main.c revision c7ab5ef9bcd281135c21b4732c9be779585181be
1/*
2
3  Broadcom B43 wireless driver
4
5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11  Some parts of the code in this file are derived from the ipw2200
12  driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14  This program is free software; you can redistribute it and/or modify
15  it under the terms of the GNU General Public License as published by
16  the Free Software Foundation; either version 2 of the License, or
17  (at your option) any later version.
18
19  This program is distributed in the hope that it will be useful,
20  but WITHOUT ANY WARRANTY; without even the implied warranty of
21  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  GNU General Public License for more details.
23
24  You should have received a copy of the GNU General Public License
25  along with this program; see the file COPYING.  If not, write to
26  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27  Boston, MA 02110-1301, USA.
28
29*/
30
31#include <linux/delay.h>
32#include <linux/init.h>
33#include <linux/moduleparam.h>
34#include <linux/if_arp.h>
35#include <linux/etherdevice.h>
36#include <linux/firmware.h>
37#include <linux/wireless.h>
38#include <linux/workqueue.h>
39#include <linux/skbuff.h>
40#include <linux/io.h>
41#include <linux/dma-mapping.h>
42#include <asm/unaligned.h>
43
44#include "b43.h"
45#include "main.h"
46#include "debugfs.h"
47#include "phy_common.h"
48#include "phy_g.h"
49#include "phy_n.h"
50#include "dma.h"
51#include "pio.h"
52#include "sysfs.h"
53#include "xmit.h"
54#include "lo.h"
55#include "pcmcia.h"
56
57MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58MODULE_AUTHOR("Martin Langer");
59MODULE_AUTHOR("Stefano Brivio");
60MODULE_AUTHOR("Michael Buesch");
61MODULE_LICENSE("GPL");
62
63MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66static int modparam_bad_frames_preempt;
67module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68MODULE_PARM_DESC(bad_frames_preempt,
69		 "enable(1) / disable(0) Bad Frames Preemption");
70
71static char modparam_fwpostfix[16];
72module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75static int modparam_hwpctl;
76module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79static int modparam_nohwcrypt;
80module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83int b43_modparam_qos = 1;
84module_param_named(qos, b43_modparam_qos, int, 0444);
85MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
86
87static int modparam_btcoex = 1;
88module_param_named(btcoex, modparam_btcoex, int, 0444);
89MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
90
91
92static const struct ssb_device_id b43_ssb_tbl[] = {
93	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
94	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
95	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
96	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
97	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
98	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
99	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
100	SSB_DEVTABLE_END
101};
102
103MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
104
105/* Channel and ratetables are shared for all devices.
106 * They can't be const, because ieee80211 puts some precalculated
107 * data in there. This data is the same for all devices, so we don't
108 * get concurrency issues */
109#define RATETAB_ENT(_rateid, _flags) \
110	{								\
111		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
112		.hw_value	= (_rateid),				\
113		.flags		= (_flags),				\
114	}
115
116/*
117 * NOTE: When changing this, sync with xmit.c's
118 *	 b43_plcp_get_bitrate_idx_* functions!
119 */
120static struct ieee80211_rate __b43_ratetable[] = {
121	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
122	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
123	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
124	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
125	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
126	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
127	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
128	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
129	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
130	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
131	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
132	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
133};
134
135#define b43_a_ratetable		(__b43_ratetable + 4)
136#define b43_a_ratetable_size	8
137#define b43_b_ratetable		(__b43_ratetable + 0)
138#define b43_b_ratetable_size	4
139#define b43_g_ratetable		(__b43_ratetable + 0)
140#define b43_g_ratetable_size	12
141
142#define CHAN4G(_channel, _freq, _flags) {			\
143	.band			= IEEE80211_BAND_2GHZ,		\
144	.center_freq		= (_freq),			\
145	.hw_value		= (_channel),			\
146	.flags			= (_flags),			\
147	.max_antenna_gain	= 0,				\
148	.max_power		= 30,				\
149}
150static struct ieee80211_channel b43_2ghz_chantable[] = {
151	CHAN4G(1, 2412, 0),
152	CHAN4G(2, 2417, 0),
153	CHAN4G(3, 2422, 0),
154	CHAN4G(4, 2427, 0),
155	CHAN4G(5, 2432, 0),
156	CHAN4G(6, 2437, 0),
157	CHAN4G(7, 2442, 0),
158	CHAN4G(8, 2447, 0),
159	CHAN4G(9, 2452, 0),
160	CHAN4G(10, 2457, 0),
161	CHAN4G(11, 2462, 0),
162	CHAN4G(12, 2467, 0),
163	CHAN4G(13, 2472, 0),
164	CHAN4G(14, 2484, 0),
165};
166#undef CHAN4G
167
168#define CHAN5G(_channel, _flags) {				\
169	.band			= IEEE80211_BAND_5GHZ,		\
170	.center_freq		= 5000 + (5 * (_channel)),	\
171	.hw_value		= (_channel),			\
172	.flags			= (_flags),			\
173	.max_antenna_gain	= 0,				\
174	.max_power		= 30,				\
175}
176static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
177	CHAN5G(32, 0),		CHAN5G(34, 0),
178	CHAN5G(36, 0),		CHAN5G(38, 0),
179	CHAN5G(40, 0),		CHAN5G(42, 0),
180	CHAN5G(44, 0),		CHAN5G(46, 0),
181	CHAN5G(48, 0),		CHAN5G(50, 0),
182	CHAN5G(52, 0),		CHAN5G(54, 0),
183	CHAN5G(56, 0),		CHAN5G(58, 0),
184	CHAN5G(60, 0),		CHAN5G(62, 0),
185	CHAN5G(64, 0),		CHAN5G(66, 0),
186	CHAN5G(68, 0),		CHAN5G(70, 0),
187	CHAN5G(72, 0),		CHAN5G(74, 0),
188	CHAN5G(76, 0),		CHAN5G(78, 0),
189	CHAN5G(80, 0),		CHAN5G(82, 0),
190	CHAN5G(84, 0),		CHAN5G(86, 0),
191	CHAN5G(88, 0),		CHAN5G(90, 0),
192	CHAN5G(92, 0),		CHAN5G(94, 0),
193	CHAN5G(96, 0),		CHAN5G(98, 0),
194	CHAN5G(100, 0),		CHAN5G(102, 0),
195	CHAN5G(104, 0),		CHAN5G(106, 0),
196	CHAN5G(108, 0),		CHAN5G(110, 0),
197	CHAN5G(112, 0),		CHAN5G(114, 0),
198	CHAN5G(116, 0),		CHAN5G(118, 0),
199	CHAN5G(120, 0),		CHAN5G(122, 0),
200	CHAN5G(124, 0),		CHAN5G(126, 0),
201	CHAN5G(128, 0),		CHAN5G(130, 0),
202	CHAN5G(132, 0),		CHAN5G(134, 0),
203	CHAN5G(136, 0),		CHAN5G(138, 0),
204	CHAN5G(140, 0),		CHAN5G(142, 0),
205	CHAN5G(144, 0),		CHAN5G(145, 0),
206	CHAN5G(146, 0),		CHAN5G(147, 0),
207	CHAN5G(148, 0),		CHAN5G(149, 0),
208	CHAN5G(150, 0),		CHAN5G(151, 0),
209	CHAN5G(152, 0),		CHAN5G(153, 0),
210	CHAN5G(154, 0),		CHAN5G(155, 0),
211	CHAN5G(156, 0),		CHAN5G(157, 0),
212	CHAN5G(158, 0),		CHAN5G(159, 0),
213	CHAN5G(160, 0),		CHAN5G(161, 0),
214	CHAN5G(162, 0),		CHAN5G(163, 0),
215	CHAN5G(164, 0),		CHAN5G(165, 0),
216	CHAN5G(166, 0),		CHAN5G(168, 0),
217	CHAN5G(170, 0),		CHAN5G(172, 0),
218	CHAN5G(174, 0),		CHAN5G(176, 0),
219	CHAN5G(178, 0),		CHAN5G(180, 0),
220	CHAN5G(182, 0),		CHAN5G(184, 0),
221	CHAN5G(186, 0),		CHAN5G(188, 0),
222	CHAN5G(190, 0),		CHAN5G(192, 0),
223	CHAN5G(194, 0),		CHAN5G(196, 0),
224	CHAN5G(198, 0),		CHAN5G(200, 0),
225	CHAN5G(202, 0),		CHAN5G(204, 0),
226	CHAN5G(206, 0),		CHAN5G(208, 0),
227	CHAN5G(210, 0),		CHAN5G(212, 0),
228	CHAN5G(214, 0),		CHAN5G(216, 0),
229	CHAN5G(218, 0),		CHAN5G(220, 0),
230	CHAN5G(222, 0),		CHAN5G(224, 0),
231	CHAN5G(226, 0),		CHAN5G(228, 0),
232};
233
234static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
235	CHAN5G(34, 0),		CHAN5G(36, 0),
236	CHAN5G(38, 0),		CHAN5G(40, 0),
237	CHAN5G(42, 0),		CHAN5G(44, 0),
238	CHAN5G(46, 0),		CHAN5G(48, 0),
239	CHAN5G(52, 0),		CHAN5G(56, 0),
240	CHAN5G(60, 0),		CHAN5G(64, 0),
241	CHAN5G(100, 0),		CHAN5G(104, 0),
242	CHAN5G(108, 0),		CHAN5G(112, 0),
243	CHAN5G(116, 0),		CHAN5G(120, 0),
244	CHAN5G(124, 0),		CHAN5G(128, 0),
245	CHAN5G(132, 0),		CHAN5G(136, 0),
246	CHAN5G(140, 0),		CHAN5G(149, 0),
247	CHAN5G(153, 0),		CHAN5G(157, 0),
248	CHAN5G(161, 0),		CHAN5G(165, 0),
249	CHAN5G(184, 0),		CHAN5G(188, 0),
250	CHAN5G(192, 0),		CHAN5G(196, 0),
251	CHAN5G(200, 0),		CHAN5G(204, 0),
252	CHAN5G(208, 0),		CHAN5G(212, 0),
253	CHAN5G(216, 0),
254};
255#undef CHAN5G
256
257static struct ieee80211_supported_band b43_band_5GHz_nphy = {
258	.band		= IEEE80211_BAND_5GHZ,
259	.channels	= b43_5ghz_nphy_chantable,
260	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
261	.bitrates	= b43_a_ratetable,
262	.n_bitrates	= b43_a_ratetable_size,
263};
264
265static struct ieee80211_supported_band b43_band_5GHz_aphy = {
266	.band		= IEEE80211_BAND_5GHZ,
267	.channels	= b43_5ghz_aphy_chantable,
268	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
269	.bitrates	= b43_a_ratetable,
270	.n_bitrates	= b43_a_ratetable_size,
271};
272
273static struct ieee80211_supported_band b43_band_2GHz = {
274	.band		= IEEE80211_BAND_2GHZ,
275	.channels	= b43_2ghz_chantable,
276	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
277	.bitrates	= b43_g_ratetable,
278	.n_bitrates	= b43_g_ratetable_size,
279};
280
281static void b43_wireless_core_exit(struct b43_wldev *dev);
282static int b43_wireless_core_init(struct b43_wldev *dev);
283static void b43_wireless_core_stop(struct b43_wldev *dev);
284static int b43_wireless_core_start(struct b43_wldev *dev);
285
286static int b43_ratelimit(struct b43_wl *wl)
287{
288	if (!wl || !wl->current_dev)
289		return 1;
290	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
291		return 1;
292	/* We are up and running.
293	 * Ratelimit the messages to avoid DoS over the net. */
294	return net_ratelimit();
295}
296
297void b43info(struct b43_wl *wl, const char *fmt, ...)
298{
299	va_list args;
300
301	if (!b43_ratelimit(wl))
302		return;
303	va_start(args, fmt);
304	printk(KERN_INFO "b43-%s: ",
305	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
306	vprintk(fmt, args);
307	va_end(args);
308}
309
310void b43err(struct b43_wl *wl, const char *fmt, ...)
311{
312	va_list args;
313
314	if (!b43_ratelimit(wl))
315		return;
316	va_start(args, fmt);
317	printk(KERN_ERR "b43-%s ERROR: ",
318	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
319	vprintk(fmt, args);
320	va_end(args);
321}
322
323void b43warn(struct b43_wl *wl, const char *fmt, ...)
324{
325	va_list args;
326
327	if (!b43_ratelimit(wl))
328		return;
329	va_start(args, fmt);
330	printk(KERN_WARNING "b43-%s warning: ",
331	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
332	vprintk(fmt, args);
333	va_end(args);
334}
335
336#if B43_DEBUG
337void b43dbg(struct b43_wl *wl, const char *fmt, ...)
338{
339	va_list args;
340
341	va_start(args, fmt);
342	printk(KERN_DEBUG "b43-%s debug: ",
343	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
344	vprintk(fmt, args);
345	va_end(args);
346}
347#endif /* DEBUG */
348
349static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
350{
351	u32 macctl;
352
353	B43_WARN_ON(offset % 4 != 0);
354
355	macctl = b43_read32(dev, B43_MMIO_MACCTL);
356	if (macctl & B43_MACCTL_BE)
357		val = swab32(val);
358
359	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
360	mmiowb();
361	b43_write32(dev, B43_MMIO_RAM_DATA, val);
362}
363
364static inline void b43_shm_control_word(struct b43_wldev *dev,
365					u16 routing, u16 offset)
366{
367	u32 control;
368
369	/* "offset" is the WORD offset. */
370	control = routing;
371	control <<= 16;
372	control |= offset;
373	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
374}
375
376u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
377{
378	u32 ret;
379
380	if (routing == B43_SHM_SHARED) {
381		B43_WARN_ON(offset & 0x0001);
382		if (offset & 0x0003) {
383			/* Unaligned access */
384			b43_shm_control_word(dev, routing, offset >> 2);
385			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
386			ret <<= 16;
387			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
388			ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
389
390			goto out;
391		}
392		offset >>= 2;
393	}
394	b43_shm_control_word(dev, routing, offset);
395	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
396out:
397	return ret;
398}
399
400u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
401{
402	struct b43_wl *wl = dev->wl;
403	unsigned long flags;
404	u32 ret;
405
406	spin_lock_irqsave(&wl->shm_lock, flags);
407	ret = __b43_shm_read32(dev, routing, offset);
408	spin_unlock_irqrestore(&wl->shm_lock, flags);
409
410	return ret;
411}
412
413u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
414{
415	u16 ret;
416
417	if (routing == B43_SHM_SHARED) {
418		B43_WARN_ON(offset & 0x0001);
419		if (offset & 0x0003) {
420			/* Unaligned access */
421			b43_shm_control_word(dev, routing, offset >> 2);
422			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
423
424			goto out;
425		}
426		offset >>= 2;
427	}
428	b43_shm_control_word(dev, routing, offset);
429	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
430out:
431	return ret;
432}
433
434u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
435{
436	struct b43_wl *wl = dev->wl;
437	unsigned long flags;
438	u16 ret;
439
440	spin_lock_irqsave(&wl->shm_lock, flags);
441	ret = __b43_shm_read16(dev, routing, offset);
442	spin_unlock_irqrestore(&wl->shm_lock, flags);
443
444	return ret;
445}
446
447void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
448{
449	if (routing == B43_SHM_SHARED) {
450		B43_WARN_ON(offset & 0x0001);
451		if (offset & 0x0003) {
452			/* Unaligned access */
453			b43_shm_control_word(dev, routing, offset >> 2);
454			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
455				    (value >> 16) & 0xffff);
456			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
457			b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
458			return;
459		}
460		offset >>= 2;
461	}
462	b43_shm_control_word(dev, routing, offset);
463	b43_write32(dev, B43_MMIO_SHM_DATA, value);
464}
465
466void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
467{
468	struct b43_wl *wl = dev->wl;
469	unsigned long flags;
470
471	spin_lock_irqsave(&wl->shm_lock, flags);
472	__b43_shm_write32(dev, routing, offset, value);
473	spin_unlock_irqrestore(&wl->shm_lock, flags);
474}
475
476void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
477{
478	if (routing == B43_SHM_SHARED) {
479		B43_WARN_ON(offset & 0x0001);
480		if (offset & 0x0003) {
481			/* Unaligned access */
482			b43_shm_control_word(dev, routing, offset >> 2);
483			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
484			return;
485		}
486		offset >>= 2;
487	}
488	b43_shm_control_word(dev, routing, offset);
489	b43_write16(dev, B43_MMIO_SHM_DATA, value);
490}
491
492void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
493{
494	struct b43_wl *wl = dev->wl;
495	unsigned long flags;
496
497	spin_lock_irqsave(&wl->shm_lock, flags);
498	__b43_shm_write16(dev, routing, offset, value);
499	spin_unlock_irqrestore(&wl->shm_lock, flags);
500}
501
502/* Read HostFlags */
503u64 b43_hf_read(struct b43_wldev * dev)
504{
505	u64 ret;
506
507	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
508	ret <<= 16;
509	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
510	ret <<= 16;
511	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
512
513	return ret;
514}
515
516/* Write HostFlags */
517void b43_hf_write(struct b43_wldev *dev, u64 value)
518{
519	u16 lo, mi, hi;
520
521	lo = (value & 0x00000000FFFFULL);
522	mi = (value & 0x0000FFFF0000ULL) >> 16;
523	hi = (value & 0xFFFF00000000ULL) >> 32;
524	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
525	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
526	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
527}
528
529void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
530{
531	/* We need to be careful. As we read the TSF from multiple
532	 * registers, we should take care of register overflows.
533	 * In theory, the whole tsf read process should be atomic.
534	 * We try to be atomic here, by restaring the read process,
535	 * if any of the high registers changed (overflew).
536	 */
537	if (dev->dev->id.revision >= 3) {
538		u32 low, high, high2;
539
540		do {
541			high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
542			low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
543			high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
544		} while (unlikely(high != high2));
545
546		*tsf = high;
547		*tsf <<= 32;
548		*tsf |= low;
549	} else {
550		u64 tmp;
551		u16 v0, v1, v2, v3;
552		u16 test1, test2, test3;
553
554		do {
555			v3 = b43_read16(dev, B43_MMIO_TSF_3);
556			v2 = b43_read16(dev, B43_MMIO_TSF_2);
557			v1 = b43_read16(dev, B43_MMIO_TSF_1);
558			v0 = b43_read16(dev, B43_MMIO_TSF_0);
559
560			test3 = b43_read16(dev, B43_MMIO_TSF_3);
561			test2 = b43_read16(dev, B43_MMIO_TSF_2);
562			test1 = b43_read16(dev, B43_MMIO_TSF_1);
563		} while (v3 != test3 || v2 != test2 || v1 != test1);
564
565		*tsf = v3;
566		*tsf <<= 48;
567		tmp = v2;
568		tmp <<= 32;
569		*tsf |= tmp;
570		tmp = v1;
571		tmp <<= 16;
572		*tsf |= tmp;
573		*tsf |= v0;
574	}
575}
576
577static void b43_time_lock(struct b43_wldev *dev)
578{
579	u32 macctl;
580
581	macctl = b43_read32(dev, B43_MMIO_MACCTL);
582	macctl |= B43_MACCTL_TBTTHOLD;
583	b43_write32(dev, B43_MMIO_MACCTL, macctl);
584	/* Commit the write */
585	b43_read32(dev, B43_MMIO_MACCTL);
586}
587
588static void b43_time_unlock(struct b43_wldev *dev)
589{
590	u32 macctl;
591
592	macctl = b43_read32(dev, B43_MMIO_MACCTL);
593	macctl &= ~B43_MACCTL_TBTTHOLD;
594	b43_write32(dev, B43_MMIO_MACCTL, macctl);
595	/* Commit the write */
596	b43_read32(dev, B43_MMIO_MACCTL);
597}
598
599static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
600{
601	/* Be careful with the in-progress timer.
