drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <mb@bu3sch.de>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode5.fw");
  76 MODULE_FIRMWARE("b43/ucode9.fw");
  77
  78 static int modparam_bad_frames_preempt;
  79 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  80 MODULE_PARM_DESC(bad_frames_preempt,
  81                  "enable(1) / disable(0) Bad Frames Preemption");
  82
  83 static char modparam_fwpostfix[16];
  84 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  85 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  86
  87 static int modparam_hwpctl;
  88 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  89 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  90
  91 static int modparam_nohwcrypt;
  92 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  93 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  94
  95 static int modparam_hwtkip;
  96 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  97 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  98
  99 static int modparam_qos = 1;
 100 module_param_named(qos, modparam_qos, int, 0444);
 101 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 102
 103 static int modparam_btcoex = 1;
 104 module_param_named(btcoex, modparam_btcoex, int, 0444);
 105 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 106
 107 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 108 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 109 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 110
 111 static int b43_modparam_pio = B43_PIO_DEFAULT;
 112 module_param_named(pio, b43_modparam_pio, int, 0644);
 113 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 114
 115 static const struct ssb_device_id b43_ssb_tbl[] = {
 116         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 117         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 118         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 119         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 120         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 121         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 122         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 123         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 124         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 125         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 126         SSB_DEVTABLE_END
 127 };
 128
 129 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 130
 131 /* Channel and ratetables are shared for all devices.
 132  * They can't be const, because ieee80211 puts some precalculated
 133  * data in there. This data is the same for all devices, so we don't
 134  * get concurrency issues */
 135 #define RATETAB_ENT(_rateid, _flags) \
 136         {                                                               \
 137                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 138                 .hw_value       = (_rateid),                            \
 139                 .flags          = (_flags),                             \
 140         }
 141
 142 /*
 143  * NOTE: When changing this, sync with xmit.c's
 144  *       b43_plcp_get_bitrate_idx_* functions!
 145  */
 146 static struct ieee80211_rate __b43_ratetable[] = {
 147         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 148         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 151         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 152         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 153         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 154         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 155         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 156         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 157         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 158         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 159 };
 160
 161 #define b43_a_ratetable         (__b43_ratetable + 4)
 162 #define b43_a_ratetable_size    8
 163 #define b43_b_ratetable         (__b43_ratetable + 0)
 164 #define b43_b_ratetable_size    4
 165 #define b43_g_ratetable         (__b43_ratetable + 0)
 166 #define b43_g_ratetable_size    12
 167
 168 #define CHAN4G(_channel, _freq, _flags) {                       \
 169         .band                   = IEEE80211_BAND_2GHZ,          \
 170         .center_freq            = (_freq),                      \
 171         .hw_value               = (_channel),                   \
 172         .flags                  = (_flags),                     \
 173         .max_antenna_gain       = 0,                            \
 174         .max_power              = 30,                           \
 175 }
 176 static struct ieee80211_channel b43_2ghz_chantable[] = {
 177         CHAN4G(1, 2412, 0),
 178         CHAN4G(2, 2417, 0),
 179         CHAN4G(3, 2422, 0),
 180         CHAN4G(4, 2427, 0),
 181         CHAN4G(5, 2432, 0),
 182         CHAN4G(6, 2437, 0),
 183         CHAN4G(7, 2442, 0),
 184         CHAN4G(8, 2447, 0),
 185         CHAN4G(9, 2452, 0),
 186         CHAN4G(10, 2457, 0),
 187         CHAN4G(11, 2462, 0),
 188         CHAN4G(12, 2467, 0),
 189         CHAN4G(13, 2472, 0),
 190         CHAN4G(14, 2484, 0),
 191 };
 192 #undef CHAN4G
 193
 194 #define CHAN5G(_channel, _flags) {                              \
 195         .band                   = IEEE80211_BAND_5GHZ,          \
 196         .center_freq            = 5000 + (5 * (_channel)),      \
 197         .hw_value               = (_channel),                   \
 198         .flags                  = (_flags),                     \
 199         .max_antenna_gain       = 0,                            \
 200         .max_power              = 30,                           \
 201 }
 202 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 203         CHAN5G(32, 0),          CHAN5G(34, 0),
 204         CHAN5G(36, 0),          CHAN5G(38, 0),
 205         CHAN5G(40, 0),          CHAN5G(42, 0),
 206         CHAN5G(44, 0),          CHAN5G(46, 0),
 207         CHAN5G(48, 0),          CHAN5G(50, 0),
 208         CHAN5G(52, 0),          CHAN5G(54, 0),
 209         CHAN5G(56, 0),          CHAN5G(58, 0),
 210         CHAN5G(60, 0),          CHAN5G(62, 0),
 211         CHAN5G(64, 0),          CHAN5G(66, 0),
 212         CHAN5G(68, 0),          CHAN5G(70, 0),
 213         CHAN5G(72, 0),          CHAN5G(74, 0),
 214         CHAN5G(76, 0),          CHAN5G(78, 0),
 215         CHAN5G(80, 0),          CHAN5G(82, 0),
 216         CHAN5G(84, 0),          CHAN5G(86, 0),
 217         CHAN5G(88, 0),          CHAN5G(90, 0),
 218         CHAN5G(92, 0),          CHAN5G(94, 0),
 219         CHAN5G(96, 0),          CHAN5G(98, 0),
 220         CHAN5G(100, 0),         CHAN5G(102, 0),
 221         CHAN5G(104, 0),         CHAN5G(106, 0),
 222         CHAN5G(108, 0),         CHAN5G(110, 0),
 223         CHAN5G(112, 0),         CHAN5G(114, 0),
 224         CHAN5G(116, 0),         CHAN5G(118, 0),
 225         CHAN5G(120, 0),         CHAN5G(122, 0),
 226         CHAN5G(124, 0),         CHAN5G(126, 0),
 227         CHAN5G(128, 0),         CHAN5G(130, 0),
 228         CHAN5G(132, 0),         CHAN5G(134, 0),
 229         CHAN5G(136, 0),         CHAN5G(138, 0),
 230         CHAN5G(140, 0),         CHAN5G(142, 0),
 231         CHAN5G(144, 0),         CHAN5G(145, 0),
 232         CHAN5G(146, 0),         CHAN5G(147, 0),
 233         CHAN5G(148, 0),         CHAN5G(149, 0),
 234         CHAN5G(150, 0),         CHAN5G(151, 0),
 235         CHAN5G(152, 0),         CHAN5G(153, 0),
 236         CHAN5G(154, 0),         CHAN5G(155, 0),
 237         CHAN5G(156, 0),         CHAN5G(157, 0),
 238         CHAN5G(158, 0),         CHAN5G(159, 0),
 239         CHAN5G(160, 0),         CHAN5G(161, 0),
 240         CHAN5G(162, 0),         CHAN5G(163, 0),
 241         CHAN5G(164, 0),         CHAN5G(165, 0),
 242         CHAN5G(166, 0),         CHAN5G(168, 0),
 243         CHAN5G(170, 0),         CHAN5G(172, 0),
 244         CHAN5G(174, 0),         CHAN5G(176, 0),
 245         CHAN5G(178, 0),         CHAN5G(180, 0),
 246         CHAN5G(182, 0),         CHAN5G(184, 0),
 247         CHAN5G(186, 0),         CHAN5G(188, 0),
 248         CHAN5G(190, 0),         CHAN5G(192, 0),
 249         CHAN5G(194, 0),         CHAN5G(196, 0),
 250         CHAN5G(198, 0),         CHAN5G(200, 0),
 251         CHAN5G(202, 0),         CHAN5G(204, 0),
 252         CHAN5G(206, 0),         CHAN5G(208, 0),
 253         CHAN5G(210, 0),         CHAN5G(212, 0),
 254         CHAN5G(214, 0),         CHAN5G(216, 0),
 255         CHAN5G(218, 0),         CHAN5G(220, 0),
 256         CHAN5G(222, 0),         CHAN5G(224, 0),
 257         CHAN5G(226, 0),         CHAN5G(228, 0),
 258 };
 259
 260 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 261         CHAN5G(34, 0),          CHAN5G(36, 0),
 262         CHAN5G(38, 0),          CHAN5G(40, 0),
 263         CHAN5G(42, 0),          CHAN5G(44, 0),
 264         CHAN5G(46, 0),          CHAN5G(48, 0),
 265         CHAN5G(52, 0),          CHAN5G(56, 0),
 266         CHAN5G(60, 0),          CHAN5G(64, 0),
 267         CHAN5G(100, 0),         CHAN5G(104, 0),
 268         CHAN5G(108, 0),         CHAN5G(112, 0),
 269         CHAN5G(116, 0),         CHAN5G(120, 0),
 270         CHAN5G(124, 0),         CHAN5G(128, 0),
 271         CHAN5G(132, 0),         CHAN5G(136, 0),
 272         CHAN5G(140, 0),         CHAN5G(149, 0),
 273         CHAN5G(153, 0),         CHAN5G(157, 0),
 274         CHAN5G(161, 0),         CHAN5G(165, 0),
 275         CHAN5G(184, 0),         CHAN5G(188, 0),
 276         CHAN5G(192, 0),         CHAN5G(196, 0),
 277         CHAN5G(200, 0),         CHAN5G(204, 0),
 278         CHAN5G(208, 0),         CHAN5G(212, 0),
 279         CHAN5G(216, 0),
 280 };
 281 #undef CHAN5G
 282
 283 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 284         .band           = IEEE80211_BAND_5GHZ,
 285         .channels       = b43_5ghz_nphy_chantable,
 286         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 287         .bitrates       = b43_a_ratetable,
 288         .n_bitrates     = b43_a_ratetable_size,
 289 };
 290
 291 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 292         .band           = IEEE80211_BAND_5GHZ,
 293         .channels       = b43_5ghz_aphy_chantable,
 294         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 295         .bitrates       = b43_a_ratetable,
 296         .n_bitrates     = b43_a_ratetable_size,
 297 };
 298
 299 static struct ieee80211_supported_band b43_band_2GHz = {
 300         .band           = IEEE80211_BAND_2GHZ,
 301         .channels       = b43_2ghz_chantable,
 302         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 303         .bitrates       = b43_g_ratetable,
 304         .n_bitrates     = b43_g_ratetable_size,
 305 };
 306
 307 static void b43_wireless_core_exit(struct b43_wldev *dev);
 308 static int b43_wireless_core_init(struct b43_wldev *dev);
 309 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 310 static int b43_wireless_core_start(struct b43_wldev *dev);
 311
 312 static int b43_ratelimit(struct b43_wl *wl)
 313 {
 314         if (!wl || !wl->current_dev)
 315                 return 1;
 316         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 317                 return 1;
 318         /* We are up and running.
 319          * Ratelimit the messages to avoid DoS over the net. */
 320         return net_ratelimit();
 321 }
 322
 323 void b43info(struct b43_wl *wl, const char *fmt, ...)
 324 {
 325         struct va_format vaf;
 326         va_list args;
 327
 328         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 329                 return;
 330         if (!b43_ratelimit(wl))
 331                 return;
 332
 333         va_start(args, fmt);
 334
 335         vaf.fmt = fmt;
 336         vaf.va = &args;
 337
 338         printk(KERN_INFO "b43-%s: %pV",
 339                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 340
 341         va_end(args);
 342 }
 343
 344 void b43err(struct b43_wl *wl, const char *fmt, ...)
 345 {
 346         struct va_format vaf;
 347         va_list args;
 348
 349         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 350                 return;
 351         if (!b43_ratelimit(wl))
 352                 return;
 353
 354         va_start(args, fmt);
 355
 356         vaf.fmt = fmt;
 357         vaf.va = &args;
 358
 359         printk(KERN_ERR "b43-%s ERROR: %pV",
 360                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 361
 362         va_end(args);
 363 }
 364
 365 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 366 {
 367         struct va_format vaf;
 368         va_list args;
 369
 370         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 371                 return;
 372         if (!b43_ratelimit(wl))
 373                 return;
 374
 375         va_start(args, fmt);
 376
 377         vaf.fmt = fmt;
 378         vaf.va = &args;
 379
 380         printk(KERN_WARNING "b43-%s warning: %pV",
 381                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 382
 383         va_end(args);
 384 }
 385
 386 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 387 {
 388         struct va_format vaf;
 389         va_list args;
 390
 391         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 392                 return;
 393
 394         va_start(args, fmt);
 395
 396         vaf.fmt = fmt;
 397         vaf.va = &args;
 398
 399         printk(KERN_DEBUG "b43-%s debug: %pV",
 400                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 401
 402         va_end(args);
 403 }
 404
 405 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 406 {
 407         u32 macctl;
 408
 409         B43_WARN_ON(offset % 4 != 0);
 410
 411         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 412         if (macctl & B43_MACCTL_BE)
 413                 val = swab32(val);
 414
 415         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 416         mmiowb();
 417         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 418 }
 419
 420 static inline void b43_shm_control_word(struct b43_wldev *dev,
 421                                         u16 routing, u16 offset)
 422 {
 423         u32 control;
 424
 425         /* "offset" is the WORD offset. */
 426         control = routing;
 427         control <<= 16;
 428         control |= offset;
 429         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 430 }
 431
 432 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 433 {
 434         u32 ret;
 435
 436         if (routing == B43_SHM_SHARED) {
 437                 B43_WARN_ON(offset & 0x0001);
 438                 if (offset & 0x0003) {
 439                         /* Unaligned access */
 440                         b43_shm_control_word(dev, routing, offset >> 2);
 441                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 442                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 443                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 444
 445                         goto out;
 446                 }
 447                 offset >>= 2;
 448         }
 449         b43_shm_control_word(dev, routing, offset);
 450         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 451 out:
 452         return ret;
 453 }
 454
 455 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 456 {
 457         u16 ret;
 458
 459         if (routing == B43_SHM_SHARED) {
 460                 B43_WARN_ON(offset & 0x0001);
 461                 if (offset & 0x0003) {
 462                         /* Unaligned access */
 463                         b43_shm_control_word(dev, routing, offset >> 2);
 464                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 465
 466                         goto out;
 467                 }
 468                 offset >>= 2;
 469         }
 470         b43_shm_control_word(dev, routing, offset);
 471         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 472 out:
 473         return ret;
 474 }
 475
 476 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 477 {
 478         if (routing == B43_SHM_SHARED) {
 479                 B43_WARN_ON(offset & 0x0001);
 480                 if (offset & 0x0003) {
 481                         /* Unaligned access */
 482                         b43_shm_control_word(dev, routing, offset >> 2);
 483                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 484                                     value & 0xFFFF);
 485                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 486                         b43_write16(dev, B43_MMIO_SHM_DATA,
 487                                     (value >> 16) & 0xFFFF);
 488                         return;
 489                 }
 490                 offset >>= 2;
 491         }
 492         b43_shm_control_word(dev, routing, offset);
 493         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 494 }
 495
 496 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 497 {
 498         if (routing == B43_SHM_SHARED) {
 499                 B43_WARN_ON(offset & 0x0001);
 500                 if (offset & 0x0003) {
 501                         /* Unaligned access */
 502                         b43_shm_control_word(dev, routing, offset >> 2);
 503                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 504                         return;
 505                 }
 506                 offset >>= 2;
 507         }
 508         b43_shm_control_word(dev, routing, offset);
 509         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 510 }
 511
 512 /* Read HostFlags */
 513 u64 b43_hf_read(struct b43_wldev *dev)
 514 {
 515         u64 ret;
 516
 517         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 518         ret <<= 16;
 519         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 520         ret <<= 16;
 521         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 522
 523         return ret;
 524 }
 525
 526 /* Write HostFlags */
 527 void b43_hf_write(struct b43_wldev *dev, u64 value)
 528 {
 529         u16 lo, mi, hi;
 530
 531         lo = (value & 0x00000000FFFFULL);
 532         mi = (value & 0x0000FFFF0000ULL) >> 16;
 533         hi = (value & 0xFFFF00000000ULL) >> 32;
 534         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 535         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 536         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 537 }
 538
 539 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 540 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 541 {
 542         B43_WARN_ON(!dev->fw.opensource);
 543         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 544 }
 545
 546 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 547 {
 548         u32 low, high;
 549
 550         B43_WARN_ON(dev->sdev->id.revision < 3);
 551
 552         /* The hardware guarantees us an atomic read, if we
 553          * read the low register first. */
 554         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 555         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 556
 557         *tsf = high;
 558         *tsf <<= 32;
 559         *tsf |= low;
 560 }
 561
 562 static void b43_time_lock(struct b43_wldev *dev)
 563 {
 564         u32 macctl;
 565
 566         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 567         macctl |= B43_MACCTL_TBTTHOLD;
 568         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 569         /* Commit the write */
 570         b43_read32(dev, B43_MMIO_MACCTL);
 571 }
 572
 573 static void b43_time_unlock(struct b43_wldev *dev)
 574 {
 575         u32 macctl;
 576
 577         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 578         macctl &= ~B43_MACCTL_TBTTHOLD;
 579         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 580         /* Commit the write */
 581         b43_read32(dev, B43_MMIO_MACCTL);
 582 }
 583
 584 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 585 {
 586         u32 low, high;
 587
 588         B43_WARN_ON(dev->sdev->id.revision < 3);
 589
 590         low = tsf;
 591         high = (tsf >> 32);
 592         /* The hardware guarantees us an atomic write, if we
 593          * write the low register first. */
 594         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 595         mmiowb();
 596         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 597         mmiowb();
 598 }
 599
 600 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 601 {
 602         b43_time_lock(dev);
 603         b43_tsf_write_locked(dev, tsf);
 604         b43_time_unlock(dev);
 605 }
 606
 607 static
 608 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 609 {
 610         static const u8 zero_addr[ETH_ALEN] = { 0 };
 611         u16 data;
 612
 613         if (!mac)
 614                 mac = zero_addr;
 615
 616         offset |= 0x0020;
 617         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 618
 619         data = mac[0];
 620         data |= mac[1] << 8;
 621         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 622         data = mac[2];
 623         data |= mac[3] << 8;
 624         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 625         data = mac[4];
 626         data |= mac[5] << 8;
 627         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 628 }
 629
 630 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 631 {
 632         const u8 *mac;
 633         const u8 *bssid;
 634         u8 mac_bssid[ETH_ALEN * 2];
 635         int i;
 636         u32 tmp;
 637
 638         bssid = dev->wl->bssid;
 639         mac = dev->wl->mac_addr;
 640
 641         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 642
 643         memcpy(mac_bssid, mac, ETH_ALEN);
 644         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 645
 646         /* Write our MAC address and BSSID to template ram */
 647         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 648                 tmp = (u32) (mac_bssid[i + 0]);
 649                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 650                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 651                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 652                 b43_ram_write(dev, 0x20 + i, tmp);
 653         }
 654 }
 655
 656 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 657 {
 658         b43_write_mac_bssid_templates(dev);
 659         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 660 }
 661
 662 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 663 {
 664         /* slot_time is in usec. */
 665         /* This test used to exit for all but a G PHY. */
 666         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 667                 return;
 668         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 669         /* Shared memory location 0x0010 is the slot time and should be
 670          * set to slot_time; however, this register is initially 0 and changing
 671          * the value adversely affects the transmit rate for BCM4311
 672          * devices. Until this behavior is unterstood, delete this step
 673          *
 674          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 675          */
 676 }
 677
 678 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 679 {
 680         b43_set_slot_time(dev, 9);
 681 }
 682
 683 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 684 {
 685         b43_set_slot_time(dev, 20);
 686 }
 687
 688 /* DummyTransmission function, as documented on
 689  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 690  */
 691 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 692 {
 693         struct b43_phy *phy = &dev->phy;
 694         unsigned int i, max_loop;
 695         u16 value;
 696         u32 buffer[5] = {
 697                 0x00000000,
 698                 0x00D40000,
 699                 0x00000000,
 700                 0x01000000,
 701                 0x00000000,
 702         };
 703
 704         if (ofdm) {
 705                 max_loop = 0x1E;
 706                 buffer[0] = 0x000201CC;
 707         } else {
 708                 max_loop = 0xFA;
 709                 buffer[0] = 0x000B846E;
 710         }
 711
 712         for (i = 0; i < 5; i++)
 713                 b43_ram_write(dev, i * 4, buffer[i]);
 714
 715         b43_write16(dev, 0x0568, 0x0000);
 716         if (dev->sdev->id.revision < 11)
 717                 b43_write16(dev, 0x07C0, 0x0000);
 718         else
 719                 b43_write16(dev, 0x07C0, 0x0100);
 720         value = (ofdm ? 0x41 : 0x40);
 721         b43_write16(dev, 0x050C, value);
 722         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 723                 b43_write16(dev, 0x0514, 0x1A02);
 724         b43_write16(dev, 0x0508, 0x0000);
 725         b43_write16(dev, 0x050A, 0x0000);
 726         b43_write16(dev, 0x054C, 0x0000);
 727         b43_write16(dev, 0x056A, 0x0014);
 728         b43_write16(dev, 0x0568, 0x0826);
 729         b43_write16(dev, 0x0500, 0x0000);
 730         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 731                 //SPEC TODO
 732         }
 733
 734         switch (phy->type) {
 735         case B43_PHYTYPE_N:
 736                 b43_write16(dev, 0x0502, 0x00D0);
 737                 break;
 738         case B43_PHYTYPE_LP:
 739                 b43_write16(dev, 0x0502, 0x0050);
 740                 break;
 741         default:
 742                 b43_write16(dev, 0x0502, 0x0030);
 743         }
 744
 745         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 746                 b43_radio_write16(dev, 0x0051, 0x0017);
 747         for (i = 0x00; i < max_loop; i++) {
 748                 value = b43_read16(dev, 0x050E);
 749                 if (value & 0x0080)
 750                         break;
 751                 udelay(10);
 752         }
 753         for (i = 0x00; i < 0x0A; i++) {
 754                 value = b43_read16(dev, 0x050E);
 755                 if (value & 0x0400)
 756                         break;
 757                 udelay(10);
 758         }
 759         for (i = 0x00; i < 0x19; i++) {
 760                 value = b43_read16(dev, 0x0690);
 761                 if (!(value & 0x0100))
 762                         break;
 763                 udelay(10);
 764         }
 765         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 766                 b43_radio_write16(dev, 0x0051, 0x0037);
 767 }
 768
 769 static void key_write(struct b43_wldev *dev,
 770                       u8 index, u8 algorithm, const u8 *key)
 771 {
 772         unsigned int i;
 773         u32 offset;
 774         u16 value;
 775         u16 kidx;
 776
 777         /* Key index/algo block */
 778         kidx = b43_kidx_to_fw(dev, index);
 779         value = ((kidx << 4) | algorithm);
 780         b43_shm_write16(dev, B43_SHM_SHARED,
 781                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 782
 783         /* Write the key to the Key Table Pointer offset */
 784         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 785         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 786                 value = key[i];
 787                 value |= (u16) (key[i + 1]) << 8;
 788                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 789         }
 790 }
 791
 792 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 793 {
 794         u32 addrtmp[2] = { 0, 0, };
 795         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 796
 797         if (b43_new_kidx_api(dev))
 798                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 799
 800         B43_WARN_ON(index < pairwise_keys_start);
 801         /* We have four default TX keys and possibly four default RX keys.
