713		0x00000000,
714		0x01000000,
715		0x00000000,
716	};
717
718	switch (phy->type) {
719	case B43_PHYTYPE_A:
720		max_loop = 0x1E;
721		buffer[0] = 0x000201CC;
722		break;
723	case B43_PHYTYPE_B:
724	case B43_PHYTYPE_G:
725		max_loop = 0xFA;
726		buffer[0] = 0x000B846E;
727		break;
728	default:
729		B43_WARN_ON(1);
730		return;
731	}
732
733	spin_lock_irq(&wl->irq_lock);
734	write_lock(&wl->tx_lock);
735
736	for (i = 0; i < 5; i++)
737		b43_ram_write(dev, i * 4, buffer[i]);
738
739	/* Commit writes */
740	b43_read32(dev, B43_MMIO_MACCTL);
741
742	b43_write16(dev, 0x0568, 0x0000);
743	b43_write16(dev, 0x07C0, 0x0000);
744	value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
745	b43_write16(dev, 0x050C, value);
746	b43_write16(dev, 0x0508, 0x0000);
747	b43_write16(dev, 0x050A, 0x0000);
748	b43_write16(dev, 0x054C, 0x0000);
749	b43_write16(dev, 0x056A, 0x0014);
750	b43_write16(dev, 0x0568, 0x0826);
751	b43_write16(dev, 0x0500, 0x0000);
752	b43_write16(dev, 0x0502, 0x0030);
753
754	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
755		b43_radio_write16(dev, 0x0051, 0x0017);
756	for (i = 0x00; i < max_loop; i++) {
757		value = b43_read16(dev, 0x050E);
758		if (value & 0x0080)
759			break;
760		udelay(10);
761	}
762	for (i = 0x00; i < 0x0A; i++) {
763		value = b43_read16(dev, 0x050E);
764		if (value & 0x0400)
765			break;
766		udelay(10);
767	}
768	for (i = 0x00; i < 0x19; i++) {
769		value = b43_read16(dev, 0x0690);
770		if (!(value & 0x0100))
771			break;
772		udelay(10);
773	}
774	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
775		b43_radio_write16(dev, 0x0051, 0x0037);
776
777	write_unlock(&wl->tx_lock);
778	spin_unlock_irq(&wl->irq_lock);
779}
780
781static void key_write(struct b43_wldev *dev,
782		      u8 index, u8 algorithm, const u8 * key)
783{
784	unsigned int i;
785	u32 offset;
786	u16 value;
787	u16 kidx;
788
789	/* Key index/algo block */
790	kidx = b43_kidx_to_fw(dev, index);
791	value = ((kidx << 4) | algorithm);
792	b43_shm_write16(dev, B43_SHM_SHARED,
793			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
794
795	/* Write the key to the Key Table Pointer offset */
796	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
797	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
798		value = key[i];
799		value |= (u16) (key[i + 1]) << 8;
800		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
801	}
802}
803
804static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
805{
806	u32 addrtmp[2] = { 0, 0, };
807	u8 per_sta_keys_start = 8;
808
809	if (b43_new_kidx_api(dev))
810		per_sta_keys_start = 4;
811
812	B43_WARN_ON(index < per_sta_keys_start);
813	/* We have two default TX keys and possibly two default RX keys.
814	 * Physical mac 0 is mapped to physical key 4 or 8, depending
815	 * on the firmware version.
816	 * So we must adjust the index here.
817	 */
818	index -= per_sta_keys_start;
819
820	if (addr) {
821		addrtmp[0] = addr[0];
822		addrtmp[0] |= ((u32) (addr[1]) << 8);
823		addrtmp[0] |= ((u32) (addr[2]) << 16);
824		addrtmp[0] |= ((u32) (addr[3]) << 24);
825		addrtmp[1] = addr[4];
826		addrtmp[1] |= ((u32) (addr[5]) << 8);
827	}
828
829	if (dev->dev->id.revision >= 5) {
830		/* Receive match transmitter address mechanism */
831		b43_shm_write32(dev, B43_SHM_RCMTA,
832				(index * 2) + 0, addrtmp[0]);
833		b43_shm_write16(dev, B43_SHM_RCMTA,
834				(index * 2) + 1, addrtmp[1]);
835	} else {
836		/* RXE (Receive Engine) and
837		 * PSM (Programmable State Machine) mechanism
838		 */
839		if (index < 8) {
840			/* TODO write to RCM 16, 19, 22 and 25 */
841		} else {
842			b43_shm_write32(dev, B43_SHM_SHARED,
843					B43_SHM_SH_PSM + (index * 6) + 0,
844					addrtmp[0]);
845			b43_shm_write16(dev, B43_SHM_SHARED,
846					B43_SHM_SH_PSM + (index * 6) + 4,
847					addrtmp[1]);
848		}
849	}
850}
851
852static void do_key_write(struct b43_wldev *dev,
853			 u8 index, u8 algorithm,
854			 const u8 * key, size_t key_len, const u8 * mac_addr)
855{
856	u8 buf[B43_SEC_KEYSIZE] = { 0, };
857	u8 per_sta_keys_start = 8;
858
859	if (b43_new_kidx_api(dev))
860		per_sta_keys_start = 4;
861
862	B43_WARN_ON(index >= dev->max_nr_keys);
863	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
864
865	if (index >= per_sta_keys_start)
866		keymac_write(dev, index, NULL);	/* First zero out mac. */
867	if (key)
868		memcpy(buf, key, key_len);
869	key_write(dev, index, algorithm, buf);
870	if (index >= per_sta_keys_start)
871		keymac_write(dev, index, mac_addr);
872
873	dev->key[index].algorithm = algorithm;
874}
875
876static int b43_key_write(struct b43_wldev *dev,
877			 int index, u8 algorithm,
878			 const u8 * key, size_t key_len,
879			 const u8 * mac_addr,
880			 struct ieee80211_key_conf *keyconf)
881{
882	int i;
883	int sta_keys_start;
884
885	if (key_len > B43_SEC_KEYSIZE)
886		return -EINVAL;
887	for (i = 0; i < dev->max_nr_keys; i++) {
888		/* Check that we don't already have this key. */
889		B43_WARN_ON(dev->key[i].keyconf == keyconf);
890	}
891	if (index < 0) {
892		/* Pairwise key. Get an empty slot for the key. */
893		if (b43_new_kidx_api(dev))
894			sta_keys_start = 4;
895		else
896			sta_keys_start = 8;
897		for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
898			if (!dev->key[i].keyconf) {
899				/* found empty */
900				index = i;
901				break;
902			}
903		}
904		if (index < 0) {
905			b43warn(dev->wl, "Out of hardware key memory\n");
906			return -ENOSPC;
907		}
908	} else
909		B43_WARN_ON(index > 3);
910
911	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
912	if ((index <= 3) && !b43_new_kidx_api(dev)) {
913		/* Default RX key */
914		B43_WARN_ON(mac_addr);
915		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
916	}
917	keyconf->hw_key_idx = index;
918	dev->key[index].keyconf = keyconf;
919
920	return 0;
921}
922
923static int b43_key_clear(struct b43_wldev *dev, int index)
924{
925	if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
926		return -EINVAL;
927	do_key_write(dev, index, B43_SEC_ALGO_NONE,
928		     NULL, B43_SEC_KEYSIZE, NULL);
929	if ((index <= 3) && !b43_new_kidx_api(dev)) {
930		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
931			     NULL, B43_SEC_KEYSIZE, NULL);
932	}
933	dev->key[index].keyconf = NULL;
934
935	return 0;
936}
937
938static void b43_clear_keys(struct b43_wldev *dev)
939{
940	int i;
941
942	for (i = 0; i < dev->max_nr_keys; i++)
943		b43_key_clear(dev, i);
944}
945
946static void b43_dump_keymemory(struct b43_wldev *dev)
947{
948	unsigned int i, index, offset;
949	DECLARE_MAC_BUF(macbuf);
950	u8 mac[ETH_ALEN];
951	u16 algo;
952	u32 rcmta0;
953	u16 rcmta1;
954	u64 hf;
955	struct b43_key *key;
956
957	if (!b43_debug(dev, B43_DBG_KEYS))
958		return;
959
960	hf = b43_hf_read(dev);
961	b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
962	       !!(hf & B43_HF_USEDEFKEYS));
963	for (index = 0; index < dev->max_nr_keys; index++) {
964		key = &(dev->key[index]);
965		printk(KERN_DEBUG "Key slot %02u: %s",
966		       index, (key->keyconf == NULL) ? " " : "*");
967		offset = dev->ktp + (index * B43_SEC_KEYSIZE);
968		for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
969			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
970			printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
971		}
972
973		algo = b43_shm_read16(dev, B43_SHM_SHARED,
974				      B43_SHM_SH_KEYIDXBLOCK + (index * 2));
975		printk("   Algo: %04X/%02X", algo, key->algorithm);
976
977		if (index >= 4) {
978			rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
979						((index - 4) * 2) + 0);
980			rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
981						((index - 4) * 2) + 1);
982			*((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
983			*((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
984			printk("   MAC: %s",
985			       print_mac(macbuf, mac));
986		} else
987			printk("   DEFAULT KEY");
988		printk("\n");
989	}
990}
991
992void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
993{
994	u32 macctl;
995	u16 ucstat;
996	bool hwps;
997	bool awake;
998	int i;
999
1000	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1001		    (ps_flags & B43_PS_DISABLED));
1002	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1003
1004	if (ps_flags & B43_PS_ENABLED) {
1005		hwps = 1;
1006	} else if (ps_flags & B43_PS_DISABLED) {
1007		hwps = 0;
1008	} else {
1009		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1010		//      and thus is not an AP and we are associated, set bit 25
1011	}
1012	if (ps_flags & B43_PS_AWAKE) {
1013		awake = 1;
1014	} else if (ps_flags & B43_PS_ASLEEP) {
1015		awake = 0;
1016	} else {
1017		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1018		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1019		//      successful, set bit26
1020	}
1021
1022/* FIXME: For now we force awake-on and hwps-off */
1023	hwps = 0;
1024	awake = 1;
1025
1026	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1027	if (hwps)
1028		macctl |= B43_MACCTL_HWPS;
1029	else
1030		macctl &= ~B43_MACCTL_HWPS;
1031	if (awake)
1032		macctl |= B43_MACCTL_AWAKE;
1033	else
1034		macctl &= ~B43_MACCTL_AWAKE;
1035	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1036	/* Commit write */
1037	b43_read32(dev, B43_MMIO_MACCTL);
1038	if (awake && dev->dev->id.revision >= 5) {
1039		/* Wait for the microcode to wake up. */
1040		for (i = 0; i < 100; i++) {
1041			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1042						B43_SHM_SH_UCODESTAT);
1043			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1044				break;
1045			udelay(10);
1046		}
1047	}
1048}
1049
1050void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1051{
1052	u32 tmslow;
1053	u32 macctl;
1054
1055	flags |= B43_TMSLOW_PHYCLKEN;
1056	flags |= B43_TMSLOW_PHYRESET;
1057	ssb_device_enable(dev->dev, flags);
1058	msleep(2);		/* Wait for the PLL to turn on. */
1059
1060	/* Now take the PHY out of Reset again */
1061	tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1062	tmslow |= SSB_TMSLOW_FGC;
1063	tmslow &= ~B43_TMSLOW_PHYRESET;
1064	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1065	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1066	msleep(1);
1067	tmslow &= ~SSB_TMSLOW_FGC;
1068	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1069	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1070	msleep(1);
1071
1072	/* Turn Analog ON, but only if we already know the PHY-type.
1073	 * This protects against very early setup where we don't know the
1074	 * PHY-type, yet. wireless_core_reset will be called once again later,
1075	 * when we know the PHY-type. */
1076	if (dev->phy.ops)
1077		dev->phy.ops->switch_analog(dev, 1);
1078
1079	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1080	macctl &= ~B43_MACCTL_GMODE;
1081	if (flags & B43_TMSLOW_GMODE)
1082		macctl |= B43_MACCTL_GMODE;
1083	macctl |= B43_MACCTL_IHR_ENABLED;
1084	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1085}
1086
1087static void handle_irq_transmit_status(struct b43_wldev *dev)
1088{
1089	u32 v0, v1;
1090	u16 tmp;
1091	struct b43_txstatus stat;
1092
1093	while (1) {
1094		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1095		if (!(v0 & 0x00000001))
1096			break;
1097		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1098
1099		stat.cookie = (v0 >> 16);
1100		stat.seq = (v1 & 0x0000FFFF);
1101		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1102		tmp = (v0 & 0x0000FFFF);
1103		stat.frame_count = ((tmp & 0xF000) >> 12);
1104		stat.rts_count = ((tmp & 0x0F00) >> 8);
1105		stat.supp_reason = ((tmp & 0x001C) >> 2);
1106		stat.pm_indicated = !!(tmp & 0x0080);
1107		stat.intermediate = !!(tmp & 0x0040);
1108		stat.for_ampdu = !!(tmp & 0x0020);
1109		stat.acked = !!(tmp & 0x0002);
1110
1111		b43_handle_txstatus(dev, &stat);
1112	}
1113}
1114
1115static void drain_txstatus_queue(struct b43_wldev *dev)
1116{
1117	u32 dummy;
1118
1119	if (dev->dev->id.revision < 5)
1120		return;
1121	/* Read all entries from the microcode TXstatus FIFO
1122	 * and throw them away.
1123	 */
1124	while (1) {
1125		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1126		if (!(dummy & 0x00000001))
1127			break;
1128		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1129	}
1130}
1131
1132static u32 b43_jssi_read(struct b43_wldev *dev)
1133{
1134	u32 val = 0;
1135
1136	val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1137	val <<= 16;
1138	val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1139
1140	return val;
1141}
1142
1143static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1144{
1145	b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1146	b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1147}
1148
1149static void b43_generate_noise_sample(struct b43_wldev *dev)
1150{
1151	b43_jssi_write(dev, 0x7F7F7F7F);
1152	b43_write32(dev, B43_MMIO_MACCMD,
1153		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1154}
1155
1156static void b43_calculate_link_quality(struct b43_wldev *dev)
1157{
1158	/* Top half of Link Quality calculation. */
1159
1160	if (dev->phy.type != B43_PHYTYPE_G)
1161		return;
1162	if (dev->noisecalc.calculation_running)
1163		return;
1164	dev->noisecalc.calculation_running = 1;
1165	dev->noisecalc.nr_samples = 0;
1166
1167	b43_generate_noise_sample(dev);
1168}
1169
1170static void handle_irq_noise(struct b43_wldev *dev)
1171{
1172	struct b43_phy_g *phy = dev->phy.g;
1173	u16 tmp;
1174	u8 noise[4];
1175	u8 i, j;
1176	s32 average;
1177
1178	/* Bottom half of Link Quality calculation. */
1179
1180	if (dev->phy.type != B43_PHYTYPE_G)
1181		return;
1182
1183	/* Possible race condition: It might be possible that the user
1184	 * changed to a different channel in the meantime since we
1185	 * started the calculation. We ignore that fact, since it's
1186	 * not really that much of a problem. The background noise is
1187	 * an estimation only anyway. Slightly wrong results will get damped
1188	 * by the averaging of the 8 sample rounds. Additionally the
1189	 * value is shortlived. So it will be replaced by the next noise
1190	 * calculation round soon. */
1191
1192	B43_WARN_ON(!dev->noisecalc.calculation_running);
1193	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1194	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1195	    noise[2] == 0x7F || noise[3] == 0x7F)
1196		goto generate_new;
1197
1198	/* Get the noise samples. */
1199	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1200	i = dev->noisecalc.nr_samples;
1201	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1202	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1203	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1204	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1205	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1206	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1207	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1208	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1209	dev->noisecalc.nr_samples++;
1210	if (dev->noisecalc.nr_samples == 8) {
1211		/* Calculate the Link Quality by the noise samples. */
1212		average = 0;
1213		for (i = 0; i < 8; i++) {
1214			for (j = 0; j < 4; j++)
1215				average += dev->noisecalc.samples[i][j];
1216		}
1217		average /= (8 * 4);
1218		average *= 125;
1219		average += 64;
1220		average /= 128;
1221		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1222		tmp = (tmp / 128) & 0x1F;
1223		if (tmp >= 8)
1224			average += 2;
1225		else
1226			average -= 25;
1227		if (tmp == 8)
1228			average -= 72;
1229		else
1230			average -= 48;
1231
1232		dev->stats.link_noise = average;
1233		dev->noisecalc.calculation_running = 0;
1234		return;
1235	}
1236generate_new:
1237	b43_generate_noise_sample(dev);
1238}
1239
1240static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1241{
1242	if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1243		///TODO: PS TBTT
1244	} else {
1245		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1246			b43_power_saving_ctl_bits(dev, 0);
1247	}
1248	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1249		dev->dfq_valid = 1;
1250}
1251
1252static void handle_irq_atim_end(struct b43_wldev *dev)
1253{
1254	if (dev->dfq_valid) {
1255		b43_write32(dev, B43_MMIO_MACCMD,
1256			    b43_read32(dev, B43_MMIO_MACCMD)
1257			    | B43_MACCMD_DFQ_VALID);
1258		dev->dfq_valid = 0;
1259	}
1260}
1261
1262static void handle_irq_pmq(struct b43_wldev *dev)
1263{
1264	u32 tmp;
1265
1266	//TODO: AP mode.
