1 /*
2 
3   Broadcom B43 wireless driver
4 
5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
10   Copyright (c) 2010-2011 Rafał Miłecki <zajec5@gmail.com>
11 
12   SDIO support
13   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
14 
15   Some parts of the code in this file are derived from the ipw2200
16   driver  Copyright(c) 2003 - 2004 Intel Corporation.
17 
18   This program is free software; you can redistribute it and/or modify
19   it under the terms of the GNU General Public License as published by
20   the Free Software Foundation; either version 2 of the License, or
21   (at your option) any later version.
22 
23   This program is distributed in the hope that it will be useful,
24   but WITHOUT ANY WARRANTY; without even the implied warranty of
25   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
26   GNU General Public License for more details.
27 
28   You should have received a copy of the GNU General Public License
29   along with this program; see the file COPYING.  If not, write to
30   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
31   Boston, MA 02110-1301, USA.
32 
33 */
34 
35 #include <linux/delay.h>
36 #include <linux/init.h>
37 #include <linux/module.h>
38 #include <linux/if_arp.h>
39 #include <linux/etherdevice.h>
40 #include <linux/firmware.h>
41 #include <linux/workqueue.h>
42 #include <linux/skbuff.h>
43 #include <linux/io.h>
44 #include <linux/dma-mapping.h>
45 #include <linux/slab.h>
46 #include <asm/unaligned.h>
47 
48 #include "b43.h"
49 #include "main.h"
50 #include "debugfs.h"
51 #include "phy_common.h"
52 #include "phy_g.h"
53 #include "phy_n.h"
54 #include "dma.h"
55 #include "pio.h"
56 #include "sysfs.h"
57 #include "xmit.h"
58 #include "lo.h"
59 #include "sdio.h"
60 #include <linux/mmc/sdio_func.h>
61 
62 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
63 MODULE_AUTHOR("Martin Langer");
64 MODULE_AUTHOR("Stefano Brivio");
65 MODULE_AUTHOR("Michael Buesch");
66 MODULE_AUTHOR("Gábor Stefanik");
67 MODULE_AUTHOR("Rafał Miłecki");
68 MODULE_LICENSE("GPL");
69 
70 MODULE_FIRMWARE("b43/ucode11.fw");
71 MODULE_FIRMWARE("b43/ucode13.fw");
72 MODULE_FIRMWARE("b43/ucode14.fw");
73 MODULE_FIRMWARE("b43/ucode15.fw");
74 MODULE_FIRMWARE("b43/ucode16_lp.fw");
75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
76 MODULE_FIRMWARE("b43/ucode24_lcn.fw");
77 MODULE_FIRMWARE("b43/ucode25_lcn.fw");
78 MODULE_FIRMWARE("b43/ucode25_mimo.fw");
79 MODULE_FIRMWARE("b43/ucode26_mimo.fw");
80 MODULE_FIRMWARE("b43/ucode29_mimo.fw");
81 MODULE_FIRMWARE("b43/ucode33_lcn40.fw");
82 MODULE_FIRMWARE("b43/ucode30_mimo.fw");
83 MODULE_FIRMWARE("b43/ucode5.fw");
84 MODULE_FIRMWARE("b43/ucode40.fw");
85 MODULE_FIRMWARE("b43/ucode42.fw");
86 MODULE_FIRMWARE("b43/ucode9.fw");
87 
88 static int modparam_bad_frames_preempt;
89 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
90 MODULE_PARM_DESC(bad_frames_preempt,
91 		 "enable(1) / disable(0) Bad Frames Preemption");
92 
93 static char modparam_fwpostfix[16];
94 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
95 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
96 
97 static int modparam_hwpctl;
98 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
99 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
100 
101 static int modparam_nohwcrypt;
102 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
103 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
104 
105 static int modparam_hwtkip;
106 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
107 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
108 
109 static int modparam_qos = 1;
110 module_param_named(qos, modparam_qos, int, 0444);
111 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
112 
113 static int modparam_btcoex = 1;
114 module_param_named(btcoex, modparam_btcoex, int, 0444);
115 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
116 
117 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
118 module_param_named(verbose, b43_modparam_verbose, int, 0644);
119 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
120 
121 static int b43_modparam_pio = 0;
122 module_param_named(pio, b43_modparam_pio, int, 0644);
123 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
124 
125 static int modparam_allhwsupport = !IS_ENABLED(CONFIG_BRCMSMAC);
126 module_param_named(allhwsupport, modparam_allhwsupport, int, 0444);
127 MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if overlaps with the brcmsmac driver)");
128 
129 #ifdef CONFIG_B43_BCMA
130 static const struct bcma_device_id b43_bcma_tbl[] = {
131 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
132 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
133 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
134 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
135 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
136 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
137 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1E, BCMA_ANY_CLASS),
138 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x28, BCMA_ANY_CLASS),
139 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x2A, BCMA_ANY_CLASS),
140 	{},
141 };
142 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
143 #endif
144 
145 #ifdef CONFIG_B43_SSB
146 static const struct ssb_device_id b43_ssb_tbl[] = {
147 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
148 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
149 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
150 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
151 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
152 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
153 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
154 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
155 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
156 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
157 	{},
158 };
159 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
160 #endif
161 
162 /* Channel and ratetables are shared for all devices.
163  * They can't be const, because ieee80211 puts some precalculated
164  * data in there. This data is the same for all devices, so we don't
165  * get concurrency issues */
166 #define RATETAB_ENT(_rateid, _flags) \
167 	{								\
168 		.bitrate	= B43_RATE_TO_BASE100KBPS(_rateid),	\
169 		.hw_value	= (_rateid),				\
170 		.flags		= (_flags),				\
171 	}
172 
173 /*
174  * NOTE: When changing this, sync with xmit.c's
175  *	 b43_plcp_get_bitrate_idx_* functions!
176  */
177 static struct ieee80211_rate __b43_ratetable[] = {
178 	RATETAB_ENT(B43_CCK_RATE_1MB, 0),
179 	RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
180 	RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
181 	RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
182 	RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
183 	RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
184 	RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
185 	RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
186 	RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
187 	RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
188 	RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
189 	RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
190 };
191 
192 #define b43_a_ratetable		(__b43_ratetable + 4)
193 #define b43_a_ratetable_size	8
194 #define b43_b_ratetable		(__b43_ratetable + 0)
195 #define b43_b_ratetable_size	4
196 #define b43_g_ratetable		(__b43_ratetable + 0)
197 #define b43_g_ratetable_size	12
198 
199 #define CHAN2G(_channel, _freq, _flags) {			\
200 	.band			= NL80211_BAND_2GHZ,		\
201 	.center_freq		= (_freq),			\
202 	.hw_value		= (_channel),			\
203 	.flags			= (_flags),			\
204 	.max_antenna_gain	= 0,				\
205 	.max_power		= 30,				\
206 }
207 static struct ieee80211_channel b43_2ghz_chantable[] = {
208 	CHAN2G(1, 2412, 0),
209 	CHAN2G(2, 2417, 0),
210 	CHAN2G(3, 2422, 0),
211 	CHAN2G(4, 2427, 0),
212 	CHAN2G(5, 2432, 0),
213 	CHAN2G(6, 2437, 0),
214 	CHAN2G(7, 2442, 0),
215 	CHAN2G(8, 2447, 0),
216 	CHAN2G(9, 2452, 0),
217 	CHAN2G(10, 2457, 0),
218 	CHAN2G(11, 2462, 0),
219 	CHAN2G(12, 2467, 0),
220 	CHAN2G(13, 2472, 0),
221 	CHAN2G(14, 2484, 0),
222 };
223 
224 /* No support for the last 3 channels (12, 13, 14) */
225 #define b43_2ghz_chantable_limited_size		11
226 #undef CHAN2G
227 
228 #define CHAN4G(_channel, _flags) {				\
229 	.band			= NL80211_BAND_5GHZ,		\
230 	.center_freq		= 4000 + (5 * (_channel)),	\
231 	.hw_value		= (_channel),			\
232 	.flags			= (_flags),			\
233 	.max_antenna_gain	= 0,				\
234 	.max_power		= 30,				\
235 }
236 #define CHAN5G(_channel, _flags) {				\
237 	.band			= NL80211_BAND_5GHZ,		\
238 	.center_freq		= 5000 + (5 * (_channel)),	\
239 	.hw_value		= (_channel),			\
240 	.flags			= (_flags),			\
241 	.max_antenna_gain	= 0,				\
242 	.max_power		= 30,				\
243 }
244 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
245 	CHAN4G(184, 0),		CHAN4G(186, 0),
246 	CHAN4G(188, 0),		CHAN4G(190, 0),
247 	CHAN4G(192, 0),		CHAN4G(194, 0),
248 	CHAN4G(196, 0),		CHAN4G(198, 0),
249 	CHAN4G(200, 0),		CHAN4G(202, 0),
250 	CHAN4G(204, 0),		CHAN4G(206, 0),
251 	CHAN4G(208, 0),		CHAN4G(210, 0),
252 	CHAN4G(212, 0),		CHAN4G(214, 0),
253 	CHAN4G(216, 0),		CHAN4G(218, 0),
254 	CHAN4G(220, 0),		CHAN4G(222, 0),
255 	CHAN4G(224, 0),		CHAN4G(226, 0),
256 	CHAN4G(228, 0),
257 	CHAN5G(32, 0),		CHAN5G(34, 0),
258 	CHAN5G(36, 0),		CHAN5G(38, 0),
259 	CHAN5G(40, 0),		CHAN5G(42, 0),
260 	CHAN5G(44, 0),		CHAN5G(46, 0),
261 	CHAN5G(48, 0),		CHAN5G(50, 0),
262 	CHAN5G(52, 0),		CHAN5G(54, 0),
263 	CHAN5G(56, 0),		CHAN5G(58, 0),
264 	CHAN5G(60, 0),		CHAN5G(62, 0),
265 	CHAN5G(64, 0),		CHAN5G(66, 0),
266 	CHAN5G(68, 0),		CHAN5G(70, 0),
267 	CHAN5G(72, 0),		CHAN5G(74, 0),
268 	CHAN5G(76, 0),		CHAN5G(78, 0),
269 	CHAN5G(80, 0),		CHAN5G(82, 0),
270 	CHAN5G(84, 0),		CHAN5G(86, 0),
271 	CHAN5G(88, 0),		CHAN5G(90, 0),
272 	CHAN5G(92, 0),		CHAN5G(94, 0),
273 	CHAN5G(96, 0),		CHAN5G(98, 0),
274 	CHAN5G(100, 0),		CHAN5G(102, 0),
275 	CHAN5G(104, 0),		CHAN5G(106, 0),
276 	CHAN5G(108, 0),		CHAN5G(110, 0),
277 	CHAN5G(112, 0),		CHAN5G(114, 0),
278 	CHAN5G(116, 0),		CHAN5G(118, 0),
279 	CHAN5G(120, 0),		CHAN5G(122, 0),
280 	CHAN5G(124, 0),		CHAN5G(126, 0),
281 	CHAN5G(128, 0),		CHAN5G(130, 0),
282 	CHAN5G(132, 0),		CHAN5G(134, 0),
283 	CHAN5G(136, 0),		CHAN5G(138, 0),
284 	CHAN5G(140, 0),		CHAN5G(142, 0),
285 	CHAN5G(144, 0),		CHAN5G(145, 0),
286 	CHAN5G(146, 0),		CHAN5G(147, 0),
287 	CHAN5G(148, 0),		CHAN5G(149, 0),
288 	CHAN5G(150, 0),		CHAN5G(151, 0),
289 	CHAN5G(152, 0),		CHAN5G(153, 0),
290 	CHAN5G(154, 0),		CHAN5G(155, 0),
291 	CHAN5G(156, 0),		CHAN5G(157, 0),
292 	CHAN5G(158, 0),		CHAN5G(159, 0),
293 	CHAN5G(160, 0),		CHAN5G(161, 0),
294 	CHAN5G(162, 0),		CHAN5G(163, 0),
295 	CHAN5G(164, 0),		CHAN5G(165, 0),
296 	CHAN5G(166, 0),		CHAN5G(168, 0),
297 	CHAN5G(170, 0),		CHAN5G(172, 0),
298 	CHAN5G(174, 0),		CHAN5G(176, 0),
299 	CHAN5G(178, 0),		CHAN5G(180, 0),
300 	CHAN5G(182, 0),
301 };
302 
303 static struct ieee80211_channel b43_5ghz_nphy_chantable_limited[] = {
304 	CHAN5G(36, 0),		CHAN5G(40, 0),
305 	CHAN5G(44, 0),		CHAN5G(48, 0),
306 	CHAN5G(149, 0),		CHAN5G(153, 0),
307 	CHAN5G(157, 0),		CHAN5G(161, 0),
308 	CHAN5G(165, 0),
309 };
310 
311 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
312 	CHAN5G(34, 0),		CHAN5G(36, 0),
313 	CHAN5G(38, 0),		CHAN5G(40, 0),
314 	CHAN5G(42, 0),		CHAN5G(44, 0),
315 	CHAN5G(46, 0),		CHAN5G(48, 0),
316 	CHAN5G(52, 0),		CHAN5G(56, 0),
317 	CHAN5G(60, 0),		CHAN5G(64, 0),
318 	CHAN5G(100, 0),		CHAN5G(104, 0),
319 	CHAN5G(108, 0),		CHAN5G(112, 0),
320 	CHAN5G(116, 0),		CHAN5G(120, 0),
321 	CHAN5G(124, 0),		CHAN5G(128, 0),
322 	CHAN5G(132, 0),		CHAN5G(136, 0),
323 	CHAN5G(140, 0),		CHAN5G(149, 0),
324 	CHAN5G(153, 0),		CHAN5G(157, 0),
325 	CHAN5G(161, 0),		CHAN5G(165, 0),
326 	CHAN5G(184, 0),		CHAN5G(188, 0),
327 	CHAN5G(192, 0),		CHAN5G(196, 0),
328 	CHAN5G(200, 0),		CHAN5G(204, 0),
329 	CHAN5G(208, 0),		CHAN5G(212, 0),
330 	CHAN5G(216, 0),
331 };
332 #undef CHAN4G
333 #undef CHAN5G
334 
335 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
336 	.band		= NL80211_BAND_5GHZ,
337 	.channels	= b43_5ghz_nphy_chantable,
338 	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable),
339 	.bitrates	= b43_a_ratetable,
340 	.n_bitrates	= b43_a_ratetable_size,
341 };
342 
343 static struct ieee80211_supported_band b43_band_5GHz_nphy_limited = {
344 	.band		= NL80211_BAND_5GHZ,
345 	.channels	= b43_5ghz_nphy_chantable_limited,
346 	.n_channels	= ARRAY_SIZE(b43_5ghz_nphy_chantable_limited),
347 	.bitrates	= b43_a_ratetable,
348 	.n_bitrates	= b43_a_ratetable_size,
349 };
350 
351 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
352 	.band		= NL80211_BAND_5GHZ,
353 	.channels	= b43_5ghz_aphy_chantable,
354 	.n_channels	= ARRAY_SIZE(b43_5ghz_aphy_chantable),
355 	.bitrates	= b43_a_ratetable,
356 	.n_bitrates	= b43_a_ratetable_size,
357 };
358 
359 static struct ieee80211_supported_band b43_band_2GHz = {
360 	.band		= NL80211_BAND_2GHZ,
361 	.channels	= b43_2ghz_chantable,
362 	.n_channels	= ARRAY_SIZE(b43_2ghz_chantable),
363 	.bitrates	= b43_g_ratetable,
364 	.n_bitrates	= b43_g_ratetable_size,
365 };
366 
367 static struct ieee80211_supported_band b43_band_2ghz_limited = {
368 	.band		= NL80211_BAND_2GHZ,
369 	.channels	= b43_2ghz_chantable,
370 	.n_channels	= b43_2ghz_chantable_limited_size,
371 	.bitrates	= b43_g_ratetable,
372 	.n_bitrates	= b43_g_ratetable_size,
373 };
374 
375 static void b43_wireless_core_exit(struct b43_wldev *dev);
376 static int b43_wireless_core_init(struct b43_wldev *dev);
377 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
378 static int b43_wireless_core_start(struct b43_wldev *dev);
379 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
380 				    struct ieee80211_vif *vif,
381 				    struct ieee80211_bss_conf *conf,
382 				    u32 changed);
383 
384 static int b43_ratelimit(struct b43_wl *wl)
385 {
386 	if (!wl || !wl->current_dev)
387 		return 1;
388 	if (b43_status(wl->current_dev) < B43_STAT_STARTED)
389 		return 1;
390 	/* We are up and running.
391 	 * Ratelimit the messages to avoid DoS over the net. */
392 	return net_ratelimit();
393 }
394 
395 void b43info(struct b43_wl *wl, const char *fmt, ...)
396 {
397 	struct va_format vaf;
398 	va_list args;
399 
400 	if (b43_modparam_verbose < B43_VERBOSITY_INFO)
401 		return;
402 	if (!b43_ratelimit(wl))
403 		return;
404 
405 	va_start(args, fmt);
406 
407 	vaf.fmt = fmt;
408 	vaf.va = &args;
409 
410 	printk(KERN_INFO "b43-%s: %pV",
411 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
412 
413 	va_end(args);
414 }
415 
416 void b43err(struct b43_wl *wl, const char *fmt, ...)
417 {
418 	struct va_format vaf;
419 	va_list args;
420 
421 	if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
422 		return;
423 	if (!b43_ratelimit(wl))
424 		return;
425 
426 	va_start(args, fmt);
427 
428 	vaf.fmt = fmt;
429 	vaf.va = &args;
430 
431 	printk(KERN_ERR "b43-%s ERROR: %pV",
432 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
433 
434 	va_end(args);
435 }
436 
437 void b43warn(struct b43_wl *wl, const char *fmt, ...)
438 {
439 	struct va_format vaf;
440 	va_list args;
441 
442 	if (b43_modparam_verbose < B43_VERBOSITY_WARN)
443 		return;
444 	if (!b43_ratelimit(wl))
445 		return;
446 
447 	va_start(args, fmt);
448 
449 	vaf.fmt = fmt;
450 	vaf.va = &args;
451 
452 	printk(KERN_WARNING "b43-%s warning: %pV",
453 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
454 
455 	va_end(args);
456 }
457 
458 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
459 {
460 	struct va_format vaf;
461 	va_list args;
462 
463 	if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
464 		return;
465 
466 	va_start(args, fmt);
467 
468 	vaf.fmt = fmt;
469 	vaf.va = &args;
470 
471 	printk(KERN_DEBUG "b43-%s debug: %pV",
472 	       (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
473 
474 	va_end(args);
475 }
476 
477 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
478 {
479 	u32 macctl;
480 
481 	B43_WARN_ON(offset % 4 != 0);
482 
483 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
484 	if (macctl & B43_MACCTL_BE)
485 		val = swab32(val);
486 
487 	b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
488 	mmiowb();
489 	b43_write32(dev, B43_MMIO_RAM_DATA, val);
490 }
491 
492 static inline void b43_shm_control_word(struct b43_wldev *dev,
493 					u16 routing, u16 offset)
494 {
495 	u32 control;
496 
497 	/* "offset" is the WORD offset. */
498 	control = routing;
499 	control <<= 16;
500 	control |= offset;
501 	b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
502 }
503 
504 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
505 {
506 	u32 ret;
507 
508 	if (routing == B43_SHM_SHARED) {
509 		B43_WARN_ON(offset & 0x0001);
510 		if (offset & 0x0003) {
511 			/* Unaligned access */
512 			b43_shm_control_word(dev, routing, offset >> 2);
513 			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
514 			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
515 			ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
516 
517 			goto out;
518 		}
519 		offset >>= 2;
520 	}
521 	b43_shm_control_word(dev, routing, offset);
522 	ret = b43_read32(dev, B43_MMIO_SHM_DATA);
523 out:
524 	return ret;
525 }
526 
527 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
528 {
529 	u16 ret;
530 
531 	if (routing == B43_SHM_SHARED) {
532 		B43_WARN_ON(offset & 0x0001);
533 		if (offset & 0x0003) {
534 			/* Unaligned access */
535 			b43_shm_control_word(dev, routing, offset >> 2);
536 			ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
537 
538 			goto out;
539 		}
540 		offset >>= 2;
541 	}
542 	b43_shm_control_word(dev, routing, offset);
543 	ret = b43_read16(dev, B43_MMIO_SHM_DATA);
544 out:
545 	return ret;
546 }
547 
548 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
549 {
550 	if (routing == B43_SHM_SHARED) {
551 		B43_WARN_ON(offset & 0x0001);
552 		if (offset & 0x0003) {
553 			/* Unaligned access */
554 			b43_shm_control_word(dev, routing, offset >> 2);
555 			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
556 				    value & 0xFFFF);
557 			b43_shm_control_word(dev, routing, (offset >> 2) + 1);
558 			b43_write16(dev, B43_MMIO_SHM_DATA,
559 				    (value >> 16) & 0xFFFF);
560 			return;
561 		}
562 		offset >>= 2;
563 	}
564 	b43_shm_control_word(dev, routing, offset);
565 	b43_write32(dev, B43_MMIO_SHM_DATA, value);
566 }
567 
568 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
569 {
570 	if (routing == B43_SHM_SHARED) {
571 		B43_WARN_ON(offset & 0x0001);
572 		if (offset & 0x0003) {
573 			/* Unaligned access */
574 			b43_shm_control_word(dev, routing, offset >> 2);
575 			b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
576 			return;
577 		}
578 		offset >>= 2;
579 	}
580 	b43_shm_control_word(dev, routing, offset);
581 	b43_write16(dev, B43_MMIO_SHM_DATA, value);
582 }
583 
584 /* Read HostFlags */
585 u64 b43_hf_read(struct b43_wldev *dev)
586 {
587 	u64 ret;
588 
589 	ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3);
590 	ret <<= 16;
591 	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2);
592 	ret <<= 16;
593 	ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1);
594 
595 	return ret;
596 }
597 
598 /* Write HostFlags */
599 void b43_hf_write(struct b43_wldev *dev, u64 value)
600 {
601 	u16 lo, mi, hi;
602 
603 	lo = (value & 0x00000000FFFFULL);
604 	mi = (value & 0x0000FFFF0000ULL) >> 16;
605 	hi = (value & 0xFFFF00000000ULL) >> 32;
606 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF1, lo);
607 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF2, mi);
608 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTF3, hi);
609 }
610 
611 /* Read the firmware capabilities bitmask (Opensource firmware only) */
612 static u16 b43_fwcapa_read(struct b43_wldev *dev)
613 {
614 	B43_WARN_ON(!dev->fw.opensource);
615 	return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
616 }
617 
618 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
619 {
620 	u32 low, high;
621 
622 	B43_WARN_ON(dev->dev->core_rev < 3);
623 
624 	/* The hardware guarantees us an atomic read, if we
625 	 * read the low register first. */
626 	low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
627 	high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
628 
629 	*tsf = high;
630 	*tsf <<= 32;
631 	*tsf |= low;
632 }
633 
634 static void b43_time_lock(struct b43_wldev *dev)
635 {
636 	b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_TBTTHOLD);
637 	/* Commit the write */
638 	b43_read32(dev, B43_MMIO_MACCTL);
639 }
640 
641 static void b43_time_unlock(struct b43_wldev *dev)
642 {
643 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_TBTTHOLD, 0);
644 	/* Commit the write */
645 	b43_read32(dev, B43_MMIO_MACCTL);
646 }
647 
648 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
649 {
650 	u32 low, high;
651 
652 	B43_WARN_ON(dev->dev->core_rev < 3);
653 
654 	low = tsf;
655 	high = (tsf >> 32);
656 	/* The hardware guarantees us an atomic write, if we
657 	 * write the low register first. */
658 	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
659 	mmiowb();
660 	b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
661 	mmiowb();
662 }
663 
664 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
665 {
666 	b43_time_lock(dev);
667 	b43_tsf_write_locked(dev, tsf);
668 	b43_time_unlock(dev);
669 }
670 
671 static
672 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
673 {
674 	static const u8 zero_addr[ETH_ALEN] = { 0 };
675 	u16 data;
676 
677 	if (!mac)
678 		mac = zero_addr;
679 
680 	offset |= 0x0020;
681 	b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
682 
683 	data = mac[0];
684 	data |= mac[1] << 8;
685 	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
686 	data = mac[2];
687 	data |= mac[3] << 8;
688 	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
689 	data = mac[4];
690 	data |= mac[5] << 8;
691 	b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
692 }
693 
694 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
695 {
696 	const u8 *mac;
697 	const u8 *bssid;
698 	u8 mac_bssid[ETH_ALEN * 2];
699 	int i;
700 	u32 tmp;
701 
702 	bssid = dev->wl->bssid;
703 	mac = dev->wl->mac_addr;
704 
705 	b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
706 
707 	memcpy(mac_bssid, mac, ETH_ALEN);
708 	memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
709 
710 	/* Write our MAC address and BSSID to template ram */
711 	for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
712 		tmp = (u32) (mac_bssid[i + 0]);
713 		tmp |= (u32) (mac_bssid[i + 1]) << 8;
714 		tmp |= (u32) (mac_bssid[i + 2]) << 16;
715 		tmp |= (u32) (mac_bssid[i + 3]) << 24;
716 		b43_ram_write(dev, 0x20 + i, tmp);
717 	}
718 }
719 
720 static void b43_upload_card_macaddress(struct b43_wldev *dev)
721 {
722 	b43_write_mac_bssid_templates(dev);
723 	b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
724 }
725 
726 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
727 {
728 	/* slot_time is in usec. */
729 	/* This test used to exit for all but a G PHY. */
730 	if (b43_current_band(dev->wl) == NL80211_BAND_5GHZ)
731 		return;
732 	b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
733 	/* Shared memory location 0x0010 is the slot time and should be
734 	 * set to slot_time; however, this register is initially 0 and changing
735 	 * the value adversely affects the transmit rate for BCM4311
736 	 * devices. Until this behavior is unterstood, delete this step
737 	 *
738 	 * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
739 	 */
740 }
741 
742 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
743 {
744 	b43_set_slot_time(dev, 9);
745 }
746 
747 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
748 {
749 	b43_set_slot_time(dev, 20);
750 }
751 
752 /* DummyTransmission function, as documented on
753  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
754  */
755 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
756 {
757 	struct b43_phy *phy = &dev->phy;
758 	unsigned int i, max_loop;
759 	u16 value;
760 	u32 buffer[5] = {
761 		0x00000000,
762 		0x00D40000,
763 		0x00000000,
764 		0x01000000,
765 		0x00000000,
766 	};
767 
768 	if (ofdm) {
769 		max_loop = 0x1E;
770 		buffer[0] = 0x000201CC;
771 	} else {
772 		max_loop = 0xFA;
773 		buffer[0] = 0x000B846E;
774 	}
775 
776 	for (i = 0; i < 5; i++)
777 		b43_ram_write(dev, i * 4, buffer[i]);
778 
779 	b43_write16(dev, B43_MMIO_XMTSEL, 0x0000);
780 
781 	if (dev->dev->core_rev < 11)
782 		b43_write16(dev, B43_MMIO_WEPCTL, 0x0000);
783 	else
784 		b43_write16(dev, B43_MMIO_WEPCTL, 0x0100);
785 
786 	value = (ofdm ? 0x41 : 0x40);
787 	b43_write16(dev, B43_MMIO_TXE0_PHYCTL, value);
788 	if (phy->type == B43_PHYTYPE_N || phy->type == B43_PHYTYPE_LP ||
789 	    phy->type == B43_PHYTYPE_LCN)
790 		b43_write16(dev, B43_MMIO_TXE0_PHYCTL1, 0x1A02);
791 
792 	b43_write16(dev, B43_MMIO_TXE0_WM_0, 0x0000);
793 	b43_write16(dev, B43_MMIO_TXE0_WM_1, 0x0000);
794 
795 	b43_write16(dev, B43_MMIO_XMTTPLATETXPTR, 0x0000);
796 	b43_write16(dev, B43_MMIO_XMTTXCNT, 0x0014);
797 	b43_write16(dev, B43_MMIO_XMTSEL, 0x0826);
798 	b43_write16(dev, B43_MMIO_TXE0_CTL, 0x0000);
799 
800 	if (!pa_on && phy->type == B43_PHYTYPE_N)
801 		; /*b43_nphy_pa_override(dev, false) */
802 
803 	switch (phy->type) {
804 	case B43_PHYTYPE_N:
805 	case B43_PHYTYPE_LCN:
806 		b43_write16(dev, B43_MMIO_TXE0_AUX, 0x00D0);
807 		break;
808 	case B43_PHYTYPE_LP:
809 		b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0050);
810 		break;
811 	default:
812 		b43_write16(dev, B43_MMIO_TXE0_AUX, 0x0030);
813 	}
814 	b43_read16(dev, B43_MMIO_TXE0_AUX);
815 
816 	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
817 		b43_radio_write16(dev, 0x0051, 0x0017);
818 	for (i = 0x00; i < max_loop; i++) {
819 		value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
820 		if (value & 0x0080)
821 			break;
822 		udelay(10);
823 	}
824 	for (i = 0x00; i < 0x0A; i++) {
825 		value = b43_read16(dev, B43_MMIO_TXE0_STATUS);
826 		if (value & 0x0400)
827 			break;
828 		udelay(10);
829 	}
830 	for (i = 0x00; i < 0x19; i++) {
831 		value = b43_read16(dev, B43_MMIO_IFSSTAT);
832 		if (!(value & 0x0100))
833 			break;
834 		udelay(10);
835 	}
836 	if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
837 		b43_radio_write16(dev, 0x0051, 0x0037);
838 }
839 
840 static void key_write(struct b43_wldev *dev,
841 		      u8 index, u8 algorithm, const u8 *key)
842 {
843 	unsigned int i;
844 	u32 offset;
845 	u16 value;
846 	u16 kidx;
847 
848 	/* Key index/algo block */
849 	kidx = b43_kidx_to_fw(dev, index);
850 	value = ((kidx << 4) | algorithm);
851 	b43_shm_write16(dev, B43_SHM_SHARED,
852 			B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
853 
854 	/* Write the key to the Key Table Pointer offset */
855 	offset = dev->ktp + (index * B43_SEC_KEYSIZE);
856 	for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
857 		value = key[i];
858 		value |= (u16) (key[i + 1]) << 8;
859 		b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
860 	}
861 }
862 
863 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
864 {
865 	u32 addrtmp[2] = { 0, 0, };
866 	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
867 
868 	if (b43_new_kidx_api(dev))
869 		pairwise_keys_start = B43_NR_GROUP_KEYS;
870 
871 	B43_WARN_ON(index < pairwise_keys_start);
872 	/* We have four default TX keys and possibly four default RX keys.
