Upgrade b43 and mac80211.
authorMichael Büsch <mb@bu3sch.de>
Fri, 15 Feb 2008 22:47:47 +0000 (22:47 +0000)
committerMichael Büsch <mb@bu3sch.de>
Fri, 15 Feb 2008 22:47:47 +0000 (22:47 +0000)
This also temporarly disables hostapd support for mac80211, as hostapd needs patches to compile against latest mac80211.
Will do that in a seperate patch.

SVN-Revision: 10466

103 files changed:
package/b43/Makefile
package/b43/src/Kconfig
package/b43/src/Makefile
package/b43/src/b43.h
package/b43/src/debugfs.c
package/b43/src/dma.c
package/b43/src/dma.h
package/b43/src/leds.c
package/b43/src/lo.c
package/b43/src/main.c
package/b43/src/main.h
package/b43/src/nphy.c [new file with mode: 0644]
package/b43/src/nphy.h [new file with mode: 0644]
package/b43/src/pcmcia.c
package/b43/src/phy.c
package/b43/src/phy.h
package/b43/src/pio.c [deleted file]
package/b43/src/pio.h [deleted file]
package/b43/src/rfkill.c
package/b43/src/rfkill.h
package/b43/src/sysfs.c
package/b43/src/tables.c
package/b43/src/tables.h
package/b43/src/tables_nphy.c [new file with mode: 0644]
package/b43/src/tables_nphy.h [new file with mode: 0644]
package/b43/src/wa.c [new file with mode: 0644]
package/b43/src/wa.h [new file with mode: 0644]
package/b43/src/xmit.c
package/b43/src/xmit.h
package/hostapd/files/default.config
package/hostapd/files/mini.config
package/mac80211/Makefile
package/mac80211/patches/000-mac80211_update.patch [deleted file]
package/mac80211/patches/001-port-to-2.6.23.patch [new file with mode: 0644]
package/mac80211/patches/008-add-hostapd-ioctl-header.patch [deleted file]
package/mac80211/patches/009-add-old-ioctl-skeleton.patch [deleted file]
package/mac80211/patches/010-add-mgmt-iface.patch [deleted file]
package/mac80211/patches/011-allow-ap-vlan-modes.patch [deleted file]
package/mac80211/patches/012-mac80211-allow-wds.patch [deleted file]
package/mac80211/patches/013-prism2-ioctl-bridge-packets.patch [deleted file]
package/mac80211/patches/014-prism2-ioctl-8021x.patch [deleted file]
package/mac80211/patches/015-hostapd-ioctl-hw-features.patch [deleted file]
package/mac80211/patches/016-prism2-ioctl-eapol.patch [deleted file]
package/mac80211/patches/017-nl80211-add-key-mgmt.patch [deleted file]
package/mac80211/patches/018-mac80211-cfg80211-keys.patch [deleted file]
package/mac80211/patches/019-mac80211-key-seq-nl80211.patch [deleted file]
package/mac80211/patches/020-nl80211-beacon-parameters.patch [deleted file]
package/mac80211/patches/021-mac80211-beacon-via-nl80211.patch [deleted file]
package/mac80211/patches/022-nl80211-sta.patch [deleted file]
package/mac80211/patches/023-mac80211-implement-sta.patch [deleted file]
package/mac80211/patches/024-nl80211-get-sta.patch [deleted file]
package/mac80211/patches/025-mac80211-get-sta.patch [deleted file]
package/mac80211/src/include/linux/ieee80211.h
package/mac80211/src/include/linux/nl80211.h
package/mac80211/src/include/net/cfg80211.h
package/mac80211/src/include/net/mac80211.h
package/mac80211/src/include/net/wireless.h [new file with mode: 0644]
package/mac80211/src/net/mac80211/Kconfig
package/mac80211/src/net/mac80211/Makefile
package/mac80211/src/net/mac80211/aes_ccm.c
package/mac80211/src/net/mac80211/cfg.c
package/mac80211/src/net/mac80211/debugfs.c
package/mac80211/src/net/mac80211/debugfs_key.c
package/mac80211/src/net/mac80211/debugfs_netdev.c
package/mac80211/src/net/mac80211/debugfs_sta.c
package/mac80211/src/net/mac80211/event.c
package/mac80211/src/net/mac80211/ieee80211.c
package/mac80211/src/net/mac80211/ieee80211_common.h [deleted file]
package/mac80211/src/net/mac80211/ieee80211_i.h
package/mac80211/src/net/mac80211/ieee80211_iface.c
package/mac80211/src/net/mac80211/ieee80211_ioctl.c
package/mac80211/src/net/mac80211/ieee80211_led.c
package/mac80211/src/net/mac80211/ieee80211_led.h
package/mac80211/src/net/mac80211/ieee80211_rate.c
package/mac80211/src/net/mac80211/ieee80211_rate.h
package/mac80211/src/net/mac80211/ieee80211_sta.c
package/mac80211/src/net/mac80211/key.c
package/mac80211/src/net/mac80211/rc80211_pid.h [new file with mode: 0644]
package/mac80211/src/net/mac80211/rc80211_pid_algo.c [new file with mode: 0644]
package/mac80211/src/net/mac80211/rc80211_pid_debugfs.c [new file with mode: 0644]
package/mac80211/src/net/mac80211/rc80211_simple.c
package/mac80211/src/net/mac80211/regdomain.c [deleted file]
package/mac80211/src/net/mac80211/rx.c
package/mac80211/src/net/mac80211/sta_info.c
package/mac80211/src/net/mac80211/sta_info.h
package/mac80211/src/net/mac80211/tkip.c
package/mac80211/src/net/mac80211/tx.c
package/mac80211/src/net/mac80211/util.c
package/mac80211/src/net/mac80211/wep.c
package/mac80211/src/net/mac80211/wep.h
package/mac80211/src/net/mac80211/wme.c
package/mac80211/src/net/mac80211/wme.h
package/mac80211/src/net/mac80211/wpa.c
package/mac80211/src/net/mac80211/wpa.h
package/mac80211/src/net/wireless/Kconfig
package/mac80211/src/net/wireless/Makefile
package/mac80211/src/net/wireless/core.c
package/mac80211/src/net/wireless/core.h
package/mac80211/src/net/wireless/nl80211.c
package/mac80211/src/net/wireless/reg.c [new file with mode: 0644]
package/mac80211/src/net/wireless/sysfs.c
package/mac80211/src/net/wireless/util.c [new file with mode: 0644]
package/mac80211/src/net/wireless/wext.c [new file with mode: 0644]

index c4cc91f..e47d516 100644 (file)
@@ -23,11 +23,11 @@ PKG_FWV4_SOURCE_URL:=http://downloads.openwrt.org/sources/
 PKG_FWV4_MD5SUM:=a7d8dde3ce474c361143b83e1d9890b1
 
 PKG_FWCUTTER_NAME:=b43-fwcutter
-PKG_FWCUTTER_VERSION=008
+PKG_FWCUTTER_VERSION=011
 
 PKG_FWCUTTER_SOURCE:=$(PKG_FWCUTTER_NAME)-$(PKG_FWCUTTER_VERSION).tar.bz2
-PKG_FWCUTTER_SOURCE_URL:=http://download.berlios.de/bcm43xx/
-PKG_FWCUTTER_MD5SUM:=3f7fbf4f8dcd296c6d1b0d42eab0f9ac
+PKG_FWCUTTER_SOURCE_URL:=http://bu3sch.de/b43/fwcutter/
+PKG_FWCUTTER_MD5SUM:=3db2f4de85a459451f5b391cf67a8d44
 
 define KernelPackage/b43
   SUBMENU:=Wireless Drivers
@@ -43,7 +43,6 @@ endef
 
 EXTRA_KCONFIG:= \
        CONFIG_B43=m \
-       CONFIG_B43_DMA=y \
        $(if $(CONFIG_LEDS_TRIGGERS),CONFIG_B43_LEDS=y) \
 
 
@@ -73,6 +72,8 @@ define Build/Prepare
        $(CP) ./src/* $(PKG_BUILD_DIR)/
        tar xjf "$(DL_DIR)/$(PKG_FWV4_SOURCE)" -C "$(PKG_BUILD_DIR)"
        tar xjf "$(DL_DIR)/$(PKG_FWCUTTER_SOURCE)" -C "$(PKG_BUILD_DIR)"
+       $(Build/Patch)
+       $(if $(QUILT),touch $(PKG_BUILD_DIR)/.quilt_used)
 endef
 
 define Build/Configure
index e3c573e..1a2141d 100644 (file)
@@ -61,16 +61,28 @@ config B43_PCMCIA
 
          If unsure, say N.
 
