broadcom/b43legacy/main.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  *
0004  *  Broadcom B43legacy wireless driver
0005  *
0006  *  Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
0007  *  Copyright (c) 2005-2008 Stefano Brivio <stefano.brivio@polimi.it>
0008  *  Copyright (c) 2005, 2006 Michael Buesch <m@bues.ch>
0009  *  Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
0010  *  Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
0011  *  Copyright (c) 2007 Larry Finger <Larry.Finger@lwfinger.net>
0012  *
0013  *  Some parts of the code in this file are derived from the ipw2200
0014  *  driver  Copyright(c) 2003 - 2004 Intel Corporation.
0015
0016  */
0017
0018 #include <linux/delay.h>
0019 #include <linux/init.h>
0020 #include <linux/module.h>
0021 #include <linux/if_arp.h>
0022 #include <linux/etherdevice.h>
0023 #include <linux/firmware.h>
0024 #include <linux/workqueue.h>
0025 #include <linux/sched/signal.h>
0026 #include <linux/skbuff.h>
0027 #include <linux/dma-mapping.h>
0028 #include <linux/slab.h>
0029 #include <net/dst.h>
0030 #include <asm/unaligned.h>
0031
0032 #include "b43legacy.h"
0033 #include "main.h"
0034 #include "debugfs.h"
0035 #include "phy.h"
0036 #include "dma.h"
0037 #include "pio.h"
0038 #include "sysfs.h"
0039 #include "xmit.h"
0040 #include "radio.h"
0041
0042
0043 MODULE_DESCRIPTION("Broadcom B43legacy wireless driver");
0044 MODULE_AUTHOR("Martin Langer");
0045 MODULE_AUTHOR("Stefano Brivio");
0046 MODULE_AUTHOR("Michael Buesch");
0047 MODULE_LICENSE("GPL");
0048
0049 MODULE_FIRMWARE("b43legacy/ucode2.fw");
0050 MODULE_FIRMWARE("b43legacy/ucode4.fw");
0051
0052 #if defined(CONFIG_B43LEGACY_DMA) && defined(CONFIG_B43LEGACY_PIO)
0053 static int modparam_pio;
0054 module_param_named(pio, modparam_pio, int, 0444);
0055 MODULE_PARM_DESC(pio, "enable(1) / disable(0) PIO mode");
0056 #elif defined(CONFIG_B43LEGACY_DMA)
0057 # define modparam_pio   0
0058 #elif defined(CONFIG_B43LEGACY_PIO)
0059 # define modparam_pio   1
0060 #endif
0061
0062 static int modparam_bad_frames_preempt;
0063 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
0064 MODULE_PARM_DESC(bad_frames_preempt, "enable(1) / disable(0) Bad Frames"
0065          " Preemption");
0066
0067 static char modparam_fwpostfix[16];
0068 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
0069 MODULE_PARM_DESC(fwpostfix, "Postfix for the firmware files to load.");
0070
0071 /* The following table supports BCM4301, BCM4303 and BCM4306/2 devices. */
0072 static const struct ssb_device_id b43legacy_ssb_tbl[] = {
0073     SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 2),
0074     SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 4),
0075     {},
0076 };
0077 MODULE_DEVICE_TABLE(ssb, b43legacy_ssb_tbl);
0078
0079
0080 /* Channel and ratetables are shared for all devices.
0081  * They can't be const, because ieee80211 puts some precalculated
0082  * data in there. This data is the same for all devices, so we don't
0083  * get concurrency issues */
0084 #define RATETAB_ENT(_rateid, _flags) \
0085     {                               \
0086         .bitrate    = B43legacy_RATE_TO_100KBPS(_rateid),   \
0087         .hw_value   = (_rateid),                \
0088         .flags      = (_flags),             \
0089     }
0090 /*
0091  * NOTE: When changing this, sync with xmit.c's
0092  *   b43legacy_plcp_get_bitrate_idx_* functions!
0093  */
0094 static struct ieee80211_rate __b43legacy_ratetable[] = {
0095     RATETAB_ENT(B43legacy_CCK_RATE_1MB, 0),
0096     RATETAB_ENT(B43legacy_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
0097     RATETAB_ENT(B43legacy_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
0098     RATETAB_ENT(B43legacy_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
0099     RATETAB_ENT(B43legacy_OFDM_RATE_6MB, 0),
0100     RATETAB_ENT(B43legacy_OFDM_RATE_9MB, 0),
0101     RATETAB_ENT(B43legacy_OFDM_RATE_12MB, 0),
0102     RATETAB_ENT(B43legacy_OFDM_RATE_18MB, 0),
0103     RATETAB_ENT(B43legacy_OFDM_RATE_24MB, 0),
0104     RATETAB_ENT(B43legacy_OFDM_RATE_36MB, 0),
0105     RATETAB_ENT(B43legacy_OFDM_RATE_48MB, 0),
0106     RATETAB_ENT(B43legacy_OFDM_RATE_54MB, 0),
0107 };
0108 #define b43legacy_b_ratetable       (__b43legacy_ratetable + 0)
0109 #define b43legacy_b_ratetable_size  4
0110 #define b43legacy_g_ratetable       (__b43legacy_ratetable + 0)
0111 #define b43legacy_g_ratetable_size  12
0112
0113 #define CHANTAB_ENT(_chanid, _freq) \
0114     {                           \
0115         .center_freq    = (_freq),          \
0116         .hw_value   = (_chanid),            \
0117     }
0118 static struct ieee80211_channel b43legacy_bg_chantable[] = {
0119     CHANTAB_ENT(1, 2412),
0120     CHANTAB_ENT(2, 2417),
0121     CHANTAB_ENT(3, 2422),
0122     CHANTAB_ENT(4, 2427),
0123     CHANTAB_ENT(5, 2432),
0124     CHANTAB_ENT(6, 2437),
0125     CHANTAB_ENT(7, 2442),
0126     CHANTAB_ENT(8, 2447),
0127     CHANTAB_ENT(9, 2452),
0128     CHANTAB_ENT(10, 2457),
0129     CHANTAB_ENT(11, 2462),
0130     CHANTAB_ENT(12, 2467),
0131     CHANTAB_ENT(13, 2472),
0132     CHANTAB_ENT(14, 2484),
0133 };
0134
0135 static struct ieee80211_supported_band b43legacy_band_2GHz_BPHY = {
0136     .channels = b43legacy_bg_chantable,
0137     .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
0138     .bitrates = b43legacy_b_ratetable,
0139     .n_bitrates = b43legacy_b_ratetable_size,
0140 };
0141
0142 static struct ieee80211_supported_band b43legacy_band_2GHz_GPHY = {
0143     .channels = b43legacy_bg_chantable,
0144     .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
0145     .bitrates = b43legacy_g_ratetable,
0146     .n_bitrates = b43legacy_g_ratetable_size,
0147 };
0148
0149 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev);
0150 static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev);
0151 static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev);
0152 static int b43legacy_wireless_core_start(struct b43legacy_wldev *dev);
0153
0154
0155 static int b43legacy_ratelimit(struct b43legacy_wl *wl)
0156 {
0157     if (!wl || !wl->current_dev)
0158         return 1;
0159     if (b43legacy_status(wl->current_dev) < B43legacy_STAT_STARTED)
0160         return 1;
0161     /* We are up and running.
0162      * Ratelimit the messages to avoid DoS over the net. */
0163     return net_ratelimit();
0164 }
0165
0166 void b43legacyinfo(struct b43legacy_wl *wl, const char *fmt, ...)
0167 {
0168     struct va_format vaf;
0169     va_list args;
0170
0171     if (!b43legacy_ratelimit(wl))
0172         return;
0173
0174     va_start(args, fmt);
0175
0176     vaf.fmt = fmt;
0177     vaf.va = &args;
0178
0179     printk(KERN_INFO "b43legacy-%s: %pV",
0180            (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
0181
0182     va_end(args);
0183 }
0184
0185 void b43legacyerr(struct b43legacy_wl *wl, const char *fmt, ...)
0186 {
0187     struct va_format vaf;
0188     va_list args;
0189
0190     if (!b43legacy_ratelimit(wl))
0191         return;
0192
0193     va_start(args, fmt);
0194
0195     vaf.fmt = fmt;
0196     vaf.va = &args;
0197
0198     printk(KERN_ERR "b43legacy-%s ERROR: %pV",
0199            (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
0200
0201     va_end(args);
0202 }
0203
0204 void b43legacywarn(struct b43legacy_wl *wl, const char *fmt, ...)
0205 {
0206     struct va_format vaf;
0207     va_list args;
0208
0209     if (!b43legacy_ratelimit(wl))
0210         return;
0211
0212     va_start(args, fmt);
0213
0214     vaf.fmt = fmt;
0215     vaf.va = &args;
0216
0217     printk(KERN_WARNING "b43legacy-%s warning: %pV",
0218            (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
0219
0220     va_end(args);
0221 }
0222
0223 #if B43legacy_DEBUG
0224 void b43legacydbg(struct b43legacy_wl *wl, const char *fmt, ...)
0225 {
0226     struct va_format vaf;
0227     va_list args;
0228
0229     va_start(args, fmt);
0230
0231     vaf.fmt = fmt;
0232     vaf.va = &args;
0233
0234     printk(KERN_DEBUG "b43legacy-%s debug: %pV",
0235            (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
0236
0237     va_end(args);
0238 }
0239 #endif /* DEBUG */
0240
0241 static void b43legacy_ram_write(struct b43legacy_wldev *dev, u16 offset,
0242                 u32 val)
0243 {
0244     u32 status;
0245
0246     B43legacy_WARN_ON(offset % 4 != 0);
0247
0248     status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
0249     if (status & B43legacy_MACCTL_BE)
0250         val = swab32(val);
0251
0252     b43legacy_write32(dev, B43legacy_MMIO_RAM_CONTROL, offset);
0253     b43legacy_write32(dev, B43legacy_MMIO_RAM_DATA, val);
0254 }
0255
0256 static inline
0257 void b43legacy_shm_control_word(struct b43legacy_wldev *dev,
0258                 u16 routing, u16 offset)
0259 {
0260     u32 control;
0261
0262     /* "offset" is the WORD offset. */
0263
0264     control = routing;
0265     control <<= 16;
0266     control |= offset;
0267     b43legacy_write32(dev, B43legacy_MMIO_SHM_CONTROL, control);
0268 }
0269
0270 u32 b43legacy_shm_read32(struct b43legacy_wldev *dev,
0271                u16 routing, u16 offset)
0272 {
0273     u32 ret;
0274
0275     if (routing == B43legacy_SHM_SHARED) {
0276         B43legacy_WARN_ON((offset & 0x0001) != 0);
0277         if (offset & 0x0003) {
0278             /* Unaligned access */
0279             b43legacy_shm_control_word(dev, routing, offset >> 2);
0280             ret = b43legacy_read16(dev,
0281                 B43legacy_MMIO_SHM_DATA_UNALIGNED);
0282             ret <<= 16;
0283             b43legacy_shm_control_word(dev, routing,
0284                              (offset >> 2) + 1);
0285             ret |= b43legacy_read16(dev, B43legacy_MMIO_SHM_DATA);
0286
0287             return ret;
0288         }
0289         offset >>= 2;
0290     }
0291     b43legacy_shm_control_word(dev, routing, offset);
0292     ret = b43legacy_read32(dev, B43legacy_MMIO_SHM_DATA);
0293
0294     return ret;
0295 }
0296
0297 u16 b43legacy_shm_read16(struct b43legacy_wldev *dev,
0298                u16 routing, u16 offset)
0299 {
0300     u16 ret;
0301
0302     if (routing == B43legacy_SHM_SHARED) {
0303         B43legacy_WARN_ON((offset & 0x0001) != 0);
0304         if (offset & 0x0003) {
0305             /* Unaligned access */
0306             b43legacy_shm_control_word(dev, routing, offset >> 2);
0307             ret = b43legacy_read16(dev,
0308                          B43legacy_MMIO_SHM_DATA_UNALIGNED);
0309
0310             return ret;
0311         }
0312         offset >>= 2;
0313     }
0314     b43legacy_shm_control_word(dev, routing, offset);
0315     ret = b43legacy_read16(dev, B43legacy_MMIO_SHM_DATA);
0316
0317     return ret;
0318 }
0319
0320 void b43legacy_shm_write32(struct b43legacy_wldev *dev,
0321                u16 routing, u16 offset,
0322                u32 value)
0323 {
0324     if (routing == B43legacy_SHM_SHARED) {
0325         B43legacy_WARN_ON((offset & 0x0001) != 0);
0326         if (offset & 0x0003) {
0327             /* Unaligned access */
0328             b43legacy_shm_control_word(dev, routing, offset >> 2);
0329             b43legacy_write16(dev,
0330                       B43legacy_MMIO_SHM_DATA_UNALIGNED,
0331                       (value >> 16) & 0xffff);
0332             b43legacy_shm_control_word(dev, routing,
0333                            (offset >> 2) + 1);
0334             b43legacy_write16(dev, B43legacy_MMIO_SHM_DATA,
0335                       value & 0xffff);
0336             return;
0337         }
0338         offset >>= 2;
0339     }
0340     b43legacy_shm_control_word(dev, routing, offset);
0341     b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA, value);
0342 }
0343
0344 void b43legacy_shm_write16(struct b43legacy_wldev *dev, u16 routing, u16 offset,
0345                u16 value)
0346 {
0347     if (routing == B43legacy_SHM_SHARED) {
0348         B43legacy_WARN_ON((offset & 0x0001) != 0);
0349         if (offset & 0x0003) {
0350             /* Unaligned access */
0351             b43legacy_shm_control_word(dev, routing, offset >> 2);
0352             b43legacy_write16(dev,
0353                       B43legacy_MMIO_SHM_DATA_UNALIGNED,
0354                       value);
0355             return;
0356         }
0357         offset >>= 2;
0358     }
0359     b43legacy_shm_control_word(dev, routing, offset);
0360     b43legacy_write16(dev, B43legacy_MMIO_SHM_DATA, value);
0361 }
0362
0363 /* Read HostFlags */
0364 u32 b43legacy_hf_read(struct b43legacy_wldev *dev)
0365 {
0366     u32 ret;
0367
0368     ret = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
0369                    B43legacy_SHM_SH_HOSTFHI);
0370     ret <<= 16;
0371     ret |= b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
0372                     B43legacy_SHM_SH_HOSTFLO);
0373
0374     return ret;
0375 }
0376
0377 /* Write HostFlags */
0378 void b43legacy_hf_write(struct b43legacy_wldev *dev, u32 value)
0379 {
0380     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
0381                   B43legacy_SHM_SH_HOSTFLO,
0382                   (value & 0x0000FFFF));
0383     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
0384                   B43legacy_SHM_SH_HOSTFHI,
0385                   ((value & 0xFFFF0000) >> 16));
0386 }
0387
0388 void b43legacy_tsf_read(struct b43legacy_wldev *dev, u64 *tsf)
0389 {
0390     /* We need to be careful. As we read the TSF from multiple
0391      * registers, we should take care of register overflows.
0392      * In theory, the whole tsf read process should be atomic.
0393      * We try to be atomic here, by restaring the read process,
0394      * if any of the high registers changed (overflowed).
0395      */
0396     if (dev->dev->id.revision >= 3) {
0397         u32 low;
0398         u32 high;
0399         u32 high2;
0400
0401         do {
0402             high = b43legacy_read32(dev,
0403                     B43legacy_MMIO_REV3PLUS_TSF_HIGH);
0404             low = b43legacy_read32(dev,
0405                     B43legacy_MMIO_REV3PLUS_TSF_LOW);
0406             high2 = b43legacy_read32(dev,
0407                     B43legacy_MMIO_REV3PLUS_TSF_HIGH);
0408         } while (unlikely(high != high2));
0409
0410         *tsf = high;
0411         *tsf <<= 32;
0412         *tsf |= low;
0413     } else {
0414         u64 tmp;
0415         u16 v0;
0416         u16 v1;
0417         u16 v2;
0418         u16 v3;
0419         u16 test1;
0420         u16 test2;
0421         u16 test3;
0422
0423         do {
0424             v3 = b43legacy_read16(dev, B43legacy_MMIO_TSF_3);
0425             v2 = b43legacy_read16(dev, B43legacy_MMIO_TSF_2);
0426             v1 = b43legacy_read16(dev, B43legacy_MMIO_TSF_1);
0427             v0 = b43legacy_read16(dev, B43legacy_MMIO_TSF_0);
0428
0429             test3 = b43legacy_read16(dev, B43legacy_MMIO_TSF_3);
0430             test2 = b43legacy_read16(dev, B43legacy_MMIO_TSF_2);
0431             test1 = b43legacy_read16(dev, B43legacy_MMIO_TSF_1);
0432         } while (v3 != test3 || v2 != test2 || v1 != test1);
0433
0434         *tsf = v3;
0435         *tsf <<= 48;
0436         tmp = v2;
0437         tmp <<= 32;
0438         *tsf |= tmp;
0439         tmp = v1;
0440         tmp <<= 16;
0441         *tsf |= tmp;
0442         *tsf |= v0;
0443     }
0444 }
0445
0446 static void b43legacy_time_lock(struct b43legacy_wldev *dev)
0447 {
0448     u32 status;
0449
0450     status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
0451     status |= B43legacy_MACCTL_TBTTHOLD;
0452     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, status);
0453 }
0454
0455 static void b43legacy_time_unlock(struct b43legacy_wldev *dev)
0456 {
0457     u32 status;
0458
0459     status = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
0460     status &= ~B43legacy_MACCTL_TBTTHOLD;
0461     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, status);
0462 }
0463
0464 static void b43legacy_tsf_write_locked(struct b43legacy_wldev *dev, u64 tsf)
0465 {
0466     /* Be careful with the in-progress timer.
0467      * First zero out the low register, so we have a full
0468      * register-overflow duration to complete the operation.