 802          * Physical mac 0 is mapped to physical key 4 or 8, depending
 803          * on the firmware version.
 804          * So we must adjust the index here.
 805          */
 806         index -= pairwise_keys_start;
 807         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 808
 809         if (addr) {
 810                 addrtmp[0] = addr[0];
 811                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 812                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 813                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 814                 addrtmp[1] = addr[4];
 815                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 816         }
 817
 818         /* Receive match transmitter address (RCMTA) mechanism */
 819         b43_shm_write32(dev, B43_SHM_RCMTA,
 820                         (index * 2) + 0, addrtmp[0]);
 821         b43_shm_write16(dev, B43_SHM_RCMTA,
 822                         (index * 2) + 1, addrtmp[1]);
 823 }
 824
 825 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 826  * When a packet is received, the iv32 is checked.
 827  * - if it doesn't the packet is returned without modification (and software
 828  *   decryption can be done). That's what happen when iv16 wrap.
 829  * - if it does, the rc4 key is computed, and decryption is tried.
 830  *   Either it will success and B43_RX_MAC_DEC is returned,
 831  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 832  *   and the packet is not usable (it got modified by the ucode).
 833  * So in order to never have B43_RX_MAC_DECERR, we should provide
 834  * a iv32 and phase1key that match. Because we drop packets in case of
 835  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 836  * packets will be lost without higher layer knowing (ie no resync possible
 837  * until next wrap).
 838  *
 839  * NOTE : this should support 50 key like RCMTA because
 840  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 841  */
 842 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 843                 u16 *phase1key)
 844 {
 845         unsigned int i;
 846         u32 offset;
 847         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 848
 849         if (!modparam_hwtkip)
 850                 return;
 851
 852         if (b43_new_kidx_api(dev))
 853                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 854
 855         B43_WARN_ON(index < pairwise_keys_start);
 856         /* We have four default TX keys and possibly four default RX keys.
 857          * Physical mac 0 is mapped to physical key 4 or 8, depending
 858          * on the firmware version.
 859          * So we must adjust the index here.
 860          */
 861         index -= pairwise_keys_start;
 862         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 863
 864         if (b43_debug(dev, B43_DBG_KEYS)) {
 865                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 866                                 index, iv32);
 867         }
 868         /* Write the key to the  RX tkip shared mem */
 869         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 870         for (i = 0; i < 10; i += 2) {
 871                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 872                                 phase1key ? phase1key[i / 2] : 0);
 873         }
 874         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 875         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 876 }
 877
 878 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 879                                    struct ieee80211_vif *vif,
 880                                    struct ieee80211_key_conf *keyconf,
 881                                    struct ieee80211_sta *sta,
 882                                    u32 iv32, u16 *phase1key)
 883 {
 884         struct b43_wl *wl = hw_to_b43_wl(hw);
 885         struct b43_wldev *dev;
 886         int index = keyconf->hw_key_idx;
 887
 888         if (B43_WARN_ON(!modparam_hwtkip))
 889                 return;
 890
 891         /* This is only called from the RX path through mac80211, where
 892          * our mutex is already locked. */
 893         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 894         dev = wl->current_dev;
 895         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 896
 897         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 898
 899         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 900         /* only pairwise TKIP keys are supported right now */
 901         if (WARN_ON(!sta))
 902                 return;
 903         keymac_write(dev, index, sta->addr);
 904 }
 905
 906 static void do_key_write(struct b43_wldev *dev,
 907                          u8 index, u8 algorithm,
 908                          const u8 *key, size_t key_len, const u8 *mac_addr)
 909 {
 910         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 911         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 912
 913         if (b43_new_kidx_api(dev))
 914                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 915
 916         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 917         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 918
 919         if (index >= pairwise_keys_start)
 920                 keymac_write(dev, index, NULL); /* First zero out mac. */
 921         if (algorithm == B43_SEC_ALGO_TKIP) {
 922                 /*
 923                  * We should provide an initial iv32, phase1key pair.
 924                  * We could start with iv32=0 and compute the corresponding
 925                  * phase1key, but this means calling ieee80211_get_tkip_key
 926                  * with a fake skb (or export other tkip function).
 927                  * Because we are lazy we hope iv32 won't start with
 928                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 929                  * correct pair.
 930                  */
 931                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 932         } else if (index >= pairwise_keys_start) /* clear it */
 933                 rx_tkip_phase1_write(dev, index, 0, NULL);
 934         if (key)
 935                 memcpy(buf, key, key_len);
 936         key_write(dev, index, algorithm, buf);
 937         if (index >= pairwise_keys_start)
 938                 keymac_write(dev, index, mac_addr);
 939
 940         dev->key[index].algorithm = algorithm;
 941 }
 942
 943 static int b43_key_write(struct b43_wldev *dev,
 944                          int index, u8 algorithm,
 945                          const u8 *key, size_t key_len,
 946                          const u8 *mac_addr,
 947                          struct ieee80211_key_conf *keyconf)
 948 {
 949         int i;
 950         int pairwise_keys_start;
 951
 952         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 953          *      - Temporal Encryption Key (128 bits)
 954          *      - Temporal Authenticator Tx MIC Key (64 bits)
 955          *      - Temporal Authenticator Rx MIC Key (64 bits)
 956          *
 957          *      Hardware only store TEK
 958          */
 959         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 960                 key_len = 16;
 961         if (key_len > B43_SEC_KEYSIZE)
 962                 return -EINVAL;
 963         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 964                 /* Check that we don't already have this key. */
 965                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 966         }
 967         if (index < 0) {
 968                 /* Pairwise key. Get an empty slot for the key. */
 969                 if (b43_new_kidx_api(dev))
 970                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 971                 else
 972                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 973                 for (i = pairwise_keys_start;
 974                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 975                      i++) {
 976                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 977                         if (!dev->key[i].keyconf) {
 978                                 /* found empty */
 979                                 index = i;
 980                                 break;
 981                         }
 982                 }
 983                 if (index < 0) {
 984                         b43warn(dev->wl, "Out of hardware key memory\n");
 985                         return -ENOSPC;
 986                 }
 987         } else
 988                 B43_WARN_ON(index > 3);
 989
 990         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
 991         if ((index <= 3) && !b43_new_kidx_api(dev)) {
 992                 /* Default RX key */
 993                 B43_WARN_ON(mac_addr);
 994                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
 995         }
 996         keyconf->hw_key_idx = index;
 997         dev->key[index].keyconf = keyconf;
 998
 999         return 0;
1000 }
1001
1002 static int b43_key_clear(struct b43_wldev *dev, int index)
1003 {
1004         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1005                 return -EINVAL;
1006         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1007                      NULL, B43_SEC_KEYSIZE, NULL);
1008         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1009                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1010                              NULL, B43_SEC_KEYSIZE, NULL);
1011         }
1012         dev->key[index].keyconf = NULL;
1013
1014         return 0;
1015 }
1016
1017 static void b43_clear_keys(struct b43_wldev *dev)
1018 {
1019         int i, count;
1020
1021         if (b43_new_kidx_api(dev))
1022                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1023         else
1024                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1025         for (i = 0; i < count; i++)
1026                 b43_key_clear(dev, i);
1027 }
1028
1029 static void b43_dump_keymemory(struct b43_wldev *dev)
1030 {
1031         unsigned int i, index, count, offset, pairwise_keys_start;
1032         u8 mac[ETH_ALEN];
1033         u16 algo;
1034         u32 rcmta0;
1035         u16 rcmta1;
1036         u64 hf;
1037         struct b43_key *key;
1038
1039         if (!b43_debug(dev, B43_DBG_KEYS))
1040                 return;
1041
1042         hf = b43_hf_read(dev);
1043         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1044                !!(hf & B43_HF_USEDEFKEYS));
1045         if (b43_new_kidx_api(dev)) {
1046                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1047                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1048         } else {
1049                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1050                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1051         }
1052         for (index = 0; index < count; index++) {
1053                 key = &(dev->key[index]);
1054                 printk(KERN_DEBUG "Key slot %02u: %s",
1055                        index, (key->keyconf == NULL) ? " " : "*");
1056                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1057                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1058                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1059                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1060                 }
1061
1062                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1063                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1064                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1065
1066                 if (index >= pairwise_keys_start) {
1067                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1068                                 printk("   TKIP: ");
1069                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1070                                 for (i = 0; i < 14; i += 2) {
1071                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1072                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1073                                 }
1074                         }
1075                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1076                                                 ((index - pairwise_keys_start) * 2) + 0);
1077                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1078                                                 ((index - pairwise_keys_start) * 2) + 1);
1079                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1080                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1081                         printk("   MAC: %pM", mac);
1082                 } else
1083                         printk("   DEFAULT KEY");
1084                 printk("\n");
1085         }
1086 }
1087
1088 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1089 {
1090         u32 macctl;
1091         u16 ucstat;
1092         bool hwps;
1093         bool awake;
1094         int i;
1095
1096         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1097                     (ps_flags & B43_PS_DISABLED));
1098         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1099
1100         if (ps_flags & B43_PS_ENABLED) {
1101                 hwps = 1;
1102         } else if (ps_flags & B43_PS_DISABLED) {
1103                 hwps = 0;
1104         } else {
1105                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1106                 //      and thus is not an AP and we are associated, set bit 25
1107         }
1108         if (ps_flags & B43_PS_AWAKE) {
1109                 awake = 1;
1110         } else if (ps_flags & B43_PS_ASLEEP) {
1111                 awake = 0;
1112         } else {
1113                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1114                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1115                 //      successful, set bit26
1116         }
1117
1118 /* FIXME: For now we force awake-on and hwps-off */
1119         hwps = 0;
1120         awake = 1;
1121
1122         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1123         if (hwps)
1124                 macctl |= B43_MACCTL_HWPS;
1125         else
1126                 macctl &= ~B43_MACCTL_HWPS;
1127         if (awake)
1128                 macctl |= B43_MACCTL_AWAKE;
1129         else
1130                 macctl &= ~B43_MACCTL_AWAKE;
1131         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1132         /* Commit write */
1133         b43_read32(dev, B43_MMIO_MACCTL);
1134         if (awake && dev->sdev->id.revision >= 5) {
1135                 /* Wait for the microcode to wake up. */
1136                 for (i = 0; i < 100; i++) {
1137                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1138                                                 B43_SHM_SH_UCODESTAT);
1139                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1140                                 break;
1141                         udelay(10);
1142                 }
1143         }
1144 }
1145
1146 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1147 {
1148         u32 tmslow;
1149
1150         flags |= B43_TMSLOW_PHYCLKEN;
1151         flags |= B43_TMSLOW_PHYRESET;
1152         if (dev->phy.type == B43_PHYTYPE_N)
1153                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1154         ssb_device_enable(dev->sdev, flags);
1155         msleep(2);              /* Wait for the PLL to turn on. */
1156
1157         /* Now take the PHY out of Reset again */
1158         tmslow = ssb_read32(dev->sdev, SSB_TMSLOW);
1159         tmslow |= SSB_TMSLOW_FGC;
1160         tmslow &= ~B43_TMSLOW_PHYRESET;
1161         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
1162         ssb_read32(dev->sdev, SSB_TMSLOW);      /* flush */
1163         msleep(1);
1164         tmslow &= ~SSB_TMSLOW_FGC;
1165         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
1166         ssb_read32(dev->sdev, SSB_TMSLOW);      /* flush */
1167         msleep(1);
1168 }
1169
1170 void b43_wireless_core_reset(struct b43_wldev *dev, u32 flags)
1171 {
1172         u32 macctl;
1173
1174         b43_ssb_wireless_core_reset(dev, flags);
1175
1176         /* Turn Analog ON, but only if we already know the PHY-type.
1177          * This protects against very early setup where we don't know the
1178          * PHY-type, yet. wireless_core_reset will be called once again later,
1179          * when we know the PHY-type. */
1180         if (dev->phy.ops)
1181                 dev->phy.ops->switch_analog(dev, 1);
1182
1183         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1184         macctl &= ~B43_MACCTL_GMODE;
1185         if (flags & B43_TMSLOW_GMODE)
1186                 macctl |= B43_MACCTL_GMODE;
1187         macctl |= B43_MACCTL_IHR_ENABLED;
1188         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1189 }
1190
1191 static void handle_irq_transmit_status(struct b43_wldev *dev)
1192 {
1193         u32 v0, v1;
1194         u16 tmp;
1195         struct b43_txstatus stat;
1196
1197         while (1) {
1198                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1199                 if (!(v0 & 0x00000001))
1200                         break;
1201                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1202
1203                 stat.cookie = (v0 >> 16);
1204                 stat.seq = (v1 & 0x0000FFFF);
1205                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1206                 tmp = (v0 & 0x0000FFFF);
1207                 stat.frame_count = ((tmp & 0xF000) >> 12);
1208                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1209                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1210                 stat.pm_indicated = !!(tmp & 0x0080);
1211                 stat.intermediate = !!(tmp & 0x0040);
1212                 stat.for_ampdu = !!(tmp & 0x0020);
1213                 stat.acked = !!(tmp & 0x0002);
1214
1215                 b43_handle_txstatus(dev, &stat);
1216         }
1217 }
1218
1219 static void drain_txstatus_queue(struct b43_wldev *dev)
1220 {
1221         u32 dummy;
1222
1223         if (dev->sdev->id.revision < 5)
1224                 return;
1225         /* Read all entries from the microcode TXstatus FIFO
1226          * and throw them away.
1227          */
1228         while (1) {
1229                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1230                 if (!(dummy & 0x00000001))
1231                         break;
1232                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1233         }
1234 }
1235
1236 static u32 b43_jssi_read(struct b43_wldev *dev)
1237 {
1238         u32 val = 0;
1239
1240         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1241         val <<= 16;
1242         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1243
1244         return val;
1245 }
1246
1247 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1248 {
1249         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1250         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1251 }
1252
1253 static void b43_generate_noise_sample(struct b43_wldev *dev)
1254 {
1255         b43_jssi_write(dev, 0x7F7F7F7F);
1256         b43_write32(dev, B43_MMIO_MACCMD,
1257                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1258 }
1259
1260 static void b43_calculate_link_quality(struct b43_wldev *dev)
1261 {
1262         /* Top half of Link Quality calculation. */
1263
1264         if (dev->phy.type != B43_PHYTYPE_G)
1265                 return;
1266         if (dev->noisecalc.calculation_running)
1267                 return;
1268         dev->noisecalc.calculation_running = 1;
1269         dev->noisecalc.nr_samples = 0;
1270
1271         b43_generate_noise_sample(dev);
1272 }
1273
1274 static void handle_irq_noise(struct b43_wldev *dev)
1275 {
1276         struct b43_phy_g *phy = dev->phy.g;
1277         u16 tmp;
1278         u8 noise[4];
1279         u8 i, j;
1280         s32 average;
1281
1282         /* Bottom half of Link Quality calculation. */
1283
1284         if (dev->phy.type != B43_PHYTYPE_G)
1285                 return;
1286
1287         /* Possible race condition: It might be possible that the user
1288          * changed to a different channel in the meantime since we
1289          * started the calculation. We ignore that fact, since it's
1290          * not really that much of a problem. The background noise is
1291          * an estimation only anyway. Slightly wrong results will get damped
1292          * by the averaging of the 8 sample rounds. Additionally the
1293          * value is shortlived. So it will be replaced by the next noise
1294          * calculation round soon. */
1295
1296         B43_WARN_ON(!dev->noisecalc.calculation_running);
1297         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1298         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1299             noise[2] == 0x7F || noise[3] == 0x7F)
1300                 goto generate_new;
1301
1302         /* Get the noise samples. */
1303         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1304         i = dev->noisecalc.nr_samples;
1305         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1306         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1307         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1308         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1309         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1310         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1311         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1312         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1313         dev->noisecalc.nr_samples++;
1314         if (dev->noisecalc.nr_samples == 8) {
1315                 /* Calculate the Link Quality by the noise samples. */
1316                 average = 0;
1317                 for (i = 0; i < 8; i++) {
1318                         for (j = 0; j < 4; j++)
1319                                 average += dev->noisecalc.samples[i][j];
1320                 }
1321                 average /= (8 * 4);
1322                 average *= 125;
1323                 average += 64;
1324                 average /= 128;
1325                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1326                 tmp = (tmp / 128) & 0x1F;
1327                 if (tmp >= 8)
1328                         average += 2;
1329                 else
1330                         average -= 25;
1331                 if (tmp == 8)
1332                         average -= 72;
1333                 else
1334                         average -= 48;
1335
1336                 dev->stats.link_noise = average;
1337                 dev->noisecalc.calculation_running = 0;
1338                 return;
1339         }
1340 generate_new:
1341         b43_generate_noise_sample(dev);
1342 }
1343
1344 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1345 {
1346         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1347                 ///TODO: PS TBTT
1348         } else {
1349                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1350                         b43_power_saving_ctl_bits(dev, 0);
1351         }
1352         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1353                 dev->dfq_valid = 1;
1354 }
1355
1356 static void handle_irq_atim_end(struct b43_wldev *dev)
1357 {
1358         if (dev->dfq_valid) {
1359                 b43_write32(dev, B43_MMIO_MACCMD,
1360                             b43_read32(dev, B43_MMIO_MACCMD)
1361                             | B43_MACCMD_DFQ_VALID);
1362                 dev->dfq_valid = 0;
1363         }
1364 }
1365
1366 static void handle_irq_pmq(struct b43_wldev *dev)
1367 {
1368         u32 tmp;
1369
1370         //TODO: AP mode.
