1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 
4   Broadcom B43 wireless driver
5 
6   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
7   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
8   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
9   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
10   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
11   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
12 
13   SDIO support
14   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
15 
16   Some parts of the code in this file are derived from the ipw2200
17   driver  Copyright(c) 2003 - 2004 Intel Corporation.
18 
19 
20 */
21 
22 #include <linux/delay.h>
23 #include <linux/init.h>
24 #include <linux/module.h>
25 #include <linux/if_arp.h>
26 #include <linux/etherdevice.h>
27 #include <linux/firmware.h>
28 #include <linux/workqueue.h>
29 #include <linux/skbuff.h>
30 #include <linux/io.h>
31 #include <linux/dma-mapping.h>
32 #include <linux/slab.h>
33 #include <asm/unaligned.h>
34 
35 #include "b43.h"
36 #include "main.h"
37 #include "debugfs.h"
38 #include "phy_common.h"
39 #include "phy_g.h"
40 #include "phy_n.h"
41 #include "dma.h"
42 #include "pio.h"
43 #include "sysfs.h"
44 #include "xmit.h"
45 #include "lo.h"
46 #include "sdio.h"
47 #include <linux/mmc/sdio_func.h>
48 
49 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
50 MODULE_AUTHOR("Martin Langer");
51 MODULE_AUTHOR("Stefano Brivio");
52 MODULE_AUTHOR("Michael Buesch");
53 MODULE_AUTHOR("Gábor Stefanik");
54 MODULE_AUTHOR("Rafał Miłecki");
55 MODULE_LICENSE("GPL");
56 
57 MODULE_FIRMWARE("b43/ucode11.fw");
58 MODULE_FIRMWARE("b43/ucode13.fw");
59 MODULE_FIRMWARE("b43/ucode14.fw");
60 MODULE_FIRMWARE("b43/ucode15.fw");
61 MODULE_FIRMWARE("b43/ucode16_lp.fw");
62 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
63 MODULE_FIRMWARE("b43/ucode24_lcn.fw");
64 MODULE_FIRMWARE("b43/ucode25_lcn.fw");
65 MODULE_FIRMWARE("b43/ucode25_mimo.fw");
66 MODULE_FIRMWARE("b43/ucode26_mimo.fw");
67 MODULE_FIRMWARE("b43/ucode29_mimo.fw");
68 MODULE_FIRMWARE("b43/ucode33_lcn40.fw");
69 MODULE_FIRMWARE("b43/ucode30_mimo.fw");
70 MODULE_FIRMWARE("b43/ucode5.fw");
71 MODULE_FIRMWARE("b43/ucode40.fw");
72 MODULE_FIRMWARE("b43/ucode42.fw");
73 MODULE_FIRMWARE("b43/ucode9.fw");
74 
75 static int modparam_bad_frames_preempt;
76 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
77 MODULE_PARM_DESC(bad_frames_preempt,
78 		 "enable(1) / disable(0) Bad Frames Preemption");
79 
80 static char modparam_fwpostfix[16];
81 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
82 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
83 
84 static int modparam_hwpctl;
85 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
86 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
87 
88 static int modparam_nohwcrypt;
89 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
90 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
91 
92 static int modparam_hwtkip;
93 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
94 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
95 
96 static int modparam_qos = 1;
97 module_param_named(qos, modparam_qos, int, 0444);
98 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
99 
100 static int modparam_btcoex = 1;
101 module_param_named(btcoex, modparam_btcoex, int, 0444);
102 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
103 
104 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
105 module_param_named(verbose, b43_modparam_verbose, int, 0644);
106 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
107 
108 static int b43_modparam_pio;
109 module_param_named(pio, b43_modparam_pio, int, 0644);
110 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
111 
112 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
113 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
114 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
115 
116 #ifdef CONFIG_B43_BCMA
117 static const struct bcma_device_id b43_bcma_tbl[] = {
118 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
119 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
120 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
121 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
122 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
123 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
124 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
125 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
126 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
127 	{},
128 };
129 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
130 #endif
131 
132 #ifdef CONFIG_B43_SSB
133 static const struct ssb_device_id b43_ssb_tbl[] = {
134 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
135 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
136 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
137 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
138 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
139 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
140 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
141 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
142 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
143 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
144 	{},
145 };
146 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
147 #endif
148 
149 /* Channel and ratetables are shared for all devices.
150  * They can't be const, because ieee80211 puts some precalculated
151  * data in there. This data is the same for all devices, so we don't
152  * get concurrency issues */
153 #define RATETAB_ENT(_rateid, _flags) \
154 	{								\
155 		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
156 		.hw_value	= (_rateid),				\
157 		.flags		= (_flags),				\
158 	}
159 
160 /*
161  * NOTE: When changing this, sync with xmit.c's
162  *	 b43_plcp_get_bitrate_idx_* functions!
163  */
164 static struct ieee80211_rate __b43_ratetable[] = {
165 	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
166 	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
167 	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
168 	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
169 	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
170 	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
171 	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
172 	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
173 	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
174 	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
175 	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
176 	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
177 };
178 
179 #define b43_a_ratetable		(__b43_ratetable + 4)
180 #define b43_a_ratetable_size	8
181 #define b43_b_ratetable		(__b43_ratetable + 0)
182 #define b43_b_ratetable_size	4
183 #define b43_g_ratetable		(__b43_ratetable + 0)
184 #define b43_g_ratetable_size	12
185 
186 #define CHAN2G(_channel, _freq, _flags) {			\
187 	.band			= NL80211_BAND_2GHZ,		\
188 	.center_freq		= (_freq),			\
189 	.hw_value		= (_channel),			\
190 	.flags			= (_flags),			\
191 	.max_antenna_gain	= 0,				\
192 	.max_power		= 30,				\
193 }
194 static struct ieee80211_channel b43_2ghz_chantable[] = {
195 	CHAN2G(1, 2412, 0),
196 	CHAN2G(2, 2417, 0),
197 	CHAN2G(3, 2422, 0),
198 	CHAN2G(4, 2427, 0),
199 	CHAN2G(5, 2432, 0),
200 	CHAN2G(6, 2437, 0),
201 	CHAN2G(7, 2442, 0),
202 	CHAN2G(8, 2447, 0),
203 	CHAN2G(9, 2452, 0),
204 	CHAN2G(10, 2457, 0),
205 	CHAN2G(11, 2462, 0),
206 	CHAN2G(12, 2467, 0),
207 	CHAN2G(13, 2472, 0),
208 	CHAN2G(14, 2484, 0),
209 };
210 
211 /* No support for the last 3 channels (12, 13, 14) */
212 #define b43_2ghz_chantable_limited_size		11
213 #undef CHAN2G
214 
215 #define CHAN4G(_channel, _flags) {				\
216 	.band			= NL80211_BAND_5GHZ,		\
217 	.center_freq		= 4000 + (5 * (_channel)),	\
218 	.hw_value		= (_channel),			\
219 	.flags			= (_flags),			\
220 	.max_antenna_gain	= 0,				\
221 	.max_power		= 30,				\
222 }
223 #define CHAN5G(_channel, _flags) {				\
224 	.band			= NL80211_BAND_5GHZ,		\
225 	.center_freq		= 5000 + (5 * (_channel)),	\
226 	.hw_value		= (_channel),			\
227 	.flags			= (_flags),			\
228 	.max_antenna_gain	= 0,				\
229 	.max_power		= 30,				\
230 }
231 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
232 	CHAN4G(184, 0),		CHAN4G(186, 0),
233 	CHAN4G(188, 0),		CHAN4G(190, 0),
234 	CHAN4G(192, 0),		CHAN4G(194, 0),
235 	CHAN4G(196, 0),		CHAN4G(198, 0),
236 	CHAN4G(200, 0),		CHAN4G(202, 0),
237 	CHAN4G(204, 0),		CHAN4G(206, 0),
238 	CHAN4G(208, 0),		CHAN4G(210, 0),
239 	CHAN4G(212, 0),		CHAN4G(214, 0),
240 	CHAN4G(216, 0),		CHAN4G(218, 0),
241 	CHAN4G(220, 0),		CHAN4G(222, 0),
242 	CHAN4G(224, 0),		CHAN4G(226, 0),
243 	CHAN4G(228, 0),
244 	CHAN5G(32, 0),		CHAN5G(34, 0),
245 	CHAN5G(36, 0),		CHAN5G(38, 0),
246 	CHAN5G(40, 0),		CHAN5G(42, 0),
247 	CHAN5G(44, 0),		CHAN5G(46, 0),
248 	CHAN5G(48, 0),		CHAN5G(50, 0),
249 	CHAN5G(52, 0),		CHAN5G(54, 0),
250 	CHAN5G(56, 0),		CHAN5G(58, 0),
251 	CHAN5G(60, 0),		CHAN5G(62, 0),
252 	CHAN5G(64, 0),		CHAN5G(66, 0),
253 	CHAN5G(68, 0),		CHAN5G(70, 0),
254 	CHAN5G(72, 0),		CHAN5G(74, 0),
255 	CHAN5G(76, 0),		CHAN5G(78, 0),
256 	CHAN5G(80, 0),		CHAN5G(82, 0),
257 	CHAN5G(84, 0),		CHAN5G(86, 0),
258 	CHAN5G(88, 0),		CHAN5G(90, 0),
259 	CHAN5G(92, 0),		CHAN5G(94, 0),
260 	CHAN5G(96, 0),		CHAN5G(98, 0),
261 	CHAN5G(100, 0),		CHAN5G(102, 0),
262 	CHAN5G(104, 0),		CHAN5G(106, 0),
263 	CHAN5G(108, 0),		CHAN5G(110, 0),
264 	CHAN5G(112, 0),		CHAN5G(114, 0),
265 	CHAN5G(116, 0),		CHAN5G(118, 0),
266 	CHAN5G(120, 0),		CHAN5G(122, 0),
267 	CHAN5G(124, 0),		CHAN5G(126, 0),
268 	CHAN5G(128, 0),		CHAN5G(130, 0),
269 	CHAN5G(132, 0),		CHAN5G(134, 0),
270 	CHAN5G(136, 0),		CHAN5G(138, 0),
271 	CHAN5G(140, 0),		CHAN5G(142, 0),
272 	CHAN5G(144, 0),		CHAN5G(145, 0),
273 	CHAN5G(146, 0),		CHAN5G(147, 0),
274 	CHAN5G(148, 0),		CHAN5G(149, 0),
275 	CHAN5G(150, 0),		CHAN5G(151, 0),
276 	CHAN5G(152, 0),		CHAN5G(153, 0),
277 	CHAN5G(154, 0),		CHAN5G(155, 0),
278 	CHAN5G(156, 0),		CHAN5G(157, 0),
279 	CHAN5G(158, 0),		CHAN5G(159, 0),
280 	CHAN5G(160, 0),		CHAN5G(161, 0),
281 	CHAN5G(162, 0),		CHAN5G(163, 0),
282 	CHAN5G(164, 0),		CHAN5G(165, 0),
283 	CHAN5G(166, 0),		CHAN5G(168, 0),
284 	CHAN5G(170, 0),		CHAN5G(172, 0),
285 	CHAN5G(174, 0),		CHAN5G(176, 0),
286 	CHAN5G(178, 0),		CHAN5G(180, 0),
287 	CHAN5G(182, 0),
288 };
289 
290 static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
291 	CHAN5G(36, 0),		CHAN5G(40, 0),
292 	CHAN5G(44, 0),		CHAN5G(48, 0),
293 	CHAN5G(149, 0),		CHAN5G(153, 0),
294 	CHAN5G(157, 0),		CHAN5G(161, 0),
295 	CHAN5G(165, 0),
296 };
297 
298 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
299 	CHAN5G(34, 0),		CHAN5G(36, 0),
300 	CHAN5G(38, 0),		CHAN5G(40, 0),
301 	CHAN5G(42, 0),		CHAN5G(44, 0),
302 	CHAN5G(46, 0),		CHAN5G(48, 0),
303 	CHAN5G(52, 0),		CHAN5G(56, 0),
304 	CHAN5G(60, 0),		CHAN5G(64, 0),
305 	CHAN5G(100, 0),		CHAN5G(104, 0),
306 	CHAN5G(108, 0),		CHAN5G(112, 0),
307 	CHAN5G(116, 0),		CHAN5G(120, 0),
308 	CHAN5G(124, 0),		CHAN5G(128, 0),
309 	CHAN5G(132, 0),		CHAN5G(136, 0),
310 	CHAN5G(140, 0),		CHAN5G(149, 0),
311 	CHAN5G(153, 0),		CHAN5G(157, 0),
312 	CHAN5G(161, 0),		CHAN5G(165, 0),
313 	CHAN5G(184, 0),		CHAN5G(188, 0),
314 	CHAN5G(192, 0),		CHAN5G(196, 0),
315 	CHAN5G(200, 0),		CHAN5G(204, 0),
316 	CHAN5G(208, 0),		CHAN5G(212, 0),
317 	CHAN5G(216, 0),
318 };
319 #undef CHAN4G
320 #undef CHAN5G
321 
322 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
323 	.band		= NL80211_BAND_5GHZ,
324 	.channels	= b43_5ghz_nphy_chantable,
325 	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
326 	.bitrates	= b43_a_ratetable,
327 	.n_bitrates	= b43_a_ratetable_size,
328 };
329 
330 static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
331 	.band		= NL80211_BAND_5GHZ,
332 	.channels	= b43_5ghz_nphy_chantable_limited,
333 	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
334 	.bitrates	= b43_a_ratetable,
335 	.n_bitrates	= b43_a_ratetable_size,
336 };
337 
338 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
339 	.band		= NL80211_BAND_5GHZ,
340 	.channels	= b43_5ghz_aphy_chantable,
341 	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
342 	.bitrates	= b43_a_ratetable,
343 	.n_bitrates	= b43_a_ratetable_size,
344 };
345 
346 static struct ieee80211_supported_band b43_band_2GHz = {
347 	.band		= NL80211_BAND_2GHZ,
348 	.channels	= b43_2ghz_chantable,
349 	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
350 	.bitrates	= b43_g_ratetable,
351 	.n_bitrates	= b43_g_ratetable_size,
352 };
353 
354 static struct ieee80211_supported_band b43_band_2ghz_limited = {
355 	.band		= NL80211_BAND_2GHZ,
356 	.channels	= b43_2ghz_chantable,
357 	.n_channels	= b43_2ghz_chantable_limited_size,
358 	.bitrates	= b43_g_ratetable,
359 	.n_bitrates	= b43_g_ratetable_size,
360 };
361 
362 static void b43_wireless_core_exit(struct b43_wldev *dev);
363 static int b43_wireless_core_init(struct b43_wldev *dev);
364 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
365 static int b43_wireless_core_start(struct b43_wldev *dev);
366 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
367 				    struct ieee80211_vif *vif,
368 				    struct ieee80211_bss_conf *conf,
369 				    u64 changed);
370 
371 static int b43_ratelimit(struct b43_wl *wl)
372 {
373 	if (!wl || !wl->current_dev)
374 		return 1;
375 	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
376 		return 1;
377 	/* We are up and running.
378 	 * Ratelimit the messages to avoid DoS over the net. */
379 	return net_ratelimit();
380 }
381 
382 void b43info(struct b43_wl *wl, const char *fmt, ...)
383 {
384 	struct va_format vaf;
385 	va_list args;
386 
387 	if (b43_modparam_verbose < B43_VERBOSITY_INFO)
388 		return;
389 	if (!b43_ratelimit(wl))
390 		return;
391 
392 	va_start(args, fmt);
393 
394 	vaf.fmt = fmt;
395 	vaf.va = &args;
396 
397 	printk(KERN_INFO "b43-%s: %pV",
398 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
399 
400 	va_end(args);
401 }
402 
403 void b43err(struct b43_wl *wl, const char *fmt, ...)
404 {
405 	struct va_format vaf;
406 	va_list args;
407 
408 	if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
409 		return;
410 	if (!b43_ratelimit(wl))
411 		return;
412 
413 	va_start(args, fmt);
414 
415 	vaf.fmt = fmt;
416 	vaf.va = &args;
417 
418 	printk(KERN_ERR "b43-%s ERROR: %pV",
419 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
420 
421 	va_end(args);
422 }
423 
424 void b43warn(struct b43_wl *wl, const char *fmt, ...)
425 {
426 	struct va_format vaf;
427 	va_list args;
428 
429 	if (b43_modparam_verbose < B43_VERBOSITY_WARN)
430 		return;
431 	if (!b43_ratelimit(wl))
432 		return;
433 
434 	va_start(args, fmt);
435 
436 	vaf.fmt = fmt;
437 	vaf.va = &args;
438 
439 	printk(KERN_WARNING "b43-%s warning: %pV",
440 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
441 
442 	va_end(args);
443 }
444 
445 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
446 {
447 	struct va_format vaf;
448 	va_list args;
449 
450 	if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
451 		return;
452 
453 	va_start(args, fmt);
454 
455 	vaf.fmt = fmt;
456 	vaf.va = &args;
457 
458 	printk(KERN_DEBUG "b43-%s debug: %pV",
459 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
460 
461 	va_end(args);
462 }
463 
464 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
465 {
466 	u32 macctl;
467 
468 	B43_WARN_ON(offset % 4 != 0);
469 
470 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
471 	if (macctl & B43_MACCTL_BE)
472 		val = swab32(val);
473 
474 	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
475 	b43_write32(dev, B43_MMIO_RAM_DATA, val);
476 }
477 
478 static inline void b43_shm_control_word(struct b43_wldev *dev,
479 					u16 routing, u16 offset)
480 {
481 	u32 control;
482 
483 	/* "offset" is the WORD offset. */
484 	control = routing;
485 	control <<= 16;
486 	control |= offset;
487 	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
488 }
489 
490 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
491 {
492 	u32 ret;
493 
494 	if (routing == B43_SHM_SHARED) {
495 		B43_WARN_ON(offset & 0x0001);
496 		if (offset & 0x0003) {
497 			/* Unaligned access */
498 			b43_shm_control_word(dev, routing, offset >> 2);
499 			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
500 			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
501 			ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
502 
503 			goto out;
504 		}
505 		offset >>= 2;
506 	}
507 	b43_shm_control_word(dev, routing, offset);
508 	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
509 out:
510 	return ret;
511 }
512 
513 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
514 {
515 	u16 ret;
516 
517 	if (routing == B43_SHM_SHARED) {
518 		B43_WARN_ON(offset & 0x0001);
519 		if (offset & 0x0003) {
520 			/* Unaligned access */
521 			b43_shm_control_word(dev, routing, offset >> 2);
522 			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
523 
524 			goto out;
525 		}
526 		offset >>= 2;
527 	}
528 	b43_shm_control_word(dev, routing, offset);
529 	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
530 out:
531 	return ret;
532 }
533 
534 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
535 {
536 	if (routing == B43_SHM_SHARED) {
537 		B43_WARN_ON(offset & 0x0001);
538 		if (offset & 0x0003) {
539 			/* Unaligned access */
540 			b43_shm_control_word(dev, routing, offset >> 2);
541 			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
542 				    value & 0xFFFF);
543 			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
544 			b43_write16(dev, B43_MMIO_SHM_DATA,
545 				    (value >> 16) & 0xFFFF);
546 			return;
547 		}
548 		offset >>= 2;
549 	}
550 	b43_shm_control_word(dev, routing, offset);
551 	b43_write32(dev, B43_MMIO_SHM_DATA, value);
552 }
553 
554 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
555 {
556 	if (routing == B43_SHM_SHARED) {
557 		B43_WARN_ON(offset & 0x0001);
558 		if (offset & 0x0003) {
559 			/* Unaligned access */
560 			b43_shm_control_word(dev, routing, offset >> 2);
561 			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
562 			return;
563 		}
564 		offset >>= 2;
565 	}
566 	b43_shm_control_word(dev, routing, offset);
567 	b43_write16(dev, B43_MMIO_SHM_DATA, value);
568 }
569 
570 /* Read HostFlags */
571 u64 b43_hf_read(struct b43_wldev *dev)
572 {
573 	u64 ret;
574 
575 	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
576 	ret <<= 16;
577 	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
578 	ret <<= 16;
579 	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
580 
581 	return ret;
582 }
583 
584 /* Write HostFlags */
585 void b43_hf_write(struct b43_wldev *dev, u64 value)
586 {
587 	u16 lo, mi, hi;
588 
589 	lo = (value & 0x00000000FFFFULL);
590 	mi = (value & 0x0000FFFF0000ULL) >> 16;
591 	hi = (value & 0xFFFF00000000ULL) >> 32;
592 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
593 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
594 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
595 }
596 
597 /* Read the firmware capabilities bitmask (Opensource firmware only) */
598 static u16 b43_fwcapa_read(struct b43_wldev *dev)
599 {
600 	B43_WARN_ON(!dev->fw.opensource);
601 	return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
602 }
603 
604 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
605 {
606 	u32 low, high;
607 
608 	B43_WARN_ON(dev->dev->core_rev < 3);
609 
610 	/* The hardware guarantees us an atomic read, if we
611 	 * read the low register first. */
612 	low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
613 	high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
614 
615 	*tsf = high;
616 	*tsf <<= 32;
617 	*tsf |= low;
618 }
619 
620 static void b43_time_lock(struct b43_wldev *dev)
621 {
622 	b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
623 	/* Commit the write */
624 	b43_read32(dev, B43_MMIO_MACCTL);
625 }
626 
627 static void b43_time_unlock(struct b43_wldev *dev)
628 {
629 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
630 	/* Commit the write */
631 	b43_read32(dev, B43_MMIO_MACCTL);
632 }
633 
634 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
635 {
636 	u32 low, high;
637 
638 	B43_WARN_ON(dev->dev->core_rev < 3);
639 
640 	low = tsf;
641 	high = (tsf >> 32);
642 	/* The hardware guarantees us an atomic write, if we
643 	 * write the low register first. */
644 	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
645 	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
646 }
647 
648 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
649 {
650 	b43_time_lock(dev);
651 	b43_tsf_write_locked(dev, tsf);
652 	b43_time_unlock(dev);
653 }
654 
655 static
656 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
657 {
658 	static const u8 zero_addr[ETH_ALEN] = { 0 };
659 	u16 data;
660 
661 	if (!mac)
662 		mac = zero_addr;
663 
664 	offset |= 0x0020;
665 	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
666 
667 	data = mac[0];
668 	data |= mac[1] << 8;
669 	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
670 	data = mac[2];
671 	data |= mac[3] << 8;
672 	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
673 	data = mac[4];
674 	data |= mac[5] << 8;
675 	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
676 }
677 
678 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
679 {
680 	const u8 *mac;
681 	const u8 *bssid;
682 	u8 mac_bssid[ETH_ALEN * 2];
683 	int i;
684 	u32 tmp;
685 
686 	bssid = dev->wl->bssid;
687 	mac = dev->wl->mac_addr;
688 
689 	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
690 
691 	memcpy(mac_bssid, mac, ETH_ALEN);
692 	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
693 
694 	/* Write our MAC address and BSSID to template ram */
695 	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
696 		tmp = (u32) (mac_bssid[i + 0]);
697 		tmp |= (u32) (mac_bssid[i + 1]) << 8;
698 		tmp |= (u32) (mac_bssid[i + 2]) << 16;
699 		tmp |= (u32) (mac_bssid[i + 3]) << 24;
700 		b43_ram_write(dev, 0x20 + i, tmp);
701 	}
702 }
703 
704 static void b43_upload_card_macaddress(struct b43_wldev *dev)
705 {
706 	b43_write_mac_bssid_templates(dev);
707 	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
708 }
709 
710 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
711 {
712 	/* slot_time is in usec. */
713 	/* This test used to exit for all but a G PHY. */
714 	if (b43_current_band(dev->wl) == NL80211_BAND_5GHZ)
715 		return;
716 	b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
717 	/* Shared memory location 0x0010 is the slot time and should be
718 	 * set to slot_time; however, this register is initially 0 and changing
719 	 * the value adversely affects the transmit rate for BCM4311
720 	 * devices. Until this behavior is unterstood, delete this step
721 	 *
722 	 * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
723 	 */
724 }
725 
726 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
727 {
728 	b43_set_slot_time(dev, 9);
729 }
730 
731 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
732 {
733 	b43_set_slot_time(dev, 20);
734 }
735 
736 /* DummyTransmission function, as documented on
737  * https://bcm-v4.sipsolutions.net/802.11/DummyTransmission
738  */
739 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
740 {
741 	struct b43_phy *phy = &dev->phy;
742 	unsigned int i, max_loop;
743 	u16 value;
744 	u32 buffer[5] = {
745 		0x00000000,
746 		0x00D40000,
747 		0x00000000,
748 		0x01000000,
749 		0x00000000,
750 	};
751 
752 	if (ofdm) {
753 		max_loop = 0x1E;
754 		buffer[0] = 0x000201CC;
755 	} else {
756 		max_loop = 0xFA;
757 		buffer[0] = 0x000B846E;
758 	}
759 
760 	for (i = 0; i < 5; i++)
761 		b43_ram_write(dev, i * 4, buffer[i]);
762 
763 	b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
764 
765 	if (dev->dev->core_rev < 11)
766 		b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
767 	else
768 		b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
769 
770 	value = (ofdm ? 0x41 : 0x40);
771 	b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
772 	if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
773 	    phy->type == B43_PHYTYPE_LCN)
774 		b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
775 
776 	b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
777 	b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
778 
779 	b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
780 	b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
781 	b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
782 	b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
783 
784 	if (!pa_on && phy->type == B43_PHYTYPE_N) {
785 		; /*b43_nphy_pa_override(dev, false) */
786 	}
787 
788 	switch (phy->type) {
789 	case B43_PHYTYPE_N:
790 	case B43_PHYTYPE_LCN:
791 		b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
792 		break;
793 	case B43_PHYTYPE_LP:
794 		b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
795 		break;
796 	default:
797 		b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
798 	}
799 	b43_read16(dev, B43_MMIO_TXE0_AUX);
800 
801 	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
802 		b43_radio_write16(dev, 0x0051, 0x0017);
803 	for (i = 0x00; i < max_loop; i++) {
804 		value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
805 		if (value & 0x0080)
806 			break;
807 		udelay(10);
808 	}
809 	for (i = 0x00; i < 0x0A; i++) {
810 		value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
811 		if (value & 0x0400)
812 			break;
813 		udelay(10);
814 	}
815 	for (i = 0x00; i < 0x19; i++) {
816 		value = b43_read16(dev, B43_MMIO_IFSSTAT);
817 		if (!(value & 0x0100))
818 			break;
819 		udelay(10);
820 	}
821 	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
822 		b43_radio_write16(dev, 0x0051, 0x0037);
823 }
824 
825 static void key_write(struct b43_wldev *dev,
826 		      u8 index, u8 algorithm, const u8 *key)
827 {
828 	unsigned int i;
829 	u32 offset;
830 	u16 value;
831 	u16 kidx;
832 
833 	/* Key index/algo block */
834 	kidx = b43_kidx_to_fw(dev, index);
835 	value = ((kidx << 4) | algorithm);
836 	b43_shm_write16(dev, B43_SHM_SHARED,
837 			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
838 
839 	/* Write the key to the Key Table Pointer offset */
840 	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
841 	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
842 		value = key[i];
843 		value |= (u16) (key[i + 1]) << 8;
844 		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
845 	}
846 }
847 
848 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
849 {
850 	u32 addrtmp[2] = { 0, 0, };
851 	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
852 
853 	if (b43_new_kidx_api(dev))
854 		pairwise_keys_start = B43_NR_GROUP_KEYS;
855 
856 	B43_WARN_ON(index < pairwise_keys_start);
857 	/* We have four default TX keys and possibly four default RX keys.