-# LED support
+config B43_NPHY
+       bool "Pre IEEE 802.11n support (BROKEN)"
+       depends on B43 && EXPERIMENTAL && BROKEN
+       ---help---
+         Support for the IEEE 802.11n draft.
+
+         THIS IS BROKEN AND DOES NOT WORK YET.
+
+         SAY N.
+
+# This config option automatically enables b43 LEDS support,
+# if it's possible.
 config B43_LEDS
        bool
-       depends on B43 && MAC80211_LEDS
+       depends on B43 && MAC80211_LEDS && (LEDS_CLASS = y || LEDS_CLASS = B43)
        default y
 
-# RFKILL support
+# This config option automatically enables b43 RFKILL support,
+# if it's possible.
 config B43_RFKILL
        bool
-       depends on B43 && RFKILL && RFKILL_INPUT && INPUT_POLLDEV
+       depends on B43 && (RFKILL = y || RFKILL = B43) && RFKILL_INPUT && (INPUT_POLLDEV = y || INPUT_POLLDEV = B43)
        default y
 
 config B43_DEBUG
@@ -81,51 +93,3 @@ config B43_DEBUG
 
          Say Y, if you want to find out why the driver does not
          work for you.
-
-config B43_DMA
-       bool
-       depends on B43
-config B43_PIO
-       bool
-       depends on B43
-
-choice
-       prompt "Broadcom 43xx data transfer mode"
-       depends on B43
-       default B43_DMA_AND_PIO_MODE
-
-config B43_DMA_AND_PIO_MODE
-       bool "DMA + PIO"
-       select B43_DMA
-       select B43_PIO
-       ---help---
-         Include both, Direct Memory Access (DMA) and Programmed I/O (PIO)
-         data transfer modes.
-         The actually used mode is selectable through the module
-         parameter "pio". If the module parameter is pio=0, DMA is used.
-         Otherwise PIO is used. DMA is default.
-
-         If unsure, choose this option.
-
-config B43_DMA_MODE
-       bool "DMA (Direct Memory Access) only"
-       select B43_DMA
-       ---help---
-         Only include Direct Memory Access (DMA).
-         This reduces the size of the driver module, by omitting the PIO code.
-
-config B43_PIO_MODE
-       bool "PIO (Programmed I/O) only"
-       select B43_PIO
-       ---help---
-         Only include Programmed I/O (PIO).
-         This reduces the size of the driver module, by omitting the DMA code.
-         Please note that PIO transfers are slow (compared to DMA).
-
-         Also note that not all devices of the 43xx series support PIO.
-         The 4306 (Apple Airport Extreme and others) supports PIO, while
-         the 4318 is known to _not_ support PIO.
-
-         Only use PIO, if DMA does not work for you.
-
-endchoice
index 485e59e..ac1329d 100644 (file)
@@ -1,20 +1,16 @@
-# b43 core
 b43-y                          += main.o
 b43-y                          += tables.o
+b43-y                          += tables_nphy.o
 b43-y                          += phy.o
+b43-y                          += nphy.o
 b43-y                          += sysfs.o
 b43-y                          += xmit.o
 b43-y                          += lo.o
-# b43 RFKILL button support
+b43-y                          += wa.o
+b43-y                          += dma.o
 b43-$(CONFIG_B43_RFKILL)       += rfkill.o
-# b43 LED support
 b43-$(CONFIG_B43_LEDS)         += leds.o
-# b43 PCMCIA support
 b43-$(CONFIG_B43_PCMCIA)       += pcmcia.o
-# b43 debugging
 b43-$(CONFIG_B43_DEBUG)                += debugfs.o
-# b43 DMA and PIO
-b43-$(CONFIG_B43_DMA)          += dma.o
-b43-$(CONFIG_B43_PIO)          += pio.o
 
 obj-$(CONFIG_B43)              += b43.o
index a28ad23..0dc1aaf 100644 (file)
@@ -35,8 +35,8 @@
 #define B43_MMIO_DMA4_IRQ_MASK         0x44
 #define B43_MMIO_DMA5_REASON           0x48
 #define B43_MMIO_DMA5_IRQ_MASK         0x4C
-#define B43_MMIO_MACCTL                        0x120
-#define B43_MMIO_STATUS2_BITFIELD      0x124
+#define B43_MMIO_MACCTL                        0x120   /* MAC control */
+#define B43_MMIO_MACCMD                        0x124   /* MAC command */
 #define B43_MMIO_GEN_IRQ_REASON                0x128
 #define B43_MMIO_GEN_IRQ_MASK          0x12C
 #define B43_MMIO_RAM_CONTROL           0x130
@@ -50,6 +50,9 @@
 #define B43_MMIO_XMITSTAT_1            0x174
 #define B43_MMIO_REV3PLUS_TSF_LOW      0x180   /* core rev >= 3 only */
 #define B43_MMIO_REV3PLUS_TSF_HIGH     0x184   /* core rev >= 3 only */
+#define B43_MMIO_TSF_CFP_REP           0x188
+#define B43_MMIO_TSF_CFP_START         0x18C
+#define B43_MMIO_TSF_CFP_MAXDUR                0x190
 
 /* 32-bit DMA */
 #define B43_MMIO_DMA32_BASE0           0x200
 #define B43_MMIO_DMA64_BASE3           0x2C0
 #define B43_MMIO_DMA64_BASE4           0x300
 #define B43_MMIO_DMA64_BASE5           0x340
-/* PIO */
-#define B43_MMIO_PIO1_BASE             0x300
-#define B43_MMIO_PIO2_BASE             0x310
-#define B43_MMIO_PIO3_BASE             0x320
-#define B43_MMIO_PIO4_BASE             0x330
 
 #define B43_MMIO_PHY_VER               0x3E0
 #define B43_MMIO_PHY_RADIO             0x3E2
@@ -88,6 +86,8 @@
 #define B43_MMIO_RADIO_HWENABLED_LO    0x49A
 #define B43_MMIO_GPIO_CONTROL          0x49C
 #define B43_MMIO_GPIO_MASK             0x49E
+#define B43_MMIO_TSF_CFP_START_LOW     0x604
+#define B43_MMIO_TSF_CFP_START_HIGH    0x606
 #define B43_MMIO_TSF_0                 0x632   /* core rev < 3 only */
 #define B43_MMIO_TSF_1                 0x634   /* core rev < 3 only */
 #define B43_MMIO_TSF_2                 0x636   /* core rev < 3 only */
@@ -170,14 +170,17 @@ enum {
 #define B43_SHM_SH_SLOTT               0x0010  /* Slot time */
 #define B43_SHM_SH_DTIMPER             0x0012  /* DTIM period */
 #define B43_SHM_SH_NOSLPZNATDTIM       0x004C  /* NOSLPZNAT DTIM */
-/* SHM_SHARED beacon variables */
+/* SHM_SHARED beacon/AP variables */
 #define B43_SHM_SH_BTL0                        0x0018  /* Beacon template length 0 */
 #define B43_SHM_SH_BTL1                        0x001A  /* Beacon template length 1 */
 #define B43_SHM_SH_BTSFOFF             0x001C  /* Beacon TSF offset */
 #define B43_SHM_SH_TIMBPOS             0x001E  /* TIM B position in beacon */
+#define B43_SHM_SH_DTIMP               0x0012  /* DTIP period */
+#define B43_SHM_SH_MCASTCOOKIE         0x00A8  /* Last bcast/mcast frame ID */
 #define B43_SHM_SH_SFFBLIM             0x0044  /* Short frame fallback retry limit */
 #define B43_SHM_SH_LFFBLIM             0x0046  /* Long frame fallback retry limit */
 #define B43_SHM_SH_BEACPHYCTL          0x0054  /* Beacon PHY TX control word (see PHY TX control) */
+#define B43_SHM_SH_EXTNPHYCTL          0x00B0  /* Extended bytes for beacon PHY control (N) */
 /* SHM_SHARED ACK/CTS control */
 #define B43_SHM_SH_ACKCTSPHYCTL                0x0022  /* ACK/CTS PHY control word (see PHY TX control) */
 /* SHM_SHARED probe response variables */
@@ -273,6 +276,8 @@ enum {
 #define B43_PHYTYPE_A                  0x00
 #define B43_PHYTYPE_B                  0x01
 #define B43_PHYTYPE_G                  0x02
+#define B43_PHYTYPE_N                  0x04
+#define B43_PHYTYPE_LP                 0x05
 
 /* PHYRegisters */
 #define B43_PHY_ILT_A_CTRL             0x0072
@@ -319,17 +324,29 @@ enum {
 #define B43_MACCTL_DISCPMQ             0x40000000      /* Discard Power Management Queue */
 #define B43_MACCTL_GMODE               0x80000000      /* G Mode */
 
-/* 802.11 core specific TM State Low flags */
+/* MAC Command bitfield */
+#define B43_MACCMD_BEACON0_VALID       0x00000001      /* Beacon 0 in template RAM is busy/valid */
+#define B43_MACCMD_BEACON1_VALID       0x00000002      /* Beacon 1 in template RAM is busy/valid */
+#define B43_MACCMD_DFQ_VALID           0x00000004      /* Directed frame queue valid (IBSS PS mode, ATIM) */
+#define B43_MACCMD_CCA                 0x00000008      /* Clear channel assessment */
+#define B43_MACCMD_BGNOISE             0x00000010      /* Background noise */
+
+/* 802.11 core specific TM State Low (SSB_TMSLOW) flags */
 #define B43_TMSLOW_GMODE               0x20000000      /* G Mode Enable */
-#define B43_TMSLOW_PLLREFSEL           0x00200000      /* PLL Frequency Reference Select */
+#define B43_TMSLOW_PHYCLKSPEED         0x00C00000      /* PHY clock speed mask (N-PHY only) */
+#define  B43_TMSLOW_PHYCLKSPEED_40MHZ  0x00000000      /* 40 MHz PHY */
+#define  B43_TMSLOW_PHYCLKSPEED_80MHZ  0x00400000      /* 80 MHz PHY */
+#define  B43_TMSLOW_PHYCLKSPEED_160MHZ 0x00800000      /* 160 MHz PHY */
+#define B43_TMSLOW_PLLREFSEL           0x00200000      /* PLL Frequency Reference Select (rev >= 5) */
 #define B43_TMSLOW_MACPHYCLKEN         0x00100000      /* MAC PHY Clock Control Enable (rev >= 5) */
 #define B43_TMSLOW_PHYRESET            0x00080000      /* PHY Reset */
 #define B43_TMSLOW_PHYCLKEN            0x00040000      /* PHY Clock Enable */
 