0469      */
0470     if (dev->dev->id.revision >= 3) {
0471         u32 lo = (tsf & 0x00000000FFFFFFFFULL);
0472         u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
0473
0474         b43legacy_write32(dev, B43legacy_MMIO_REV3PLUS_TSF_LOW, 0);
0475         b43legacy_write32(dev, B43legacy_MMIO_REV3PLUS_TSF_HIGH,
0476                     hi);
0477         b43legacy_write32(dev, B43legacy_MMIO_REV3PLUS_TSF_LOW,
0478                     lo);
0479     } else {
0480         u16 v0 = (tsf & 0x000000000000FFFFULL);
0481         u16 v1 = (tsf & 0x00000000FFFF0000ULL) >> 16;
0482         u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
0483         u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
0484
0485         b43legacy_write16(dev, B43legacy_MMIO_TSF_0, 0);
0486         b43legacy_write16(dev, B43legacy_MMIO_TSF_3, v3);
0487         b43legacy_write16(dev, B43legacy_MMIO_TSF_2, v2);
0488         b43legacy_write16(dev, B43legacy_MMIO_TSF_1, v1);
0489         b43legacy_write16(dev, B43legacy_MMIO_TSF_0, v0);
0490     }
0491 }
0492
0493 void b43legacy_tsf_write(struct b43legacy_wldev *dev, u64 tsf)
0494 {
0495     b43legacy_time_lock(dev);
0496     b43legacy_tsf_write_locked(dev, tsf);
0497     b43legacy_time_unlock(dev);
0498 }
0499
0500 static
0501 void b43legacy_macfilter_set(struct b43legacy_wldev *dev,
0502                  u16 offset, const u8 *mac)
0503 {
0504     static const u8 zero_addr[ETH_ALEN] = { 0 };
0505     u16 data;
0506
0507     if (!mac)
0508         mac = zero_addr;
0509
0510     offset |= 0x0020;
0511     b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_CONTROL, offset);
0512
0513     data = mac[0];
0514     data |= mac[1] << 8;
0515     b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_DATA, data);
0516     data = mac[2];
0517     data |= mac[3] << 8;
0518     b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_DATA, data);
0519     data = mac[4];
0520     data |= mac[5] << 8;
0521     b43legacy_write16(dev, B43legacy_MMIO_MACFILTER_DATA, data);
0522 }
0523
0524 static void b43legacy_write_mac_bssid_templates(struct b43legacy_wldev *dev)
0525 {
0526     static const u8 zero_addr[ETH_ALEN] = { 0 };
0527     const u8 *mac = dev->wl->mac_addr;
0528     const u8 *bssid = dev->wl->bssid;
0529     u8 mac_bssid[ETH_ALEN * 2];
0530     int i;
0531     u32 tmp;
0532
0533     if (!bssid)
0534         bssid = zero_addr;
0535     if (!mac)
0536         mac = zero_addr;
0537
0538     b43legacy_macfilter_set(dev, B43legacy_MACFILTER_BSSID, bssid);
0539
0540     memcpy(mac_bssid, mac, ETH_ALEN);
0541     memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
0542
0543     /* Write our MAC address and BSSID to template ram */
0544     for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
0545         tmp =  (u32)(mac_bssid[i + 0]);
0546         tmp |= (u32)(mac_bssid[i + 1]) << 8;
0547         tmp |= (u32)(mac_bssid[i + 2]) << 16;
0548         tmp |= (u32)(mac_bssid[i + 3]) << 24;
0549         b43legacy_ram_write(dev, 0x20 + i, tmp);
0550         b43legacy_ram_write(dev, 0x78 + i, tmp);
0551         b43legacy_ram_write(dev, 0x478 + i, tmp);
0552     }
0553 }
0554
0555 static void b43legacy_upload_card_macaddress(struct b43legacy_wldev *dev)
0556 {
0557     b43legacy_write_mac_bssid_templates(dev);
0558     b43legacy_macfilter_set(dev, B43legacy_MACFILTER_SELF,
0559                 dev->wl->mac_addr);
0560 }
0561
0562 static void b43legacy_set_slot_time(struct b43legacy_wldev *dev,
0563                     u16 slot_time)
0564 {
0565     /* slot_time is in usec. */
0566     if (dev->phy.type != B43legacy_PHYTYPE_G)
0567         return;
0568     b43legacy_write16(dev, 0x684, 510 + slot_time);
0569     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0010,
0570                   slot_time);
0571 }
0572
0573 static void b43legacy_short_slot_timing_enable(struct b43legacy_wldev *dev)
0574 {
0575     b43legacy_set_slot_time(dev, 9);
0576 }
0577
0578 static void b43legacy_short_slot_timing_disable(struct b43legacy_wldev *dev)
0579 {
0580     b43legacy_set_slot_time(dev, 20);
0581 }
0582
0583 /* Synchronize IRQ top- and bottom-half.
0584  * IRQs must be masked before calling this.
0585  * This must not be called with the irq_lock held.
0586  */
0587 static void b43legacy_synchronize_irq(struct b43legacy_wldev *dev)
0588 {
0589     synchronize_irq(dev->dev->irq);
0590     tasklet_kill(&dev->isr_tasklet);
0591 }
0592
0593 /* DummyTransmission function, as documented on
0594  * https://bcm-specs.sipsolutions.net/DummyTransmission
0595  */
0596 void b43legacy_dummy_transmission(struct b43legacy_wldev *dev)
0597 {
0598     struct b43legacy_phy *phy = &dev->phy;
0599     unsigned int i;
0600     unsigned int max_loop;
0601     u16 value;
0602     u32 buffer[5] = {
0603         0x00000000,
0604         0x00D40000,
0605         0x00000000,
0606         0x01000000,
0607         0x00000000,
0608     };
0609
0610     switch (phy->type) {
0611     case B43legacy_PHYTYPE_B:
0612     case B43legacy_PHYTYPE_G:
0613         max_loop = 0xFA;
0614         buffer[0] = 0x000B846E;
0615         break;
0616     default:
0617         B43legacy_BUG_ON(1);
0618         return;
0619     }
0620
0621     for (i = 0; i < 5; i++)
0622         b43legacy_ram_write(dev, i * 4, buffer[i]);
0623
0624     /* dummy read follows */
0625     b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
0626
0627     b43legacy_write16(dev, 0x0568, 0x0000);
0628     b43legacy_write16(dev, 0x07C0, 0x0000);
0629     b43legacy_write16(dev, 0x050C, 0x0000);
0630     b43legacy_write16(dev, 0x0508, 0x0000);
0631     b43legacy_write16(dev, 0x050A, 0x0000);
0632     b43legacy_write16(dev, 0x054C, 0x0000);
0633     b43legacy_write16(dev, 0x056A, 0x0014);
0634     b43legacy_write16(dev, 0x0568, 0x0826);
0635     b43legacy_write16(dev, 0x0500, 0x0000);
0636     b43legacy_write16(dev, 0x0502, 0x0030);
0637
0638     if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
0639         b43legacy_radio_write16(dev, 0x0051, 0x0017);
0640     for (i = 0x00; i < max_loop; i++) {
0641         value = b43legacy_read16(dev, 0x050E);
0642         if (value & 0x0080)
0643             break;
0644         udelay(10);
0645     }
0646     for (i = 0x00; i < 0x0A; i++) {
0647         value = b43legacy_read16(dev, 0x050E);
0648         if (value & 0x0400)
0649             break;
0650         udelay(10);
0651     }
0652     for (i = 0x00; i < 0x0A; i++) {
0653         value = b43legacy_read16(dev, 0x0690);
0654         if (!(value & 0x0100))
0655             break;
0656         udelay(10);
0657     }
0658     if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
0659         b43legacy_radio_write16(dev, 0x0051, 0x0037);
0660 }
0661
0662 /* Turn the Analog ON/OFF */
0663 static void b43legacy_switch_analog(struct b43legacy_wldev *dev, int on)
0664 {
0665     b43legacy_write16(dev, B43legacy_MMIO_PHY0, on ? 0 : 0xF4);
0666 }
0667
0668 void b43legacy_wireless_core_reset(struct b43legacy_wldev *dev, u32 flags)
0669 {
0670     u32 tmslow;
0671     u32 macctl;
0672
0673     flags |= B43legacy_TMSLOW_PHYCLKEN;
0674     flags |= B43legacy_TMSLOW_PHYRESET;
0675     ssb_device_enable(dev->dev, flags);
0676     msleep(2); /* Wait for the PLL to turn on. */
0677
0678     /* Now take the PHY out of Reset again */
0679     tmslow = ssb_read32(dev->dev, SSB_TMSLOW);
0680     tmslow |= SSB_TMSLOW_FGC;
0681     tmslow &= ~B43legacy_TMSLOW_PHYRESET;
0682     ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
0683     ssb_read32(dev->dev, SSB_TMSLOW); /* flush */
0684     msleep(1);
0685     tmslow &= ~SSB_TMSLOW_FGC;
0686     ssb_write32(dev->dev, SSB_TMSLOW, tmslow);
0687     ssb_read32(dev->dev, SSB_TMSLOW); /* flush */
0688     msleep(1);
0689
0690     /* Turn Analog ON */
0691     b43legacy_switch_analog(dev, 1);
0692
0693     macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
0694     macctl &= ~B43legacy_MACCTL_GMODE;
0695     if (flags & B43legacy_TMSLOW_GMODE) {
0696         macctl |= B43legacy_MACCTL_GMODE;
0697         dev->phy.gmode = true;
0698     } else
0699         dev->phy.gmode = false;
0700     macctl |= B43legacy_MACCTL_IHR_ENABLED;
0701     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
0702 }
0703
0704 static void handle_irq_transmit_status(struct b43legacy_wldev *dev)
0705 {
0706     u32 v0;
0707     u32 v1;
0708     u16 tmp;
0709     struct b43legacy_txstatus stat;
0710
0711     while (1) {
0712         v0 = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_0);
0713         if (!(v0 & 0x00000001))
0714             break;
0715         v1 = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_1);
0716
0717         stat.cookie = (v0 >> 16);
0718         stat.seq = (v1 & 0x0000FFFF);
0719         stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
0720         tmp = (v0 & 0x0000FFFF);
0721         stat.frame_count = ((tmp & 0xF000) >> 12);
0722         stat.rts_count = ((tmp & 0x0F00) >> 8);
0723         stat.supp_reason = ((tmp & 0x001C) >> 2);
0724         stat.pm_indicated = !!(tmp & 0x0080);
0725         stat.intermediate = !!(tmp & 0x0040);
0726         stat.for_ampdu = !!(tmp & 0x0020);
0727         stat.acked = !!(tmp & 0x0002);
0728
0729         b43legacy_handle_txstatus(dev, &stat);
0730     }
0731 }
0732
0733 static void drain_txstatus_queue(struct b43legacy_wldev *dev)
0734 {
0735     u32 dummy;
0736
0737     if (dev->dev->id.revision < 5)
0738         return;
0739     /* Read all entries from the microcode TXstatus FIFO
0740      * and throw them away.
0741      */
0742     while (1) {
0743         dummy = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_0);
0744         if (!(dummy & 0x00000001))
0745             break;
0746         dummy = b43legacy_read32(dev, B43legacy_MMIO_XMITSTAT_1);
0747     }
0748 }
0749
0750 static u32 b43legacy_jssi_read(struct b43legacy_wldev *dev)
0751 {
0752     u32 val = 0;
0753
0754     val = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED, 0x40A);
0755     val <<= 16;
0756     val |= b43legacy_shm_read16(dev, B43legacy_SHM_SHARED, 0x408);
0757
0758     return val;
0759 }
0760
0761 static void b43legacy_jssi_write(struct b43legacy_wldev *dev, u32 jssi)
0762 {
0763     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x408,
0764                   (jssi & 0x0000FFFF));
0765     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x40A,
0766                   (jssi & 0xFFFF0000) >> 16);
0767 }
0768
0769 static void b43legacy_generate_noise_sample(struct b43legacy_wldev *dev)
0770 {
0771     b43legacy_jssi_write(dev, 0x7F7F7F7F);
0772     b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
0773               b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
0774               | B43legacy_MACCMD_BGNOISE);
0775     B43legacy_WARN_ON(dev->noisecalc.channel_at_start !=
0776                 dev->phy.channel);
0777 }
0778
0779 static void b43legacy_calculate_link_quality(struct b43legacy_wldev *dev)
0780 {
0781     /* Top half of Link Quality calculation. */
0782
0783     if (dev->noisecalc.calculation_running)
0784         return;
0785     dev->noisecalc.channel_at_start = dev->phy.channel;
0786     dev->noisecalc.calculation_running = true;
0787     dev->noisecalc.nr_samples = 0;
0788
0789     b43legacy_generate_noise_sample(dev);
0790 }
0791
0792 static void handle_irq_noise(struct b43legacy_wldev *dev)
0793 {
0794     struct b43legacy_phy *phy = &dev->phy;
0795     u16 tmp;
0796     u8 noise[4];
0797     u8 i;
0798     u8 j;
0799     s32 average;
0800
0801     /* Bottom half of Link Quality calculation. */
0802
0803     B43legacy_WARN_ON(!dev->noisecalc.calculation_running);
0804     if (dev->noisecalc.channel_at_start != phy->channel)
0805         goto drop_calculation;
0806     *((__le32 *)noise) = cpu_to_le32(b43legacy_jssi_read(dev));
0807     if (noise[0] == 0x7F || noise[1] == 0x7F ||
0808         noise[2] == 0x7F || noise[3] == 0x7F)
0809         goto generate_new;
0810
0811     /* Get the noise samples. */
0812     B43legacy_WARN_ON(dev->noisecalc.nr_samples >= 8);
0813     i = dev->noisecalc.nr_samples;
0814     noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
0815     noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
0816     noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
0817     noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
0818     dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
0819     dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
0820     dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
0821     dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
0822     dev->noisecalc.nr_samples++;
0823     if (dev->noisecalc.nr_samples == 8) {
0824         /* Calculate the Link Quality by the noise samples. */
0825         average = 0;
0826         for (i = 0; i < 8; i++) {
0827             for (j = 0; j < 4; j++)
0828                 average += dev->noisecalc.samples[i][j];
0829         }
0830         average /= (8 * 4);
0831         average *= 125;
0832         average += 64;
0833         average /= 128;
0834         tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
0835                          0x40C);
0836         tmp = (tmp / 128) & 0x1F;
0837         if (tmp >= 8)
0838             average += 2;
0839         else
0840             average -= 25;
0841         if (tmp == 8)
0842             average -= 72;
0843         else
0844             average -= 48;
0845
0846         dev->stats.link_noise = average;
0847 drop_calculation:
0848         dev->noisecalc.calculation_running = false;
0849         return;
0850     }
0851 generate_new:
0852     b43legacy_generate_noise_sample(dev);
0853 }
0854
0855 static void handle_irq_tbtt_indication(struct b43legacy_wldev *dev)
0856 {
0857     if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
0858         /* TODO: PS TBTT */
0859     } else {
0860         if (1/*FIXME: the last PSpoll frame was sent successfully */)
0861             b43legacy_power_saving_ctl_bits(dev, -1, -1);
0862     }
0863     if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
0864         dev->dfq_valid = true;
0865 }
0866
0867 static void handle_irq_atim_end(struct b43legacy_wldev *dev)
0868 {
0869     if (dev->dfq_valid) {
0870         b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
0871                   b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
0872                   | B43legacy_MACCMD_DFQ_VALID);
0873         dev->dfq_valid = false;
0874     }
0875 }
0876
0877 static void handle_irq_pmq(struct b43legacy_wldev *dev)
0878 {
0879     u32 tmp;
0880
0881     /* TODO: AP mode. */
0882
0883     while (1) {
0884         tmp = b43legacy_read32(dev, B43legacy_MMIO_PS_STATUS);
0885         if (!(tmp & 0x00000008))
0886             break;
0887     }
0888     /* 16bit write is odd, but correct. */
0889     b43legacy_write16(dev, B43legacy_MMIO_PS_STATUS, 0x0002);
0890 }
0891
0892 static void b43legacy_write_template_common(struct b43legacy_wldev *dev,
0893                         const u8 *data, u16 size,
0894                         u16 ram_offset,
0895                         u16 shm_size_offset, u8 rate)
0896 {
0897     u32 i;
0898     u32 tmp;
0899     struct b43legacy_plcp_hdr4 plcp;
0900
0901     plcp.data = 0;
0902     b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
0903     b43legacy_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
0904     ram_offset += sizeof(u32);
0905     /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
0906      * So leave the first two bytes of the next write blank.