858 	 * Physical mac 0 is mapped to physical key 4 or 8, depending
859 	 * on the firmware version.
860 	 * So we must adjust the index here.
861 	 */
862 	index -= pairwise_keys_start;
863 	B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
864 
865 	if (addr) {
866 		addrtmp[0] = addr[0];
867 		addrtmp[0] |= ((u32) (addr[1]) << 8);
868 		addrtmp[0] |= ((u32) (addr[2]) << 16);
869 		addrtmp[0] |= ((u32) (addr[3]) << 24);
870 		addrtmp[1] = addr[4];
871 		addrtmp[1] |= ((u32) (addr[5]) << 8);
872 	}
873 
874 	/* Receive match transmitter address (RCMTA) mechanism */
875 	b43_shm_write32(dev, B43_SHM_RCMTA,
876 			(index * 2) + 0, addrtmp[0]);
877 	b43_shm_write16(dev, B43_SHM_RCMTA,
878 			(index * 2) + 1, addrtmp[1]);
879 }
880 
881 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
882  * When a packet is received, the iv32 is checked.
883  * - if it doesn't the packet is returned without modification (and software
884  *   decryption can be done). That's what happen when iv16 wrap.
885  * - if it does, the rc4 key is computed, and decryption is tried.
886  *   Either it will success and B43_RX_MAC_DEC is returned,
887  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
888  *   and the packet is not usable (it got modified by the ucode).
889  * So in order to never have B43_RX_MAC_DECERR, we should provide
890  * a iv32 and phase1key that match. Because we drop packets in case of
891  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
892  * packets will be lost without higher layer knowing (ie no resync possible
893  * until next wrap).
894  *
895  * NOTE : this should support 50 key like RCMTA because
896  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
897  */
898 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
899 		u16 *phase1key)
900 {
901 	unsigned int i;
902 	u32 offset;
903 	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
904 
905 	if (!modparam_hwtkip)
906 		return;
907 
908 	if (b43_new_kidx_api(dev))
909 		pairwise_keys_start = B43_NR_GROUP_KEYS;
910 
911 	B43_WARN_ON(index < pairwise_keys_start);
912 	/* We have four default TX keys and possibly four default RX keys.
913 	 * Physical mac 0 is mapped to physical key 4 or 8, depending
914 	 * on the firmware version.
915 	 * So we must adjust the index here.
916 	 */
917 	index -= pairwise_keys_start;
918 	B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
919 
920 	if (b43_debug(dev, B43_DBG_KEYS)) {
921 		b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
922 				index, iv32);
923 	}
924 	/* Write the key to the  RX tkip shared mem */
925 	offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
926 	for (i = 0; i < 10; i += 2) {
927 		b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
928 				phase1key ? phase1key[i / 2] : 0);
929 	}
930 	b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
931 	b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
932 }
933 
934 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
935 				   struct ieee80211_vif *vif,
936 				   struct ieee80211_key_conf *keyconf,
937 				   struct ieee80211_sta *sta,
938 				   u32 iv32, u16 *phase1key)
939 {
940 	struct b43_wl *wl = hw_to_b43_wl(hw);
941 	struct b43_wldev *dev;
942 	int index = keyconf->hw_key_idx;
943 
944 	if (B43_WARN_ON(!modparam_hwtkip))
945 		return;
946 
947 	/* This is only called from the RX path through mac80211, where
948 	 * our mutex is already locked. */
949 	B43_WARN_ON(!mutex_is_locked(&wl->mutex));
950 	dev = wl->current_dev;
951 	B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
952 
953 	keymac_write(dev, index, NULL);	/* First zero out mac to avoid race */
954 
955 	rx_tkip_phase1_write(dev, index, iv32, phase1key);
956 	/* only pairwise TKIP keys are supported right now */
957 	if (WARN_ON(!sta))
958 		return;
959 	keymac_write(dev, index, sta->addr);
960 }
961 
962 static void do_key_write(struct b43_wldev *dev,
963 			 u8 index, u8 algorithm,
964 			 const u8 *key, size_t key_len, const u8 *mac_addr)
965 {
966 	u8 buf[B43_SEC_KEYSIZE] = { 0, };
967 	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
968 
969 	if (b43_new_kidx_api(dev))
970 		pairwise_keys_start = B43_NR_GROUP_KEYS;
971 
972 	B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
973 	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
974 
975 	if (index >= pairwise_keys_start)
976 		keymac_write(dev, index, NULL);	/* First zero out mac. */
977 	if (algorithm == B43_SEC_ALGO_TKIP) {
978 		/*
979 		 * We should provide an initial iv32, phase1key pair.
980 		 * We could start with iv32=0 and compute the corresponding
981 		 * phase1key, but this means calling ieee80211_get_tkip_key
982 		 * with a fake skb (or export other tkip function).
983 		 * Because we are lazy we hope iv32 won't start with
984 		 * 0xffffffff and let's b43_op_update_tkip_key provide a
985 		 * correct pair.
986 		 */
987 		rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
988 	} else if (index >= pairwise_keys_start) /* clear it */
989 		rx_tkip_phase1_write(dev, index, 0, NULL);
990 	if (key)
991 		memcpy(buf, key, key_len);
992 	key_write(dev, index, algorithm, buf);
993 	if (index >= pairwise_keys_start)
994 		keymac_write(dev, index, mac_addr);
995 
996 	dev->key[index].algorithm = algorithm;
997 }
998 
999 static int b43_key_write(struct b43_wldev *dev,
1000 			 int index, u8 algorithm,
1001 			 const u8 *key, size_t key_len,
1002 			 const u8 *mac_addr,
1003 			 struct ieee80211_key_conf *keyconf)
1004 {
1005 	int i;
1006 	int pairwise_keys_start;
1007 
1008 	/* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1009 	 * 	- Temporal Encryption Key (128 bits)
1010 	 * 	- Temporal Authenticator Tx MIC Key (64 bits)
1011 	 * 	- Temporal Authenticator Rx MIC Key (64 bits)
1012 	 *
1013 	 * 	Hardware only store TEK
1014 	 */
1015 	if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1016 		key_len = 16;
1017 	if (key_len > B43_SEC_KEYSIZE)
1018 		return -EINVAL;
1019 	for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1020 		/* Check that we don't already have this key. */
1021 		B43_WARN_ON(dev->key[i].keyconf == keyconf);
1022 	}
1023 	if (index < 0) {
1024 		/* Pairwise key. Get an empty slot for the key. */
1025 		if (b43_new_kidx_api(dev))
1026 			pairwise_keys_start = B43_NR_GROUP_KEYS;
1027 		else
1028 			pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1029 		for (i = pairwise_keys_start;
1030 		     i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1031 		     i++) {
1032 			B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1033 			if (!dev->key[i].keyconf) {
1034 				/* found empty */
1035 				index = i;
1036 				break;
1037 			}
1038 		}
1039 		if (index < 0) {
1040 			b43warn(dev->wl, "Out of hardware key memory\n");
1041 			return -ENOSPC;
1042 		}
1043 	} else
1044 		B43_WARN_ON(index > 3);
1045 
1046 	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1047 	if ((index <= 3) && !b43_new_kidx_api(dev)) {
1048 		/* Default RX key */
1049 		B43_WARN_ON(mac_addr);
1050 		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1051 	}
1052 	keyconf->hw_key_idx = index;
1053 	dev->key[index].keyconf = keyconf;
1054 
1055 	return 0;
1056 }
1057 
1058 static int b43_key_clear(struct b43_wldev *dev, int index)
1059 {
1060 	if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1061 		return -EINVAL;
1062 	do_key_write(dev, index, B43_SEC_ALGO_NONE,
1063 		     NULL, B43_SEC_KEYSIZE, NULL);
1064 	if ((index <= 3) && !b43_new_kidx_api(dev)) {
1065 		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1066 			     NULL, B43_SEC_KEYSIZE, NULL);
1067 	}
1068 	dev->key[index].keyconf = NULL;
1069 
1070 	return 0;
1071 }
1072 
1073 static void b43_clear_keys(struct b43_wldev *dev)
1074 {
1075 	int i, count;
1076 
1077 	if (b43_new_kidx_api(dev))
1078 		count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1079 	else
1080 		count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1081 	for (i = 0; i < count; i++)
1082 		b43_key_clear(dev, i);
1083 }
1084 
1085 static void b43_dump_keymemory(struct b43_wldev *dev)
1086 {
1087 	unsigned int i, index, count, offset, pairwise_keys_start;
1088 	u8 mac[ETH_ALEN];
1089 	u16 algo;
1090 	u32 rcmta0;
1091 	u16 rcmta1;
1092 	u64 hf;
1093 	struct b43_key *key;
1094 
1095 	if (!b43_debug(dev, B43_DBG_KEYS))
1096 		return;
1097 
1098 	hf = b43_hf_read(dev);
1099 	b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1100 	       !!(hf & B43_HF_USEDEFKEYS));
1101 	if (b43_new_kidx_api(dev)) {
1102 		pairwise_keys_start = B43_NR_GROUP_KEYS;
1103 		count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1104 	} else {
1105 		pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1106 		count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1107 	}
1108 	for (index = 0; index < count; index++) {
1109 		key = &(dev->key[index]);
1110 		printk(KERN_DEBUG "Key slot %02u: %s",
1111 		       index, (key->keyconf == NULL) ? " " : "*");
1112 		offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1113 		for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1114 			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1115 			printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1116 		}
1117 
1118 		algo = b43_shm_read16(dev, B43_SHM_SHARED,
1119 				      B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1120 		printk("   Algo: %04X/%02X", algo, key->algorithm);
1121 
1122 		if (index >= pairwise_keys_start) {
1123 			if (key->algorithm == B43_SEC_ALGO_TKIP) {
1124 				printk("   TKIP: ");
1125 				offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1126 				for (i = 0; i < 14; i += 2) {
1127 					u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1128 					printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1129 				}
1130 			}
1131 			rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1132 						((index - pairwise_keys_start) * 2) + 0);
1133 			rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1134 						((index - pairwise_keys_start) * 2) + 1);
1135 			*((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1136 			*((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1137 			printk("   MAC: %pM", mac);
1138 		} else
1139 			printk("   DEFAULT KEY");
1140 		printk("\n");
1141 	}
1142 }
1143 
1144 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1145 {
1146 	u32 macctl;
1147 	u16 ucstat;
1148 	bool hwps;
1149 	bool awake;
1150 	int i;
1151 
1152 	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1153 		    (ps_flags & B43_PS_DISABLED));
1154 	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1155 
1156 	if (ps_flags & B43_PS_ENABLED) {
1157 		hwps = true;
1158 	} else if (ps_flags & B43_PS_DISABLED) {
1159 		hwps = false;
1160 	} else {
1161 		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1162 		//      and thus is not an AP and we are associated, set bit 25
1163 	}
1164 	if (ps_flags & B43_PS_AWAKE) {
1165 		awake = true;
1166 	} else if (ps_flags & B43_PS_ASLEEP) {
1167 		awake = false;
1168 	} else {
1169 		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1170 		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1171 		//      successful, set bit26
1172 	}
1173 
1174 /* FIXME: For now we force awake-on and hwps-off */
1175 	hwps = false;
1176 	awake = true;
1177 
1178 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1179 	if (hwps)
1180 		macctl |= B43_MACCTL_HWPS;
1181 	else
1182 		macctl &= ~B43_MACCTL_HWPS;
1183 	if (awake)
1184 		macctl |= B43_MACCTL_AWAKE;
1185 	else
1186 		macctl &= ~B43_MACCTL_AWAKE;
1187 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1188 	/* Commit write */
1189 	b43_read32(dev, B43_MMIO_MACCTL);
1190 	if (awake && dev->dev->core_rev >= 5) {
1191 		/* Wait for the microcode to wake up. */
1192 		for (i = 0; i < 100; i++) {
1193 			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1194 						B43_SHM_SH_UCODESTAT);
1195 			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1196 				break;
1197 			udelay(10);
1198 		}
1199 	}
1200 }
1201 
1202 /* https://bcm-v4.sipsolutions.net/802.11/PHY/BmacCorePllReset */
1203 void b43_wireless_core_phy_pll_reset(struct b43_wldev *dev)
1204 {
1205 	struct bcma_drv_cc *bcma_cc __maybe_unused;
1206 	struct ssb_chipcommon *ssb_cc __maybe_unused;
1207 
1208 	switch (dev->dev->bus_type) {
1209 #ifdef CONFIG_B43_BCMA
1210 	case B43_BUS_BCMA:
1211 		bcma_cc = &dev->dev->bdev->bus->drv_cc;
1212 
1213 		bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
1214 		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1215 		bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
1216 		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1217 		break;
1218 #endif
1219 #ifdef CONFIG_B43_SSB
1220 	case B43_BUS_SSB:
1221 		ssb_cc = &dev->dev->sdev->bus->chipco;
1222 
1223 		chipco_write32(ssb_cc, SSB_CHIPCO_CHIPCTL_ADDR, 0);
1224 		chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1225 		chipco_set32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, 0x4);
1226 		chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1227 		break;
1228 #endif
1229 	}
1230 }
1231 
1232 #ifdef CONFIG_B43_BCMA
1233 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1234 {
1235 	u32 flags;
1236 
1237 	/* Put PHY into reset */
1238 	flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1239 	flags |= B43_BCMA_IOCTL_PHY_RESET;
1240 	flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1241 	bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1242 	udelay(2);
1243 
1244 	b43_phy_take_out_of_reset(dev);
1245 }
1246 
1247 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1248 {
1249 	u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1250 		  B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1251 	u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1252 		     B43_BCMA_CLKCTLST_PHY_PLL_ST;
1253 	u32 flags;
1254 
1255 	flags = B43_BCMA_IOCTL_PHY_CLKEN;
1256 	if (gmode)
1257 		flags |= B43_BCMA_IOCTL_GMODE;
1258 	b43_device_enable(dev, flags);
1259 
1260 	if (dev->phy.type == B43_PHYTYPE_AC) {
1261 		u16 tmp;
1262 
1263 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1264 		tmp &= ~B43_BCMA_IOCTL_DAC;
1265 		tmp |= 0x100;
1266 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1267 
1268 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1269 		tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
1270 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1271 
1272 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1273 		tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
1274 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1275 	}
1276 
1277 	bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1278 	b43_bcma_phy_reset(dev);
1279 	bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1280 }
1281 #endif
1282 
1283 #ifdef CONFIG_B43_SSB
1284 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1285 {
1286 	u32 flags = 0;
1287 
1288 	if (gmode)
1289 		flags |= B43_TMSLOW_GMODE;
1290 	flags |= B43_TMSLOW_PHYCLKEN;
1291 	flags |= B43_TMSLOW_PHYRESET;
1292 	if (dev->phy.type == B43_PHYTYPE_N)
1293 		flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1294 	b43_device_enable(dev, flags);
1295 	msleep(2);		/* Wait for the PLL to turn on. */
1296 
1297 	b43_phy_take_out_of_reset(dev);
1298 }
1299 #endif
1300 
1301 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1302 {
1303 	u32 macctl;
1304 
1305 	switch (dev->dev->bus_type) {
1306 #ifdef CONFIG_B43_BCMA
1307 	case B43_BUS_BCMA:
1308 		b43_bcma_wireless_core_reset(dev, gmode);
1309 		break;
1310 #endif
1311 #ifdef CONFIG_B43_SSB
1312 	case B43_BUS_SSB:
1313 		b43_ssb_wireless_core_reset(dev, gmode);
1314 		break;
1315 #endif
1316 	}
1317 
1318 	/* Turn Analog ON, but only if we already know the PHY-type.
1319 	 * This protects against very early setup where we don't know the
1320 	 * PHY-type, yet. wireless_core_reset will be called once again later,
1321 	 * when we know the PHY-type. */
1322 	if (dev->phy.ops)
1323 		dev->phy.ops->switch_analog(dev, 1);
1324 
1325 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1326 	macctl &= ~B43_MACCTL_GMODE;
1327 	if (gmode)
1328 		macctl |= B43_MACCTL_GMODE;
1329 	macctl |= B43_MACCTL_IHR_ENABLED;
1330 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1331 }
1332 
1333 static void handle_irq_transmit_status(struct b43_wldev *dev)
1334 {
1335 	u32 v0, v1;
1336 	u16 tmp;
1337 	struct b43_txstatus stat;
1338 
1339 	while (1) {
1340 		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1341 		if (!(v0 & 0x00000001))
1342 			break;
1343 		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1344 
1345 		stat.cookie = (v0 >> 16);
1346 		stat.seq = (v1 & 0x0000FFFF);
1347 		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1348 		tmp = (v0 & 0x0000FFFF);
1349 		stat.frame_count = ((tmp & 0xF000) >> 12);
1350 		stat.rts_count = ((tmp & 0x0F00) >> 8);
1351 		stat.supp_reason = ((tmp & 0x001C) >> 2);
1352 		stat.pm_indicated = !!(tmp & 0x0080);
1353 		stat.intermediate = !!(tmp & 0x0040);
1354 		stat.for_ampdu = !!(tmp & 0x0020);
1355 		stat.acked = !!(tmp & 0x0002);
1356 
1357 		b43_handle_txstatus(dev, &stat);
1358 	}
1359 }
1360 
1361 static void drain_txstatus_queue(struct b43_wldev *dev)
1362 {
1363 	u32 dummy;
1364 
1365 	if (dev->dev->core_rev < 5)
1366 		return;
1367 	/* Read all entries from the microcode TXstatus FIFO
1368 	 * and throw them away.
1369 	 */
1370 	while (1) {
1371 		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1372 		if (!(dummy & 0x00000001))
1373 			break;
1374 		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1375 	}
1376 }
1377 
1378 static u32 b43_jssi_read(struct b43_wldev *dev)
1379 {
1380 	u32 val = 0;
1381 
1382 	val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1383 	val <<= 16;
1384 	val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1385 
1386 	return val;
1387 }
1388 
1389 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1390 {
1391 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1392 			(jssi & 0x0000FFFF));
1393 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1394 			(jssi & 0xFFFF0000) >> 16);
1395 }
1396 
1397 static void b43_generate_noise_sample(struct b43_wldev *dev)
1398 {
1399 	b43_jssi_write(dev, 0x7F7F7F7F);
1400 	b43_write32(dev, B43_MMIO_MACCMD,
1401 		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1402 }
1403 
1404 static void b43_calculate_link_quality(struct b43_wldev *dev)
1405 {
1406 	/* Top half of Link Quality calculation. */
1407 
1408 	if (dev->phy.type != B43_PHYTYPE_G)
1409 		return;
1410 	if (dev->noisecalc.calculation_running)
1411 		return;
1412 	dev->noisecalc.calculation_running = true;
1413 	dev->noisecalc.nr_samples = 0;
1414 
1415 	b43_generate_noise_sample(dev);
1416 }
1417 
1418 static void handle_irq_noise(struct b43_wldev *dev)
1419 {
1420 	struct b43_phy_g *phy = dev->phy.g;
1421 	u16 tmp;
1422 	u8 noise[4];
1423 	u8 i, j;
1424 	s32 average;
1425 
1426 	/* Bottom half of Link Quality calculation. */
1427 
1428 	if (dev->phy.type != B43_PHYTYPE_G)
1429 		return;
1430 
1431 	/* Possible race condition: It might be possible that the user
1432 	 * changed to a different channel in the meantime since we
1433 	 * started the calculation. We ignore that fact, since it's
1434 	 * not really that much of a problem. The background noise is
1435 	 * an estimation only anyway. Slightly wrong results will get damped
1436 	 * by the averaging of the 8 sample rounds. Additionally the
1437 	 * value is shortlived. So it will be replaced by the next noise
1438 	 * calculation round soon. */
1439 
1440 	B43_WARN_ON(!dev->noisecalc.calculation_running);
1441 	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1442 	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1443 	    noise[2] == 0x7F || noise[3] == 0x7F)
1444 		goto generate_new;
1445 
1446 	/* Get the noise samples. */
1447 	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1448 	i = dev->noisecalc.nr_samples;
1449 	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1450 	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1451 	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1452 	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1453 	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1454 	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1455 	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1456 	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1457 	dev->noisecalc.nr_samples++;
1458 	if (dev->noisecalc.nr_samples == 8) {
1459 		/* Calculate the Link Quality by the noise samples. */
1460 		average = 0;
1461 		for (i = 0; i < 8; i++) {
1462 			for (j = 0; j < 4; j++)
1463 				average += dev->noisecalc.samples[i][j];
1464 		}
1465 		average /= (8 * 4);
1466 		average *= 125;
1467 		average += 64;
1468 		average /= 128;
1469 		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1470 		tmp = (tmp / 128) & 0x1F;
1471 		if (tmp >= 8)
1472 			average += 2;
1473 		else
1474 			average -= 25;
1475 		if (tmp == 8)
1476 			average -= 72;
1477 		else
1478 			average -= 48;
1479 
1480 		dev->stats.link_noise = average;
1481 		dev->noisecalc.calculation_running = false;
1482 		return;
1483 	}
1484 generate_new:
1485 	b43_generate_noise_sample(dev);
1486 }
1487 
1488 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1489 {
1490 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1491 		///TODO: PS TBTT
1492 	} else {
1493 		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1494 			b43_power_saving_ctl_bits(dev, 0);
1495 	}
1496 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1497 		dev->dfq_valid = true;
1498 }
1499 
1500 static void handle_irq_atim_end(struct b43_wldev *dev)
1501 {
1502 	if (dev->dfq_valid) {
1503 		b43_write32(dev, B43_MMIO_MACCMD,
1504 			    b43_read32(dev, B43_MMIO_MACCMD)
1505 			    | B43_MACCMD_DFQ_VALID);
1506 		dev->dfq_valid = false;
1507 	}
1508 }
1509 
1510 static void handle_irq_pmq(struct b43_wldev *dev)
1511 {
1512 	u32 tmp;
1513 
1514 	//TODO: AP mode.