-/* 802.11 core specific TM State High flags */
+/* 802.11 core specific TM State High (SSB_TMSHIGH) flags */
+#define B43_TMSHIGH_DUALBAND_PHY       0x00080000      /* Dualband PHY available */
 #define B43_TMSHIGH_FCLOCK             0x00040000      /* Fast Clock Available (rev >= 5) */
-#define B43_TMSHIGH_APHY               0x00020000      /* A-PHY available (rev >= 5) */
-#define B43_TMSHIGH_GPHY               0x00010000      /* G-PHY available (rev >= 5) */
+#define B43_TMSHIGH_HAVE_5GHZ_PHY      0x00020000      /* 5 GHz PHY available (rev >= 5) */
+#define B43_TMSHIGH_HAVE_2GHZ_PHY      0x00010000      /* 2.4 GHz PHY available (rev >= 5) */
 
 /* Generic-Interrupt reasons. */
 #define B43_IRQ_MAC_SUSPENDED          0x00000001
@@ -391,6 +408,8 @@ enum {
 #define B43_DEFAULT_SHORT_RETRY_LIMIT  7
 #define B43_DEFAULT_LONG_RETRY_LIMIT   4
 
+#define B43_PHY_TX_BADNESS_LIMIT       1000
+
 /* Max size of a security key */
 #define B43_SEC_KEYSIZE                        16
 /* Security algorithms. */
@@ -443,10 +462,6 @@ struct b43_phy {
        u8 possible_phymodes;
        /* GMODE bit enabled? */
        bool gmode;
-       /* Possible ieee80211 subsystem hwmodes for this PHY.
-        * Which mode is selected, depends on thr GMODE enabled bit */
-#define B43_MAX_PHYHWMODES     2
-       struct ieee80211_hw_mode hwmodes[B43_MAX_PHYHWMODES];
 
        /* Analog Type */
        u8 analog;
@@ -460,7 +475,6 @@ struct b43_phy {
        u16 radio_ver;          /* Radio version */
        u8 radio_rev;           /* Radio revision */
 
-       bool locked;            /* Only used in b43_phy_{un}lock() */
        bool dyn_tssi_tbl;      /* tssi2dbm is kmalloc()ed. */
 
        /* ACI (adjacent channel interference) flags. */
@@ -497,11 +511,6 @@ struct b43_phy {
        s16 lna_gain;           /* LNA */
        s16 pga_gain;           /* PGA */
 
-       /* PHY lock for core.rev < 3
-        * This lock is only used by b43_phy_{un}lock()
-        */
-       spinlock_t lock;
-
        /* Desired TX power level (in dBm).
         * This is set by the user and adjusted in b43_phy_xmitpower(). */
        u8 power_level;
@@ -512,9 +521,7 @@ struct b43_phy {
        struct b43_bbatt bbatt;
        struct b43_rfatt rfatt;
        u8 tx_control;          /* B43_TXCTL_XXX */
-#ifdef CONFIG_B43_DEBUG
-       bool manual_txpower_control;    /* Manual TX-power control enabled? */
-#endif
+
        /* Hardware Power Control enabled? */
        bool hardware_power_control;
 
@@ -542,6 +549,26 @@ struct b43_phy {
        u16 lofcal;
 
        u16 initval;            //FIXME rename?
+
+       /* PHY TX errors counter. */
+       atomic_t txerr_cnt;
+
+       /* The device does address auto increment for the OFDM tables.
+        * We cache the previously used address here and omit the address
+        * write on the next table access, if possible. */
+       u16 ofdmtab_addr; /* The address currently set in hardware. */
+       enum { /* The last data flow direction. */
+               B43_OFDMTAB_DIRECTION_UNKNOWN = 0,
+               B43_OFDMTAB_DIRECTION_READ,
+               B43_OFDMTAB_DIRECTION_WRITE,
+       } ofdmtab_addr_direction;
+
+#if B43_DEBUG
+       /* Manual TX-power control enabled? */
+       bool manual_txpower_control;
+       /* PHY registers locked by b43_phy_lock()? */
+       bool phy_locked;
+#endif /* B43_DEBUG */
 };
 
 /* Data structures for DMA transmission, per 80211 core. */
@@ -557,14 +584,6 @@ struct b43_dma {
        struct b43_dmaring *rx_ring3;   /* only available on core.rev < 5 */
 };
 
-/* Data structures for PIO transmission, per 80211 core. */
-struct b43_pio {
-       struct b43_pioqueue *queue0;
-       struct b43_pioqueue *queue1;
-       struct b43_pioqueue *queue2;
-       struct b43_pioqueue *queue3;
-};
-
 /* Context information for a noise calculation (Link Quality). */
 struct b43_noise_calculation {
        u8 channel_at_start;
@@ -597,18 +616,18 @@ struct b43_wl {
        /* Pointer to the ieee80211 hardware data structure */
        struct ieee80211_hw *hw;
 
-       spinlock_t irq_lock;
        struct mutex mutex;
+       spinlock_t irq_lock;
+       /* Lock for LEDs access. */
        spinlock_t leds_lock;
+       /* Lock for SHM access. */
+       spinlock_t shm_lock;
 
        /* We can only have one operating interface (802.11 core)
         * at a time. General information about this interface follows.
         */
 
-       /* Opaque ID of the operating interface from the ieee80211
-        * subsystem. Do not modify.
-        */
-       int if_id;
+       struct ieee80211_vif *vif;
        /* The MAC address of the operating interface. */
        u8 mac_addr[ETH_ALEN];
        /* Current BSSID */
@@ -632,18 +651,33 @@ struct b43_wl {
        /* List of all wireless devices on this chip */
        struct list_head devlist;
        u8 nr_devs;
+
+       bool radiotap_enabled;
+
+       /* The beacon we are currently using (AP or IBSS mode).
+        * This beacon stuff is protected by the irq_lock. */
+       struct sk_buff *current_beacon;
+       bool beacon0_uploaded;
+       bool beacon1_uploaded;
+};
+
+/* In-memory representation of a cached microcode file. */
+struct b43_firmware_file {
+       const char *filename;
+       const struct firmware *data;
 };
 
 /* Pointers to the firmware data and meta information about it. */
 struct b43_firmware {
        /* Microcode */
-       const struct firmware *ucode;
+       struct b43_firmware_file ucode;
        /* PCM code */
-       const struct firmware *pcm;
+       struct b43_firmware_file pcm;
        /* Initial MMIO values for the firmware */
-       const struct firmware *initvals;
+       struct b43_firmware_file initvals;
        /* Initial MMIO values for the firmware, band-specific */
-       const struct firmware *initvals_band;
+       struct b43_firmware_file initvals_band;
+
        /* Firmware revision */
        u16 rev;
        /* Firmware patchlevel */
@@ -681,21 +715,16 @@ struct b43_wldev {
        /* Saved init status for handling suspend. */
        int suspend_init_status;
 
-       bool __using_pio;       /* Internal, use b43_using_pio(). */
        bool bad_frames_preempt;        /* Use "Bad Frames Preemption" (default off) */
-       bool reg124_set_0x4;    /* Some variable to keep track of IRQ stuff. */
-       bool short_preamble;    /* TRUE, if short preamble is enabled. */
+       bool dfq_valid;         /* Directed frame queue valid (IBSS PS mode, ATIM) */
        bool short_slot;        /* TRUE, if short slot timing is enabled. */
        bool radio_hw_enable;   /* saved state of radio hardware enabled state */
 
        /* PHY/Radio device. */
        struct b43_phy phy;
-       union {
-               /* DMA engines. */
-               struct b43_dma dma;
-               /* PIO engines. */
-               struct b43_pio pio;
-       };
+
+       /* DMA engines. */
+       struct b43_dma dma;
 
        /* Various statistics about the physical device. */
        struct b43_stats stats;
@@ -730,9 +759,6 @@ struct b43_wldev {
        u8 max_nr_keys;
        struct b43_key key[58];
 
-       /* Cached beacon template while uploading the template. */
-       struct sk_buff *cached_beacon;
-
        /* Firmware data */
        struct b43_firmware fw;
 
@@ -750,28 +776,6 @@ static inline struct b43_wl *hw_to_b43_wl(struct ieee80211_hw *hw)
        return hw->priv;
 }
 
-/* Helper function, which returns a boolean.
- * TRUE, if PIO is used; FALSE, if DMA is used.
- */
-#if defined(CONFIG_B43_DMA) && defined(CONFIG_B43_PIO)
-static inline int b43_using_pio(struct b43_wldev *dev)
-{
-       return dev->__using_pio;
-}
-#elif defined(CONFIG_B43_DMA)
-static inline int b43_using_pio(struct b43_wldev *dev)
-{
-       return 0;
-}
-#elif defined(CONFIG_B43_PIO)
-static inline int b43_using_pio(struct b43_wldev *dev)
-{
-       return 1;
-}
-#else
-# error "Using neither DMA nor PIO? Confused..."
-#endif
-
 static inline struct b43_wldev *dev_to_b43_wldev(struct device *dev)
 {
        struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
index 734e70e..e38ed0f 100644 (file)
@@ -34,7 +34,6 @@
 #include "main.h"
 #include "debugfs.h"
 #include "dma.h"
-#include "pio.h"
 #include "xmit.h"
 