0907      */
0908     tmp = (u32)(data[0]) << 16;
0909     tmp |= (u32)(data[1]) << 24;
0910     b43legacy_ram_write(dev, ram_offset, tmp);
0911     ram_offset += sizeof(u32);
0912     for (i = 2; i < size; i += sizeof(u32)) {
0913         tmp = (u32)(data[i + 0]);
0914         if (i + 1 < size)
0915             tmp |= (u32)(data[i + 1]) << 8;
0916         if (i + 2 < size)
0917             tmp |= (u32)(data[i + 2]) << 16;
0918         if (i + 3 < size)
0919             tmp |= (u32)(data[i + 3]) << 24;
0920         b43legacy_ram_write(dev, ram_offset + i - 2, tmp);
0921     }
0922     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_size_offset,
0923                   size + sizeof(struct b43legacy_plcp_hdr6));
0924 }
0925
0926 /* Convert a b43legacy antenna number value to the PHY TX control value. */
0927 static u16 b43legacy_antenna_to_phyctl(int antenna)
0928 {
0929     switch (antenna) {
0930     case B43legacy_ANTENNA0:
0931         return B43legacy_TX4_PHY_ANT0;
0932     case B43legacy_ANTENNA1:
0933         return B43legacy_TX4_PHY_ANT1;
0934     }
0935     return B43legacy_TX4_PHY_ANTLAST;
0936 }
0937
0938 static void b43legacy_write_beacon_template(struct b43legacy_wldev *dev,
0939                         u16 ram_offset,
0940                         u16 shm_size_offset)
0941 {
0942
0943     unsigned int i, len, variable_len;
0944     const struct ieee80211_mgmt *bcn;
0945     const u8 *ie;
0946     bool tim_found = false;
0947     unsigned int rate;
0948     u16 ctl;
0949     int antenna;
0950     struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
0951
0952     bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
0953     len = min_t(size_t, dev->wl->current_beacon->len,
0954           0x200 - sizeof(struct b43legacy_plcp_hdr6));
0955     rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
0956
0957     b43legacy_write_template_common(dev, (const u8 *)bcn, len, ram_offset,
0958                     shm_size_offset, rate);
0959
0960     /* Write the PHY TX control parameters. */
0961     antenna = B43legacy_ANTENNA_DEFAULT;
0962     antenna = b43legacy_antenna_to_phyctl(antenna);
0963     ctl = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
0964                    B43legacy_SHM_SH_BEACPHYCTL);
0965     /* We can't send beacons with short preamble. Would get PHY errors. */
0966     ctl &= ~B43legacy_TX4_PHY_SHORTPRMBL;
0967     ctl &= ~B43legacy_TX4_PHY_ANT;
0968     ctl &= ~B43legacy_TX4_PHY_ENC;
0969     ctl |= antenna;
0970     ctl |= B43legacy_TX4_PHY_ENC_CCK;
0971     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
0972                   B43legacy_SHM_SH_BEACPHYCTL, ctl);
0973
0974     /* Find the position of the TIM and the DTIM_period value
0975      * and write them to SHM. */
0976     ie = bcn->u.beacon.variable;
0977     variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
0978     for (i = 0; i < variable_len - 2; ) {
0979         uint8_t ie_id, ie_len;
0980
0981         ie_id = ie[i];
0982         ie_len = ie[i + 1];
0983         if (ie_id == 5) {
0984             u16 tim_position;
0985             u16 dtim_period;
0986             /* This is the TIM Information Element */
0987
0988             /* Check whether the ie_len is in the beacon data range. */
0989             if (variable_len < ie_len + 2 + i)
0990                 break;
0991             /* A valid TIM is at least 4 bytes long. */
0992             if (ie_len < 4)
0993                 break;
0994             tim_found = true;
0995
0996             tim_position = sizeof(struct b43legacy_plcp_hdr6);
0997             tim_position += offsetof(struct ieee80211_mgmt,
0998                          u.beacon.variable);
0999             tim_position += i;
1000
1001             dtim_period = ie[i + 3];
1002
1003             b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
1004                     B43legacy_SHM_SH_TIMPOS, tim_position);
1005             b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
1006                     B43legacy_SHM_SH_DTIMP, dtim_period);
1007             break;
1008         }
1009         i += ie_len + 2;
1010     }
1011     if (!tim_found) {
1012         b43legacywarn(dev->wl, "Did not find a valid TIM IE in the "
1013                   "beacon template packet. AP or IBSS operation "
1014                   "may be broken.\n");
1015     } else
1016         b43legacydbg(dev->wl, "Updated beacon template\n");
1017 }
1018
1019 static void b43legacy_write_probe_resp_plcp(struct b43legacy_wldev *dev,
1020                         u16 shm_offset, u16 size,
1021                         struct ieee80211_rate *rate)
1022 {
1023     struct b43legacy_plcp_hdr4 plcp;
1024     u32 tmp;
1025     __le16 dur;
1026
1027     plcp.data = 0;
1028     b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
1029     dur = ieee80211_generic_frame_duration(dev->wl->hw,
1030                            dev->wl->vif,
1031                            NL80211_BAND_2GHZ,
1032                            size,
1033                            rate);
1034     /* Write PLCP in two parts and timing for packet transfer */
1035     tmp = le32_to_cpu(plcp.data);
1036     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset,
1037                   tmp & 0xFFFF);
1038     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset + 2,
1039                   tmp >> 16);
1040     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset + 6,
1041                   le16_to_cpu(dur));
1042 }
1043
1044 /* Instead of using custom probe response template, this function
1045  * just patches custom beacon template by:
1046  * 1) Changing packet type
1047  * 2) Patching duration field
1048  * 3) Stripping TIM
1049  */
1050 static const u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
1051                            u16 *dest_size,
1052                            struct ieee80211_rate *rate)
1053 {
1054     const u8 *src_data;
1055     u8 *dest_data;
1056     u16 src_size, elem_size, src_pos, dest_pos;
1057     __le16 dur;
1058     struct ieee80211_hdr *hdr;
1059     size_t ie_start;
1060
1061     src_size = dev->wl->current_beacon->len;
1062     src_data = (const u8 *)dev->wl->current_beacon->data;
1063
1064     /* Get the start offset of the variable IEs in the packet. */
1065     ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
1066     B43legacy_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt,
1067                            u.beacon.variable));
1068
1069     if (B43legacy_WARN_ON(src_size < ie_start))
1070         return NULL;
1071
1072     dest_data = kmalloc(src_size, GFP_ATOMIC);
1073     if (unlikely(!dest_data))
1074         return NULL;
1075
1076     /* Copy the static data and all Information Elements, except the TIM. */
1077     memcpy(dest_data, src_data, ie_start);
1078     src_pos = ie_start;
1079     dest_pos = ie_start;
1080     for ( ; src_pos < src_size - 2; src_pos += elem_size) {
1081         elem_size = src_data[src_pos + 1] + 2;
1082         if (src_data[src_pos] == 5) {
1083             /* This is the TIM. */
1084             continue;
1085         }
1086         memcpy(dest_data + dest_pos, src_data + src_pos, elem_size);
1087         dest_pos += elem_size;
1088     }
1089     *dest_size = dest_pos;
1090     hdr = (struct ieee80211_hdr *)dest_data;
1091
1092     /* Set the frame control. */
1093     hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1094                      IEEE80211_STYPE_PROBE_RESP);
1095     dur = ieee80211_generic_frame_duration(dev->wl->hw,
1096                            dev->wl->vif,
1097                            NL80211_BAND_2GHZ,
1098                            *dest_size,
1099                            rate);
1100     hdr->duration_id = dur;
1101
1102     return dest_data;
1103 }
1104
1105 static void b43legacy_write_probe_resp_template(struct b43legacy_wldev *dev,
1106                         u16 ram_offset,
1107                         u16 shm_size_offset,
1108                         struct ieee80211_rate *rate)
1109 {
1110     const u8 *probe_resp_data;
1111     u16 size;
1112
1113     size = dev->wl->current_beacon->len;
1114     probe_resp_data = b43legacy_generate_probe_resp(dev, &size, rate);
1115     if (unlikely(!probe_resp_data))
1116         return;
1117
1118     /* Looks like PLCP headers plus packet timings are stored for
1119      * all possible basic rates
1120      */
1121     b43legacy_write_probe_resp_plcp(dev, 0x31A, size,
1122                     &b43legacy_b_ratetable[0]);
1123     b43legacy_write_probe_resp_plcp(dev, 0x32C, size,
1124                     &b43legacy_b_ratetable[1]);
1125     b43legacy_write_probe_resp_plcp(dev, 0x33E, size,
1126                     &b43legacy_b_ratetable[2]);
1127     b43legacy_write_probe_resp_plcp(dev, 0x350, size,
1128                     &b43legacy_b_ratetable[3]);
1129
1130     size = min_t(size_t, size,
1131            0x200 - sizeof(struct b43legacy_plcp_hdr6));
1132     b43legacy_write_template_common(dev, probe_resp_data,
1133                     size, ram_offset,
1134                     shm_size_offset, rate->hw_value);
1135     kfree(probe_resp_data);
1136 }
1137
1138 static void b43legacy_upload_beacon0(struct b43legacy_wldev *dev)
1139 {
1140     struct b43legacy_wl *wl = dev->wl;
1141
1142     if (wl->beacon0_uploaded)
1143         return;
1144     b43legacy_write_beacon_template(dev, 0x68, 0x18);
1145     /* FIXME: Probe resp upload doesn't really belong here,
1146      *        but we don't use that feature anyway. */
1147     b43legacy_write_probe_resp_template(dev, 0x268, 0x4A,
1148                       &__b43legacy_ratetable[3]);
1149     wl->beacon0_uploaded = true;
1150 }
1151
1152 static void b43legacy_upload_beacon1(struct b43legacy_wldev *dev)
1153 {
1154     struct b43legacy_wl *wl = dev->wl;
1155
1156     if (wl->beacon1_uploaded)
1157         return;
1158     b43legacy_write_beacon_template(dev, 0x468, 0x1A);
1159     wl->beacon1_uploaded = true;
1160 }
1161
1162 static void handle_irq_beacon(struct b43legacy_wldev *dev)
1163 {
1164     struct b43legacy_wl *wl = dev->wl;
1165     u32 cmd, beacon0_valid, beacon1_valid;
1166
1167     if (!b43legacy_is_mode(wl, NL80211_IFTYPE_AP))
1168         return;
1169
1170     /* This is the bottom half of the asynchronous beacon update. */
1171
1172     /* Ignore interrupt in the future. */
1173     dev->irq_mask &= ~B43legacy_IRQ_BEACON;
1174
1175     cmd = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
1176     beacon0_valid = (cmd & B43legacy_MACCMD_BEACON0_VALID);
1177     beacon1_valid = (cmd & B43legacy_MACCMD_BEACON1_VALID);
1178
1179     /* Schedule interrupt manually, if busy. */
1180     if (beacon0_valid && beacon1_valid) {
1181         b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON, B43legacy_IRQ_BEACON);
1182         dev->irq_mask |= B43legacy_IRQ_BEACON;
1183         return;
1184     }
1185
1186     if (unlikely(wl->beacon_templates_virgin)) {
1187         /* We never uploaded a beacon before.
1188          * Upload both templates now, but only mark one valid. */
1189         wl->beacon_templates_virgin = false;
1190         b43legacy_upload_beacon0(dev);
1191         b43legacy_upload_beacon1(dev);
1192         cmd = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
1193         cmd |= B43legacy_MACCMD_BEACON0_VALID;
1194         b43legacy_write32(dev, B43legacy_MMIO_MACCMD, cmd);
1195     } else {
1196         if (!beacon0_valid) {
1197             b43legacy_upload_beacon0(dev);
1198             cmd = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
1199             cmd |= B43legacy_MACCMD_BEACON0_VALID;
1200             b43legacy_write32(dev, B43legacy_MMIO_MACCMD, cmd);
1201         } else if (!beacon1_valid) {
1202             b43legacy_upload_beacon1(dev);
1203             cmd = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
1204             cmd |= B43legacy_MACCMD_BEACON1_VALID;
1205             b43legacy_write32(dev, B43legacy_MMIO_MACCMD, cmd);
1206         }
1207     }
1208 }
1209
1210 static void b43legacy_beacon_update_trigger_work(struct work_struct *work)
1211 {
1212     struct b43legacy_wl *wl = container_of(work, struct b43legacy_wl,
1213                      beacon_update_trigger);
1214     struct b43legacy_wldev *dev;
1215
1216     mutex_lock(&wl->mutex);
1217     dev = wl->current_dev;
1218     if (likely(dev && (b43legacy_status(dev) >= B43legacy_STAT_INITIALIZED))) {
1219         spin_lock_irq(&wl->irq_lock);
1220         /* Update beacon right away or defer to IRQ. */
1221         handle_irq_beacon(dev);
1222         /* The handler might have updated the IRQ mask. */
1223         b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK,
1224                   dev->irq_mask);
1225         spin_unlock_irq(&wl->irq_lock);
1226     }
1227     mutex_unlock(&wl->mutex);
1228 }
1229
1230 /* Asynchronously update the packet templates in template RAM.
1231  * Locking: Requires wl->irq_lock to be locked. */
1232 static void b43legacy_update_templates(struct b43legacy_wl *wl)
1233 {
1234     struct sk_buff *beacon;
1235     /* This is the top half of the ansynchronous beacon update. The bottom
1236      * half is the beacon IRQ. Beacon update must be asynchronous to avoid
1237      * sending an invalid beacon. This can happen for example, if the
1238      * firmware transmits a beacon while we are updating it. */
1239
1240     /* We could modify the existing beacon and set the aid bit in the TIM
1241      * field, but that would probably require resizing and moving of data
1242      * within the beacon template. Simply request a new beacon and let
1243      * mac80211 do the hard work. */
1244     beacon = ieee80211_beacon_get(wl->hw, wl->vif, 0);
1245     if (unlikely(!beacon))
1246         return;
1247
1248     if (wl->current_beacon)
1249         dev_kfree_skb_any(wl->current_beacon);
1250     wl->current_beacon = beacon;
1251     wl->beacon0_uploaded = false;
1252     wl->beacon1_uploaded = false;
1253     ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1254 }
1255
1256 static void b43legacy_set_beacon_int(struct b43legacy_wldev *dev,
1257                      u16 beacon_int)
1258 {
1259     b43legacy_time_lock(dev);
1260     if (dev->dev->id.revision >= 3) {
1261         b43legacy_write32(dev, B43legacy_MMIO_TSF_CFP_REP,
1262                  (beacon_int << 16));
1263         b43legacy_write32(dev, B43legacy_MMIO_TSF_CFP_START,
1264                  (beacon_int << 10));
1265     } else {
1266         b43legacy_write16(dev, 0x606, (beacon_int >> 6));
1267         b43legacy_write16(dev, 0x610, beacon_int);
1268     }
1269     b43legacy_time_unlock(dev);
1270     b43legacydbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1271 }
1272
1273 static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
1274 {
1275 }
1276
1277 /* Interrupt handler bottom-half */
1278 static void b43legacy_interrupt_tasklet(struct tasklet_struct *t)
1279 {
1280     struct b43legacy_wldev *dev = from_tasklet(dev, t, isr_tasklet);
1281     u32 reason;
1282     u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1283     u32 merged_dma_reason = 0;
1284     int i;
1285     unsigned long flags;
1286
1287     spin_lock_irqsave(&dev->wl->irq_lock, flags);
1288
1289     B43legacy_WARN_ON(b43legacy_status(dev) <
1290               B43legacy_STAT_INITIALIZED);
1291
1292     reason = dev->irq_reason;
1293     for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1294         dma_reason[i] = dev->dma_reason[i];
1295         merged_dma_reason |= dma_reason[i];
1296     }
1297
1298     if (unlikely(reason & B43legacy_IRQ_MAC_TXERR))
1299         b43legacyerr(dev->wl, "MAC transmission error\n");
1300
1301     if (unlikely(reason & B43legacy_IRQ_PHY_TXERR)) {
1302         b43legacyerr(dev->wl, "PHY transmission error\n");
1303         rmb();
1304         if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1305             b43legacyerr(dev->wl, "Too many PHY TX errors, "
1306                           "restarting the controller\n");
1307             b43legacy_controller_restart(dev, "PHY TX errors");
1308         }
1309     }
1310
1311     if (unlikely(merged_dma_reason & (B43legacy_DMAIRQ_FATALMASK |
1312                       B43legacy_DMAIRQ_NONFATALMASK))) {
1313         if (merged_dma_reason & B43legacy_DMAIRQ_FATALMASK) {
1314             b43legacyerr(dev->wl, "Fatal DMA error: "
1315                    "0x%08X, 0x%08X, 0x%08X, "
1316                    "0x%08X, 0x%08X, 0x%08X\n",
1317                    dma_reason[0], dma_reason[1],
1318                    dma_reason[2], dma_reason[3],
1319                    dma_reason[4], dma_reason[5]);
1320             b43legacy_controller_restart(dev, "DMA error");
1321             spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1322             return;
1323         }
1324         if (merged_dma_reason & B43legacy_DMAIRQ_NONFATALMASK)
1325             b43legacyerr(dev->wl, "DMA error: "
1326                    "0x%08X, 0x%08X, 0x%08X, "
1327                    "0x%08X, 0x%08X, 0x%08X\n",
1328                    dma_reason[0], dma_reason[1],
1329                    dma_reason[2], dma_reason[3],
1330                    dma_reason[4], dma_reason[5]);
1331     }
1332
1333     if (unlikely(reason & B43legacy_IRQ_UCODE_DEBUG))
1334         handle_irq_ucode_debug(dev);
1335     if (reason & B43legacy_IRQ_TBTT_INDI)
1336         handle_irq_tbtt_indication(dev);
1337     if (reason & B43legacy_IRQ_ATIM_END)
1338         handle_irq_atim_end(dev);
1339     if (reason & B43legacy_IRQ_BEACON)
1340         handle_irq_beacon(dev);
1341     if (reason & B43legacy_IRQ_PMQ)
1342         handle_irq_pmq(dev);
1343     if (reason & B43legacy_IRQ_TXFIFO_FLUSH_OK) {
1344         ;/*TODO*/
1345     }
1346     if (reason & B43legacy_IRQ_NOISESAMPLE_OK)
1347         handle_irq_noise(dev);
1348
1349     /* Check the DMA reason registers for received data. */
1350     if (dma_reason[0] & B43legacy_DMAIRQ_RX_DONE) {
1351         if (b43legacy_using_pio(dev))
1352             b43legacy_pio_rx(dev->pio.queue0);
1353         else
1354             b43legacy_dma_rx(dev->dma.rx_ring0);
1355     }
1356     B43legacy_WARN_ON(dma_reason[1] & B43legacy_DMAIRQ_RX_DONE);
1357     B43legacy_WARN_ON(dma_reason[2] & B43legacy_DMAIRQ_RX_DONE);
1358     if (dma_reason[3] & B43legacy_DMAIRQ_RX_DONE) {
1359         if (b43legacy_using_pio(dev))
1360             b43legacy_pio_rx(dev->pio.queue3);
1361         else
1362             b43legacy_dma_rx(dev->dma.rx_ring3);
1363     }
1364     B43legacy_WARN_ON(dma_reason[4] & B43legacy_DMAIRQ_RX_DONE);
1365     B43legacy_WARN_ON(dma_reason[5] & B43legacy_DMAIRQ_RX_DONE);
1366
1367     if (reason & B43legacy_IRQ_TX_OK)
1368         handle_irq_transmit_status(dev);
1369
1370     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1371     spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
1372 }
1373
1374 static void pio_irq_workaround(struct b43legacy_wldev *dev,
1375                    u16 base, int queueidx)
1376 {
1377     u16 rxctl;
1378
1379     rxctl = b43legacy_read16(dev, base + B43legacy_PIO_RXCTL);
1380     if (rxctl & B43legacy_PIO_RXCTL_DATAAVAILABLE)
1381         dev->dma_reason[queueidx] |= B43legacy_DMAIRQ_RX_DONE;
1382     else
1383         dev->dma_reason[queueidx] &= ~B43legacy_DMAIRQ_RX_DONE;
1384 }
1385
1386 static void b43legacy_interrupt_ack(struct b43legacy_wldev *dev, u32 reason)
1387 {
1388     if (b43legacy_using_pio(dev) &&
1389         (dev->dev->id.revision < 3) &&
1390         (!(reason & B43legacy_IRQ_PIO_WORKAROUND))) {
1391         /* Apply a PIO specific workaround to the dma_reasons */
1392         pio_irq_workaround(dev, B43legacy_MMIO_PIO1_BASE, 0);
1393         pio_irq_workaround(dev, B43legacy_MMIO_PIO2_BASE, 1);
1394         pio_irq_workaround(dev, B43legacy_MMIO_PIO3_BASE, 2);
1395         pio_irq_workaround(dev, B43legacy_MMIO_PIO4_BASE, 3);
1396     }
1397
1398     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON, reason);
1399
1400     b43legacy_write32(dev, B43legacy_MMIO_DMA0_REASON,
1401               dev->dma_reason[0]);
1402     b43legacy_write32(dev, B43legacy_MMIO_DMA1_REASON,
1403               dev->dma_reason[1]);
1404     b43legacy_write32(dev, B43legacy_MMIO_DMA2_REASON,
1405               dev->dma_reason[2]);
1406     b43legacy_write32(dev, B43legacy_MMIO_DMA3_REASON,
1407               dev->dma_reason[3]);
1408     b43legacy_write32(dev, B43legacy_MMIO_DMA4_REASON,
1409               dev->dma_reason[4]);
1410     b43legacy_write32(dev, B43legacy_MMIO_DMA5_REASON,
1411               dev->dma_reason[5]);
1412 }
1413
1414 /* Interrupt handler top-half */
1415 static irqreturn_t b43legacy_interrupt_handler(int irq, void *dev_id)
1416 {
1417     irqreturn_t ret = IRQ_NONE;
1418     struct b43legacy_wldev *dev = dev_id;
1419     u32 reason;
1420