1267
1268	while (1) {
1269		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1270		if (!(tmp & 0x00000008))
1271			break;
1272	}
1273	/* 16bit write is odd, but correct. */
1274	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1275}
1276
1277static void b43_write_template_common(struct b43_wldev *dev,
1278				      const u8 * data, u16 size,
1279				      u16 ram_offset,
1280				      u16 shm_size_offset, u8 rate)
1281{
1282	u32 i, tmp;
1283	struct b43_plcp_hdr4 plcp;
1284
1285	plcp.data = 0;
1286	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1287	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1288	ram_offset += sizeof(u32);
1289	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1290	 * So leave the first two bytes of the next write blank.
1291	 */
1292	tmp = (u32) (data[0]) << 16;
1293	tmp |= (u32) (data[1]) << 24;
1294	b43_ram_write(dev, ram_offset, tmp);
1295	ram_offset += sizeof(u32);
1296	for (i = 2; i < size; i += sizeof(u32)) {
1297		tmp = (u32) (data[i + 0]);
1298		if (i + 1 < size)
1299			tmp |= (u32) (data[i + 1]) << 8;
1300		if (i + 2 < size)
1301			tmp |= (u32) (data[i + 2]) << 16;
1302		if (i + 3 < size)
1303			tmp |= (u32) (data[i + 3]) << 24;
1304		b43_ram_write(dev, ram_offset + i - 2, tmp);
1305	}
1306	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1307			size + sizeof(struct b43_plcp_hdr6));
1308}
1309
1310/* Check if the use of the antenna that ieee80211 told us to
1311 * use is possible. This will fall back to DEFAULT.
1312 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1313u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1314				  u8 antenna_nr)
1315{
1316	u8 antenna_mask;
1317
1318	if (antenna_nr == 0) {
1319		/* Zero means "use default antenna". That's always OK. */
1320		return 0;
1321	}
1322
1323	/* Get the mask of available antennas. */
1324	if (dev->phy.gmode)
1325		antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1326	else
1327		antenna_mask = dev->dev->bus->sprom.ant_available_a;
1328
1329	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1330		/* This antenna is not available. Fall back to default. */
1331		return 0;
1332	}
1333
1334	return antenna_nr;
1335}
1336
1337/* Convert a b43 antenna number value to the PHY TX control value. */
1338static u16 b43_antenna_to_phyctl(int antenna)
1339{
1340	switch (antenna) {
1341	case B43_ANTENNA0:
1342		return B43_TXH_PHY_ANT0;
1343	case B43_ANTENNA1:
1344		return B43_TXH_PHY_ANT1;
1345	case B43_ANTENNA2:
1346		return B43_TXH_PHY_ANT2;
1347	case B43_ANTENNA3:
1348		return B43_TXH_PHY_ANT3;
1349	case B43_ANTENNA_AUTO:
1350		return B43_TXH_PHY_ANT01AUTO;
1351	}
1352	B43_WARN_ON(1);
1353	return 0;
1354}
1355
1356static void b43_write_beacon_template(struct b43_wldev *dev,
1357				      u16 ram_offset,
1358				      u16 shm_size_offset)
1359{
1360	unsigned int i, len, variable_len;
1361	const struct ieee80211_mgmt *bcn;
1362	const u8 *ie;
1363	bool tim_found = 0;
1364	unsigned int rate;
1365	u16 ctl;
1366	int antenna;
1367	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1368
1369	bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1370	len = min((size_t) dev->wl->current_beacon->len,
1371		  0x200 - sizeof(struct b43_plcp_hdr6));
1372	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1373
1374	b43_write_template_common(dev, (const u8 *)bcn,
1375				  len, ram_offset, shm_size_offset, rate);
1376
1377	/* Write the PHY TX control parameters. */
1378	antenna = B43_ANTENNA_DEFAULT;
1379	antenna = b43_antenna_to_phyctl(antenna);
1380	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1381	/* We can't send beacons with short preamble. Would get PHY errors. */
1382	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1383	ctl &= ~B43_TXH_PHY_ANT;
1384	ctl &= ~B43_TXH_PHY_ENC;
1385	ctl |= antenna;
1386	if (b43_is_cck_rate(rate))
1387		ctl |= B43_TXH_PHY_ENC_CCK;
1388	else
1389		ctl |= B43_TXH_PHY_ENC_OFDM;
1390	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1391
1392	/* Find the position of the TIM and the DTIM_period value
1393	 * and write them to SHM. */
1394	ie = bcn->u.beacon.variable;
1395	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1396	for (i = 0; i < variable_len - 2; ) {
1397		uint8_t ie_id, ie_len;
1398
1399		ie_id = ie[i];
1400		ie_len = ie[i + 1];
1401		if (ie_id == 5) {
1402			u16 tim_position;
1403			u16 dtim_period;
1404			/* This is the TIM Information Element */
1405
1406			/* Check whether the ie_len is in the beacon data range. */
1407			if (variable_len < ie_len + 2 + i)
1408				break;
1409			/* A valid TIM is at least 4 bytes long. */
1410			if (ie_len < 4)
1411				break;
1412			tim_found = 1;
1413
1414			tim_position = sizeof(struct b43_plcp_hdr6);
1415			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1416			tim_position += i;
1417
1418			dtim_period = ie[i + 3];
1419
1420			b43_shm_write16(dev, B43_SHM_SHARED,
1421					B43_SHM_SH_TIMBPOS, tim_position);
1422			b43_shm_write16(dev, B43_SHM_SHARED,
1423					B43_SHM_SH_DTIMPER, dtim_period);
1424			break;
1425		}
1426		i += ie_len + 2;
1427	}
1428	if (!tim_found) {
1429		/*
1430		 * If ucode wants to modify TIM do it behind the beacon, this
1431		 * will happen, for example, when doing mesh networking.
1432		 */
1433		b43_shm_write16(dev, B43_SHM_SHARED,
1434				B43_SHM_SH_TIMBPOS,
1435				len + sizeof(struct b43_plcp_hdr6));
1436		b43_shm_write16(dev, B43_SHM_SHARED,
1437				B43_SHM_SH_DTIMPER, 0);
1438	}
1439	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1440}
1441
1442static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1443				      u16 shm_offset, u16 size,
1444				      struct ieee80211_rate *rate)
1445{
1446	struct b43_plcp_hdr4 plcp;
1447	u32 tmp;
1448	__le16 dur;
1449
1450	plcp.data = 0;
1451	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1452	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1453					       dev->wl->vif, size,
1454					       rate);
1455	/* Write PLCP in two parts and timing for packet transfer */
1456	tmp = le32_to_cpu(plcp.data);
1457	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1458	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1459	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1460}
1461
1462/* Instead of using custom probe response template, this function
1463 * just patches custom beacon template by:
1464 * 1) Changing packet type
1465 * 2) Patching duration field
1466 * 3) Stripping TIM
1467 */
1468static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1469					  u16 *dest_size,
1470					  struct ieee80211_rate *rate)
1471{
1472	const u8 *src_data;
1473	u8 *dest_data;
1474	u16 src_size, elem_size, src_pos, dest_pos;
1475	__le16 dur;
1476	struct ieee80211_hdr *hdr;
1477	size_t ie_start;
1478
1479	src_size = dev->wl->current_beacon->len;
1480	src_data = (const u8 *)dev->wl->current_beacon->data;
1481
1482	/* Get the start offset of the variable IEs in the packet. */
1483	ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1484	B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1485
1486	if (B43_WARN_ON(src_size < ie_start))
1487		return NULL;
1488
1489	dest_data = kmalloc(src_size, GFP_ATOMIC);
1490	if (unlikely(!dest_data))
1491		return NULL;
1492
1493	/* Copy the static data and all Information Elements, except the TIM. */
1494	memcpy(dest_data, src_data, ie_start);
1495	src_pos = ie_start;
1496	dest_pos = ie_start;
1497	for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1498		elem_size = src_data[src_pos + 1] + 2;
1499		if (src_data[src_pos] == 5) {
1500			/* This is the TIM. */
1501			continue;
1502		}
1503		memcpy(dest_data + dest_pos, src_data + src_pos,
1504		       elem_size);
1505		dest_pos += elem_size;
1506	}
1507	*dest_size = dest_pos;
1508	hdr = (struct ieee80211_hdr *)dest_data;
1509
1510	/* Set the frame control. */
1511	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1512					 IEEE80211_STYPE_PROBE_RESP);
1513	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1514					       dev->wl->vif, *dest_size,
1515					       rate);
1516	hdr->duration_id = dur;
1517
1518	return dest_data;
1519}
1520
1521static void b43_write_probe_resp_template(struct b43_wldev *dev,
1522					  u16 ram_offset,
1523					  u16 shm_size_offset,
1524					  struct ieee80211_rate *rate)
1525{
1526	const u8 *probe_resp_data;
1527	u16 size;
1528
1529	size = dev->wl->current_beacon->len;
1530	probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1531	if (unlikely(!probe_resp_data))
1532		return;
1533
1534	/* Looks like PLCP headers plus packet timings are stored for
1535	 * all possible basic rates
1536	 */
1537	b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1538	b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1539	b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1540	b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1541
1542	size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1543	b43_write_template_common(dev, probe_resp_data,
1544				  size, ram_offset, shm_size_offset,
1545				  rate->hw_value);
1546	kfree(probe_resp_data);
1547}
1548
1549static void b43_upload_beacon0(struct b43_wldev *dev)
1550{
1551	struct b43_wl *wl = dev->wl;
1552
1553	if (wl->beacon0_uploaded)
1554		return;
1555	b43_write_beacon_template(dev, 0x68, 0x18);
1556	/* FIXME: Probe resp upload doesn't really belong here,
1557	 *        but we don't use that feature anyway. */
1558	b43_write_probe_resp_template(dev, 0x268, 0x4A,
1559				      &__b43_ratetable[3]);
1560	wl->beacon0_uploaded = 1;
1561}
1562
1563static void b43_upload_beacon1(struct b43_wldev *dev)
1564{
1565	struct b43_wl *wl = dev->wl;
1566
1567	if (wl->beacon1_uploaded)
1568		return;
1569	b43_write_beacon_template(dev, 0x468, 0x1A);
1570	wl->beacon1_uploaded = 1;
1571}
1572
1573static void handle_irq_beacon(struct b43_wldev *dev)
1574{
1575	struct b43_wl *wl = dev->wl;
1576	u32 cmd, beacon0_valid, beacon1_valid;
1577
1578	if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1579	    !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1580		return;
1581
1582	/* This is the bottom half of the asynchronous beacon update. */
1583
1584	/* Ignore interrupt in the future. */
1585	dev->irq_savedstate &= ~B43_IRQ_BEACON;
1586
1587	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1588	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1589	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1590
1591	/* Schedule interrupt manually, if busy. */
1592	if (beacon0_valid && beacon1_valid) {
1593		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1594		dev->irq_savedstate |= B43_IRQ_BEACON;
1595		return;
1596	}
1597
1598	if (unlikely(wl->beacon_templates_virgin)) {
1599		/* We never uploaded a beacon before.
1600		 * Upload both templates now, but only mark one valid. */
1601		wl->beacon_templates_virgin = 0;
1602		b43_upload_beacon0(dev);
1603		b43_upload_beacon1(dev);
1604		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1605		cmd |= B43_MACCMD_BEACON0_VALID;
1606		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1607	} else {
1608		if (!beacon0_valid) {
1609			b43_upload_beacon0(dev);
1610			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1611			cmd |= B43_MACCMD_BEACON0_VALID;
1612			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1613		} else if (!beacon1_valid) {
1614			b43_upload_beacon1(dev);
1615			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1616			cmd |= B43_MACCMD_BEACON1_VALID;
1617			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1618		}
1619	}
1620}
1621
1622static void b43_beacon_update_trigger_work(struct work_struct *work)
1623{
1624	struct b43_wl *wl = container_of(work, struct b43_wl,
1625					 beacon_update_trigger);
1626	struct b43_wldev *dev;
1627
1628	mutex_lock(&wl->mutex);
1629	dev = wl->current_dev;
1630	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1631		spin_lock_irq(&wl->irq_lock);
1632		/* update beacon right away or defer to irq */
1633		dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1634		handle_irq_beacon(dev);
1635		/* The handler might have updated the IRQ mask. */
1636		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1637			    dev->irq_savedstate);
1638		mmiowb();
1639		spin_unlock_irq(&wl->irq_lock);
1640	}
1641	mutex_unlock(&wl->mutex);
1642}
1643
1644/* Asynchronously update the packet templates in template RAM.
1645 * Locking: Requires wl->irq_lock to be locked. */
1646static void b43_update_templates(struct b43_wl *wl)
1647{
1648	struct sk_buff *beacon;
1649
1650	/* This is the top half of the ansynchronous beacon update.
1651	 * The bottom half is the beacon IRQ.
1652	 * Beacon update must be asynchronous to avoid sending an
1653	 * invalid beacon. This can happen for example, if the firmware
1654	 * transmits a beacon while we are updating it. */
1655
1656	/* We could modify the existing beacon and set the aid bit in
1657	 * the TIM field, but that would probably require resizing and
1658	 * moving of data within the beacon template.
1659	 * Simply request a new beacon and let mac80211 do the hard work. */
1660	beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1661	if (unlikely(!beacon))
1662		return;
1663
1664	if (wl->current_beacon)
1665		dev_kfree_skb_any(wl->current_beacon);
1666	wl->current_beacon = beacon;
1667	wl->beacon0_uploaded = 0;
1668	wl->beacon1_uploaded = 0;
1669	queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1670}
1671
1672static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1673{
1674	b43_time_lock(dev);
1675	if (dev->dev->id.revision >= 3) {
1676		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1677		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1678	} else {
1679		b43_write16(dev, 0x606, (beacon_int >> 6));
1680		b43_write16(dev, 0x610, beacon_int);
1681	}
1682	b43_time_unlock(dev);
1683	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1684}
1685
1686static void b43_handle_firmware_panic(struct b43_wldev *dev)
1687{
1688	u16 reason;
1689
1690	/* Read the register that contains the reason code for the panic. */
1691	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1692	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1693
1694	switch (reason) {
1695	default:
1696		b43dbg(dev->wl, "The panic reason is unknown.\n");
1697		/* fallthrough */
1698	case B43_FWPANIC_DIE:
1699		/* Do not restart the controller or firmware.
1700		 * The device is nonfunctional from now on.