1515 
1516 	while (1) {
1517 		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1518 		if (!(tmp & 0x00000008))
1519 			break;
1520 	}
1521 	/* 16bit write is odd, but correct. */
1522 	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1523 }
1524 
1525 static void b43_write_template_common(struct b43_wldev *dev,
1526 				      const u8 *data, u16 size,
1527 				      u16 ram_offset,
1528 				      u16 shm_size_offset, u8 rate)
1529 {
1530 	u32 i, tmp;
1531 	struct b43_plcp_hdr4 plcp;
1532 
1533 	plcp.data = 0;
1534 	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1535 	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1536 	ram_offset += sizeof(u32);
1537 	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1538 	 * So leave the first two bytes of the next write blank.
1539 	 */
1540 	tmp = (u32) (data[0]) << 16;
1541 	tmp |= (u32) (data[1]) << 24;
1542 	b43_ram_write(dev, ram_offset, tmp);
1543 	ram_offset += sizeof(u32);
1544 	for (i = 2; i < size; i += sizeof(u32)) {
1545 		tmp = (u32) (data[i + 0]);
1546 		if (i + 1 < size)
1547 			tmp |= (u32) (data[i + 1]) << 8;
1548 		if (i + 2 < size)
1549 			tmp |= (u32) (data[i + 2]) << 16;
1550 		if (i + 3 < size)
1551 			tmp |= (u32) (data[i + 3]) << 24;
1552 		b43_ram_write(dev, ram_offset + i - 2, tmp);
1553 	}
1554 	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1555 			size + sizeof(struct b43_plcp_hdr6));
1556 }
1557 
1558 /* Check if the use of the antenna that ieee80211 told us to
1559  * use is possible. This will fall back to DEFAULT.
1560  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1561 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1562 				  u8 antenna_nr)
1563 {
1564 	u8 antenna_mask;
1565 
1566 	if (antenna_nr == 0) {
1567 		/* Zero means "use default antenna". That's always OK. */
1568 		return 0;
1569 	}
1570 
1571 	/* Get the mask of available antennas. */
1572 	if (dev->phy.gmode)
1573 		antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1574 	else
1575 		antenna_mask = dev->dev->bus_sprom->ant_available_a;
1576 
1577 	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1578 		/* This antenna is not available. Fall back to default. */
1579 		return 0;
1580 	}
1581 
1582 	return antenna_nr;
1583 }
1584 
1585 /* Convert a b43 antenna number value to the PHY TX control value. */
1586 static u16 b43_antenna_to_phyctl(int antenna)
1587 {
1588 	switch (antenna) {
1589 	case B43_ANTENNA0:
1590 		return B43_TXH_PHY_ANT0;
1591 	case B43_ANTENNA1:
1592 		return B43_TXH_PHY_ANT1;
1593 	case B43_ANTENNA2:
1594 		return B43_TXH_PHY_ANT2;
1595 	case B43_ANTENNA3:
1596 		return B43_TXH_PHY_ANT3;
1597 	case B43_ANTENNA_AUTO0:
1598 	case B43_ANTENNA_AUTO1:
1599 		return B43_TXH_PHY_ANT01AUTO;
1600 	}
1601 	B43_WARN_ON(1);
1602 	return 0;
1603 }
1604 
1605 static void b43_write_beacon_template(struct b43_wldev *dev,
1606 				      u16 ram_offset,
1607 				      u16 shm_size_offset)
1608 {
1609 	unsigned int i, len, variable_len;
1610 	const struct ieee80211_mgmt *bcn;
1611 	const u8 *ie;
1612 	bool tim_found = false;
1613 	unsigned int rate;
1614 	u16 ctl;
1615 	int antenna;
1616 	struct ieee80211_tx_info *info;
1617 	unsigned long flags;
1618 	struct sk_buff *beacon_skb;
1619 
1620 	spin_lock_irqsave(&dev->wl->beacon_lock, flags);
1621 	info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1622 	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1623 	/* Clone the beacon, so it cannot go away, while we write it to hw. */
1624 	beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
1625 	spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
1626 
1627 	if (!beacon_skb) {
1628 		b43dbg(dev->wl, "Could not upload beacon. "
1629 		       "Failed to clone beacon skb.");
1630 		return;
1631 	}
1632 
1633 	bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
1634 	len = min_t(size_t, beacon_skb->len,
1635 		    0x200 - sizeof(struct b43_plcp_hdr6));
1636 
1637 	b43_write_template_common(dev, (const u8 *)bcn,
1638 				  len, ram_offset, shm_size_offset, rate);
1639 
1640 	/* Write the PHY TX control parameters. */
1641 	antenna = B43_ANTENNA_DEFAULT;
1642 	antenna = b43_antenna_to_phyctl(antenna);
1643 	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1644 	/* We can't send beacons with short preamble. Would get PHY errors. */
1645 	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1646 	ctl &= ~B43_TXH_PHY_ANT;
1647 	ctl &= ~B43_TXH_PHY_ENC;
1648 	ctl |= antenna;
1649 	if (b43_is_cck_rate(rate))
1650 		ctl |= B43_TXH_PHY_ENC_CCK;
1651 	else
1652 		ctl |= B43_TXH_PHY_ENC_OFDM;
1653 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1654 
1655 	/* Find the position of the TIM and the DTIM_period value
1656 	 * and write them to SHM. */
1657 	ie = bcn->u.beacon.variable;
1658 	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1659 	for (i = 0; i < variable_len - 2; ) {
1660 		uint8_t ie_id, ie_len;
1661 
1662 		ie_id = ie[i];
1663 		ie_len = ie[i + 1];
1664 		if (ie_id == 5) {
1665 			u16 tim_position;
1666 			u16 dtim_period;
1667 			/* This is the TIM Information Element */
1668 
1669 			/* Check whether the ie_len is in the beacon data range. */
1670 			if (variable_len < ie_len + 2 + i)
1671 				break;
1672 			/* A valid TIM is at least 4 bytes long. */
1673 			if (ie_len < 4)
1674 				break;
1675 			tim_found = true;
1676 
1677 			tim_position = sizeof(struct b43_plcp_hdr6);
1678 			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1679 			tim_position += i;
1680 
1681 			dtim_period = ie[i + 3];
1682 
1683 			b43_shm_write16(dev, B43_SHM_SHARED,
1684 					B43_SHM_SH_TIMBPOS, tim_position);
1685 			b43_shm_write16(dev, B43_SHM_SHARED,
1686 					B43_SHM_SH_DTIMPER, dtim_period);
1687 			break;
1688 		}
1689 		i += ie_len + 2;
1690 	}
1691 	if (!tim_found) {
1692 		/*
1693 		 * If ucode wants to modify TIM do it behind the beacon, this
1694 		 * will happen, for example, when doing mesh networking.
1695 		 */
1696 		b43_shm_write16(dev, B43_SHM_SHARED,
1697 				B43_SHM_SH_TIMBPOS,
1698 				len + sizeof(struct b43_plcp_hdr6));
1699 		b43_shm_write16(dev, B43_SHM_SHARED,
1700 				B43_SHM_SH_DTIMPER, 0);
1701 	}
1702 	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1703 
1704 	dev_kfree_skb_any(beacon_skb);
1705 }
1706 
1707 static void b43_upload_beacon0(struct b43_wldev *dev)
1708 {
1709 	struct b43_wl *wl = dev->wl;
1710 
1711 	if (wl->beacon0_uploaded)
1712 		return;
1713 	b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1714 	wl->beacon0_uploaded = true;
1715 }
1716 
1717 static void b43_upload_beacon1(struct b43_wldev *dev)
1718 {
1719 	struct b43_wl *wl = dev->wl;
1720 
1721 	if (wl->beacon1_uploaded)
1722 		return;
1723 	b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1724 	wl->beacon1_uploaded = true;
1725 }
1726 
1727 static void handle_irq_beacon(struct b43_wldev *dev)
1728 {
1729 	struct b43_wl *wl = dev->wl;
1730 	u32 cmd, beacon0_valid, beacon1_valid;
1731 
1732 	if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1733 	    !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1734 	    !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1735 		return;
1736 
1737 	/* This is the bottom half of the asynchronous beacon update. */
1738 
1739 	/* Ignore interrupt in the future. */
1740 	dev->irq_mask &= ~B43_IRQ_BEACON;
1741 
1742 	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1743 	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1744 	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1745 
1746 	/* Schedule interrupt manually, if busy. */
1747 	if (beacon0_valid && beacon1_valid) {
1748 		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1749 		dev->irq_mask |= B43_IRQ_BEACON;
1750 		return;
1751 	}
1752 
1753 	if (unlikely(wl->beacon_templates_virgin)) {
1754 		/* We never uploaded a beacon before.
1755 		 * Upload both templates now, but only mark one valid. */
1756 		wl->beacon_templates_virgin = false;
1757 		b43_upload_beacon0(dev);
1758 		b43_upload_beacon1(dev);
1759 		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1760 		cmd |= B43_MACCMD_BEACON0_VALID;
1761 		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1762 	} else {
1763 		if (!beacon0_valid) {
1764 			b43_upload_beacon0(dev);
1765 			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1766 			cmd |= B43_MACCMD_BEACON0_VALID;
1767 			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1768 		} else if (!beacon1_valid) {
1769 			b43_upload_beacon1(dev);
1770 			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1771 			cmd |= B43_MACCMD_BEACON1_VALID;
1772 			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1773 		}
1774 	}
1775 }
1776 
1777 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1778 {
1779 	u32 old_irq_mask = dev->irq_mask;
1780 
1781 	/* update beacon right away or defer to irq */
1782 	handle_irq_beacon(dev);
1783 	if (old_irq_mask != dev->irq_mask) {
1784 		/* The handler updated the IRQ mask. */
1785 		B43_WARN_ON(!dev->irq_mask);
1786 		if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1787 			b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1788 		} else {
1789 			/* Device interrupts are currently disabled. That means
1790 			 * we just ran the hardirq handler and scheduled the
1791 			 * IRQ thread. The thread will write the IRQ mask when
1792 			 * it finished, so there's nothing to do here. Writing
1793 			 * the mask _here_ would incorrectly re-enable IRQs. */
1794 		}
1795 	}
1796 }
1797 
1798 static void b43_beacon_update_trigger_work(struct work_struct *work)
1799 {
1800 	struct b43_wl *wl = container_of(work, struct b43_wl,
1801 					 beacon_update_trigger);
1802 	struct b43_wldev *dev;
1803 
1804 	mutex_lock(&wl->mutex);
1805 	dev = wl->current_dev;
1806 	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1807 		if (b43_bus_host_is_sdio(dev->dev)) {
1808 			/* wl->mutex is enough. */
1809 			b43_do_beacon_update_trigger_work(dev);
1810 		} else {
1811 			spin_lock_irq(&wl->hardirq_lock);
1812 			b43_do_beacon_update_trigger_work(dev);
1813 			spin_unlock_irq(&wl->hardirq_lock);
1814 		}
1815 	}
1816 	mutex_unlock(&wl->mutex);
1817 }
1818 
1819 /* Asynchronously update the packet templates in template RAM. */
1820 static void b43_update_templates(struct b43_wl *wl)
1821 {
1822 	struct sk_buff *beacon, *old_beacon;
1823 	unsigned long flags;
1824 
1825 	/* This is the top half of the asynchronous beacon update.
1826 	 * The bottom half is the beacon IRQ.
1827 	 * Beacon update must be asynchronous to avoid sending an
1828 	 * invalid beacon. This can happen for example, if the firmware
1829 	 * transmits a beacon while we are updating it. */
1830 
1831 	/* We could modify the existing beacon and set the aid bit in
1832 	 * the TIM field, but that would probably require resizing and
1833 	 * moving of data within the beacon template.
1834 	 * Simply request a new beacon and let mac80211 do the hard work. */
1835 	beacon = ieee80211_beacon_get(wl->hw, wl->vif, 0);
1836 	if (unlikely(!beacon))
1837 		return;
1838 
1839 	spin_lock_irqsave(&wl->beacon_lock, flags);
1840 	old_beacon = wl->current_beacon;
1841 	wl->current_beacon = beacon;
1842 	wl->beacon0_uploaded = false;
1843 	wl->beacon1_uploaded = false;
1844 	spin_unlock_irqrestore(&wl->beacon_lock, flags);
1845 
1846 	ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1847 
1848 	if (old_beacon)
1849 		dev_kfree_skb_any(old_beacon);
1850 }
1851 
1852 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1853 {
1854 	b43_time_lock(dev);
1855 	if (dev->dev->core_rev >= 3) {
1856 		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1857 		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1858 	} else {
1859 		b43_write16(dev, 0x606, (beacon_int >> 6));
1860 		b43_write16(dev, 0x610, beacon_int);
1861 	}
1862 	b43_time_unlock(dev);
1863 	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1864 }
1865 
1866 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1867 {
1868 	u16 reason;
1869 
1870 	/* Read the register that contains the reason code for the panic. */
1871 	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1872 	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1873 
1874 	switch (reason) {
1875 	default:
1876 		b43dbg(dev->wl, "The panic reason is unknown.\n");
1877 		fallthrough;
1878 	case B43_FWPANIC_DIE:
1879 		/* Do not restart the controller or firmware.
1880 		 * The device is nonfunctional from now on.
1881 		 * Restarting would result in this panic to trigger again,
1882 		 * so we avoid that recursion. */
1883 		break;
1884 	case B43_FWPANIC_RESTART:
1885 		b43_controller_restart(dev, "Microcode panic");
1886 		break;
1887 	}
1888 }
1889 
1890 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1891 {
1892 	unsigned int i, cnt;
1893 	u16 reason, marker_id, marker_line;
1894 	__le16 *buf;
1895 
1896 	/* The proprietary firmware doesn't have this IRQ. */
1897 	if (!dev->fw.opensource)
1898 		return;
1899 
1900 	/* Read the register that contains the reason code for this IRQ. */
1901 	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1902 
1903 	switch (reason) {
1904 	case B43_DEBUGIRQ_PANIC:
1905 		b43_handle_firmware_panic(dev);
1906 		break;
1907 	case B43_DEBUGIRQ_DUMP_SHM:
1908 		if (!B43_DEBUG)
1909 			break; /* Only with driver debugging enabled. */
1910 		buf = kmalloc(4096, GFP_ATOMIC);
1911 		if (!buf) {
1912 			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1913 			goto out;
1914 		}
1915 		for (i = 0; i < 4096; i += 2) {
1916 			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1917 			buf[i / 2] = cpu_to_le16(tmp);
1918 		}
1919 		b43info(dev->wl, "Shared memory dump:\n");
1920 		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1921 			       16, 2, buf, 4096, 1);
1922 		kfree(buf);
1923 		break;
1924 	case B43_DEBUGIRQ_DUMP_REGS:
1925 		if (!B43_DEBUG)
1926 			break; /* Only with driver debugging enabled. */
1927 		b43info(dev->wl, "Microcode register dump:\n");
1928 		for (i = 0, cnt = 0; i < 64; i++) {
1929 			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1930 			if (cnt == 0)
1931 				printk(KERN_INFO);
1932 			printk("r%02u: 0x%04X  ", i, tmp);
1933 			cnt++;
1934 			if (cnt == 6) {
1935 				printk("\n");
1936 				cnt = 0;
1937 			}
1938 		}
1939 		printk("\n");
1940 		break;
1941 	case B43_DEBUGIRQ_MARKER:
1942 		if (!B43_DEBUG)
1943 			break; /* Only with driver debugging enabled. */
1944 		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1945 					   B43_MARKER_ID_REG);
1946 		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1947 					     B43_MARKER_LINE_REG);
1948 		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1949 			"at line number %u\n",
1950 			marker_id, marker_line);
1951 		break;
1952 	default:
1953 		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1954 		       reason);
1955 	}
1956 out:
1957 	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1958 	b43_shm_write16(dev, B43_SHM_SCRATCH,
1959 			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1960 }
1961 
1962 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1963 {
1964 	u32 reason;
1965 	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1966 	u32 merged_dma_reason = 0;
1967 	int i;
1968 
1969 	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1970 		return;
1971 
1972 	reason = dev->irq_reason;
1973 	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1974 		dma_reason[i] = dev->dma_reason[i];
1975 		merged_dma_reason |= dma_reason[i];
1976 	}
1977 
1978 	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1979 		b43err(dev->wl, "MAC transmission error\n");
1980 
1981 	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1982 		b43err(dev->wl, "PHY transmission error\n");
1983 		rmb();
1984 		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1985 			atomic_set(&dev->phy.txerr_cnt,
1986 				   B43_PHY_TX_BADNESS_LIMIT);
1987 			b43err(dev->wl, "Too many PHY TX errors, "
1988 					"restarting the controller\n");
1989 			b43_controller_restart(dev, "PHY TX errors");
1990 		}
1991 	}
1992 
1993 	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
1994 		b43err(dev->wl,
1995 			"Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
1996 			dma_reason[0], dma_reason[1],
1997 			dma_reason[2], dma_reason[3],
1998 			dma_reason[4], dma_reason[5]);
1999 		b43err(dev->wl, "This device does not support DMA "
2000 			       "on your system. It will now be switched to PIO.\n");
2001 		/* Fall back to PIO transfers if we get fatal DMA errors! */
2002 		dev->use_pio = true;
2003 		b43_controller_restart(dev, "DMA error");
2004 		return;
2005 	}
2006 
2007 	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
2008 		handle_irq_ucode_debug(dev);
2009 	if (reason & B43_IRQ_TBTT_INDI)
2010 		handle_irq_tbtt_indication(dev);
2011 	if (reason & B43_IRQ_ATIM_END)
2012 		handle_irq_atim_end(dev);
2013 	if (reason & B43_IRQ_BEACON)
2014 		handle_irq_beacon(dev);
2015 	if (reason & B43_IRQ_PMQ)
2016 		handle_irq_pmq(dev);
2017 	if (reason & B43_IRQ_TXFIFO_FLUSH_OK) {
2018 		;/* TODO */
2019 	}
2020 	if (reason & B43_IRQ_NOISESAMPLE_OK)
2021 		handle_irq_noise(dev);
2022 
2023 	/* Check the DMA reason registers for received data. */
2024 	if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
2025 		if (B43_DEBUG)
2026 			b43warn(dev->wl, "RX descriptor underrun\n");
2027 		b43_dma_handle_rx_overflow(dev->dma.rx_ring);
2028 	}
2029 	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
2030 		if (b43_using_pio_transfers(dev))
2031 			b43_pio_rx(dev->pio.rx_queue);
2032 		else
2033 			b43_dma_rx(dev->dma.rx_ring);
2034 	}
2035 	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
2036 	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
2037 	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
2038 	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
2039 	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
2040 
2041 	if (reason & B43_IRQ_TX_OK)
2042 		handle_irq_transmit_status(dev);
2043 
2044 	/* Re-enable interrupts on the device by restoring the current interrupt mask. */
2045 	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2046 
2047 #if B43_DEBUG
2048 	if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2049 		dev->irq_count++;
2050 		for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2051 			if (reason & (1 << i))
2052 				dev->irq_bit_count[i]++;
2053 		}
2054 	}
2055 #endif
2056 }
2057 
2058 /* Interrupt thread handler. Handles device interrupts in thread context. */
2059 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
2060 {
2061 	struct b43_wldev *dev = dev_id;
2062 
2063 	mutex_lock(&dev->wl->mutex);
2064 	b43_do_interrupt_thread(dev);
2065 	mutex_unlock(&dev->wl->mutex);
2066 
2067 	return IRQ_HANDLED;
2068 }
2069 
2070 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2071 {
2072 	u32 reason;
2073 
2074 	/* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2075 	 * On SDIO, this runs under wl->mutex. */
2076 
2077 	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2078 	if (reason == 0xffffffff)	/* shared IRQ */
2079 		return IRQ_NONE;
2080 	reason &= dev->irq_mask;
2081 	if (!reason)
2082 		return IRQ_NONE;
2083 
2084 	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2085 	    & 0x0001FC00;
2086 	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2087 	    & 0x0000DC00;
2088 	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2089 	    & 0x0000DC00;
2090 	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2091 	    & 0x0001DC00;
2092 	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2093 	    & 0x0000DC00;
2094 /* Unused ring
2095 	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2096 	    & 0x0000DC00;
2097 */
2098 
2099 	/* ACK the interrupt. */
2100 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2101 	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2102 	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2103 	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2104 	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2105 	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2106 /* Unused ring
2107 	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2108 */
2109 
2110 	/* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2111 	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2112 	/* Save the reason bitmasks for the IRQ thread handler. */
2113 	dev->irq_reason = reason;
2114 
2115 	return IRQ_WAKE_THREAD;
2116 }
2117 
2118 /* Interrupt handler top-half. This runs with interrupts disabled. */
2119 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2120 {
2121 	struct b43_wldev *dev = dev_id;
2122 	irqreturn_t ret;
2123 
2124 	if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2125 		return IRQ_NONE;
2126 
2127 	spin_lock(&dev->wl->hardirq_lock);
2128 	ret = b43_do_interrupt(dev);
2129 	spin_unlock(&dev->wl->hardirq_lock);
2130 
2131 	return ret;
2132 }
2133 
2134 /* SDIO interrupt handler. This runs in process context. */
2135 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2136 {
2137 	struct b43_wl *wl = dev->wl;
2138 	irqreturn_t ret;
2139 
2140 	mutex_lock(&wl->mutex);
2141 
2142 	ret = b43_do_interrupt(dev);
2143 	if (ret == IRQ_WAKE_THREAD)
2144 		b43_do_interrupt_thread(dev);
2145 
2146 	mutex_unlock(&wl->mutex);
2147 }
2148 
2149 void b43_do_release_fw(struct b43_firmware_file *fw)
2150 {
2151 	release_firmware(fw->data);
2152 	fw->data = NULL;
2153 	fw->filename = NULL;
2154 }
2155 
2156 static void b43_release_firmware(struct b43_wldev *dev)
2157 {
2158 	complete(&dev->fw_load_complete);
2159 	b43_do_release_fw(&dev->fw.ucode);
2160 	b43_do_release_fw(&dev->fw.pcm);
2161 	b43_do_release_fw(&dev->fw.initvals);
2162 	b43_do_release_fw(&dev->fw.initvals_band);
2163 }
2164 
2165 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2166 {
2167 	const char text[] =
2168 		"You must go to " \
2169 		"https://wireless.wiki.kernel.org/en/users/Drivers/b43#devicefirmware " \
2170 		"and download the correct firmware for this driver version. " \
2171 		"Please carefully read all instructions on this website.\n";
2172 
2173 	if (error)
2174 		b43err(wl, text);
2175 	else
2176 		b43warn(wl, text);
2177 }
2178 
2179 static void b43_fw_cb(const struct firmware *firmware, void *context)
2180 {
2181 	struct b43_request_fw_context *ctx = context;
2182 
2183 	ctx->blob = firmware;
2184 	complete(&ctx->dev->fw_load_complete);
2185 }
2186 
2187 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2188 		      const char *name,
2189 		      struct b43_firmware_file *fw, bool async)
2190 {
2191 	struct b43_fw_header *hdr;
2192 	u32 size;
2193 	int err;
2194 
2195 	if (!name) {
2196 		/* Don't fetch anything. Free possibly cached firmware. */
2197 		/* FIXME: We should probably keep it anyway, to save some headache
2198 		 * on suspend/resume with multiband devices. */
2199 		b43_do_release_fw(fw);
2200 		return 0;
2201 	}
2202 	if (fw->filename) {
2203 		if ((fw->type == ctx->req_type) &&
2204 		    (strcmp(fw->filename, name) == 0))
2205 			return 0; /* Already have this fw. */
2206 		/* Free the cached firmware first. */
2207 		/* FIXME: We should probably do this later after we successfully
2208 		 * got the new fw. This could reduce headache with multiband devices.