 
@@ -128,7 +127,7 @@ static ssize_t shm_read_file(struct b43_wldev *dev,
        __le16 *le16buf = (__le16 *)buf;
 
        for (i = 0; i < 0x1000; i++) {
-               if (bufsize <= 0)
+               if (bufsize < sizeof(tmp))
                        break;
                tmp = b43_shm_read16(dev, B43_SHM_SHARED, 2 * i);
                le16buf[i] = cpu_to_le16(tmp);
@@ -223,8 +222,6 @@ out:
 static int txpower_g_write_file(struct b43_wldev *dev,
                                const char *buf, size_t count)
 {
-       unsigned long phy_flags;
-
        if (dev->phy.type != B43_PHYTYPE_G)
                return -ENODEV;
        if ((count >= 4) && (memcmp(buf, "auto", 4) == 0)) {
@@ -248,12 +245,12 @@ static int txpower_g_write_file(struct b43_wldev *dev,
                        dev->phy.tx_control |= B43_TXCTL_PA2DB;
                if (pa3db)
                        dev->phy.tx_control |= B43_TXCTL_PA3DB;
-               b43_phy_lock(dev, phy_flags);
+               b43_phy_lock(dev);
                b43_radio_lock(dev);
                b43_set_txpower_g(dev, &dev->phy.bbatt,
                                  &dev->phy.rfatt, dev->phy.tx_control);
                b43_radio_unlock(dev);
-               b43_phy_unlock(dev, phy_flags);
+               b43_phy_unlock(dev);
        }
 
        return 0;
@@ -352,7 +349,7 @@ static ssize_t b43_debugfs_read(struct file *file, char __user *userbuf,
        struct b43_wldev *dev;
        struct b43_debugfs_fops *dfops;
        struct b43_dfs_file *dfile;
-       ssize_t ret;
+       ssize_t uninitialized_var(ret);
        char *buf;
        const size_t bufsize = 1024 * 128;
        const size_t buforder = get_order(bufsize);
index 5e8f8ac..3dfb28a 100644 (file)
@@ -37,6 +37,8 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/skbuff.h>
+#include <linux/etherdevice.h>
+
 
 /* 32bit DMA ops. */
 static
@@ -165,7 +167,7 @@ static void op64_fill_descriptor(struct b43_dmaring *ring,
        addrhi = (((u64) dmaaddr >> 32) & ~SSB_DMA_TRANSLATION_MASK);
        addrext = (((u64) dmaaddr >> 32) & SSB_DMA_TRANSLATION_MASK)
            >> SSB_DMA_TRANSLATION_SHIFT;
-       addrhi |= ssb_dma_translation(ring->dev->dev);
+       addrhi |= (ssb_dma_translation(ring->dev->dev) << 1);
        if (slot == ring->nr_slots - 1)
                ctl0 |= B43_DMA64_DCTL0_DTABLEEND;
        if (start)
@@ -315,29 +317,27 @@ static struct b43_dmaring *priority_to_txring(struct b43_wldev *dev,
        case 3:
                ring = dev->dma.tx_ring0;
                break;
-       case 4:
-               ring = dev->dma.tx_ring4;
-               break;
-       case 5:
-               ring = dev->dma.tx_ring5;
-               break;
        }
 
        return ring;
 }
 
-/* Bcm43xx-ring to mac80211-queue mapping */
+/* b43-ring to mac80211-queue mapping */
 static inline int txring_to_priority(struct b43_dmaring *ring)
 {
-       static const u8 idx_to_prio[] = { 3, 2, 1, 0, 4, 5, };
+       static const u8 idx_to_prio[] = { 3, 2, 1, 0, };
+       unsigned int index;
 
 /*FIXME: have only one queue, for now */
        return 0;
 
-       return idx_to_prio[ring->index];
+       index = ring->index;
+       if (B43_WARN_ON(index >= ARRAY_SIZE(idx_to_prio)))
+               index = 0;
+       return idx_to_prio[index];
 }
 
-u16 b43_dmacontroller_base(int dma64bit, int controller_idx)
+static u16 b43_dmacontroller_base(enum b43_dmatype type, int controller_idx)
 {
        static const u16 map64[] = {
                B43_MMIO_DMA64_BASE0,
@@ -356,7 +356,7 @@ u16 b43_dmacontroller_base(int dma64bit, int controller_idx)
                B43_MMIO_DMA32_BASE5,
        };
 
-       if (dma64bit) {
+       if (type == B43_DMA_64BIT) {
                B43_WARN_ON(!(controller_idx >= 0 &&
                              controller_idx < ARRAY_SIZE(map64)));
                return map64[controller_idx];
@@ -426,9 +426,21 @@ static inline
 static int alloc_ringmemory(struct b43_dmaring *ring)
 {
        struct device *dev = ring->dev->dev->dev;
-
+       gfp_t flags = GFP_KERNEL;
+
+       /* The specs call for 4K buffers for 30- and 32-bit DMA with 4K
+        * alignment and 8K buffers for 64-bit DMA with 8K alignment. Testing
+        * has shown that 4K is sufficient for the latter as long as the buffer
+        * does not cross an 8K boundary.
+        *
+        * For unknown reasons - possibly a hardware error - the BCM4311 rev
+        * 02, which uses 64-bit DMA, needs the ring buffer in very low memory,
+        * which accounts for the GFP_DMA flag below.
+        */
+       if (ring->type == B43_DMA_64BIT)
+               flags |= GFP_DMA;
        ring->descbase = dma_alloc_coherent(dev, B43_DMA_RINGMEMSIZE,
-                                           &(ring->dmabase), GFP_KERNEL);
+                                           &(ring->dmabase), flags);
        if (!ring->descbase) {
                b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
                return -ENOMEM;
@@ -447,7 +459,8 @@ static void free_ringmemory(struct b43_dmaring *ring)
 }
 
 /* Reset the RX DMA channel */
-int b43_dmacontroller_rx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
+static int b43_dmacontroller_rx_reset(struct b43_wldev *dev, u16 mmio_base,
+                                     enum b43_dmatype type)
 {
        int i;
        u32 value;
@@ -455,12 +468,13 @@ int b43_dmacontroller_rx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
 
        might_sleep();
 
-       offset = dma64 ? B43_DMA64_RXCTL : B43_DMA32_RXCTL;
+       offset = (type == B43_DMA_64BIT) ? B43_DMA64_RXCTL : B43_DMA32_RXCTL;
        b43_write32(dev, mmio_base + offset, 0);
        for (i = 0; i < 10; i++) {
-               offset = dma64 ? B43_DMA64_RXSTATUS : B43_DMA32_RXSTATUS;
+               offset = (type == B43_DMA_64BIT) ? B43_DMA64_RXSTATUS :
+                                                  B43_DMA32_RXSTATUS;
                value = b43_read32(dev, mmio_base + offset);
-               if (dma64) {
+               if (type == B43_DMA_64BIT) {
                        value &= B43_DMA64_RXSTAT;
                        if (value == B43_DMA64_RXSTAT_DISABLED) {
                                i = -1;
@@ -483,8 +497,9 @@ int b43_dmacontroller_rx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
        return 0;
 }
 
-/* Reset the RX DMA channel */
-int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
+/* Reset the TX DMA channel */
+static int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base,
+                                     enum b43_dmatype type)
 {
        int i;
        u32 value;
@@ -493,9 +508,10 @@ int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
        might_sleep();
 
        for (i = 0; i < 10; i++) {
-               offset = dma64 ? B43_DMA64_TXSTATUS : B43_DMA32_TXSTATUS;
+               offset = (type == B43_DMA_64BIT) ? B43_DMA64_TXSTATUS :
+                                                  B43_DMA32_TXSTATUS;
                value = b43_read32(dev, mmio_base + offset);
-               if (dma64) {
+               if (type == B43_DMA_64BIT) {
                        value &= B43_DMA64_TXSTAT;
                        if (value == B43_DMA64_TXSTAT_DISABLED ||
                            value == B43_DMA64_TXSTAT_IDLEWAIT ||
@@ -510,12 +526,13 @@ int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
                }
                msleep(1);
        }
-       offset = dma64 ? B43_DMA64_TXCTL : B43_DMA32_TXCTL;
+       offset = (type == B43_DMA_64BIT) ? B43_DMA64_TXCTL : B43_DMA32_TXCTL;
        b43_write32(dev, mmio_base + offset, 0);
        for (i = 0; i < 10; i++) {
-               offset = dma64 ? B43_DMA64_TXSTATUS : B43_DMA32_TXSTATUS;
+               offset = (type == B43_DMA_64BIT) ? B43_DMA64_TXSTATUS :
+                                                  B43_DMA32_TXSTATUS;
                value = b43_read32(dev, mmio_base + offset);
-               if (dma64) {
+               if (type == B43_DMA_64BIT) {
                        value &= B43_DMA64_TXSTAT;
                        if (value == B43_DMA64_TXSTAT_DISABLED) {
                                i = -1;
@@ -540,6 +557,33 @@ int b43_dmacontroller_tx_reset(struct b43_wldev *dev, u16 mmio_base, int dma64)
        return 0;
 }
 
+/* Check if a DMA mapping address is invalid. */
+static bool b43_dma_mapping_error(struct b43_dmaring *ring,
+                                 dma_addr_t addr,
+                                 size_t buffersize)
+{
+       if (unlikely(dma_mapping_error(addr)))
+               return 1;
+
+       switch (ring->type) {
+       case B43_DMA_30BIT:
+               if ((u64)addr + buffersize > (1ULL << 30))
+                       return 1;
+               break;
+       case B43_DMA_32BIT:
+               if ((u64)addr + buffersize > (1ULL << 32))
+                       return 1;
+               break;
+       case B43_DMA_64BIT:
+               /* Currently we can't have addresses beyond
+                * 64bit in the kernel. */
+               break;
+       }
+
+       /* The address is OK. */
+       return 0;
+}
+
 static int setup_rx_descbuffer(struct b43_dmaring *ring,
                               struct b43_dmadesc_generic *desc,
                               struct b43_dmadesc_meta *meta, gfp_t gfp_flags)
@@ -555,7 +599,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
        if (unlikely(!skb))
                return -ENOMEM;
        dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0);
-       if (dma_mapping_error(dmaaddr)) {
+       if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize)) {
                /* ugh. try to realloc in zone_dma */
                gfp_flags |= GFP_DMA;
 
@@ -568,7 +612,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
                                         ring->rx_buffersize, 0);
        }
 