602	 * First zero out the low register, so we have a full
603	 * register-overflow duration to complete the operation.
604	 */
605	if (dev->dev->id.revision >= 3) {
606		u32 lo = (tsf & 0x00000000FFFFFFFFULL);
607		u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
608
609		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
610		mmiowb();
611		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
612		mmiowb();
613		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
614	} else {
615		u16 v0 = (tsf & 0x000000000000FFFFULL);
616		u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
617		u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
618		u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
619
620		b43_write16(dev, B43_MMIO_TSF_0, 0);
621		mmiowb();
622		b43_write16(dev, B43_MMIO_TSF_3, v3);
623		mmiowb();
624		b43_write16(dev, B43_MMIO_TSF_2, v2);
625		mmiowb();
626		b43_write16(dev, B43_MMIO_TSF_1, v1);
627		mmiowb();
628		b43_write16(dev, B43_MMIO_TSF_0, v0);
629	}
630}
631
632void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
633{
634	b43_time_lock(dev);
635	b43_tsf_write_locked(dev, tsf);
636	b43_time_unlock(dev);
637}
638
639static
640void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
641{
642	static const u8 zero_addr[ETH_ALEN] = { 0 };
643	u16 data;
644
645	if (!mac)
646		mac = zero_addr;
647
648	offset |= 0x0020;
649	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
650
651	data = mac[0];
652	data |= mac[1] << 8;
653	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
654	data = mac[2];
655	data |= mac[3] << 8;
656	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
657	data = mac[4];
658	data |= mac[5] << 8;
659	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
660}
661
662static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
663{
664	const u8 *mac;
665	const u8 *bssid;
666	u8 mac_bssid[ETH_ALEN * 2];
667	int i;
668	u32 tmp;
669
670	bssid = dev->wl->bssid;
671	mac = dev->wl->mac_addr;
672
673	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
674
675	memcpy(mac_bssid, mac, ETH_ALEN);
676	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
677
678	/* Write our MAC address and BSSID to template ram */
679	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
680		tmp = (u32) (mac_bssid[i + 0]);
681		tmp |= (u32) (mac_bssid[i + 1]) << 8;
682		tmp |= (u32) (mac_bssid[i + 2]) << 16;
683		tmp |= (u32) (mac_bssid[i + 3]) << 24;
684		b43_ram_write(dev, 0x20 + i, tmp);
685	}
686}
687
688static void b43_upload_card_macaddress(struct b43_wldev *dev)
689{
690	b43_write_mac_bssid_templates(dev);
691	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
692}
693
694static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
695{
696	/* slot_time is in usec. */
697	if (dev->phy.type != B43_PHYTYPE_G)
698		return;
699	b43_write16(dev, 0x684, 510 + slot_time);
700	b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
701}
702
703static void b43_short_slot_timing_enable(struct b43_wldev *dev)
704{
705	b43_set_slot_time(dev, 9);
706}
707
708static void b43_short_slot_timing_disable(struct b43_wldev *dev)
709{
710	b43_set_slot_time(dev, 20);
711}
712
713/* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
714 * Returns the _previously_ enabled IRQ mask.
715 */
716static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
717{
718	u32 old_mask;
719
720	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
721	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
722
723	return old_mask;
724}
725
726/* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
727 * Returns the _previously_ enabled IRQ mask.
728 */
729static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
730{
731	u32 old_mask;
732
733	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
734	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
735
736	return old_mask;
737}
738
739/* Synchronize IRQ top- and bottom-half.
740 * IRQs must be masked before calling this.
741 * This must not be called with the irq_lock held.
742 */
743static void b43_synchronize_irq(struct b43_wldev *dev)
744{
745	synchronize_irq(dev->dev->irq);
746	tasklet_kill(&dev->isr_tasklet);
747}
748
749/* DummyTransmission function, as documented on
750 * http://bcm-specs.sipsolutions.net/DummyTransmission
751 */
752void b43_dummy_transmission(struct b43_wldev *dev)
753{
754	struct b43_wl *wl = dev->wl;
755	struct b43_phy *phy = &dev->phy;
756	unsigned int i, max_loop;
757	u16 value;
758	u32 buffer[5] = {
759		0x00000000,
760		0x00D40000,
761		0x00000000,
762		0x01000000,
763		0x00000000,
764	};
765
766	switch (phy->type) {
767	case B43_PHYTYPE_A:
768		max_loop = 0x1E;
769		buffer[0] = 0x000201CC;
770		break;
771	case B43_PHYTYPE_B:
772	case B43_PHYTYPE_G:
773		max_loop = 0xFA;
774		buffer[0] = 0x000B846E;
775		break;
776	default:
777		B43_WARN_ON(1);
778		return;
779	}
780
781	spin_lock_irq(&wl->irq_lock);
782	write_lock(&wl->tx_lock);
783
784	for (i = 0; i < 5; i++)
785		b43_ram_write(dev, i * 4, buffer[i]);
786
787	/* Commit writes */
788	b43_read32(dev, B43_MMIO_MACCTL);
789
790	b43_write16(dev, 0x0568, 0x0000);
791	b43_write16(dev, 0x07C0, 0x0000);
792	value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
793	b43_write16(dev, 0x050C, value);
794	b43_write16(dev, 0x0508, 0x0000);
795	b43_write16(dev, 0x050A, 0x0000);
796	b43_write16(dev, 0x054C, 0x0000);
797	b43_write16(dev, 0x056A, 0x0014);
798	b43_write16(dev, 0x0568, 0x0826);
799	b43_write16(dev, 0x0500, 0x0000);
800	b43_write16(dev, 0x0502, 0x0030);
801
802	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
803		b43_radio_write16(dev, 0x0051, 0x0017);
804	for (i = 0x00; i < max_loop; i++) {
805		value = b43_read16(dev, 0x050E);
806		if (value & 0x0080)
807			break;
808		udelay(10);
809	}
810	for (i = 0x00; i < 0x0A; i++) {
811		value = b43_read16(dev, 0x050E);
812		if (value & 0x0400)
813			break;
814		udelay(10);
815	}
816	for (i = 0x00; i < 0x19; i++) {
817		value = b43_read16(dev, 0x0690);
818		if (!(value & 0x0100))
819			break;
820		udelay(10);
821	}
822	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
823		b43_radio_write16(dev, 0x0051, 0x0037);
824
825	write_unlock(&wl->tx_lock);
826	spin_unlock_irq(&wl->irq_lock);
827}
828
829static void key_write(struct b43_wldev *dev,
830		      u8 index, u8 algorithm, const u8 * key)
831{
832	unsigned int i;
833	u32 offset;
834	u16 value;
835	u16 kidx;
836
837	/* Key index/algo block */
838	kidx = b43_kidx_to_fw(dev, index);
839	value = ((kidx << 4) | algorithm);
840	b43_shm_write16(dev, B43_SHM_SHARED,
841			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
842
843	/* Write the key to the Key Table Pointer offset */
844	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
845	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
846		value = key[i];
847		value |= (u16) (key[i + 1]) << 8;
848		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
849	}
850}
851
852static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
853{
854	u32 addrtmp[2] = { 0, 0, };
855	u8 per_sta_keys_start = 8;
856
857	if (b43_new_kidx_api(dev))
858		per_sta_keys_start = 4;
859
860	B43_WARN_ON(index < per_sta_keys_start);
861	/* We have two default TX keys and possibly two default RX keys.
862	 * Physical mac 0 is mapped to physical key 4 or 8, depending
863	 * on the firmware version.
864	 * So we must adjust the index here.
865	 */
866	index -= per_sta_keys_start;
867
868	if (addr) {
869		addrtmp[0] = addr[0];
870		addrtmp[0] |= ((u32) (addr[1]) << 8);
871		addrtmp[0] |= ((u32) (addr[2]) << 16);
872		addrtmp[0] |= ((u32) (addr[3]) << 24);
873		addrtmp[1] = addr[4];
874		addrtmp[1] |= ((u32) (addr[5]) << 8);
875	}
876
877	if (dev->dev->id.revision >= 5) {
878		/* Receive match transmitter address mechanism */
879		b43_shm_write32(dev, B43_SHM_RCMTA,
880				(index * 2) + 0, addrtmp[0]);
881		b43_shm_write16(dev, B43_SHM_RCMTA,
882				(index * 2) + 1, addrtmp[1]);
883	} else {
884		/* RXE (Receive Engine) and
885		 * PSM (Programmable State Machine) mechanism
886		 */
887		if (index < 8) {
888			/* TODO write to RCM 16, 19, 22 and 25 */
889		} else {
890			b43_shm_write32(dev, B43_SHM_SHARED,
891					B43_SHM_SH_PSM + (index * 6) + 0,
892					addrtmp[0]);
893			b43_shm_write16(dev, B43_SHM_SHARED,
894					B43_SHM_SH_PSM + (index * 6) + 4,
895					addrtmp[1]);
896		}
897	}
898}
899
900static void do_key_write(struct b43_wldev *dev,
901			 u8 index, u8 algorithm,
902			 const u8 * key, size_t key_len, const u8 * mac_addr)
903{
904	u8 buf[B43_SEC_KEYSIZE] = { 0, };
905	u8 per_sta_keys_start = 8;
906
907	if (b43_new_kidx_api(dev))
908		per_sta_keys_start = 4;
909
910	B43_WARN_ON(index >= dev->max_nr_keys);
911	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
912
913	if (index >= per_sta_keys_start)
914		keymac_write(dev, index, NULL);	/* First zero out mac. */
915	if (key)
916		memcpy(buf, key, key_len);
917	key_write(dev, index, algorithm, buf);
918	if (index >= per_sta_keys_start)
919		keymac_write(dev, index, mac_addr);
920
921	dev->key[index].algorithm = algorithm;
922}
923
924static int b43_key_write(struct b43_wldev *dev,
925			 int index, u8 algorithm,
926			 const u8 * key, size_t key_len,
927			 const u8 * mac_addr,
928			 struct ieee80211_key_conf *keyconf)
929{
930	int i;
931	int sta_keys_start;
932
933	if (key_len > B43_SEC_KEYSIZE)
934		return -EINVAL;
935	for (i = 0; i < dev->max_nr_keys; i++) {
936		/* Check that we don't already have this key. */
937		B43_WARN_ON(dev->key[i].keyconf == keyconf);
938	}
939	if (index < 0) {
940		/* Either pairwise key or address is 00:00:00:00:00:00
941		 * for transmit-only keys. Search the index. */
942		if (b43_new_kidx_api(dev))
943			sta_keys_start = 4;
944		else
945			sta_keys_start = 8;
946		for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
947			if (!dev->key[i].keyconf) {
948				/* found empty */
949				index = i;
950				break;
951			}
952		}
953		if (index < 0) {
954			b43err(dev->wl, "Out of hardware key memory\n");
955			return -ENOSPC;
956		}
957	} else
958		B43_WARN_ON(index > 3);
959
960	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
961	if ((index <= 3) && !b43_new_kidx_api(dev)) {
962		/* Default RX key */
963		B43_WARN_ON(mac_addr);
964		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
965	}
966	keyconf->hw_key_idx = index;
967	dev->key[index].keyconf = keyconf;
968
969	return 0;
970}
971
972static int b43_key_clear(struct b43_wldev *dev, int index)
973{
974	if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
975		return -EINVAL;
976	do_key_write(dev, index, B43_SEC_ALGO_NONE,
977		     NULL, B43_SEC_KEYSIZE, NULL);
978	if ((index <= 3) && !b43_new_kidx_api(dev)) {
979		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
980			     NULL, B43_SEC_KEYSIZE, NULL);
981	}
982	dev->key[index].keyconf = NULL;
983
984	return 0;
985}
986
987static void b43_clear_keys(struct b43_wldev *dev)
988{
989	int i;
990
991	for (i = 0; i < dev->max_nr_keys; i++)
992		b43_key_clear(dev, i);
993}
994
995void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
996{
997	u32 macctl;
998	u16 ucstat;
999	bool hwps;
1000	bool awake;
1001	int i;
1002
1003	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1004		    (ps_flags & B43_PS_DISABLED));
1005	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1006
1007	if (ps_flags & B43_PS_ENABLED) {
1008		hwps = 1;
1009	} else if (ps_flags & B43_PS_DISABLED) {
1010		hwps = 0;
1011	} else {
1012		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1013		//      and thus is not an AP and we are associated, set bit 25
1014	}
1015	if (ps_flags & B43_PS_AWAKE) {
1016		awake = 1;
1017	} else if (ps_flags & B43_PS_ASLEEP) {
1018		awake = 0;
1019	} else {
1020		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1021		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1022		//      successful, set bit26
1023	}
1024
1025/* FIXME: For now we force awake-on and hwps-off */
1026	hwps = 0;
1027	awake = 1;
1028
1029	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1030	if (hwps)
1031		macctl |= B43_MACCTL_HWPS;
1032	else
1033		macctl &= ~B43_MACCTL_HWPS;
1034	if (awake)
1035		macctl |= B43_MACCTL_AWAKE;
1036	else
1037		macctl &= ~B43_MACCTL_AWAKE;
1038	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1039	/* Commit write */
1040	b43_read32(dev, B43_MMIO_MACCTL);
1041	if (awake && dev->dev->id.revision >= 5) {
1042		/* Wait for the microcode to wake up. */
1043		for (i = 0; i < 100; i++) {
1044			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1045						B43_SHM_SH_UCODESTAT);
1046			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1047				break;
1048			udelay(10);
1049		}
1050	}
1051}
1052
1053void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1054{
1055	u32 tmslow;
1056	u32 macctl;
1057
1058	flags |= B43_TMSLOW_PHYCLKEN;
1059	flags |= B43_TMSLOW_PHYRESET;
1060	ssb_device_enable(dev->dev, flags);
1061	msleep(2);		/* Wait for the PLL to turn on. */
1062
1063	/* Now take the PHY out of Reset again */
1064	tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1065	tmslow |= SSB_TMSLOW_FGC;
1066	tmslow &= ~B43_TMSLOW_PHYRESET;
1067	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1068	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1069	msleep(1);
1070	tmslow &= ~SSB_TMSLOW_FGC;
1071	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1072	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1073	msleep(1);
1074
1075	/* Turn Analog ON, but only if we already know the PHY-type.
1076	 * This protects against very early setup where we don't know the
1077	 * PHY-type, yet. wireless_core_reset will be called once again later,
1078	 * when we know the PHY-type. */
1079	if (dev->phy.ops)
1080		dev->phy.ops->switch_analog(dev, 1);
1081
1082	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1083	macctl &= ~B43_MACCTL_GMODE;
1084	if (flags & B43_TMSLOW_GMODE)
1085		macctl |= B43_MACCTL_GMODE;
1086	macctl |= B43_MACCTL_IHR_ENABLED;
1087	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1088}
1089
1090static void handle_irq_transmit_status(struct b43_wldev *dev)
1091{
1092	u32 v0, v1;
1093	u16 tmp;
1094	struct b43_txstatus stat;
1095
1096	while (1) {
1097		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1098		if (!(v0 & 0x00000001))
1099			break;
1100		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1101
1102		stat.cookie = (v0 >> 16);
1103		stat.seq = (v1 & 0x0000FFFF);
1104		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1105		tmp = (v0 & 0x0000FFFF);
1106		stat.frame_count = ((tmp & 0xF000) >> 12);
1107		stat.rts_count = ((tmp & 0x0F00) >> 8);
1108		stat.supp_reason = ((tmp & 0x001C) >> 2);
1109		stat.pm_indicated = !!(tmp & 0x0080);
1110		stat.intermediate = !!(tmp & 0x0040);
1111		stat.for_ampdu = !!(tmp & 0x0020);
1112		stat.acked = !!(tmp & 0x0002);
1113
1114		b43_handle_txstatus(dev, &stat);
1115	}
1116}
1117
1118static void drain_txstatus_queue(struct b43_wldev *dev)
1119{
1120	u32 dummy;
1121
1122	if (dev->dev->id.revision < 5)
1123		return;
1124	/* Read all entries from the microcode TXstatus FIFO
1125	 * and throw them away.
1126	 */
1127	while (1) {
1128		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1129		if (!(dummy & 0x00000001))
1130			break;
1131		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1132	}
1133}
1134
1135static u32 b43_jssi_read(struct b43_wldev *dev)
1136{
1137	u32 val = 0;
1138
1139	val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1140	val <<= 16;
1141	val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1142
1143	return val;
1144}
1145
1146static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1147{
1148	b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1149	b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1150}
1151
1152static void b43_generate_noise_sample(struct b43_wldev *dev)
1153{
1154	b43_jssi_write(dev, 0x7F7F7F7F);
1155	b43_write32(dev, B43_MMIO_MACCMD,
1156		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1157}
1158
1159static void b43_calculate_link_quality(struct b43_wldev *dev)
1160{
1161	/* Top half of Link Quality calculation. */
1162
1163	if (dev->phy.type != B43_PHYTYPE_G)
1164		return;
1165	if (dev->noisecalc.calculation_running)
1166		return;
1167	dev->noisecalc.calculation_running = 1;
1168	dev->noisecalc.nr_samples = 0;
1169
1170	b43_generate_noise_sample(dev);
1171}
1172
1173static void handle_irq_noise(struct b43_wldev *dev)
1174{
1175	struct b43_phy_g *phy = dev->phy.g;
1176	u16 tmp;
1177	u8 noise[4];
1178	u8 i, j;
1179	s32 average;
1180
1181	/* Bottom half of Link Quality calculation. */
1182
1183	if (dev->phy.type != B43_PHYTYPE_G)
1184		return;
1185
1186	/* Possible race condition: It might be possible that the user
1187	 * changed to a different channel in the meantime since we
1188	 * started the calculation. We ignore that fact, since it's
1189	 * not really that much of a problem. The background noise is
1190	 * an estimation only anyway. Slightly wrong results will get damped
1191	 * by the averaging of the 8 sample rounds. Additionally the
1192	 * value is shortlived. So it will be replaced by the next noise
1193	 * calculation round soon. */
1194
1195	B43_WARN_ON(!dev->noisecalc.calculation_running);
1196	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1197	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1198	    noise[2] == 0x7F || noise[3] == 0x7F)
1199		goto generate_new;
1200
1201	/* Get the noise samples. */
1202	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1203	i = dev->noisecalc.nr_samples;
1204	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1205	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1206	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1207	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1208	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1209	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1210	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1211	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1212	dev->noisecalc.nr_samples++;
1213	if (dev->noisecalc.nr_samples == 8) {
1214		/* Calculate the Link Quality by the noise samples. */
1215		average = 0;
1216		for (i = 0; i < 8; i++) {
1217			for (j = 0; j < 4; j++)
1218				average += dev->noisecalc.samples[i][j];
1219		}
1220		average /= (8 * 4);
1221		average *= 125;
1222		average += 64;
1223		average /= 128;
1224		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1225		tmp = (tmp / 128) & 0x1F;
1226		if (tmp >= 8)
1227			average += 2;
1228		else
1229			average -= 25;
1230		if (tmp == 8)
1231			average -= 72;
1232		else
1233			average -= 48;
1234
1235		dev->stats.link_noise = average;
1236		dev->noisecalc.calculation_running = 0;
1237		return;
1238	}
1239generate_new:
1240	b43_generate_noise_sample(dev);
1241}
1242
1243static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1244{
1245	if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1246		///TODO: PS TBTT
1247	} else {
1248		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1249			b43_power_saving_ctl_bits(dev, 0);
1250	}
1251	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1252		dev->dfq_valid = 1;
1253}
1254
1255static void handle_irq_atim_end(struct b43_wldev *dev)
1256{
1257	if (dev->dfq_valid) {
1258		b43_write32(dev, B43_MMIO_MACCMD,
1259			    b43_read32(dev, B43_MMIO_MACCMD)
1260			    | B43_MACCMD_DFQ_VALID);
1261		dev->dfq_valid = 0;
1262	}
1263}
1264
1265static void handle_irq_pmq(struct b43_wldev *dev)
1266{
1267	u32 tmp;
1268
1269	//TODO: AP mode.