873 	 * Physical mac 0 is mapped to physical key 4 or 8, depending
874 	 * on the firmware version.
875 	 * So we must adjust the index here.
876 	 */
877 	index -= pairwise_keys_start;
878 	B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
879 
880 	if (addr) {
881 		addrtmp[0] = addr[0];
882 		addrtmp[0] |= ((u32) (addr[1]) << 8);
883 		addrtmp[0] |= ((u32) (addr[2]) << 16);
884 		addrtmp[0] |= ((u32) (addr[3]) << 24);
885 		addrtmp[1] = addr[4];
886 		addrtmp[1] |= ((u32) (addr[5]) << 8);
887 	}
888 
889 	/* Receive match transmitter address (RCMTA) mechanism */
890 	b43_shm_write32(dev, B43_SHM_RCMTA,
891 			(index * 2) + 0, addrtmp[0]);
892 	b43_shm_write16(dev, B43_SHM_RCMTA,
893 			(index * 2) + 1, addrtmp[1]);
894 }
895 
896 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
897  * When a packet is received, the iv32 is checked.
898  * - if it doesn't the packet is returned without modification (and software
899  *   decryption can be done). That's what happen when iv16 wrap.
900  * - if it does, the rc4 key is computed, and decryption is tried.
901  *   Either it will success and B43_RX_MAC_DEC is returned,
902  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
903  *   and the packet is not usable (it got modified by the ucode).
904  * So in order to never have B43_RX_MAC_DECERR, we should provide
905  * a iv32 and phase1key that match. Because we drop packets in case of
906  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
907  * packets will be lost without higher layer knowing (ie no resync possible
908  * until next wrap).
909  *
910  * NOTE : this should support 50 key like RCMTA because
911  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
912  */
913 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
914 		u16 *phase1key)
915 {
916 	unsigned int i;
917 	u32 offset;
918 	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
919 
920 	if (!modparam_hwtkip)
921 		return;
922 
923 	if (b43_new_kidx_api(dev))
924 		pairwise_keys_start = B43_NR_GROUP_KEYS;
925 
926 	B43_WARN_ON(index < pairwise_keys_start);
927 	/* We have four default TX keys and possibly four default RX keys.
928 	 * Physical mac 0 is mapped to physical key 4 or 8, depending
929 	 * on the firmware version.
930 	 * So we must adjust the index here.
931 	 */
932 	index -= pairwise_keys_start;
933 	B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
934 
935 	if (b43_debug(dev, B43_DBG_KEYS)) {
936 		b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
937 				index, iv32);
938 	}
939 	/* Write the key to the  RX tkip shared mem */
940 	offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
941 	for (i = 0; i < 10; i += 2) {
942 		b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
943 				phase1key ? phase1key[i / 2] : 0);
944 	}
945 	b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
946 	b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
947 }
948 
949 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
950 				   struct ieee80211_vif *vif,
951 				   struct ieee80211_key_conf *keyconf,
952 				   struct ieee80211_sta *sta,
953 				   u32 iv32, u16 *phase1key)
954 {
955 	struct b43_wl *wl = hw_to_b43_wl(hw);
956 	struct b43_wldev *dev;
957 	int index = keyconf->hw_key_idx;
958 
959 	if (B43_WARN_ON(!modparam_hwtkip))
960 		return;
961 
962 	/* This is only called from the RX path through mac80211, where
963 	 * our mutex is already locked. */
964 	B43_WARN_ON(!mutex_is_locked(&wl->mutex));
965 	dev = wl->current_dev;
966 	B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
967 
968 	keymac_write(dev, index, NULL);	/* First zero out mac to avoid race */
969 
970 	rx_tkip_phase1_write(dev, index, iv32, phase1key);
971 	/* only pairwise TKIP keys are supported right now */
972 	if (WARN_ON(!sta))
973 		return;
974 	keymac_write(dev, index, sta->addr);
975 }
976 
977 static void do_key_write(struct b43_wldev *dev,
978 			 u8 index, u8 algorithm,
979 			 const u8 *key, size_t key_len, const u8 *mac_addr)
980 {
981 	u8 buf[B43_SEC_KEYSIZE] = { 0, };
982 	u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
983 
984 	if (b43_new_kidx_api(dev))
985 		pairwise_keys_start = B43_NR_GROUP_KEYS;
986 
987 	B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
988 	B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
989 
990 	if (index >= pairwise_keys_start)
991 		keymac_write(dev, index, NULL);	/* First zero out mac. */
992 	if (algorithm == B43_SEC_ALGO_TKIP) {
993 		/*
994 		 * We should provide an initial iv32, phase1key pair.
995 		 * We could start with iv32=0 and compute the corresponding
996 		 * phase1key, but this means calling ieee80211_get_tkip_key
997 		 * with a fake skb (or export other tkip function).
998 		 * Because we are lazy we hope iv32 won't start with
999 		 * 0xffffffff and let's b43_op_update_tkip_key provide a
1000 		 * correct pair.
1001 		 */
1002 		rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
1003 	} else if (index >= pairwise_keys_start) /* clear it */
1004 		rx_tkip_phase1_write(dev, index, 0, NULL);
1005 	if (key)
1006 		memcpy(buf, key, key_len);
1007 	key_write(dev, index, algorithm, buf);
1008 	if (index >= pairwise_keys_start)
1009 		keymac_write(dev, index, mac_addr);
1010 
1011 	dev->key[index].algorithm = algorithm;
1012 }
1013 
1014 static int b43_key_write(struct b43_wldev *dev,
1015 			 int index, u8 algorithm,
1016 			 const u8 *key, size_t key_len,
1017 			 const u8 *mac_addr,
1018 			 struct ieee80211_key_conf *keyconf)
1019 {
1020 	int i;
1021 	int pairwise_keys_start;
1022 
1023 	/* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
1024 	 * 	- Temporal Encryption Key (128 bits)
1025 	 * 	- Temporal Authenticator Tx MIC Key (64 bits)
1026 	 * 	- Temporal Authenticator Rx MIC Key (64 bits)
1027 	 *
1028 	 * 	Hardware only store TEK
1029 	 */
1030 	if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
1031 		key_len = 16;
1032 	if (key_len > B43_SEC_KEYSIZE)
1033 		return -EINVAL;
1034 	for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
1035 		/* Check that we don't already have this key. */
1036 		B43_WARN_ON(dev->key[i].keyconf == keyconf);
1037 	}
1038 	if (index < 0) {
1039 		/* Pairwise key. Get an empty slot for the key. */
1040 		if (b43_new_kidx_api(dev))
1041 			pairwise_keys_start = B43_NR_GROUP_KEYS;
1042 		else
1043 			pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1044 		for (i = pairwise_keys_start;
1045 		     i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
1046 		     i++) {
1047 			B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
1048 			if (!dev->key[i].keyconf) {
1049 				/* found empty */
1050 				index = i;
1051 				break;
1052 			}
1053 		}
1054 		if (index < 0) {
1055 			b43warn(dev->wl, "Out of hardware key memory\n");
1056 			return -ENOSPC;
1057 		}
1058 	} else
1059 		B43_WARN_ON(index > 3);
1060 
1061 	do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1062 	if ((index <= 3) && !b43_new_kidx_api(dev)) {
1063 		/* Default RX key */
1064 		B43_WARN_ON(mac_addr);
1065 		do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1066 	}
1067 	keyconf->hw_key_idx = index;
1068 	dev->key[index].keyconf = keyconf;
1069 
1070 	return 0;
1071 }
1072 
1073 static int b43_key_clear(struct b43_wldev *dev, int index)
1074 {
1075 	if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1076 		return -EINVAL;
1077 	do_key_write(dev, index, B43_SEC_ALGO_NONE,
1078 		     NULL, B43_SEC_KEYSIZE, NULL);
1079 	if ((index <= 3) && !b43_new_kidx_api(dev)) {
1080 		do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1081 			     NULL, B43_SEC_KEYSIZE, NULL);
1082 	}
1083 	dev->key[index].keyconf = NULL;
1084 
1085 	return 0;
1086 }
1087 
1088 static void b43_clear_keys(struct b43_wldev *dev)
1089 {
1090 	int i, count;
1091 
1092 	if (b43_new_kidx_api(dev))
1093 		count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1094 	else
1095 		count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1096 	for (i = 0; i < count; i++)
1097 		b43_key_clear(dev, i);
1098 }
1099 
1100 static void b43_dump_keymemory(struct b43_wldev *dev)
1101 {
1102 	unsigned int i, index, count, offset, pairwise_keys_start;
1103 	u8 mac[ETH_ALEN];
1104 	u16 algo;
1105 	u32 rcmta0;
1106 	u16 rcmta1;
1107 	u64 hf;
1108 	struct b43_key *key;
1109 
1110 	if (!b43_debug(dev, B43_DBG_KEYS))
1111 		return;
1112 
1113 	hf = b43_hf_read(dev);
1114 	b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1115 	       !!(hf & B43_HF_USEDEFKEYS));
1116 	if (b43_new_kidx_api(dev)) {
1117 		pairwise_keys_start = B43_NR_GROUP_KEYS;
1118 		count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1119 	} else {
1120 		pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1121 		count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1122 	}
1123 	for (index = 0; index < count; index++) {
1124 		key = &(dev->key[index]);
1125 		printk(KERN_DEBUG "Key slot %02u: %s",
1126 		       index, (key->keyconf == NULL) ? " " : "*");
1127 		offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1128 		for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1129 			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1130 			printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1131 		}
1132 
1133 		algo = b43_shm_read16(dev, B43_SHM_SHARED,
1134 				      B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1135 		printk("   Algo: %04X/%02X", algo, key->algorithm);
1136 
1137 		if (index >= pairwise_keys_start) {
1138 			if (key->algorithm == B43_SEC_ALGO_TKIP) {
1139 				printk("   TKIP: ");
1140 				offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1141 				for (i = 0; i < 14; i += 2) {
1142 					u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1143 					printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1144 				}
1145 			}
1146 			rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1147 						((index - pairwise_keys_start) * 2) + 0);
1148 			rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1149 						((index - pairwise_keys_start) * 2) + 1);
1150 			*((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1151 			*((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1152 			printk("   MAC: %pM", mac);
1153 		} else
1154 			printk("   DEFAULT KEY");
1155 		printk("\n");
1156 	}
1157 }
1158 
1159 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1160 {
1161 	u32 macctl;
1162 	u16 ucstat;
1163 	bool hwps;
1164 	bool awake;
1165 	int i;
1166 
1167 	B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1168 		    (ps_flags & B43_PS_DISABLED));
1169 	B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1170 
1171 	if (ps_flags & B43_PS_ENABLED) {
1172 		hwps = true;
1173 	} else if (ps_flags & B43_PS_DISABLED) {
1174 		hwps = false;
1175 	} else {
1176 		//TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1177 		//      and thus is not an AP and we are associated, set bit 25
1178 	}
1179 	if (ps_flags & B43_PS_AWAKE) {
1180 		awake = true;
1181 	} else if (ps_flags & B43_PS_ASLEEP) {
1182 		awake = false;
1183 	} else {
1184 		//TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1185 		//      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1186 		//      successful, set bit26
1187 	}
1188 
1189 /* FIXME: For now we force awake-on and hwps-off */
1190 	hwps = false;
1191 	awake = true;
1192 
1193 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1194 	if (hwps)
1195 		macctl |= B43_MACCTL_HWPS;
1196 	else
1197 		macctl &= ~B43_MACCTL_HWPS;
1198 	if (awake)
1199 		macctl |= B43_MACCTL_AWAKE;
1200 	else
1201 		macctl &= ~B43_MACCTL_AWAKE;
1202 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1203 	/* Commit write */
1204 	b43_read32(dev, B43_MMIO_MACCTL);
1205 	if (awake && dev->dev->core_rev >= 5) {
1206 		/* Wait for the microcode to wake up. */
1207 		for (i = 0; i < 100; i++) {
1208 			ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1209 						B43_SHM_SH_UCODESTAT);
1210 			if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1211 				break;
1212 			udelay(10);
1213 		}
1214 	}
1215 }
1216 
1217 /* http://bcm-v4.sipsolutions.net/802.11/PHY/BmacCorePllReset */
1218 void b43_wireless_core_phy_pll_reset(struct b43_wldev *dev)
1219 {
1220 	struct bcma_drv_cc *bcma_cc __maybe_unused;
1221 	struct ssb_chipcommon *ssb_cc __maybe_unused;
1222 
1223 	switch (dev->dev->bus_type) {
1224 #ifdef CONFIG_B43_BCMA
1225 	case B43_BUS_BCMA:
1226 		bcma_cc = &dev->dev->bdev->bus->drv_cc;
1227 
1228 		bcma_cc_write32(bcma_cc, BCMA_CC_PMU_CHIPCTL_ADDR, 0);
1229 		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1230 		bcma_cc_set32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, 0x4);
1231 		bcma_cc_mask32(bcma_cc, BCMA_CC_PMU_CHIPCTL_DATA, ~0x4);
1232 		break;
1233 #endif
1234 #ifdef CONFIG_B43_SSB
1235 	case B43_BUS_SSB:
1236 		ssb_cc = &dev->dev->sdev->bus->chipco;
1237 
1238 		chipco_write32(ssb_cc, SSB_CHIPCO_CHIPCTL_ADDR, 0);
1239 		chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1240 		chipco_set32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, 0x4);
1241 		chipco_mask32(ssb_cc, SSB_CHIPCO_CHIPCTL_DATA, ~0x4);
1242 		break;
1243 #endif
1244 	}
1245 }
1246 
1247 #ifdef CONFIG_B43_BCMA
1248 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1249 {
1250 	u32 flags;
1251 
1252 	/* Put PHY into reset */
1253 	flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1254 	flags |= B43_BCMA_IOCTL_PHY_RESET;
1255 	flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1256 	bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1257 	udelay(2);
1258 
1259 	b43_phy_take_out_of_reset(dev);
1260 }
1261 
1262 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1263 {
1264 	u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
1265 		  B43_BCMA_CLKCTLST_PHY_PLL_REQ;
1266 	u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
1267 		     B43_BCMA_CLKCTLST_PHY_PLL_ST;
1268 	u32 flags;
1269 
1270 	flags = B43_BCMA_IOCTL_PHY_CLKEN;
1271 	if (gmode)
1272 		flags |= B43_BCMA_IOCTL_GMODE;
1273 	b43_device_enable(dev, flags);
1274 
1275 	if (dev->phy.type == B43_PHYTYPE_AC) {
1276 		u16 tmp;
1277 
1278 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1279 		tmp &= ~B43_BCMA_IOCTL_DAC;
1280 		tmp |= 0x100;
1281 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1282 
1283 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1284 		tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
1285 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1286 
1287 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1288 		tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
1289 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
1290 	}
1291 
1292 	bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1293 	b43_bcma_phy_reset(dev);
1294 	bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
1295 }
1296 #endif
1297 
1298 #ifdef CONFIG_B43_SSB
1299 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1300 {
1301 	u32 flags = 0;
1302 
1303 	if (gmode)
1304 		flags |= B43_TMSLOW_GMODE;
1305 	flags |= B43_TMSLOW_PHYCLKEN;
1306 	flags |= B43_TMSLOW_PHYRESET;
1307 	if (dev->phy.type == B43_PHYTYPE_N)
1308 		flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1309 	b43_device_enable(dev, flags);
1310 	msleep(2);		/* Wait for the PLL to turn on. */
1311 
1312 	b43_phy_take_out_of_reset(dev);
1313 }
1314 #endif
1315 
1316 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1317 {
1318 	u32 macctl;
1319 
1320 	switch (dev->dev->bus_type) {
1321 #ifdef CONFIG_B43_BCMA
1322 	case B43_BUS_BCMA:
1323 		b43_bcma_wireless_core_reset(dev, gmode);
1324 		break;
1325 #endif
1326 #ifdef CONFIG_B43_SSB
1327 	case B43_BUS_SSB:
1328 		b43_ssb_wireless_core_reset(dev, gmode);
1329 		break;
1330 #endif
1331 	}
1332 
1333 	/* Turn Analog ON, but only if we already know the PHY-type.
1334 	 * This protects against very early setup where we don't know the
1335 	 * PHY-type, yet. wireless_core_reset will be called once again later,
1336 	 * when we know the PHY-type. */
1337 	if (dev->phy.ops)
1338 		dev->phy.ops->switch_analog(dev, 1);
1339 
1340 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
1341 	macctl &= ~B43_MACCTL_GMODE;
1342 	if (gmode)
1343 		macctl |= B43_MACCTL_GMODE;
1344 	macctl |= B43_MACCTL_IHR_ENABLED;
1345 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
1346 }
1347 
1348 static void handle_irq_transmit_status(struct b43_wldev *dev)
1349 {
1350 	u32 v0, v1;
1351 	u16 tmp;
1352 	struct b43_txstatus stat;
1353 
1354 	while (1) {
1355 		v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1356 		if (!(v0 & 0x00000001))
1357 			break;
1358 		v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1359 
1360 		stat.cookie = (v0 >> 16);
1361 		stat.seq = (v1 & 0x0000FFFF);
1362 		stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1363 		tmp = (v0 & 0x0000FFFF);
1364 		stat.frame_count = ((tmp & 0xF000) >> 12);
1365 		stat.rts_count = ((tmp & 0x0F00) >> 8);
1366 		stat.supp_reason = ((tmp & 0x001C) >> 2);
1367 		stat.pm_indicated = !!(tmp & 0x0080);
1368 		stat.intermediate = !!(tmp & 0x0040);
1369 		stat.for_ampdu = !!(tmp & 0x0020);
1370 		stat.acked = !!(tmp & 0x0002);
1371 
1372 		b43_handle_txstatus(dev, &stat);
1373 	}
1374 }
1375 
1376 static void drain_txstatus_queue(struct b43_wldev *dev)
1377 {
1378 	u32 dummy;
1379 
1380 	if (dev->dev->core_rev < 5)
1381 		return;
1382 	/* Read all entries from the microcode TXstatus FIFO
1383 	 * and throw them away.
1384 	 */
1385 	while (1) {
1386 		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1387 		if (!(dummy & 0x00000001))
1388 			break;
1389 		dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1390 	}
1391 }
1392 
1393 static u32 b43_jssi_read(struct b43_wldev *dev)
1394 {
1395 	u32 val = 0;
1396 
1397 	val = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1);
1398 	val <<= 16;
1399 	val |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0);
1400 
1401 	return val;
1402 }
1403 
1404 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1405 {
1406 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI0,
1407 			(jssi & 0x0000FFFF));
1408 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_JSSI1,
1409 			(jssi & 0xFFFF0000) >> 16);
1410 }
1411 
1412 static void b43_generate_noise_sample(struct b43_wldev *dev)
1413 {
1414 	b43_jssi_write(dev, 0x7F7F7F7F);
1415 	b43_write32(dev, B43_MMIO_MACCMD,
1416 		    b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1417 }
1418 
1419 static void b43_calculate_link_quality(struct b43_wldev *dev)
1420 {
1421 	/* Top half of Link Quality calculation. */
1422 
1423 	if (dev->phy.type != B43_PHYTYPE_G)
1424 		return;
1425 	if (dev->noisecalc.calculation_running)
1426 		return;
1427 	dev->noisecalc.calculation_running = true;
1428 	dev->noisecalc.nr_samples = 0;
1429 
1430 	b43_generate_noise_sample(dev);
1431 }
1432 
1433 static void handle_irq_noise(struct b43_wldev *dev)
1434 {
1435 	struct b43_phy_g *phy = dev->phy.g;
1436 	u16 tmp;
1437 	u8 noise[4];
1438 	u8 i, j;
1439 	s32 average;
1440 
1441 	/* Bottom half of Link Quality calculation. */
1442 
1443 	if (dev->phy.type != B43_PHYTYPE_G)
1444 		return;
1445 
1446 	/* Possible race condition: It might be possible that the user
1447 	 * changed to a different channel in the meantime since we
1448 	 * started the calculation. We ignore that fact, since it's
1449 	 * not really that much of a problem. The background noise is
1450 	 * an estimation only anyway. Slightly wrong results will get damped
1451 	 * by the averaging of the 8 sample rounds. Additionally the
1452 	 * value is shortlived. So it will be replaced by the next noise
1453 	 * calculation round soon. */
1454 
1455 	B43_WARN_ON(!dev->noisecalc.calculation_running);
1456 	*((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1457 	if (noise[0] == 0x7F || noise[1] == 0x7F ||
1458 	    noise[2] == 0x7F || noise[3] == 0x7F)
1459 		goto generate_new;
1460 
1461 	/* Get the noise samples. */
1462 	B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1463 	i = dev->noisecalc.nr_samples;
1464 	noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1465 	noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1466 	noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1467 	noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1468 	dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1469 	dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1470 	dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1471 	dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1472 	dev->noisecalc.nr_samples++;
1473 	if (dev->noisecalc.nr_samples == 8) {
1474 		/* Calculate the Link Quality by the noise samples. */
1475 		average = 0;
1476 		for (i = 0; i < 8; i++) {
1477 			for (j = 0; j < 4; j++)
1478 				average += dev->noisecalc.samples[i][j];
1479 		}
1480 		average /= (8 * 4);
1481 		average *= 125;
1482 		average += 64;
1483 		average /= 128;
1484 		tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1485 		tmp = (tmp / 128) & 0x1F;
1486 		if (tmp >= 8)
1487 			average += 2;
1488 		else
1489 			average -= 25;
1490 		if (tmp == 8)
1491 			average -= 72;
1492 		else
1493 			average -= 48;
1494 
1495 		dev->stats.link_noise = average;
1496 		dev->noisecalc.calculation_running = false;
1497 		return;
1498 	}
1499 generate_new:
1500 	b43_generate_noise_sample(dev);
1501 }
1502 
1503 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1504 {
1505 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1506 		///TODO: PS TBTT
1507 	} else {
1508 		if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1509 			b43_power_saving_ctl_bits(dev, 0);
1510 	}
1511 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1512 		dev->dfq_valid = true;
1513 }
1514 
1515 static void handle_irq_atim_end(struct b43_wldev *dev)
1516 {
1517 	if (dev->dfq_valid) {
1518 		b43_write32(dev, B43_MMIO_MACCMD,
1519 			    b43_read32(dev, B43_MMIO_MACCMD)
1520 			    | B43_MACCMD_DFQ_VALID);
1521 		dev->dfq_valid = false;
1522 	}
1523 }
1524 
1525 static void handle_irq_pmq(struct b43_wldev *dev)
1526 {
1527 	u32 tmp;
1528 
1529 	//TODO: AP mode.