-       if (dma_mapping_error(dmaaddr)) {
+       if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize)) {
                dev_kfree_skb_any(skb);
                return -EIO;
        }
@@ -633,7 +677,7 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
        u32 trans = ssb_dma_translation(ring->dev->dev);
 
        if (ring->tx) {
-               if (ring->dma64) {
+               if (ring->type == B43_DMA_64BIT) {
                        u64 ringbase = (u64) (ring->dmabase);
 
                        addrext = ((ringbase >> 32) & SSB_DMA_TRANSLATION_MASK)
@@ -647,7 +691,7 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
                        b43_dma_write(ring, B43_DMA64_TXRINGHI,
                                      ((ringbase >> 32) &
                                       ~SSB_DMA_TRANSLATION_MASK)
-                                     | trans);
+                                     | (trans << 1));
                } else {
                        u32 ringbase = (u32) (ring->dmabase);
 
@@ -665,7 +709,7 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
                err = alloc_initial_descbuffers(ring);
                if (err)
                        goto out;
-               if (ring->dma64) {
+               if (ring->type == B43_DMA_64BIT) {
                        u64 ringbase = (u64) (ring->dmabase);
 
                        addrext = ((ringbase >> 32) & SSB_DMA_TRANSLATION_MASK)
@@ -680,8 +724,9 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
                        b43_dma_write(ring, B43_DMA64_RXRINGHI,
                                      ((ringbase >> 32) &
                                       ~SSB_DMA_TRANSLATION_MASK)
-                                     | trans);
-                       b43_dma_write(ring, B43_DMA64_RXINDEX, 200);
+                                     | (trans << 1));
+                       b43_dma_write(ring, B43_DMA64_RXINDEX, ring->nr_slots *
+                                     sizeof(struct b43_dmadesc64));
                } else {
                        u32 ringbase = (u32) (ring->dmabase);
 
@@ -695,11 +740,12 @@ static int dmacontroller_setup(struct b43_dmaring *ring)
                        b43_dma_write(ring, B43_DMA32_RXRING,
                                      (ringbase & ~SSB_DMA_TRANSLATION_MASK)
                                      | trans);
-                       b43_dma_write(ring, B43_DMA32_RXINDEX, 200);
+                       b43_dma_write(ring, B43_DMA32_RXINDEX, ring->nr_slots *
+                                     sizeof(struct b43_dmadesc32));
                }
        }
 
-      out:
+out:
        return err;
 }
 
@@ -708,16 +754,16 @@ static void dmacontroller_cleanup(struct b43_dmaring *ring)
 {
        if (ring->tx) {
                b43_dmacontroller_tx_reset(ring->dev, ring->mmio_base,
-                                          ring->dma64);
-               if (ring->dma64) {
+                                          ring->type);
+               if (ring->type == B43_DMA_64BIT) {
                        b43_dma_write(ring, B43_DMA64_TXRINGLO, 0);
                        b43_dma_write(ring, B43_DMA64_TXRINGHI, 0);
                } else
                        b43_dma_write(ring, B43_DMA32_TXRING, 0);
        } else {
                b43_dmacontroller_rx_reset(ring->dev, ring->mmio_base,
-                                          ring->dma64);
-               if (ring->dma64) {
+                                          ring->type);
+               if (ring->type == B43_DMA_64BIT) {
                        b43_dma_write(ring, B43_DMA64_RXRINGLO, 0);
                        b43_dma_write(ring, B43_DMA64_RXRINGHI, 0);
                } else
@@ -772,7 +818,8 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
 static
 struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                                      int controller_index,
-                                     int for_tx, int dma64)
+                                     int for_tx,
+                                     enum b43_dmatype type)
 {
        struct b43_dmaring *ring;
        int err;
@@ -782,6 +829,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
        ring = kzalloc(sizeof(*ring), GFP_KERNEL);
        if (!ring)
                goto out;
+       ring->type = type;
 
        nr_slots = B43_RXRING_SLOTS;
        if (for_tx)
@@ -793,7 +841,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                goto err_kfree_ring;
        if (for_tx) {
                ring->txhdr_cache = kcalloc(nr_slots,
-                                           sizeof(struct b43_txhdr_fw4),
+                                           b43_txhdr_size(dev),
                                            GFP_KERNEL);
                if (!ring->txhdr_cache)
                        goto err_kfree_meta;
@@ -801,39 +849,38 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                /* test for ability to dma to txhdr_cache */
                dma_test = dma_map_single(dev->dev->dev,
                                          ring->txhdr_cache,
-                                         sizeof(struct b43_txhdr_fw4),
+                                         b43_txhdr_size(dev),
                                          DMA_TO_DEVICE);
 
-               if (dma_mapping_error(dma_test)) {
+               if (b43_dma_mapping_error(ring, dma_test, b43_txhdr_size(dev))) {
                        /* ugh realloc */
                        kfree(ring->txhdr_cache);
                        ring->txhdr_cache = kcalloc(nr_slots,
-                                                   sizeof(struct
-                                                          b43_txhdr_fw4),
+                                                   b43_txhdr_size(dev),
                                                    GFP_KERNEL | GFP_DMA);
                        if (!ring->txhdr_cache)
                                goto err_kfree_meta;
 
                        dma_test = dma_map_single(dev->dev->dev,
                                                  ring->txhdr_cache,
-                                                 sizeof(struct b43_txhdr_fw4),
+                                                 b43_txhdr_size(dev),
                                                  DMA_TO_DEVICE);
 
-                       if (dma_mapping_error(dma_test))
+                       if (b43_dma_mapping_error(ring, dma_test,
+                                                 b43_txhdr_size(dev)))
                                goto err_kfree_txhdr_cache;
                }
 
                dma_unmap_single(dev->dev->dev,
-                                dma_test, sizeof(struct b43_txhdr_fw4),
+                                dma_test, b43_txhdr_size(dev),
                                 DMA_TO_DEVICE);
        }
 
        ring->dev = dev;
        ring->nr_slots = nr_slots;
-       ring->mmio_base = b43_dmacontroller_base(dma64, controller_index);
+       ring->mmio_base = b43_dmacontroller_base(type, controller_index);
        ring->index = controller_index;
-       ring->dma64 = !!dma64;
-       if (dma64)
+       if (type == B43_DMA_64BIT)
                ring->ops = &dma64_ops;
        else
                ring->ops = &dma32_ops;
@@ -883,8 +930,8 @@ static void b43_destroy_dmaring(struct b43_dmaring *ring)
        if (!ring)
                return;
 
-       b43dbg(ring->dev->wl, "DMA-%s 0x%04X (%s) max used slots: %d/%d\n",
-              (ring->dma64) ? "64" : "32",
+       b43dbg(ring->dev->wl, "DMA-%u 0x%04X (%s) max used slots: %d/%d\n",
+              (unsigned int)(ring->type),
               ring->mmio_base,
               (ring->tx) ? "TX" : "RX", ring->max_used_slots, ring->nr_slots);
        /* Device IRQs are disabled prior entering this function,
@@ -901,11 +948,7 @@ static void b43_destroy_dmaring(struct b43_dmaring *ring)
 
 void b43_dma_free(struct b43_wldev *dev)
 {
-       struct b43_dma *dma;
-
-       if (b43_using_pio(dev))
-               return;
-       dma = &dev->dma;
+       struct b43_dma *dma = &dev->dma;
 
        b43_destroy_dmaring(dma->rx_ring3);
        dma->rx_ring3 = NULL;
@@ -932,74 +975,78 @@ int b43_dma_init(struct b43_wldev *dev)
        struct b43_dmaring *ring;
        int err;
        u64 dmamask;
-       int dma64 = 0;
+       enum b43_dmatype type;
 
        dmamask = supported_dma_mask(dev);
-       if (dmamask == DMA_64BIT_MASK)
-               dma64 = 1;
-
+       switch (dmamask) {
+       default:
+               B43_WARN_ON(1);
+       case DMA_30BIT_MASK:
+               type = B43_DMA_30BIT;
+               break;
+       case DMA_32BIT_MASK:
+               type = B43_DMA_32BIT;
+               break;
+       case DMA_64BIT_MASK:
+               type = B43_DMA_64BIT;
+               break;
+       }
        err = ssb_dma_set_mask(dev->dev, dmamask);
        if (err) {
-#ifdef B43_PIO
-               b43warn(dev->wl, "DMA for this device not supported. "
-                       "Falling back to PIO\n");
-               dev->__using_pio = 1;
-               return -EAGAIN;
-#else
-               b43err(dev->wl, "DMA for this device not supported and "
-                      "no PIO support compiled in\n");
+               b43err(dev->wl, "The machine/kernel does not support "
+                      "the required DMA mask (0x%08X%08X)\n",
+                      (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32),
+                      (unsigned int)(dmamask & 0x00000000FFFFFFFFULL));
                return -EOPNOTSUPP;
-#endif
        }
 
        err = -ENOMEM;
        /* setup TX DMA channels. */
-       ring = b43_setup_dmaring(dev, 0, 1, dma64);
+       ring = b43_setup_dmaring(dev, 0, 1, type);
        if (!ring)
                goto out;
        dma->tx_ring0 = ring;
 
-       ring = b43_setup_dmaring(dev, 1, 1, dma64);
+       ring = b43_setup_dmaring(dev, 1, 1, type);
        if (!ring)
                goto err_destroy_tx0;
        dma->tx_ring1 = ring;
 
-       ring = b43_setup_dmaring(dev, 2, 1, dma64);
+       ring = b43_setup_dmaring(dev, 2, 1, type);
        if (!ring)
                goto err_destroy_tx1;
        dma->tx_ring2 = ring;
 
-       ring = b43_setup_dmaring(dev, 3, 1, dma64);
+       ring = b43_setup_dmaring(dev, 3, 1, type);
        if (!ring)
                goto err_destroy_tx2;
        dma->tx_ring3 = ring;
 