1421     B43legacy_WARN_ON(!dev);
1422
1423     spin_lock(&dev->wl->irq_lock);
1424
1425     if (unlikely(b43legacy_status(dev) < B43legacy_STAT_STARTED))
1426         /* This can only happen on shared IRQ lines. */
1427         goto out;
1428     reason = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1429     if (reason == 0xffffffff) /* shared IRQ */
1430         goto out;
1431     ret = IRQ_HANDLED;
1432     reason &= dev->irq_mask;
1433     if (!reason)
1434         goto out;
1435
1436     dev->dma_reason[0] = b43legacy_read32(dev,
1437                           B43legacy_MMIO_DMA0_REASON)
1438                           & 0x0001DC00;
1439     dev->dma_reason[1] = b43legacy_read32(dev,
1440                           B43legacy_MMIO_DMA1_REASON)
1441                           & 0x0000DC00;
1442     dev->dma_reason[2] = b43legacy_read32(dev,
1443                           B43legacy_MMIO_DMA2_REASON)
1444                           & 0x0000DC00;
1445     dev->dma_reason[3] = b43legacy_read32(dev,
1446                           B43legacy_MMIO_DMA3_REASON)
1447                           & 0x0001DC00;
1448     dev->dma_reason[4] = b43legacy_read32(dev,
1449                           B43legacy_MMIO_DMA4_REASON)
1450                           & 0x0000DC00;
1451     dev->dma_reason[5] = b43legacy_read32(dev,
1452                           B43legacy_MMIO_DMA5_REASON)
1453                           & 0x0000DC00;
1454
1455     b43legacy_interrupt_ack(dev, reason);
1456     /* Disable all IRQs. They are enabled again in the bottom half. */
1457     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, 0);
1458     /* Save the reason code and call our bottom half. */
1459     dev->irq_reason = reason;
1460     tasklet_schedule(&dev->isr_tasklet);
1461 out:
1462     spin_unlock(&dev->wl->irq_lock);
1463
1464     return ret;
1465 }
1466
1467 static void b43legacy_release_firmware(struct b43legacy_wldev *dev)
1468 {
1469     release_firmware(dev->fw.ucode);
1470     dev->fw.ucode = NULL;
1471     release_firmware(dev->fw.pcm);
1472     dev->fw.pcm = NULL;
1473     release_firmware(dev->fw.initvals);
1474     dev->fw.initvals = NULL;
1475     release_firmware(dev->fw.initvals_band);
1476     dev->fw.initvals_band = NULL;
1477 }
1478
1479 static void b43legacy_print_fw_helptext(struct b43legacy_wl *wl)
1480 {
1481     b43legacyerr(wl, "You must go to https://wireless.wiki.kernel.org/en/"
1482              "users/Drivers/b43#devicefirmware "
1483              "and download the correct firmware (version 3).\n");
1484 }
1485
1486 static void b43legacy_fw_cb(const struct firmware *firmware, void *context)
1487 {
1488     struct b43legacy_wldev *dev = context;
1489
1490     dev->fwp = firmware;
1491     complete(&dev->fw_load_complete);
1492 }
1493
1494 static int do_request_fw(struct b43legacy_wldev *dev,
1495              const char *name,
1496              const struct firmware **fw, bool async)
1497 {
1498     char path[sizeof(modparam_fwpostfix) + 32];
1499     struct b43legacy_fw_header *hdr;
1500     u32 size;
1501     int err;
1502
1503     if (!name)
1504         return 0;
1505
1506     snprintf(path, ARRAY_SIZE(path),
1507          "b43legacy%s/%s.fw",
1508          modparam_fwpostfix, name);
1509     b43legacyinfo(dev->wl, "Loading firmware %s\n", path);
1510     if (async) {
1511         init_completion(&dev->fw_load_complete);
1512         err = request_firmware_nowait(THIS_MODULE, 1, path,
1513                           dev->dev->dev, GFP_KERNEL,
1514                           dev, b43legacy_fw_cb);
1515         if (err) {
1516             b43legacyerr(dev->wl, "Unable to load firmware\n");
1517             return err;
1518         }
1519         /* stall here until fw ready */
1520         wait_for_completion(&dev->fw_load_complete);
1521         if (!dev->fwp)
1522             err = -EINVAL;
1523         *fw = dev->fwp;
1524     } else {
1525         err = request_firmware(fw, path, dev->dev->dev);
1526     }
1527     if (err) {
1528         b43legacyerr(dev->wl, "Firmware file \"%s\" not found "
1529                "or load failed.\n", path);
1530         return err;
1531     }
1532     if ((*fw)->size < sizeof(struct b43legacy_fw_header))
1533         goto err_format;
1534     hdr = (struct b43legacy_fw_header *)((*fw)->data);
1535     switch (hdr->type) {
1536     case B43legacy_FW_TYPE_UCODE:
1537     case B43legacy_FW_TYPE_PCM:
1538         size = be32_to_cpu(hdr->size);
1539         if (size != (*fw)->size - sizeof(struct b43legacy_fw_header))
1540             goto err_format;
1541         fallthrough;
1542     case B43legacy_FW_TYPE_IV:
1543         if (hdr->ver != 1)
1544             goto err_format;
1545         break;
1546     default:
1547         goto err_format;
1548     }
1549
1550     return err;
1551
1552 err_format:
1553     b43legacyerr(dev->wl, "Firmware file \"%s\" format error.\n", path);
1554     return -EPROTO;
1555 }
1556
1557 static int b43legacy_one_core_attach(struct ssb_device *dev,
1558                      struct b43legacy_wl *wl);
1559 static void b43legacy_one_core_detach(struct ssb_device *dev);
1560
1561 static void b43legacy_request_firmware(struct work_struct *work)
1562 {
1563     struct b43legacy_wl *wl = container_of(work,
1564                   struct b43legacy_wl, firmware_load);
1565     struct b43legacy_wldev *dev = wl->current_dev;
1566     struct b43legacy_firmware *fw = &dev->fw;
1567     const u8 rev = dev->dev->id.revision;
1568     const char *filename;
1569     int err;
1570
1571     if (!fw->ucode) {
1572         if (rev == 2)
1573             filename = "ucode2";
1574         else if (rev == 4)
1575             filename = "ucode4";
1576         else
1577             filename = "ucode5";
1578         err = do_request_fw(dev, filename, &fw->ucode, true);
1579         if (err)
1580             goto err_load;
1581     }
1582     if (!fw->pcm) {
1583         if (rev < 5)
1584             filename = "pcm4";
1585         else
1586             filename = "pcm5";
1587         err = do_request_fw(dev, filename, &fw->pcm, false);
1588         if (err)
1589             goto err_load;
1590     }
1591     if (!fw->initvals) {
1592         switch (dev->phy.type) {
1593         case B43legacy_PHYTYPE_B:
1594         case B43legacy_PHYTYPE_G:
1595             if ((rev >= 5) && (rev <= 10))
1596                 filename = "b0g0initvals5";
1597             else if (rev == 2 || rev == 4)
1598                 filename = "b0g0initvals2";
1599             else
1600                 goto err_no_initvals;
1601             break;
1602         default:
1603             goto err_no_initvals;
1604         }
1605         err = do_request_fw(dev, filename, &fw->initvals, false);
1606         if (err)
1607             goto err_load;
1608     }
1609     if (!fw->initvals_band) {
1610         switch (dev->phy.type) {
1611         case B43legacy_PHYTYPE_B:
1612         case B43legacy_PHYTYPE_G:
1613             if ((rev >= 5) && (rev <= 10))
1614                 filename = "b0g0bsinitvals5";
1615             else if (rev >= 11)
1616                 filename = NULL;
1617             else if (rev == 2 || rev == 4)
1618                 filename = NULL;
1619             else
1620                 goto err_no_initvals;
1621             break;
1622         default:
1623             goto err_no_initvals;
1624         }
1625         err = do_request_fw(dev, filename, &fw->initvals_band, false);
1626         if (err)
1627             goto err_load;
1628     }
1629     err = ieee80211_register_hw(wl->hw);
1630     if (err)
1631         goto err_one_core_detach;
1632     return;
1633
1634 err_one_core_detach:
1635     b43legacy_one_core_detach(dev->dev);
1636     goto error;
1637
1638 err_load:
1639     b43legacy_print_fw_helptext(dev->wl);
1640     goto error;
1641
1642 err_no_initvals:
1643     err = -ENODEV;
1644     b43legacyerr(dev->wl, "No Initial Values firmware file for PHY %u, "
1645            "core rev %u\n", dev->phy.type, rev);
1646     goto error;
1647
1648 error:
1649     b43legacy_release_firmware(dev);
1650     return;
1651 }
1652
1653 static int b43legacy_upload_microcode(struct b43legacy_wldev *dev)
1654 {
1655     struct wiphy *wiphy = dev->wl->hw->wiphy;
1656     const size_t hdr_len = sizeof(struct b43legacy_fw_header);
1657     const __be32 *data;
1658     unsigned int i;
1659     unsigned int len;
1660     u16 fwrev;
1661     u16 fwpatch;
1662     u16 fwdate;
1663     u16 fwtime;
1664     u32 tmp, macctl;
1665     int err = 0;
1666
1667     /* Jump the microcode PSM to offset 0 */
1668     macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1669     B43legacy_WARN_ON(macctl & B43legacy_MACCTL_PSM_RUN);
1670     macctl |= B43legacy_MACCTL_PSM_JMP0;
1671     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
1672     /* Zero out all microcode PSM registers and shared memory. */
1673     for (i = 0; i < 64; i++)
1674         b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, i, 0);
1675     for (i = 0; i < 4096; i += 2)
1676         b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, i, 0);
1677
1678     /* Upload Microcode. */
1679     data = (__be32 *) (dev->fw.ucode->data + hdr_len);
1680     len = (dev->fw.ucode->size - hdr_len) / sizeof(__be32);
1681     b43legacy_shm_control_word(dev,
1682                    B43legacy_SHM_UCODE |
1683                    B43legacy_SHM_AUTOINC_W,
1684                    0x0000);
1685     for (i = 0; i < len; i++) {
1686         b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA,
1687                     be32_to_cpu(data[i]));
1688         udelay(10);
1689     }
1690
1691     if (dev->fw.pcm) {
1692         /* Upload PCM data. */
1693         data = (__be32 *) (dev->fw.pcm->data + hdr_len);
1694         len = (dev->fw.pcm->size - hdr_len) / sizeof(__be32);
1695         b43legacy_shm_control_word(dev, B43legacy_SHM_HW, 0x01EA);
1696         b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA, 0x00004000);
1697         /* No need for autoinc bit in SHM_HW */
1698         b43legacy_shm_control_word(dev, B43legacy_SHM_HW, 0x01EB);
1699         for (i = 0; i < len; i++) {
1700             b43legacy_write32(dev, B43legacy_MMIO_SHM_DATA,
1701                       be32_to_cpu(data[i]));
1702             udelay(10);
1703         }
1704     }
1705
1706     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
1707               B43legacy_IRQ_ALL);
1708
1709     /* Start the microcode PSM */
1710     macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1711     macctl &= ~B43legacy_MACCTL_PSM_JMP0;
1712     macctl |= B43legacy_MACCTL_PSM_RUN;
1713     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
1714
1715     /* Wait for the microcode to load and respond */
1716     i = 0;
1717     while (1) {
1718         tmp = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1719         if (tmp == B43legacy_IRQ_MAC_SUSPENDED)
1720             break;
1721         i++;
1722         if (i >= B43legacy_IRQWAIT_MAX_RETRIES) {
1723             b43legacyerr(dev->wl, "Microcode not responding\n");
1724             b43legacy_print_fw_helptext(dev->wl);
1725             err = -ENODEV;
1726             goto error;
1727         }
1728         msleep_interruptible(50);
1729         if (signal_pending(current)) {
1730             err = -EINTR;
1731             goto error;
1732         }
1733     }
1734     /* dummy read follows */
1735     b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1736
1737     /* Get and check the revisions. */
1738     fwrev = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1739                      B43legacy_SHM_SH_UCODEREV);
1740     fwpatch = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1741                        B43legacy_SHM_SH_UCODEPATCH);
1742     fwdate = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1743                       B43legacy_SHM_SH_UCODEDATE);
1744     fwtime = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
1745                       B43legacy_SHM_SH_UCODETIME);
1746
1747     if (fwrev > 0x128) {
1748         b43legacyerr(dev->wl, "YOU ARE TRYING TO LOAD V4 FIRMWARE."
1749                  " Only firmware from binary drivers version 3.x"
1750                  " is supported. You must change your firmware"
1751                  " files.\n");
1752         b43legacy_print_fw_helptext(dev->wl);
1753         err = -EOPNOTSUPP;
1754         goto error;
1755     }
1756     b43legacyinfo(dev->wl, "Loading firmware version 0x%X, patch level %u "
1757               "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n", fwrev, fwpatch,
1758               (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
1759               (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F,
1760               fwtime & 0x1F);
1761
1762     dev->fw.rev = fwrev;
1763     dev->fw.patch = fwpatch;
1764
1765     snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
1766             dev->fw.rev, dev->fw.patch);
1767     wiphy->hw_version = dev->dev->id.coreid;
1768
1769     return 0;
1770
1771 error:
1772     macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1773     macctl &= ~B43legacy_MACCTL_PSM_RUN;
1774     macctl |= B43legacy_MACCTL_PSM_JMP0;
1775     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
1776
1777     return err;
1778 }
1779
1780 static int b43legacy_write_initvals(struct b43legacy_wldev *dev,
1781                     const struct b43legacy_iv *ivals,
1782                     size_t count,
1783                     size_t array_size)
1784 {
1785     const struct b43legacy_iv *iv;
1786     u16 offset;
1787     size_t i;
1788     bool bit32;
1789
1790     BUILD_BUG_ON(sizeof(struct b43legacy_iv) != 6);
1791     iv = ivals;
1792     for (i = 0; i < count; i++) {
1793         if (array_size < sizeof(iv->offset_size))
1794             goto err_format;
1795         array_size -= sizeof(iv->offset_size);
1796         offset = be16_to_cpu(iv->offset_size);
1797         bit32 = !!(offset & B43legacy_IV_32BIT);
1798         offset &= B43legacy_IV_OFFSET_MASK;
1799         if (offset >= 0x1000)
1800             goto err_format;
1801         if (bit32) {
1802             u32 value;
1803
1804             if (array_size < sizeof(iv->data.d32))
1805                 goto err_format;
1806             array_size -= sizeof(iv->data.d32);
1807
1808             value = get_unaligned_be32(&iv->data.d32);
1809             b43legacy_write32(dev, offset, value);
1810
1811             iv = (const struct b43legacy_iv *)((const uint8_t *)iv +
1812                             sizeof(__be16) +
1813                             sizeof(__be32));
1814         } else {
1815             u16 value;
1816
1817             if (array_size < sizeof(iv->data.d16))
1818                 goto err_format;
1819             array_size -= sizeof(iv->data.d16);
1820
1821             value = be16_to_cpu(iv->data.d16);
1822             b43legacy_write16(dev, offset, value);
1823
1824             iv = (const struct b43legacy_iv *)((const uint8_t *)iv +
1825                             sizeof(__be16) +
1826                             sizeof(__be16));
1827         }
1828     }
1829     if (array_size)
1830         goto err_format;
1831
1832     return 0;
1833
1834 err_format:
1835     b43legacyerr(dev->wl, "Initial Values Firmware file-format error.\n");
1836     b43legacy_print_fw_helptext(dev->wl);
1837
1838     return -EPROTO;
1839 }
1840
1841 static int b43legacy_upload_initvals(struct b43legacy_wldev *dev)
1842 {
1843     const size_t hdr_len = sizeof(struct b43legacy_fw_header);
1844     const struct b43legacy_fw_header *hdr;
1845     struct b43legacy_firmware *fw = &dev->fw;
1846     const struct b43legacy_iv *ivals;
1847     size_t count;
1848     int err;
1849
1850     hdr = (const struct b43legacy_fw_header *)(fw->initvals->data);
1851     ivals = (const struct b43legacy_iv *)(fw->initvals->data + hdr_len);
1852     count = be32_to_cpu(hdr->size);
1853     err = b43legacy_write_initvals(dev, ivals, count,
1854                  fw->initvals->size - hdr_len);
1855     if (err)
1856         goto out;
1857     if (fw->initvals_band) {
1858         hdr = (const struct b43legacy_fw_header *)
1859               (fw->initvals_band->data);
1860         ivals = (const struct b43legacy_iv *)(fw->initvals_band->data
1861             + hdr_len);
1862         count = be32_to_cpu(hdr->size);
1863         err = b43legacy_write_initvals(dev, ivals, count,
1864                      fw->initvals_band->size - hdr_len);
1865         if (err)
1866             goto out;
1867     }
1868 out:
1869
1870     return err;
1871 }
1872
1873 /* Initialize the GPIOs
1874  * https://bcm-specs.sipsolutions.net/GPIO
1875  */
1876 static int b43legacy_gpio_init(struct b43legacy_wldev *dev)
1877 {
1878     struct ssb_bus *bus = dev->dev->bus;
1879     struct ssb_device *gpiodev, *pcidev = NULL;
1880     u32 mask;
1881     u32 set;
1882
1883     b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
1884               b43legacy_read32(dev,
1885               B43legacy_MMIO_MACCTL)
1886               & 0xFFFF3FFF);
1887
1888     b43legacy_write16(dev, B43legacy_MMIO_GPIO_MASK,
1889               b43legacy_read16(dev,
1890               B43legacy_MMIO_GPIO_MASK)
1891               | 0x000F);
1892
1893     mask = 0x0000001F;
1894     set = 0x0000000F;
1895     if (dev->dev->bus->chip_id == 0x4301) {
1896         mask |= 0x0060;
1897         set |= 0x0060;
1898     }
1899     if (dev->dev->bus->sprom.boardflags_lo & B43legacy_BFL_PACTRL) {
1900         b43legacy_write16(dev, B43legacy_MMIO_GPIO_MASK,
1901                   b43legacy_read16(dev,
1902                   B43legacy_MMIO_GPIO_MASK)
1903                   | 0x0200);
1904         mask |= 0x0200;
1905         set |= 0x0200;
1906     }
1907     if (dev->dev->id.revision >= 2)
1908         mask  |= 0x0010; /* FIXME: This is redundant. */
1909
1910 #ifdef CONFIG_SSB_DRIVER_PCICORE
1911     pcidev = bus->pcicore.dev;
1912 #endif
1913     gpiodev = bus->chipco.dev ? : pcidev;
1914     if (!gpiodev)
1915         return 0;
1916     ssb_write32(gpiodev, B43legacy_GPIO_CONTROL,
1917             (ssb_read32(gpiodev, B43legacy_GPIO_CONTROL)
1918              & ~mask) | set);
1919
1920     return 0;
1921 }
1922
1923 /* Turn off all GPIO stuff. Call this on module unload, for example. */
1924 static void b43legacy_gpio_cleanup(struct b43legacy_wldev *dev)
1925 {
1926     struct ssb_bus *bus = dev->dev->bus;
1927     struct ssb_device *gpiodev, *pcidev = NULL;
1928
1929 #ifdef CONFIG_SSB_DRIVER_PCICORE
1930     pcidev = bus->pcicore.dev;
1931 #endif
1932     gpiodev = bus->chipco.dev ? : pcidev;
1933     if (!gpiodev)
1934         return;
1935     ssb_write32(gpiodev, B43legacy_GPIO_CONTROL, 0);
1936 }
1937
1938 /* http://bcm-specs.sipsolutions.net/EnableMac */
1939 void b43legacy_mac_enable(struct b43legacy_wldev *dev)
1940 {
1941     dev->mac_suspended--;
1942     B43legacy_WARN_ON(dev->mac_suspended < 0);
1943     B43legacy_WARN_ON(irqs_disabled());
1944     if (dev->mac_suspended == 0) {
1945         b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
1946                   b43legacy_read32(dev,
1947                   B43legacy_MMIO_MACCTL)
1948                   | B43legacy_MACCTL_ENABLED);
1949         b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
1950                   B43legacy_IRQ_MAC_SUSPENDED);
1951         /* the next two are dummy reads */
1952         b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
1953         b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1954         b43legacy_power_saving_ctl_bits(dev, -1, -1);
1955
1956         /* Re-enable IRQs. */
1957         spin_lock_irq(&dev->wl->irq_lock);
1958         b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK,
1959                   dev->irq_mask);
1960         spin_unlock_irq(&dev->wl->irq_lock);
1961     }
1962 }
1963
1964 /* https://bcm-specs.sipsolutions.net/SuspendMAC */
1965 void b43legacy_mac_suspend(struct b43legacy_wldev *dev)
1966 {
1967     int i;
1968     u32 tmp;
1969
1970     might_sleep();
1971     B43legacy_WARN_ON(irqs_disabled());
1972     B43legacy_WARN_ON(dev->mac_suspended < 0);
1973
1974     if (dev->mac_suspended == 0) {
1975         /* Mask IRQs before suspending MAC. Otherwise
1976          * the MAC stays busy and won't suspend. */
1977         spin_lock_irq(&dev->wl->irq_lock);
1978         b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, 0);
1979         spin_unlock_irq(&dev->wl->irq_lock);
1980         b43legacy_synchronize_irq(dev);
1981
1982         b43legacy_power_saving_ctl_bits(dev, -1, 1);
1983         b43legacy_write32(dev, B43legacy_MMIO_MACCTL,
1984                   b43legacy_read32(dev,
1985                   B43legacy_MMIO_MACCTL)
1986                   & ~B43legacy_MACCTL_ENABLED);
1987         b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
