main.c revision f59ac0481660e66cec67f1d6b024e78b9dc715fe
1/*
2
3  Broadcom B43 wireless driver
4
5  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7  Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
8  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10
11  Some parts of the code in this file are derived from the ipw2200
12  driver  Copyright(c) 2003 - 2004 Intel Corporation.
13
14  This program is free software; you can redistribute it and/or modify
15  it under the terms of the GNU General Public License as published by
16  the Free Software Foundation; either version 2 of the License, or
17  (at your option) any later version.
18
19  This program is distributed in the hope that it will be useful,
20  but WITHOUT ANY WARRANTY; without even the implied warranty of
21  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  GNU General Public License for more details.
23
24  You should have received a copy of the GNU General Public License
25  along with this program; see the file COPYING.  If not, write to
26  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
27  Boston, MA 02110-1301, USA.
28
29*/
30
31#include <linux/delay.h>
32#include <linux/init.h>
33#include <linux/moduleparam.h>
34#include <linux/if_arp.h>
35#include <linux/etherdevice.h>
36#include <linux/firmware.h>
37#include <linux/wireless.h>
38#include <linux/workqueue.h>
39#include <linux/skbuff.h>
40#include <linux/io.h>
41#include <linux/dma-mapping.h>
42#include <asm/unaligned.h>
43
44#include "b43.h"
45#include "main.h"
46#include "debugfs.h"
47#include "phy_common.h"
48#include "phy_g.h"
49#include "nphy.h"
50#include "dma.h"
51#include "pio.h"
52#include "sysfs.h"
53#include "xmit.h"
54#include "lo.h"
55#include "pcmcia.h"
56
57MODULE_DESCRIPTION("Broadcom B43 wireless driver");
58MODULE_AUTHOR("Martin Langer");
59MODULE_AUTHOR("Stefano Brivio");
60MODULE_AUTHOR("Michael Buesch");
61MODULE_LICENSE("GPL");
62
63MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
64
65
66static int modparam_bad_frames_preempt;
67module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
68MODULE_PARM_DESC(bad_frames_preempt,
69		 "enable(1) / disable(0) Bad Frames Preemption");
70
71static char modparam_fwpostfix[16];
72module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
73MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
74
75static int modparam_hwpctl;
76module_param_named(hwpctl, modparam_hwpctl, int, 0444);
77MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
78
79static int modparam_nohwcrypt;
80module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
81MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
82
83int b43_modparam_qos = 1;
84module_param_named(qos, b43_modparam_qos, int, 0444);
85MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
86
87static int modparam_btcoex = 1;
88module_param_named(btcoex, modparam_btcoex, int, 0444);
89MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
90
91
92static const struct ssb_device_id b43_ssb_tbl[] = {
93	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
94	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
95	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
96	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
97	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
98	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
99	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
100	SSB_DEVTABLE_END
101};
102
103MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
104
105/* Channel and ratetables are shared for all devices.
106 * They can't be const, because ieee80211 puts some precalculated
107 * data in there. This data is the same for all devices, so we don't
108 * get concurrency issues */
109#define RATETAB_ENT(_rateid, _flags) \
110	{								\
111		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
112		.hw_value	= (_rateid),				\
113		.flags		= (_flags),				\
114	}
115
116/*
117 * NOTE: When changing this, sync with xmit.c's
118 *	 b43_plcp_get_bitrate_idx_* functions!
119 */
120static struct ieee80211_rate __b43_ratetable[] = {
121	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
122	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
123	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
124	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
125	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
126	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
127	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
128	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
129	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
130	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
131	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
132	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
133};
134
135#define b43_a_ratetable		(__b43_ratetable + 4)
136#define b43_a_ratetable_size	8
137#define b43_b_ratetable		(__b43_ratetable + 0)
138#define b43_b_ratetable_size	4
139#define b43_g_ratetable		(__b43_ratetable + 0)
140#define b43_g_ratetable_size	12
141
142#define CHAN4G(_channel, _freq, _flags) {			\
143	.band			= IEEE80211_BAND_2GHZ,		\
144	.center_freq		= (_freq),			\
145	.hw_value		= (_channel),			\
146	.flags			= (_flags),			\
147	.max_antenna_gain	= 0,				\
148	.max_power		= 30,				\
149}
150static struct ieee80211_channel b43_2ghz_chantable[] = {
151	CHAN4G(1, 2412, 0),
152	CHAN4G(2, 2417, 0),
153	CHAN4G(3, 2422, 0),
154	CHAN4G(4, 2427, 0),
155	CHAN4G(5, 2432, 0),
156	CHAN4G(6, 2437, 0),
157	CHAN4G(7, 2442, 0),
158	CHAN4G(8, 2447, 0),
159	CHAN4G(9, 2452, 0),
160	CHAN4G(10, 2457, 0),
161	CHAN4G(11, 2462, 0),
162	CHAN4G(12, 2467, 0),
163	CHAN4G(13, 2472, 0),
164	CHAN4G(14, 2484, 0),
165};
166#undef CHAN4G
167
168#define CHAN5G(_channel, _flags) {				\
169	.band			= IEEE80211_BAND_5GHZ,		\
170	.center_freq		= 5000 + (5 * (_channel)),	\
171	.hw_value		= (_channel),			\
172	.flags			= (_flags),			\
173	.max_antenna_gain	= 0,				\
174	.max_power		= 30,				\
175}
176static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
177	CHAN5G(32, 0),		CHAN5G(34, 0),
178	CHAN5G(36, 0),		CHAN5G(38, 0),
179	CHAN5G(40, 0),		CHAN5G(42, 0),
180	CHAN5G(44, 0),		CHAN5G(46, 0),
181	CHAN5G(48, 0),		CHAN5G(50, 0),
182	CHAN5G(52, 0),		CHAN5G(54, 0),
183	CHAN5G(56, 0),		CHAN5G(58, 0),
184	CHAN5G(60, 0),		CHAN5G(62, 0),
185	CHAN5G(64, 0),		CHAN5G(66, 0),
186	CHAN5G(68, 0),		CHAN5G(70, 0),
187	CHAN5G(72, 0),		CHAN5G(74, 0),
188	CHAN5G(76, 0),		CHAN5G(78, 0),
189	CHAN5G(80, 0),		CHAN5G(82, 0),
190	CHAN5G(84, 0),		CHAN5G(86, 0),
191	CHAN5G(88, 0),		CHAN5G(90, 0),
192	CHAN5G(92, 0),		CHAN5G(94, 0),
193	CHAN5G(96, 0),		CHAN5G(98, 0),
194	CHAN5G(100, 0),		CHAN5G(102, 0),
195	CHAN5G(104, 0),		CHAN5G(106, 0),
196	CHAN5G(108, 0),		CHAN5G(110, 0),
197	CHAN5G(112, 0),		CHAN5G(114, 0),
198	CHAN5G(116, 0),		CHAN5G(118, 0),
199	CHAN5G(120, 0),		CHAN5G(122, 0),
200	CHAN5G(124, 0),		CHAN5G(126, 0),
201	CHAN5G(128, 0),		CHAN5G(130, 0),
202	CHAN5G(132, 0),		CHAN5G(134, 0),
203	CHAN5G(136, 0),		CHAN5G(138, 0),
204	CHAN5G(140, 0),		CHAN5G(142, 0),
205	CHAN5G(144, 0),		CHAN5G(145, 0),
206	CHAN5G(146, 0),		CHAN5G(147, 0),
207	CHAN5G(148, 0),		CHAN5G(149, 0),
208	CHAN5G(150, 0),		CHAN5G(151, 0),
209	CHAN5G(152, 0),		CHAN5G(153, 0),
210	CHAN5G(154, 0),		CHAN5G(155, 0),
211	CHAN5G(156, 0),		CHAN5G(157, 0),
212	CHAN5G(158, 0),		CHAN5G(159, 0),
213	CHAN5G(160, 0),		CHAN5G(161, 0),
214	CHAN5G(162, 0),		CHAN5G(163, 0),
215	CHAN5G(164, 0),		CHAN5G(165, 0),
216	CHAN5G(166, 0),		CHAN5G(168, 0),
217	CHAN5G(170, 0),		CHAN5G(172, 0),
218	CHAN5G(174, 0),		CHAN5G(176, 0),
219	CHAN5G(178, 0),		CHAN5G(180, 0),
220	CHAN5G(182, 0),		CHAN5G(184, 0),
221	CHAN5G(186, 0),		CHAN5G(188, 0),
222	CHAN5G(190, 0),		CHAN5G(192, 0),
223	CHAN5G(194, 0),		CHAN5G(196, 0),
224	CHAN5G(198, 0),		CHAN5G(200, 0),
225	CHAN5G(202, 0),		CHAN5G(204, 0),
226	CHAN5G(206, 0),		CHAN5G(208, 0),
227	CHAN5G(210, 0),		CHAN5G(212, 0),
228	CHAN5G(214, 0),		CHAN5G(216, 0),
229	CHAN5G(218, 0),		CHAN5G(220, 0),
230	CHAN5G(222, 0),		CHAN5G(224, 0),
231	CHAN5G(226, 0),		CHAN5G(228, 0),
232};
233
234static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
235	CHAN5G(34, 0),		CHAN5G(36, 0),
236	CHAN5G(38, 0),		CHAN5G(40, 0),
237	CHAN5G(42, 0),		CHAN5G(44, 0),
238	CHAN5G(46, 0),		CHAN5G(48, 0),
239	CHAN5G(52, 0),		CHAN5G(56, 0),
240	CHAN5G(60, 0),		CHAN5G(64, 0),
241	CHAN5G(100, 0),		CHAN5G(104, 0),
242	CHAN5G(108, 0),		CHAN5G(112, 0),
243	CHAN5G(116, 0),		CHAN5G(120, 0),
244	CHAN5G(124, 0),		CHAN5G(128, 0),
245	CHAN5G(132, 0),		CHAN5G(136, 0),
246	CHAN5G(140, 0),		CHAN5G(149, 0),
247	CHAN5G(153, 0),		CHAN5G(157, 0),
248	CHAN5G(161, 0),		CHAN5G(165, 0),
249	CHAN5G(184, 0),		CHAN5G(188, 0),
250	CHAN5G(192, 0),		CHAN5G(196, 0),
251	CHAN5G(200, 0),		CHAN5G(204, 0),
252	CHAN5G(208, 0),		CHAN5G(212, 0),
253	CHAN5G(216, 0),
254};
255#undef CHAN5G
256
257static struct ieee80211_supported_band b43_band_5GHz_nphy = {
258	.band		= IEEE80211_BAND_5GHZ,
259	.channels	= b43_5ghz_nphy_chantable,
260	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
261	.bitrates	= b43_a_ratetable,
262	.n_bitrates	= b43_a_ratetable_size,
263};
264
265static struct ieee80211_supported_band b43_band_5GHz_aphy = {
266	.band		= IEEE80211_BAND_5GHZ,
267	.channels	= b43_5ghz_aphy_chantable,
268	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
269	.bitrates	= b43_a_ratetable,
270	.n_bitrates	= b43_a_ratetable_size,
271};
272
273static struct ieee80211_supported_band b43_band_2GHz = {
274	.band		= IEEE80211_BAND_2GHZ,
275	.channels	= b43_2ghz_chantable,
276	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
277	.bitrates	= b43_g_ratetable,
278	.n_bitrates	= b43_g_ratetable_size,
279};
280
281static void b43_wireless_core_exit(struct b43_wldev *dev);
282static int b43_wireless_core_init(struct b43_wldev *dev);
283static void b43_wireless_core_stop(struct b43_wldev *dev);
284static int b43_wireless_core_start(struct b43_wldev *dev);
285
286static int b43_ratelimit(struct b43_wl *wl)
287{
288	if (!wl || !wl->current_dev)
289		return 1;
290	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
291		return 1;
292	/* We are up and running.
293	 * Ratelimit the messages to avoid DoS over the net. */
294	return net_ratelimit();
295}
296
297void b43info(struct b43_wl *wl, const char *fmt, ...)
298{
299	va_list args;
300
301	if (!b43_ratelimit(wl))
302		return;
303	va_start(args, fmt);
304	printk(KERN_INFO "b43-%s: ",
305	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
306	vprintk(fmt, args);
307	va_end(args);
308}
309
310void b43err(struct b43_wl *wl, const char *fmt, ...)
311{
312	va_list args;
313
314	if (!b43_ratelimit(wl))
315		return;
316	va_start(args, fmt);
317	printk(KERN_ERR "b43-%s ERROR: ",
318	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
319	vprintk(fmt, args);
320	va_end(args);
321}
322
323void b43warn(struct b43_wl *wl, const char *fmt, ...)
324{
325	va_list args;
326
327	if (!b43_ratelimit(wl))
328		return;
329	va_start(args, fmt);
330	printk(KERN_WARNING "b43-%s warning: ",
331	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
332	vprintk(fmt, args);
333	va_end(args);
334}
335
336#if B43_DEBUG
337void b43dbg(struct b43_wl *wl, const char *fmt, ...)
338{
339	va_list args;
340
341	va_start(args, fmt);
342	printk(KERN_DEBUG "b43-%s debug: ",
343	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan");
344	vprintk(fmt, args);
345	va_end(args);
346}
347#endif /* DEBUG */
348
349static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
350{
351	u32 macctl;
352
353	B43_WARN_ON(offset % 4 != 0);
354
355	macctl = b43_read32(dev, B43_MMIO_MACCTL);
356	if (macctl & B43_MACCTL_BE)
357		val = swab32(val);
358
359	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
360	mmiowb();
361	b43_write32(dev, B43_MMIO_RAM_DATA, val);
362}
363
364static inline void b43_shm_control_word(struct b43_wldev *dev,
365					u16 routing, u16 offset)
366{
367	u32 control;
368
369	/* "offset" is the WORD offset. */
370	control = routing;
371	control <<= 16;
372	control |= offset;
373	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
374}
375
376u32 __b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
377{
378	u32 ret;
379
380	if (routing == B43_SHM_SHARED) {
381		B43_WARN_ON(offset & 0x0001);
382		if (offset & 0x0003) {
383			/* Unaligned access */
384			b43_shm_control_word(dev, routing, offset >> 2);
385			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
386			ret <<= 16;
387			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
388			ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
389
390			goto out;
391		}
392		offset >>= 2;
393	}
394	b43_shm_control_word(dev, routing, offset);
395	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
396out:
397	return ret;
398}
399
400u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
401{
402	struct b43_wl *wl = dev->wl;
403	unsigned long flags;
404	u32 ret;
405
406	spin_lock_irqsave(&wl->shm_lock, flags);
407	ret = __b43_shm_read32(dev, routing, offset);
408	spin_unlock_irqrestore(&wl->shm_lock, flags);
409
410	return ret;
411}
412
413u16 __b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
414{
415	u16 ret;
416
417	if (routing == B43_SHM_SHARED) {
418		B43_WARN_ON(offset & 0x0001);
419		if (offset & 0x0003) {
420			/* Unaligned access */
421			b43_shm_control_word(dev, routing, offset >> 2);
422			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
423
424			goto out;
425		}
426		offset >>= 2;
427	}
428	b43_shm_control_word(dev, routing, offset);
429	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
430out:
431	return ret;
432}
433
434u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
435{
436	struct b43_wl *wl = dev->wl;
437	unsigned long flags;
438	u16 ret;
439
440	spin_lock_irqsave(&wl->shm_lock, flags);
441	ret = __b43_shm_read16(dev, routing, offset);
442	spin_unlock_irqrestore(&wl->shm_lock, flags);
443
444	return ret;
445}
446
447void __b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
448{
449	if (routing == B43_SHM_SHARED) {
450		B43_WARN_ON(offset & 0x0001);
451		if (offset & 0x0003) {
452			/* Unaligned access */
453			b43_shm_control_word(dev, routing, offset >> 2);
454			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
455				    (value >> 16) & 0xffff);
456			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
457			b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
458			return;
459		}
460		offset >>= 2;
461	}
462	b43_shm_control_word(dev, routing, offset);
463	b43_write32(dev, B43_MMIO_SHM_DATA, value);
464}
465
466void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
467{
468	struct b43_wl *wl = dev->wl;
469	unsigned long flags;
470
471	spin_lock_irqsave(&wl->shm_lock, flags);
472	__b43_shm_write32(dev, routing, offset, value);
473	spin_unlock_irqrestore(&wl->shm_lock, flags);
474}
475
476void __b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
477{
478	if (routing == B43_SHM_SHARED) {
479		B43_WARN_ON(offset & 0x0001);
480		if (offset & 0x0003) {
481			/* Unaligned access */
482			b43_shm_control_word(dev, routing, offset >> 2);
483			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
484			return;
485		}
486		offset >>= 2;
487	}
488	b43_shm_control_word(dev, routing, offset);
489	b43_write16(dev, B43_MMIO_SHM_DATA, value);
490}
491
492void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
493{
494	struct b43_wl *wl = dev->wl;
495	unsigned long flags;
496
497	spin_lock_irqsave(&wl->shm_lock, flags);
498	__b43_shm_write16(dev, routing, offset, value);
499	spin_unlock_irqrestore(&wl->shm_lock, flags);
500}
501
502/* Read HostFlags */
503u64 b43_hf_read(struct b43_wldev * dev)
504{
505	u64 ret;
506
507	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
508	ret <<= 16;
509	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
510	ret <<= 16;
511	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
512
513	return ret;
514}
515
516/* Write HostFlags */
517void b43_hf_write(struct b43_wldev *dev, u64 value)
518{
519	u16 lo, mi, hi;
520
521	lo = (value & 0x00000000FFFFULL);
522	mi = (value & 0x0000FFFF0000ULL) >> 16;
523	hi = (value & 0xFFFF00000000ULL) >> 32;
524	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
525	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
526	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
527}
528
529void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
530{
531	/* We need to be careful. As we read the TSF from multiple
532	 * registers, we should take care of register overflows.
533	 * In theory, the whole tsf read process should be atomic.
534	 * We try to be atomic here, by restaring the read process,
535	 * if any of the high registers changed (overflew).
536	 */
537	if (dev->dev->id.revision >= 3) {
538		u32 low, high, high2;
539
540		do {
541			high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
542			low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
543			high2 = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
544		} while (unlikely(high != high2));
545
546		*tsf = high;
547		*tsf <<= 32;
548		*tsf |= low;
549	} else {
550		u64 tmp;
551		u16 v0, v1, v2, v3;
552		u16 test1, test2, test3;
553
554		do {
555			v3 = b43_read16(dev, B43_MMIO_TSF_3);
556			v2 = b43_read16(dev, B43_MMIO_TSF_2);
557			v1 = b43_read16(dev, B43_MMIO_TSF_1);
558			v0 = b43_read16(dev, B43_MMIO_TSF_0);
559
560			test3 = b43_read16(dev, B43_MMIO_TSF_3);
561			test2 = b43_read16(dev, B43_MMIO_TSF_2);
562			test1 = b43_read16(dev, B43_MMIO_TSF_1);
563		} while (v3 != test3 || v2 != test2 || v1 != test1);
564
565		*tsf = v3;
566		*tsf <<= 48;
567		tmp = v2;
568		tmp <<= 32;
569		*tsf |= tmp;
570		tmp = v1;
571		tmp <<= 16;
572		*tsf |= tmp;
573		*tsf |= v0;
574	}
575}
576
577static void b43_time_lock(struct b43_wldev *dev)
578{
579	u32 macctl;
580
581	macctl = b43_read32(dev, B43_MMIO_MACCTL);
582	macctl |= B43_MACCTL_TBTTHOLD;
583	b43_write32(dev, B43_MMIO_MACCTL, macctl);
584	/* Commit the write */
585	b43_read32(dev, B43_MMIO_MACCTL);
586}
587
588static void b43_time_unlock(struct b43_wldev *dev)
589{
590	u32 macctl;
591
592	macctl = b43_read32(dev, B43_MMIO_MACCTL);
593	macctl &= ~B43_MACCTL_TBTTHOLD;
594	b43_write32(dev, B43_MMIO_MACCTL, macctl);
595	/* Commit the write */
596	b43_read32(dev, B43_MMIO_MACCTL);
597}
598
599static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
600{
601	/* Be careful with the in-progress timer.
