drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode5.fw");
  76 MODULE_FIRMWARE("b43/ucode9.fw");
  77
  78 static int modparam_bad_frames_preempt;
  79 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  80 MODULE_PARM_DESC(bad_frames_preempt,
  81                  "enable(1) / disable(0) Bad Frames Preemption");
  82
  83 static char modparam_fwpostfix[16];
  84 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  85 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  86
  87 static int modparam_hwpctl;
  88 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  89 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  90
  91 static int modparam_nohwcrypt;
  92 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  93 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  94
  95 static int modparam_hwtkip;
  96 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  97 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  98
  99 static int modparam_qos = 1;
 100 module_param_named(qos, modparam_qos, int, 0444);
 101 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 102
 103 static int modparam_btcoex = 1;
 104 module_param_named(btcoex, modparam_btcoex, int, 0444);
 105 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 106
 107 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 108 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 109 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 110
 111 static int b43_modparam_pio = B43_PIO_DEFAULT;
 112 module_param_named(pio, b43_modparam_pio, int, 0644);
 113 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 114
 115 static const struct ssb_device_id b43_ssb_tbl[] = {
 116         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 117         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 118         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 119         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 120         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 121         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 122         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 123         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 124         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 125         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 126         SSB_DEVTABLE_END
 127 };
 128
 129 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 130
 131 /* Channel and ratetables are shared for all devices.
 132  * They can't be const, because ieee80211 puts some precalculated
 133  * data in there. This data is the same for all devices, so we don't
 134  * get concurrency issues */
 135 #define RATETAB_ENT(_rateid, _flags) \
 136         {                                                               \
 137                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 138                 .hw_value       = (_rateid),                            \
 139                 .flags          = (_flags),                             \
 140         }
 141
 142 /*
 143  * NOTE: When changing this, sync with xmit.c's
 144  *       b43_plcp_get_bitrate_idx_* functions!
 145  */
 146 static struct ieee80211_rate __b43_ratetable[] = {
 147         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 148         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 151         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 152         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 153         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 154         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 155         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 156         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 157         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 158         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 159 };
 160
 161 #define b43_a_ratetable         (__b43_ratetable + 4)
 162 #define b43_a_ratetable_size    8
 163 #define b43_b_ratetable         (__b43_ratetable + 0)
 164 #define b43_b_ratetable_size    4
 165 #define b43_g_ratetable         (__b43_ratetable + 0)
 166 #define b43_g_ratetable_size    12
 167
 168 #define CHAN4G(_channel, _freq, _flags) {                       \
 169         .band                   = IEEE80211_BAND_2GHZ,          \
 170         .center_freq            = (_freq),                      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_2ghz_chantable[] = {
 177         CHAN4G(1, 2412, 0),
 178         CHAN4G(2, 2417, 0),
 179         CHAN4G(3, 2422, 0),
 180         CHAN4G(4, 2427, 0),
 181         CHAN4G(5, 2432, 0),
 182         CHAN4G(6, 2437, 0),
 183         CHAN4G(7, 2442, 0),
 184         CHAN4G(8, 2447, 0),
 185         CHAN4G(9, 2452, 0),
 186         CHAN4G(10, 2457, 0),
 187         CHAN4G(11, 2462, 0),
 188         CHAN4G(12, 2467, 0),
 189         CHAN4G(13, 2472, 0),
 190         CHAN4G(14, 2484, 0),
 191 };
 192 #undef CHAN4G
 193
 194 #define CHAN5G(_channel, _flags) {                              \
 195         .band                   = IEEE80211_BAND_5GHZ,          \
 196         .center_freq            = 5000 + (5 * (_channel)),      \
 197         .hw_value               = (_channel),                   \
 198         .flags                  = (_flags),                     \
 199         .max_antenna_gain       = 0,                            \
 200         .max_power              = 30,                           \
 201 }
 202 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 203         CHAN5G(32, 0),          CHAN5G(34, 0),
 204         CHAN5G(36, 0),          CHAN5G(38, 0),
 205         CHAN5G(40, 0),          CHAN5G(42, 0),
 206         CHAN5G(44, 0),          CHAN5G(46, 0),
 207         CHAN5G(48, 0),          CHAN5G(50, 0),
 208         CHAN5G(52, 0),          CHAN5G(54, 0),
 209         CHAN5G(56, 0),          CHAN5G(58, 0),
 210         CHAN5G(60, 0),          CHAN5G(62, 0),
 211         CHAN5G(64, 0),          CHAN5G(66, 0),
 212         CHAN5G(68, 0),          CHAN5G(70, 0),
 213         CHAN5G(72, 0),          CHAN5G(74, 0),
 214         CHAN5G(76, 0),          CHAN5G(78, 0),
 215         CHAN5G(80, 0),          CHAN5G(82, 0),
 216         CHAN5G(84, 0),          CHAN5G(86, 0),
 217         CHAN5G(88, 0),          CHAN5G(90, 0),
 218         CHAN5G(92, 0),          CHAN5G(94, 0),
 219         CHAN5G(96, 0),          CHAN5G(98, 0),
 220         CHAN5G(100, 0),         CHAN5G(102, 0),
 221         CHAN5G(104, 0),         CHAN5G(106, 0),
 222         CHAN5G(108, 0),         CHAN5G(110, 0),
 223         CHAN5G(112, 0),         CHAN5G(114, 0),
 224         CHAN5G(116, 0),         CHAN5G(118, 0),
 225         CHAN5G(120, 0),         CHAN5G(122, 0),
 226         CHAN5G(124, 0),         CHAN5G(126, 0),
 227         CHAN5G(128, 0),         CHAN5G(130, 0),
 228         CHAN5G(132, 0),         CHAN5G(134, 0),
 229         CHAN5G(136, 0),         CHAN5G(138, 0),
 230         CHAN5G(140, 0),         CHAN5G(142, 0),
 231         CHAN5G(144, 0),         CHAN5G(145, 0),
 232         CHAN5G(146, 0),         CHAN5G(147, 0),
 233         CHAN5G(148, 0),         CHAN5G(149, 0),
 234         CHAN5G(150, 0),         CHAN5G(151, 0),
 235         CHAN5G(152, 0),         CHAN5G(153, 0),
 236         CHAN5G(154, 0),         CHAN5G(155, 0),
 237         CHAN5G(156, 0),         CHAN5G(157, 0),
 238         CHAN5G(158, 0),         CHAN5G(159, 0),
 239         CHAN5G(160, 0),         CHAN5G(161, 0),
 240         CHAN5G(162, 0),         CHAN5G(163, 0),
 241         CHAN5G(164, 0),         CHAN5G(165, 0),
 242         CHAN5G(166, 0),         CHAN5G(168, 0),
 243         CHAN5G(170, 0),         CHAN5G(172, 0),
 244         CHAN5G(174, 0),         CHAN5G(176, 0),
 245         CHAN5G(178, 0),         CHAN5G(180, 0),
 246         CHAN5G(182, 0),         CHAN5G(184, 0),
 247         CHAN5G(186, 0),         CHAN5G(188, 0),
 248         CHAN5G(190, 0),         CHAN5G(192, 0),
 249         CHAN5G(194, 0),         CHAN5G(196, 0),
 250         CHAN5G(198, 0),         CHAN5G(200, 0),
 251         CHAN5G(202, 0),         CHAN5G(204, 0),
 252         CHAN5G(206, 0),         CHAN5G(208, 0),
 253         CHAN5G(210, 0),         CHAN5G(212, 0),
 254         CHAN5G(214, 0),         CHAN5G(216, 0),
 255         CHAN5G(218, 0),         CHAN5G(220, 0),
 256         CHAN5G(222, 0),         CHAN5G(224, 0),
 257         CHAN5G(226, 0),         CHAN5G(228, 0),
 258 };
 259
 260 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 261         CHAN5G(34, 0),          CHAN5G(36, 0),
 262         CHAN5G(38, 0),          CHAN5G(40, 0),
 263         CHAN5G(42, 0),          CHAN5G(44, 0),
 264         CHAN5G(46, 0),          CHAN5G(48, 0),
 265         CHAN5G(52, 0),          CHAN5G(56, 0),
 266         CHAN5G(60, 0),          CHAN5G(64, 0),
 267         CHAN5G(100, 0),         CHAN5G(104, 0),
 268         CHAN5G(108, 0),         CHAN5G(112, 0),
 269         CHAN5G(116, 0),         CHAN5G(120, 0),
 270         CHAN5G(124, 0),         CHAN5G(128, 0),
 271         CHAN5G(132, 0),         CHAN5G(136, 0),
 272         CHAN5G(140, 0),         CHAN5G(149, 0),
 273         CHAN5G(153, 0),         CHAN5G(157, 0),
 274         CHAN5G(161, 0),         CHAN5G(165, 0),
 275         CHAN5G(184, 0),         CHAN5G(188, 0),
 276         CHAN5G(192, 0),         CHAN5G(196, 0),
 277         CHAN5G(200, 0),         CHAN5G(204, 0),
 278         CHAN5G(208, 0),         CHAN5G(212, 0),
 279         CHAN5G(216, 0),
 280 };
 281 #undef CHAN5G
 282
 283 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 284         .band           = IEEE80211_BAND_5GHZ,
 285         .channels       = b43_5ghz_nphy_chantable,
 286         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 287         .bitrates       = b43_a_ratetable,
 288         .n_bitrates     = b43_a_ratetable_size,
 289 };
 290
 291 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 292         .band           = IEEE80211_BAND_5GHZ,
 293         .channels       = b43_5ghz_aphy_chantable,
 294         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 295         .bitrates       = b43_a_ratetable,
 296         .n_bitrates     = b43_a_ratetable_size,
 297 };
 298
 299 static struct ieee80211_supported_band b43_band_2GHz = {
 300         .band           = IEEE80211_BAND_2GHZ,
 301         .channels       = b43_2ghz_chantable,
 302         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 303         .bitrates       = b43_g_ratetable,
 304         .n_bitrates     = b43_g_ratetable_size,
 305 };
 306
 307 static void b43_wireless_core_exit(struct b43_wldev *dev);
 308 static int b43_wireless_core_init(struct b43_wldev *dev);
 309 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 310 static int b43_wireless_core_start(struct b43_wldev *dev);
 311
 312 static int b43_ratelimit(struct b43_wl *wl)
 313 {
 314         if (!wl || !wl->current_dev)
 315                 return 1;
 316         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 317                 return 1;
 318         /* We are up and running.
 319          * Ratelimit the messages to avoid DoS over the net. */
 320         return net_ratelimit();
 321 }
 322
 323 void b43info(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         struct va_format vaf;
 326         va_list args;
 327
 328         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 329                 return;
 330         if (!b43_ratelimit(wl))
 331                 return;
 332
 333         va_start(args, fmt);
 334
 335         vaf.fmt = fmt;
 336         vaf.va = &args;
 337
 338         printk(KERN_INFO "b43-%s: %pV",
 339                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 340
 341         va_end(args);
 342 }
 343
 344 void b43err(struct b43_wl *wl, const char *fmt, ...)
 345 {
 346         struct va_format vaf;
 347         va_list args;
 348
 349         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 350                 return;
 351         if (!b43_ratelimit(wl))
 352                 return;
 353
 354         va_start(args, fmt);
 355
 356         vaf.fmt = fmt;
 357         vaf.va = &args;
 358
 359         printk(KERN_ERR "b43-%s ERROR: %pV",
 360                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 361
 362         va_end(args);
 363 }
 364
 365 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 366 {
 367         struct va_format vaf;
 368         va_list args;
 369
 370         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 371                 return;
 372         if (!b43_ratelimit(wl))
 373                 return;
 374
 375         va_start(args, fmt);
 376
 377         vaf.fmt = fmt;
 378         vaf.va = &args;
 379
 380         printk(KERN_WARNING "b43-%s warning: %pV",
 381                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 382
 383         va_end(args);
 384 }
 385
 386 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 387 {
 388         struct va_format vaf;
 389         va_list args;
 390
 391         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 392                 return;
 393
 394         va_start(args, fmt);
 395
 396         vaf.fmt = fmt;
 397         vaf.va = &args;
 398
 399         printk(KERN_DEBUG "b43-%s debug: %pV",
 400                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 401
 402         va_end(args);
 403 }
 404
 405 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 406 {
 407         u32 macctl;
 408
 409         B43_WARN_ON(offset % 4 != 0);
 410
 411         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 412         if (macctl & B43_MACCTL_BE)
 413                 val = swab32(val);
 414
 415         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 416         mmiowb();
 417         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 418 }
 419
 420 static inline void b43_shm_control_word(struct b43_wldev *dev,
 421                                         u16 routing, u16 offset)
 422 {
 423         u32 control;
 424
 425         /* "offset" is the WORD offset. */
 426         control = routing;
 427         control <<= 16;
 428         control |= offset;
 429         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 430 }
 431
 432 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 433 {
 434         u32 ret;
 435
 436         if (routing == B43_SHM_SHARED) {
 437                 B43_WARN_ON(offset & 0x0001);
 438                 if (offset & 0x0003) {
 439                         /* Unaligned access */
 440                         b43_shm_control_word(dev, routing, offset >> 2);
 441                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 442                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 443                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 444
 445                         goto out;
 446                 }
 447                 offset >>= 2;
 448         }
 449         b43_shm_control_word(dev, routing, offset);
 450         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 451 out:
 452         return ret;
 453 }
 454
 455 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 456 {
 457         u16 ret;
 458
 459         if (routing == B43_SHM_SHARED) {
 460                 B43_WARN_ON(offset & 0x0001);
 461                 if (offset & 0x0003) {
 462                         /* Unaligned access */
 463                         b43_shm_control_word(dev, routing, offset >> 2);
 464                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 465
 466                         goto out;
 467                 }
 468                 offset >>= 2;
 469         }
 470         b43_shm_control_word(dev, routing, offset);
 471         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 472 out:
 473         return ret;
 474 }
 475
 476 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 477 {
 478         if (routing == B43_SHM_SHARED) {
 479                 B43_WARN_ON(offset & 0x0001);
 480                 if (offset & 0x0003) {
 481                         /* Unaligned access */
 482                         b43_shm_control_word(dev, routing, offset >> 2);
 483                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 484                                     value & 0xFFFF);
 485                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 486                         b43_write16(dev, B43_MMIO_SHM_DATA,
 487                                     (value >> 16) & 0xFFFF);
 488                         return;
 489                 }
 490                 offset >>= 2;
 491         }
 492         b43_shm_control_word(dev, routing, offset);
 493         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 494 }
 495
 496 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 497 {
 498         if (routing == B43_SHM_SHARED) {
 499                 B43_WARN_ON(offset & 0x0001);
 500                 if (offset & 0x0003) {
 501                         /* Unaligned access */
 502                         b43_shm_control_word(dev, routing, offset >> 2);
 503                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 504                         return;
 505                 }
 506                 offset >>= 2;
 507         }
 508         b43_shm_control_word(dev, routing, offset);
 509         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 510 }
 511
 512 /* Read HostFlags */
 513 u64 b43_hf_read(struct b43_wldev *dev)
 514 {
 515         u64 ret;
 516
 517         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 518         ret <<= 16;
 519         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 520         ret <<= 16;
 521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 522
 523         return ret;
 524 }
 525
 526 /* Write HostFlags */
 527 void b43_hf_write(struct b43_wldev *dev, u64 value)
 528 {
 529         u16 lo, mi, hi;
 530
 531         lo = (value & 0x00000000FFFFULL);
 532         mi = (value & 0x0000FFFF0000ULL) >> 16;
 533         hi = (value & 0xFFFF00000000ULL) >> 32;
 534         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 535         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 537 }
 538
 539 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 540 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 541 {
 542         B43_WARN_ON(!dev->fw.opensource);
 543         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 544 }
 545
 546 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 547 {
 548         u32 low, high;
 549
 550         B43_WARN_ON(dev->sdev->id.revision < 3);
 551
 552         /* The hardware guarantees us an atomic read, if we
 553          * read the low register first. */
 554         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 555         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 556
 557         *tsf = high;
 558         *tsf <<= 32;
 559         *tsf |= low;
 560 }
 561
 562 static void b43_time_lock(struct b43_wldev *dev)
 563 {
 564         u32 macctl;
 565
 566         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 567         macctl |= B43_MACCTL_TBTTHOLD;
 568         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 569         /* Commit the write */
 570         b43_read32(dev, B43_MMIO_MACCTL);
 571 }
 572
 573 static void b43_time_unlock(struct b43_wldev *dev)
 574 {
 575         u32 macctl;
 576
 577         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 578         macctl &= ~B43_MACCTL_TBTTHOLD;
 579         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 580         /* Commit the write */
 581         b43_read32(dev, B43_MMIO_MACCTL);
 582 }
 583
 584 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 585 {
 586         u32 low, high;
 587
 588         B43_WARN_ON(dev->sdev->id.revision < 3);
 589
 590         low = tsf;
 591         high = (tsf >> 32);
 592         /* The hardware guarantees us an atomic write, if we
 593          * write the low register first. */
 594         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 595         mmiowb();
 596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 597         mmiowb();
 598 }
 599
 600 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 601 {
 602         b43_time_lock(dev);
 603         b43_tsf_write_locked(dev, tsf);
 604         b43_time_unlock(dev);
 605 }
 606
 607 static
 608 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 609 {
 610         static const u8 zero_addr[ETH_ALEN] = { 0 };
 611         u16 data;
 612
 613         if (!mac)
 614                 mac = zero_addr;
 615
 616         offset |= 0x0020;
 617         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 618
 619         data = mac[0];
 620         data |= mac[1] << 8;
 621         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 622         data = mac[2];
 623         data |= mac[3] << 8;
 624         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 625         data = mac[4];
 626         data |= mac[5] << 8;
 627         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 628 }
 629
 630 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 631 {
 632         const u8 *mac;
 633         const u8 *bssid;
 634         u8 mac_bssid[ETH_ALEN * 2];
 635         int i;
 636         u32 tmp;
 637
 638         bssid = dev->wl->bssid;
 639         mac = dev->wl->mac_addr;
 640
 641         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 642
 643         memcpy(mac_bssid, mac, ETH_ALEN);
 644         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 645
 646         /* Write our MAC address and BSSID to template ram */
 647         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 648                 tmp = (u32) (mac_bssid[i + 0]);
 649                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 650                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 651                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 652                 b43_ram_write(dev, 0x20 + i, tmp);
 653         }
 654 }
 655
 656 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 657 {
 658         b43_write_mac_bssid_templates(dev);
 659         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 660 }
 661
 662 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 663 {
 664         /* slot_time is in usec. */
 665         /* This test used to exit for all but a G PHY. */
 666         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 667                 return;
 668         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 669         /* Shared memory location 0x0010 is the slot time and should be
 670          * set to slot_time; however, this register is initially 0 and changing
 671          * the value adversely affects the transmit rate for BCM4311
 672          * devices. Until this behavior is unterstood, delete this step
 673          *
 674          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 675          */
 676 }
 677
 678 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 9);
 681 }
 682
 683 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 684 {
 685         b43_set_slot_time(dev, 20);
 686 }
 687
 688 /* DummyTransmission function, as documented on
 689  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 690  */
 691 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 692 {
 693         struct b43_phy *phy = &dev->phy;
 694         unsigned int i, max_loop;
 695         u16 value;
 696         u32 buffer[5] = {
 697                 0x00000000,
 698                 0x00D40000,
 699                 0x00000000,
 700                 0x01000000,
 701                 0x00000000,
 702         };
 703
 704         if (ofdm) {
 705                 max_loop = 0x1E;
 706                 buffer[0] = 0x000201CC;
 707         } else {
 708                 max_loop = 0xFA;
 709                 buffer[0] = 0x000B846E;
 710         }
 711
 712         for (i = 0; i < 5; i++)
 713                 b43_ram_write(dev, i * 4, buffer[i]);
 714
 715         b43_write16(dev, 0x0568, 0x0000);
 716         if (dev->sdev->id.revision < 11)
 717                 b43_write16(dev, 0x07C0, 0x0000);
 718         else
 719                 b43_write16(dev, 0x07C0, 0x0100);
 720         value = (ofdm ? 0x41 : 0x40);
 721         b43_write16(dev, 0x050C, value);
 722         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 723                 b43_write16(dev, 0x0514, 0x1A02);
 724         b43_write16(dev, 0x0508, 0x0000);
 725         b43_write16(dev, 0x050A, 0x0000);
 726         b43_write16(dev, 0x054C, 0x0000);
 727         b43_write16(dev, 0x056A, 0x0014);
 728         b43_write16(dev, 0x0568, 0x0826);
 729         b43_write16(dev, 0x0500, 0x0000);
 730         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 731                 //SPEC TODO
 732         }
 733
 734         switch (phy->type) {
 735         case B43_PHYTYPE_N:
 736                 b43_write16(dev, 0x0502, 0x00D0);
 737                 break;
 738         case B43_PHYTYPE_LP:
 739                 b43_write16(dev, 0x0502, 0x0050);
 740                 break;
 741         default:
 742                 b43_write16(dev, 0x0502, 0x0030);
 743         }
 744
 745         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 746                 b43_radio_write16(dev, 0x0051, 0x0017);
 747         for (i = 0x00; i < max_loop; i++) {
 748                 value = b43_read16(dev, 0x050E);
 749                 if (value & 0x0080)
 750                         break;
 751                 udelay(10);
 752         }
 753         for (i = 0x00; i < 0x0A; i++) {
 754                 value = b43_read16(dev, 0x050E);
 755                 if (value & 0x0400)
 756                         break;
 757                 udelay(10);
 758         }
 759         for (i = 0x00; i < 0x19; i++) {
 760                 value = b43_read16(dev, 0x0690);
 761                 if (!(value & 0x0100))
 762                         break;
 763                 udelay(10);
 764         }
 765         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 766                 b43_radio_write16(dev, 0x0051, 0x0037);
 767 }
 768
 769 static void key_write(struct b43_wldev *dev,
 770                       u8 index, u8 algorithm, const u8 *key)
 771 {
 772         unsigned int i;
 773         u32 offset;
 774         u16 value;
 775         u16 kidx;
 776
 777         /* Key index/algo block */
 778         kidx = b43_kidx_to_fw(dev, index);
 779         value = ((kidx << 4) | algorithm);
 780         b43_shm_write16(dev, B43_SHM_SHARED,
 781                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 782
 783         /* Write the key to the Key Table Pointer offset */
 784         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 785         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 786                 value = key[i];
 787                 value |= (u16) (key[i + 1]) << 8;
 788                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 789         }
 790 }
 791
 792 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 793 {
 794         u32 addrtmp[2] = { 0, 0, };
 795         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 796
 797         if (b43_new_kidx_api(dev))
 798                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 799
 800         B43_WARN_ON(index < pairwise_keys_start);
 801         /* We have four default TX keys and possibly four default RX keys.