1270
1271	while (1) {
1272		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1273		if (!(tmp & 0x00000008))
1274			break;
1275	}
1276	/* 16bit write is odd, but correct. */
1277	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1278}
1279
1280static void b43_write_template_common(struct b43_wldev *dev,
1281				      const u8 * data, u16 size,
1282				      u16 ram_offset,
1283				      u16 shm_size_offset, u8 rate)
1284{
1285	u32 i, tmp;
1286	struct b43_plcp_hdr4 plcp;
1287
1288	plcp.data = 0;
1289	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1290	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1291	ram_offset += sizeof(u32);
1292	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1293	 * So leave the first two bytes of the next write blank.
1294	 */
1295	tmp = (u32) (data[0]) << 16;
1296	tmp |= (u32) (data[1]) << 24;
1297	b43_ram_write(dev, ram_offset, tmp);
1298	ram_offset += sizeof(u32);
1299	for (i = 2; i < size; i += sizeof(u32)) {
1300		tmp = (u32) (data[i + 0]);
1301		if (i + 1 < size)
1302			tmp |= (u32) (data[i + 1]) << 8;
1303		if (i + 2 < size)
1304			tmp |= (u32) (data[i + 2]) << 16;
1305		if (i + 3 < size)
1306			tmp |= (u32) (data[i + 3]) << 24;
1307		b43_ram_write(dev, ram_offset + i - 2, tmp);
1308	}
1309	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1310			size + sizeof(struct b43_plcp_hdr6));
1311}
1312
1313/* Check if the use of the antenna that ieee80211 told us to
1314 * use is possible. This will fall back to DEFAULT.
1315 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1316u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1317				  u8 antenna_nr)
1318{
1319	u8 antenna_mask;
1320
1321	if (antenna_nr == 0) {
1322		/* Zero means "use default antenna". That's always OK. */
1323		return 0;
1324	}
1325
1326	/* Get the mask of available antennas. */
1327	if (dev->phy.gmode)
1328		antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1329	else
1330		antenna_mask = dev->dev->bus->sprom.ant_available_a;
1331
1332	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1333		/* This antenna is not available. Fall back to default. */
1334		return 0;
1335	}
1336
1337	return antenna_nr;
1338}
1339
1340/* Convert a b43 antenna number value to the PHY TX control value. */
1341static u16 b43_antenna_to_phyctl(int antenna)
1342{
1343	switch (antenna) {
1344	case B43_ANTENNA0:
1345		return B43_TXH_PHY_ANT0;
1346	case B43_ANTENNA1:
1347		return B43_TXH_PHY_ANT1;
1348	case B43_ANTENNA2:
1349		return B43_TXH_PHY_ANT2;
1350	case B43_ANTENNA3:
1351		return B43_TXH_PHY_ANT3;
1352	case B43_ANTENNA_AUTO:
1353		return B43_TXH_PHY_ANT01AUTO;
1354	}
1355	B43_WARN_ON(1);
1356	return 0;
1357}
1358
1359static void b43_write_beacon_template(struct b43_wldev *dev,
1360				      u16 ram_offset,
1361				      u16 shm_size_offset)
1362{
1363	unsigned int i, len, variable_len;
1364	const struct ieee80211_mgmt *bcn;
1365	const u8 *ie;
1366	bool tim_found = 0;
1367	unsigned int rate;
1368	u16 ctl;
1369	int antenna;
1370	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1371
1372	bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1373	len = min((size_t) dev->wl->current_beacon->len,
1374		  0x200 - sizeof(struct b43_plcp_hdr6));
1375	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1376
1377	b43_write_template_common(dev, (const u8 *)bcn,
1378				  len, ram_offset, shm_size_offset, rate);
1379
1380	/* Write the PHY TX control parameters. */
1381	antenna = B43_ANTENNA_DEFAULT;
1382	antenna = b43_antenna_to_phyctl(antenna);
1383	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1384	/* We can't send beacons with short preamble. Would get PHY errors. */
1385	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1386	ctl &= ~B43_TXH_PHY_ANT;
1387	ctl &= ~B43_TXH_PHY_ENC;
1388	ctl |= antenna;
1389	if (b43_is_cck_rate(rate))
1390		ctl |= B43_TXH_PHY_ENC_CCK;
1391	else
1392		ctl |= B43_TXH_PHY_ENC_OFDM;
1393	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1394
1395	/* Find the position of the TIM and the DTIM_period value
1396	 * and write them to SHM. */
1397	ie = bcn->u.beacon.variable;
1398	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1399	for (i = 0; i < variable_len - 2; ) {
1400		uint8_t ie_id, ie_len;
1401
1402		ie_id = ie[i];
1403		ie_len = ie[i + 1];
1404		if (ie_id == 5) {
1405			u16 tim_position;
1406			u16 dtim_period;
1407			/* This is the TIM Information Element */
1408
1409			/* Check whether the ie_len is in the beacon data range. */
1410			if (variable_len < ie_len + 2 + i)
1411				break;
1412			/* A valid TIM is at least 4 bytes long. */
1413			if (ie_len < 4)
1414				break;
1415			tim_found = 1;
1416
1417			tim_position = sizeof(struct b43_plcp_hdr6);
1418			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1419			tim_position += i;
1420
1421			dtim_period = ie[i + 3];
1422
1423			b43_shm_write16(dev, B43_SHM_SHARED,
1424					B43_SHM_SH_TIMBPOS, tim_position);
1425			b43_shm_write16(dev, B43_SHM_SHARED,
1426					B43_SHM_SH_DTIMPER, dtim_period);
1427			break;
1428		}
1429		i += ie_len + 2;
1430	}
1431	if (!tim_found) {
1432		/*
1433		 * If ucode wants to modify TIM do it behind the beacon, this
1434		 * will happen, for example, when doing mesh networking.
1435		 */
1436		b43_shm_write16(dev, B43_SHM_SHARED,
1437				B43_SHM_SH_TIMBPOS,
1438				len + sizeof(struct b43_plcp_hdr6));
1439		b43_shm_write16(dev, B43_SHM_SHARED,
1440				B43_SHM_SH_DTIMPER, 0);
1441	}
1442	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1443}
1444
1445static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1446				      u16 shm_offset, u16 size,
1447				      struct ieee80211_rate *rate)
1448{
1449	struct b43_plcp_hdr4 plcp;
1450	u32 tmp;
1451	__le16 dur;
1452
1453	plcp.data = 0;
1454	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1455	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1456					       dev->wl->vif, size,
1457					       rate);
1458	/* Write PLCP in two parts and timing for packet transfer */
1459	tmp = le32_to_cpu(plcp.data);
1460	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1461	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1462	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1463}
1464
1465/* Instead of using custom probe response template, this function
1466 * just patches custom beacon template by:
1467 * 1) Changing packet type
1468 * 2) Patching duration field
1469 * 3) Stripping TIM
1470 */
1471static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1472					  u16 *dest_size,
1473					  struct ieee80211_rate *rate)
1474{
1475	const u8 *src_data;
1476	u8 *dest_data;
1477	u16 src_size, elem_size, src_pos, dest_pos;
1478	__le16 dur;
1479	struct ieee80211_hdr *hdr;
1480	size_t ie_start;
1481
1482	src_size = dev->wl->current_beacon->len;
1483	src_data = (const u8 *)dev->wl->current_beacon->data;
1484
1485	/* Get the start offset of the variable IEs in the packet. */
1486	ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1487	B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1488
1489	if (B43_WARN_ON(src_size < ie_start))
1490		return NULL;
1491
1492	dest_data = kmalloc(src_size, GFP_ATOMIC);
1493	if (unlikely(!dest_data))
1494		return NULL;
1495
1496	/* Copy the static data and all Information Elements, except the TIM. */
1497	memcpy(dest_data, src_data, ie_start);
1498	src_pos = ie_start;
1499	dest_pos = ie_start;
1500	for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1501		elem_size = src_data[src_pos + 1] + 2;
1502		if (src_data[src_pos] == 5) {
1503			/* This is the TIM. */
1504			continue;
1505		}
1506		memcpy(dest_data + dest_pos, src_data + src_pos,
1507		       elem_size);
1508		dest_pos += elem_size;
1509	}
1510	*dest_size = dest_pos;
1511	hdr = (struct ieee80211_hdr *)dest_data;
1512
1513	/* Set the frame control. */
1514	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1515					 IEEE80211_STYPE_PROBE_RESP);
1516	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1517					       dev->wl->vif, *dest_size,
1518					       rate);
1519	hdr->duration_id = dur;
1520
1521	return dest_data;
1522}
1523
1524static void b43_write_probe_resp_template(struct b43_wldev *dev,
1525					  u16 ram_offset,
1526					  u16 shm_size_offset,
1527					  struct ieee80211_rate *rate)
1528{
1529	const u8 *probe_resp_data;
1530	u16 size;
1531
1532	size = dev->wl->current_beacon->len;
1533	probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1534	if (unlikely(!probe_resp_data))
1535		return;
1536
1537	/* Looks like PLCP headers plus packet timings are stored for
1538	 * all possible basic rates
1539	 */
1540	b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1541	b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1542	b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1543	b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1544
1545	size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1546	b43_write_template_common(dev, probe_resp_data,
1547				  size, ram_offset, shm_size_offset,
1548				  rate->hw_value);
1549	kfree(probe_resp_data);
1550}
1551
1552static void b43_upload_beacon0(struct b43_wldev *dev)
1553{
1554	struct b43_wl *wl = dev->wl;
1555
1556	if (wl->beacon0_uploaded)
1557		return;
1558	b43_write_beacon_template(dev, 0x68, 0x18);
1559	/* FIXME: Probe resp upload doesn't really belong here,
1560	 *        but we don't use that feature anyway. */
1561	b43_write_probe_resp_template(dev, 0x268, 0x4A,
1562				      &__b43_ratetable[3]);
1563	wl->beacon0_uploaded = 1;
1564}
1565
1566static void b43_upload_beacon1(struct b43_wldev *dev)
1567{
1568	struct b43_wl *wl = dev->wl;
1569
1570	if (wl->beacon1_uploaded)
1571		return;
1572	b43_write_beacon_template(dev, 0x468, 0x1A);
1573	wl->beacon1_uploaded = 1;
1574}
1575
1576static void handle_irq_beacon(struct b43_wldev *dev)
1577{
1578	struct b43_wl *wl = dev->wl;
1579	u32 cmd, beacon0_valid, beacon1_valid;
1580
1581	if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1582	    !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1583		return;
1584
1585	/* This is the bottom half of the asynchronous beacon update. */
1586
1587	/* Ignore interrupt in the future. */
1588	dev->irq_savedstate &= ~B43_IRQ_BEACON;
1589
1590	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1591	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1592	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1593
1594	/* Schedule interrupt manually, if busy. */
1595	if (beacon0_valid && beacon1_valid) {
1596		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1597		dev->irq_savedstate |= B43_IRQ_BEACON;
1598		return;
1599	}
1600
1601	if (unlikely(wl->beacon_templates_virgin)) {
1602		/* We never uploaded a beacon before.
1603		 * Upload both templates now, but only mark one valid. */
1604		wl->beacon_templates_virgin = 0;
1605		b43_upload_beacon0(dev);
1606		b43_upload_beacon1(dev);
1607		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1608		cmd |= B43_MACCMD_BEACON0_VALID;
1609		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1610	} else {
1611		if (!beacon0_valid) {
1612			b43_upload_beacon0(dev);
1613			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1614			cmd |= B43_MACCMD_BEACON0_VALID;
1615			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1616		} else if (!beacon1_valid) {
1617			b43_upload_beacon1(dev);
1618			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1619			cmd |= B43_MACCMD_BEACON1_VALID;
1620			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1621		}
1622	}
1623}
1624
1625static void b43_beacon_update_trigger_work(struct work_struct *work)
1626{
1627	struct b43_wl *wl = container_of(work, struct b43_wl,
1628					 beacon_update_trigger);
1629	struct b43_wldev *dev;
1630
1631	mutex_lock(&wl->mutex);
1632	dev = wl->current_dev;
1633	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1634		spin_lock_irq(&wl->irq_lock);
1635		/* update beacon right away or defer to irq */
1636		dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1637		handle_irq_beacon(dev);
1638		/* The handler might have updated the IRQ mask. */
1639		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1640			    dev->irq_savedstate);
1641		mmiowb();
1642		spin_unlock_irq(&wl->irq_lock);
1643	}
1644	mutex_unlock(&wl->mutex);
1645}
1646
1647/* Asynchronously update the packet templates in template RAM.
1648 * Locking: Requires wl->irq_lock to be locked. */
1649static void b43_update_templates(struct b43_wl *wl)
1650{
1651	struct sk_buff *beacon;
1652
1653	/* This is the top half of the ansynchronous beacon update.
1654	 * The bottom half is the beacon IRQ.
1655	 * Beacon update must be asynchronous to avoid sending an
1656	 * invalid beacon. This can happen for example, if the firmware
1657	 * transmits a beacon while we are updating it. */
1658
1659	/* We could modify the existing beacon and set the aid bit in
1660	 * the TIM field, but that would probably require resizing and
1661	 * moving of data within the beacon template.
1662	 * Simply request a new beacon and let mac80211 do the hard work. */
1663	beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1664	if (unlikely(!beacon))
1665		return;
1666
1667	if (wl->current_beacon)
1668		dev_kfree_skb_any(wl->current_beacon);
1669	wl->current_beacon = beacon;
1670	wl->beacon0_uploaded = 0;
1671	wl->beacon1_uploaded = 0;
1672	queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1673}
1674
1675static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1676{
1677	b43_time_lock(dev);
1678	if (dev->dev->id.revision >= 3) {
1679		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1680		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1681	} else {
1682		b43_write16(dev, 0x606, (beacon_int >> 6));
1683		b43_write16(dev, 0x610, beacon_int);
1684	}
1685	b43_time_unlock(dev);
1686	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1687}
1688
1689static void b43_handle_firmware_panic(struct b43_wldev *dev)
1690{
1691	u16 reason;
1692
1693	/* Read the register that contains the reason code for the panic. */
1694	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1695	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1696
1697	switch (reason) {
1698	default:
1699		b43dbg(dev->wl, "The panic reason is unknown.\n");
1700		/* fallthrough */
1701	case B43_FWPANIC_DIE:
1702		/* Do not restart the controller or firmware.
1703		 * The device is nonfunctional from now on.