602	 * First zero out the low register, so we have a full
603	 * register-overflow duration to complete the operation.
604	 */
605	if (dev->dev->id.revision >= 3) {
606		u32 lo = (tsf & 0x00000000FFFFFFFFULL);
607		u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
608
609		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, 0);
610		mmiowb();
611		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, hi);
612		mmiowb();
613		b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, lo);
614	} else {
615		u16 v0 = (tsf & 0x000000000000FFFFULL);
616		u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
617		u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
618		u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
619
620		b43_write16(dev, B43_MMIO_TSF_0, 0);
621		mmiowb();
622		b43_write16(dev, B43_MMIO_TSF_3, v3);
623		mmiowb();
624		b43_write16(dev, B43_MMIO_TSF_2, v2);
625		mmiowb();
626		b43_write16(dev, B43_MMIO_TSF_1, v1);
627		mmiowb();
628		b43_write16(dev, B43_MMIO_TSF_0, v0);
629	}
630}
631
632void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
633{
634	b43_time_lock(dev);
635	b43_tsf_write_locked(dev, tsf);
636	b43_time_unlock(dev);
637}
638
639static
640void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 * mac)
641{
642	static const u8 zero_addr[ETH_ALEN] = { 0 };
643	u16 data;
644
645	if (!mac)
646		mac = zero_addr;
647
648	offset |= 0x0020;
649	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
650
651	data = mac[0];
652	data |= mac[1] << 8;
653	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
654	data = mac[2];
655	data |= mac[3] << 8;
656	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
657	data = mac[4];
658	data |= mac[5] << 8;
659	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
660}
661
662static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
663{
664	const u8 *mac;
665	const u8 *bssid;
666	u8 mac_bssid[ETH_ALEN * 2];
667	int i;
668	u32 tmp;
669
670	bssid = dev->wl->bssid;
671	mac = dev->wl->mac_addr;
672
673	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
674
675	memcpy(mac_bssid, mac, ETH_ALEN);
676	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
677
678	/* Write our MAC address and BSSID to template ram */
679	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
680		tmp = (u32) (mac_bssid[i + 0]);
681		tmp |= (u32) (mac_bssid[i + 1]) << 8;
682		tmp |= (u32) (mac_bssid[i + 2]) << 16;
683		tmp |= (u32) (mac_bssid[i + 3]) << 24;
684		b43_ram_write(dev, 0x20 + i, tmp);
685	}
686}
687
688static void b43_upload_card_macaddress(struct b43_wldev *dev)
689{
690	b43_write_mac_bssid_templates(dev);
691	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
692}
693
694static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
695{
696	/* slot_time is in usec. */
697	if (dev->phy.type != B43_PHYTYPE_G)
698		return;
699	b43_write16(dev, 0x684, 510 + slot_time);
700	b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
701}
702
703static void b43_short_slot_timing_enable(struct b43_wldev *dev)
704{
705	b43_set_slot_time(dev, 9);
706	dev->short_slot = 1;
707}
708
709static void b43_short_slot_timing_disable(struct b43_wldev *dev)
710{
711	b43_set_slot_time(dev, 20);
712	dev->short_slot = 0;
713}
714
715/* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
716 * Returns the _previously_ enabled IRQ mask.
717 */
718static inline u32 b43_interrupt_enable(struct b43_wldev *dev, u32 mask)
719{
720	u32 old_mask;
721
722	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
723	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask | mask);
724
725	return old_mask;
726}
727
728/* Disable a Generic IRQ. "mask" is the mask of which IRQs to disable.
729 * Returns the _previously_ enabled IRQ mask.
730 */
731static inline u32 b43_interrupt_disable(struct b43_wldev *dev, u32 mask)
732{
733	u32 old_mask;
734
735	old_mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
736	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, old_mask & ~mask);
737
738	return old_mask;
739}
740
741/* Synchronize IRQ top- and bottom-half.
742 * IRQs must be masked before calling this.
743 * This must not be called with the irq_lock held.
744 */
745static void b43_synchronize_irq(struct b43_wldev *dev)
746{
747	synchronize_irq(dev->dev->irq);
748	tasklet_kill(&dev->isr_tasklet);
749}
750
751/* DummyTransmission function, as documented on
752 * http://bcm-specs.sipsolutions.net/DummyTransmission
753 */
754void b43_dummy_transmission(struct b43_wldev *dev)
755{
756	struct b43_wl *wl = dev->wl;
757	struct b43_phy *phy = &dev->phy;
758	unsigned int i, max_loop;
759	u16 value;
760	u32 buffer[5] = {
761		0x00000000,
762		0x00D40000,
763		0x00000000,
764		0x01000000,
765		0x00000000,
766	};
767
768	switch (phy->type) {
769	case B43_PHYTYPE_A:
770		max_loop = 0x1E;
771		buffer[0] = 0x000201CC;
772		break;
773	case B43_PHYTYPE_B:
774	case B43_PHYTYPE_G:
775		max_loop = 0xFA;
776		buffer[0] = 0x000B846E;
777		break;
778	default:
779		B43_WARN_ON(1);
780		return;
781	}
782
783	spin_lock_irq(&wl->irq_lock);
784	write_lock(&wl->tx_lock);
785
786	for (i = 0; i < 5; i++)
787		b43_ram_write(dev, i * 4, buffer[i]);
788
789	/* Commit writes */
790	b43_read32(dev, B43_MMIO_MACCTL);
791
792	b43_write16(dev, 0x0568, 0x0000);
793	b43_write16(dev, 0x07C0, 0x0000);
794	value = ((phy->type == B43_PHYTYPE_A) ? 1 : 0);
795	b43_write16(dev, 0x050C, value);
796	b43_write16(dev, 0x0508, 0x0000);
797	b43_write16(dev, 0x050A, 0x0000);
798	b43_write16(dev, 0x054C, 0x0000);
799	b43_write16(dev, 0x056A, 0x0014);
800	b43_write16(dev, 0x0568, 0x0826);
801	b43_write16(dev, 0x0500, 0x0000);
802	b43_write16(dev, 0x0502, 0x0030);
803
804	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
805		b43_radio_write16(dev, 0x0051, 0x0017);
806	for (i = 0x00; i < max_loop; i++) {
807		value = b43_read16(dev, 0x050E);
808		if (value & 0x0080)
809			break;
810		udelay(10);
811	}
812	for (i = 0x00; i < 0x0A; i++) {
813		value = b43_read16(dev, 0x050E);
814		if (value & 0x0400)
815			break;
816		udelay(10);
817	}
818	for (i = 0x00; i < 0x0A; i++) {
819		value = b43_read16(dev, 0x0690);
820		if (!(value & 0x0100))
821			break;
822		udelay(10);
823	}
824	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
825		b43_radio_write16(dev, 0x0051, 0x0037);
826
827	write_unlock(&wl->tx_lock);
828	spin_unlock_irq(&wl->irq_lock);
829}
830
831static void key_write(struct b43_wldev *dev,
832		      u8 index, u8 algorithm, const u8 * key)
833{
834	unsigned int i;
835	u32 offset;
836	u16 value;
837	u16 kidx;
838
839	/* Key index/algo block */
840	kidx = b43_kidx_to_fw(dev, index);
841	value = ((kidx << 4) | algorithm);
842	b43_shm_write16(dev, B43_SHM_SHARED,
843			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
844
845	/* Write the key to the Key Table Pointer offset */
846	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
847	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
848		value = key[i];
849		value |= (u16) (key[i + 1]) << 8;
850		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
851	}
852}
853
854static void keymac_write(struct b43_wldev *dev, u8 index, const u8 * addr)
855{
856	u32 addrtmp[2] = { 0, 0, };
857	u8 per_sta_keys_start = 8;
858
859	if (b43_new_kidx_api(dev))
860		per_sta_keys_start = 4;
861
862	B43_WARN_ON(index < per_sta_keys_start);
863	/* We have two default TX keys and possibly two default RX keys.
864	 * Physical mac 0 is mapped to physical key 4 or 8, depending
865	 * on the firmware version.
866	 * So we must adjust the index here.
867	 */
868	index -= per_sta_keys_start;
869
870	if (addr) {
871		addrtmp[0] = addr[0];
872		addrtmp[0] |= ((u32) (addr[1]) << 8);
873		addrtmp[0] |= ((u32) (addr[2]) << 16);
874		addrtmp[0] |= ((u32) (addr[3]) << 24);
875		addrtmp[1] = addr[4];
876		addrtmp[1] |= ((u32) (addr[5]) << 8);
877	}
878
879	if (dev->dev->id.revision >= 5) {
880		/* Receive match transmitter address mechanism */
881		b43_shm_write32(dev, B43_SHM_RCMTA,
882				(index * 2) + 0, addrtmp[0]);
883		b43_shm_write16(dev, B43_SHM_RCMTA,
884				(index * 2) + 1, addrtmp[1]);
885	} else {
886		/* RXE (Receive Engine) and
887		 * PSM (Programmable State Machine) mechanism
888		 */
889		if (index < 8) {
890			/* TODO write to RCM 16, 19, 22 and 25 */
891		} else {
892			b43_shm_write32(dev, B43_SHM_SHARED,
893					B43_SHM_SH_PSM + (index * 6) + 0,
894					addrtmp[0]);
895			b43_shm_write16(dev, B43_SHM_SHARED,
896					B43_SHM_SH_PSM + (index * 6) + 4,
897					addrtmp[1]);
898		}
899	}
900}
901
902static void do_key_write(struct b43_wldev *dev,
903			 u8 index, u8 algorithm,
904			 const u8 * key, size_t key_len, const u8 * mac_addr)
905{
906	u8 buf[B43_SEC_KEYSIZE] = { 0, };
907	u8 per_sta_keys_start = 8;
908
909	if (b43_new_kidx_api(dev))
910		per_sta_keys_start = 4;
911
912	B43_WARN_ON(index >= dev->max_nr_keys);
913	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
914
915	if (index >= per_sta_keys_start)
916		keymac_write(dev, index, NULL);	/* First zero out mac. */
917	if (key)
918		memcpy(buf, key, key_len);
919	key_write(dev, index, algorithm, buf);
920	if (index >= per_sta_keys_start)
921		keymac_write(dev, index, mac_addr);
922
923	dev->key[index].algorithm = algorithm;
924}
925
926static int b43_key_write(struct b43_wldev *dev,
927			 int index, u8 algorithm,
928			 const u8 * key, size_t key_len,
929			 const u8 * mac_addr,
930			 struct ieee80211_key_conf *keyconf)
931{
932	int i;
933	int sta_keys_start;
934
935	if (key_len > B43_SEC_KEYSIZE)
936		return -EINVAL;
937	for (i = 0; i < dev->max_nr_keys; i++) {
938		/* Check that we don't already have this key. */
939		B43_WARN_ON(dev->key[i].keyconf == keyconf);
940	}
941	if (index < 0) {
942		/* Either pairwise key or address is 00:00:00:00:00:00
943		 * for transmit-only keys. Search the index. */
944		if (b43_new_kidx_api(dev))
945			sta_keys_start = 4;
946		else
947			sta_keys_start = 8;
948		for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
949			if (!dev->key[i].keyconf) {
950				/* found empty */
951				index = i;
952				break;
953			}
954		}
955		if (index < 0) {
956			b43err(dev->wl, "Out of hardware key memory\n");
957			return -ENOSPC;
958		}
959	} else
960		B43_WARN_ON(index > 3);
961
962	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
963	if ((index <= 3) && !b43_new_kidx_api(dev)) {
964		/* Default RX key */
965		B43_WARN_ON(mac_addr);
966		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
967	}
968	keyconf->hw_key_idx = index;
969	dev->key[index].keyconf = keyconf;
970
971	return 0;
972}
973
974static int b43_key_clear(struct b43_wldev *dev, int index)
975{
976	if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
977		return -EINVAL;
978	do_key_write(dev, index, B43_SEC_ALGO_NONE,
979		     NULL, B43_SEC_KEYSIZE, NULL);
980	if ((index <= 3) && !b43_new_kidx_api(dev)) {
981		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
982			     NULL, B43_SEC_KEYSIZE, NULL);
983	}
984	dev->key[index].keyconf = NULL;
985
986	return 0;
987}
988
989static void b43_clear_keys(struct b43_wldev *dev)
990{
991	int i;
992
993	for (i = 0; i < dev->max_nr_keys; i++)
994		b43_key_clear(dev, i);
995}
996
997void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
998{
999	u32 macctl;
1000	u16 ucstat;
1001	bool hwps;
1002	bool awake;
1003	int i;
1004
1005	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1006		    (ps_flags & B43_PS_DISABLED));
1007	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1008
1009	if (ps_flags & B43_PS_ENABLED) {
1010		hwps = 1;
1011	} else if (ps_flags & B43_PS_DISABLED) {
1012		hwps = 0;
1013	} else {
1014		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1015		//      and thus is not an AP and we are associated, set bit 25
1016	}
1017	if (ps_flags & B43_PS_AWAKE) {
1018		awake = 1;
1019	} else if (ps_flags & B43_PS_ASLEEP) {
1020		awake = 0;
1021	} else {
1022		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1023		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1024		//      successful, set bit26
1025	}
1026
1027/* FIXME: For now we force awake-on and hwps-off */
1028	hwps = 0;
1029	awake = 1;
1030
1031	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1032	if (hwps)
1033		macctl |= B43_MACCTL_HWPS;
1034	else
1035		macctl &= ~B43_MACCTL_HWPS;
1036	if (awake)
1037		macctl |= B43_MACCTL_AWAKE;
1038	else
1039		macctl &= ~B43_MACCTL_AWAKE;
1040	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1041	/* Commit write */
1042	b43_read32(dev, B43_MMIO_MACCTL);
1043	if (awake && dev->dev->id.revision >= 5) {
1044		/* Wait for the microcode to wake up. */
1045		for (i = 0; i < 100; i++) {
1046			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1047						B43_SHM_SH_UCODESTAT);
1048			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1049				break;
1050			udelay(10);
1051		}
1052	}
1053}
1054
1055/* Turn the Analog ON/OFF */
1056static void b43_switch_analog(struct b43_wldev *dev, int on)
1057{
1058	switch (dev->phy.type) {
1059	case B43_PHYTYPE_A:
1060	case B43_PHYTYPE_G:
1061		b43_write16(dev, B43_MMIO_PHY0, on ? 0 : 0xF4);
1062		break;
1063	case B43_PHYTYPE_N:
1064		b43_phy_write(dev, B43_NPHY_AFECTL_OVER,
1065			      on ? 0 : 0x7FFF);
1066		break;
1067	default:
1068		B43_WARN_ON(1);
1069	}
1070}
1071
1072void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1073{
1074	u32 tmslow;
1075	u32 macctl;
1076
1077	flags |= B43_TMSLOW_PHYCLKEN;
1078	flags |= B43_TMSLOW_PHYRESET;
1079	ssb_device_enable(dev->dev, flags);
1080	msleep(2);		/* Wait for the PLL to turn on. */
1081
1082	/* Now take the PHY out of Reset again */
1083	tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
1084	tmslow |= SSB_TMSLOW_FGC;
1085	tmslow &= ~B43_TMSLOW_PHYRESET;
1086	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1087	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1088	msleep(1);
1089	tmslow &= ~SSB_TMSLOW_FGC;
1090	ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
1091	ssb_read32(dev->dev, SSB_TMSLOW);	/* flush */
1092	msleep(1);
1093
1094	/* Turn Analog ON */
1095	b43_switch_analog(dev, 1);
1096
1097	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1098	macctl &= ~B43_MACCTL_GMODE;
1099	if (flags & B43_TMSLOW_GMODE)
1100		macctl |= B43_MACCTL_GMODE;
1101	macctl |= B43_MACCTL_IHR_ENABLED;
1102	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1103}
1104
1105static void handle_irq_transmit_status(struct b43_wldev *dev)
1106{
1107	u32 v0, v1;
1108	u16 tmp;
1109	struct b43_txstatus stat;
1110
1111	while (1) {
1112		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1113		if (!(v0 & 0x00000001))
1114			break;
1115		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1116
1117		stat.cookie = (v0 >> 16);
1118		stat.seq = (v1 & 0x0000FFFF);
1119		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1120		tmp = (v0 & 0x0000FFFF);
1121		stat.frame_count = ((tmp & 0xF000) >> 12);
1122		stat.rts_count = ((tmp & 0x0F00) >> 8);
1123		stat.supp_reason = ((tmp & 0x001C) >> 2);
1124		stat.pm_indicated = !!(tmp & 0x0080);
1125		stat.intermediate = !!(tmp & 0x0040);
1126		stat.for_ampdu = !!(tmp & 0x0020);
1127		stat.acked = !!(tmp & 0x0002);
1128
1129		b43_handle_txstatus(dev, &stat);
1130	}
1131}
1132
1133static void drain_txstatus_queue(struct b43_wldev *dev)
1134{
1135	u32 dummy;
1136
1137	if (dev->dev->id.revision < 5)
1138		return;
1139	/* Read all entries from the microcode TXstatus FIFO
1140	 * and throw them away.
1141	 */
1142	while (1) {
1143		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1144		if (!(dummy & 0x00000001))
1145			break;
1146		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1147	}
1148}
1149
1150static u32 b43_jssi_read(struct b43_wldev *dev)
1151{
1152	u32 val = 0;
1153
1154	val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1155	val <<= 16;
1156	val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1157
1158	return val;
1159}
1160
1161static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1162{
1163	b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1164	b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1165}
1166
1167static void b43_generate_noise_sample(struct b43_wldev *dev)
1168{
1169	b43_jssi_write(dev, 0x7F7F7F7F);
1170	b43_write32(dev, B43_MMIO_MACCMD,
1171		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1172}
1173
1174static void b43_calculate_link_quality(struct b43_wldev *dev)
1175{
1176	/* Top half of Link Quality calculation. */
1177
1178	if (dev->phy.type != B43_PHYTYPE_G)
1179		return;
1180	if (dev->noisecalc.calculation_running)
1181		return;
1182	dev->noisecalc.calculation_running = 1;
1183	dev->noisecalc.nr_samples = 0;
1184
1185	b43_generate_noise_sample(dev);
1186}
1187
1188static void handle_irq_noise(struct b43_wldev *dev)
1189{
1190	struct b43_phy_g *phy = dev->phy.g;
1191	u16 tmp;
1192	u8 noise[4];
1193	u8 i, j;
1194	s32 average;
1195
1196	/* Bottom half of Link Quality calculation. */
1197
1198	if (dev->phy.type != B43_PHYTYPE_G)
1199		return;
1200
1201	/* Possible race condition: It might be possible that the user
1202	 * changed to a different channel in the meantime since we
1203	 * started the calculation. We ignore that fact, since it's
1204	 * not really that much of a problem. The background noise is
1205	 * an estimation only anyway. Slightly wrong results will get damped
1206	 * by the averaging of the 8 sample rounds. Additionally the
1207	 * value is shortlived. So it will be replaced by the next noise
1208	 * calculation round soon. */
1209
1210	B43_WARN_ON(!dev->noisecalc.calculation_running);
1211	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1212	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1213	    noise[2] == 0x7F || noise[3] == 0x7F)
1214		goto generate_new;
1215
1216	/* Get the noise samples. */
1217	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1218	i = dev->noisecalc.nr_samples;
1219	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1220	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1221	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1222	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1223	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1224	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1225	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1226	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1227	dev->noisecalc.nr_samples++;
1228	if (dev->noisecalc.nr_samples == 8) {
1229		/* Calculate the Link Quality by the noise samples. */
1230		average = 0;
1231		for (i = 0; i < 8; i++) {
1232			for (j = 0; j < 4; j++)
1233				average += dev->noisecalc.samples[i][j];
1234		}
1235		average /= (8 * 4);
1236		average *= 125;
1237		average += 64;
1238		average /= 128;
1239		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1240		tmp = (tmp / 128) & 0x1F;
1241		if (tmp >= 8)
1242			average += 2;
1243		else
1244			average -= 25;
1245		if (tmp == 8)
1246			average -= 72;
1247		else
1248			average -= 48;
1249
1250		dev->stats.link_noise = average;
1251		dev->noisecalc.calculation_running = 0;
1252		return;
1253	}
1254generate_new:
1255	b43_generate_noise_sample(dev);
1256}
1257
1258static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1259{
1260	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP)) {
1261		///TODO: PS TBTT
1262	} else {
1263		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1264			b43_power_saving_ctl_bits(dev, 0);
1265	}
1266	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
1267		dev->dfq_valid = 1;
1268}
1269
1270static void handle_irq_atim_end(struct b43_wldev *dev)
1271{
1272	if (dev->dfq_valid) {
1273		b43_write32(dev, B43_MMIO_MACCMD,
1274			    b43_read32(dev, B43_MMIO_MACCMD)
1275			    | B43_MACCMD_DFQ_VALID);
1276		dev->dfq_valid = 0;
1277	}
1278}
1279
1280static void handle_irq_pmq(struct b43_wldev *dev)
1281{
1282	u32 tmp;
1283
1284	//TODO: AP mode.