1988         for (i = 40; i; i--) {
1989             tmp = b43legacy_read32(dev,
1990                            B43legacy_MMIO_GEN_IRQ_REASON);
1991             if (tmp & B43legacy_IRQ_MAC_SUSPENDED)
1992                 goto out;
1993             msleep(1);
1994         }
1995         b43legacyerr(dev->wl, "MAC suspend failed\n");
1996     }
1997 out:
1998     dev->mac_suspended++;
1999 }
2000
2001 static void b43legacy_adjust_opmode(struct b43legacy_wldev *dev)
2002 {
2003     struct b43legacy_wl *wl = dev->wl;
2004     u32 ctl;
2005     u16 cfp_pretbtt;
2006
2007     ctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
2008     /* Reset status to STA infrastructure mode. */
2009     ctl &= ~B43legacy_MACCTL_AP;
2010     ctl &= ~B43legacy_MACCTL_KEEP_CTL;
2011     ctl &= ~B43legacy_MACCTL_KEEP_BADPLCP;
2012     ctl &= ~B43legacy_MACCTL_KEEP_BAD;
2013     ctl &= ~B43legacy_MACCTL_PROMISC;
2014     ctl &= ~B43legacy_MACCTL_BEACPROMISC;
2015     ctl |= B43legacy_MACCTL_INFRA;
2016
2017     if (b43legacy_is_mode(wl, NL80211_IFTYPE_AP))
2018         ctl |= B43legacy_MACCTL_AP;
2019     else if (b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC))
2020         ctl &= ~B43legacy_MACCTL_INFRA;
2021
2022     if (wl->filter_flags & FIF_CONTROL)
2023         ctl |= B43legacy_MACCTL_KEEP_CTL;
2024     if (wl->filter_flags & FIF_FCSFAIL)
2025         ctl |= B43legacy_MACCTL_KEEP_BAD;
2026     if (wl->filter_flags & FIF_PLCPFAIL)
2027         ctl |= B43legacy_MACCTL_KEEP_BADPLCP;
2028     if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2029         ctl |= B43legacy_MACCTL_BEACPROMISC;
2030
2031     /* Workaround: On old hardware the HW-MAC-address-filter
2032      * doesn't work properly, so always run promisc in filter
2033      * it in software. */
2034     if (dev->dev->id.revision <= 4)
2035         ctl |= B43legacy_MACCTL_PROMISC;
2036
2037     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, ctl);
2038
2039     cfp_pretbtt = 2;
2040     if ((ctl & B43legacy_MACCTL_INFRA) &&
2041         !(ctl & B43legacy_MACCTL_AP)) {
2042         if (dev->dev->bus->chip_id == 0x4306 &&
2043             dev->dev->bus->chip_rev == 3)
2044             cfp_pretbtt = 100;
2045         else
2046             cfp_pretbtt = 50;
2047     }
2048     b43legacy_write16(dev, 0x612, cfp_pretbtt);
2049 }
2050
2051 static void b43legacy_rate_memory_write(struct b43legacy_wldev *dev,
2052                     u16 rate,
2053                     int is_ofdm)
2054 {
2055     u16 offset;
2056
2057     if (is_ofdm) {
2058         offset = 0x480;
2059         offset += (b43legacy_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2060     } else {
2061         offset = 0x4C0;
2062         offset += (b43legacy_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2063     }
2064     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, offset + 0x20,
2065                   b43legacy_shm_read16(dev,
2066                   B43legacy_SHM_SHARED, offset));
2067 }
2068
2069 static void b43legacy_rate_memory_init(struct b43legacy_wldev *dev)
2070 {
2071     switch (dev->phy.type) {
2072     case B43legacy_PHYTYPE_G:
2073         b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_6MB, 1);
2074         b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_12MB, 1);
2075         b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_18MB, 1);
2076         b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_24MB, 1);
2077         b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_36MB, 1);
2078         b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_48MB, 1);
2079         b43legacy_rate_memory_write(dev, B43legacy_OFDM_RATE_54MB, 1);
2080         fallthrough;
2081     case B43legacy_PHYTYPE_B:
2082         b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_1MB, 0);
2083         b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_2MB, 0);
2084         b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_5MB, 0);
2085         b43legacy_rate_memory_write(dev, B43legacy_CCK_RATE_11MB, 0);
2086         break;
2087     default:
2088         B43legacy_BUG_ON(1);
2089     }
2090 }
2091
2092 /* Set the TX-Antenna for management frames sent by firmware. */
2093 static void b43legacy_mgmtframe_txantenna(struct b43legacy_wldev *dev,
2094                       int antenna)
2095 {
2096     u16 ant = 0;
2097     u16 tmp;
2098
2099     switch (antenna) {
2100     case B43legacy_ANTENNA0:
2101         ant |= B43legacy_TX4_PHY_ANT0;
2102         break;
2103     case B43legacy_ANTENNA1:
2104         ant |= B43legacy_TX4_PHY_ANT1;
2105         break;
2106     case B43legacy_ANTENNA_AUTO:
2107         ant |= B43legacy_TX4_PHY_ANTLAST;
2108         break;
2109     default:
2110         B43legacy_BUG_ON(1);
2111     }
2112
2113     /* FIXME We also need to set the other flags of the PHY control
2114      * field somewhere. */
2115
2116     /* For Beacons */
2117     tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2118                    B43legacy_SHM_SH_BEACPHYCTL);
2119     tmp = (tmp & ~B43legacy_TX4_PHY_ANT) | ant;
2120     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2121                   B43legacy_SHM_SH_BEACPHYCTL, tmp);
2122     /* For ACK/CTS */
2123     tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2124                    B43legacy_SHM_SH_ACKCTSPHYCTL);
2125     tmp = (tmp & ~B43legacy_TX4_PHY_ANT) | ant;
2126     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2127                   B43legacy_SHM_SH_ACKCTSPHYCTL, tmp);
2128     /* For Probe Resposes */
2129     tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2130                    B43legacy_SHM_SH_PRPHYCTL);
2131     tmp = (tmp & ~B43legacy_TX4_PHY_ANT) | ant;
2132     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2133                   B43legacy_SHM_SH_PRPHYCTL, tmp);
2134 }
2135
2136 /* This is the opposite of b43legacy_chip_init() */
2137 static void b43legacy_chip_exit(struct b43legacy_wldev *dev)
2138 {
2139     b43legacy_radio_turn_off(dev, 1);
2140     b43legacy_gpio_cleanup(dev);
2141     /* firmware is released later */
2142 }
2143
2144 /* Initialize the chip
2145  * https://bcm-specs.sipsolutions.net/ChipInit
2146  */
2147 static int b43legacy_chip_init(struct b43legacy_wldev *dev)
2148 {
2149     struct b43legacy_phy *phy = &dev->phy;
2150     int err;
2151     int tmp;
2152     u32 value32, macctl;
2153     u16 value16;
2154
2155     /* Initialize the MAC control */
2156     macctl = B43legacy_MACCTL_IHR_ENABLED | B43legacy_MACCTL_SHM_ENABLED;
2157     if (dev->phy.gmode)
2158         macctl |= B43legacy_MACCTL_GMODE;
2159     macctl |= B43legacy_MACCTL_INFRA;
2160     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
2161
2162     err = b43legacy_upload_microcode(dev);
2163     if (err)
2164         goto out; /* firmware is released later */
2165
2166     err = b43legacy_gpio_init(dev);
2167     if (err)
2168         goto out; /* firmware is released later */
2169
2170     err = b43legacy_upload_initvals(dev);
2171     if (err)
2172         goto err_gpio_clean;
2173     b43legacy_radio_turn_on(dev);
2174
2175     b43legacy_write16(dev, 0x03E6, 0x0000);
2176     err = b43legacy_phy_init(dev);
2177     if (err)
2178         goto err_radio_off;
2179
2180     /* Select initial Interference Mitigation. */
2181     tmp = phy->interfmode;
2182     phy->interfmode = B43legacy_INTERFMODE_NONE;
2183     b43legacy_radio_set_interference_mitigation(dev, tmp);
2184
2185     b43legacy_phy_set_antenna_diversity(dev);
2186     b43legacy_mgmtframe_txantenna(dev, B43legacy_ANTENNA_DEFAULT);
2187
2188     if (phy->type == B43legacy_PHYTYPE_B) {
2189         value16 = b43legacy_read16(dev, 0x005E);
2190         value16 |= 0x0004;
2191         b43legacy_write16(dev, 0x005E, value16);
2192     }
2193     b43legacy_write32(dev, 0x0100, 0x01000000);
2194     if (dev->dev->id.revision < 5)
2195         b43legacy_write32(dev, 0x010C, 0x01000000);
2196
2197     value32 = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
2198     value32 &= ~B43legacy_MACCTL_INFRA;
2199     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, value32);
2200     value32 = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
2201     value32 |= B43legacy_MACCTL_INFRA;
2202     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, value32);
2203
2204     if (b43legacy_using_pio(dev)) {
2205         b43legacy_write32(dev, 0x0210, 0x00000100);
2206         b43legacy_write32(dev, 0x0230, 0x00000100);
2207         b43legacy_write32(dev, 0x0250, 0x00000100);
2208         b43legacy_write32(dev, 0x0270, 0x00000100);
2209         b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0034,
2210                       0x0000);
2211     }
2212
2213     /* Probe Response Timeout value */
2214     /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
2215     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, 0x0074, 0x0000);
2216
2217     /* Initially set the wireless operation mode. */
2218     b43legacy_adjust_opmode(dev);
2219
2220     if (dev->dev->id.revision < 3) {
2221         b43legacy_write16(dev, 0x060E, 0x0000);
2222         b43legacy_write16(dev, 0x0610, 0x8000);
2223         b43legacy_write16(dev, 0x0604, 0x0000);
2224         b43legacy_write16(dev, 0x0606, 0x0200);
2225     } else {
2226         b43legacy_write32(dev, 0x0188, 0x80000000);
2227         b43legacy_write32(dev, 0x018C, 0x02000000);
2228     }
2229     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON, 0x00004000);
2230     b43legacy_write32(dev, B43legacy_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
2231     b43legacy_write32(dev, B43legacy_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
2232     b43legacy_write32(dev, B43legacy_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
2233     b43legacy_write32(dev, B43legacy_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
2234     b43legacy_write32(dev, B43legacy_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
2235     b43legacy_write32(dev, B43legacy_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
2236
2237     value32 = ssb_read32(dev->dev, SSB_TMSLOW);
2238     value32 |= B43legacy_TMSLOW_MACPHYCLKEN;
2239     ssb_write32(dev->dev, SSB_TMSLOW, value32);
2240
2241     b43legacy_write16(dev, B43legacy_MMIO_POWERUP_DELAY,
2242               dev->dev->bus->chipco.fast_pwrup_delay);
2243
2244     /* PHY TX errors counter. */
2245     atomic_set(&phy->txerr_cnt, B43legacy_PHY_TX_BADNESS_LIMIT);
2246
2247     B43legacy_WARN_ON(err != 0);
2248     b43legacydbg(dev->wl, "Chip initialized\n");
2249 out:
2250     return err;
2251
2252 err_radio_off:
2253     b43legacy_radio_turn_off(dev, 1);
2254 err_gpio_clean:
2255     b43legacy_gpio_cleanup(dev);
2256     goto out;
2257 }
2258
2259 static void b43legacy_periodic_every120sec(struct b43legacy_wldev *dev)
2260 {
2261     struct b43legacy_phy *phy = &dev->phy;
2262
2263     if (phy->type != B43legacy_PHYTYPE_G || phy->rev < 2)
2264         return;
2265
2266     b43legacy_mac_suspend(dev);
2267     b43legacy_phy_lo_g_measure(dev);
2268     b43legacy_mac_enable(dev);
2269 }
2270
2271 static void b43legacy_periodic_every60sec(struct b43legacy_wldev *dev)
2272 {
2273     b43legacy_phy_lo_mark_all_unused(dev);
2274     if (dev->dev->bus->sprom.boardflags_lo & B43legacy_BFL_RSSI) {
2275         b43legacy_mac_suspend(dev);
2276         b43legacy_calc_nrssi_slope(dev);
2277         b43legacy_mac_enable(dev);
2278     }
2279 }
2280
2281 static void b43legacy_periodic_every30sec(struct b43legacy_wldev *dev)
2282 {
2283     /* Update device statistics. */
2284     b43legacy_calculate_link_quality(dev);
2285 }
2286
2287 static void b43legacy_periodic_every15sec(struct b43legacy_wldev *dev)
2288 {
2289     b43legacy_phy_xmitpower(dev); /* FIXME: unless scanning? */
2290
2291     atomic_set(&dev->phy.txerr_cnt, B43legacy_PHY_TX_BADNESS_LIMIT);
2292     wmb();
2293 }
2294
2295 static void do_periodic_work(struct b43legacy_wldev *dev)
2296 {
2297     unsigned int state;
2298
2299     state = dev->periodic_state;
2300     if (state % 8 == 0)
2301         b43legacy_periodic_every120sec(dev);
2302     if (state % 4 == 0)
2303         b43legacy_periodic_every60sec(dev);
2304     if (state % 2 == 0)
2305         b43legacy_periodic_every30sec(dev);
2306     b43legacy_periodic_every15sec(dev);
2307 }
2308
2309 /* Periodic work locking policy:
2310  *  The whole periodic work handler is protected by
2311  *  wl->mutex. If another lock is needed somewhere in the
2312  *  pwork callchain, it's acquired in-place, where it's needed.
2313  */
2314 static void b43legacy_periodic_work_handler(struct work_struct *work)
2315 {
2316     struct b43legacy_wldev *dev = container_of(work, struct b43legacy_wldev,
2317                          periodic_work.work);
2318     struct b43legacy_wl *wl = dev->wl;
2319     unsigned long delay;
2320
2321     mutex_lock(&wl->mutex);
2322
2323     if (unlikely(b43legacy_status(dev) != B43legacy_STAT_STARTED))
2324         goto out;
2325     if (b43legacy_debug(dev, B43legacy_DBG_PWORK_STOP))
2326         goto out_requeue;
2327
2328     do_periodic_work(dev);
2329
2330     dev->periodic_state++;
2331 out_requeue:
2332     if (b43legacy_debug(dev, B43legacy_DBG_PWORK_FAST))
2333         delay = msecs_to_jiffies(50);
2334     else
2335         delay = round_jiffies_relative(HZ * 15);
2336     ieee80211_queue_delayed_work(wl->hw, &dev->periodic_work, delay);
2337 out:
2338     mutex_unlock(&wl->mutex);
2339 }
2340
2341 static void b43legacy_periodic_tasks_setup(struct b43legacy_wldev *dev)
2342 {
2343     struct delayed_work *work = &dev->periodic_work;
2344
2345     dev->periodic_state = 0;
2346     INIT_DELAYED_WORK(work, b43legacy_periodic_work_handler);
2347     ieee80211_queue_delayed_work(dev->wl->hw, work, 0);
2348 }
2349
2350 /* Validate access to the chip (SHM) */
2351 static int b43legacy_validate_chipaccess(struct b43legacy_wldev *dev)
2352 {
2353     u32 value;
2354     u32 shm_backup;
2355
2356     shm_backup = b43legacy_shm_read32(dev, B43legacy_SHM_SHARED, 0);
2357     b43legacy_shm_write32(dev, B43legacy_SHM_SHARED, 0, 0xAA5555AA);
2358     if (b43legacy_shm_read32(dev, B43legacy_SHM_SHARED, 0) !=
2359                  0xAA5555AA)
2360         goto error;
2361     b43legacy_shm_write32(dev, B43legacy_SHM_SHARED, 0, 0x55AAAA55);
2362     if (b43legacy_shm_read32(dev, B43legacy_SHM_SHARED, 0) !=
2363                  0x55AAAA55)
2364         goto error;
2365     b43legacy_shm_write32(dev, B43legacy_SHM_SHARED, 0, shm_backup);
2366
2367     value = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
2368     if ((value | B43legacy_MACCTL_GMODE) !=
2369         (B43legacy_MACCTL_GMODE | B43legacy_MACCTL_IHR_ENABLED))
2370         goto error;
2371
2372     value = b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_REASON);
2373     if (value)
2374         goto error;
2375
2376     return 0;
2377 error:
2378     b43legacyerr(dev->wl, "Failed to validate the chipaccess\n");
2379     return -ENODEV;
2380 }
2381
2382 static void b43legacy_security_init(struct b43legacy_wldev *dev)
2383 {
2384     dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
2385     B43legacy_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
2386     dev->ktp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2387                     0x0056);
2388     /* KTP is a word address, but we address SHM bytewise.
2389      * So multiply by two.
2390      */
2391     dev->ktp *= 2;
2392     if (dev->dev->id.revision >= 5)
2393         /* Number of RCMTA address slots */
2394         b43legacy_write16(dev, B43legacy_MMIO_RCMTA_COUNT,
2395                   dev->max_nr_keys - 8);
2396 }
2397
2398 #ifdef CONFIG_B43LEGACY_HWRNG
2399 static int b43legacy_rng_read(struct hwrng *rng, u32 *data)
2400 {
2401     struct b43legacy_wl *wl = (struct b43legacy_wl *)rng->priv;
2402     unsigned long flags;
2403
2404     /* Don't take wl->mutex here, as it could deadlock with
2405      * hwrng internal locking. It's not needed to take
2406      * wl->mutex here, anyway. */
2407
2408     spin_lock_irqsave(&wl->irq_lock, flags);
2409     *data = b43legacy_read16(wl->current_dev, B43legacy_MMIO_RNG);
2410     spin_unlock_irqrestore(&wl->irq_lock, flags);
2411
2412     return (sizeof(u16));
2413 }
2414 #endif
2415
2416 static void b43legacy_rng_exit(struct b43legacy_wl *wl)
2417 {
2418 #ifdef CONFIG_B43LEGACY_HWRNG
2419     if (wl->rng_initialized)
2420         hwrng_unregister(&wl->rng);
2421 #endif
2422 }
2423
2424 static int b43legacy_rng_init(struct b43legacy_wl *wl)
2425 {
2426     int err = 0;
2427
2428 #ifdef CONFIG_B43LEGACY_HWRNG
2429     snprintf(wl->rng_name, ARRAY_SIZE(wl->rng_name),
2430          "%s_%s", KBUILD_MODNAME, wiphy_name(wl->hw->wiphy));
2431     wl->rng.name = wl->rng_name;
2432     wl->rng.data_read = b43legacy_rng_read;
2433     wl->rng.priv = (unsigned long)wl;
2434     wl->rng_initialized = 1;
2435     err = hwrng_register(&wl->rng);
2436     if (err) {
2437         wl->rng_initialized = 0;
2438         b43legacyerr(wl, "Failed to register the random "
2439                "number generator (%d)\n", err);
2440     }
2441
2442 #endif
2443     return err;
2444 }
2445
2446 static void b43legacy_tx_work(struct work_struct *work)
2447 {
2448     struct b43legacy_wl *wl = container_of(work, struct b43legacy_wl,
2449                   tx_work);
2450     struct b43legacy_wldev *dev;
2451     struct sk_buff *skb;
2452     int queue_num;
2453     int err = 0;
2454
2455     mutex_lock(&wl->mutex);
2456     dev = wl->current_dev;
2457     if (unlikely(!dev || b43legacy_status(dev) < B43legacy_STAT_STARTED)) {
2458         mutex_unlock(&wl->mutex);
2459         return;
2460     }
2461
2462     for (queue_num = 0; queue_num < B43legacy_QOS_QUEUE_NUM; queue_num++) {
2463         while (skb_queue_len(&wl->tx_queue[queue_num])) {
2464             skb = skb_dequeue(&wl->tx_queue[queue_num]);
2465             if (b43legacy_using_pio(dev))
2466                 err = b43legacy_pio_tx(dev, skb);
2467             else
2468                 err = b43legacy_dma_tx(dev, skb);
2469             if (err == -ENOSPC) {
2470                 wl->tx_queue_stopped[queue_num] = 1;
2471                 ieee80211_stop_queue(wl->hw, queue_num);
2472                 skb_queue_head(&wl->tx_queue[queue_num], skb);
2473                 break;
2474             }
2475             if (unlikely(err))
2476                 dev_kfree_skb(skb); /* Drop it */
2477             err = 0;
2478         }
2479
2480         if (!err)
2481             wl->tx_queue_stopped[queue_num] = 0;
2482     }
2483
2484     mutex_unlock(&wl->mutex);
2485 }
2486
2487 static void b43legacy_op_tx(struct ieee80211_hw *hw,
2488                 struct ieee80211_tx_control *control,
2489                 struct sk_buff *skb)
2490 {
2491     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2492
2493     if (unlikely(skb->len < 2 + 2 + 6)) {
2494         /* Too short, this can't be a valid frame. */
2495         dev_kfree_skb_any(skb);
2496         return;
2497     }
2498     B43legacy_WARN_ON(skb_shinfo(skb)->nr_frags);
2499
2500     skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
2501     if (!wl->tx_queue_stopped[skb->queue_mapping])
2502         ieee80211_queue_work(wl->hw, &wl->tx_work);
2503     else
2504         ieee80211_stop_queue(wl->hw, skb->queue_mapping);
2505 }
2506
2507 static int b43legacy_op_conf_tx(struct ieee80211_hw *hw,
2508                 struct ieee80211_vif *vif,
2509                 unsigned int link_id, u16 queue,
2510                 const struct ieee80211_tx_queue_params *params)
2511 {
2512     return 0;
2513 }
2514
2515 static int b43legacy_op_get_stats(struct ieee80211_hw *hw,
2516                   struct ieee80211_low_level_stats *stats)
2517 {
2518     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2519     unsigned long flags;
2520
2521     spin_lock_irqsave(&wl->irq_lock, flags);
2522     memcpy(stats, &wl->ieee_stats, sizeof(*stats));
2523     spin_unlock_irqrestore(&wl->irq_lock, flags);
2524
2525     return 0;
2526 }
2527
2528 static const char *phymode_to_string(unsigned int phymode)
2529 {
2530     switch (phymode) {
2531     case B43legacy_PHYMODE_B:
2532         return "B";
2533     case B43legacy_PHYMODE_G:
2534         return "G";
2535     default:
2536         B43legacy_BUG_ON(1);
2537     }
2538     return "";
2539 }
2540
2541 static int find_wldev_for_phymode(struct b43legacy_wl *wl,
2542                   unsigned int phymode,
2543                   struct b43legacy_wldev **dev,
2544                   bool *gmode)
2545 {
2546     struct b43legacy_wldev *d;
2547
2548     list_for_each_entry(d, &wl->devlist, list) {
2549         if (d->phy.possible_phymodes & phymode) {
2550             /* Ok, this device supports the PHY-mode.