2209 		 * We could also redesign this to cache the firmware for all possible
2210 		 * bands all the time. */
2211 		b43_do_release_fw(fw);
2212 	}
2213 
2214 	switch (ctx->req_type) {
2215 	case B43_FWTYPE_PROPRIETARY:
2216 		snprintf(ctx->fwname, sizeof(ctx->fwname),
2217 			 "b43%s/%s.fw",
2218 			 modparam_fwpostfix, name);
2219 		break;
2220 	case B43_FWTYPE_OPENSOURCE:
2221 		snprintf(ctx->fwname, sizeof(ctx->fwname),
2222 			 "b43-open%s/%s.fw",
2223 			 modparam_fwpostfix, name);
2224 		break;
2225 	default:
2226 		B43_WARN_ON(1);
2227 		return -ENOSYS;
2228 	}
2229 	if (async) {
2230 		/* do this part asynchronously */
2231 		init_completion(&ctx->dev->fw_load_complete);
2232 		err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2233 					      ctx->dev->dev->dev, GFP_KERNEL,
2234 					      ctx, b43_fw_cb);
2235 		if (err < 0) {
2236 			pr_err("Unable to load firmware\n");
2237 			return err;
2238 		}
2239 		wait_for_completion(&ctx->dev->fw_load_complete);
2240 		if (ctx->blob)
2241 			goto fw_ready;
2242 	/* On some ARM systems, the async request will fail, but the next sync
2243 	 * request works. For this reason, we fall through here
2244 	 */
2245 	}
2246 	err = request_firmware(&ctx->blob, ctx->fwname,
2247 			       ctx->dev->dev->dev);
2248 	if (err == -ENOENT) {
2249 		snprintf(ctx->errors[ctx->req_type],
2250 			 sizeof(ctx->errors[ctx->req_type]),
2251 			 "Firmware file \"%s\" not found\n",
2252 			 ctx->fwname);
2253 		return err;
2254 	} else if (err) {
2255 		snprintf(ctx->errors[ctx->req_type],
2256 			 sizeof(ctx->errors[ctx->req_type]),
2257 			 "Firmware file \"%s\" request failed (err=%d)\n",
2258 			 ctx->fwname, err);
2259 		return err;
2260 	}
2261 fw_ready:
2262 	if (ctx->blob->size < sizeof(struct b43_fw_header))
2263 		goto err_format;
2264 	hdr = (struct b43_fw_header *)(ctx->blob->data);
2265 	switch (hdr->type) {
2266 	case B43_FW_TYPE_UCODE:
2267 	case B43_FW_TYPE_PCM:
2268 		size = be32_to_cpu(hdr->size);
2269 		if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2270 			goto err_format;
2271 		fallthrough;
2272 	case B43_FW_TYPE_IV:
2273 		if (hdr->ver != 1)
2274 			goto err_format;
2275 		break;
2276 	default:
2277 		goto err_format;
2278 	}
2279 
2280 	fw->data = ctx->blob;
2281 	fw->filename = name;
2282 	fw->type = ctx->req_type;
2283 
2284 	return 0;
2285 
2286 err_format:
2287 	snprintf(ctx->errors[ctx->req_type],
2288 		 sizeof(ctx->errors[ctx->req_type]),
2289 		 "Firmware file \"%s\" format error.\n", ctx->fwname);
2290 	release_firmware(ctx->blob);
2291 
2292 	return -EPROTO;
2293 }
2294 
2295 /* https://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2296 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2297 {
2298 	struct b43_wldev *dev = ctx->dev;
2299 	struct b43_firmware *fw = &ctx->dev->fw;
2300 	struct b43_phy *phy = &dev->phy;
2301 	const u8 rev = ctx->dev->dev->core_rev;
2302 	const char *filename;
2303 	int err;
2304 
2305 	/* Get microcode */
2306 	filename = NULL;
2307 	switch (rev) {
2308 	case 42:
2309 		if (phy->type == B43_PHYTYPE_AC)
2310 			filename = "ucode42";
2311 		break;
2312 	case 40:
2313 		if (phy->type == B43_PHYTYPE_AC)
2314 			filename = "ucode40";
2315 		break;
2316 	case 33:
2317 		if (phy->type == B43_PHYTYPE_LCN40)
2318 			filename = "ucode33_lcn40";
2319 		break;
2320 	case 30:
2321 		if (phy->type == B43_PHYTYPE_N)
2322 			filename = "ucode30_mimo";
2323 		break;
2324 	case 29:
2325 		if (phy->type == B43_PHYTYPE_HT)
2326 			filename = "ucode29_mimo";
2327 		break;
2328 	case 26:
2329 		if (phy->type == B43_PHYTYPE_HT)
2330 			filename = "ucode26_mimo";
2331 		break;
2332 	case 28:
2333 	case 25:
2334 		if (phy->type == B43_PHYTYPE_N)
2335 			filename = "ucode25_mimo";
2336 		else if (phy->type == B43_PHYTYPE_LCN)
2337 			filename = "ucode25_lcn";
2338 		break;
2339 	case 24:
2340 		if (phy->type == B43_PHYTYPE_LCN)
2341 			filename = "ucode24_lcn";
2342 		break;
2343 	case 23:
2344 		if (phy->type == B43_PHYTYPE_N)
2345 			filename = "ucode16_mimo";
2346 		break;
2347 	case 16 ... 19:
2348 		if (phy->type == B43_PHYTYPE_N)
2349 			filename = "ucode16_mimo";
2350 		else if (phy->type == B43_PHYTYPE_LP)
2351 			filename = "ucode16_lp";
2352 		break;
2353 	case 15:
2354 		filename = "ucode15";
2355 		break;
2356 	case 14:
2357 		filename = "ucode14";
2358 		break;
2359 	case 13:
2360 		filename = "ucode13";
2361 		break;
2362 	case 11 ... 12:
2363 		filename = "ucode11";
2364 		break;
2365 	case 5 ... 10:
2366 		filename = "ucode5";
2367 		break;
2368 	}
2369 	if (!filename)
2370 		goto err_no_ucode;
2371 	err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2372 	if (err)
2373 		goto err_load;
2374 
2375 	/* Get PCM code */
2376 	if ((rev >= 5) && (rev <= 10))
2377 		filename = "pcm5";
2378 	else if (rev >= 11)
2379 		filename = NULL;
2380 	else
2381 		goto err_no_pcm;
2382 	fw->pcm_request_failed = false;
2383 	err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2384 	if (err == -ENOENT) {
2385 		/* We did not find a PCM file? Not fatal, but
2386 		 * core rev <= 10 must do without hwcrypto then. */
2387 		fw->pcm_request_failed = true;
2388 	} else if (err)
2389 		goto err_load;
2390 
2391 	/* Get initvals */
2392 	filename = NULL;
2393 	switch (dev->phy.type) {
2394 	case B43_PHYTYPE_G:
2395 		if (rev == 13)
2396 			filename = "b0g0initvals13";
2397 		else if (rev >= 5 && rev <= 10)
2398 			filename = "b0g0initvals5";
2399 		break;
2400 	case B43_PHYTYPE_N:
2401 		if (rev == 30)
2402 			filename = "n16initvals30";
2403 		else if (rev == 28 || rev == 25)
2404 			filename = "n0initvals25";
2405 		else if (rev == 24)
2406 			filename = "n0initvals24";
2407 		else if (rev == 23)
2408 			filename = "n0initvals16"; /* What about n0initvals22? */
2409 		else if (rev >= 16 && rev <= 18)
2410 			filename = "n0initvals16";
2411 		else if (rev >= 11 && rev <= 12)
2412 			filename = "n0initvals11";
2413 		break;
2414 	case B43_PHYTYPE_LP:
2415 		if (rev >= 16 && rev <= 18)
2416 			filename = "lp0initvals16";
2417 		else if (rev == 15)
2418 			filename = "lp0initvals15";
2419 		else if (rev == 14)
2420 			filename = "lp0initvals14";
2421 		else if (rev == 13)
2422 			filename = "lp0initvals13";
2423 		break;
2424 	case B43_PHYTYPE_HT:
2425 		if (rev == 29)
2426 			filename = "ht0initvals29";
2427 		else if (rev == 26)
2428 			filename = "ht0initvals26";
2429 		break;
2430 	case B43_PHYTYPE_LCN:
2431 		if (rev == 24)
2432 			filename = "lcn0initvals24";
2433 		break;
2434 	case B43_PHYTYPE_LCN40:
2435 		if (rev == 33)
2436 			filename = "lcn400initvals33";
2437 		break;
2438 	case B43_PHYTYPE_AC:
2439 		if (rev == 42)
2440 			filename = "ac1initvals42";
2441 		else if (rev == 40)
2442 			filename = "ac0initvals40";
2443 		break;
2444 	}
2445 	if (!filename)
2446 		goto err_no_initvals;
2447 	err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2448 	if (err)
2449 		goto err_load;
2450 
2451 	/* Get bandswitch initvals */
2452 	filename = NULL;
2453 	switch (dev->phy.type) {
2454 	case B43_PHYTYPE_G:
2455 		if (rev == 13)
2456 			filename = "b0g0bsinitvals13";
2457 		else if (rev >= 5 && rev <= 10)
2458 			filename = "b0g0bsinitvals5";
2459 		break;
2460 	case B43_PHYTYPE_N:
2461 		if (rev == 30)
2462 			filename = "n16bsinitvals30";
2463 		else if (rev == 28 || rev == 25)
2464 			filename = "n0bsinitvals25";
2465 		else if (rev == 24)
2466 			filename = "n0bsinitvals24";
2467 		else if (rev == 23)
2468 			filename = "n0bsinitvals16"; /* What about n0bsinitvals22? */
2469 		else if (rev >= 16 && rev <= 18)
2470 			filename = "n0bsinitvals16";
2471 		else if (rev >= 11 && rev <= 12)
2472 			filename = "n0bsinitvals11";
2473 		break;
2474 	case B43_PHYTYPE_LP:
2475 		if (rev >= 16 && rev <= 18)
2476 			filename = "lp0bsinitvals16";
2477 		else if (rev == 15)
2478 			filename = "lp0bsinitvals15";
2479 		else if (rev == 14)
2480 			filename = "lp0bsinitvals14";
2481 		else if (rev == 13)
2482 			filename = "lp0bsinitvals13";
2483 		break;
2484 	case B43_PHYTYPE_HT:
2485 		if (rev == 29)
2486 			filename = "ht0bsinitvals29";
2487 		else if (rev == 26)
2488 			filename = "ht0bsinitvals26";
2489 		break;
2490 	case B43_PHYTYPE_LCN:
2491 		if (rev == 24)
2492 			filename = "lcn0bsinitvals24";
2493 		break;
2494 	case B43_PHYTYPE_LCN40:
2495 		if (rev == 33)
2496 			filename = "lcn400bsinitvals33";
2497 		break;
2498 	case B43_PHYTYPE_AC:
2499 		if (rev == 42)
2500 			filename = "ac1bsinitvals42";
2501 		else if (rev == 40)
2502 			filename = "ac0bsinitvals40";
2503 		break;
2504 	}
2505 	if (!filename)
2506 		goto err_no_initvals;
2507 	err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2508 	if (err)
2509 		goto err_load;
2510 
2511 	fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2512 
2513 	return 0;
2514 
2515 err_no_ucode:
2516 	err = ctx->fatal_failure = -EOPNOTSUPP;
2517 	b43err(dev->wl, "The driver does not know which firmware (ucode) "
2518 	       "is required for your device (wl-core rev %u)\n", rev);
2519 	goto error;
2520 
2521 err_no_pcm:
2522 	err = ctx->fatal_failure = -EOPNOTSUPP;
2523 	b43err(dev->wl, "The driver does not know which firmware (PCM) "
2524 	       "is required for your device (wl-core rev %u)\n", rev);
2525 	goto error;
2526 
2527 err_no_initvals:
2528 	err = ctx->fatal_failure = -EOPNOTSUPP;
2529 	b43err(dev->wl, "The driver does not know which firmware (initvals) "
2530 	       "is required for your device (wl-core rev %u)\n", rev);
2531 	goto error;
2532 
2533 err_load:
2534 	/* We failed to load this firmware image. The error message
2535 	 * already is in ctx->errors. Return and let our caller decide
2536 	 * what to do. */
2537 	goto error;
2538 
2539 error:
2540 	b43_release_firmware(dev);
2541 	return err;
2542 }
2543 
2544 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2545 static void b43_one_core_detach(struct b43_bus_dev *dev);
2546 static int b43_rng_init(struct b43_wl *wl);
2547 
2548 static void b43_request_firmware(struct work_struct *work)
2549 {
2550 	struct b43_wl *wl = container_of(work,
2551 			    struct b43_wl, firmware_load);
2552 	struct b43_wldev *dev = wl->current_dev;
2553 	struct b43_request_fw_context *ctx;
2554 	unsigned int i;
2555 	int err;
2556 	const char *errmsg;
2557 
2558 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2559 	if (!ctx)
2560 		return;
2561 	ctx->dev = dev;
2562 
2563 	ctx->req_type = B43_FWTYPE_PROPRIETARY;
2564 	err = b43_try_request_fw(ctx);
2565 	if (!err)
2566 		goto start_ieee80211; /* Successfully loaded it. */
2567 	/* Was fw version known? */
2568 	if (ctx->fatal_failure)
2569 		goto out;
2570 
2571 	/* proprietary fw not found, try open source */
2572 	ctx->req_type = B43_FWTYPE_OPENSOURCE;
2573 	err = b43_try_request_fw(ctx);
2574 	if (!err)
2575 		goto start_ieee80211; /* Successfully loaded it. */
2576 	if(ctx->fatal_failure)
2577 		goto out;
2578 
2579 	/* Could not find a usable firmware. Print the errors. */
2580 	for (i = 0; i < B43_NR_FWTYPES; i++) {
2581 		errmsg = ctx->errors[i];
2582 		if (strlen(errmsg))
2583 			b43err(dev->wl, "%s", errmsg);
2584 	}
2585 	b43_print_fw_helptext(dev->wl, 1);
2586 	goto out;
2587 
2588 start_ieee80211:
2589 	wl->hw->queues = B43_QOS_QUEUE_NUM;
2590 	if (!modparam_qos || dev->fw.opensource ||
2591 	    dev->dev->chip_id == BCMA_CHIP_ID_BCM4331)
2592 		wl->hw->queues = 1;
2593 
2594 	err = ieee80211_register_hw(wl->hw);
2595 	if (err)
2596 		goto out;
2597 	wl->hw_registered = true;
2598 	b43_leds_register(wl->current_dev);
2599 
2600 	/* Register HW RNG driver */
2601 	b43_rng_init(wl);
2602 
2603 out:
2604 	kfree(ctx);
2605 }
2606 
2607 static int b43_upload_microcode(struct b43_wldev *dev)
2608 {
2609 	struct wiphy *wiphy = dev->wl->hw->wiphy;
2610 	const size_t hdr_len = sizeof(struct b43_fw_header);
2611 	const __be32 *data;
2612 	unsigned int i, len;
2613 	u16 fwrev, fwpatch, fwdate, fwtime;
2614 	u32 tmp, macctl;
2615 	int err = 0;
2616 
2617 	/* Jump the microcode PSM to offset 0 */
2618 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2619 	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2620 	macctl |= B43_MACCTL_PSM_JMP0;
2621 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2622 	/* Zero out all microcode PSM registers and shared memory. */
2623 	for (i = 0; i < 64; i++)
2624 		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2625 	for (i = 0; i < 4096; i += 2)
2626 		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2627 
2628 	/* Upload Microcode. */
2629 	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2630 	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2631 	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2632 	for (i = 0; i < len; i++) {
2633 		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2634 		udelay(10);
2635 	}
2636 
2637 	if (dev->fw.pcm.data) {
2638 		/* Upload PCM data. */
2639 		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2640 		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2641 		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2642 		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2643 		/* No need for autoinc bit in SHM_HW */
2644 		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2645 		for (i = 0; i < len; i++) {
2646 			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2647 			udelay(10);
2648 		}
2649 	}
2650 
2651 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2652 
2653 	/* Start the microcode PSM */
2654 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2655 		      B43_MACCTL_PSM_RUN);
2656 
2657 	/* Wait for the microcode to load and respond */
2658 	i = 0;
2659 	while (1) {
2660 		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2661 		if (tmp == B43_IRQ_MAC_SUSPENDED)
2662 			break;
2663 		i++;
2664 		if (i >= 20) {
2665 			b43err(dev->wl, "Microcode not responding\n");
2666 			b43_print_fw_helptext(dev->wl, 1);
2667 			err = -ENODEV;
2668 			goto error;
2669 		}
2670 		msleep(50);
2671 	}
2672 	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2673 
2674 	/* Get and check the revisions. */
2675 	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2676 	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2677 	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2678 	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2679 
2680 	if (fwrev <= 0x128) {
2681 		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2682 		       "binary drivers older than version 4.x is unsupported. "
2683 		       "You must upgrade your firmware files.\n");
2684 		b43_print_fw_helptext(dev->wl, 1);
2685 		err = -EOPNOTSUPP;
2686 		goto error;
2687 	}
2688 	dev->fw.rev = fwrev;
2689 	dev->fw.patch = fwpatch;
2690 	if (dev->fw.rev >= 598)
2691 		dev->fw.hdr_format = B43_FW_HDR_598;
2692 	else if (dev->fw.rev >= 410)
2693 		dev->fw.hdr_format = B43_FW_HDR_410;
2694 	else
2695 		dev->fw.hdr_format = B43_FW_HDR_351;
2696 	WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2697 
2698 	dev->qos_enabled = dev->wl->hw->queues > 1;
2699 	/* Default to firmware/hardware crypto acceleration. */
2700 	dev->hwcrypto_enabled = true;
2701 
2702 	if (dev->fw.opensource) {
2703 		u16 fwcapa;
2704 
2705 		/* Patchlevel info is encoded in the "time" field. */
2706 		dev->fw.patch = fwtime;
2707 		b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2708 			dev->fw.rev, dev->fw.patch);
2709 
2710 		fwcapa = b43_fwcapa_read(dev);
2711 		if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2712 			b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2713 			/* Disable hardware crypto and fall back to software crypto. */
2714 			dev->hwcrypto_enabled = false;
2715 		}
2716 		/* adding QoS support should use an offline discovery mechanism */
2717 		WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2718 	} else {
2719 		b43info(dev->wl, "Loading firmware version %u.%u "
2720 			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2721 			fwrev, fwpatch,
2722 			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2723 			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2724 		if (dev->fw.pcm_request_failed) {
2725 			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2726 				"Hardware accelerated cryptography is disabled.\n");
2727 			b43_print_fw_helptext(dev->wl, 0);
2728 		}
2729 	}
2730 
2731 	snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2732 			dev->fw.rev, dev->fw.patch);
2733 	wiphy->hw_version = dev->dev->core_id;
2734 
2735 	if (dev->fw.hdr_format == B43_FW_HDR_351) {
2736 		/* We're over the deadline, but we keep support for old fw
2737 		 * until it turns out to be in major conflict with something new. */
2738 		b43warn(dev->wl, "You are using an old firmware image. "
2739 			"Support for old firmware will be removed soon "
2740 			"(official deadline was July 2008).\n");
2741 		b43_print_fw_helptext(dev->wl, 0);
2742 	}
2743 
2744 	return 0;
2745 
2746 error:
2747 	/* Stop the microcode PSM. */
2748 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2749 		      B43_MACCTL_PSM_JMP0);
2750 
2751 	return err;
2752 }
2753 
2754 static int b43_write_initvals(struct b43_wldev *dev,
2755 			      const struct b43_iv *ivals,
2756 			      size_t count,
2757 			      size_t array_size)
2758 {
2759 	const struct b43_iv *iv;
2760 	u16 offset;
2761 	size_t i;
2762 	bool bit32;
2763 
2764 	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2765 	iv = ivals;
2766 	for (i = 0; i < count; i++) {
2767 		if (array_size < sizeof(iv->offset_size))
2768 			goto err_format;
2769 		array_size -= sizeof(iv->offset_size);
2770 		offset = be16_to_cpu(iv->offset_size);
2771 		bit32 = !!(offset & B43_IV_32BIT);
2772 		offset &= B43_IV_OFFSET_MASK;
2773 		if (offset >= 0x1000)
2774 			goto err_format;
2775 		if (bit32) {
2776 			u32 value;
2777 
2778 			if (array_size < sizeof(iv->data.d32))
2779 				goto err_format;
2780 			array_size -= sizeof(iv->data.d32);
2781 
2782 			value = get_unaligned_be32(&iv->data.d32);
2783 			b43_write32(dev, offset, value);
2784 
2785 			iv = (const struct b43_iv *)((const uint8_t *)iv +
2786 							sizeof(__be16) +
2787 							sizeof(__be32));
2788 		} else {
2789 			u16 value;
2790 
2791 			if (array_size < sizeof(iv->data.d16))
2792 				goto err_format;
2793 			array_size -= sizeof(iv->data.d16);
2794 
2795 			value = be16_to_cpu(iv->data.d16);
2796 			b43_write16(dev, offset, value);
2797 
2798 			iv = (const struct b43_iv *)((const uint8_t *)iv +
2799 							sizeof(__be16) +
2800 							sizeof(__be16));
2801 		}
2802 	}
2803 	if (array_size)
2804 		goto err_format;
2805 
2806 	return 0;
2807 
2808 err_format:
2809 	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2810 	b43_print_fw_helptext(dev->wl, 1);
2811 
2812 	return -EPROTO;
2813 }
2814 
2815 static int b43_upload_initvals(struct b43_wldev *dev)
2816 {
2817 	const size_t hdr_len = sizeof(struct b43_fw_header);
2818 	const struct b43_fw_header *hdr;
2819 	struct b43_firmware *fw = &dev->fw;
2820 	const struct b43_iv *ivals;
2821 	size_t count;
2822 
2823 	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2824 	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2825 	count = be32_to_cpu(hdr->size);
2826 	return b43_write_initvals(dev, ivals, count,
2827 				 fw->initvals.data->size - hdr_len);
2828 }
2829 
2830 static int b43_upload_initvals_band(struct b43_wldev *dev)
2831 {
2832 	const size_t hdr_len = sizeof(struct b43_fw_header);
2833 	const struct b43_fw_header *hdr;
2834 	struct b43_firmware *fw = &dev->fw;
2835 	const struct b43_iv *ivals;
2836 	size_t count;
2837 
2838 	if (!fw->initvals_band.data)
2839 		return 0;
2840 
2841 	hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2842 	ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2843 	count = be32_to_cpu(hdr->size);
2844 	return b43_write_initvals(dev, ivals, count,
2845 				  fw->initvals_band.data->size - hdr_len);
2846 }
2847 
2848 /* Initialize the GPIOs
2849  * https://bcm-specs.sipsolutions.net/GPIO
2850  */
2851 
2852 #ifdef CONFIG_B43_SSB
2853 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2854 {
2855 	struct ssb_bus *bus = dev->dev->sdev->bus;
2856 
2857 #ifdef CONFIG_SSB_DRIVER_PCICORE
2858 	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2859 #else
2860 	return bus->chipco.dev;
2861 #endif
2862 }
2863 #endif
2864 
2865 static int b43_gpio_init(struct b43_wldev *dev)
2866 {
2867 #ifdef CONFIG_B43_SSB
2868 	struct ssb_device *gpiodev;
2869 #endif
2870 	u32 mask, set;
2871 
2872 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2873 	b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2874 
2875 	mask = 0x0000001F;
2876 	set = 0x0000000F;
2877 	if (dev->dev->chip_id == 0x4301) {
2878 		mask |= 0x0060;
2879 		set |= 0x0060;
2880 	} else if (dev->dev->chip_id == 0x5354) {
2881 		/* Don't allow overtaking buttons GPIOs */
2882 		set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2883 	}
2884 
2885 	if (0 /* FIXME: conditional unknown */ ) {
2886 		b43_write16(dev, B43_MMIO_GPIO_MASK,
2887 			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2888 			    | 0x0100);
2889 		/* BT Coexistance Input */