1285
1286	while (1) {
1287		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1288		if (!(tmp & 0x00000008))
1289			break;
1290	}
1291	/* 16bit write is odd, but correct. */
1292	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1293}
1294
1295static void b43_write_template_common(struct b43_wldev *dev,
1296				      const u8 * data, u16 size,
1297				      u16 ram_offset,
1298				      u16 shm_size_offset, u8 rate)
1299{
1300	u32 i, tmp;
1301	struct b43_plcp_hdr4 plcp;
1302
1303	plcp.data = 0;
1304	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1305	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1306	ram_offset += sizeof(u32);
1307	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1308	 * So leave the first two bytes of the next write blank.
1309	 */
1310	tmp = (u32) (data[0]) << 16;
1311	tmp |= (u32) (data[1]) << 24;
1312	b43_ram_write(dev, ram_offset, tmp);
1313	ram_offset += sizeof(u32);
1314	for (i = 2; i < size; i += sizeof(u32)) {
1315		tmp = (u32) (data[i + 0]);
1316		if (i + 1 < size)
1317			tmp |= (u32) (data[i + 1]) << 8;
1318		if (i + 2 < size)
1319			tmp |= (u32) (data[i + 2]) << 16;
1320		if (i + 3 < size)
1321			tmp |= (u32) (data[i + 3]) << 24;
1322		b43_ram_write(dev, ram_offset + i - 2, tmp);
1323	}
1324	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1325			size + sizeof(struct b43_plcp_hdr6));
1326}
1327
1328/* Check if the use of the antenna that ieee80211 told us to
1329 * use is possible. This will fall back to DEFAULT.
1330 * "antenna_nr" is the antenna identifier we got from ieee80211. */
1331u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1332				  u8 antenna_nr)
1333{
1334	u8 antenna_mask;
1335
1336	if (antenna_nr == 0) {
1337		/* Zero means "use default antenna". That's always OK. */
1338		return 0;
1339	}
1340
1341	/* Get the mask of available antennas. */
1342	if (dev->phy.gmode)
1343		antenna_mask = dev->dev->bus->sprom.ant_available_bg;
1344	else
1345		antenna_mask = dev->dev->bus->sprom.ant_available_a;
1346
1347	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1348		/* This antenna is not available. Fall back to default. */
1349		return 0;
1350	}
1351
1352	return antenna_nr;
1353}
1354
1355static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
1356{
1357	antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
1358	switch (antenna) {
1359	case 0:		/* default/diversity */
1360		return B43_ANTENNA_DEFAULT;
1361	case 1:		/* Antenna 0 */
1362		return B43_ANTENNA0;
1363	case 2:		/* Antenna 1 */
1364		return B43_ANTENNA1;
1365	case 3:		/* Antenna 2 */
1366		return B43_ANTENNA2;
1367	case 4:		/* Antenna 3 */
1368		return B43_ANTENNA3;
1369	default:
1370		return B43_ANTENNA_DEFAULT;
1371	}
1372}
1373
1374/* Convert a b43 antenna number value to the PHY TX control value. */
1375static u16 b43_antenna_to_phyctl(int antenna)
1376{
1377	switch (antenna) {
1378	case B43_ANTENNA0:
1379		return B43_TXH_PHY_ANT0;
1380	case B43_ANTENNA1:
1381		return B43_TXH_PHY_ANT1;
1382	case B43_ANTENNA2:
1383		return B43_TXH_PHY_ANT2;
1384	case B43_ANTENNA3:
1385		return B43_TXH_PHY_ANT3;
1386	case B43_ANTENNA_AUTO:
1387		return B43_TXH_PHY_ANT01AUTO;
1388	}
1389	B43_WARN_ON(1);
1390	return 0;
1391}
1392
1393static void b43_write_beacon_template(struct b43_wldev *dev,
1394				      u16 ram_offset,
1395				      u16 shm_size_offset)
1396{
1397	unsigned int i, len, variable_len;
1398	const struct ieee80211_mgmt *bcn;
1399	const u8 *ie;
1400	bool tim_found = 0;
1401	unsigned int rate;
1402	u16 ctl;
1403	int antenna;
1404	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1405
1406	bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1407	len = min((size_t) dev->wl->current_beacon->len,
1408		  0x200 - sizeof(struct b43_plcp_hdr6));
1409	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1410
1411	b43_write_template_common(dev, (const u8 *)bcn,
1412				  len, ram_offset, shm_size_offset, rate);
1413
1414	/* Write the PHY TX control parameters. */
1415	antenna = b43_antenna_from_ieee80211(dev, info->antenna_sel_tx);
1416	antenna = b43_antenna_to_phyctl(antenna);
1417	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1418	/* We can't send beacons with short preamble. Would get PHY errors. */
1419	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1420	ctl &= ~B43_TXH_PHY_ANT;
1421	ctl &= ~B43_TXH_PHY_ENC;
1422	ctl |= antenna;
1423	if (b43_is_cck_rate(rate))
1424		ctl |= B43_TXH_PHY_ENC_CCK;
1425	else
1426		ctl |= B43_TXH_PHY_ENC_OFDM;
1427	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1428
1429	/* Find the position of the TIM and the DTIM_period value
1430	 * and write them to SHM. */
1431	ie = bcn->u.beacon.variable;
1432	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1433	for (i = 0; i < variable_len - 2; ) {
1434		uint8_t ie_id, ie_len;
1435
1436		ie_id = ie[i];
1437		ie_len = ie[i + 1];
1438		if (ie_id == 5) {
1439			u16 tim_position;
1440			u16 dtim_period;
1441			/* This is the TIM Information Element */
1442
1443			/* Check whether the ie_len is in the beacon data range. */
1444			if (variable_len < ie_len + 2 + i)
1445				break;
1446			/* A valid TIM is at least 4 bytes long. */
1447			if (ie_len < 4)
1448				break;
1449			tim_found = 1;
1450
1451			tim_position = sizeof(struct b43_plcp_hdr6);
1452			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1453			tim_position += i;
1454
1455			dtim_period = ie[i + 3];
1456
1457			b43_shm_write16(dev, B43_SHM_SHARED,
1458					B43_SHM_SH_TIMBPOS, tim_position);
1459			b43_shm_write16(dev, B43_SHM_SHARED,
1460					B43_SHM_SH_DTIMPER, dtim_period);
1461			break;
1462		}
1463		i += ie_len + 2;
1464	}
1465	if (!tim_found) {
1466		/*
1467		 * If ucode wants to modify TIM do it behind the beacon, this
1468		 * will happen, for example, when doing mesh networking.
1469		 */
1470		b43_shm_write16(dev, B43_SHM_SHARED,
1471				B43_SHM_SH_TIMBPOS,
1472				len + sizeof(struct b43_plcp_hdr6));
1473		b43_shm_write16(dev, B43_SHM_SHARED,
1474				B43_SHM_SH_DTIMPER, 0);
1475	}
1476	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1477}
1478
1479static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
1480				      u16 shm_offset, u16 size,
1481				      struct ieee80211_rate *rate)
1482{
1483	struct b43_plcp_hdr4 plcp;
1484	u32 tmp;
1485	__le16 dur;
1486
1487	plcp.data = 0;
1488	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1489	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1490					       dev->wl->vif, size,
1491					       rate);
1492	/* Write PLCP in two parts and timing for packet transfer */
1493	tmp = le32_to_cpu(plcp.data);
1494	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
1495	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
1496	b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
1497}
1498
1499/* Instead of using custom probe response template, this function
1500 * just patches custom beacon template by:
1501 * 1) Changing packet type
1502 * 2) Patching duration field
1503 * 3) Stripping TIM
1504 */
1505static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
1506					  u16 *dest_size,
1507					  struct ieee80211_rate *rate)
1508{
1509	const u8 *src_data;
1510	u8 *dest_data;
1511	u16 src_size, elem_size, src_pos, dest_pos;
1512	__le16 dur;
1513	struct ieee80211_hdr *hdr;
1514	size_t ie_start;
1515
1516	src_size = dev->wl->current_beacon->len;
1517	src_data = (const u8 *)dev->wl->current_beacon->data;
1518
1519	/* Get the start offset of the variable IEs in the packet. */
1520	ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1521	B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
1522
1523	if (B43_WARN_ON(src_size < ie_start))
1524		return NULL;
1525
1526	dest_data = kmalloc(src_size, GFP_ATOMIC);
1527	if (unlikely(!dest_data))
1528		return NULL;
1529
1530	/* Copy the static data and all Information Elements, except the TIM. */
1531	memcpy(dest_data, src_data, ie_start);
1532	src_pos = ie_start;
1533	dest_pos = ie_start;
1534	for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1535		elem_size = src_data[src_pos + 1] + 2;
1536		if (src_data[src_pos] == 5) {
1537			/* This is the TIM. */
1538			continue;
1539		}
1540		memcpy(dest_data + dest_pos, src_data + src_pos,
1541		       elem_size);
1542		dest_pos += elem_size;
1543	}
1544	*dest_size = dest_pos;
1545	hdr = (struct ieee80211_hdr *)dest_data;
1546
1547	/* Set the frame control. */
1548	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1549					 IEEE80211_STYPE_PROBE_RESP);
1550	dur = ieee80211_generic_frame_duration(dev->wl->hw,
1551					       dev->wl->vif, *dest_size,
1552					       rate);
1553	hdr->duration_id = dur;
1554
1555	return dest_data;
1556}
1557
1558static void b43_write_probe_resp_template(struct b43_wldev *dev,
1559					  u16 ram_offset,
1560					  u16 shm_size_offset,
1561					  struct ieee80211_rate *rate)
1562{
1563	const u8 *probe_resp_data;
1564	u16 size;
1565
1566	size = dev->wl->current_beacon->len;
1567	probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
1568	if (unlikely(!probe_resp_data))
1569		return;
1570
1571	/* Looks like PLCP headers plus packet timings are stored for
1572	 * all possible basic rates
1573	 */
1574	b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
1575	b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
1576	b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
1577	b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
1578
1579	size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
1580	b43_write_template_common(dev, probe_resp_data,
1581				  size, ram_offset, shm_size_offset,
1582				  rate->hw_value);
1583	kfree(probe_resp_data);
1584}
1585
1586static void b43_upload_beacon0(struct b43_wldev *dev)
1587{
1588	struct b43_wl *wl = dev->wl;
1589
1590	if (wl->beacon0_uploaded)
1591		return;
1592	b43_write_beacon_template(dev, 0x68, 0x18);
1593	/* FIXME: Probe resp upload doesn't really belong here,
1594	 *        but we don't use that feature anyway. */
1595	b43_write_probe_resp_template(dev, 0x268, 0x4A,
1596				      &__b43_ratetable[3]);
1597	wl->beacon0_uploaded = 1;
1598}
1599
1600static void b43_upload_beacon1(struct b43_wldev *dev)
1601{
1602	struct b43_wl *wl = dev->wl;
1603
1604	if (wl->beacon1_uploaded)
1605		return;
1606	b43_write_beacon_template(dev, 0x468, 0x1A);
1607	wl->beacon1_uploaded = 1;
1608}
1609
1610static void handle_irq_beacon(struct b43_wldev *dev)
1611{
1612	struct b43_wl *wl = dev->wl;
1613	u32 cmd, beacon0_valid, beacon1_valid;
1614
1615	if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP) &&
1616	    !b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
1617		return;
1618
1619	/* This is the bottom half of the asynchronous beacon update. */
1620
1621	/* Ignore interrupt in the future. */
1622	dev->irq_savedstate &= ~B43_IRQ_BEACON;
1623
1624	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1625	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1626	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1627
1628	/* Schedule interrupt manually, if busy. */
1629	if (beacon0_valid && beacon1_valid) {
1630		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1631		dev->irq_savedstate |= B43_IRQ_BEACON;
1632		return;
1633	}
1634
1635	if (unlikely(wl->beacon_templates_virgin)) {
1636		/* We never uploaded a beacon before.
1637		 * Upload both templates now, but only mark one valid. */
1638		wl->beacon_templates_virgin = 0;
1639		b43_upload_beacon0(dev);
1640		b43_upload_beacon1(dev);
1641		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1642		cmd |= B43_MACCMD_BEACON0_VALID;
1643		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1644	} else {
1645		if (!beacon0_valid) {
1646			b43_upload_beacon0(dev);
1647			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1648			cmd |= B43_MACCMD_BEACON0_VALID;
1649			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1650		} else if (!beacon1_valid) {
1651			b43_upload_beacon1(dev);
1652			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1653			cmd |= B43_MACCMD_BEACON1_VALID;
1654			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1655		}
1656	}
1657}
1658
1659static void b43_beacon_update_trigger_work(struct work_struct *work)
1660{
1661	struct b43_wl *wl = container_of(work, struct b43_wl,
1662					 beacon_update_trigger);
1663	struct b43_wldev *dev;
1664
1665	mutex_lock(&wl->mutex);
1666	dev = wl->current_dev;
1667	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1668		spin_lock_irq(&wl->irq_lock);
1669		/* update beacon right away or defer to irq */
1670		dev->irq_savedstate = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1671		handle_irq_beacon(dev);
1672		/* The handler might have updated the IRQ mask. */
1673		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK,
1674			    dev->irq_savedstate);
1675		mmiowb();
1676		spin_unlock_irq(&wl->irq_lock);
1677	}
1678	mutex_unlock(&wl->mutex);
1679}
1680
1681/* Asynchronously update the packet templates in template RAM.
1682 * Locking: Requires wl->irq_lock to be locked. */
1683static void b43_update_templates(struct b43_wl *wl)
1684{
1685	struct sk_buff *beacon;
1686
1687	/* This is the top half of the ansynchronous beacon update.
1688	 * The bottom half is the beacon IRQ.
1689	 * Beacon update must be asynchronous to avoid sending an
1690	 * invalid beacon. This can happen for example, if the firmware
1691	 * transmits a beacon while we are updating it. */
1692
1693	/* We could modify the existing beacon and set the aid bit in
1694	 * the TIM field, but that would probably require resizing and
1695	 * moving of data within the beacon template.
1696	 * Simply request a new beacon and let mac80211 do the hard work. */
1697	beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1698	if (unlikely(!beacon))
1699		return;
1700
1701	if (wl->current_beacon)
1702		dev_kfree_skb_any(wl->current_beacon);
1703	wl->current_beacon = beacon;
1704	wl->beacon0_uploaded = 0;
1705	wl->beacon1_uploaded = 0;
1706	queue_work(wl->hw->workqueue, &wl->beacon_update_trigger);
1707}
1708
1709static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
1710{
1711	u32 tmp;
1712	u16 i, len;
1713
1714	len = min((u16) ssid_len, (u16) 0x100);
1715	for (i = 0; i < len; i += sizeof(u32)) {
1716		tmp = (u32) (ssid[i + 0]);
1717		if (i + 1 < len)
1718			tmp |= (u32) (ssid[i + 1]) << 8;
1719		if (i + 2 < len)
1720			tmp |= (u32) (ssid[i + 2]) << 16;
1721		if (i + 3 < len)
1722			tmp |= (u32) (ssid[i + 3]) << 24;
1723		b43_shm_write32(dev, B43_SHM_SHARED, 0x380 + i, tmp);
1724	}
1725	b43_shm_write16(dev, B43_SHM_SHARED, 0x48, len);
1726}
1727
1728static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1729{
1730	b43_time_lock(dev);
1731	if (dev->dev->id.revision >= 3) {
1732		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1733		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1734	} else {
1735		b43_write16(dev, 0x606, (beacon_int >> 6));
1736		b43_write16(dev, 0x610, beacon_int);
1737	}
1738	b43_time_unlock(dev);
1739	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1740}
1741
1742static void b43_handle_firmware_panic(struct b43_wldev *dev)
1743{
1744	u16 reason;
1745
1746	/* Read the register that contains the reason code for the panic. */
1747	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1748	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1749
1750	switch (reason) {
1751	default:
1752		b43dbg(dev->wl, "The panic reason is unknown.\n");
1753		/* fallthrough */
1754	case B43_FWPANIC_DIE:
1755		/* Do not restart the controller or firmware.
1756		 * The device is nonfunctional from now on.