2551              * Set the gmode bit. */
2552             *gmode = true;
2553             *dev = d;
2554
2555             return 0;
2556         }
2557     }
2558
2559     return -ESRCH;
2560 }
2561
2562 static void b43legacy_put_phy_into_reset(struct b43legacy_wldev *dev)
2563 {
2564     struct ssb_device *sdev = dev->dev;
2565     u32 tmslow;
2566
2567     tmslow = ssb_read32(sdev, SSB_TMSLOW);
2568     tmslow &= ~B43legacy_TMSLOW_GMODE;
2569     tmslow |= B43legacy_TMSLOW_PHYRESET;
2570     tmslow |= SSB_TMSLOW_FGC;
2571     ssb_write32(sdev, SSB_TMSLOW, tmslow);
2572     msleep(1);
2573
2574     tmslow = ssb_read32(sdev, SSB_TMSLOW);
2575     tmslow &= ~SSB_TMSLOW_FGC;
2576     tmslow |= B43legacy_TMSLOW_PHYRESET;
2577     ssb_write32(sdev, SSB_TMSLOW, tmslow);
2578     msleep(1);
2579 }
2580
2581 /* Expects wl->mutex locked */
2582 static int b43legacy_switch_phymode(struct b43legacy_wl *wl,
2583                       unsigned int new_mode)
2584 {
2585     struct b43legacy_wldev *up_dev;
2586     struct b43legacy_wldev *down_dev;
2587     int err;
2588     bool gmode = false;
2589     int prev_status;
2590
2591     err = find_wldev_for_phymode(wl, new_mode, &up_dev, &gmode);
2592     if (err) {
2593         b43legacyerr(wl, "Could not find a device for %s-PHY mode\n",
2594                phymode_to_string(new_mode));
2595         return err;
2596     }
2597     if ((up_dev == wl->current_dev) &&
2598         (!!wl->current_dev->phy.gmode == !!gmode))
2599         /* This device is already running. */
2600         return 0;
2601     b43legacydbg(wl, "Reconfiguring PHYmode to %s-PHY\n",
2602            phymode_to_string(new_mode));
2603     down_dev = wl->current_dev;
2604
2605     prev_status = b43legacy_status(down_dev);
2606     /* Shutdown the currently running core. */
2607     if (prev_status >= B43legacy_STAT_STARTED)
2608         b43legacy_wireless_core_stop(down_dev);
2609     if (prev_status >= B43legacy_STAT_INITIALIZED)
2610         b43legacy_wireless_core_exit(down_dev);
2611
2612     if (down_dev != up_dev)
2613         /* We switch to a different core, so we put PHY into
2614          * RESET on the old core. */
2615         b43legacy_put_phy_into_reset(down_dev);
2616
2617     /* Now start the new core. */
2618     up_dev->phy.gmode = gmode;
2619     if (prev_status >= B43legacy_STAT_INITIALIZED) {
2620         err = b43legacy_wireless_core_init(up_dev);
2621         if (err) {
2622             b43legacyerr(wl, "Fatal: Could not initialize device"
2623                      " for newly selected %s-PHY mode\n",
2624                      phymode_to_string(new_mode));
2625             goto init_failure;
2626         }
2627     }
2628     if (prev_status >= B43legacy_STAT_STARTED) {
2629         err = b43legacy_wireless_core_start(up_dev);
2630         if (err) {
2631             b43legacyerr(wl, "Fatal: Could not start device for "
2632                    "newly selected %s-PHY mode\n",
2633                    phymode_to_string(new_mode));
2634             b43legacy_wireless_core_exit(up_dev);
2635             goto init_failure;
2636         }
2637     }
2638     B43legacy_WARN_ON(b43legacy_status(up_dev) != prev_status);
2639
2640     b43legacy_shm_write32(up_dev, B43legacy_SHM_SHARED, 0x003E, 0);
2641
2642     wl->current_dev = up_dev;
2643
2644     return 0;
2645 init_failure:
2646     /* Whoops, failed to init the new core. No core is operating now. */
2647     wl->current_dev = NULL;
2648     return err;
2649 }
2650
2651 /* Write the short and long frame retry limit values. */
2652 static void b43legacy_set_retry_limits(struct b43legacy_wldev *dev,
2653                        unsigned int short_retry,
2654                        unsigned int long_retry)
2655 {
2656     /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
2657      * the chip-internal counter. */
2658     short_retry = min(short_retry, (unsigned int)0xF);
2659     long_retry = min(long_retry, (unsigned int)0xF);
2660
2661     b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, 0x0006, short_retry);
2662     b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS, 0x0007, long_retry);
2663 }
2664
2665 static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
2666                    u32 changed)
2667 {
2668     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2669     struct b43legacy_wldev *dev;
2670     struct b43legacy_phy *phy;
2671     struct ieee80211_conf *conf = &hw->conf;
2672     unsigned long flags;
2673     unsigned int new_phymode = 0xFFFF;
2674     int antenna_tx;
2675     int err = 0;
2676
2677     antenna_tx = B43legacy_ANTENNA_DEFAULT;
2678
2679     mutex_lock(&wl->mutex);
2680     dev = wl->current_dev;
2681     phy = &dev->phy;
2682
2683     if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
2684         b43legacy_set_retry_limits(dev,
2685                        conf->short_frame_max_tx_count,
2686                        conf->long_frame_max_tx_count);
2687     changed &= ~IEEE80211_CONF_CHANGE_RETRY_LIMITS;
2688     if (!changed)
2689         goto out_unlock_mutex;
2690
2691     /* Switch the PHY mode (if necessary). */
2692     switch (conf->chandef.chan->band) {
2693     case NL80211_BAND_2GHZ:
2694         if (phy->type == B43legacy_PHYTYPE_B)
2695             new_phymode = B43legacy_PHYMODE_B;
2696         else
2697             new_phymode = B43legacy_PHYMODE_G;
2698         break;
2699     default:
2700         B43legacy_WARN_ON(1);
2701     }
2702     err = b43legacy_switch_phymode(wl, new_phymode);
2703     if (err)
2704         goto out_unlock_mutex;
2705
2706     /* Disable IRQs while reconfiguring the device.
2707      * This makes it possible to drop the spinlock throughout
2708      * the reconfiguration process. */
2709     spin_lock_irqsave(&wl->irq_lock, flags);
2710     if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
2711         spin_unlock_irqrestore(&wl->irq_lock, flags);
2712         goto out_unlock_mutex;
2713     }
2714     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, 0);
2715     spin_unlock_irqrestore(&wl->irq_lock, flags);
2716     b43legacy_synchronize_irq(dev);
2717
2718     /* Switch to the requested channel.
2719      * The firmware takes care of races with the TX handler. */
2720     if (conf->chandef.chan->hw_value != phy->channel)
2721         b43legacy_radio_selectchannel(dev, conf->chandef.chan->hw_value,
2722                           0);
2723
2724     dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_MONITOR);
2725
2726     /* Adjust the desired TX power level. */
2727     if (conf->power_level != 0) {
2728         if (conf->power_level != phy->power_level) {
2729             phy->power_level = conf->power_level;
2730             b43legacy_phy_xmitpower(dev);
2731         }
2732     }
2733
2734     /* Antennas for RX and management frame TX. */
2735     b43legacy_mgmtframe_txantenna(dev, antenna_tx);
2736
2737     if (wl->radio_enabled != phy->radio_on) {
2738         if (wl->radio_enabled) {
2739             b43legacy_radio_turn_on(dev);
2740             b43legacyinfo(dev->wl, "Radio turned on by software\n");
2741             if (!dev->radio_hw_enable)
2742                 b43legacyinfo(dev->wl, "The hardware RF-kill"
2743                           " button still turns the radio"
2744                           " physically off. Press the"
2745                           " button to turn it on.\n");
2746         } else {
2747             b43legacy_radio_turn_off(dev, 0);
2748             b43legacyinfo(dev->wl, "Radio turned off by"
2749                       " software\n");
2750         }
2751     }
2752
2753     spin_lock_irqsave(&wl->irq_lock, flags);
2754     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2755     spin_unlock_irqrestore(&wl->irq_lock, flags);
2756 out_unlock_mutex:
2757     mutex_unlock(&wl->mutex);
2758
2759     return err;
2760 }
2761
2762 static void b43legacy_update_basic_rates(struct b43legacy_wldev *dev, u32 brates)
2763 {
2764     struct ieee80211_supported_band *sband =
2765         dev->wl->hw->wiphy->bands[NL80211_BAND_2GHZ];
2766     const struct ieee80211_rate *rate;
2767     int i;
2768     u16 basic, direct, offset, basic_offset, rateptr;
2769
2770     for (i = 0; i < sband->n_bitrates; i++) {
2771         rate = &sband->bitrates[i];
2772
2773         if (b43legacy_is_cck_rate(rate->hw_value)) {
2774             direct = B43legacy_SHM_SH_CCKDIRECT;
2775             basic = B43legacy_SHM_SH_CCKBASIC;
2776             offset = b43legacy_plcp_get_ratecode_cck(rate->hw_value);
2777             offset &= 0xF;
2778         } else {
2779             direct = B43legacy_SHM_SH_OFDMDIRECT;
2780             basic = B43legacy_SHM_SH_OFDMBASIC;
2781             offset = b43legacy_plcp_get_ratecode_ofdm(rate->hw_value);
2782             offset &= 0xF;
2783         }
2784
2785         rate = ieee80211_get_response_rate(sband, brates, rate->bitrate);
2786
2787         if (b43legacy_is_cck_rate(rate->hw_value)) {
2788             basic_offset = b43legacy_plcp_get_ratecode_cck(rate->hw_value);
2789             basic_offset &= 0xF;
2790         } else {
2791             basic_offset = b43legacy_plcp_get_ratecode_ofdm(rate->hw_value);
2792             basic_offset &= 0xF;
2793         }
2794
2795         /*
2796          * Get the pointer that we need to point to
2797          * from the direct map
2798          */
2799         rateptr = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED,
2800                            direct + 2 * basic_offset);
2801         /* and write it to the basic map */
2802         b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
2803                       basic + 2 * offset, rateptr);
2804     }
2805 }
2806
2807 static void b43legacy_op_bss_info_changed(struct ieee80211_hw *hw,
2808                     struct ieee80211_vif *vif,
2809                     struct ieee80211_bss_conf *conf,
2810                     u64 changed)
2811 {
2812     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2813     struct b43legacy_wldev *dev;
2814     unsigned long flags;
2815
2816     mutex_lock(&wl->mutex);
2817     B43legacy_WARN_ON(wl->vif != vif);
2818
2819     dev = wl->current_dev;
2820
2821     /* Disable IRQs while reconfiguring the device.
2822      * This makes it possible to drop the spinlock throughout
2823      * the reconfiguration process. */
2824     spin_lock_irqsave(&wl->irq_lock, flags);
2825     if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
2826         spin_unlock_irqrestore(&wl->irq_lock, flags);
2827         goto out_unlock_mutex;
2828     }
2829     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, 0);
2830
2831     if (changed & BSS_CHANGED_BSSID) {
2832         b43legacy_synchronize_irq(dev);
2833
2834         if (conf->bssid)
2835             memcpy(wl->bssid, conf->bssid, ETH_ALEN);
2836         else
2837             eth_zero_addr(wl->bssid);
2838     }
2839
2840     if (b43legacy_status(dev) >= B43legacy_STAT_INITIALIZED) {
2841         if (changed & BSS_CHANGED_BEACON &&
2842             (b43legacy_is_mode(wl, NL80211_IFTYPE_AP) ||
2843              b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC)))
2844             b43legacy_update_templates(wl);
2845
2846         if (changed & BSS_CHANGED_BSSID)
2847             b43legacy_write_mac_bssid_templates(dev);
2848     }
2849     spin_unlock_irqrestore(&wl->irq_lock, flags);
2850
2851     b43legacy_mac_suspend(dev);
2852
2853     if (changed & BSS_CHANGED_BEACON_INT &&
2854         (b43legacy_is_mode(wl, NL80211_IFTYPE_AP) ||
2855          b43legacy_is_mode(wl, NL80211_IFTYPE_ADHOC)))
2856         b43legacy_set_beacon_int(dev, conf->beacon_int);
2857
2858     if (changed & BSS_CHANGED_BASIC_RATES)
2859         b43legacy_update_basic_rates(dev, conf->basic_rates);
2860
2861     if (changed & BSS_CHANGED_ERP_SLOT) {
2862         if (conf->use_short_slot)
2863             b43legacy_short_slot_timing_enable(dev);
2864         else
2865             b43legacy_short_slot_timing_disable(dev);
2866     }
2867
2868     b43legacy_mac_enable(dev);
2869
2870     spin_lock_irqsave(&wl->irq_lock, flags);
2871     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2872     /* XXX: why? */
2873     spin_unlock_irqrestore(&wl->irq_lock, flags);
2874  out_unlock_mutex:
2875     mutex_unlock(&wl->mutex);
2876 }
2877
2878 static void b43legacy_op_configure_filter(struct ieee80211_hw *hw,
2879                       unsigned int changed,
2880                       unsigned int *fflags,u64 multicast)
2881 {
2882     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
2883     struct b43legacy_wldev *dev = wl->current_dev;
2884     unsigned long flags;
2885
2886     if (!dev) {
2887         *fflags = 0;
2888         return;
2889     }
2890
2891     spin_lock_irqsave(&wl->irq_lock, flags);
2892     *fflags &= FIF_ALLMULTI |
2893           FIF_FCSFAIL |
2894           FIF_PLCPFAIL |
2895           FIF_CONTROL |
2896           FIF_OTHER_BSS |
2897           FIF_BCN_PRBRESP_PROMISC;
2898
2899     changed &= FIF_ALLMULTI |
2900            FIF_FCSFAIL |
2901            FIF_PLCPFAIL |
2902            FIF_CONTROL |
2903            FIF_OTHER_BSS |
2904            FIF_BCN_PRBRESP_PROMISC;
2905
2906     wl->filter_flags = *fflags;
2907
2908     if (changed && b43legacy_status(dev) >= B43legacy_STAT_INITIALIZED)
2909         b43legacy_adjust_opmode(dev);
2910     spin_unlock_irqrestore(&wl->irq_lock, flags);
2911 }
2912
2913 /* Locking: wl->mutex */
2914 static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev)
2915 {
2916     struct b43legacy_wl *wl = dev->wl;
2917     unsigned long flags;
2918     int queue_num;
2919
2920     if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
2921         return;
2922
2923     /* Disable and sync interrupts. We must do this before than
2924      * setting the status to INITIALIZED, as the interrupt handler
2925      * won't care about IRQs then. */
2926     spin_lock_irqsave(&wl->irq_lock, flags);
2927     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, 0);
2928     b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK); /* flush */
2929     spin_unlock_irqrestore(&wl->irq_lock, flags);
2930     b43legacy_synchronize_irq(dev);
2931
2932     b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
2933
2934     mutex_unlock(&wl->mutex);
2935     /* Must unlock as it would otherwise deadlock. No races here.