1701		 * Restarting would result in this panic to trigger again,
1702		 * so we avoid that recursion. */
1703		break;
1704	case B43_FWPANIC_RESTART:
1705		b43_controller_restart(dev, "Microcode panic");
1706		break;
1707	}
1708}
1709
1710static void handle_irq_ucode_debug(struct b43_wldev *dev)
1711{
1712	unsigned int i, cnt;
1713	u16 reason, marker_id, marker_line;
1714	__le16 *buf;
1715
1716	/* The proprietary firmware doesn't have this IRQ. */
1717	if (!dev->fw.opensource)
1718		return;
1719
1720	/* Read the register that contains the reason code for this IRQ. */
1721	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1722
1723	switch (reason) {
1724	case B43_DEBUGIRQ_PANIC:
1725		b43_handle_firmware_panic(dev);
1726		break;
1727	case B43_DEBUGIRQ_DUMP_SHM:
1728		if (!B43_DEBUG)
1729			break; /* Only with driver debugging enabled. */
1730		buf = kmalloc(4096, GFP_ATOMIC);
1731		if (!buf) {
1732			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1733			goto out;
1734		}
1735		for (i = 0; i < 4096; i += 2) {
1736			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1737			buf[i / 2] = cpu_to_le16(tmp);
1738		}
1739		b43info(dev->wl, "Shared memory dump:\n");
1740		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1741			       16, 2, buf, 4096, 1);
1742		kfree(buf);
1743		break;
1744	case B43_DEBUGIRQ_DUMP_REGS:
1745		if (!B43_DEBUG)
1746			break; /* Only with driver debugging enabled. */
1747		b43info(dev->wl, "Microcode register dump:\n");
1748		for (i = 0, cnt = 0; i < 64; i++) {
1749			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1750			if (cnt == 0)
1751				printk(KERN_INFO);
1752			printk("r%02u: 0x%04X  ", i, tmp);
1753			cnt++;
1754			if (cnt == 6) {
1755				printk("\n");
1756				cnt = 0;
1757			}
1758		}
1759		printk("\n");
1760		break;
1761	case B43_DEBUGIRQ_MARKER:
1762		if (!B43_DEBUG)
1763			break; /* Only with driver debugging enabled. */
1764		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1765					   B43_MARKER_ID_REG);
1766		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1767					     B43_MARKER_LINE_REG);
1768		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1769			"at line number %u\n",
1770			marker_id, marker_line);
1771		break;
1772	default:
1773		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1774		       reason);
1775	}
1776out:
1777	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1778	b43_shm_write16(dev, B43_SHM_SCRATCH,
1779			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1780}
1781
1782/* Interrupt handler bottom-half */
1783static void b43_interrupt_tasklet(struct b43_wldev *dev)
1784{
1785	u32 reason;
1786	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1787	u32 merged_dma_reason = 0;
1788	int i;
1789	unsigned long flags;
1790
1791	spin_lock_irqsave(&dev->wl->irq_lock, flags);
1792
1793	B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1794
1795	reason = dev->irq_reason;
1796	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1797		dma_reason[i] = dev->dma_reason[i];
1798		merged_dma_reason |= dma_reason[i];
1799	}
1800
1801	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1802		b43err(dev->wl, "MAC transmission error\n");
1803
1804	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1805		b43err(dev->wl, "PHY transmission error\n");
1806		rmb();
1807		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1808			atomic_set(&dev->phy.txerr_cnt,
1809				   B43_PHY_TX_BADNESS_LIMIT);
1810			b43err(dev->wl, "Too many PHY TX errors, "
1811					"restarting the controller\n");
1812			b43_controller_restart(dev, "PHY TX errors");
1813		}
1814	}
1815
1816	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1817					  B43_DMAIRQ_NONFATALMASK))) {
1818		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1819			b43err(dev->wl, "Fatal DMA error: "
1820			       "0x%08X, 0x%08X, 0x%08X, "
1821			       "0x%08X, 0x%08X, 0x%08X\n",
1822			       dma_reason[0], dma_reason[1],
1823			       dma_reason[2], dma_reason[3],
1824			       dma_reason[4], dma_reason[5]);
1825			b43_controller_restart(dev, "DMA error");
1826			mmiowb();
1827			spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1828			return;
1829		}
1830		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1831			b43err(dev->wl, "DMA error: "
1832			       "0x%08X, 0x%08X, 0x%08X, "
1833			       "0x%08X, 0x%08X, 0x%08X\n",
1834			       dma_reason[0], dma_reason[1],
1835			       dma_reason[2], dma_reason[3],
1836			       dma_reason[4], dma_reason[5]);
1837		}
1838	}
1839
1840	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1841		handle_irq_ucode_debug(dev);
1842	if (reason & B43_IRQ_TBTT_INDI)
1843		handle_irq_tbtt_indication(dev);
1844	if (reason & B43_IRQ_ATIM_END)
1845		handle_irq_atim_end(dev);
1846	if (reason & B43_IRQ_BEACON)
1847		handle_irq_beacon(dev);
1848	if (reason & B43_IRQ_PMQ)
1849		handle_irq_pmq(dev);
1850	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1851		;/* TODO */
1852	if (reason & B43_IRQ_NOISESAMPLE_OK)
1853		handle_irq_noise(dev);
1854
1855	/* Check the DMA reason registers for received data. */
1856	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1857		if (b43_using_pio_transfers(dev))
1858			b43_pio_rx(dev->pio.rx_queue);
1859		else
1860			b43_dma_rx(dev->dma.rx_ring);
1861	}
1862	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1863	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1864	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1865	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1866	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1867
1868	if (reason & B43_IRQ_TX_OK)
1869		handle_irq_transmit_status(dev);
1870
1871	b43_interrupt_enable(dev, dev->irq_savedstate);
1872	mmiowb();
1873	spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1874}
1875
1876static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1877{
1878	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1879
1880	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1881	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1882	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1883	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1884	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1885	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1886}
1887
1888/* Interrupt handler top-half */
1889static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1890{
1891	irqreturn_t ret = IRQ_NONE;
1892	struct b43_wldev *dev = dev_id;
1893	u32 reason;
1894
1895	if (!dev)
1896		return IRQ_NONE;
1897
1898	spin_lock(&dev->wl->irq_lock);
1899
1900	if (b43_status(dev) < B43_STAT_STARTED)
1901		goto out;
1902	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1903	if (reason == 0xffffffff)	/* shared IRQ */
1904		goto out;
1905	ret = IRQ_HANDLED;
1906	reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1907	if (!reason)
1908		goto out;
1909
1910	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1911	    & 0x0001DC00;
1912	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1913	    & 0x0000DC00;
1914	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1915	    & 0x0000DC00;
1916	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1917	    & 0x0001DC00;
1918	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1919	    & 0x0000DC00;
1920	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1921	    & 0x0000DC00;
1922
1923	b43_interrupt_ack(dev, reason);
1924	/* disable all IRQs. They are enabled again in the bottom half. */
1925	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1926	/* save the reason code and call our bottom half. */
1927	dev->irq_reason = reason;
1928	tasklet_schedule(&dev->isr_tasklet);
1929      out:
1930	mmiowb();
1931	spin_unlock(&dev->wl->irq_lock);
1932
1933	return ret;
1934}
1935
1936static void do_release_fw(struct b43_firmware_file *fw)
1937{
1938	release_firmware(fw->data);
1939	fw->data = NULL;
1940	fw->filename = NULL;
1941}
1942
1943static void b43_release_firmware(struct b43_wldev *dev)
1944{
1945	do_release_fw(&dev->fw.ucode);
1946	do_release_fw(&dev->fw.pcm);
1947	do_release_fw(&dev->fw.initvals);
1948	do_release_fw(&dev->fw.initvals_band);
1949}
1950
1951static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1952{
1953	const char *text;
1954
1955	text = "You must go to "
1956	       "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1957	       "and download the latest firmware (version 4).\n";
1958	if (error)
1959		b43err(wl, text);
1960	else
1961		b43warn(wl, text);
1962}
1963
1964static int do_request_fw(struct b43_wldev *dev,
1965			 const char *name,
1966			 struct b43_firmware_file *fw,
1967			 bool silent)
1968{
1969	char path[sizeof(modparam_fwpostfix) + 32];
1970	const struct firmware *blob;
1971	struct b43_fw_header *hdr;
1972	u32 size;
1973	int err;
1974
1975	if (!name) {
1976		/* Don't fetch anything. Free possibly cached firmware. */
1977		do_release_fw(fw);
1978		return 0;
1979	}
1980	if (fw->filename) {
1981		if (strcmp(fw->filename, name) == 0)
1982			return 0; /* Already have this fw. */
1983		/* Free the cached firmware first. */
1984		do_release_fw(fw);
1985	}
1986
1987	snprintf(path, ARRAY_SIZE(path),
1988		 "b43%s/%s.fw",
1989		 modparam_fwpostfix, name);
1990	err = request_firmware(&blob, path, dev->dev->dev);
1991	if (err == -ENOENT) {
1992		if (!silent) {
1993			b43err(dev->wl, "Firmware file \"%s\" not found\n",
1994			       path);
1995		}
1996		return err;
1997	} else if (err) {
1998		b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
1999		       path, err);
2000		return err;
2001	}
2002	if (blob->size < sizeof(struct b43_fw_header))
2003		goto err_format;
2004	hdr = (struct b43_fw_header *)(blob->data);
2005	switch (hdr->type) {
2006	case B43_FW_TYPE_UCODE:
2007	case B43_FW_TYPE_PCM:
2008		size = be32_to_cpu(hdr->size);
2009		if (size != blob->size - sizeof(struct b43_fw_header))
2010			goto err_format;
2011		/* fallthrough */
2012	case B43_FW_TYPE_IV:
2013		if (hdr->ver != 1)
2014			goto err_format;
2015		break;
2016	default:
2017		goto err_format;
2018	}
2019
2020	fw->data = blob;
2021	fw->filename = name;
2022
2023	return 0;
2024
2025err_format:
2026	b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2027	release_firmware(blob);
2028
2029	return -EPROTO;
2030}
2031
2032static int b43_request_firmware(struct b43_wldev *dev)
2033{
2034	struct b43_firmware *fw = &dev->fw;
2035	const u8 rev = dev->dev->id.revision;
2036	const char *filename;
2037	u32 tmshigh;
2038	int err;
2039
2040	/* Get microcode */
2041	tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2042	if ((rev >= 5) && (rev <= 10))
2043		filename = "ucode5";
2044	else if ((rev >= 11) && (rev <= 12))
2045		filename = "ucode11";
2046	else if (rev >= 13)
2047		filename = "ucode13";
2048	else
2049		goto err_no_ucode;
2050	err = do_request_fw(dev, filename, &fw->ucode, 0);
2051	if (err)
2052		goto err_load;
2053
2054	/* Get PCM code */
2055	if ((rev >= 5) && (rev <= 10))
2056		filename = "pcm5";
2057	else if (rev >= 11)
2058		filename = NULL;
2059	else
2060		goto err_no_pcm;
2061	fw->pcm_request_failed = 0;
2062	err = do_request_fw(dev, filename, &fw->pcm, 1);
2063	if (err == -ENOENT) {
2064		/* We did not find a PCM file? Not fatal, but
2065		 * core rev <= 10 must do without hwcrypto then. */
2066		fw->pcm_request_failed = 1;
2067	} else if (err)
2068		goto err_load;
2069
2070	/* Get initvals */
2071	switch (dev->phy.type) {
2072	case B43_PHYTYPE_A:
2073		if ((rev >= 5) && (rev <= 10)) {
2074			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2075				filename = "a0g1initvals5";
2076			else
2077				filename = "a0g0initvals5";
2078		} else
2079			goto err_no_initvals;
2080		break;
2081	case B43_PHYTYPE_G:
2082		if ((rev >= 5) && (rev <= 10))
2083			filename = "b0g0initvals5";
2084		else if (rev >= 13)
2085			filename = "b0g0initvals13";
2086		else
2087			goto err_no_initvals;
2088		break;
2089	case B43_PHYTYPE_N:
2090		if ((rev >= 11) && (rev <= 12))
2091			filename = "n0initvals11";
2092		else
2093			goto err_no_initvals;
2094		break;
2095	default:
2096		goto err_no_initvals;
2097	}
2098	err = do_request_fw(dev, filename, &fw->initvals, 0);
2099	if (err)
2100		goto err_load;
2101
2102	/* Get bandswitch initvals */
2103	switch (dev->phy.type) {
2104	case B43_PHYTYPE_A:
2105		if ((rev >= 5) && (rev <= 10)) {
2106			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2107				filename = "a0g1bsinitvals5";
2108			else
2109				filename = "a0g0bsinitvals5";
2110		} else if (rev >= 11)
2111			filename = NULL;
2112		else
2113			goto err_no_initvals;
2114		break;
2115	case B43_PHYTYPE_G:
2116		if ((rev >= 5) && (rev <= 10))
2117			filename = "b0g0bsinitvals5";
2118		else if (rev >= 11)
2119			filename = NULL;
2120		else
2121			goto err_no_initvals;
2122		break;
2123	case B43_PHYTYPE_N:
2124		if ((rev >= 11) && (rev <= 12))
2125			filename = "n0bsinitvals11";
2126		else
2127			goto err_no_initvals;
2128		break;
2129	default:
2130		goto err_no_initvals;
2131	}
2132	err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2133	if (err)
2134		goto err_load;
2135
2136	return 0;
2137
2138err_load:
2139	b43_print_fw_helptext(dev->wl, 1);
2140	goto error;
2141
2142err_no_ucode:
2143	err = -ENODEV;
2144	b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2145	goto error;
2146
2147err_no_pcm:
2148	err = -ENODEV;
2149	b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2150	goto error;
2151
2152err_no_initvals:
2153	err = -ENODEV;
2154	b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2155	       "core rev %u\n", dev->phy.type, rev);
2156	goto error;
2157
2158error:
2159	b43_release_firmware(dev);
2160	return err;
2161}
2162
2163static int b43_upload_microcode(struct b43_wldev *dev)
2164{
2165	const size_t hdr_len = sizeof(struct b43_fw_header);
2166	const __be32 *data;
2167	unsigned int i, len;
2168	u16 fwrev, fwpatch, fwdate, fwtime;
2169	u32 tmp, macctl;
2170	int err = 0;
2171
2172	/* Jump the microcode PSM to offset 0 */
2173	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2174	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2175	macctl |= B43_MACCTL_PSM_JMP0;
2176	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2177	/* Zero out all microcode PSM registers and shared memory. */
2178	for (i = 0; i < 64; i++)
2179		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2180	for (i = 0; i < 4096; i += 2)
2181		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2182
2183	/* Upload Microcode. */
2184	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2185	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2186	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2187	for (i = 0; i < len; i++) {
2188		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2189		udelay(10);
2190	}
2191
2192	if (dev->fw.pcm.data) {
2193		/* Upload PCM data. */
2194		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2195		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2196		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2197		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2198		/* No need for autoinc bit in SHM_HW */
2199		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2200		for (i = 0; i < len; i++) {
2201			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2202			udelay(10);
2203		}
2204	}
2205
2206	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2207
2208	/* Start the microcode PSM */
2209	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2210	macctl &= ~B43_MACCTL_PSM_JMP0;
2211	macctl |= B43_MACCTL_PSM_RUN;
2212	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2213
2214	/* Wait for the microcode to load and respond */
2215	i = 0;
2216	while (1) {
2217		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2218		if (tmp == B43_IRQ_MAC_SUSPENDED)
2219			break;
2220		i++;
2221		if (i >= 20) {
2222			b43err(dev->wl, "Microcode not responding\n");
2223			b43_print_fw_helptext(dev->wl, 1);
2224			err = -ENODEV;
2225			goto error;
2226		}
2227		msleep_interruptible(50);
2228		if (signal_pending(current)) {
2229			err = -EINTR;
2230			goto error;
2231		}
2232	}
2233	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2234
2235	/* Get and check the revisions. */
2236	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2237	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2238	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2239	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2240
2241	if (fwrev <= 0x128) {
2242		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2243		       "binary drivers older than version 4.x is unsupported. "
2244		       "You must upgrade your firmware files.\n");
2245		b43_print_fw_helptext(dev->wl, 1);
2246		err = -EOPNOTSUPP;
2247		goto error;
2248	}
2249	dev->fw.rev = fwrev;
2250	dev->fw.patch = fwpatch;
2251	dev->fw.opensource = (fwdate == 0xFFFF);
2252
2253	if (dev->fw.opensource) {
2254		/* Patchlevel info is encoded in the "time" field. */
2255		dev->fw.patch = fwtime;
2256		b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2257			dev->fw.rev, dev->fw.patch,