 802          * Physical mac 0 is mapped to physical key 4 or 8, depending
 803          * on the firmware version.
 804          * So we must adjust the index here.
 805          */
 806         index -= pairwise_keys_start;
 807         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 808
 809         if (addr) {
 810                 addrtmp[0] = addr[0];
 811                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 812                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 813                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 814                 addrtmp[1] = addr[4];
 815                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 816         }
 817
 818         /* Receive match transmitter address (RCMTA) mechanism */
 819         b43_shm_write32(dev, B43_SHM_RCMTA,
 820                         (index * 2) + 0, addrtmp[0]);
 821         b43_shm_write16(dev, B43_SHM_RCMTA,
 822                         (index * 2) + 1, addrtmp[1]);
 823 }
 824
 825 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 826  * When a packet is received, the iv32 is checked.
 827  * - if it doesn't the packet is returned without modification (and software
 828  *   decryption can be done). That's what happen when iv16 wrap.
 829  * - if it does, the rc4 key is computed, and decryption is tried.
 830  *   Either it will success and B43_RX_MAC_DEC is returned,
 831  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 832  *   and the packet is not usable (it got modified by the ucode).
 833  * So in order to never have B43_RX_MAC_DECERR, we should provide
 834  * a iv32 and phase1key that match. Because we drop packets in case of
 835  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 836  * packets will be lost without higher layer knowing (ie no resync possible
 837  * until next wrap).
 838  *
 839  * NOTE : this should support 50 key like RCMTA because
 840  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 841  */
 842 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 843                 u16 *phase1key)
 844 {
 845         unsigned int i;
 846         u32 offset;
 847         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 848
 849         if (!modparam_hwtkip)
 850                 return;
 851
 852         if (b43_new_kidx_api(dev))
 853                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 854
 855         B43_WARN_ON(index < pairwise_keys_start);
 856         /* We have four default TX keys and possibly four default RX keys.
 857          * Physical mac 0 is mapped to physical key 4 or 8, depending
 858          * on the firmware version.
 859          * So we must adjust the index here.
 860          */
 861         index -= pairwise_keys_start;
 862         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 863
 864         if (b43_debug(dev, B43_DBG_KEYS)) {
 865                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 866                                 index, iv32);
 867         }
 868         /* Write the key to the  RX tkip shared mem */
 869         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 870         for (i = 0; i < 10; i += 2) {
 871                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 872                                 phase1key ? phase1key[i / 2] : 0);
 873         }
 874         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 875         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 876 }
 877
 878 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 879                                    struct ieee80211_vif *vif,
 880                                    struct ieee80211_key_conf *keyconf,
 881                                    struct ieee80211_sta *sta,
 882                                    u32 iv32, u16 *phase1key)
 883 {
 884         struct b43_wl *wl = hw_to_b43_wl(hw);
 885         struct b43_wldev *dev;
 886         int index = keyconf->hw_key_idx;
 887
 888         if (B43_WARN_ON(!modparam_hwtkip))
 889                 return;
 890
 891         /* This is only called from the RX path through mac80211, where
 892          * our mutex is already locked. */
 893         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 894         dev = wl->current_dev;
 895         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 896
 897         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 898
 899         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 900         /* only pairwise TKIP keys are supported right now */
 901         if (WARN_ON(!sta))
 902                 return;
 903         keymac_write(dev, index, sta->addr);
 904 }
 905
 906 static void do_key_write(struct b43_wldev *dev,
 907                          u8 index, u8 algorithm,
 908                          const u8 *key, size_t key_len, const u8 *mac_addr)
 909 {
 910         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 911         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 912
 913         if (b43_new_kidx_api(dev))
 914                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 915
 916         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 917         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 918
 919         if (index >= pairwise_keys_start)
 920                 keymac_write(dev, index, NULL); /* First zero out mac. */
 921         if (algorithm == B43_SEC_ALGO_TKIP) {
 922                 /*
 923                  * We should provide an initial iv32, phase1key pair.
 924                  * We could start with iv32=0 and compute the corresponding
 925                  * phase1key, but this means calling ieee80211_get_tkip_key
 926                  * with a fake skb (or export other tkip function).
 927                  * Because we are lazy we hope iv32 won't start with
 928                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 929                  * correct pair.
 930                  */
 931                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 932         } else if (index >= pairwise_keys_start) /* clear it */
 933                 rx_tkip_phase1_write(dev, index, 0, NULL);
 934         if (key)
 935                 memcpy(buf, key, key_len);
 936         key_write(dev, index, algorithm, buf);
 937         if (index >= pairwise_keys_start)
 938                 keymac_write(dev, index, mac_addr);
 939
 940         dev->key[index].algorithm = algorithm;
 941 }
 942
 943 static int b43_key_write(struct b43_wldev *dev,
 944                          int index, u8 algorithm,
 945                          const u8 *key, size_t key_len,
 946                          const u8 *mac_addr,
 947                          struct ieee80211_key_conf *keyconf)
 948 {
 949         int i;
 950         int pairwise_keys_start;
 951
 952         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 953          *      - Temporal Encryption Key (128 bits)
 954          *      - Temporal Authenticator Tx MIC Key (64 bits)
 955          *      - Temporal Authenticator Rx MIC Key (64 bits)
 956          *
 957          *      Hardware only store TEK
 958          */
 959         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 960                 key_len = 16;
 961         if (key_len > B43_SEC_KEYSIZE)
 962                 return -EINVAL;
 963         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 964                 /* Check that we don't already have this key. */
 965                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 966         }
 967         if (index < 0) {
 968                 /* Pairwise key. Get an empty slot for the key. */
 969                 if (b43_new_kidx_api(dev))
 970                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 971                 else
 972                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 973                 for (i = pairwise_keys_start;
 974                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 975                      i++) {
 976                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 977                         if (!dev->key[i].keyconf) {
 978                                 /* found empty */
 979                                 index = i;
 980                                 break;
 981                         }
 982                 }
 983                 if (index < 0) {
 984                         b43warn(dev->wl, "Out of hardware key memory\n");
 985                         return -ENOSPC;
 986                 }
 987         } else
 988                 B43_WARN_ON(index > 3);
 989
 990         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 991         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 992                 /* Default RX key */
 993                 B43_WARN_ON(mac_addr);
 994                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 995         }
 996         keyconf->hw_key_idx = index;
 997         dev->key[index].keyconf = keyconf;
 998
 999         return 0;
1000 }
1001
1002 static int b43_key_clear(struct b43_wldev *dev, int index)
1003 {
1004         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1005                 return -EINVAL;
1006         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1007                      NULL, B43_SEC_KEYSIZE, NULL);
1008         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1009                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1010                              NULL, B43_SEC_KEYSIZE, NULL);
1011         }
1012         dev->key[index].keyconf = NULL;
1013
1014         return 0;
1015 }
1016
1017 static void b43_clear_keys(struct b43_wldev *dev)
1018 {
1019         int i, count;
1020
1021         if (b43_new_kidx_api(dev))
1022                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1023         else
1024                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1025         for (i = 0; i < count; i++)
1026                 b43_key_clear(dev, i);
1027 }
1028
1029 static void b43_dump_keymemory(struct b43_wldev *dev)
1030 {
1031         unsigned int i, index, count, offset, pairwise_keys_start;
1032         u8 mac[ETH_ALEN];
1033         u16 algo;
1034         u32 rcmta0;
1035         u16 rcmta1;
1036         u64 hf;
1037         struct b43_key *key;
1038
1039         if (!b43_debug(dev, B43_DBG_KEYS))
1040                 return;
1041
1042         hf = b43_hf_read(dev);
1043         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1044                !!(hf & B43_HF_USEDEFKEYS));
1045         if (b43_new_kidx_api(dev)) {
1046                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1047                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1048         } else {
1049                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1050                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1051         }
1052         for (index = 0; index < count; index++) {
1053                 key = &(dev->key[index]);
1054                 printk(KERN_DEBUG "Key slot %02u: %s",
1055                        index, (key->keyconf == NULL) ? " " : "*");
1056                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1057                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1058                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1059                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1060                 }
1061
1062                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1063                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1064                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1065
1066                 if (index >= pairwise_keys_start) {
1067                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1068                                 printk("   TKIP: ");
1069                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1070                                 for (i = 0; i < 14; i += 2) {
1071                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1072                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1073                                 }
1074                         }
1075                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1076                                                 ((index - pairwise_keys_start) * 2) + 0);
1077                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1078                                                 ((index - pairwise_keys_start) * 2) + 1);
1079                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1080                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1081                         printk("   MAC: %pM", mac);
1082                 } else
1083                         printk("   DEFAULT KEY");
1084                 printk("\n");
1085         }
1086 }
1087
1088 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1089 {
1090         u32 macctl;
1091         u16 ucstat;
1092         bool hwps;
1093         bool awake;
1094         int i;
1095
1096         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1097                     (ps_flags & B43_PS_DISABLED));
1098         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1099
1100         if (ps_flags & B43_PS_ENABLED) {
1101                 hwps = 1;
1102         } else if (ps_flags & B43_PS_DISABLED) {
1103                 hwps = 0;
1104         } else {
1105                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1106                 //      and thus is not an AP and we are associated, set bit 25
1107         }
1108         if (ps_flags & B43_PS_AWAKE) {
1109                 awake = 1;
1110         } else if (ps_flags & B43_PS_ASLEEP) {
1111                 awake = 0;
1112         } else {
1113                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1114                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1115                 //      successful, set bit26
1116         }
1117
1118 /* FIXME: For now we force awake-on and hwps-off */
1119         hwps = 0;
1120         awake = 1;
1121
1122         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1123         if (hwps)
1124                 macctl |= B43_MACCTL_HWPS;
1125         else
1126                 macctl &= ~B43_MACCTL_HWPS;
1127         if (awake)
1128                 macctl |= B43_MACCTL_AWAKE;
1129         else
1130                 macctl &= ~B43_MACCTL_AWAKE;
1131         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1132         /* Commit write */
1133         b43_read32(dev, B43_MMIO_MACCTL);
1134         if (awake && dev->sdev->id.revision >= 5) {
1135                 /* Wait for the microcode to wake up. */
1136                 for (i = 0; i < 100; i++) {
1137                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1138                                                 B43_SHM_SH_UCODESTAT);
1139                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1140                                 break;
1141                         udelay(10);
1142                 }
1143         }
1144 }
1145
1146 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1147 {
1148         u32 tmslow;
1149
1150         flags |= B43_TMSLOW_PHYCLKEN;
1151         flags |= B43_TMSLOW_PHYRESET;
1152         if (dev->phy.type == B43_PHYTYPE_N)
1153                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1154         ssb_device_enable(dev->sdev, flags);
1155         msleep(2);              /* Wait for the PLL to turn on. */
1156
1157         /* Now take the PHY out of Reset again */
1158         tmslow = ssb_read32(dev->sdev, SSB_TMSLOW);
1159         tmslow |= SSB_TMSLOW_FGC;
1160         tmslow &= ~B43_TMSLOW_PHYRESET;
1161         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
1162         ssb_read32(dev->sdev, SSB_TMSLOW);      /* flush */
1163         msleep(1);
1164         tmslow &= ~SSB_TMSLOW_FGC;
1165         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
1166         ssb_read32(dev->sdev, SSB_TMSLOW);      /* flush */
1167         msleep(1);
1168 }
1169
1170 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1171 {
1172         u32 macctl;
1173
1174         b43_ssb_wireless_core_reset(dev, flags);
1175
1176         /* Turn Analog ON, but only if we already know the PHY-type.
1177          * This protects against very early setup where we don't know the
1178          * PHY-type, yet. wireless_core_reset will be called once again later,
1179          * when we know the PHY-type. */
1180         if (dev->phy.ops)
1181                 dev->phy.ops->switch_analog(dev, 1);
1182
1183         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1184         macctl &= ~B43_MACCTL_GMODE;
1185         if (flags & B43_TMSLOW_GMODE)
1186                 macctl |= B43_MACCTL_GMODE;
1187         macctl |= B43_MACCTL_IHR_ENABLED;
1188         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1189 }
1190
1191 static void handle_irq_transmit_status(struct b43_wldev *dev)
1192 {
1193         u32 v0, v1;
1194         u16 tmp;
1195         struct b43_txstatus stat;
1196
1197         while (1) {
1198                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1199                 if (!(v0 & 0x00000001))
1200                         break;
1201                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1202
1203                 stat.cookie = (v0 >> 16);
1204                 stat.seq = (v1 & 0x0000FFFF);
1205                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1206                 tmp = (v0 & 0x0000FFFF);
1207                 stat.frame_count = ((tmp & 0xF000) >> 12);
1208                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1209                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1210                 stat.pm_indicated = !!(tmp & 0x0080);
1211                 stat.intermediate = !!(tmp & 0x0040);
1212                 stat.for_ampdu = !!(tmp & 0x0020);
1213                 stat.acked = !!(tmp & 0x0002);
1214
1215                 b43_handle_txstatus(dev, &stat);
1216         }
1217 }
1218
1219 static void drain_txstatus_queue(struct b43_wldev *dev)
1220 {
1221         u32 dummy;
1222
1223         if (dev->sdev->id.revision < 5)
1224                 return;
1225         /* Read all entries from the microcode TXstatus FIFO
1226          * and throw them away.
1227          */
1228         while (1) {
1229                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1230                 if (!(dummy & 0x00000001))
1231                         break;
1232                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1233         }
1234 }
1235
1236 static u32 b43_jssi_read(struct b43_wldev *dev)
1237 {
1238         u32 val = 0;
1239
1240         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1241         val <<= 16;
1242         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1243
1244         return val;
1245 }
1246
1247 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1248 {
1249         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1250         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1251 }
1252
1253 static void b43_generate_noise_sample(struct b43_wldev *dev)
1254 {
1255         b43_jssi_write(dev, 0x7F7F7F7F);
1256         b43_write32(dev, B43_MMIO_MACCMD,
1257                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1258 }
1259
1260 static void b43_calculate_link_quality(struct b43_wldev *dev)
1261 {
1262         /* Top half of Link Quality calculation. */
1263
1264         if (dev->phy.type != B43_PHYTYPE_G)
1265                 return;
1266         if (dev->noisecalc.calculation_running)
1267                 return;
1268         dev->noisecalc.calculation_running = 1;
1269         dev->noisecalc.nr_samples = 0;
1270
1271         b43_generate_noise_sample(dev);
1272 }
1273
1274 static void handle_irq_noise(struct b43_wldev *dev)
1275 {
1276         struct b43_phy_g *phy = dev->phy.g;
1277         u16 tmp;
1278         u8 noise[4];
1279         u8 i, j;
1280         s32 average;
1281
1282         /* Bottom half of Link Quality calculation. */
1283
1284         if (dev->phy.type != B43_PHYTYPE_G)
1285                 return;
1286
1287         /* Possible race condition: It might be possible that the user
1288          * changed to a different channel in the meantime since we
1289          * started the calculation. We ignore that fact, since it's
1290          * not really that much of a problem. The background noise is
1291          * an estimation only anyway. Slightly wrong results will get damped
1292          * by the averaging of the 8 sample rounds. Additionally the
1293          * value is shortlived. So it will be replaced by the next noise
1294          * calculation round soon. */
1295
1296         B43_WARN_ON(!dev->noisecalc.calculation_running);
1297         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1298         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1299             noise[2] == 0x7F || noise[3] == 0x7F)
1300                 goto generate_new;
1301
1302         /* Get the noise samples. */
1303         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1304         i = dev->noisecalc.nr_samples;
1305         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1306         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1307         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1308         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1309         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1310         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1311         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1312         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1313         dev->noisecalc.nr_samples++;
1314         if (dev->noisecalc.nr_samples == 8) {
1315                 /* Calculate the Link Quality by the noise samples. */
1316                 average = 0;
1317                 for (i = 0; i < 8; i++) {
1318                         for (j = 0; j < 4; j++)
1319                                 average += dev->noisecalc.samples[i][j];
1320                 }
1321                 average /= (8 * 4);
1322                 average *= 125;
1323                 average += 64;
1324                 average /= 128;
1325                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1326                 tmp = (tmp / 128) & 0x1F;
1327                 if (tmp >= 8)
1328                         average += 2;
1329                 else
1330                         average -= 25;
1331                 if (tmp == 8)
1332                         average -= 72;
1333                 else
1334                         average -= 48;
1335
1336                 dev->stats.link_noise = average;
1337                 dev->noisecalc.calculation_running = 0;
1338                 return;
1339         }
1340 generate_new:
1341         b43_generate_noise_sample(dev);
1342 }
1343
1344 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1345 {
1346         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1347                 ///TODO: PS TBTT
1348         } else {
1349                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1350                         b43_power_saving_ctl_bits(dev, 0);
1351         }
1352         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1353                 dev->dfq_valid = 1;
1354 }
1355
1356 static void handle_irq_atim_end(struct b43_wldev *dev)
1357 {
1358         if (dev->dfq_valid) {
1359                 b43_write32(dev, B43_MMIO_MACCMD,
1360                             b43_read32(dev, B43_MMIO_MACCMD)
1361                             | B43_MACCMD_DFQ_VALID);
1362                 dev->dfq_valid = 0;
1363         }
1364 }
1365
1366 static void handle_irq_pmq(struct b43_wldev *dev)
1367 {
1368         u32 tmp;
1369
1370         //TODO: AP mode.