1530 
1531 	while (1) {
1532 		tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1533 		if (!(tmp & 0x00000008))
1534 			break;
1535 	}
1536 	/* 16bit write is odd, but correct. */
1537 	b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1538 }
1539 
1540 static void b43_write_template_common(struct b43_wldev *dev,
1541 				      const u8 *data, u16 size,
1542 				      u16 ram_offset,
1543 				      u16 shm_size_offset, u8 rate)
1544 {
1545 	u32 i, tmp;
1546 	struct b43_plcp_hdr4 plcp;
1547 
1548 	plcp.data = 0;
1549 	b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1550 	b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1551 	ram_offset += sizeof(u32);
1552 	/* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1553 	 * So leave the first two bytes of the next write blank.
1554 	 */
1555 	tmp = (u32) (data[0]) << 16;
1556 	tmp |= (u32) (data[1]) << 24;
1557 	b43_ram_write(dev, ram_offset, tmp);
1558 	ram_offset += sizeof(u32);
1559 	for (i = 2; i < size; i += sizeof(u32)) {
1560 		tmp = (u32) (data[i + 0]);
1561 		if (i + 1 < size)
1562 			tmp |= (u32) (data[i + 1]) << 8;
1563 		if (i + 2 < size)
1564 			tmp |= (u32) (data[i + 2]) << 16;
1565 		if (i + 3 < size)
1566 			tmp |= (u32) (data[i + 3]) << 24;
1567 		b43_ram_write(dev, ram_offset + i - 2, tmp);
1568 	}
1569 	b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1570 			size + sizeof(struct b43_plcp_hdr6));
1571 }
1572 
1573 /* Check if the use of the antenna that ieee80211 told us to
1574  * use is possible. This will fall back to DEFAULT.
1575  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1576 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1577 				  u8 antenna_nr)
1578 {
1579 	u8 antenna_mask;
1580 
1581 	if (antenna_nr == 0) {
1582 		/* Zero means "use default antenna". That's always OK. */
1583 		return 0;
1584 	}
1585 
1586 	/* Get the mask of available antennas. */
1587 	if (dev->phy.gmode)
1588 		antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1589 	else
1590 		antenna_mask = dev->dev->bus_sprom->ant_available_a;
1591 
1592 	if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1593 		/* This antenna is not available. Fall back to default. */
1594 		return 0;
1595 	}
1596 
1597 	return antenna_nr;
1598 }
1599 
1600 /* Convert a b43 antenna number value to the PHY TX control value. */
1601 static u16 b43_antenna_to_phyctl(int antenna)
1602 {
1603 	switch (antenna) {
1604 	case B43_ANTENNA0:
1605 		return B43_TXH_PHY_ANT0;
1606 	case B43_ANTENNA1:
1607 		return B43_TXH_PHY_ANT1;
1608 	case B43_ANTENNA2:
1609 		return B43_TXH_PHY_ANT2;
1610 	case B43_ANTENNA3:
1611 		return B43_TXH_PHY_ANT3;
1612 	case B43_ANTENNA_AUTO0:
1613 	case B43_ANTENNA_AUTO1:
1614 		return B43_TXH_PHY_ANT01AUTO;
1615 	}
1616 	B43_WARN_ON(1);
1617 	return 0;
1618 }
1619 
1620 static void b43_write_beacon_template(struct b43_wldev *dev,
1621 				      u16 ram_offset,
1622 				      u16 shm_size_offset)
1623 {
1624 	unsigned int i, len, variable_len;
1625 	const struct ieee80211_mgmt *bcn;
1626 	const u8 *ie;
1627 	bool tim_found = false;
1628 	unsigned int rate;
1629 	u16 ctl;
1630 	int antenna;
1631 	struct ieee80211_tx_info *info;
1632 	unsigned long flags;
1633 	struct sk_buff *beacon_skb;
1634 
1635 	spin_lock_irqsave(&dev->wl->beacon_lock, flags);
1636 	info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1637 	rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1638 	/* Clone the beacon, so it cannot go away, while we write it to hw. */
1639 	beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
1640 	spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
1641 
1642 	if (!beacon_skb) {
1643 		b43dbg(dev->wl, "Could not upload beacon. "
1644 		       "Failed to clone beacon skb.");
1645 		return;
1646 	}
1647 
1648 	bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
1649 	len = min_t(size_t, beacon_skb->len,
1650 		    0x200 - sizeof(struct b43_plcp_hdr6));
1651 
1652 	b43_write_template_common(dev, (const u8 *)bcn,
1653 				  len, ram_offset, shm_size_offset, rate);
1654 
1655 	/* Write the PHY TX control parameters. */
1656 	antenna = B43_ANTENNA_DEFAULT;
1657 	antenna = b43_antenna_to_phyctl(antenna);
1658 	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1659 	/* We can't send beacons with short preamble. Would get PHY errors. */
1660 	ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1661 	ctl &= ~B43_TXH_PHY_ANT;
1662 	ctl &= ~B43_TXH_PHY_ENC;
1663 	ctl |= antenna;
1664 	if (b43_is_cck_rate(rate))
1665 		ctl |= B43_TXH_PHY_ENC_CCK;
1666 	else
1667 		ctl |= B43_TXH_PHY_ENC_OFDM;
1668 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1669 
1670 	/* Find the position of the TIM and the DTIM_period value
1671 	 * and write them to SHM. */
1672 	ie = bcn->u.beacon.variable;
1673 	variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1674 	for (i = 0; i < variable_len - 2; ) {
1675 		uint8_t ie_id, ie_len;
1676 
1677 		ie_id = ie[i];
1678 		ie_len = ie[i + 1];
1679 		if (ie_id == 5) {
1680 			u16 tim_position;
1681 			u16 dtim_period;
1682 			/* This is the TIM Information Element */
1683 
1684 			/* Check whether the ie_len is in the beacon data range. */
1685 			if (variable_len < ie_len + 2 + i)
1686 				break;
1687 			/* A valid TIM is at least 4 bytes long. */
1688 			if (ie_len < 4)
1689 				break;
1690 			tim_found = true;
1691 
1692 			tim_position = sizeof(struct b43_plcp_hdr6);
1693 			tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1694 			tim_position += i;
1695 
1696 			dtim_period = ie[i + 3];
1697 
1698 			b43_shm_write16(dev, B43_SHM_SHARED,
1699 					B43_SHM_SH_TIMBPOS, tim_position);
1700 			b43_shm_write16(dev, B43_SHM_SHARED,
1701 					B43_SHM_SH_DTIMPER, dtim_period);
1702 			break;
1703 		}
1704 		i += ie_len + 2;
1705 	}
1706 	if (!tim_found) {
1707 		/*
1708 		 * If ucode wants to modify TIM do it behind the beacon, this
1709 		 * will happen, for example, when doing mesh networking.
1710 		 */
1711 		b43_shm_write16(dev, B43_SHM_SHARED,
1712 				B43_SHM_SH_TIMBPOS,
1713 				len + sizeof(struct b43_plcp_hdr6));
1714 		b43_shm_write16(dev, B43_SHM_SHARED,
1715 				B43_SHM_SH_DTIMPER, 0);
1716 	}
1717 	b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1718 
1719 	dev_kfree_skb_any(beacon_skb);
1720 }
1721 
1722 static void b43_upload_beacon0(struct b43_wldev *dev)
1723 {
1724 	struct b43_wl *wl = dev->wl;
1725 
1726 	if (wl->beacon0_uploaded)
1727 		return;
1728 	b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE0, B43_SHM_SH_BTL0);
1729 	wl->beacon0_uploaded = true;
1730 }
1731 
1732 static void b43_upload_beacon1(struct b43_wldev *dev)
1733 {
1734 	struct b43_wl *wl = dev->wl;
1735 
1736 	if (wl->beacon1_uploaded)
1737 		return;
1738 	b43_write_beacon_template(dev, B43_SHM_SH_BT_BASE1, B43_SHM_SH_BTL1);
1739 	wl->beacon1_uploaded = true;
1740 }
1741 
1742 static void handle_irq_beacon(struct b43_wldev *dev)
1743 {
1744 	struct b43_wl *wl = dev->wl;
1745 	u32 cmd, beacon0_valid, beacon1_valid;
1746 
1747 	if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1748 	    !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
1749 	    !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
1750 		return;
1751 
1752 	/* This is the bottom half of the asynchronous beacon update. */
1753 
1754 	/* Ignore interrupt in the future. */
1755 	dev->irq_mask &= ~B43_IRQ_BEACON;
1756 
1757 	cmd = b43_read32(dev, B43_MMIO_MACCMD);
1758 	beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1759 	beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1760 
1761 	/* Schedule interrupt manually, if busy. */
1762 	if (beacon0_valid && beacon1_valid) {
1763 		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1764 		dev->irq_mask |= B43_IRQ_BEACON;
1765 		return;
1766 	}
1767 
1768 	if (unlikely(wl->beacon_templates_virgin)) {
1769 		/* We never uploaded a beacon before.
1770 		 * Upload both templates now, but only mark one valid. */
1771 		wl->beacon_templates_virgin = false;
1772 		b43_upload_beacon0(dev);
1773 		b43_upload_beacon1(dev);
1774 		cmd = b43_read32(dev, B43_MMIO_MACCMD);
1775 		cmd |= B43_MACCMD_BEACON0_VALID;
1776 		b43_write32(dev, B43_MMIO_MACCMD, cmd);
1777 	} else {
1778 		if (!beacon0_valid) {
1779 			b43_upload_beacon0(dev);
1780 			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1781 			cmd |= B43_MACCMD_BEACON0_VALID;
1782 			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1783 		} else if (!beacon1_valid) {
1784 			b43_upload_beacon1(dev);
1785 			cmd = b43_read32(dev, B43_MMIO_MACCMD);
1786 			cmd |= B43_MACCMD_BEACON1_VALID;
1787 			b43_write32(dev, B43_MMIO_MACCMD, cmd);
1788 		}
1789 	}
1790 }
1791 
1792 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1793 {
1794 	u32 old_irq_mask = dev->irq_mask;
1795 
1796 	/* update beacon right away or defer to irq */
1797 	handle_irq_beacon(dev);
1798 	if (old_irq_mask != dev->irq_mask) {
1799 		/* The handler updated the IRQ mask. */
1800 		B43_WARN_ON(!dev->irq_mask);
1801 		if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1802 			b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1803 		} else {
1804 			/* Device interrupts are currently disabled. That means
1805 			 * we just ran the hardirq handler and scheduled the
1806 			 * IRQ thread. The thread will write the IRQ mask when
1807 			 * it finished, so there's nothing to do here. Writing
1808 			 * the mask _here_ would incorrectly re-enable IRQs. */
1809 		}
1810 	}
1811 }
1812 
1813 static void b43_beacon_update_trigger_work(struct work_struct *work)
1814 {
1815 	struct b43_wl *wl = container_of(work, struct b43_wl,
1816 					 beacon_update_trigger);
1817 	struct b43_wldev *dev;
1818 
1819 	mutex_lock(&wl->mutex);
1820 	dev = wl->current_dev;
1821 	if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1822 		if (b43_bus_host_is_sdio(dev->dev)) {
1823 			/* wl->mutex is enough. */
1824 			b43_do_beacon_update_trigger_work(dev);
1825 			mmiowb();
1826 		} else {
1827 			spin_lock_irq(&wl->hardirq_lock);
1828 			b43_do_beacon_update_trigger_work(dev);
1829 			mmiowb();
1830 			spin_unlock_irq(&wl->hardirq_lock);
1831 		}
1832 	}
1833 	mutex_unlock(&wl->mutex);
1834 }
1835 
1836 /* Asynchronously update the packet templates in template RAM. */
1837 static void b43_update_templates(struct b43_wl *wl)
1838 {
1839 	struct sk_buff *beacon, *old_beacon;
1840 	unsigned long flags;
1841 
1842 	/* This is the top half of the asynchronous beacon update.
1843 	 * The bottom half is the beacon IRQ.
1844 	 * Beacon update must be asynchronous to avoid sending an
1845 	 * invalid beacon. This can happen for example, if the firmware
1846 	 * transmits a beacon while we are updating it. */
1847 
1848 	/* We could modify the existing beacon and set the aid bit in
1849 	 * the TIM field, but that would probably require resizing and
1850 	 * moving of data within the beacon template.
1851 	 * Simply request a new beacon and let mac80211 do the hard work. */
1852 	beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1853 	if (unlikely(!beacon))
1854 		return;
1855 
1856 	spin_lock_irqsave(&wl->beacon_lock, flags);
1857 	old_beacon = wl->current_beacon;
1858 	wl->current_beacon = beacon;
1859 	wl->beacon0_uploaded = false;
1860 	wl->beacon1_uploaded = false;
1861 	spin_unlock_irqrestore(&wl->beacon_lock, flags);
1862 
1863 	ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1864 
1865 	if (old_beacon)
1866 		dev_kfree_skb_any(old_beacon);
1867 }
1868 
1869 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1870 {
1871 	b43_time_lock(dev);
1872 	if (dev->dev->core_rev >= 3) {
1873 		b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1874 		b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1875 	} else {
1876 		b43_write16(dev, 0x606, (beacon_int >> 6));
1877 		b43_write16(dev, 0x610, beacon_int);
1878 	}
1879 	b43_time_unlock(dev);
1880 	b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1881 }
1882 
1883 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1884 {
1885 	u16 reason;
1886 
1887 	/* Read the register that contains the reason code for the panic. */
1888 	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1889 	b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1890 
1891 	switch (reason) {
1892 	default:
1893 		b43dbg(dev->wl, "The panic reason is unknown.\n");
1894 		/* fallthrough */
1895 	case B43_FWPANIC_DIE:
1896 		/* Do not restart the controller or firmware.
1897 		 * The device is nonfunctional from now on.
1898 		 * Restarting would result in this panic to trigger again,
1899 		 * so we avoid that recursion. */
1900 		break;
1901 	case B43_FWPANIC_RESTART:
1902 		b43_controller_restart(dev, "Microcode panic");
1903 		break;
1904 	}
1905 }
1906 
1907 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1908 {
1909 	unsigned int i, cnt;
1910 	u16 reason, marker_id, marker_line;
1911 	__le16 *buf;
1912 
1913 	/* The proprietary firmware doesn't have this IRQ. */
1914 	if (!dev->fw.opensource)
1915 		return;
1916 
1917 	/* Read the register that contains the reason code for this IRQ. */
1918 	reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1919 
1920 	switch (reason) {
1921 	case B43_DEBUGIRQ_PANIC:
1922 		b43_handle_firmware_panic(dev);
1923 		break;
1924 	case B43_DEBUGIRQ_DUMP_SHM:
1925 		if (!B43_DEBUG)
1926 			break; /* Only with driver debugging enabled. */
1927 		buf = kmalloc(4096, GFP_ATOMIC);
1928 		if (!buf) {
1929 			b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1930 			goto out;
1931 		}
1932 		for (i = 0; i < 4096; i += 2) {
1933 			u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1934 			buf[i / 2] = cpu_to_le16(tmp);
1935 		}
1936 		b43info(dev->wl, "Shared memory dump:\n");
1937 		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1938 			       16, 2, buf, 4096, 1);
1939 		kfree(buf);
1940 		break;
1941 	case B43_DEBUGIRQ_DUMP_REGS:
1942 		if (!B43_DEBUG)
1943 			break; /* Only with driver debugging enabled. */
1944 		b43info(dev->wl, "Microcode register dump:\n");
1945 		for (i = 0, cnt = 0; i < 64; i++) {
1946 			u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1947 			if (cnt == 0)
1948 				printk(KERN_INFO);
1949 			printk("r%02u: 0x%04X  ", i, tmp);
1950 			cnt++;
1951 			if (cnt == 6) {
1952 				printk("\n");
1953 				cnt = 0;
1954 			}
1955 		}
1956 		printk("\n");
1957 		break;
1958 	case B43_DEBUGIRQ_MARKER:
1959 		if (!B43_DEBUG)
1960 			break; /* Only with driver debugging enabled. */
1961 		marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1962 					   B43_MARKER_ID_REG);
1963 		marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1964 					     B43_MARKER_LINE_REG);
1965 		b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1966 			"at line number %u\n",
1967 			marker_id, marker_line);
1968 		break;
1969 	default:
1970 		b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1971 		       reason);
1972 	}
1973 out:
1974 	/* Acknowledge the debug-IRQ, so the firmware can continue. */
1975 	b43_shm_write16(dev, B43_SHM_SCRATCH,
1976 			B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1977 }
1978 
1979 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1980 {
1981 	u32 reason;
1982 	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1983 	u32 merged_dma_reason = 0;
1984 	int i;
1985 
1986 	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1987 		return;
1988 
1989 	reason = dev->irq_reason;
1990 	for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1991 		dma_reason[i] = dev->dma_reason[i];
1992 		merged_dma_reason |= dma_reason[i];
1993 	}
1994 
1995 	if (unlikely(reason & B43_IRQ_MAC_TXERR))
1996 		b43err(dev->wl, "MAC transmission error\n");
1997 
1998 	if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1999 		b43err(dev->wl, "PHY transmission error\n");
2000 		rmb();
2001 		if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
2002 			atomic_set(&dev->phy.txerr_cnt,
2003 				   B43_PHY_TX_BADNESS_LIMIT);
2004 			b43err(dev->wl, "Too many PHY TX errors, "
2005 					"restarting the controller\n");
2006 			b43_controller_restart(dev, "PHY TX errors");
2007 		}
2008 	}
2009 
2010 	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
2011 		b43err(dev->wl,
2012 			"Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
2013 			dma_reason[0], dma_reason[1],
2014 			dma_reason[2], dma_reason[3],
2015 			dma_reason[4], dma_reason[5]);
2016 		b43err(dev->wl, "This device does not support DMA "
2017 			       "on your system. It will now be switched to PIO.\n");
2018 		/* Fall back to PIO transfers if we get fatal DMA errors! */
2019 		dev->use_pio = true;
2020 		b43_controller_restart(dev, "DMA error");
2021 		return;
2022 	}
2023 
2024 	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
2025 		handle_irq_ucode_debug(dev);
2026 	if (reason & B43_IRQ_TBTT_INDI)
2027 		handle_irq_tbtt_indication(dev);
2028 	if (reason & B43_IRQ_ATIM_END)
2029 		handle_irq_atim_end(dev);
2030 	if (reason & B43_IRQ_BEACON)
2031 		handle_irq_beacon(dev);
2032 	if (reason & B43_IRQ_PMQ)
2033 		handle_irq_pmq(dev);
2034 	if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
2035 		;/* TODO */
2036 	if (reason & B43_IRQ_NOISESAMPLE_OK)
2037 		handle_irq_noise(dev);
2038 
2039 	/* Check the DMA reason registers for received data. */
2040 	if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
2041 		if (B43_DEBUG)
2042 			b43warn(dev->wl, "RX descriptor underrun\n");
2043 		b43_dma_handle_rx_overflow(dev->dma.rx_ring);
2044 	}
2045 	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
2046 		if (b43_using_pio_transfers(dev))
2047 			b43_pio_rx(dev->pio.rx_queue);
2048 		else
2049 			b43_dma_rx(dev->dma.rx_ring);
2050 	}
2051 	B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
2052 	B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
2053 	B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
2054 	B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
2055 	B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
2056 
2057 	if (reason & B43_IRQ_TX_OK)
2058 		handle_irq_transmit_status(dev);
2059 
2060 	/* Re-enable interrupts on the device by restoring the current interrupt mask. */
2061 	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2062 
2063 #if B43_DEBUG
2064 	if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
2065 		dev->irq_count++;
2066 		for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
2067 			if (reason & (1 << i))
2068 				dev->irq_bit_count[i]++;
2069 		}
2070 	}
2071 #endif
2072 }
2073 
2074 /* Interrupt thread handler. Handles device interrupts in thread context. */
2075 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
2076 {
2077 	struct b43_wldev *dev = dev_id;
2078 
2079 	mutex_lock(&dev->wl->mutex);
2080 	b43_do_interrupt_thread(dev);
2081 	mmiowb();
2082 	mutex_unlock(&dev->wl->mutex);
2083 
2084 	return IRQ_HANDLED;
2085 }
2086 
2087 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
2088 {
2089 	u32 reason;
2090 
2091 	/* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
2092 	 * On SDIO, this runs under wl->mutex. */
2093 
2094 	reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2095 	if (reason == 0xffffffff)	/* shared IRQ */
2096 		return IRQ_NONE;
2097 	reason &= dev->irq_mask;
2098 	if (!reason)
2099 		return IRQ_NONE;
2100 
2101 	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
2102 	    & 0x0001FC00;
2103 	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
2104 	    & 0x0000DC00;
2105 	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
2106 	    & 0x0000DC00;
2107 	dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
2108 	    & 0x0001DC00;
2109 	dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
2110 	    & 0x0000DC00;
2111 /* Unused ring
2112 	dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2113 	    & 0x0000DC00;
2114 */
2115 
2116 	/* ACK the interrupt. */
2117 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2118 	b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2119 	b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2120 	b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2121 	b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2122 	b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2123 /* Unused ring
2124 	b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2125 */
2126 
2127 	/* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2128 	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2129 	/* Save the reason bitmasks for the IRQ thread handler. */
2130 	dev->irq_reason = reason;
2131 
2132 	return IRQ_WAKE_THREAD;
2133 }
2134 
2135 /* Interrupt handler top-half. This runs with interrupts disabled. */
2136 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2137 {
2138 	struct b43_wldev *dev = dev_id;
2139 	irqreturn_t ret;
2140 
2141 	if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2142 		return IRQ_NONE;
2143 
2144 	spin_lock(&dev->wl->hardirq_lock);
2145 	ret = b43_do_interrupt(dev);
2146 	mmiowb();
2147 	spin_unlock(&dev->wl->hardirq_lock);
2148 
2149 	return ret;
2150 }
2151 
2152 /* SDIO interrupt handler. This runs in process context. */
2153 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2154 {
2155 	struct b43_wl *wl = dev->wl;
2156 	irqreturn_t ret;
2157 
2158 	mutex_lock(&wl->mutex);
2159 
2160 	ret = b43_do_interrupt(dev);
2161 	if (ret == IRQ_WAKE_THREAD)
2162 		b43_do_interrupt_thread(dev);
2163 
2164 	mutex_unlock(&wl->mutex);
2165 }
2166 
2167 void b43_do_release_fw(struct b43_firmware_file *fw)
2168 {
2169 	release_firmware(fw->data);
2170 	fw->data = NULL;
2171 	fw->filename = NULL;
2172 }
2173 
2174 static void b43_release_firmware(struct b43_wldev *dev)
2175 {
2176 	complete(&dev->fw_load_complete);
2177 	b43_do_release_fw(&dev->fw.ucode);
2178 	b43_do_release_fw(&dev->fw.pcm);
2179 	b43_do_release_fw(&dev->fw.initvals);
2180 	b43_do_release_fw(&dev->fw.initvals_band);
2181 }
2182 
2183 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2184 {
2185 	const char text[] =
2186 		"You must go to " \
2187 		"http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2188 		"and download the correct firmware for this driver version. " \
2189 		"Please carefully read all instructions on this website.\n";
2190 
2191 	if (error)
2192 		b43err(wl, text);
2193 	else
2194 		b43warn(wl, text);
2195 }
2196 
2197 static void b43_fw_cb(const struct firmware *firmware, void *context)
2198 {
2199 	struct b43_request_fw_context *ctx = context;
2200 
2201 	ctx->blob = firmware;
2202 	complete(&ctx->dev->fw_load_complete);
2203 }
2204 
2205 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2206 		      const char *name,
2207 		      struct b43_firmware_file *fw, bool async)
2208 {
2209 	struct b43_fw_header *hdr;
2210 	u32 size;
2211 	int err;
2212 
2213 	if (!name) {
2214 		/* Don't fetch anything. Free possibly cached firmware. */
2215 		/* FIXME: We should probably keep it anyway, to save some headache
2216 		 * on suspend/resume with multiband devices. */
2217 		b43_do_release_fw(fw);
2218 		return 0;
2219 	}
2220 	if (fw->filename) {
2221 		if ((fw->type == ctx->req_type) &&
2222 		    (strcmp(fw->filename, name) == 0))
2223 			return 0; /* Already have this fw. */
2224 		/* Free the cached firmware first. */
2225 		/* FIXME: We should probably do this later after we successfully
2226 		 * got the new fw. This could reduce headache with multiband devices.