2258			dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2259	} else {
2260		b43info(dev->wl, "Loading firmware version %u.%u "
2261			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2262			fwrev, fwpatch,
2263			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2264			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2265		if (dev->fw.pcm_request_failed) {
2266			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2267				"Hardware accelerated cryptography is disabled.\n");
2268			b43_print_fw_helptext(dev->wl, 0);
2269		}
2270	}
2271
2272	if (b43_is_old_txhdr_format(dev)) {
2273		b43warn(dev->wl, "You are using an old firmware image. "
2274			"Support for old firmware will be removed in July 2008.\n");
2275		b43_print_fw_helptext(dev->wl, 0);
2276	}
2277
2278	return 0;
2279
2280error:
2281	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2282	macctl &= ~B43_MACCTL_PSM_RUN;
2283	macctl |= B43_MACCTL_PSM_JMP0;
2284	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2285
2286	return err;
2287}
2288
2289static int b43_write_initvals(struct b43_wldev *dev,
2290			      const struct b43_iv *ivals,
2291			      size_t count,
2292			      size_t array_size)
2293{
2294	const struct b43_iv *iv;
2295	u16 offset;
2296	size_t i;
2297	bool bit32;
2298
2299	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2300	iv = ivals;
2301	for (i = 0; i < count; i++) {
2302		if (array_size < sizeof(iv->offset_size))
2303			goto err_format;
2304		array_size -= sizeof(iv->offset_size);
2305		offset = be16_to_cpu(iv->offset_size);
2306		bit32 = !!(offset & B43_IV_32BIT);
2307		offset &= B43_IV_OFFSET_MASK;
2308		if (offset >= 0x1000)
2309			goto err_format;
2310		if (bit32) {
2311			u32 value;
2312
2313			if (array_size < sizeof(iv->data.d32))
2314				goto err_format;
2315			array_size -= sizeof(iv->data.d32);
2316
2317			value = get_unaligned_be32(&iv->data.d32);
2318			b43_write32(dev, offset, value);
2319
2320			iv = (const struct b43_iv *)((const uint8_t *)iv +
2321							sizeof(__be16) +
2322							sizeof(__be32));
2323		} else {
2324			u16 value;
2325
2326			if (array_size < sizeof(iv->data.d16))
2327				goto err_format;
2328			array_size -= sizeof(iv->data.d16);
2329
2330			value = be16_to_cpu(iv->data.d16);
2331			b43_write16(dev, offset, value);
2332
2333			iv = (const struct b43_iv *)((const uint8_t *)iv +
2334							sizeof(__be16) +
2335							sizeof(__be16));
2336		}
2337	}
2338	if (array_size)
2339		goto err_format;
2340
2341	return 0;
2342
2343err_format:
2344	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2345	b43_print_fw_helptext(dev->wl, 1);
2346
2347	return -EPROTO;
2348}
2349
2350static int b43_upload_initvals(struct b43_wldev *dev)
2351{
2352	const size_t hdr_len = sizeof(struct b43_fw_header);
2353	const struct b43_fw_header *hdr;
2354	struct b43_firmware *fw = &dev->fw;
2355	const struct b43_iv *ivals;
2356	size_t count;
2357	int err;
2358
2359	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2360	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2361	count = be32_to_cpu(hdr->size);
2362	err = b43_write_initvals(dev, ivals, count,
2363				 fw->initvals.data->size - hdr_len);
2364	if (err)
2365		goto out;
2366	if (fw->initvals_band.data) {
2367		hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2368		ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2369		count = be32_to_cpu(hdr->size);
2370		err = b43_write_initvals(dev, ivals, count,
2371					 fw->initvals_band.data->size - hdr_len);
2372		if (err)
2373			goto out;
2374	}
2375out:
2376
2377	return err;
2378}
2379
2380/* Initialize the GPIOs
2381 * http://bcm-specs.sipsolutions.net/GPIO
2382 */
2383static int b43_gpio_init(struct b43_wldev *dev)
2384{
2385	struct ssb_bus *bus = dev->dev->bus;
2386	struct ssb_device *gpiodev, *pcidev = NULL;
2387	u32 mask, set;
2388
2389	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2390		    & ~B43_MACCTL_GPOUTSMSK);
2391
2392	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2393		    | 0x000F);
2394
2395	mask = 0x0000001F;
2396	set = 0x0000000F;
2397	if (dev->dev->bus->chip_id == 0x4301) {
2398		mask |= 0x0060;
2399		set |= 0x0060;
2400	}
2401	if (0 /* FIXME: conditional unknown */ ) {
2402		b43_write16(dev, B43_MMIO_GPIO_MASK,
2403			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2404			    | 0x0100);
2405		mask |= 0x0180;
2406		set |= 0x0180;
2407	}
2408	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2409		b43_write16(dev, B43_MMIO_GPIO_MASK,
2410			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2411			    | 0x0200);
2412		mask |= 0x0200;
2413		set |= 0x0200;
2414	}
2415	if (dev->dev->id.revision >= 2)
2416		mask |= 0x0010;	/* FIXME: This is redundant. */
2417
2418#ifdef CONFIG_SSB_DRIVER_PCICORE
2419	pcidev = bus->pcicore.dev;
2420#endif
2421	gpiodev = bus->chipco.dev ? : pcidev;
2422	if (!gpiodev)
2423		return 0;
2424	ssb_write32(gpiodev, B43_GPIO_CONTROL,
2425		    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2426		     & mask) | set);
2427
2428	return 0;
2429}
2430
2431/* Turn off all GPIO stuff. Call this on module unload, for example. */
2432static void b43_gpio_cleanup(struct b43_wldev *dev)
2433{
2434	struct ssb_bus *bus = dev->dev->bus;
2435	struct ssb_device *gpiodev, *pcidev = NULL;
2436
2437#ifdef CONFIG_SSB_DRIVER_PCICORE
2438	pcidev = bus->pcicore.dev;
2439#endif
2440	gpiodev = bus->chipco.dev ? : pcidev;
2441	if (!gpiodev)
2442		return;
2443	ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2444}
2445
2446/* http://bcm-specs.sipsolutions.net/EnableMac */
2447void b43_mac_enable(struct b43_wldev *dev)
2448{
2449	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2450		u16 fwstate;
2451
2452		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2453					 B43_SHM_SH_UCODESTAT);
2454		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2455		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2456			b43err(dev->wl, "b43_mac_enable(): The firmware "
2457			       "should be suspended, but current state is %u\n",
2458			       fwstate);
2459		}
2460	}
2461
2462	dev->mac_suspended--;
2463	B43_WARN_ON(dev->mac_suspended < 0);
2464	if (dev->mac_suspended == 0) {
2465		b43_write32(dev, B43_MMIO_MACCTL,
2466			    b43_read32(dev, B43_MMIO_MACCTL)
2467			    | B43_MACCTL_ENABLED);
2468		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2469			    B43_IRQ_MAC_SUSPENDED);
2470		/* Commit writes */
2471		b43_read32(dev, B43_MMIO_MACCTL);
2472		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2473		b43_power_saving_ctl_bits(dev, 0);
2474	}
2475}
2476
2477/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2478void b43_mac_suspend(struct b43_wldev *dev)
2479{
2480	int i;
2481	u32 tmp;
2482
2483	might_sleep();
2484	B43_WARN_ON(dev->mac_suspended < 0);
2485
2486	if (dev->mac_suspended == 0) {
2487		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2488		b43_write32(dev, B43_MMIO_MACCTL,
2489			    b43_read32(dev, B43_MMIO_MACCTL)
2490			    & ~B43_MACCTL_ENABLED);
2491		/* force pci to flush the write */
2492		b43_read32(dev, B43_MMIO_MACCTL);
2493		for (i = 35; i; i--) {
2494			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2495			if (tmp & B43_IRQ_MAC_SUSPENDED)
2496				goto out;
2497			udelay(10);
2498		}
2499		/* Hm, it seems this will take some time. Use msleep(). */
2500		for (i = 40; i; i--) {
2501			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2502			if (tmp & B43_IRQ_MAC_SUSPENDED)
2503				goto out;
2504			msleep(1);
2505		}
2506		b43err(dev->wl, "MAC suspend failed\n");
2507	}
2508out:
2509	dev->mac_suspended++;
2510}
2511
2512static void b43_adjust_opmode(struct b43_wldev *dev)
2513{
2514	struct b43_wl *wl = dev->wl;
2515	u32 ctl;
2516	u16 cfp_pretbtt;
2517
2518	ctl = b43_read32(dev, B43_MMIO_MACCTL);
2519	/* Reset status to STA infrastructure mode. */
2520	ctl &= ~B43_MACCTL_AP;
2521	ctl &= ~B43_MACCTL_KEEP_CTL;
2522	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2523	ctl &= ~B43_MACCTL_KEEP_BAD;
2524	ctl &= ~B43_MACCTL_PROMISC;
2525	ctl &= ~B43_MACCTL_BEACPROMISC;
2526	ctl |= B43_MACCTL_INFRA;
2527
2528	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2529	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2530		ctl |= B43_MACCTL_AP;
2531	else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2532		ctl &= ~B43_MACCTL_INFRA;
2533
2534	if (wl->filter_flags & FIF_CONTROL)
2535		ctl |= B43_MACCTL_KEEP_CTL;
2536	if (wl->filter_flags & FIF_FCSFAIL)
2537		ctl |= B43_MACCTL_KEEP_BAD;
2538	if (wl->filter_flags & FIF_PLCPFAIL)
2539		ctl |= B43_MACCTL_KEEP_BADPLCP;
2540	if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2541		ctl |= B43_MACCTL_PROMISC;
2542	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2543		ctl |= B43_MACCTL_BEACPROMISC;
2544
2545	/* Workaround: On old hardware the HW-MAC-address-filter
2546	 * doesn't work properly, so always run promisc in filter
2547	 * it in software. */
2548	if (dev->dev->id.revision <= 4)
2549		ctl |= B43_MACCTL_PROMISC;
2550
2551	b43_write32(dev, B43_MMIO_MACCTL, ctl);
2552
2553	cfp_pretbtt = 2;
2554	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2555		if (dev->dev->bus->chip_id == 0x4306 &&
2556		    dev->dev->bus->chip_rev == 3)
2557			cfp_pretbtt = 100;
2558		else
2559			cfp_pretbtt = 50;
2560	}
2561	b43_write16(dev, 0x612, cfp_pretbtt);
2562}
2563
2564static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2565{
2566	u16 offset;
2567
2568	if (is_ofdm) {
2569		offset = 0x480;
2570		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2571	} else {
2572		offset = 0x4C0;
2573		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2574	}
2575	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2576			b43_shm_read16(dev, B43_SHM_SHARED, offset));
2577}
2578
2579static void b43_rate_memory_init(struct b43_wldev *dev)
2580{
2581	switch (dev->phy.type) {
2582	case B43_PHYTYPE_A:
2583	case B43_PHYTYPE_G:
2584	case B43_PHYTYPE_N:
2585		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2586		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2587		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2588		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2589		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2590		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2591		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2592		if (dev->phy.type == B43_PHYTYPE_A)
2593			break;
2594		/* fallthrough */
2595	case B43_PHYTYPE_B:
2596		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2597		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2598		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2599		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2600		break;
2601	default:
2602		B43_WARN_ON(1);
2603	}
2604}
2605
2606/* Set the default values for the PHY TX Control Words. */
2607static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2608{
2609	u16 ctl = 0;
2610
2611	ctl |= B43_TXH_PHY_ENC_CCK;
2612	ctl |= B43_TXH_PHY_ANT01AUTO;
2613	ctl |= B43_TXH_PHY_TXPWR;
2614
2615	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2616	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2617	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2618}
2619
2620/* Set the TX-Antenna for management frames sent by firmware. */
2621static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2622{
2623	u16 ant;
2624	u16 tmp;
2625
2626	ant = b43_antenna_to_phyctl(antenna);
2627
2628	/* For ACK/CTS */
2629	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2630	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2631	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2632	/* For Probe Resposes */
2633	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2634	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2635	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2636}
2637
2638/* This is the opposite of b43_chip_init() */
2639static void b43_chip_exit(struct b43_wldev *dev)
2640{
2641	b43_phy_exit(dev);
2642	b43_gpio_cleanup(dev);
2643	/* firmware is released later */
2644}
2645
2646/* Initialize the chip
2647 * http://bcm-specs.sipsolutions.net/ChipInit
2648 */
2649static int b43_chip_init(struct b43_wldev *dev)
2650{
2651	struct b43_phy *phy = &dev->phy;
2652	int err;
2653	u32 value32, macctl;
2654	u16 value16;
2655
2656	/* Initialize the MAC control */
2657	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2658	if (dev->phy.gmode)
2659		macctl |= B43_MACCTL_GMODE;
2660	macctl |= B43_MACCTL_INFRA;
2661	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2662
2663	err = b43_request_firmware(dev);
2664	if (err)
2665		goto out;
2666	err = b43_upload_microcode(dev);
2667	if (err)
2668		goto out;	/* firmware is released later */
2669
2670	err = b43_gpio_init(dev);
2671	if (err)
2672		goto out;	/* firmware is released later */
2673
2674	err = b43_upload_initvals(dev);
2675	if (err)
2676		goto err_gpio_clean;
2677
2678	/* Turn the Analog on and initialize the PHY. */
2679	phy->ops->switch_analog(dev, 1);
2680	err = b43_phy_init(dev);
2681	if (err)
2682		goto err_gpio_clean;
2683
2684	/* Disable Interference Mitigation. */
2685	if (phy->ops->interf_mitigation)
2686		phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2687
2688	/* Select the antennae */
2689	if (phy->ops->set_rx_antenna)
2690		phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2691	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2692
2693	if (phy->type == B43_PHYTYPE_B) {
2694		value16 = b43_read16(dev, 0x005E);
2695		value16 |= 0x0004;
2696		b43_write16(dev, 0x005E, value16);
2697	}
2698	b43_write32(dev, 0x0100, 0x01000000);
2699	if (dev->dev->id.revision < 5)
2700		b43_write32(dev, 0x010C, 0x01000000);
2701
2702	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2703		    & ~B43_MACCTL_INFRA);
2704	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2705		    | B43_MACCTL_INFRA);
2706
2707	/* Probe Response Timeout value */
2708	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2709	b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2710
2711	/* Initially set the wireless operation mode. */
2712	b43_adjust_opmode(dev);
2713
2714	if (dev->dev->id.revision < 3) {
2715		b43_write16(dev, 0x060E, 0x0000);
2716		b43_write16(dev, 0x0610, 0x8000);
2717		b43_write16(dev, 0x0604, 0x0000);
2718		b43_write16(dev, 0x0606, 0x0200);
2719	} else {
2720		b43_write32(dev, 0x0188, 0x80000000);
2721		b43_write32(dev, 0x018C, 0x02000000);
2722	}
2723	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2724	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2725	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2726	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2727	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2728	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2729	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2730
2731	value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2732	value32 |= 0x00100000;
2733	ssb_write32(dev->dev, SSB_TMSLOW, value32);
2734
2735	b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2736		    dev->dev->bus->chipco.fast_pwrup_delay);
2737
2738	err = 0;
2739	b43dbg(dev->wl, "Chip initialized\n");
2740out:
2741	return err;
2742
2743err_gpio_clean:
2744	b43_gpio_cleanup(dev);
2745	return err;
2746}
2747
2748static void b43_periodic_every60sec(struct b43_wldev *dev)
2749{
2750	const struct b43_phy_operations *ops = dev->phy.ops;
2751
2752	if (ops->pwork_60sec)
2753		ops->pwork_60sec(dev);
2754
2755	/* Force check the TX power emission now. */
2756	b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2757}
2758
2759static void b43_periodic_every30sec(struct b43_wldev *dev)
2760{
2761	/* Update device statistics. */
2762	b43_calculate_link_quality(dev);
2763}
2764
2765static void b43_periodic_every15sec(struct b43_wldev *dev)
2766{
2767	struct b43_phy *phy = &dev->phy;
2768	u16 wdr;
2769
2770	if (dev->fw.opensource) {
2771		/* Check if the firmware is still alive.
2772		 * It will reset the watchdog counter to 0 in its idle loop. */
2773		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2774		if (unlikely(wdr)) {
2775			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2776			b43_controller_restart(dev, "Firmware watchdog");
2777			return;
2778		} else {
2779			b43_shm_write16(dev, B43_SHM_SCRATCH,
2780					B43_WATCHDOG_REG, 1);
2781		}
2782	}
2783
2784	if (phy->ops->pwork_15sec)
2785		phy->ops->pwork_15sec(dev);
2786
2787	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2788	wmb();
2789}
2790
2791static void do_periodic_work(struct b43_wldev *dev)
2792{
2793	unsigned int state;
2794
2795	state = dev->periodic_state;
2796	if (state % 4 == 0)
2797		b43_periodic_every60sec(dev);
2798	if (state % 2 == 0)
2799		b43_periodic_every30sec(dev);
2800	b43_periodic_every15sec(dev);
2801}
2802
2803/* Periodic work locking policy:
2804 * 	The whole periodic work handler is protected by
2805 * 	wl->mutex. If another lock is needed somewhere in the
2806 * 	pwork callchain, it's aquired in-place, where it's needed.