1704		 * Restarting would result in this panic to trigger again,
1705		 * so we avoid that recursion. */
1706		break;
1707	case B43_FWPANIC_RESTART:
1708		b43_controller_restart(dev, "Microcode panic");
1709		break;
1710	}
1711}
1712
1713static void handle_irq_ucode_debug(struct b43_wldev *dev)
1714{
1715	unsigned int i, cnt;
1716	u16 reason, marker_id, marker_line;
1717	__le16 *buf;
1718
1719	/* The proprietary firmware doesn't have this IRQ. */
1720	if (!dev->fw.opensource)
1721		return;
1722
1723	/* Read the register that contains the reason code for this IRQ. */
1724	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1725
1726	switch (reason) {
1727	case B43_DEBUGIRQ_PANIC:
1728		b43_handle_firmware_panic(dev);
1729		break;
1730	case B43_DEBUGIRQ_DUMP_SHM:
1731		if (!B43_DEBUG)
1732			break; /* Only with driver debugging enabled. */
1733		buf = kmalloc(4096, GFP_ATOMIC);
1734		if (!buf) {
1735			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1736			goto out;
1737		}
1738		for (i = 0; i < 4096; i += 2) {
1739			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1740			buf[i / 2] = cpu_to_le16(tmp);
1741		}
1742		b43info(dev->wl, "Shared memory dump:\n");
1743		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1744			       16, 2, buf, 4096, 1);
1745		kfree(buf);
1746		break;
1747	case B43_DEBUGIRQ_DUMP_REGS:
1748		if (!B43_DEBUG)
1749			break; /* Only with driver debugging enabled. */
1750		b43info(dev->wl, "Microcode register dump:\n");
1751		for (i = 0, cnt = 0; i < 64; i++) {
1752			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1753			if (cnt == 0)
1754				printk(KERN_INFO);
1755			printk("r%02u: 0x%04X  ", i, tmp);
1756			cnt++;
1757			if (cnt == 6) {
1758				printk("\n");
1759				cnt = 0;
1760			}
1761		}
1762		printk("\n");
1763		break;
1764	case B43_DEBUGIRQ_MARKER:
1765		if (!B43_DEBUG)
1766			break; /* Only with driver debugging enabled. */
1767		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1768					   B43_MARKER_ID_REG);
1769		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1770					     B43_MARKER_LINE_REG);
1771		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1772			"at line number %u\n",
1773			marker_id, marker_line);
1774		break;
1775	default:
1776		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1777		       reason);
1778	}
1779out:
1780	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1781	b43_shm_write16(dev, B43_SHM_SCRATCH,
1782			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1783}
1784
1785/* Interrupt handler bottom-half */
1786static void b43_interrupt_tasklet(struct b43_wldev *dev)
1787{
1788	u32 reason;
1789	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1790	u32 merged_dma_reason = 0;
1791	int i;
1792	unsigned long flags;
1793
1794	spin_lock_irqsave(&dev->wl->irq_lock, flags);
1795
1796	B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1797
1798	reason = dev->irq_reason;
1799	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1800		dma_reason[i] = dev->dma_reason[i];
1801		merged_dma_reason |= dma_reason[i];
1802	}
1803
1804	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1805		b43err(dev->wl, "MAC transmission error\n");
1806
1807	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1808		b43err(dev->wl, "PHY transmission error\n");
1809		rmb();
1810		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1811			atomic_set(&dev->phy.txerr_cnt,
1812				   B43_PHY_TX_BADNESS_LIMIT);
1813			b43err(dev->wl, "Too many PHY TX errors, "
1814					"restarting the controller\n");
1815			b43_controller_restart(dev, "PHY TX errors");
1816		}
1817	}
1818
1819	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1820					  B43_DMAIRQ_NONFATALMASK))) {
1821		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1822			b43err(dev->wl, "Fatal DMA error: "
1823			       "0x%08X, 0x%08X, 0x%08X, "
1824			       "0x%08X, 0x%08X, 0x%08X\n",
1825			       dma_reason[0], dma_reason[1],
1826			       dma_reason[2], dma_reason[3],
1827			       dma_reason[4], dma_reason[5]);
1828			b43_controller_restart(dev, "DMA error");
1829			mmiowb();
1830			spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1831			return;
1832		}
1833		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1834			b43err(dev->wl, "DMA error: "
1835			       "0x%08X, 0x%08X, 0x%08X, "
1836			       "0x%08X, 0x%08X, 0x%08X\n",
1837			       dma_reason[0], dma_reason[1],
1838			       dma_reason[2], dma_reason[3],
1839			       dma_reason[4], dma_reason[5]);
1840		}
1841	}
1842
1843	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1844		handle_irq_ucode_debug(dev);
1845	if (reason & B43_IRQ_TBTT_INDI)
1846		handle_irq_tbtt_indication(dev);
1847	if (reason & B43_IRQ_ATIM_END)
1848		handle_irq_atim_end(dev);
1849	if (reason & B43_IRQ_BEACON)
1850		handle_irq_beacon(dev);
1851	if (reason & B43_IRQ_PMQ)
1852		handle_irq_pmq(dev);
1853	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1854		;/* TODO */
1855	if (reason & B43_IRQ_NOISESAMPLE_OK)
1856		handle_irq_noise(dev);
1857
1858	/* Check the DMA reason registers for received data. */
1859	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1860		if (b43_using_pio_transfers(dev))
1861			b43_pio_rx(dev->pio.rx_queue);
1862		else
1863			b43_dma_rx(dev->dma.rx_ring);
1864	}
1865	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1866	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1867	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1868	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1869	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1870
1871	if (reason & B43_IRQ_TX_OK)
1872		handle_irq_transmit_status(dev);
1873
1874	b43_interrupt_enable(dev, dev->irq_savedstate);
1875	mmiowb();
1876	spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1877}
1878
1879static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1880{
1881	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1882
1883	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1884	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1885	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1886	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1887	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1888	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1889}
1890
1891/* Interrupt handler top-half */
1892static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1893{
1894	irqreturn_t ret = IRQ_NONE;
1895	struct b43_wldev *dev = dev_id;
1896	u32 reason;
1897
1898	if (!dev)
1899		return IRQ_NONE;
1900
1901	spin_lock(&dev->wl->irq_lock);
1902
1903	if (b43_status(dev) < B43_STAT_STARTED)
1904		goto out;
1905	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1906	if (reason == 0xffffffff)	/* shared IRQ */
1907		goto out;
1908	ret = IRQ_HANDLED;
1909	reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1910	if (!reason)
1911		goto out;
1912
1913	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1914	    & 0x0001DC00;
1915	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1916	    & 0x0000DC00;
1917	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1918	    & 0x0000DC00;
1919	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1920	    & 0x0001DC00;
1921	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1922	    & 0x0000DC00;
1923	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1924	    & 0x0000DC00;
1925
1926	b43_interrupt_ack(dev, reason);
1927	/* disable all IRQs. They are enabled again in the bottom half. */
1928	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1929	/* save the reason code and call our bottom half. */
1930	dev->irq_reason = reason;
1931	tasklet_schedule(&dev->isr_tasklet);
1932      out:
1933	mmiowb();
1934	spin_unlock(&dev->wl->irq_lock);
1935
1936	return ret;
1937}
1938
1939static void do_release_fw(struct b43_firmware_file *fw)
1940{
1941	release_firmware(fw->data);
1942	fw->data = NULL;
1943	fw->filename = NULL;
1944}
1945
1946static void b43_release_firmware(struct b43_wldev *dev)
1947{
1948	do_release_fw(&dev->fw.ucode);
1949	do_release_fw(&dev->fw.pcm);
1950	do_release_fw(&dev->fw.initvals);
1951	do_release_fw(&dev->fw.initvals_band);
1952}
1953
1954static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
1955{
1956	const char *text;
1957
1958	text = "You must go to "
1959	       "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
1960	       "and download the latest firmware (version 4).\n";
1961	if (error)
1962		b43err(wl, text);
1963	else
1964		b43warn(wl, text);
1965}
1966
1967static int do_request_fw(struct b43_wldev *dev,
1968			 const char *name,
1969			 struct b43_firmware_file *fw,
1970			 bool silent)
1971{
1972	char path[sizeof(modparam_fwpostfix) + 32];
1973	const struct firmware *blob;
1974	struct b43_fw_header *hdr;
1975	u32 size;
1976	int err;
1977
1978	if (!name) {
1979		/* Don't fetch anything. Free possibly cached firmware. */
1980		do_release_fw(fw);
1981		return 0;
1982	}
1983	if (fw->filename) {
1984		if (strcmp(fw->filename, name) == 0)
1985			return 0; /* Already have this fw. */
1986		/* Free the cached firmware first. */
1987		do_release_fw(fw);
1988	}
1989
1990	snprintf(path, ARRAY_SIZE(path),
1991		 "b43%s/%s.fw",
1992		 modparam_fwpostfix, name);
1993	err = request_firmware(&blob, path, dev->dev->dev);
1994	if (err == -ENOENT) {
1995		if (!silent) {
1996			b43err(dev->wl, "Firmware file \"%s\" not found\n",
1997			       path);
1998		}
1999		return err;
2000	} else if (err) {
2001		b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
2002		       path, err);
2003		return err;
2004	}
2005	if (blob->size < sizeof(struct b43_fw_header))
2006		goto err_format;
2007	hdr = (struct b43_fw_header *)(blob->data);
2008	switch (hdr->type) {
2009	case B43_FW_TYPE_UCODE:
2010	case B43_FW_TYPE_PCM:
2011		size = be32_to_cpu(hdr->size);
2012		if (size != blob->size - sizeof(struct b43_fw_header))
2013			goto err_format;
2014		/* fallthrough */
2015	case B43_FW_TYPE_IV:
2016		if (hdr->ver != 1)
2017			goto err_format;
2018		break;
2019	default:
2020		goto err_format;
2021	}
2022
2023	fw->data = blob;
2024	fw->filename = name;
2025
2026	return 0;
2027
2028err_format:
2029	b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2030	release_firmware(blob);
2031
2032	return -EPROTO;
2033}
2034
2035static int b43_request_firmware(struct b43_wldev *dev)
2036{
2037	struct b43_firmware *fw = &dev->fw;
2038	const u8 rev = dev->dev->id.revision;
2039	const char *filename;
2040	u32 tmshigh;
2041	int err;
2042
2043	/* Get microcode */
2044	tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2045	if ((rev >= 5) && (rev <= 10))
2046		filename = "ucode5";
2047	else if ((rev >= 11) && (rev <= 12))
2048		filename = "ucode11";
2049	else if (rev >= 13)
2050		filename = "ucode13";
2051	else
2052		goto err_no_ucode;
2053	err = do_request_fw(dev, filename, &fw->ucode, 0);
2054	if (err)
2055		goto err_load;
2056
2057	/* Get PCM code */
2058	if ((rev >= 5) && (rev <= 10))
2059		filename = "pcm5";
2060	else if (rev >= 11)
2061		filename = NULL;
2062	else
2063		goto err_no_pcm;
2064	fw->pcm_request_failed = 0;
2065	err = do_request_fw(dev, filename, &fw->pcm, 1);
2066	if (err == -ENOENT) {
2067		/* We did not find a PCM file? Not fatal, but
2068		 * core rev <= 10 must do without hwcrypto then. */
2069		fw->pcm_request_failed = 1;
2070	} else if (err)
2071		goto err_load;
2072
2073	/* Get initvals */
2074	switch (dev->phy.type) {
2075	case B43_PHYTYPE_A:
2076		if ((rev >= 5) && (rev <= 10)) {
2077			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2078				filename = "a0g1initvals5";
2079			else
2080				filename = "a0g0initvals5";
2081		} else
2082			goto err_no_initvals;
2083		break;
2084	case B43_PHYTYPE_G:
2085		if ((rev >= 5) && (rev <= 10))
2086			filename = "b0g0initvals5";
2087		else if (rev >= 13)
2088			filename = "b0g0initvals13";
2089		else
2090			goto err_no_initvals;
2091		break;
2092	case B43_PHYTYPE_N:
2093		if ((rev >= 11) && (rev <= 12))
2094			filename = "n0initvals11";
2095		else
2096			goto err_no_initvals;
2097		break;
2098	default:
2099		goto err_no_initvals;
2100	}
2101	err = do_request_fw(dev, filename, &fw->initvals, 0);
2102	if (err)
2103		goto err_load;
2104
2105	/* Get bandswitch initvals */
2106	switch (dev->phy.type) {
2107	case B43_PHYTYPE_A:
2108		if ((rev >= 5) && (rev <= 10)) {
2109			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2110				filename = "a0g1bsinitvals5";
2111			else
2112				filename = "a0g0bsinitvals5";
2113		} else if (rev >= 11)
2114			filename = NULL;
2115		else
2116			goto err_no_initvals;
2117		break;
2118	case B43_PHYTYPE_G:
2119		if ((rev >= 5) && (rev <= 10))
2120			filename = "b0g0bsinitvals5";
2121		else if (rev >= 11)
2122			filename = NULL;
2123		else
2124			goto err_no_initvals;
2125		break;
2126	case B43_PHYTYPE_N:
2127		if ((rev >= 11) && (rev <= 12))
2128			filename = "n0bsinitvals11";
2129		else
2130			goto err_no_initvals;
2131		break;
2132	default:
2133		goto err_no_initvals;
2134	}
2135	err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2136	if (err)
2137		goto err_load;
2138
2139	return 0;
2140
2141err_load:
2142	b43_print_fw_helptext(dev->wl, 1);
2143	goto error;
2144
2145err_no_ucode:
2146	err = -ENODEV;
2147	b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2148	goto error;
2149
2150err_no_pcm:
2151	err = -ENODEV;
2152	b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2153	goto error;
2154
2155err_no_initvals:
2156	err = -ENODEV;
2157	b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2158	       "core rev %u\n", dev->phy.type, rev);
2159	goto error;
2160
2161error:
2162	b43_release_firmware(dev);
2163	return err;
2164}
2165
2166static int b43_upload_microcode(struct b43_wldev *dev)
2167{
2168	const size_t hdr_len = sizeof(struct b43_fw_header);
2169	const __be32 *data;
2170	unsigned int i, len;
2171	u16 fwrev, fwpatch, fwdate, fwtime;
2172	u32 tmp, macctl;
2173	int err = 0;
2174
2175	/* Jump the microcode PSM to offset 0 */
2176	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2177	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2178	macctl |= B43_MACCTL_PSM_JMP0;
2179	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2180	/* Zero out all microcode PSM registers and shared memory. */
2181	for (i = 0; i < 64; i++)
2182		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2183	for (i = 0; i < 4096; i += 2)
2184		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2185
2186	/* Upload Microcode. */
2187	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2188	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2189	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2190	for (i = 0; i < len; i++) {
2191		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2192		udelay(10);
2193	}
2194
2195	if (dev->fw.pcm.data) {
2196		/* Upload PCM data. */
2197		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2198		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2199		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2200		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2201		/* No need for autoinc bit in SHM_HW */
2202		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2203		for (i = 0; i < len; i++) {
2204			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2205			udelay(10);
2206		}
2207	}
2208
2209	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2210
2211	/* Start the microcode PSM */
2212	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2213	macctl &= ~B43_MACCTL_PSM_JMP0;
2214	macctl |= B43_MACCTL_PSM_RUN;
2215	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2216
2217	/* Wait for the microcode to load and respond */
2218	i = 0;
2219	while (1) {
2220		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2221		if (tmp == B43_IRQ_MAC_SUSPENDED)
2222			break;
2223		i++;
2224		if (i >= 20) {
2225			b43err(dev->wl, "Microcode not responding\n");
2226			b43_print_fw_helptext(dev->wl, 1);
2227			err = -ENODEV;
2228			goto error;
2229		}
2230		msleep_interruptible(50);
2231		if (signal_pending(current)) {
2232			err = -EINTR;
2233			goto error;
2234		}
2235	}
2236	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2237
2238	/* Get and check the revisions. */
2239	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2240	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2241	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2242	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2243
2244	if (fwrev <= 0x128) {
2245		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2246		       "binary drivers older than version 4.x is unsupported. "
2247		       "You must upgrade your firmware files.\n");
2248		b43_print_fw_helptext(dev->wl, 1);
2249		err = -EOPNOTSUPP;
2250		goto error;
2251	}
2252	dev->fw.rev = fwrev;
2253	dev->fw.patch = fwpatch;
2254	dev->fw.opensource = (fwdate == 0xFFFF);
2255
2256	if (dev->fw.opensource) {
2257		/* Patchlevel info is encoded in the "time" field. */
2258		dev->fw.patch = fwtime;
2259		b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2260			dev->fw.rev, dev->fw.patch,
2261			dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2262	} else {
2263		b43info(dev->wl, "Loading firmware version %u.%u "
2264			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2265			fwrev, fwpatch,
2266			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2267			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2268		if (dev->fw.pcm_request_failed) {
2269			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2270				"Hardware accelerated cryptography is disabled.\n");
2271			b43_print_fw_helptext(dev->wl, 0);
2272		}
2273	}
2274
2275	if (b43_is_old_txhdr_format(dev)) {
2276		b43warn(dev->wl, "You are using an old firmware image. "
2277			"Support for old firmware will be removed in July 2008.\n");
2278		b43_print_fw_helptext(dev->wl, 0);
2279	}
2280
2281	return 0;
2282
2283error:
2284	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2285	macctl &= ~B43_MACCTL_PSM_RUN;
2286	macctl |= B43_MACCTL_PSM_JMP0;
2287	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2288
2289	return err;
2290}
2291
2292static int b43_write_initvals(struct b43_wldev *dev,
2293			      const struct b43_iv *ivals,
2294			      size_t count,
2295			      size_t array_size)
2296{
2297	const struct b43_iv *iv;
2298	u16 offset;
2299	size_t i;
2300	bool bit32;
2301
2302	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2303	iv = ivals;
2304	for (i = 0; i < count; i++) {
2305		if (array_size < sizeof(iv->offset_size))
2306			goto err_format;
2307		array_size -= sizeof(iv->offset_size);
2308		offset = be16_to_cpu(iv->offset_size);
2309		bit32 = !!(offset & B43_IV_32BIT);
2310		offset &= B43_IV_OFFSET_MASK;
2311		if (offset >= 0x1000)
2312			goto err_format;
2313		if (bit32) {
2314			u32 value;
2315
2316			if (array_size < sizeof(iv->data.d32))
2317				goto err_format;
2318			array_size -= sizeof(iv->data.d32);
2319
2320			value = get_unaligned_be32(&iv->data.d32);
2321			b43_write32(dev, offset, value);
2322
2323			iv = (const struct b43_iv *)((const uint8_t *)iv +
2324							sizeof(__be16) +
2325							sizeof(__be32));
2326		} else {
2327			u16 value;
2328
2329			if (array_size < sizeof(iv->data.d16))
2330				goto err_format;
2331			array_size -= sizeof(iv->data.d16);
2332
2333			value = be16_to_cpu(iv->data.d16);
2334			b43_write16(dev, offset, value);
2335
2336			iv = (const struct b43_iv *)((const uint8_t *)iv +
2337							sizeof(__be16) +
2338							sizeof(__be16));
2339		}
2340	}
2341	if (array_size)
2342		goto err_format;
2343
2344	return 0;
2345
2346err_format:
2347	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2348	b43_print_fw_helptext(dev->wl, 1);
2349
2350	return -EPROTO;
2351}
2352
2353static int b43_upload_initvals(struct b43_wldev *dev)
2354{
2355	const size_t hdr_len = sizeof(struct b43_fw_header);
2356	const struct b43_fw_header *hdr;
2357	struct b43_firmware *fw = &dev->fw;
2358	const struct b43_iv *ivals;
2359	size_t count;
2360	int err;
2361
2362	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2363	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2364	count = be32_to_cpu(hdr->size);
2365	err = b43_write_initvals(dev, ivals, count,
2366				 fw->initvals.data->size - hdr_len);
2367	if (err)
2368		goto out;
2369	if (fw->initvals_band.data) {
2370		hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2371		ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2372		count = be32_to_cpu(hdr->size);