2227 		 * We could also redesign this to cache the firmware for all possible
2228 		 * bands all the time. */
2229 		b43_do_release_fw(fw);
2230 	}
2231 
2232 	switch (ctx->req_type) {
2233 	case B43_FWTYPE_PROPRIETARY:
2234 		snprintf(ctx->fwname, sizeof(ctx->fwname),
2235 			 "b43%s/%s.fw",
2236 			 modparam_fwpostfix, name);
2237 		break;
2238 	case B43_FWTYPE_OPENSOURCE:
2239 		snprintf(ctx->fwname, sizeof(ctx->fwname),
2240 			 "b43-open%s/%s.fw",
2241 			 modparam_fwpostfix, name);
2242 		break;
2243 	default:
2244 		B43_WARN_ON(1);
2245 		return -ENOSYS;
2246 	}
2247 	if (async) {
2248 		/* do this part asynchronously */
2249 		init_completion(&ctx->dev->fw_load_complete);
2250 		err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
2251 					      ctx->dev->dev->dev, GFP_KERNEL,
2252 					      ctx, b43_fw_cb);
2253 		if (err < 0) {
2254 			pr_err("Unable to load firmware\n");
2255 			return err;
2256 		}
2257 		wait_for_completion(&ctx->dev->fw_load_complete);
2258 		if (ctx->blob)
2259 			goto fw_ready;
2260 	/* On some ARM systems, the async request will fail, but the next sync
2261 	 * request works. For this reason, we fall through here
2262 	 */
2263 	}
2264 	err = request_firmware(&ctx->blob, ctx->fwname,
2265 			       ctx->dev->dev->dev);
2266 	if (err == -ENOENT) {
2267 		snprintf(ctx->errors[ctx->req_type],
2268 			 sizeof(ctx->errors[ctx->req_type]),
2269 			 "Firmware file \"%s\" not found\n",
2270 			 ctx->fwname);
2271 		return err;
2272 	} else if (err) {
2273 		snprintf(ctx->errors[ctx->req_type],
2274 			 sizeof(ctx->errors[ctx->req_type]),
2275 			 "Firmware file \"%s\" request failed (err=%d)\n",
2276 			 ctx->fwname, err);
2277 		return err;
2278 	}
2279 fw_ready:
2280 	if (ctx->blob->size < sizeof(struct b43_fw_header))
2281 		goto err_format;
2282 	hdr = (struct b43_fw_header *)(ctx->blob->data);
2283 	switch (hdr->type) {
2284 	case B43_FW_TYPE_UCODE:
2285 	case B43_FW_TYPE_PCM:
2286 		size = be32_to_cpu(hdr->size);
2287 		if (size != ctx->blob->size - sizeof(struct b43_fw_header))
2288 			goto err_format;
2289 		/* fallthrough */
2290 	case B43_FW_TYPE_IV:
2291 		if (hdr->ver != 1)
2292 			goto err_format;
2293 		break;
2294 	default:
2295 		goto err_format;
2296 	}
2297 
2298 	fw->data = ctx->blob;
2299 	fw->filename = name;
2300 	fw->type = ctx->req_type;
2301 
2302 	return 0;
2303 
2304 err_format:
2305 	snprintf(ctx->errors[ctx->req_type],
2306 		 sizeof(ctx->errors[ctx->req_type]),
2307 		 "Firmware file \"%s\" format error.\n", ctx->fwname);
2308 	release_firmware(ctx->blob);
2309 
2310 	return -EPROTO;
2311 }
2312 
2313 /* http://bcm-v4.sipsolutions.net/802.11/Init/Firmware */
2314 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2315 {
2316 	struct b43_wldev *dev = ctx->dev;
2317 	struct b43_firmware *fw = &ctx->dev->fw;
2318 	struct b43_phy *phy = &dev->phy;
2319 	const u8 rev = ctx->dev->dev->core_rev;
2320 	const char *filename;
2321 	int err;
2322 
2323 	/* Get microcode */
2324 	filename = NULL;
2325 	switch (rev) {
2326 	case 42:
2327 		if (phy->type == B43_PHYTYPE_AC)
2328 			filename = "ucode42";
2329 		break;
2330 	case 40:
2331 		if (phy->type == B43_PHYTYPE_AC)
2332 			filename = "ucode40";
2333 		break;
2334 	case 33:
2335 		if (phy->type == B43_PHYTYPE_LCN40)
2336 			filename = "ucode33_lcn40";
2337 		break;
2338 	case 30:
2339 		if (phy->type == B43_PHYTYPE_N)
2340 			filename = "ucode30_mimo";
2341 		break;
2342 	case 29:
2343 		if (phy->type == B43_PHYTYPE_HT)
2344 			filename = "ucode29_mimo";
2345 		break;
2346 	case 26:
2347 		if (phy->type == B43_PHYTYPE_HT)
2348 			filename = "ucode26_mimo";
2349 		break;
2350 	case 28:
2351 	case 25:
2352 		if (phy->type == B43_PHYTYPE_N)
2353 			filename = "ucode25_mimo";
2354 		else if (phy->type == B43_PHYTYPE_LCN)
2355 			filename = "ucode25_lcn";
2356 		break;
2357 	case 24:
2358 		if (phy->type == B43_PHYTYPE_LCN)
2359 			filename = "ucode24_lcn";
2360 		break;
2361 	case 23:
2362 		if (phy->type == B43_PHYTYPE_N)
2363 			filename = "ucode16_mimo";
2364 		break;
2365 	case 16 ... 19:
2366 		if (phy->type == B43_PHYTYPE_N)
2367 			filename = "ucode16_mimo";
2368 		else if (phy->type == B43_PHYTYPE_LP)
2369 			filename = "ucode16_lp";
2370 		break;
2371 	case 15:
2372 		filename = "ucode15";
2373 		break;
2374 	case 14:
2375 		filename = "ucode14";
2376 		break;
2377 	case 13:
2378 		filename = "ucode13";
2379 		break;
2380 	case 11 ... 12:
2381 		filename = "ucode11";
2382 		break;
2383 	case 5 ... 10:
2384 		filename = "ucode5";
2385 		break;
2386 	}
2387 	if (!filename)
2388 		goto err_no_ucode;
2389 	err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
2390 	if (err)
2391 		goto err_load;
2392 
2393 	/* Get PCM code */
2394 	if ((rev >= 5) && (rev <= 10))
2395 		filename = "pcm5";
2396 	else if (rev >= 11)
2397 		filename = NULL;
2398 	else
2399 		goto err_no_pcm;
2400 	fw->pcm_request_failed = false;
2401 	err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
2402 	if (err == -ENOENT) {
2403 		/* We did not find a PCM file? Not fatal, but
2404 		 * core rev <= 10 must do without hwcrypto then. */
2405 		fw->pcm_request_failed = true;
2406 	} else if (err)
2407 		goto err_load;
2408 
2409 	/* Get initvals */
2410 	filename = NULL;
2411 	switch (dev->phy.type) {
2412 	case B43_PHYTYPE_G:
2413 		if (rev == 13)
2414 			filename = "b0g0initvals13";
2415 		else if (rev >= 5 && rev <= 10)
2416 			filename = "b0g0initvals5";
2417 		break;
2418 	case B43_PHYTYPE_N:
2419 		if (rev == 30)
2420 			filename = "n16initvals30";
2421 		else if (rev == 28 || rev == 25)
2422 			filename = "n0initvals25";
2423 		else if (rev == 24)
2424 			filename = "n0initvals24";
2425 		else if (rev == 23)
2426 			filename = "n0initvals16"; /* What about n0initvals22? */
2427 		else if (rev >= 16 && rev <= 18)
2428 			filename = "n0initvals16";
2429 		else if (rev >= 11 && rev <= 12)
2430 			filename = "n0initvals11";
2431 		break;
2432 	case B43_PHYTYPE_LP:
2433 		if (rev >= 16 && rev <= 18)
2434 			filename = "lp0initvals16";
2435 		else if (rev == 15)
2436 			filename = "lp0initvals15";
2437 		else if (rev == 14)
2438 			filename = "lp0initvals14";
2439 		else if (rev == 13)
2440 			filename = "lp0initvals13";
2441 		break;
2442 	case B43_PHYTYPE_HT:
2443 		if (rev == 29)
2444 			filename = "ht0initvals29";
2445 		else if (rev == 26)
2446 			filename = "ht0initvals26";
2447 		break;
2448 	case B43_PHYTYPE_LCN:
2449 		if (rev == 24)
2450 			filename = "lcn0initvals24";
2451 		break;
2452 	case B43_PHYTYPE_LCN40:
2453 		if (rev == 33)
2454 			filename = "lcn400initvals33";
2455 		break;
2456 	case B43_PHYTYPE_AC:
2457 		if (rev == 42)
2458 			filename = "ac1initvals42";
2459 		else if (rev == 40)
2460 			filename = "ac0initvals40";
2461 		break;
2462 	}
2463 	if (!filename)
2464 		goto err_no_initvals;
2465 	err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
2466 	if (err)
2467 		goto err_load;
2468 
2469 	/* Get bandswitch initvals */
2470 	filename = NULL;
2471 	switch (dev->phy.type) {
2472 	case B43_PHYTYPE_G:
2473 		if (rev == 13)
2474 			filename = "b0g0bsinitvals13";
2475 		else if (rev >= 5 && rev <= 10)
2476 			filename = "b0g0bsinitvals5";
2477 		break;
2478 	case B43_PHYTYPE_N:
2479 		if (rev == 30)
2480 			filename = "n16bsinitvals30";
2481 		else if (rev == 28 || rev == 25)
2482 			filename = "n0bsinitvals25";
2483 		else if (rev == 24)
2484 			filename = "n0bsinitvals24";
2485 		else if (rev == 23)
2486 			filename = "n0bsinitvals16"; /* What about n0bsinitvals22? */
2487 		else if (rev >= 16 && rev <= 18)
2488 			filename = "n0bsinitvals16";
2489 		else if (rev >= 11 && rev <= 12)
2490 			filename = "n0bsinitvals11";
2491 		break;
2492 	case B43_PHYTYPE_LP:
2493 		if (rev >= 16 && rev <= 18)
2494 			filename = "lp0bsinitvals16";
2495 		else if (rev == 15)
2496 			filename = "lp0bsinitvals15";
2497 		else if (rev == 14)
2498 			filename = "lp0bsinitvals14";
2499 		else if (rev == 13)
2500 			filename = "lp0bsinitvals13";
2501 		break;
2502 	case B43_PHYTYPE_HT:
2503 		if (rev == 29)
2504 			filename = "ht0bsinitvals29";
2505 		else if (rev == 26)
2506 			filename = "ht0bsinitvals26";
2507 		break;
2508 	case B43_PHYTYPE_LCN:
2509 		if (rev == 24)
2510 			filename = "lcn0bsinitvals24";
2511 		break;
2512 	case B43_PHYTYPE_LCN40:
2513 		if (rev == 33)
2514 			filename = "lcn400bsinitvals33";
2515 		break;
2516 	case B43_PHYTYPE_AC:
2517 		if (rev == 42)
2518 			filename = "ac1bsinitvals42";
2519 		else if (rev == 40)
2520 			filename = "ac0bsinitvals40";
2521 		break;
2522 	}
2523 	if (!filename)
2524 		goto err_no_initvals;
2525 	err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
2526 	if (err)
2527 		goto err_load;
2528 
2529 	fw->opensource = (ctx->req_type == B43_FWTYPE_OPENSOURCE);
2530 
2531 	return 0;
2532 
2533 err_no_ucode:
2534 	err = ctx->fatal_failure = -EOPNOTSUPP;
2535 	b43err(dev->wl, "The driver does not know which firmware (ucode) "
2536 	       "is required for your device (wl-core rev %u)\n", rev);
2537 	goto error;
2538 
2539 err_no_pcm:
2540 	err = ctx->fatal_failure = -EOPNOTSUPP;
2541 	b43err(dev->wl, "The driver does not know which firmware (PCM) "
2542 	       "is required for your device (wl-core rev %u)\n", rev);
2543 	goto error;
2544 
2545 err_no_initvals:
2546 	err = ctx->fatal_failure = -EOPNOTSUPP;
2547 	b43err(dev->wl, "The driver does not know which firmware (initvals) "
2548 	       "is required for your device (wl-core rev %u)\n", rev);
2549 	goto error;
2550 
2551 err_load:
2552 	/* We failed to load this firmware image. The error message
2553 	 * already is in ctx->errors. Return and let our caller decide
2554 	 * what to do. */
2555 	goto error;
2556 
2557 error:
2558 	b43_release_firmware(dev);
2559 	return err;
2560 }
2561 
2562 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
2563 static void b43_one_core_detach(struct b43_bus_dev *dev);
2564 static int b43_rng_init(struct b43_wl *wl);
2565 
2566 static void b43_request_firmware(struct work_struct *work)
2567 {
2568 	struct b43_wl *wl = container_of(work,
2569 			    struct b43_wl, firmware_load);
2570 	struct b43_wldev *dev = wl->current_dev;
2571 	struct b43_request_fw_context *ctx;
2572 	unsigned int i;
2573 	int err;
2574 	const char *errmsg;
2575 
2576 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2577 	if (!ctx)
2578 		return;
2579 	ctx->dev = dev;
2580 
2581 	ctx->req_type = B43_FWTYPE_PROPRIETARY;
2582 	err = b43_try_request_fw(ctx);
2583 	if (!err)
2584 		goto start_ieee80211; /* Successfully loaded it. */
2585 	/* Was fw version known? */
2586 	if (ctx->fatal_failure)
2587 		goto out;
2588 
2589 	/* proprietary fw not found, try open source */
2590 	ctx->req_type = B43_FWTYPE_OPENSOURCE;
2591 	err = b43_try_request_fw(ctx);
2592 	if (!err)
2593 		goto start_ieee80211; /* Successfully loaded it. */
2594 	if(ctx->fatal_failure)
2595 		goto out;
2596 
2597 	/* Could not find a usable firmware. Print the errors. */
2598 	for (i = 0; i < B43_NR_FWTYPES; i++) {
2599 		errmsg = ctx->errors[i];
2600 		if (strlen(errmsg))
2601 			b43err(dev->wl, "%s", errmsg);
2602 	}
2603 	b43_print_fw_helptext(dev->wl, 1);
2604 	goto out;
2605 
2606 start_ieee80211:
2607 	wl->hw->queues = B43_QOS_QUEUE_NUM;
2608 	if (!modparam_qos || dev->fw.opensource)
2609 		wl->hw->queues = 1;
2610 
2611 	err = ieee80211_register_hw(wl->hw);
2612 	if (err)
2613 		goto err_one_core_detach;
2614 	wl->hw_registred = true;
2615 	b43_leds_register(wl->current_dev);
2616 
2617 	/* Register HW RNG driver */
2618 	b43_rng_init(wl);
2619 
2620 	goto out;
2621 
2622 err_one_core_detach:
2623 	b43_one_core_detach(dev->dev);
2624 
2625 out:
2626 	kfree(ctx);
2627 }
2628 
2629 static int b43_upload_microcode(struct b43_wldev *dev)
2630 {
2631 	struct wiphy *wiphy = dev->wl->hw->wiphy;
2632 	const size_t hdr_len = sizeof(struct b43_fw_header);
2633 	const __be32 *data;
2634 	unsigned int i, len;
2635 	u16 fwrev, fwpatch, fwdate, fwtime;
2636 	u32 tmp, macctl;
2637 	int err = 0;
2638 
2639 	/* Jump the microcode PSM to offset 0 */
2640 	macctl = b43_read32(dev, B43_MMIO_MACCTL);
2641 	B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2642 	macctl |= B43_MACCTL_PSM_JMP0;
2643 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
2644 	/* Zero out all microcode PSM registers and shared memory. */
2645 	for (i = 0; i < 64; i++)
2646 		b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2647 	for (i = 0; i < 4096; i += 2)
2648 		b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2649 
2650 	/* Upload Microcode. */
2651 	data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2652 	len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2653 	b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2654 	for (i = 0; i < len; i++) {
2655 		b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2656 		udelay(10);
2657 	}
2658 
2659 	if (dev->fw.pcm.data) {
2660 		/* Upload PCM data. */
2661 		data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2662 		len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2663 		b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2664 		b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2665 		/* No need for autoinc bit in SHM_HW */
2666 		b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2667 		for (i = 0; i < len; i++) {
2668 			b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2669 			udelay(10);
2670 		}
2671 	}
2672 
2673 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2674 
2675 	/* Start the microcode PSM */
2676 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_JMP0,
2677 		      B43_MACCTL_PSM_RUN);
2678 
2679 	/* Wait for the microcode to load and respond */
2680 	i = 0;
2681 	while (1) {
2682 		tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2683 		if (tmp == B43_IRQ_MAC_SUSPENDED)
2684 			break;
2685 		i++;
2686 		if (i >= 20) {
2687 			b43err(dev->wl, "Microcode not responding\n");
2688 			b43_print_fw_helptext(dev->wl, 1);
2689 			err = -ENODEV;
2690 			goto error;
2691 		}
2692 		msleep(50);
2693 	}
2694 	b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);	/* dummy read */
2695 
2696 	/* Get and check the revisions. */
2697 	fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2698 	fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2699 	fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2700 	fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2701 
2702 	if (fwrev <= 0x128) {
2703 		b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2704 		       "binary drivers older than version 4.x is unsupported. "
2705 		       "You must upgrade your firmware files.\n");
2706 		b43_print_fw_helptext(dev->wl, 1);
2707 		err = -EOPNOTSUPP;
2708 		goto error;
2709 	}
2710 	dev->fw.rev = fwrev;
2711 	dev->fw.patch = fwpatch;
2712 	if (dev->fw.rev >= 598)
2713 		dev->fw.hdr_format = B43_FW_HDR_598;
2714 	else if (dev->fw.rev >= 410)
2715 		dev->fw.hdr_format = B43_FW_HDR_410;
2716 	else
2717 		dev->fw.hdr_format = B43_FW_HDR_351;
2718 	WARN_ON(dev->fw.opensource != (fwdate == 0xFFFF));
2719 
2720 	dev->qos_enabled = dev->wl->hw->queues > 1;
2721 	/* Default to firmware/hardware crypto acceleration. */
2722 	dev->hwcrypto_enabled = true;
2723 
2724 	if (dev->fw.opensource) {
2725 		u16 fwcapa;
2726 
2727 		/* Patchlevel info is encoded in the "time" field. */
2728 		dev->fw.patch = fwtime;
2729 		b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2730 			dev->fw.rev, dev->fw.patch);
2731 
2732 		fwcapa = b43_fwcapa_read(dev);
2733 		if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2734 			b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2735 			/* Disable hardware crypto and fall back to software crypto. */
2736 			dev->hwcrypto_enabled = false;
2737 		}
2738 		/* adding QoS support should use an offline discovery mechanism */
2739 		WARN(fwcapa & B43_FWCAPA_QOS, "QoS in OpenFW not supported\n");
2740 	} else {
2741 		b43info(dev->wl, "Loading firmware version %u.%u "
2742 			"(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2743 			fwrev, fwpatch,
2744 			(fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2745 			(fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2746 		if (dev->fw.pcm_request_failed) {
2747 			b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2748 				"Hardware accelerated cryptography is disabled.\n");
2749 			b43_print_fw_helptext(dev->wl, 0);
2750 		}
2751 	}
2752 
2753 	snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2754 			dev->fw.rev, dev->fw.patch);
2755 	wiphy->hw_version = dev->dev->core_id;
2756 
2757 	if (dev->fw.hdr_format == B43_FW_HDR_351) {
2758 		/* We're over the deadline, but we keep support for old fw
2759 		 * until it turns out to be in major conflict with something new. */
2760 		b43warn(dev->wl, "You are using an old firmware image. "
2761 			"Support for old firmware will be removed soon "
2762 			"(official deadline was July 2008).\n");
2763 		b43_print_fw_helptext(dev->wl, 0);
2764 	}
2765 
2766 	return 0;
2767 
2768 error:
2769 	/* Stop the microcode PSM. */
2770 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
2771 		      B43_MACCTL_PSM_JMP0);
2772 
2773 	return err;
2774 }
2775 
2776 static int b43_write_initvals(struct b43_wldev *dev,
2777 			      const struct b43_iv *ivals,
2778 			      size_t count,
2779 			      size_t array_size)
2780 {
2781 	const struct b43_iv *iv;
2782 	u16 offset;
2783 	size_t i;
2784 	bool bit32;
2785 
2786 	BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2787 	iv = ivals;
2788 	for (i = 0; i < count; i++) {
2789 		if (array_size < sizeof(iv->offset_size))
2790 			goto err_format;
2791 		array_size -= sizeof(iv->offset_size);
2792 		offset = be16_to_cpu(iv->offset_size);
2793 		bit32 = !!(offset & B43_IV_32BIT);
2794 		offset &= B43_IV_OFFSET_MASK;
2795 		if (offset >= 0x1000)
2796 			goto err_format;
2797 		if (bit32) {
2798 			u32 value;
2799 
2800 			if (array_size < sizeof(iv->data.d32))
2801 				goto err_format;
2802 			array_size -= sizeof(iv->data.d32);
2803 
2804 			value = get_unaligned_be32(&iv->data.d32);
2805 			b43_write32(dev, offset, value);
2806 
2807 			iv = (const struct b43_iv *)((const uint8_t *)iv +
2808 							sizeof(__be16) +
2809 							sizeof(__be32));
2810 		} else {
2811 			u16 value;
2812 
2813 			if (array_size < sizeof(iv->data.d16))
2814 				goto err_format;
2815 			array_size -= sizeof(iv->data.d16);
2816 
2817 			value = be16_to_cpu(iv->data.d16);
2818 			b43_write16(dev, offset, value);
2819 
2820 			iv = (const struct b43_iv *)((const uint8_t *)iv +
2821 							sizeof(__be16) +
2822 							sizeof(__be16));
2823 		}
2824 	}
2825 	if (array_size)
2826 		goto err_format;
2827 
2828 	return 0;
2829 
2830 err_format:
2831 	b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2832 	b43_print_fw_helptext(dev->wl, 1);
2833 
2834 	return -EPROTO;
2835 }
2836 
2837 static int b43_upload_initvals(struct b43_wldev *dev)
2838 {
2839 	const size_t hdr_len = sizeof(struct b43_fw_header);
2840 	const struct b43_fw_header *hdr;
2841 	struct b43_firmware *fw = &dev->fw;
2842 	const struct b43_iv *ivals;
2843 	size_t count;
2844 
2845 	hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2846 	ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2847 	count = be32_to_cpu(hdr->size);
2848 	return b43_write_initvals(dev, ivals, count,
2849 				 fw->initvals.data->size - hdr_len);
2850 }
2851 
2852 static int b43_upload_initvals_band(struct b43_wldev *dev)
2853 {
2854 	const size_t hdr_len = sizeof(struct b43_fw_header);
2855 	const struct b43_fw_header *hdr;
2856 	struct b43_firmware *fw = &dev->fw;
2857 	const struct b43_iv *ivals;
2858 	size_t count;
2859 
2860 	if (!fw->initvals_band.data)
2861 		return 0;
2862 
2863 	hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2864 	ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2865 	count = be32_to_cpu(hdr->size);
2866 	return b43_write_initvals(dev, ivals, count,
2867 				  fw->initvals_band.data->size - hdr_len);
2868 }
2869 
2870 /* Initialize the GPIOs
2871  * http://bcm-specs.sipsolutions.net/GPIO
2872  */
2873 
2874 #ifdef CONFIG_B43_SSB
2875 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2876 {
2877 	struct ssb_bus *bus = dev->dev->sdev->bus;
2878 
2879 #ifdef CONFIG_SSB_DRIVER_PCICORE
2880 	return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2881 #else
2882 	return bus->chipco.dev;
2883 #endif
2884 }
2885 #endif
2886 
2887 static int b43_gpio_init(struct b43_wldev *dev)
2888 {
2889 #ifdef CONFIG_B43_SSB
2890 	struct ssb_device *gpiodev;
2891 #endif
2892 	u32 mask, set;
2893 
2894 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
2895 	b43_maskset16(dev, B43_MMIO_GPIO_MASK, ~0, 0xF);
2896 
2897 	mask = 0x0000001F;
2898 	set = 0x0000000F;
2899 	if (dev->dev->chip_id == 0x4301) {
2900 		mask |= 0x0060;
2901 		set |= 0x0060;
2902 	} else if (dev->dev->chip_id == 0x5354) {
2903 		/* Don't allow overtaking buttons GPIOs */
2904 		set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
2905 	}
2906 
2907 	if (0 /* FIXME: conditional unknown */ ) {
2908 		b43_write16(dev, B43_MMIO_GPIO_MASK,
2909 			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2910 			    | 0x0100);
2911 		/* BT Coexistance Input */
2912 		mask |= 0x0080;
2913 		set |= 0x0080;
2914 		/* BT Coexistance Out */
2915 		mask |= 0x0100;
2916 		set |= 0x0100;
2917 	}
2918 	if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2919 		/* PA is controlled by gpio 9, let ucode handle it */
2920 		b43_write16(dev, B43_MMIO_GPIO_MASK,
2921 			    b43_read16(dev, B43_MMIO_GPIO_MASK)
2922 			    | 0x0200);
2923 		mask |= 0x0200;
2924 		set |= 0x0200;
2925 	}
2926 
2927 	switch (dev->dev->bus_type) {
2928 #ifdef CONFIG_B43_BCMA
2929 	case B43_BUS_BCMA:
2930 		bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, mask, set);
2931 		break;
2932 #endif
2933 #ifdef CONFIG_B43_SSB
2934 	case B43_BUS_SSB:
2935 		gpiodev = b43_ssb_gpio_dev(dev);
2936 		if (gpiodev)
2937 			ssb_write32(gpiodev, B43_GPIO_CONTROL,
2938 				    (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2939 				    & ~mask) | set);
2940 		break;
2941 #endif
2942 	}
2943 
2944 	return 0;
2945 }
2946 
2947 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2948 static void b43_gpio_cleanup(struct b43_wldev *dev)
2949 {
2950 #ifdef CONFIG_B43_SSB
2951 	struct ssb_device *gpiodev;
2952 #endif
2953 
2954 	switch (dev->dev->bus_type) {
2955 #ifdef CONFIG_B43_BCMA
2956 	case B43_BUS_BCMA:
2957 		bcma_chipco_gpio_control(&dev->dev->bdev->bus->drv_cc, ~0, 0);
2958 		break;
2959 #endif
2960 #ifdef CONFIG_B43_SSB
2961 	case B43_BUS_SSB:
2962 		gpiodev = b43_ssb_gpio_dev(dev);
2963 		if (gpiodev)
2964 			ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2965 		break;
2966 #endif
2967 	}
2968 }
2969 
2970 /* http://bcm-specs.sipsolutions.net/EnableMac */
2971 void b43_mac_enable(struct b43_wldev *dev)
2972 {
2973 	if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2974 		u16 fwstate;
2975 
2976 		fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2977 					 B43_SHM_SH_UCODESTAT);
2978 		if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2979 		    (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2980 			b43err(dev->wl, "b43_mac_enable(): The firmware "
2981 			       "should be suspended, but current state is %u\n",
2982 			       fwstate);
2983 		}
2984 	}
2985 
2986 	dev->mac_suspended--;
2987 	B43_WARN_ON(dev->mac_suspended < 0);
2988 	if (dev->mac_suspended == 0) {
2989 		b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_ENABLED);
2990 		b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2991 			    B43_IRQ_MAC_SUSPENDED);
2992 		/* Commit writes */
2993 		b43_read32(dev, B43_MMIO_MACCTL);
2994 		b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2995 		b43_power_saving_ctl_bits(dev, 0);
2996 	}
2997 }
2998 
2999 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
3000 void b43_mac_suspend(struct b43_wldev *dev)
3001 {
3002 	int i;
3003 	u32 tmp;
3004 
3005 	might_sleep();
3006 	B43_WARN_ON(dev->mac_suspended < 0);
3007 
3008 	if (dev->mac_suspended == 0) {
3009 		b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
3010 		b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_ENABLED, 0);
3011 		/* force pci to flush the write */
3012 		b43_read32(dev, B43_MMIO_MACCTL);
3013 		for (i = 35; i; i--) {
3014 			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3015 			if (tmp & B43_IRQ_MAC_SUSPENDED)
3016 				goto out;
3017 			udelay(10);
3018 		}
3019 		/* Hm, it seems this will take some time. Use msleep(). */
3020 		for (i = 40; i; i--) {
3021 			tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
3022 			if (tmp & B43_IRQ_MAC_SUSPENDED)
3023 				goto out;
3024 			msleep(1);
3025 		}
3026 		b43err(dev->wl, "MAC suspend failed\n");
3027 	}
3028 out:
3029 	dev->mac_suspended++;
3030 }
3031 
3032 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
3033 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
3034 {
3035 	u32 tmp;
3036 
3037 	switch (dev->dev->bus_type) {
3038 #ifdef CONFIG_B43_BCMA
3039 	case B43_BUS_BCMA:
3040 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3041 		if (on)
3042 			tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
3043 		else
3044 			tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
3045 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3046 		break;
3047 #endif
3048 #ifdef CONFIG_B43_SSB
3049 	case B43_BUS_SSB:
3050 		tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3051 		if (on)
3052 			tmp |= B43_TMSLOW_MACPHYCLKEN;
3053 		else
3054 			tmp &= ~B43_TMSLOW_MACPHYCLKEN;
3055 		ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3056 		break;
3057 #endif
3058 	}
3059 }
3060 
3061 /* brcms_b_switch_macfreq */
3062 void b43_mac_switch_freq(struct b43_wldev *dev, u8 spurmode)
3063 {
3064 	u16 chip_id = dev->dev->chip_id;
3065 
3066 	if (chip_id == BCMA_CHIP_ID_BCM4331) {
3067 		switch (spurmode) {
3068 		case 2: /* 168 Mhz: 2^26/168 = 0x61862 */
3069 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x1862);
3070 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3071 			break;
3072 		case 1: /* 164 Mhz: 2^26/164 = 0x63e70 */
3073 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x3e70);
3074 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3075 			break;
3076 		default: /* 160 Mhz: 2^26/160 = 0x66666 */
3077 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x6666);
3078 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x6);
3079 			break;
3080 		}
3081 	} else if (chip_id == BCMA_CHIP_ID_BCM43131 ||
3082 	    chip_id == BCMA_CHIP_ID_BCM43217 ||
3083 	    chip_id == BCMA_CHIP_ID_BCM43222 ||
3084 	    chip_id == BCMA_CHIP_ID_BCM43224 ||
3085 	    chip_id == BCMA_CHIP_ID_BCM43225 ||
3086 	    chip_id == BCMA_CHIP_ID_BCM43227 ||
3087 	    chip_id == BCMA_CHIP_ID_BCM43228) {
3088 		switch (spurmode) {
3089 		case 2: /* 126 Mhz */
3090 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x2082);
3091 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3092 			break;
3093 		case 1: /* 123 Mhz */
3094 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x5341);
3095 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3096 			break;
3097 		default: /* 120 Mhz */
3098 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x8889);
3099 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
3100 			break;
3101 		}
3102 	} else if (dev->phy.type == B43_PHYTYPE_LCN) {
3103 		switch (spurmode) {
3104 		case 1: /* 82 Mhz */
3105 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0x7CE0);
3106 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3107 			break;
3108 		default: /* 80 Mhz */
3109 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, 0xCCCD);
3110 			b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0xC);
3111 			break;
3112 		}
3113 	}
3114 }
3115 
3116 static void b43_adjust_opmode(struct b43_wldev *dev)
3117 {
3118 	struct b43_wl *wl = dev->wl;
3119 	u32 ctl;
3120 	u16 cfp_pretbtt;
3121 
3122 	ctl = b43_read32(dev, B43_MMIO_MACCTL);
3123 	/* Reset status to STA infrastructure mode. */
3124 	ctl &= ~B43_MACCTL_AP;
3125 	ctl &= ~B43_MACCTL_KEEP_CTL;
3126 	ctl &= ~B43_MACCTL_KEEP_BADPLCP;
3127 	ctl &= ~B43_MACCTL_KEEP_BAD;
3128 	ctl &= ~B43_MACCTL_PROMISC;
3129 	ctl &= ~B43_MACCTL_BEACPROMISC;
3130 	ctl |= B43_MACCTL_INFRA;
3131 
3132 	if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
3133 	    b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
3134 		ctl |= B43_MACCTL_AP;
3135 	else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
3136 		ctl &= ~B43_MACCTL_INFRA;
3137 
3138 	if (wl->filter_flags & FIF_CONTROL)
3139 		ctl |= B43_MACCTL_KEEP_CTL;
3140 	if (wl->filter_flags & FIF_FCSFAIL)
3141 		ctl |= B43_MACCTL_KEEP_BAD;
3142 	if (wl->filter_flags & FIF_PLCPFAIL)
3143 		ctl |= B43_MACCTL_KEEP_BADPLCP;
3144 	if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
3145 		ctl |= B43_MACCTL_BEACPROMISC;
3146 
3147 	/* Workaround: On old hardware the HW-MAC-address-filter
3148 	 * doesn't work properly, so always run promisc in filter
3149 	 * it in software. */
3150 	if (dev->dev->core_rev <= 4)
3151 		ctl |= B43_MACCTL_PROMISC;
3152 
3153 	b43_write32(dev, B43_MMIO_MACCTL, ctl);
3154 
3155 	cfp_pretbtt = 2;
3156 	if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
3157 		if (dev->dev->chip_id == 0x4306 &&
3158 		    dev->dev->chip_rev == 3)
3159 			cfp_pretbtt = 100;
3160 		else
3161 			cfp_pretbtt = 50;
3162 	}
3163 	b43_write16(dev, 0x612, cfp_pretbtt);
3164 
3165 	/* FIXME: We don't currently implement the PMQ mechanism,
3166 	 *        so always disable it. If we want to implement PMQ,
3167 	 *        we need to enable it here (clear DISCPMQ) in AP mode.