2807 */
2808static void b43_periodic_work_handler(struct work_struct *work)
2809{
2810	struct b43_wldev *dev = container_of(work, struct b43_wldev,
2811					     periodic_work.work);
2812	struct b43_wl *wl = dev->wl;
2813	unsigned long delay;
2814
2815	mutex_lock(&wl->mutex);
2816
2817	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2818		goto out;
2819	if (b43_debug(dev, B43_DBG_PWORK_STOP))
2820		goto out_requeue;
2821
2822	do_periodic_work(dev);
2823
2824	dev->periodic_state++;
2825out_requeue:
2826	if (b43_debug(dev, B43_DBG_PWORK_FAST))
2827		delay = msecs_to_jiffies(50);
2828	else
2829		delay = round_jiffies_relative(HZ * 15);
2830	queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2831out:
2832	mutex_unlock(&wl->mutex);
2833}
2834
2835static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2836{
2837	struct delayed_work *work = &dev->periodic_work;
2838
2839	dev->periodic_state = 0;
2840	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2841	queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2842}
2843
2844/* Check if communication with the device works correctly. */
2845static int b43_validate_chipaccess(struct b43_wldev *dev)
2846{
2847	u32 v, backup;
2848
2849	backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2850
2851	/* Check for read/write and endianness problems. */
2852	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2853	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2854		goto error;
2855	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2856	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2857		goto error;
2858
2859	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2860
2861	if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2862		/* The 32bit register shadows the two 16bit registers
2863		 * with update sideeffects. Validate this. */
2864		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2865		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2866		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2867			goto error;
2868		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2869			goto error;
2870	}
2871	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2872
2873	v = b43_read32(dev, B43_MMIO_MACCTL);
2874	v |= B43_MACCTL_GMODE;
2875	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2876		goto error;
2877
2878	return 0;
2879error:
2880	b43err(dev->wl, "Failed to validate the chipaccess\n");
2881	return -ENODEV;
2882}
2883
2884static void b43_security_init(struct b43_wldev *dev)
2885{
2886	dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2887	B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2888	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2889	/* KTP is a word address, but we address SHM bytewise.
2890	 * So multiply by two.
2891	 */
2892	dev->ktp *= 2;
2893	if (dev->dev->id.revision >= 5) {
2894		/* Number of RCMTA address slots */
2895		b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2896	}
2897	b43_clear_keys(dev);
2898}
2899
2900static int b43_rng_read(struct hwrng *rng, u32 * data)
2901{
2902	struct b43_wl *wl = (struct b43_wl *)rng->priv;
2903	unsigned long flags;
2904
2905	/* Don't take wl->mutex here, as it could deadlock with
2906	 * hwrng internal locking. It's not needed to take
2907	 * wl->mutex here, anyway. */
2908
2909	spin_lock_irqsave(&wl->irq_lock, flags);
2910	*data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2911	spin_unlock_irqrestore(&wl->irq_lock, flags);
2912
2913	return (sizeof(u16));
2914}
2915
2916static void b43_rng_exit(struct b43_wl *wl)
2917{
2918	if (wl->rng_initialized)
2919		hwrng_unregister(&wl->rng);
2920}
2921
2922static int b43_rng_init(struct b43_wl *wl)
2923{
2924	int err;
2925
2926	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2927		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2928	wl->rng.name = wl->rng_name;
2929	wl->rng.data_read = b43_rng_read;
2930	wl->rng.priv = (unsigned long)wl;
2931	wl->rng_initialized = 1;
2932	err = hwrng_register(&wl->rng);
2933	if (err) {
2934		wl->rng_initialized = 0;
2935		b43err(wl, "Failed to register the random "
2936		       "number generator (%d)\n", err);
2937	}
2938
2939	return err;
2940}
2941
2942static int b43_op_tx(struct ieee80211_hw *hw,
2943		     struct sk_buff *skb)
2944{
2945	struct b43_wl *wl = hw_to_b43_wl(hw);
2946	struct b43_wldev *dev = wl->current_dev;
2947	unsigned long flags;
2948	int err;
2949
2950	if (unlikely(skb->len < 2 + 2 + 6)) {
2951		/* Too short, this can't be a valid frame. */
2952		goto drop_packet;
2953	}
2954	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2955	if (unlikely(!dev))
2956		goto drop_packet;
2957
2958	/* Transmissions on seperate queues can run concurrently. */
2959	read_lock_irqsave(&wl->tx_lock, flags);
2960
2961	err = -ENODEV;
2962	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2963		if (b43_using_pio_transfers(dev))
2964			err = b43_pio_tx(dev, skb);
2965		else
2966			err = b43_dma_tx(dev, skb);
2967	}
2968
2969	read_unlock_irqrestore(&wl->tx_lock, flags);
2970
2971	if (unlikely(err))
2972		goto drop_packet;
2973	return NETDEV_TX_OK;
2974
2975drop_packet:
2976	/* We can not transmit this packet. Drop it. */
2977	dev_kfree_skb_any(skb);
2978	return NETDEV_TX_OK;
2979}
2980
2981/* Locking: wl->irq_lock */
2982static void b43_qos_params_upload(struct b43_wldev *dev,
2983				  const struct ieee80211_tx_queue_params *p,
2984				  u16 shm_offset)
2985{
2986	u16 params[B43_NR_QOSPARAMS];
2987	int bslots, tmp;
2988	unsigned int i;
2989
2990	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
2991
2992	memset(&params, 0, sizeof(params));
2993
2994	params[B43_QOSPARAM_TXOP] = p->txop * 32;
2995	params[B43_QOSPARAM_CWMIN] = p->cw_min;
2996	params[B43_QOSPARAM_CWMAX] = p->cw_max;
2997	params[B43_QOSPARAM_CWCUR] = p->cw_min;
2998	params[B43_QOSPARAM_AIFS] = p->aifs;
2999	params[B43_QOSPARAM_BSLOTS] = bslots;
3000	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3001
3002	for (i = 0; i < ARRAY_SIZE(params); i++) {
3003		if (i == B43_QOSPARAM_STATUS) {
3004			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3005					     shm_offset + (i * 2));
3006			/* Mark the parameters as updated. */
3007			tmp |= 0x100;
3008			b43_shm_write16(dev, B43_SHM_SHARED,
3009					shm_offset + (i * 2),
3010					tmp);
3011		} else {
3012			b43_shm_write16(dev, B43_SHM_SHARED,
3013					shm_offset + (i * 2),
3014					params[i]);
3015		}
3016	}
3017}
3018
3019/* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3020static const u16 b43_qos_shm_offsets[] = {
3021	/* [mac80211-queue-nr] = SHM_OFFSET, */
3022	[0] = B43_QOS_VOICE,
3023	[1] = B43_QOS_VIDEO,
3024	[2] = B43_QOS_BESTEFFORT,
3025	[3] = B43_QOS_BACKGROUND,
3026};
3027
3028/* Update all QOS parameters in hardware. */
3029static void b43_qos_upload_all(struct b43_wldev *dev)
3030{
3031	struct b43_wl *wl = dev->wl;
3032	struct b43_qos_params *params;
3033	unsigned int i;
3034
3035	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3036		     ARRAY_SIZE(wl->qos_params));
3037
3038	b43_mac_suspend(dev);
3039	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3040		params = &(wl->qos_params[i]);
3041		b43_qos_params_upload(dev, &(params->p),
3042				      b43_qos_shm_offsets[i]);
3043	}
3044	b43_mac_enable(dev);
3045}
3046
3047static void b43_qos_clear(struct b43_wl *wl)
3048{
3049	struct b43_qos_params *params;
3050	unsigned int i;
3051
3052	/* Initialize QoS parameters to sane defaults. */
3053
3054	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3055		     ARRAY_SIZE(wl->qos_params));
3056
3057	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3058		params = &(wl->qos_params[i]);
3059
3060		switch (b43_qos_shm_offsets[i]) {
3061		case B43_QOS_VOICE:
3062			params->p.txop = 0;
3063			params->p.aifs = 2;
3064			params->p.cw_min = 0x0001;
3065			params->p.cw_max = 0x0001;
3066			break;
3067		case B43_QOS_VIDEO:
3068			params->p.txop = 0;
3069			params->p.aifs = 2;
3070			params->p.cw_min = 0x0001;
3071			params->p.cw_max = 0x0001;
3072			break;
3073		case B43_QOS_BESTEFFORT:
3074			params->p.txop = 0;
3075			params->p.aifs = 3;
3076			params->p.cw_min = 0x0001;
3077			params->p.cw_max = 0x03FF;
3078			break;
3079		case B43_QOS_BACKGROUND:
3080			params->p.txop = 0;
3081			params->p.aifs = 7;
3082			params->p.cw_min = 0x0001;
3083			params->p.cw_max = 0x03FF;
3084			break;
3085		default:
3086			B43_WARN_ON(1);
3087		}
3088	}
3089}
3090
3091/* Initialize the core's QOS capabilities */
3092static void b43_qos_init(struct b43_wldev *dev)
3093{
3094	/* Upload the current QOS parameters. */
3095	b43_qos_upload_all(dev);
3096
3097	/* Enable QOS support. */
3098	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3099	b43_write16(dev, B43_MMIO_IFSCTL,
3100		    b43_read16(dev, B43_MMIO_IFSCTL)
3101		    | B43_MMIO_IFSCTL_USE_EDCF);
3102}
3103
3104static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3105			  const struct ieee80211_tx_queue_params *params)
3106{
3107	struct b43_wl *wl = hw_to_b43_wl(hw);
3108	struct b43_wldev *dev;
3109	unsigned int queue = (unsigned int)_queue;
3110	int err = -ENODEV;
3111
3112	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3113		/* Queue not available or don't support setting
3114		 * params on this queue. Return success to not
3115		 * confuse mac80211. */
3116		return 0;
3117	}
3118	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3119		     ARRAY_SIZE(wl->qos_params));
3120
3121	mutex_lock(&wl->mutex);
3122	dev = wl->current_dev;
3123	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3124		goto out_unlock;
3125
3126	memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3127	b43_mac_suspend(dev);
3128	b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3129			      b43_qos_shm_offsets[queue]);
3130	b43_mac_enable(dev);
3131	err = 0;
3132
3133out_unlock:
3134	mutex_unlock(&wl->mutex);
3135
3136	return err;
3137}
3138
3139static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3140			       struct ieee80211_tx_queue_stats *stats)
3141{
3142	struct b43_wl *wl = hw_to_b43_wl(hw);
3143	struct b43_wldev *dev = wl->current_dev;
3144	unsigned long flags;
3145	int err = -ENODEV;
3146
3147	if (!dev)
3148		goto out;
3149	spin_lock_irqsave(&wl->irq_lock, flags);
3150	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3151		if (b43_using_pio_transfers(dev))
3152			b43_pio_get_tx_stats(dev, stats);
3153		else
3154			b43_dma_get_tx_stats(dev, stats);
3155		err = 0;
3156	}
3157	spin_unlock_irqrestore(&wl->irq_lock, flags);
3158out:
3159	return err;
3160}
3161
3162static int b43_op_get_stats(struct ieee80211_hw *hw,
3163			    struct ieee80211_low_level_stats *stats)
3164{
3165	struct b43_wl *wl = hw_to_b43_wl(hw);
3166	unsigned long flags;
3167
3168	spin_lock_irqsave(&wl->irq_lock, flags);
3169	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3170	spin_unlock_irqrestore(&wl->irq_lock, flags);
3171
3172	return 0;
3173}
3174
3175static void b43_put_phy_into_reset(struct b43_wldev *dev)
3176{
3177	struct ssb_device *sdev = dev->dev;
3178	u32 tmslow;
3179
3180	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3181	tmslow &= ~B43_TMSLOW_GMODE;
3182	tmslow |= B43_TMSLOW_PHYRESET;
3183	tmslow |= SSB_TMSLOW_FGC;
3184	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3185	msleep(1);
3186
3187	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3188	tmslow &= ~SSB_TMSLOW_FGC;
3189	tmslow |= B43_TMSLOW_PHYRESET;
3190	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3191	msleep(1);
3192}
3193
3194static const char * band_to_string(enum ieee80211_band band)
3195{
3196	switch (band) {
3197	case IEEE80211_BAND_5GHZ:
3198		return "5";
3199	case IEEE80211_BAND_2GHZ:
3200		return "2.4";
3201	default:
3202		break;
3203	}
3204	B43_WARN_ON(1);
3205	return "";
3206}
3207
3208/* Expects wl->mutex locked */
3209static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3210{
3211	struct b43_wldev *up_dev = NULL;
3212	struct b43_wldev *down_dev;
3213	struct b43_wldev *d;
3214	int err;
3215	bool uninitialized_var(gmode);
3216	int prev_status;
3217
3218	/* Find a device and PHY which supports the band. */
3219	list_for_each_entry(d, &wl->devlist, list) {
3220		switch (chan->band) {
3221		case IEEE80211_BAND_5GHZ:
3222			if (d->phy.supports_5ghz) {
3223				up_dev = d;
3224				gmode = 0;
3225			}
3226			break;
3227		case IEEE80211_BAND_2GHZ:
3228			if (d->phy.supports_2ghz) {
3229				up_dev = d;
3230				gmode = 1;
3231			}
3232			break;
3233		default:
3234			B43_WARN_ON(1);
3235			return -EINVAL;
3236		}
3237		if (up_dev)
3238			break;
3239	}
3240	if (!up_dev) {
3241		b43err(wl, "Could not find a device for %s-GHz band operation\n",
3242		       band_to_string(chan->band));
3243		return -ENODEV;
3244	}
3245	if ((up_dev == wl->current_dev) &&
3246	    (!!wl->current_dev->phy.gmode == !!gmode)) {
3247		/* This device is already running. */
3248		return 0;
3249	}
3250	b43dbg(wl, "Switching to %s-GHz band\n",
3251	       band_to_string(chan->band));
3252	down_dev = wl->current_dev;
3253
3254	prev_status = b43_status(down_dev);
3255	/* Shutdown the currently running core. */
3256	if (prev_status >= B43_STAT_STARTED)
3257		b43_wireless_core_stop(down_dev);
3258	if (prev_status >= B43_STAT_INITIALIZED)
3259		b43_wireless_core_exit(down_dev);
3260
3261	if (down_dev != up_dev) {
3262		/* We switch to a different core, so we put PHY into
3263		 * RESET on the old core. */
3264		b43_put_phy_into_reset(down_dev);
3265	}
3266
3267	/* Now start the new core. */
3268	up_dev->phy.gmode = gmode;
3269	if (prev_status >= B43_STAT_INITIALIZED) {
3270		err = b43_wireless_core_init(up_dev);
3271		if (err) {
3272			b43err(wl, "Fatal: Could not initialize device for "
3273			       "selected %s-GHz band\n",
3274			       band_to_string(chan->band));
3275			goto init_failure;
3276		}
3277	}
3278	if (prev_status >= B43_STAT_STARTED) {
3279		err = b43_wireless_core_start(up_dev);
3280		if (err) {
3281			b43err(wl, "Fatal: Coult not start device for "
3282			       "selected %s-GHz band\n",
3283			       band_to_string(chan->band));
3284			b43_wireless_core_exit(up_dev);
3285			goto init_failure;
3286		}
3287	}
3288	B43_WARN_ON(b43_status(up_dev) != prev_status);
3289
3290	wl->current_dev = up_dev;
3291
3292	return 0;
3293init_failure:
3294	/* Whoops, failed to init the new core. No core is operating now. */
3295	wl->current_dev = NULL;
3296	return err;
3297}
3298
3299/* Write the short and long frame retry limit values. */
3300static void b43_set_retry_limits(struct b43_wldev *dev,
3301				 unsigned int short_retry,
3302				 unsigned int long_retry)
3303{
3304	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3305	 * the chip-internal counter. */
3306	short_retry = min(short_retry, (unsigned int)0xF);
3307	long_retry = min(long_retry, (unsigned int)0xF);
3308
3309	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3310			short_retry);
3311	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3312			long_retry);
3313}
3314
3315static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3316{
3317	struct b43_wl *wl = hw_to_b43_wl(hw);
3318	struct b43_wldev *dev;
3319	struct b43_phy *phy;
3320	struct ieee80211_conf *conf = &hw->conf;
3321	unsigned long flags;
3322	int antenna;
3323	int err = 0;
3324
3325	mutex_lock(&wl->mutex);
3326
3327	/* Switch the band (if necessary). This might change the active core. */
3328	err = b43_switch_band(wl, conf->channel);
3329	if (err)
3330		goto out_unlock_mutex;
3331	dev = wl->current_dev;
3332	phy = &dev->phy;
3333
3334	b43_mac_suspend(dev);
3335
3336	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3337		b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3338					  conf->long_frame_max_tx_count);
3339	changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3340	if (!changed)
3341		goto out_mac_enable;
3342
3343	/* Switch to the requested channel.