1757		 * Restarting would result in this panic to trigger again,
1758		 * so we avoid that recursion. */
1759		break;
1760	case B43_FWPANIC_RESTART:
1761		b43_controller_restart(dev, "Microcode panic");
1762		break;
1763	}
1764}
1765
1766static void handle_irq_ucode_debug(struct b43_wldev *dev)
1767{
1768	unsigned int i, cnt;
1769	u16 reason, marker_id, marker_line;
1770	__le16 *buf;
1771
1772	/* The proprietary firmware doesn't have this IRQ. */
1773	if (!dev->fw.opensource)
1774		return;
1775
1776	/* Read the register that contains the reason code for this IRQ. */
1777	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1778
1779	switch (reason) {
1780	case B43_DEBUGIRQ_PANIC:
1781		b43_handle_firmware_panic(dev);
1782		break;
1783	case B43_DEBUGIRQ_DUMP_SHM:
1784		if (!B43_DEBUG)
1785			break; /* Only with driver debugging enabled. */
1786		buf = kmalloc(4096, GFP_ATOMIC);
1787		if (!buf) {
1788			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1789			goto out;
1790		}
1791		for (i = 0; i < 4096; i += 2) {
1792			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1793			buf[i / 2] = cpu_to_le16(tmp);
1794		}
1795		b43info(dev->wl, "Shared memory dump:\n");
1796		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1797			       16, 2, buf, 4096, 1);
1798		kfree(buf);
1799		break;
1800	case B43_DEBUGIRQ_DUMP_REGS:
1801		if (!B43_DEBUG)
1802			break; /* Only with driver debugging enabled. */
1803		b43info(dev->wl, "Microcode register dump:\n");
1804		for (i = 0, cnt = 0; i < 64; i++) {
1805			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1806			if (cnt == 0)
1807				printk(KERN_INFO);
1808			printk("r%02u: 0x%04X  ", i, tmp);
1809			cnt++;
1810			if (cnt == 6) {
1811				printk("\n");
1812				cnt = 0;
1813			}
1814		}
1815		printk("\n");
1816		break;
1817	case B43_DEBUGIRQ_MARKER:
1818		if (!B43_DEBUG)
1819			break; /* Only with driver debugging enabled. */
1820		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1821					   B43_MARKER_ID_REG);
1822		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1823					     B43_MARKER_LINE_REG);
1824		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1825			"at line number %u\n",
1826			marker_id, marker_line);
1827		break;
1828	default:
1829		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1830		       reason);
1831	}
1832out:
1833	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1834	b43_shm_write16(dev, B43_SHM_SCRATCH,
1835			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1836}
1837
1838/* Interrupt handler bottom-half */
1839static void b43_interrupt_tasklet(struct b43_wldev *dev)
1840{
1841	u32 reason;
1842	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1843	u32 merged_dma_reason = 0;
1844	int i;
1845	unsigned long flags;
1846
1847	spin_lock_irqsave(&dev->wl->irq_lock, flags);
1848
1849	B43_WARN_ON(b43_status(dev) != B43_STAT_STARTED);
1850
1851	reason = dev->irq_reason;
1852	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1853		dma_reason[i] = dev->dma_reason[i];
1854		merged_dma_reason |= dma_reason[i];
1855	}
1856
1857	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1858		b43err(dev->wl, "MAC transmission error\n");
1859
1860	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1861		b43err(dev->wl, "PHY transmission error\n");
1862		rmb();
1863		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1864			atomic_set(&dev->phy.txerr_cnt,
1865				   B43_PHY_TX_BADNESS_LIMIT);
1866			b43err(dev->wl, "Too many PHY TX errors, "
1867					"restarting the controller\n");
1868			b43_controller_restart(dev, "PHY TX errors");
1869		}
1870	}
1871
1872	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1873					  B43_DMAIRQ_NONFATALMASK))) {
1874		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1875			b43err(dev->wl, "Fatal DMA error: "
1876			       "0x%08X, 0x%08X, 0x%08X, "
1877			       "0x%08X, 0x%08X, 0x%08X\n",
1878			       dma_reason[0], dma_reason[1],
1879			       dma_reason[2], dma_reason[3],
1880			       dma_reason[4], dma_reason[5]);
1881			b43_controller_restart(dev, "DMA error");
1882			mmiowb();
1883			spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1884			return;
1885		}
1886		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1887			b43err(dev->wl, "DMA error: "
1888			       "0x%08X, 0x%08X, 0x%08X, "
1889			       "0x%08X, 0x%08X, 0x%08X\n",
1890			       dma_reason[0], dma_reason[1],
1891			       dma_reason[2], dma_reason[3],
1892			       dma_reason[4], dma_reason[5]);
1893		}
1894	}
1895
1896	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1897		handle_irq_ucode_debug(dev);
1898	if (reason & B43_IRQ_TBTT_INDI)
1899		handle_irq_tbtt_indication(dev);
1900	if (reason & B43_IRQ_ATIM_END)
1901		handle_irq_atim_end(dev);
1902	if (reason & B43_IRQ_BEACON)
1903		handle_irq_beacon(dev);
1904	if (reason & B43_IRQ_PMQ)
1905		handle_irq_pmq(dev);
1906	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1907		;/* TODO */
1908	if (reason & B43_IRQ_NOISESAMPLE_OK)
1909		handle_irq_noise(dev);
1910
1911	/* Check the DMA reason registers for received data. */
1912	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1913		if (b43_using_pio_transfers(dev))
1914			b43_pio_rx(dev->pio.rx_queue);
1915		else
1916			b43_dma_rx(dev->dma.rx_ring);
1917	}
1918	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1919	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1920	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1921	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1922	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1923
1924	if (reason & B43_IRQ_TX_OK)
1925		handle_irq_transmit_status(dev);
1926
1927	b43_interrupt_enable(dev, dev->irq_savedstate);
1928	mmiowb();
1929	spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1930}
1931
1932static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
1933{
1934	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1935
1936	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1937	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1938	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1939	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1940	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1941	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1942}
1943
1944/* Interrupt handler top-half */
1945static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1946{
1947	irqreturn_t ret = IRQ_NONE;
1948	struct b43_wldev *dev = dev_id;
1949	u32 reason;
1950
1951	if (!dev)
1952		return IRQ_NONE;
1953
1954	spin_lock(&dev->wl->irq_lock);
1955
1956	if (b43_status(dev) < B43_STAT_STARTED)
1957		goto out;
1958	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1959	if (reason == 0xffffffff)	/* shared IRQ */
1960		goto out;
1961	ret = IRQ_HANDLED;
1962	reason &= b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
1963	if (!reason)
1964		goto out;
1965
1966	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1967	    & 0x0001DC00;
1968	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1969	    & 0x0000DC00;
1970	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1971	    & 0x0000DC00;
1972	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1973	    & 0x0001DC00;
1974	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1975	    & 0x0000DC00;
1976	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1977	    & 0x0000DC00;
1978
1979	b43_interrupt_ack(dev, reason);
1980	/* disable all IRQs. They are enabled again in the bottom half. */
1981	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
1982	/* save the reason code and call our bottom half. */
1983	dev->irq_reason = reason;
1984	tasklet_schedule(&dev->isr_tasklet);
1985      out:
1986	mmiowb();
1987	spin_unlock(&dev->wl->irq_lock);
1988
1989	return ret;
1990}
1991
1992static void do_release_fw(struct b43_firmware_file *fw)
1993{
1994	release_firmware(fw->data);
1995	fw->data = NULL;
1996	fw->filename = NULL;
1997}
1998
1999static void b43_release_firmware(struct b43_wldev *dev)
2000{
2001	do_release_fw(&dev->fw.ucode);
2002	do_release_fw(&dev->fw.pcm);
2003	do_release_fw(&dev->fw.initvals);
2004	do_release_fw(&dev->fw.initvals_band);
2005}
2006
2007static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2008{
2009	const char *text;
2010
2011	text = "You must go to "
2012	       "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
2013	       "and download the latest firmware (version 4).\n";
2014	if (error)
2015		b43err(wl, text);
2016	else
2017		b43warn(wl, text);
2018}
2019
2020static int do_request_fw(struct b43_wldev *dev,
2021			 const char *name,
2022			 struct b43_firmware_file *fw,
2023			 bool silent)
2024{
2025	char path[sizeof(modparam_fwpostfix) + 32];
2026	const struct firmware *blob;
2027	struct b43_fw_header *hdr;
2028	u32 size;
2029	int err;
2030
2031	if (!name) {
2032		/* Don't fetch anything. Free possibly cached firmware. */
2033		do_release_fw(fw);
2034		return 0;
2035	}
2036	if (fw->filename) {
2037		if (strcmp(fw->filename, name) == 0)
2038			return 0; /* Already have this fw. */
2039		/* Free the cached firmware first. */
2040		do_release_fw(fw);
2041	}
2042
2043	snprintf(path, ARRAY_SIZE(path),
2044		 "b43%s/%s.fw",
2045		 modparam_fwpostfix, name);
2046	err = request_firmware(&blob, path, dev->dev->dev);
2047	if (err == -ENOENT) {
2048		if (!silent) {
2049			b43err(dev->wl, "Firmware file \"%s\" not found\n",
2050			       path);
2051		}
2052		return err;
2053	} else if (err) {
2054		b43err(dev->wl, "Firmware file \"%s\" request failed (err=%d)\n",
2055		       path, err);
2056		return err;
2057	}
2058	if (blob->size < sizeof(struct b43_fw_header))
2059		goto err_format;
2060	hdr = (struct b43_fw_header *)(blob->data);
2061	switch (hdr->type) {
2062	case B43_FW_TYPE_UCODE:
2063	case B43_FW_TYPE_PCM:
2064		size = be32_to_cpu(hdr->size);
2065		if (size != blob->size - sizeof(struct b43_fw_header))
2066			goto err_format;
2067		/* fallthrough */
2068	case B43_FW_TYPE_IV:
2069		if (hdr->ver != 1)
2070			goto err_format;
2071		break;
2072	default:
2073		goto err_format;
2074	}
2075
2076	fw->data = blob;
2077	fw->filename = name;
2078
2079	return 0;
2080
2081err_format:
2082	b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
2083	release_firmware(blob);
2084
2085	return -EPROTO;
2086}
2087
2088static int b43_request_firmware(struct b43_wldev *dev)
2089{
2090	struct b43_firmware *fw = &dev->fw;
2091	const u8 rev = dev->dev->id.revision;
2092	const char *filename;
2093	u32 tmshigh;
2094	int err;
2095
2096	/* Get microcode */
2097	tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
2098	if ((rev >= 5) && (rev <= 10))
2099		filename = "ucode5";
2100	else if ((rev >= 11) && (rev <= 12))
2101		filename = "ucode11";
2102	else if (rev >= 13)
2103		filename = "ucode13";
2104	else
2105		goto err_no_ucode;
2106	err = do_request_fw(dev, filename, &fw->ucode, 0);
2107	if (err)
2108		goto err_load;
2109
2110	/* Get PCM code */
2111	if ((rev >= 5) && (rev <= 10))
2112		filename = "pcm5";
2113	else if (rev >= 11)
2114		filename = NULL;
2115	else
2116		goto err_no_pcm;
2117	fw->pcm_request_failed = 0;
2118	err = do_request_fw(dev, filename, &fw->pcm, 1);
2119	if (err == -ENOENT) {
2120		/* We did not find a PCM file? Not fatal, but
2121		 * core rev <= 10 must do without hwcrypto then. */
2122		fw->pcm_request_failed = 1;
2123	} else if (err)
2124		goto err_load;
2125
2126	/* Get initvals */
2127	switch (dev->phy.type) {
2128	case B43_PHYTYPE_A:
2129		if ((rev >= 5) && (rev <= 10)) {
2130			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2131				filename = "a0g1initvals5";
2132			else
2133				filename = "a0g0initvals5";
2134		} else
2135			goto err_no_initvals;
2136		break;
2137	case B43_PHYTYPE_G:
2138		if ((rev >= 5) && (rev <= 10))
2139			filename = "b0g0initvals5";
2140		else if (rev >= 13)
2141			filename = "b0g0initvals13";
2142		else
2143			goto err_no_initvals;
2144		break;
2145	case B43_PHYTYPE_N:
2146		if ((rev >= 11) && (rev <= 12))
2147			filename = "n0initvals11";
2148		else
2149			goto err_no_initvals;
2150		break;
2151	default:
2152		goto err_no_initvals;
2153	}
2154	err = do_request_fw(dev, filename, &fw->initvals, 0);
2155	if (err)
2156		goto err_load;
2157
2158	/* Get bandswitch initvals */
2159	switch (dev->phy.type) {
2160	case B43_PHYTYPE_A:
2161		if ((rev >= 5) && (rev <= 10)) {
2162			if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2163				filename = "a0g1bsinitvals5";
2164			else
2165				filename = "a0g0bsinitvals5";
2166		} else if (rev >= 11)
2167			filename = NULL;
2168		else
2169			goto err_no_initvals;
2170		break;
2171	case B43_PHYTYPE_G:
2172		if ((rev >= 5) && (rev <= 10))
2173			filename = "b0g0bsinitvals5";
2174		else if (rev >= 11)
2175			filename = NULL;
2176		else
2177			goto err_no_initvals;
2178		break;
2179	case B43_PHYTYPE_N:
2180		if ((rev >= 11) && (rev <= 12))
2181			filename = "n0bsinitvals11";
2182		else
2183			goto err_no_initvals;
2184		break;
2185	default:
2186		goto err_no_initvals;
2187	}
2188	err = do_request_fw(dev, filename, &fw->initvals_band, 0);
2189	if (err)
2190		goto err_load;
2191
2192	return 0;
2193
2194err_load:
2195	b43_print_fw_helptext(dev->wl, 1);
2196	goto error;
2197
2198err_no_ucode:
2199	err = -ENODEV;
2200	b43err(dev->wl, "No microcode available for core rev %u\n", rev);
2201	goto error;
2202
2203err_no_pcm:
2204	err = -ENODEV;
2205	b43err(dev->wl, "No PCM available for core rev %u\n", rev);
2206	goto error;
2207
2208err_no_initvals:
2209	err = -ENODEV;
2210	b43err(dev->wl, "No Initial Values firmware file for PHY %u, "
2211	       "core rev %u\n", dev->phy.type, rev);
2212	goto error;
2213
2214error:
2215	b43_release_firmware(dev);
2216	return err;
2217}
2218
2219static int b43_upload_microcode(struct b43_wldev *dev)
2220{
2221	const size_t hdr_len = sizeof(struct b43_fw_header);
2222	const __be32 *data;
2223	unsigned int i, len;
2224	u16 fwrev, fwpatch, fwdate, fwtime;
2225	u32 tmp, macctl;
2226	int err = 0;
2227
2228	/* Jump the microcode PSM to offset 0 */
2229	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2230	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2231	macctl |= B43_MACCTL_PSM_JMP0;
2232	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2233	/* Zero out all microcode PSM registers and shared memory. */
2234	for (i = 0; i < 64; i++)
2235		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2236	for (i = 0; i < 4096; i += 2)
2237		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2238
2239	/* Upload Microcode. */
2240	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2241	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2242	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2243	for (i = 0; i < len; i++) {
2244		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2245		udelay(10);
2246	}
2247
2248	if (dev->fw.pcm.data) {
2249		/* Upload PCM data. */
2250		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2251		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2252		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2253		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2254		/* No need for autoinc bit in SHM_HW */
2255		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2256		for (i = 0; i < len; i++) {
2257			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2258			udelay(10);
2259		}
2260	}
2261
2262	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2263
2264	/* Start the microcode PSM */
2265	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2266	macctl &= ~B43_MACCTL_PSM_JMP0;
2267	macctl |= B43_MACCTL_PSM_RUN;
2268	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2269
2270	/* Wait for the microcode to load and respond */
2271	i = 0;
2272	while (1) {
2273		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2274		if (tmp == B43_IRQ_MAC_SUSPENDED)
2275			break;
2276		i++;
2277		if (i >= 20) {
2278			b43err(dev->wl, "Microcode not responding\n");
2279			b43_print_fw_helptext(dev->wl, 1);
2280			err = -ENODEV;
2281			goto error;
2282		}
2283		msleep_interruptible(50);
2284		if (signal_pending(current)) {
2285			err = -EINTR;
2286			goto error;
2287		}
2288	}
2289	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2290
2291	/* Get and check the revisions. */
2292	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2293	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2294	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2295	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2296
2297	if (fwrev <= 0x128) {
2298		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2299		       "binary drivers older than version 4.x is unsupported. "
2300		       "You must upgrade your firmware files.\n");
2301		b43_print_fw_helptext(dev->wl, 1);
2302		err = -EOPNOTSUPP;
2303		goto error;
2304	}
2305	dev->fw.rev = fwrev;
2306	dev->fw.patch = fwpatch;
2307	dev->fw.opensource = (fwdate == 0xFFFF);
2308
2309	if (dev->fw.opensource) {
2310		/* Patchlevel info is encoded in the "time" field. */
2311		dev->fw.patch = fwtime;
2312		b43info(dev->wl, "Loading OpenSource firmware version %u.%u%s\n",
2313			dev->fw.rev, dev->fw.patch,
2314			dev->fw.pcm_request_failed ? " (Hardware crypto not supported)" : "");
2315	} else {
2316		b43info(dev->wl, "Loading firmware version %u.%u "
2317			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2318			fwrev, fwpatch,
2319			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2320			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2321		if (dev->fw.pcm_request_failed) {
2322			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2323				"Hardware accelerated cryptography is disabled.\n");
2324			b43_print_fw_helptext(dev->wl, 0);
2325		}
2326	}
2327
2328	if (b43_is_old_txhdr_format(dev)) {
2329		b43warn(dev->wl, "You are using an old firmware image. "
2330			"Support for old firmware will be removed in July 2008.\n");
2331		b43_print_fw_helptext(dev->wl, 0);
2332	}
2333
2334	return 0;
2335
2336error:
2337	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2338	macctl &= ~B43_MACCTL_PSM_RUN;
2339	macctl |= B43_MACCTL_PSM_JMP0;
2340	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2341
2342	return err;
2343}
2344
2345static int b43_write_initvals(struct b43_wldev *dev,
2346			      const struct b43_iv *ivals,
2347			      size_t count,
2348			      size_t array_size)
2349{
2350	const struct b43_iv *iv;
2351	u16 offset;
2352	size_t i;
2353	bool bit32;
2354