2890 		mask |= 0x0080;
2891 		set |= 0x0080;
2892 		/* BT Coexistance Out */
2893 		mask |= 0x0100;
2894 		set |= 0x0100;
2895 	}
2896 	if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2897 		/* PA is controlled by gpio 9, let ucode handle it */
2898 		b43_write16(dev, B43_MMIO_GPIO_MASK,
2899 			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2900 			    | 0x0200);
2901 		mask |= 0x0200;
2902 		set |= 0x0200;
2903 	}
2904 
2905 	switch (dev->dev->bus_type) {
2906 #ifdef CONFIG_B43_BCMA
2907 	case B43_BUS_BCMA:
2908 		bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2909 		break;
2910 #endif
2911 #ifdef CONFIG_B43_SSB
2912 	case B43_BUS_SSB:
2913 		gpiodev = b43_ssb_gpio_dev(dev);
2914 		if (gpiodev)
2915 			ssb_write32(gpiodev, B43_GPIO_CONTROL,
2916 				    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2917 				    & ~mask) | set);
2918 		break;
2919 #endif
2920 	}
2921 
2922 	return 0;
2923 }
2924 
2925 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2926 static void b43_gpio_cleanup(struct b43_wldev *dev)
2927 {
2928 #ifdef CONFIG_B43_SSB
2929 	struct ssb_device *gpiodev;
2930 #endif
2931 
2932 	switch (dev->dev->bus_type) {
2933 #ifdef CONFIG_B43_BCMA
2934 	case B43_BUS_BCMA:
2935 		bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2936 		break;
2937 #endif
2938 #ifdef CONFIG_B43_SSB
2939 	case B43_BUS_SSB:
2940 		gpiodev = b43_ssb_gpio_dev(dev);
2941 		if (gpiodev)
2942 			ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2943 		break;
2944 #endif
2945 	}
2946 }
2947 
2948 /* http://bcm-specs.sipsolutions.net/EnableMac */
2949 void b43_mac_enable(struct b43_wldev *dev)
2950 {
2951 	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2952 		u16 fwstate;
2953 
2954 		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2955 					 B43_SHM_SH_UCODESTAT);
2956 		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2957 		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2958 			b43err(dev->wl, "b43_mac_enable(): The firmware "
2959 			       "should be suspended, but current state is %u\n",
2960 			       fwstate);
2961 		}
2962 	}
2963 
2964 	dev->mac_suspended--;
2965 	B43_WARN_ON(dev->mac_suspended < 0);
2966 	if (dev->mac_suspended == 0) {
2967 		b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2968 		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2969 			    B43_IRQ_MAC_SUSPENDED);
2970 		/* Commit writes */
2971 		b43_read32(dev, B43_MMIO_MACCTL);
2972 		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2973 		b43_power_saving_ctl_bits(dev, 0);
2974 	}
2975 }
2976 
2977 /* https://bcm-specs.sipsolutions.net/SuspendMAC */
2978 void b43_mac_suspend(struct b43_wldev *dev)
2979 {
2980 	int i;
2981 	u32 tmp;
2982 
2983 	might_sleep();
2984 	B43_WARN_ON(dev->mac_suspended < 0);
2985 
2986 	if (dev->mac_suspended == 0) {
2987 		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2988 		b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
2989 		/* force pci to flush the write */
2990 		b43_read32(dev, B43_MMIO_MACCTL);
2991 		for (i = 35; i; i--) {
2992 			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2993 			if (tmp & B43_IRQ_MAC_SUSPENDED)
2994 				goto out;
2995 			udelay(10);
2996 		}
2997 		/* Hm, it seems this will take some time. Use msleep(). */
2998 		for (i = 40; i; i--) {
2999 			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3000 			if (tmp & B43_IRQ_MAC_SUSPENDED)
3001 				goto out;
3002 			msleep(1);
3003 		}
3004 		b43err(dev->wl, "MAC suspend failed\n");
3005 	}
3006 out:
3007 	dev->mac_suspended++;
3008 }
3009 
3010 /* https://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
3011 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
3012 {
3013 	u32 tmp;
3014 
3015 	switch (dev->dev->bus_type) {
3016 #ifdef CONFIG_B43_BCMA
3017 	case B43_BUS_BCMA:
3018 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3019 		if (on)
3020 			tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
3021 		else
3022 			tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
3023 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3024 		break;
3025 #endif
3026 #ifdef CONFIG_B43_SSB
3027 	case B43_BUS_SSB:
3028 		tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3029 		if (on)
3030 			tmp |= B43_TMSLOW_MACPHYCLKEN;
3031 		else
3032 			tmp &= ~B43_TMSLOW_MACPHYCLKEN;
3033 		ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3034 		break;
3035 #endif
3036 	}
3037 }
3038 
3039 /* brcms_b_switch_macfreq */
3040 void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
3041 {
3042 	u16 chip_id = dev->dev->chip_id;
3043 
3044 	if (chip_id == BCMA_CHIP_ID_BCM4331) {
3045 		switch (spurmode) {
3046 		case 2: /* 168 Mhz: 2^26/168 = 0x61862 */
3047 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x1862);
3048 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3049 			break;
3050 		case 1: /* 164 Mhz: 2^26/164 = 0x63e70 */
3051 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x3e70);
3052 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3053 			break;
3054 		default: /* 160 Mhz: 2^26/160 = 0x66666 */
3055 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x6666);
3056 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3057 			break;
3058 		}
3059 	} else if (chip_id == BCMA_CHIP_ID_BCM43131 ||
3060 	    chip_id == BCMA_CHIP_ID_BCM43217 ||
3061 	    chip_id == BCMA_CHIP_ID_BCM43222 ||
3062 	    chip_id == BCMA_CHIP_ID_BCM43224 ||
3063 	    chip_id == BCMA_CHIP_ID_BCM43225 ||
3064 	    chip_id == BCMA_CHIP_ID_BCM43227 ||
3065 	    chip_id == BCMA_CHIP_ID_BCM43228) {
3066 		switch (spurmode) {
3067 		case 2: /* 126 Mhz */
3068 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
3069 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3070 			break;
3071 		case 1: /* 123 Mhz */
3072 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3073 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3074 			break;
3075 		default: /* 120 Mhz */
3076 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3077 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3078 			break;
3079 		}
3080 	} else if (dev->phy.type == B43_PHYTYPE_LCN) {
3081 		switch (spurmode) {
3082 		case 1: /* 82 Mhz */
3083 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3084 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3085 			break;
3086 		default: /* 80 Mhz */
3087 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3088 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3089 			break;
3090 		}
3091 	}
3092 }
3093 
3094 static void b43_adjust_opmode(struct b43_wldev *dev)
3095 {
3096 	struct b43_wl *wl = dev->wl;
3097 	u32 ctl;
3098 	u16 cfp_pretbtt;
3099 
3100 	ctl = b43_read32(dev, B43_MMIO_MACCTL);
3101 	/* Reset status to STA infrastructure mode. */
3102 	ctl &= ~B43_MACCTL_AP;
3103 	ctl &= ~B43_MACCTL_KEEP_CTL;
3104 	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3105 	ctl &= ~B43_MACCTL_KEEP_BAD;
3106 	ctl &= ~B43_MACCTL_PROMISC;
3107 	ctl &= ~B43_MACCTL_BEACPROMISC;
3108 	ctl |= B43_MACCTL_INFRA;
3109 
3110 	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3111 	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3112 		ctl |= B43_MACCTL_AP;
3113 	else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3114 		ctl &= ~B43_MACCTL_INFRA;
3115 
3116 	if (wl->filter_flags & FIF_CONTROL)
3117 		ctl |= B43_MACCTL_KEEP_CTL;
3118 	if (wl->filter_flags & FIF_FCSFAIL)
3119 		ctl |= B43_MACCTL_KEEP_BAD;
3120 	if (wl->filter_flags & FIF_PLCPFAIL)
3121 		ctl |= B43_MACCTL_KEEP_BADPLCP;
3122 	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3123 		ctl |= B43_MACCTL_BEACPROMISC;
3124 
3125 	/* Workaround: On old hardware the HW-MAC-address-filter
3126 	 * doesn't work properly, so always run promisc in filter
3127 	 * it in software. */
3128 	if (dev->dev->core_rev <= 4)
3129 		ctl |= B43_MACCTL_PROMISC;
3130 
3131 	b43_write32(dev, B43_MMIO_MACCTL, ctl);
3132 
3133 	cfp_pretbtt = 2;
3134 	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3135 		if (dev->dev->chip_id == 0x4306 &&
3136 		    dev->dev->chip_rev == 3)
3137 			cfp_pretbtt = 100;
3138 		else
3139 			cfp_pretbtt = 50;
3140 	}
3141 	b43_write16(dev, 0x612, cfp_pretbtt);
3142 
3143 	/* FIXME: We don't currently implement the PMQ mechanism,
3144 	 *        so always disable it. If we want to implement PMQ,
3145 	 *        we need to enable it here (clear DISCPMQ) in AP mode.
3146 	 */
3147 	if (0  /* ctl & B43_MACCTL_AP */)
3148 		b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3149 	else
3150 		b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3151 }
3152 
3153 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3154 {
3155 	u16 offset;
3156 
3157 	if (is_ofdm) {
3158 		offset = 0x480;
3159 		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3160 	} else {
3161 		offset = 0x4C0;
3162 		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3163 	}
3164 	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3165 			b43_shm_read16(dev, B43_SHM_SHARED, offset));
3166 }
3167 
3168 static void b43_rate_memory_init(struct b43_wldev *dev)
3169 {
3170 	switch (dev->phy.type) {
3171 	case B43_PHYTYPE_G:
3172 	case B43_PHYTYPE_N:
3173 	case B43_PHYTYPE_LP:
3174 	case B43_PHYTYPE_HT:
3175 	case B43_PHYTYPE_LCN:
3176 		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3177 		b43_rate_memory_write(dev, B43_OFDM_RATE_9MB, 1);
3178 		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3179 		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3180 		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3181 		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3182 		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3183 		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3184 		fallthrough;
3185 	case B43_PHYTYPE_B:
3186 		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3187 		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3188 		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3189 		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3190 		break;
3191 	default:
3192 		B43_WARN_ON(1);
3193 	}
3194 }
3195 
3196 /* Set the default values for the PHY TX Control Words. */
3197 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3198 {
3199 	u16 ctl = 0;
3200 
3201 	ctl |= B43_TXH_PHY_ENC_CCK;
3202 	ctl |= B43_TXH_PHY_ANT01AUTO;
3203 	ctl |= B43_TXH_PHY_TXPWR;
3204 
3205 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3206 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3207 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3208 }
3209 
3210 /* Set the TX-Antenna for management frames sent by firmware. */
3211 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3212 {
3213 	u16 ant;
3214 	u16 tmp;
3215 
3216 	ant = b43_antenna_to_phyctl(antenna);
3217 
3218 	/* For ACK/CTS */
3219 	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3220 	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3221 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3222 	/* For Probe Resposes */
3223 	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3224 	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3225 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3226 }
3227 
3228 /* This is the opposite of b43_chip_init() */
3229 static void b43_chip_exit(struct b43_wldev *dev)
3230 {
3231 	b43_phy_exit(dev);
3232 	b43_gpio_cleanup(dev);
3233 	/* firmware is released later */
3234 }
3235 
3236 /* Initialize the chip
3237  * https://bcm-specs.sipsolutions.net/ChipInit
3238  */
3239 static int b43_chip_init(struct b43_wldev *dev)
3240 {
3241 	struct b43_phy *phy = &dev->phy;
3242 	int err;
3243 	u32 macctl;
3244 	u16 value16;
3245 
3246 	/* Initialize the MAC control */
3247 	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3248 	if (dev->phy.gmode)
3249 		macctl |= B43_MACCTL_GMODE;
3250 	macctl |= B43_MACCTL_INFRA;
3251 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
3252 
3253 	err = b43_upload_microcode(dev);
3254 	if (err)
3255 		goto out;	/* firmware is released later */
3256 
3257 	err = b43_gpio_init(dev);
3258 	if (err)
3259 		goto out;	/* firmware is released later */
3260 
3261 	err = b43_upload_initvals(dev);
3262 	if (err)
3263 		goto err_gpio_clean;
3264 
3265 	err = b43_upload_initvals_band(dev);
3266 	if (err)
3267 		goto err_gpio_clean;
3268 
3269 	/* Turn the Analog on and initialize the PHY. */
3270 	phy->ops->switch_analog(dev, 1);
3271 	err = b43_phy_init(dev);
3272 	if (err)
3273 		goto err_gpio_clean;
3274 
3275 	/* Disable Interference Mitigation. */
3276 	if (phy->ops->interf_mitigation)
3277 		phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3278 
3279 	/* Select the antennae */
3280 	if (phy->ops->set_rx_antenna)
3281 		phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3282 	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3283 
3284 	if (phy->type == B43_PHYTYPE_B) {
3285 		value16 = b43_read16(dev, 0x005E);
3286 		value16 |= 0x0004;
3287 		b43_write16(dev, 0x005E, value16);
3288 	}
3289 	b43_write32(dev, 0x0100, 0x01000000);
3290 	if (dev->dev->core_rev < 5)
3291 		b43_write32(dev, 0x010C, 0x01000000);
3292 
3293 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3294 	b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3295 
3296 	/* Probe Response Timeout value */
3297 	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3298 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3299 
3300 	/* Initially set the wireless operation mode. */
3301 	b43_adjust_opmode(dev);
3302 
3303 	if (dev->dev->core_rev < 3) {
3304 		b43_write16(dev, 0x060E, 0x0000);
3305 		b43_write16(dev, 0x0610, 0x8000);
3306 		b43_write16(dev, 0x0604, 0x0000);
3307 		b43_write16(dev, 0x0606, 0x0200);
3308 	} else {
3309 		b43_write32(dev, 0x0188, 0x80000000);
3310 		b43_write32(dev, 0x018C, 0x02000000);
3311 	}
3312 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3313 	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3314 	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3315 	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3316 	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3317 	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3318 	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3319 
3320 	b43_mac_phy_clock_set(dev, true);
3321 
3322 	switch (dev->dev->bus_type) {
3323 #ifdef CONFIG_B43_BCMA
3324 	case B43_BUS_BCMA:
3325 		/* FIXME: 0xE74 is quite common, but should be read from CC */
3326 		b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3327 		break;
3328 #endif
3329 #ifdef CONFIG_B43_SSB
3330 	case B43_BUS_SSB:
3331 		b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3332 			    dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3333 		break;
3334 #endif
3335 	}
3336 
3337 	err = 0;
3338 	b43dbg(dev->wl, "Chip initialized\n");
3339 out:
3340 	return err;
3341 
3342 err_gpio_clean:
3343 	b43_gpio_cleanup(dev);
3344 	return err;
3345 }
3346 
3347 static void b43_periodic_every60sec(struct b43_wldev *dev)
3348 {
3349 	const struct b43_phy_operations *ops = dev->phy.ops;
3350 
3351 	if (ops->pwork_60sec)
3352 		ops->pwork_60sec(dev);
3353 
3354 	/* Force check the TX power emission now. */
3355 	b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3356 }
3357 
3358 static void b43_periodic_every30sec(struct b43_wldev *dev)
3359 {
3360 	/* Update device statistics. */
3361 	b43_calculate_link_quality(dev);
3362 }
3363 
3364 static void b43_periodic_every15sec(struct b43_wldev *dev)
3365 {
3366 	struct b43_phy *phy = &dev->phy;
3367 	u16 wdr;
3368 
3369 	if (dev->fw.opensource) {
3370 		/* Check if the firmware is still alive.
3371 		 * It will reset the watchdog counter to 0 in its idle loop. */
3372 		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3373 		if (unlikely(wdr)) {
3374 			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3375 			b43_controller_restart(dev, "Firmware watchdog");
3376 			return;
3377 		} else {
3378 			b43_shm_write16(dev, B43_SHM_SCRATCH,
3379 					B43_WATCHDOG_REG, 1);
3380 		}
3381 	}
3382 
3383 	if (phy->ops->pwork_15sec)
3384 		phy->ops->pwork_15sec(dev);
3385 
3386 	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3387 	wmb();
3388 
3389 #if B43_DEBUG
3390 	if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3391 		unsigned int i;
3392 
3393 		b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3394 		       dev->irq_count / 15,
3395 		       dev->tx_count / 15,
3396 		       dev->rx_count / 15);
3397 		dev->irq_count = 0;
3398 		dev->tx_count = 0;
3399 		dev->rx_count = 0;
3400 		for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3401 			if (dev->irq_bit_count[i]) {
3402 				b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3403 				       dev->irq_bit_count[i] / 15, i, (1 << i));
3404 				dev->irq_bit_count[i] = 0;
3405 			}
3406 		}
3407 	}
3408 #endif
3409 }
3410 
3411 static void do_periodic_work(struct b43_wldev *dev)
3412 {
3413 	unsigned int state;
3414 
3415 	state = dev->periodic_state;
3416 	if (state % 4 == 0)
3417 		b43_periodic_every60sec(dev);
3418 	if (state % 2 == 0)
3419 		b43_periodic_every30sec(dev);
3420 	b43_periodic_every15sec(dev);
3421 }
3422 
3423 /* Periodic work locking policy:
3424  * 	The whole periodic work handler is protected by
3425  * 	wl->mutex. If another lock is needed somewhere in the
3426  * 	pwork callchain, it's acquired in-place, where it's needed.
3427  */
3428 static void b43_periodic_work_handler(struct work_struct *work)
3429 {
3430 	struct b43_wldev *dev = container_of(work, struct b43_wldev,
3431 					     periodic_work.work);
3432 	struct b43_wl *wl = dev->wl;
3433 	unsigned long delay;
3434 
3435 	mutex_lock(&wl->mutex);
3436 
3437 	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3438 		goto out;
3439 	if (b43_debug(dev, B43_DBG_PWORK_STOP))
3440 		goto out_requeue;
3441 
3442 	do_periodic_work(dev);
3443 
3444 	dev->periodic_state++;
3445 out_requeue:
3446 	if (b43_debug(dev, B43_DBG_PWORK_FAST))
3447 		delay = msecs_to_jiffies(50);
3448 	else
3449 		delay = round_jiffies_relative(HZ * 15);
3450 	ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3451 out:
3452 	mutex_unlock(&wl->mutex);
3453 }
3454 
3455 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3456 {
3457 	struct delayed_work *work = &dev->periodic_work;
3458 
3459 	dev->periodic_state = 0;
3460 	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3461 	ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3462 }
3463 
3464 /* Check if communication with the device works correctly. */
3465 static int b43_validate_chipaccess(struct b43_wldev *dev)
3466 {
3467 	u32 v, backup0, backup4;
3468 
3469 	backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3470 	backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3471 
3472 	/* Check for read/write and endianness problems. */
3473 	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3474 	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3475 		goto error;
3476 	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3477 	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3478 		goto error;
3479 
3480 	/* Check if unaligned 32bit SHM_SHARED access works properly.
3481 	 * However, don't bail out on failure, because it's noncritical. */
3482 	b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3483 	b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3484 	b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3485 	b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3486 	if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3487 		b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3488 	b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3489 	if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3490 	    b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3491 	    b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3492 	    b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3493 		b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3494 
3495 	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3496 	b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3497 
3498 	if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3499 		/* The 32bit register shadows the two 16bit registers
3500 		 * with update sideeffects. Validate this. */
3501 		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3502 		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3503 		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3504 			goto error;
3505 		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3506 			goto error;
3507 	}
3508 	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3509 
3510 	v = b43_read32(dev, B43_MMIO_MACCTL);
3511 	v |= B43_MACCTL_GMODE;
3512 	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3513 		goto error;
3514 
3515 	return 0;
3516 error:
3517 	b43err(dev->wl, "Failed to validate the chipaccess\n");
3518 	return -ENODEV;
3519 }
3520 
3521 static void b43_security_init(struct b43_wldev *dev)
3522 {
3523 	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3524 	/* KTP is a word address, but we address SHM bytewise.
3525 	 * So multiply by two.