-       ring = b43_setup_dmaring(dev, 4, 1, dma64);
+       ring = b43_setup_dmaring(dev, 4, 1, type);
        if (!ring)
                goto err_destroy_tx3;
        dma->tx_ring4 = ring;
 
-       ring = b43_setup_dmaring(dev, 5, 1, dma64);
+       ring = b43_setup_dmaring(dev, 5, 1, type);
        if (!ring)
                goto err_destroy_tx4;
        dma->tx_ring5 = ring;
 
        /* setup RX DMA channels. */
-       ring = b43_setup_dmaring(dev, 0, 0, dma64);
+       ring = b43_setup_dmaring(dev, 0, 0, type);
        if (!ring)
                goto err_destroy_tx5;
        dma->rx_ring0 = ring;
 
        if (dev->dev->id.revision < 5) {
-               ring = b43_setup_dmaring(dev, 3, 0, dma64);
+               ring = b43_setup_dmaring(dev, 3, 0, type);
                if (!ring)
                        goto err_destroy_rx0;
                dma->rx_ring3 = ring;
        }
 
-       b43dbg(dev->wl, "%d-bit DMA initialized\n",
-              (dmamask == DMA_64BIT_MASK) ? 64 :
-              (dmamask == DMA_32BIT_MASK) ? 32 : 30);
+       b43dbg(dev->wl, "%u-bit DMA initialized\n",
+              (unsigned int)type);
        err = 0;
       out:
        return err;
@@ -1038,26 +1085,30 @@ static u16 generate_cookie(struct b43_dmaring *ring, int slot)
         * in the lower 12 bits.
         * Note that the cookie must never be 0, as this
         * is a special value used in RX path.
+        * It can also not be 0xFFFF because that is special
+        * for multicast frames.
         */
        switch (ring->index) {
        case 0:
-               cookie = 0xA000;
+               cookie = 0x1000;
                break;
        case 1:
-               cookie = 0xB000;
+               cookie = 0x2000;
                break;
        case 2:
-               cookie = 0xC000;
+               cookie = 0x3000;
                break;
        case 3:
-               cookie = 0xD000;
+               cookie = 0x4000;
                break;
        case 4:
-               cookie = 0xE000;
+               cookie = 0x5000;
                break;
        case 5:
-               cookie = 0xF000;
+               cookie = 0x6000;
                break;
+       default:
+               B43_WARN_ON(1);
        }
        B43_WARN_ON(slot & ~0x0FFF);
        cookie |= (u16) slot;
@@ -1073,22 +1124,22 @@ struct b43_dmaring *parse_cookie(struct b43_wldev *dev, u16 cookie, int *slot)
        struct b43_dmaring *ring = NULL;
 
        switch (cookie & 0xF000) {
-       case 0xA000:
+       case 0x1000:
                ring = dma->tx_ring0;
                break;
-       case 0xB000:
+       case 0x2000:
                ring = dma->tx_ring1;
                break;
-       case 0xC000:
+       case 0x3000:
                ring = dma->tx_ring2;
                break;
-       case 0xD000:
+       case 0x4000:
                ring = dma->tx_ring3;
                break;
-       case 0xE000:
+       case 0x5000:
                ring = dma->tx_ring4;
                break;
-       case 0xF000:
+       case 0x6000:
                ring = dma->tx_ring5;
                break;
        default:
@@ -1106,32 +1157,45 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
 {
        const struct b43_dma_ops *ops = ring->ops;
        u8 *header;
-       int slot;
+       int slot, old_top_slot, old_used_slots;
        int err;
        struct b43_dmadesc_generic *desc;
        struct b43_dmadesc_meta *meta;
        struct b43_dmadesc_meta *meta_hdr;
        struct sk_buff *bounce_skb;
+       u16 cookie;
+       size_t hdrsize = b43_txhdr_size(ring->dev);
 
 #define SLOTS_PER_PACKET  2
        B43_WARN_ON(skb_shinfo(skb)->nr_frags);
 
+       old_top_slot = ring->current_slot;
+       old_used_slots = ring->used_slots;
+
        /* Get a slot for the header. */
        slot = request_slot(ring);
        desc = ops->idx2desc(ring, slot, &meta_hdr);
        memset(meta_hdr, 0, sizeof(*meta_hdr));
 
-       header = &(ring->txhdr_cache[slot * sizeof(struct b43_txhdr_fw4)]);
-       b43_generate_txhdr(ring->dev, header,
-                          skb->data, skb->len, ctl,
-                          generate_cookie(ring, slot));
+       header = &(ring->txhdr_cache[slot * hdrsize]);
+       cookie = generate_cookie(ring, slot);
+       err = b43_generate_txhdr(ring->dev, header,
+                                skb->data, skb->len, ctl, cookie);
+       if (unlikely(err)) {
+               ring->current_slot = old_top_slot;
+               ring->used_slots = old_used_slots;
+               return err;
+       }
 
        meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header,
-                                          sizeof(struct b43_txhdr_fw4), 1);
-       if (dma_mapping_error(meta_hdr->dmaaddr))
+                                          hdrsize, 1);
+       if (b43_dma_mapping_error(ring, meta_hdr->dmaaddr, hdrsize)) {
+               ring->current_slot = old_top_slot;
+               ring->used_slots = old_used_slots;
                return -EIO;
+       }
        ops->fill_descriptor(ring, desc, meta_hdr->dmaaddr,
-                            sizeof(struct b43_txhdr_fw4), 1, 0, 0);
+                            hdrsize, 1, 0, 0);
 
        /* Get a slot for the payload. */
        slot = request_slot(ring);
@@ -1144,9 +1208,11 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
 
        meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
        /* create a bounce buffer in zone_dma on mapping failure. */
-       if (dma_mapping_error(meta->dmaaddr)) {
+       if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len)) {
                bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                if (!bounce_skb) {
+                       ring->current_slot = old_top_slot;
+                       ring->used_slots = old_used_slots;
                        err = -ENOMEM;
                        goto out_unmap_hdr;
                }
@@ -1156,7 +1222,9 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
                skb = bounce_skb;
                meta->skb = skb;
                meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
-               if (dma_mapping_error(meta->dmaaddr)) {
+               if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len)) {
+                       ring->current_slot = old_top_slot;
+                       ring->used_slots = old_used_slots;
                        err = -EIO;
                        goto out_free_bounce;
                }
@@ -1164,16 +1232,22 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
 
        ops->fill_descriptor(ring, desc, meta->dmaaddr, skb->len, 0, 1, 1);
 
+       if (ctl->flags & IEEE80211_TXCTL_SEND_AFTER_DTIM) {
+               /* Tell the firmware about the cookie of the last
+                * mcast frame, so it can clear the more-data bit in it. */
+               b43_shm_write16(ring->dev, B43_SHM_SHARED,
+                               B43_SHM_SH_MCASTCOOKIE, cookie);
+       }
        /* Now transfer the whole frame. */
        wmb();
        ops->poke_tx(ring, next_slot(ring, slot));
        return 0;
 
-      out_free_bounce:
+out_free_bounce:
        dev_kfree_skb_any(skb);
-      out_unmap_hdr:
+out_unmap_hdr:
        unmap_descbuffer(ring, meta_hdr->dmaaddr,
-                        sizeof(struct b43_txhdr_fw4), 1);
+                        hdrsize, 1);
        return err;
 }
 
@@ -1202,10 +1276,27 @@ int b43_dma_tx(struct b43_wldev *dev,
               struct sk_buff *skb, struct ieee80211_tx_control *ctl)
 {
        struct b43_dmaring *ring;
+       struct ieee80211_hdr *hdr;
        int err = 0;
        unsigned long flags;
 
-       ring = priority_to_txring(dev, ctl->queue);
+       if (unlikely(skb->len < 2 + 2 + 6)) {
+               /* Too short, this can't be a valid frame. */
+               return -EINVAL;
+       }
+
+       hdr = (struct ieee80211_hdr *)skb->data;
+       if (ctl->flags & IEEE80211_TXCTL_SEND_AFTER_DTIM) {
+               /* The multicast ring will be sent after the DTIM */
+               ring = dev->dma.tx_ring4;
+               /* Set the more-data bit. Ucode will clear it on
+                * the last frame for us. */
+               hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+       } else {
+               /* Decide by priority where to put this frame. */
+               ring = priority_to_txring(dev, ctl->queue);
+       }
+
        spin_lock_irqsave(&ring->lock, flags);
        B43_WARN_ON(!ring->tx);
        if (unlikely(free_slots(ring) < SLOTS_PER_PACKET)) {
@@ -1219,6 +1310,13 @@ int b43_dma_tx(struct b43_wldev *dev,
        B43_WARN_ON(ring->stopped);
 
        err = dma_tx_fragment(ring, skb, ctl);
+       if (unlikely(err == -ENOKEY)) {
+               /* Drop this packet, as we don't have the encryption key
+                * anymore and must not transmit it unencrypted. */
+               dev_kfree_skb_any(skb);
+               err = 0;
+               goto out_unlock;
+       }
        if (unlikely(err)) {
                b43err(dev->wl, "DMA tx mapping failure\n");
                goto out_unlock;
@@ -1233,7 +1331,7 @@ int b43_dma_tx(struct b43_wldev *dev,
                        b43dbg(dev->wl, "Stopped TX ring %d\n", ring->index);
                }
        }
-      out_unlock:
+out_unlock:
        spin_unlock_irqrestore(&ring->lock, flags);
 
        return err;
@@ -1265,7 +1363,7 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                                         1);
                else
                        unmap_descbuffer(ring, meta->dmaaddr,
-                                        sizeof(struct b43_txhdr_fw4), 1);
+                                        b43_txhdr_size(dev), 1);
 
                if (meta->is_last_fragment) {
                        B43_WARN_ON(!meta->skb);
index 3eed185..c0d6b69 100644 (file)
@@ -170,8 +170,6 @@ struct b43_dmadesc_generic {
 #define B43_DMA0_RX_BUFFERSIZE (2304 + 100)
 #define B43_DMA3_RX_BUFFERSIZE 16
 