1371
1372         while (1) {
1373                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1374                 if (!(tmp & 0x00000008))
1375                         break;
1376         }
1377         /* 16bit write is odd, but correct. */
1378         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1379 }
1380
1381 static void b43_write_template_common(struct b43_wldev *dev,
1382                                       const u8 *data, u16 size,
1383                                       u16 ram_offset,
1384                                       u16 shm_size_offset, u8 rate)
1385 {
1386         u32 i, tmp;
1387         struct b43_plcp_hdr4 plcp;
1388
1389         plcp.data = 0;
1390         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1391         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1392         ram_offset += sizeof(u32);
1393         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1394          * So leave the first two bytes of the next write blank.
1395          */
1396         tmp = (u32) (data[0]) << 16;
1397         tmp |= (u32) (data[1]) << 24;
1398         b43_ram_write(dev, ram_offset, tmp);
1399         ram_offset += sizeof(u32);
1400         for (i = 2; i < size; i += sizeof(u32)) {
1401                 tmp = (u32) (data[i + 0]);
1402                 if (i + 1 < size)
1403                         tmp |= (u32) (data[i + 1]) << 8;
1404                 if (i + 2 < size)
1405                         tmp |= (u32) (data[i + 2]) << 16;
1406                 if (i + 3 < size)
1407                         tmp |= (u32) (data[i + 3]) << 24;
1408                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1409         }
1410         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1411                         size + sizeof(struct b43_plcp_hdr6));
1412 }
1413
1414 /* Check if the use of the antenna that ieee80211 told us to
1415  * use is possible. This will fall back to DEFAULT.
1416  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1417 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1418                                   u8 antenna_nr)
1419 {
1420         u8 antenna_mask;
1421
1422         if (antenna_nr == 0) {
1423                 /* Zero means "use default antenna". That's always OK. */
1424                 return 0;
1425         }
1426
1427         /* Get the mask of available antennas. */
1428         if (dev->phy.gmode)
1429                 antenna_mask = dev->sdev->bus->sprom.ant_available_bg;
1430         else
1431                 antenna_mask = dev->sdev->bus->sprom.ant_available_a;
1432
1433         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1434                 /* This antenna is not available. Fall back to default. */
1435                 return 0;
1436         }
1437
1438         return antenna_nr;
1439 }
1440
1441 /* Convert a b43 antenna number value to the PHY TX control value. */
1442 static u16 b43_antenna_to_phyctl(int antenna)
1443 {
1444         switch (antenna) {
1445         case B43_ANTENNA0:
1446                 return B43_TXH_PHY_ANT0;
1447         case B43_ANTENNA1:
1448                 return B43_TXH_PHY_ANT1;
1449         case B43_ANTENNA2:
1450                 return B43_TXH_PHY_ANT2;
1451         case B43_ANTENNA3:
1452                 return B43_TXH_PHY_ANT3;
1453         case B43_ANTENNA_AUTO0:
1454         case B43_ANTENNA_AUTO1:
1455                 return B43_TXH_PHY_ANT01AUTO;
1456         }
1457         B43_WARN_ON(1);
1458         return 0;
1459 }
1460
1461 static void b43_write_beacon_template(struct b43_wldev *dev,
1462                                       u16 ram_offset,
1463                                       u16 shm_size_offset)
1464 {
1465         unsigned int i, len, variable_len;
1466         const struct ieee80211_mgmt *bcn;
1467         const u8 *ie;
1468         bool tim_found = 0;
1469         unsigned int rate;
1470         u16 ctl;
1471         int antenna;
1472         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1473
1474         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1475         len = min((size_t) dev->wl->current_beacon->len,
1476                   0x200 - sizeof(struct b43_plcp_hdr6));
1477         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1478
1479         b43_write_template_common(dev, (const u8 *)bcn,
1480                                   len, ram_offset, shm_size_offset, rate);
1481
1482         /* Write the PHY TX control parameters. */
1483         antenna = B43_ANTENNA_DEFAULT;
1484         antenna = b43_antenna_to_phyctl(antenna);
1485         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1486         /* We can't send beacons with short preamble. Would get PHY errors. */
1487         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1488         ctl &= ~B43_TXH_PHY_ANT;
1489         ctl &= ~B43_TXH_PHY_ENC;
1490         ctl |= antenna;
1491         if (b43_is_cck_rate(rate))
1492                 ctl |= B43_TXH_PHY_ENC_CCK;
1493         else
1494                 ctl |= B43_TXH_PHY_ENC_OFDM;
1495         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1496
1497         /* Find the position of the TIM and the DTIM_period value
1498          * and write them to SHM. */
1499         ie = bcn->u.beacon.variable;
1500         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1501         for (i = 0; i < variable_len - 2; ) {
1502                 uint8_t ie_id, ie_len;
1503
1504                 ie_id = ie[i];
1505                 ie_len = ie[i + 1];
1506                 if (ie_id == 5) {
1507                         u16 tim_position;
1508                         u16 dtim_period;
1509                         /* This is the TIM Information Element */
1510
1511                         /* Check whether the ie_len is in the beacon data range. */
1512                         if (variable_len < ie_len + 2 + i)
1513                                 break;
1514                         /* A valid TIM is at least 4 bytes long. */
1515                         if (ie_len < 4)
1516                                 break;
1517                         tim_found = 1;
1518
1519                         tim_position = sizeof(struct b43_plcp_hdr6);
1520                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1521                         tim_position += i;
1522
1523                         dtim_period = ie[i + 3];
1524
1525                         b43_shm_write16(dev, B43_SHM_SHARED,
1526                                         B43_SHM_SH_TIMBPOS, tim_position);
1527                         b43_shm_write16(dev, B43_SHM_SHARED,
1528                                         B43_SHM_SH_DTIMPER, dtim_period);
1529                         break;
1530                 }
1531                 i += ie_len + 2;
1532         }
1533         if (!tim_found) {
1534                 /*
1535                  * If ucode wants to modify TIM do it behind the beacon, this
1536                  * will happen, for example, when doing mesh networking.
1537                  */
1538                 b43_shm_write16(dev, B43_SHM_SHARED,
1539                                 B43_SHM_SH_TIMBPOS,
1540                                 len + sizeof(struct b43_plcp_hdr6));
1541                 b43_shm_write16(dev, B43_SHM_SHARED,
1542                                 B43_SHM_SH_DTIMPER, 0);
1543         }
1544         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1545 }
1546
1547 static void b43_upload_beacon0(struct b43_wldev *dev)
1548 {
1549         struct b43_wl *wl = dev->wl;
1550
1551         if (wl->beacon0_uploaded)
1552                 return;
1553         b43_write_beacon_template(dev, 0x68, 0x18);
1554         wl->beacon0_uploaded = 1;
1555 }
1556
1557 static void b43_upload_beacon1(struct b43_wldev *dev)
1558 {
1559         struct b43_wl *wl = dev->wl;
1560
1561         if (wl->beacon1_uploaded)
1562                 return;
1563         b43_write_beacon_template(dev, 0x468, 0x1A);
1564         wl->beacon1_uploaded = 1;
1565 }
1566
1567 static void handle_irq_beacon(struct b43_wldev *dev)
1568 {
1569         struct b43_wl *wl = dev->wl;
1570         u32 cmd, beacon0_valid, beacon1_valid;
1571
1572         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1573             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1574                 return;
1575
1576         /* This is the bottom half of the asynchronous beacon update. */
1577
1578         /* Ignore interrupt in the future. */
1579         dev->irq_mask &= ~B43_IRQ_BEACON;
1580
1581         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1582         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1583         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1584
1585         /* Schedule interrupt manually, if busy. */
1586         if (beacon0_valid && beacon1_valid) {
1587                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1588                 dev->irq_mask |= B43_IRQ_BEACON;
1589                 return;
1590         }
1591
1592         if (unlikely(wl->beacon_templates_virgin)) {
1593                 /* We never uploaded a beacon before.
1594                  * Upload both templates now, but only mark one valid. */
1595                 wl->beacon_templates_virgin = 0;
1596                 b43_upload_beacon0(dev);
1597                 b43_upload_beacon1(dev);
1598                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1599                 cmd |= B43_MACCMD_BEACON0_VALID;
1600                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1601         } else {
1602                 if (!beacon0_valid) {
1603                         b43_upload_beacon0(dev);
1604                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1605                         cmd |= B43_MACCMD_BEACON0_VALID;
1606                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1607                 } else if (!beacon1_valid) {
1608                         b43_upload_beacon1(dev);
1609                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1610                         cmd |= B43_MACCMD_BEACON1_VALID;
1611                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1612                 }
1613         }
1614 }
1615
1616 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1617 {
1618         u32 old_irq_mask = dev->irq_mask;
1619
1620         /* update beacon right away or defer to irq */
1621         handle_irq_beacon(dev);
1622         if (old_irq_mask != dev->irq_mask) {
1623                 /* The handler updated the IRQ mask. */
1624                 B43_WARN_ON(!dev->irq_mask);
1625                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1626                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1627                 } else {
1628                         /* Device interrupts are currently disabled. That means
1629                          * we just ran the hardirq handler and scheduled the
1630                          * IRQ thread. The thread will write the IRQ mask when
1631                          * it finished, so there's nothing to do here. Writing
1632                          * the mask _here_ would incorrectly re-enable IRQs. */
1633                 }
1634         }
1635 }
1636
1637 static void b43_beacon_update_trigger_work(struct work_struct *work)
1638 {
1639         struct b43_wl *wl = container_of(work, struct b43_wl,
1640                                          beacon_update_trigger);
1641         struct b43_wldev *dev;
1642
1643         mutex_lock(&wl->mutex);
1644         dev = wl->current_dev;
1645         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1646                 if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
1647                         /* wl->mutex is enough. */
1648                         b43_do_beacon_update_trigger_work(dev);
1649                         mmiowb();
1650                 } else {
1651                         spin_lock_irq(&wl->hardirq_lock);
1652                         b43_do_beacon_update_trigger_work(dev);
1653                         mmiowb();
1654                         spin_unlock_irq(&wl->hardirq_lock);
1655                 }
1656         }
1657         mutex_unlock(&wl->mutex);
1658 }
1659
1660 /* Asynchronously update the packet templates in template RAM.
1661  * Locking: Requires wl->mutex to be locked. */
1662 static void b43_update_templates(struct b43_wl *wl)
1663 {
1664         struct sk_buff *beacon;
1665
1666         /* This is the top half of the ansynchronous beacon update.
1667          * The bottom half is the beacon IRQ.
1668          * Beacon update must be asynchronous to avoid sending an
1669          * invalid beacon. This can happen for example, if the firmware
1670          * transmits a beacon while we are updating it. */
1671
1672         /* We could modify the existing beacon and set the aid bit in
1673          * the TIM field, but that would probably require resizing and
1674          * moving of data within the beacon template.
1675          * Simply request a new beacon and let mac80211 do the hard work. */
1676         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1677         if (unlikely(!beacon))
1678                 return;
1679
1680         if (wl->current_beacon)
1681                 dev_kfree_skb_any(wl->current_beacon);
1682         wl->current_beacon = beacon;
1683         wl->beacon0_uploaded = 0;
1684         wl->beacon1_uploaded = 0;
1685         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1686 }
1687
1688 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1689 {
1690         b43_time_lock(dev);
1691         if (dev->sdev->id.revision >= 3) {
1692                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1693                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1694         } else {
1695                 b43_write16(dev, 0x606, (beacon_int >> 6));
1696                 b43_write16(dev, 0x610, beacon_int);
1697         }
1698         b43_time_unlock(dev);
1699         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1700 }
1701
1702 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1703 {
1704         u16 reason;
1705
1706         /* Read the register that contains the reason code for the panic. */
1707         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1708         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1709
1710         switch (reason) {
1711         default:
1712                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1713                 /* fallthrough */
1714         case B43_FWPANIC_DIE:
1715                 /* Do not restart the controller or firmware.
1716                  * The device is nonfunctional from now on.
1717                  * Restarting would result in this panic to trigger again,
1718                  * so we avoid that recursion. */
1719                 break;
1720         case B43_FWPANIC_RESTART:
1721                 b43_controller_restart(dev, "Microcode panic");
1722                 break;
1723         }
1724 }
1725
1726 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1727 {
1728         unsigned int i, cnt;
1729         u16 reason, marker_id, marker_line;
1730         __le16 *buf;
1731
1732         /* The proprietary firmware doesn't have this IRQ. */
1733         if (!dev->fw.opensource)
1734                 return;
1735
1736         /* Read the register that contains the reason code for this IRQ. */
1737         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1738
1739         switch (reason) {
1740         case B43_DEBUGIRQ_PANIC:
1741                 b43_handle_firmware_panic(dev);
1742                 break;
1743         case B43_DEBUGIRQ_DUMP_SHM:
1744                 if (!B43_DEBUG)
1745                         break; /* Only with driver debugging enabled. */
1746                 buf = kmalloc(4096, GFP_ATOMIC);
1747                 if (!buf) {
1748                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1749                         goto out;
1750                 }
1751                 for (i = 0; i < 4096; i += 2) {
1752                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1753                         buf[i / 2] = cpu_to_le16(tmp);
1754                 }
1755                 b43info(dev->wl, "Shared memory dump:\n");
1756                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1757                                16, 2, buf, 4096, 1);
1758                 kfree(buf);
1759                 break;
1760         case B43_DEBUGIRQ_DUMP_REGS:
1761                 if (!B43_DEBUG)
1762                         break; /* Only with driver debugging enabled. */
1763                 b43info(dev->wl, "Microcode register dump:\n");
1764                 for (i = 0, cnt = 0; i < 64; i++) {
1765                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1766                         if (cnt == 0)
1767                                 printk(KERN_INFO);
1768                         printk("r%02u: 0x%04X  ", i, tmp);
1769                         cnt++;
1770                         if (cnt == 6) {
1771                                 printk("\n");
1772                                 cnt = 0;
1773                         }
1774                 }
1775                 printk("\n");
1776                 break;
1777         case B43_DEBUGIRQ_MARKER:
1778                 if (!B43_DEBUG)
1779                         break; /* Only with driver debugging enabled. */
1780                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1781                                            B43_MARKER_ID_REG);
1782                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1783                                              B43_MARKER_LINE_REG);
1784                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1785                         "at line number %u\n",
1786                         marker_id, marker_line);
1787                 break;
1788         default:
1789                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1790                        reason);
1791         }
1792 out:
1793         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1794         b43_shm_write16(dev, B43_SHM_SCRATCH,
1795                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1796 }
1797
1798 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1799 {
1800         u32 reason;
1801         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1802         u32 merged_dma_reason = 0;
1803         int i;
1804
1805         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1806                 return;
1807
1808         reason = dev->irq_reason;
1809         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1810                 dma_reason[i] = dev->dma_reason[i];
1811                 merged_dma_reason |= dma_reason[i];
1812         }
1813
1814         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1815                 b43err(dev->wl, "MAC transmission error\n");
1816
1817         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1818                 b43err(dev->wl, "PHY transmission error\n");
1819                 rmb();
1820                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1821                         atomic_set(&dev->phy.txerr_cnt,
1822                                    B43_PHY_TX_BADNESS_LIMIT);
1823                         b43err(dev->wl, "Too many PHY TX errors, "
1824                                         "restarting the controller\n");
1825                         b43_controller_restart(dev, "PHY TX errors");
1826                 }
1827         }
1828
1829         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1830                                           B43_DMAIRQ_NONFATALMASK))) {
1831                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1832                         b43err(dev->wl, "Fatal DMA error: "
1833                                "0x%08X, 0x%08X, 0x%08X, "
1834                                "0x%08X, 0x%08X, 0x%08X\n",
1835                                dma_reason[0], dma_reason[1],
1836                                dma_reason[2], dma_reason[3],
1837                                dma_reason[4], dma_reason[5]);
1838                         b43err(dev->wl, "This device does not support DMA "
1839                                "on your system. It will now be switched to PIO.\n");
1840                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1841                         dev->use_pio = 1;
1842                         b43_controller_restart(dev, "DMA error");
1843                         return;
1844                 }
1845                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1846                         b43err(dev->wl, "DMA error: "
1847                                "0x%08X, 0x%08X, 0x%08X, "
1848                                "0x%08X, 0x%08X, 0x%08X\n",
1849                                dma_reason[0], dma_reason[1],
1850                                dma_reason[2], dma_reason[3],
1851                                dma_reason[4], dma_reason[5]);
1852                 }
1853         }
1854
1855         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1856                 handle_irq_ucode_debug(dev);
1857         if (reason & B43_IRQ_TBTT_INDI)
1858                 handle_irq_tbtt_indication(dev);
1859         if (reason & B43_IRQ_ATIM_END)
1860                 handle_irq_atim_end(dev);
1861         if (reason & B43_IRQ_BEACON)
1862                 handle_irq_beacon(dev);
1863         if (reason & B43_IRQ_PMQ)
1864                 handle_irq_pmq(dev);
1865         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1866                 ;/* TODO */
1867         if (reason & B43_IRQ_NOISESAMPLE_OK)
1868                 handle_irq_noise(dev);
1869
1870         /* Check the DMA reason registers for received data. */
1871         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1872                 if (b43_using_pio_transfers(dev))
1873                         b43_pio_rx(dev->pio.rx_queue);
1874                 else
1875                         b43_dma_rx(dev->dma.rx_ring);
1876         }
1877         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1878         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1879         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1880         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1881         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1882
1883         if (reason & B43_IRQ_TX_OK)
1884                 handle_irq_transmit_status(dev);
1885
1886         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1887         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1888
1889 #if B43_DEBUG
1890         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1891                 dev->irq_count++;
1892                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1893                         if (reason & (1 << i))
1894                                 dev->irq_bit_count[i]++;
1895                 }
1896         }
1897 #endif
1898 }
1899
1900 /* Interrupt thread handler. Handles device interrupts in thread context. */
1901 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1902 {
1903         struct b43_wldev *dev = dev_id;
1904
1905         mutex_lock(&dev->wl->mutex);
1906         b43_do_interrupt_thread(dev);
1907         mmiowb();
1908         mutex_unlock(&dev->wl->mutex);
1909
1910         return IRQ_HANDLED;
1911 }
1912
1913 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1914 {
1915         u32 reason;
1916
1917         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1918          * On SDIO, this runs under wl->mutex. */
1919
1920         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1921         if (reason == 0xffffffff)       /* shared IRQ */
1922                 return IRQ_NONE;
1923         reason &= dev->irq_mask;
1924         if (!reason)
1925                 return IRQ_HANDLED;
1926
1927         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1928             & 0x0001DC00;
1929         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1930             & 0x0000DC00;
1931         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1932             & 0x0000DC00;
1933         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1934             & 0x0001DC00;
1935         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1936             & 0x0000DC00;
1937 /* Unused ring
1938         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1939             & 0x0000DC00;
1940 */
1941
1942         /* ACK the interrupt. */
1943         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1944         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1945         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1946         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1947         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1948         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1949 /* Unused ring
1950         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1951 */
1952
1953         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1954         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1955         /* Save the reason bitmasks for the IRQ thread handler. */
1956         dev->irq_reason = reason;
1957
1958         return IRQ_WAKE_THREAD;
1959 }
1960
1961 /* Interrupt handler top-half. This runs with interrupts disabled. */
1962 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1963 {
1964         struct b43_wldev *dev = dev_id;
1965         irqreturn_t ret;
1966
1967         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1968                 return IRQ_NONE;
1969
1970         spin_lock(&dev->wl->hardirq_lock);
1971         ret = b43_do_interrupt(dev);
1972         mmiowb();
1973         spin_unlock(&dev->wl->hardirq_lock);
1974
1975         return ret;
1976 }
1977
1978 /* SDIO interrupt handler. This runs in process context. */
1979 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
1980 {
1981         struct b43_wl *wl = dev->wl;
1982         irqreturn_t ret;
1983
1984         mutex_lock(&wl->mutex);
1985
1986         ret = b43_do_interrupt(dev);
1987         if (ret == IRQ_WAKE_THREAD)
1988                 b43_do_interrupt_thread(dev);
1989
1990         mutex_unlock(&wl->mutex);
1991 }
1992
1993 void b43_do_release_fw(struct b43_firmware_file *fw)
1994 {
1995         release_firmware(fw->data);
1996         fw->data = NULL;
1997         fw->filename = NULL;
1998 }
1999
2000 static void b43_release_firmware(struct b43_wldev *dev)
2001 {
2002         b43_do_release_fw(&dev->fw.ucode);
2003         b43_do_release_fw(&dev->fw.pcm);
2004         b43_do_release_fw(&dev->fw.initvals);
2005         b43_do_release_fw(&dev->fw.initvals_band);
2006 }
2007
2008 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2009 {
2010         const char text[] =
2011                 "You must go to " \
2012                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2013                 "and download the correct firmware for this driver version. " \
2014                 "Please carefully read all instructions on this website.\n";
2015
2016         if (error)
2017                 b43err(wl, text);
2018         else
2019                 b43warn(wl, text);
2020 }
2021
2022 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2023                       const char *name,
2024                       struct b43_firmware_file *fw)
2025 {
2026         const struct firmware *blob;
2027         struct b43_fw_header *hdr;
2028         u32 size;
2029         int err;
2030
2031         if (!name) {
2032                 /* Don't fetch anything. Free possibly cached firmware. */
2033                 /* FIXME: We should probably keep it anyway, to save some headache
2034                  * on suspend/resume with multiband devices. */
2035                 b43_do_release_fw(fw);
2036                 return 0;
2037         }
2038         if (fw->filename) {
2039                 if ((fw->type == ctx->req_type) &&
2040                     (strcmp(fw->filename, name) == 0))
2041                         return 0; /* Already have this fw. */
2042                 /* Free the cached firmware first. */
2043                 /* FIXME: We should probably do this later after we successfully
2044                  * got the new fw. This could reduce headache with multiband devices.