1371
1372         while (1) {
1373                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1374                 if (!(tmp & 0x00000008))
1375                         break;
1376         }
1377         /* 16bit write is odd, but correct. */
1378         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1379 }
1380
1381 static void b43_write_template_common(struct b43_wldev *dev,
1382                                       const u8 *data, u16 size,
1383                                       u16 ram_offset,
1384                                       u16 shm_size_offset, u8 rate)
1385 {
1386         u32 i, tmp;
1387         struct b43_plcp_hdr4 plcp;
1388
1389         plcp.data = 0;
1390         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1391         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1392         ram_offset += sizeof(u32);
1393         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1394          * So leave the first two bytes of the next write blank.
1395          */
1396         tmp = (u32) (data[0]) << 16;
1397         tmp |= (u32) (data[1]) << 24;
1398         b43_ram_write(dev, ram_offset, tmp);
1399         ram_offset += sizeof(u32);
1400         for (i = 2; i < size; i += sizeof(u32)) {
1401                 tmp = (u32) (data[i + 0]);
1402                 if (i + 1 < size)
1403                         tmp |= (u32) (data[i + 1]) << 8;
1404                 if (i + 2 < size)
1405                         tmp |= (u32) (data[i + 2]) << 16;
1406                 if (i + 3 < size)
1407                         tmp |= (u32) (data[i + 3]) << 24;
1408                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1409         }
1410         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1411                         size + sizeof(struct b43_plcp_hdr6));
1412 }
1413
1414 /* Check if the use of the antenna that ieee80211 told us to
1415  * use is possible. This will fall back to DEFAULT.
1416  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1417 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1418                                   u8 antenna_nr)
1419 {
1420         u8 antenna_mask;
1421
1422         if (antenna_nr == 0) {
1423                 /* Zero means "use default antenna". That's always OK. */
1424                 return 0;
1425         }
1426
1427         /* Get the mask of available antennas. */
1428         if (dev->phy.gmode)
1429                 antenna_mask = dev->sdev->bus->sprom.ant_available_bg;
1430         else
1431                 antenna_mask = dev->sdev->bus->sprom.ant_available_a;
1432
1433         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1434                 /* This antenna is not available. Fall back to default. */
1435                 return 0;
1436         }
1437
1438         return antenna_nr;
1439 }
1440
1441 /* Convert a b43 antenna number value to the PHY TX control value. */
1442 static u16 b43_antenna_to_phyctl(int antenna)
1443 {
1444         switch (antenna) {
1445         case B43_ANTENNA0:
1446                 return B43_TXH_PHY_ANT0;
1447         case B43_ANTENNA1:
1448                 return B43_TXH_PHY_ANT1;
1449         case B43_ANTENNA2:
1450                 return B43_TXH_PHY_ANT2;
1451         case B43_ANTENNA3:
1452                 return B43_TXH_PHY_ANT3;
1453         case B43_ANTENNA_AUTO0:
1454         case B43_ANTENNA_AUTO1:
1455                 return B43_TXH_PHY_ANT01AUTO;
1456         }
1457         B43_WARN_ON(1);
1458         return 0;
1459 }
1460
1461 static void b43_write_beacon_template(struct b43_wldev *dev,
1462                                       u16 ram_offset,
1463                                       u16 shm_size_offset)
1464 {
1465         unsigned int i, len, variable_len;
1466         const struct ieee80211_mgmt *bcn;
1467         const u8 *ie;
1468         bool tim_found = 0;
1469         unsigned int rate;
1470         u16 ctl;
1471         int antenna;
1472         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1473
1474         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1475         len = min((size_t) dev->wl->current_beacon->len,
1476                   0x200 - sizeof(struct b43_plcp_hdr6));
1477         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1478
1479         b43_write_template_common(dev, (const u8 *)bcn,
1480                                   len, ram_offset, shm_size_offset, rate);
1481
1482         /* Write the PHY TX control parameters. */
1483         antenna = B43_ANTENNA_DEFAULT;
1484         antenna = b43_antenna_to_phyctl(antenna);
1485         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1486         /* We can't send beacons with short preamble. Would get PHY errors. */
1487         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1488         ctl &= ~B43_TXH_PHY_ANT;
1489         ctl &= ~B43_TXH_PHY_ENC;
1490         ctl |= antenna;
1491         if (b43_is_cck_rate(rate))
1492                 ctl |= B43_TXH_PHY_ENC_CCK;
1493         else
1494                 ctl |= B43_TXH_PHY_ENC_OFDM;
1495         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1496
1497         /* Find the position of the TIM and the DTIM_period value
1498          * and write them to SHM. */
1499         ie = bcn->u.beacon.variable;
1500         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1501         for (i = 0; i < variable_len - 2; ) {
1502                 uint8_t ie_id, ie_len;
1503
1504                 ie_id = ie[i];
1505                 ie_len = ie[i + 1];
1506                 if (ie_id == 5) {
1507                         u16 tim_position;
1508                         u16 dtim_period;
1509                         /* This is the TIM Information Element */
1510
1511                         /* Check whether the ie_len is in the beacon data range. */
1512                         if (variable_len < ie_len + 2 + i)
1513                                 break;
1514                         /* A valid TIM is at least 4 bytes long. */
1515                         if (ie_len < 4)
1516                                 break;
1517                         tim_found = 1;
1518
1519                         tim_position = sizeof(struct b43_plcp_hdr6);
1520                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1521                         tim_position += i;
1522
1523                         dtim_period = ie[i + 3];
1524
1525                         b43_shm_write16(dev, B43_SHM_SHARED,
1526                                         B43_SHM_SH_TIMBPOS, tim_position);
1527                         b43_shm_write16(dev, B43_SHM_SHARED,
1528                                         B43_SHM_SH_DTIMPER, dtim_period);
1529                         break;
1530                 }
1531                 i += ie_len + 2;
1532         }
1533         if (!tim_found) {
1534                 /*
1535                  * If ucode wants to modify TIM do it behind the beacon, this
1536                  * will happen, for example, when doing mesh networking.
1537                  */
1538                 b43_shm_write16(dev, B43_SHM_SHARED,
1539                                 B43_SHM_SH_TIMBPOS,
1540                                 len + sizeof(struct b43_plcp_hdr6));
1541                 b43_shm_write16(dev, B43_SHM_SHARED,
1542                                 B43_SHM_SH_DTIMPER, 0);
1543         }
1544         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1545 }
1546
1547 static void b43_upload_beacon0(struct b43_wldev *dev)
1548 {
1549         struct b43_wl *wl = dev->wl;
1550
1551         if (wl->beacon0_uploaded)
1552                 return;
1553         b43_write_beacon_template(dev, 0x68, 0x18);
1554         wl->beacon0_uploaded = 1;
1555 }
1556
1557 static void b43_upload_beacon1(struct b43_wldev *dev)
1558 {
1559         struct b43_wl *wl = dev->wl;
1560
1561         if (wl->beacon1_uploaded)
1562                 return;
1563         b43_write_beacon_template(dev, 0x468, 0x1A);
1564         wl->beacon1_uploaded = 1;
1565 }
1566
1567 static void handle_irq_beacon(struct b43_wldev *dev)
1568 {
1569         struct b43_wl *wl = dev->wl;
1570         u32 cmd, beacon0_valid, beacon1_valid;
1571
1572         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1573             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1574                 return;
1575
1576         /* This is the bottom half of the asynchronous beacon update. */
1577
1578         /* Ignore interrupt in the future. */
1579         dev->irq_mask &= ~B43_IRQ_BEACON;
1580
1581         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1582         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1583         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1584
1585         /* Schedule interrupt manually, if busy. */
1586         if (beacon0_valid && beacon1_valid) {
1587                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1588                 dev->irq_mask |= B43_IRQ_BEACON;
1589                 return;
1590         }
1591
1592         if (unlikely(wl->beacon_templates_virgin)) {
1593                 /* We never uploaded a beacon before.
1594                  * Upload both templates now, but only mark one valid. */
1595                 wl->beacon_templates_virgin = 0;
1596                 b43_upload_beacon0(dev);
1597                 b43_upload_beacon1(dev);
1598                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1599                 cmd |= B43_MACCMD_BEACON0_VALID;
1600                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1601         } else {
1602                 if (!beacon0_valid) {
1603                         b43_upload_beacon0(dev);
1604                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1605                         cmd |= B43_MACCMD_BEACON0_VALID;
1606                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1607                 } else if (!beacon1_valid) {
1608                         b43_upload_beacon1(dev);
1609                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1610                         cmd |= B43_MACCMD_BEACON1_VALID;
1611                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1612                 }
1613         }
1614 }
1615
1616 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1617 {
1618         u32 old_irq_mask = dev->irq_mask;
1619
1620         /* update beacon right away or defer to irq */
1621         handle_irq_beacon(dev);
1622         if (old_irq_mask != dev->irq_mask) {
1623                 /* The handler updated the IRQ mask. */
1624                 B43_WARN_ON(!dev->irq_mask);
1625                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1626                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1627                 } else {
1628                         /* Device interrupts are currently disabled. That means
1629                          * we just ran the hardirq handler and scheduled the
1630                          * IRQ thread. The thread will write the IRQ mask when
1631                          * it finished, so there's nothing to do here. Writing
1632                          * the mask _here_ would incorrectly re-enable IRQs. */
1633                 }
1634         }
1635 }
1636
1637 static void b43_beacon_update_trigger_work(struct work_struct *work)
1638 {
1639         struct b43_wl *wl = container_of(work, struct b43_wl,
1640                                          beacon_update_trigger);
1641         struct b43_wldev *dev;
1642
1643         mutex_lock(&wl->mutex);
1644         dev = wl->current_dev;
1645         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1646                 if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
1647                         /* wl->mutex is enough. */
1648                         b43_do_beacon_update_trigger_work(dev);
1649                         mmiowb();
1650                 } else {
1651                         spin_lock_irq(&wl->hardirq_lock);
1652                         b43_do_beacon_update_trigger_work(dev);
1653                         mmiowb();
1654                         spin_unlock_irq(&wl->hardirq_lock);
1655                 }
1656         }
1657         mutex_unlock(&wl->mutex);
1658 }
1659
1660 /* Asynchronously update the packet templates in template RAM.
1661  * Locking: Requires wl->mutex to be locked. */
1662 static void b43_update_templates(struct b43_wl *wl)
1663 {
1664         struct sk_buff *beacon;
1665
1666         /* This is the top half of the ansynchronous beacon update.
1667          * The bottom half is the beacon IRQ.
1668          * Beacon update must be asynchronous to avoid sending an
1669          * invalid beacon. This can happen for example, if the firmware
1670          * transmits a beacon while we are updating it. */
1671
1672         /* We could modify the existing beacon and set the aid bit in
1673          * the TIM field, but that would probably require resizing and
1674          * moving of data within the beacon template.
1675          * Simply request a new beacon and let mac80211 do the hard work. */
1676         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1677         if (unlikely(!beacon))
1678                 return;
1679
1680         if (wl->current_beacon)
1681                 dev_kfree_skb_any(wl->current_beacon);
1682         wl->current_beacon = beacon;
1683         wl->beacon0_uploaded = 0;
1684         wl->beacon1_uploaded = 0;
1685         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1686 }
1687
1688 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1689 {
1690         b43_time_lock(dev);
1691         if (dev->sdev->id.revision >= 3) {
1692                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1693                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1694         } else {
1695                 b43_write16(dev, 0x606, (beacon_int >> 6));
1696                 b43_write16(dev, 0x610, beacon_int);
1697         }
1698         b43_time_unlock(dev);
1699         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1700 }
1701
1702 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1703 {
1704         u16 reason;
1705
1706         /* Read the register that contains the reason code for the panic. */
1707         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1708         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1709
1710         switch (reason) {
1711         default:
1712                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1713                 /* fallthrough */
1714         case B43_FWPANIC_DIE:
1715                 /* Do not restart the controller or firmware.
1716                  * The device is nonfunctional from now on.
1717                  * Restarting would result in this panic to trigger again,
1718                  * so we avoid that recursion. */
1719                 break;
1720         case B43_FWPANIC_RESTART:
1721                 b43_controller_restart(dev, "Microcode panic");
1722                 break;
1723         }
1724 }
1725
1726 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1727 {
1728         unsigned int i, cnt;
1729         u16 reason, marker_id, marker_line;
1730         __le16 *buf;
1731
1732         /* The proprietary firmware doesn't have this IRQ. */
1733         if (!dev->fw.opensource)
1734                 return;
1735
1736         /* Read the register that contains the reason code for this IRQ. */
1737         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1738
1739         switch (reason) {
1740         case B43_DEBUGIRQ_PANIC:
1741                 b43_handle_firmware_panic(dev);
1742                 break;
1743         case B43_DEBUGIRQ_DUMP_SHM:
1744                 if (!B43_DEBUG)
1745                         break; /* Only with driver debugging enabled. */
1746                 buf = kmalloc(4096, GFP_ATOMIC);
1747                 if (!buf) {
1748                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1749                         goto out;
1750                 }
1751                 for (i = 0; i < 4096; i += 2) {
1752                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1753                         buf[i / 2] = cpu_to_le16(tmp);
1754                 }
1755                 b43info(dev->wl, "Shared memory dump:\n");
1756                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1757                                16, 2, buf, 4096, 1);
1758                 kfree(buf);
1759                 break;
1760         case B43_DEBUGIRQ_DUMP_REGS:
1761                 if (!B43_DEBUG)
1762                         break; /* Only with driver debugging enabled. */
1763                 b43info(dev->wl, "Microcode register dump:\n");
1764                 for (i = 0, cnt = 0; i < 64; i++) {
1765                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1766                         if (cnt == 0)
1767                                 printk(KERN_INFO);
1768                         printk("r%02u: 0x%04X  ", i, tmp);
1769                         cnt++;
1770                         if (cnt == 6) {
1771                                 printk("\n");
1772                                 cnt = 0;
1773                         }
1774                 }
1775                 printk("\n");
1776                 break;
1777         case B43_DEBUGIRQ_MARKER:
1778                 if (!B43_DEBUG)
1779                         break; /* Only with driver debugging enabled. */
1780                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1781                                            B43_MARKER_ID_REG);
1782                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1783                                              B43_MARKER_LINE_REG);
1784                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1785                         "at line number %u\n",
1786                         marker_id, marker_line);
1787                 break;
1788         default:
1789                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1790                        reason);
1791         }
1792 out:
1793         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1794         b43_shm_write16(dev, B43_SHM_SCRATCH,
1795                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1796 }
1797
1798 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1799 {
1800         u32 reason;
1801         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1802         u32 merged_dma_reason = 0;
1803         int i;
1804
1805         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1806                 return;
1807
1808         reason = dev->irq_reason;
1809         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1810                 dma_reason[i] = dev->dma_reason[i];
1811                 merged_dma_reason |= dma_reason[i];
1812         }
1813
1814         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1815                 b43err(dev->wl, "MAC transmission error\n");
1816
1817         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1818                 b43err(dev->wl, "PHY transmission error\n");
1819                 rmb();
1820                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1821                         atomic_set(&dev->phy.txerr_cnt,
1822                                    B43_PHY_TX_BADNESS_LIMIT);
1823                         b43err(dev->wl, "Too many PHY TX errors, "
1824                                         "restarting the controller\n");
1825                         b43_controller_restart(dev, "PHY TX errors");
1826                 }
1827         }
1828
1829         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1830                                           B43_DMAIRQ_NONFATALMASK))) {
1831                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1832                         b43err(dev->wl, "Fatal DMA error: "
1833                                "0x%08X, 0x%08X, 0x%08X, "
1834                                "0x%08X, 0x%08X, 0x%08X\n",
1835                                dma_reason[0], dma_reason[1],
1836                                dma_reason[2], dma_reason[3],
1837                                dma_reason[4], dma_reason[5]);
1838                         b43err(dev->wl, "This device does not support DMA "
1839                                "on your system. It will now be switched to PIO.\n");
1840                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1841                         dev->use_pio = 1;
1842                         b43_controller_restart(dev, "DMA error");
1843                         return;
1844                 }
1845                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1846                         b43err(dev->wl, "DMA error: "
1847                                "0x%08X, 0x%08X, 0x%08X, "
1848                                "0x%08X, 0x%08X, 0x%08X\n",
1849                                dma_reason[0], dma_reason[1],
1850                                dma_reason[2], dma_reason[3],
1851                                dma_reason[4], dma_reason[5]);
1852                 }
1853         }
1854
1855         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1856                 handle_irq_ucode_debug(dev);
1857         if (reason & B43_IRQ_TBTT_INDI)
1858                 handle_irq_tbtt_indication(dev);
1859         if (reason & B43_IRQ_ATIM_END)
1860                 handle_irq_atim_end(dev);
1861         if (reason & B43_IRQ_BEACON)
1862                 handle_irq_beacon(dev);
1863         if (reason & B43_IRQ_PMQ)
1864                 handle_irq_pmq(dev);
1865         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1866                 ;/* TODO */
1867         if (reason & B43_IRQ_NOISESAMPLE_OK)
1868                 handle_irq_noise(dev);
1869
1870         /* Check the DMA reason registers for received data. */
1871         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1872                 if (b43_using_pio_transfers(dev))
1873                         b43_pio_rx(dev->pio.rx_queue);
1874                 else
1875                         b43_dma_rx(dev->dma.rx_ring);
1876         }
1877         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1878         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1879         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1880         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1881         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1882
1883         if (reason & B43_IRQ_TX_OK)
1884                 handle_irq_transmit_status(dev);
1885
1886         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1887         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1888
1889 #if B43_DEBUG
1890         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1891                 dev->irq_count++;
1892                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1893                         if (reason & (1 << i))
1894                                 dev->irq_bit_count[i]++;
1895                 }
1896         }
1897 #endif
1898 }
1899
1900 /* Interrupt thread handler. Handles device interrupts in thread context. */
1901 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1902 {
1903         struct b43_wldev *dev = dev_id;
1904
1905         mutex_lock(&dev->wl->mutex);
1906         b43_do_interrupt_thread(dev);
1907         mmiowb();
1908         mutex_unlock(&dev->wl->mutex);
1909
1910         return IRQ_HANDLED;
1911 }
1912
1913 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1914 {
1915         u32 reason;
1916
1917         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1918          * On SDIO, this runs under wl->mutex. */
1919
1920         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1921         if (reason == 0xffffffff)       /* shared IRQ */
1922                 return IRQ_NONE;
1923         reason &= dev->irq_mask;
1924         if (!reason)
1925                 return IRQ_HANDLED;
1926
1927         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1928             & 0x0001DC00;
1929         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1930             & 0x0000DC00;
1931         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1932             & 0x0000DC00;
1933         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1934             & 0x0001DC00;
1935         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1936             & 0x0000DC00;
1937 /* Unused ring
1938         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
1939             & 0x0000DC00;
1940 */
1941
1942         /* ACK the interrupt. */
1943         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
1944         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
1945         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
1946         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
1947         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
1948         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
1949 /* Unused ring
1950         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
1951 */
1952
1953         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
1954         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
1955         /* Save the reason bitmasks for the IRQ thread handler. */
1956         dev->irq_reason = reason;
1957
1958         return IRQ_WAKE_THREAD;
1959 }
1960
1961 /* Interrupt handler top-half. This runs with interrupts disabled. */
1962 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
1963 {
1964         struct b43_wldev *dev = dev_id;
1965         irqreturn_t ret;
1966
1967         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
1968                 return IRQ_NONE;
1969
1970         spin_lock(&dev->wl->hardirq_lock);
1971         ret = b43_do_interrupt(dev);
1972         mmiowb();
1973         spin_unlock(&dev->wl->hardirq_lock);
1974
1975         return ret;
1976 }
1977
1978 /* SDIO interrupt handler. This runs in process context. */
1979 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
1980 {
1981         struct b43_wl *wl = dev->wl;
1982         irqreturn_t ret;
1983
1984         mutex_lock(&wl->mutex);
1985
1986         ret = b43_do_interrupt(dev);
1987         if (ret == IRQ_WAKE_THREAD)
1988                 b43_do_interrupt_thread(dev);
1989
1990         mutex_unlock(&wl->mutex);
1991 }
1992
1993 void b43_do_release_fw(struct b43_firmware_file *fw)
1994 {
1995         release_firmware(fw->data);
1996         fw->data = NULL;
1997         fw->filename = NULL;
1998 }
1999
2000 static void b43_release_firmware(struct b43_wldev *dev)
2001 {
2002         b43_do_release_fw(&dev->fw.ucode);
2003         b43_do_release_fw(&dev->fw.pcm);
2004         b43_do_release_fw(&dev->fw.initvals);
2005         b43_do_release_fw(&dev->fw.initvals_band);
2006 }
2007
2008 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2009 {
2010         const char text[] =
2011                 "You must go to " \
2012                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2013                 "and download the correct firmware for this driver version. " \
2014                 "Please carefully read all instructions on this website.\n";
2015
2016         if (error)
2017                 b43err(wl, text);
2018         else
2019                 b43warn(wl, text);
2020 }
2021
2022 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2023                       const char *name,
2024                       struct b43_firmware_file *fw)
2025 {
2026         const struct firmware *blob;
2027         struct b43_fw_header *hdr;
2028         u32 size;
2029         int err;
2030
2031         if (!name) {
2032                 /* Don't fetch anything. Free possibly cached firmware. */
2033                 /* FIXME: We should probably keep it anyway, to save some headache
2034                  * on suspend/resume with multiband devices. */
2035                 b43_do_release_fw(fw);
2036                 return 0;
2037         }
2038         if (fw->filename) {
2039                 if ((fw->type == ctx->req_type) &&
2040                     (strcmp(fw->filename, name) == 0))
2041                         return 0; /* Already have this fw. */
2042                 /* Free the cached firmware first. */
2043                 /* FIXME: We should probably do this later after we successfully
2044                  * got the new fw. This could reduce headache with multiband devices.