-#ifdef CONFIG_B43_DMA
-
 struct sk_buff;
 struct b43_private;
 struct b43_txstatus;
@@ -205,6 +203,12 @@ struct b43_dma_ops {
        void (*set_current_rxslot) (struct b43_dmaring * ring, int slot);
 };
 
+enum b43_dmatype {
+       B43_DMA_30BIT   = 30,
+       B43_DMA_32BIT   = 32,
+       B43_DMA_64BIT   = 64,
+};
+
 struct b43_dmaring {
        /* Lowlevel DMA ops. */
        const struct b43_dma_ops *ops;
@@ -237,8 +241,8 @@ struct b43_dmaring {
        int index;
        /* Boolean. Is this a TX ring? */
        bool tx;
-       /* Boolean. 64bit DMA if true, 32bit DMA otherwise. */
-       bool dma64;
+       /* The type of DMA engine used. */
+       enum b43_dmatype type;
        /* Boolean. Is this ring stopped at ieee80211 level? */
        bool stopped;
        /* Lock, only used for TX. */
@@ -257,8 +261,7 @@ static inline u32 b43_dma_read(struct b43_dmaring *ring, u16 offset)
        return b43_read32(ring->dev, ring->mmio_base + offset);
 }
 
-static inline
-    void b43_dma_write(struct b43_dmaring *ring, u16 offset, u32 value)
+static inline void b43_dma_write(struct b43_dmaring *ring, u16 offset, u32 value)
 {
        b43_write32(ring->dev, ring->mmio_base + offset, value);
 }
@@ -266,13 +269,6 @@ static inline
 int b43_dma_init(struct b43_wldev *dev);
 void b43_dma_free(struct b43_wldev *dev);
 
-int b43_dmacontroller_rx_reset(struct b43_wldev *dev,
-                              u16 dmacontroller_mmio_base, int dma64);
-int b43_dmacontroller_tx_reset(struct b43_wldev *dev,
-                              u16 dmacontroller_mmio_base, int dma64);
-
-u16 b43_dmacontroller_base(int dma64bit, int dmacontroller_idx);
-
 void b43_dma_tx_suspend(struct b43_wldev *dev);
 void b43_dma_tx_resume(struct b43_wldev *dev);
 
@@ -286,52 +282,4 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
 
 void b43_dma_rx(struct b43_dmaring *ring);
 
-#else /* CONFIG_B43_DMA */
-
-static inline int b43_dma_init(struct b43_wldev *dev)
-{
-       return 0;
-}
-static inline void b43_dma_free(struct b43_wldev *dev)
-{
-}
-static inline
-    int b43_dmacontroller_rx_reset(struct b43_wldev *dev,
-                                  u16 dmacontroller_mmio_base, int dma64)
-{
-       return 0;
-}
-static inline
-    int b43_dmacontroller_tx_reset(struct b43_wldev *dev,
-                                  u16 dmacontroller_mmio_base, int dma64)
-{
-       return 0;
-}
-static inline
-    void b43_dma_get_tx_stats(struct b43_wldev *dev,
-                             struct ieee80211_tx_queue_stats *stats)
-{
-}
-static inline
-    int b43_dma_tx(struct b43_wldev *dev,
-                  struct sk_buff *skb, struct ieee80211_tx_control *ctl)
-{
-       return 0;
-}
-static inline
-    void b43_dma_handle_txstatus(struct b43_wldev *dev,
-                                const struct b43_txstatus *status)
-{
-}
-static inline void b43_dma_rx(struct b43_dmaring *ring)
-{
-}
-static inline void b43_dma_tx_suspend(struct b43_wldev *dev)
-{
-}
-static inline void b43_dma_tx_resume(struct b43_wldev *dev)
-{
-}
-
-#endif /* CONFIG_B43_DMA */
 #endif /* B43_DMA_H_ */
index 19e5885..4b590d8 100644 (file)
@@ -4,7 +4,7 @@
   LED control
 
   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>,
-  Copyright (c) 2005 Stefano Brivio <st3@riseup.net>
+  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   Copyright (c) 2005-2007 Michael Buesch <mb@bu3sch.de>
   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
@@ -163,6 +163,9 @@ static void b43_map_led(struct b43_wldev *dev,
                b43_register_led(dev, &dev->led_radio, name,
                                 b43_rfkill_led_name(dev),
                                 led_index, activelow);
+               /* Sync the RF-kill LED state with the switch state. */
+               if (dev->radio_hw_enable)
+                       b43_led_turn_on(dev, led_index, activelow);
                break;
        case B43_LED_WEIRD:
        case B43_LED_ASSOC:
@@ -187,10 +190,10 @@ void b43_leds_init(struct b43_wldev *dev)
        enum b43_led_behaviour behaviour;
        bool activelow;
 
-       sprom[0] = bus->sprom.r1.gpio0;
-       sprom[1] = bus->sprom.r1.gpio1;
-       sprom[2] = bus->sprom.r1.gpio2;
-       sprom[3] = bus->sprom.r1.gpio3;
+       sprom[0] = bus->sprom.gpio0;
+       sprom[1] = bus->sprom.gpio1;
+       sprom[2] = bus->sprom.gpio2;
+       sprom[3] = bus->sprom.gpio3;
 
        for (i = 0; i < 4; i++) {
                if (sprom[i] == 0xFF) {
@@ -232,4 +235,5 @@ void b43_leds_exit(struct b43_wldev *dev)
        b43_unregister_led(&dev->led_tx);
        b43_unregister_led(&dev->led_rx);
        b43_unregister_led(&dev->led_assoc);
+       b43_unregister_led(&dev->led_radio);
 }
index b14a175..d890f36 100644 (file)
@@ -5,7 +5,7 @@
   G PHY LO (LocalOscillator) Measuring and Control routines
 
   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>,
-  Copyright (c) 2005, 2006 Stefano Brivio <st3@riseup.net>
+  Copyright (c) 2005, 2006 Stefano Brivio <stefano.brivio@polimi.it>
   Copyright (c) 2005-2007 Michael Buesch <mb@bu3sch.de>
   Copyright (c) 2005, 2006 Danny van Dyk <kugelfang@gentoo.org>
   Copyright (c) 2005, 2006 Andreas Jaggi <andreas.jaggi@waterwave.ch>
@@ -264,8 +264,8 @@ static u16 lo_measure_feedthrough(struct b43_wldev *dev,
                rfover |= pga;
                rfover |= lna;
                rfover |= trsw_rx;
-               if ((dev->dev->bus->sprom.r1.boardflags_lo & B43_BFL_EXTLNA) &&
-                   phy->rev > 6)
+               if ((dev->dev->bus->sprom.boardflags_lo & B43_BFL_EXTLNA)
+                   && phy->rev > 6)
                        rfover |= B43_PHY_RFOVERVAL_EXTLNA;
 
                b43_phy_write(dev, B43_PHY_PGACTL, 0xE300);
@@ -555,20 +555,20 @@ struct lo_g_saved_values {
        u16 phy_extg_01;
        u16 phy_dacctl_hwpctl;
        u16 phy_dacctl;
-       u16 phy_base_14;
+       u16 phy_cck_14;
        u16 phy_hpwr_tssictl;
        u16 phy_analogover;
        u16 phy_analogoverval;
        u16 phy_rfover;
        u16 phy_rfoverval;
        u16 phy_classctl;
-       u16 phy_base_3E;
+       u16 phy_cck_3E;
        u16 phy_crs0;
        u16 phy_pgactl;
-       u16 phy_base_2A;
+       u16 phy_cck_2A;
        u16 phy_syncctl;
-       u16 phy_base_30;
-       u16 phy_base_06;
+       u16 phy_cck_30;
+       u16 phy_cck_06;
 
        /* Radio registers */
        u16 radio_43;
@@ -588,7 +588,7 @@ static void lo_measure_setup(struct b43_wldev *dev,
                sav->phy_lo_mask = b43_phy_read(dev, B43_PHY_LO_MASK);
                sav->phy_extg_01 = b43_phy_read(dev, B43_PHY_EXTG(0x01));
                sav->phy_dacctl_hwpctl = b43_phy_read(dev, B43_PHY_DACCTL);
-               sav->phy_base_14 = b43_phy_read(dev, B43_PHY_BASE(0x14));
+               sav->phy_cck_14 = b43_phy_read(dev, B43_PHY_CCK(0x14));
                sav->phy_hpwr_tssictl = b43_phy_read(dev, B43_PHY_HPWR_TSSICTL);
 
                b43_phy_write(dev, B43_PHY_HPWR_TSSICTL,
@@ -600,14 +600,14 @@ static void lo_measure_setup(struct b43_wldev *dev,
                b43_phy_write(dev, B43_PHY_DACCTL,
                              b43_phy_read(dev, B43_PHY_DACCTL)
                              | 0x40);
-               b43_phy_write(dev, B43_PHY_BASE(0x14),
-                             b43_phy_read(dev, B43_PHY_BASE(0x14))
+               b43_phy_write(dev, B43_PHY_CCK(0x14),
+                             b43_phy_read(dev, B43_PHY_CCK(0x14))
                              | 0x200);
        }
        if (phy->type == B43_PHYTYPE_B &&
            phy->radio_ver == 0x2050 && phy->radio_rev < 6) {
-               b43_phy_write(dev, B43_PHY_BASE(0x16), 0x410);
-               b43_phy_write(dev, B43_PHY_BASE(0x17), 0x820);
+               b43_phy_write(dev, B43_PHY_CCK(0x16), 0x410);
+               b43_phy_write(dev, B43_PHY_CCK(0x17), 0x820);
        }
        if (!lo->rebuild && b43_has_hardware_pctl(phy))
                lo_read_power_vector(dev);
@@ -618,7 +618,7 @@ static void lo_measure_setup(struct b43_wldev *dev,
                sav->phy_rfover = b43_phy_read(dev, B43_PHY_RFOVER);
                sav->phy_rfoverval = b43_phy_read(dev, B43_PHY_RFOVERVAL);
                sav->phy_classctl = b43_phy_read(dev, B43_PHY_CLASSCTL);
-               sav->phy_base_3E = b43_phy_read(dev, B43_PHY_BASE(0x3E));
+               sav->phy_cck_3E = b43_phy_read(dev, B43_PHY_CCK(0x3E));
                sav->phy_crs0 = b43_phy_read(dev, B43_PHY_CRS0);
 