2045                  * We could also redesign this to cache the firmware for all possible
2046                  * bands all the time. */
2047                 b43_do_release_fw(fw);
2048         }
2049
2050         switch (ctx->req_type) {
2051         case B43_FWTYPE_PROPRIETARY:
2052                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2053                          "b43%s/%s.fw",
2054                          modparam_fwpostfix, name);
2055                 break;
2056         case B43_FWTYPE_OPENSOURCE:
2057                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2058                          "b43-open%s/%s.fw",
2059                          modparam_fwpostfix, name);
2060                 break;
2061         default:
2062                 B43_WARN_ON(1);
2063                 return -ENOSYS;
2064         }
2065         err = request_firmware(&blob, ctx->fwname, ctx->dev->sdev->dev);
2066         if (err == -ENOENT) {
2067                 snprintf(ctx->errors[ctx->req_type],
2068                          sizeof(ctx->errors[ctx->req_type]),
2069                          "Firmware file \"%s\" not found\n", ctx->fwname);
2070                 return err;
2071         } else if (err) {
2072                 snprintf(ctx->errors[ctx->req_type],
2073                          sizeof(ctx->errors[ctx->req_type]),
2074                          "Firmware file \"%s\" request failed (err=%d)\n",
2075                          ctx->fwname, err);
2076                 return err;
2077         }
2078         if (blob->size < sizeof(struct b43_fw_header))
2079                 goto err_format;
2080         hdr = (struct b43_fw_header *)(blob->data);
2081         switch (hdr->type) {
2082         case B43_FW_TYPE_UCODE:
2083         case B43_FW_TYPE_PCM:
2084                 size = be32_to_cpu(hdr->size);
2085                 if (size != blob->size - sizeof(struct b43_fw_header))
2086                         goto err_format;
2087                 /* fallthrough */
2088         case B43_FW_TYPE_IV:
2089                 if (hdr->ver != 1)
2090                         goto err_format;
2091                 break;
2092         default:
2093                 goto err_format;
2094         }
2095
2096         fw->data = blob;
2097         fw->filename = name;
2098         fw->type = ctx->req_type;
2099
2100         return 0;
2101
2102 err_format:
2103         snprintf(ctx->errors[ctx->req_type],
2104                  sizeof(ctx->errors[ctx->req_type]),
2105                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2106         release_firmware(blob);
2107
2108         return -EPROTO;
2109 }
2110
2111 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2112 {
2113         struct b43_wldev *dev = ctx->dev;
2114         struct b43_firmware *fw = &ctx->dev->fw;
2115         const u8 rev = ctx->dev->sdev->id.revision;
2116         const char *filename;
2117         u32 tmshigh;
2118         int err;
2119
2120         /* Get microcode */
2121         if ((rev >= 5) && (rev <= 10))
2122                 filename = "ucode5";
2123         else if ((rev >= 11) && (rev <= 12))
2124                 filename = "ucode11";
2125         else if (rev == 13)
2126                 filename = "ucode13";
2127         else if (rev == 14)
2128                 filename = "ucode14";
2129         else if (rev == 15)
2130                 filename = "ucode15";
2131         else if ((rev >= 16) && (rev <= 20))
2132                 filename = "ucode16_mimo";
2133         else
2134                 goto err_no_ucode;
2135         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2136         if (err)
2137                 goto err_load;
2138
2139         /* Get PCM code */
2140         if ((rev >= 5) && (rev <= 10))
2141                 filename = "pcm5";
2142         else if (rev >= 11)
2143                 filename = NULL;
2144         else
2145                 goto err_no_pcm;
2146         fw->pcm_request_failed = 0;
2147         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2148         if (err == -ENOENT) {
2149                 /* We did not find a PCM file? Not fatal, but
2150                  * core rev <= 10 must do without hwcrypto then. */
2151                 fw->pcm_request_failed = 1;
2152         } else if (err)
2153                 goto err_load;
2154
2155         /* Get initvals */
2156         switch (dev->phy.type) {
2157         case B43_PHYTYPE_A:
2158                 if ((rev >= 5) && (rev <= 10)) {
2159                         tmshigh = ssb_read32(dev->sdev, SSB_TMSHIGH);
2160                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2161                                 filename = "a0g1initvals5";
2162                         else
2163                                 filename = "a0g0initvals5";
2164                 } else
2165                         goto err_no_initvals;
2166                 break;
2167         case B43_PHYTYPE_G:
2168                 if ((rev >= 5) && (rev <= 10))
2169                         filename = "b0g0initvals5";
2170                 else if (rev >= 13)
2171                         filename = "b0g0initvals13";
2172                 else
2173                         goto err_no_initvals;
2174                 break;
2175         case B43_PHYTYPE_N:
2176                 if (rev >= 16)
2177                         filename = "n0initvals16";
2178                 else if ((rev >= 11) && (rev <= 12))
2179                         filename = "n0initvals11";
2180                 else
2181                         goto err_no_initvals;
2182                 break;
2183         case B43_PHYTYPE_LP:
2184                 if (rev == 13)
2185                         filename = "lp0initvals13";
2186                 else if (rev == 14)
2187                         filename = "lp0initvals14";
2188                 else if (rev >= 15)
2189                         filename = "lp0initvals15";
2190                 else
2191                         goto err_no_initvals;
2192                 break;
2193         default:
2194                 goto err_no_initvals;
2195         }
2196         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2197         if (err)
2198                 goto err_load;
2199
2200         /* Get bandswitch initvals */
2201         switch (dev->phy.type) {
2202         case B43_PHYTYPE_A:
2203                 if ((rev >= 5) && (rev <= 10)) {
2204                         tmshigh = ssb_read32(dev->sdev, SSB_TMSHIGH);
2205                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2206                                 filename = "a0g1bsinitvals5";
2207                         else
2208                                 filename = "a0g0bsinitvals5";
2209                 } else if (rev >= 11)
2210                         filename = NULL;
2211                 else
2212                         goto err_no_initvals;
2213                 break;
2214         case B43_PHYTYPE_G:
2215                 if ((rev >= 5) && (rev <= 10))
2216                         filename = "b0g0bsinitvals5";
2217                 else if (rev >= 11)
2218                         filename = NULL;
2219                 else
2220                         goto err_no_initvals;
2221                 break;
2222         case B43_PHYTYPE_N:
2223                 if (rev >= 16)
2224                         filename = "n0bsinitvals16";
2225                 else if ((rev >= 11) && (rev <= 12))
2226                         filename = "n0bsinitvals11";
2227                 else
2228                         goto err_no_initvals;
2229                 break;
2230         case B43_PHYTYPE_LP:
2231                 if (rev == 13)
2232                         filename = "lp0bsinitvals13";
2233                 else if (rev == 14)
2234                         filename = "lp0bsinitvals14";
2235                 else if (rev >= 15)
2236                         filename = "lp0bsinitvals15";
2237                 else
2238                         goto err_no_initvals;
2239                 break;
2240         default:
2241                 goto err_no_initvals;
2242         }
2243         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2244         if (err)
2245                 goto err_load;
2246
2247         return 0;
2248
2249 err_no_ucode:
2250         err = ctx->fatal_failure = -EOPNOTSUPP;
2251         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2252                "is required for your device (wl-core rev %u)\n", rev);
2253         goto error;
2254
2255 err_no_pcm:
2256         err = ctx->fatal_failure = -EOPNOTSUPP;
2257         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2258                "is required for your device (wl-core rev %u)\n", rev);
2259         goto error;
2260
2261 err_no_initvals:
2262         err = ctx->fatal_failure = -EOPNOTSUPP;
2263         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2264                "is required for your device (wl-core rev %u)\n", rev);
2265         goto error;
2266
2267 err_load:
2268         /* We failed to load this firmware image. The error message
2269          * already is in ctx->errors. Return and let our caller decide
2270          * what to do. */
2271         goto error;
2272
2273 error:
2274         b43_release_firmware(dev);
2275         return err;
2276 }
2277
2278 static int b43_request_firmware(struct b43_wldev *dev)
2279 {
2280         struct b43_request_fw_context *ctx;
2281         unsigned int i;
2282         int err;
2283         const char *errmsg;
2284
2285         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2286         if (!ctx)
2287                 return -ENOMEM;
2288         ctx->dev = dev;
2289
2290         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2291         err = b43_try_request_fw(ctx);
2292         if (!err)
2293                 goto out; /* Successfully loaded it. */
2294         err = ctx->fatal_failure;
2295         if (err)
2296                 goto out;
2297
2298         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2299         err = b43_try_request_fw(ctx);
2300         if (!err)
2301                 goto out; /* Successfully loaded it. */
2302         err = ctx->fatal_failure;
2303         if (err)
2304                 goto out;
2305
2306         /* Could not find a usable firmware. Print the errors. */
2307         for (i = 0; i < B43_NR_FWTYPES; i++) {
2308                 errmsg = ctx->errors[i];
2309                 if (strlen(errmsg))
2310                         b43err(dev->wl, errmsg);
2311         }
2312         b43_print_fw_helptext(dev->wl, 1);
2313         err = -ENOENT;
2314
2315 out:
2316         kfree(ctx);
2317         return err;
2318 }
2319
2320 static int b43_upload_microcode(struct b43_wldev *dev)
2321 {
2322         struct wiphy *wiphy = dev->wl->hw->wiphy;
2323         const size_t hdr_len = sizeof(struct b43_fw_header);
2324         const __be32 *data;
2325         unsigned int i, len;
2326         u16 fwrev, fwpatch, fwdate, fwtime;
2327         u32 tmp, macctl;
2328         int err = 0;
2329
2330         /* Jump the microcode PSM to offset 0 */
2331         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2332         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2333         macctl |= B43_MACCTL_PSM_JMP0;
2334         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2335         /* Zero out all microcode PSM registers and shared memory. */
2336         for (i = 0; i < 64; i++)
2337                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2338         for (i = 0; i < 4096; i += 2)
2339                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2340
2341         /* Upload Microcode. */
2342         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2343         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2344         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2345         for (i = 0; i < len; i++) {
2346                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2347                 udelay(10);
2348         }
2349
2350         if (dev->fw.pcm.data) {
2351                 /* Upload PCM data. */
2352                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2353                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2354                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2355                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2356                 /* No need for autoinc bit in SHM_HW */
2357                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2358                 for (i = 0; i < len; i++) {
2359                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2360                         udelay(10);
2361                 }
2362         }
2363
2364         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2365
2366         /* Start the microcode PSM */
2367         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2368         macctl &= ~B43_MACCTL_PSM_JMP0;
2369         macctl |= B43_MACCTL_PSM_RUN;
2370         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2371
2372         /* Wait for the microcode to load and respond */
2373         i = 0;
2374         while (1) {
2375                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2376                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2377                         break;
2378                 i++;
2379                 if (i >= 20) {
2380                         b43err(dev->wl, "Microcode not responding\n");
2381                         b43_print_fw_helptext(dev->wl, 1);
2382                         err = -ENODEV;
2383                         goto error;
2384                 }
2385                 msleep(50);
2386         }
2387         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2388
2389         /* Get and check the revisions. */
2390         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2391         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2392         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2393         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2394
2395         if (fwrev <= 0x128) {
2396                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2397                        "binary drivers older than version 4.x is unsupported. "
2398                        "You must upgrade your firmware files.\n");
2399                 b43_print_fw_helptext(dev->wl, 1);
2400                 err = -EOPNOTSUPP;
2401                 goto error;
2402         }
2403         dev->fw.rev = fwrev;
2404         dev->fw.patch = fwpatch;
2405         dev->fw.opensource = (fwdate == 0xFFFF);
2406
2407         /* Default to use-all-queues. */
2408         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2409         dev->qos_enabled = !!modparam_qos;
2410         /* Default to firmware/hardware crypto acceleration. */
2411         dev->hwcrypto_enabled = 1;
2412
2413         if (dev->fw.opensource) {
2414                 u16 fwcapa;
2415
2416                 /* Patchlevel info is encoded in the "time" field. */
2417                 dev->fw.patch = fwtime;
2418                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2419                         dev->fw.rev, dev->fw.patch);
2420
2421                 fwcapa = b43_fwcapa_read(dev);
2422                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2423                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2424                         /* Disable hardware crypto and fall back to software crypto. */
2425                         dev->hwcrypto_enabled = 0;
2426                 }
2427                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2428                         b43info(dev->wl, "QoS not supported by firmware\n");
2429                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2430                          * ieee80211_unregister to make sure the networking core can
2431                          * properly free possible resources. */
2432                         dev->wl->hw->queues = 1;
2433                         dev->qos_enabled = 0;
2434                 }
2435         } else {
2436                 b43info(dev->wl, "Loading firmware version %u.%u "
2437                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2438                         fwrev, fwpatch,
2439                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2440                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2441                 if (dev->fw.pcm_request_failed) {
2442                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2443                                 "Hardware accelerated cryptography is disabled.\n");
2444                         b43_print_fw_helptext(dev->wl, 0);
2445                 }
2446         }
2447
2448         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2449                         dev->fw.rev, dev->fw.patch);
2450         wiphy->hw_version = dev->sdev->id.coreid;
2451
2452         if (b43_is_old_txhdr_format(dev)) {
2453                 /* We're over the deadline, but we keep support for old fw
2454                  * until it turns out to be in major conflict with something new. */
2455                 b43warn(dev->wl, "You are using an old firmware image. "
2456                         "Support for old firmware will be removed soon "
2457                         "(official deadline was July 2008).\n");
2458                 b43_print_fw_helptext(dev->wl, 0);
2459         }
2460
2461         return 0;
2462
2463 error:
2464         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2465         macctl &= ~B43_MACCTL_PSM_RUN;
2466         macctl |= B43_MACCTL_PSM_JMP0;
2467         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2468
2469         return err;
2470 }
2471
2472 static int b43_write_initvals(struct b43_wldev *dev,
2473                               const struct b43_iv *ivals,
2474                               size_t count,
2475                               size_t array_size)
2476 {
2477         const struct b43_iv *iv;
2478         u16 offset;
2479         size_t i;
2480         bool bit32;
2481
2482         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2483         iv = ivals;
2484         for (i = 0; i < count; i++) {
2485                 if (array_size < sizeof(iv->offset_size))
2486                         goto err_format;
2487                 array_size -= sizeof(iv->offset_size);
2488                 offset = be16_to_cpu(iv->offset_size);
2489                 bit32 = !!(offset & B43_IV_32BIT);
2490                 offset &= B43_IV_OFFSET_MASK;
2491                 if (offset >= 0x1000)
2492                         goto err_format;
2493                 if (bit32) {
2494                         u32 value;
2495
2496                         if (array_size < sizeof(iv->data.d32))
2497                                 goto err_format;
2498                         array_size -= sizeof(iv->data.d32);
2499
2500                         value = get_unaligned_be32(&iv->data.d32);
2501                         b43_write32(dev, offset, value);
2502
2503                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2504                                                         sizeof(__be16) +
2505                                                         sizeof(__be32));
2506                 } else {
2507                         u16 value;
2508
2509                         if (array_size < sizeof(iv->data.d16))
2510                                 goto err_format;
2511                         array_size -= sizeof(iv->data.d16);
2512
2513                         value = be16_to_cpu(iv->data.d16);
2514                         b43_write16(dev, offset, value);
2515
2516                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2517                                                         sizeof(__be16) +
2518                                                         sizeof(__be16));
2519                 }
2520         }
2521         if (array_size)
2522                 goto err_format;
2523
2524         return 0;
2525
2526 err_format:
2527         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2528         b43_print_fw_helptext(dev->wl, 1);
2529
2530         return -EPROTO;
2531 }
2532
2533 static int b43_upload_initvals(struct b43_wldev *dev)
2534 {
2535         const size_t hdr_len = sizeof(struct b43_fw_header);
2536         const struct b43_fw_header *hdr;
2537         struct b43_firmware *fw = &dev->fw;
2538         const struct b43_iv *ivals;
2539         size_t count;
2540         int err;
2541
2542         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2543         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2544         count = be32_to_cpu(hdr->size);
2545         err = b43_write_initvals(dev, ivals, count,
2546                                  fw->initvals.data->size - hdr_len);
2547         if (err)
2548                 goto out;
2549         if (fw->initvals_band.data) {
2550                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2551                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2552                 count = be32_to_cpu(hdr->size);
2553                 err = b43_write_initvals(dev, ivals, count,
2554                                          fw->initvals_band.data->size - hdr_len);
2555                 if (err)
2556                         goto out;
2557         }
2558 out:
2559
2560         return err;
2561 }
2562
2563 /* Initialize the GPIOs
2564  * http://bcm-specs.sipsolutions.net/GPIO
2565  */
2566 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2567 {
2568         struct ssb_bus *bus = dev->sdev->bus;
2569
2570 #ifdef CONFIG_SSB_DRIVER_PCICORE
2571         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2572 #else
2573         return bus->chipco.dev;
2574 #endif
2575 }
2576
2577 static int b43_gpio_init(struct b43_wldev *dev)
2578 {
2579         struct ssb_device *gpiodev;
2580         u32 mask, set;
2581
2582         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2583                     & ~B43_MACCTL_GPOUTSMSK);
2584
2585         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2586                     | 0x000F);
2587
2588         mask = 0x0000001F;
2589         set = 0x0000000F;
2590         if (dev->sdev->bus->chip_id == 0x4301) {
2591                 mask |= 0x0060;
2592                 set |= 0x0060;
2593         }
2594         if (0 /* FIXME: conditional unknown */ ) {
2595                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2596                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2597                             | 0x0100);
2598                 mask |= 0x0180;
2599                 set |= 0x0180;
2600         }
2601         if (dev->sdev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2602                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2603                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2604                             | 0x0200);
2605                 mask |= 0x0200;
2606                 set |= 0x0200;
2607         }
2608         if (dev->sdev->id.revision >= 2)
2609                 mask |= 0x0010; /* FIXME: This is redundant. */
2610
2611         gpiodev = b43_ssb_gpio_dev(dev);
2612         if (gpiodev)
2613                 ssb_write32(gpiodev, B43_GPIO_CONTROL,
2614                             (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2615                              & mask) | set);
2616
2617         return 0;
2618 }
2619
2620 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2621 static void b43_gpio_cleanup(struct b43_wldev *dev)
2622 {
2623         struct ssb_device *gpiodev;
2624
2625         gpiodev = b43_ssb_gpio_dev(dev);
2626         if (gpiodev)
2627                 ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2628 }
2629
2630 /* http://bcm-specs.sipsolutions.net/EnableMac */
2631 void b43_mac_enable(struct b43_wldev *dev)
2632 {
2633         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2634                 u16 fwstate;
2635
2636                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2637                                          B43_SHM_SH_UCODESTAT);
2638                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2639                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2640                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2641                                "should be suspended, but current state is %u\n",
2642                                fwstate);
2643                 }
2644         }
2645
2646         dev->mac_suspended--;
2647         B43_WARN_ON(dev->mac_suspended < 0);
2648         if (dev->mac_suspended == 0) {
2649                 b43_write32(dev, B43_MMIO_MACCTL,
2650                             b43_read32(dev, B43_MMIO_MACCTL)
2651                             | B43_MACCTL_ENABLED);
2652                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2653                             B43_IRQ_MAC_SUSPENDED);
2654                 /* Commit writes */
2655                 b43_read32(dev, B43_MMIO_MACCTL);
2656                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2657                 b43_power_saving_ctl_bits(dev, 0);
2658         }
2659 }
2660
2661 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2662 void b43_mac_suspend(struct b43_wldev *dev)
2663 {
2664         int i;
2665         u32 tmp;
2666
2667         might_sleep();
2668         B43_WARN_ON(dev->mac_suspended < 0);
2669
2670         if (dev->mac_suspended == 0) {
2671                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2672                 b43_write32(dev, B43_MMIO_MACCTL,
2673                             b43_read32(dev, B43_MMIO_MACCTL)
2674                             & ~B43_MACCTL_ENABLED);
2675                 /* force pci to flush the write */
2676                 b43_read32(dev, B43_MMIO_MACCTL);
2677                 for (i = 35; i; i--) {
2678                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2679                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2680                                 goto out;
2681                         udelay(10);
2682                 }
2683                 /* Hm, it seems this will take some time. Use msleep(). */
2684                 for (i = 40; i; i--) {
2685                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2686                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2687                                 goto out;
2688                         msleep(1);
2689                 }
2690                 b43err(dev->wl, "MAC suspend failed\n");
2691         }
2692 out:
2693         dev->mac_suspended++;
2694 }
2695
2696 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2697 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2698 {
2699         u32 tmslow = ssb_read32(dev->sdev, SSB_TMSLOW);
2700         if (on)
2701                 tmslow |= B43_TMSLOW_MACPHYCLKEN;
2702         else
2703                 tmslow &= ~B43_TMSLOW_MACPHYCLKEN;
2704         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
2705 }
2706
2707 static void b43_adjust_opmode(struct b43_wldev *dev)
2708 {
2709         struct b43_wl *wl = dev->wl;
2710         u32 ctl;
2711         u16 cfp_pretbtt;
2712
2713         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2714         /* Reset status to STA infrastructure mode. */
2715         ctl &= ~B43_MACCTL_AP;
2716         ctl &= ~B43_MACCTL_KEEP_CTL;
2717         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2718         ctl &= ~B43_MACCTL_KEEP_BAD;
2719         ctl &= ~B43_MACCTL_PROMISC;
2720         ctl &= ~B43_MACCTL_BEACPROMISC;
2721         ctl |= B43_MACCTL_INFRA;
2722
2723         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2724             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2725                 ctl |= B43_MACCTL_AP;
2726         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2727                 ctl &= ~B43_MACCTL_INFRA;
2728
2729         if (wl->filter_flags & FIF_CONTROL)
2730                 ctl |= B43_MACCTL_KEEP_CTL;
2731         if (wl->filter_flags & FIF_FCSFAIL)
2732                 ctl |= B43_MACCTL_KEEP_BAD;
2733         if (wl->filter_flags & FIF_PLCPFAIL)
2734                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2735         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2736                 ctl |= B43_MACCTL_PROMISC;
2737         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2738                 ctl |= B43_MACCTL_BEACPROMISC;
2739
2740         /* Workaround: On old hardware the HW-MAC-address-filter
2741          * doesn't work properly, so always run promisc in filter
2742          * it in software. */
2743         if (dev->sdev->id.revision <= 4)
2744                 ctl |= B43_MACCTL_PROMISC;
2745
2746         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2747
2748         cfp_pretbtt = 2;
2749         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2750                 if (dev->sdev->bus->chip_id == 0x4306 &&
2751                     dev->sdev->bus->chip_rev == 3)
2752                         cfp_pretbtt = 100;
2753                 else
2754                         cfp_pretbtt = 50;
2755         }
2756         b43_write16(dev, 0x612, cfp_pretbtt);
2757
2758         /* FIXME: We don't currently implement the PMQ mechanism,
2759          *        so always disable it. If we want to implement PMQ,
2760          *        we need to enable it here (clear DISCPMQ) in AP mode.