2373		err = b43_write_initvals(dev, ivals, count,
2374					 fw->initvals_band.data->size - hdr_len);
2375		if (err)
2376			goto out;
2377	}
2378out:
2379
2380	return err;
2381}
2382
2383/* Initialize the GPIOs
2384 * http://bcm-specs.sipsolutions.net/GPIO
2385 */
2386static int b43_gpio_init(struct b43_wldev *dev)
2387{
2388	struct ssb_bus *bus = dev->dev->bus;
2389	struct ssb_device *gpiodev, *pcidev = NULL;
2390	u32 mask, set;
2391
2392	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2393		    & ~B43_MACCTL_GPOUTSMSK);
2394
2395	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2396		    | 0x000F);
2397
2398	mask = 0x0000001F;
2399	set = 0x0000000F;
2400	if (dev->dev->bus->chip_id == 0x4301) {
2401		mask |= 0x0060;
2402		set |= 0x0060;
2403	}
2404	if (0 /* FIXME: conditional unknown */ ) {
2405		b43_write16(dev, B43_MMIO_GPIO_MASK,
2406			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2407			    | 0x0100);
2408		mask |= 0x0180;
2409		set |= 0x0180;
2410	}
2411	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2412		b43_write16(dev, B43_MMIO_GPIO_MASK,
2413			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2414			    | 0x0200);
2415		mask |= 0x0200;
2416		set |= 0x0200;
2417	}
2418	if (dev->dev->id.revision >= 2)
2419		mask |= 0x0010;	/* FIXME: This is redundant. */
2420
2421#ifdef CONFIG_SSB_DRIVER_PCICORE
2422	pcidev = bus->pcicore.dev;
2423#endif
2424	gpiodev = bus->chipco.dev ? : pcidev;
2425	if (!gpiodev)
2426		return 0;
2427	ssb_write32(gpiodev, B43_GPIO_CONTROL,
2428		    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2429		     & mask) | set);
2430
2431	return 0;
2432}
2433
2434/* Turn off all GPIO stuff. Call this on module unload, for example. */
2435static void b43_gpio_cleanup(struct b43_wldev *dev)
2436{
2437	struct ssb_bus *bus = dev->dev->bus;
2438	struct ssb_device *gpiodev, *pcidev = NULL;
2439
2440#ifdef CONFIG_SSB_DRIVER_PCICORE
2441	pcidev = bus->pcicore.dev;
2442#endif
2443	gpiodev = bus->chipco.dev ? : pcidev;
2444	if (!gpiodev)
2445		return;
2446	ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2447}
2448
2449/* http://bcm-specs.sipsolutions.net/EnableMac */
2450void b43_mac_enable(struct b43_wldev *dev)
2451{
2452	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2453		u16 fwstate;
2454
2455		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2456					 B43_SHM_SH_UCODESTAT);
2457		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2458		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2459			b43err(dev->wl, "b43_mac_enable(): The firmware "
2460			       "should be suspended, but current state is %u\n",
2461			       fwstate);
2462		}
2463	}
2464
2465	dev->mac_suspended--;
2466	B43_WARN_ON(dev->mac_suspended < 0);
2467	if (dev->mac_suspended == 0) {
2468		b43_write32(dev, B43_MMIO_MACCTL,
2469			    b43_read32(dev, B43_MMIO_MACCTL)
2470			    | B43_MACCTL_ENABLED);
2471		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2472			    B43_IRQ_MAC_SUSPENDED);
2473		/* Commit writes */
2474		b43_read32(dev, B43_MMIO_MACCTL);
2475		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2476		b43_power_saving_ctl_bits(dev, 0);
2477	}
2478}
2479
2480/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2481void b43_mac_suspend(struct b43_wldev *dev)
2482{
2483	int i;
2484	u32 tmp;
2485
2486	might_sleep();
2487	B43_WARN_ON(dev->mac_suspended < 0);
2488
2489	if (dev->mac_suspended == 0) {
2490		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2491		b43_write32(dev, B43_MMIO_MACCTL,
2492			    b43_read32(dev, B43_MMIO_MACCTL)
2493			    & ~B43_MACCTL_ENABLED);
2494		/* force pci to flush the write */
2495		b43_read32(dev, B43_MMIO_MACCTL);
2496		for (i = 35; i; i--) {
2497			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2498			if (tmp & B43_IRQ_MAC_SUSPENDED)
2499				goto out;
2500			udelay(10);
2501		}
2502		/* Hm, it seems this will take some time. Use msleep(). */
2503		for (i = 40; i; i--) {
2504			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2505			if (tmp & B43_IRQ_MAC_SUSPENDED)
2506				goto out;
2507			msleep(1);
2508		}
2509		b43err(dev->wl, "MAC suspend failed\n");
2510	}
2511out:
2512	dev->mac_suspended++;
2513}
2514
2515static void b43_adjust_opmode(struct b43_wldev *dev)
2516{
2517	struct b43_wl *wl = dev->wl;
2518	u32 ctl;
2519	u16 cfp_pretbtt;
2520
2521	ctl = b43_read32(dev, B43_MMIO_MACCTL);
2522	/* Reset status to STA infrastructure mode. */
2523	ctl &= ~B43_MACCTL_AP;
2524	ctl &= ~B43_MACCTL_KEEP_CTL;
2525	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2526	ctl &= ~B43_MACCTL_KEEP_BAD;
2527	ctl &= ~B43_MACCTL_PROMISC;
2528	ctl &= ~B43_MACCTL_BEACPROMISC;
2529	ctl |= B43_MACCTL_INFRA;
2530
2531	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2532	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2533		ctl |= B43_MACCTL_AP;
2534	else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2535		ctl &= ~B43_MACCTL_INFRA;
2536
2537	if (wl->filter_flags & FIF_CONTROL)
2538		ctl |= B43_MACCTL_KEEP_CTL;
2539	if (wl->filter_flags & FIF_FCSFAIL)
2540		ctl |= B43_MACCTL_KEEP_BAD;
2541	if (wl->filter_flags & FIF_PLCPFAIL)
2542		ctl |= B43_MACCTL_KEEP_BADPLCP;
2543	if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2544		ctl |= B43_MACCTL_PROMISC;
2545	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2546		ctl |= B43_MACCTL_BEACPROMISC;
2547
2548	/* Workaround: On old hardware the HW-MAC-address-filter
2549	 * doesn't work properly, so always run promisc in filter
2550	 * it in software. */
2551	if (dev->dev->id.revision <= 4)
2552		ctl |= B43_MACCTL_PROMISC;
2553
2554	b43_write32(dev, B43_MMIO_MACCTL, ctl);
2555
2556	cfp_pretbtt = 2;
2557	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2558		if (dev->dev->bus->chip_id == 0x4306 &&
2559		    dev->dev->bus->chip_rev == 3)
2560			cfp_pretbtt = 100;
2561		else
2562			cfp_pretbtt = 50;
2563	}
2564	b43_write16(dev, 0x612, cfp_pretbtt);
2565}
2566
2567static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2568{
2569	u16 offset;
2570
2571	if (is_ofdm) {
2572		offset = 0x480;
2573		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2574	} else {
2575		offset = 0x4C0;
2576		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2577	}
2578	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2579			b43_shm_read16(dev, B43_SHM_SHARED, offset));
2580}
2581
2582static void b43_rate_memory_init(struct b43_wldev *dev)
2583{
2584	switch (dev->phy.type) {
2585	case B43_PHYTYPE_A:
2586	case B43_PHYTYPE_G:
2587	case B43_PHYTYPE_N:
2588		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2589		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2590		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2591		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2592		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2593		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2594		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2595		if (dev->phy.type == B43_PHYTYPE_A)
2596			break;
2597		/* fallthrough */
2598	case B43_PHYTYPE_B:
2599		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2600		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2601		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2602		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2603		break;
2604	default:
2605		B43_WARN_ON(1);
2606	}
2607}
2608
2609/* Set the default values for the PHY TX Control Words. */
2610static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2611{
2612	u16 ctl = 0;
2613
2614	ctl |= B43_TXH_PHY_ENC_CCK;
2615	ctl |= B43_TXH_PHY_ANT01AUTO;
2616	ctl |= B43_TXH_PHY_TXPWR;
2617
2618	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2619	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2620	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2621}
2622
2623/* Set the TX-Antenna for management frames sent by firmware. */
2624static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2625{
2626	u16 ant;
2627	u16 tmp;
2628
2629	ant = b43_antenna_to_phyctl(antenna);
2630
2631	/* For ACK/CTS */
2632	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2633	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2634	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2635	/* For Probe Resposes */
2636	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2637	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2638	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2639}
2640
2641/* This is the opposite of b43_chip_init() */
2642static void b43_chip_exit(struct b43_wldev *dev)
2643{
2644	b43_phy_exit(dev);
2645	b43_gpio_cleanup(dev);
2646	/* firmware is released later */
2647}
2648
2649/* Initialize the chip
2650 * http://bcm-specs.sipsolutions.net/ChipInit
2651 */
2652static int b43_chip_init(struct b43_wldev *dev)
2653{
2654	struct b43_phy *phy = &dev->phy;
2655	int err;
2656	u32 value32, macctl;
2657	u16 value16;
2658
2659	/* Initialize the MAC control */
2660	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2661	if (dev->phy.gmode)
2662		macctl |= B43_MACCTL_GMODE;
2663	macctl |= B43_MACCTL_INFRA;
2664	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2665
2666	err = b43_request_firmware(dev);
2667	if (err)
2668		goto out;
2669	err = b43_upload_microcode(dev);
2670	if (err)
2671		goto out;	/* firmware is released later */
2672
2673	err = b43_gpio_init(dev);
2674	if (err)
2675		goto out;	/* firmware is released later */
2676
2677	err = b43_upload_initvals(dev);
2678	if (err)
2679		goto err_gpio_clean;
2680
2681	/* Turn the Analog on and initialize the PHY. */
2682	phy->ops->switch_analog(dev, 1);
2683	err = b43_phy_init(dev);
2684	if (err)
2685		goto err_gpio_clean;
2686
2687	/* Disable Interference Mitigation. */
2688	if (phy->ops->interf_mitigation)
2689		phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2690
2691	/* Select the antennae */
2692	if (phy->ops->set_rx_antenna)
2693		phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2694	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2695
2696	if (phy->type == B43_PHYTYPE_B) {
2697		value16 = b43_read16(dev, 0x005E);
2698		value16 |= 0x0004;
2699		b43_write16(dev, 0x005E, value16);
2700	}
2701	b43_write32(dev, 0x0100, 0x01000000);
2702	if (dev->dev->id.revision < 5)
2703		b43_write32(dev, 0x010C, 0x01000000);
2704
2705	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2706		    & ~B43_MACCTL_INFRA);
2707	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2708		    | B43_MACCTL_INFRA);
2709
2710	/* Probe Response Timeout value */
2711	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2712	b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2713
2714	/* Initially set the wireless operation mode. */
2715	b43_adjust_opmode(dev);
2716
2717	if (dev->dev->id.revision < 3) {
2718		b43_write16(dev, 0x060E, 0x0000);
2719		b43_write16(dev, 0x0610, 0x8000);
2720		b43_write16(dev, 0x0604, 0x0000);
2721		b43_write16(dev, 0x0606, 0x0200);
2722	} else {
2723		b43_write32(dev, 0x0188, 0x80000000);
2724		b43_write32(dev, 0x018C, 0x02000000);
2725	}
2726	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2727	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2728	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2729	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2730	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2731	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2732	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2733
2734	value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2735	value32 |= 0x00100000;
2736	ssb_write32(dev->dev, SSB_TMSLOW, value32);
2737
2738	b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2739		    dev->dev->bus->chipco.fast_pwrup_delay);
2740
2741	err = 0;
2742	b43dbg(dev->wl, "Chip initialized\n");
2743out:
2744	return err;
2745
2746err_gpio_clean:
2747	b43_gpio_cleanup(dev);
2748	return err;
2749}
2750
2751static void b43_periodic_every60sec(struct b43_wldev *dev)
2752{
2753	const struct b43_phy_operations *ops = dev->phy.ops;
2754
2755	if (ops->pwork_60sec)
2756		ops->pwork_60sec(dev);
2757
2758	/* Force check the TX power emission now. */
2759	b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2760}
2761
2762static void b43_periodic_every30sec(struct b43_wldev *dev)
2763{
2764	/* Update device statistics. */
2765	b43_calculate_link_quality(dev);
2766}
2767
2768static void b43_periodic_every15sec(struct b43_wldev *dev)
2769{
2770	struct b43_phy *phy = &dev->phy;
2771	u16 wdr;
2772
2773	if (dev->fw.opensource) {
2774		/* Check if the firmware is still alive.
2775		 * It will reset the watchdog counter to 0 in its idle loop. */
2776		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2777		if (unlikely(wdr)) {
2778			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2779			b43_controller_restart(dev, "Firmware watchdog");
2780			return;
2781		} else {
2782			b43_shm_write16(dev, B43_SHM_SCRATCH,
2783					B43_WATCHDOG_REG, 1);
2784		}
2785	}
2786
2787	if (phy->ops->pwork_15sec)
2788		phy->ops->pwork_15sec(dev);
2789
2790	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2791	wmb();
2792}
2793
2794static void do_periodic_work(struct b43_wldev *dev)
2795{
2796	unsigned int state;
2797
2798	state = dev->periodic_state;
2799	if (state % 4 == 0)
2800		b43_periodic_every60sec(dev);
2801	if (state % 2 == 0)
2802		b43_periodic_every30sec(dev);
2803	b43_periodic_every15sec(dev);
2804}
2805
2806/* Periodic work locking policy:
2807 * 	The whole periodic work handler is protected by
2808 * 	wl->mutex. If another lock is needed somewhere in the
2809 * 	pwork callchain, it's aquired in-place, where it's needed.
2810 */
2811static void b43_periodic_work_handler(struct work_struct *work)
2812{
2813	struct b43_wldev *dev = container_of(work, struct b43_wldev,
2814					     periodic_work.work);
2815	struct b43_wl *wl = dev->wl;
2816	unsigned long delay;
2817
2818	mutex_lock(&wl->mutex);
2819
2820	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2821		goto out;
2822	if (b43_debug(dev, B43_DBG_PWORK_STOP))
2823		goto out_requeue;
2824
2825	do_periodic_work(dev);
2826
2827	dev->periodic_state++;
2828out_requeue:
2829	if (b43_debug(dev, B43_DBG_PWORK_FAST))
2830		delay = msecs_to_jiffies(50);
2831	else
2832		delay = round_jiffies_relative(HZ * 15);
2833	queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2834out:
2835	mutex_unlock(&wl->mutex);
2836}
2837
2838static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2839{
2840	struct delayed_work *work = &dev->periodic_work;
2841
2842	dev->periodic_state = 0;
2843	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2844	queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2845}
2846
2847/* Check if communication with the device works correctly. */
2848static int b43_validate_chipaccess(struct b43_wldev *dev)
2849{
2850	u32 v, backup;
2851
2852	backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2853
2854	/* Check for read/write and endianness problems. */
2855	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2856	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2857		goto error;
2858	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2859	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2860		goto error;
2861
2862	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2863
2864	if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2865		/* The 32bit register shadows the two 16bit registers
2866		 * with update sideeffects. Validate this. */
2867		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2868		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2869		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2870			goto error;
2871		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2872			goto error;
2873	}
2874	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2875
2876	v = b43_read32(dev, B43_MMIO_MACCTL);
2877	v |= B43_MACCTL_GMODE;
2878	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2879		goto error;
2880
2881	return 0;
2882error:
2883	b43err(dev->wl, "Failed to validate the chipaccess\n");
2884	return -ENODEV;
2885}
2886
2887static void b43_security_init(struct b43_wldev *dev)
2888{
2889	dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2890	B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2891	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2892	/* KTP is a word address, but we address SHM bytewise.
2893	 * So multiply by two.
2894	 */
2895	dev->ktp *= 2;
2896	if (dev->dev->id.revision >= 5) {
2897		/* Number of RCMTA address slots */
2898		b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2899	}
2900	b43_clear_keys(dev);
2901}
2902
2903static int b43_rng_read(struct hwrng *rng, u32 * data)
2904{
2905	struct b43_wl *wl = (struct b43_wl *)rng->priv;
2906	unsigned long flags;
2907
2908	/* Don't take wl->mutex here, as it could deadlock with
2909	 * hwrng internal locking. It's not needed to take
2910	 * wl->mutex here, anyway. */
2911
2912	spin_lock_irqsave(&wl->irq_lock, flags);
2913	*data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2914	spin_unlock_irqrestore(&wl->irq_lock, flags);
2915
2916	return (sizeof(u16));
2917}
2918
2919static void b43_rng_exit(struct b43_wl *wl)
2920{
2921	if (wl->rng_initialized)
2922		hwrng_unregister(&wl->rng);
2923}
2924
2925static int b43_rng_init(struct b43_wl *wl)
2926{
2927	int err;
2928
2929	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2930		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2931	wl->rng.name = wl->rng_name;
2932	wl->rng.data_read = b43_rng_read;
2933	wl->rng.priv = (unsigned long)wl;
2934	wl->rng_initialized = 1;
2935	err = hwrng_register(&wl->rng);
2936	if (err) {
2937		wl->rng_initialized = 0;
2938		b43err(wl, "Failed to register the random "
2939		       "number generator (%d)\n", err);
2940	}
2941
2942	return err;
2943}
2944
2945static int b43_op_tx(struct ieee80211_hw *hw,
2946		     struct sk_buff *skb)
2947{
2948	struct b43_wl *wl = hw_to_b43_wl(hw);
2949	struct b43_wldev *dev = wl->current_dev;
2950	unsigned long flags;
2951	int err;
2952
2953	if (unlikely(skb->len < 2 + 2 + 6)) {
2954		/* Too short, this can't be a valid frame. */
2955		goto drop_packet;
2956	}
2957	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
2958	if (unlikely(!dev))
2959		goto drop_packet;
2960
2961	/* Transmissions on seperate queues can run concurrently. */
2962	read_lock_irqsave(&wl->tx_lock, flags);
2963
2964	err = -ENODEV;
2965	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
2966		if (b43_using_pio_transfers(dev))
2967			err = b43_pio_tx(dev, skb);
2968		else
2969			err = b43_dma_tx(dev, skb);
2970	}
2971
2972	read_unlock_irqrestore(&wl->tx_lock, flags);
2973
2974	if (unlikely(err))
2975		goto drop_packet;
2976	return NETDEV_TX_OK;
2977
2978drop_packet:
2979	/* We can not transmit this packet. Drop it. */
2980	dev_kfree_skb_any(skb);
2981	return NETDEV_TX_OK;
2982}
2983
2984/* Locking: wl->irq_lock */
2985static void b43_qos_params_upload(struct b43_wldev *dev,
2986				  const struct ieee80211_tx_queue_params *p,
2987				  u16 shm_offset)
2988{
2989	u16 params[B43_NR_QOSPARAMS];
2990	int bslots, tmp;
2991	unsigned int i;
2992
2993	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
2994
2995	memset(&params, 0, sizeof(params));
2996
2997	params[B43_QOSPARAM_TXOP] = p->txop * 32;
2998	params[B43_QOSPARAM_CWMIN] = p->cw_min;
2999	params[B43_QOSPARAM_CWMAX] = p->cw_max;
3000	params[B43_QOSPARAM_CWCUR] = p->cw_min;
3001	params[B43_QOSPARAM_AIFS] = p->aifs;
3002	params[B43_QOSPARAM_BSLOTS] = bslots;
3003	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3004
3005	for (i = 0; i < ARRAY_SIZE(params); i++) {
3006		if (i == B43_QOSPARAM_STATUS) {
3007			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3008					     shm_offset + (i * 2));
3009			/* Mark the parameters as updated. */
3010			tmp |= 0x100;
3011			b43_shm_write16(dev, B43_SHM_SHARED,
3012					shm_offset + (i * 2),
3013					tmp);
3014		} else {
3015			b43_shm_write16(dev, B43_SHM_SHARED,
3016					shm_offset + (i * 2),
3017					params[i]);
3018		}
3019	}
3020}
3021
3022/* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3023static const u16 b43_qos_shm_offsets[] = {
3024	/* [mac80211-queue-nr] = SHM_OFFSET, */
3025	[0] = B43_QOS_VOICE,
3026	[1] = B43_QOS_VIDEO,
3027	[2] = B43_QOS_BESTEFFORT,
3028	[3] = B43_QOS_BACKGROUND,
3029};
3030