3168 	 */
3169 	if (0  /* ctl & B43_MACCTL_AP */)
3170 		b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_DISCPMQ, 0);
3171 	else
3172 		b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_DISCPMQ);
3173 }
3174 
3175 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
3176 {
3177 	u16 offset;
3178 
3179 	if (is_ofdm) {
3180 		offset = 0x480;
3181 		offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
3182 	} else {
3183 		offset = 0x4C0;
3184 		offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
3185 	}
3186 	b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
3187 			b43_shm_read16(dev, B43_SHM_SHARED, offset));
3188 }
3189 
3190 static void b43_rate_memory_init(struct b43_wldev *dev)
3191 {
3192 	switch (dev->phy.type) {
3193 	case B43_PHYTYPE_G:
3194 	case B43_PHYTYPE_N:
3195 	case B43_PHYTYPE_LP:
3196 	case B43_PHYTYPE_HT:
3197 	case B43_PHYTYPE_LCN:
3198 		b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
3199 		b43_rate_memory_write(dev, B43_OFDM_RATE_9MB, 1);
3200 		b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
3201 		b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
3202 		b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
3203 		b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
3204 		b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
3205 		b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
3206 		/* fallthrough */
3207 	case B43_PHYTYPE_B:
3208 		b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
3209 		b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
3210 		b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
3211 		b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
3212 		break;
3213 	default:
3214 		B43_WARN_ON(1);
3215 	}
3216 }
3217 
3218 /* Set the default values for the PHY TX Control Words. */
3219 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
3220 {
3221 	u16 ctl = 0;
3222 
3223 	ctl |= B43_TXH_PHY_ENC_CCK;
3224 	ctl |= B43_TXH_PHY_ANT01AUTO;
3225 	ctl |= B43_TXH_PHY_TXPWR;
3226 
3227 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
3228 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
3229 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
3230 }
3231 
3232 /* Set the TX-Antenna for management frames sent by firmware. */
3233 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
3234 {
3235 	u16 ant;
3236 	u16 tmp;
3237 
3238 	ant = b43_antenna_to_phyctl(antenna);
3239 
3240 	/* For ACK/CTS */
3241 	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
3242 	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3243 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
3244 	/* For Probe Resposes */
3245 	tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
3246 	tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
3247 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
3248 }
3249 
3250 /* This is the opposite of b43_chip_init() */
3251 static void b43_chip_exit(struct b43_wldev *dev)
3252 {
3253 	b43_phy_exit(dev);
3254 	b43_gpio_cleanup(dev);
3255 	/* firmware is released later */
3256 }
3257 
3258 /* Initialize the chip
3259  * http://bcm-specs.sipsolutions.net/ChipInit
3260  */
3261 static int b43_chip_init(struct b43_wldev *dev)
3262 {
3263 	struct b43_phy *phy = &dev->phy;
3264 	int err;
3265 	u32 macctl;
3266 	u16 value16;
3267 
3268 	/* Initialize the MAC control */
3269 	macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3270 	if (dev->phy.gmode)
3271 		macctl |= B43_MACCTL_GMODE;
3272 	macctl |= B43_MACCTL_INFRA;
3273 	b43_write32(dev, B43_MMIO_MACCTL, macctl);
3274 
3275 	err = b43_upload_microcode(dev);
3276 	if (err)
3277 		goto out;	/* firmware is released later */
3278 
3279 	err = b43_gpio_init(dev);
3280 	if (err)
3281 		goto out;	/* firmware is released later */
3282 
3283 	err = b43_upload_initvals(dev);
3284 	if (err)
3285 		goto err_gpio_clean;
3286 
3287 	err = b43_upload_initvals_band(dev);
3288 	if (err)
3289 		goto err_gpio_clean;
3290 
3291 	/* Turn the Analog on and initialize the PHY. */
3292 	phy->ops->switch_analog(dev, 1);
3293 	err = b43_phy_init(dev);
3294 	if (err)
3295 		goto err_gpio_clean;
3296 
3297 	/* Disable Interference Mitigation. */
3298 	if (phy->ops->interf_mitigation)
3299 		phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3300 
3301 	/* Select the antennae */
3302 	if (phy->ops->set_rx_antenna)
3303 		phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3304 	b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3305 
3306 	if (phy->type == B43_PHYTYPE_B) {
3307 		value16 = b43_read16(dev, 0x005E);
3308 		value16 |= 0x0004;
3309 		b43_write16(dev, 0x005E, value16);
3310 	}
3311 	b43_write32(dev, 0x0100, 0x01000000);
3312 	if (dev->dev->core_rev < 5)
3313 		b43_write32(dev, 0x010C, 0x01000000);
3314 
3315 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_INFRA, 0);
3316 	b43_maskset32(dev, B43_MMIO_MACCTL, ~0, B43_MACCTL_INFRA);
3317 
3318 	/* Probe Response Timeout value */
3319 	/* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3320 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 0);
3321 
3322 	/* Initially set the wireless operation mode. */
3323 	b43_adjust_opmode(dev);
3324 
3325 	if (dev->dev->core_rev < 3) {
3326 		b43_write16(dev, 0x060E, 0x0000);
3327 		b43_write16(dev, 0x0610, 0x8000);
3328 		b43_write16(dev, 0x0604, 0x0000);
3329 		b43_write16(dev, 0x0606, 0x0200);
3330 	} else {
3331 		b43_write32(dev, 0x0188, 0x80000000);
3332 		b43_write32(dev, 0x018C, 0x02000000);
3333 	}
3334 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3335 	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
3336 	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3337 	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3338 	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3339 	b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3340 	b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3341 
3342 	b43_mac_phy_clock_set(dev, true);
3343 
3344 	switch (dev->dev->bus_type) {
3345 #ifdef CONFIG_B43_BCMA
3346 	case B43_BUS_BCMA:
3347 		/* FIXME: 0xE74 is quite common, but should be read from CC */
3348 		b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3349 		break;
3350 #endif
3351 #ifdef CONFIG_B43_SSB
3352 	case B43_BUS_SSB:
3353 		b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3354 			    dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3355 		break;
3356 #endif
3357 	}
3358 
3359 	err = 0;
3360 	b43dbg(dev->wl, "Chip initialized\n");
3361 out:
3362 	return err;
3363 
3364 err_gpio_clean:
3365 	b43_gpio_cleanup(dev);
3366 	return err;
3367 }
3368 
3369 static void b43_periodic_every60sec(struct b43_wldev *dev)
3370 {
3371 	const struct b43_phy_operations *ops = dev->phy.ops;
3372 
3373 	if (ops->pwork_60sec)
3374 		ops->pwork_60sec(dev);
3375 
3376 	/* Force check the TX power emission now. */
3377 	b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3378 }
3379 
3380 static void b43_periodic_every30sec(struct b43_wldev *dev)
3381 {
3382 	/* Update device statistics. */
3383 	b43_calculate_link_quality(dev);
3384 }
3385 
3386 static void b43_periodic_every15sec(struct b43_wldev *dev)
3387 {
3388 	struct b43_phy *phy = &dev->phy;
3389 	u16 wdr;
3390 
3391 	if (dev->fw.opensource) {
3392 		/* Check if the firmware is still alive.
3393 		 * It will reset the watchdog counter to 0 in its idle loop. */
3394 		wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3395 		if (unlikely(wdr)) {
3396 			b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3397 			b43_controller_restart(dev, "Firmware watchdog");
3398 			return;
3399 		} else {
3400 			b43_shm_write16(dev, B43_SHM_SCRATCH,
3401 					B43_WATCHDOG_REG, 1);
3402 		}
3403 	}
3404 
3405 	if (phy->ops->pwork_15sec)
3406 		phy->ops->pwork_15sec(dev);
3407 
3408 	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3409 	wmb();
3410 
3411 #if B43_DEBUG
3412 	if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3413 		unsigned int i;
3414 
3415 		b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3416 		       dev->irq_count / 15,
3417 		       dev->tx_count / 15,
3418 		       dev->rx_count / 15);
3419 		dev->irq_count = 0;
3420 		dev->tx_count = 0;
3421 		dev->rx_count = 0;
3422 		for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3423 			if (dev->irq_bit_count[i]) {
3424 				b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3425 				       dev->irq_bit_count[i] / 15, i, (1 << i));
3426 				dev->irq_bit_count[i] = 0;
3427 			}
3428 		}
3429 	}
3430 #endif
3431 }
3432 
3433 static void do_periodic_work(struct b43_wldev *dev)
3434 {
3435 	unsigned int state;
3436 
3437 	state = dev->periodic_state;
3438 	if (state % 4 == 0)
3439 		b43_periodic_every60sec(dev);
3440 	if (state % 2 == 0)
3441 		b43_periodic_every30sec(dev);
3442 	b43_periodic_every15sec(dev);
3443 }
3444 
3445 /* Periodic work locking policy:
3446  * 	The whole periodic work handler is protected by
3447  * 	wl->mutex. If another lock is needed somewhere in the
3448  * 	pwork callchain, it's acquired in-place, where it's needed.
3449  */
3450 static void b43_periodic_work_handler(struct work_struct *work)
3451 {
3452 	struct b43_wldev *dev = container_of(work, struct b43_wldev,
3453 					     periodic_work.work);
3454 	struct b43_wl *wl = dev->wl;
3455 	unsigned long delay;
3456 
3457 	mutex_lock(&wl->mutex);
3458 
3459 	if (unlikely(b43_status(dev) != B43_STAT_STARTED))
3460 		goto out;
3461 	if (b43_debug(dev, B43_DBG_PWORK_STOP))
3462 		goto out_requeue;
3463 
3464 	do_periodic_work(dev);
3465 
3466 	dev->periodic_state++;
3467 out_requeue:
3468 	if (b43_debug(dev, B43_DBG_PWORK_FAST))
3469 		delay = msecs_to_jiffies(50);
3470 	else
3471 		delay = round_jiffies_relative(HZ * 15);
3472 	ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
3473 out:
3474 	mutex_unlock(&wl->mutex);
3475 }
3476 
3477 static void b43_periodic_tasks_setup(struct b43_wldev *dev)
3478 {
3479 	struct delayed_work *work = &dev->periodic_work;
3480 
3481 	dev->periodic_state = 0;
3482 	INIT_DELAYED_WORK(work, b43_periodic_work_handler);
3483 	ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
3484 }
3485 
3486 /* Check if communication with the device works correctly. */
3487 static int b43_validate_chipaccess(struct b43_wldev *dev)
3488 {
3489 	u32 v, backup0, backup4;
3490 
3491 	backup0 = b43_shm_read32(dev, B43_SHM_SHARED, 0);
3492 	backup4 = b43_shm_read32(dev, B43_SHM_SHARED, 4);
3493 
3494 	/* Check for read/write and endianness problems. */
3495 	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
3496 	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
3497 		goto error;
3498 	b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
3499 	if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
3500 		goto error;
3501 
3502 	/* Check if unaligned 32bit SHM_SHARED access works properly.
3503 	 * However, don't bail out on failure, because it's noncritical. */
3504 	b43_shm_write16(dev, B43_SHM_SHARED, 0, 0x1122);
3505 	b43_shm_write16(dev, B43_SHM_SHARED, 2, 0x3344);
3506 	b43_shm_write16(dev, B43_SHM_SHARED, 4, 0x5566);
3507 	b43_shm_write16(dev, B43_SHM_SHARED, 6, 0x7788);
3508 	if (b43_shm_read32(dev, B43_SHM_SHARED, 2) != 0x55663344)
3509 		b43warn(dev->wl, "Unaligned 32bit SHM read access is broken\n");
3510 	b43_shm_write32(dev, B43_SHM_SHARED, 2, 0xAABBCCDD);
3511 	if (b43_shm_read16(dev, B43_SHM_SHARED, 0) != 0x1122 ||
3512 	    b43_shm_read16(dev, B43_SHM_SHARED, 2) != 0xCCDD ||
3513 	    b43_shm_read16(dev, B43_SHM_SHARED, 4) != 0xAABB ||
3514 	    b43_shm_read16(dev, B43_SHM_SHARED, 6) != 0x7788)
3515 		b43warn(dev->wl, "Unaligned 32bit SHM write access is broken\n");
3516 
3517 	b43_shm_write32(dev, B43_SHM_SHARED, 0, backup0);
3518 	b43_shm_write32(dev, B43_SHM_SHARED, 4, backup4);
3519 
3520 	if ((dev->dev->core_rev >= 3) && (dev->dev->core_rev <= 10)) {
3521 		/* The 32bit register shadows the two 16bit registers
3522 		 * with update sideeffects. Validate this. */
3523 		b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
3524 		b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
3525 		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
3526 			goto error;
3527 		if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
3528 			goto error;
3529 	}
3530 	b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
3531 
3532 	v = b43_read32(dev, B43_MMIO_MACCTL);
3533 	v |= B43_MACCTL_GMODE;
3534 	if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
3535 		goto error;
3536 
3537 	return 0;
3538 error:
3539 	b43err(dev->wl, "Failed to validate the chipaccess\n");
3540 	return -ENODEV;
3541 }
3542 
3543 static void b43_security_init(struct b43_wldev *dev)
3544 {
3545 	dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
3546 	/* KTP is a word address, but we address SHM bytewise.
3547 	 * So multiply by two.
3548 	 */
3549 	dev->ktp *= 2;
3550 	/* Number of RCMTA address slots */
3551 	b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
3552 	/* Clear the key memory. */
3553 	b43_clear_keys(dev);
3554 }
3555 
3556 #ifdef CONFIG_B43_HWRNG
3557 static int b43_rng_read(struct hwrng *rng, u32 *data)
3558 {
3559 	struct b43_wl *wl = (struct b43_wl *)rng->priv;
3560 	struct b43_wldev *dev;
3561 	int count = -ENODEV;
3562 
3563 	mutex_lock(&wl->mutex);
3564 	dev = wl->current_dev;
3565 	if (likely(dev && b43_status(dev) >= B43_STAT_INITIALIZED)) {
3566 		*data = b43_read16(dev, B43_MMIO_RNG);
3567 		count = sizeof(u16);
3568 	}
3569 	mutex_unlock(&wl->mutex);
3570 
3571 	return count;
3572 }
3573 #endif /* CONFIG_B43_HWRNG */
3574 
3575 static void b43_rng_exit(struct b43_wl *wl)
3576 {
3577 #ifdef CONFIG_B43_HWRNG
3578 	if (wl->rng_initialized)
3579 		hwrng_unregister(&wl->rng);
3580 #endif /* CONFIG_B43_HWRNG */
3581 }
3582 
3583 static int b43_rng_init(struct b43_wl *wl)
3584 {
3585 	int err = 0;
3586 
3587 #ifdef CONFIG_B43_HWRNG
3588 	snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
3589 		 "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
3590 	wl->rng.name = wl->rng_name;
3591 	wl->rng.data_read = b43_rng_read;
3592 	wl->rng.priv = (unsigned long)wl;
3593 	wl->rng_initialized = true;
3594 	err = hwrng_register(&wl->rng);
3595 	if (err) {
3596 		wl->rng_initialized = false;
3597 		b43err(wl, "Failed to register the random "
3598 		       "number generator (%d)\n", err);
3599 	}
3600 #endif /* CONFIG_B43_HWRNG */
3601 
3602 	return err;
3603 }
3604 
3605 static void b43_tx_work(struct work_struct *work)
3606 {
3607 	struct b43_wl *wl = container_of(work, struct b43_wl, tx_work);
3608 	struct b43_wldev *dev;
3609 	struct sk_buff *skb;
3610 	int queue_num;
3611 	int err = 0;
3612 
3613 	mutex_lock(&wl->mutex);
3614 	dev = wl->current_dev;
3615 	if (unlikely(!dev || b43_status(dev) < B43_STAT_STARTED)) {
3616 		mutex_unlock(&wl->mutex);
3617 		return;
3618 	}
3619 
3620 	for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
3621 		while (skb_queue_len(&wl->tx_queue[queue_num])) {
3622 			skb = skb_dequeue(&wl->tx_queue[queue_num]);
3623 			if (b43_using_pio_transfers(dev))
3624 				err = b43_pio_tx(dev, skb);
3625 			else
3626 				err = b43_dma_tx(dev, skb);
3627 			if (err == -ENOSPC) {
3628 				wl->tx_queue_stopped[queue_num] = 1;
3629 				ieee80211_stop_queue(wl->hw, queue_num);
3630 				skb_queue_head(&wl->tx_queue[queue_num], skb);
3631 				break;
3632 			}
3633 			if (unlikely(err))
3634 				ieee80211_free_txskb(wl->hw, skb);
3635 			err = 0;
3636 		}
3637 
3638 		if (!err)
3639 			wl->tx_queue_stopped[queue_num] = 0;
3640 	}
3641 
3642 #if B43_DEBUG
3643 	dev->tx_count++;
3644 #endif
3645 	mutex_unlock(&wl->mutex);
3646 }
3647 
3648 static void b43_op_tx(struct ieee80211_hw *hw,
3649 		      struct ieee80211_tx_control *control,
3650 		      struct sk_buff *skb)
3651 {
3652 	struct b43_wl *wl = hw_to_b43_wl(hw);
3653 
3654 	if (unlikely(skb->len < 2 + 2 + 6)) {
3655 		/* Too short, this can't be a valid frame. */
3656 		ieee80211_free_txskb(hw, skb);
3657 		return;
3658 	}
3659 	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
3660 
3661 	skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
3662 	if (!wl->tx_queue_stopped[skb->queue_mapping]) {
3663 		ieee80211_queue_work(wl->hw, &wl->tx_work);
3664 	} else {
3665 		ieee80211_stop_queue(wl->hw, skb->queue_mapping);
3666 	}
3667 }
3668 
3669 static void b43_qos_params_upload(struct b43_wldev *dev,
3670 				  const struct ieee80211_tx_queue_params *p,
3671 				  u16 shm_offset)
3672 {
3673 	u16 params[B43_NR_QOSPARAMS];
3674 	int bslots, tmp;
3675 	unsigned int i;
3676 
3677 	if (!dev->qos_enabled)
3678 		return;
3679 
3680 	bslots = b43_read16(dev, B43_MMIO_RNG) & p->cw_min;
3681 
3682 	memset(&params, 0, sizeof(params));
3683 
3684 	params[B43_QOSPARAM_TXOP] = p->txop * 32;
3685 	params[B43_QOSPARAM_CWMIN] = p->cw_min;
3686 	params[B43_QOSPARAM_CWMAX] = p->cw_max;
3687 	params[B43_QOSPARAM_CWCUR] = p->cw_min;
3688 	params[B43_QOSPARAM_AIFS] = p->aifs;
3689 	params[B43_QOSPARAM_BSLOTS] = bslots;
3690 	params[B43_QOSPARAM_REGGAP] = bslots + p->aifs;
3691 
3692 	for (i = 0; i < ARRAY_SIZE(params); i++) {
3693 		if (i == B43_QOSPARAM_STATUS) {
3694 			tmp = b43_shm_read16(dev, B43_SHM_SHARED,
3695 					     shm_offset + (i * 2));
3696 			/* Mark the parameters as updated. */
3697 			tmp |= 0x100;
3698 			b43_shm_write16(dev, B43_SHM_SHARED,
3699 					shm_offset + (i * 2),
3700 					tmp);
3701 		} else {
3702 			b43_shm_write16(dev, B43_SHM_SHARED,
3703 					shm_offset + (i * 2),
3704 					params[i]);
3705 		}
3706 	}
3707 }
3708 
3709 /* Mapping of mac80211 queue numbers to b43 QoS SHM offsets. */
3710 static const u16 b43_qos_shm_offsets[] = {
3711 	/* [mac80211-queue-nr] = SHM_OFFSET, */
3712 	[0] = B43_QOS_VOICE,
3713 	[1] = B43_QOS_VIDEO,
3714 	[2] = B43_QOS_BESTEFFORT,
3715 	[3] = B43_QOS_BACKGROUND,
3716 };
3717 
3718 /* Update all QOS parameters in hardware. */
3719 static void b43_qos_upload_all(struct b43_wldev *dev)
3720 {
3721 	struct b43_wl *wl = dev->wl;
3722 	struct b43_qos_params *params;
3723 	unsigned int i;
3724 
3725 	if (!dev->qos_enabled)
3726 		return;
3727 
3728 	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3729 		     ARRAY_SIZE(wl->qos_params));
3730 
3731 	b43_mac_suspend(dev);
3732 	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3733 		params = &(wl->qos_params[i]);
3734 		b43_qos_params_upload(dev, &(params->p),
3735 				      b43_qos_shm_offsets[i]);
3736 	}
3737 	b43_mac_enable(dev);
3738 }
3739 
3740 static void b43_qos_clear(struct b43_wl *wl)
3741 {
3742 	struct b43_qos_params *params;
3743 	unsigned int i;
3744 
3745 	/* Initialize QoS parameters to sane defaults. */
3746 
3747 	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3748 		     ARRAY_SIZE(wl->qos_params));
3749 
3750 	for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
3751 		params = &(wl->qos_params[i]);
3752 
3753 		switch (b43_qos_shm_offsets[i]) {
3754 		case B43_QOS_VOICE:
3755 			params->p.txop = 0;
3756 			params->p.aifs = 2;
3757 			params->p.cw_min = 0x0001;
3758 			params->p.cw_max = 0x0001;
3759 			break;
3760 		case B43_QOS_VIDEO:
3761 			params->p.txop = 0;
3762 			params->p.aifs = 2;
3763 			params->p.cw_min = 0x0001;
3764 			params->p.cw_max = 0x0001;
3765 			break;
3766 		case B43_QOS_BESTEFFORT:
3767 			params->p.txop = 0;
3768 			params->p.aifs = 3;
3769 			params->p.cw_min = 0x0001;
3770 			params->p.cw_max = 0x03FF;
3771 			break;
3772 		case B43_QOS_BACKGROUND:
3773 			params->p.txop = 0;
3774 			params->p.aifs = 7;
3775 			params->p.cw_min = 0x0001;
3776 			params->p.cw_max = 0x03FF;
3777 			break;
3778 		default:
3779 			B43_WARN_ON(1);
3780 		}
3781 	}
3782 }
3783 
3784 /* Initialize the core's QOS capabilities */
3785 static void b43_qos_init(struct b43_wldev *dev)
3786 {
3787 	if (!dev->qos_enabled) {
3788 		/* Disable QOS support. */
3789 		b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_EDCF);
3790 		b43_write16(dev, B43_MMIO_IFSCTL,
3791 			    b43_read16(dev, B43_MMIO_IFSCTL)
3792 			    & ~B43_MMIO_IFSCTL_USE_EDCF);
3793 		b43dbg(dev->wl, "QoS disabled\n");
3794 		return;
3795 	}
3796 
3797 	/* Upload the current QOS parameters. */
3798 	b43_qos_upload_all(dev);
3799 
3800 	/* Enable QOS support. */
3801 	b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
3802 	b43_write16(dev, B43_MMIO_IFSCTL,
3803 		    b43_read16(dev, B43_MMIO_IFSCTL)
3804 		    | B43_MMIO_IFSCTL_USE_EDCF);
3805 	b43dbg(dev->wl, "QoS enabled\n");
3806 }
3807 
3808 static int b43_op_conf_tx(struct ieee80211_hw *hw,
3809 			  struct ieee80211_vif *vif, u16 _queue,
3810 			  const struct ieee80211_tx_queue_params *params)
3811 {
3812 	struct b43_wl *wl = hw_to_b43_wl(hw);
3813 	struct b43_wldev *dev;
3814 	unsigned int queue = (unsigned int)_queue;
3815 	int err = -ENODEV;
3816 
3817 	if (queue >= ARRAY_SIZE(wl->qos_params)) {
3818 		/* Queue not available or don't support setting
3819 		 * params on this queue. Return success to not
3820 		 * confuse mac80211. */