2355	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2356	iv = ivals;
2357	for (i = 0; i < count; i++) {
2358		if (array_size < sizeof(iv->offset_size))
2359			goto err_format;
2360		array_size -= sizeof(iv->offset_size);
2361		offset = be16_to_cpu(iv->offset_size);
2362		bit32 = !!(offset & B43_IV_32BIT);
2363		offset &= B43_IV_OFFSET_MASK;
2364		if (offset >= 0x1000)
2365			goto err_format;
2366		if (bit32) {
2367			u32 value;
2368
2369			if (array_size < sizeof(iv->data.d32))
2370				goto err_format;
2371			array_size -= sizeof(iv->data.d32);
2372
2373			value = get_unaligned_be32(&iv->data.d32);
2374			b43_write32(dev, offset, value);
2375
2376			iv = (const struct b43_iv *)((const uint8_t *)iv +
2377							sizeof(__be16) +
2378							sizeof(__be32));
2379		} else {
2380			u16 value;
2381
2382			if (array_size < sizeof(iv->data.d16))
2383				goto err_format;
2384			array_size -= sizeof(iv->data.d16);
2385
2386			value = be16_to_cpu(iv->data.d16);
2387			b43_write16(dev, offset, value);
2388
2389			iv = (const struct b43_iv *)((const uint8_t *)iv +
2390							sizeof(__be16) +
2391							sizeof(__be16));
2392		}
2393	}
2394	if (array_size)
2395		goto err_format;
2396
2397	return 0;
2398
2399err_format:
2400	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2401	b43_print_fw_helptext(dev->wl, 1);
2402
2403	return -EPROTO;
2404}
2405
2406static int b43_upload_initvals(struct b43_wldev *dev)
2407{
2408	const size_t hdr_len = sizeof(struct b43_fw_header);
2409	const struct b43_fw_header *hdr;
2410	struct b43_firmware *fw = &dev->fw;
2411	const struct b43_iv *ivals;
2412	size_t count;
2413	int err;
2414
2415	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2416	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2417	count = be32_to_cpu(hdr->size);
2418	err = b43_write_initvals(dev, ivals, count,
2419				 fw->initvals.data->size - hdr_len);
2420	if (err)
2421		goto out;
2422	if (fw->initvals_band.data) {
2423		hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2424		ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2425		count = be32_to_cpu(hdr->size);
2426		err = b43_write_initvals(dev, ivals, count,
2427					 fw->initvals_band.data->size - hdr_len);
2428		if (err)
2429			goto out;
2430	}
2431out:
2432
2433	return err;
2434}
2435
2436/* Initialize the GPIOs
2437 * http://bcm-specs.sipsolutions.net/GPIO
2438 */
2439static int b43_gpio_init(struct b43_wldev *dev)
2440{
2441	struct ssb_bus *bus = dev->dev->bus;
2442	struct ssb_device *gpiodev, *pcidev = NULL;
2443	u32 mask, set;
2444
2445	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2446		    & ~B43_MACCTL_GPOUTSMSK);
2447
2448	b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2449		    | 0x000F);
2450
2451	mask = 0x0000001F;
2452	set = 0x0000000F;
2453	if (dev->dev->bus->chip_id == 0x4301) {
2454		mask |= 0x0060;
2455		set |= 0x0060;
2456	}
2457	if (0 /* FIXME: conditional unknown */ ) {
2458		b43_write16(dev, B43_MMIO_GPIO_MASK,
2459			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2460			    | 0x0100);
2461		mask |= 0x0180;
2462		set |= 0x0180;
2463	}
2464	if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2465		b43_write16(dev, B43_MMIO_GPIO_MASK,
2466			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2467			    | 0x0200);
2468		mask |= 0x0200;
2469		set |= 0x0200;
2470	}
2471	if (dev->dev->id.revision >= 2)
2472		mask |= 0x0010;	/* FIXME: This is redundant. */
2473
2474#ifdef CONFIG_SSB_DRIVER_PCICORE
2475	pcidev = bus->pcicore.dev;
2476#endif
2477	gpiodev = bus->chipco.dev ? : pcidev;
2478	if (!gpiodev)
2479		return 0;
2480	ssb_write32(gpiodev, B43_GPIO_CONTROL,
2481		    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2482		     & mask) | set);
2483
2484	return 0;
2485}
2486
2487/* Turn off all GPIO stuff. Call this on module unload, for example. */
2488static void b43_gpio_cleanup(struct b43_wldev *dev)
2489{
2490	struct ssb_bus *bus = dev->dev->bus;
2491	struct ssb_device *gpiodev, *pcidev = NULL;
2492
2493#ifdef CONFIG_SSB_DRIVER_PCICORE
2494	pcidev = bus->pcicore.dev;
2495#endif
2496	gpiodev = bus->chipco.dev ? : pcidev;
2497	if (!gpiodev)
2498		return;
2499	ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2500}
2501
2502/* http://bcm-specs.sipsolutions.net/EnableMac */
2503void b43_mac_enable(struct b43_wldev *dev)
2504{
2505	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2506		u16 fwstate;
2507
2508		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2509					 B43_SHM_SH_UCODESTAT);
2510		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2511		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2512			b43err(dev->wl, "b43_mac_enable(): The firmware "
2513			       "should be suspended, but current state is %u\n",
2514			       fwstate);
2515		}
2516	}
2517
2518	dev->mac_suspended--;
2519	B43_WARN_ON(dev->mac_suspended < 0);
2520	if (dev->mac_suspended == 0) {
2521		b43_write32(dev, B43_MMIO_MACCTL,
2522			    b43_read32(dev, B43_MMIO_MACCTL)
2523			    | B43_MACCTL_ENABLED);
2524		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2525			    B43_IRQ_MAC_SUSPENDED);
2526		/* Commit writes */
2527		b43_read32(dev, B43_MMIO_MACCTL);
2528		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2529		b43_power_saving_ctl_bits(dev, 0);
2530	}
2531}
2532
2533/* http://bcm-specs.sipsolutions.net/SuspendMAC */
2534void b43_mac_suspend(struct b43_wldev *dev)
2535{
2536	int i;
2537	u32 tmp;
2538
2539	might_sleep();
2540	B43_WARN_ON(dev->mac_suspended < 0);
2541
2542	if (dev->mac_suspended == 0) {
2543		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2544		b43_write32(dev, B43_MMIO_MACCTL,
2545			    b43_read32(dev, B43_MMIO_MACCTL)
2546			    & ~B43_MACCTL_ENABLED);
2547		/* force pci to flush the write */
2548		b43_read32(dev, B43_MMIO_MACCTL);
2549		for (i = 35; i; i--) {
2550			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2551			if (tmp & B43_IRQ_MAC_SUSPENDED)
2552				goto out;
2553			udelay(10);
2554		}
2555		/* Hm, it seems this will take some time. Use msleep(). */
2556		for (i = 40; i; i--) {
2557			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2558			if (tmp & B43_IRQ_MAC_SUSPENDED)
2559				goto out;
2560			msleep(1);
2561		}
2562		b43err(dev->wl, "MAC suspend failed\n");
2563	}
2564out:
2565	dev->mac_suspended++;
2566}
2567
2568static void b43_adjust_opmode(struct b43_wldev *dev)
2569{
2570	struct b43_wl *wl = dev->wl;
2571	u32 ctl;
2572	u16 cfp_pretbtt;
2573
2574	ctl = b43_read32(dev, B43_MMIO_MACCTL);
2575	/* Reset status to STA infrastructure mode. */
2576	ctl &= ~B43_MACCTL_AP;
2577	ctl &= ~B43_MACCTL_KEEP_CTL;
2578	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2579	ctl &= ~B43_MACCTL_KEEP_BAD;
2580	ctl &= ~B43_MACCTL_PROMISC;
2581	ctl &= ~B43_MACCTL_BEACPROMISC;
2582	ctl |= B43_MACCTL_INFRA;
2583
2584	if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
2585	    b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
2586		ctl |= B43_MACCTL_AP;
2587	else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS))
2588		ctl &= ~B43_MACCTL_INFRA;
2589
2590	if (wl->filter_flags & FIF_CONTROL)
2591		ctl |= B43_MACCTL_KEEP_CTL;
2592	if (wl->filter_flags & FIF_FCSFAIL)
2593		ctl |= B43_MACCTL_KEEP_BAD;
2594	if (wl->filter_flags & FIF_PLCPFAIL)
2595		ctl |= B43_MACCTL_KEEP_BADPLCP;
2596	if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2597		ctl |= B43_MACCTL_PROMISC;
2598	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2599		ctl |= B43_MACCTL_BEACPROMISC;
2600
2601	/* Workaround: On old hardware the HW-MAC-address-filter
2602	 * doesn't work properly, so always run promisc in filter
2603	 * it in software. */
2604	if (dev->dev->id.revision <= 4)
2605		ctl |= B43_MACCTL_PROMISC;
2606
2607	b43_write32(dev, B43_MMIO_MACCTL, ctl);
2608
2609	cfp_pretbtt = 2;
2610	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2611		if (dev->dev->bus->chip_id == 0x4306 &&
2612		    dev->dev->bus->chip_rev == 3)
2613			cfp_pretbtt = 100;
2614		else
2615			cfp_pretbtt = 50;
2616	}
2617	b43_write16(dev, 0x612, cfp_pretbtt);
2618}
2619
2620static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2621{
2622	u16 offset;
2623
2624	if (is_ofdm) {
2625		offset = 0x480;
2626		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2627	} else {
2628		offset = 0x4C0;
2629		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2630	}
2631	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2632			b43_shm_read16(dev, B43_SHM_SHARED, offset));
2633}
2634
2635static void b43_rate_memory_init(struct b43_wldev *dev)
2636{
2637	switch (dev->phy.type) {
2638	case B43_PHYTYPE_A:
2639	case B43_PHYTYPE_G:
2640	case B43_PHYTYPE_N:
2641		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2642		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2643		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2644		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2645		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2646		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2647		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2648		if (dev->phy.type == B43_PHYTYPE_A)
2649			break;
2650		/* fallthrough */
2651	case B43_PHYTYPE_B:
2652		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2653		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2654		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2655		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2656		break;
2657	default:
2658		B43_WARN_ON(1);
2659	}
2660}
2661
2662/* Set the default values for the PHY TX Control Words. */
2663static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2664{
2665	u16 ctl = 0;
2666
2667	ctl |= B43_TXH_PHY_ENC_CCK;
2668	ctl |= B43_TXH_PHY_ANT01AUTO;
2669	ctl |= B43_TXH_PHY_TXPWR;
2670
2671	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2672	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2673	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2674}
2675
2676/* Set the TX-Antenna for management frames sent by firmware. */
2677static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2678{
2679	u16 ant;
2680	u16 tmp;
2681
2682	ant = b43_antenna_to_phyctl(antenna);
2683
2684	/* For ACK/CTS */
2685	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2686	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2687	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2688	/* For Probe Resposes */
2689	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2690	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2691	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2692}
2693
2694/* This is the opposite of b43_chip_init() */
2695static void b43_chip_exit(struct b43_wldev *dev)
2696{
2697	b43_gpio_cleanup(dev);
2698	/* firmware is released later */
2699}
2700
2701/* Initialize the chip
2702 * http://bcm-specs.sipsolutions.net/ChipInit
2703 */
2704static int b43_chip_init(struct b43_wldev *dev)
2705{
2706	struct b43_phy *phy = &dev->phy;
2707	int err;
2708	u32 value32, macctl;
2709	u16 value16;
2710
2711	/* Initialize the MAC control */
2712	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2713	if (dev->phy.gmode)
2714		macctl |= B43_MACCTL_GMODE;
2715	macctl |= B43_MACCTL_INFRA;
2716	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2717
2718	err = b43_request_firmware(dev);
2719	if (err)
2720		goto out;
2721	err = b43_upload_microcode(dev);
2722	if (err)
2723		goto out;	/* firmware is released later */
2724
2725	err = b43_gpio_init(dev);
2726	if (err)
2727		goto out;	/* firmware is released later */
2728
2729	err = b43_upload_initvals(dev);
2730	if (err)
2731		goto err_gpio_clean;
2732
2733	b43_write16(dev, 0x03E6, 0x0000);
2734	err = b43_phy_init(dev);
2735	if (err)
2736		goto err_gpio_clean;
2737
2738	/* Disable Interference Mitigation. */
2739	if (phy->ops->interf_mitigation)
2740		phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2741
2742	/* Select the antennae */
2743	if (phy->ops->set_rx_antenna)
2744		phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2745	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2746
2747	if (phy->type == B43_PHYTYPE_B) {
2748		value16 = b43_read16(dev, 0x005E);
2749		value16 |= 0x0004;
2750		b43_write16(dev, 0x005E, value16);
2751	}
2752	b43_write32(dev, 0x0100, 0x01000000);
2753	if (dev->dev->id.revision < 5)
2754		b43_write32(dev, 0x010C, 0x01000000);
2755
2756	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2757		    & ~B43_MACCTL_INFRA);
2758	b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2759		    | B43_MACCTL_INFRA);
2760
2761	/* Probe Response Timeout value */
2762	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2763	b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2764
2765	/* Initially set the wireless operation mode. */
2766	b43_adjust_opmode(dev);
2767
2768	if (dev->dev->id.revision < 3) {
2769		b43_write16(dev, 0x060E, 0x0000);
2770		b43_write16(dev, 0x0610, 0x8000);
2771		b43_write16(dev, 0x0604, 0x0000);
2772		b43_write16(dev, 0x0606, 0x0200);
2773	} else {
2774		b43_write32(dev, 0x0188, 0x80000000);
2775		b43_write32(dev, 0x018C, 0x02000000);
2776	}
2777	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2778	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2779	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2780	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2781	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2782	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2783	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2784
2785	value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2786	value32 |= 0x00100000;
2787	ssb_write32(dev->dev, SSB_TMSLOW, value32);
2788
2789	b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2790		    dev->dev->bus->chipco.fast_pwrup_delay);
2791
2792	err = 0;
2793	b43dbg(dev->wl, "Chip initialized\n");
2794out:
2795	return err;
2796
2797err_gpio_clean:
2798	b43_gpio_cleanup(dev);
2799	return err;
2800}
2801
2802static void b43_periodic_every60sec(struct b43_wldev *dev)
2803{
2804	const struct b43_phy_operations *ops = dev->phy.ops;
2805
2806	if (ops->pwork_60sec)
2807		ops->pwork_60sec(dev);
2808
2809	/* Force check the TX power emission now. */
2810	b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2811}
2812
2813static void b43_periodic_every30sec(struct b43_wldev *dev)
2814{
2815	/* Update device statistics. */
2816	b43_calculate_link_quality(dev);
2817}
2818
2819static void b43_periodic_every15sec(struct b43_wldev *dev)
2820{
2821	struct b43_phy *phy = &dev->phy;
2822	u16 wdr;
2823
2824	if (dev->fw.opensource) {
2825		/* Check if the firmware is still alive.
2826		 * It will reset the watchdog counter to 0 in its idle loop. */
2827		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2828		if (unlikely(wdr)) {
2829			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2830			b43_controller_restart(dev, "Firmware watchdog");
2831			return;
2832		} else {
2833			b43_shm_write16(dev, B43_SHM_SCRATCH,
2834					B43_WATCHDOG_REG, 1);
2835		}
2836	}
2837
2838	if (phy->ops->pwork_15sec)
2839		phy->ops->pwork_15sec(dev);
2840
2841	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2842	wmb();
2843}
2844
2845static void do_periodic_work(struct b43_wldev *dev)
2846{
2847	unsigned int state;
2848
2849	state = dev->periodic_state;
2850	if (state % 4 == 0)
2851		b43_periodic_every60sec(dev);
2852	if (state % 2 == 0)
2853		b43_periodic_every30sec(dev);
2854	b43_periodic_every15sec(dev);
2855}
2856
2857/* Periodic work locking policy:
2858 * 	The whole periodic work handler is protected by
2859 * 	wl->mutex. If another lock is needed somewhere in the
2860 * 	pwork callchain, it's aquired in-place, where it's needed.
2861 */
2862static void b43_periodic_work_handler(struct work_struct *work)
2863{
2864	struct b43_wldev *dev = container_of(work, struct b43_wldev,
2865					     periodic_work.work);
2866	struct b43_wl *wl = dev->wl;
2867	unsigned long delay;
2868
2869	mutex_lock(&wl->mutex);
2870
2871	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
2872		goto out;
2873	if (b43_debug(dev, B43_DBG_PWORK_STOP))
2874		goto out_requeue;
2875
2876	do_periodic_work(dev);
2877
2878	dev->periodic_state++;
2879out_requeue:
2880	if (b43_debug(dev, B43_DBG_PWORK_FAST))
2881		delay = msecs_to_jiffies(50);
2882	else
2883		delay = round_jiffies_relative(HZ * 15);
2884	queue_delayed_work(wl->hw->workqueue, &dev->periodic_work, delay);
2885out:
2886	mutex_unlock(&wl->mutex);
2887}
2888
2889static void b43_periodic_tasks_setup(struct b43_wldev *dev)
2890{
2891	struct delayed_work *work = &dev->periodic_work;
2892
2893	dev->periodic_state = 0;
2894	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
2895	queue_delayed_work(dev->wl->hw->workqueue, work, 0);
2896}
2897
2898/* Check if communication with the device works correctly. */
2899static int b43_validate_chipaccess(struct b43_wldev *dev)
2900{
2901	u32 v, backup;
2902
2903	backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
2904
2905	/* Check for read/write and endianness problems. */
2906	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
2907	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
2908		goto error;
2909	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
2910	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
2911		goto error;
2912
2913	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
2914
2915	if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
2916		/* The 32bit register shadows the two 16bit registers
2917		 * with update sideeffects. Validate this. */
2918		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
2919		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
2920		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
2921			goto error;
2922		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
2923			goto error;
2924	}
2925	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
2926
2927	v = b43_read32(dev, B43_MMIO_MACCTL);
2928	v |= B43_MACCTL_GMODE;
2929	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
2930		goto error;
2931
2932	return 0;
2933error:
2934	b43err(dev->wl, "Failed to validate the chipaccess\n");
2935	return -ENODEV;
2936}
2937
2938static void b43_security_init(struct b43_wldev *dev)
2939{
2940	dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2941	B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2942	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
2943	/* KTP is a word address, but we address SHM bytewise.
2944	 * So multiply by two.