3031/* Update all QOS parameters in hardware. */
3032static void b43_qos_upload_all(struct b43_wldev *dev)
3033{
3034	struct b43_wl *wl = dev->wl;
3035	struct b43_qos_params *params;
3036	unsigned int i;
3037
3038	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3039		     ARRAY_SIZE(wl->qos_params));
3040
3041	b43_mac_suspend(dev);
3042	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3043		params = &(wl->qos_params[i]);
3044		b43_qos_params_upload(dev, &(params->p),
3045				      b43_qos_shm_offsets[i]);
3046	}
3047	b43_mac_enable(dev);
3048}
3049
3050static void b43_qos_clear(struct b43_wl *wl)
3051{
3052	struct b43_qos_params *params;
3053	unsigned int i;
3054
3055	/* Initialize QoS parameters to sane defaults. */
3056
3057	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3058		     ARRAY_SIZE(wl->qos_params));
3059
3060	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3061		params = &(wl->qos_params[i]);
3062
3063		switch (b43_qos_shm_offsets[i]) {
3064		case B43_QOS_VOICE:
3065			params->p.txop = 0;
3066			params->p.aifs = 2;
3067			params->p.cw_min = 0x0001;
3068			params->p.cw_max = 0x0001;
3069			break;
3070		case B43_QOS_VIDEO:
3071			params->p.txop = 0;
3072			params->p.aifs = 2;
3073			params->p.cw_min = 0x0001;
3074			params->p.cw_max = 0x0001;
3075			break;
3076		case B43_QOS_BESTEFFORT:
3077			params->p.txop = 0;
3078			params->p.aifs = 3;
3079			params->p.cw_min = 0x0001;
3080			params->p.cw_max = 0x03FF;
3081			break;
3082		case B43_QOS_BACKGROUND:
3083			params->p.txop = 0;
3084			params->p.aifs = 7;
3085			params->p.cw_min = 0x0001;
3086			params->p.cw_max = 0x03FF;
3087			break;
3088		default:
3089			B43_WARN_ON(1);
3090		}
3091	}
3092}
3093
3094/* Initialize the core's QOS capabilities */
3095static void b43_qos_init(struct b43_wldev *dev)
3096{
3097	/* Upload the current QOS parameters. */
3098	b43_qos_upload_all(dev);
3099
3100	/* Enable QOS support. */
3101	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3102	b43_write16(dev, B43_MMIO_IFSCTL,
3103		    b43_read16(dev, B43_MMIO_IFSCTL)
3104		    | B43_MMIO_IFSCTL_USE_EDCF);
3105}
3106
3107static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3108			  const struct ieee80211_tx_queue_params *params)
3109{
3110	struct b43_wl *wl = hw_to_b43_wl(hw);
3111	struct b43_wldev *dev;
3112	unsigned int queue = (unsigned int)_queue;
3113	int err = -ENODEV;
3114
3115	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3116		/* Queue not available or don't support setting
3117		 * params on this queue. Return success to not
3118		 * confuse mac80211. */
3119		return 0;
3120	}
3121	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3122		     ARRAY_SIZE(wl->qos_params));
3123
3124	mutex_lock(&wl->mutex);
3125	dev = wl->current_dev;
3126	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3127		goto out_unlock;
3128
3129	memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3130	b43_mac_suspend(dev);
3131	b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3132			      b43_qos_shm_offsets[queue]);
3133	b43_mac_enable(dev);
3134	err = 0;
3135
3136out_unlock:
3137	mutex_unlock(&wl->mutex);
3138
3139	return err;
3140}
3141
3142static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3143			       struct ieee80211_tx_queue_stats *stats)
3144{
3145	struct b43_wl *wl = hw_to_b43_wl(hw);
3146	struct b43_wldev *dev = wl->current_dev;
3147	unsigned long flags;
3148	int err = -ENODEV;
3149
3150	if (!dev)
3151		goto out;
3152	spin_lock_irqsave(&wl->irq_lock, flags);
3153	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3154		if (b43_using_pio_transfers(dev))
3155			b43_pio_get_tx_stats(dev, stats);
3156		else
3157			b43_dma_get_tx_stats(dev, stats);
3158		err = 0;
3159	}
3160	spin_unlock_irqrestore(&wl->irq_lock, flags);
3161out:
3162	return err;
3163}
3164
3165static int b43_op_get_stats(struct ieee80211_hw *hw,
3166			    struct ieee80211_low_level_stats *stats)
3167{
3168	struct b43_wl *wl = hw_to_b43_wl(hw);
3169	unsigned long flags;
3170
3171	spin_lock_irqsave(&wl->irq_lock, flags);
3172	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3173	spin_unlock_irqrestore(&wl->irq_lock, flags);
3174
3175	return 0;
3176}
3177
3178static void b43_put_phy_into_reset(struct b43_wldev *dev)
3179{
3180	struct ssb_device *sdev = dev->dev;
3181	u32 tmslow;
3182
3183	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3184	tmslow &= ~B43_TMSLOW_GMODE;
3185	tmslow |= B43_TMSLOW_PHYRESET;
3186	tmslow |= SSB_TMSLOW_FGC;
3187	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3188	msleep(1);
3189
3190	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3191	tmslow &= ~SSB_TMSLOW_FGC;
3192	tmslow |= B43_TMSLOW_PHYRESET;
3193	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3194	msleep(1);
3195}
3196
3197static const char * band_to_string(enum ieee80211_band band)
3198{
3199	switch (band) {
3200	case IEEE80211_BAND_5GHZ:
3201		return "5";
3202	case IEEE80211_BAND_2GHZ:
3203		return "2.4";
3204	default:
3205		break;
3206	}
3207	B43_WARN_ON(1);
3208	return "";
3209}
3210
3211/* Expects wl->mutex locked */
3212static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3213{
3214	struct b43_wldev *up_dev = NULL;
3215	struct b43_wldev *down_dev;
3216	struct b43_wldev *d;
3217	int err;
3218	bool gmode;
3219	int prev_status;
3220
3221	/* Find a device and PHY which supports the band. */
3222	list_for_each_entry(d, &wl->devlist, list) {
3223		switch (chan->band) {
3224		case IEEE80211_BAND_5GHZ:
3225			if (d->phy.supports_5ghz) {
3226				up_dev = d;
3227				gmode = 0;
3228			}
3229			break;
3230		case IEEE80211_BAND_2GHZ:
3231			if (d->phy.supports_2ghz) {
3232				up_dev = d;
3233				gmode = 1;
3234			}
3235			break;
3236		default:
3237			B43_WARN_ON(1);
3238			return -EINVAL;
3239		}
3240		if (up_dev)
3241			break;
3242	}
3243	if (!up_dev) {
3244		b43err(wl, "Could not find a device for %s-GHz band operation\n",
3245		       band_to_string(chan->band));
3246		return -ENODEV;
3247	}
3248	if ((up_dev == wl->current_dev) &&
3249	    (!!wl->current_dev->phy.gmode == !!gmode)) {
3250		/* This device is already running. */
3251		return 0;
3252	}
3253	b43dbg(wl, "Switching to %s-GHz band\n",
3254	       band_to_string(chan->band));
3255	down_dev = wl->current_dev;
3256
3257	prev_status = b43_status(down_dev);
3258	/* Shutdown the currently running core. */
3259	if (prev_status >= B43_STAT_STARTED)
3260		b43_wireless_core_stop(down_dev);
3261	if (prev_status >= B43_STAT_INITIALIZED)
3262		b43_wireless_core_exit(down_dev);
3263
3264	if (down_dev != up_dev) {
3265		/* We switch to a different core, so we put PHY into
3266		 * RESET on the old core. */
3267		b43_put_phy_into_reset(down_dev);
3268	}
3269
3270	/* Now start the new core. */
3271	up_dev->phy.gmode = gmode;
3272	if (prev_status >= B43_STAT_INITIALIZED) {
3273		err = b43_wireless_core_init(up_dev);
3274		if (err) {
3275			b43err(wl, "Fatal: Could not initialize device for "
3276			       "selected %s-GHz band\n",
3277			       band_to_string(chan->band));
3278			goto init_failure;
3279		}
3280	}
3281	if (prev_status >= B43_STAT_STARTED) {
3282		err = b43_wireless_core_start(up_dev);
3283		if (err) {
3284			b43err(wl, "Fatal: Coult not start device for "
3285			       "selected %s-GHz band\n",
3286			       band_to_string(chan->band));
3287			b43_wireless_core_exit(up_dev);
3288			goto init_failure;
3289		}
3290	}
3291	B43_WARN_ON(b43_status(up_dev) != prev_status);
3292
3293	wl->current_dev = up_dev;
3294
3295	return 0;
3296init_failure:
3297	/* Whoops, failed to init the new core. No core is operating now. */
3298	wl->current_dev = NULL;
3299	return err;
3300}
3301
3302/* Write the short and long frame retry limit values. */
3303static void b43_set_retry_limits(struct b43_wldev *dev,
3304				 unsigned int short_retry,
3305				 unsigned int long_retry)
3306{
3307	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3308	 * the chip-internal counter. */
3309	short_retry = min(short_retry, (unsigned int)0xF);
3310	long_retry = min(long_retry, (unsigned int)0xF);
3311
3312	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3313			short_retry);
3314	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3315			long_retry);
3316}
3317
3318static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3319{
3320	struct b43_wl *wl = hw_to_b43_wl(hw);
3321	struct b43_wldev *dev;
3322	struct b43_phy *phy;
3323	struct ieee80211_conf *conf = &hw->conf;
3324	unsigned long flags;
3325	int antenna;
3326	int err = 0;
3327	u32 savedirqs;
3328
3329	mutex_lock(&wl->mutex);
3330
3331	/* Switch the band (if necessary). This might change the active core. */
3332	err = b43_switch_band(wl, conf->channel);
3333	if (err)
3334		goto out_unlock_mutex;
3335	dev = wl->current_dev;
3336	phy = &dev->phy;
3337
3338	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3339		b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3340					  conf->long_frame_max_tx_count);
3341	changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3342	if (!changed)
3343		goto out_unlock_mutex;
3344
3345	/* Disable IRQs while reconfiguring the device.
3346	 * This makes it possible to drop the spinlock throughout
3347	 * the reconfiguration process. */
3348	spin_lock_irqsave(&wl->irq_lock, flags);
3349	if (b43_status(dev) < B43_STAT_STARTED) {
3350		spin_unlock_irqrestore(&wl->irq_lock, flags);
3351		goto out_unlock_mutex;
3352	}
3353	savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3354	spin_unlock_irqrestore(&wl->irq_lock, flags);
3355	b43_synchronize_irq(dev);
3356
3357	/* Switch to the requested channel.
3358	 * The firmware takes care of races with the TX handler. */
3359	if (conf->channel->hw_value != phy->channel)
3360		b43_switch_channel(dev, conf->channel->hw_value);
3361
3362	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3363
3364	/* Adjust the desired TX power level. */
3365	if (conf->power_level != 0) {
3366		spin_lock_irqsave(&wl->irq_lock, flags);
3367		if (conf->power_level != phy->desired_txpower) {
3368			phy->desired_txpower = conf->power_level;
3369			b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3370						   B43_TXPWR_IGNORE_TSSI);
3371		}
3372		spin_unlock_irqrestore(&wl->irq_lock, flags);
3373	}
3374
3375	/* Antennas for RX and management frame TX. */
3376	antenna = B43_ANTENNA_DEFAULT;
3377	b43_mgmtframe_txantenna(dev, antenna);
3378	antenna = B43_ANTENNA_DEFAULT;
3379	if (phy->ops->set_rx_antenna)
3380		phy->ops->set_rx_antenna(dev, antenna);
3381
3382	/* Update templates for AP/mesh mode. */
3383	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3384	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3385		b43_set_beacon_int(dev, conf->beacon_int);
3386
3387	if (!!conf->radio_enabled != phy->radio_on) {
3388		if (conf->radio_enabled) {
3389			b43_software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
3390			b43info(dev->wl, "Radio turned on by software\n");
3391			if (!dev->radio_hw_enable) {
3392				b43info(dev->wl, "The hardware RF-kill button "
3393					"still turns the radio physically off. "
3394					"Press the button to turn it on.\n");
3395			}
3396		} else {
3397			b43_software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
3398			b43info(dev->wl, "Radio turned off by software\n");
3399		}
3400	}
3401
3402	spin_lock_irqsave(&wl->irq_lock, flags);
3403	b43_interrupt_enable(dev, savedirqs);
3404	mmiowb();
3405	spin_unlock_irqrestore(&wl->irq_lock, flags);
3406      out_unlock_mutex:
3407	mutex_unlock(&wl->mutex);
3408
3409	return err;
3410}
3411
3412static void b43_update_basic_rates(struct b43_wldev *dev, u64 brates)
3413{
3414	struct ieee80211_supported_band *sband =
3415		dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3416	struct ieee80211_rate *rate;
3417	int i;
3418	u16 basic, direct, offset, basic_offset, rateptr;
3419
3420	for (i = 0; i < sband->n_bitrates; i++) {
3421		rate = &sband->bitrates[i];
3422
3423		if (b43_is_cck_rate(rate->hw_value)) {
3424			direct = B43_SHM_SH_CCKDIRECT;
3425			basic = B43_SHM_SH_CCKBASIC;
3426			offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3427			offset &= 0xF;
3428		} else {
3429			direct = B43_SHM_SH_OFDMDIRECT;
3430			basic = B43_SHM_SH_OFDMBASIC;
3431			offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3432			offset &= 0xF;
3433		}
3434
3435		rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3436
3437		if (b43_is_cck_rate(rate->hw_value)) {
3438			basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3439			basic_offset &= 0xF;
3440		} else {
3441			basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3442			basic_offset &= 0xF;
3443		}
3444
3445		/*
3446		 * Get the pointer that we need to point to
3447		 * from the direct map
3448		 */
3449		rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3450					 direct + 2 * basic_offset);
3451		/* and write it to the basic map */
3452		b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3453				rateptr);
3454	}
3455}
3456
3457static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3458				    struct ieee80211_vif *vif,
3459				    struct ieee80211_bss_conf *conf,
3460				    u32 changed)
3461{
3462	struct b43_wl *wl = hw_to_b43_wl(hw);
3463	struct b43_wldev *dev;
3464	struct b43_phy *phy;
3465	unsigned long flags;
3466	u32 savedirqs;
3467
3468	mutex_lock(&wl->mutex);
3469
3470	dev = wl->current_dev;
3471	phy = &dev->phy;
3472
3473	/* Disable IRQs while reconfiguring the device.
3474	 * This makes it possible to drop the spinlock throughout
3475	 * the reconfiguration process. */
3476	spin_lock_irqsave(&wl->irq_lock, flags);
3477	if (b43_status(dev) < B43_STAT_STARTED) {
3478		spin_unlock_irqrestore(&wl->irq_lock, flags);
3479		goto out_unlock_mutex;
3480	}
3481	savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3482	spin_unlock_irqrestore(&wl->irq_lock, flags);
3483	b43_synchronize_irq(dev);
3484
3485	b43_mac_suspend(dev);
3486
3487	if (changed & BSS_CHANGED_BASIC_RATES)
3488		b43_update_basic_rates(dev, conf->basic_rates);
3489
3490	if (changed & BSS_CHANGED_ERP_SLOT) {
3491		if (conf->use_short_slot)
3492			b43_short_slot_timing_enable(dev);
3493		else
3494			b43_short_slot_timing_disable(dev);
3495	}
3496
3497	b43_mac_enable(dev);
3498
3499	spin_lock_irqsave(&wl->irq_lock, flags);
3500	b43_interrupt_enable(dev, savedirqs);
3501	/* XXX: why? */
3502	mmiowb();
3503	spin_unlock_irqrestore(&wl->irq_lock, flags);
3504 out_unlock_mutex:
3505	mutex_unlock(&wl->mutex);
3506
3507	return;
3508}
3509
3510static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3511			   const u8 *local_addr, const u8 *addr,
3512			   struct ieee80211_key_conf *key)
3513{
3514	struct b43_wl *wl = hw_to_b43_wl(hw);
3515	struct b43_wldev *dev;
3516	unsigned long flags;
3517	u8 algorithm;
3518	u8 index;
3519	int err;
3520
3521	if (modparam_nohwcrypt)
3522		return -ENOSPC; /* User disabled HW-crypto */
3523
3524	mutex_lock(&wl->mutex);
3525	spin_lock_irqsave(&wl->irq_lock, flags);
3526
3527	dev = wl->current_dev;
3528	err = -ENODEV;
3529	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3530		goto out_unlock;
3531
3532	if (dev->fw.pcm_request_failed) {
3533		/* We don't have firmware for the crypto engine.
3534		 * Must use software-crypto. */
3535		err = -EOPNOTSUPP;
3536		goto out_unlock;
3537	}
3538
3539	err = -EINVAL;
3540	switch (key->alg) {
3541	case ALG_WEP:
3542		if (key->keylen == 5)
3543			algorithm = B43_SEC_ALGO_WEP40;
3544		else
3545			algorithm = B43_SEC_ALGO_WEP104;
3546		break;
3547	case ALG_TKIP:
3548		algorithm = B43_SEC_ALGO_TKIP;
3549		break;
3550	case ALG_CCMP:
3551		algorithm = B43_SEC_ALGO_AES;
3552		break;
3553	default:
3554		B43_WARN_ON(1);
3555		goto out_unlock;
3556	}
3557	index = (u8) (key->keyidx);
3558	if (index > 3)
3559		goto out_unlock;
3560
3561	switch (cmd) {
3562	case SET_KEY:
3563		if (algorithm == B43_SEC_ALGO_TKIP) {
3564			/* FIXME: No TKIP hardware encryption for now. */
3565			err = -EOPNOTSUPP;
3566			goto out_unlock;
3567		}
3568
3569		if (is_broadcast_ether_addr(addr)) {
3570			/* addr is FF:FF:FF:FF:FF:FF for default keys */
3571			err = b43_key_write(dev, index, algorithm,
3572					    key->key, key->keylen, NULL, key);
3573		} else {
3574			/*
3575			 * either pairwise key or address is 00:00:00:00:00:00
3576			 * for transmit-only keys
3577			 */
3578			err = b43_key_write(dev, -1, algorithm,
3579					    key->key, key->keylen, addr, key);
3580		}
3581		if (err)
3582			goto out_unlock;
3583
3584		if (algorithm == B43_SEC_ALGO_WEP40 ||
3585		    algorithm == B43_SEC_ALGO_WEP104) {
3586			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3587		} else {
3588			b43_hf_write(dev,
3589				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3590		}
3591		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3592		break;
3593	case DISABLE_KEY: {
3594		err = b43_key_clear(dev, key->hw_key_idx);
3595		if (err)
3596			goto out_unlock;
3597		break;
3598	}
3599	default:
3600		B43_WARN_ON(1);
3601	}
3602out_unlock:
3603	spin_unlock_irqrestore(&wl->irq_lock, flags);
3604	mutex_unlock(&wl->mutex);
3605	if (!err) {
3606		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3607		       "mac: %pM\n",
3608		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3609		       addr);
3610	}
3611	return err;
3612}
3613
3614static void b43_op_configure_filter(struct ieee80211_hw *hw,
3615				    unsigned int changed, unsigned int *fflags,
3616				    int mc_count, struct dev_addr_list *mc_list)
3617{
3618	struct b43_wl *wl = hw_to_b43_wl(hw);
3619	struct b43_wldev *dev = wl->current_dev;
3620	unsigned long flags;
3621
3622	if (!dev) {
3623		*fflags = 0;
3624		return;
3625	}
3626
3627	spin_lock_irqsave(&wl->irq_lock, flags);
3628	*fflags &= FIF_PROMISC_IN_BSS |
3629		  FIF_ALLMULTI |
3630		  FIF_FCSFAIL |
3631		  FIF_PLCPFAIL |
3632		  FIF_CONTROL |
3633		  FIF_OTHER_BSS |
3634		  FIF_BCN_PRBRESP_PROMISC;
3635
3636	changed &= FIF_PROMISC_IN_BSS |
3637		   FIF_ALLMULTI |
3638		   FIF_FCSFAIL |
3639		   FIF_PLCPFAIL |
3640		   FIF_CONTROL |
3641		   FIF_OTHER_BSS |
3642		   FIF_BCN_PRBRESP_PROMISC;
3643
3644	wl->filter_flags = *fflags;
3645
3646	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3647		b43_adjust_opmode(dev);
3648	spin_unlock_irqrestore(&wl->irq_lock, flags);
3649}
3650
3651static int b43_op_config_interface(struct ieee80211_hw *hw,
3652				   struct ieee80211_vif *vif,
3653				   struct ieee80211_if_conf *conf)
3654{
3655	struct b43_wl *wl = hw_to_b43_wl(hw);
3656	struct b43_wldev *dev = wl->current_dev;
3657	unsigned long flags;
3658
3659	if (!dev)
3660		return -ENODEV;
3661	mutex_lock(&wl->mutex);
3662	spin_lock_irqsave(&wl->irq_lock, flags);
3663	B43_WARN_ON(wl->vif != vif);
3664	if (conf->bssid)
3665		memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3666	else
3667		memset(wl->bssid, 0, ETH_ALEN);
3668	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3669		if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3670		    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT)) {
3671			B43_WARN_ON(vif->type != wl->if_type);
3672			if (conf->changed & IEEE80211_IFCC_BEACON)
3673				b43_update_templates(wl);
3674		} else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) {
3675			if (conf->changed & IEEE80211_IFCC_BEACON)
3676				b43_update_templates(wl);
3677		}
3678		b43_write_mac_bssid_templates(dev);
3679	}
3680	spin_unlock_irqrestore(&wl->irq_lock, flags);
3681	mutex_unlock(&wl->mutex);
3682
3683	return 0;
3684}
3685
3686/* Locking: wl->mutex */
3687static void b43_wireless_core_stop(struct b43_wldev *dev)
3688{
3689	struct b43_wl *wl = dev->wl;
3690	unsigned long flags;
3691
3692	if (b43_status(dev) < B43_STAT_STARTED)
3693		return;
3694
3695	/* Disable and sync interrupts. We must do this before than
3696	 * setting the status to INITIALIZED, as the interrupt handler
3697	 * won't care about IRQs then. */
3698	spin_lock_irqsave(&wl->irq_lock, flags);
3699	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3700	b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* flush */
3701	spin_unlock_irqrestore(&wl->irq_lock, flags);
3702	b43_synchronize_irq(dev);
3703
3704	write_lock_irqsave(&wl->tx_lock, flags);
3705	b43_set_status(dev, B43_STAT_INITIALIZED);
3706	write_unlock_irqrestore(&wl->tx_lock, flags);
3707
3708	b43_pio_stop(dev);
3709	mutex_unlock(&wl->mutex);
3710	/* Must unlock as it would otherwise deadlock. No races here.