3821 		return 0;
3822 	}
3823 	BUILD_BUG_ON(ARRAY_SIZE(b43_qos_shm_offsets) !=
3824 		     ARRAY_SIZE(wl->qos_params));
3825 
3826 	mutex_lock(&wl->mutex);
3827 	dev = wl->current_dev;
3828 	if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED)))
3829 		goto out_unlock;
3830 
3831 	memcpy(&(wl->qos_params[queue].p), params, sizeof(*params));
3832 	b43_mac_suspend(dev);
3833 	b43_qos_params_upload(dev, &(wl->qos_params[queue].p),
3834 			      b43_qos_shm_offsets[queue]);
3835 	b43_mac_enable(dev);
3836 	err = 0;
3837 
3838 out_unlock:
3839 	mutex_unlock(&wl->mutex);
3840 
3841 	return err;
3842 }
3843 
3844 static int b43_op_get_stats(struct ieee80211_hw *hw,
3845 			    struct ieee80211_low_level_stats *stats)
3846 {
3847 	struct b43_wl *wl = hw_to_b43_wl(hw);
3848 
3849 	mutex_lock(&wl->mutex);
3850 	memcpy(stats, &wl->ieee_stats, sizeof(*stats));
3851 	mutex_unlock(&wl->mutex);
3852 
3853 	return 0;
3854 }
3855 
3856 static u64 b43_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
3857 {
3858 	struct b43_wl *wl = hw_to_b43_wl(hw);
3859 	struct b43_wldev *dev;
3860 	u64 tsf;
3861 
3862 	mutex_lock(&wl->mutex);
3863 	dev = wl->current_dev;
3864 
3865 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3866 		b43_tsf_read(dev, &tsf);
3867 	else
3868 		tsf = 0;
3869 
3870 	mutex_unlock(&wl->mutex);
3871 
3872 	return tsf;
3873 }
3874 
3875 static void b43_op_set_tsf(struct ieee80211_hw *hw,
3876 			   struct ieee80211_vif *vif, u64 tsf)
3877 {
3878 	struct b43_wl *wl = hw_to_b43_wl(hw);
3879 	struct b43_wldev *dev;
3880 
3881 	mutex_lock(&wl->mutex);
3882 	dev = wl->current_dev;
3883 
3884 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED))
3885 		b43_tsf_write(dev, tsf);
3886 
3887 	mutex_unlock(&wl->mutex);
3888 }
3889 
3890 static const char *band_to_string(enum nl80211_band band)
3891 {
3892 	switch (band) {
3893 	case NL80211_BAND_5GHZ:
3894 		return "5";
3895 	case NL80211_BAND_2GHZ:
3896 		return "2.4";
3897 	default:
3898 		break;
3899 	}
3900 	B43_WARN_ON(1);
3901 	return "";
3902 }
3903 
3904 /* Expects wl->mutex locked */
3905 static int b43_switch_band(struct b43_wldev *dev,
3906 			   struct ieee80211_channel *chan)
3907 {
3908 	struct b43_phy *phy = &dev->phy;
3909 	bool gmode;
3910 	u32 tmp;
3911 
3912 	switch (chan->band) {
3913 	case NL80211_BAND_5GHZ:
3914 		gmode = false;
3915 		break;
3916 	case NL80211_BAND_2GHZ:
3917 		gmode = true;
3918 		break;
3919 	default:
3920 		B43_WARN_ON(1);
3921 		return -EINVAL;
3922 	}
3923 
3924 	if (!((gmode && phy->supports_2ghz) ||
3925 	      (!gmode && phy->supports_5ghz))) {
3926 		b43err(dev->wl, "This device doesn't support %s-GHz band\n",
3927 		       band_to_string(chan->band));
3928 		return -ENODEV;
3929 	}
3930 
3931 	if (!!phy->gmode == !!gmode) {
3932 		/* This device is already running. */
3933 		return 0;
3934 	}
3935 
3936 	b43dbg(dev->wl, "Switching to %s GHz band\n",
3937 	       band_to_string(chan->band));
3938 
3939 	/* Some new devices don't need disabling radio for band switching */
3940 	if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
3941 		b43_software_rfkill(dev, true);
3942 
3943 	phy->gmode = gmode;
3944 	b43_phy_put_into_reset(dev);
3945 	switch (dev->dev->bus_type) {
3946 #ifdef CONFIG_B43_BCMA
3947 	case B43_BUS_BCMA:
3948 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
3949 		if (gmode)
3950 			tmp |= B43_BCMA_IOCTL_GMODE;
3951 		else
3952 			tmp &= ~B43_BCMA_IOCTL_GMODE;
3953 		bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
3954 		break;
3955 #endif
3956 #ifdef CONFIG_B43_SSB
3957 	case B43_BUS_SSB:
3958 		tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
3959 		if (gmode)
3960 			tmp |= B43_TMSLOW_GMODE;
3961 		else
3962 			tmp &= ~B43_TMSLOW_GMODE;
3963 		ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
3964 		break;
3965 #endif
3966 	}
3967 	b43_phy_take_out_of_reset(dev);
3968 
3969 	b43_upload_initvals_band(dev);
3970 
3971 	b43_phy_init(dev);
3972 
3973 	return 0;
3974 }
3975 
3976 static void b43_set_beacon_listen_interval(struct b43_wldev *dev, u16 interval)
3977 {
3978 	interval = min_t(u16, interval, (u16)0xFF);
3979 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BCN_LI, interval);
3980 }
3981 
3982 /* Write the short and long frame retry limit values. */
3983 static void b43_set_retry_limits(struct b43_wldev *dev,
3984 				 unsigned int short_retry,
3985 				 unsigned int long_retry)
3986 {
3987 	/* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
3988 	 * the chip-internal counter. */
3989 	short_retry = min(short_retry, (unsigned int)0xF);
3990 	long_retry = min(long_retry, (unsigned int)0xF);
3991 
3992 	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
3993 			short_retry);
3994 	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
3995 			long_retry);
3996 }
3997 
3998 static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
3999 {
4000 	struct b43_wl *wl = hw_to_b43_wl(hw);
4001 	struct b43_wldev *dev = wl->current_dev;
4002 	struct b43_phy *phy = &dev->phy;
4003 	struct ieee80211_conf *conf = &hw->conf;
4004 	int antenna;
4005 	int err = 0;
4006 
4007 	mutex_lock(&wl->mutex);
4008 	b43_mac_suspend(dev);
4009 
4010 	if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL)
4011 		b43_set_beacon_listen_interval(dev, conf->listen_interval);
4012 
4013 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
4014 		phy->chandef = &conf->chandef;
4015 		phy->channel = conf->chandef.chan->hw_value;
4016 
4017 		/* Switch the band (if necessary). */
4018 		err = b43_switch_band(dev, conf->chandef.chan);
4019 		if (err)
4020 			goto out_mac_enable;
4021 
4022 		/* Switch to the requested channel.
4023 		 * The firmware takes care of races with the TX handler.
4024 		 */
4025 		b43_switch_channel(dev, phy->channel);
4026 	}
4027 
4028 	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
4029 		b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
4030 					  conf->long_frame_max_tx_count);
4031 	changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
4032 	if (!changed)
4033 		goto out_mac_enable;
4034 
4035 	dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
4036 
4037 	/* Adjust the desired TX power level. */
4038 	if (conf->power_level != 0) {
4039 		if (conf->power_level != phy->desired_txpower) {
4040 			phy->desired_txpower = conf->power_level;
4041 			b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME |
4042 						   B43_TXPWR_IGNORE_TSSI);
4043 		}
4044 	}
4045 
4046 	/* Antennas for RX and management frame TX. */
4047 	antenna = B43_ANTENNA_DEFAULT;
4048 	b43_mgmtframe_txantenna(dev, antenna);
4049 	antenna = B43_ANTENNA_DEFAULT;
4050 	if (phy->ops->set_rx_antenna)
4051 		phy->ops->set_rx_antenna(dev, antenna);
4052 
4053 	if (wl->radio_enabled != phy->radio_on) {
4054 		if (wl->radio_enabled) {
4055 			b43_software_rfkill(dev, false);
4056 			b43info(dev->wl, "Radio turned on by software\n");
4057 			if (!dev->radio_hw_enable) {
4058 				b43info(dev->wl, "The hardware RF-kill button "
4059 					"still turns the radio physically off. "
4060 					"Press the button to turn it on.\n");
4061 			}
4062 		} else {
4063 			b43_software_rfkill(dev, true);
4064 			b43info(dev->wl, "Radio turned off by software\n");
4065 		}
4066 	}
4067 
4068 out_mac_enable:
4069 	b43_mac_enable(dev);
4070 	mutex_unlock(&wl->mutex);
4071 
4072 	return err;
4073 }
4074 
4075 static void b43_update_basic_rates(struct b43_wldev *dev, u32 brates)
4076 {
4077 	struct ieee80211_supported_band *sband =
4078 		dev->wl->hw->wiphy->bands[b43_current_band(dev->wl)];
4079 	struct ieee80211_rate *rate;
4080 	int i;
4081 	u16 basic, direct, offset, basic_offset, rateptr;
4082 
4083 	for (i = 0; i < sband->n_bitrates; i++) {
4084 		rate = &sband->bitrates[i];
4085 
4086 		if (b43_is_cck_rate(rate->hw_value)) {
4087 			direct = B43_SHM_SH_CCKDIRECT;
4088 			basic = B43_SHM_SH_CCKBASIC;
4089 			offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4090 			offset &= 0xF;
4091 		} else {
4092 			direct = B43_SHM_SH_OFDMDIRECT;
4093 			basic = B43_SHM_SH_OFDMBASIC;
4094 			offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4095 			offset &= 0xF;
4096 		}
4097 
4098 		rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
4099 
4100 		if (b43_is_cck_rate(rate->hw_value)) {
4101 			basic_offset = b43_plcp_get_ratecode_cck(rate->hw_value);
4102 			basic_offset &= 0xF;
4103 		} else {
4104 			basic_offset = b43_plcp_get_ratecode_ofdm(rate->hw_value);
4105 			basic_offset &= 0xF;
4106 		}
4107 
4108 		/*
4109 		 * Get the pointer that we need to point to
4110 		 * from the direct map
4111 		 */
4112 		rateptr = b43_shm_read16(dev, B43_SHM_SHARED,
4113 					 direct + 2 * basic_offset);
4114 		/* and write it to the basic map */
4115 		b43_shm_write16(dev, B43_SHM_SHARED, basic + 2 * offset,
4116 				rateptr);
4117 	}
4118 }
4119 
4120 static void b43_op_bss_info_changed(struct ieee80211_hw *hw,
4121 				    struct ieee80211_vif *vif,
4122 				    struct ieee80211_bss_conf *conf,
4123 				    u32 changed)
4124 {
4125 	struct b43_wl *wl = hw_to_b43_wl(hw);
4126 	struct b43_wldev *dev;
4127 
4128 	mutex_lock(&wl->mutex);
4129 
4130 	dev = wl->current_dev;
4131 	if (!dev || b43_status(dev) < B43_STAT_STARTED)
4132 		goto out_unlock_mutex;
4133 
4134 	B43_WARN_ON(wl->vif != vif);
4135 
4136 	if (changed & BSS_CHANGED_BSSID) {
4137 		if (conf->bssid)
4138 			memcpy(wl->bssid, conf->bssid, ETH_ALEN);
4139 		else
4140 			eth_zero_addr(wl->bssid);
4141 	}
4142 
4143 	if (b43_status(dev) >= B43_STAT_INITIALIZED) {
4144 		if (changed & BSS_CHANGED_BEACON &&
4145 		    (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4146 		     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4147 		     b43_is_mode(wl, NL80211_IFTYPE_ADHOC)))
4148 			b43_update_templates(wl);
4149 
4150 		if (changed & BSS_CHANGED_BSSID)
4151 			b43_write_mac_bssid_templates(dev);
4152 	}
4153 
4154 	b43_mac_suspend(dev);
4155 
4156 	/* Update templates for AP/mesh mode. */
4157 	if (changed & BSS_CHANGED_BEACON_INT &&
4158 	    (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
4159 	     b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) ||
4160 	     b43_is_mode(wl, NL80211_IFTYPE_ADHOC)) &&
4161 	    conf->beacon_int)
4162 		b43_set_beacon_int(dev, conf->beacon_int);
4163 
4164 	if (changed & BSS_CHANGED_BASIC_RATES)
4165 		b43_update_basic_rates(dev, conf->basic_rates);
4166 
4167 	if (changed & BSS_CHANGED_ERP_SLOT) {
4168 		if (conf->use_short_slot)
4169 			b43_short_slot_timing_enable(dev);
4170 		else
4171 			b43_short_slot_timing_disable(dev);
4172 	}
4173 
4174 	b43_mac_enable(dev);
4175 out_unlock_mutex:
4176 	mutex_unlock(&wl->mutex);
4177 }
4178 
4179 static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
4180 			  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
4181 			  struct ieee80211_key_conf *key)
4182 {
4183 	struct b43_wl *wl = hw_to_b43_wl(hw);
4184 	struct b43_wldev *dev;
4185 	u8 algorithm;
4186 	u8 index;
4187 	int err;
4188 	static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4189 
4190 	if (modparam_nohwcrypt)
4191 		return -ENOSPC; /* User disabled HW-crypto */
4192 
4193 	if ((vif->type == NL80211_IFTYPE_ADHOC ||
4194 	     vif->type == NL80211_IFTYPE_MESH_POINT) &&
4195 	    (key->cipher == WLAN_CIPHER_SUITE_TKIP ||
4196 	     key->cipher == WLAN_CIPHER_SUITE_CCMP) &&
4197 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
4198 		/*
4199 		 * For now, disable hw crypto for the RSN IBSS group keys. This
4200 		 * could be optimized in the future, but until that gets
4201 		 * implemented, use of software crypto for group addressed
4202 		 * frames is a acceptable to allow RSN IBSS to be used.
4203 		 */
4204 		return -EOPNOTSUPP;
4205 	}
4206 
4207 	mutex_lock(&wl->mutex);
4208 
4209 	dev = wl->current_dev;
4210 	err = -ENODEV;
4211 	if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
4212 		goto out_unlock;
4213 
4214 	if (dev->fw.pcm_request_failed || !dev->hwcrypto_enabled) {
4215 		/* We don't have firmware for the crypto engine.
4216 		 * Must use software-crypto. */
4217 		err = -EOPNOTSUPP;
4218 		goto out_unlock;
4219 	}
4220 
4221 	err = -EINVAL;
4222 	switch (key->cipher) {
4223 	case WLAN_CIPHER_SUITE_WEP40:
4224 		algorithm = B43_SEC_ALGO_WEP40;
4225 		break;
4226 	case WLAN_CIPHER_SUITE_WEP104:
4227 		algorithm = B43_SEC_ALGO_WEP104;
4228 		break;
4229 	case WLAN_CIPHER_SUITE_TKIP:
4230 		algorithm = B43_SEC_ALGO_TKIP;
4231 		break;
4232 	case WLAN_CIPHER_SUITE_CCMP:
4233 		algorithm = B43_SEC_ALGO_AES;
4234 		break;
4235 	default:
4236 		B43_WARN_ON(1);
4237 		goto out_unlock;
4238 	}
4239 	index = (u8) (key->keyidx);
4240 	if (index > 3)
4241 		goto out_unlock;
4242 
4243 	switch (cmd) {
4244 	case SET_KEY:
4245 		if (algorithm == B43_SEC_ALGO_TKIP &&
4246 		    (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ||
4247 		    !modparam_hwtkip)) {
4248 			/* We support only pairwise key */
4249 			err = -EOPNOTSUPP;
4250 			goto out_unlock;
4251 		}
4252 
4253 		if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
4254 			if (WARN_ON(!sta)) {
4255 				err = -EOPNOTSUPP;
4256 				goto out_unlock;
4257 			}
4258 			/* Pairwise key with an assigned MAC address. */
4259 			err = b43_key_write(dev, -1, algorithm,
4260 					    key->key, key->keylen,
4261 					    sta->addr, key);
4262 		} else {
4263 			/* Group key */
4264 			err = b43_key_write(dev, index, algorithm,
4265 					    key->key, key->keylen, NULL, key);
4266 		}
4267 		if (err)
4268 			goto out_unlock;
4269 
4270 		if (algorithm == B43_SEC_ALGO_WEP40 ||
4271 		    algorithm == B43_SEC_ALGO_WEP104) {
4272 			b43_hf_write(dev, b43_hf_read(dev) | B43_HF_USEDEFKEYS);
4273 		} else {
4274 			b43_hf_write(dev,
4275 				     b43_hf_read(dev) & ~B43_HF_USEDEFKEYS);
4276 		}
4277 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
4278 		if (algorithm == B43_SEC_ALGO_TKIP)
4279 			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
4280 		break;
4281 	case DISABLE_KEY: {
4282 		err = b43_key_clear(dev, key->hw_key_idx);
4283 		if (err)
4284 			goto out_unlock;
4285 		break;
4286 	}
4287 	default:
4288 		B43_WARN_ON(1);
4289 	}
4290 
4291 out_unlock:
4292 	if (!err) {
4293 		b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
4294 		       "mac: %pM\n",
4295 		       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
4296 		       sta ? sta->addr : bcast_addr);
4297 		b43_dump_keymemory(dev);
4298 	}
4299 	mutex_unlock(&wl->mutex);
4300 
4301 	return err;
4302 }
4303 
4304 static void b43_op_configure_filter(struct ieee80211_hw *hw,
4305 				    unsigned int changed, unsigned int *fflags,
4306 				    u64 multicast)
4307 {
4308 	struct b43_wl *wl = hw_to_b43_wl(hw);
4309 	struct b43_wldev *dev;
4310 
4311 	mutex_lock(&wl->mutex);
4312 	dev = wl->current_dev;
4313 	if (!dev) {
4314 		*fflags = 0;
4315 		goto out_unlock;
4316 	}
4317 
4318 	*fflags &= FIF_ALLMULTI |
4319 		  FIF_FCSFAIL |
4320 		  FIF_PLCPFAIL |
4321 		  FIF_CONTROL |
4322 		  FIF_OTHER_BSS |
4323 		  FIF_BCN_PRBRESP_PROMISC;
4324 
4325 	changed &= FIF_ALLMULTI |
4326 		   FIF_FCSFAIL |
4327 		   FIF_PLCPFAIL |
4328 		   FIF_CONTROL |
4329 		   FIF_OTHER_BSS |
4330 		   FIF_BCN_PRBRESP_PROMISC;
4331 
4332 	wl->filter_flags = *fflags;
4333 
4334 	if (changed && b43_status(dev) >= B43_STAT_INITIALIZED)
4335 		b43_adjust_opmode(dev);
4336 
4337 out_unlock:
4338 	mutex_unlock(&wl->mutex);
4339 }
4340 
4341 /* Locking: wl->mutex
4342  * Returns the current dev. This might be different from the passed in dev,
4343  * because the core might be gone away while we unlocked the mutex. */
4344 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev)
4345 {
4346 	struct b43_wl *wl;
4347 	struct b43_wldev *orig_dev;
4348 	u32 mask;
4349 	int queue_num;
4350 
4351 	if (!dev)
4352 		return NULL;
4353 	wl = dev->wl;
4354 redo:
4355 	if (!dev || b43_status(dev) < B43_STAT_STARTED)
4356 		return dev;
4357 
4358 	/* Cancel work. Unlock to avoid deadlocks. */
4359 	mutex_unlock(&wl->mutex);
4360 	cancel_delayed_work_sync(&dev->periodic_work);
4361 	cancel_work_sync(&wl->tx_work);
4362 	b43_leds_stop(dev);
4363 	mutex_lock(&wl->mutex);
4364 	dev = wl->current_dev;
4365 	if (!dev || b43_status(dev) < B43_STAT_STARTED) {
4366 		/* Whoops, aliens ate up the device while we were unlocked. */
4367 		return dev;
4368 	}
4369 
4370 	/* Disable interrupts on the device. */
4371 	b43_set_status(dev, B43_STAT_INITIALIZED);
4372 	if (b43_bus_host_is_sdio(dev->dev)) {
4373 		/* wl->mutex is locked. That is enough. */
4374 		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4375 		b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* Flush */
4376 	} else {
4377 		spin_lock_irq(&wl->hardirq_lock);
4378 		b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
4379 		b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);	/* Flush */
4380 		spin_unlock_irq(&wl->hardirq_lock);
4381 	}
4382 	/* Synchronize and free the interrupt handlers. Unlock to avoid deadlocks. */
4383 	orig_dev = dev;
4384 	mutex_unlock(&wl->mutex);
4385 	if (b43_bus_host_is_sdio(dev->dev))
4386 		b43_sdio_free_irq(dev);
4387 	else
4388 		free_irq(dev->dev->irq, dev);
4389 	mutex_lock(&wl->mutex);
4390 	dev = wl->current_dev;
4391 	if (!dev)
4392 		return dev;
4393 	if (dev != orig_dev) {
4394 		if (b43_status(dev) >= B43_STAT_STARTED)
4395 			goto redo;
4396 		return dev;
4397 	}
4398 	mask = b43_read32(dev, B43_MMIO_GEN_IRQ_MASK);
4399 	B43_WARN_ON(mask != 0xFFFFFFFF && mask);
4400 
4401 	/* Drain all TX queues. */
4402 	for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
4403 		while (skb_queue_len(&wl->tx_queue[queue_num])) {
4404 			struct sk_buff *skb;
4405 
4406 			skb = skb_dequeue(&wl->tx_queue[queue_num]);
4407 			ieee80211_free_txskb(wl->hw, skb);
4408 		}
4409 	}
4410 
4411 	b43_mac_suspend(dev);
4412 	b43_leds_exit(dev);
4413 	b43dbg(wl, "Wireless interface stopped\n");
4414 
4415 	return dev;
4416 }
4417 
4418 /* Locking: wl->mutex */
4419 static int b43_wireless_core_start(struct b43_wldev *dev)
4420 {
4421 	int err;
4422 
4423 	B43_WARN_ON(b43_status(dev) != B43_STAT_INITIALIZED);
4424 
4425 	drain_txstatus_queue(dev);
4426 	if (b43_bus_host_is_sdio(dev->dev)) {
4427 		err = b43_sdio_request_irq(dev, b43_sdio_interrupt_handler);
4428 		if (err) {
4429 			b43err(dev->wl, "Cannot request SDIO IRQ\n");
4430 			goto out;
4431 		}
4432 	} else {
4433 		err = request_threaded_irq(dev->dev->irq, b43_interrupt_handler,
4434 					   b43_interrupt_thread_handler,
4435 					   IRQF_SHARED, KBUILD_MODNAME, dev);
4436 		if (err) {
4437 			b43err(dev->wl, "Cannot request IRQ-%d\n",
4438 			       dev->dev->irq);
4439 			goto out;
4440 		}
4441 	}
4442 
4443 	/* We are ready to run. */
4444 	ieee80211_wake_queues(dev->wl->hw);
4445 	b43_set_status(dev, B43_STAT_STARTED);
4446 
4447 	/* Start data flow (TX/RX). */
4448 	b43_mac_enable(dev);
4449 	b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
4450 
4451 	/* Start maintenance work */
4452 	b43_periodic_tasks_setup(dev);
4453 
4454 	b43_leds_init(dev);
4455 
4456 	b43dbg(dev->wl, "Wireless interface started\n");
4457 out:
4458 	return err;
4459 }
4460 
4461 static char *b43_phy_name(struct b43_wldev *dev, u8 phy_type)
4462 {
4463 	switch (phy_type) {
4464 	case B43_PHYTYPE_A:
4465 		return "A";
4466 	case B43_PHYTYPE_B:
4467 		return "B";
4468 	case B43_PHYTYPE_G:
4469 		return "G";
4470 	case B43_PHYTYPE_N:
4471 		return "N";
4472 	case B43_PHYTYPE_LP:
4473 		return "LP";
4474 	case B43_PHYTYPE_SSLPN:
4475 		return "SSLPN";
4476 	case B43_PHYTYPE_HT:
4477 		return "HT";
4478 	case B43_PHYTYPE_LCN:
4479 		return "LCN";
4480 	case B43_PHYTYPE_LCNXN:
4481 		return "LCNXN";
4482 	case B43_PHYTYPE_LCN40:
4483 		return "LCN40";
4484 	case B43_PHYTYPE_AC:
4485 		return "AC";
4486 	}
4487 	return "UNKNOWN";
4488 }
4489 
4490 /* Get PHY and RADIO versioning numbers */
4491 static int b43_phy_versioning(struct b43_wldev *dev)
4492 {
4493 	struct b43_phy *phy = &dev->phy;
4494 	const u8 core_rev = dev->dev->core_rev;
4495 	u32 tmp;
4496 	u8 analog_type;
4497 	u8 phy_type;
4498 	u8 phy_rev;
4499 	u16 radio_manuf;
4500 	u16 radio_id;
4501 	u16 radio_rev;
4502 	u8 radio_ver;
4503 	int unsupported = 0;
4504 
4505 	/* Get PHY versioning */
4506 	tmp = b43_read16(dev, B43_MMIO_PHY_VER);
4507 	analog_type = (tmp & B43_PHYVER_ANALOG) >> B43_PHYVER_ANALOG_SHIFT;
4508 	phy_type = (tmp & B43_PHYVER_TYPE) >> B43_PHYVER_TYPE_SHIFT;
4509 	phy_rev = (tmp & B43_PHYVER_VERSION);
4510 
4511 	/* LCNXN is continuation of N which run out of revisions */
4512 	if (phy_type == B43_PHYTYPE_LCNXN) {
4513 		phy_type = B43_PHYTYPE_N;
4514 		phy_rev += 16;
4515 	}
4516 
4517 	switch (phy_type) {
4518 #ifdef CONFIG_B43_PHY_G
4519 	case B43_PHYTYPE_G:
4520 		if (phy_rev > 9)
4521 			unsupported = 1;
4522 		break;
4523 #endif
4524 #ifdef CONFIG_B43_PHY_N
4525 	case B43_PHYTYPE_N:
4526 		if (phy_rev >= 19)
4527 			unsupported = 1;