3344	 * The firmware takes care of races with the TX handler. */
3345	if (conf->channel->hw_value != phy->channel)
3346		b43_switch_channel(dev, conf->channel->hw_value);
3347
3348	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3349
3350	/* Adjust the desired TX power level. */
3351	if (conf->power_level != 0) {
3352		spin_lock_irqsave(&wl->irq_lock, flags);
3353		if (conf->power_level != phy->desired_txpower) {
3354			phy->desired_txpower = conf->power_level;
3355			b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3356						   B43_TXPWR_IGNORE_TSSI);
3357		}
3358		spin_unlock_irqrestore(&wl->irq_lock, flags);
3359	}
3360
3361	/* Antennas for RX and management frame TX. */
3362	antenna = B43_ANTENNA_DEFAULT;
3363	b43_mgmtframe_txantenna(dev, antenna);
3364	antenna = B43_ANTENNA_DEFAULT;
3365	if (phy->ops->set_rx_antenna)
3366		phy->ops->set_rx_antenna(dev, antenna);
3367
3368	/* Update templates for AP/mesh mode. */
3369	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3370	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3371		b43_set_beacon_int(dev, conf->beacon_int);
3372
3373	if (!!conf->radio_enabled != phy->radio_on) {
3374		if (conf->radio_enabled) {
3375			b43_software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
3376			b43info(dev->wl, "Radio turned on by software\n");
3377			if (!dev->radio_hw_enable) {
3378				b43info(dev->wl, "The hardware RF-kill button "
3379					"still turns the radio physically off. "
3380					"Press the button to turn it on.\n");
3381			}
3382		} else {
3383			b43_software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
3384			b43info(dev->wl, "Radio turned off by software\n");
3385		}
3386	}
3387
3388out_mac_enable:
3389	b43_mac_enable(dev);
3390out_unlock_mutex:
3391	mutex_unlock(&wl->mutex);
3392
3393	return err;
3394}
3395
3396static void b43_update_basic_rates(struct b43_wldev *dev, u64 brates)
3397{
3398	struct ieee80211_supported_band *sband =
3399		dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3400	struct ieee80211_rate *rate;
3401	int i;
3402	u16 basic, direct, offset, basic_offset, rateptr;
3403
3404	for (i = 0; i < sband->n_bitrates; i++) {
3405		rate = &sband->bitrates[i];
3406
3407		if (b43_is_cck_rate(rate->hw_value)) {
3408			direct = B43_SHM_SH_CCKDIRECT;
3409			basic = B43_SHM_SH_CCKBASIC;
3410			offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3411			offset &= 0xF;
3412		} else {
3413			direct = B43_SHM_SH_OFDMDIRECT;
3414			basic = B43_SHM_SH_OFDMBASIC;
3415			offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3416			offset &= 0xF;
3417		}
3418
3419		rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3420
3421		if (b43_is_cck_rate(rate->hw_value)) {
3422			basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3423			basic_offset &= 0xF;
3424		} else {
3425			basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3426			basic_offset &= 0xF;
3427		}
3428
3429		/*
3430		 * Get the pointer that we need to point to
3431		 * from the direct map
3432		 */
3433		rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3434					 direct + 2 * basic_offset);
3435		/* and write it to the basic map */
3436		b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3437				rateptr);
3438	}
3439}
3440
3441static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3442				    struct ieee80211_vif *vif,
3443				    struct ieee80211_bss_conf *conf,
3444				    u32 changed)
3445{
3446	struct b43_wl *wl = hw_to_b43_wl(hw);
3447	struct b43_wldev *dev;
3448
3449	mutex_lock(&wl->mutex);
3450
3451	dev = wl->current_dev;
3452	if (!dev || b43_status(dev) < B43_STAT_STARTED)
3453		goto out_unlock_mutex;
3454	b43_mac_suspend(dev);
3455
3456	if (changed & BSS_CHANGED_BASIC_RATES)
3457		b43_update_basic_rates(dev, conf->basic_rates);
3458
3459	if (changed & BSS_CHANGED_ERP_SLOT) {
3460		if (conf->use_short_slot)
3461			b43_short_slot_timing_enable(dev);
3462		else
3463			b43_short_slot_timing_disable(dev);
3464	}
3465
3466	b43_mac_enable(dev);
3467out_unlock_mutex:
3468	mutex_unlock(&wl->mutex);
3469
3470	return;
3471}
3472
3473static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3474			   const u8 *local_addr, const u8 *addr,
3475			   struct ieee80211_key_conf *key)
3476{
3477	struct b43_wl *wl = hw_to_b43_wl(hw);
3478	struct b43_wldev *dev;
3479	u8 algorithm;
3480	u8 index;
3481	int err;
3482
3483	if (modparam_nohwcrypt)
3484		return -ENOSPC; /* User disabled HW-crypto */
3485
3486	mutex_lock(&wl->mutex);
3487	spin_lock_irq(&wl->irq_lock);
3488	write_lock(&wl->tx_lock);
3489	/* Why do we need all this locking here?
3490	 * mutex     -> Every config operation must take it.
3491	 * irq_lock  -> We modify the dev->key array, which is accessed
3492	 *              in the IRQ handlers.
3493	 * tx_lock   -> We modify the dev->key array, which is accessed
3494	 *              in the TX handler.
3495	 */
3496
3497	dev = wl->current_dev;
3498	err = -ENODEV;
3499	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3500		goto out_unlock;
3501
3502	if (dev->fw.pcm_request_failed) {
3503		/* We don't have firmware for the crypto engine.
3504		 * Must use software-crypto. */
3505		err = -EOPNOTSUPP;
3506		goto out_unlock;
3507	}
3508
3509	err = -EINVAL;
3510	switch (key->alg) {
3511	case ALG_WEP:
3512		if (key->keylen == LEN_WEP40)
3513			algorithm = B43_SEC_ALGO_WEP40;
3514		else
3515			algorithm = B43_SEC_ALGO_WEP104;
3516		break;
3517	case ALG_TKIP:
3518		algorithm = B43_SEC_ALGO_TKIP;
3519		break;
3520	case ALG_CCMP:
3521		algorithm = B43_SEC_ALGO_AES;
3522		break;
3523	default:
3524		B43_WARN_ON(1);
3525		goto out_unlock;
3526	}
3527	index = (u8) (key->keyidx);
3528	if (index > 3)
3529		goto out_unlock;
3530
3531	switch (cmd) {
3532	case SET_KEY:
3533		if (algorithm == B43_SEC_ALGO_TKIP) {
3534			/* FIXME: No TKIP hardware encryption for now. */
3535			err = -EOPNOTSUPP;
3536			goto out_unlock;
3537		}
3538
3539		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3540			/* Pairwise key with an assigned MAC address. */
3541			err = b43_key_write(dev, -1, algorithm,
3542					    key->key, key->keylen, addr, key);
3543		} else {
3544			/* Group key */
3545			err = b43_key_write(dev, index, algorithm,
3546					    key->key, key->keylen, NULL, key);
3547		}
3548		if (err)
3549			goto out_unlock;
3550
3551		if (algorithm == B43_SEC_ALGO_WEP40 ||
3552		    algorithm == B43_SEC_ALGO_WEP104) {
3553			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3554		} else {
3555			b43_hf_write(dev,
3556				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3557		}
3558		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3559		break;
3560	case DISABLE_KEY: {
3561		err = b43_key_clear(dev, key->hw_key_idx);
3562		if (err)
3563			goto out_unlock;
3564		break;
3565	}
3566	default:
3567		B43_WARN_ON(1);
3568	}
3569
3570out_unlock:
3571	if (!err) {
3572		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3573		       "mac: %pM\n",
3574		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3575		       addr);
3576		b43_dump_keymemory(dev);
3577	}
3578	write_unlock(&wl->tx_lock);
3579	spin_unlock_irq(&wl->irq_lock);
3580	mutex_unlock(&wl->mutex);
3581
3582	return err;
3583}
3584
3585static void b43_op_configure_filter(struct ieee80211_hw *hw,
3586				    unsigned int changed, unsigned int *fflags,
3587				    int mc_count, struct dev_addr_list *mc_list)
3588{
3589	struct b43_wl *wl = hw_to_b43_wl(hw);
3590	struct b43_wldev *dev = wl->current_dev;
3591	unsigned long flags;
3592
3593	if (!dev) {
3594		*fflags = 0;
3595		return;
3596	}
3597
3598	spin_lock_irqsave(&wl->irq_lock, flags);
3599	*fflags &= FIF_PROMISC_IN_BSS |
3600		  FIF_ALLMULTI |
3601		  FIF_FCSFAIL |
3602		  FIF_PLCPFAIL |
3603		  FIF_CONTROL |
3604		  FIF_OTHER_BSS |
3605		  FIF_BCN_PRBRESP_PROMISC;
3606
3607	changed &= FIF_PROMISC_IN_BSS |
3608		   FIF_ALLMULTI |
3609		   FIF_FCSFAIL |
3610		   FIF_PLCPFAIL |
3611		   FIF_CONTROL |
3612		   FIF_OTHER_BSS |
3613		   FIF_BCN_PRBRESP_PROMISC;
3614
3615	wl->filter_flags = *fflags;
3616
3617	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3618		b43_adjust_opmode(dev);
3619	spin_unlock_irqrestore(&wl->irq_lock, flags);
3620}
3621
3622static int b43_op_config_interface(struct ieee80211_hw *hw,
3623				   struct ieee80211_vif *vif,
3624				   struct ieee80211_if_conf *conf)
3625{
3626	struct b43_wl *wl = hw_to_b43_wl(hw);
3627	struct b43_wldev *dev = wl->current_dev;
3628	unsigned long flags;
3629
3630	if (!dev)
3631		return -ENODEV;
3632	mutex_lock(&wl->mutex);
3633	spin_lock_irqsave(&wl->irq_lock, flags);
3634	B43_WARN_ON(wl->vif != vif);
3635	if (conf->bssid)
3636		memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3637	else
3638		memset(wl->bssid, 0, ETH_ALEN);
3639	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3640		if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3641		    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT)) {
3642			B43_WARN_ON(vif->type != wl->if_type);
3643			if (conf->changed & IEEE80211_IFCC_BEACON)
3644				b43_update_templates(wl);
3645		} else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
3646			if (conf->changed & IEEE80211_IFCC_BEACON)
3647				b43_update_templates(wl);
3648		}
3649		b43_write_mac_bssid_templates(dev);
3650	}
3651	spin_unlock_irqrestore(&wl->irq_lock, flags);
3652	mutex_unlock(&wl->mutex);
3653
3654	return 0;
3655}
3656
3657/* Locking: wl->mutex */
3658static void b43_wireless_core_stop(struct b43_wldev *dev)
3659{
3660	struct b43_wl *wl = dev->wl;
3661	unsigned long flags;
3662
3663	if (b43_status(dev) < B43_STAT_STARTED)
3664		return;
3665
3666	/* Disable and sync interrupts. We must do this before than
3667	 * setting the status to INITIALIZED, as the interrupt handler
3668	 * won't care about IRQs then. */
3669	spin_lock_irqsave(&wl->irq_lock, flags);
3670	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3671	b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* flush */
3672	spin_unlock_irqrestore(&wl->irq_lock, flags);
3673	b43_synchronize_irq(dev);
3674
3675	write_lock_irqsave(&wl->tx_lock, flags);
3676	b43_set_status(dev, B43_STAT_INITIALIZED);
3677	write_unlock_irqrestore(&wl->tx_lock, flags);
3678
3679	b43_pio_stop(dev);
3680	mutex_unlock(&wl->mutex);
3681	/* Must unlock as it would otherwise deadlock. No races here.