2761          */
2762         if (0  /* ctl & B43_MACCTL_AP */) {
2763                 b43_write32(dev, B43_MMIO_MACCTL,
2764                             b43_read32(dev, B43_MMIO_MACCTL)
2765                             & ~B43_MACCTL_DISCPMQ);
2766         } else {
2767                 b43_write32(dev, B43_MMIO_MACCTL,
2768                             b43_read32(dev, B43_MMIO_MACCTL)
2769                             | B43_MACCTL_DISCPMQ);
2770         }
2771 }
2772
2773 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2774 {
2775         u16 offset;
2776
2777         if (is_ofdm) {
2778                 offset = 0x480;
2779                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2780         } else {
2781                 offset = 0x4C0;
2782                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2783         }
2784         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2785                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2786 }
2787
2788 static void b43_rate_memory_init(struct b43_wldev *dev)
2789 {
2790         switch (dev->phy.type) {
2791         case B43_PHYTYPE_A:
2792         case B43_PHYTYPE_G:
2793         case B43_PHYTYPE_N:
2794         case B43_PHYTYPE_LP:
2795                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2796                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2797                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2798                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2799                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2800                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2801                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2802                 if (dev->phy.type == B43_PHYTYPE_A)
2803                         break;
2804                 /* fallthrough */
2805         case B43_PHYTYPE_B:
2806                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2807                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2808                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2809                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2810                 break;
2811         default:
2812                 B43_WARN_ON(1);
2813         }
2814 }
2815
2816 /* Set the default values for the PHY TX Control Words. */
2817 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2818 {
2819         u16 ctl = 0;
2820
2821         ctl |= B43_TXH_PHY_ENC_CCK;
2822         ctl |= B43_TXH_PHY_ANT01AUTO;
2823         ctl |= B43_TXH_PHY_TXPWR;
2824
2825         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2826         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2827         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2828 }
2829
2830 /* Set the TX-Antenna for management frames sent by firmware. */
2831 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2832 {
2833         u16 ant;
2834         u16 tmp;
2835
2836         ant = b43_antenna_to_phyctl(antenna);
2837
2838         /* For ACK/CTS */
2839         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2840         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2841         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2842         /* For Probe Resposes */
2843         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2844         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2845         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2846 }
2847
2848 /* This is the opposite of b43_chip_init() */
2849 static void b43_chip_exit(struct b43_wldev *dev)
2850 {
2851         b43_phy_exit(dev);
2852         b43_gpio_cleanup(dev);
2853         /* firmware is released later */
2854 }
2855
2856 /* Initialize the chip
2857  * http://bcm-specs.sipsolutions.net/ChipInit
2858  */
2859 static int b43_chip_init(struct b43_wldev *dev)
2860 {
2861         struct b43_phy *phy = &dev->phy;
2862         int err;
2863         u32 macctl;
2864         u16 value16;
2865
2866         /* Initialize the MAC control */
2867         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2868         if (dev->phy.gmode)
2869                 macctl |= B43_MACCTL_GMODE;
2870         macctl |= B43_MACCTL_INFRA;
2871         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2872
2873         err = b43_request_firmware(dev);
2874         if (err)
2875                 goto out;
2876         err = b43_upload_microcode(dev);
2877         if (err)
2878                 goto out;       /* firmware is released later */
2879
2880         err = b43_gpio_init(dev);
2881         if (err)
2882                 goto out;       /* firmware is released later */
2883
2884         err = b43_upload_initvals(dev);
2885         if (err)
2886                 goto err_gpio_clean;
2887
2888         /* Turn the Analog on and initialize the PHY. */
2889         phy->ops->switch_analog(dev, 1);
2890         err = b43_phy_init(dev);
2891         if (err)
2892                 goto err_gpio_clean;
2893
2894         /* Disable Interference Mitigation. */
2895         if (phy->ops->interf_mitigation)
2896                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2897
2898         /* Select the antennae */
2899         if (phy->ops->set_rx_antenna)
2900                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2901         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2902
2903         if (phy->type == B43_PHYTYPE_B) {
2904                 value16 = b43_read16(dev, 0x005E);
2905                 value16 |= 0x0004;
2906                 b43_write16(dev, 0x005E, value16);
2907         }
2908         b43_write32(dev, 0x0100, 0x01000000);
2909         if (dev->sdev->id.revision < 5)
2910                 b43_write32(dev, 0x010C, 0x01000000);
2911
2912         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2913                     & ~B43_MACCTL_INFRA);
2914         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2915                     | B43_MACCTL_INFRA);
2916
2917         /* Probe Response Timeout value */
2918         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2919         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2920
2921         /* Initially set the wireless operation mode. */
2922         b43_adjust_opmode(dev);
2923
2924         if (dev->sdev->id.revision < 3) {
2925                 b43_write16(dev, 0x060E, 0x0000);
2926                 b43_write16(dev, 0x0610, 0x8000);
2927                 b43_write16(dev, 0x0604, 0x0000);
2928                 b43_write16(dev, 0x0606, 0x0200);
2929         } else {
2930                 b43_write32(dev, 0x0188, 0x80000000);
2931                 b43_write32(dev, 0x018C, 0x02000000);
2932         }
2933         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2934         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2935         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2936         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2937         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2938         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2939         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2940
2941         b43_mac_phy_clock_set(dev, true);
2942
2943         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2944                     dev->sdev->bus->chipco.fast_pwrup_delay);
2945
2946         err = 0;
2947         b43dbg(dev->wl, "Chip initialized\n");
2948 out:
2949         return err;
2950
2951 err_gpio_clean:
2952         b43_gpio_cleanup(dev);
2953         return err;
2954 }
2955
2956 static void b43_periodic_every60sec(struct b43_wldev *dev)
2957 {
2958         const struct b43_phy_operations *ops = dev->phy.ops;
2959
2960         if (ops->pwork_60sec)
2961                 ops->pwork_60sec(dev);
2962
2963         /* Force check the TX power emission now. */
2964         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2965 }
2966
2967 static void b43_periodic_every30sec(struct b43_wldev *dev)
2968 {
2969         /* Update device statistics. */
2970         b43_calculate_link_quality(dev);
2971 }
2972
2973 static void b43_periodic_every15sec(struct b43_wldev *dev)
2974 {
2975         struct b43_phy *phy = &dev->phy;
2976         u16 wdr;
2977
2978         if (dev->fw.opensource) {
2979                 /* Check if the firmware is still alive.
2980                  * It will reset the watchdog counter to 0 in its idle loop. */
2981                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2982                 if (unlikely(wdr)) {
2983                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2984                         b43_controller_restart(dev, "Firmware watchdog");
2985                         return;
2986                 } else {
2987                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2988                                         B43_WATCHDOG_REG, 1);
2989                 }
2990         }
2991
2992         if (phy->ops->pwork_15sec)
2993                 phy->ops->pwork_15sec(dev);
2994
2995         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2996         wmb();
2997
2998 #if B43_DEBUG
2999         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3000                 unsigned int i;
3001
3002                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3003                        dev->irq_count / 15,
3004                        dev->tx_count / 15,
3005                        dev->rx_count / 15);
3006                 dev->irq_count = 0;
3007                 dev->tx_count = 0;
3008                 dev->rx_count = 0;
3009                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3010                         if (dev->irq_bit_count[i]) {
3011                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3012                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3013                                 dev->irq_bit_count[i] = 0;
3014                         }
3015                 }
3016         }
3017 #endif
3018 }
3019
3020 static void do_periodic_work(struct b43_wldev *dev)
3021 {
3022         unsigned int state;
3023
3024         state = dev->periodic_state;
3025         if (state % 4 == 0)
3026                 b43_periodic_every60sec(dev);
3027         if (state % 2 == 0)
3028                 b43_periodic_every30sec(dev);
3029         b43_periodic_every15sec(dev);
3030 }
3031
3032 /* Periodic work locking policy:
3033  *      The whole periodic work handler is protected by
3034  *      wl->mutex. If another lock is needed somewhere in the
3035  *      pwork callchain, it's acquired in-place, where it's needed.
3036  */
3037 static void b43_periodic_work_handler(struct work_struct *work)
3038 {
3039         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3040                                              periodic_work.work);
3041         struct b43_wl *wl = dev->wl;
3042         unsigned long delay;
3043
3044         mutex_lock(&wl->mutex);
3045
3046         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3047                 goto out;
3048         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3049                 goto out_requeue;
3050
3051         do_periodic_work(dev);
3052
3053         dev->periodic_state++;
3054 out_requeue:
3055         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3056                 delay = msecs_to_jiffies(50);
3057         else
3058                 delay = round_jiffies_relative(HZ * 15);
3059         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3060 out:
3061         mutex_unlock(&wl->mutex);
3062 }
3063
3064 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3065 {
3066         struct delayed_work *work = &dev->periodic_work;
3067
3068         dev->periodic_state = 0;
3069         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3070         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3071 }
3072
3073 /* Check if communication with the device works correctly. */
3074 static int b43_validate_chipaccess(struct b43_wldev *dev)
3075 {
3076         u32 v, backup0, backup4;
3077
3078         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3079         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3080
3081         /* Check for read/write and endianness problems. */
3082         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3083         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3084                 goto error;
3085         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3086         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3087                 goto error;
3088
3089         /* Check if unaligned 32bit SHM_SHARED access works properly.
3090          * However, don't bail out on failure, because it's noncritical. */
3091         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3092         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3093         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3094         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3095         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3096                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3097         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3098         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3099             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3100             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3101             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3102                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3103
3104         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3105         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3106
3107         if ((dev->sdev->id.revision >= 3) && (dev->sdev->id.revision <= 10)) {
3108                 /* The 32bit register shadows the two 16bit registers
3109                  * with update sideeffects. Validate this. */
3110                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3111                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3112                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3113                         goto error;
3114                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3115                         goto error;
3116         }
3117         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3118
3119         v = b43_read32(dev, B43_MMIO_MACCTL);
3120         v |= B43_MACCTL_GMODE;
3121         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3122                 goto error;
3123
3124         return 0;
3125 error:
3126         b43err(dev->wl, "Failed to validate the chipaccess\n");
3127         return -ENODEV;
3128 }
3129
3130 static void b43_security_init(struct b43_wldev *dev)
3131 {
3132         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3133         /* KTP is a word address, but we address SHM bytewise.
3134          * So multiply by two.