4528 		break;
4529 #endif
4530 #ifdef CONFIG_B43_PHY_LP
4531 	case B43_PHYTYPE_LP:
4532 		if (phy_rev > 2)
4533 			unsupported = 1;
4534 		break;
4535 #endif
4536 #ifdef CONFIG_B43_PHY_HT
4537 	case B43_PHYTYPE_HT:
4538 		if (phy_rev > 1)
4539 			unsupported = 1;
4540 		break;
4541 #endif
4542 #ifdef CONFIG_B43_PHY_LCN
4543 	case B43_PHYTYPE_LCN:
4544 		if (phy_rev > 1)
4545 			unsupported = 1;
4546 		break;
4547 #endif
4548 #ifdef CONFIG_B43_PHY_AC
4549 	case B43_PHYTYPE_AC:
4550 		if (phy_rev > 1)
4551 			unsupported = 1;
4552 		break;
4553 #endif
4554 	default:
4555 		unsupported = 1;
4556 	}
4557 	if (unsupported) {
4558 		b43err(dev->wl, "FOUND UNSUPPORTED PHY (Analog %u, Type %d (%s), Revision %u)\n",
4559 		       analog_type, phy_type, b43_phy_name(dev, phy_type),
4560 		       phy_rev);
4561 		return -EOPNOTSUPP;
4562 	}
4563 	b43info(dev->wl, "Found PHY: Analog %u, Type %d (%s), Revision %u\n",
4564 		analog_type, phy_type, b43_phy_name(dev, phy_type), phy_rev);
4565 
4566 	/* Get RADIO versioning */
4567 	if (core_rev == 40 || core_rev == 42) {
4568 		radio_manuf = 0x17F;
4569 
4570 		b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 0);
4571 		radio_rev = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4572 
4573 		b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, 1);
4574 		radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4575 
4576 		radio_ver = 0; /* Is there version somewhere? */
4577 	} else if (core_rev >= 24) {
4578 		u16 radio24[3];
4579 
4580 		for (tmp = 0; tmp < 3; tmp++) {
4581 			b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, tmp);
4582 			radio24[tmp] = b43_read16(dev, B43_MMIO_RADIO24_DATA);
4583 		}
4584 
4585 		radio_manuf = 0x17F;
4586 		radio_id = (radio24[2] << 8) | radio24[1];
4587 		radio_rev = (radio24[0] & 0xF);
4588 		radio_ver = (radio24[0] & 0xF0) >> 4;
4589 	} else {
4590 		if (dev->dev->chip_id == 0x4317) {
4591 			if (dev->dev->chip_rev == 0)
4592 				tmp = 0x3205017F;
4593 			else if (dev->dev->chip_rev == 1)
4594 				tmp = 0x4205017F;
4595 			else
4596 				tmp = 0x5205017F;
4597 		} else {
4598 			b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4599 				     B43_RADIOCTL_ID);
4600 			tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
4601 			b43_write16f(dev, B43_MMIO_RADIO_CONTROL,
4602 				     B43_RADIOCTL_ID);
4603 			tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
4604 		}
4605 		radio_manuf = (tmp & 0x00000FFF);
4606 		radio_id = (tmp & 0x0FFFF000) >> 12;
4607 		radio_rev = (tmp & 0xF0000000) >> 28;
4608 		radio_ver = 0; /* Probably not available on old hw */
4609 	}
4610 
4611 	if (radio_manuf != 0x17F /* Broadcom */)
4612 		unsupported = 1;
4613 	switch (phy_type) {
4614 	case B43_PHYTYPE_B:
4615 		if ((radio_id & 0xFFF0) != 0x2050)
4616 			unsupported = 1;
4617 		break;
4618 	case B43_PHYTYPE_G:
4619 		if (radio_id != 0x2050)
4620 			unsupported = 1;
4621 		break;
4622 	case B43_PHYTYPE_N:
4623 		if (radio_id != 0x2055 && radio_id != 0x2056 &&
4624 		    radio_id != 0x2057)
4625 			unsupported = 1;
4626 		if (radio_id == 0x2057 &&
4627 		    !(radio_rev == 9 || radio_rev == 14))
4628 			unsupported = 1;
4629 		break;
4630 	case B43_PHYTYPE_LP:
4631 		if (radio_id != 0x2062 && radio_id != 0x2063)
4632 			unsupported = 1;
4633 		break;
4634 	case B43_PHYTYPE_HT:
4635 		if (radio_id != 0x2059)
4636 			unsupported = 1;
4637 		break;
4638 	case B43_PHYTYPE_LCN:
4639 		if (radio_id != 0x2064)
4640 			unsupported = 1;
4641 		break;
4642 	case B43_PHYTYPE_AC:
4643 		if (radio_id != 0x2069)
4644 			unsupported = 1;
4645 		break;
4646 	default:
4647 		B43_WARN_ON(1);
4648 	}
4649 	if (unsupported) {
4650 		b43err(dev->wl,
4651 		       "FOUND UNSUPPORTED RADIO (Manuf 0x%X, ID 0x%X, Revision %u, Version %u)\n",
4652 		       radio_manuf, radio_id, radio_rev, radio_ver);
4653 		return -EOPNOTSUPP;
4654 	}
4655 	b43info(dev->wl,
4656 		"Found Radio: Manuf 0x%X, ID 0x%X, Revision %u, Version %u\n",
4657 		radio_manuf, radio_id, radio_rev, radio_ver);
4658 
4659 	/* FIXME: b43 treats "id" as "ver" and ignores the real "ver" */
4660 	phy->radio_manuf = radio_manuf;
4661 	phy->radio_ver = radio_id;
4662 	phy->radio_rev = radio_rev;
4663 
4664 	phy->analog = analog_type;
4665 	phy->type = phy_type;
4666 	phy->rev = phy_rev;
4667 
4668 	return 0;
4669 }
4670 
4671 static void setup_struct_phy_for_init(struct b43_wldev *dev,
4672 				      struct b43_phy *phy)
4673 {
4674 	phy->hardware_power_control = !!modparam_hwpctl;
4675 	phy->next_txpwr_check_time = jiffies;
4676 	/* PHY TX errors counter. */
4677 	atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
4678 
4679 #if B43_DEBUG
4680 	phy->phy_locked = false;
4681 	phy->radio_locked = false;
4682 #endif
4683 }
4684 
4685 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
4686 {
4687 	dev->dfq_valid = false;
4688 
4689 	/* Assume the radio is enabled. If it's not enabled, the state will
4690 	 * immediately get fixed on the first periodic work run. */
4691 	dev->radio_hw_enable = true;
4692 
4693 	/* Stats */
4694 	memset(&dev->stats, 0, sizeof(dev->stats));
4695 
4696 	setup_struct_phy_for_init(dev, &dev->phy);
4697 
4698 	/* IRQ related flags */
4699 	dev->irq_reason = 0;
4700 	memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
4701 	dev->irq_mask = B43_IRQ_MASKTEMPLATE;
4702 	if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
4703 		dev->irq_mask &= ~B43_IRQ_PHY_TXERR;
4704 
4705 	dev->mac_suspended = 1;
4706 
4707 	/* Noise calculation context */
4708 	memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
4709 }
4710 
4711 static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
4712 {
4713 	struct ssb_sprom *sprom = dev->dev->bus_sprom;
4714 	u64 hf;
4715 
4716 	if (!modparam_btcoex)
4717 		return;
4718 	if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
4719 		return;
4720 	if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
4721 		return;
4722 
4723 	hf = b43_hf_read(dev);
4724 	if (sprom->boardflags_lo & B43_BFL_BTCMOD)
4725 		hf |= B43_HF_BTCOEXALT;
4726 	else
4727 		hf |= B43_HF_BTCOEX;
4728 	b43_hf_write(dev, hf);
4729 }
4730 
4731 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
4732 {
4733 	if (!modparam_btcoex)
4734 		return;
4735 	//TODO
4736 }
4737 
4738 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
4739 {
4740 	struct ssb_bus *bus;
4741 	u32 tmp;
4742 
4743 #ifdef CONFIG_B43_SSB
4744 	if (dev->dev->bus_type != B43_BUS_SSB)
4745 		return;
4746 #else
4747 	return;
4748 #endif
4749 
4750 	bus = dev->dev->sdev->bus;
4751 
4752 	if ((bus->chip_id == 0x4311 && bus->chip_rev == 2) ||
4753 	    (bus->chip_id == 0x4312)) {
4754 		tmp = ssb_read32(dev->dev->sdev, SSB_IMCFGLO);
4755 		tmp &= ~SSB_IMCFGLO_REQTO;
4756 		tmp &= ~SSB_IMCFGLO_SERTO;
4757 		tmp |= 0x3;
4758 		ssb_write32(dev->dev->sdev, SSB_IMCFGLO, tmp);
4759 		ssb_commit_settings(bus);
4760 	}
4761 }
4762 
4763 static void b43_set_synth_pu_delay(struct b43_wldev *dev, bool idle)
4764 {
4765 	u16 pu_delay;
4766 
4767 	/* The time value is in microseconds. */
4768 	pu_delay = 1050;
4769 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
4770 		pu_delay = 500;
4771 	if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
4772 		pu_delay = max(pu_delay, (u16)2400);
4773 
4774 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SPUWKUP, pu_delay);
4775 }
4776 
4777 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
4778 static void b43_set_pretbtt(struct b43_wldev *dev)
4779 {
4780 	u16 pretbtt;
4781 
4782 	/* The time value is in microseconds. */
4783 	if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
4784 		pretbtt = 2;
4785 	else
4786 		pretbtt = 250;
4787 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRETBTT, pretbtt);
4788 	b43_write16(dev, B43_MMIO_TSF_CFP_PRETBTT, pretbtt);
4789 }
4790 
4791 /* Shutdown a wireless core */
4792 /* Locking: wl->mutex */
4793 static void b43_wireless_core_exit(struct b43_wldev *dev)
4794 {
4795 	B43_WARN_ON(dev && b43_status(dev) > B43_STAT_INITIALIZED);
4796 	if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
4797 		return;
4798 
4799 	b43_set_status(dev, B43_STAT_UNINIT);
4800 
4801 	/* Stop the microcode PSM. */
4802 	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
4803 		      B43_MACCTL_PSM_JMP0);
4804 
4805 	switch (dev->dev->bus_type) {
4806 #ifdef CONFIG_B43_BCMA
4807 	case B43_BUS_BCMA:
4808 		bcma_host_pci_down(dev->dev->bdev->bus);
4809 		break;
4810 #endif
4811 #ifdef CONFIG_B43_SSB
4812 	case B43_BUS_SSB:
4813 		/* TODO */
4814 		break;
4815 #endif
4816 	}
4817 
4818 	b43_dma_free(dev);
4819 	b43_pio_free(dev);
4820 	b43_chip_exit(dev);
4821 	dev->phy.ops->switch_analog(dev, 0);
4822 	if (dev->wl->current_beacon) {
4823 		dev_kfree_skb_any(dev->wl->current_beacon);
4824 		dev->wl->current_beacon = NULL;
4825 	}
4826 
4827 	b43_device_disable(dev, 0);
4828 	b43_bus_may_powerdown(dev);
4829 }
4830 
4831 /* Initialize a wireless core */
4832 static int b43_wireless_core_init(struct b43_wldev *dev)
4833 {
4834 	struct ssb_sprom *sprom = dev->dev->bus_sprom;
4835 	struct b43_phy *phy = &dev->phy;
4836 	int err;
4837 	u64 hf;
4838 
4839 	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4840 
4841 	err = b43_bus_powerup(dev, 0);
4842 	if (err)
4843 		goto out;
4844 	if (!b43_device_is_enabled(dev))
4845 		b43_wireless_core_reset(dev, phy->gmode);
4846 
4847 	/* Reset all data structures. */
4848 	setup_struct_wldev_for_init(dev);
4849 	phy->ops->prepare_structs(dev);
4850 
4851 	/* Enable IRQ routing to this device. */
4852 	switch (dev->dev->bus_type) {
4853 #ifdef CONFIG_B43_BCMA
4854 	case B43_BUS_BCMA:
4855 		bcma_host_pci_irq_ctl(dev->dev->bdev->bus,
4856 				      dev->dev->bdev, true);
4857 		bcma_host_pci_up(dev->dev->bdev->bus);
4858 		break;
4859 #endif
4860 #ifdef CONFIG_B43_SSB
4861 	case B43_BUS_SSB:
4862 		ssb_pcicore_dev_irqvecs_enable(&dev->dev->sdev->bus->pcicore,
4863 					       dev->dev->sdev);
4864 		break;
4865 #endif
4866 	}
4867 
4868 	b43_imcfglo_timeouts_workaround(dev);
4869 	b43_bluetooth_coext_disable(dev);
4870 	if (phy->ops->prepare_hardware) {
4871 		err = phy->ops->prepare_hardware(dev);
4872 		if (err)
4873 			goto err_busdown;
4874 	}
4875 	err = b43_chip_init(dev);
4876 	if (err)
4877 		goto err_busdown;
4878 	b43_shm_write16(dev, B43_SHM_SHARED,
4879 			B43_SHM_SH_WLCOREREV, dev->dev->core_rev);
4880 	hf = b43_hf_read(dev);
4881 	if (phy->type == B43_PHYTYPE_G) {
4882 		hf |= B43_HF_SYMW;
4883 		if (phy->rev == 1)
4884 			hf |= B43_HF_GDCW;
4885 		if (sprom->boardflags_lo & B43_BFL_PACTRL)
4886 			hf |= B43_HF_OFDMPABOOST;
4887 	}
4888 	if (phy->radio_ver == 0x2050) {
4889 		if (phy->radio_rev == 6)
4890 			hf |= B43_HF_4318TSSI;
4891 		if (phy->radio_rev < 6)
4892 			hf |= B43_HF_VCORECALC;
4893 	}
4894 	if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
4895 		hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
4896 #if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
4897 	if (dev->dev->bus_type == B43_BUS_SSB &&
4898 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
4899 	    dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
4900 		hf |= B43_HF_PCISCW; /* PCI slow clock workaround. */
4901 #endif
4902 	hf &= ~B43_HF_SKCFPUP;
4903 	b43_hf_write(dev, hf);
4904 
4905 	/* tell the ucode MAC capabilities */
4906 	if (dev->dev->core_rev >= 13) {
4907 		u32 mac_hw_cap = b43_read32(dev, B43_MMIO_MAC_HW_CAP);
4908 
4909 		b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_L,
4910 				mac_hw_cap & 0xffff);
4911 		b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_MACHW_H,
4912 				(mac_hw_cap >> 16) & 0xffff);
4913 	}
4914 
4915 	b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
4916 			     B43_DEFAULT_LONG_RETRY_LIMIT);
4917 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
4918 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
4919 
4920 	/* Disable sending probe responses from firmware.
4921 	 * Setting the MaxTime to one usec will always trigger
4922 	 * a timeout, so we never send any probe resp.
4923 	 * A timeout of zero is infinite. */
4924 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRMAXTIME, 1);
4925 
4926 	b43_rate_memory_init(dev);
4927 	b43_set_phytxctl_defaults(dev);
4928 
4929 	/* Minimum Contention Window */
4930 	if (phy->type == B43_PHYTYPE_B)
4931 		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
4932 	else
4933 		b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
4934 	/* Maximum Contention Window */
4935 	b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
4936 
4937 	/* write phytype and phyvers */
4938 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYTYPE, phy->type);
4939 	b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PHYVER, phy->rev);
4940 
4941 	if (b43_bus_host_is_pcmcia(dev->dev) ||
4942 	    b43_bus_host_is_sdio(dev->dev)) {
4943 		dev->__using_pio_transfers = true;
4944 		err = b43_pio_init(dev);
4945 	} else if (dev->use_pio) {
4946 		b43warn(dev->wl, "Forced PIO by use_pio module parameter. "
4947 			"This should not be needed and will result in lower "
4948 			"performance.\n");
4949 		dev->__using_pio_transfers = true;
4950 		err = b43_pio_init(dev);
4951 	} else {
4952 		dev->__using_pio_transfers = false;
4953 		err = b43_dma_init(dev);
4954 	}
4955 	if (err)
4956 		goto err_chip_exit;
4957 	b43_qos_init(dev);
4958 	b43_set_synth_pu_delay(dev, 1);
4959 	b43_bluetooth_coext_enable(dev);
4960 
4961 	b43_bus_powerup(dev, !(sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW));
4962 	b43_upload_card_macaddress(dev);
4963 	b43_security_init(dev);
4964 
4965 	ieee80211_wake_queues(dev->wl->hw);
4966 
4967 	b43_set_status(dev, B43_STAT_INITIALIZED);
4968 
4969 out:
4970 	return err;
4971 
4972 err_chip_exit:
4973 	b43_chip_exit(dev);
4974 err_busdown:
4975 	b43_bus_may_powerdown(dev);
4976 	B43_WARN_ON(b43_status(dev) != B43_STAT_UNINIT);
4977 	return err;
4978 }
4979 
4980 static int b43_op_add_interface(struct ieee80211_hw *hw,
4981 				struct ieee80211_vif *vif)
4982 {
4983 	struct b43_wl *wl = hw_to_b43_wl(hw);
4984 	struct b43_wldev *dev;
4985 	int err = -EOPNOTSUPP;
4986 
4987 	/* TODO: allow WDS/AP devices to coexist */
4988 
4989 	if (vif->type != NL80211_IFTYPE_AP &&
4990 	    vif->type != NL80211_IFTYPE_MESH_POINT &&
4991 	    vif->type != NL80211_IFTYPE_STATION &&
4992 	    vif->type != NL80211_IFTYPE_WDS &&
4993 	    vif->type != NL80211_IFTYPE_ADHOC)
4994 		return -EOPNOTSUPP;
4995 
4996 	mutex_lock(&wl->mutex);
4997 	if (wl->operating)
4998 		goto out_mutex_unlock;
4999 
5000 	b43dbg(wl, "Adding Interface type %d\n", vif->type);
5001 
5002 	dev = wl->current_dev;
5003 	wl->operating = true;
5004 	wl->vif = vif;
5005 	wl->if_type = vif->type;
5006 	memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
5007 
5008 	b43_adjust_opmode(dev);
5009 	b43_set_pretbtt(dev);
5010 	b43_set_synth_pu_delay(dev, 0);
5011 	b43_upload_card_macaddress(dev);
5012 
5013 	err = 0;
5014  out_mutex_unlock:
5015 	mutex_unlock(&wl->mutex);
5016 
5017 	if (err == 0)
5018 		b43_op_bss_info_changed(hw, vif, &vif->bss_conf, ~0);
5019 
5020 	return err;
5021 }
5022 
5023 static void b43_op_remove_interface(struct ieee80211_hw *hw,
5024 				    struct ieee80211_vif *vif)
5025 {
5026 	struct b43_wl *wl = hw_to_b43_wl(hw);
5027 	struct b43_wldev *dev = wl->current_dev;
5028 
5029 	b43dbg(wl, "Removing Interface type %d\n", vif->type);
5030 
5031 	mutex_lock(&wl->mutex);
5032 
5033 	B43_WARN_ON(!wl->operating);
5034 	B43_WARN_ON(wl->vif != vif);
5035 	wl->vif = NULL;
5036 
5037 	wl->operating = false;
5038 
5039 	b43_adjust_opmode(dev);
5040 	eth_zero_addr(wl->mac_addr);
5041 	b43_upload_card_macaddress(dev);
5042 
5043 	mutex_unlock(&wl->mutex);
5044 }
5045 
5046 static int b43_op_start(struct ieee80211_hw *hw)
5047 {
5048 	struct b43_wl *wl = hw_to_b43_wl(hw);
5049 	struct b43_wldev *dev = wl->current_dev;
5050 	int did_init = 0;
5051 	int err = 0;
5052 
5053 	/* Kill all old instance specific information to make sure
5054 	 * the card won't use it in the short timeframe between start
5055 	 * and mac80211 reconfiguring it. */
5056 	eth_zero_addr(wl->bssid);
5057 	eth_zero_addr(wl->mac_addr);
5058 	wl->filter_flags = 0;
5059 	wl->radiotap_enabled = false;
5060 	b43_qos_clear(wl);
5061 	wl->beacon0_uploaded = false;
5062 	wl->beacon1_uploaded = false;
5063 	wl->beacon_templates_virgin = true;
5064 	wl->radio_enabled = true;
5065 
5066 	mutex_lock(&wl->mutex);
5067 
5068 	if (b43_status(dev) < B43_STAT_INITIALIZED) {
5069 		err = b43_wireless_core_init(dev);
5070 		if (err)
5071 			goto out_mutex_unlock;
5072 		did_init = 1;
5073 	}
5074 
5075 	if (b43_status(dev) < B43_STAT_STARTED) {
5076 		err = b43_wireless_core_start(dev);
5077 		if (err) {
5078 			if (did_init)
5079 				b43_wireless_core_exit(dev);
5080 			goto out_mutex_unlock;
5081 		}
5082 	}
5083 
5084 	/* XXX: only do if device doesn't support rfkill irq */
5085 	wiphy_rfkill_start_polling(hw->wiphy);
5086 
5087  out_mutex_unlock:
5088 	mutex_unlock(&wl->mutex);
5089 
5090 	/*
5091 	 * Configuration may have been overwritten during initialization.
5092 	 * Reload the configuration, but only if initialization was
5093 	 * successful. Reloading the configuration after a failed init
5094 	 * may hang the system.
5095 	 */
5096 	if (!err)
5097 		b43_op_config(hw, ~0);
5098 
5099 	return err;
5100 }
5101 
5102 static void b43_op_stop(struct ieee80211_hw *hw)
5103 {
5104 	struct b43_wl *wl = hw_to_b43_wl(hw);
5105 	struct b43_wldev *dev = wl->current_dev;
5106 
5107 	cancel_work_sync(&(wl->beacon_update_trigger));
5108 
5109 	if (!dev)
5110 		goto out;
5111 
5112 	mutex_lock(&wl->mutex);
5113 	if (b43_status(dev) >= B43_STAT_STARTED) {
5114 		dev = b43_wireless_core_stop(dev);
5115 		if (!dev)
5116 			goto out_unlock;
5117 	}
5118 	b43_wireless_core_exit(dev);
5119 	wl->radio_enabled = false;
5120 
5121 out_unlock:
5122 	mutex_unlock(&wl->mutex);
5123 out:
5124 	cancel_work_sync(&(wl->txpower_adjust_work));
5125 }
5126 
5127 static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
5128 				 struct ieee80211_sta *sta, bool set)
5129 {
5130 	struct b43_wl *wl = hw_to_b43_wl(hw);
5131 
5132 	b43_update_templates(wl);
5133 
5134 	return 0;
5135 }
5136 
5137 static void b43_op_sta_notify(struct ieee80211_hw *hw,
5138 			      struct ieee80211_vif *vif,
5139 			      enum sta_notify_cmd notify_cmd,
5140 			      struct ieee80211_sta *sta)
5141 {
5142 	struct b43_wl *wl = hw_to_b43_wl(hw);
5143 
5144 	B43_WARN_ON(!vif || wl->vif != vif);
5145 }
5146 
5147 static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw,
5148 					  struct ieee80211_vif *vif,
5149 					  const u8 *mac_addr)
5150 {
5151 	struct b43_wl *wl = hw_to_b43_wl(hw);
5152 	struct b43_wldev *dev;
5153 
5154 	mutex_lock(&wl->mutex);
5155 	dev = wl->current_dev;
5156 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5157 		/* Disable CFP update during scan on other channels. */
5158 		b43_hf_write(dev, b43_hf_read(dev) | B43_HF_SKCFPUP);
5159 	}
5160 	mutex_unlock(&wl->mutex);
5161 }
5162 
5163 static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw,
5164 					     struct ieee80211_vif *vif)
5165 {
5166 	struct b43_wl *wl = hw_to_b43_wl(hw);
5167 	struct b43_wldev *dev;
5168 
5169 	mutex_lock(&wl->mutex);
5170 	dev = wl->current_dev;
5171 	if (dev && (b43_status(dev) >= B43_STAT_INITIALIZED)) {
5172 		/* Re-enable CFP update. */
5173 		b43_hf_write(dev, b43_hf_read(dev) & ~B43_HF_SKCFPUP);
5174 	}
5175 	mutex_unlock(&wl->mutex);
5176 }
5177 
5178 static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
5179 			     struct survey_info *survey)
5180 {
5181 	struct b43_wl *wl = hw_to_b43_wl(hw);
5182 	struct b43_wldev *dev = wl->current_dev;
5183 	struct ieee80211_conf *conf = &hw->conf;
5184 
5185 	if (idx != 0)
5186 		return -ENOENT;
5187 
5188 	survey->channel = conf->chandef.chan;
5189 	survey->filled = SURVEY_INFO_NOISE_DBM;
5190 	survey->noise = dev->stats.link_noise;
5191 
5192 	return 0;
5193 }
5194 
5195 static const struct ieee80211_ops b43_hw_ops = {
5196 	.tx			= b43_op_tx,
5197 	.conf_tx		= b43_op_conf_tx,
5198 	.add_interface		= b43_op_add_interface,
5199 	.remove_interface	= b43_op_remove_interface,
5200 	.config			= b43_op_config,
5201 	.bss_info_changed	= b43_op_bss_info_changed,
5202 	.configure_filter	= b43_op_configure_filter,
5203 	.set_key		= b43_op_set_key,
5204 	.update_tkip_key	= b43_op_update_tkip_key,
5205 	.get_stats		= b43_op_get_stats,
5206 	.get_tsf		= b43_op_get_tsf,
5207 	.set_tsf		= b43_op_set_tsf,
5208 	.start			= b43_op_start,
5209 	.stop			= b43_op_stop,
5210 	.set_tim		= b43_op_beacon_set_tim,
5211 	.sta_notify		= b43_op_sta_notify,
5212 	.sw_scan_start		= b43_op_sw_scan_start_notifier,
5213 	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
5214 	.get_survey		= b43_op_get_survey,
5215 	.rfkill_poll		= b43_rfkill_poll,
5216 };
5217 
5218 /* Hard-reset the chip. Do not call this directly.