2045                  * We could also redesign this to cache the firmware for all possible
2046                  * bands all the time. */
2047                 b43_do_release_fw(fw);
2048         }
2049
2050         switch (ctx->req_type) {
2051         case B43_FWTYPE_PROPRIETARY:
2052                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2053                          "b43%s/%s.fw",
2054                          modparam_fwpostfix, name);
2055                 break;
2056         case B43_FWTYPE_OPENSOURCE:
2057                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2058                          "b43-open%s/%s.fw",
2059                          modparam_fwpostfix, name);
2060                 break;
2061         default:
2062                 B43_WARN_ON(1);
2063                 return -ENOSYS;
2064         }
2065         err = request_firmware(&blob, ctx->fwname, ctx->dev->sdev->dev);
2066         if (err == -ENOENT) {
2067                 snprintf(ctx->errors[ctx->req_type],
2068                          sizeof(ctx->errors[ctx->req_type]),
2069                          "Firmware file \"%s\" not found\n", ctx->fwname);
2070                 return err;
2071         } else if (err) {
2072                 snprintf(ctx->errors[ctx->req_type],
2073                          sizeof(ctx->errors[ctx->req_type]),
2074                          "Firmware file \"%s\" request failed (err=%d)\n",
2075                          ctx->fwname, err);
2076                 return err;
2077         }
2078         if (blob->size < sizeof(struct b43_fw_header))
2079                 goto err_format;
2080         hdr = (struct b43_fw_header *)(blob->data);
2081         switch (hdr->type) {
2082         case B43_FW_TYPE_UCODE:
2083         case B43_FW_TYPE_PCM:
2084                 size = be32_to_cpu(hdr->size);
2085                 if (size != blob->size - sizeof(struct b43_fw_header))
2086                         goto err_format;
2087                 /* fallthrough */
2088         case B43_FW_TYPE_IV:
2089                 if (hdr->ver != 1)
2090                         goto err_format;
2091                 break;
2092         default:
2093                 goto err_format;
2094         }
2095
2096         fw->data = blob;
2097         fw->filename = name;
2098         fw->type = ctx->req_type;
2099
2100         return 0;
2101
2102 err_format:
2103         snprintf(ctx->errors[ctx->req_type],
2104                  sizeof(ctx->errors[ctx->req_type]),
2105                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2106         release_firmware(blob);
2107
2108         return -EPROTO;
2109 }
2110
2111 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2112 {
2113         struct b43_wldev *dev = ctx->dev;
2114         struct b43_firmware *fw = &ctx->dev->fw;
2115         const u8 rev = ctx->dev->sdev->id.revision;
2116         const char *filename;
2117         u32 tmshigh;
2118         int err;
2119
2120         /* Get microcode */
2121         tmshigh = ssb_read32(dev->sdev, SSB_TMSHIGH);
2122         if ((rev >= 5) && (rev <= 10))
2123                 filename = "ucode5";
2124         else if ((rev >= 11) && (rev <= 12))
2125                 filename = "ucode11";
2126         else if (rev == 13)
2127                 filename = "ucode13";
2128         else if (rev == 14)
2129                 filename = "ucode14";
2130         else if (rev == 15)
2131                 filename = "ucode15";
2132         else if ((rev >= 16) && (rev <= 20))
2133                 filename = "ucode16_mimo";
2134         else
2135                 goto err_no_ucode;
2136         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2137         if (err)
2138                 goto err_load;
2139
2140         /* Get PCM code */
2141         if ((rev >= 5) && (rev <= 10))
2142                 filename = "pcm5";
2143         else if (rev >= 11)
2144                 filename = NULL;
2145         else
2146                 goto err_no_pcm;
2147         fw->pcm_request_failed = 0;
2148         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2149         if (err == -ENOENT) {
2150                 /* We did not find a PCM file? Not fatal, but
2151                  * core rev <= 10 must do without hwcrypto then. */
2152                 fw->pcm_request_failed = 1;
2153         } else if (err)
2154                 goto err_load;
2155
2156         /* Get initvals */
2157         switch (dev->phy.type) {
2158         case B43_PHYTYPE_A:
2159                 if ((rev >= 5) && (rev <= 10)) {
2160                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2161                                 filename = "a0g1initvals5";
2162                         else
2163                                 filename = "a0g0initvals5";
2164                 } else
2165                         goto err_no_initvals;
2166                 break;
2167         case B43_PHYTYPE_G:
2168                 if ((rev >= 5) && (rev <= 10))
2169                         filename = "b0g0initvals5";
2170                 else if (rev >= 13)
2171                         filename = "b0g0initvals13";
2172                 else
2173                         goto err_no_initvals;
2174                 break;
2175         case B43_PHYTYPE_N:
2176                 if (rev >= 16)
2177                         filename = "n0initvals16";
2178                 else if ((rev >= 11) && (rev <= 12))
2179                         filename = "n0initvals11";
2180                 else
2181                         goto err_no_initvals;
2182                 break;
2183         case B43_PHYTYPE_LP:
2184                 if (rev == 13)
2185                         filename = "lp0initvals13";
2186                 else if (rev == 14)
2187                         filename = "lp0initvals14";
2188                 else if (rev >= 15)
2189                         filename = "lp0initvals15";
2190                 else
2191                         goto err_no_initvals;
2192                 break;
2193         default:
2194                 goto err_no_initvals;
2195         }
2196         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2197         if (err)
2198                 goto err_load;
2199
2200         /* Get bandswitch initvals */
2201         switch (dev->phy.type) {
2202         case B43_PHYTYPE_A:
2203                 if ((rev >= 5) && (rev <= 10)) {
2204                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2205                                 filename = "a0g1bsinitvals5";
2206                         else
2207                                 filename = "a0g0bsinitvals5";
2208                 } else if (rev >= 11)
2209                         filename = NULL;
2210                 else
2211                         goto err_no_initvals;
2212                 break;
2213         case B43_PHYTYPE_G:
2214                 if ((rev >= 5) && (rev <= 10))
2215                         filename = "b0g0bsinitvals5";
2216                 else if (rev >= 11)
2217                         filename = NULL;
2218                 else
2219                         goto err_no_initvals;
2220                 break;
2221         case B43_PHYTYPE_N:
2222                 if (rev >= 16)
2223                         filename = "n0bsinitvals16";
2224                 else if ((rev >= 11) && (rev <= 12))
2225                         filename = "n0bsinitvals11";
2226                 else
2227                         goto err_no_initvals;
2228                 break;
2229         case B43_PHYTYPE_LP:
2230                 if (rev == 13)
2231                         filename = "lp0bsinitvals13";
2232                 else if (rev == 14)
2233                         filename = "lp0bsinitvals14";
2234                 else if (rev >= 15)
2235                         filename = "lp0bsinitvals15";
2236                 else
2237                         goto err_no_initvals;
2238                 break;
2239         default:
2240                 goto err_no_initvals;
2241         }
2242         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2243         if (err)
2244                 goto err_load;
2245
2246         return 0;
2247
2248 err_no_ucode:
2249         err = ctx->fatal_failure = -EOPNOTSUPP;
2250         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2251                "is required for your device (wl-core rev %u)\n", rev);
2252         goto error;
2253
2254 err_no_pcm:
2255         err = ctx->fatal_failure = -EOPNOTSUPP;
2256         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2257                "is required for your device (wl-core rev %u)\n", rev);
2258         goto error;
2259
2260 err_no_initvals:
2261         err = ctx->fatal_failure = -EOPNOTSUPP;
2262         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2263                "is required for your device (wl-core rev %u)\n", rev);
2264         goto error;
2265
2266 err_load:
2267         /* We failed to load this firmware image. The error message
2268          * already is in ctx->errors. Return and let our caller decide
2269          * what to do. */
2270         goto error;
2271
2272 error:
2273         b43_release_firmware(dev);
2274         return err;
2275 }
2276
2277 static int b43_request_firmware(struct b43_wldev *dev)
2278 {
2279         struct b43_request_fw_context *ctx;
2280         unsigned int i;
2281         int err;
2282         const char *errmsg;
2283
2284         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2285         if (!ctx)
2286                 return -ENOMEM;
2287         ctx->dev = dev;
2288
2289         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2290         err = b43_try_request_fw(ctx);
2291         if (!err)
2292                 goto out; /* Successfully loaded it. */
2293         err = ctx->fatal_failure;
2294         if (err)
2295                 goto out;
2296
2297         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2298         err = b43_try_request_fw(ctx);
2299         if (!err)
2300                 goto out; /* Successfully loaded it. */
2301         err = ctx->fatal_failure;
2302         if (err)
2303                 goto out;
2304
2305         /* Could not find a usable firmware. Print the errors. */
2306         for (i = 0; i < B43_NR_FWTYPES; i++) {
2307                 errmsg = ctx->errors[i];
2308                 if (strlen(errmsg))
2309                         b43err(dev->wl, errmsg);
2310         }
2311         b43_print_fw_helptext(dev->wl, 1);
2312         err = -ENOENT;
2313
2314 out:
2315         kfree(ctx);
2316         return err;
2317 }
2318
2319 static int b43_upload_microcode(struct b43_wldev *dev)
2320 {
2321         struct wiphy *wiphy = dev->wl->hw->wiphy;
2322         const size_t hdr_len = sizeof(struct b43_fw_header);
2323         const __be32 *data;
2324         unsigned int i, len;
2325         u16 fwrev, fwpatch, fwdate, fwtime;
2326         u32 tmp, macctl;
2327         int err = 0;
2328
2329         /* Jump the microcode PSM to offset 0 */
2330         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2331         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2332         macctl |= B43_MACCTL_PSM_JMP0;
2333         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2334         /* Zero out all microcode PSM registers and shared memory. */
2335         for (i = 0; i < 64; i++)
2336                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2337         for (i = 0; i < 4096; i += 2)
2338                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2339
2340         /* Upload Microcode. */
2341         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2342         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2343         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2344         for (i = 0; i < len; i++) {
2345                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2346                 udelay(10);
2347         }
2348
2349         if (dev->fw.pcm.data) {
2350                 /* Upload PCM data. */
2351                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2352                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2353                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2354                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2355                 /* No need for autoinc bit in SHM_HW */
2356                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2357                 for (i = 0; i < len; i++) {
2358                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2359                         udelay(10);
2360                 }
2361         }
2362
2363         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2364
2365         /* Start the microcode PSM */
2366         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2367         macctl &= ~B43_MACCTL_PSM_JMP0;
2368         macctl |= B43_MACCTL_PSM_RUN;
2369         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2370
2371         /* Wait for the microcode to load and respond */
2372         i = 0;
2373         while (1) {
2374                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2375                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2376                         break;
2377                 i++;
2378                 if (i >= 20) {
2379                         b43err(dev->wl, "Microcode not responding\n");
2380                         b43_print_fw_helptext(dev->wl, 1);
2381                         err = -ENODEV;
2382                         goto error;
2383                 }
2384                 msleep(50);
2385         }
2386         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2387
2388         /* Get and check the revisions. */
2389         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2390         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2391         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2392         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2393
2394         if (fwrev <= 0x128) {
2395                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2396                        "binary drivers older than version 4.x is unsupported. "
2397                        "You must upgrade your firmware files.\n");
2398                 b43_print_fw_helptext(dev->wl, 1);
2399                 err = -EOPNOTSUPP;
2400                 goto error;
2401         }
2402         dev->fw.rev = fwrev;
2403         dev->fw.patch = fwpatch;
2404         dev->fw.opensource = (fwdate == 0xFFFF);
2405
2406         /* Default to use-all-queues. */
2407         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2408         dev->qos_enabled = !!modparam_qos;
2409         /* Default to firmware/hardware crypto acceleration. */
2410         dev->hwcrypto_enabled = 1;
2411
2412         if (dev->fw.opensource) {
2413                 u16 fwcapa;
2414
2415                 /* Patchlevel info is encoded in the "time" field. */
2416                 dev->fw.patch = fwtime;
2417                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2418                         dev->fw.rev, dev->fw.patch);
2419
2420                 fwcapa = b43_fwcapa_read(dev);
2421                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2422                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2423                         /* Disable hardware crypto and fall back to software crypto. */
2424                         dev->hwcrypto_enabled = 0;
2425                 }
2426                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2427                         b43info(dev->wl, "QoS not supported by firmware\n");
2428                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2429                          * ieee80211_unregister to make sure the networking core can
2430                          * properly free possible resources. */
2431                         dev->wl->hw->queues = 1;
2432                         dev->qos_enabled = 0;
2433                 }
2434         } else {
2435                 b43info(dev->wl, "Loading firmware version %u.%u "
2436                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2437                         fwrev, fwpatch,
2438                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2439                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2440                 if (dev->fw.pcm_request_failed) {
2441                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2442                                 "Hardware accelerated cryptography is disabled.\n");
2443                         b43_print_fw_helptext(dev->wl, 0);
2444                 }
2445         }
2446
2447         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2448                         dev->fw.rev, dev->fw.patch);
2449         wiphy->hw_version = dev->sdev->id.coreid;
2450
2451         if (b43_is_old_txhdr_format(dev)) {
2452                 /* We're over the deadline, but we keep support for old fw
2453                  * until it turns out to be in major conflict with something new. */
2454                 b43warn(dev->wl, "You are using an old firmware image. "
2455                         "Support for old firmware will be removed soon "
2456                         "(official deadline was July 2008).\n");
2457                 b43_print_fw_helptext(dev->wl, 0);
2458         }
2459
2460         return 0;
2461
2462 error:
2463         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2464         macctl &= ~B43_MACCTL_PSM_RUN;
2465         macctl |= B43_MACCTL_PSM_JMP0;
2466         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2467
2468         return err;
2469 }
2470
2471 static int b43_write_initvals(struct b43_wldev *dev,
2472                               const struct b43_iv *ivals,
2473                               size_t count,
2474                               size_t array_size)
2475 {
2476         const struct b43_iv *iv;
2477         u16 offset;
2478         size_t i;
2479         bool bit32;
2480
2481         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2482         iv = ivals;
2483         for (i = 0; i < count; i++) {
2484                 if (array_size < sizeof(iv->offset_size))
2485                         goto err_format;
2486                 array_size -= sizeof(iv->offset_size);
2487                 offset = be16_to_cpu(iv->offset_size);
2488                 bit32 = !!(offset & B43_IV_32BIT);
2489                 offset &= B43_IV_OFFSET_MASK;
2490                 if (offset >= 0x1000)
2491                         goto err_format;
2492                 if (bit32) {
2493                         u32 value;
2494
2495                         if (array_size < sizeof(iv->data.d32))
2496                                 goto err_format;
2497                         array_size -= sizeof(iv->data.d32);
2498
2499                         value = get_unaligned_be32(&iv->data.d32);
2500                         b43_write32(dev, offset, value);
2501
2502                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2503                                                         sizeof(__be16) +
2504                                                         sizeof(__be32));
2505                 } else {
2506                         u16 value;
2507
2508                         if (array_size < sizeof(iv->data.d16))
2509                                 goto err_format;
2510                         array_size -= sizeof(iv->data.d16);
2511
2512                         value = be16_to_cpu(iv->data.d16);
2513                         b43_write16(dev, offset, value);
2514
2515                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2516                                                         sizeof(__be16) +
2517                                                         sizeof(__be16));
2518                 }
2519         }
2520         if (array_size)
2521                 goto err_format;
2522
2523         return 0;
2524
2525 err_format:
2526         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2527         b43_print_fw_helptext(dev->wl, 1);
2528
2529         return -EPROTO;
2530 }
2531
2532 static int b43_upload_initvals(struct b43_wldev *dev)
2533 {
2534         const size_t hdr_len = sizeof(struct b43_fw_header);
2535         const struct b43_fw_header *hdr;
2536         struct b43_firmware *fw = &dev->fw;
2537         const struct b43_iv *ivals;
2538         size_t count;
2539         int err;
2540
2541         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2542         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2543         count = be32_to_cpu(hdr->size);
2544         err = b43_write_initvals(dev, ivals, count,
2545                                  fw->initvals.data->size - hdr_len);
2546         if (err)
2547                 goto out;
2548         if (fw->initvals_band.data) {
2549                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2550                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2551                 count = be32_to_cpu(hdr->size);
2552                 err = b43_write_initvals(dev, ivals, count,
2553                                          fw->initvals_band.data->size - hdr_len);
2554                 if (err)
2555                         goto out;
2556         }
2557 out:
2558
2559         return err;
2560 }
2561
2562 /* Initialize the GPIOs
2563  * http://bcm-specs.sipsolutions.net/GPIO
2564  */
2565 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2566 {
2567         struct ssb_bus *bus = dev->sdev->bus;
2568
2569 #ifdef CONFIG_SSB_DRIVER_PCICORE
2570         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2571 #else
2572         return bus->chipco.dev;
2573 #endif
2574 }
2575
2576 static int b43_gpio_init(struct b43_wldev *dev)
2577 {
2578         struct ssb_device *gpiodev;
2579         u32 mask, set;
2580
2581         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2582                     & ~B43_MACCTL_GPOUTSMSK);
2583
2584         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2585                     | 0x000F);
2586
2587         mask = 0x0000001F;
2588         set = 0x0000000F;
2589         if (dev->sdev->bus->chip_id == 0x4301) {
2590                 mask |= 0x0060;
2591                 set |= 0x0060;
2592         }
2593         if (0 /* FIXME: conditional unknown */ ) {
2594                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2595                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2596                             | 0x0100);
2597                 mask |= 0x0180;
2598                 set |= 0x0180;
2599         }
2600         if (dev->sdev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
2601                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2602                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2603                             | 0x0200);
2604                 mask |= 0x0200;
2605                 set |= 0x0200;
2606         }
2607         if (dev->sdev->id.revision >= 2)
2608                 mask |= 0x0010; /* FIXME: This is redundant. */
2609
2610         gpiodev = b43_ssb_gpio_dev(dev);
2611         if (gpiodev)
2612                 ssb_write32(gpiodev, B43_GPIO_CONTROL,
2613                             (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2614                              & mask) | set);
2615
2616         return 0;
2617 }
2618
2619 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2620 static void b43_gpio_cleanup(struct b43_wldev *dev)
2621 {
2622         struct ssb_device *gpiodev;
2623
2624         gpiodev = b43_ssb_gpio_dev(dev);
2625         if (gpiodev)
2626                 ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2627 }
2628
2629 /* http://bcm-specs.sipsolutions.net/EnableMac */
2630 void b43_mac_enable(struct b43_wldev *dev)
2631 {
2632         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2633                 u16 fwstate;
2634
2635                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2636                                          B43_SHM_SH_UCODESTAT);
2637                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2638                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2639                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2640                                "should be suspended, but current state is %u\n",
2641                                fwstate);
2642                 }
2643         }
2644
2645         dev->mac_suspended--;
2646         B43_WARN_ON(dev->mac_suspended < 0);
2647         if (dev->mac_suspended == 0) {
2648                 b43_write32(dev, B43_MMIO_MACCTL,
2649                             b43_read32(dev, B43_MMIO_MACCTL)
2650                             | B43_MACCTL_ENABLED);
2651                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2652                             B43_IRQ_MAC_SUSPENDED);
2653                 /* Commit writes */
2654                 b43_read32(dev, B43_MMIO_MACCTL);
2655                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2656                 b43_power_saving_ctl_bits(dev, 0);
2657         }
2658 }
2659
2660 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2661 void b43_mac_suspend(struct b43_wldev *dev)
2662 {
2663         int i;
2664         u32 tmp;
2665
2666         might_sleep();
2667         B43_WARN_ON(dev->mac_suspended < 0);
2668
2669         if (dev->mac_suspended == 0) {
2670                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2671                 b43_write32(dev, B43_MMIO_MACCTL,
2672                             b43_read32(dev, B43_MMIO_MACCTL)
2673                             & ~B43_MACCTL_ENABLED);
2674                 /* force pci to flush the write */
2675                 b43_read32(dev, B43_MMIO_MACCTL);
2676                 for (i = 35; i; i--) {
2677                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2678                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2679                                 goto out;
2680                         udelay(10);
2681                 }
2682                 /* Hm, it seems this will take some time. Use msleep(). */
2683                 for (i = 40; i; i--) {
2684                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2685                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2686                                 goto out;
2687                         msleep(1);
2688                 }
2689                 b43err(dev->wl, "MAC suspend failed\n");
2690         }
2691 out:
2692         dev->mac_suspended++;
2693 }
2694
2695 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2696 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2697 {
2698         u32 tmslow = ssb_read32(dev->sdev, SSB_TMSLOW);
2699         if (on)
2700                 tmslow |= B43_TMSLOW_MACPHYCLKEN;
2701         else
2702                 tmslow &= ~B43_TMSLOW_MACPHYCLKEN;
2703         ssb_write32(dev->sdev, SSB_TMSLOW, tmslow);
2704 }
2705
2706 static void b43_adjust_opmode(struct b43_wldev *dev)
2707 {
2708         struct b43_wl *wl = dev->wl;
2709         u32 ctl;
2710         u16 cfp_pretbtt;
2711
2712         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2713         /* Reset status to STA infrastructure mode. */
2714         ctl &= ~B43_MACCTL_AP;
2715         ctl &= ~B43_MACCTL_KEEP_CTL;
2716         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2717         ctl &= ~B43_MACCTL_KEEP_BAD;
2718         ctl &= ~B43_MACCTL_PROMISC;
2719         ctl &= ~B43_MACCTL_BEACPROMISC;
2720         ctl |= B43_MACCTL_INFRA;
2721
2722         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2723             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2724                 ctl |= B43_MACCTL_AP;
2725         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2726                 ctl &= ~B43_MACCTL_INFRA;
2727
2728         if (wl->filter_flags & FIF_CONTROL)
2729                 ctl |= B43_MACCTL_KEEP_CTL;
2730         if (wl->filter_flags & FIF_FCSFAIL)
2731                 ctl |= B43_MACCTL_KEEP_BAD;
2732         if (wl->filter_flags & FIF_PLCPFAIL)
2733                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2734         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2735                 ctl |= B43_MACCTL_PROMISC;
2736         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2737                 ctl |= B43_MACCTL_BEACPROMISC;
2738
2739         /* Workaround: On old hardware the HW-MAC-address-filter
2740          * doesn't work properly, so always run promisc in filter
2741          * it in software. */
2742         if (dev->sdev->id.revision <= 4)
2743                 ctl |= B43_MACCTL_PROMISC;
2744
2745         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2746
2747         cfp_pretbtt = 2;
2748         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2749                 if (dev->sdev->bus->chip_id == 0x4306 &&
2750                     dev->sdev->bus->chip_rev == 3)
2751                         cfp_pretbtt = 100;
2752                 else
2753                         cfp_pretbtt = 50;
2754         }
2755         b43_write16(dev, 0x612, cfp_pretbtt);
2756
2757         /* FIXME: We don't currently implement the PMQ mechanism,
2758          *        so always disable it. If we want to implement PMQ,
2759          *        we need to enable it here (clear DISCPMQ) in AP mode.