3682	 * Cancel the possibly running self-rearming periodic work. */
3683	cancel_delayed_work_sync(&dev->periodic_work);
3684	mutex_lock(&wl->mutex);
3685
3686	b43_mac_suspend(dev);
3687	free_irq(dev->dev->irq, dev);
3688	b43dbg(wl, "Wireless interface stopped\n");
3689}
3690
3691/* Locking: wl->mutex */
3692static int b43_wireless_core_start(struct b43_wldev *dev)
3693{
3694	int err;
3695
3696	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3697
3698	drain_txstatus_queue(dev);
3699	err = request_irq(dev->dev->irq, b43_interrupt_handler,
3700			  IRQF_SHARED, KBUILD_MODNAME, dev);
3701	if (err) {
3702		b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3703		goto out;
3704	}
3705
3706	/* We are ready to run. */
3707	b43_set_status(dev, B43_STAT_STARTED);
3708
3709	/* Start data flow (TX/RX). */
3710	b43_mac_enable(dev);
3711	b43_interrupt_enable(dev, dev->irq_savedstate);
3712
3713	/* Start maintainance work */
3714	b43_periodic_tasks_setup(dev);
3715
3716	b43dbg(dev->wl, "Wireless interface started\n");
3717      out:
3718	return err;
3719}
3720
3721/* Get PHY and RADIO versioning numbers */
3722static int b43_phy_versioning(struct b43_wldev *dev)
3723{
3724	struct b43_phy *phy = &dev->phy;
3725	u32 tmp;
3726	u8 analog_type;
3727	u8 phy_type;
3728	u8 phy_rev;
3729	u16 radio_manuf;
3730	u16 radio_ver;
3731	u16 radio_rev;
3732	int unsupported = 0;
3733
3734	/* Get PHY versioning */
3735	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3736	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3737	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3738	phy_rev = (tmp & B43_PHYVER_VERSION);
3739	switch (phy_type) {
3740	case B43_PHYTYPE_A:
3741		if (phy_rev >= 4)
3742			unsupported = 1;
3743		break;
3744	case B43_PHYTYPE_B:
3745		if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3746		    && phy_rev != 7)
3747			unsupported = 1;
3748		break;
3749	case B43_PHYTYPE_G:
3750		if (phy_rev > 9)
3751			unsupported = 1;
3752		break;
3753#ifdef CONFIG_B43_NPHY
3754	case B43_PHYTYPE_N:
3755		if (phy_rev > 1)
3756			unsupported = 1;
3757		break;
3758#endif
3759	default:
3760		unsupported = 1;
3761	};
3762	if (unsupported) {
3763		b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3764		       "(Analog %u, Type %u, Revision %u)\n",
3765		       analog_type, phy_type, phy_rev);
3766		return -EOPNOTSUPP;
3767	}
3768	b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3769	       analog_type, phy_type, phy_rev);
3770
3771	/* Get RADIO versioning */
3772	if (dev->dev->bus->chip_id == 0x4317) {
3773		if (dev->dev->bus->chip_rev == 0)
3774			tmp = 0x3205017F;
3775		else if (dev->dev->bus->chip_rev == 1)
3776			tmp = 0x4205017F;
3777		else
3778			tmp = 0x5205017F;
3779	} else {
3780		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3781		tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3782		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3783		tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3784	}
3785	radio_manuf = (tmp & 0x00000FFF);
3786	radio_ver = (tmp & 0x0FFFF000) >> 12;
3787	radio_rev = (tmp & 0xF0000000) >> 28;
3788	if (radio_manuf != 0x17F /* Broadcom */)
3789		unsupported = 1;
3790	switch (phy_type) {
3791	case B43_PHYTYPE_A:
3792		if (radio_ver != 0x2060)
3793			unsupported = 1;
3794		if (radio_rev != 1)
3795			unsupported = 1;
3796		if (radio_manuf != 0x17F)
3797			unsupported = 1;
3798		break;
3799	case B43_PHYTYPE_B:
3800		if ((radio_ver & 0xFFF0) != 0x2050)
3801			unsupported = 1;
3802		break;
3803	case B43_PHYTYPE_G:
3804		if (radio_ver != 0x2050)
3805			unsupported = 1;
3806		break;
3807	case B43_PHYTYPE_N:
3808		if (radio_ver != 0x2055)
3809			unsupported = 1;
3810		break;
3811	default:
3812		B43_WARN_ON(1);
3813	}
3814	if (unsupported) {
3815		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3816		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3817		       radio_manuf, radio_ver, radio_rev);
3818		return -EOPNOTSUPP;
3819	}
3820	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3821	       radio_manuf, radio_ver, radio_rev);
3822
3823	phy->radio_manuf = radio_manuf;
3824	phy->radio_ver = radio_ver;
3825	phy->radio_rev = radio_rev;
3826
3827	phy->analog = analog_type;
3828	phy->type = phy_type;
3829	phy->rev = phy_rev;
3830
3831	return 0;
3832}
3833
3834static void setup_struct_phy_for_init(struct b43_wldev *dev,
3835				      struct b43_phy *phy)
3836{
3837	phy->hardware_power_control = !!modparam_hwpctl;
3838	phy->next_txpwr_check_time = jiffies;
3839	/* PHY TX errors counter. */
3840	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3841}
3842
3843static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3844{
3845	dev->dfq_valid = 0;
3846
3847	/* Assume the radio is enabled. If it's not enabled, the state will
3848	 * immediately get fixed on the first periodic work run. */
3849	dev->radio_hw_enable = 1;
3850
3851	/* Stats */
3852	memset(&dev->stats, 0, sizeof(dev->stats));
3853
3854	setup_struct_phy_for_init(dev, &dev->phy);
3855
3856	/* IRQ related flags */
3857	dev->irq_reason = 0;
3858	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3859	dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3860
3861	dev->mac_suspended = 1;
3862
3863	/* Noise calculation context */
3864	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3865}
3866
3867static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3868{
3869	struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3870	u64 hf;
3871
3872	if (!modparam_btcoex)
3873		return;
3874	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3875		return;
3876	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3877		return;
3878
3879	hf = b43_hf_read(dev);
3880	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3881		hf |= B43_HF_BTCOEXALT;
3882	else
3883		hf |= B43_HF_BTCOEX;
3884	b43_hf_write(dev, hf);
3885}
3886
3887static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3888{
3889	if (!modparam_btcoex)
3890		return;
3891	//TODO
3892}
3893
3894static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3895{
3896#ifdef CONFIG_SSB_DRIVER_PCICORE
3897	struct ssb_bus *bus = dev->dev->bus;
3898	u32 tmp;
3899
3900	if (bus->pcicore.dev &&
3901	    bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3902	    bus->pcicore.dev->id.revision <= 5) {
3903		/* IMCFGLO timeouts workaround. */
3904		tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3905		tmp &= ~SSB_IMCFGLO_REQTO;
3906		tmp &= ~SSB_IMCFGLO_SERTO;
3907		switch (bus->bustype) {
3908		case SSB_BUSTYPE_PCI:
3909		case SSB_BUSTYPE_PCMCIA:
3910			tmp |= 0x32;
3911			break;
3912		case SSB_BUSTYPE_SSB:
3913			tmp |= 0x53;
3914			break;
3915		}
3916		ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3917	}
3918#endif /* CONFIG_SSB_DRIVER_PCICORE */
3919}
3920
3921static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3922{
3923	u16 pu_delay;
3924
3925	/* The time value is in microseconds. */
3926	if (dev->phy.type == B43_PHYTYPE_A)
3927		pu_delay = 3700;
3928	else
3929		pu_delay = 1050;
3930	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3931		pu_delay = 500;
3932	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3933		pu_delay = max(pu_delay, (u16)2400);
3934
3935	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3936}
3937
3938/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3939static void b43_set_pretbtt(struct b43_wldev *dev)
3940{
3941	u16 pretbtt;
3942
3943	/* The time value is in microseconds. */
3944	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
3945		pretbtt = 2;
3946	} else {
3947		if (dev->phy.type == B43_PHYTYPE_A)
3948			pretbtt = 120;
3949		else
3950			pretbtt = 250;
3951	}
3952	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3953	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3954}
3955
3956/* Shutdown a wireless core */
3957/* Locking: wl->mutex */
3958static void b43_wireless_core_exit(struct b43_wldev *dev)
3959{
3960	u32 macctl;
3961
3962	B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3963	if (b43_status(dev) != B43_STAT_INITIALIZED)
3964		return;
3965	b43_set_status(dev, B43_STAT_UNINIT);
3966
3967	/* Stop the microcode PSM. */
3968	macctl = b43_read32(dev, B43_MMIO_MACCTL);
3969	macctl &= ~B43_MACCTL_PSM_RUN;
3970	macctl |= B43_MACCTL_PSM_JMP0;
3971	b43_write32(dev, B43_MMIO_MACCTL, macctl);
3972
3973	if (!dev->suspend_in_progress) {
3974		b43_leds_exit(dev);
3975		b43_rng_exit(dev->wl);
3976	}
3977	b43_dma_free(dev);
3978	b43_pio_free(dev);
3979	b43_chip_exit(dev);
3980	dev->phy.ops->switch_analog(dev, 0);
3981	if (dev->wl->current_beacon) {
3982		dev_kfree_skb_any(dev->wl->current_beacon);
3983		dev->wl->current_beacon = NULL;
3984	}
3985
3986	ssb_device_disable(dev->dev, 0);
3987	ssb_bus_may_powerdown(dev->dev->bus);
3988}
3989
3990/* Initialize a wireless core */
3991static int b43_wireless_core_init(struct b43_wldev *dev)
3992{
3993	struct b43_wl *wl = dev->wl;
3994	struct ssb_bus *bus = dev->dev->bus;
3995	struct ssb_sprom *sprom = &bus->sprom;
3996	struct b43_phy *phy = &dev->phy;
3997	int err;
3998	u64 hf;
3999	u32 tmp;
4000
4001	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4002
4003	err = ssb_bus_powerup(bus, 0);
4004	if (err)
4005		goto out;
4006	if (!ssb_device_is_enabled(dev->dev)) {
4007		tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4008		b43_wireless_core_reset(dev, tmp);
4009	}
4010
4011	/* Reset all data structures. */
4012	setup_struct_wldev_for_init(dev);
4013	phy->ops->prepare_structs(dev);
4014
4015	/* Enable IRQ routing to this device. */
4016	ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4017
4018	b43_imcfglo_timeouts_workaround(dev);
4019	b43_bluetooth_coext_disable(dev);
4020	if (phy->ops->prepare_hardware) {
4021		err = phy->ops->prepare_hardware(dev);
4022		if (err)
4023			goto err_busdown;
4024	}
4025	err = b43_chip_init(dev);
4026	if (err)
4027		goto err_busdown;
4028	b43_shm_write16(dev, B43_SHM_SHARED,
4029			B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4030	hf = b43_hf_read(dev);
4031	if (phy->type == B43_PHYTYPE_G) {
4032		hf |= B43_HF_SYMW;
4033		if (phy->rev == 1)
4034			hf |= B43_HF_GDCW;
4035		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4036			hf |= B43_HF_OFDMPABOOST;
4037	} else if (phy->type == B43_PHYTYPE_B) {
4038		hf |= B43_HF_SYMW;
4039		if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4040			hf &= ~B43_HF_GDCW;
4041	}
4042	b43_hf_write(dev, hf);
4043
4044	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4045			     B43_DEFAULT_LONG_RETRY_LIMIT);
4046	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4047	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4048
4049	/* Disable sending probe responses from firmware.
4050	 * Setting the MaxTime to one usec will always trigger
4051	 * a timeout, so we never send any probe resp.
4052	 * A timeout of zero is infinite. */
4053	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4054
4055	b43_rate_memory_init(dev);
4056	b43_set_phytxctl_defaults(dev);
4057
4058	/* Minimum Contention Window */
4059	if (phy->type == B43_PHYTYPE_B) {
4060		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4061	} else {
4062		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4063	}
4064	/* Maximum Contention Window */
4065	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4066
4067	if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4068		dev->__using_pio_transfers = 1;
4069		err = b43_pio_init(dev);
4070	} else {
4071		dev->__using_pio_transfers = 0;
4072		err = b43_dma_init(dev);
4073	}
4074	if (err)
4075		goto err_chip_exit;
4076	b43_qos_init(dev);
4077	b43_set_synth_pu_delay(dev, 1);
4078	b43_bluetooth_coext_enable(dev);
4079
4080	ssb_bus_powerup(bus, 1);	/* Enable dynamic PCTL */
4081	b43_upload_card_macaddress(dev);
4082	b43_security_init(dev);
4083	if (!dev->suspend_in_progress)
4084		b43_rng_init(wl);
4085
4086	b43_set_status(dev, B43_STAT_INITIALIZED);
4087
4088	if (!dev->suspend_in_progress)
4089		b43_leds_init(dev);
4090out:
4091	return err;
4092
4093err_chip_exit:
4094	b43_chip_exit(dev);
4095err_busdown:
4096	ssb_bus_may_powerdown(bus);
4097	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4098	return err;
4099}
4100
4101static int b43_op_add_interface(struct ieee80211_hw *hw,
4102				struct ieee80211_if_init_conf *conf)
4103{
4104	struct b43_wl *wl = hw_to_b43_wl(hw);
4105	struct b43_wldev *dev;
4106	unsigned long flags;
4107	int err = -EOPNOTSUPP;
4108
4109	/* TODO: allow WDS/AP devices to coexist */
4110
4111	if (conf->type != NL80211_IFTYPE_AP &&
4112	    conf->type != NL80211_IFTYPE_MESH_POINT &&
4113	    conf->type != NL80211_IFTYPE_STATION &&
4114	    conf->type != NL80211_IFTYPE_WDS &&
4115	    conf->type != NL80211_IFTYPE_ADHOC)
4116		return -EOPNOTSUPP;
4117
4118	mutex_lock(&wl->mutex);
4119	if (wl->operating)
4120		goto out_mutex_unlock;
4121
4122	b43dbg(wl, "Adding Interface type %d\n", conf->type);
4123
4124	dev = wl->current_dev;
4125	wl->operating = 1;
4126	wl->vif = conf->vif;
4127	wl->if_type = conf->type;
4128	memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4129
4130	spin_lock_irqsave(&wl->irq_lock, flags);
4131	b43_adjust_opmode(dev);
4132	b43_set_pretbtt(dev);
4133	b43_set_synth_pu_delay(dev, 0);
4134	b43_upload_card_macaddress(dev);
4135	spin_unlock_irqrestore(&wl->irq_lock, flags);
4136
4137	err = 0;
4138 out_mutex_unlock:
4139	mutex_unlock(&wl->mutex);
4140
4141	return err;
4142}
4143
4144static void b43_op_remove_interface(struct ieee80211_hw *hw,
4145				    struct ieee80211_if_init_conf *conf)
4146{
4147	struct b43_wl *wl = hw_to_b43_wl(hw);
4148	struct b43_wldev *dev = wl->current_dev;
4149	unsigned long flags;
4150
4151	b43dbg(wl, "Removing Interface type %d\n", conf->type);
4152
4153	mutex_lock(&wl->mutex);
4154
4155	B43_WARN_ON(!wl->operating);
4156	B43_WARN_ON(wl->vif != conf->vif);
4157	wl->vif = NULL;
4158
4159	wl->operating = 0;
4160
4161	spin_lock_irqsave(&wl->irq_lock, flags);
4162	b43_adjust_opmode(dev);
4163	memset(wl->mac_addr, 0, ETH_ALEN);
4164	b43_upload_card_macaddress(dev);
4165	spin_unlock_irqrestore(&wl->irq_lock, flags);
4166
4167	mutex_unlock(&wl->mutex);
4168}
4169
4170static int b43_op_start(struct ieee80211_hw *hw)
4171{
4172	struct b43_wl *wl = hw_to_b43_wl(hw);
4173	struct b43_wldev *dev = wl->current_dev;
4174	int did_init = 0;
4175	int err = 0;
4176	bool do_rfkill_exit = 0;
4177
4178	/* Kill all old instance specific information to make sure
4179	 * the card won't use it in the short timeframe between start
4180	 * and mac80211 reconfiguring it. */
4181	memset(wl->bssid, 0, ETH_ALEN);
4182	memset(wl->mac_addr, 0, ETH_ALEN);
4183	wl->filter_flags = 0;
4184	wl->radiotap_enabled = 0;
4185	b43_qos_clear(wl);
4186	wl->beacon0_uploaded = 0;
4187	wl->beacon1_uploaded = 0;
4188	wl->beacon_templates_virgin = 1;
4189
4190	/* First register RFkill.
4191	 * LEDs that are registered later depend on it. */
4192	b43_rfkill_init(dev);
4193
4194	mutex_lock(&wl->mutex);
4195
4196	if (b43_status(dev) < B43_STAT_INITIALIZED) {
4197		err = b43_wireless_core_init(dev);
4198		if (err) {
4199			do_rfkill_exit = 1;
4200			goto out_mutex_unlock;
4201		}
4202		did_init = 1;
4203	}
4204
4205	if (b43_status(dev) < B43_STAT_STARTED) {
4206		err = b43_wireless_core_start(dev);
4207		if (err) {
4208			if (did_init)
4209				b43_wireless_core_exit(dev);
4210			do_rfkill_exit = 1;
4211			goto out_mutex_unlock;
4212		}
4213	}
4214
4215 out_mutex_unlock:
4216	mutex_unlock(&wl->mutex);
4217
4218	if (do_rfkill_exit)
4219		b43_rfkill_exit(dev);
4220
4221	return err;
4222}
4223
4224static void b43_op_stop(struct ieee80211_hw *hw)
4225{
4226	struct b43_wl *wl = hw_to_b43_wl(hw);
4227	struct b43_wldev *dev = wl->current_dev;
4228
4229	b43_rfkill_exit(dev);
4230	cancel_work_sync(&(wl->beacon_update_trigger));
4231
4232	mutex_lock(&wl->mutex);
4233	if (b43_status(dev) >= B43_STAT_STARTED)
4234		b43_wireless_core_stop(dev);
4235	b43_wireless_core_exit(dev);
4236	mutex_unlock(&wl->mutex);
4237
4238	cancel_work_sync(&(wl->txpower_adjust_work));
4239}
4240
4241static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4242				 struct ieee80211_sta *sta, bool set)
4243{
4244	struct b43_wl *wl = hw_to_b43_wl(hw);
4245	unsigned long flags;
4246
4247	spin_lock_irqsave(&wl->irq_lock, flags);
4248	b43_update_templates(wl);
4249	spin_unlock_irqrestore(&wl->irq_lock, flags);
4250
4251	return 0;
4252}
4253
4254static void b43_op_sta_notify(struct ieee80211_hw *hw,
4255			      struct ieee80211_vif *vif,
4256			      enum sta_notify_cmd notify_cmd,
4257			      struct ieee80211_sta *sta)
4258{
4259	struct b43_wl *wl = hw_to_b43_wl(hw);
4260
4261	B43_WARN_ON(!vif || wl->vif != vif);
4262}
4263
4264static const struct ieee80211_ops b43_hw_ops = {
4265	.tx			= b43_op_tx,
4266	.conf_tx		= b43_op_conf_tx,
4267	.add_interface		= b43_op_add_interface,
4268	.remove_interface	= b43_op_remove_interface,
4269	.config			= b43_op_config,
4270	.bss_info_changed	= b43_op_bss_info_changed,
4271	.config_interface	= b43_op_config_interface,
4272	.configure_filter	= b43_op_configure_filter,
4273	.set_key		= b43_op_set_key,
4274	.get_stats		= b43_op_get_stats,
4275	.get_tx_stats		= b43_op_get_tx_stats,
4276	.start			= b43_op_start,
4277	.stop			= b43_op_stop,
4278	.set_tim		= b43_op_beacon_set_tim,
4279	.sta_notify		= b43_op_sta_notify,
4280};
4281
4282/* Hard-reset the chip. Do not call this directly.