3526 	 */
3527 	dev->ktp *= 2;
3528 	/* Number of RCMTA address slots */
3529 	b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3530 	/* Clear the key memory. */
3531 	b43_clear_keys(dev);
3532 }
3533 
3534 #ifdef CONFIG_B43_HWRNG
3535 static int b43_rng_read(struct hwrng *rng, u32 *data)
3536 {
3537 	struct b43_wl *wl = (struct b43_wl *)rng->priv;
3538 	struct b43_wldev *dev;
3539 	int count = -ENODEV;
3540 
3541 	mutex_lock(&wl->mutex);
3542 	dev = wl->current_dev;
3543 	if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3544 		*data = b43_read16(dev, B43_MMIO_RNG);
3545 		count = sizeof(u16);
3546 	}
3547 	mutex_unlock(&wl->mutex);
3548 
3549 	return count;
3550 }
3551 #endif /* CONFIG_B43_HWRNG */
3552 
3553 static void b43_rng_exit(struct b43_wl *wl)
3554 {
3555 #ifdef CONFIG_B43_HWRNG
3556 	if (wl->rng_initialized)
3557 		hwrng_unregister(&wl->rng);
3558 #endif /* CONFIG_B43_HWRNG */
3559 }
3560 
3561 static int b43_rng_init(struct b43_wl *wl)
3562 {
3563 	int err = 0;
3564 
3565 #ifdef CONFIG_B43_HWRNG
3566 	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3567 		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3568 	wl->rng.name = wl->rng_name;
3569 	wl->rng.data_read = b43_rng_read;
3570 	wl->rng.priv = (unsigned long)wl;
3571 	wl->rng_initialized = true;
3572 	err = hwrng_register(&wl->rng);
3573 	if (err) {
3574 		wl->rng_initialized = false;
3575 		b43err(wl, "Failed to register the random "
3576 		       "number generator (%d)\n", err);
3577 	}
3578 #endif /* CONFIG_B43_HWRNG */
3579 
3580 	return err;
3581 }
3582 
3583 static void b43_tx_work(struct work_struct *work)
3584 {
3585 	struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3586 	struct b43_wldev *dev;
3587 	struct sk_buff *skb;
3588 	int queue_num;
3589 	int err = 0;
3590 
3591 	mutex_lock(&wl->mutex);
3592 	dev = wl->current_dev;
3593 	if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3594 		mutex_unlock(&wl->mutex);
3595 		return;
3596 	}
3597 
3598 	for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3599 		while (skb_queue_len(&wl->tx_queue[queue_num])) {
3600 			skb = skb_dequeue(&wl->tx_queue[queue_num]);
3601 			if (b43_using_pio_transfers(dev))
3602 				err = b43_pio_tx(dev, skb);
3603 			else
3604 				err = b43_dma_tx(dev, skb);
3605 			if (err == -ENOSPC) {
3606 				wl->tx_queue_stopped[queue_num] = true;
3607 				b43_stop_queue(dev, queue_num);
3608 				skb_queue_head(&wl->tx_queue[queue_num], skb);
3609 				break;
3610 			}
3611 			if (unlikely(err))
3612 				ieee80211_free_txskb(wl->hw, skb);
3613 			err = 0;
3614 		}
3615 
3616 		if (!err)
3617 			wl->tx_queue_stopped[queue_num] = false;
3618 	}
3619 
3620 #if B43_DEBUG
3621 	dev->tx_count++;
3622 #endif
3623 	mutex_unlock(&wl->mutex);
3624 }
3625 
3626 static void b43_op_tx(struct ieee80211_hw *hw,
3627 		      struct ieee80211_tx_control *control,
3628 		      struct sk_buff *skb)
3629 {
3630 	struct b43_wl *wl = hw_to_b43_wl(hw);
3631 	u16 skb_queue_mapping;
3632 
3633 	if (unlikely(skb->len < 2 + 2 + 6)) {
3634 		/* Too short, this can't be a valid frame. */
3635 		ieee80211_free_txskb(hw, skb);
3636 		return;
3637 	}
3638 	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3639 
3640 	skb_queue_mapping = skb_get_queue_mapping(skb);
3641 	skb_queue_tail(&wl->tx_queue[skb_queue_mapping], skb);
3642 	if (!wl->tx_queue_stopped[skb_queue_mapping])
3643 		ieee80211_queue_work(wl->hw, &wl->tx_work);
3644 	else
3645 		b43_stop_queue(wl->current_dev, skb_queue_mapping);
3646 }
3647 
3648 static void b43_qos_params_upload(struct b43_wldev *dev,
3649 				  const struct ieee80211_tx_queue_params *p,
3650 				  u16 shm_offset)
3651 {
3652 	u16 params[B43_NR_QOSPARAMS];
3653 	int bslots, tmp;
3654 	unsigned int i;
3655 
3656 	if (!dev->qos_enabled)
3657 		return;
3658 
3659 	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3660 
3661 	memset(&params, 0, sizeof(params));
3662 
3663 	params[B43_QOSPARAM_TXOP] = p->txop * 32;
3664 	params[B43_QOSPARAM_CWMIN] = p->cw_min;
3665 	params[B43_QOSPARAM_CWMAX] = p->cw_max;
3666 	params[B43_QOSPARAM_CWCUR] = p->cw_min;
3667 	params[B43_QOSPARAM_AIFS] = p->aifs;
3668 	params[B43_QOSPARAM_BSLOTS] = bslots;
3669 	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3670 
3671 	for (i = 0; i < ARRAY_SIZE(params); i++) {
3672 		if (i == B43_QOSPARAM_STATUS) {
3673 			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3674 					     shm_offset + (i * 2));
3675 			/* Mark the parameters as updated. */
3676 			tmp |= 0x100;
3677 			b43_shm_write16(dev, B43_SHM_SHARED,
3678 					shm_offset + (i * 2),
3679 					tmp);
3680 		} else {
3681 			b43_shm_write16(dev, B43_SHM_SHARED,
3682 					shm_offset + (i * 2),
3683 					params[i]);
3684 		}
3685 	}
3686 }
3687 
3688 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3689 static const u16 b43_qos_shm_offsets[] = {
3690 	/* [mac80211-queue-nr] = SHM_OFFSET, */
3691 	[0] = B43_QOS_VOICE,
3692 	[1] = B43_QOS_VIDEO,
3693 	[2] = B43_QOS_BESTEFFORT,
3694 	[3] = B43_QOS_BACKGROUND,
3695 };
3696 
3697 /* Update all QOS parameters in hardware. */
3698 static void b43_qos_upload_all(struct b43_wldev *dev)
3699 {
3700 	struct b43_wl *wl = dev->wl;
3701 	struct b43_qos_params *params;
3702 	unsigned int i;
3703 
3704 	if (!dev->qos_enabled)
3705 		return;
3706 
3707 	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3708 		     ARRAY_SIZE(wl->qos_params));
3709 
3710 	b43_mac_suspend(dev);
3711 	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3712 		params = &(wl->qos_params[i]);
3713 		b43_qos_params_upload(dev, &(params->p),
3714 				      b43_qos_shm_offsets[i]);
3715 	}
3716 	b43_mac_enable(dev);
3717 }
3718 
3719 static void b43_qos_clear(struct b43_wl *wl)
3720 {
3721 	struct b43_qos_params *params;
3722 	unsigned int i;
3723 
3724 	/* Initialize QoS parameters to sane defaults. */
3725 
3726 	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3727 		     ARRAY_SIZE(wl->qos_params));
3728 
3729 	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3730 		params = &(wl->qos_params[i]);
3731 
3732 		switch (b43_qos_shm_offsets[i]) {
3733 		case B43_QOS_VOICE:
3734 			params->p.txop = 0;
3735 			params->p.aifs = 2;
3736 			params->p.cw_min = 0x0001;
3737 			params->p.cw_max = 0x0001;
3738 			break;
3739 		case B43_QOS_VIDEO:
3740 			params->p.txop = 0;
3741 			params->p.aifs = 2;
3742 			params->p.cw_min = 0x0001;
3743 			params->p.cw_max = 0x0001;
3744 			break;
3745 		case B43_QOS_BESTEFFORT:
3746 			params->p.txop = 0;
3747 			params->p.aifs = 3;
3748 			params->p.cw_min = 0x0001;
3749 			params->p.cw_max = 0x03FF;
3750 			break;
3751 		case B43_QOS_BACKGROUND:
3752 			params->p.txop = 0;
3753 			params->p.aifs = 7;
3754 			params->p.cw_min = 0x0001;
3755 			params->p.cw_max = 0x03FF;
3756 			break;
3757 		default:
3758 			B43_WARN_ON(1);
3759 		}
3760 	}
3761 }
3762 
3763 /* Initialize the core's QOS capabilities */
3764 static void b43_qos_init(struct b43_wldev *dev)
3765 {
3766 	if (!dev->qos_enabled) {
3767 		/* Disable QOS support. */
3768 		b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3769 		b43_write16(dev, B43_MMIO_IFSCTL,
3770 			    b43_read16(dev, B43_MMIO_IFSCTL)
3771 			    & ~B43_MMIO_IFSCTL_USE_EDCF);
3772 		b43dbg(dev->wl, "QoS disabled\n");
3773 		return;
3774 	}
3775 
3776 	/* Upload the current QOS parameters. */
3777 	b43_qos_upload_all(dev);
3778 
3779 	/* Enable QOS support. */
3780 	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3781 	b43_write16(dev, B43_MMIO_IFSCTL,
3782 		    b43_read16(dev, B43_MMIO_IFSCTL)
3783 		    | B43_MMIO_IFSCTL_USE_EDCF);
3784 	b43dbg(dev->wl, "QoS enabled\n");
3785 }
3786 
3787 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3788 			  struct ieee80211_vif *vif,
3789 			  unsigned int link_id, u16 _queue,
3790 			  const struct ieee80211_tx_queue_params *params)
3791 {
3792 	struct b43_wl *wl = hw_to_b43_wl(hw);
3793 	struct b43_wldev *dev;
3794 	unsigned int queue = (unsigned int)_queue;
3795 	int err = -ENODEV;
3796 
3797 	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3798 		/* Queue not available or don't support setting
3799 		 * params on this queue. Return success to not
3800 		 * confuse mac80211. */
3801 		return 0;
3802 	}
3803 	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3804 		     ARRAY_SIZE(wl->qos_params));
3805 
3806 	mutex_lock(&wl->mutex);
3807 	dev = wl->current_dev;
3808 	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3809 		goto out_unlock;
3810 
3811 	memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3812 	b43_mac_suspend(dev);
3813 	b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3814 			      b43_qos_shm_offsets[queue]);
3815 	b43_mac_enable(dev);
3816 	err = 0;
3817 
3818 out_unlock:
3819 	mutex_unlock(&wl->mutex);
3820 
3821 	return err;
3822 }
3823 
3824 static int b43_op_get_stats(struct ieee80211_hw *hw,
3825 			    struct ieee80211_low_level_stats *stats)
3826 {
3827 	struct b43_wl *wl = hw_to_b43_wl(hw);
3828 
3829 	mutex_lock(&wl->mutex);
3830 	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3831 	mutex_unlock(&wl->mutex);
3832 
3833 	return 0;
3834 }
3835 
3836 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3837 {
3838 	struct b43_wl *wl = hw_to_b43_wl(hw);
3839 	struct b43_wldev *dev;
3840 	u64 tsf;
3841 
3842 	mutex_lock(&wl->mutex);
3843 	dev = wl->current_dev;
3844 
3845 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3846 		b43_tsf_read(dev, &tsf);
3847 	else
3848 		tsf = 0;
3849 
3850 	mutex_unlock(&wl->mutex);
3851 
3852 	return tsf;
3853 }
3854 
3855 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3856 			   struct ieee80211_vif *vif, u64 tsf)
3857 {
3858 	struct b43_wl *wl = hw_to_b43_wl(hw);
3859 	struct b43_wldev *dev;
3860 
3861 	mutex_lock(&wl->mutex);
3862 	dev = wl->current_dev;
3863 
3864 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3865 		b43_tsf_write(dev, tsf);
3866 
3867 	mutex_unlock(&wl->mutex);
3868 }
3869 
3870 static const char *band_to_string(enum nl80211_band band)
3871 {
3872 	switch (band) {
3873 	case NL80211_BAND_5GHZ:
3874 		return "5";
3875 	case NL80211_BAND_2GHZ:
3876 		return "2.4";
3877 	default:
3878 		break;
3879 	}
3880 	B43_WARN_ON(1);
3881 	return "";
3882 }
3883 
3884 /* Expects wl->mutex locked */
3885 static int b43_switch_band(struct b43_wldev *dev,
3886 			   struct ieee80211_channel *chan)
3887 {
3888 	struct b43_phy *phy = &dev->phy;
3889 	bool gmode;
3890 	u32 tmp;
3891 
3892 	switch (chan->band) {
3893 	case NL80211_BAND_5GHZ:
3894 		gmode = false;
3895 		break;
3896 	case NL80211_BAND_2GHZ:
3897 		gmode = true;
3898 		break;
3899 	default:
3900 		B43_WARN_ON(1);
3901 		return -EINVAL;
3902 	}
3903 
3904 	if (!((gmode && phy->supports_2ghz) ||
3905 	      (!gmode && phy->supports_5ghz))) {
3906 		b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3907 		       band_to_string(chan->band));
3908 		return -ENODEV;
3909 	}
3910 
3911 	if (!!phy->gmode == !!gmode) {
3912 		/* This device is already running. */
3913 		return 0;
3914 	}
3915 
3916 	b43dbg(dev->wl, "Switching to %s GHz band\n",
3917 	       band_to_string(chan->band));
3918 
3919 	/* Some new devices don't need disabling radio for band switching */
3920 	if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3921 		b43_software_rfkill(dev, true);
3922 
3923 	phy->gmode = gmode;
3924 	b43_phy_put_into_reset(dev);
3925 	switch (dev->dev->bus_type) {
3926 #ifdef CONFIG_B43_BCMA
3927 	case B43_BUS_BCMA:
3928 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3929 		if (gmode)
3930 			tmp |= B43_BCMA_IOCTL_GMODE;
3931 		else
3932 			tmp &= ~B43_BCMA_IOCTL_GMODE;
3933 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3934 		break;
3935 #endif
3936 #ifdef CONFIG_B43_SSB
3937 	case B43_BUS_SSB:
3938 		tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3939 		if (gmode)
3940 			tmp |= B43_TMSLOW_GMODE;
3941 		else
3942 			tmp &= ~B43_TMSLOW_GMODE;
3943 		ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3944 		break;
3945 #endif
3946 	}
3947 	b43_phy_take_out_of_reset(dev);
3948 
3949 	b43_upload_initvals_band(dev);
3950 
3951 	b43_phy_init(dev);
3952 
3953 	return 0;
3954 }
3955 
3956 static void b43_set_beacon_listen_interval(struct b43_wldev *dev, u16 interval)
3957 {
3958 	interval = min_t(u16, interval, (u16)0xFF);
3959 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BCN_LI, interval);
3960 }
3961 
3962 /* Write the short and long frame retry limit values. */
3963 static void b43_set_retry_limits(struct b43_wldev *dev,
3964 				 unsigned int short_retry,
3965 				 unsigned int long_retry)
3966 {
3967 	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3968 	 * the chip-internal counter. */
3969 	short_retry = min(short_retry, (unsigned int)0xF);
3970 	long_retry = min(long_retry, (unsigned int)0xF);
3971 
3972 	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3973 			short_retry);
3974 	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3975 			long_retry);
3976 }
3977 
3978 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3979 {
3980 	struct b43_wl *wl = hw_to_b43_wl(hw);
3981 	struct b43_wldev *dev = wl->current_dev;
3982 	struct b43_phy *phy = &dev->phy;
3983 	struct ieee80211_conf *conf = &hw->conf;
3984 	int antenna;
3985 	int err = 0;
3986 
3987 	mutex_lock(&wl->mutex);
3988 	b43_mac_suspend(dev);
3989 
3990 	if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL)
3991 		b43_set_beacon_listen_interval(dev, conf->listen_interval);
3992 
3993 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
3994 		phy->chandef = &conf->chandef;
3995 		phy->channel = conf->chandef.chan->hw_value;
3996 
3997 		/* Switch the band (if necessary). */
3998 		err = b43_switch_band(dev, conf->chandef.chan);
3999 		if (err)
4000 			goto out_mac_enable;
4001 
4002 		/* Switch to the requested channel.
4003 		 * The firmware takes care of races with the TX handler.
4004 		 */
4005 		b43_switch_channel(dev, phy->channel);
4006 	}
4007 
4008 	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
4009 		b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
4010 					  conf->long_frame_max_tx_count);
4011 	changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
4012 	if (!changed)
4013 		goto out_mac_enable;
4014 
4015 	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
4016 
4017 	/* Adjust the desired TX power level. */
4018 	if (conf->power_level != 0) {
4019 		if (conf->power_level != phy->desired_txpower) {
4020 			phy->desired_txpower = conf->power_level;
4021 			b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
4022 						   B43_TXPWR_IGNORE_TSSI);
4023 		}
4024 	}
4025 
4026 	/* Antennas for RX and management frame TX. */
4027 	antenna = B43_ANTENNA_DEFAULT;
4028 	b43_mgmtframe_txantenna(dev, antenna);
4029 	antenna = B43_ANTENNA_DEFAULT;
4030 	if (phy->ops->set_rx_antenna)
4031 		phy->ops->set_rx_antenna(dev, antenna);
4032 
4033 	if (wl->radio_enabled != phy->radio_on) {
4034 		if (wl->radio_enabled) {
4035 			b43_software_rfkill(dev, false);
4036 			b43info(dev->wl, "Radio turned on by software\n");
4037 			if (!dev->radio_hw_enable) {
4038 				b43info(dev->wl, "The hardware RF-kill button "
4039 					"still turns the radio physically off. "
4040 					"Press the button to turn it on.\n");
4041 			}
4042 		} else {
4043 			b43_software_rfkill(dev, true);
4044 			b43info(dev->wl, "Radio turned off by software\n");
4045 		}
4046 	}
4047 
4048 out_mac_enable:
4049 	b43_mac_enable(dev);
4050 	mutex_unlock(&wl->mutex);
4051 
4052 	return err;
4053 }
4054 
4055 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
4056 {
4057 	struct ieee80211_supported_band *sband =
4058 		dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
4059 	const struct ieee80211_rate *rate;
4060 	int i;
4061 	u16 basic, direct, offset, basic_offset, rateptr;
4062 
4063 	for (i = 0; i < sband->n_bitrates; i++) {
4064 		rate = &sband->bitrates[i];
4065 
4066 		if (b43_is_cck_rate(rate->hw_value)) {
4067 			direct = B43_SHM_SH_CCKDIRECT;
4068 			basic = B43_SHM_SH_CCKBASIC;
4069 			offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4070 			offset &= 0xF;
4071 		} else {
4072 			direct = B43_SHM_SH_OFDMDIRECT;
4073 			basic = B43_SHM_SH_OFDMBASIC;
4074 			offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4075 			offset &= 0xF;
4076 		}
4077 
4078 		rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4079 
4080 		if (b43_is_cck_rate(rate->hw_value)) {
4081 			basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4082 			basic_offset &= 0xF;
4083 		} else {
4084 			basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4085 			basic_offset &= 0xF;
4086 		}
4087 
4088 		/*
4089 		 * Get the pointer that we need to point to
4090 		 * from the direct map
4091 		 */
4092 		rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4093 					 direct + 2 * basic_offset);
4094 		/* and write it to the basic map */
4095 		b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4096 				rateptr);
4097 	}
4098 }
4099 
4100 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4101 				    struct ieee80211_vif *vif,
4102 				    struct ieee80211_bss_conf *conf,
4103 				    u64 changed)
4104 {
4105 	struct b43_wl *wl = hw_to_b43_wl(hw);
4106 	struct b43_wldev *dev;
4107 
4108 	mutex_lock(&wl->mutex);
4109 
4110 	dev = wl->current_dev;
4111 	if (!dev || b43_status(dev) < B43_STAT_STARTED)
4112 		goto out_unlock_mutex;
4113 
4114 	B43_WARN_ON(wl->vif != vif);
4115 
4116 	if (changed & BSS_CHANGED_BSSID) {
4117 		if (conf->bssid)
4118 			memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4119 		else
4120 			eth_zero_addr(wl->bssid);
4121 	}
4122 
4123 	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4124 		if (changed & BSS_CHANGED_BEACON &&
4125 		    (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4126 		     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4127 		     b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4128 			b43_update_templates(wl);
4129 
4130 		if (changed & BSS_CHANGED_BSSID)
4131 			b43_write_mac_bssid_templates(dev);
4132 	}
4133 
4134 	b43_mac_suspend(dev);
4135 
4136 	/* Update templates for AP/mesh mode. */
4137 	if (changed & BSS_CHANGED_BEACON_INT &&
4138 	    (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4139 	     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4140 	     b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4141 	    conf->beacon_int)
4142 		b43_set_beacon_int(dev, conf->beacon_int);
4143 
4144 	if (changed & BSS_CHANGED_BASIC_RATES)
4145 		b43_update_basic_rates(dev, conf->basic_rates);
4146 
4147 	if (changed & BSS_CHANGED_ERP_SLOT) {
4148 		if (conf->use_short_slot)
4149 			b43_short_slot_timing_enable(dev);
4150 		else
4151 			b43_short_slot_timing_disable(dev);
4152 	}
4153 
4154 	b43_mac_enable(dev);
4155 out_unlock_mutex:
4156 	mutex_unlock(&wl->mutex);
4157 }
4158 
4159 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4160 			  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4161 			  struct ieee80211_key_conf *key)
4162 {
4163 	struct b43_wl *wl = hw_to_b43_wl(hw);
4164 	struct b43_wldev *dev;
4165 	u8 algorithm;
4166 	u8 index;
4167 	int err;
4168 	static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4169 
4170 	if (modparam_nohwcrypt)
4171 		return -ENOSPC; /* User disabled HW-crypto */
4172 
4173 	if ((vif->type == NL80211_IFTYPE_ADHOC ||
4174 	     vif->type == NL80211_IFTYPE_MESH_POINT) &&
4175 	    (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4176 	     key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4177 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4178 		/*
4179 		 * For now, disable hw crypto for the RSN IBSS group keys. This
4180 		 * could be optimized in the future, but until that gets
4181 		 * implemented, use of software crypto for group addressed
4182 		 * frames is a acceptable to allow RSN IBSS to be used.
4183 		 */
4184 		return -EOPNOTSUPP;
4185 	}
4186 
4187 	mutex_lock(&wl->mutex);
4188 
4189 	dev = wl->current_dev;
4190 	err = -ENODEV;
4191 	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4192 		goto out_unlock;
4193 
4194 	if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4195 		/* We don't have firmware for the crypto engine.
4196 		 * Must use software-crypto. */
4197 		err = -EOPNOTSUPP;
4198 		goto out_unlock;
4199 	}
4200 
4201 	err = -EINVAL;
4202 	switch (key->cipher) {
4203 	case WLAN_CIPHER_SUITE_WEP40:
4204 		algorithm = B43_SEC_ALGO_WEP40;
4205 		break;
4206 	case WLAN_CIPHER_SUITE_WEP104:
4207 		algorithm = B43_SEC_ALGO_WEP104;
4208 		break;
4209 	case WLAN_CIPHER_SUITE_TKIP:
4210 		algorithm = B43_SEC_ALGO_TKIP;
4211 		break;
4212 	case WLAN_CIPHER_SUITE_CCMP:
4213 		algorithm = B43_SEC_ALGO_AES;
4214 		break;
4215 	default:
4216 		B43_WARN_ON(1);
4217 		goto out_unlock;
4218 	}
4219 	index = (u8) (key->keyidx);
4220 	if (index > 3)
4221 		goto out_unlock;
4222 
4223 	switch (cmd) {
4224 	case SET_KEY:
4225 		if (algorithm == B43_SEC_ALGO_TKIP &&
4226 		    (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4227 		    !modparam_hwtkip)) {
4228 			/* We support only pairwise key */
4229 			err = -EOPNOTSUPP;
4230 			goto out_unlock;
4231 		}
4232 
4233 		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4234 			if (WARN_ON(!sta)) {
4235 				err = -EOPNOTSUPP;
4236 				goto out_unlock;
4237 			}
4238 			/* Pairwise key with an assigned MAC address. */
4239 			err = b43_key_write(dev, -1, algorithm,
4240 					    key->key, key->keylen,
4241 					    sta->addr, key);
4242 		} else {
4243 			/* Group key */
4244 			err = b43_key_write(dev, index, algorithm,
4245 					    key->key, key->keylen, NULL, key);
4246 		}
4247 		if (err)
4248 			goto out_unlock;
4249 
4250 		if (algorithm == B43_SEC_ALGO_WEP40 ||
4251 		    algorithm == B43_SEC_ALGO_WEP104) {
4252 			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4253 		} else {
4254 			b43_hf_write(dev,
4255 				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4256 		}
4257 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4258 		if (algorithm == B43_SEC_ALGO_TKIP)
4259 			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4260 		break;
4261 	case DISABLE_KEY: {
4262 		err = b43_key_clear(dev, key->hw_key_idx);
4263 		if (err)
4264 			goto out_unlock;
4265 		break;
4266 	}
4267 	default:
4268 		B43_WARN_ON(1);
4269 	}
4270 
4271 out_unlock:
4272 	if (!err) {
4273 		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4274 		       "mac: %pM\n",
4275 		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4276 		       sta ? sta->addr : bcast_addr);
4277 		b43_dump_keymemory(dev);
4278 	}
4279 	mutex_unlock(&wl->mutex);
4280 
4281 	return err;
4282 }
4283 
4284 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4285 				    unsigned int changed, unsigned int *fflags,
4286 				    u64 multicast)
4287 {
4288 	struct b43_wl *wl = hw_to_b43_wl(hw);
4289 	struct b43_wldev *dev;
4290 
4291 	mutex_lock(&wl->mutex);
4292 	dev = wl->current_dev;
4293 	if (!dev) {
4294 		*fflags = 0;
4295 		goto out_unlock;
4296 	}
4297 
4298 	*fflags &= FIF_ALLMULTI |
4299 		  FIF_FCSFAIL |
4300 		  FIF_PLCPFAIL |
4301 		  FIF_CONTROL |
4302 		  FIF_OTHER_BSS |
4303 		  FIF_BCN_PRBRESP_PROMISC;
4304 
4305 	changed &= FIF_ALLMULTI |
4306 		   FIF_FCSFAIL |
4307 		   FIF_PLCPFAIL |
4308 		   FIF_CONTROL |
4309 		   FIF_OTHER_BSS |
4310 		   FIF_BCN_PRBRESP_PROMISC;
4311 
4312 	wl->filter_flags = *fflags;
4313 
4314 	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4315 		b43_adjust_opmode(dev);
4316 
4317 out_unlock:
4318 	mutex_unlock(&wl->mutex);
4319 }
4320 
4321 /* Locking: wl->mutex
4322  * Returns the current dev. This might be different from the passed in dev,
4323  * because the core might be gone away while we unlocked the mutex. */
4324 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4325 {
4326 	struct b43_wl *wl;
4327 	struct b43_wldev *orig_dev;
4328 	u32 mask;
4329 	int queue_num;
4330 
4331 	if (!dev)
4332 		return NULL;
4333 	wl = dev->wl;
4334 redo:
4335 	if (!dev || b43_status(dev) < B43_STAT_STARTED)
4336 		return dev;
4337 
4338 	/* Cancel work. Unlock to avoid deadlocks. */
4339 	mutex_unlock(&wl->mutex);
4340 	cancel_delayed_work_sync(&dev->periodic_work);
4341 	cancel_work_sync(&wl->tx_work);
4342 	b43_leds_stop(dev);
4343 	mutex_lock(&wl->mutex);
4344 	dev = wl->current_dev;
4345 	if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4346 		/* Whoops, aliens ate up the device while we were unlocked. */
4347 		return dev;
4348 	}
4349 
4350 	/* Disable interrupts on the device. */
4351 	b43_set_status(dev, B43_STAT_INITIALIZED);
4352 	if (b43_bus_host_is_sdio(dev->dev)) {
4353 		/* wl->mutex is locked. That is enough. */
4354 		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4355 		b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* Flush */
4356 	} else {
4357 		spin_lock_irq(&wl->hardirq_lock);