2945	 */
2946	dev->ktp *= 2;
2947	if (dev->dev->id.revision >= 5) {
2948		/* Number of RCMTA address slots */
2949		b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
2950	}
2951	b43_clear_keys(dev);
2952}
2953
2954static int b43_rng_read(struct hwrng *rng, u32 * data)
2955{
2956	struct b43_wl *wl = (struct b43_wl *)rng->priv;
2957	unsigned long flags;
2958
2959	/* Don't take wl->mutex here, as it could deadlock with
2960	 * hwrng internal locking. It's not needed to take
2961	 * wl->mutex here, anyway. */
2962
2963	spin_lock_irqsave(&wl->irq_lock, flags);
2964	*data = b43_read16(wl->current_dev, B43_MMIO_RNG);
2965	spin_unlock_irqrestore(&wl->irq_lock, flags);
2966
2967	return (sizeof(u16));
2968}
2969
2970static void b43_rng_exit(struct b43_wl *wl)
2971{
2972	if (wl->rng_initialized)
2973		hwrng_unregister(&wl->rng);
2974}
2975
2976static int b43_rng_init(struct b43_wl *wl)
2977{
2978	int err;
2979
2980	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2981		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2982	wl->rng.name = wl->rng_name;
2983	wl->rng.data_read = b43_rng_read;
2984	wl->rng.priv = (unsigned long)wl;
2985	wl->rng_initialized = 1;
2986	err = hwrng_register(&wl->rng);
2987	if (err) {
2988		wl->rng_initialized = 0;
2989		b43err(wl, "Failed to register the random "
2990		       "number generator (%d)\n", err);
2991	}
2992
2993	return err;
2994}
2995
2996static int b43_op_tx(struct ieee80211_hw *hw,
2997		     struct sk_buff *skb)
2998{
2999	struct b43_wl *wl = hw_to_b43_wl(hw);
3000	struct b43_wldev *dev = wl->current_dev;
3001	unsigned long flags;
3002	int err;
3003
3004	if (unlikely(skb->len < 2 + 2 + 6)) {
3005		/* Too short, this can't be a valid frame. */
3006		goto drop_packet;
3007	}
3008	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3009	if (unlikely(!dev))
3010		goto drop_packet;
3011
3012	/* Transmissions on seperate queues can run concurrently. */
3013	read_lock_irqsave(&wl->tx_lock, flags);
3014
3015	err = -ENODEV;
3016	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3017		if (b43_using_pio_transfers(dev))
3018			err = b43_pio_tx(dev, skb);
3019		else
3020			err = b43_dma_tx(dev, skb);
3021	}
3022
3023	read_unlock_irqrestore(&wl->tx_lock, flags);
3024
3025	if (unlikely(err))
3026		goto drop_packet;
3027	return NETDEV_TX_OK;
3028
3029drop_packet:
3030	/* We can not transmit this packet. Drop it. */
3031	dev_kfree_skb_any(skb);
3032	return NETDEV_TX_OK;
3033}
3034
3035/* Locking: wl->irq_lock */
3036static void b43_qos_params_upload(struct b43_wldev *dev,
3037				  const struct ieee80211_tx_queue_params *p,
3038				  u16 shm_offset)
3039{
3040	u16 params[B43_NR_QOSPARAMS];
3041	int bslots, tmp;
3042	unsigned int i;
3043
3044	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3045
3046	memset(&params, 0, sizeof(params));
3047
3048	params[B43_QOSPARAM_TXOP] = p->txop * 32;
3049	params[B43_QOSPARAM_CWMIN] = p->cw_min;
3050	params[B43_QOSPARAM_CWMAX] = p->cw_max;
3051	params[B43_QOSPARAM_CWCUR] = p->cw_min;
3052	params[B43_QOSPARAM_AIFS] = p->aifs;
3053	params[B43_QOSPARAM_BSLOTS] = bslots;
3054	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3055
3056	for (i = 0; i < ARRAY_SIZE(params); i++) {
3057		if (i == B43_QOSPARAM_STATUS) {
3058			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3059					     shm_offset + (i * 2));
3060			/* Mark the parameters as updated. */
3061			tmp |= 0x100;
3062			b43_shm_write16(dev, B43_SHM_SHARED,
3063					shm_offset + (i * 2),
3064					tmp);
3065		} else {
3066			b43_shm_write16(dev, B43_SHM_SHARED,
3067					shm_offset + (i * 2),
3068					params[i]);
3069		}
3070	}
3071}
3072
3073/* Update the QOS parameters in hardware. */
3074static void b43_qos_update(struct b43_wldev *dev)
3075{
3076	struct b43_wl *wl = dev->wl;
3077	struct b43_qos_params *params;
3078	unsigned long flags;
3079	unsigned int i;
3080
3081	/* Mapping of mac80211 queues to b43 SHM offsets. */
3082	static const u16 qos_shm_offsets[] = {
3083		[0] = B43_QOS_VOICE,
3084		[1] = B43_QOS_VIDEO,
3085		[2] = B43_QOS_BESTEFFORT,
3086		[3] = B43_QOS_BACKGROUND,
3087	};
3088	BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
3089
3090	b43_mac_suspend(dev);
3091	spin_lock_irqsave(&wl->irq_lock, flags);
3092
3093	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3094		params = &(wl->qos_params[i]);
3095		if (params->need_hw_update) {
3096			b43_qos_params_upload(dev, &(params->p),
3097					      qos_shm_offsets[i]);
3098			params->need_hw_update = 0;
3099		}
3100	}
3101
3102	spin_unlock_irqrestore(&wl->irq_lock, flags);
3103	b43_mac_enable(dev);
3104}
3105
3106static void b43_qos_clear(struct b43_wl *wl)
3107{
3108	struct b43_qos_params *params;
3109	unsigned int i;
3110
3111	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3112		params = &(wl->qos_params[i]);
3113
3114		memset(&(params->p), 0, sizeof(params->p));
3115		params->p.aifs = -1;
3116		params->need_hw_update = 1;
3117	}
3118}
3119
3120/* Initialize the core's QOS capabilities */
3121static void b43_qos_init(struct b43_wldev *dev)
3122{
3123	struct b43_wl *wl = dev->wl;
3124	unsigned int i;
3125
3126	/* Upload the current QOS parameters. */
3127	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
3128		wl->qos_params[i].need_hw_update = 1;
3129	b43_qos_update(dev);
3130
3131	/* Enable QOS support. */
3132	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3133	b43_write16(dev, B43_MMIO_IFSCTL,
3134		    b43_read16(dev, B43_MMIO_IFSCTL)
3135		    | B43_MMIO_IFSCTL_USE_EDCF);
3136}
3137
3138static void b43_qos_update_work(struct work_struct *work)
3139{
3140	struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
3141	struct b43_wldev *dev;
3142
3143	mutex_lock(&wl->mutex);
3144	dev = wl->current_dev;
3145	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
3146		b43_qos_update(dev);
3147	mutex_unlock(&wl->mutex);
3148}
3149
3150static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3151			  const struct ieee80211_tx_queue_params *params)
3152{
3153	struct b43_wl *wl = hw_to_b43_wl(hw);
3154	unsigned long flags;
3155	unsigned int queue = (unsigned int)_queue;
3156	struct b43_qos_params *p;
3157
3158	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3159		/* Queue not available or don't support setting
3160		 * params on this queue. Return success to not
3161		 * confuse mac80211. */
3162		return 0;
3163	}
3164
3165	spin_lock_irqsave(&wl->irq_lock, flags);
3166	p = &(wl->qos_params[queue]);
3167	memcpy(&(p->p), params, sizeof(p->p));
3168	p->need_hw_update = 1;
3169	spin_unlock_irqrestore(&wl->irq_lock, flags);
3170
3171	queue_work(hw->workqueue, &wl->qos_update_work);
3172
3173	return 0;
3174}
3175
3176static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
3177			       struct ieee80211_tx_queue_stats *stats)
3178{
3179	struct b43_wl *wl = hw_to_b43_wl(hw);
3180	struct b43_wldev *dev = wl->current_dev;
3181	unsigned long flags;
3182	int err = -ENODEV;
3183
3184	if (!dev)
3185		goto out;
3186	spin_lock_irqsave(&wl->irq_lock, flags);
3187	if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
3188		if (b43_using_pio_transfers(dev))
3189			b43_pio_get_tx_stats(dev, stats);
3190		else
3191			b43_dma_get_tx_stats(dev, stats);
3192		err = 0;
3193	}
3194	spin_unlock_irqrestore(&wl->irq_lock, flags);
3195out:
3196	return err;
3197}
3198
3199static int b43_op_get_stats(struct ieee80211_hw *hw,
3200			    struct ieee80211_low_level_stats *stats)
3201{
3202	struct b43_wl *wl = hw_to_b43_wl(hw);
3203	unsigned long flags;
3204
3205	spin_lock_irqsave(&wl->irq_lock, flags);
3206	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3207	spin_unlock_irqrestore(&wl->irq_lock, flags);
3208
3209	return 0;
3210}
3211
3212static void b43_put_phy_into_reset(struct b43_wldev *dev)
3213{
3214	struct ssb_device *sdev = dev->dev;
3215	u32 tmslow;
3216
3217	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3218	tmslow &= ~B43_TMSLOW_GMODE;
3219	tmslow |= B43_TMSLOW_PHYRESET;
3220	tmslow |= SSB_TMSLOW_FGC;
3221	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3222	msleep(1);
3223
3224	tmslow = ssb_read32(sdev, SSB_TMSLOW);
3225	tmslow &= ~SSB_TMSLOW_FGC;
3226	tmslow |= B43_TMSLOW_PHYRESET;
3227	ssb_write32(sdev, SSB_TMSLOW, tmslow);
3228	msleep(1);
3229}
3230
3231static const char * band_to_string(enum ieee80211_band band)
3232{
3233	switch (band) {
3234	case IEEE80211_BAND_5GHZ:
3235		return "5";
3236	case IEEE80211_BAND_2GHZ:
3237		return "2.4";
3238	default:
3239		break;
3240	}
3241	B43_WARN_ON(1);
3242	return "";
3243}
3244
3245/* Expects wl->mutex locked */
3246static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3247{
3248	struct b43_wldev *up_dev = NULL;
3249	struct b43_wldev *down_dev;
3250	struct b43_wldev *d;
3251	int err;
3252	bool gmode;
3253	int prev_status;
3254
3255	/* Find a device and PHY which supports the band. */
3256	list_for_each_entry(d, &wl->devlist, list) {
3257		switch (chan->band) {
3258		case IEEE80211_BAND_5GHZ:
3259			if (d->phy.supports_5ghz) {
3260				up_dev = d;
3261				gmode = 0;
3262			}
3263			break;
3264		case IEEE80211_BAND_2GHZ:
3265			if (d->phy.supports_2ghz) {
3266				up_dev = d;
3267				gmode = 1;
3268			}
3269			break;
3270		default:
3271			B43_WARN_ON(1);
3272			return -EINVAL;
3273		}
3274		if (up_dev)
3275			break;
3276	}
3277	if (!up_dev) {
3278		b43err(wl, "Could not find a device for %s-GHz band operation\n",
3279		       band_to_string(chan->band));
3280		return -ENODEV;
3281	}
3282	if ((up_dev == wl->current_dev) &&
3283	    (!!wl->current_dev->phy.gmode == !!gmode)) {
3284		/* This device is already running. */
3285		return 0;
3286	}
3287	b43dbg(wl, "Switching to %s-GHz band\n",
3288	       band_to_string(chan->band));
3289	down_dev = wl->current_dev;
3290
3291	prev_status = b43_status(down_dev);
3292	/* Shutdown the currently running core. */
3293	if (prev_status >= B43_STAT_STARTED)
3294		b43_wireless_core_stop(down_dev);
3295	if (prev_status >= B43_STAT_INITIALIZED)
3296		b43_wireless_core_exit(down_dev);
3297
3298	if (down_dev != up_dev) {
3299		/* We switch to a different core, so we put PHY into
3300		 * RESET on the old core. */
3301		b43_put_phy_into_reset(down_dev);
3302	}
3303
3304	/* Now start the new core. */
3305	up_dev->phy.gmode = gmode;
3306	if (prev_status >= B43_STAT_INITIALIZED) {
3307		err = b43_wireless_core_init(up_dev);
3308		if (err) {
3309			b43err(wl, "Fatal: Could not initialize device for "
3310			       "selected %s-GHz band\n",
3311			       band_to_string(chan->band));
3312			goto init_failure;
3313		}
3314	}
3315	if (prev_status >= B43_STAT_STARTED) {
3316		err = b43_wireless_core_start(up_dev);
3317		if (err) {
3318			b43err(wl, "Fatal: Coult not start device for "
3319			       "selected %s-GHz band\n",
3320			       band_to_string(chan->band));
3321			b43_wireless_core_exit(up_dev);
3322			goto init_failure;
3323		}
3324	}
3325	B43_WARN_ON(b43_status(up_dev) != prev_status);
3326
3327	wl->current_dev = up_dev;
3328
3329	return 0;
3330init_failure:
3331	/* Whoops, failed to init the new core. No core is operating now. */
3332	wl->current_dev = NULL;
3333	return err;
3334}
3335
3336static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
3337{
3338	struct b43_wl *wl = hw_to_b43_wl(hw);
3339	struct b43_wldev *dev;
3340	struct b43_phy *phy;
3341	unsigned long flags;
3342	int antenna;
3343	int err = 0;
3344	u32 savedirqs;
3345
3346	mutex_lock(&wl->mutex);
3347
3348	/* Switch the band (if necessary). This might change the active core. */
3349	err = b43_switch_band(wl, conf->channel);
3350	if (err)
3351		goto out_unlock_mutex;
3352	dev = wl->current_dev;
3353	phy = &dev->phy;
3354
3355	/* Disable IRQs while reconfiguring the device.
3356	 * This makes it possible to drop the spinlock throughout
3357	 * the reconfiguration process. */
3358	spin_lock_irqsave(&wl->irq_lock, flags);
3359	if (b43_status(dev) < B43_STAT_STARTED) {
3360		spin_unlock_irqrestore(&wl->irq_lock, flags);
3361		goto out_unlock_mutex;
3362	}
3363	savedirqs = b43_interrupt_disable(dev, B43_IRQ_ALL);
3364	spin_unlock_irqrestore(&wl->irq_lock, flags);
3365	b43_synchronize_irq(dev);
3366
3367	/* Switch to the requested channel.
3368	 * The firmware takes care of races with the TX handler. */
3369	if (conf->channel->hw_value != phy->channel)
3370		b43_switch_channel(dev, conf->channel->hw_value);
3371
3372	/* Enable/Disable ShortSlot timing. */
3373	if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
3374	    dev->short_slot) {
3375		B43_WARN_ON(phy->type != B43_PHYTYPE_G);
3376		if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)
3377			b43_short_slot_timing_enable(dev);
3378		else
3379			b43_short_slot_timing_disable(dev);
3380	}
3381
3382	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
3383
3384	/* Adjust the desired TX power level. */
3385	if (conf->power_level != 0) {
3386		spin_lock_irqsave(&wl->irq_lock, flags);
3387		if (conf->power_level != phy->desired_txpower) {
3388			phy->desired_txpower = conf->power_level;
3389			b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3390						   B43_TXPWR_IGNORE_TSSI);
3391		}
3392		spin_unlock_irqrestore(&wl->irq_lock, flags);
3393	}
3394
3395	/* Antennas for RX and management frame TX. */
3396	antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
3397	b43_mgmtframe_txantenna(dev, antenna);
3398	antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
3399	if (phy->ops->set_rx_antenna)
3400		phy->ops->set_rx_antenna(dev, antenna);
3401
3402	/* Update templates for AP/mesh mode. */
3403	if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3404	    b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT))
3405		b43_set_beacon_int(dev, conf->beacon_int);
3406
3407	if (!!conf->radio_enabled != phy->radio_on) {
3408		if (conf->radio_enabled) {
3409			b43_software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
3410			b43info(dev->wl, "Radio turned on by software\n");
3411			if (!dev->radio_hw_enable) {
3412				b43info(dev->wl, "The hardware RF-kill button "
3413					"still turns the radio physically off. "
3414					"Press the button to turn it on.\n");
3415			}
3416		} else {
3417			b43_software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
3418			b43info(dev->wl, "Radio turned off by software\n");
3419		}
3420	}
3421
3422	spin_lock_irqsave(&wl->irq_lock, flags);
3423	b43_interrupt_enable(dev, savedirqs);
3424	mmiowb();
3425	spin_unlock_irqrestore(&wl->irq_lock, flags);
3426      out_unlock_mutex:
3427	mutex_unlock(&wl->mutex);
3428
3429	return err;
3430}
3431
3432static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3433			   const u8 *local_addr, const u8 *addr,
3434			   struct ieee80211_key_conf *key)
3435{
3436	struct b43_wl *wl = hw_to_b43_wl(hw);
3437	struct b43_wldev *dev;
3438	unsigned long flags;
3439	u8 algorithm;
3440	u8 index;
3441	int err;
3442	DECLARE_MAC_BUF(mac);
3443
3444	if (modparam_nohwcrypt)
3445		return -ENOSPC; /* User disabled HW-crypto */
3446
3447	mutex_lock(&wl->mutex);
3448	spin_lock_irqsave(&wl->irq_lock, flags);
3449
3450	dev = wl->current_dev;
3451	err = -ENODEV;
3452	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3453		goto out_unlock;
3454
3455	if (dev->fw.pcm_request_failed) {
3456		/* We don't have firmware for the crypto engine.
3457		 * Must use software-crypto. */
3458		err = -EOPNOTSUPP;
3459		goto out_unlock;
3460	}
3461
3462	err = -EINVAL;
3463	switch (key->alg) {
3464	case ALG_WEP:
3465		if (key->keylen == 5)
3466			algorithm = B43_SEC_ALGO_WEP40;
3467		else
3468			algorithm = B43_SEC_ALGO_WEP104;
3469		break;
3470	case ALG_TKIP:
3471		algorithm = B43_SEC_ALGO_TKIP;
3472		break;
3473	case ALG_CCMP:
3474		algorithm = B43_SEC_ALGO_AES;
3475		break;
3476	default:
3477		B43_WARN_ON(1);
3478		goto out_unlock;
3479	}
3480	index = (u8) (key->keyidx);
3481	if (index > 3)
3482		goto out_unlock;
3483
3484	switch (cmd) {
3485	case SET_KEY:
3486		if (algorithm == B43_SEC_ALGO_TKIP) {
3487			/* FIXME: No TKIP hardware encryption for now. */
3488			err = -EOPNOTSUPP;
3489			goto out_unlock;
3490		}
3491
3492		if (is_broadcast_ether_addr(addr)) {
3493			/* addr is FF:FF:FF:FF:FF:FF for default keys */
3494			err = b43_key_write(dev, index, algorithm,
3495					    key->key, key->keylen, NULL, key);
3496		} else {
3497			/*
3498			 * either pairwise key or address is 00:00:00:00:00:00
3499			 * for transmit-only keys
3500			 */
3501			err = b43_key_write(dev, -1, algorithm,
3502					    key->key, key->keylen, addr, key);
3503		}
3504		if (err)
3505			goto out_unlock;
3506
3507		if (algorithm == B43_SEC_ALGO_WEP40 ||
3508		    algorithm == B43_SEC_ALGO_WEP104) {
3509			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3510		} else {
3511			b43_hf_write(dev,
3512				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3513		}
3514		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3515		break;
3516	case DISABLE_KEY: {
3517		err = b43_key_clear(dev, key->hw_key_idx);
3518		if (err)
3519			goto out_unlock;
3520		break;
3521	}
3522	default:
3523		B43_WARN_ON(1);
3524	}
3525out_unlock:
3526	spin_unlock_irqrestore(&wl->irq_lock, flags);
3527	mutex_unlock(&wl->mutex);
3528	if (!err) {
3529		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3530		       "mac: %s\n",
3531		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3532		       print_mac(mac, addr));
3533	}
3534	return err;
3535}
3536
3537static void b43_op_configure_filter(struct ieee80211_hw *hw,
3538				    unsigned int changed, unsigned int *fflags,
3539				    int mc_count, struct dev_addr_list *mc_list)
3540{
3541	struct b43_wl *wl = hw_to_b43_wl(hw);
3542	struct b43_wldev *dev = wl->current_dev;
3543	unsigned long flags;
3544
3545	if (!dev) {
3546		*fflags = 0;
3547		return;
3548	}
3549
3550	spin_lock_irqsave(&wl->irq_lock, flags);
3551	*fflags &= FIF_PROMISC_IN_BSS |
3552		  FIF_ALLMULTI |
3553		  FIF_FCSFAIL |
3554		  FIF_PLCPFAIL |
3555		  FIF_CONTROL |
3556		  FIF_OTHER_BSS |
3557		  FIF_BCN_PRBRESP_PROMISC;
3558
3559	changed &= FIF_PROMISC_IN_BSS |
3560		   FIF_ALLMULTI |
3561		   FIF_FCSFAIL |
3562		   FIF_PLCPFAIL |
3563		   FIF_CONTROL |
3564		   FIF_OTHER_BSS |
3565		   FIF_BCN_PRBRESP_PROMISC;
3566
3567	wl->filter_flags = *fflags;
3568
3569	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3570		b43_adjust_opmode(dev);
3571	spin_unlock_irqrestore(&wl->irq_lock, flags);
3572}
3573
3574static int b43_op_config_interface(struct ieee80211_hw *hw,
3575				   struct ieee80211_vif *vif,
3576				   struct ieee80211_if_conf *conf)
3577{
3578	struct b43_wl *wl = hw_to_b43_wl(hw);
3579	struct b43_wldev *dev = wl->current_dev;
3580	unsigned long flags;
3581
3582	if (!dev)
3583		return -ENODEV;
3584	mutex_lock(&wl->mutex);
3585	spin_lock_irqsave(&wl->irq_lock, flags);
3586	B43_WARN_ON(wl->vif != vif);
3587	if (conf->bssid)
3588		memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3589	else
3590		memset(wl->bssid, 0, ETH_ALEN);
3591	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3592		if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP) ||
3593		    b43_is_mode(wl, IEEE80211_IF_TYPE_MESH_POINT)) {
3594			B43_WARN_ON(vif->type != wl->if_type);
3595			if (conf->changed & IEEE80211_IFCC_SSID)
3596				b43_set_ssid(dev, conf->ssid, conf->ssid_len);
3597			if (conf->changed & IEEE80211_IFCC_BEACON)
3598				b43_update_templates(wl);
3599		} else if (b43_is_mode(wl, IEEE80211_IF_TYPE_IBSS)) {
3600			if (conf->changed & IEEE80211_IFCC_BEACON)
3601				b43_update_templates(wl);
3602		}
3603		b43_write_mac_bssid_templates(dev);
3604	}
3605	spin_unlock_irqrestore(&wl->irq_lock, flags);
3606	mutex_unlock(&wl->mutex);
3607
3608	return 0;
3609}
3610
3611/* Locking: wl->mutex */
3612static void b43_wireless_core_stop(struct b43_wldev *dev)
3613{
3614	struct b43_wl *wl = dev->wl;
3615	unsigned long flags;
3616
3617	if (b43_status(dev) < B43_STAT_STARTED)
3618		return;
3619
3620	/* Disable and sync interrupts. We must do this before than
3621	 * setting the status to INITIALIZED, as the interrupt handler
3622	 * won't care about IRQs then. */
3623	spin_lock_irqsave(&wl->irq_lock, flags);
3624	dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
3625	b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* flush */
3626	spin_unlock_irqrestore(&wl->irq_lock, flags);
3627	b43_synchronize_irq(dev);
3628
3629	write_lock_irqsave(&wl->tx_lock, flags);
3630	b43_set_status(dev, B43_STAT_INITIALIZED);
3631	write_unlock_irqrestore(&wl->tx_lock, flags);
3632
3633	b43_pio_stop(dev);
3634	mutex_unlock(&wl->mutex);
3635	/* Must unlock as it would otherwise deadlock. No races here.