3711	 * Cancel the possibly running self-rearming periodic work. */
3712	cancel_delayed_work_sync(&dev->periodic_work);
3713	mutex_lock(&wl->mutex);
3714
3715	b43_mac_suspend(dev);
3716	free_irq(dev->dev->irq, dev);
3717	b43dbg(wl, "Wireless interface stopped\n");
3718}
3719
3720/* Locking: wl->mutex */
3721static int b43_wireless_core_start(struct b43_wldev *dev)
3722{
3723	int err;
3724
3725	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3726
3727	drain_txstatus_queue(dev);
3728	err = request_irq(dev->dev->irq, b43_interrupt_handler,
3729			  IRQF_SHARED, KBUILD_MODNAME, dev);
3730	if (err) {
3731		b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3732		goto out;
3733	}
3734
3735	/* We are ready to run. */
3736	b43_set_status(dev, B43_STAT_STARTED);
3737
3738	/* Start data flow (TX/RX). */
3739	b43_mac_enable(dev);
3740	b43_interrupt_enable(dev, dev->irq_savedstate);
3741
3742	/* Start maintainance work */
3743	b43_periodic_tasks_setup(dev);
3744
3745	b43dbg(dev->wl, "Wireless interface started\n");
3746      out:
3747	return err;
3748}
3749
3750/* Get PHY and RADIO versioning numbers */
3751static int b43_phy_versioning(struct b43_wldev *dev)
3752{
3753	struct b43_phy *phy = &dev->phy;
3754	u32 tmp;
3755	u8 analog_type;
3756	u8 phy_type;
3757	u8 phy_rev;
3758	u16 radio_manuf;
3759	u16 radio_ver;
3760	u16 radio_rev;
3761	int unsupported = 0;
3762
3763	/* Get PHY versioning */
3764	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3765	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3766	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3767	phy_rev = (tmp & B43_PHYVER_VERSION);
3768	switch (phy_type) {
3769	case B43_PHYTYPE_A:
3770		if (phy_rev >= 4)
3771			unsupported = 1;
3772		break;
3773	case B43_PHYTYPE_B:
3774		if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3775		    && phy_rev != 7)
3776			unsupported = 1;
3777		break;
3778	case B43_PHYTYPE_G:
3779		if (phy_rev > 9)
3780			unsupported = 1;
3781		break;
3782#ifdef CONFIG_B43_NPHY
3783	case B43_PHYTYPE_N:
3784		if (phy_rev > 1)
3785			unsupported = 1;
3786		break;
3787#endif
3788	default:
3789		unsupported = 1;
3790	};
3791	if (unsupported) {
3792		b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3793		       "(Analog %u, Type %u, Revision %u)\n",
3794		       analog_type, phy_type, phy_rev);
3795		return -EOPNOTSUPP;
3796	}
3797	b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3798	       analog_type, phy_type, phy_rev);
3799
3800	/* Get RADIO versioning */
3801	if (dev->dev->bus->chip_id == 0x4317) {
3802		if (dev->dev->bus->chip_rev == 0)
3803			tmp = 0x3205017F;
3804		else if (dev->dev->bus->chip_rev == 1)
3805			tmp = 0x4205017F;
3806		else
3807			tmp = 0x5205017F;
3808	} else {
3809		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3810		tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3811		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3812		tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3813	}
3814	radio_manuf = (tmp & 0x00000FFF);
3815	radio_ver = (tmp & 0x0FFFF000) >> 12;
3816	radio_rev = (tmp & 0xF0000000) >> 28;
3817	if (radio_manuf != 0x17F /* Broadcom */)
3818		unsupported = 1;
3819	switch (phy_type) {
3820	case B43_PHYTYPE_A:
3821		if (radio_ver != 0x2060)
3822			unsupported = 1;
3823		if (radio_rev != 1)
3824			unsupported = 1;
3825		if (radio_manuf != 0x17F)
3826			unsupported = 1;
3827		break;
3828	case B43_PHYTYPE_B:
3829		if ((radio_ver & 0xFFF0) != 0x2050)
3830			unsupported = 1;
3831		break;
3832	case B43_PHYTYPE_G:
3833		if (radio_ver != 0x2050)
3834			unsupported = 1;
3835		break;
3836	case B43_PHYTYPE_N:
3837		if (radio_ver != 0x2055)
3838			unsupported = 1;
3839		break;
3840	default:
3841		B43_WARN_ON(1);
3842	}
3843	if (unsupported) {
3844		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3845		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3846		       radio_manuf, radio_ver, radio_rev);
3847		return -EOPNOTSUPP;
3848	}
3849	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3850	       radio_manuf, radio_ver, radio_rev);
3851
3852	phy->radio_manuf = radio_manuf;
3853	phy->radio_ver = radio_ver;
3854	phy->radio_rev = radio_rev;
3855
3856	phy->analog = analog_type;
3857	phy->type = phy_type;
3858	phy->rev = phy_rev;
3859
3860	return 0;
3861}
3862
3863static void setup_struct_phy_for_init(struct b43_wldev *dev,
3864				      struct b43_phy *phy)
3865{
3866	phy->hardware_power_control = !!modparam_hwpctl;
3867	phy->next_txpwr_check_time = jiffies;
3868	/* PHY TX errors counter. */
3869	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3870}
3871
3872static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3873{
3874	dev->dfq_valid = 0;
3875
3876	/* Assume the radio is enabled. If it's not enabled, the state will
3877	 * immediately get fixed on the first periodic work run. */
3878	dev->radio_hw_enable = 1;
3879
3880	/* Stats */
3881	memset(&dev->stats, 0, sizeof(dev->stats));
3882
3883	setup_struct_phy_for_init(dev, &dev->phy);
3884
3885	/* IRQ related flags */
3886	dev->irq_reason = 0;
3887	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3888	dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3889
3890	dev->mac_suspended = 1;
3891
3892	/* Noise calculation context */
3893	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3894}
3895
3896static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3897{
3898	struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3899	u64 hf;
3900
3901	if (!modparam_btcoex)
3902		return;
3903	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3904		return;
3905	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3906		return;
3907
3908	hf = b43_hf_read(dev);
3909	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3910		hf |= B43_HF_BTCOEXALT;
3911	else
3912		hf |= B43_HF_BTCOEX;
3913	b43_hf_write(dev, hf);
3914}
3915
3916static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3917{
3918	if (!modparam_btcoex)
3919		return;
3920	//TODO
3921}
3922
3923static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3924{
3925#ifdef CONFIG_SSB_DRIVER_PCICORE
3926	struct ssb_bus *bus = dev->dev->bus;
3927	u32 tmp;
3928
3929	if (bus->pcicore.dev &&
3930	    bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3931	    bus->pcicore.dev->id.revision <= 5) {
3932		/* IMCFGLO timeouts workaround. */
3933		tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3934		tmp &= ~SSB_IMCFGLO_REQTO;
3935		tmp &= ~SSB_IMCFGLO_SERTO;
3936		switch (bus->bustype) {
3937		case SSB_BUSTYPE_PCI:
3938		case SSB_BUSTYPE_PCMCIA:
3939			tmp |= 0x32;
3940			break;
3941		case SSB_BUSTYPE_SSB:
3942			tmp |= 0x53;
3943			break;
3944		}
3945		ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3946	}
3947#endif /* CONFIG_SSB_DRIVER_PCICORE */
3948}
3949
3950static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3951{
3952	u16 pu_delay;
3953
3954	/* The time value is in microseconds. */
3955	if (dev->phy.type == B43_PHYTYPE_A)
3956		pu_delay = 3700;
3957	else
3958		pu_delay = 1050;
3959	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3960		pu_delay = 500;
3961	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3962		pu_delay = max(pu_delay, (u16)2400);
3963
3964	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3965}
3966
3967/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3968static void b43_set_pretbtt(struct b43_wldev *dev)
3969{
3970	u16 pretbtt;
3971
3972	/* The time value is in microseconds. */
3973	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
3974		pretbtt = 2;
3975	} else {
3976		if (dev->phy.type == B43_PHYTYPE_A)
3977			pretbtt = 120;
3978		else
3979			pretbtt = 250;
3980	}
3981	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3982	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3983}
3984
3985/* Shutdown a wireless core */
3986/* Locking: wl->mutex */
3987static void b43_wireless_core_exit(struct b43_wldev *dev)
3988{
3989	u32 macctl;
3990
3991	B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3992	if (b43_status(dev) != B43_STAT_INITIALIZED)
3993		return;
3994	b43_set_status(dev, B43_STAT_UNINIT);
3995
3996	/* Stop the microcode PSM. */
3997	macctl = b43_read32(dev, B43_MMIO_MACCTL);
3998	macctl &= ~B43_MACCTL_PSM_RUN;
3999	macctl |= B43_MACCTL_PSM_JMP0;
4000	b43_write32(dev, B43_MMIO_MACCTL, macctl);
4001
4002	if (!dev->suspend_in_progress) {
4003		b43_leds_exit(dev);
4004		b43_rng_exit(dev->wl);
4005	}
4006	b43_dma_free(dev);
4007	b43_pio_free(dev);
4008	b43_chip_exit(dev);
4009	dev->phy.ops->switch_analog(dev, 0);
4010	if (dev->wl->current_beacon) {
4011		dev_kfree_skb_any(dev->wl->current_beacon);
4012		dev->wl->current_beacon = NULL;
4013	}
4014
4015	ssb_device_disable(dev->dev, 0);
4016	ssb_bus_may_powerdown(dev->dev->bus);
4017}
4018
4019/* Initialize a wireless core */
4020static int b43_wireless_core_init(struct b43_wldev *dev)
4021{
4022	struct b43_wl *wl = dev->wl;
4023	struct ssb_bus *bus = dev->dev->bus;
4024	struct ssb_sprom *sprom = &bus->sprom;
4025	struct b43_phy *phy = &dev->phy;
4026	int err;
4027	u64 hf;
4028	u32 tmp;
4029
4030	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4031
4032	err = ssb_bus_powerup(bus, 0);
4033	if (err)
4034		goto out;
4035	if (!ssb_device_is_enabled(dev->dev)) {
4036		tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4037		b43_wireless_core_reset(dev, tmp);
4038	}
4039
4040	/* Reset all data structures. */
4041	setup_struct_wldev_for_init(dev);
4042	phy->ops->prepare_structs(dev);
4043
4044	/* Enable IRQ routing to this device. */
4045	ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
4046
4047	b43_imcfglo_timeouts_workaround(dev);
4048	b43_bluetooth_coext_disable(dev);
4049	if (phy->ops->prepare_hardware) {
4050		err = phy->ops->prepare_hardware(dev);
4051		if (err)
4052			goto err_busdown;
4053	}
4054	err = b43_chip_init(dev);
4055	if (err)
4056		goto err_busdown;
4057	b43_shm_write16(dev, B43_SHM_SHARED,
4058			B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4059	hf = b43_hf_read(dev);
4060	if (phy->type == B43_PHYTYPE_G) {
4061		hf |= B43_HF_SYMW;
4062		if (phy->rev == 1)
4063			hf |= B43_HF_GDCW;
4064		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4065			hf |= B43_HF_OFDMPABOOST;
4066	} else if (phy->type == B43_PHYTYPE_B) {
4067		hf |= B43_HF_SYMW;
4068		if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4069			hf &= ~B43_HF_GDCW;
4070	}
4071	b43_hf_write(dev, hf);
4072
4073	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4074			     B43_DEFAULT_LONG_RETRY_LIMIT);
4075	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4076	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4077
4078	/* Disable sending probe responses from firmware.
4079	 * Setting the MaxTime to one usec will always trigger
4080	 * a timeout, so we never send any probe resp.
4081	 * A timeout of zero is infinite. */
4082	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4083
4084	b43_rate_memory_init(dev);
4085	b43_set_phytxctl_defaults(dev);
4086
4087	/* Minimum Contention Window */
4088	if (phy->type == B43_PHYTYPE_B) {
4089		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4090	} else {
4091		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4092	}
4093	/* Maximum Contention Window */
4094	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4095
4096	if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4097		dev->__using_pio_transfers = 1;
4098		err = b43_pio_init(dev);
4099	} else {
4100		dev->__using_pio_transfers = 0;
4101		err = b43_dma_init(dev);
4102	}
4103	if (err)
4104		goto err_chip_exit;
4105	b43_qos_init(dev);
4106	b43_set_synth_pu_delay(dev, 1);
4107	b43_bluetooth_coext_enable(dev);
4108
4109	ssb_bus_powerup(bus, 1);	/* Enable dynamic PCTL */
4110	b43_upload_card_macaddress(dev);
4111	b43_security_init(dev);
4112	if (!dev->suspend_in_progress)
4113		b43_rng_init(wl);
4114
4115	b43_set_status(dev, B43_STAT_INITIALIZED);
4116
4117	if (!dev->suspend_in_progress)
4118		b43_leds_init(dev);
4119out:
4120	return err;
4121
4122err_chip_exit:
4123	b43_chip_exit(dev);
4124err_busdown:
4125	ssb_bus_may_powerdown(bus);
4126	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4127	return err;
4128}
4129
4130static int b43_op_add_interface(struct ieee80211_hw *hw,
4131				struct ieee80211_if_init_conf *conf)
4132{
4133	struct b43_wl *wl = hw_to_b43_wl(hw);
4134	struct b43_wldev *dev;
4135	unsigned long flags;
4136	int err = -EOPNOTSUPP;
4137
4138	/* TODO: allow WDS/AP devices to coexist */
4139
4140	if (conf->type != NL80211_IFTYPE_AP &&
4141	    conf->type != NL80211_IFTYPE_MESH_POINT &&
4142	    conf->type != NL80211_IFTYPE_STATION &&
4143	    conf->type != NL80211_IFTYPE_WDS &&
4144	    conf->type != NL80211_IFTYPE_ADHOC)
4145		return -EOPNOTSUPP;
4146
4147	mutex_lock(&wl->mutex);
4148	if (wl->operating)
4149		goto out_mutex_unlock;
4150
4151	b43dbg(wl, "Adding Interface type %d\n", conf->type);
4152
4153	dev = wl->current_dev;
4154	wl->operating = 1;
4155	wl->vif = conf->vif;
4156	wl->if_type = conf->type;
4157	memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4158
4159	spin_lock_irqsave(&wl->irq_lock, flags);
4160	b43_adjust_opmode(dev);
4161	b43_set_pretbtt(dev);
4162	b43_set_synth_pu_delay(dev, 0);
4163	b43_upload_card_macaddress(dev);
4164	spin_unlock_irqrestore(&wl->irq_lock, flags);
4165
4166	err = 0;
4167 out_mutex_unlock:
4168	mutex_unlock(&wl->mutex);
4169
4170	return err;
4171}
4172
4173static void b43_op_remove_interface(struct ieee80211_hw *hw,
4174				    struct ieee80211_if_init_conf *conf)
4175{
4176	struct b43_wl *wl = hw_to_b43_wl(hw);
4177	struct b43_wldev *dev = wl->current_dev;
4178	unsigned long flags;
4179
4180	b43dbg(wl, "Removing Interface type %d\n", conf->type);
4181
4182	mutex_lock(&wl->mutex);
4183
4184	B43_WARN_ON(!wl->operating);
4185	B43_WARN_ON(wl->vif != conf->vif);
4186	wl->vif = NULL;
4187
4188	wl->operating = 0;
4189
4190	spin_lock_irqsave(&wl->irq_lock, flags);
4191	b43_adjust_opmode(dev);
4192	memset(wl->mac_addr, 0, ETH_ALEN);
4193	b43_upload_card_macaddress(dev);
4194	spin_unlock_irqrestore(&wl->irq_lock, flags);
4195
4196	mutex_unlock(&wl->mutex);
4197}
4198
4199static int b43_op_start(struct ieee80211_hw *hw)
4200{
4201	struct b43_wl *wl = hw_to_b43_wl(hw);
4202	struct b43_wldev *dev = wl->current_dev;
4203	int did_init = 0;
4204	int err = 0;
4205	bool do_rfkill_exit = 0;
4206
4207	/* Kill all old instance specific information to make sure
4208	 * the card won't use it in the short timeframe between start
4209	 * and mac80211 reconfiguring it. */
4210	memset(wl->bssid, 0, ETH_ALEN);
4211	memset(wl->mac_addr, 0, ETH_ALEN);
4212	wl->filter_flags = 0;
4213	wl->radiotap_enabled = 0;
4214	b43_qos_clear(wl);
4215	wl->beacon0_uploaded = 0;
4216	wl->beacon1_uploaded = 0;
4217	wl->beacon_templates_virgin = 1;
4218
4219	/* First register RFkill.