2936      * Cancel the possibly running self-rearming periodic work. */
2937     cancel_delayed_work_sync(&dev->periodic_work);
2938     cancel_work_sync(&wl->tx_work);
2939     mutex_lock(&wl->mutex);
2940
2941     /* Drain all TX queues. */
2942     for (queue_num = 0; queue_num < B43legacy_QOS_QUEUE_NUM; queue_num++) {
2943         while (skb_queue_len(&wl->tx_queue[queue_num]))
2944             dev_kfree_skb(skb_dequeue(&wl->tx_queue[queue_num]));
2945     }
2946
2947     b43legacy_mac_suspend(dev);
2948     free_irq(dev->dev->irq, dev);
2949     b43legacydbg(wl, "Wireless interface stopped\n");
2950 }
2951
2952 /* Locking: wl->mutex */
2953 static int b43legacy_wireless_core_start(struct b43legacy_wldev *dev)
2954 {
2955     int err;
2956
2957     B43legacy_WARN_ON(b43legacy_status(dev) != B43legacy_STAT_INITIALIZED);
2958
2959     drain_txstatus_queue(dev);
2960     err = request_irq(dev->dev->irq, b43legacy_interrupt_handler,
2961               IRQF_SHARED, KBUILD_MODNAME, dev);
2962     if (err) {
2963         b43legacyerr(dev->wl, "Cannot request IRQ-%d\n",
2964                dev->dev->irq);
2965         goto out;
2966     }
2967     /* We are ready to run. */
2968     ieee80211_wake_queues(dev->wl->hw);
2969     b43legacy_set_status(dev, B43legacy_STAT_STARTED);
2970
2971     /* Start data flow (TX/RX) */
2972     b43legacy_mac_enable(dev);
2973     b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_MASK, dev->irq_mask);
2974
2975     /* Start maintenance work */
2976     b43legacy_periodic_tasks_setup(dev);
2977
2978     b43legacydbg(dev->wl, "Wireless interface started\n");
2979 out:
2980     return err;
2981 }
2982
2983 /* Get PHY and RADIO versioning numbers */
2984 static int b43legacy_phy_versioning(struct b43legacy_wldev *dev)
2985 {
2986     struct b43legacy_phy *phy = &dev->phy;
2987     u32 tmp;
2988     u8 analog_type;
2989     u8 phy_type;
2990     u8 phy_rev;
2991     u16 radio_manuf;
2992     u16 radio_ver;
2993     u16 radio_rev;
2994     int unsupported = 0;
2995
2996     /* Get PHY versioning */
2997     tmp = b43legacy_read16(dev, B43legacy_MMIO_PHY_VER);
2998     analog_type = (tmp & B43legacy_PHYVER_ANALOG)
2999               >> B43legacy_PHYVER_ANALOG_SHIFT;
3000     phy_type = (tmp & B43legacy_PHYVER_TYPE) >> B43legacy_PHYVER_TYPE_SHIFT;
3001     phy_rev = (tmp & B43legacy_PHYVER_VERSION);
3002     switch (phy_type) {
3003     case B43legacy_PHYTYPE_B:
3004         if (phy_rev != 2 && phy_rev != 4
3005             && phy_rev != 6 && phy_rev != 7)
3006             unsupported = 1;
3007         break;
3008     case B43legacy_PHYTYPE_G:
3009         if (phy_rev > 8)
3010             unsupported = 1;
3011         break;
3012     default:
3013         unsupported = 1;
3014     }
3015     if (unsupported) {
3016         b43legacyerr(dev->wl, "FOUND UNSUPPORTED PHY "
3017                "(Analog %u, Type %u, Revision %u)\n",
3018                analog_type, phy_type, phy_rev);
3019         return -EOPNOTSUPP;
3020     }
3021     b43legacydbg(dev->wl, "Found PHY: Analog %u, Type %u, Revision %u\n",
3022            analog_type, phy_type, phy_rev);
3023
3024
3025     /* Get RADIO versioning */
3026     if (dev->dev->bus->chip_id == 0x4317) {
3027         if (dev->dev->bus->chip_rev == 0)
3028             tmp = 0x3205017F;
3029         else if (dev->dev->bus->chip_rev == 1)
3030             tmp = 0x4205017F;
3031         else
3032             tmp = 0x5205017F;
3033     } else {
3034         b43legacy_write16(dev, B43legacy_MMIO_RADIO_CONTROL,
3035                   B43legacy_RADIOCTL_ID);
3036         tmp = b43legacy_read16(dev, B43legacy_MMIO_RADIO_DATA_HIGH);
3037         tmp <<= 16;
3038         b43legacy_write16(dev, B43legacy_MMIO_RADIO_CONTROL,
3039                   B43legacy_RADIOCTL_ID);
3040         tmp |= b43legacy_read16(dev, B43legacy_MMIO_RADIO_DATA_LOW);
3041     }
3042     radio_manuf = (tmp & 0x00000FFF);
3043     radio_ver = (tmp & 0x0FFFF000) >> 12;
3044     radio_rev = (tmp & 0xF0000000) >> 28;
3045     switch (phy_type) {
3046     case B43legacy_PHYTYPE_B:
3047         if ((radio_ver & 0xFFF0) != 0x2050)
3048             unsupported = 1;
3049         break;
3050     case B43legacy_PHYTYPE_G:
3051         if (radio_ver != 0x2050)
3052             unsupported = 1;
3053         break;
3054     default:
3055         B43legacy_BUG_ON(1);
3056     }
3057     if (unsupported) {
3058         b43legacyerr(dev->wl, "FOUND UNSUPPORTED RADIO "
3059                "(Manuf 0x%X, Version 0x%X, Revision %u)\n",
3060                radio_manuf, radio_ver, radio_rev);
3061         return -EOPNOTSUPP;
3062     }
3063     b43legacydbg(dev->wl, "Found Radio: Manuf 0x%X, Version 0x%X,"
3064              " Revision %u\n", radio_manuf, radio_ver, radio_rev);
3065
3066
3067     phy->radio_manuf = radio_manuf;
3068     phy->radio_ver = radio_ver;
3069     phy->radio_rev = radio_rev;
3070
3071     phy->analog = analog_type;
3072     phy->type = phy_type;
3073     phy->rev = phy_rev;
3074
3075     return 0;
3076 }
3077
3078 static void setup_struct_phy_for_init(struct b43legacy_wldev *dev,
3079                       struct b43legacy_phy *phy)
3080 {
3081     struct b43legacy_lopair *lo;
3082     int i;
3083
3084     memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3085     memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3086
3087     /* Assume the radio is enabled. If it's not enabled, the state will
3088      * immediately get fixed on the first periodic work run. */
3089     dev->radio_hw_enable = true;
3090
3091     phy->savedpctlreg = 0xFFFF;
3092     phy->aci_enable = false;
3093     phy->aci_wlan_automatic = false;
3094     phy->aci_hw_rssi = false;
3095
3096     lo = phy->_lo_pairs;
3097     if (lo)
3098         memset(lo, 0, sizeof(struct b43legacy_lopair) *
3099                      B43legacy_LO_COUNT);
3100     phy->max_lb_gain = 0;
3101     phy->trsw_rx_gain = 0;
3102
3103     /* Set default attenuation values. */
3104     phy->bbatt = b43legacy_default_baseband_attenuation(dev);
3105     phy->rfatt = b43legacy_default_radio_attenuation(dev);
3106     phy->txctl1 = b43legacy_default_txctl1(dev);
3107     phy->txpwr_offset = 0;
3108
3109     /* NRSSI */
3110     phy->nrssislope = 0;
3111     for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3112         phy->nrssi[i] = -1000;
3113     for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3114         phy->nrssi_lt[i] = i;
3115
3116     phy->lofcal = 0xFFFF;
3117     phy->initval = 0xFFFF;
3118
3119     phy->interfmode = B43legacy_INTERFMODE_NONE;
3120     phy->channel = 0xFF;
3121 }
3122
3123 static void setup_struct_wldev_for_init(struct b43legacy_wldev *dev)
3124 {
3125     /* Flags */
3126     dev->dfq_valid = false;
3127
3128     /* Stats */
3129     memset(&dev->stats, 0, sizeof(dev->stats));
3130
3131     setup_struct_phy_for_init(dev, &dev->phy);
3132
3133     /* IRQ related flags */
3134     dev->irq_reason = 0;
3135     memset(dev->dma_reason, 0, sizeof(dev->dma_reason));
3136     dev->irq_mask = B43legacy_IRQ_MASKTEMPLATE;
3137
3138     dev->mac_suspended = 1;
3139
3140     /* Noise calculation context */
3141     memset(&dev->noisecalc, 0, sizeof(dev->noisecalc));
3142 }
3143
3144 static void b43legacy_set_synth_pu_delay(struct b43legacy_wldev *dev,
3145                       bool idle) {
3146     u16 pu_delay = 1050;
3147
3148     if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_ADHOC) || idle)
3149         pu_delay = 500;
3150     if ((dev->phy.radio_ver == 0x2050) && (dev->phy.radio_rev == 8))
3151         pu_delay = max(pu_delay, (u16)2400);
3152
3153     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3154                   B43legacy_SHM_SH_SPUWKUP, pu_delay);
3155 }
3156
3157 /* Set the TSF CFP pre-TargetBeaconTransmissionTime. */
3158 static void b43legacy_set_pretbtt(struct b43legacy_wldev *dev)
3159 {
3160     u16 pretbtt;
3161
3162     /* The time value is in microseconds. */
3163     if (b43legacy_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
3164         pretbtt = 2;
3165     else
3166         pretbtt = 250;
3167     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3168                   B43legacy_SHM_SH_PRETBTT, pretbtt);
3169     b43legacy_write16(dev, B43legacy_MMIO_TSF_CFP_PRETBTT, pretbtt);
3170 }
3171
3172 /* Shutdown a wireless core */
3173 /* Locking: wl->mutex */
3174 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
3175 {
3176     struct b43legacy_phy *phy = &dev->phy;
3177     u32 macctl;
3178
3179     B43legacy_WARN_ON(b43legacy_status(dev) > B43legacy_STAT_INITIALIZED);
3180     if (b43legacy_status(dev) != B43legacy_STAT_INITIALIZED)
3181         return;
3182     b43legacy_set_status(dev, B43legacy_STAT_UNINIT);
3183
3184     /* Stop the microcode PSM. */
3185     macctl = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
3186     macctl &= ~B43legacy_MACCTL_PSM_RUN;
3187     macctl |= B43legacy_MACCTL_PSM_JMP0;
3188     b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
3189
3190     b43legacy_leds_exit(dev);
3191     b43legacy_rng_exit(dev->wl);
3192     b43legacy_pio_free(dev);
3193     b43legacy_dma_free(dev);
3194     b43legacy_chip_exit(dev);
3195     b43legacy_radio_turn_off(dev, 1);
3196     b43legacy_switch_analog(dev, 0);
3197     if (phy->dyn_tssi_tbl)
3198         kfree(phy->tssi2dbm);
3199     kfree(phy->lo_control);
3200     phy->lo_control = NULL;
3201     if (dev->wl->current_beacon) {
3202         dev_kfree_skb_any(dev->wl->current_beacon);
3203         dev->wl->current_beacon = NULL;
3204     }
3205
3206     ssb_device_disable(dev->dev, 0);
3207     ssb_bus_may_powerdown(dev->dev->bus);
3208 }
3209
3210 static void prepare_phy_data_for_init(struct b43legacy_wldev *dev)
3211 {
3212     struct b43legacy_phy *phy = &dev->phy;
3213     int i;
3214
3215     /* Set default attenuation values. */
3216     phy->bbatt = b43legacy_default_baseband_attenuation(dev);
3217     phy->rfatt = b43legacy_default_radio_attenuation(dev);
3218     phy->txctl1 = b43legacy_default_txctl1(dev);
3219     phy->txctl2 = 0xFFFF;
3220     phy->txpwr_offset = 0;
3221
3222     /* NRSSI */
3223     phy->nrssislope = 0;
3224     for (i = 0; i < ARRAY_SIZE(phy->nrssi); i++)
3225         phy->nrssi[i] = -1000;
3226     for (i = 0; i < ARRAY_SIZE(phy->nrssi_lt); i++)
3227         phy->nrssi_lt[i] = i;
3228
3229     phy->lofcal = 0xFFFF;
3230     phy->initval = 0xFFFF;
3231
3232     phy->aci_enable = false;
3233     phy->aci_wlan_automatic = false;
3234     phy->aci_hw_rssi = false;
3235
3236     phy->antenna_diversity = 0xFFFF;
3237     memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
3238     memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
3239
3240     /* Flags */
3241     phy->calibrated = 0;
3242
3243     if (phy->_lo_pairs)
3244         memset(phy->_lo_pairs, 0,
3245                sizeof(struct b43legacy_lopair) * B43legacy_LO_COUNT);
3246     memset(phy->loopback_gain, 0, sizeof(phy->loopback_gain));
3247 }
3248
3249 /* Initialize a wireless core */
3250 static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
3251 {
3252     struct b43legacy_wl *wl = dev->wl;
3253     struct ssb_bus *bus = dev->dev->bus;
3254     struct b43legacy_phy *phy = &dev->phy;
3255     struct ssb_sprom *sprom = &dev->dev->bus->sprom;
3256     int err;
3257     u32 hf;
3258     u32 tmp;
3259
3260     B43legacy_WARN_ON(b43legacy_status(dev) != B43legacy_STAT_UNINIT);
3261
3262     err = ssb_bus_powerup(bus, 0);
3263     if (err)
3264         goto out;
3265     if (!ssb_device_is_enabled(dev->dev)) {
3266         tmp = phy->gmode ? B43legacy_TMSLOW_GMODE : 0;
3267         b43legacy_wireless_core_reset(dev, tmp);
3268     }
3269
3270     if ((phy->type == B43legacy_PHYTYPE_B) ||
3271         (phy->type == B43legacy_PHYTYPE_G)) {
3272         phy->_lo_pairs = kcalloc(B43legacy_LO_COUNT,
3273                      sizeof(struct b43legacy_lopair),
3274                      GFP_KERNEL);
3275         if (!phy->_lo_pairs)
3276             return -ENOMEM;
3277     }
3278     setup_struct_wldev_for_init(dev);
3279
3280     err = b43legacy_phy_init_tssi2dbm_table(dev);
3281     if (err)
3282         goto err_kfree_lo_control;
3283
3284     /* Enable IRQ routing to this device. */
3285     ssb_pcicore_dev_irqvecs_enable(&bus->pcicore, dev->dev);
3286
3287     prepare_phy_data_for_init(dev);
3288     b43legacy_phy_calibrate(dev);
3289     err = b43legacy_chip_init(dev);
3290     if (err)
3291         goto err_kfree_tssitbl;
3292     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3293                   B43legacy_SHM_SH_WLCOREREV,
3294                   dev->dev->id.revision);
3295     hf = b43legacy_hf_read(dev);
3296     if (phy->type == B43legacy_PHYTYPE_G) {
3297         hf |= B43legacy_HF_SYMW;
3298         if (phy->rev == 1)
3299             hf |= B43legacy_HF_GDCW;
3300         if (sprom->boardflags_lo & B43legacy_BFL_PACTRL)
3301             hf |= B43legacy_HF_OFDMPABOOST;
3302     } else if (phy->type == B43legacy_PHYTYPE_B) {
3303         hf |= B43legacy_HF_SYMW;
3304         if (phy->rev >= 2 && phy->radio_ver == 0x2050)
3305             hf &= ~B43legacy_HF_GDCW;
3306     }
3307     b43legacy_hf_write(dev, hf);
3308
3309     b43legacy_set_retry_limits(dev,
3310                    B43legacy_DEFAULT_SHORT_RETRY_LIMIT,
3311                    B43legacy_DEFAULT_LONG_RETRY_LIMIT);
3312
3313     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3314                   0x0044, 3);
3315     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3316                   0x0046, 2);
3317
3318     /* Disable sending probe responses from firmware.
3319      * Setting the MaxTime to one usec will always trigger
3320      * a timeout, so we never send any probe resp.
3321      * A timeout of zero is infinite. */
3322     b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
3323                   B43legacy_SHM_SH_PRMAXTIME, 1);
3324
3325     b43legacy_rate_memory_init(dev);
3326
3327     /* Minimum Contention Window */
3328     if (phy->type == B43legacy_PHYTYPE_B)
3329         b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
3330                       0x0003, 31);
3331     else
3332         b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
3333                       0x0003, 15);
3334     /* Maximum Contention Window */
3335     b43legacy_shm_write16(dev, B43legacy_SHM_WIRELESS,
3336                   0x0004, 1023);
3337
3338     do {
3339         if (b43legacy_using_pio(dev))
3340             err = b43legacy_pio_init(dev);
3341         else {
3342             err = b43legacy_dma_init(dev);
3343             if (!err)
3344                 b43legacy_qos_init(dev);
3345         }
3346     } while (err == -EAGAIN);
3347     if (err)
3348         goto err_chip_exit;
3349
3350     b43legacy_set_synth_pu_delay(dev, 1);
3351
3352     ssb_bus_powerup(bus, 1); /* Enable dynamic PCTL */
3353     b43legacy_upload_card_macaddress(dev);
3354     b43legacy_security_init(dev);
3355     b43legacy_rng_init(wl);
3356
3357     ieee80211_wake_queues(dev->wl->hw);
3358     b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
3359
3360     b43legacy_leds_init(dev);
3361 out:
3362     return err;
3363
3364 err_chip_exit:
3365     b43legacy_chip_exit(dev);
3366 err_kfree_tssitbl:
3367     if (phy->dyn_tssi_tbl)
3368         kfree(phy->tssi2dbm);
3369 err_kfree_lo_control:
3370     kfree(phy->lo_control);
3371     phy->lo_control = NULL;
3372     ssb_bus_may_powerdown(bus);
3373     B43legacy_WARN_ON(b43legacy_status(dev) != B43legacy_STAT_UNINIT);
3374     return err;
3375 }
3376
3377 static int b43legacy_op_add_interface(struct ieee80211_hw *hw,
3378                       struct ieee80211_vif *vif)
3379 {
3380     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3381     struct b43legacy_wldev *dev;
3382     unsigned long flags;
3383     int err = -EOPNOTSUPP;
3384
3385     /* TODO: allow AP devices to coexist */
3386
3387     if (vif->type != NL80211_IFTYPE_AP &&
3388         vif->type != NL80211_IFTYPE_STATION &&
3389         vif->type != NL80211_IFTYPE_ADHOC)
3390         return -EOPNOTSUPP;
3391
3392     mutex_lock(&wl->mutex);
3393     if (wl->operating)
3394         goto out_mutex_unlock;
3395
3396     b43legacydbg(wl, "Adding Interface type %d\n", vif->type);
3397
3398     dev = wl->current_dev;
3399     wl->operating = true;
3400     wl->vif = vif;
3401     wl->if_type = vif->type;
3402     memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
3403
3404     spin_lock_irqsave(&wl->irq_lock, flags);
3405     b43legacy_adjust_opmode(dev);
3406     b43legacy_set_pretbtt(dev);
3407     b43legacy_set_synth_pu_delay(dev, 0);
3408     b43legacy_upload_card_macaddress(dev);
3409     spin_unlock_irqrestore(&wl->irq_lock, flags);
3410
3411     err = 0;
3412  out_mutex_unlock:
3413     mutex_unlock(&wl->mutex);
3414
3415     return err;
3416 }
3417
3418 static void b43legacy_op_remove_interface(struct ieee80211_hw *hw,
3419                       struct ieee80211_vif *vif)
3420 {
3421     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3422     struct b43legacy_wldev *dev = wl->current_dev;
3423     unsigned long flags;
3424
3425     b43legacydbg(wl, "Removing Interface type %d\n", vif->type);
3426
3427     mutex_lock(&wl->mutex);
3428
3429     B43legacy_WARN_ON(!wl->operating);
3430     B43legacy_WARN_ON(wl->vif != vif);
3431     wl->vif = NULL;
3432
3433     wl->operating = false;
3434
3435     spin_lock_irqsave(&wl->irq_lock, flags);
3436     b43legacy_adjust_opmode(dev);
3437     eth_zero_addr(wl->mac_addr);
3438     b43legacy_upload_card_macaddress(dev);
3439     spin_unlock_irqrestore(&wl->irq_lock, flags);
3440
3441     mutex_unlock(&wl->mutex);
3442 }
3443
3444 static int b43legacy_op_start(struct ieee80211_hw *hw)
3445 {
3446     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3447     struct b43legacy_wldev *dev = wl->current_dev;
3448     int did_init = 0;
3449     int err = 0;
3450
3451     /* Kill all old instance specific information to make sure
3452      * the card won't use it in the short timeframe between start
3453      * and mac80211 reconfiguring it. */
3454     eth_zero_addr(wl->bssid);
3455     eth_zero_addr(wl->mac_addr);
3456     wl->filter_flags = 0;
3457     wl->beacon0_uploaded = false;
3458     wl->beacon1_uploaded = false;
3459     wl->beacon_templates_virgin = true;
3460     wl->radio_enabled = true;
3461
3462     mutex_lock(&wl->mutex);
3463
3464     if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
3465         err = b43legacy_wireless_core_init(dev);
3466         if (err)
3467             goto out_mutex_unlock;
3468         did_init = 1;
3469     }
3470
3471     if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
3472         err = b43legacy_wireless_core_start(dev);
3473         if (err) {
3474             if (did_init)
3475                 b43legacy_wireless_core_exit(dev);
3476             goto out_mutex_unlock;
3477         }
3478     }
3479
3480     wiphy_rfkill_start_polling(hw->wiphy);
3481
3482 out_mutex_unlock:
3483     mutex_unlock(&wl->mutex);
3484
3485     return err;
3486 }
3487
3488 static void b43legacy_op_stop(struct ieee80211_hw *hw)
3489 {
3490     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3491     struct b43legacy_wldev *dev = wl->current_dev;
3492
3493     cancel_work_sync(&(wl->beacon_update_trigger));
3494
3495     mutex_lock(&wl->mutex);
3496     if (b43legacy_status(dev) >= B43legacy_STAT_STARTED)
3497         b43legacy_wireless_core_stop(dev);
3498     b43legacy_wireless_core_exit(dev);
3499     wl->radio_enabled = false;
3500     mutex_unlock(&wl->mutex);
3501 }
3502
3503 static int b43legacy_op_beacon_set_tim(struct ieee80211_hw *hw,
3504                        struct ieee80211_sta *sta, bool set)
3505 {
3506     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3507     unsigned long flags;
3508
3509     spin_lock_irqsave(&wl->irq_lock, flags);
3510     b43legacy_update_templates(wl);
3511     spin_unlock_irqrestore(&wl->irq_lock, flags);
3512
3513     return 0;
3514 }
3515
3516 static int b43legacy_op_get_survey(struct ieee80211_hw *hw, int idx,
3517                    struct survey_info *survey)
3518 {
3519     struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
3520     struct b43legacy_wldev *dev = wl->current_dev;
3521     struct ieee80211_conf *conf = &hw->conf;
3522
3523     if (idx != 0)
3524         return -ENOENT;
3525
3526     survey->channel = conf->chandef.chan;
3527     survey->filled = SURVEY_INFO_NOISE_DBM;
3528     survey->noise = dev->stats.link_noise;
3529
3530     return 0;
3531 }
3532
3533 static const struct ieee80211_ops b43legacy_hw_ops = {
3534     .tx         = b43legacy_op_tx,
3535     .conf_tx        = b43legacy_op_conf_tx,
3536     .add_interface      = b43legacy_op_add_interface,
3537     .remove_interface   = b43legacy_op_remove_interface,
3538     .config         = b43legacy_op_dev_config,
3539     .bss_info_changed   = b43legacy_op_bss_info_changed,
3540     .configure_filter   = b43legacy_op_configure_filter,
3541     .get_stats      = b43legacy_op_get_stats,
3542     .start          = b43legacy_op_start,
3543     .stop           = b43legacy_op_stop,
3544     .set_tim        = b43legacy_op_beacon_set_tim,
3545     .get_survey     = b43legacy_op_get_survey,
3546     .rfkill_poll        = b43legacy_rfkill_poll,
3547 };
3548
3549 /* Hard-reset the chip. Do not call this directly.