4283 * Use b43_controller_restart()
4284 */
4285static void b43_chip_reset(struct work_struct *work)
4286{
4287	struct b43_wldev *dev =
4288	    container_of(work, struct b43_wldev, restart_work);
4289	struct b43_wl *wl = dev->wl;
4290	int err = 0;
4291	int prev_status;
4292
4293	mutex_lock(&wl->mutex);
4294
4295	prev_status = b43_status(dev);
4296	/* Bring the device down... */
4297	if (prev_status >= B43_STAT_STARTED)
4298		b43_wireless_core_stop(dev);
4299	if (prev_status >= B43_STAT_INITIALIZED)
4300		b43_wireless_core_exit(dev);
4301
4302	/* ...and up again. */
4303	if (prev_status >= B43_STAT_INITIALIZED) {
4304		err = b43_wireless_core_init(dev);
4305		if (err)
4306			goto out;
4307	}
4308	if (prev_status >= B43_STAT_STARTED) {
4309		err = b43_wireless_core_start(dev);
4310		if (err) {
4311			b43_wireless_core_exit(dev);
4312			goto out;
4313		}
4314	}
4315out:
4316	if (err)
4317		wl->current_dev = NULL; /* Failed to init the dev. */
4318	mutex_unlock(&wl->mutex);
4319	if (err)
4320		b43err(wl, "Controller restart FAILED\n");
4321	else
4322		b43info(wl, "Controller restarted\n");
4323}
4324
4325static int b43_setup_bands(struct b43_wldev *dev,
4326			   bool have_2ghz_phy, bool have_5ghz_phy)
4327{
4328	struct ieee80211_hw *hw = dev->wl->hw;
4329
4330	if (have_2ghz_phy)
4331		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4332	if (dev->phy.type == B43_PHYTYPE_N) {
4333		if (have_5ghz_phy)
4334			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4335	} else {
4336		if (have_5ghz_phy)
4337			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4338	}
4339
4340	dev->phy.supports_2ghz = have_2ghz_phy;
4341	dev->phy.supports_5ghz = have_5ghz_phy;
4342
4343	return 0;
4344}
4345
4346static void b43_wireless_core_detach(struct b43_wldev *dev)
4347{
4348	/* We release firmware that late to not be required to re-request
4349	 * is all the time when we reinit the core. */
4350	b43_release_firmware(dev);
4351	b43_phy_free(dev);
4352}
4353
4354static int b43_wireless_core_attach(struct b43_wldev *dev)
4355{
4356	struct b43_wl *wl = dev->wl;
4357	struct ssb_bus *bus = dev->dev->bus;
4358	struct pci_dev *pdev = bus->host_pci;
4359	int err;
4360	bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4361	u32 tmp;
4362
4363	/* Do NOT do any device initialization here.
4364	 * Do it in wireless_core_init() instead.
4365	 * This function is for gathering basic information about the HW, only.
4366	 * Also some structs may be set up here. But most likely you want to have
4367	 * that in core_init(), too.
4368	 */
4369
4370	err = ssb_bus_powerup(bus, 0);
4371	if (err) {
4372		b43err(wl, "Bus powerup failed\n");
4373		goto out;
4374	}
4375	/* Get the PHY type. */
4376	if (dev->dev->id.revision >= 5) {
4377		u32 tmshigh;
4378
4379		tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4380		have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4381		have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4382	} else
4383		B43_WARN_ON(1);
4384
4385	dev->phy.gmode = have_2ghz_phy;
4386	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4387	b43_wireless_core_reset(dev, tmp);
4388
4389	err = b43_phy_versioning(dev);
4390	if (err)
4391		goto err_powerdown;
4392	/* Check if this device supports multiband. */
4393	if (!pdev ||
4394	    (pdev->device != 0x4312 &&
4395	     pdev->device != 0x4319 && pdev->device != 0x4324)) {
4396		/* No multiband support. */
4397		have_2ghz_phy = 0;
4398		have_5ghz_phy = 0;
4399		switch (dev->phy.type) {
4400		case B43_PHYTYPE_A:
4401			have_5ghz_phy = 1;
4402			break;
4403		case B43_PHYTYPE_G:
4404		case B43_PHYTYPE_N:
4405			have_2ghz_phy = 1;
4406			break;
4407		default:
4408			B43_WARN_ON(1);
4409		}
4410	}
4411	if (dev->phy.type == B43_PHYTYPE_A) {
4412		/* FIXME */
4413		b43err(wl, "IEEE 802.11a devices are unsupported\n");
4414		err = -EOPNOTSUPP;
4415		goto err_powerdown;
4416	}
4417	if (1 /* disable A-PHY */) {
4418		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4419		if (dev->phy.type != B43_PHYTYPE_N) {
4420			have_2ghz_phy = 1;
4421			have_5ghz_phy = 0;
4422		}
4423	}
4424
4425	err = b43_phy_allocate(dev);
4426	if (err)
4427		goto err_powerdown;
4428
4429	dev->phy.gmode = have_2ghz_phy;
4430	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4431	b43_wireless_core_reset(dev, tmp);
4432
4433	err = b43_validate_chipaccess(dev);
4434	if (err)
4435		goto err_phy_free;
4436	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4437	if (err)
4438		goto err_phy_free;
4439
4440	/* Now set some default "current_dev" */
4441	if (!wl->current_dev)
4442		wl->current_dev = dev;
4443	INIT_WORK(&dev->restart_work, b43_chip_reset);
4444
4445	dev->phy.ops->switch_analog(dev, 0);
4446	ssb_device_disable(dev->dev, 0);
4447	ssb_bus_may_powerdown(bus);
4448
4449out:
4450	return err;
4451
4452err_phy_free:
4453	b43_phy_free(dev);
4454err_powerdown:
4455	ssb_bus_may_powerdown(bus);
4456	return err;
4457}
4458
4459static void b43_one_core_detach(struct ssb_device *dev)
4460{
4461	struct b43_wldev *wldev;
4462	struct b43_wl *wl;
4463
4464	/* Do not cancel ieee80211-workqueue based work here.
4465	 * See comment in b43_remove(). */
4466
4467	wldev = ssb_get_drvdata(dev);
4468	wl = wldev->wl;
4469	b43_debugfs_remove_device(wldev);
4470	b43_wireless_core_detach(wldev);
4471	list_del(&wldev->list);
4472	wl->nr_devs--;
4473	ssb_set_drvdata(dev, NULL);
4474	kfree(wldev);
4475}
4476
4477static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4478{
4479	struct b43_wldev *wldev;
4480	struct pci_dev *pdev;
4481	int err = -ENOMEM;
4482
4483	if (!list_empty(&wl->devlist)) {
4484		/* We are not the first core on this chip. */
4485		pdev = dev->bus->host_pci;
4486		/* Only special chips support more than one wireless
4487		 * core, although some of the other chips have more than
4488		 * one wireless core as well. Check for this and
4489		 * bail out early.
4490		 */
4491		if (!pdev ||
4492		    ((pdev->device != 0x4321) &&
4493		     (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4494			b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4495			return -ENODEV;
4496		}
4497	}
4498
4499	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4500	if (!wldev)
4501		goto out;
4502
4503	wldev->dev = dev;
4504	wldev->wl = wl;
4505	b43_set_status(wldev, B43_STAT_UNINIT);
4506	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4507	tasklet_init(&wldev->isr_tasklet,
4508		     (void (*)(unsigned long))b43_interrupt_tasklet,
4509		     (unsigned long)wldev);
4510	INIT_LIST_HEAD(&wldev->list);
4511
4512	err = b43_wireless_core_attach(wldev);
4513	if (err)
4514		goto err_kfree_wldev;
4515
4516	list_add(&wldev->list, &wl->devlist);
4517	wl->nr_devs++;
4518	ssb_set_drvdata(dev, wldev);
4519	b43_debugfs_add_device(wldev);
4520
4521      out:
4522	return err;
4523
4524      err_kfree_wldev:
4525	kfree(wldev);
4526	return err;
4527}
4528
4529#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
4530	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
4531	(pdev->device == _device) &&					\
4532	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
4533	(pdev->subsystem_device == _subdevice)				)
4534
4535static void b43_sprom_fixup(struct ssb_bus *bus)
4536{
4537	struct pci_dev *pdev;
4538
4539	/* boardflags workarounds */
4540	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4541	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4542		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4543	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4544	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4545		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4546	if (bus->bustype == SSB_BUSTYPE_PCI) {
4547		pdev = bus->host_pci;
4548		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4549		    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4550		    IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4551		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4552		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4553		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4554		    IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4555			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4556	}
4557}
4558
4559static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4560{
4561	struct ieee80211_hw *hw = wl->hw;
4562
4563	ssb_set_devtypedata(dev, NULL);
4564	ieee80211_free_hw(hw);
4565}
4566
4567static int b43_wireless_init(struct ssb_device *dev)
4568{
4569	struct ssb_sprom *sprom = &dev->bus->sprom;
4570	struct ieee80211_hw *hw;
4571	struct b43_wl *wl;
4572	int err = -ENOMEM;
4573
4574	b43_sprom_fixup(dev->bus);
4575
4576	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4577	if (!hw) {
4578		b43err(NULL, "Could not allocate ieee80211 device\n");
4579		goto out;
4580	}
4581
4582	/* fill hw info */
4583	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4584		    IEEE80211_HW_SIGNAL_DBM |
4585		    IEEE80211_HW_NOISE_DBM;
4586
4587	hw->wiphy->interface_modes =
4588		BIT(NL80211_IFTYPE_AP) |
4589		BIT(NL80211_IFTYPE_MESH_POINT) |
4590		BIT(NL80211_IFTYPE_STATION) |
4591		BIT(NL80211_IFTYPE_WDS) |
4592		BIT(NL80211_IFTYPE_ADHOC);
4593
4594	hw->queues = b43_modparam_qos ? 4 : 1;
4595	hw->max_rates = 2;
4596	SET_IEEE80211_DEV(hw, dev->dev);
4597	if (is_valid_ether_addr(sprom->et1mac))
4598		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4599	else
4600		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4601
4602	/* Get and initialize struct b43_wl */
4603	wl = hw_to_b43_wl(hw);
4604	memset(wl, 0, sizeof(*wl));
4605	wl->hw = hw;
4606	spin_lock_init(&wl->irq_lock);
4607	rwlock_init(&wl->tx_lock);
4608	spin_lock_init(&wl->leds_lock);
4609	spin_lock_init(&wl->shm_lock);
4610	mutex_init(&wl->mutex);
4611	INIT_LIST_HEAD(&wl->devlist);
4612	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4613	INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4614
4615	ssb_set_devtypedata(dev, wl);
4616	b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4617	err = 0;
4618      out:
4619	return err;
4620}
4621
4622static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4623{
4624	struct b43_wl *wl;
4625	int err;
4626	int first = 0;
4627
4628	wl = ssb_get_devtypedata(dev);
4629	if (!wl) {
4630		/* Probing the first core. Must setup common struct b43_wl */
4631		first = 1;
4632		err = b43_wireless_init(dev);
4633		if (err)
4634			goto out;
4635		wl = ssb_get_devtypedata(dev);
4636		B43_WARN_ON(!wl);
4637	}
4638	err = b43_one_core_attach(dev, wl);
4639	if (err)
4640		goto err_wireless_exit;
4641
4642	if (first) {
4643		err = ieee80211_register_hw(wl->hw);
4644		if (err)
4645			goto err_one_core_detach;
4646	}
4647
4648      out:
4649	return err;
4650
4651      err_one_core_detach:
4652	b43_one_core_detach(dev);
4653      err_wireless_exit:
4654	if (first)
4655		b43_wireless_exit(dev, wl);
4656	return err;
4657}
4658
4659static void b43_remove(struct ssb_device *dev)
4660{
4661	struct b43_wl *wl = ssb_get_devtypedata(dev);
4662	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4663
4664	/* We must cancel any work here before unregistering from ieee80211,
4665	 * as the ieee80211 unreg will destroy the workqueue. */
4666	cancel_work_sync(&wldev->restart_work);
4667
4668	B43_WARN_ON(!wl);
4669	if (wl->current_dev == wldev)
4670		ieee80211_unregister_hw(wl->hw);
4671
4672	b43_one_core_detach(dev);
4673
4674	if (list_empty(&wl->devlist)) {
4675		/* Last core on the chip unregistered.
4676		 * We can destroy common struct b43_wl.
4677		 */
4678		b43_wireless_exit(dev, wl);
4679	}
4680}
4681
4682/* Perform a hardware reset. This can be called from any context. */
4683void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4684{
4685	/* Must avoid requeueing, if we are in shutdown. */
4686	if (b43_status(dev) < B43_STAT_INITIALIZED)
4687		return;
4688	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4689	queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4690}
4691
4692#ifdef CONFIG_PM
4693
4694static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4695{
4696	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4697	struct b43_wl *wl = wldev->wl;
4698
4699	b43dbg(wl, "Suspending...\n");
4700
4701	mutex_lock(&wl->mutex);
4702	wldev->suspend_in_progress = true;
4703	wldev->suspend_init_status = b43_status(wldev);
4704	if (wldev->suspend_init_status >= B43_STAT_STARTED)
4705		b43_wireless_core_stop(wldev);
4706	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4707		b43_wireless_core_exit(wldev);
4708	mutex_unlock(&wl->mutex);
4709
4710	b43dbg(wl, "Device suspended.\n");
4711
4712	return 0;
4713}
4714
4715static int b43_resume(struct ssb_device *dev)
4716{
4717	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4718	struct b43_wl *wl = wldev->wl;
4719	int err = 0;
4720
4721	b43dbg(wl, "Resuming...\n");
4722
4723	mutex_lock(&wl->mutex);
4724	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4725		err = b43_wireless_core_init(wldev);
4726		if (err) {
4727			b43err(wl, "Resume failed at core init\n");
4728			goto out;
4729		}
4730	}
4731	if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4732		err = b43_wireless_core_start(wldev);
4733		if (err) {
4734			b43_leds_exit(wldev);
4735			b43_rng_exit(wldev->wl);
4736			b43_wireless_core_exit(wldev);
4737			b43err(wl, "Resume failed at core start\n");
4738			goto out;
4739		}
4740	}
4741	b43dbg(wl, "Device resumed.\n");
4742 out:
4743	wldev->suspend_in_progress = false;
4744	mutex_unlock(&wl->mutex);
4745	return err;
4746}
4747
4748#else /* CONFIG_PM */
4749# define b43_suspend	NULL
4750# define b43_resume	NULL
4751#endif /* CONFIG_PM */
4752
4753static struct ssb_driver b43_ssb_driver = {
4754	.name		= KBUILD_MODNAME,
4755	.id_table	= b43_ssb_tbl,
4756	.probe		= b43_probe,
4757	.remove		= b43_remove,
4758	.suspend	= b43_suspend,
4759	.resume		= b43_resume,
4760};
4761
4762static void b43_print_driverinfo(void)
4763{
4764	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4765		   *feat_leds = "", *feat_rfkill = "";
4766
4767#ifdef CONFIG_B43_PCI_AUTOSELECT
4768	feat_pci = "P";
4769#endif
4770#ifdef CONFIG_B43_PCMCIA
4771	feat_pcmcia = "M";
4772#endif
4773#ifdef CONFIG_B43_NPHY
4774	feat_nphy = "N";
4775#endif
4776#ifdef CONFIG_B43_LEDS
4777	feat_leds = "L";
4778#endif
4779#ifdef CONFIG_B43_RFKILL
4780	feat_rfkill = "R";
4781#endif
4782	printk(KERN_INFO "Broadcom 43xx driver loaded "
4783	       "[ Features: %s%s%s%s%s, Firmware-ID: "
4784	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
4785	       feat_pci, feat_pcmcia, feat_nphy,
4786	       feat_leds, feat_rfkill);
4787}
4788
4789static int __init b43_init(void)
4790{
4791	int err;
4792
4793	b43_debugfs_init();
4794	err = b43_pcmcia_init();
4795	if (err)
4796		goto err_dfs_exit;
4797	err = ssb_driver_register(&b43_ssb_driver);
4798	if (err)
4799		goto err_pcmcia_exit;
4800	b43_print_driverinfo();
4801
4802	return err;
4803
4804err_pcmcia_exit:
4805	b43_pcmcia_exit();
4806err_dfs_exit:
4807	b43_debugfs_exit();
4808	return err;
4809}
4810
4811static void __exit b43_exit(void)
4812{
4813	ssb_driver_unregister(&b43_ssb_driver);
4814	b43_pcmcia_exit();
4815	b43_debugfs_exit();
4816}
4817
4818module_init(b43_init)
4819module_exit(b43_exit)
4820