4358 		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4359 		b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* Flush */
4360 		spin_unlock_irq(&wl->hardirq_lock);
4361 	}
4362 	/* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4363 	orig_dev = dev;
4364 	mutex_unlock(&wl->mutex);
4365 	if (b43_bus_host_is_sdio(dev->dev))
4366 		b43_sdio_free_irq(dev);
4367 	else
4368 		free_irq(dev->dev->irq, dev);
4369 	mutex_lock(&wl->mutex);
4370 	dev = wl->current_dev;
4371 	if (!dev)
4372 		return dev;
4373 	if (dev != orig_dev) {
4374 		if (b43_status(dev) >= B43_STAT_STARTED)
4375 			goto redo;
4376 		return dev;
4377 	}
4378 	mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4379 	B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4380 
4381 	/* Drain all TX queues. */
4382 	for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4383 		while (skb_queue_len(&wl->tx_queue[queue_num])) {
4384 			struct sk_buff *skb;
4385 
4386 			skb = skb_dequeue(&wl->tx_queue[queue_num]);
4387 			ieee80211_free_txskb(wl->hw, skb);
4388 		}
4389 	}
4390 
4391 	b43_mac_suspend(dev);
4392 	b43_leds_exit(dev);
4393 	b43dbg(wl, "Wireless interface stopped\n");
4394 
4395 	return dev;
4396 }
4397 
4398 /* Locking: wl->mutex */
4399 static int b43_wireless_core_start(struct b43_wldev *dev)
4400 {
4401 	int err;
4402 
4403 	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4404 
4405 	drain_txstatus_queue(dev);
4406 	if (b43_bus_host_is_sdio(dev->dev)) {
4407 		err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4408 		if (err) {
4409 			b43err(dev->wl, "Cannot request SDIO IRQ\n");
4410 			goto out;
4411 		}
4412 	} else {
4413 		err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4414 					   b43_interrupt_thread_handler,
4415 					   IRQF_SHARED, KBUILD_MODNAME, dev);
4416 		if (err) {
4417 			b43err(dev->wl, "Cannot request IRQ-%d\n",
4418 			       dev->dev->irq);
4419 			goto out;
4420 		}
4421 	}
4422 
4423 	/* We are ready to run. */
4424 	ieee80211_wake_queues(dev->wl->hw);
4425 	b43_set_status(dev, B43_STAT_STARTED);
4426 
4427 	/* Start data flow (TX/RX). */
4428 	b43_mac_enable(dev);
4429 	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4430 
4431 	/* Start maintenance work */
4432 	b43_periodic_tasks_setup(dev);
4433 
4434 	b43_leds_init(dev);
4435 
4436 	b43dbg(dev->wl, "Wireless interface started\n");
4437 out:
4438 	return err;
4439 }
4440 
4441 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4442 {
4443 	switch (phy_type) {
4444 	case B43_PHYTYPE_A:
4445 		return "A";
4446 	case B43_PHYTYPE_B:
4447 		return "B";
4448 	case B43_PHYTYPE_G:
4449 		return "G";
4450 	case B43_PHYTYPE_N:
4451 		return "N";
4452 	case B43_PHYTYPE_LP:
4453 		return "LP";
4454 	case B43_PHYTYPE_SSLPN:
4455 		return "SSLPN";
4456 	case B43_PHYTYPE_HT:
4457 		return "HT";
4458 	case B43_PHYTYPE_LCN:
4459 		return "LCN";
4460 	case B43_PHYTYPE_LCNXN:
4461 		return "LCNXN";
4462 	case B43_PHYTYPE_LCN40:
4463 		return "LCN40";
4464 	case B43_PHYTYPE_AC:
4465 		return "AC";
4466 	}
4467 	return "UNKNOWN";
4468 }
4469 
4470 /* Get PHY and RADIO versioning numbers */
4471 static int b43_phy_versioning(struct b43_wldev *dev)
4472 {
4473 	struct b43_phy *phy = &dev->phy;
4474 	const u8 core_rev = dev->dev->core_rev;
4475 	u32 tmp;
4476 	u8 analog_type;
4477 	u8 phy_type;
4478 	u8 phy_rev;
4479 	u16 radio_manuf;
4480 	u16 radio_id;
4481 	u16 radio_rev;
4482 	u8 radio_ver;
4483 	int unsupported = 0;
4484 
4485 	/* Get PHY versioning */
4486 	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4487 	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4488 	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4489 	phy_rev = (tmp & B43_PHYVER_VERSION);
4490 
4491 	/* LCNXN is continuation of N which run out of revisions */
4492 	if (phy_type == B43_PHYTYPE_LCNXN) {
4493 		phy_type = B43_PHYTYPE_N;
4494 		phy_rev += 16;
4495 	}
4496 
4497 	switch (phy_type) {
4498 #ifdef CONFIG_B43_PHY_G
4499 	case B43_PHYTYPE_G:
4500 		if (phy_rev > 9)
4501 			unsupported = 1;
4502 		break;
4503 #endif
4504 #ifdef CONFIG_B43_PHY_N
4505 	case B43_PHYTYPE_N:
4506 		if (phy_rev >= 19)
4507 			unsupported = 1;
4508 		break;
4509 #endif
4510 #ifdef CONFIG_B43_PHY_LP
4511 	case B43_PHYTYPE_LP:
4512 		if (phy_rev > 2)
4513 			unsupported = 1;
4514 		break;
4515 #endif
4516 #ifdef CONFIG_B43_PHY_HT
4517 	case B43_PHYTYPE_HT:
4518 		if (phy_rev > 1)
4519 			unsupported = 1;
4520 		break;
4521 #endif
4522 #ifdef CONFIG_B43_PHY_LCN
4523 	case B43_PHYTYPE_LCN:
4524 		if (phy_rev > 1)
4525 			unsupported = 1;
4526 		break;
4527 #endif
4528 #ifdef CONFIG_B43_PHY_AC
4529 	case B43_PHYTYPE_AC:
4530 		if (phy_rev > 1)
4531 			unsupported = 1;
4532 		break;
4533 #endif
4534 	default:
4535 		unsupported = 1;
4536 	}
4537 	if (unsupported) {
4538 		b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4539 		       analog_type, phy_type, b43_phy_name(dev, phy_type),
4540 		       phy_rev);
4541 		return -EOPNOTSUPP;
4542 	}
4543 	b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4544 		analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4545 
4546 	/* Get RADIO versioning */
4547 	if (core_rev == 40 || core_rev == 42) {
4548 		radio_manuf = 0x17F;
4549 
4550 		b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 0);
4551 		radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4552 
4553 		b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 1);
4554 		radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4555 
4556 		radio_ver = 0; /* Is there version somewhere? */
4557 	} else if (core_rev >= 24) {
4558 		u16 radio24[3];
4559 
4560 		for (tmp = 0; tmp < 3; tmp++) {
4561 			b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4562 			radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4563 		}
4564 
4565 		radio_manuf = 0x17F;
4566 		radio_id = (radio24[2] << 8) | radio24[1];
4567 		radio_rev = (radio24[0] & 0xF);
4568 		radio_ver = (radio24[0] & 0xF0) >> 4;
4569 	} else {
4570 		if (dev->dev->chip_id == 0x4317) {
4571 			if (dev->dev->chip_rev == 0)
4572 				tmp = 0x3205017F;
4573 			else if (dev->dev->chip_rev == 1)
4574 				tmp = 0x4205017F;
4575 			else
4576 				tmp = 0x5205017F;
4577 		} else {
4578 			b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4579 				     B43_RADIOCTL_ID);
4580 			tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4581 			b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4582 				     B43_RADIOCTL_ID);
4583 			tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4584 		}
4585 		radio_manuf = (tmp & 0x00000FFF);
4586 		radio_id = (tmp & 0x0FFFF000) >> 12;
4587 		radio_rev = (tmp & 0xF0000000) >> 28;
4588 		radio_ver = 0; /* Probably not available on old hw */
4589 	}
4590 
4591 	if (radio_manuf != 0x17F /* Broadcom */)
4592 		unsupported = 1;
4593 	switch (phy_type) {
4594 	case B43_PHYTYPE_B:
4595 		if ((radio_id & 0xFFF0) != 0x2050)
4596 			unsupported = 1;
4597 		break;
4598 	case B43_PHYTYPE_G:
4599 		if (radio_id != 0x2050)
4600 			unsupported = 1;
4601 		break;
4602 	case B43_PHYTYPE_N:
4603 		if (radio_id != 0x2055 && radio_id != 0x2056 &&
4604 		    radio_id != 0x2057)
4605 			unsupported = 1;
4606 		if (radio_id == 0x2057 &&
4607 		    !(radio_rev == 9 || radio_rev == 14))
4608 			unsupported = 1;
4609 		break;
4610 	case B43_PHYTYPE_LP:
4611 		if (radio_id != 0x2062 && radio_id != 0x2063)
4612 			unsupported = 1;
4613 		break;
4614 	case B43_PHYTYPE_HT:
4615 		if (radio_id != 0x2059)
4616 			unsupported = 1;
4617 		break;
4618 	case B43_PHYTYPE_LCN:
4619 		if (radio_id != 0x2064)
4620 			unsupported = 1;
4621 		break;
4622 	case B43_PHYTYPE_AC:
4623 		if (radio_id != 0x2069)
4624 			unsupported = 1;
4625 		break;
4626 	default:
4627 		B43_WARN_ON(1);
4628 	}
4629 	if (unsupported) {
4630 		b43err(dev->wl,
4631 		       "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4632 		       radio_manuf, radio_id, radio_rev, radio_ver);
4633 		return -EOPNOTSUPP;
4634 	}
4635 	b43info(dev->wl,
4636 		"Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4637 		radio_manuf, radio_id, radio_rev, radio_ver);
4638 
4639 	/* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4640 	phy->radio_manuf = radio_manuf;
4641 	phy->radio_ver = radio_id;
4642 	phy->radio_rev = radio_rev;
4643 
4644 	phy->analog = analog_type;
4645 	phy->type = phy_type;
4646 	phy->rev = phy_rev;
4647 
4648 	return 0;
4649 }
4650 
4651 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4652 				      struct b43_phy *phy)
4653 {
4654 	phy->hardware_power_control = !!modparam_hwpctl;
4655 	phy->next_txpwr_check_time = jiffies;
4656 	/* PHY TX errors counter. */
4657 	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4658 
4659 #if B43_DEBUG
4660 	phy->phy_locked = false;
4661 	phy->radio_locked = false;
4662 #endif
4663 }
4664 
4665 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4666 {
4667 	dev->dfq_valid = false;
4668 
4669 	/* Assume the radio is enabled. If it's not enabled, the state will
4670 	 * immediately get fixed on the first periodic work run. */
4671 	dev->radio_hw_enable = true;
4672 
4673 	/* Stats */
4674 	memset(&dev->stats, 0, sizeof(dev->stats));
4675 
4676 	setup_struct_phy_for_init(dev, &dev->phy);
4677 
4678 	/* IRQ related flags */
4679 	dev->irq_reason = 0;
4680 	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4681 	dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4682 	if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4683 		dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4684 
4685 	dev->mac_suspended = 1;
4686 
4687 	/* Noise calculation context */
4688 	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4689 }
4690 
4691 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4692 {
4693 	struct ssb_sprom *sprom = dev->dev->bus_sprom;
4694 	u64 hf;
4695 
4696 	if (!modparam_btcoex)
4697 		return;
4698 	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4699 		return;
4700 	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4701 		return;
4702 
4703 	hf = b43_hf_read(dev);
4704 	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4705 		hf |= B43_HF_BTCOEXALT;
4706 	else
4707 		hf |= B43_HF_BTCOEX;
4708 	b43_hf_write(dev, hf);
4709 }
4710 
4711 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4712 {
4713 	if (!modparam_btcoex)
4714 		return;
4715 	//TODO
4716 }
4717 
4718 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4719 {
4720 	struct ssb_bus *bus;
4721 	u32 tmp;
4722 
4723 #ifdef CONFIG_B43_SSB
4724 	if (dev->dev->bus_type != B43_BUS_SSB)
4725 		return;
4726 #else
4727 	return;
4728 #endif
4729 
4730 	bus = dev->dev->sdev->bus;
4731 
4732 	if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4733 	    (bus->chip_id == 0x4312)) {
4734 		tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4735 		tmp &= ~SSB_IMCFGLO_REQTO;
4736 		tmp &= ~SSB_IMCFGLO_SERTO;
4737 		tmp |= 0x3;
4738 		ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4739 		ssb_commit_settings(bus);
4740 	}
4741 }
4742 
4743 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4744 {
4745 	u16 pu_delay;
4746 
4747 	/* The time value is in microseconds. */
4748 	pu_delay = 1050;
4749 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4750 		pu_delay = 500;
4751 	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4752 		pu_delay = max(pu_delay, (u16)2400);
4753 
4754 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4755 }
4756 
4757 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4758 static void b43_set_pretbtt(struct b43_wldev *dev)
4759 {
4760 	u16 pretbtt;
4761 
4762 	/* The time value is in microseconds. */
4763 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
4764 		pretbtt = 2;
4765 	else
4766 		pretbtt = 250;
4767 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4768 	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4769 }
4770 
4771 /* Shutdown a wireless core */
4772 /* Locking: wl->mutex */
4773 static void b43_wireless_core_exit(struct b43_wldev *dev)
4774 {
4775 	B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4776 	if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4777 		return;
4778 
4779 	b43_set_status(dev, B43_STAT_UNINIT);
4780 
4781 	/* Stop the microcode PSM. */
4782 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4783 		      B43_MACCTL_PSM_JMP0);
4784 
4785 	switch (dev->dev->bus_type) {
4786 #ifdef CONFIG_B43_BCMA
4787 	case B43_BUS_BCMA:
4788 		bcma_host_pci_down(dev->dev->bdev->bus);
4789 		break;
4790 #endif
4791 #ifdef CONFIG_B43_SSB
4792 	case B43_BUS_SSB:
4793 		/* TODO */
4794 		break;
4795 #endif
4796 	}
4797 
4798 	b43_dma_free(dev);
4799 	b43_pio_free(dev);
4800 	b43_chip_exit(dev);
4801 	dev->phy.ops->switch_analog(dev, 0);
4802 	if (dev->wl->current_beacon) {
4803 		dev_kfree_skb_any(dev->wl->current_beacon);
4804 		dev->wl->current_beacon = NULL;
4805 	}
4806 
4807 	b43_device_disable(dev, 0);
4808 	b43_bus_may_powerdown(dev);
4809 }
4810 
4811 /* Initialize a wireless core */
4812 static int b43_wireless_core_init(struct b43_wldev *dev)
4813 {
4814 	struct ssb_sprom *sprom = dev->dev->bus_sprom;
4815 	struct b43_phy *phy = &dev->phy;
4816 	int err;
4817 	u64 hf;
4818 
4819 	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4820 
4821 	err = b43_bus_powerup(dev, 0);
4822 	if (err)
4823 		goto out;
4824 	if (!b43_device_is_enabled(dev))
4825 		b43_wireless_core_reset(dev, phy->gmode);
4826 
4827 	/* Reset all data structures. */
4828 	setup_struct_wldev_for_init(dev);
4829 	phy->ops->prepare_structs(dev);
4830 
4831 	/* Enable IRQ routing to this device. */
4832 	switch (dev->dev->bus_type) {
4833 #ifdef CONFIG_B43_BCMA
4834 	case B43_BUS_BCMA:
4835 		bcma_host_pci_irq_ctl(dev->dev->bdev->bus,
4836 				      dev->dev->bdev, true);
4837 		bcma_host_pci_up(dev->dev->bdev->bus);
4838 		break;
4839 #endif
4840 #ifdef CONFIG_B43_SSB
4841 	case B43_BUS_SSB:
4842 		ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4843 					       dev->dev->sdev);
4844 		break;
4845 #endif
4846 	}
4847 
4848 	b43_imcfglo_timeouts_workaround(dev);
4849 	b43_bluetooth_coext_disable(dev);
4850 	if (phy->ops->prepare_hardware) {
4851 		err = phy->ops->prepare_hardware(dev);
4852 		if (err)
4853 			goto err_busdown;
4854 	}
4855 	err = b43_chip_init(dev);
4856 	if (err)
4857 		goto err_busdown;
4858 	b43_shm_write16(dev, B43_SHM_SHARED,
4859 			B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4860 	hf = b43_hf_read(dev);
4861 	if (phy->type == B43_PHYTYPE_G) {
4862 		hf |= B43_HF_SYMW;
4863 		if (phy->rev == 1)
4864 			hf |= B43_HF_GDCW;
4865 		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4866 			hf |= B43_HF_OFDMPABOOST;
4867 	}
4868 	if (phy->radio_ver == 0x2050) {
4869 		if (phy->radio_rev == 6)
4870 			hf |= B43_HF_4318TSSI;
4871 		if (phy->radio_rev < 6)
4872 			hf |= B43_HF_VCORECALC;
4873 	}
4874 	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4875 		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4876 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4877 	if (dev->dev->bus_type == B43_BUS_SSB &&
4878 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4879 	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4880 		hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4881 #endif
4882 	hf &= ~B43_HF_SKCFPUP;
4883 	b43_hf_write(dev, hf);
4884 
4885 	/* tell the ucode MAC capabilities */
4886 	if (dev->dev->core_rev >= 13) {
4887 		u32 mac_hw_cap = b43_read32(dev, B43_MMIO_MAC_HW_CAP);
4888 
4889 		b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_L,
4890 				mac_hw_cap & 0xffff);
4891 		b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_H,
4892 				(mac_hw_cap >> 16) & 0xffff);
4893 	}
4894 
4895 	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4896 			     B43_DEFAULT_LONG_RETRY_LIMIT);
4897 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4898 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4899 
4900 	/* Disable sending probe responses from firmware.
4901 	 * Setting the MaxTime to one usec will always trigger
4902 	 * a timeout, so we never send any probe resp.
4903 	 * A timeout of zero is infinite. */
4904 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4905 
4906 	b43_rate_memory_init(dev);
4907 	b43_set_phytxctl_defaults(dev);
4908 
4909 	/* Minimum Contention Window */
4910 	if (phy->type == B43_PHYTYPE_B)
4911 		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4912 	else
4913 		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4914 	/* Maximum Contention Window */
4915 	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4916 
4917 	/* write phytype and phyvers */
4918 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYTYPE, phy->type);
4919 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYVER, phy->rev);
4920 
4921 	if (b43_bus_host_is_pcmcia(dev->dev) ||
4922 	    b43_bus_host_is_sdio(dev->dev)) {
4923 		dev->__using_pio_transfers = true;
4924 		err = b43_pio_init(dev);
4925 	} else if (dev->use_pio) {
4926 		b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4927 			"This should not be needed and will result in lower "
4928 			"performance.\n");
4929 		dev->__using_pio_transfers = true;
4930 		err = b43_pio_init(dev);
4931 	} else {
4932 		dev->__using_pio_transfers = false;
4933 		err = b43_dma_init(dev);
4934 	}
4935 	if (err)
4936 		goto err_chip_exit;
4937 	b43_qos_init(dev);
4938 	b43_set_synth_pu_delay(dev, 1);
4939 	b43_bluetooth_coext_enable(dev);
4940 
4941 	b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4942 	b43_upload_card_macaddress(dev);
4943 	b43_security_init(dev);
4944 
4945 	ieee80211_wake_queues(dev->wl->hw);
4946 
4947 	b43_set_status(dev, B43_STAT_INITIALIZED);
4948 
4949 out:
4950 	return err;
4951 
4952 err_chip_exit:
4953 	b43_chip_exit(dev);
4954 err_busdown:
4955 	b43_bus_may_powerdown(dev);
4956 	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4957 	return err;
4958 }
4959 
4960 static int b43_op_add_interface(struct ieee80211_hw *hw,
4961 				struct ieee80211_vif *vif)
4962 {
4963 	struct b43_wl *wl = hw_to_b43_wl(hw);
4964 	struct b43_wldev *dev;
4965 	int err = -EOPNOTSUPP;
4966 
4967 	/* TODO: allow AP devices to coexist */
4968 
4969 	if (vif->type != NL80211_IFTYPE_AP &&
4970 	    vif->type != NL80211_IFTYPE_MESH_POINT &&
4971 	    vif->type != NL80211_IFTYPE_STATION &&
4972 	    vif->type != NL80211_IFTYPE_ADHOC)
4973 		return -EOPNOTSUPP;
4974 
4975 	mutex_lock(&wl->mutex);
4976 	if (wl->operating)
4977 		goto out_mutex_unlock;
4978 
4979 	b43dbg(wl, "Adding Interface type %d\n", vif->type);
4980 
4981 	dev = wl->current_dev;
4982 	wl->operating = true;
4983 	wl->vif = vif;
4984 	wl->if_type = vif->type;
4985 	memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
4986 
4987 	b43_adjust_opmode(dev);
4988 	b43_set_pretbtt(dev);
4989 	b43_set_synth_pu_delay(dev, 0);
4990 	b43_upload_card_macaddress(dev);
4991 
4992 	err = 0;
4993  out_mutex_unlock:
4994 	mutex_unlock(&wl->mutex);
4995 
4996 	if (err == 0)
4997 		b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
4998 
4999 	return err;
5000 }
5001 
5002 static void b43_op_remove_interface(struct ieee80211_hw *hw,
5003 				    struct ieee80211_vif *vif)
5004 {
5005 	struct b43_wl *wl = hw_to_b43_wl(hw);
5006 	struct b43_wldev *dev = wl->current_dev;
5007 
5008 	b43dbg(wl, "Removing Interface type %d\n", vif->type);
5009 
5010 	mutex_lock(&wl->mutex);
5011 
5012 	B43_WARN_ON(!wl->operating);
5013 	B43_WARN_ON(wl->vif != vif);
5014 	wl->vif = NULL;
5015 
5016 	wl->operating = false;
5017 
5018 	b43_adjust_opmode(dev);
5019 	eth_zero_addr(wl->mac_addr);
5020 	b43_upload_card_macaddress(dev);
5021 
5022 	mutex_unlock(&wl->mutex);
5023 }
5024 
5025 static int b43_op_start(struct ieee80211_hw *hw)
5026 {
5027 	struct b43_wl *wl = hw_to_b43_wl(hw);
5028 	struct b43_wldev *dev = wl->current_dev;
5029 	int did_init = 0;
5030 	int err = 0;
5031 
5032 	/* Kill all old instance specific information to make sure
5033 	 * the card won't use it in the short timeframe between start
5034 	 * and mac80211 reconfiguring it. */
5035 	eth_zero_addr(wl->bssid);
5036 	eth_zero_addr(wl->mac_addr);
5037 	wl->filter_flags = 0;
5038 	wl->radiotap_enabled = false;
5039 	b43_qos_clear(wl);
5040 	wl->beacon0_uploaded = false;
5041 	wl->beacon1_uploaded = false;
5042 	wl->beacon_templates_virgin = true;
5043 	wl->radio_enabled = true;
5044 
5045 	mutex_lock(&wl->mutex);
5046 
5047 	if (b43_status(dev) < B43_STAT_INITIALIZED) {
5048 		err = b43_wireless_core_init(dev);
5049 		if (err)
5050 			goto out_mutex_unlock;
5051 		did_init = 1;
5052 	}
5053 
5054 	if (b43_status(dev) < B43_STAT_STARTED) {
5055 		err = b43_wireless_core_start(dev);
5056 		if (err) {
5057 			if (did_init)
5058 				b43_wireless_core_exit(dev);
5059 			goto out_mutex_unlock;
5060 		}
5061 	}
5062 
5063 	/* XXX: only do if device doesn't support rfkill irq */
5064 	wiphy_rfkill_start_polling(hw->wiphy);
5065 
5066  out_mutex_unlock:
5067 	mutex_unlock(&wl->mutex);
5068 
5069 	/*
5070 	 * Configuration may have been overwritten during initialization.
5071 	 * Reload the configuration, but only if initialization was
5072 	 * successful. Reloading the configuration after a failed init
5073 	 * may hang the system.
5074 	 */
5075 	if (!err)
5076 		b43_op_config(hw, ~0);
5077 
5078 	return err;
5079 }
5080 
5081 static void b43_op_stop(struct ieee80211_hw *hw)
5082 {
5083 	struct b43_wl *wl = hw_to_b43_wl(hw);
5084 	struct b43_wldev *dev = wl->current_dev;
5085 
5086 	cancel_work_sync(&(wl->beacon_update_trigger));
5087 
5088 	if (!dev)
5089 		goto out;
5090 
5091 	mutex_lock(&wl->mutex);
5092 	if (b43_status(dev) >= B43_STAT_STARTED) {
5093 		dev = b43_wireless_core_stop(dev);
5094 		if (!dev)
5095 			goto out_unlock;
5096 	}
5097 	b43_wireless_core_exit(dev);
5098 	wl->radio_enabled = false;
5099 
5100 out_unlock:
5101 	mutex_unlock(&wl->mutex);
5102 out:
5103 	cancel_work_sync(&(wl->txpower_adjust_work));
5104 }
5105 
5106 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5107 				 struct ieee80211_sta *sta, bool set)
5108 {
5109 	struct b43_wl *wl = hw_to_b43_wl(hw);
5110 
5111 	b43_update_templates(wl);
5112 
5113 	return 0;
5114 }
5115 
5116 static void b43_op_sta_notify(struct ieee80211_hw *hw,
5117 			      struct ieee80211_vif *vif,
5118 			      enum sta_notify_cmd notify_cmd,
5119 			      struct ieee80211_sta *sta)
5120 {
5121 	struct b43_wl *wl = hw_to_b43_wl(hw);
5122 
5123 	B43_WARN_ON(!vif || wl->vif != vif);
5124 }
5125 
5126 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw,
5127 					  struct ieee80211_vif *vif,
5128 					  const u8 *mac_addr)
5129 {
5130 	struct b43_wl *wl = hw_to_b43_wl(hw);
5131 	struct b43_wldev *dev;
5132 
5133 	mutex_lock(&wl->mutex);
5134 	dev = wl->current_dev;
5135 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5136 		/* Disable CFP update during scan on other channels. */
5137 		b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5138 	}
5139 	mutex_unlock(&wl->mutex);
5140 }
5141 
5142 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw,
5143 					     struct ieee80211_vif *vif)
5144 {
5145 	struct b43_wl *wl = hw_to_b43_wl(hw);
5146 	struct b43_wldev *dev;
5147 
5148 	mutex_lock(&wl->mutex);
5149 	dev = wl->current_dev;
5150 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5151 		/* Re-enable CFP update. */
5152 		b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5153 	}
5154 	mutex_unlock(&wl->mutex);
5155 }
5156 
5157 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5158 			     struct survey_info *survey)
5159 {
5160 	struct b43_wl *wl = hw_to_b43_wl(hw);
5161 	struct b43_wldev *dev = wl->current_dev;
5162 	struct ieee80211_conf *conf = &hw->conf;
5163 
5164 	if (idx != 0)
5165 		return -ENOENT;
5166 
5167 	survey->channel = conf->chandef.chan;
5168 	survey->filled = SURVEY_INFO_NOISE_DBM;
5169 	survey->noise = dev->stats.link_noise;
5170 
5171 	return 0;
5172 }
5173 
5174 static const struct ieee80211_ops b43_hw_ops = {
5175 	.tx			= b43_op_tx,
5176 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
5177 	.conf_tx		= b43_op_conf_tx,
5178 	.add_interface		= b43_op_add_interface,
5179 	.remove_interface	= b43_op_remove_interface,
5180 	.config			= b43_op_config,
5181 	.bss_info_changed	= b43_op_bss_info_changed,
5182 	.configure_filter	= b43_op_configure_filter,
5183 	.set_key		= b43_op_set_key,
5184 	.update_tkip_key	= b43_op_update_tkip_key,
5185 	.get_stats		= b43_op_get_stats,
5186 	.get_tsf		= b43_op_get_tsf,
5187 	.set_tsf		= b43_op_set_tsf,
5188 	.start			= b43_op_start,
5189 	.stop			= b43_op_stop,
5190 	.set_tim		= b43_op_beacon_set_tim,
5191 	.sta_notify		= b43_op_sta_notify,
5192 	.sw_scan_start		= b43_op_sw_scan_start_notifier,
5193 	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
5194 	.get_survey		= b43_op_get_survey,
5195 	.rfkill_poll		= b43_rfkill_poll,
5196 };
5197 
5198 /* Hard-reset the chip. Do not call this directly.