3550  * Use b43legacy_controller_restart()
3551  */
3552 static void b43legacy_chip_reset(struct work_struct *work)
3553 {
3554     struct b43legacy_wldev *dev =
3555         container_of(work, struct b43legacy_wldev, restart_work);
3556     struct b43legacy_wl *wl = dev->wl;
3557     int err = 0;
3558     int prev_status;
3559
3560     mutex_lock(&wl->mutex);
3561
3562     prev_status = b43legacy_status(dev);
3563     /* Bring the device down... */
3564     if (prev_status >= B43legacy_STAT_STARTED)
3565         b43legacy_wireless_core_stop(dev);
3566     if (prev_status >= B43legacy_STAT_INITIALIZED)
3567         b43legacy_wireless_core_exit(dev);
3568
3569     /* ...and up again. */
3570     if (prev_status >= B43legacy_STAT_INITIALIZED) {
3571         err = b43legacy_wireless_core_init(dev);
3572         if (err)
3573             goto out;
3574     }
3575     if (prev_status >= B43legacy_STAT_STARTED) {
3576         err = b43legacy_wireless_core_start(dev);
3577         if (err) {
3578             b43legacy_wireless_core_exit(dev);
3579             goto out;
3580         }
3581     }
3582 out:
3583     if (err)
3584         wl->current_dev = NULL; /* Failed to init the dev. */
3585     mutex_unlock(&wl->mutex);
3586     if (err)
3587         b43legacyerr(wl, "Controller restart FAILED\n");
3588     else
3589         b43legacyinfo(wl, "Controller restarted\n");
3590 }
3591
3592 static int b43legacy_setup_modes(struct b43legacy_wldev *dev,
3593                  int have_bphy,
3594                  int have_gphy)
3595 {
3596     struct ieee80211_hw *hw = dev->wl->hw;
3597     struct b43legacy_phy *phy = &dev->phy;
3598
3599     phy->possible_phymodes = 0;
3600     if (have_bphy) {
3601         hw->wiphy->bands[NL80211_BAND_2GHZ] =
3602             &b43legacy_band_2GHz_BPHY;
3603         phy->possible_phymodes |= B43legacy_PHYMODE_B;
3604     }
3605
3606     if (have_gphy) {
3607         hw->wiphy->bands[NL80211_BAND_2GHZ] =
3608             &b43legacy_band_2GHz_GPHY;
3609         phy->possible_phymodes |= B43legacy_PHYMODE_G;
3610     }
3611
3612     return 0;
3613 }
3614
3615 static void b43legacy_wireless_core_detach(struct b43legacy_wldev *dev)
3616 {
3617     /* We release firmware that late to not be required to re-request
3618      * is all the time when we reinit the core. */
3619     b43legacy_release_firmware(dev);
3620 }
3621
3622 static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
3623 {
3624     struct b43legacy_wl *wl = dev->wl;
3625     struct ssb_bus *bus = dev->dev->bus;
3626     struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
3627     int err;
3628     int have_bphy = 0;
3629     int have_gphy = 0;
3630     u32 tmp;
3631
3632     /* Do NOT do any device initialization here.
3633      * Do it in wireless_core_init() instead.
3634      * This function is for gathering basic information about the HW, only.
3635      * Also some structs may be set up here. But most likely you want to
3636      * have that in core_init(), too.
3637      */
3638
3639     err = ssb_bus_powerup(bus, 0);
3640     if (err) {
3641         b43legacyerr(wl, "Bus powerup failed\n");
3642         goto out;
3643     }
3644     /* Get the PHY type. */
3645     if (dev->dev->id.revision >= 5) {
3646         u32 tmshigh;
3647
3648         tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
3649         have_gphy = !!(tmshigh & B43legacy_TMSHIGH_GPHY);
3650         if (!have_gphy)
3651             have_bphy = 1;
3652     } else if (dev->dev->id.revision == 4)
3653         have_gphy = 1;
3654     else
3655         have_bphy = 1;
3656
3657     dev->phy.gmode = (have_gphy || have_bphy);
3658     dev->phy.radio_on = true;
3659     tmp = dev->phy.gmode ? B43legacy_TMSLOW_GMODE : 0;
3660     b43legacy_wireless_core_reset(dev, tmp);
3661
3662     err = b43legacy_phy_versioning(dev);
3663     if (err)
3664         goto err_powerdown;
3665     /* Check if this device supports multiband. */
3666     if (!pdev ||
3667         (pdev->device != 0x4312 &&
3668          pdev->device != 0x4319 &&
3669          pdev->device != 0x4324)) {
3670         /* No multiband support. */
3671         have_bphy = 0;
3672         have_gphy = 0;
3673         switch (dev->phy.type) {
3674         case B43legacy_PHYTYPE_B:
3675             have_bphy = 1;
3676             break;
3677         case B43legacy_PHYTYPE_G:
3678             have_gphy = 1;
3679             break;
3680         default:
3681             B43legacy_BUG_ON(1);
3682         }
3683     }
3684     dev->phy.gmode = (have_gphy || have_bphy);
3685     tmp = dev->phy.gmode ? B43legacy_TMSLOW_GMODE : 0;
3686     b43legacy_wireless_core_reset(dev, tmp);
3687
3688     err = b43legacy_validate_chipaccess(dev);
3689     if (err)
3690         goto err_powerdown;
3691     err = b43legacy_setup_modes(dev, have_bphy, have_gphy);
3692     if (err)
3693         goto err_powerdown;
3694
3695     /* Now set some default "current_dev" */
3696     if (!wl->current_dev)
3697         wl->current_dev = dev;
3698     INIT_WORK(&dev->restart_work, b43legacy_chip_reset);
3699
3700     b43legacy_radio_turn_off(dev, 1);
3701     b43legacy_switch_analog(dev, 0);
3702     ssb_device_disable(dev->dev, 0);
3703     ssb_bus_may_powerdown(bus);
3704
3705 out:
3706     return err;
3707
3708 err_powerdown:
3709     ssb_bus_may_powerdown(bus);
3710     return err;
3711 }
3712
3713 static void b43legacy_one_core_detach(struct ssb_device *dev)
3714 {
3715     struct b43legacy_wldev *wldev;
3716     struct b43legacy_wl *wl;
3717
3718     /* Do not cancel ieee80211-workqueue based work here.
3719      * See comment in b43legacy_remove(). */
3720
3721     wldev = ssb_get_drvdata(dev);
3722     wl = wldev->wl;
3723     b43legacy_debugfs_remove_device(wldev);
3724     b43legacy_wireless_core_detach(wldev);
3725     list_del(&wldev->list);
3726     wl->nr_devs--;
3727     ssb_set_drvdata(dev, NULL);
3728     kfree(wldev);
3729 }
3730
3731 static int b43legacy_one_core_attach(struct ssb_device *dev,
3732                      struct b43legacy_wl *wl)
3733 {
3734     struct b43legacy_wldev *wldev;
3735     int err = -ENOMEM;
3736
3737     wldev = kzalloc(sizeof(*wldev), GFP_KERNEL);
3738     if (!wldev)
3739         goto out;
3740
3741     wldev->dev = dev;
3742     wldev->wl = wl;
3743     b43legacy_set_status(wldev, B43legacy_STAT_UNINIT);
3744     wldev->bad_frames_preempt = modparam_bad_frames_preempt;
3745     tasklet_setup(&wldev->isr_tasklet, b43legacy_interrupt_tasklet);
3746     if (modparam_pio)
3747         wldev->__using_pio = true;
3748     INIT_LIST_HEAD(&wldev->list);
3749
3750     err = b43legacy_wireless_core_attach(wldev);
3751     if (err)
3752         goto err_kfree_wldev;
3753
3754     list_add(&wldev->list, &wl->devlist);
3755     wl->nr_devs++;
3756     ssb_set_drvdata(dev, wldev);
3757     b43legacy_debugfs_add_device(wldev);
3758 out:
3759     return err;
3760
3761 err_kfree_wldev:
3762     kfree(wldev);
3763     return err;
3764 }
3765
3766 static void b43legacy_sprom_fixup(struct ssb_bus *bus)
3767 {
3768     /* boardflags workarounds */
3769     if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
3770         bus->boardinfo.type == 0x4E &&
3771         bus->sprom.board_rev > 0x40)
3772         bus->sprom.boardflags_lo |= B43legacy_BFL_PACTRL;
3773 }
3774
3775 static void b43legacy_wireless_exit(struct ssb_device *dev,
3776                   struct b43legacy_wl *wl)
3777 {
3778     struct ieee80211_hw *hw = wl->hw;
3779
3780     ssb_set_devtypedata(dev, NULL);
3781     ieee80211_free_hw(hw);
3782 }
3783
3784 static int b43legacy_wireless_init(struct ssb_device *dev)
3785 {
3786     struct ssb_sprom *sprom = &dev->bus->sprom;
3787     struct ieee80211_hw *hw;
3788     struct b43legacy_wl *wl;
3789     int err = -ENOMEM;
3790     int queue_num;
3791
3792     b43legacy_sprom_fixup(dev->bus);
3793
3794     hw = ieee80211_alloc_hw(sizeof(*wl), &b43legacy_hw_ops);
3795     if (!hw) {
3796         b43legacyerr(NULL, "Could not allocate ieee80211 device\n");
3797         goto out;
3798     }
3799
3800     /* fill hw info */
3801     ieee80211_hw_set(hw, RX_INCLUDES_FCS);
3802     ieee80211_hw_set(hw, SIGNAL_DBM);
3803     ieee80211_hw_set(hw, MFP_CAPABLE); /* Allow WPA3 in software */
3804
3805     hw->wiphy->interface_modes =
3806         BIT(NL80211_IFTYPE_AP) |
3807         BIT(NL80211_IFTYPE_STATION) |
3808         BIT(NL80211_IFTYPE_ADHOC);
3809     hw->queues = 1; /* FIXME: hardware has more queues */
3810     hw->max_rates = 2;
3811     SET_IEEE80211_DEV(hw, dev->dev);
3812     if (is_valid_ether_addr(sprom->et1mac))
3813         SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
3814     else
3815         SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
3816
3817     wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
3818
3819     /* Get and initialize struct b43legacy_wl */
3820     wl = hw_to_b43legacy_wl(hw);
3821     memset(wl, 0, sizeof(*wl));
3822     wl->hw = hw;
3823     spin_lock_init(&wl->irq_lock);
3824     spin_lock_init(&wl->leds_lock);
3825     mutex_init(&wl->mutex);
3826     INIT_LIST_HEAD(&wl->devlist);
3827     INIT_WORK(&wl->beacon_update_trigger, b43legacy_beacon_update_trigger_work);
3828     INIT_WORK(&wl->tx_work, b43legacy_tx_work);
3829
3830     /* Initialize queues and flags. */
3831     for (queue_num = 0; queue_num < B43legacy_QOS_QUEUE_NUM; queue_num++) {
3832         skb_queue_head_init(&wl->tx_queue[queue_num]);
3833         wl->tx_queue_stopped[queue_num] = 0;
3834     }
3835
3836     ssb_set_devtypedata(dev, wl);
3837     b43legacyinfo(wl, "Broadcom %04X WLAN found (core revision %u)\n",
3838               dev->bus->chip_id, dev->id.revision);
3839     err = 0;
3840 out:
3841     return err;
3842 }
3843
3844 static int b43legacy_probe(struct ssb_device *dev,
3845              const struct ssb_device_id *id)
3846 {
3847     struct b43legacy_wl *wl;
3848     int err;
3849     int first = 0;
3850
3851     wl = ssb_get_devtypedata(dev);
3852     if (!wl) {
3853         /* Probing the first core - setup common struct b43legacy_wl */
3854         first = 1;
3855         err = b43legacy_wireless_init(dev);
3856         if (err)
3857             goto out;
3858         wl = ssb_get_devtypedata(dev);
3859         B43legacy_WARN_ON(!wl);
3860     }
3861     err = b43legacy_one_core_attach(dev, wl);
3862     if (err)
3863         goto err_wireless_exit;
3864
3865     /* setup and start work to load firmware */
3866     INIT_WORK(&wl->firmware_load, b43legacy_request_firmware);
3867     schedule_work(&wl->firmware_load);
3868
3869 out:
3870     return err;
3871
3872 err_wireless_exit:
3873     if (first)
3874         b43legacy_wireless_exit(dev, wl);
3875     return err;
3876 }
3877
3878 static void b43legacy_remove(struct ssb_device *dev)
3879 {
3880     struct b43legacy_wl *wl = ssb_get_devtypedata(dev);
3881     struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
3882
3883     /* We must cancel any work here before unregistering from ieee80211,
3884      * as the ieee80211 unreg will destroy the workqueue. */
3885     cancel_work_sync(&wldev->restart_work);
3886     cancel_work_sync(&wl->firmware_load);
3887     complete(&wldev->fw_load_complete);
3888
3889     B43legacy_WARN_ON(!wl);
3890     if (!wldev->fw.ucode)
3891         return;         /* NULL if fw never loaded */
3892     if (wl->current_dev == wldev)
3893         ieee80211_unregister_hw(wl->hw);
3894
3895     b43legacy_one_core_detach(dev);
3896
3897     if (list_empty(&wl->devlist))
3898         /* Last core on the chip unregistered.
3899          * We can destroy common struct b43legacy_wl.
3900          */
3901         b43legacy_wireless_exit(dev, wl);
3902 }
3903
3904 /* Perform a hardware reset. This can be called from any context. */
3905 void b43legacy_controller_restart(struct b43legacy_wldev *dev,
3906                   const char *reason)
3907 {
3908     /* Must avoid requeueing, if we are in shutdown. */
3909     if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED)
3910         return;
3911     b43legacyinfo(dev->wl, "Controller RESET (%s) ...\n", reason);
3912     ieee80211_queue_work(dev->wl->hw, &dev->restart_work);
3913 }
3914
3915 #ifdef CONFIG_PM
3916
3917 static int b43legacy_suspend(struct ssb_device *dev, pm_message_t state)
3918 {
3919     struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
3920     struct b43legacy_wl *wl = wldev->wl;
3921
3922     b43legacydbg(wl, "Suspending...\n");
3923
3924     mutex_lock(&wl->mutex);
3925     wldev->suspend_init_status = b43legacy_status(wldev);
3926     if (wldev->suspend_init_status >= B43legacy_STAT_STARTED)
3927         b43legacy_wireless_core_stop(wldev);
3928     if (wldev->suspend_init_status >= B43legacy_STAT_INITIALIZED)
3929         b43legacy_wireless_core_exit(wldev);
3930     mutex_unlock(&wl->mutex);
3931
3932     b43legacydbg(wl, "Device suspended.\n");
3933
3934     return 0;
3935 }
3936
3937 static int b43legacy_resume(struct ssb_device *dev)
3938 {
3939     struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
3940     struct b43legacy_wl *wl = wldev->wl;
3941     int err = 0;
3942
3943     b43legacydbg(wl, "Resuming...\n");
3944
3945     mutex_lock(&wl->mutex);
3946     if (wldev->suspend_init_status >= B43legacy_STAT_INITIALIZED) {
3947         err = b43legacy_wireless_core_init(wldev);
3948         if (err) {
3949             b43legacyerr(wl, "Resume failed at core init\n");
3950             goto out;
3951         }
3952     }
3953     if (wldev->suspend_init_status >= B43legacy_STAT_STARTED) {
3954         err = b43legacy_wireless_core_start(wldev);
3955         if (err) {
3956             b43legacy_wireless_core_exit(wldev);
3957             b43legacyerr(wl, "Resume failed at core start\n");
3958             goto out;
3959         }
3960     }
3961
3962     b43legacydbg(wl, "Device resumed.\n");
3963 out:
3964     mutex_unlock(&wl->mutex);
3965     return err;
3966 }
3967
3968 #else   /* CONFIG_PM */
3969 # define b43legacy_suspend  NULL
3970 # define b43legacy_resume       NULL
3971 #endif  /* CONFIG_PM */
3972
3973 static struct ssb_driver b43legacy_ssb_driver = {
3974     .name       = KBUILD_MODNAME,
3975     .id_table   = b43legacy_ssb_tbl,
3976     .probe      = b43legacy_probe,
3977     .remove     = b43legacy_remove,
3978     .suspend    = b43legacy_suspend,
3979     .resume     = b43legacy_resume,
3980 };
3981
3982 static void b43legacy_print_driverinfo(void)
3983 {
3984     const char *feat_pci = "", *feat_leds = "",
3985            *feat_pio = "", *feat_dma = "";
3986
3987 #ifdef CONFIG_B43LEGACY_PCI_AUTOSELECT
3988     feat_pci = "P";
3989 #endif
3990 #ifdef CONFIG_B43LEGACY_LEDS
3991     feat_leds = "L";
3992 #endif
3993 #ifdef CONFIG_B43LEGACY_PIO
3994     feat_pio = "I";
3995 #endif
3996 #ifdef CONFIG_B43LEGACY_DMA
3997     feat_dma = "D";
3998 #endif
3999     printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
4000            "[ Features: %s%s%s%s ]\n",
4001            feat_pci, feat_leds, feat_pio, feat_dma);
4002 }
4003
4004 static int __init b43legacy_init(void)
4005 {
4006     int err;
4007
4008     b43legacy_debugfs_init();
4009
4010     err = ssb_driver_register(&b43legacy_ssb_driver);
4011     if (err)
4012         goto err_dfs_exit;
4013
4014     b43legacy_print_driverinfo();
4015
4016     return err;
4017
4018 err_dfs_exit:
4019     b43legacy_debugfs_exit();
4020     return err;
4021 }
4022
4023 static void __exit b43legacy_exit(void)
4024 {
4025     ssb_driver_unregister(&b43legacy_ssb_driver);
4026     b43legacy_debugfs_exit();
4027 }
4028
4029 module_init(b43legacy_init)
4030 module_exit(b43legacy_exit)