2760          */
2761         if (0  /* ctl & B43_MACCTL_AP */) {
2762                 b43_write32(dev, B43_MMIO_MACCTL,
2763                             b43_read32(dev, B43_MMIO_MACCTL)
2764                             & ~B43_MACCTL_DISCPMQ);
2765         } else {
2766                 b43_write32(dev, B43_MMIO_MACCTL,
2767                             b43_read32(dev, B43_MMIO_MACCTL)
2768                             | B43_MACCTL_DISCPMQ);
2769         }
2770 }
2771
2772 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2773 {
2774         u16 offset;
2775
2776         if (is_ofdm) {
2777                 offset = 0x480;
2778                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2779         } else {
2780                 offset = 0x4C0;
2781                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2782         }
2783         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2784                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2785 }
2786
2787 static void b43_rate_memory_init(struct b43_wldev *dev)
2788 {
2789         switch (dev->phy.type) {
2790         case B43_PHYTYPE_A:
2791         case B43_PHYTYPE_G:
2792         case B43_PHYTYPE_N:
2793         case B43_PHYTYPE_LP:
2794                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2795                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2796                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2797                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2798                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2799                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2800                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2801                 if (dev->phy.type == B43_PHYTYPE_A)
2802                         break;
2803                 /* fallthrough */
2804         case B43_PHYTYPE_B:
2805                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2806                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2807                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2808                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2809                 break;
2810         default:
2811                 B43_WARN_ON(1);
2812         }
2813 }
2814
2815 /* Set the default values for the PHY TX Control Words. */
2816 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2817 {
2818         u16 ctl = 0;
2819
2820         ctl |= B43_TXH_PHY_ENC_CCK;
2821         ctl |= B43_TXH_PHY_ANT01AUTO;
2822         ctl |= B43_TXH_PHY_TXPWR;
2823
2824         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2825         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2826         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2827 }
2828
2829 /* Set the TX-Antenna for management frames sent by firmware. */
2830 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2831 {
2832         u16 ant;
2833         u16 tmp;
2834
2835         ant = b43_antenna_to_phyctl(antenna);
2836
2837         /* For ACK/CTS */
2838         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2839         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2840         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2841         /* For Probe Resposes */
2842         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2843         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2844         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2845 }
2846
2847 /* This is the opposite of b43_chip_init() */
2848 static void b43_chip_exit(struct b43_wldev *dev)
2849 {
2850         b43_phy_exit(dev);
2851         b43_gpio_cleanup(dev);
2852         /* firmware is released later */
2853 }
2854
2855 /* Initialize the chip
2856  * http://bcm-specs.sipsolutions.net/ChipInit
2857  */
2858 static int b43_chip_init(struct b43_wldev *dev)
2859 {
2860         struct b43_phy *phy = &dev->phy;
2861         int err;
2862         u32 macctl;
2863         u16 value16;
2864
2865         /* Initialize the MAC control */
2866         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
2867         if (dev->phy.gmode)
2868                 macctl |= B43_MACCTL_GMODE;
2869         macctl |= B43_MACCTL_INFRA;
2870         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2871
2872         err = b43_request_firmware(dev);
2873         if (err)
2874                 goto out;
2875         err = b43_upload_microcode(dev);
2876         if (err)
2877                 goto out;       /* firmware is released later */
2878
2879         err = b43_gpio_init(dev);
2880         if (err)
2881                 goto out;       /* firmware is released later */
2882
2883         err = b43_upload_initvals(dev);
2884         if (err)
2885                 goto err_gpio_clean;
2886
2887         /* Turn the Analog on and initialize the PHY. */
2888         phy->ops->switch_analog(dev, 1);
2889         err = b43_phy_init(dev);
2890         if (err)
2891                 goto err_gpio_clean;
2892
2893         /* Disable Interference Mitigation. */
2894         if (phy->ops->interf_mitigation)
2895                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
2896
2897         /* Select the antennae */
2898         if (phy->ops->set_rx_antenna)
2899                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
2900         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
2901
2902         if (phy->type == B43_PHYTYPE_B) {
2903                 value16 = b43_read16(dev, 0x005E);
2904                 value16 |= 0x0004;
2905                 b43_write16(dev, 0x005E, value16);
2906         }
2907         b43_write32(dev, 0x0100, 0x01000000);
2908         if (dev->sdev->id.revision < 5)
2909                 b43_write32(dev, 0x010C, 0x01000000);
2910
2911         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2912                     & ~B43_MACCTL_INFRA);
2913         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2914                     | B43_MACCTL_INFRA);
2915
2916         /* Probe Response Timeout value */
2917         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2918         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
2919
2920         /* Initially set the wireless operation mode. */
2921         b43_adjust_opmode(dev);
2922
2923         if (dev->sdev->id.revision < 3) {
2924                 b43_write16(dev, 0x060E, 0x0000);
2925                 b43_write16(dev, 0x0610, 0x8000);
2926                 b43_write16(dev, 0x0604, 0x0000);
2927                 b43_write16(dev, 0x0606, 0x0200);
2928         } else {
2929                 b43_write32(dev, 0x0188, 0x80000000);
2930                 b43_write32(dev, 0x018C, 0x02000000);
2931         }
2932         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
2933         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2934         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2935         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2936         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2937         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2938         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2939
2940         b43_mac_phy_clock_set(dev, true);
2941
2942         b43_write16(dev, B43_MMIO_POWERUP_DELAY,
2943                     dev->sdev->bus->chipco.fast_pwrup_delay);
2944
2945         err = 0;
2946         b43dbg(dev->wl, "Chip initialized\n");
2947 out:
2948         return err;
2949
2950 err_gpio_clean:
2951         b43_gpio_cleanup(dev);
2952         return err;
2953 }
2954
2955 static void b43_periodic_every60sec(struct b43_wldev *dev)
2956 {
2957         const struct b43_phy_operations *ops = dev->phy.ops;
2958
2959         if (ops->pwork_60sec)
2960                 ops->pwork_60sec(dev);
2961
2962         /* Force check the TX power emission now. */
2963         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
2964 }
2965
2966 static void b43_periodic_every30sec(struct b43_wldev *dev)
2967 {
2968         /* Update device statistics. */
2969         b43_calculate_link_quality(dev);
2970 }
2971
2972 static void b43_periodic_every15sec(struct b43_wldev *dev)
2973 {
2974         struct b43_phy *phy = &dev->phy;
2975         u16 wdr;
2976
2977         if (dev->fw.opensource) {
2978                 /* Check if the firmware is still alive.
2979                  * It will reset the watchdog counter to 0 in its idle loop. */
2980                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
2981                 if (unlikely(wdr)) {
2982                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
2983                         b43_controller_restart(dev, "Firmware watchdog");
2984                         return;
2985                 } else {
2986                         b43_shm_write16(dev, B43_SHM_SCRATCH,
2987                                         B43_WATCHDOG_REG, 1);
2988                 }
2989         }
2990
2991         if (phy->ops->pwork_15sec)
2992                 phy->ops->pwork_15sec(dev);
2993
2994         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
2995         wmb();
2996
2997 #if B43_DEBUG
2998         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2999                 unsigned int i;
3000
3001                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3002                        dev->irq_count / 15,
3003                        dev->tx_count / 15,
3004                        dev->rx_count / 15);
3005                 dev->irq_count = 0;
3006                 dev->tx_count = 0;
3007                 dev->rx_count = 0;
3008                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3009                         if (dev->irq_bit_count[i]) {
3010                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3011                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3012                                 dev->irq_bit_count[i] = 0;
3013                         }
3014                 }
3015         }
3016 #endif
3017 }
3018
3019 static void do_periodic_work(struct b43_wldev *dev)
3020 {
3021         unsigned int state;
3022
3023         state = dev->periodic_state;
3024         if (state % 4 == 0)
3025                 b43_periodic_every60sec(dev);
3026         if (state % 2 == 0)
3027                 b43_periodic_every30sec(dev);
3028         b43_periodic_every15sec(dev);
3029 }
3030
3031 /* Periodic work locking policy:
3032  *      The whole periodic work handler is protected by
3033  *      wl->mutex. If another lock is needed somewhere in the
3034  *      pwork callchain, it's acquired in-place, where it's needed.
3035  */
3036 static void b43_periodic_work_handler(struct work_struct *work)
3037 {
3038         struct b43_wldev *dev = container_of(work, struct b43_wldev,
3039                                              periodic_work.work);
3040         struct b43_wl *wl = dev->wl;
3041         unsigned long delay;
3042
3043         mutex_lock(&wl->mutex);
3044
3045         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3046                 goto out;
3047         if (b43_debug(dev, B43_DBG_PWORK_STOP))
3048                 goto out_requeue;
3049
3050         do_periodic_work(dev);
3051
3052         dev->periodic_state++;
3053 out_requeue:
3054         if (b43_debug(dev, B43_DBG_PWORK_FAST))
3055                 delay = msecs_to_jiffies(50);
3056         else
3057                 delay = round_jiffies_relative(HZ * 15);
3058         ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3059 out:
3060         mutex_unlock(&wl->mutex);
3061 }
3062
3063 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3064 {
3065         struct delayed_work *work = &dev->periodic_work;
3066
3067         dev->periodic_state = 0;
3068         INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3069         ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3070 }
3071
3072 /* Check if communication with the device works correctly. */
3073 static int b43_validate_chipaccess(struct b43_wldev *dev)
3074 {
3075         u32 v, backup0, backup4;
3076
3077         backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3078         backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3079
3080         /* Check for read/write and endianness problems. */
3081         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3082         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3083                 goto error;
3084         b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3085         if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3086                 goto error;
3087
3088         /* Check if unaligned 32bit SHM_SHARED access works properly.
3089          * However, don't bail out on failure, because it's noncritical. */
3090         b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3091         b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3092         b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3093         b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3094         if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3095                 b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3096         b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3097         if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3098             b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3099             b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3100             b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3101                 b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3102
3103         b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3104         b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3105
3106         if ((dev->sdev->id.revision >= 3) && (dev->sdev->id.revision <= 10)) {
3107                 /* The 32bit register shadows the two 16bit registers
3108                  * with update sideeffects. Validate this. */
3109                 b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3110                 b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3111                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3112                         goto error;
3113                 if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3114                         goto error;
3115         }
3116         b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3117
3118         v = b43_read32(dev, B43_MMIO_MACCTL);
3119         v |= B43_MACCTL_GMODE;
3120         if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3121                 goto error;
3122
3123         return 0;
3124 error:
3125         b43err(dev->wl, "Failed to validate the chipaccess\n");
3126         return -ENODEV;
3127 }
3128
3129 static void b43_security_init(struct b43_wldev *dev)
3130 {
3131         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3132         /* KTP is a word address, but we address SHM bytewise.
3133          * So multiply by two.