5199  * Use b43_controller_restart()
5200  */
5201 static void b43_chip_reset(struct work_struct *work)
5202 {
5203 	struct b43_wldev *dev =
5204 	    container_of(work, struct b43_wldev, restart_work);
5205 	struct b43_wl *wl = dev->wl;
5206 	int err = 0;
5207 	int prev_status;
5208 
5209 	mutex_lock(&wl->mutex);
5210 
5211 	prev_status = b43_status(dev);
5212 	/* Bring the device down... */
5213 	if (prev_status >= B43_STAT_STARTED) {
5214 		dev = b43_wireless_core_stop(dev);
5215 		if (!dev) {
5216 			err = -ENODEV;
5217 			goto out;
5218 		}
5219 	}
5220 	if (prev_status >= B43_STAT_INITIALIZED)
5221 		b43_wireless_core_exit(dev);
5222 
5223 	/* ...and up again. */
5224 	if (prev_status >= B43_STAT_INITIALIZED) {
5225 		err = b43_wireless_core_init(dev);
5226 		if (err)
5227 			goto out;
5228 	}
5229 	if (prev_status >= B43_STAT_STARTED) {
5230 		err = b43_wireless_core_start(dev);
5231 		if (err) {
5232 			b43_wireless_core_exit(dev);
5233 			goto out;
5234 		}
5235 	}
5236 out:
5237 	if (err)
5238 		wl->current_dev = NULL; /* Failed to init the dev. */
5239 	mutex_unlock(&wl->mutex);
5240 
5241 	if (err) {
5242 		b43err(wl, "Controller restart FAILED\n");
5243 		return;
5244 	}
5245 
5246 	/* reload configuration */
5247 	b43_op_config(wl->hw, ~0);
5248 	if (wl->vif)
5249 		b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5250 
5251 	b43info(wl, "Controller restarted\n");
5252 }
5253 
5254 static int b43_setup_bands(struct b43_wldev *dev,
5255 			   bool have_2ghz_phy, bool have_5ghz_phy)
5256 {
5257 	struct ieee80211_hw *hw = dev->wl->hw;
5258 	struct b43_phy *phy = &dev->phy;
5259 	bool limited_2g;
5260 	bool limited_5g;
5261 
5262 	/* We don't support all 2 GHz channels on some devices */
5263 	limited_2g = phy->radio_ver == 0x2057 &&
5264 		     (phy->radio_rev == 9 || phy->radio_rev == 14);
5265 	limited_5g = phy->radio_ver == 0x2057 &&
5266 		     phy->radio_rev == 9;
5267 
5268 	if (have_2ghz_phy)
5269 		hw->wiphy->bands[NL80211_BAND_2GHZ] = limited_2g ?
5270 			&b43_band_2ghz_limited : &b43_band_2GHz;
5271 	if (dev->phy.type == B43_PHYTYPE_N) {
5272 		if (have_5ghz_phy)
5273 			hw->wiphy->bands[NL80211_BAND_5GHZ] = limited_5g ?
5274 				&b43_band_5GHz_nphy_limited :
5275 				&b43_band_5GHz_nphy;
5276 	} else {
5277 		if (have_5ghz_phy)
5278 			hw->wiphy->bands[NL80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5279 	}
5280 
5281 	dev->phy.supports_2ghz = have_2ghz_phy;
5282 	dev->phy.supports_5ghz = have_5ghz_phy;
5283 
5284 	return 0;
5285 }
5286 
5287 static void b43_wireless_core_detach(struct b43_wldev *dev)
5288 {
5289 	/* We release firmware that late to not be required to re-request
5290 	 * is all the time when we reinit the core. */
5291 	b43_release_firmware(dev);
5292 	b43_phy_free(dev);
5293 }
5294 
5295 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5296 				bool *have_5ghz_phy)
5297 {
5298 	u16 dev_id = 0;
5299 
5300 #ifdef CONFIG_B43_BCMA
5301 	if (dev->dev->bus_type == B43_BUS_BCMA &&
5302 	    dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5303 		dev_id = dev->dev->bdev->bus->host_pci->device;
5304 #endif
5305 #ifdef CONFIG_B43_SSB
5306 	if (dev->dev->bus_type == B43_BUS_SSB &&
5307 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5308 		dev_id = dev->dev->sdev->bus->host_pci->device;
5309 #endif
5310 	/* Override with SPROM value if available */
5311 	if (dev->dev->bus_sprom->dev_id)
5312 		dev_id = dev->dev->bus_sprom->dev_id;
5313 
5314 	/* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5315 	switch (dev_id) {
5316 	case 0x4324: /* BCM4306 */
5317 	case 0x4312: /* BCM4311 */
5318 	case 0x4319: /* BCM4318 */
5319 	case 0x4328: /* BCM4321 */
5320 	case 0x432b: /* BCM4322 */
5321 	case 0x4350: /* BCM43222 */
5322 	case 0x4353: /* BCM43224 */
5323 	case 0x0576: /* BCM43224 */
5324 	case 0x435f: /* BCM6362 */
5325 	case 0x4331: /* BCM4331 */
5326 	case 0x4359: /* BCM43228 */
5327 	case 0x43a0: /* BCM4360 */
5328 	case 0x43b1: /* BCM4352 */
5329 		/* Dual band devices */
5330 		*have_2ghz_phy = true;
5331 		*have_5ghz_phy = true;
5332 		return;
5333 	case 0x4321: /* BCM4306 */
5334 		/* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
5335 		if (dev->phy.type != B43_PHYTYPE_G)
5336 			break;
5337 		fallthrough;
5338 	case 0x4313: /* BCM4311 */
5339 	case 0x431a: /* BCM4318 */
5340 	case 0x432a: /* BCM4321 */
5341 	case 0x432d: /* BCM4322 */
5342 	case 0x4352: /* BCM43222 */
5343 	case 0x435a: /* BCM43228 */
5344 	case 0x4333: /* BCM4331 */
5345 	case 0x43a2: /* BCM4360 */
5346 	case 0x43b3: /* BCM4352 */
5347 		/* 5 GHz only devices */
5348 		*have_2ghz_phy = false;
5349 		*have_5ghz_phy = true;
5350 		return;
5351 	}
5352 
5353 	/* As a fallback, try to guess using PHY type */
5354 	switch (dev->phy.type) {
5355 	case B43_PHYTYPE_G:
5356 	case B43_PHYTYPE_N:
5357 	case B43_PHYTYPE_LP:
5358 	case B43_PHYTYPE_HT:
5359 	case B43_PHYTYPE_LCN:
5360 		*have_2ghz_phy = true;
5361 		*have_5ghz_phy = false;
5362 		return;
5363 	}
5364 
5365 	B43_WARN_ON(1);
5366 }
5367 
5368 static int b43_wireless_core_attach(struct b43_wldev *dev)
5369 {
5370 	struct b43_wl *wl = dev->wl;
5371 	struct b43_phy *phy = &dev->phy;
5372 	int err;
5373 	u32 tmp;
5374 	bool have_2ghz_phy = false, have_5ghz_phy = false;
5375 
5376 	/* Do NOT do any device initialization here.
5377 	 * Do it in wireless_core_init() instead.
5378 	 * This function is for gathering basic information about the HW, only.
5379 	 * Also some structs may be set up here. But most likely you want to have
5380 	 * that in core_init(), too.
5381 	 */
5382 
5383 	err = b43_bus_powerup(dev, 0);
5384 	if (err) {
5385 		b43err(wl, "Bus powerup failed\n");
5386 		goto out;
5387 	}
5388 
5389 	phy->do_full_init = true;
5390 
5391 	/* Try to guess supported bands for the first init needs */
5392 	switch (dev->dev->bus_type) {
5393 #ifdef CONFIG_B43_BCMA
5394 	case B43_BUS_BCMA:
5395 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5396 		have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5397 		have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5398 		break;
5399 #endif
5400 #ifdef CONFIG_B43_SSB
5401 	case B43_BUS_SSB:
5402 		if (dev->dev->core_rev >= 5) {
5403 			tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5404 			have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5405 			have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5406 		} else
5407 			B43_WARN_ON(1);
5408 		break;
5409 #endif
5410 	}
5411 
5412 	dev->phy.gmode = have_2ghz_phy;
5413 	b43_wireless_core_reset(dev, dev->phy.gmode);
5414 
5415 	/* Get the PHY type. */
5416 	err = b43_phy_versioning(dev);
5417 	if (err)
5418 		goto err_powerdown;
5419 
5420 	/* Get real info about supported bands */
5421 	b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5422 
5423 	/* We don't support 5 GHz on some PHYs yet */
5424 	if (have_5ghz_phy) {
5425 		switch (dev->phy.type) {
5426 		case B43_PHYTYPE_G:
5427 		case B43_PHYTYPE_LP:
5428 		case B43_PHYTYPE_HT:
5429 			b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5430 			have_5ghz_phy = false;
5431 		}
5432 	}
5433 
5434 	if (!have_2ghz_phy && !have_5ghz_phy) {
5435 		b43err(wl, "b43 can't support any band on this device\n");
5436 		err = -EOPNOTSUPP;
5437 		goto err_powerdown;
5438 	}
5439 
5440 	err = b43_phy_allocate(dev);
5441 	if (err)
5442 		goto err_powerdown;
5443 
5444 	dev->phy.gmode = have_2ghz_phy;
5445 	b43_wireless_core_reset(dev, dev->phy.gmode);
5446 
5447 	err = b43_validate_chipaccess(dev);
5448 	if (err)
5449 		goto err_phy_free;
5450 	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5451 	if (err)
5452 		goto err_phy_free;
5453 
5454 	/* Now set some default "current_dev" */
5455 	if (!wl->current_dev)
5456 		wl->current_dev = dev;
5457 	INIT_WORK(&dev->restart_work, b43_chip_reset);
5458 
5459 	dev->phy.ops->switch_analog(dev, 0);
5460 	b43_device_disable(dev, 0);
5461 	b43_bus_may_powerdown(dev);
5462 
5463 out:
5464 	return err;
5465 
5466 err_phy_free:
5467 	b43_phy_free(dev);
5468 err_powerdown:
5469 	b43_bus_may_powerdown(dev);
5470 	return err;
5471 }
5472 
5473 static void b43_one_core_detach(struct b43_bus_dev *dev)
5474 {
5475 	struct b43_wldev *wldev;
5476 
5477 	/* Do not cancel ieee80211-workqueue based work here.
5478 	 * See comment in b43_remove(). */
5479 
5480 	wldev = b43_bus_get_wldev(dev);
5481 	b43_debugfs_remove_device(wldev);
5482 	b43_wireless_core_detach(wldev);
5483 	list_del(&wldev->list);
5484 	b43_bus_set_wldev(dev, NULL);
5485 	kfree(wldev);
5486 }
5487 
5488 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5489 {
5490 	struct b43_wldev *wldev;
5491 	int err = -ENOMEM;
5492 
5493 	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5494 	if (!wldev)
5495 		goto out;
5496 
5497 	wldev->use_pio = b43_modparam_pio;
5498 	wldev->dev = dev;
5499 	wldev->wl = wl;
5500 	b43_set_status(wldev, B43_STAT_UNINIT);
5501 	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5502 	INIT_LIST_HEAD(&wldev->list);
5503 
5504 	err = b43_wireless_core_attach(wldev);
5505 	if (err)
5506 		goto err_kfree_wldev;
5507 
5508 	b43_bus_set_wldev(dev, wldev);
5509 	b43_debugfs_add_device(wldev);
5510 
5511       out:
5512 	return err;
5513 
5514       err_kfree_wldev:
5515 	kfree(wldev);
5516 	return err;
5517 }
5518 
5519 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
5520 	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
5521 	(pdev->device == _device) &&					\
5522 	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
5523 	(pdev->subsystem_device == _subdevice)				)
5524 
5525 #ifdef CONFIG_B43_SSB
5526 static void b43_sprom_fixup(struct ssb_bus *bus)
5527 {
5528 	struct pci_dev *pdev;
5529 
5530 	/* boardflags workarounds */
5531 	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5532 	    bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5533 		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5534 	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5535 	    bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5536 		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5537 	if (bus->bustype == SSB_BUSTYPE_PCI) {
5538 		pdev = bus->host_pci;
5539 		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5540 		    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5541 		    IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5542 		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5543 		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5544 		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5545 		    IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5546 			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5547 	}
5548 }
5549 
5550 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5551 {
5552 	struct ieee80211_hw *hw = wl->hw;
5553 
5554 	ssb_set_devtypedata(dev->sdev, NULL);
5555 	ieee80211_free_hw(hw);
5556 }
5557 #endif
5558 
5559 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5560 {
5561 	struct ssb_sprom *sprom = dev->bus_sprom;
5562 	struct ieee80211_hw *hw;
5563 	struct b43_wl *wl;
5564 	char chip_name[6];
5565 	int queue_num;
5566 
5567 	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5568 	if (!hw) {
5569 		b43err(NULL, "Could not allocate ieee80211 device\n");
5570 		return ERR_PTR(-ENOMEM);
5571 	}
5572 	wl = hw_to_b43_wl(hw);
5573 
5574 	/* fill hw info */
5575 	ieee80211_hw_set(hw, RX_INCLUDES_FCS);
5576 	ieee80211_hw_set(hw, SIGNAL_DBM);
5577 	ieee80211_hw_set(hw, MFP_CAPABLE);
5578 	hw->wiphy->interface_modes =
5579 		BIT(NL80211_IFTYPE_AP) |
5580 		BIT(NL80211_IFTYPE_MESH_POINT) |
5581 		BIT(NL80211_IFTYPE_STATION) |
5582 		BIT(NL80211_IFTYPE_ADHOC);
5583 
5584 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5585 
5586 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5587 
5588 	wl->hw_registered = false;
5589 	hw->max_rates = 2;
5590 	SET_IEEE80211_DEV(hw, dev->dev);
5591 	if (is_valid_ether_addr(sprom->et1mac))
5592 		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5593 	else
5594 		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5595 
5596 	/* Initialize struct b43_wl */
5597 	wl->hw = hw;
5598 	mutex_init(&wl->mutex);
5599 	spin_lock_init(&wl->hardirq_lock);
5600 	spin_lock_init(&wl->beacon_lock);
5601 	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5602 	INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5603 	INIT_WORK(&wl->tx_work, b43_tx_work);
5604 
5605 	/* Initialize queues and flags. */
5606 	for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5607 		skb_queue_head_init(&wl->tx_queue[queue_num]);
5608 		wl->tx_queue_stopped[queue_num] = false;
5609 	}
5610 
5611 	snprintf(chip_name, ARRAY_SIZE(chip_name),
5612 		 (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5613 	b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5614 		dev->core_rev);
5615 	return wl;
5616 }
5617 
5618 #ifdef CONFIG_B43_BCMA
5619 static int b43_bcma_probe(struct bcma_device *core)
5620 {
5621 	struct b43_bus_dev *dev;
5622 	struct b43_wl *wl;
5623 	int err;
5624 
5625 	if (!modparam_allhwsupport &&
5626 	    (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5627 		pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5628 		return -ENOTSUPP;
5629 	}
5630 
5631 	dev = b43_bus_dev_bcma_init(core);
5632 	if (!dev)
5633 		return -ENODEV;
5634 
5635 	wl = b43_wireless_init(dev);
5636 	if (IS_ERR(wl)) {
5637 		err = PTR_ERR(wl);
5638 		goto bcma_out;
5639 	}
5640 
5641 	err = b43_one_core_attach(dev, wl);
5642 	if (err)
5643 		goto bcma_err_wireless_exit;
5644 
5645 	/* setup and start work to load firmware */
5646 	INIT_WORK(&wl->firmware_load, b43_request_firmware);
5647 	schedule_work(&wl->firmware_load);
5648 
5649 	return err;
5650 
5651 bcma_err_wireless_exit:
5652 	ieee80211_free_hw(wl->hw);
5653 bcma_out:
5654 	kfree(dev);
5655 	return err;
5656 }
5657 
5658 static void b43_bcma_remove(struct bcma_device *core)
5659 {
5660 	struct b43_wldev *wldev = bcma_get_drvdata(core);
5661 	struct b43_wl *wl = wldev->wl;
5662 
5663 	/* We must cancel any work here before unregistering from ieee80211,
5664 	 * as the ieee80211 unreg will destroy the workqueue. */
5665 	cancel_work_sync(&wldev->restart_work);
5666 	cancel_work_sync(&wl->firmware_load);
5667 
5668 	B43_WARN_ON(!wl);
5669 	if (!wldev->fw.ucode.data)
5670 		return;			/* NULL if firmware never loaded */
5671 	if (wl->current_dev == wldev && wl->hw_registered) {
5672 		b43_leds_stop(wldev);
5673 		ieee80211_unregister_hw(wl->hw);
5674 	}
5675 
5676 	b43_one_core_detach(wldev->dev);
5677 
5678 	/* Unregister HW RNG driver */
5679 	b43_rng_exit(wl);
5680 
5681 	b43_leds_unregister(wl);
5682 	ieee80211_free_hw(wl->hw);
5683 	kfree(wldev->dev);
5684 }
5685 
5686 static struct bcma_driver b43_bcma_driver = {
5687 	.name		= KBUILD_MODNAME,
5688 	.id_table	= b43_bcma_tbl,
5689 	.probe		= b43_bcma_probe,
5690 	.remove		= b43_bcma_remove,
5691 };
5692 #endif
5693 
5694 #ifdef CONFIG_B43_SSB
5695 static
5696 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5697 {
5698 	struct b43_bus_dev *dev;
5699 	struct b43_wl *wl;
5700 	int err;
5701 
5702 	dev = b43_bus_dev_ssb_init(sdev);
5703 	if (!dev)
5704 		return -ENOMEM;
5705 
5706 	wl = ssb_get_devtypedata(sdev);
5707 	if (wl) {
5708 		b43err(NULL, "Dual-core devices are not supported\n");
5709 		err = -ENOTSUPP;
5710 		goto err_ssb_kfree_dev;
5711 	}
5712 
5713 	b43_sprom_fixup(sdev->bus);
5714 
5715 	wl = b43_wireless_init(dev);
5716 	if (IS_ERR(wl)) {
5717 		err = PTR_ERR(wl);
5718 		goto err_ssb_kfree_dev;
5719 	}
5720 	ssb_set_devtypedata(sdev, wl);
5721 	B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5722 
5723 	err = b43_one_core_attach(dev, wl);
5724 	if (err)
5725 		goto err_ssb_wireless_exit;
5726 
5727 	/* setup and start work to load firmware */
5728 	INIT_WORK(&wl->firmware_load, b43_request_firmware);
5729 	schedule_work(&wl->firmware_load);
5730 
5731 	return err;
5732 
5733 err_ssb_wireless_exit:
5734 	b43_wireless_exit(dev, wl);
5735 err_ssb_kfree_dev:
5736 	kfree(dev);
5737 	return err;
5738 }
5739 
5740 static void b43_ssb_remove(struct ssb_device *sdev)
5741 {
5742 	struct b43_wl *wl = ssb_get_devtypedata(sdev);
5743 	struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5744 	struct b43_bus_dev *dev = wldev->dev;
5745 
5746 	/* We must cancel any work here before unregistering from ieee80211,
5747 	 * as the ieee80211 unreg will destroy the workqueue. */
5748 	cancel_work_sync(&wldev->restart_work);
5749 	cancel_work_sync(&wl->firmware_load);
5750 
5751 	B43_WARN_ON(!wl);
5752 	if (!wldev->fw.ucode.data)
5753 		return;			/* NULL if firmware never loaded */
5754 	if (wl->current_dev == wldev && wl->hw_registered) {
5755 		b43_leds_stop(wldev);
5756 		ieee80211_unregister_hw(wl->hw);
5757 	}
5758 
5759 	b43_one_core_detach(dev);
5760 
5761 	/* Unregister HW RNG driver */
5762 	b43_rng_exit(wl);
5763 
5764 	b43_leds_unregister(wl);
5765 	b43_wireless_exit(dev, wl);
5766 	kfree(dev);
5767 }
5768 
5769 static struct ssb_driver b43_ssb_driver = {
5770 	.name		= KBUILD_MODNAME,
5771 	.id_table	= b43_ssb_tbl,
5772 	.probe		= b43_ssb_probe,
5773 	.remove		= b43_ssb_remove,
5774 };
5775 #endif /* CONFIG_B43_SSB */
5776 
5777 /* Perform a hardware reset. This can be called from any context. */
5778 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5779 {
5780 	/* Must avoid requeueing, if we are in shutdown. */
5781 	if (b43_status(dev) < B43_STAT_INITIALIZED)
5782 		return;
5783 	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5784 	ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5785 }
5786 
5787 static void b43_print_driverinfo(void)
5788 {
5789 	const char *feat_pci = "", *feat_nphy = "",
5790 		   *feat_leds = "", *feat_sdio = "";
5791 
5792 #ifdef CONFIG_B43_PCI_AUTOSELECT
5793 	feat_pci = "P";
5794 #endif
5795 #ifdef CONFIG_B43_PHY_N
5796 	feat_nphy = "N";
5797 #endif
5798 #ifdef CONFIG_B43_LEDS
5799 	feat_leds = "L";
5800 #endif
5801 #ifdef CONFIG_B43_SDIO
5802 	feat_sdio = "S";
5803 #endif
5804 	printk(KERN_INFO "Broadcom 43xx driver loaded "
5805 	       "[ Features: %s%s%s%s ]\n",
5806 	       feat_pci, feat_nphy, feat_leds, feat_sdio);
5807 }
5808 
5809 static int __init b43_init(void)
5810 {
5811 	int err;
5812 
5813 	b43_debugfs_init();
5814 	err = b43_sdio_init();
5815 	if (err)
5816 		goto err_dfs_exit;
5817 #ifdef CONFIG_B43_BCMA
5818 	err = bcma_driver_register(&b43_bcma_driver);
5819 	if (err)
5820 		goto err_sdio_exit;
5821 #endif
5822 #ifdef CONFIG_B43_SSB
5823 	err = ssb_driver_register(&b43_ssb_driver);
5824 	if (err)
5825 		goto err_bcma_driver_exit;
5826 #endif
5827 	b43_print_driverinfo();
5828 
5829 	return err;
5830 
5831 #ifdef CONFIG_B43_SSB
5832 err_bcma_driver_exit:
5833 #endif
5834 #ifdef CONFIG_B43_BCMA
5835 	bcma_driver_unregister(&b43_bcma_driver);
5836 err_sdio_exit:
5837 #endif
5838 	b43_sdio_exit();
5839 err_dfs_exit:
5840 	b43_debugfs_exit();
5841 	return err;
5842 }
5843 
5844 static void __exit b43_exit(void)
5845 {
5846 #ifdef CONFIG_B43_SSB
5847 	ssb_driver_unregister(&b43_ssb_driver);
5848 #endif
5849 #ifdef CONFIG_B43_BCMA
5850 	bcma_driver_unregister(&b43_bcma_driver);
5851 #endif
5852 	b43_sdio_exit();
5853 	b43_debugfs_exit();
5854 }
5855 
5856 module_init(b43_init)
5857 module_exit(b43_exit)
5858