3135          */
3136         dev->ktp *= 2;
3137         /* Number of RCMTA address slots */
3138         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3139         /* Clear the key memory. */
3140         b43_clear_keys(dev);
3141 }
3142
3143 #ifdef CONFIG_B43_HWRNG
3144 static int b43_rng_read(struct hwrng *rng, u32 *data)
3145 {
3146         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3147         struct b43_wldev *dev;
3148         int count = -ENODEV;
3149
3150         mutex_lock(&wl->mutex);
3151         dev = wl->current_dev;
3152         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3153                 *data = b43_read16(dev, B43_MMIO_RNG);
3154                 count = sizeof(u16);
3155         }
3156         mutex_unlock(&wl->mutex);
3157
3158         return count;
3159 }
3160 #endif /* CONFIG_B43_HWRNG */
3161
3162 static void b43_rng_exit(struct b43_wl *wl)
3163 {
3164 #ifdef CONFIG_B43_HWRNG
3165         if (wl->rng_initialized)
3166                 hwrng_unregister(&wl->rng);
3167 #endif /* CONFIG_B43_HWRNG */
3168 }
3169
3170 static int b43_rng_init(struct b43_wl *wl)
3171 {
3172         int err = 0;
3173
3174 #ifdef CONFIG_B43_HWRNG
3175         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3176                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3177         wl->rng.name = wl->rng_name;
3178         wl->rng.data_read = b43_rng_read;
3179         wl->rng.priv = (unsigned long)wl;
3180         wl->rng_initialized = 1;
3181         err = hwrng_register(&wl->rng);
3182         if (err) {
3183                 wl->rng_initialized = 0;
3184                 b43err(wl, "Failed to register the random "
3185                        "number generator (%d)\n", err);
3186         }
3187 #endif /* CONFIG_B43_HWRNG */
3188
3189         return err;
3190 }
3191
3192 static void b43_tx_work(struct work_struct *work)
3193 {
3194         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3195         struct b43_wldev *dev;
3196         struct sk_buff *skb;
3197         int err = 0;
3198
3199         mutex_lock(&wl->mutex);
3200         dev = wl->current_dev;
3201         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3202                 mutex_unlock(&wl->mutex);
3203                 return;
3204         }
3205
3206         while (skb_queue_len(&wl->tx_queue)) {
3207                 skb = skb_dequeue(&wl->tx_queue);
3208
3209                 if (b43_using_pio_transfers(dev))
3210                         err = b43_pio_tx(dev, skb);
3211                 else
3212                         err = b43_dma_tx(dev, skb);
3213                 if (unlikely(err))
3214                         dev_kfree_skb(skb); /* Drop it */
3215         }
3216
3217 #if B43_DEBUG
3218         dev->tx_count++;
3219 #endif
3220         mutex_unlock(&wl->mutex);
3221 }
3222
3223 static void b43_op_tx(struct ieee80211_hw *hw,
3224                      struct sk_buff *skb)
3225 {
3226         struct b43_wl *wl = hw_to_b43_wl(hw);
3227
3228         if (unlikely(skb->len < 2 + 2 + 6)) {
3229                 /* Too short, this can't be a valid frame. */
3230                 dev_kfree_skb_any(skb);
3231                 return;
3232         }
3233         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3234
3235         skb_queue_tail(&wl->tx_queue, skb);
3236         ieee80211_queue_work(wl->hw, &wl->tx_work);
3237 }
3238
3239 static void b43_qos_params_upload(struct b43_wldev *dev,
3240                                   const struct ieee80211_tx_queue_params *p,
3241                                   u16 shm_offset)
3242 {
3243         u16 params[B43_NR_QOSPARAMS];
3244         int bslots, tmp;
3245         unsigned int i;
3246
3247         if (!dev->qos_enabled)
3248                 return;
3249
3250         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3251
3252         memset(&params, 0, sizeof(params));
3253
3254         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3255         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3256         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3257         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3258         params[B43_QOSPARAM_AIFS] = p->aifs;
3259         params[B43_QOSPARAM_BSLOTS] = bslots;
3260         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3261
3262         for (i = 0; i < ARRAY_SIZE(params); i++) {
3263                 if (i == B43_QOSPARAM_STATUS) {
3264                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3265                                              shm_offset + (i * 2));
3266                         /* Mark the parameters as updated. */
3267                         tmp |= 0x100;
3268                         b43_shm_write16(dev, B43_SHM_SHARED,
3269                                         shm_offset + (i * 2),
3270                                         tmp);
3271                 } else {
3272                         b43_shm_write16(dev, B43_SHM_SHARED,
3273                                         shm_offset + (i * 2),
3274                                         params[i]);
3275                 }
3276         }
3277 }
3278
3279 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3280 static const u16 b43_qos_shm_offsets[] = {
3281         /* [mac80211-queue-nr] = SHM_OFFSET, */
3282         [0] = B43_QOS_VOICE,
3283         [1] = B43_QOS_VIDEO,
3284         [2] = B43_QOS_BESTEFFORT,
3285         [3] = B43_QOS_BACKGROUND,
3286 };
3287
3288 /* Update all QOS parameters in hardware. */
3289 static void b43_qos_upload_all(struct b43_wldev *dev)
3290 {
3291         struct b43_wl *wl = dev->wl;
3292         struct b43_qos_params *params;
3293         unsigned int i;
3294
3295         if (!dev->qos_enabled)
3296                 return;
3297
3298         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3299                      ARRAY_SIZE(wl->qos_params));
3300
3301         b43_mac_suspend(dev);
3302         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3303                 params = &(wl->qos_params[i]);
3304                 b43_qos_params_upload(dev, &(params->p),
3305                                       b43_qos_shm_offsets[i]);
3306         }
3307         b43_mac_enable(dev);
3308 }
3309
3310 static void b43_qos_clear(struct b43_wl *wl)
3311 {
3312         struct b43_qos_params *params;
3313         unsigned int i;
3314
3315         /* Initialize QoS parameters to sane defaults. */
3316
3317         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3318                      ARRAY_SIZE(wl->qos_params));
3319
3320         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3321                 params = &(wl->qos_params[i]);
3322
3323                 switch (b43_qos_shm_offsets[i]) {
3324                 case B43_QOS_VOICE:
3325                         params->p.txop = 0;
3326                         params->p.aifs = 2;
3327                         params->p.cw_min = 0x0001;
3328                         params->p.cw_max = 0x0001;
3329                         break;
3330                 case B43_QOS_VIDEO:
3331                         params->p.txop = 0;
3332                         params->p.aifs = 2;
3333                         params->p.cw_min = 0x0001;
3334                         params->p.cw_max = 0x0001;
3335                         break;
3336                 case B43_QOS_BESTEFFORT:
3337                         params->p.txop = 0;
3338                         params->p.aifs = 3;
3339                         params->p.cw_min = 0x0001;
3340                         params->p.cw_max = 0x03FF;
3341                         break;
3342                 case B43_QOS_BACKGROUND:
3343                         params->p.txop = 0;
3344                         params->p.aifs = 7;
3345                         params->p.cw_min = 0x0001;
3346                         params->p.cw_max = 0x03FF;
3347                         break;
3348                 default:
3349                         B43_WARN_ON(1);
3350                 }
3351         }
3352 }
3353
3354 /* Initialize the core's QOS capabilities */
3355 static void b43_qos_init(struct b43_wldev *dev)
3356 {
3357         if (!dev->qos_enabled) {
3358                 /* Disable QOS support. */
3359                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3360                 b43_write16(dev, B43_MMIO_IFSCTL,
3361                             b43_read16(dev, B43_MMIO_IFSCTL)
3362                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3363                 b43dbg(dev->wl, "QoS disabled\n");
3364                 return;
3365         }
3366
3367         /* Upload the current QOS parameters. */
3368         b43_qos_upload_all(dev);
3369
3370         /* Enable QOS support. */
3371         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3372         b43_write16(dev, B43_MMIO_IFSCTL,
3373                     b43_read16(dev, B43_MMIO_IFSCTL)
3374                     | B43_MMIO_IFSCTL_USE_EDCF);
3375         b43dbg(dev->wl, "QoS enabled\n");
3376 }
3377
3378 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3379                           const struct ieee80211_tx_queue_params *params)
3380 {
3381         struct b43_wl *wl = hw_to_b43_wl(hw);
3382         struct b43_wldev *dev;
3383         unsigned int queue = (unsigned int)_queue;
3384         int err = -ENODEV;
3385
3386         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3387                 /* Queue not available or don't support setting
3388                  * params on this queue. Return success to not
3389                  * confuse mac80211. */
3390                 return 0;
3391         }
3392         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3393                      ARRAY_SIZE(wl->qos_params));
3394
3395         mutex_lock(&wl->mutex);
3396         dev = wl->current_dev;
3397         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3398                 goto out_unlock;
3399
3400         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3401         b43_mac_suspend(dev);
3402         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3403                               b43_qos_shm_offsets[queue]);
3404         b43_mac_enable(dev);
3405         err = 0;
3406
3407 out_unlock:
3408         mutex_unlock(&wl->mutex);
3409
3410         return err;
3411 }
3412
3413 static int b43_op_get_stats(struct ieee80211_hw *hw,
3414                             struct ieee80211_low_level_stats *stats)
3415 {
3416         struct b43_wl *wl = hw_to_b43_wl(hw);
3417
3418         mutex_lock(&wl->mutex);
3419         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3420         mutex_unlock(&wl->mutex);
3421
3422         return 0;
3423 }
3424
3425 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3426 {
3427         struct b43_wl *wl = hw_to_b43_wl(hw);
3428         struct b43_wldev *dev;
3429         u64 tsf;
3430
3431         mutex_lock(&wl->mutex);
3432         dev = wl->current_dev;
3433
3434         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3435                 b43_tsf_read(dev, &tsf);
3436         else
3437                 tsf = 0;
3438
3439         mutex_unlock(&wl->mutex);
3440
3441         return tsf;
3442 }
3443
3444 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3445 {
3446         struct b43_wl *wl = hw_to_b43_wl(hw);
3447         struct b43_wldev *dev;
3448
3449         mutex_lock(&wl->mutex);
3450         dev = wl->current_dev;
3451
3452         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3453                 b43_tsf_write(dev, tsf);
3454
3455         mutex_unlock(&wl->mutex);
3456 }
3457
3458 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3459 {
3460         struct ssb_device *sdev = dev->sdev;
3461         u32 tmslow;
3462
3463         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3464         tmslow &= ~B43_TMSLOW_GMODE;
3465         tmslow |= B43_TMSLOW_PHYRESET;
3466         tmslow |= SSB_TMSLOW_FGC;
3467         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3468         msleep(1);
3469
3470         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3471         tmslow &= ~SSB_TMSLOW_FGC;
3472         tmslow |= B43_TMSLOW_PHYRESET;
3473         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3474         msleep(1);
3475 }
3476
3477 static const char *band_to_string(enum ieee80211_band band)
3478 {
3479         switch (band) {
3480         case IEEE80211_BAND_5GHZ:
3481                 return "5";
3482         case IEEE80211_BAND_2GHZ:
3483                 return "2.4";
3484         default:
3485                 break;
3486         }
3487         B43_WARN_ON(1);
3488         return "";
3489 }
3490
3491 /* Expects wl->mutex locked */
3492 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3493 {
3494         struct b43_wldev *up_dev = NULL;
3495         struct b43_wldev *down_dev;
3496         struct b43_wldev *d;
3497         int err;
3498         bool uninitialized_var(gmode);
3499         int prev_status;
3500
3501         /* Find a device and PHY which supports the band. */
3502         list_for_each_entry(d, &wl->devlist, list) {
3503                 switch (chan->band) {
3504                 case IEEE80211_BAND_5GHZ:
3505                         if (d->phy.supports_5ghz) {
3506                                 up_dev = d;
3507                                 gmode = 0;
3508                         }
3509                         break;
3510                 case IEEE80211_BAND_2GHZ:
3511                         if (d->phy.supports_2ghz) {
3512                                 up_dev = d;
3513                                 gmode = 1;
3514                         }
3515                         break;
3516                 default:
3517                         B43_WARN_ON(1);
3518                         return -EINVAL;
3519                 }
3520                 if (up_dev)
3521                         break;
3522         }
3523         if (!up_dev) {
3524                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3525                        band_to_string(chan->band));
3526                 return -ENODEV;
3527         }
3528         if ((up_dev == wl->current_dev) &&
3529             (!!wl->current_dev->phy.gmode == !!gmode)) {
3530                 /* This device is already running. */
3531                 return 0;
3532         }
3533         b43dbg(wl, "Switching to %s-GHz band\n",
3534                band_to_string(chan->band));
3535         down_dev = wl->current_dev;
3536
3537         prev_status = b43_status(down_dev);
3538         /* Shutdown the currently running core. */
3539         if (prev_status >= B43_STAT_STARTED)
3540                 down_dev = b43_wireless_core_stop(down_dev);
3541         if (prev_status >= B43_STAT_INITIALIZED)
3542                 b43_wireless_core_exit(down_dev);
3543
3544         if (down_dev != up_dev) {
3545                 /* We switch to a different core, so we put PHY into
3546                  * RESET on the old core. */
3547                 b43_put_phy_into_reset(down_dev);
3548         }
3549
3550         /* Now start the new core. */
3551         up_dev->phy.gmode = gmode;
3552         if (prev_status >= B43_STAT_INITIALIZED) {
3553                 err = b43_wireless_core_init(up_dev);
3554                 if (err) {
3555                         b43err(wl, "Fatal: Could not initialize device for "
3556                                "selected %s-GHz band\n",
3557                                band_to_string(chan->band));
3558                         goto init_failure;
3559                 }
3560         }
3561         if (prev_status >= B43_STAT_STARTED) {
3562                 err = b43_wireless_core_start(up_dev);
3563                 if (err) {
3564                         b43err(wl, "Fatal: Coult not start device for "
3565                                "selected %s-GHz band\n",
3566                                band_to_string(chan->band));
3567                         b43_wireless_core_exit(up_dev);
3568                         goto init_failure;
3569                 }
3570         }
3571         B43_WARN_ON(b43_status(up_dev) != prev_status);
3572
3573         wl->current_dev = up_dev;
3574
3575         return 0;
3576 init_failure:
3577         /* Whoops, failed to init the new core. No core is operating now. */
3578         wl->current_dev = NULL;
3579         return err;
3580 }
3581
3582 /* Write the short and long frame retry limit values. */
3583 static void b43_set_retry_limits(struct b43_wldev *dev,
3584                                  unsigned int short_retry,
3585                                  unsigned int long_retry)
3586 {
3587         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3588          * the chip-internal counter. */
3589         short_retry = min(short_retry, (unsigned int)0xF);
3590         long_retry = min(long_retry, (unsigned int)0xF);
3591
3592         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3593                         short_retry);
3594         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3595                         long_retry);
3596 }
3597
3598 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3599 {
3600         struct b43_wl *wl = hw_to_b43_wl(hw);
3601         struct b43_wldev *dev;
3602         struct b43_phy *phy;
3603         struct ieee80211_conf *conf = &hw->conf;
3604         int antenna;
3605         int err = 0;
3606
3607         mutex_lock(&wl->mutex);
3608
3609         /* Switch the band (if necessary). This might change the active core. */
3610         err = b43_switch_band(wl, conf->channel);
3611         if (err)
3612                 goto out_unlock_mutex;
3613         dev = wl->current_dev;
3614         phy = &dev->phy;
3615
3616         if (conf_is_ht(conf))
3617                 phy->is_40mhz =
3618                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3619         else
3620                 phy->is_40mhz = false;
3621
3622         b43_mac_suspend(dev);
3623
3624         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3625                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3626                                           conf->long_frame_max_tx_count);
3627         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3628         if (!changed)
3629                 goto out_mac_enable;
3630
3631         /* Switch to the requested channel.
3632          * The firmware takes care of races with the TX handler. */
3633         if (conf->channel->hw_value != phy->channel)
3634                 b43_switch_channel(dev, conf->channel->hw_value);
3635
3636         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3637
3638         /* Adjust the desired TX power level. */
3639         if (conf->power_level != 0) {
3640                 if (conf->power_level != phy->desired_txpower) {
3641                         phy->desired_txpower = conf->power_level;
3642                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3643                                                    B43_TXPWR_IGNORE_TSSI);
3644                 }
3645         }
3646
3647         /* Antennas for RX and management frame TX. */
3648         antenna = B43_ANTENNA_DEFAULT;
3649         b43_mgmtframe_txantenna(dev, antenna);
3650         antenna = B43_ANTENNA_DEFAULT;
3651         if (phy->ops->set_rx_antenna)
3652                 phy->ops->set_rx_antenna(dev, antenna);
3653
3654         if (wl->radio_enabled != phy->radio_on) {
3655                 if (wl->radio_enabled) {
3656                         b43_software_rfkill(dev, false);
3657                         b43info(dev->wl, "Radio turned on by software\n");
3658                         if (!dev->radio_hw_enable) {
3659                                 b43info(dev->wl, "The hardware RF-kill button "
3660                                         "still turns the radio physically off. "
3661                                         "Press the button to turn it on.\n");
3662                         }
3663                 } else {
3664                         b43_software_rfkill(dev, true);
3665                         b43info(dev->wl, "Radio turned off by software\n");
3666                 }
3667         }
3668
3669 out_mac_enable:
3670         b43_mac_enable(dev);
3671 out_unlock_mutex:
3672         mutex_unlock(&wl->mutex);
3673
3674         return err;
3675 }
3676
3677 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3678 {
3679         struct ieee80211_supported_band *sband =
3680                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3681         struct ieee80211_rate *rate;
3682         int i;
3683         u16 basic, direct, offset, basic_offset, rateptr;
3684
3685         for (i = 0; i < sband->n_bitrates; i++) {
3686                 rate = &sband->bitrates[i];
3687
3688                 if (b43_is_cck_rate(rate->hw_value)) {
3689                         direct = B43_SHM_SH_CCKDIRECT;
3690                         basic = B43_SHM_SH_CCKBASIC;
3691                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3692                         offset &= 0xF;
3693                 } else {
3694                         direct = B43_SHM_SH_OFDMDIRECT;
3695                         basic = B43_SHM_SH_OFDMBASIC;
3696                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3697                         offset &= 0xF;
3698                 }
3699
3700                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3701
3702                 if (b43_is_cck_rate(rate->hw_value)) {
3703                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3704                         basic_offset &= 0xF;
3705                 } else {
3706                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3707                         basic_offset &= 0xF;
3708                 }
3709
3710                 /*
3711                  * Get the pointer that we need to point to
3712                  * from the direct map
3713                  */
3714                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3715                                          direct + 2 * basic_offset);
3716                 /* and write it to the basic map */
3717                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3718                                 rateptr);
3719         }
3720 }
3721
3722 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3723                                     struct ieee80211_vif *vif,
3724                                     struct ieee80211_bss_conf *conf,
3725                                     u32 changed)
3726 {
3727         struct b43_wl *wl = hw_to_b43_wl(hw);
3728         struct b43_wldev *dev;
3729
3730         mutex_lock(&wl->mutex);
3731
3732         dev = wl->current_dev;
3733         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3734                 goto out_unlock_mutex;
3735
3736         B43_WARN_ON(wl->vif != vif);
3737
3738         if (changed & BSS_CHANGED_BSSID) {
3739                 if (conf->bssid)
3740                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3741                 else
3742                         memset(wl->bssid, 0, ETH_ALEN);
3743         }
3744
3745         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3746                 if (changed & BSS_CHANGED_BEACON &&
3747                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3748                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3749                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3750                         b43_update_templates(wl);
3751
3752                 if (changed & BSS_CHANGED_BSSID)
3753                         b43_write_mac_bssid_templates(dev);
3754         }
3755
3756         b43_mac_suspend(dev);
3757
3758         /* Update templates for AP/mesh mode. */
3759         if (changed & BSS_CHANGED_BEACON_INT &&
3760             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3761              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3762              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3763                 b43_set_beacon_int(dev, conf->beacon_int);
3764
3765         if (changed & BSS_CHANGED_BASIC_RATES)
3766                 b43_update_basic_rates(dev, conf->basic_rates);
3767
3768         if (changed & BSS_CHANGED_ERP_SLOT) {
3769                 if (conf->use_short_slot)
3770                         b43_short_slot_timing_enable(dev);
3771                 else
3772                         b43_short_slot_timing_disable(dev);
3773         }
3774
3775         b43_mac_enable(dev);
3776 out_unlock_mutex:
3777         mutex_unlock(&wl->mutex);
3778 }
3779
3780 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3781                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3782                           struct ieee80211_key_conf *key)
3783 {
3784         struct b43_wl *wl = hw_to_b43_wl(hw);
3785         struct b43_wldev *dev;
3786         u8 algorithm;
3787         u8 index;
3788         int err;
3789         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3790
3791         if (modparam_nohwcrypt)
3792                 return -ENOSPC; /* User disabled HW-crypto */
3793
3794         mutex_lock(&wl->mutex);
3795
3796         dev = wl->current_dev;
3797         err = -ENODEV;
3798         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3799                 goto out_unlock;
3800
3801         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3802                 /* We don't have firmware for the crypto engine.