3134          */
3135         dev->ktp *= 2;
3136         /* Number of RCMTA address slots */
3137         b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3138         /* Clear the key memory. */
3139         b43_clear_keys(dev);
3140 }
3141
3142 #ifdef CONFIG_B43_HWRNG
3143 static int b43_rng_read(struct hwrng *rng, u32 *data)
3144 {
3145         struct b43_wl *wl = (struct b43_wl *)rng->priv;
3146         struct b43_wldev *dev;
3147         int count = -ENODEV;
3148
3149         mutex_lock(&wl->mutex);
3150         dev = wl->current_dev;
3151         if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3152                 *data = b43_read16(dev, B43_MMIO_RNG);
3153                 count = sizeof(u16);
3154         }
3155         mutex_unlock(&wl->mutex);
3156
3157         return count;
3158 }
3159 #endif /* CONFIG_B43_HWRNG */
3160
3161 static void b43_rng_exit(struct b43_wl *wl)
3162 {
3163 #ifdef CONFIG_B43_HWRNG
3164         if (wl->rng_initialized)
3165                 hwrng_unregister(&wl->rng);
3166 #endif /* CONFIG_B43_HWRNG */
3167 }
3168
3169 static int b43_rng_init(struct b43_wl *wl)
3170 {
3171         int err = 0;
3172
3173 #ifdef CONFIG_B43_HWRNG
3174         snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3175                  "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3176         wl->rng.name = wl->rng_name;
3177         wl->rng.data_read = b43_rng_read;
3178         wl->rng.priv = (unsigned long)wl;
3179         wl->rng_initialized = 1;
3180         err = hwrng_register(&wl->rng);
3181         if (err) {
3182                 wl->rng_initialized = 0;
3183                 b43err(wl, "Failed to register the random "
3184                        "number generator (%d)\n", err);
3185         }
3186 #endif /* CONFIG_B43_HWRNG */
3187
3188         return err;
3189 }
3190
3191 static void b43_tx_work(struct work_struct *work)
3192 {
3193         struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3194         struct b43_wldev *dev;
3195         struct sk_buff *skb;
3196         int err = 0;
3197
3198         mutex_lock(&wl->mutex);
3199         dev = wl->current_dev;
3200         if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3201                 mutex_unlock(&wl->mutex);
3202                 return;
3203         }
3204
3205         while (skb_queue_len(&wl->tx_queue)) {
3206                 skb = skb_dequeue(&wl->tx_queue);
3207
3208                 if (b43_using_pio_transfers(dev))
3209                         err = b43_pio_tx(dev, skb);
3210                 else
3211                         err = b43_dma_tx(dev, skb);
3212                 if (unlikely(err))
3213                         dev_kfree_skb(skb); /* Drop it */
3214         }
3215
3216 #if B43_DEBUG
3217         dev->tx_count++;
3218 #endif
3219         mutex_unlock(&wl->mutex);
3220 }
3221
3222 static void b43_op_tx(struct ieee80211_hw *hw,
3223                      struct sk_buff *skb)
3224 {
3225         struct b43_wl *wl = hw_to_b43_wl(hw);
3226
3227         if (unlikely(skb->len < 2 + 2 + 6)) {
3228                 /* Too short, this can't be a valid frame. */
3229                 dev_kfree_skb_any(skb);
3230                 return;
3231         }
3232         B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3233
3234         skb_queue_tail(&wl->tx_queue, skb);
3235         ieee80211_queue_work(wl->hw, &wl->tx_work);
3236 }
3237
3238 static void b43_qos_params_upload(struct b43_wldev *dev,
3239                                   const struct ieee80211_tx_queue_params *p,
3240                                   u16 shm_offset)
3241 {
3242         u16 params[B43_NR_QOSPARAMS];
3243         int bslots, tmp;
3244         unsigned int i;
3245
3246         if (!dev->qos_enabled)
3247                 return;
3248
3249         bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3250
3251         memset(&params, 0, sizeof(params));
3252
3253         params[B43_QOSPARAM_TXOP] = p->txop * 32;
3254         params[B43_QOSPARAM_CWMIN] = p->cw_min;
3255         params[B43_QOSPARAM_CWMAX] = p->cw_max;
3256         params[B43_QOSPARAM_CWCUR] = p->cw_min;
3257         params[B43_QOSPARAM_AIFS] = p->aifs;
3258         params[B43_QOSPARAM_BSLOTS] = bslots;
3259         params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3260
3261         for (i = 0; i < ARRAY_SIZE(params); i++) {
3262                 if (i == B43_QOSPARAM_STATUS) {
3263                         tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3264                                              shm_offset + (i * 2));
3265                         /* Mark the parameters as updated. */
3266                         tmp |= 0x100;
3267                         b43_shm_write16(dev, B43_SHM_SHARED,
3268                                         shm_offset + (i * 2),
3269                                         tmp);
3270                 } else {
3271                         b43_shm_write16(dev, B43_SHM_SHARED,
3272                                         shm_offset + (i * 2),
3273                                         params[i]);
3274                 }
3275         }
3276 }
3277
3278 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3279 static const u16 b43_qos_shm_offsets[] = {
3280         /* [mac80211-queue-nr] = SHM_OFFSET, */
3281         [0] = B43_QOS_VOICE,
3282         [1] = B43_QOS_VIDEO,
3283         [2] = B43_QOS_BESTEFFORT,
3284         [3] = B43_QOS_BACKGROUND,
3285 };
3286
3287 /* Update all QOS parameters in hardware. */
3288 static void b43_qos_upload_all(struct b43_wldev *dev)
3289 {
3290         struct b43_wl *wl = dev->wl;
3291         struct b43_qos_params *params;
3292         unsigned int i;
3293
3294         if (!dev->qos_enabled)
3295                 return;
3296
3297         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3298                      ARRAY_SIZE(wl->qos_params));
3299
3300         b43_mac_suspend(dev);
3301         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3302                 params = &(wl->qos_params[i]);
3303                 b43_qos_params_upload(dev, &(params->p),
3304                                       b43_qos_shm_offsets[i]);
3305         }
3306         b43_mac_enable(dev);
3307 }
3308
3309 static void b43_qos_clear(struct b43_wl *wl)
3310 {
3311         struct b43_qos_params *params;
3312         unsigned int i;
3313
3314         /* Initialize QoS parameters to sane defaults. */
3315
3316         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3317                      ARRAY_SIZE(wl->qos_params));
3318
3319         for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3320                 params = &(wl->qos_params[i]);
3321
3322                 switch (b43_qos_shm_offsets[i]) {
3323                 case B43_QOS_VOICE:
3324                         params->p.txop = 0;
3325                         params->p.aifs = 2;
3326                         params->p.cw_min = 0x0001;
3327                         params->p.cw_max = 0x0001;
3328                         break;
3329                 case B43_QOS_VIDEO:
3330                         params->p.txop = 0;
3331                         params->p.aifs = 2;
3332                         params->p.cw_min = 0x0001;
3333                         params->p.cw_max = 0x0001;
3334                         break;
3335                 case B43_QOS_BESTEFFORT:
3336                         params->p.txop = 0;
3337                         params->p.aifs = 3;
3338                         params->p.cw_min = 0x0001;
3339                         params->p.cw_max = 0x03FF;
3340                         break;
3341                 case B43_QOS_BACKGROUND:
3342                         params->p.txop = 0;
3343                         params->p.aifs = 7;
3344                         params->p.cw_min = 0x0001;
3345                         params->p.cw_max = 0x03FF;
3346                         break;
3347                 default:
3348                         B43_WARN_ON(1);
3349                 }
3350         }
3351 }
3352
3353 /* Initialize the core's QOS capabilities */
3354 static void b43_qos_init(struct b43_wldev *dev)
3355 {
3356         if (!dev->qos_enabled) {
3357                 /* Disable QOS support. */
3358                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3359                 b43_write16(dev, B43_MMIO_IFSCTL,
3360                             b43_read16(dev, B43_MMIO_IFSCTL)
3361                             & ~B43_MMIO_IFSCTL_USE_EDCF);
3362                 b43dbg(dev->wl, "QoS disabled\n");
3363                 return;
3364         }
3365
3366         /* Upload the current QOS parameters. */
3367         b43_qos_upload_all(dev);
3368
3369         /* Enable QOS support. */
3370         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3371         b43_write16(dev, B43_MMIO_IFSCTL,
3372                     b43_read16(dev, B43_MMIO_IFSCTL)
3373                     | B43_MMIO_IFSCTL_USE_EDCF);
3374         b43dbg(dev->wl, "QoS enabled\n");
3375 }
3376
3377 static int b43_op_conf_tx(struct ieee80211_hw *hw, u16 _queue,
3378                           const struct ieee80211_tx_queue_params *params)
3379 {
3380         struct b43_wl *wl = hw_to_b43_wl(hw);
3381         struct b43_wldev *dev;
3382         unsigned int queue = (unsigned int)_queue;
3383         int err = -ENODEV;
3384
3385         if (queue >= ARRAY_SIZE(wl->qos_params)) {
3386                 /* Queue not available or don't support setting
3387                  * params on this queue. Return success to not
3388                  * confuse mac80211. */
3389                 return 0;
3390         }
3391         BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3392                      ARRAY_SIZE(wl->qos_params));
3393
3394         mutex_lock(&wl->mutex);
3395         dev = wl->current_dev;
3396         if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3397                 goto out_unlock;
3398
3399         memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3400         b43_mac_suspend(dev);
3401         b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3402                               b43_qos_shm_offsets[queue]);
3403         b43_mac_enable(dev);
3404         err = 0;
3405
3406 out_unlock:
3407         mutex_unlock(&wl->mutex);
3408
3409         return err;
3410 }
3411
3412 static int b43_op_get_stats(struct ieee80211_hw *hw,
3413                             struct ieee80211_low_level_stats *stats)
3414 {
3415         struct b43_wl *wl = hw_to_b43_wl(hw);
3416
3417         mutex_lock(&wl->mutex);
3418         memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3419         mutex_unlock(&wl->mutex);
3420
3421         return 0;
3422 }
3423
3424 static u64 b43_op_get_tsf(struct ieee80211_hw *hw)
3425 {
3426         struct b43_wl *wl = hw_to_b43_wl(hw);
3427         struct b43_wldev *dev;
3428         u64 tsf;
3429
3430         mutex_lock(&wl->mutex);
3431         dev = wl->current_dev;
3432
3433         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3434                 b43_tsf_read(dev, &tsf);
3435         else
3436                 tsf = 0;
3437
3438         mutex_unlock(&wl->mutex);
3439
3440         return tsf;
3441 }
3442
3443 static void b43_op_set_tsf(struct ieee80211_hw *hw, u64 tsf)
3444 {
3445         struct b43_wl *wl = hw_to_b43_wl(hw);
3446         struct b43_wldev *dev;
3447
3448         mutex_lock(&wl->mutex);
3449         dev = wl->current_dev;
3450
3451         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3452                 b43_tsf_write(dev, tsf);
3453
3454         mutex_unlock(&wl->mutex);
3455 }
3456
3457 static void b43_put_phy_into_reset(struct b43_wldev *dev)
3458 {
3459         struct ssb_device *sdev = dev->sdev;
3460         u32 tmslow;
3461
3462         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3463         tmslow &= ~B43_TMSLOW_GMODE;
3464         tmslow |= B43_TMSLOW_PHYRESET;
3465         tmslow |= SSB_TMSLOW_FGC;
3466         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3467         msleep(1);
3468
3469         tmslow = ssb_read32(sdev, SSB_TMSLOW);
3470         tmslow &= ~SSB_TMSLOW_FGC;
3471         tmslow |= B43_TMSLOW_PHYRESET;
3472         ssb_write32(sdev, SSB_TMSLOW, tmslow);
3473         msleep(1);
3474 }
3475
3476 static const char *band_to_string(enum ieee80211_band band)
3477 {
3478         switch (band) {
3479         case IEEE80211_BAND_5GHZ:
3480                 return "5";
3481         case IEEE80211_BAND_2GHZ:
3482                 return "2.4";
3483         default:
3484                 break;
3485         }
3486         B43_WARN_ON(1);
3487         return "";
3488 }
3489
3490 /* Expects wl->mutex locked */
3491 static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
3492 {
3493         struct b43_wldev *up_dev = NULL;
3494         struct b43_wldev *down_dev;
3495         struct b43_wldev *d;
3496         int err;
3497         bool uninitialized_var(gmode);
3498         int prev_status;
3499
3500         /* Find a device and PHY which supports the band. */
3501         list_for_each_entry(d, &wl->devlist, list) {
3502                 switch (chan->band) {
3503                 case IEEE80211_BAND_5GHZ:
3504                         if (d->phy.supports_5ghz) {
3505                                 up_dev = d;
3506                                 gmode = 0;
3507                         }
3508                         break;
3509                 case IEEE80211_BAND_2GHZ:
3510                         if (d->phy.supports_2ghz) {
3511                                 up_dev = d;
3512                                 gmode = 1;
3513                         }
3514                         break;
3515                 default:
3516                         B43_WARN_ON(1);
3517                         return -EINVAL;
3518                 }
3519                 if (up_dev)
3520                         break;
3521         }
3522         if (!up_dev) {
3523                 b43err(wl, "Could not find a device for %s-GHz band operation\n",
3524                        band_to_string(chan->band));
3525                 return -ENODEV;
3526         }
3527         if ((up_dev == wl->current_dev) &&
3528             (!!wl->current_dev->phy.gmode == !!gmode)) {
3529                 /* This device is already running. */
3530                 return 0;
3531         }
3532         b43dbg(wl, "Switching to %s-GHz band\n",
3533                band_to_string(chan->band));
3534         down_dev = wl->current_dev;
3535
3536         prev_status = b43_status(down_dev);
3537         /* Shutdown the currently running core. */
3538         if (prev_status >= B43_STAT_STARTED)
3539                 down_dev = b43_wireless_core_stop(down_dev);
3540         if (prev_status >= B43_STAT_INITIALIZED)
3541                 b43_wireless_core_exit(down_dev);
3542
3543         if (down_dev != up_dev) {
3544                 /* We switch to a different core, so we put PHY into
3545                  * RESET on the old core. */
3546                 b43_put_phy_into_reset(down_dev);
3547         }
3548
3549         /* Now start the new core. */
3550         up_dev->phy.gmode = gmode;
3551         if (prev_status >= B43_STAT_INITIALIZED) {
3552                 err = b43_wireless_core_init(up_dev);
3553                 if (err) {
3554                         b43err(wl, "Fatal: Could not initialize device for "
3555                                "selected %s-GHz band\n",
3556                                band_to_string(chan->band));
3557                         goto init_failure;
3558                 }
3559         }
3560         if (prev_status >= B43_STAT_STARTED) {
3561                 err = b43_wireless_core_start(up_dev);
3562                 if (err) {
3563                         b43err(wl, "Fatal: Coult not start device for "
3564                                "selected %s-GHz band\n",
3565                                band_to_string(chan->band));
3566                         b43_wireless_core_exit(up_dev);
3567                         goto init_failure;
3568                 }
3569         }
3570         B43_WARN_ON(b43_status(up_dev) != prev_status);
3571
3572         wl->current_dev = up_dev;
3573
3574         return 0;
3575 init_failure:
3576         /* Whoops, failed to init the new core. No core is operating now. */
3577         wl->current_dev = NULL;
3578         return err;
3579 }
3580
3581 /* Write the short and long frame retry limit values. */
3582 static void b43_set_retry_limits(struct b43_wldev *dev,
3583                                  unsigned int short_retry,
3584                                  unsigned int long_retry)
3585 {
3586         /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3587          * the chip-internal counter. */
3588         short_retry = min(short_retry, (unsigned int)0xF);
3589         long_retry = min(long_retry, (unsigned int)0xF);
3590
3591         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3592                         short_retry);
3593         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3594                         long_retry);
3595 }
3596
3597 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3598 {
3599         struct b43_wl *wl = hw_to_b43_wl(hw);
3600         struct b43_wldev *dev;
3601         struct b43_phy *phy;
3602         struct ieee80211_conf *conf = &hw->conf;
3603         int antenna;
3604         int err = 0;
3605
3606         mutex_lock(&wl->mutex);
3607
3608         /* Switch the band (if necessary). This might change the active core. */
3609         err = b43_switch_band(wl, conf->channel);
3610         if (err)
3611                 goto out_unlock_mutex;
3612         dev = wl->current_dev;
3613         phy = &dev->phy;
3614
3615         if (conf_is_ht(conf))
3616                 phy->is_40mhz =
3617                         (conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf));
3618         else
3619                 phy->is_40mhz = false;
3620
3621         b43_mac_suspend(dev);
3622
3623         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
3624                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
3625                                           conf->long_frame_max_tx_count);
3626         changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
3627         if (!changed)
3628                 goto out_mac_enable;
3629
3630         /* Switch to the requested channel.
3631          * The firmware takes care of races with the TX handler. */
3632         if (conf->channel->hw_value != phy->channel)
3633                 b43_switch_channel(dev, conf->channel->hw_value);
3634
3635         dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
3636
3637         /* Adjust the desired TX power level. */
3638         if (conf->power_level != 0) {
3639                 if (conf->power_level != phy->desired_txpower) {
3640                         phy->desired_txpower = conf->power_level;
3641                         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
3642                                                    B43_TXPWR_IGNORE_TSSI);
3643                 }
3644         }
3645
3646         /* Antennas for RX and management frame TX. */
3647         antenna = B43_ANTENNA_DEFAULT;
3648         b43_mgmtframe_txantenna(dev, antenna);
3649         antenna = B43_ANTENNA_DEFAULT;
3650         if (phy->ops->set_rx_antenna)
3651                 phy->ops->set_rx_antenna(dev, antenna);
3652
3653         if (wl->radio_enabled != phy->radio_on) {
3654                 if (wl->radio_enabled) {
3655                         b43_software_rfkill(dev, false);
3656                         b43info(dev->wl, "Radio turned on by software\n");
3657                         if (!dev->radio_hw_enable) {
3658                                 b43info(dev->wl, "The hardware RF-kill button "
3659                                         "still turns the radio physically off. "
3660                                         "Press the button to turn it on.\n");
3661                         }
3662                 } else {
3663                         b43_software_rfkill(dev, true);
3664                         b43info(dev->wl, "Radio turned off by software\n");
3665                 }
3666         }
3667
3668 out_mac_enable:
3669         b43_mac_enable(dev);
3670 out_unlock_mutex:
3671         mutex_unlock(&wl->mutex);
3672
3673         return err;
3674 }
3675
3676 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
3677 {
3678         struct ieee80211_supported_band *sband =
3679                 dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
3680         struct ieee80211_rate *rate;
3681         int i;
3682         u16 basic, direct, offset, basic_offset, rateptr;
3683
3684         for (i = 0; i < sband->n_bitrates; i++) {
3685                 rate = &sband->bitrates[i];
3686
3687                 if (b43_is_cck_rate(rate->hw_value)) {
3688                         direct = B43_SHM_SH_CCKDIRECT;
3689                         basic = B43_SHM_SH_CCKBASIC;
3690                         offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3691                         offset &= 0xF;
3692                 } else {
3693                         direct = B43_SHM_SH_OFDMDIRECT;
3694                         basic = B43_SHM_SH_OFDMBASIC;
3695                         offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3696                         offset &= 0xF;
3697                 }
3698
3699                 rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
3700
3701                 if (b43_is_cck_rate(rate->hw_value)) {
3702                         basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
3703                         basic_offset &= 0xF;
3704                 } else {
3705                         basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
3706                         basic_offset &= 0xF;
3707                 }
3708
3709                 /*
3710                  * Get the pointer that we need to point to
3711                  * from the direct map
3712                  */
3713                 rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
3714                                          direct + 2 * basic_offset);
3715                 /* and write it to the basic map */
3716                 b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
3717                                 rateptr);
3718         }
3719 }
3720
3721 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
3722                                     struct ieee80211_vif *vif,
3723                                     struct ieee80211_bss_conf *conf,
3724                                     u32 changed)
3725 {
3726         struct b43_wl *wl = hw_to_b43_wl(hw);
3727         struct b43_wldev *dev;
3728
3729         mutex_lock(&wl->mutex);
3730
3731         dev = wl->current_dev;
3732         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3733                 goto out_unlock_mutex;
3734
3735         B43_WARN_ON(wl->vif != vif);
3736
3737         if (changed & BSS_CHANGED_BSSID) {
3738                 if (conf->bssid)
3739                         memcpy(wl->bssid, conf->bssid, ETH_ALEN);
3740                 else
3741                         memset(wl->bssid, 0, ETH_ALEN);
3742         }
3743
3744         if (b43_status(dev) >= B43_STAT_INITIALIZED) {
3745                 if (changed & BSS_CHANGED_BEACON &&
3746                     (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3747                      b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3748                      b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3749                         b43_update_templates(wl);
3750
3751                 if (changed & BSS_CHANGED_BSSID)
3752                         b43_write_mac_bssid_templates(dev);
3753         }
3754
3755         b43_mac_suspend(dev);
3756
3757         /* Update templates for AP/mesh mode. */
3758         if (changed & BSS_CHANGED_BEACON_INT &&
3759             (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3760              b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
3761              b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
3762                 b43_set_beacon_int(dev, conf->beacon_int);
3763
3764         if (changed & BSS_CHANGED_BASIC_RATES)
3765                 b43_update_basic_rates(dev, conf->basic_rates);
3766
3767         if (changed & BSS_CHANGED_ERP_SLOT) {
3768                 if (conf->use_short_slot)
3769                         b43_short_slot_timing_enable(dev);
3770                 else
3771                         b43_short_slot_timing_disable(dev);
3772         }
3773
3774         b43_mac_enable(dev);
3775 out_unlock_mutex:
3776         mutex_unlock(&wl->mutex);
3777 }
3778
3779 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
3780                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
3781                           struct ieee80211_key_conf *key)
3782 {
3783         struct b43_wl *wl = hw_to_b43_wl(hw);
3784         struct b43_wldev *dev;
3785         u8 algorithm;
3786         u8 index;
3787         int err;
3788         static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3789
3790         if (modparam_nohwcrypt)
3791                 return -ENOSPC; /* User disabled HW-crypto */
3792
3793         mutex_lock(&wl->mutex);
3794
3795         dev = wl->current_dev;
3796         err = -ENODEV;
3797         if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
3798                 goto out_unlock;
3799
3800         if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
3801                 /* We don't have firmware for the crypto engine.