4220	 * LEDs that are registered later depend on it. */
4221	b43_rfkill_init(dev);
4222
4223	mutex_lock(&wl->mutex);
4224
4225	if (b43_status(dev) < B43_STAT_INITIALIZED) {
4226		err = b43_wireless_core_init(dev);
4227		if (err) {
4228			do_rfkill_exit = 1;
4229			goto out_mutex_unlock;
4230		}
4231		did_init = 1;
4232	}
4233
4234	if (b43_status(dev) < B43_STAT_STARTED) {
4235		err = b43_wireless_core_start(dev);
4236		if (err) {
4237			if (did_init)
4238				b43_wireless_core_exit(dev);
4239			do_rfkill_exit = 1;
4240			goto out_mutex_unlock;
4241		}
4242	}
4243
4244 out_mutex_unlock:
4245	mutex_unlock(&wl->mutex);
4246
4247	if (do_rfkill_exit)
4248		b43_rfkill_exit(dev);
4249
4250	return err;
4251}
4252
4253static void b43_op_stop(struct ieee80211_hw *hw)
4254{
4255	struct b43_wl *wl = hw_to_b43_wl(hw);
4256	struct b43_wldev *dev = wl->current_dev;
4257
4258	b43_rfkill_exit(dev);
4259	cancel_work_sync(&(wl->beacon_update_trigger));
4260
4261	mutex_lock(&wl->mutex);
4262	if (b43_status(dev) >= B43_STAT_STARTED)
4263		b43_wireless_core_stop(dev);
4264	b43_wireless_core_exit(dev);
4265	mutex_unlock(&wl->mutex);
4266
4267	cancel_work_sync(&(wl->txpower_adjust_work));
4268}
4269
4270static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4271				 struct ieee80211_sta *sta, bool set)
4272{
4273	struct b43_wl *wl = hw_to_b43_wl(hw);
4274	unsigned long flags;
4275
4276	spin_lock_irqsave(&wl->irq_lock, flags);
4277	b43_update_templates(wl);
4278	spin_unlock_irqrestore(&wl->irq_lock, flags);
4279
4280	return 0;
4281}
4282
4283static void b43_op_sta_notify(struct ieee80211_hw *hw,
4284			      struct ieee80211_vif *vif,
4285			      enum sta_notify_cmd notify_cmd,
4286			      struct ieee80211_sta *sta)
4287{
4288	struct b43_wl *wl = hw_to_b43_wl(hw);
4289
4290	B43_WARN_ON(!vif || wl->vif != vif);
4291}
4292
4293static const struct ieee80211_ops b43_hw_ops = {
4294	.tx			= b43_op_tx,
4295	.conf_tx		= b43_op_conf_tx,
4296	.add_interface		= b43_op_add_interface,
4297	.remove_interface	= b43_op_remove_interface,
4298	.config			= b43_op_config,
4299	.bss_info_changed	= b43_op_bss_info_changed,
4300	.config_interface	= b43_op_config_interface,
4301	.configure_filter	= b43_op_configure_filter,
4302	.set_key		= b43_op_set_key,
4303	.get_stats		= b43_op_get_stats,
4304	.get_tx_stats		= b43_op_get_tx_stats,
4305	.start			= b43_op_start,
4306	.stop			= b43_op_stop,
4307	.set_tim		= b43_op_beacon_set_tim,
4308	.sta_notify		= b43_op_sta_notify,
4309};
4310
4311/* Hard-reset the chip. Do not call this directly.
4312 * Use b43_controller_restart()
4313 */
4314static void b43_chip_reset(struct work_struct *work)
4315{
4316	struct b43_wldev *dev =
4317	    container_of(work, struct b43_wldev, restart_work);
4318	struct b43_wl *wl = dev->wl;
4319	int err = 0;
4320	int prev_status;
4321
4322	mutex_lock(&wl->mutex);
4323
4324	prev_status = b43_status(dev);
4325	/* Bring the device down... */
4326	if (prev_status >= B43_STAT_STARTED)
4327		b43_wireless_core_stop(dev);
4328	if (prev_status >= B43_STAT_INITIALIZED)
4329		b43_wireless_core_exit(dev);
4330
4331	/* ...and up again. */
4332	if (prev_status >= B43_STAT_INITIALIZED) {
4333		err = b43_wireless_core_init(dev);
4334		if (err)
4335			goto out;
4336	}
4337	if (prev_status >= B43_STAT_STARTED) {
4338		err = b43_wireless_core_start(dev);
4339		if (err) {
4340			b43_wireless_core_exit(dev);
4341			goto out;
4342		}
4343	}
4344out:
4345	if (err)
4346		wl->current_dev = NULL; /* Failed to init the dev. */
4347	mutex_unlock(&wl->mutex);
4348	if (err)
4349		b43err(wl, "Controller restart FAILED\n");
4350	else
4351		b43info(wl, "Controller restarted\n");
4352}
4353
4354static int b43_setup_bands(struct b43_wldev *dev,
4355			   bool have_2ghz_phy, bool have_5ghz_phy)
4356{
4357	struct ieee80211_hw *hw = dev->wl->hw;
4358
4359	if (have_2ghz_phy)
4360		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4361	if (dev->phy.type == B43_PHYTYPE_N) {
4362		if (have_5ghz_phy)
4363			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4364	} else {
4365		if (have_5ghz_phy)
4366			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4367	}
4368
4369	dev->phy.supports_2ghz = have_2ghz_phy;
4370	dev->phy.supports_5ghz = have_5ghz_phy;
4371
4372	return 0;
4373}
4374
4375static void b43_wireless_core_detach(struct b43_wldev *dev)
4376{
4377	/* We release firmware that late to not be required to re-request
4378	 * is all the time when we reinit the core. */
4379	b43_release_firmware(dev);
4380	b43_phy_free(dev);
4381}
4382
4383static int b43_wireless_core_attach(struct b43_wldev *dev)
4384{
4385	struct b43_wl *wl = dev->wl;
4386	struct ssb_bus *bus = dev->dev->bus;
4387	struct pci_dev *pdev = bus->host_pci;
4388	int err;
4389	bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4390	u32 tmp;
4391
4392	/* Do NOT do any device initialization here.
4393	 * Do it in wireless_core_init() instead.
4394	 * This function is for gathering basic information about the HW, only.
4395	 * Also some structs may be set up here. But most likely you want to have
4396	 * that in core_init(), too.
4397	 */
4398
4399	err = ssb_bus_powerup(bus, 0);
4400	if (err) {
4401		b43err(wl, "Bus powerup failed\n");
4402		goto out;
4403	}
4404	/* Get the PHY type. */
4405	if (dev->dev->id.revision >= 5) {
4406		u32 tmshigh;
4407
4408		tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4409		have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4410		have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4411	} else
4412		B43_WARN_ON(1);
4413
4414	dev->phy.gmode = have_2ghz_phy;
4415	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4416	b43_wireless_core_reset(dev, tmp);
4417
4418	err = b43_phy_versioning(dev);
4419	if (err)
4420		goto err_powerdown;
4421	/* Check if this device supports multiband. */
4422	if (!pdev ||
4423	    (pdev->device != 0x4312 &&
4424	     pdev->device != 0x4319 && pdev->device != 0x4324)) {
4425		/* No multiband support. */
4426		have_2ghz_phy = 0;
4427		have_5ghz_phy = 0;
4428		switch (dev->phy.type) {
4429		case B43_PHYTYPE_A:
4430			have_5ghz_phy = 1;
4431			break;
4432		case B43_PHYTYPE_G:
4433		case B43_PHYTYPE_N:
4434			have_2ghz_phy = 1;
4435			break;
4436		default:
4437			B43_WARN_ON(1);
4438		}
4439	}
4440	if (dev->phy.type == B43_PHYTYPE_A) {
4441		/* FIXME */
4442		b43err(wl, "IEEE 802.11a devices are unsupported\n");
4443		err = -EOPNOTSUPP;
4444		goto err_powerdown;
4445	}
4446	if (1 /* disable A-PHY */) {
4447		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4448		if (dev->phy.type != B43_PHYTYPE_N) {
4449			have_2ghz_phy = 1;
4450			have_5ghz_phy = 0;
4451		}
4452	}
4453
4454	err = b43_phy_allocate(dev);
4455	if (err)
4456		goto err_powerdown;
4457
4458	dev->phy.gmode = have_2ghz_phy;
4459	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4460	b43_wireless_core_reset(dev, tmp);
4461
4462	err = b43_validate_chipaccess(dev);
4463	if (err)
4464		goto err_phy_free;
4465	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4466	if (err)
4467		goto err_phy_free;
4468
4469	/* Now set some default "current_dev" */
4470	if (!wl->current_dev)
4471		wl->current_dev = dev;
4472	INIT_WORK(&dev->restart_work, b43_chip_reset);
4473
4474	dev->phy.ops->switch_analog(dev, 0);
4475	ssb_device_disable(dev->dev, 0);
4476	ssb_bus_may_powerdown(bus);
4477
4478out:
4479	return err;
4480
4481err_phy_free:
4482	b43_phy_free(dev);
4483err_powerdown:
4484	ssb_bus_may_powerdown(bus);
4485	return err;
4486}
4487
4488static void b43_one_core_detach(struct ssb_device *dev)
4489{
4490	struct b43_wldev *wldev;
4491	struct b43_wl *wl;
4492
4493	/* Do not cancel ieee80211-workqueue based work here.
4494	 * See comment in b43_remove(). */
4495
4496	wldev = ssb_get_drvdata(dev);
4497	wl = wldev->wl;
4498	b43_debugfs_remove_device(wldev);
4499	b43_wireless_core_detach(wldev);
4500	list_del(&wldev->list);
4501	wl->nr_devs--;
4502	ssb_set_drvdata(dev, NULL);
4503	kfree(wldev);
4504}
4505
4506static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4507{
4508	struct b43_wldev *wldev;
4509	struct pci_dev *pdev;
4510	int err = -ENOMEM;
4511
4512	if (!list_empty(&wl->devlist)) {
4513		/* We are not the first core on this chip. */
4514		pdev = dev->bus->host_pci;
4515		/* Only special chips support more than one wireless
4516		 * core, although some of the other chips have more than
4517		 * one wireless core as well. Check for this and
4518		 * bail out early.
4519		 */
4520		if (!pdev ||
4521		    ((pdev->device != 0x4321) &&
4522		     (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4523			b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4524			return -ENODEV;
4525		}
4526	}
4527
4528	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4529	if (!wldev)
4530		goto out;
4531
4532	wldev->dev = dev;
4533	wldev->wl = wl;
4534	b43_set_status(wldev, B43_STAT_UNINIT);
4535	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4536	tasklet_init(&wldev->isr_tasklet,
4537		     (void (*)(unsigned long))b43_interrupt_tasklet,
4538		     (unsigned long)wldev);
4539	INIT_LIST_HEAD(&wldev->list);
4540
4541	err = b43_wireless_core_attach(wldev);
4542	if (err)
4543		goto err_kfree_wldev;
4544
4545	list_add(&wldev->list, &wl->devlist);
4546	wl->nr_devs++;
4547	ssb_set_drvdata(dev, wldev);
4548	b43_debugfs_add_device(wldev);
4549
4550      out:
4551	return err;
4552
4553      err_kfree_wldev:
4554	kfree(wldev);
4555	return err;
4556}
4557
4558#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
4559	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
4560	(pdev->device == _device) &&					\
4561	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
4562	(pdev->subsystem_device == _subdevice)				)
4563
4564static void b43_sprom_fixup(struct ssb_bus *bus)
4565{
4566	struct pci_dev *pdev;
4567
4568	/* boardflags workarounds */
4569	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4570	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4571		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4572	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4573	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4574		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4575	if (bus->bustype == SSB_BUSTYPE_PCI) {
4576		pdev = bus->host_pci;
4577		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4578		    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4579		    IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4580		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4581		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4582		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4583		    IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4584			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4585	}
4586}
4587
4588static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4589{
4590	struct ieee80211_hw *hw = wl->hw;
4591
4592	ssb_set_devtypedata(dev, NULL);
4593	ieee80211_free_hw(hw);
4594}
4595
4596static int b43_wireless_init(struct ssb_device *dev)
4597{
4598	struct ssb_sprom *sprom = &dev->bus->sprom;
4599	struct ieee80211_hw *hw;
4600	struct b43_wl *wl;
4601	int err = -ENOMEM;
4602
4603	b43_sprom_fixup(dev->bus);
4604
4605	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4606	if (!hw) {
4607		b43err(NULL, "Could not allocate ieee80211 device\n");
4608		goto out;
4609	}
4610
4611	/* fill hw info */
4612	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4613		    IEEE80211_HW_SIGNAL_DBM |
4614		    IEEE80211_HW_NOISE_DBM;
4615
4616	hw->wiphy->interface_modes =
4617		BIT(NL80211_IFTYPE_AP) |
4618		BIT(NL80211_IFTYPE_MESH_POINT) |
4619		BIT(NL80211_IFTYPE_STATION) |
4620		BIT(NL80211_IFTYPE_WDS) |
4621		BIT(NL80211_IFTYPE_ADHOC);
4622
4623	hw->queues = b43_modparam_qos ? 4 : 1;
4624	hw->max_rates = 2;
4625	SET_IEEE80211_DEV(hw, dev->dev);
4626	if (is_valid_ether_addr(sprom->et1mac))
4627		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4628	else
4629		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4630
4631	/* Get and initialize struct b43_wl */
4632	wl = hw_to_b43_wl(hw);
4633	memset(wl, 0, sizeof(*wl));
4634	wl->hw = hw;
4635	spin_lock_init(&wl->irq_lock);
4636	rwlock_init(&wl->tx_lock);
4637	spin_lock_init(&wl->leds_lock);
4638	spin_lock_init(&wl->shm_lock);
4639	mutex_init(&wl->mutex);
4640	INIT_LIST_HEAD(&wl->devlist);
4641	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4642	INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4643
4644	ssb_set_devtypedata(dev, wl);
4645	b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4646	err = 0;
4647      out:
4648	return err;
4649}
4650
4651static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4652{
4653	struct b43_wl *wl;
4654	int err;
4655	int first = 0;
4656
4657	wl = ssb_get_devtypedata(dev);
4658	if (!wl) {
4659		/* Probing the first core. Must setup common struct b43_wl */
4660		first = 1;
4661		err = b43_wireless_init(dev);
4662		if (err)
4663			goto out;
4664		wl = ssb_get_devtypedata(dev);
4665		B43_WARN_ON(!wl);
4666	}
4667	err = b43_one_core_attach(dev, wl);
4668	if (err)
4669		goto err_wireless_exit;
4670
4671	if (first) {
4672		err = ieee80211_register_hw(wl->hw);
4673		if (err)
4674			goto err_one_core_detach;
4675	}
4676
4677      out:
4678	return err;
4679
4680      err_one_core_detach:
4681	b43_one_core_detach(dev);
4682      err_wireless_exit:
4683	if (first)
4684		b43_wireless_exit(dev, wl);
4685	return err;
4686}
4687
4688static void b43_remove(struct ssb_device *dev)
4689{
4690	struct b43_wl *wl = ssb_get_devtypedata(dev);
4691	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4692
4693	/* We must cancel any work here before unregistering from ieee80211,
4694	 * as the ieee80211 unreg will destroy the workqueue. */
4695	cancel_work_sync(&wldev->restart_work);
4696
4697	B43_WARN_ON(!wl);
4698	if (wl->current_dev == wldev)
4699		ieee80211_unregister_hw(wl->hw);
4700
4701	b43_one_core_detach(dev);
4702
4703	if (list_empty(&wl->devlist)) {
4704		/* Last core on the chip unregistered.
4705		 * We can destroy common struct b43_wl.
4706		 */
4707		b43_wireless_exit(dev, wl);
4708	}
4709}
4710
4711/* Perform a hardware reset. This can be called from any context. */
4712void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4713{
4714	/* Must avoid requeueing, if we are in shutdown. */
4715	if (b43_status(dev) < B43_STAT_INITIALIZED)
4716		return;
4717	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4718	queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4719}
4720
4721#ifdef CONFIG_PM
4722
4723static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4724{
4725	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4726	struct b43_wl *wl = wldev->wl;
4727
4728	b43dbg(wl, "Suspending...\n");
4729
4730	mutex_lock(&wl->mutex);
4731	wldev->suspend_in_progress = true;
4732	wldev->suspend_init_status = b43_status(wldev);
4733	if (wldev->suspend_init_status >= B43_STAT_STARTED)
4734		b43_wireless_core_stop(wldev);
4735	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4736		b43_wireless_core_exit(wldev);
4737	mutex_unlock(&wl->mutex);
4738
4739	b43dbg(wl, "Device suspended.\n");
4740
4741	return 0;
4742}
4743
4744static int b43_resume(struct ssb_device *dev)
4745{
4746	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4747	struct b43_wl *wl = wldev->wl;
4748	int err = 0;
4749
4750	b43dbg(wl, "Resuming...\n");
4751
4752	mutex_lock(&wl->mutex);
4753	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4754		err = b43_wireless_core_init(wldev);
4755		if (err) {
4756			b43err(wl, "Resume failed at core init\n");
4757			goto out;
4758		}
4759	}
4760	if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4761		err = b43_wireless_core_start(wldev);
4762		if (err) {
4763			b43_leds_exit(wldev);
4764			b43_rng_exit(wldev->wl);
4765			b43_wireless_core_exit(wldev);
4766			b43err(wl, "Resume failed at core start\n");
4767			goto out;
4768		}
4769	}
4770	b43dbg(wl, "Device resumed.\n");
4771 out:
4772	wldev->suspend_in_progress = false;
4773	mutex_unlock(&wl->mutex);
4774	return err;
4775}
4776
4777#else /* CONFIG_PM */
4778# define b43_suspend	NULL
4779# define b43_resume	NULL
4780#endif /* CONFIG_PM */
4781
4782static struct ssb_driver b43_ssb_driver = {
4783	.name		= KBUILD_MODNAME,
4784	.id_table	= b43_ssb_tbl,
4785	.probe		= b43_probe,
4786	.remove		= b43_remove,
4787	.suspend	= b43_suspend,
4788	.resume		= b43_resume,
4789};
4790
4791static void b43_print_driverinfo(void)
4792{
4793	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4794		   *feat_leds = "", *feat_rfkill = "";
4795
4796#ifdef CONFIG_B43_PCI_AUTOSELECT
4797	feat_pci = "P";
4798#endif
4799#ifdef CONFIG_B43_PCMCIA
4800	feat_pcmcia = "M";
4801#endif
4802#ifdef CONFIG_B43_NPHY
4803	feat_nphy = "N";
4804#endif
4805#ifdef CONFIG_B43_LEDS
4806	feat_leds = "L";
4807#endif
4808#ifdef CONFIG_B43_RFKILL
4809	feat_rfkill = "R";
4810#endif
4811	printk(KERN_INFO "Broadcom 43xx driver loaded "
4812	       "[ Features: %s%s%s%s%s, Firmware-ID: "
4813	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
4814	       feat_pci, feat_pcmcia, feat_nphy,
4815	       feat_leds, feat_rfkill);
4816}
4817
4818static int __init b43_init(void)
4819{
4820	int err;
4821
4822	b43_debugfs_init();
4823	err = b43_pcmcia_init();
4824	if (err)
4825		goto err_dfs_exit;
4826	err = ssb_driver_register(&b43_ssb_driver);
4827	if (err)
4828		goto err_pcmcia_exit;
4829	b43_print_driverinfo();
4830
4831	return err;
4832
4833err_pcmcia_exit:
4834	b43_pcmcia_exit();
4835err_dfs_exit:
4836	b43_debugfs_exit();
4837	return err;
4838}
4839
4840static void __exit b43_exit(void)
4841{
4842	ssb_driver_unregister(&b43_ssb_driver);
4843	b43_pcmcia_exit();
4844	b43_debugfs_exit();
4845}
4846
4847module_init(b43_init)
4848module_exit(b43_exit)
4849