3803                  * Must use software-crypto. */
3804                 err = -EOPNOTSUPP;
3805                 goto out_unlock;
3806         }
3807
3808         err = -EINVAL;
3809         switch (key->cipher) {
3810         case WLAN_CIPHER_SUITE_WEP40:
3811                 algorithm = B43_SEC_ALGO_WEP40;
3812                 break;
3813         case WLAN_CIPHER_SUITE_WEP104:
3814                 algorithm = B43_SEC_ALGO_WEP104;
3815                 break;
3816         case WLAN_CIPHER_SUITE_TKIP:
3817                 algorithm = B43_SEC_ALGO_TKIP;
3818                 break;
3819         case WLAN_CIPHER_SUITE_CCMP:
3820                 algorithm = B43_SEC_ALGO_AES;
3821                 break;
3822         default:
3823                 B43_WARN_ON(1);
3824                 goto out_unlock;
3825         }
3826         index = (u8) (key->keyidx);
3827         if (index > 3)
3828                 goto out_unlock;
3829
3830         switch (cmd) {
3831         case SET_KEY:
3832                 if (algorithm == B43_SEC_ALGO_TKIP &&
3833                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3834                     !modparam_hwtkip)) {
3835                         /* We support only pairwise key */
3836                         err = -EOPNOTSUPP;
3837                         goto out_unlock;
3838                 }
3839
3840                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3841                         if (WARN_ON(!sta)) {
3842                                 err = -EOPNOTSUPP;
3843                                 goto out_unlock;
3844                         }
3845                         /* Pairwise key with an assigned MAC address. */
3846                         err = b43_key_write(dev, -1, algorithm,
3847                                             key->key, key->keylen,
3848                                             sta->addr, key);
3849                 } else {
3850                         /* Group key */
3851                         err = b43_key_write(dev, index, algorithm,
3852                                             key->key, key->keylen, NULL, key);
3853                 }
3854                 if (err)
3855                         goto out_unlock;
3856
3857                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3858                     algorithm == B43_SEC_ALGO_WEP104) {
3859                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3860                 } else {
3861                         b43_hf_write(dev,
3862                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3863                 }
3864                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3865                 if (algorithm == B43_SEC_ALGO_TKIP)
3866                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3867                 break;
3868         case DISABLE_KEY: {
3869                 err = b43_key_clear(dev, key->hw_key_idx);
3870                 if (err)
3871                         goto out_unlock;
3872                 break;
3873         }
3874         default:
3875                 B43_WARN_ON(1);
3876         }
3877
3878 out_unlock:
3879         if (!err) {
3880                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3881                        "mac: %pM\n",
3882                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3883                        sta ? sta->addr : bcast_addr);
3884                 b43_dump_keymemory(dev);
3885         }
3886         mutex_unlock(&wl->mutex);
3887
3888         return err;
3889 }
3890
3891 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3892                                     unsigned int changed, unsigned int *fflags,
3893                                     u64 multicast)
3894 {
3895         struct b43_wl *wl = hw_to_b43_wl(hw);
3896         struct b43_wldev *dev;
3897
3898         mutex_lock(&wl->mutex);
3899         dev = wl->current_dev;
3900         if (!dev) {
3901                 *fflags = 0;
3902                 goto out_unlock;
3903         }
3904
3905         *fflags &= FIF_PROMISC_IN_BSS |
3906                   FIF_ALLMULTI |
3907                   FIF_FCSFAIL |
3908                   FIF_PLCPFAIL |
3909                   FIF_CONTROL |
3910                   FIF_OTHER_BSS |
3911                   FIF_BCN_PRBRESP_PROMISC;
3912
3913         changed &= FIF_PROMISC_IN_BSS |
3914                    FIF_ALLMULTI |
3915                    FIF_FCSFAIL |
3916                    FIF_PLCPFAIL |
3917                    FIF_CONTROL |
3918                    FIF_OTHER_BSS |
3919                    FIF_BCN_PRBRESP_PROMISC;
3920
3921         wl->filter_flags = *fflags;
3922
3923         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3924                 b43_adjust_opmode(dev);
3925
3926 out_unlock:
3927         mutex_unlock(&wl->mutex);
3928 }
3929
3930 /* Locking: wl->mutex
3931  * Returns the current dev. This might be different from the passed in dev,
3932  * because the core might be gone away while we unlocked the mutex. */
3933 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3934 {
3935         struct b43_wl *wl = dev->wl;
3936         struct b43_wldev *orig_dev;
3937         u32 mask;
3938
3939 redo:
3940         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3941                 return dev;
3942
3943         /* Cancel work. Unlock to avoid deadlocks. */
3944         mutex_unlock(&wl->mutex);
3945         cancel_delayed_work_sync(&dev->periodic_work);
3946         cancel_work_sync(&wl->tx_work);
3947         mutex_lock(&wl->mutex);
3948         dev = wl->current_dev;
3949         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
3950                 /* Whoops, aliens ate up the device while we were unlocked. */
3951                 return dev;
3952         }
3953
3954         /* Disable interrupts on the device. */
3955         b43_set_status(dev, B43_STAT_INITIALIZED);
3956         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
3957                 /* wl->mutex is locked. That is enough. */
3958                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3959                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3960         } else {
3961                 spin_lock_irq(&wl->hardirq_lock);
3962                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3963                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3964                 spin_unlock_irq(&wl->hardirq_lock);
3965         }
3966         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
3967         orig_dev = dev;
3968         mutex_unlock(&wl->mutex);
3969         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
3970                 b43_sdio_free_irq(dev);
3971         } else {
3972                 synchronize_irq(dev->sdev->irq);
3973                 free_irq(dev->sdev->irq, dev);
3974         }
3975         mutex_lock(&wl->mutex);
3976         dev = wl->current_dev;
3977         if (!dev)
3978                 return dev;
3979         if (dev != orig_dev) {
3980                 if (b43_status(dev) >= B43_STAT_STARTED)
3981                         goto redo;
3982                 return dev;
3983         }
3984         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
3985         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
3986
3987         /* Drain the TX queue */
3988         while (skb_queue_len(&wl->tx_queue))
3989                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
3990
3991         b43_mac_suspend(dev);
3992         b43_leds_exit(dev);
3993         b43dbg(wl, "Wireless interface stopped\n");
3994
3995         return dev;
3996 }
3997
3998 /* Locking: wl->mutex */
3999 static int b43_wireless_core_start(struct b43_wldev *dev)
4000 {
4001         int err;
4002
4003         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4004
4005         drain_txstatus_queue(dev);
4006         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
4007                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4008                 if (err) {
4009                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4010                         goto out;
4011                 }
4012         } else {
4013                 err = request_threaded_irq(dev->sdev->irq, b43_interrupt_handler,
4014                                            b43_interrupt_thread_handler,
4015                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4016                 if (err) {
4017                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4018                                dev->sdev->irq);
4019                         goto out;
4020                 }
4021         }
4022
4023         /* We are ready to run. */
4024         ieee80211_wake_queues(dev->wl->hw);
4025         b43_set_status(dev, B43_STAT_STARTED);
4026
4027         /* Start data flow (TX/RX). */
4028         b43_mac_enable(dev);
4029         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4030
4031         /* Start maintainance work */
4032         b43_periodic_tasks_setup(dev);
4033
4034         b43_leds_init(dev);
4035
4036         b43dbg(dev->wl, "Wireless interface started\n");
4037 out:
4038         return err;
4039 }
4040
4041 /* Get PHY and RADIO versioning numbers */
4042 static int b43_phy_versioning(struct b43_wldev *dev)
4043 {
4044         struct b43_phy *phy = &dev->phy;
4045         u32 tmp;
4046         u8 analog_type;
4047         u8 phy_type;
4048         u8 phy_rev;
4049         u16 radio_manuf;
4050         u16 radio_ver;
4051         u16 radio_rev;
4052         int unsupported = 0;
4053
4054         /* Get PHY versioning */
4055         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4056         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4057         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4058         phy_rev = (tmp & B43_PHYVER_VERSION);
4059         switch (phy_type) {
4060         case B43_PHYTYPE_A:
4061                 if (phy_rev >= 4)
4062                         unsupported = 1;
4063                 break;
4064         case B43_PHYTYPE_B:
4065                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4066                     && phy_rev != 7)
4067                         unsupported = 1;
4068                 break;
4069         case B43_PHYTYPE_G:
4070                 if (phy_rev > 9)
4071                         unsupported = 1;
4072                 break;
4073 #ifdef CONFIG_B43_PHY_N
4074         case B43_PHYTYPE_N:
4075                 if (phy_rev > 9)
4076                         unsupported = 1;
4077                 break;
4078 #endif
4079 #ifdef CONFIG_B43_PHY_LP
4080         case B43_PHYTYPE_LP:
4081                 if (phy_rev > 2)
4082                         unsupported = 1;
4083                 break;
4084 #endif
4085         default:
4086                 unsupported = 1;
4087         };
4088         if (unsupported) {
4089                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4090                        "(Analog %u, Type %u, Revision %u)\n",
4091                        analog_type, phy_type, phy_rev);
4092                 return -EOPNOTSUPP;
4093         }
4094         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4095                analog_type, phy_type, phy_rev);
4096
4097         /* Get RADIO versioning */
4098         if (dev->sdev->bus->chip_id == 0x4317) {
4099                 if (dev->sdev->bus->chip_rev == 0)
4100                         tmp = 0x3205017F;
4101                 else if (dev->sdev->bus->chip_rev == 1)
4102                         tmp = 0x4205017F;
4103                 else
4104                         tmp = 0x5205017F;
4105         } else {
4106                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4107                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4108                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4109                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4110         }
4111         radio_manuf = (tmp & 0x00000FFF);
4112         radio_ver = (tmp & 0x0FFFF000) >> 12;
4113         radio_rev = (tmp & 0xF0000000) >> 28;
4114         if (radio_manuf != 0x17F /* Broadcom */)
4115                 unsupported = 1;
4116         switch (phy_type) {
4117         case B43_PHYTYPE_A:
4118                 if (radio_ver != 0x2060)
4119                         unsupported = 1;
4120                 if (radio_rev != 1)
4121                         unsupported = 1;
4122                 if (radio_manuf != 0x17F)
4123                         unsupported = 1;
4124                 break;
4125         case B43_PHYTYPE_B:
4126                 if ((radio_ver & 0xFFF0) != 0x2050)
4127                         unsupported = 1;
4128                 break;
4129         case B43_PHYTYPE_G:
4130                 if (radio_ver != 0x2050)
4131                         unsupported = 1;
4132                 break;
4133         case B43_PHYTYPE_N:
4134                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4135                         unsupported = 1;
4136                 break;
4137         case B43_PHYTYPE_LP:
4138                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4139                         unsupported = 1;
4140                 break;
4141         default:
4142                 B43_WARN_ON(1);
4143         }
4144         if (unsupported) {
4145                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4146                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4147                        radio_manuf, radio_ver, radio_rev);
4148                 return -EOPNOTSUPP;
4149         }
4150         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4151                radio_manuf, radio_ver, radio_rev);
4152
4153         phy->radio_manuf = radio_manuf;
4154         phy->radio_ver = radio_ver;
4155         phy->radio_rev = radio_rev;
4156
4157         phy->analog = analog_type;
4158         phy->type = phy_type;
4159         phy->rev = phy_rev;
4160
4161         return 0;
4162 }
4163
4164 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4165                                       struct b43_phy *phy)
4166 {
4167         phy->hardware_power_control = !!modparam_hwpctl;
4168         phy->next_txpwr_check_time = jiffies;
4169         /* PHY TX errors counter. */
4170         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4171
4172 #if B43_DEBUG
4173         phy->phy_locked = 0;
4174         phy->radio_locked = 0;
4175 #endif
4176 }
4177
4178 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4179 {
4180         dev->dfq_valid = 0;
4181
4182         /* Assume the radio is enabled. If it's not enabled, the state will
4183          * immediately get fixed on the first periodic work run. */
4184         dev->radio_hw_enable = 1;
4185
4186         /* Stats */
4187         memset(&dev->stats, 0, sizeof(dev->stats));
4188
4189         setup_struct_phy_for_init(dev, &dev->phy);
4190
4191         /* IRQ related flags */
4192         dev->irq_reason = 0;
4193         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4194         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4195         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4196                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4197
4198         dev->mac_suspended = 1;
4199
4200         /* Noise calculation context */
4201         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4202 }
4203
4204 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4205 {
4206         struct ssb_sprom *sprom = &dev->sdev->bus->sprom;
4207         u64 hf;
4208
4209         if (!modparam_btcoex)
4210                 return;
4211         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4212                 return;
4213         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4214                 return;
4215
4216         hf = b43_hf_read(dev);
4217         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4218                 hf |= B43_HF_BTCOEXALT;
4219         else
4220                 hf |= B43_HF_BTCOEX;
4221         b43_hf_write(dev, hf);
4222 }
4223
4224 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4225 {
4226         if (!modparam_btcoex)
4227                 return;
4228         //TODO
4229 }
4230
4231 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4232 {
4233         struct ssb_bus *bus = dev->sdev->bus;
4234         u32 tmp;
4235
4236         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4237             (bus->chip_id == 0x4312)) {
4238                 tmp = ssb_read32(dev->sdev, SSB_IMCFGLO);
4239                 tmp &= ~SSB_IMCFGLO_REQTO;
4240                 tmp &= ~SSB_IMCFGLO_SERTO;
4241                 tmp |= 0x3;
4242                 ssb_write32(dev->sdev, SSB_IMCFGLO, tmp);
4243                 ssb_commit_settings(bus);
4244         }
4245 }
4246
4247 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4248 {
4249         u16 pu_delay;
4250
4251         /* The time value is in microseconds. */
4252         if (dev->phy.type == B43_PHYTYPE_A)
4253                 pu_delay = 3700;
4254         else
4255                 pu_delay = 1050;
4256         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4257                 pu_delay = 500;
4258         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4259                 pu_delay = max(pu_delay, (u16)2400);
4260
4261         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4262 }
4263
4264 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4265 static void b43_set_pretbtt(struct b43_wldev *dev)
4266 {
4267         u16 pretbtt;
4268
4269         /* The time value is in microseconds. */
4270         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4271                 pretbtt = 2;
4272         } else {
4273                 if (dev->phy.type == B43_PHYTYPE_A)
4274                         pretbtt = 120;
4275                 else
4276                         pretbtt = 250;
4277         }
4278         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4279         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4280 }
4281
4282 /* Shutdown a wireless core */
4283 /* Locking: wl->mutex */
4284 static void b43_wireless_core_exit(struct b43_wldev *dev)
4285 {
4286         u32 macctl;
4287
4288         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4289         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4290                 return;
4291
4292         /* Unregister HW RNG driver */
4293         b43_rng_exit(dev->wl);
4294
4295         b43_set_status(dev, B43_STAT_UNINIT);
4296
4297         /* Stop the microcode PSM. */
4298         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4299         macctl &= ~B43_MACCTL_PSM_RUN;
4300         macctl |= B43_MACCTL_PSM_JMP0;
4301         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4302
4303         b43_dma_free(dev);
4304         b43_pio_free(dev);
4305         b43_chip_exit(dev);
4306         dev->phy.ops->switch_analog(dev, 0);
4307         if (dev->wl->current_beacon) {
4308                 dev_kfree_skb_any(dev->wl->current_beacon);
4309                 dev->wl->current_beacon = NULL;
4310         }
4311
4312         ssb_device_disable(dev->sdev, 0);
4313         ssb_bus_may_powerdown(dev->sdev->bus);
4314 }
4315
4316 /* Initialize a wireless core */
4317 static int b43_wireless_core_init(struct b43_wldev *dev)
4318 {
4319         struct ssb_bus *bus = dev->sdev->bus;
4320         struct ssb_sprom *sprom = &bus->sprom;
4321         struct b43_phy *phy = &dev->phy;
4322         int err;
4323         u64 hf;
4324         u32 tmp;
4325
4326         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4327
4328         err = ssb_bus_powerup(bus, 0);
4329         if (err)
4330                 goto out;
4331         if (!ssb_device_is_enabled(dev->sdev)) {
4332                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4333                 b43_wireless_core_reset(dev, tmp);
4334         }
4335
4336         /* Reset all data structures. */
4337         setup_struct_wldev_for_init(dev);
4338         phy->ops->prepare_structs(dev);
4339
4340         /* Enable IRQ routing to this device. */
4341         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->sdev);
4342
4343         b43_imcfglo_timeouts_workaround(dev);
4344         b43_bluetooth_coext_disable(dev);
4345         if (phy->ops->prepare_hardware) {
4346                 err = phy->ops->prepare_hardware(dev);
4347                 if (err)
4348                         goto err_busdown;
4349         }
4350         err = b43_chip_init(dev);
4351         if (err)
4352                 goto err_busdown;
4353         b43_shm_write16(dev, B43_SHM_SHARED,
4354                         B43_SHM_SH_WLCOREREV, dev->sdev->id.revision);
4355         hf = b43_hf_read(dev);
4356         if (phy->type == B43_PHYTYPE_G) {
4357                 hf |= B43_HF_SYMW;
4358                 if (phy->rev == 1)
4359                         hf |= B43_HF_GDCW;
4360                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4361                         hf |= B43_HF_OFDMPABOOST;
4362         }
4363         if (phy->radio_ver == 0x2050) {
4364                 if (phy->radio_rev == 6)
4365                         hf |= B43_HF_4318TSSI;
4366                 if (phy->radio_rev < 6)
4367                         hf |= B43_HF_VCORECALC;
4368         }
4369         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4370                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4371 #ifdef CONFIG_SSB_DRIVER_PCICORE
4372         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4373             (bus->pcicore.dev->id.revision <= 10))
4374                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4375 #endif
4376         hf &= ~B43_HF_SKCFPUP;
4377         b43_hf_write(dev, hf);
4378
4379         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4380                              B43_DEFAULT_LONG_RETRY_LIMIT);
4381         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4382         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4383
4384         /* Disable sending probe responses from firmware.
4385          * Setting the MaxTime to one usec will always trigger
4386          * a timeout, so we never send any probe resp.