3802                  * Must use software-crypto. */
3803                 err = -EOPNOTSUPP;
3804                 goto out_unlock;
3805         }
3806
3807         err = -EINVAL;
3808         switch (key->cipher) {
3809         case WLAN_CIPHER_SUITE_WEP40:
3810                 algorithm = B43_SEC_ALGO_WEP40;
3811                 break;
3812         case WLAN_CIPHER_SUITE_WEP104:
3813                 algorithm = B43_SEC_ALGO_WEP104;
3814                 break;
3815         case WLAN_CIPHER_SUITE_TKIP:
3816                 algorithm = B43_SEC_ALGO_TKIP;
3817                 break;
3818         case WLAN_CIPHER_SUITE_CCMP:
3819                 algorithm = B43_SEC_ALGO_AES;
3820                 break;
3821         default:
3822                 B43_WARN_ON(1);
3823                 goto out_unlock;
3824         }
3825         index = (u8) (key->keyidx);
3826         if (index > 3)
3827                 goto out_unlock;
3828
3829         switch (cmd) {
3830         case SET_KEY:
3831                 if (algorithm == B43_SEC_ALGO_TKIP &&
3832                     (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
3833                     !modparam_hwtkip)) {
3834                         /* We support only pairwise key */
3835                         err = -EOPNOTSUPP;
3836                         goto out_unlock;
3837                 }
3838
3839                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
3840                         if (WARN_ON(!sta)) {
3841                                 err = -EOPNOTSUPP;
3842                                 goto out_unlock;
3843                         }
3844                         /* Pairwise key with an assigned MAC address. */
3845                         err = b43_key_write(dev, -1, algorithm,
3846                                             key->key, key->keylen,
3847                                             sta->addr, key);
3848                 } else {
3849                         /* Group key */
3850                         err = b43_key_write(dev, index, algorithm,
3851                                             key->key, key->keylen, NULL, key);
3852                 }
3853                 if (err)
3854                         goto out_unlock;
3855
3856                 if (algorithm == B43_SEC_ALGO_WEP40 ||
3857                     algorithm == B43_SEC_ALGO_WEP104) {
3858                         b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
3859                 } else {
3860                         b43_hf_write(dev,
3861                                      b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
3862                 }
3863                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3864                 if (algorithm == B43_SEC_ALGO_TKIP)
3865                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3866                 break;
3867         case DISABLE_KEY: {
3868                 err = b43_key_clear(dev, key->hw_key_idx);
3869                 if (err)
3870                         goto out_unlock;
3871                 break;
3872         }
3873         default:
3874                 B43_WARN_ON(1);
3875         }
3876
3877 out_unlock:
3878         if (!err) {
3879                 b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
3880                        "mac: %pM\n",
3881                        cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
3882                        sta ? sta->addr : bcast_addr);
3883                 b43_dump_keymemory(dev);
3884         }
3885         mutex_unlock(&wl->mutex);
3886
3887         return err;
3888 }
3889
3890 static void b43_op_configure_filter(struct ieee80211_hw *hw,
3891                                     unsigned int changed, unsigned int *fflags,
3892                                     u64 multicast)
3893 {
3894         struct b43_wl *wl = hw_to_b43_wl(hw);
3895         struct b43_wldev *dev;
3896
3897         mutex_lock(&wl->mutex);
3898         dev = wl->current_dev;
3899         if (!dev) {
3900                 *fflags = 0;
3901                 goto out_unlock;
3902         }
3903
3904         *fflags &= FIF_PROMISC_IN_BSS |
3905                   FIF_ALLMULTI |
3906                   FIF_FCSFAIL |
3907                   FIF_PLCPFAIL |
3908                   FIF_CONTROL |
3909                   FIF_OTHER_BSS |
3910                   FIF_BCN_PRBRESP_PROMISC;
3911
3912         changed &= FIF_PROMISC_IN_BSS |
3913                    FIF_ALLMULTI |
3914                    FIF_FCSFAIL |
3915                    FIF_PLCPFAIL |
3916                    FIF_CONTROL |
3917                    FIF_OTHER_BSS |
3918                    FIF_BCN_PRBRESP_PROMISC;
3919
3920         wl->filter_flags = *fflags;
3921
3922         if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
3923                 b43_adjust_opmode(dev);
3924
3925 out_unlock:
3926         mutex_unlock(&wl->mutex);
3927 }
3928
3929 /* Locking: wl->mutex
3930  * Returns the current dev. This might be different from the passed in dev,
3931  * because the core might be gone away while we unlocked the mutex. */
3932 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
3933 {
3934         struct b43_wl *wl = dev->wl;
3935         struct b43_wldev *orig_dev;
3936         u32 mask;
3937
3938 redo:
3939         if (!dev || b43_status(dev) < B43_STAT_STARTED)
3940                 return dev;
3941
3942         /* Cancel work. Unlock to avoid deadlocks. */
3943         mutex_unlock(&wl->mutex);
3944         cancel_delayed_work_sync(&dev->periodic_work);
3945         cancel_work_sync(&wl->tx_work);
3946         mutex_lock(&wl->mutex);
3947         dev = wl->current_dev;
3948         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
3949                 /* Whoops, aliens ate up the device while we were unlocked. */
3950                 return dev;
3951         }
3952
3953         /* Disable interrupts on the device. */
3954         b43_set_status(dev, B43_STAT_INITIALIZED);
3955         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
3956                 /* wl->mutex is locked. That is enough. */
3957                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3958                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3959         } else {
3960                 spin_lock_irq(&wl->hardirq_lock);
3961                 b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
3962                 b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* Flush */
3963                 spin_unlock_irq(&wl->hardirq_lock);
3964         }
3965         /* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
3966         orig_dev = dev;
3967         mutex_unlock(&wl->mutex);
3968         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
3969                 b43_sdio_free_irq(dev);
3970         } else {
3971                 synchronize_irq(dev->sdev->irq);
3972                 free_irq(dev->sdev->irq, dev);
3973         }
3974         mutex_lock(&wl->mutex);
3975         dev = wl->current_dev;
3976         if (!dev)
3977                 return dev;
3978         if (dev != orig_dev) {
3979                 if (b43_status(dev) >= B43_STAT_STARTED)
3980                         goto redo;
3981                 return dev;
3982         }
3983         mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
3984         B43_WARN_ON(mask != 0xFFFFFFFF && mask);
3985
3986         /* Drain the TX queue */
3987         while (skb_queue_len(&wl->tx_queue))
3988                 dev_kfree_skb(skb_dequeue(&wl->tx_queue));
3989
3990         b43_mac_suspend(dev);
3991         b43_leds_exit(dev);
3992         b43dbg(wl, "Wireless interface stopped\n");
3993
3994         return dev;
3995 }
3996
3997 /* Locking: wl->mutex */
3998 static int b43_wireless_core_start(struct b43_wldev *dev)
3999 {
4000         int err;
4001
4002         B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4003
4004         drain_txstatus_queue(dev);
4005         if (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) {
4006                 err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4007                 if (err) {
4008                         b43err(dev->wl, "Cannot request SDIO IRQ\n");
4009                         goto out;
4010                 }
4011         } else {
4012                 err = request_threaded_irq(dev->sdev->irq, b43_interrupt_handler,
4013                                            b43_interrupt_thread_handler,
4014                                            IRQF_SHARED, KBUILD_MODNAME, dev);
4015                 if (err) {
4016                         b43err(dev->wl, "Cannot request IRQ-%d\n",
4017                                dev->sdev->irq);
4018                         goto out;
4019                 }
4020         }
4021
4022         /* We are ready to run. */
4023         ieee80211_wake_queues(dev->wl->hw);
4024         b43_set_status(dev, B43_STAT_STARTED);
4025
4026         /* Start data flow (TX/RX). */
4027         b43_mac_enable(dev);
4028         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4029
4030         /* Start maintainance work */
4031         b43_periodic_tasks_setup(dev);
4032
4033         b43_leds_init(dev);
4034
4035         b43dbg(dev->wl, "Wireless interface started\n");
4036 out:
4037         return err;
4038 }
4039
4040 /* Get PHY and RADIO versioning numbers */
4041 static int b43_phy_versioning(struct b43_wldev *dev)
4042 {
4043         struct b43_phy *phy = &dev->phy;
4044         u32 tmp;
4045         u8 analog_type;
4046         u8 phy_type;
4047         u8 phy_rev;
4048         u16 radio_manuf;
4049         u16 radio_ver;
4050         u16 radio_rev;
4051         int unsupported = 0;
4052
4053         /* Get PHY versioning */
4054         tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4055         analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4056         phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4057         phy_rev = (tmp & B43_PHYVER_VERSION);
4058         switch (phy_type) {
4059         case B43_PHYTYPE_A:
4060                 if (phy_rev >= 4)
4061                         unsupported = 1;
4062                 break;
4063         case B43_PHYTYPE_B:
4064                 if (phy_rev != 2 && phy_rev != 4 && phy_rev != 6
4065                     && phy_rev != 7)
4066                         unsupported = 1;
4067                 break;
4068         case B43_PHYTYPE_G:
4069                 if (phy_rev > 9)
4070                         unsupported = 1;
4071                 break;
4072 #ifdef CONFIG_B43_PHY_N
4073         case B43_PHYTYPE_N:
4074                 if (phy_rev > 9)
4075                         unsupported = 1;
4076                 break;
4077 #endif
4078 #ifdef CONFIG_B43_PHY_LP
4079         case B43_PHYTYPE_LP:
4080                 if (phy_rev > 2)
4081                         unsupported = 1;
4082                 break;
4083 #endif
4084         default:
4085                 unsupported = 1;
4086         };
4087         if (unsupported) {
4088                 b43err(dev->wl, "FOUND UNSUPPORTED PHY "
4089                        "(Analog %u, Type %u, Revision %u)\n",
4090                        analog_type, phy_type, phy_rev);
4091                 return -EOPNOTSUPP;
4092         }
4093         b43dbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
4094                analog_type, phy_type, phy_rev);
4095
4096         /* Get RADIO versioning */
4097         if (dev->sdev->bus->chip_id == 0x4317) {
4098                 if (dev->sdev->bus->chip_rev == 0)
4099                         tmp = 0x3205017F;
4100                 else if (dev->sdev->bus->chip_rev == 1)
4101                         tmp = 0x4205017F;
4102                 else
4103                         tmp = 0x5205017F;
4104         } else {
4105                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4106                 tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4107                 b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
4108                 tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4109         }
4110         radio_manuf = (tmp & 0x00000FFF);
4111         radio_ver = (tmp & 0x0FFFF000) >> 12;
4112         radio_rev = (tmp & 0xF0000000) >> 28;
4113         if (radio_manuf != 0x17F /* Broadcom */)
4114                 unsupported = 1;
4115         switch (phy_type) {
4116         case B43_PHYTYPE_A:
4117                 if (radio_ver != 0x2060)
4118                         unsupported = 1;
4119                 if (radio_rev != 1)
4120                         unsupported = 1;
4121                 if (radio_manuf != 0x17F)
4122                         unsupported = 1;
4123                 break;
4124         case B43_PHYTYPE_B:
4125                 if ((radio_ver & 0xFFF0) != 0x2050)
4126                         unsupported = 1;
4127                 break;
4128         case B43_PHYTYPE_G:
4129                 if (radio_ver != 0x2050)
4130                         unsupported = 1;
4131                 break;
4132         case B43_PHYTYPE_N:
4133                 if (radio_ver != 0x2055 && radio_ver != 0x2056)
4134                         unsupported = 1;
4135                 break;
4136         case B43_PHYTYPE_LP:
4137                 if (radio_ver != 0x2062 && radio_ver != 0x2063)
4138                         unsupported = 1;
4139                 break;
4140         default:
4141                 B43_WARN_ON(1);
4142         }
4143         if (unsupported) {
4144                 b43err(dev->wl, "FOUND UNSUPPORTED RADIO "
4145                        "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
4146                        radio_manuf, radio_ver, radio_rev);
4147                 return -EOPNOTSUPP;
4148         }
4149         b43dbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X, Revision %u\n",
4150                radio_manuf, radio_ver, radio_rev);
4151
4152         phy->radio_manuf = radio_manuf;
4153         phy->radio_ver = radio_ver;
4154         phy->radio_rev = radio_rev;
4155
4156         phy->analog = analog_type;
4157         phy->type = phy_type;
4158         phy->rev = phy_rev;
4159
4160         return 0;
4161 }
4162
4163 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4164                                       struct b43_phy *phy)
4165 {
4166         phy->hardware_power_control = !!modparam_hwpctl;
4167         phy->next_txpwr_check_time = jiffies;
4168         /* PHY TX errors counter. */
4169         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4170
4171 #if B43_DEBUG
4172         phy->phy_locked = 0;
4173         phy->radio_locked = 0;
4174 #endif
4175 }
4176
4177 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4178 {
4179         dev->dfq_valid = 0;
4180
4181         /* Assume the radio is enabled. If it's not enabled, the state will
4182          * immediately get fixed on the first periodic work run. */
4183         dev->radio_hw_enable = 1;
4184
4185         /* Stats */
4186         memset(&dev->stats, 0, sizeof(dev->stats));
4187
4188         setup_struct_phy_for_init(dev, &dev->phy);
4189
4190         /* IRQ related flags */
4191         dev->irq_reason = 0;
4192         memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4193         dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4194         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4195                 dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4196
4197         dev->mac_suspended = 1;
4198
4199         /* Noise calculation context */
4200         memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4201 }
4202
4203 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4204 {
4205         struct ssb_sprom *sprom = &dev->sdev->bus->sprom;
4206         u64 hf;
4207
4208         if (!modparam_btcoex)
4209                 return;
4210         if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4211                 return;
4212         if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4213                 return;
4214
4215         hf = b43_hf_read(dev);
4216         if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4217                 hf |= B43_HF_BTCOEXALT;
4218         else
4219                 hf |= B43_HF_BTCOEX;
4220         b43_hf_write(dev, hf);
4221 }
4222
4223 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4224 {
4225         if (!modparam_btcoex)
4226                 return;
4227         //TODO
4228 }
4229
4230 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4231 {
4232         struct ssb_bus *bus = dev->sdev->bus;
4233         u32 tmp;
4234
4235         if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4236             (bus->chip_id == 0x4312)) {
4237                 tmp = ssb_read32(dev->sdev, SSB_IMCFGLO);
4238                 tmp &= ~SSB_IMCFGLO_REQTO;
4239                 tmp &= ~SSB_IMCFGLO_SERTO;
4240                 tmp |= 0x3;
4241                 ssb_write32(dev->sdev, SSB_IMCFGLO, tmp);
4242                 ssb_commit_settings(bus);
4243         }
4244 }
4245
4246 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4247 {
4248         u16 pu_delay;
4249
4250         /* The time value is in microseconds. */
4251         if (dev->phy.type == B43_PHYTYPE_A)
4252                 pu_delay = 3700;
4253         else
4254                 pu_delay = 1050;
4255         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4256                 pu_delay = 500;
4257         if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4258                 pu_delay = max(pu_delay, (u16)2400);
4259
4260         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4261 }
4262
4263 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4264 static void b43_set_pretbtt(struct b43_wldev *dev)
4265 {
4266         u16 pretbtt;
4267
4268         /* The time value is in microseconds. */
4269         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC)) {
4270                 pretbtt = 2;
4271         } else {
4272                 if (dev->phy.type == B43_PHYTYPE_A)
4273                         pretbtt = 120;
4274                 else
4275                         pretbtt = 250;
4276         }
4277         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4278         b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4279 }
4280
4281 /* Shutdown a wireless core */
4282 /* Locking: wl->mutex */
4283 static void b43_wireless_core_exit(struct b43_wldev *dev)
4284 {
4285         u32 macctl;
4286
4287         B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4288         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4289                 return;
4290
4291         /* Unregister HW RNG driver */
4292         b43_rng_exit(dev->wl);
4293
4294         b43_set_status(dev, B43_STAT_UNINIT);
4295
4296         /* Stop the microcode PSM. */
4297         macctl = b43_read32(dev, B43_MMIO_MACCTL);
4298         macctl &= ~B43_MACCTL_PSM_RUN;
4299         macctl |= B43_MACCTL_PSM_JMP0;
4300         b43_write32(dev, B43_MMIO_MACCTL, macctl);
4301
4302         b43_dma_free(dev);
4303         b43_pio_free(dev);
4304         b43_chip_exit(dev);
4305         dev->phy.ops->switch_analog(dev, 0);
4306         if (dev->wl->current_beacon) {
4307                 dev_kfree_skb_any(dev->wl->current_beacon);
4308                 dev->wl->current_beacon = NULL;
4309         }
4310
4311         ssb_device_disable(dev->sdev, 0);
4312         ssb_bus_may_powerdown(dev->sdev->bus);
4313 }
4314
4315 /* Initialize a wireless core */
4316 static int b43_wireless_core_init(struct b43_wldev *dev)
4317 {
4318         struct ssb_bus *bus = dev->sdev->bus;
4319         struct ssb_sprom *sprom = &bus->sprom;
4320         struct b43_phy *phy = &dev->phy;
4321         int err;
4322         u64 hf;
4323         u32 tmp;
4324
4325         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4326
4327         err = ssb_bus_powerup(bus, 0);
4328         if (err)
4329                 goto out;
4330         if (!ssb_device_is_enabled(dev->sdev)) {
4331                 tmp = phy->gmode ? B43_TMSLOW_GMODE : 0;
4332                 b43_wireless_core_reset(dev, tmp);
4333         }
4334
4335         /* Reset all data structures. */
4336         setup_struct_wldev_for_init(dev);
4337         phy->ops->prepare_structs(dev);
4338
4339         /* Enable IRQ routing to this device. */
4340         ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->sdev);
4341
4342         b43_imcfglo_timeouts_workaround(dev);
4343         b43_bluetooth_coext_disable(dev);
4344         if (phy->ops->prepare_hardware) {
4345                 err = phy->ops->prepare_hardware(dev);
4346                 if (err)
4347                         goto err_busdown;
4348         }
4349         err = b43_chip_init(dev);
4350         if (err)
4351                 goto err_busdown;
4352         b43_shm_write16(dev, B43_SHM_SHARED,
4353                         B43_SHM_SH_WLCOREREV, dev->sdev->id.revision);
4354         hf = b43_hf_read(dev);
4355         if (phy->type == B43_PHYTYPE_G) {
4356                 hf |= B43_HF_SYMW;
4357                 if (phy->rev == 1)
4358                         hf |= B43_HF_GDCW;
4359                 if (sprom->boardflags_lo & B43_BFL_PACTRL)
4360                         hf |= B43_HF_OFDMPABOOST;
4361         }
4362         if (phy->radio_ver == 0x2050) {
4363                 if (phy->radio_rev == 6)
4364                         hf |= B43_HF_4318TSSI;
4365                 if (phy->radio_rev < 6)
4366                         hf |= B43_HF_VCORECALC;
4367         }
4368         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4369                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4370 #ifdef CONFIG_SSB_DRIVER_PCICORE
4371         if ((bus->bustype == SSB_BUSTYPE_PCI) &&
4372             (bus->pcicore.dev->id.revision <= 10))
4373                 hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4374 #endif
4375         hf &= ~B43_HF_SKCFPUP;
4376         b43_hf_write(dev, hf);
4377
4378         b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4379                              B43_DEFAULT_LONG_RETRY_LIMIT);
4380         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4381         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4382
4383         /* Disable sending probe responses from firmware.
4384          * Setting the MaxTime to one usec will always trigger
4385          * a timeout, so we never send any probe resp.
4386          * A timeout of zero is infinite. */
4387         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4388
4389         b43_rate_memory_init(dev);
4390         b43_set_phytxctl_defaults(dev);
4391
4392         /* Minimum Contention Window */
4393         if (phy->type == B43_PHYTYPE_B)
4394                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4395         else
4396                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4397         /* Maximum Contention Window */
4398         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4399
4400         if ((dev->sdev->bus->bustype == SSB_BUSTYPE_PCMCIA) ||
4401             (dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO) ||
4402             dev->use_pio) {
4403                 dev->__using_pio_transfers = 1;
4404                 err = b43_pio_init(dev);
4405         } else {
4406                 dev->__using_pio_transfers = 0;
4407                 err = b43_dma_init(dev);
4408         }
4409         if (err)
4410                 goto err_chip_exit;
4411         b43_qos_init(dev);
4412         b43_set_synth_pu_delay(dev, 1);
4413         b43_bluetooth_coext_enable(dev);
4414
4415         ssb_bus_powerup(bus, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4416         b43_upload_card_macaddress(dev);
4417         b43_security_init(dev);
4418
4419         ieee80211_wake_queues(dev->wl->hw);
4420
4421         b43_set_status(dev, B43_STAT_INITIALIZED);
4422
4423         /* Register HW RNG driver */
4424         b43_rng_init(dev->wl);
4425
4426 out:
4427         return err;
4428
4429 err_chip_exit:
4430         b43_chip_exit(dev);
4431 err_busdown:
4432         ssb_bus_may_powerdown(bus);
4433         B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4434         return err;
4435 }
4436
4437 static int b43_op_add_interface(struct ieee80211_hw *hw,
4438                                 struct ieee80211_vif *vif)
4439 {
4440         struct b43_wl *wl = hw_to_b43_wl(hw);
4441         struct b43_wldev *dev;
4442         int err = -EOPNOTSUPP;
4443
4444         /* TODO: allow WDS/AP devices to coexist */
4445
4446         if (vif->type != NL80211_IFTYPE_AP &&
4447             vif->type != NL80211_IFTYPE_MESH_POINT &&
4448             vif->type != NL80211_IFTYPE_STATION &&
4449             vif->type != NL80211_IFTYPE_WDS &&
4450             vif->type != NL80211_IFTYPE_ADHOC)
4451                 return -EOPNOTSUPP;
4452
4453         mutex_lock(&wl->mutex);
4454         if (wl->operating)
4455                 goto out_mutex_unlock;
4456
4457         b43dbg(wl, "Adding Interface type %d\n", vif->type);
4458
4459         dev = wl->current_dev;
4460         wl->operating = 1;
4461         wl->vif = vif;
4462         wl->if_type = vif->type;
4463         memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4464
4465         b43_adjust_opmode(dev);
4466         b43_set_pretbtt(dev);
4467         b43_set_synth_pu_delay(dev, 0);
4468         b43_upload_card_macaddress(dev);
4469
4470         err = 0;
4471  out_mutex_unlock:
4472         mutex_unlock(&wl->mutex);
4473
4474         return err;
4475 }
4476
4477 static void b43_op_remove_interface(struct ieee80211_hw *hw,
4478                                     struct ieee80211_vif *vif)
4479 {
4480         struct b43_wl *wl = hw_to_b43_wl(hw);
4481         struct b43_wldev *dev = wl->current_dev;
4482
4483         b43dbg(wl, "Removing Interface type %d\n", vif->type);
4484
4485         mutex_lock(&wl->mutex);
4486
4487         B43_WARN_ON(!wl->operating);
4488         B43_WARN_ON(wl->vif != vif);
4489         wl->vif = NULL;
4490
4491         wl->operating = 0;
4492
4493         b43_adjust_opmode(dev);
4494         memset(wl->mac_addr, 0, ETH_ALEN);
4495         b43_upload_card_macaddress(dev);
4496
4497         mutex_unlock(&wl->mutex);
4498 }
4499
4500 static int b43_op_start(struct ieee80211_hw *hw)
4501 {
4502         struct b43_wl *wl = hw_to_b43_wl(hw);
4503         struct b43_wldev *dev = wl->current_dev;
4504         int did_init = 0;
4505         int err = 0;
4506
4507         /* Kill all old instance specific information to make sure
4508          * the card won't use it in the short timeframe between start
4509          * and mac80211 reconfiguring it. */
4510         memset(wl->bssid, 0, ETH_ALEN);
4511         memset(wl->mac_addr, 0, ETH_ALEN);
4512         wl->filter_flags = 0;
4513         wl->radiotap_enabled = 0;
4514         b43_qos_clear(wl);
4515         wl->beacon0_uploaded = 0;
4516         wl->beacon1_uploaded = 0;
4517         wl->beacon_templates_virgin = 1;
4518         wl->radio_enabled = 1;
4519
4520         mutex_lock(&wl->mutex);
4521
4522         if (b43_status(dev) < B43_STAT_INITIALIZED) {
4523                 err = b43_wireless_core_init(dev);
4524                 if (err)
4525                         goto out_mutex_unlock;
4526                 did_init = 1;
4527         }
4528
4529         if (b43_status(dev) < B43_STAT_STARTED) {
4530                 err = b43_wireless_core_start(dev);
4531                 if (err) {
4532                         if (did_init)
4533                                 b43_wireless_core_exit(dev);
4534                         goto out_mutex_unlock;
4535                 }
4536         }
4537
4538         /* XXX: only do if device doesn't support rfkill irq */
4539         wiphy_rfkill_start_polling(hw->wiphy);
4540
4541  out_mutex_unlock:
4542         mutex_unlock(&wl->mutex);
4543
4544         return err;
4545 }
4546
4547 static void b43_op_stop(struct ieee80211_hw *hw)
4548 {
4549         struct b43_wl *wl = hw_to_b43_wl(hw);
4550         struct b43_wldev *dev = wl->current_dev;
4551
4552         cancel_work_sync(&(wl->beacon_update_trigger));
4553
4554         mutex_lock(&wl->mutex);
4555         if (b43_status(dev) >= B43_STAT_STARTED) {
4556                 dev = b43_wireless_core_stop(dev);
4557                 if (!dev)
4558                         goto out_unlock;
4559         }
4560         b43_wireless_core_exit(dev);
4561         wl->radio_enabled = 0;
4562
4563 out_unlock:
4564         mutex_unlock(&wl->mutex);
4565
4566         cancel_work_sync(&(wl->txpower_adjust_work));
4567 }
4568
4569 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
4570                                  struct ieee80211_sta *sta, bool set)
4571 {
4572         struct b43_wl *wl = hw_to_b43_wl(hw);
4573
4574         /* FIXME: add locking */
4575         b43_update_templates(wl);
4576
4577         return 0;
4578 }
4579
4580 static void b43_op_sta_notify(struct ieee80211_hw *hw,
4581                               struct ieee80211_vif *vif,
4582                               enum sta_notify_cmd notify_cmd,
4583                               struct ieee80211_sta *sta)
4584 {
4585         struct b43_wl *wl = hw_to_b43_wl(hw);
4586
4587         B43_WARN_ON(!vif || wl->vif != vif);
4588 }
4589
4590 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
4591 {
4592         struct b43_wl *wl = hw_to_b43_wl(hw);
4593         struct b43_wldev *dev;
4594
4595         mutex_lock(&wl->mutex);
4596         dev = wl->current_dev;
4597         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4598                 /* Disable CFP update during scan on other channels. */
4599                 b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
4600         }
4601         mutex_unlock(&wl->mutex);
4602 }
4603
4604 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
4605 {
4606         struct b43_wl *wl = hw_to_b43_wl(hw);
4607         struct b43_wldev *dev;
4608
4609         mutex_lock(&wl->mutex);
4610         dev = wl->current_dev;
4611         if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
4612                 /* Re-enable CFP update. */
4613                 b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
4614         }
4615         mutex_unlock(&wl->mutex);
4616 }
4617
4618 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
4619                              struct survey_info *survey)
4620 {
4621         struct b43_wl *wl = hw_to_b43_wl(hw);
4622         struct b43_wldev *dev = wl->current_dev;
4623         struct ieee80211_conf *conf = &hw->conf;
4624
4625         if (idx != 0)
4626                 return -ENOENT;
4627
4628         survey->channel = conf->channel;
4629         survey->filled = SURVEY_INFO_NOISE_DBM;
4630         survey->noise = dev->stats.link_noise;
4631
4632         return 0;
4633 }
4634
4635 static const struct ieee80211_ops b43_hw_ops = {
4636         .tx                     = b43_op_tx,
4637         .conf_tx                = b43_op_conf_tx,
4638         .add_interface          = b43_op_add_interface,
4639         .remove_interface       = b43_op_remove_interface,
4640         .config                 = b43_op_config,
4641         .bss_info_changed       = b43_op_bss_info_changed,
4642         .configure_filter       = b43_op_configure_filter,
4643         .set_key                = b43_op_set_key,
4644         .update_tkip_key        = b43_op_update_tkip_key,
4645         .get_stats              = b43_op_get_stats,
4646         .get_tsf                = b43_op_get_tsf,
4647         .set_tsf                = b43_op_set_tsf,
4648         .start                  = b43_op_start,
4649         .stop                   = b43_op_stop,
4650         .set_tim                = b43_op_beacon_set_tim,
4651         .sta_notify             = b43_op_sta_notify,
4652         .sw_scan_start          = b43_op_sw_scan_start_notifier,
4653         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
4654         .get_survey             = b43_op_get_survey,
4655         .rfkill_poll            = b43_rfkill_poll,
4656 };
4657
4658 /* Hard-reset the chip. Do not call this directly.