5219  * Use b43_controller_restart()
5220  */
5221 static void b43_chip_reset(struct work_struct *work)
5222 {
5223 	struct b43_wldev *dev =
5224 	    container_of(work, struct b43_wldev, restart_work);
5225 	struct b43_wl *wl = dev->wl;
5226 	int err = 0;
5227 	int prev_status;
5228 
5229 	mutex_lock(&wl->mutex);
5230 
5231 	prev_status = b43_status(dev);
5232 	/* Bring the device down... */
5233 	if (prev_status >= B43_STAT_STARTED) {
5234 		dev = b43_wireless_core_stop(dev);
5235 		if (!dev) {
5236 			err = -ENODEV;
5237 			goto out;
5238 		}
5239 	}
5240 	if (prev_status >= B43_STAT_INITIALIZED)
5241 		b43_wireless_core_exit(dev);
5242 
5243 	/* ...and up again. */
5244 	if (prev_status >= B43_STAT_INITIALIZED) {
5245 		err = b43_wireless_core_init(dev);
5246 		if (err)
5247 			goto out;
5248 	}
5249 	if (prev_status >= B43_STAT_STARTED) {
5250 		err = b43_wireless_core_start(dev);
5251 		if (err) {
5252 			b43_wireless_core_exit(dev);
5253 			goto out;
5254 		}
5255 	}
5256 out:
5257 	if (err)
5258 		wl->current_dev = NULL; /* Failed to init the dev. */
5259 	mutex_unlock(&wl->mutex);
5260 
5261 	if (err) {
5262 		b43err(wl, "Controller restart FAILED\n");
5263 		return;
5264 	}
5265 
5266 	/* reload configuration */
5267 	b43_op_config(wl->hw, ~0);
5268 	if (wl->vif)
5269 		b43_op_bss_info_changed(wl->hw, wl->vif, &wl->vif->bss_conf, ~0);
5270 
5271 	b43info(wl, "Controller restarted\n");
5272 }
5273 
5274 static int b43_setup_bands(struct b43_wldev *dev,
5275 			   bool have_2ghz_phy, bool have_5ghz_phy)
5276 {
5277 	struct ieee80211_hw *hw = dev->wl->hw;
5278 	struct b43_phy *phy = &dev->phy;
5279 	bool limited_2g;
5280 	bool limited_5g;
5281 
5282 	/* We don't support all 2 GHz channels on some devices */
5283 	limited_2g = phy->radio_ver == 0x2057 &&
5284 		     (phy->radio_rev == 9 || phy->radio_rev == 14);
5285 	limited_5g = phy->radio_ver == 0x2057 &&
5286 		     phy->radio_rev == 9;
5287 
5288 	if (have_2ghz_phy)
5289 		hw->wiphy->bands[NL80211_BAND_2GHZ] = limited_2g ?
5290 			&b43_band_2ghz_limited : &b43_band_2GHz;
5291 	if (dev->phy.type == B43_PHYTYPE_N) {
5292 		if (have_5ghz_phy)
5293 			hw->wiphy->bands[NL80211_BAND_5GHZ] = limited_5g ?
5294 				&b43_band_5GHz_nphy_limited :
5295 				&b43_band_5GHz_nphy;
5296 	} else {
5297 		if (have_5ghz_phy)
5298 			hw->wiphy->bands[NL80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
5299 	}
5300 
5301 	dev->phy.supports_2ghz = have_2ghz_phy;
5302 	dev->phy.supports_5ghz = have_5ghz_phy;
5303 
5304 	return 0;
5305 }
5306 
5307 static void b43_wireless_core_detach(struct b43_wldev *dev)
5308 {
5309 	/* We release firmware that late to not be required to re-request
5310 	 * is all the time when we reinit the core. */
5311 	b43_release_firmware(dev);
5312 	b43_phy_free(dev);
5313 }
5314 
5315 static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
5316 				bool *have_5ghz_phy)
5317 {
5318 	u16 dev_id = 0;
5319 
5320 #ifdef CONFIG_B43_BCMA
5321 	if (dev->dev->bus_type == B43_BUS_BCMA &&
5322 	    dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
5323 		dev_id = dev->dev->bdev->bus->host_pci->device;
5324 #endif
5325 #ifdef CONFIG_B43_SSB
5326 	if (dev->dev->bus_type == B43_BUS_SSB &&
5327 	    dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
5328 		dev_id = dev->dev->sdev->bus->host_pci->device;
5329 #endif
5330 	/* Override with SPROM value if available */
5331 	if (dev->dev->bus_sprom->dev_id)
5332 		dev_id = dev->dev->bus_sprom->dev_id;
5333 
5334 	/* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
5335 	switch (dev_id) {
5336 	case 0x4324: /* BCM4306 */
5337 	case 0x4312: /* BCM4311 */
5338 	case 0x4319: /* BCM4318 */
5339 	case 0x4328: /* BCM4321 */
5340 	case 0x432b: /* BCM4322 */
5341 	case 0x4350: /* BCM43222 */
5342 	case 0x4353: /* BCM43224 */
5343 	case 0x0576: /* BCM43224 */
5344 	case 0x435f: /* BCM6362 */
5345 	case 0x4331: /* BCM4331 */
5346 	case 0x4359: /* BCM43228 */
5347 	case 0x43a0: /* BCM4360 */
5348 	case 0x43b1: /* BCM4352 */
5349 		/* Dual band devices */
5350 		*have_2ghz_phy = true;
5351 		*have_5ghz_phy = true;
5352 		return;
5353 	case 0x4321: /* BCM4306 */
5354 		/* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
5355 		if (dev->phy.type != B43_PHYTYPE_G)
5356 			break;
5357 		/* fall through */
5358 	case 0x4313: /* BCM4311 */
5359 	case 0x431a: /* BCM4318 */
5360 	case 0x432a: /* BCM4321 */
5361 	case 0x432d: /* BCM4322 */
5362 	case 0x4352: /* BCM43222 */
5363 	case 0x435a: /* BCM43228 */
5364 	case 0x4333: /* BCM4331 */
5365 	case 0x43a2: /* BCM4360 */
5366 	case 0x43b3: /* BCM4352 */
5367 		/* 5 GHz only devices */
5368 		*have_2ghz_phy = false;
5369 		*have_5ghz_phy = true;
5370 		return;
5371 	}
5372 
5373 	/* As a fallback, try to guess using PHY type */
5374 	switch (dev->phy.type) {
5375 	case B43_PHYTYPE_G:
5376 	case B43_PHYTYPE_N:
5377 	case B43_PHYTYPE_LP:
5378 	case B43_PHYTYPE_HT:
5379 	case B43_PHYTYPE_LCN:
5380 		*have_2ghz_phy = true;
5381 		*have_5ghz_phy = false;
5382 		return;
5383 	}
5384 
5385 	B43_WARN_ON(1);
5386 }
5387 
5388 static int b43_wireless_core_attach(struct b43_wldev *dev)
5389 {
5390 	struct b43_wl *wl = dev->wl;
5391 	struct b43_phy *phy = &dev->phy;
5392 	int err;
5393 	u32 tmp;
5394 	bool have_2ghz_phy = false, have_5ghz_phy = false;
5395 
5396 	/* Do NOT do any device initialization here.
5397 	 * Do it in wireless_core_init() instead.
5398 	 * This function is for gathering basic information about the HW, only.
5399 	 * Also some structs may be set up here. But most likely you want to have
5400 	 * that in core_init(), too.
5401 	 */
5402 
5403 	err = b43_bus_powerup(dev, 0);
5404 	if (err) {
5405 		b43err(wl, "Bus powerup failed\n");
5406 		goto out;
5407 	}
5408 
5409 	phy->do_full_init = true;
5410 
5411 	/* Try to guess supported bands for the first init needs */
5412 	switch (dev->dev->bus_type) {
5413 #ifdef CONFIG_B43_BCMA
5414 	case B43_BUS_BCMA:
5415 		tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
5416 		have_2ghz_phy = !!(tmp & B43_BCMA_IOST_2G_PHY);
5417 		have_5ghz_phy = !!(tmp & B43_BCMA_IOST_5G_PHY);
5418 		break;
5419 #endif
5420 #ifdef CONFIG_B43_SSB
5421 	case B43_BUS_SSB:
5422 		if (dev->dev->core_rev >= 5) {
5423 			tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
5424 			have_2ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_2GHZ_PHY);
5425 			have_5ghz_phy = !!(tmp & B43_TMSHIGH_HAVE_5GHZ_PHY);
5426 		} else
5427 			B43_WARN_ON(1);
5428 		break;
5429 #endif
5430 	}
5431 
5432 	dev->phy.gmode = have_2ghz_phy;
5433 	b43_wireless_core_reset(dev, dev->phy.gmode);
5434 
5435 	/* Get the PHY type. */
5436 	err = b43_phy_versioning(dev);
5437 	if (err)
5438 		goto err_powerdown;
5439 
5440 	/* Get real info about supported bands */
5441 	b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
5442 
5443 	/* We don't support 5 GHz on some PHYs yet */
5444 	if (have_5ghz_phy) {
5445 		switch (dev->phy.type) {
5446 		case B43_PHYTYPE_G:
5447 		case B43_PHYTYPE_LP:
5448 		case B43_PHYTYPE_HT:
5449 			b43warn(wl, "5 GHz band is unsupported on this PHY\n");
5450 			have_5ghz_phy = false;
5451 		}
5452 	}
5453 
5454 	if (!have_2ghz_phy && !have_5ghz_phy) {
5455 		b43err(wl, "b43 can't support any band on this device\n");
5456 		err = -EOPNOTSUPP;
5457 		goto err_powerdown;
5458 	}
5459 
5460 	err = b43_phy_allocate(dev);
5461 	if (err)
5462 		goto err_powerdown;
5463 
5464 	dev->phy.gmode = have_2ghz_phy;
5465 	b43_wireless_core_reset(dev, dev->phy.gmode);
5466 
5467 	err = b43_validate_chipaccess(dev);
5468 	if (err)
5469 		goto err_phy_free;
5470 	err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
5471 	if (err)
5472 		goto err_phy_free;
5473 
5474 	/* Now set some default "current_dev" */
5475 	if (!wl->current_dev)
5476 		wl->current_dev = dev;
5477 	INIT_WORK(&dev->restart_work, b43_chip_reset);
5478 
5479 	dev->phy.ops->switch_analog(dev, 0);
5480 	b43_device_disable(dev, 0);
5481 	b43_bus_may_powerdown(dev);
5482 
5483 out:
5484 	return err;
5485 
5486 err_phy_free:
5487 	b43_phy_free(dev);
5488 err_powerdown:
5489 	b43_bus_may_powerdown(dev);
5490 	return err;
5491 }
5492 
5493 static void b43_one_core_detach(struct b43_bus_dev *dev)
5494 {
5495 	struct b43_wldev *wldev;
5496 	struct b43_wl *wl;
5497 
5498 	/* Do not cancel ieee80211-workqueue based work here.
5499 	 * See comment in b43_remove(). */
5500 
5501 	wldev = b43_bus_get_wldev(dev);
5502 	wl = wldev->wl;
5503 	b43_debugfs_remove_device(wldev);
5504 	b43_wireless_core_detach(wldev);
5505 	list_del(&wldev->list);
5506 	b43_bus_set_wldev(dev, NULL);
5507 	kfree(wldev);
5508 }
5509 
5510 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
5511 {
5512 	struct b43_wldev *wldev;
5513 	int err = -ENOMEM;
5514 
5515 	wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
5516 	if (!wldev)
5517 		goto out;
5518 
5519 	wldev->use_pio = b43_modparam_pio;
5520 	wldev->dev = dev;
5521 	wldev->wl = wl;
5522 	b43_set_status(wldev, B43_STAT_UNINIT);
5523 	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
5524 	INIT_LIST_HEAD(&wldev->list);
5525 
5526 	err = b43_wireless_core_attach(wldev);
5527 	if (err)
5528 		goto err_kfree_wldev;
5529 
5530 	b43_bus_set_wldev(dev, wldev);
5531 	b43_debugfs_add_device(wldev);
5532 
5533       out:
5534 	return err;
5535 
5536       err_kfree_wldev:
5537 	kfree(wldev);
5538 	return err;
5539 }
5540 
5541 #define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice)		( \
5542 	(pdev->vendor == PCI_VENDOR_ID_##_vendor) &&			\
5543 	(pdev->device == _device) &&					\
5544 	(pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&	\
5545 	(pdev->subsystem_device == _subdevice)				)
5546 
5547 #ifdef CONFIG_B43_SSB
5548 static void b43_sprom_fixup(struct ssb_bus *bus)
5549 {
5550 	struct pci_dev *pdev;
5551 
5552 	/* boardflags workarounds */
5553 	if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
5554 	    bus->chip_id == 0x4301 && bus->sprom.board_rev == 0x74)
5555 		bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
5556 	if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
5557 	    bus->boardinfo.type == 0x4E && bus->sprom.board_rev > 0x40)
5558 		bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
5559 	if (bus->bustype == SSB_BUSTYPE_PCI) {
5560 		pdev = bus->host_pci;
5561 		if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
5562 		    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
5563 		    IS_PDEV(pdev, BROADCOM, 0x4320,      HP, 0x12f8) ||
5564 		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
5565 		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
5566 		    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013) ||
5567 		    IS_PDEV(pdev, BROADCOM, 0x4320, MOTOROLA, 0x7010))
5568 			bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
5569 	}
5570 }
5571 
5572 static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
5573 {
5574 	struct ieee80211_hw *hw = wl->hw;
5575 
5576 	ssb_set_devtypedata(dev->sdev, NULL);
5577 	ieee80211_free_hw(hw);
5578 }
5579 #endif
5580 
5581 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
5582 {
5583 	struct ssb_sprom *sprom = dev->bus_sprom;
5584 	struct ieee80211_hw *hw;
5585 	struct b43_wl *wl;
5586 	char chip_name[6];
5587 	int queue_num;
5588 
5589 	hw = ieee80211_alloc_hw(sizeof(*wl), &b43_hw_ops);
5590 	if (!hw) {
5591 		b43err(NULL, "Could not allocate ieee80211 device\n");
5592 		return ERR_PTR(-ENOMEM);
5593 	}
5594 	wl = hw_to_b43_wl(hw);
5595 
5596 	/* fill hw info */
5597 	ieee80211_hw_set(hw, RX_INCLUDES_FCS);
5598 	ieee80211_hw_set(hw, SIGNAL_DBM);
5599 
5600 	hw->wiphy->interface_modes =
5601 		BIT(NL80211_IFTYPE_AP) |
5602 		BIT(NL80211_IFTYPE_MESH_POINT) |
5603 		BIT(NL80211_IFTYPE_STATION) |
5604 #ifdef CONFIG_WIRELESS_WDS
5605 		BIT(NL80211_IFTYPE_WDS) |
5606 #endif
5607 		BIT(NL80211_IFTYPE_ADHOC);
5608 
5609 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5610 
5611 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5612 
5613 	wl->hw_registred = false;
5614 	hw->max_rates = 2;
5615 	SET_IEEE80211_DEV(hw, dev->dev);
5616 	if (is_valid_ether_addr(sprom->et1mac))
5617 		SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
5618 	else
5619 		SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
5620 
5621 	/* Initialize struct b43_wl */
5622 	wl->hw = hw;
5623 	mutex_init(&wl->mutex);
5624 	spin_lock_init(&wl->hardirq_lock);
5625 	spin_lock_init(&wl->beacon_lock);
5626 	INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
5627 	INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
5628 	INIT_WORK(&wl->tx_work, b43_tx_work);
5629 
5630 	/* Initialize queues and flags. */
5631 	for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
5632 		skb_queue_head_init(&wl->tx_queue[queue_num]);
5633 		wl->tx_queue_stopped[queue_num] = 0;
5634 	}
5635 
5636 	snprintf(chip_name, ARRAY_SIZE(chip_name),
5637 		 (dev->chip_id > 0x9999) ? "%d" : "%04X", dev->chip_id);
5638 	b43info(wl, "Broadcom %s WLAN found (core revision %u)\n", chip_name,
5639 		dev->core_rev);
5640 	return wl;
5641 }
5642 
5643 #ifdef CONFIG_B43_BCMA
5644 static int b43_bcma_probe(struct bcma_device *core)
5645 {
5646 	struct b43_bus_dev *dev;
5647 	struct b43_wl *wl;
5648 	int err;
5649 
5650 	if (!modparam_allhwsupport &&
5651 	    (core->id.rev == 0x17 || core->id.rev == 0x18)) {
5652 		pr_err("Support for cores revisions 0x17 and 0x18 disabled by module param allhwsupport=0. Try b43.allhwsupport=1\n");
5653 		return -ENOTSUPP;
5654 	}
5655 
5656 	dev = b43_bus_dev_bcma_init(core);
5657 	if (!dev)
5658 		return -ENODEV;
5659 
5660 	wl = b43_wireless_init(dev);
5661 	if (IS_ERR(wl)) {
5662 		err = PTR_ERR(wl);
5663 		goto bcma_out;
5664 	}
5665 
5666 	err = b43_one_core_attach(dev, wl);
5667 	if (err)
5668 		goto bcma_err_wireless_exit;
5669 
5670 	/* setup and start work to load firmware */
5671 	INIT_WORK(&wl->firmware_load, b43_request_firmware);
5672 	schedule_work(&wl->firmware_load);
5673 
5674 	return err;
5675 
5676 bcma_err_wireless_exit:
5677 	ieee80211_free_hw(wl->hw);
5678 bcma_out:
5679 	kfree(dev);
5680 	return err;
5681 }
5682 
5683 static void b43_bcma_remove(struct bcma_device *core)
5684 {
5685 	struct b43_wldev *wldev = bcma_get_drvdata(core);
5686 	struct b43_wl *wl = wldev->wl;
5687 
5688 	/* We must cancel any work here before unregistering from ieee80211,
5689 	 * as the ieee80211 unreg will destroy the workqueue. */
5690 	cancel_work_sync(&wldev->restart_work);
5691 	cancel_work_sync(&wl->firmware_load);
5692 
5693 	B43_WARN_ON(!wl);
5694 	if (!wldev->fw.ucode.data)
5695 		return;			/* NULL if firmware never loaded */
5696 	if (wl->current_dev == wldev && wl->hw_registred) {
5697 		b43_leds_stop(wldev);
5698 		ieee80211_unregister_hw(wl->hw);
5699 	}
5700 
5701 	b43_one_core_detach(wldev->dev);
5702 
5703 	/* Unregister HW RNG driver */
5704 	b43_rng_exit(wl);
5705 
5706 	b43_leds_unregister(wl);
5707 	ieee80211_free_hw(wl->hw);
5708 	kfree(wldev->dev);
5709 }
5710 
5711 static struct bcma_driver b43_bcma_driver = {
5712 	.name		= KBUILD_MODNAME,
5713 	.id_table	= b43_bcma_tbl,
5714 	.probe		= b43_bcma_probe,
5715 	.remove		= b43_bcma_remove,
5716 };
5717 #endif
5718 
5719 #ifdef CONFIG_B43_SSB
5720 static
5721 int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
5722 {
5723 	struct b43_bus_dev *dev;
5724 	struct b43_wl *wl;
5725 	int err;
5726 
5727 	dev = b43_bus_dev_ssb_init(sdev);
5728 	if (!dev)
5729 		return -ENOMEM;
5730 
5731 	wl = ssb_get_devtypedata(sdev);
5732 	if (wl) {
5733 		b43err(NULL, "Dual-core devices are not supported\n");
5734 		err = -ENOTSUPP;
5735 		goto err_ssb_kfree_dev;
5736 	}
5737 
5738 	b43_sprom_fixup(sdev->bus);
5739 
5740 	wl = b43_wireless_init(dev);
5741 	if (IS_ERR(wl)) {
5742 		err = PTR_ERR(wl);
5743 		goto err_ssb_kfree_dev;
5744 	}
5745 	ssb_set_devtypedata(sdev, wl);
5746 	B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
5747 
5748 	err = b43_one_core_attach(dev, wl);
5749 	if (err)
5750 		goto err_ssb_wireless_exit;
5751 
5752 	/* setup and start work to load firmware */
5753 	INIT_WORK(&wl->firmware_load, b43_request_firmware);
5754 	schedule_work(&wl->firmware_load);
5755 
5756 	return err;
5757 
5758 err_ssb_wireless_exit:
5759 	b43_wireless_exit(dev, wl);
5760 err_ssb_kfree_dev:
5761 	kfree(dev);
5762 	return err;
5763 }
5764 
5765 static void b43_ssb_remove(struct ssb_device *sdev)
5766 {
5767 	struct b43_wl *wl = ssb_get_devtypedata(sdev);
5768 	struct b43_wldev *wldev = ssb_get_drvdata(sdev);
5769 	struct b43_bus_dev *dev = wldev->dev;
5770 
5771 	/* We must cancel any work here before unregistering from ieee80211,
5772 	 * as the ieee80211 unreg will destroy the workqueue. */
5773 	cancel_work_sync(&wldev->restart_work);
5774 	cancel_work_sync(&wl->firmware_load);
5775 
5776 	B43_WARN_ON(!wl);
5777 	if (!wldev->fw.ucode.data)
5778 		return;			/* NULL if firmware never loaded */
5779 	if (wl->current_dev == wldev && wl->hw_registred) {
5780 		b43_leds_stop(wldev);
5781 		ieee80211_unregister_hw(wl->hw);
5782 	}
5783 
5784 	b43_one_core_detach(dev);
5785 
5786 	/* Unregister HW RNG driver */
5787 	b43_rng_exit(wl);
5788 
5789 	b43_leds_unregister(wl);
5790 	b43_wireless_exit(dev, wl);
5791 	kfree(dev);
5792 }
5793 
5794 static struct ssb_driver b43_ssb_driver = {
5795 	.name		= KBUILD_MODNAME,
5796 	.id_table	= b43_ssb_tbl,
5797 	.probe		= b43_ssb_probe,
5798 	.remove		= b43_ssb_remove,
5799 };
5800 #endif /* CONFIG_B43_SSB */
5801 
5802 /* Perform a hardware reset. This can be called from any context. */
5803 void b43_controller_restart(struct b43_wldev *dev, const char *reason)
5804 {
5805 	/* Must avoid requeueing, if we are in shutdown. */
5806 	if (b43_status(dev) < B43_STAT_INITIALIZED)
5807 		return;
5808 	b43info(dev->wl, "Controller RESET (%s) ...\n", reason);
5809 	ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
5810 }
5811 
5812 static void b43_print_driverinfo(void)
5813 {
5814 	const char *feat_pci = "", *feat_pcmcia = "", *feat_nphy = "",
5815 		   *feat_leds = "", *feat_sdio = "";
5816 
5817 #ifdef CONFIG_B43_PCI_AUTOSELECT
5818 	feat_pci = "P";
5819 #endif
5820 #ifdef CONFIG_B43_PCMCIA
5821 	feat_pcmcia = "M";
5822 #endif
5823 #ifdef CONFIG_B43_PHY_N
5824 	feat_nphy = "N";
5825 #endif
5826 #ifdef CONFIG_B43_LEDS
5827 	feat_leds = "L";
5828 #endif
5829 #ifdef CONFIG_B43_SDIO
5830 	feat_sdio = "S";
5831 #endif
5832 	printk(KERN_INFO "Broadcom 43xx driver loaded "
5833 	       "[ Features: %s%s%s%s%s ]\n",
5834 	       feat_pci, feat_pcmcia, feat_nphy,
5835 	       feat_leds, feat_sdio);
5836 }
5837 
5838 static int __init b43_init(void)
5839 {
5840 	int err;
5841 
5842 	b43_debugfs_init();
5843 	err = b43_sdio_init();
5844 	if (err)
5845 		goto err_dfs_exit;
5846 #ifdef CONFIG_B43_BCMA
5847 	err = bcma_driver_register(&b43_bcma_driver);
5848 	if (err)
5849 		goto err_sdio_exit;
5850 #endif
5851 #ifdef CONFIG_B43_SSB
5852 	err = ssb_driver_register(&b43_ssb_driver);
5853 	if (err)
5854 		goto err_bcma_driver_exit;
5855 #endif
5856 	b43_print_driverinfo();
5857 
5858 	return err;
5859 
5860 #ifdef CONFIG_B43_SSB
5861 err_bcma_driver_exit:
5862 #endif
5863 #ifdef CONFIG_B43_BCMA
5864 	bcma_driver_unregister(&b43_bcma_driver);
5865 err_sdio_exit:
5866 #endif
5867 	b43_sdio_exit();
5868 err_dfs_exit:
5869 	b43_debugfs_exit();
5870 	return err;
5871 }
5872 
5873 static void __exit b43_exit(void)
5874 {
5875 #ifdef CONFIG_B43_SSB
5876 	ssb_driver_unregister(&b43_ssb_driver);
5877 #endif
5878 #ifdef CONFIG_B43_BCMA
5879 	bcma_driver_unregister(&b43_bcma_driver);
5880 #endif
5881 	b43_sdio_exit();
5882 	b43_debugfs_exit();
5883 }
5884 
5885 module_init(b43_init)
5886 module_exit(b43_exit)
5887