4387          * A timeout of zero is infinite. */
4388         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4389
4390         b43_rate_memory_init(dev);
4391         b43_set_phytxctl_defaults(dev);
4392
4393         /* Minimum Contention Window */
4394         if (phy->type == B43_PHYTYPE_B)
4395                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4396         else
4397                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4398         /* Maximum Contention Window */
4399         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4400
4401         if ((dev->sdev->bus->bustype == SSB_BUSTYPE_PCMCIA) ||
4402             (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) ||
4403             dev->use_pio) {
4404                 dev->__using_pio_transfers = 1;
4405                 err = b43_pio_init(dev);
4406         } else {
4407                 dev->__using_pio_transfers = 0;
4408                 err = b43_dma_init(dev);
4409         }
4410         if (err)
4411                 goto err_chip_exit;
4412         b43_qos_init(dev);
4413         b43_set_synth_pu_delay(dev, 1);
4414         b43_bluetooth_coext_enable(dev);
4415
4416         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4417         b43_upload_card_macaddress(dev);
4418         b43_security_init(dev);
4419
4420         ieee80211_wake_queues(dev->wl->hw);
4421
4422         b43_set_status(dev, B43_STAT_INITIALIZED);
4423
4424         /* Register HW RNG driver */
4425         b43_rng_init(dev->wl);
4426
4427 out:
4428         return err;
4429
4430 err_chip_exit:
4431         b43_chip_exit(dev);
4432 err_busdown:
4433         ssb_bus_may_powerdown(bus);
4434         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4435         return err;
4436 }
4437
4438 static int b43_op_add_interface(struct ieee80211_hw *hw,
4439                                 struct ieee80211_vif *vif)
4440 {
4441         struct b43_wl *wl = hw_to_b43_wl(hw);
4442         struct b43_wldev *dev;
4443         int err = -EOPNOTSUPP;
4444
4445         /* TODO: allow WDS/AP devices to coexist */
4446
4447         if (vif->type != NL80211_IFTYPE_AP &&
4448             vif->type != NL80211_IFTYPE_MESH_POINT &&
4449             vif->type != NL80211_IFTYPE_STATION &&
4450             vif->type != NL80211_IFTYPE_WDS &&
4451             vif->type != NL80211_IFTYPE_ADHOC)
4452                 return -EOPNOTSUPP;
4453
4454         mutex_lock(&wl->mutex);
4455         if (wl->operating)
4456                 goto out_mutex_unlock;
4457
4458         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4459
4460         dev = wl->current_dev;
4461         wl->operating = 1;
4462         wl->vif = vif;
4463         wl->if_type = vif->type;
4464         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4465
4466         b43_adjust_opmode(dev);
4467         b43_set_pretbtt(dev);
4468         b43_set_synth_pu_delay(dev, 0);
4469         b43_upload_card_macaddress(dev);
4470
4471         err = 0;
4472  out_mutex_unlock:
4473         mutex_unlock(&wl->mutex);
4474
4475         return err;
4476 }
4477
4478 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4479                                     struct ieee80211_vif *vif)
4480 {
4481         struct b43_wl *wl = hw_to_b43_wl(hw);
4482         struct b43_wldev *dev = wl->current_dev;
4483
4484         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4485
4486         mutex_lock(&wl->mutex);
4487
4488         B43_WARN_ON(!wl->operating);
4489         B43_WARN_ON(wl->vif != vif);
4490         wl->vif = NULL;
4491
4492         wl->operating = 0;
4493
4494         b43_adjust_opmode(dev);
4495         memset(wl->mac_addr, 0, ETH_ALEN);
4496         b43_upload_card_macaddress(dev);
4497
4498         mutex_unlock(&wl->mutex);
4499 }
4500
4501 static int b43_op_start(struct ieee80211_hw *hw)
4502 {
4503         struct b43_wl *wl = hw_to_b43_wl(hw);
4504         struct b43_wldev *dev = wl->current_dev;
4505         int did_init = 0;
4506         int err = 0;
4507
4508         /* Kill all old instance specific information to make sure
4509          * the card won't use it in the short timeframe between start
4510          * and mac80211 reconfiguring it. */
4511         memset(wl->bssid, 0, ETH_ALEN);
4512         memset(wl->mac_addr, 0, ETH_ALEN);
4513         wl->filter_flags = 0;
4514         wl->radiotap_enabled = 0;
4515         b43_qos_clear(wl);
4516         wl->beacon0_uploaded = 0;
4517         wl->beacon1_uploaded = 0;
4518         wl->beacon_templates_virgin = 1;
4519         wl->radio_enabled = 1;
4520
4521         mutex_lock(&wl->mutex);
4522
4523         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4524                 err = b43_wireless_core_init(dev);
4525                 if (err)
4526                         goto out_mutex_unlock;
4527                 did_init = 1;
4528         }
4529
4530         if (b43_status(dev) < B43_STAT_STARTED) {
4531                 err = b43_wireless_core_start(dev);
4532                 if (err) {
4533                         if (did_init)
4534                                 b43_wireless_core_exit(dev);
4535                         goto out_mutex_unlock;
4536                 }
4537         }
4538
4539         /* XXX: only do if device doesn't support rfkill irq */
4540         wiphy_rfkill_start_polling(hw->wiphy);
4541
4542  out_mutex_unlock:
4543         mutex_unlock(&wl->mutex);
4544
4545         return err;
4546 }
4547
4548 static void b43_op_stop(struct ieee80211_hw *hw)
4549 {
4550         struct b43_wl *wl = hw_to_b43_wl(hw);
4551         struct b43_wldev *dev = wl->current_dev;
4552
4553         cancel_work_sync(&(wl->beacon_update_trigger));
4554
4555         mutex_lock(&wl->mutex);
4556         if (b43_status(dev) >= B43_STAT_STARTED) {
4557                 dev = b43_wireless_core_stop(dev);
4558                 if (!dev)
4559                         goto out_unlock;
4560         }
4561         b43_wireless_core_exit(dev);
4562         wl->radio_enabled = 0;
4563
4564 out_unlock:
4565         mutex_unlock(&wl->mutex);
4566
4567         cancel_work_sync(&(wl->txpower_adjust_work));
4568 }
4569
4570 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4571                                  struct ieee80211_sta *sta, bool set)
4572 {
4573         struct b43_wl *wl = hw_to_b43_wl(hw);
4574
4575         /* FIXME: add locking */
4576         b43_update_templates(wl);
4577
4578         return 0;
4579 }
4580
4581 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4582                               struct ieee80211_vif *vif,
4583                               enum sta_notify_cmd notify_cmd,
4584                               struct ieee80211_sta *sta)
4585 {
4586         struct b43_wl *wl = hw_to_b43_wl(hw);
4587
4588         B43_WARN_ON(!vif || wl->vif != vif);
4589 }
4590
4591 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4592 {
4593         struct b43_wl *wl = hw_to_b43_wl(hw);
4594         struct b43_wldev *dev;
4595
4596         mutex_lock(&wl->mutex);
4597         dev = wl->current_dev;
4598         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4599                 /* Disable CFP update during scan on other channels. */
4600                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4601         }
4602         mutex_unlock(&wl->mutex);
4603 }
4604
4605 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4606 {
4607         struct b43_wl *wl = hw_to_b43_wl(hw);
4608         struct b43_wldev *dev;
4609
4610         mutex_lock(&wl->mutex);
4611         dev = wl->current_dev;
4612         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4613                 /* Re-enable CFP update. */
4614                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4615         }
4616         mutex_unlock(&wl->mutex);
4617 }
4618
4619 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4620                              struct survey_info *survey)
4621 {
4622         struct b43_wl *wl = hw_to_b43_wl(hw);
4623         struct b43_wldev *dev = wl->current_dev;
4624         struct ieee80211_conf *conf = &hw->conf;
4625
4626         if (idx != 0)
4627                 return -ENOENT;
4628
4629         survey->channel = conf->channel;
4630         survey->filled = SURVEY_INFO_NOISE_DBM;
4631         survey->noise = dev->stats.link_noise;
4632
4633         return 0;
4634 }
4635
4636 static const struct ieee80211_ops b43_hw_ops = {
4637         .tx                     = b43_op_tx,
4638         .conf_tx                = b43_op_conf_tx,
4639         .add_interface          = b43_op_add_interface,
4640         .remove_interface       = b43_op_remove_interface,
4641         .config                 = b43_op_config,
4642         .bss_info_changed       = b43_op_bss_info_changed,
4643         .configure_filter       = b43_op_configure_filter,
4644         .set_key                = b43_op_set_key,
4645         .update_tkip_key        = b43_op_update_tkip_key,
4646         .get_stats              = b43_op_get_stats,
4647         .get_tsf                = b43_op_get_tsf,
4648         .set_tsf                = b43_op_set_tsf,
4649         .start                  = b43_op_start,
4650         .stop                   = b43_op_stop,
4651         .set_tim                = b43_op_beacon_set_tim,
4652         .sta_notify             = b43_op_sta_notify,
4653         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4654         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4655         .get_survey             = b43_op_get_survey,
4656         .rfkill_poll            = b43_rfkill_poll,
4657 };
4658
4659 /* Hard-reset the chip. Do not call this directly.
4660  * Use b43_controller_restart()
4661  */
4662 static void b43_chip_reset(struct work_struct *work)
4663 {
4664         struct b43_wldev *dev =
4665             container_of(work, struct b43_wldev, restart_work);
4666         struct b43_wl *wl = dev->wl;
4667         int err = 0;
4668         int prev_status;
4669
4670         mutex_lock(&wl->mutex);
4671
4672         prev_status = b43_status(dev);
4673         /* Bring the device down... */
4674         if (prev_status >= B43_STAT_STARTED) {
4675                 dev = b43_wireless_core_stop(dev);
4676                 if (!dev) {
4677                         err = -ENODEV;
4678                         goto out;
4679                 }
4680         }
4681         if (prev_status >= B43_STAT_INITIALIZED)
4682                 b43_wireless_core_exit(dev);
4683
4684         /* ...and up again. */
4685         if (prev_status >= B43_STAT_INITIALIZED) {
4686                 err = b43_wireless_core_init(dev);
4687                 if (err)
4688                         goto out;
4689         }
4690         if (prev_status >= B43_STAT_STARTED) {
4691                 err = b43_wireless_core_start(dev);
4692                 if (err) {
4693                         b43_wireless_core_exit(dev);
4694                         goto out;
4695                 }
4696         }
4697 out:
4698         if (err)
4699                 wl->current_dev = NULL; /* Failed to init the dev. */
4700         mutex_unlock(&wl->mutex);
4701         if (err)
4702                 b43err(wl, "Controller restart FAILED\n");
4703         else
4704                 b43info(wl, "Controller restarted\n");
4705 }
4706
4707 static int b43_setup_bands(struct b43_wldev *dev,
4708                            bool have_2ghz_phy, bool have_5ghz_phy)
4709 {
4710         struct ieee80211_hw *hw = dev->wl->hw;
4711
4712         if (have_2ghz_phy)
4713                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4714         if (dev->phy.type == B43_PHYTYPE_N) {
4715                 if (have_5ghz_phy)
4716                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4717         } else {
4718                 if (have_5ghz_phy)
4719                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4720         }
4721
4722         dev->phy.supports_2ghz = have_2ghz_phy;
4723         dev->phy.supports_5ghz = have_5ghz_phy;
4724
4725         return 0;
4726 }
4727
4728 static void b43_wireless_core_detach(struct b43_wldev *dev)
4729 {
4730         /* We release firmware that late to not be required to re-request
4731          * is all the time when we reinit the core. */
4732         b43_release_firmware(dev);
4733         b43_phy_free(dev);
4734 }
4735
4736 static int b43_wireless_core_attach(struct b43_wldev *dev)
4737 {
4738         struct b43_wl *wl = dev->wl;
4739         struct ssb_bus *bus = dev->sdev->bus;
4740         struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
4741         int err;
4742         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4743         u32 tmp;
4744
4745         /* Do NOT do any device initialization here.
4746          * Do it in wireless_core_init() instead.
4747          * This function is for gathering basic information about the HW, only.
4748          * Also some structs may be set up here. But most likely you want to have
4749          * that in core_init(), too.
4750          */
4751
4752         err = ssb_bus_powerup(bus, 0);
4753         if (err) {
4754                 b43err(wl, "Bus powerup failed\n");
4755                 goto out;
4756         }
4757         /* Get the PHY type. */
4758         if (dev->sdev->id.revision >= 5) {
4759                 u32 tmshigh;
4760
4761                 tmshigh = ssb_read32(dev->sdev, SSB_TMSHIGH);
4762                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4763                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4764         } else
4765                 B43_WARN_ON(1);
4766
4767         dev->phy.gmode = have_2ghz_phy;
4768         dev->phy.radio_on = 1;
4769         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4770         b43_wireless_core_reset(dev, tmp);
4771
4772         err = b43_phy_versioning(dev);
4773         if (err)
4774                 goto err_powerdown;
4775         /* Check if this device supports multiband. */
4776         if (!pdev ||
4777             (pdev->device != 0x4312 &&
4778              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4779                 /* No multiband support. */
4780                 have_2ghz_phy = 0;
4781                 have_5ghz_phy = 0;
4782                 switch (dev->phy.type) {
4783                 case B43_PHYTYPE_A:
4784                         have_5ghz_phy = 1;
4785                         break;
4786                 case B43_PHYTYPE_LP: //FIXME not always!
4787 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4788                         have_5ghz_phy = 1;
4789 #endif
4790                 case B43_PHYTYPE_G:
4791                 case B43_PHYTYPE_N:
4792                         have_2ghz_phy = 1;
4793                         break;
4794                 default:
4795                         B43_WARN_ON(1);
4796                 }
4797         }
4798         if (dev->phy.type == B43_PHYTYPE_A) {
4799                 /* FIXME */
4800                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4801                 err = -EOPNOTSUPP;
4802                 goto err_powerdown;
4803         }
4804         if (1 /* disable A-PHY */) {
4805                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4806                 if (dev->phy.type != B43_PHYTYPE_N &&
4807                     dev->phy.type != B43_PHYTYPE_LP) {
4808                         have_2ghz_phy = 1;
4809                         have_5ghz_phy = 0;
4810                 }
4811         }
4812
4813         err = b43_phy_allocate(dev);
4814         if (err)
4815                 goto err_powerdown;
4816
4817         dev->phy.gmode = have_2ghz_phy;
4818         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4819         b43_wireless_core_reset(dev, tmp);
4820
4821         err = b43_validate_chipaccess(dev);
4822         if (err)
4823                 goto err_phy_free;
4824         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4825         if (err)
4826                 goto err_phy_free;
4827
4828         /* Now set some default "current_dev" */
4829         if (!wl->current_dev)
4830                 wl->current_dev = dev;
4831         INIT_WORK(&dev->restart_work, b43_chip_reset);
4832
4833         dev->phy.ops->switch_analog(dev, 0);
4834         ssb_device_disable(dev->sdev, 0);
4835         ssb_bus_may_powerdown(bus);
4836
4837 out:
4838         return err;
4839
4840 err_phy_free:
4841         b43_phy_free(dev);
4842 err_powerdown:
4843         ssb_bus_may_powerdown(bus);
4844         return err;
4845 }
4846
4847 static void b43_one_core_detach(struct ssb_device *dev)
4848 {
4849         struct b43_wldev *wldev;
4850         struct b43_wl *wl;
4851
4852         /* Do not cancel ieee80211-workqueue based work here.
4853          * See comment in b43_remove(). */
4854
4855         wldev = ssb_get_drvdata(dev);
4856         wl = wldev->wl;
4857         b43_debugfs_remove_device(wldev);
4858         b43_wireless_core_detach(wldev);
4859         list_del(&wldev->list);
4860         wl->nr_devs--;
4861         ssb_set_drvdata(dev, NULL);
4862         kfree(wldev);
4863 }
4864
4865 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4866 {
4867         struct b43_wldev *wldev;
4868         int err = -ENOMEM;
4869
4870         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4871         if (!wldev)
4872                 goto out;
4873
4874         wldev->use_pio = b43_modparam_pio;
4875         wldev->sdev = dev;
4876         wldev->wl = wl;
4877         b43_set_status(wldev, B43_STAT_UNINIT);
4878         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4879         INIT_LIST_HEAD(&wldev->list);
4880
4881         err = b43_wireless_core_attach(wldev);
4882         if (err)
4883                 goto err_kfree_wldev;
4884
4885         list_add(&wldev->list, &wl->devlist);
4886         wl->nr_devs++;
4887         ssb_set_drvdata(dev, wldev);
4888         b43_debugfs_add_device(wldev);
4889
4890       out:
4891         return err;
4892
4893       err_kfree_wldev:
4894         kfree(wldev);
4895         return err;
4896 }
4897
4898 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4899         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4900         (pdev->device == _device) &&                                    \
4901         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4902         (pdev->subsystem_device == _subdevice)                          )
4903
4904 static void b43_sprom_fixup(struct ssb_bus *bus)
4905 {
4906         struct pci_dev *pdev;
4907
4908         /* boardflags workarounds */
4909         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4910             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4911                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4912         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4913             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4914                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4915         if (bus->bustype == SSB_BUSTYPE_PCI) {
4916                 pdev = bus->host_pci;
4917                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4918                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4919                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4920                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4921                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4922                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4923                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4924                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4925         }
4926 }
4927
4928 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4929 {
4930         struct ieee80211_hw *hw = wl->hw;
4931
4932         ssb_set_devtypedata(dev, NULL);
4933         ieee80211_free_hw(hw);
4934 }
4935
4936 static struct b43_wl *b43_wireless_init(struct ssb_device *dev)
4937 {
4938         struct ssb_sprom *sprom = &dev->bus->sprom;
4939         struct ieee80211_hw *hw;
4940         struct b43_wl *wl;
4941
4942         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4943         if (!hw) {
4944                 b43err(NULL, "Could not allocate ieee80211 device\n");
4945                 return ERR_PTR(-ENOMEM);
4946         }
4947         wl = hw_to_b43_wl(hw);
4948
4949         /* fill hw info */
4950         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4951                     IEEE80211_HW_SIGNAL_DBM;
4952
4953         hw->wiphy->interface_modes =
4954                 BIT(NL80211_IFTYPE_AP) |
4955                 BIT(NL80211_IFTYPE_MESH_POINT) |
4956                 BIT(NL80211_IFTYPE_STATION) |
4957                 BIT(NL80211_IFTYPE_WDS) |
4958                 BIT(NL80211_IFTYPE_ADHOC);
4959
4960         hw->queues = modparam_qos ? 4 : 1;
4961         wl->mac80211_initially_registered_queues = hw->queues;
4962         hw->max_rates = 2;
4963         SET_IEEE80211_DEV(hw, dev->dev);
4964         if (is_valid_ether_addr(sprom->et1mac))
4965                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4966         else
4967                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4968
4969         /* Initialize struct b43_wl */
4970         wl->hw = hw;
4971         mutex_init(&wl->mutex);
4972         spin_lock_init(&wl->hardirq_lock);
4973         INIT_LIST_HEAD(&wl->devlist);
4974         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4975         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4976         INIT_WORK(&wl->tx_work, b43_tx_work);
4977         skb_queue_head_init(&wl->tx_queue);
4978
4979         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4980                 dev->bus->chip_id, dev->id.revision);
4981         return wl;
4982 }
4983
4984 static int b43_ssb_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4985 {
4986         struct b43_wl *wl;
4987         int err;
4988         int first = 0;
4989
4990         wl = ssb_get_devtypedata(dev);
4991         if (!wl) {
4992                 /* Probing the first core. Must setup common struct b43_wl */
4993                 first = 1;
4994                 b43_sprom_fixup(dev->bus);
4995                 wl = b43_wireless_init(dev);
4996                 if (IS_ERR(wl)) {
4997                         err = PTR_ERR(wl);
4998                         goto out;
4999                 }
5000                 ssb_set_devtypedata(dev, wl);
5001                 B43_WARN_ON(ssb_get_devtypedata(dev) != wl);
5002         }
5003         err = b43_one_core_attach(dev, wl);
5004         if (err)
5005                 goto err_wireless_exit;
5006
5007         if (first) {
5008                 err = ieee80211_register_hw(wl->hw);
5009                 if (err)
5010                         goto err_one_core_detach;
5011                 b43_leds_register(wl->current_dev);
5012         }
5013
5014       out:
5015         return err;
5016
5017       err_one_core_detach:
5018         b43_one_core_detach(dev);
5019       err_wireless_exit:
5020         if (first)
5021                 b43_wireless_exit(dev, wl);
5022         return err;
5023 }
5024
5025 static void b43_ssb_remove(struct ssb_device *dev)
5026 {
5027         struct b43_wl *wl = ssb_get_devtypedata(dev);
5028         struct b43_wldev *wldev = ssb_get_drvdata(dev);
5029
5030         /* We must cancel any work here before unregistering from ieee80211,
5031          * as the ieee80211 unreg will destroy the workqueue. */
5032         cancel_work_sync(&wldev->restart_work);
5033
5034         B43_WARN_ON(!wl);
5035         if (wl->current_dev == wldev) {
5036                 /* Restore the queues count before unregistering, because firmware detect
5037                  * might have modified it. Restoring is important, so the networking
5038                  * stack can properly free resources. */
5039                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5040                 b43_leds_stop(wldev);
5041                 ieee80211_unregister_hw(wl->hw);
5042         }
5043
5044         b43_one_core_detach(dev);
5045
5046         if (list_empty(&wl->devlist)) {
5047                 b43_leds_unregister(wl);
5048                 /* Last core on the chip unregistered.
5049                  * We can destroy common struct b43_wl.
5050                  */
5051                 b43_wireless_exit(dev, wl);
5052         }
5053 }
5054
5055 /* Perform a hardware reset. This can be called from any context. */
5056 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5057 {
5058         /* Must avoid requeueing, if we are in shutdown. */
5059         if (b43_status(dev) < B43_STAT_INITIALIZED)
5060                 return;
5061         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5062         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5063 }
5064
5065 static struct ssb_driver b43_ssb_driver = {
5066         .name           = KBUILD_MODNAME,
5067         .id_table       = b43_ssb_tbl,
5068         .probe          = b43_ssb_probe,
5069         .remove         = b43_ssb_remove,
5070 };
5071
5072 static void b43_print_driverinfo(void)
5073 {
5074         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5075                    *feat_leds = "", *feat_sdio = "";
5076
5077 #ifdef CONFIG_B43_PCI_AUTOSELECT
5078         feat_pci = "P";
5079 #endif
5080 #ifdef CONFIG_B43_PCMCIA
5081         feat_pcmcia = "M";
5082 #endif
5083 #ifdef CONFIG_B43_PHY_N
5084         feat_nphy = "N";
5085 #endif
5086 #ifdef CONFIG_B43_LEDS
5087         feat_leds = "L";
5088 #endif
5089 #ifdef CONFIG_B43_SDIO
5090         feat_sdio = "S";
5091 #endif
5092         printk(KERN_INFO "Broadcom 43xx driver loaded "
5093                "[ Features: %s%s%s%s%s, Firmware-ID: "
5094                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5095                feat_pci, feat_pcmcia, feat_nphy,
5096                feat_leds, feat_sdio);
5097 }
5098
5099 static int __init b43_init(void)
5100 {
5101         int err;
5102
5103         b43_debugfs_init();
5104         err = b43_pcmcia_init();
5105         if (err)
5106                 goto err_dfs_exit;
5107         err = b43_sdio_init();
5108         if (err)
5109                 goto err_pcmcia_exit;
5110         err = ssb_driver_register(&b43_ssb_driver);
5111         if (err)
5112                 goto err_sdio_exit;
5113         b43_print_driverinfo();
5114
5115         return err;
5116
5117 err_sdio_exit:
5118         b43_sdio_exit();
5119 err_pcmcia_exit:
5120         b43_pcmcia_exit();
5121 err_dfs_exit:
5122         b43_debugfs_exit();
5123         return err;
5124 }
5125
5126 static void __exit b43_exit(void)
5127 {
5128         ssb_driver_unregister(&b43_ssb_driver);
5129         b43_sdio_exit();
5130         b43_pcmcia_exit();
5131         b43_debugfs_exit();
5132 }
5133
5134 module_init(b43_init)
5135 module_exit(b43_exit)