4659  * Use b43_controller_restart()
4660  */
4661 static void b43_chip_reset(struct work_struct *work)
4662 {
4663         struct b43_wldev *dev =
4664             container_of(work, struct b43_wldev, restart_work);
4665         struct b43_wl *wl = dev->wl;
4666         int err = 0;
4667         int prev_status;
4668
4669         mutex_lock(&wl->mutex);
4670
4671         prev_status = b43_status(dev);
4672         /* Bring the device down... */
4673         if (prev_status >= B43_STAT_STARTED) {
4674                 dev = b43_wireless_core_stop(dev);
4675                 if (!dev) {
4676                         err = -ENODEV;
4677                         goto out;
4678                 }
4679         }
4680         if (prev_status >= B43_STAT_INITIALIZED)
4681                 b43_wireless_core_exit(dev);
4682
4683         /* ...and up again. */
4684         if (prev_status >= B43_STAT_INITIALIZED) {
4685                 err = b43_wireless_core_init(dev);
4686                 if (err)
4687                         goto out;
4688         }
4689         if (prev_status >= B43_STAT_STARTED) {
4690                 err = b43_wireless_core_start(dev);
4691                 if (err) {
4692                         b43_wireless_core_exit(dev);
4693                         goto out;
4694                 }
4695         }
4696 out:
4697         if (err)
4698                 wl->current_dev = NULL; /* Failed to init the dev. */
4699         mutex_unlock(&wl->mutex);
4700         if (err)
4701                 b43err(wl, "Controller restart FAILED\n");
4702         else
4703                 b43info(wl, "Controller restarted\n");
4704 }
4705
4706 static int b43_setup_bands(struct b43_wldev *dev,
4707                            bool have_2ghz_phy, bool have_5ghz_phy)
4708 {
4709         struct ieee80211_hw *hw = dev->wl->hw;
4710
4711         if (have_2ghz_phy)
4712                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
4713         if (dev->phy.type == B43_PHYTYPE_N) {
4714                 if (have_5ghz_phy)
4715                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
4716         } else {
4717                 if (have_5ghz_phy)
4718                         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
4719         }
4720
4721         dev->phy.supports_2ghz = have_2ghz_phy;
4722         dev->phy.supports_5ghz = have_5ghz_phy;
4723
4724         return 0;
4725 }
4726
4727 static void b43_wireless_core_detach(struct b43_wldev *dev)
4728 {
4729         /* We release firmware that late to not be required to re-request
4730          * is all the time when we reinit the core. */
4731         b43_release_firmware(dev);
4732         b43_phy_free(dev);
4733 }
4734
4735 static int b43_wireless_core_attach(struct b43_wldev *dev)
4736 {
4737         struct b43_wl *wl = dev->wl;
4738         struct ssb_bus *bus = dev->sdev->bus;
4739         struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
4740         int err;
4741         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
4742         u32 tmp;
4743
4744         /* Do NOT do any device initialization here.
4745          * Do it in wireless_core_init() instead.
4746          * This function is for gathering basic information about the HW, only.
4747          * Also some structs may be set up here. But most likely you want to have
4748          * that in core_init(), too.
4749          */
4750
4751         err = ssb_bus_powerup(bus, 0);
4752         if (err) {
4753                 b43err(wl, "Bus powerup failed\n");
4754                 goto out;
4755         }
4756         /* Get the PHY type. */
4757         if (dev->sdev->id.revision >= 5) {
4758                 u32 tmshigh;
4759
4760                 tmshigh = ssb_read32(dev->sdev, SSB_TMSHIGH);
4761                 have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
4762                 have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
4763         } else
4764                 B43_WARN_ON(1);
4765
4766         dev->phy.gmode = have_2ghz_phy;
4767         dev->phy.radio_on = 1;
4768         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4769         b43_wireless_core_reset(dev, tmp);
4770
4771         err = b43_phy_versioning(dev);
4772         if (err)
4773                 goto err_powerdown;
4774         /* Check if this device supports multiband. */
4775         if (!pdev ||
4776             (pdev->device != 0x4312 &&
4777              pdev->device != 0x4319 && pdev->device != 0x4324)) {
4778                 /* No multiband support. */
4779                 have_2ghz_phy = 0;
4780                 have_5ghz_phy = 0;
4781                 switch (dev->phy.type) {
4782                 case B43_PHYTYPE_A:
4783                         have_5ghz_phy = 1;
4784                         break;
4785                 case B43_PHYTYPE_LP: //FIXME not always!
4786 #if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
4787                         have_5ghz_phy = 1;
4788 #endif
4789                 case B43_PHYTYPE_G:
4790                 case B43_PHYTYPE_N:
4791                         have_2ghz_phy = 1;
4792                         break;
4793                 default:
4794                         B43_WARN_ON(1);
4795                 }
4796         }
4797         if (dev->phy.type == B43_PHYTYPE_A) {
4798                 /* FIXME */
4799                 b43err(wl, "IEEE 802.11a devices are unsupported\n");
4800                 err = -EOPNOTSUPP;
4801                 goto err_powerdown;
4802         }
4803         if (1 /* disable A-PHY */) {
4804                 /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
4805                 if (dev->phy.type != B43_PHYTYPE_N &&
4806                     dev->phy.type != B43_PHYTYPE_LP) {
4807                         have_2ghz_phy = 1;
4808                         have_5ghz_phy = 0;
4809                 }
4810         }
4811
4812         err = b43_phy_allocate(dev);
4813         if (err)
4814                 goto err_powerdown;
4815
4816         dev->phy.gmode = have_2ghz_phy;
4817         tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
4818         b43_wireless_core_reset(dev, tmp);
4819
4820         err = b43_validate_chipaccess(dev);
4821         if (err)
4822                 goto err_phy_free;
4823         err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
4824         if (err)
4825                 goto err_phy_free;
4826
4827         /* Now set some default "current_dev" */
4828         if (!wl->current_dev)
4829                 wl->current_dev = dev;
4830         INIT_WORK(&dev->restart_work, b43_chip_reset);
4831
4832         dev->phy.ops->switch_analog(dev, 0);
4833         ssb_device_disable(dev->sdev, 0);
4834         ssb_bus_may_powerdown(bus);
4835
4836 out:
4837         return err;
4838
4839 err_phy_free:
4840         b43_phy_free(dev);
4841 err_powerdown:
4842         ssb_bus_may_powerdown(bus);
4843         return err;
4844 }
4845
4846 static void b43_one_core_detach(struct ssb_device *dev)
4847 {
4848         struct b43_wldev *wldev;
4849         struct b43_wl *wl;
4850
4851         /* Do not cancel ieee80211-workqueue based work here.
4852          * See comment in b43_remove(). */
4853
4854         wldev = ssb_get_drvdata(dev);
4855         wl = wldev->wl;
4856         b43_debugfs_remove_device(wldev);
4857         b43_wireless_core_detach(wldev);
4858         list_del(&wldev->list);
4859         wl->nr_devs--;
4860         ssb_set_drvdata(dev, NULL);
4861         kfree(wldev);
4862 }
4863
4864 static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
4865 {
4866         struct b43_wldev *wldev;
4867         int err = -ENOMEM;
4868
4869         wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
4870         if (!wldev)
4871                 goto out;
4872
4873         wldev->use_pio = b43_modparam_pio;
4874         wldev->sdev = dev;
4875         wldev->wl = wl;
4876         b43_set_status(wldev, B43_STAT_UNINIT);
4877         wldev->bad_frames_preempt = modparam_bad_frames_preempt;
4878         INIT_LIST_HEAD(&wldev->list);
4879
4880         err = b43_wireless_core_attach(wldev);
4881         if (err)
4882                 goto err_kfree_wldev;
4883
4884         list_add(&wldev->list, &wl->devlist);
4885         wl->nr_devs++;
4886         ssb_set_drvdata(dev, wldev);
4887         b43_debugfs_add_device(wldev);
4888
4889       out:
4890         return err;
4891
4892       err_kfree_wldev:
4893         kfree(wldev);
4894         return err;
4895 }
4896
4897 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)         ( \
4898         (pdev->vendor == PCI_VENDOR_ID_##_vendor) &&                    \
4899         (pdev->device == _device) &&                                    \
4900         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
4901         (pdev->subsystem_device == _subdevice)                          )
4902
4903 static void b43_sprom_fixup(struct ssb_bus *bus)
4904 {
4905         struct pci_dev *pdev;
4906
4907         /* boardflags workarounds */
4908         if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
4909             bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
4910                 bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
4911         if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
4912             bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
4913                 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
4914         if (bus->bustype == SSB_BUSTYPE_PCI) {
4915                 pdev = bus->host_pci;
4916                 if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
4917                     IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
4918                     IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
4919                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
4920                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
4921                     IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
4922                     IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
4923                         bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
4924         }
4925 }
4926
4927 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
4928 {
4929         struct ieee80211_hw *hw = wl->hw;
4930
4931         ssb_set_devtypedata(dev, NULL);
4932         ieee80211_free_hw(hw);
4933 }
4934
4935 static struct b43_wl *b43_wireless_init(struct ssb_device *dev)
4936 {
4937         struct ssb_sprom *sprom = &dev->bus->sprom;
4938         struct ieee80211_hw *hw;
4939         struct b43_wl *wl;
4940
4941         hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
4942         if (!hw) {
4943                 b43err(NULL, "Could not allocate ieee80211 device\n");
4944                 return ERR_PTR(-ENOMEM);
4945         }
4946         wl = hw_to_b43_wl(hw);
4947
4948         /* fill hw info */
4949         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
4950                     IEEE80211_HW_SIGNAL_DBM;
4951
4952         hw->wiphy->interface_modes =
4953                 BIT(NL80211_IFTYPE_AP) |
4954                 BIT(NL80211_IFTYPE_MESH_POINT) |
4955                 BIT(NL80211_IFTYPE_STATION) |
4956                 BIT(NL80211_IFTYPE_WDS) |
4957                 BIT(NL80211_IFTYPE_ADHOC);
4958
4959         hw->queues = modparam_qos ? 4 : 1;
4960         wl->mac80211_initially_registered_queues = hw->queues;
4961         hw->max_rates = 2;
4962         SET_IEEE80211_DEV(hw, dev->dev);
4963         if (is_valid_ether_addr(sprom->et1mac))
4964                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
4965         else
4966                 SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
4967
4968         /* Initialize struct b43_wl */
4969         wl->hw = hw;
4970         mutex_init(&wl->mutex);
4971         spin_lock_init(&wl->hardirq_lock);
4972         INIT_LIST_HEAD(&wl->devlist);
4973         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
4974         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
4975         INIT_WORK(&wl->tx_work, b43_tx_work);
4976         skb_queue_head_init(&wl->tx_queue);
4977
4978         b43info(wl, "Broadcom %04X WLAN found (core revision %u)\n",
4979                 dev->bus->chip_id, dev->id.revision);
4980         return wl;
4981 }
4982
4983 static int b43_ssb_probe(struct ssb_device *dev, const struct ssb_device_id *id)
4984 {
4985         struct b43_wl *wl;
4986         int err;
4987         int first = 0;
4988
4989         wl = ssb_get_devtypedata(dev);
4990         if (!wl) {
4991                 /* Probing the first core. Must setup common struct b43_wl */
4992                 first = 1;
4993                 b43_sprom_fixup(dev->bus);
4994                 wl = b43_wireless_init(dev);
4995                 if (IS_ERR(wl)) {
4996                         err = PTR_ERR(wl);
4997                         goto out;
4998                 }
4999                 ssb_set_devtypedata(dev, wl);
5000                 B43_WARN_ON(ssb_get_devtypedata(dev) != wl);
5001         }
5002         err = b43_one_core_attach(dev, wl);
5003         if (err)
5004                 goto err_wireless_exit;
5005
5006         if (first) {
5007                 err = ieee80211_register_hw(wl->hw);
5008                 if (err)
5009                         goto err_one_core_detach;
5010                 b43_leds_register(wl->current_dev);
5011         }
5012
5013       out:
5014         return err;
5015
5016       err_one_core_detach:
5017         b43_one_core_detach(dev);
5018       err_wireless_exit:
5019         if (first)
5020                 b43_wireless_exit(dev, wl);
5021         return err;
5022 }
5023
5024 static void b43_ssb_remove(struct ssb_device *dev)
5025 {
5026         struct b43_wl *wl = ssb_get_devtypedata(dev);
5027         struct b43_wldev *wldev = ssb_get_drvdata(dev);
5028
5029         /* We must cancel any work here before unregistering from ieee80211,
5030          * as the ieee80211 unreg will destroy the workqueue. */
5031         cancel_work_sync(&wldev->restart_work);
5032
5033         B43_WARN_ON(!wl);
5034         if (wl->current_dev == wldev) {
5035                 /* Restore the queues count before unregistering, because firmware detect
5036                  * might have modified it. Restoring is important, so the networking
5037                  * stack can properly free resources. */
5038                 wl->hw->queues = wl->mac80211_initially_registered_queues;
5039                 b43_leds_stop(wldev);
5040                 ieee80211_unregister_hw(wl->hw);
5041         }
5042
5043         b43_one_core_detach(dev);
5044
5045         if (list_empty(&wl->devlist)) {
5046                 b43_leds_unregister(wl);
5047                 /* Last core on the chip unregistered.
5048                  * We can destroy common struct b43_wl.
5049                  */
5050                 b43_wireless_exit(dev, wl);
5051         }
5052 }
5053
5054 /* Perform a hardware reset. This can be called from any context. */
5055 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5056 {
5057         /* Must avoid requeueing, if we are in shutdown. */
5058         if (b43_status(dev) < B43_STAT_INITIALIZED)
5059                 return;
5060         b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5061         ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5062 }
5063
5064 static struct ssb_driver b43_ssb_driver = {
5065         .name           = KBUILD_MODNAME,
5066         .id_table       = b43_ssb_tbl,
5067         .probe          = b43_ssb_probe,
5068         .remove         = b43_ssb_remove,
5069 };
5070
5071 static void b43_print_driverinfo(void)
5072 {
5073         const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5074                    *feat_leds = "", *feat_sdio = "";
5075
5076 #ifdef CONFIG_B43_PCI_AUTOSELECT
5077         feat_pci = "P";
5078 #endif
5079 #ifdef CONFIG_B43_PCMCIA
5080         feat_pcmcia = "M";
5081 #endif
5082 #ifdef CONFIG_B43_PHY_N
5083         feat_nphy = "N";
5084 #endif
5085 #ifdef CONFIG_B43_LEDS
5086         feat_leds = "L";
5087 #endif
5088 #ifdef CONFIG_B43_SDIO
5089         feat_sdio = "S";
5090 #endif
5091         printk(KERN_INFO "Broadcom 43xx driver loaded "
5092                "[ Features: %s%s%s%s%s, Firmware-ID: "
5093                B43_SUPPORTED_FIRMWARE_ID " ]\n",
5094                feat_pci, feat_pcmcia, feat_nphy,
5095                feat_leds, feat_sdio);
5096 }
5097
5098 static int __init b43_init(void)
5099 {
5100         int err;
5101
5102         b43_debugfs_init();
5103         err = b43_pcmcia_init();
5104         if (err)
5105                 goto err_dfs_exit;
5106         err = b43_sdio_init();
5107         if (err)
5108                 goto err_pcmcia_exit;
5109         err = ssb_driver_register(&b43_ssb_driver);
5110         if (err)
5111                 goto err_sdio_exit;
5112         b43_print_driverinfo();
5113
5114         return err;
5115
5116 err_sdio_exit:
5117         b43_sdio_exit();
5118 err_pcmcia_exit:
5119         b43_pcmcia_exit();
5120 err_dfs_exit:
5121         b43_debugfs_exit();
5122         return err;
5123 }
5124
5125 static void __exit b43_exit(void)
5126 {
5127         ssb_driver_unregister(&b43_ssb_driver);
5128         b43_sdio_exit();
5129         b43_pcmcia_exit();
5130         b43_debugfs_exit();
5131 }
5132
5133 module_init(b43_init)
5134 module_exit(b43_exit)