3636	 * Cancel the possibly running self-rearming periodic work. */
3637	cancel_delayed_work_sync(&dev->periodic_work);
3638	mutex_lock(&wl->mutex);
3639
3640	b43_mac_suspend(dev);
3641	free_irq(dev->dev->irq, dev);
3642	b43dbg(wl, "Wireless interface stopped\n");
3643}
3644
3645/* Locking: wl->mutex */
3646static int b43_wireless_core_start(struct b43_wldev *dev)
3647{
3648	int err;
3649
3650	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
3651
3652	drain_txstatus_queue(dev);
3653	err = request_irq(dev->dev->irq, b43_interrupt_handler,
3654			  IRQF_SHARED, KBUILD_MODNAME, dev);
3655	if (err) {
3656		b43err(dev->wl, "Cannot request IRQ-%d\n", dev->dev->irq);
3657		goto out;
3658	}
3659
3660	/* We are ready to run. */
3661	b43_set_status(dev, B43_STAT_STARTED);
3662
3663	/* Start data flow (TX/RX). */
3664	b43_mac_enable(dev);
3665	b43_interrupt_enable(dev, dev->irq_savedstate);
3666
3667	/* Start maintainance work */
3668	b43_periodic_tasks_setup(dev);
3669
3670	b43dbg(dev->wl, "Wireless interface started\n");
3671      out:
3672	return err;
3673}
3674
3675/* Get PHY and RADIO versioning numbers */
3676static int b43_phy_versioning(struct b43_wldev *dev)
3677{
3678	struct b43_phy *phy = &dev->phy;
3679	u32 tmp;
3680	u8 analog_type;
3681	u8 phy_type;
3682	u8 phy_rev;
3683	u16 radio_manuf;
3684	u16 radio_ver;
3685	u16 radio_rev;
3686	int unsupported = 0;
3687
3688	/* Get PHY versioning */
3689	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
3690	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
3691	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
3692	phy_rev = (tmp & B43_PHYVER_VERSION);
3693	switch (phy_type) {
3694	case B43_PHYTYPE_A:
3695		if (phy_rev >= 4)
3696			unsupported = 1;
3697		break;
3698	case B43_PHYTYPE_B:
3699		if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
3700		    && phy_rev != 7)
3701			unsupported = 1;
3702		break;
3703	case B43_PHYTYPE_G:
3704		if (phy_rev > 9)
3705			unsupported = 1;
3706		break;
3707#ifdef CONFIG_B43_NPHY
3708	case B43_PHYTYPE_N:
3709		if (phy_rev > 1)
3710			unsupported = 1;
3711		break;
3712#endif
3713	default:
3714		unsupported = 1;
3715	};
3716	if (unsupported) {
3717		b43err(dev->wl, "FOUND UNSUPPORTED PHY "
3718		       "(Analog %u, Type %u, Revision %u)\n",
3719		       analog_type, phy_type, phy_rev);
3720		return -EOPNOTSUPP;
3721	}
3722	b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3723	       analog_type, phy_type, phy_rev);
3724
3725	/* Get RADIO versioning */
3726	if (dev->dev->bus->chip_id == 0x4317) {
3727		if (dev->dev->bus->chip_rev == 0)
3728			tmp = 0x3205017F;
3729		else if (dev->dev->bus->chip_rev == 1)
3730			tmp = 0x4205017F;
3731		else
3732			tmp = 0x5205017F;
3733	} else {
3734		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3735		tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
3736		b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
3737		tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
3738	}
3739	radio_manuf = (tmp & 0x00000FFF);
3740	radio_ver = (tmp & 0x0FFFF000) >> 12;
3741	radio_rev = (tmp & 0xF0000000) >> 28;
3742	if (radio_manuf != 0x17F /* Broadcom */)
3743		unsupported = 1;
3744	switch (phy_type) {
3745	case B43_PHYTYPE_A:
3746		if (radio_ver != 0x2060)
3747			unsupported = 1;
3748		if (radio_rev != 1)
3749			unsupported = 1;
3750		if (radio_manuf != 0x17F)
3751			unsupported = 1;
3752		break;
3753	case B43_PHYTYPE_B:
3754		if ((radio_ver & 0xFFF0) != 0x2050)
3755			unsupported = 1;
3756		break;
3757	case B43_PHYTYPE_G:
3758		if (radio_ver != 0x2050)
3759			unsupported = 1;
3760		break;
3761	case B43_PHYTYPE_N:
3762		if (radio_ver != 0x2055)
3763			unsupported = 1;
3764		break;
3765	default:
3766		B43_WARN_ON(1);
3767	}
3768	if (unsupported) {
3769		b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
3770		       "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3771		       radio_manuf, radio_ver, radio_rev);
3772		return -EOPNOTSUPP;
3773	}
3774	b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
3775	       radio_manuf, radio_ver, radio_rev);
3776
3777	phy->radio_manuf = radio_manuf;
3778	phy->radio_ver = radio_ver;
3779	phy->radio_rev = radio_rev;
3780
3781	phy->analog = analog_type;
3782	phy->type = phy_type;
3783	phy->rev = phy_rev;
3784
3785	return 0;
3786}
3787
3788static void setup_struct_phy_for_init(struct b43_wldev *dev,
3789				      struct b43_phy *phy)
3790{
3791	phy->hardware_power_control = !!modparam_hwpctl;
3792	phy->next_txpwr_check_time = jiffies;
3793	/* PHY TX errors counter. */
3794	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3795}
3796
3797static void setup_struct_wldev_for_init(struct b43_wldev *dev)
3798{
3799	dev->dfq_valid = 0;
3800
3801	/* Assume the radio is enabled. If it's not enabled, the state will
3802	 * immediately get fixed on the first periodic work run. */
3803	dev->radio_hw_enable = 1;
3804
3805	/* Stats */
3806	memset(&dev->stats, 0, sizeof(dev->stats));
3807
3808	setup_struct_phy_for_init(dev, &dev->phy);
3809
3810	/* IRQ related flags */
3811	dev->irq_reason = 0;
3812	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3813	dev->irq_savedstate = B43_IRQ_MASKTEMPLATE;
3814
3815	dev->mac_suspended = 1;
3816
3817	/* Noise calculation context */
3818	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3819}
3820
3821static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
3822{
3823	struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3824	u64 hf;
3825
3826	if (!modparam_btcoex)
3827		return;
3828	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
3829		return;
3830	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
3831		return;
3832
3833	hf = b43_hf_read(dev);
3834	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
3835		hf |= B43_HF_BTCOEXALT;
3836	else
3837		hf |= B43_HF_BTCOEX;
3838	b43_hf_write(dev, hf);
3839}
3840
3841static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
3842{
3843	if (!modparam_btcoex)
3844		return;
3845	//TODO
3846}
3847
3848static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
3849{
3850#ifdef CONFIG_SSB_DRIVER_PCICORE
3851	struct ssb_bus *bus = dev->dev->bus;
3852	u32 tmp;
3853
3854	if (bus->pcicore.dev &&
3855	    bus->pcicore.dev->id.coreid == SSB_DEV_PCI &&
3856	    bus->pcicore.dev->id.revision <= 5) {
3857		/* IMCFGLO timeouts workaround. */
3858		tmp = ssb_read32(dev->dev, SSB_IMCFGLO);
3859		tmp &= ~SSB_IMCFGLO_REQTO;
3860		tmp &= ~SSB_IMCFGLO_SERTO;
3861		switch (bus->bustype) {
3862		case SSB_BUSTYPE_PCI:
3863		case SSB_BUSTYPE_PCMCIA:
3864			tmp |= 0x32;
3865			break;
3866		case SSB_BUSTYPE_SSB:
3867			tmp |= 0x53;
3868			break;
3869		}
3870		ssb_write32(dev->dev, SSB_IMCFGLO, tmp);
3871	}
3872#endif /* CONFIG_SSB_DRIVER_PCICORE */
3873}
3874
3875/* Write the short and long frame retry limit values. */
3876static void b43_set_retry_limits(struct b43_wldev *dev,
3877				 unsigned int short_retry,
3878				 unsigned int long_retry)
3879{
3880	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3881	 * the chip-internal counter. */
3882	short_retry = min(short_retry, (unsigned int)0xF);
3883	long_retry = min(long_retry, (unsigned int)0xF);
3884
3885	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3886			short_retry);
3887	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3888			long_retry);
3889}
3890
3891static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
3892{
3893	u16 pu_delay;
3894
3895	/* The time value is in microseconds. */
3896	if (dev->phy.type == B43_PHYTYPE_A)
3897		pu_delay = 3700;
3898	else
3899		pu_delay = 1050;
3900	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS) || idle)
3901		pu_delay = 500;
3902	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3903		pu_delay = max(pu_delay, (u16)2400);
3904
3905	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
3906}
3907
3908/* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3909static void b43_set_pretbtt(struct b43_wldev *dev)
3910{
3911	u16 pretbtt;
3912
3913	/* The time value is in microseconds. */
3914	if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS)) {
3915		pretbtt = 2;
3916	} else {
3917		if (dev->phy.type == B43_PHYTYPE_A)
3918			pretbtt = 120;
3919		else
3920			pretbtt = 250;
3921	}
3922	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
3923	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
3924}
3925
3926/* Shutdown a wireless core */
3927/* Locking: wl->mutex */
3928static void b43_wireless_core_exit(struct b43_wldev *dev)
3929{
3930	u32 macctl;
3931
3932	B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
3933	if (b43_status(dev) != B43_STAT_INITIALIZED)
3934		return;
3935	b43_set_status(dev, B43_STAT_UNINIT);
3936
3937	/* Stop the microcode PSM. */
3938	macctl = b43_read32(dev, B43_MMIO_MACCTL);
3939	macctl &= ~B43_MACCTL_PSM_RUN;
3940	macctl |= B43_MACCTL_PSM_JMP0;
3941	b43_write32(dev, B43_MMIO_MACCTL, macctl);
3942
3943	if (!dev->suspend_in_progress) {
3944		b43_leds_exit(dev);
3945		b43_rng_exit(dev->wl);
3946	}
3947	b43_dma_free(dev);
3948	b43_pio_free(dev);
3949	b43_chip_exit(dev);
3950	b43_switch_analog(dev, 0);
3951	if (dev->wl->current_beacon) {
3952		dev_kfree_skb_any(dev->wl->current_beacon);
3953		dev->wl->current_beacon = NULL;
3954	}
3955	b43_phy_exit(dev);
3956
3957	ssb_device_disable(dev->dev, 0);
3958	ssb_bus_may_powerdown(dev->dev->bus);
3959}
3960
3961/* Initialize a wireless core */
3962static int b43_wireless_core_init(struct b43_wldev *dev)
3963{
3964	struct b43_wl *wl = dev->wl;
3965	struct ssb_bus *bus = dev->dev->bus;
3966	struct ssb_sprom *sprom = &bus->sprom;
3967	struct b43_phy *phy = &dev->phy;
3968	int err;
3969	u64 hf;
3970	u32 tmp;
3971
3972	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
3973
3974	err = ssb_bus_powerup(bus, 0);
3975	if (err)
3976		goto out;
3977	if (!ssb_device_is_enabled(dev->dev)) {
3978		tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
3979		b43_wireless_core_reset(dev, tmp);
3980	}
3981
3982	setup_struct_wldev_for_init(dev);
3983	err = b43_phy_operations_setup(dev);
3984	if (err)
3985		goto err_busdown;
3986
3987	/* Enable IRQ routing to this device. */
3988	ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
3989
3990	b43_imcfglo_timeouts_workaround(dev);
3991	b43_bluetooth_coext_disable(dev);
3992	if (phy->ops->prepare) {
3993		err = phy->ops->prepare(dev);
3994		if (err)
3995			goto err_phy_exit;
3996	}
3997	err = b43_chip_init(dev);
3998	if (err)
3999		goto err_phy_exit;
4000	b43_shm_write16(dev, B43_SHM_SHARED,
4001			B43_SHM_SH_WLCOREREV, dev->dev->id.revision);
4002	hf = b43_hf_read(dev);
4003	if (phy->type == B43_PHYTYPE_G) {
4004		hf |= B43_HF_SYMW;
4005		if (phy->rev == 1)
4006			hf |= B43_HF_GDCW;
4007		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4008			hf |= B43_HF_OFDMPABOOST;
4009	} else if (phy->type == B43_PHYTYPE_B) {
4010		hf |= B43_HF_SYMW;
4011		if (phy->rev >= 2 && phy->radio_ver == 0x2050)
4012			hf &= ~B43_HF_GDCW;
4013	}
4014	b43_hf_write(dev, hf);
4015
4016	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4017			     B43_DEFAULT_LONG_RETRY_LIMIT);
4018	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4019	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4020
4021	/* Disable sending probe responses from firmware.
4022	 * Setting the MaxTime to one usec will always trigger
4023	 * a timeout, so we never send any probe resp.
4024	 * A timeout of zero is infinite. */
4025	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4026
4027	b43_rate_memory_init(dev);
4028	b43_set_phytxctl_defaults(dev);
4029
4030	/* Minimum Contention Window */
4031	if (phy->type == B43_PHYTYPE_B) {
4032		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4033	} else {
4034		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4035	}
4036	/* Maximum Contention Window */
4037	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4038
4039	if ((dev->dev->bus->bustype == SSB_BUSTYPE_PCMCIA) || B43_FORCE_PIO) {
4040		dev->__using_pio_transfers = 1;
4041		err = b43_pio_init(dev);
4042	} else {
4043		dev->__using_pio_transfers = 0;
4044		err = b43_dma_init(dev);
4045	}
4046	if (err)
4047		goto err_chip_exit;
4048	b43_qos_init(dev);
4049	b43_set_synth_pu_delay(dev, 1);
4050	b43_bluetooth_coext_enable(dev);
4051
4052	ssb_bus_powerup(bus, 1);	/* Enable dynamic PCTL */
4053	b43_upload_card_macaddress(dev);
4054	b43_security_init(dev);
4055	if (!dev->suspend_in_progress)
4056		b43_rng_init(wl);
4057
4058	b43_set_status(dev, B43_STAT_INITIALIZED);
4059
4060	if (!dev->suspend_in_progress)
4061		b43_leds_init(dev);
4062out:
4063	return err;
4064
4065err_chip_exit:
4066	b43_chip_exit(dev);
4067err_phy_exit:
4068	b43_phy_exit(dev);
4069err_busdown:
4070	ssb_bus_may_powerdown(bus);
4071	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4072	return err;
4073}
4074
4075static int b43_op_add_interface(struct ieee80211_hw *hw,
4076				struct ieee80211_if_init_conf *conf)
4077{
4078	struct b43_wl *wl = hw_to_b43_wl(hw);
4079	struct b43_wldev *dev;
4080	unsigned long flags;
4081	int err = -EOPNOTSUPP;
4082
4083	/* TODO: allow WDS/AP devices to coexist */
4084
4085	if (conf->type != IEEE80211_IF_TYPE_AP &&
4086	    conf->type != IEEE80211_IF_TYPE_MESH_POINT &&
4087	    conf->type != IEEE80211_IF_TYPE_STA &&
4088	    conf->type != IEEE80211_IF_TYPE_WDS &&
4089	    conf->type != IEEE80211_IF_TYPE_IBSS)
4090		return -EOPNOTSUPP;
4091
4092	mutex_lock(&wl->mutex);
4093	if (wl->operating)
4094		goto out_mutex_unlock;
4095
4096	b43dbg(wl, "Adding Interface type %d\n", conf->type);
4097
4098	dev = wl->current_dev;
4099	wl->operating = 1;
4100	wl->vif = conf->vif;
4101	wl->if_type = conf->type;
4102	memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
4103
4104	spin_lock_irqsave(&wl->irq_lock, flags);
4105	b43_adjust_opmode(dev);
4106	b43_set_pretbtt(dev);
4107	b43_set_synth_pu_delay(dev, 0);
4108	b43_upload_card_macaddress(dev);
4109	spin_unlock_irqrestore(&wl->irq_lock, flags);
4110
4111	err = 0;
4112 out_mutex_unlock:
4113	mutex_unlock(&wl->mutex);
4114
4115	return err;
4116}
4117
4118static void b43_op_remove_interface(struct ieee80211_hw *hw,
4119				    struct ieee80211_if_init_conf *conf)
4120{
4121	struct b43_wl *wl = hw_to_b43_wl(hw);
4122	struct b43_wldev *dev = wl->current_dev;
4123	unsigned long flags;
4124
4125	b43dbg(wl, "Removing Interface type %d\n", conf->type);
4126
4127	mutex_lock(&wl->mutex);
4128
4129	B43_WARN_ON(!wl->operating);
4130	B43_WARN_ON(wl->vif != conf->vif);
4131	wl->vif = NULL;
4132
4133	wl->operating = 0;
4134
4135	spin_lock_irqsave(&wl->irq_lock, flags);
4136	b43_adjust_opmode(dev);
4137	memset(wl->mac_addr, 0, ETH_ALEN);
4138	b43_upload_card_macaddress(dev);
4139	spin_unlock_irqrestore(&wl->irq_lock, flags);
4140
4141	mutex_unlock(&wl->mutex);
4142}
4143
4144static int b43_op_start(struct ieee80211_hw *hw)
4145{
4146	struct b43_wl *wl = hw_to_b43_wl(hw);
4147	struct b43_wldev *dev = wl->current_dev;
4148	int did_init = 0;
4149	int err = 0;
4150	bool do_rfkill_exit = 0;
4151
4152	/* Kill all old instance specific information to make sure
4153	 * the card won't use it in the short timeframe between start
4154	 * and mac80211 reconfiguring it. */
4155	memset(wl->bssid, 0, ETH_ALEN);
4156	memset(wl->mac_addr, 0, ETH_ALEN);
4157	wl->filter_flags = 0;
4158	wl->radiotap_enabled = 0;
4159	b43_qos_clear(wl);
4160	wl->beacon0_uploaded = 0;
4161	wl->beacon1_uploaded = 0;
4162	wl->beacon_templates_virgin = 1;
4163
4164	/* First register RFkill.
4165	 * LEDs that are registered later depend on it. */
4166	b43_rfkill_init(dev);
4167
4168	mutex_lock(&wl->mutex);
4169
4170	if (b43_status(dev) < B43_STAT_INITIALIZED) {
4171		err = b43_wireless_core_init(dev);
4172		if (err) {
4173			do_rfkill_exit = 1;
4174			goto out_mutex_unlock;
4175		}
4176		did_init = 1;
4177	}
4178
4179	if (b43_status(dev) < B43_STAT_STARTED) {
4180		err = b43_wireless_core_start(dev);
4181		if (err) {
4182			if (did_init)
4183				b43_wireless_core_exit(dev);
4184			do_rfkill_exit = 1;
4185			goto out_mutex_unlock;
4186		}
4187	}
4188
4189 out_mutex_unlock:
4190	mutex_unlock(&wl->mutex);
4191
4192	if (do_rfkill_exit)
4193		b43_rfkill_exit(dev);
4194
4195	return err;
4196}
4197
4198static void b43_op_stop(struct ieee80211_hw *hw)
4199{
4200	struct b43_wl *wl = hw_to_b43_wl(hw);
4201	struct b43_wldev *dev = wl->current_dev;
4202
4203	b43_rfkill_exit(dev);
4204	cancel_work_sync(&(wl->qos_update_work));
4205	cancel_work_sync(&(wl->beacon_update_trigger));
4206
4207	mutex_lock(&wl->mutex);
4208	if (b43_status(dev) >= B43_STAT_STARTED)
4209		b43_wireless_core_stop(dev);
4210	b43_wireless_core_exit(dev);
4211	mutex_unlock(&wl->mutex);
4212
4213	cancel_work_sync(&(wl->txpower_adjust_work));
4214}
4215
4216static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
4217				  u32 short_retry_limit, u32 long_retry_limit)
4218{
4219	struct b43_wl *wl = hw_to_b43_wl(hw);
4220	struct b43_wldev *dev;
4221	int err = 0;
4222
4223	mutex_lock(&wl->mutex);
4224	dev = wl->current_dev;
4225	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
4226		err = -ENODEV;
4227		goto out_unlock;
4228	}
4229	b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
4230out_unlock:
4231	mutex_unlock(&wl->mutex);
4232
4233	return err;
4234}
4235
4236static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
4237{
4238	struct b43_wl *wl = hw_to_b43_wl(hw);
4239	unsigned long flags;
4240
4241	spin_lock_irqsave(&wl->irq_lock, flags);
4242	b43_update_templates(wl);
4243	spin_unlock_irqrestore(&wl->irq_lock, flags);
4244
4245	return 0;
4246}
4247
4248static void b43_op_sta_notify(struct ieee80211_hw *hw,
4249			      struct ieee80211_vif *vif,
4250			      enum sta_notify_cmd notify_cmd,
4251			      const u8 *addr)
4252{
4253	struct b43_wl *wl = hw_to_b43_wl(hw);
4254
4255	B43_WARN_ON(!vif || wl->vif != vif);
4256}
4257
4258static const struct ieee80211_ops b43_hw_ops = {
4259	.tx			= b43_op_tx,
4260	.conf_tx		= b43_op_conf_tx,
4261	.add_interface		= b43_op_add_interface,
4262	.remove_interface	= b43_op_remove_interface,
4263	.config			= b43_op_config,
4264	.config_interface	= b43_op_config_interface,
4265	.configure_filter	= b43_op_configure_filter,
4266	.set_key		= b43_op_set_key,
4267	.get_stats		= b43_op_get_stats,
4268	.get_tx_stats		= b43_op_get_tx_stats,
4269	.start			= b43_op_start,
4270	.stop			= b43_op_stop,
4271	.set_retry_limit	= b43_op_set_retry_limit,
4272	.set_tim		= b43_op_beacon_set_tim,
4273	.sta_notify		= b43_op_sta_notify,
4274};
4275
4276/* Hard-reset the chip. Do not call this directly.
4277 * Use b43_controller_restart()
4278 */
4279static void b43_chip_reset(struct work_struct *work)
4280{
4281	struct b43_wldev *dev =
4282	    container_of(work, struct b43_wldev, restart_work);
4283	struct b43_wl *wl = dev->wl;
4284	int err = 0;
4285	int prev_status;
4286
4287	mutex_lock(&wl->mutex);
4288
4289	prev_status = b43_status(dev);
4290	/* Bring the device down... */
4291	if (prev_status >= B43_STAT_STARTED)
4292		b43_wireless_core_stop(dev);
4293	if (prev_status >= B43_STAT_INITIALIZED)
4294		b43_wireless_core_exit(dev);
4295
4296	/* ...and up again. */
4297	if (prev_status >= B43_STAT_INITIALIZED) {
4298		err = b43_wireless_core_init(dev);
4299		if (err)
4300			goto out;
4301	}
4302	if (prev_status >= B43_STAT_STARTED) {
4303		err = b43_wireless_core_start(dev);
4304		if (err) {
4305			b43_wireless_core_exit(dev);
4306			goto out;
4307		}
4308	}
4309out:
4310	if (err)
4311		wl->current_dev = NULL; /* Failed to init the dev. */
4312	mutex_unlock(&wl->mutex);
4313	if (err)
4314		b43err(wl, "Controller restart FAILED\n");
4315	else
4316		b43info(wl, "Controller restarted\n");
4317}
4318
4319static int b43_setup_bands(struct b43_wldev *dev,
4320			   bool have_2ghz_phy, bool have_5ghz_phy)
4321{
4322	struct ieee80211_hw *hw = dev->wl->hw;
4323
4324	if (have_2ghz_phy)
4325		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4326	if (dev->phy.type == B43_PHYTYPE_N) {
4327		if (have_5ghz_phy)
4328			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4329	} else {
4330		if (have_5ghz_phy)
4331			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4332	}
4333
4334	dev->phy.supports_2ghz = have_2ghz_phy;
4335	dev->phy.supports_5ghz = have_5ghz_phy;
4336
4337	return 0;
4338}
4339
4340static void b43_wireless_core_detach(struct b43_wldev *dev)
4341{
4342	/* We release firmware that late to not be required to re-request
4343	 * is all the time when we reinit the core. */
4344	b43_release_firmware(dev);
4345}
4346
4347static int b43_wireless_core_attach(struct b43_wldev *dev)
4348{
4349	struct b43_wl *wl = dev->wl;
4350	struct ssb_bus *bus = dev->dev->bus;
4351	struct pci_dev *pdev = bus->host_pci;
4352	int err;
4353	bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4354	u32 tmp;
4355
4356	/* Do NOT do any device initialization here.
4357	 * Do it in wireless_core_init() instead.
4358	 * This function is for gathering basic information about the HW, only.
4359	 * Also some structs may be set up here. But most likely you want to have
4360	 * that in core_init(), too.
4361	 */
4362
4363	err = ssb_bus_powerup(bus, 0);
4364	if (err) {
4365		b43err(wl, "Bus powerup failed\n");
4366		goto out;
4367	}
4368	/* Get the PHY type. */
4369	if (dev->dev->id.revision >= 5) {
4370		u32 tmshigh;
4371
4372		tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
4373		have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4374		have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4375	} else
4376		B43_WARN_ON(1);
4377
4378	dev->phy.gmode = have_2ghz_phy;
4379	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4380	b43_wireless_core_reset(dev, tmp);
4381
4382	err = b43_phy_versioning(dev);
4383	if (err)
4384		goto err_powerdown;
4385	/* Check if this device supports multiband. */
4386	if (!pdev ||
4387	    (pdev->device != 0x4312 &&
4388	     pdev->device != 0x4319 && pdev->device != 0x4324)) {
4389		/* No multiband support. */
4390		have_2ghz_phy = 0;
4391		have_5ghz_phy = 0;
4392		switch (dev->phy.type) {
4393		case B43_PHYTYPE_A:
4394			have_5ghz_phy = 1;
4395			break;
4396		case B43_PHYTYPE_G:
4397		case B43_PHYTYPE_N:
4398			have_2ghz_phy = 1;
4399			break;
4400		default:
4401			B43_WARN_ON(1);
4402		}
4403	}
4404	if (dev->phy.type == B43_PHYTYPE_A) {
4405		/* FIXME */
4406		b43err(wl, "IEEE 802.11a devices are unsupported\n");
4407		err = -EOPNOTSUPP;
4408		goto err_powerdown;
4409	}
4410	if (1 /* disable A-PHY */) {
4411		/* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4412		if (dev->phy.type != B43_PHYTYPE_N) {
4413			have_2ghz_phy = 1;
4414			have_5ghz_phy = 0;
4415		}
4416	}
4417
4418	dev->phy.gmode = have_2ghz_phy;
4419	tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4420	b43_wireless_core_reset(dev, tmp);
4421
4422	err = b43_validate_chipaccess(dev);
4423	if (err)
4424		goto err_powerdown;
4425	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4426	if (err)
4427		goto err_powerdown;
4428
4429	/* Now set some default "current_dev" */
4430	if (!wl->current_dev)
4431		wl->current_dev = dev;
4432	INIT_WORK(&dev->restart_work, b43_chip_reset);
4433
4434	b43_switch_analog(dev, 0);
4435	ssb_device_disable(dev->dev, 0);
4436	ssb_bus_may_powerdown(bus);
4437
4438out:
4439	return err;
4440
4441err_powerdown:
4442	ssb_bus_may_powerdown(bus);
4443	return err;
4444}
4445
4446static void b43_one_core_detach(struct ssb_device *dev)
4447{
4448	struct b43_wldev *wldev;
4449	struct b43_wl *wl;
4450
4451	/* Do not cancel ieee80211-workqueue based work here.
4452	 * See comment in b43_remove(). */
4453
4454	wldev = ssb_get_drvdata(dev);
4455	wl = wldev->wl;
4456	b43_debugfs_remove_device(wldev);
4457	b43_wireless_core_detach(wldev);
4458	list_del(&wldev->list);
4459	wl->nr_devs--;
4460	ssb_set_drvdata(dev, NULL);
4461	kfree(wldev);
4462}
4463
4464static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4465{
4466	struct b43_wldev *wldev;
4467	struct pci_dev *pdev;
4468	int err = -ENOMEM;
4469
4470	if (!list_empty(&wl->devlist)) {
4471		/* We are not the first core on this chip. */
4472		pdev = dev->bus->host_pci;
4473		/* Only special chips support more than one wireless
4474		 * core, although some of the other chips have more than
4475		 * one wireless core as well. Check for this and
4476		 * bail out early.
4477		 */
4478		if (!pdev ||
4479		    ((pdev->device != 0x4321) &&
4480		     (pdev->device != 0x4313) && (pdev->device != 0x431A))) {
4481			b43dbg(wl, "Ignoring unconnected 802.11 core\n");
4482			return -ENODEV;
4483		}
4484	}
4485
4486	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4487	if (!wldev)
4488		goto out;
4489
4490	wldev->dev = dev;
4491	wldev->wl = wl;
4492	b43_set_status(wldev, B43_STAT_UNINIT);
4493	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4494	tasklet_init(&wldev->isr_tasklet,
4495		     (void (*)(unsigned long))b43_interrupt_tasklet,
4496		     (unsigned long)wldev);
4497	INIT_LIST_HEAD(&wldev->list);
4498
4499	err = b43_wireless_core_attach(wldev);
4500	if (err)
4501		goto err_kfree_wldev;
4502
4503	list_add(&wldev->list, &wl->devlist);
4504	wl->nr_devs++;
4505	ssb_set_drvdata(dev, wldev);
4506	b43_debugfs_add_device(wldev);
4507
4508      out:
4509	return err;
4510
4511      err_kfree_wldev:
4512	kfree(wldev);
4513	return err;
4514}
4515
4516#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
4517	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
4518	(pdev->device == _device) &&					\
4519	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
4520	(pdev->subsystem_device == _subdevice)				)
4521
4522static void b43_sprom_fixup(struct ssb_bus *bus)
4523{
4524	struct pci_dev *pdev;
4525
4526	/* boardflags workarounds */
4527	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4528	    bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4529		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4530	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4531	    bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4532		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4533	if (bus->bustype == SSB_BUSTYPE_PCI) {
4534		pdev = bus->host_pci;
4535		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4536		    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4537		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4538		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4539		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
4540			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4541	}
4542}
4543
4544static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4545{
4546	struct ieee80211_hw *hw = wl->hw;
4547
4548	ssb_set_devtypedata(dev, NULL);
4549	ieee80211_free_hw(hw);
4550}
4551
4552static int b43_wireless_init(struct ssb_device *dev)
4553{
4554	struct ssb_sprom *sprom = &dev->bus->sprom;
4555	struct ieee80211_hw *hw;
4556	struct b43_wl *wl;
4557	int err = -ENOMEM;
4558
4559	b43_sprom_fixup(dev->bus);
4560
4561	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4562	if (!hw) {
4563		b43err(NULL, "Could not allocate ieee80211 device\n");
4564		goto out;
4565	}
4566
4567	/* fill hw info */
4568	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4569		    IEEE80211_HW_SIGNAL_DBM |
4570		    IEEE80211_HW_NOISE_DBM;
4571
4572	hw->wiphy->interface_modes =
4573		BIT(NL80211_IFTYPE_AP) |
4574		BIT(NL80211_IFTYPE_MESH_POINT) |
4575		BIT(NL80211_IFTYPE_STATION) |
4576		BIT(NL80211_IFTYPE_WDS) |
4577		BIT(NL80211_IFTYPE_ADHOC);
4578
4579	hw->queues = b43_modparam_qos ? 4 : 1;
4580	SET_IEEE80211_DEV(hw, dev->dev);
4581	if (is_valid_ether_addr(sprom->et1mac))
4582		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4583	else
4584		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4585
4586	/* Get and initialize struct b43_wl */
4587	wl = hw_to_b43_wl(hw);
4588	memset(wl, 0, sizeof(*wl));
4589	wl->hw = hw;
4590	spin_lock_init(&wl->irq_lock);
4591	rwlock_init(&wl->tx_lock);
4592	spin_lock_init(&wl->leds_lock);
4593	spin_lock_init(&wl->shm_lock);
4594	mutex_init(&wl->mutex);
4595	INIT_LIST_HEAD(&wl->devlist);
4596	INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
4597	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4598	INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4599
4600	ssb_set_devtypedata(dev, wl);
4601	b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
4602	err = 0;
4603      out:
4604	return err;
4605}
4606
4607static int b43_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4608{
4609	struct b43_wl *wl;
4610	int err;
4611	int first = 0;
4612
4613	wl = ssb_get_devtypedata(dev);
4614	if (!wl) {
4615		/* Probing the first core. Must setup common struct b43_wl */
4616		first = 1;
4617		err = b43_wireless_init(dev);
4618		if (err)
4619			goto out;
4620		wl = ssb_get_devtypedata(dev);
4621		B43_WARN_ON(!wl);
4622	}
4623	err = b43_one_core_attach(dev, wl);
4624	if (err)
4625		goto err_wireless_exit;
4626
4627	if (first) {
4628		err = ieee80211_register_hw(wl->hw);
4629		if (err)
4630			goto err_one_core_detach;
4631	}
4632
4633      out:
4634	return err;
4635
4636      err_one_core_detach:
4637	b43_one_core_detach(dev);
4638      err_wireless_exit:
4639	if (first)
4640		b43_wireless_exit(dev, wl);
4641	return err;
4642}
4643
4644static void b43_remove(struct ssb_device *dev)
4645{
4646	struct b43_wl *wl = ssb_get_devtypedata(dev);
4647	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4648
4649	/* We must cancel any work here before unregistering from ieee80211,
4650	 * as the ieee80211 unreg will destroy the workqueue. */
4651	cancel_work_sync(&wldev->restart_work);
4652
4653	B43_WARN_ON(!wl);
4654	if (wl->current_dev == wldev)
4655		ieee80211_unregister_hw(wl->hw);
4656
4657	b43_one_core_detach(dev);
4658
4659	if (list_empty(&wl->devlist)) {
4660		/* Last core on the chip unregistered.
4661		 * We can destroy common struct b43_wl.
4662		 */
4663		b43_wireless_exit(dev, wl);
4664	}
4665}
4666
4667/* Perform a hardware reset. This can be called from any context. */
4668void b43_controller_restart(struct b43_wldev *dev, const char *reason)
4669{
4670	/* Must avoid requeueing, if we are in shutdown. */
4671	if (b43_status(dev) < B43_STAT_INITIALIZED)
4672		return;
4673	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
4674	queue_work(dev->wl->hw->workqueue, &dev->restart_work);
4675}
4676
4677#ifdef CONFIG_PM
4678
4679static int b43_suspend(struct ssb_device *dev, pm_message_t state)
4680{
4681	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4682	struct b43_wl *wl = wldev->wl;
4683
4684	b43dbg(wl, "Suspending...\n");
4685
4686	mutex_lock(&wl->mutex);
4687	wldev->suspend_in_progress = true;
4688	wldev->suspend_init_status = b43_status(wldev);
4689	if (wldev->suspend_init_status >= B43_STAT_STARTED)
4690		b43_wireless_core_stop(wldev);
4691	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED)
4692		b43_wireless_core_exit(wldev);
4693	mutex_unlock(&wl->mutex);
4694
4695	b43dbg(wl, "Device suspended.\n");
4696
4697	return 0;
4698}
4699
4700static int b43_resume(struct ssb_device *dev)
4701{
4702	struct b43_wldev *wldev = ssb_get_drvdata(dev);
4703	struct b43_wl *wl = wldev->wl;
4704	int err = 0;
4705
4706	b43dbg(wl, "Resuming...\n");
4707
4708	mutex_lock(&wl->mutex);
4709	if (wldev->suspend_init_status >= B43_STAT_INITIALIZED) {
4710		err = b43_wireless_core_init(wldev);
4711		if (err) {
4712			b43err(wl, "Resume failed at core init\n");
4713			goto out;
4714		}
4715	}
4716	if (wldev->suspend_init_status >= B43_STAT_STARTED) {
4717		err = b43_wireless_core_start(wldev);
4718		if (err) {
4719			b43_leds_exit(wldev);
4720			b43_rng_exit(wldev->wl);
4721			b43_wireless_core_exit(wldev);
4722			b43err(wl, "Resume failed at core start\n");
4723			goto out;
4724		}
4725	}
4726	b43dbg(wl, "Device resumed.\n");
4727 out:
4728	wldev->suspend_in_progress = false;
4729	mutex_unlock(&wl->mutex);
4730	return err;
4731}
4732
4733#else /* CONFIG_PM */
4734# define b43_suspend	NULL
4735# define b43_resume	NULL
4736#endif /* CONFIG_PM */
4737
4738static struct ssb_driver b43_ssb_driver = {
4739	.name		= KBUILD_MODNAME,
4740	.id_table	= b43_ssb_tbl,
4741	.probe		= b43_probe,
4742	.remove		= b43_remove,
4743	.suspend	= b43_suspend,
4744	.resume		= b43_resume,
4745};
4746
4747static void b43_print_driverinfo(void)
4748{
4749	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
4750		   *feat_leds = "", *feat_rfkill = "";
4751
4752#ifdef CONFIG_B43_PCI_AUTOSELECT
4753	feat_pci = "P";
4754#endif
4755#ifdef CONFIG_B43_PCMCIA
4756	feat_pcmcia = "M";
4757#endif
4758#ifdef CONFIG_B43_NPHY
4759	feat_nphy = "N";
4760#endif
4761#ifdef CONFIG_B43_LEDS
4762	feat_leds = "L";
4763#endif
4764#ifdef CONFIG_B43_RFKILL
4765	feat_rfkill = "R";
4766#endif
4767	printk(KERN_INFO "Broadcom 43xx driver loaded "
4768	       "[ Features: %s%s%s%s%s, Firmware-ID: "
4769	       B43_SUPPORTED_FIRMWARE_ID " ]\n",
4770	       feat_pci, feat_pcmcia, feat_nphy,
4771	       feat_leds, feat_rfkill);
4772}
4773
4774static int __init b43_init(void)
4775{
4776	int err;
4777
4778	b43_debugfs_init();
4779	err = b43_pcmcia_init();
4780	if (err)
4781		goto err_dfs_exit;
4782	err = ssb_driver_register(&b43_ssb_driver);
4783	if (err)
4784		goto err_pcmcia_exit;
4785	b43_print_driverinfo();
4786
4787	return err;
4788
4789err_pcmcia_exit:
4790	b43_pcmcia_exit();
4791err_dfs_exit:
4792	b43_debugfs_exit();
4793	return err;
4794}
4795
4796static void __exit b43_exit(void)
4797{
4798	ssb_driver_unregister(&b43_ssb_driver);
4799	b43_pcmcia_exit();
4800	b43_debugfs_exit();
4801}
4802
4803module_init(b43_init)
4804module_exit(b43_exit)
4805