                b43_phy_write(dev, B43_PHY_CLASSCTL,
@@ -634,7 +634,7 @@ static void lo_measure_setup(struct b43_wldev *dev,
                              & 0xFFFC);
                if (phy->type == B43_PHYTYPE_G) {
                        if ((phy->rev >= 7) &&
-                           (sprom->r1.boardflags_lo & B43_BFL_EXTLNA)) {
+                           (sprom->boardflags_lo & B43_BFL_EXTLNA)) {
                                b43_phy_write(dev, B43_PHY_RFOVER, 0x933);
                        } else {
                                b43_phy_write(dev, B43_PHY_RFOVER, 0x133);
@@ -642,14 +642,14 @@ static void lo_measure_setup(struct b43_wldev *dev,
                } else {
                        b43_phy_write(dev, B43_PHY_RFOVER, 0);
                }
-               b43_phy_write(dev, B43_PHY_BASE(0x3E), 0);
+               b43_phy_write(dev, B43_PHY_CCK(0x3E), 0);
        }
        sav->reg_3F4 = b43_read16(dev, 0x3F4);
        sav->reg_3E2 = b43_read16(dev, 0x3E2);
        sav->radio_43 = b43_radio_read16(dev, 0x43);
        sav->radio_7A = b43_radio_read16(dev, 0x7A);
        sav->phy_pgactl = b43_phy_read(dev, B43_PHY_PGACTL);
-       sav->phy_base_2A = b43_phy_read(dev, B43_PHY_BASE(0x2A));
+       sav->phy_cck_2A = b43_phy_read(dev, B43_PHY_CCK(0x2A));
        sav->phy_syncctl = b43_phy_read(dev, B43_PHY_SYNCCTL);
        sav->phy_dacctl = b43_phy_read(dev, B43_PHY_DACCTL);
 
@@ -658,10 +658,10 @@ static void lo_measure_setup(struct b43_wldev *dev,
                sav->radio_52 &= 0x00F0;
        }
        if (phy->type == B43_PHYTYPE_B) {
-               sav->phy_base_30 = b43_phy_read(dev, B43_PHY_BASE(0x30));
-               sav->phy_base_06 = b43_phy_read(dev, B43_PHY_BASE(0x06));
-               b43_phy_write(dev, B43_PHY_BASE(0x30), 0x00FF);
-               b43_phy_write(dev, B43_PHY_BASE(0x06), 0x3F3F);
+               sav->phy_cck_30 = b43_phy_read(dev, B43_PHY_CCK(0x30));
+               sav->phy_cck_06 = b43_phy_read(dev, B43_PHY_CCK(0x06));
+               b43_phy_write(dev, B43_PHY_CCK(0x30), 0x00FF);
+               b43_phy_write(dev, B43_PHY_CCK(0x06), 0x3F3F);
        } else {
                b43_write16(dev, 0x3E2, b43_read16(dev, 0x3E2)
                            | 0x8000);
@@ -670,7 +670,7 @@ static void lo_measure_setup(struct b43_wldev *dev,
                    & 0xF000);
 
        tmp =
-           (phy->type == B43_PHYTYPE_G) ? B43_PHY_LO_MASK : B43_PHY_BASE(0x2E);
+           (phy->type == B43_PHYTYPE_G) ? B43_PHY_LO_MASK : B43_PHY_CCK(0x2E);
        b43_phy_write(dev, tmp, 0x007F);
 
        tmp = sav->phy_syncctl;
@@ -678,26 +678,26 @@ static void lo_measure_setup(struct b43_wldev *dev,
        tmp = sav->radio_7A;
        b43_radio_write16(dev, 0x007A, tmp & 0xFFF0);
 
-       b43_phy_write(dev, B43_PHY_BASE(0x2A), 0x8A3);
+       b43_phy_write(dev, B43_PHY_CCK(0x2A), 0x8A3);
        if (phy->type == B43_PHYTYPE_G ||
            (phy->type == B43_PHYTYPE_B &&
             phy->radio_ver == 0x2050 && phy->radio_rev >= 6)) {
-               b43_phy_write(dev, B43_PHY_BASE(0x2B), 0x1003);
+               b43_phy_write(dev, B43_PHY_CCK(0x2B), 0x1003);
        } else
-               b43_phy_write(dev, B43_PHY_BASE(0x2B), 0x0802);
+               b43_phy_write(dev, B43_PHY_CCK(0x2B), 0x0802);
        if (phy->rev >= 2)
                b43_dummy_transmission(dev);
        b43_radio_selectchannel(dev, 6, 0);
        b43_radio_read16(dev, 0x51);    /* dummy read */
        if (phy->type == B43_PHYTYPE_G)
-               b43_phy_write(dev, B43_PHY_BASE(0x2F), 0);
+               b43_phy_write(dev, B43_PHY_CCK(0x2F), 0);
        if (lo->rebuild)
                lo_measure_txctl_values(dev);
        if (phy->type == B43_PHYTYPE_G && phy->rev >= 3) {
                b43_phy_write(dev, B43_PHY_LO_MASK, 0xC078);
        } else {
                if (phy->type == B43_PHYTYPE_B)
-                       b43_phy_write(dev, B43_PHY_BASE(0x2E), 0x8078);
+                       b43_phy_write(dev, B43_PHY_CCK(0x2E), 0x8078);
                else
                        b43_phy_write(dev, B43_PHY_LO_MASK, 0x8078);
        }
@@ -732,17 +732,17 @@ static void lo_measure_restore(struct b43_wldev *dev,
        }
        if (phy->type == B43_PHYTYPE_G) {
                if (phy->rev >= 3)
-                       b43_phy_write(dev, B43_PHY_BASE(0x2E), 0xC078);
+                       b43_phy_write(dev, B43_PHY_CCK(0x2E), 0xC078);
                else
-                       b43_phy_write(dev, B43_PHY_BASE(0x2E), 0x8078);
+                       b43_phy_write(dev, B43_PHY_CCK(0x2E), 0x8078);
                if (phy->rev >= 2)
-                       b43_phy_write(dev, B43_PHY_BASE(0x2F), 0x0202);
+                       b43_phy_write(dev, B43_PHY_CCK(0x2F), 0x0202);
                else
-                       b43_phy_write(dev, B43_PHY_BASE(0x2F), 0x0101);
+                       b43_phy_write(dev, B43_PHY_CCK(0x2F), 0x0101);
        }
        b43_write16(dev, 0x3F4, sav->reg_3F4);
        b43_phy_write(dev, B43_PHY_PGACTL, sav->phy_pgactl);
-       b43_phy_write(dev, B43_PHY_BASE(0x2A), sav->phy_base_2A);
+       b43_phy_write(dev, B43_PHY_CCK(0x2A), sav->phy_cck_2A);
        b43_phy_write(dev, B43_PHY_SYNCCTL, sav->phy_syncctl);
        b43_phy_write(dev, B43_PHY_DACCTL, sav->phy_dacctl);
        b43_radio_write16(dev, 0x43, sav->radio_43);
@@ -755,8 +755,8 @@ static void lo_measure_restore(struct b43_wldev *dev,
        b43_write16(dev, 0x3E2, sav->reg_3E2);
        if (phy->type == B43_PHYTYPE_B &&
            phy->radio_ver == 0x2050 && phy->radio_rev <= 5) {
-               b43_phy_write(dev, B43_PHY_BASE(0x30), sav->phy_base_30);
-               b43_phy_write(dev, B43_PHY_BASE(0x06), sav->phy_base_06);
+               b43_phy_write(dev, B43_PHY_CCK(0x30), sav->phy_cck_30);
+               b43_phy_write(dev, B43_PHY_CCK(0x06), sav->phy_cck_06);
        }
        if (phy->rev >= 2) {
                b43_phy_write(dev, B43_PHY_ANALOGOVER, sav->phy_analogover);
@@ -765,7 +765,7 @@ static void lo_measure_restore(struct b43_wldev *dev,
                b43_phy_write(dev, B43_PHY_CLASSCTL, sav->phy_classctl);
                b43_phy_write(dev, B43_PHY_RFOVER, sav->phy_rfover);
                b43_phy_write(dev, B43_PHY_RFOVERVAL, sav->phy_rfoverval);
-               b43_phy_write(dev, B43_PHY_BASE(0x3E), sav->phy_base_3E);
+               b43_phy_write(dev, B43_PHY_CCK(0x3E), sav->phy_cck_3E);
                b43_phy_write(dev, B43_PHY_CRS0, sav->phy_crs0);
        }
        if (b43_has_hardware_pctl(phy)) {
@@ -773,7 +773,7 @@ static void lo_measure_restore(struct b43_wldev *dev,
                b43_phy_write(dev, B43_PHY_LO_MASK, tmp);
                b43_phy_write(dev, B43_PHY_EXTG(0x01), sav->phy_extg_01);
                b43_phy_write(dev, B43_PHY_DACCTL, sav->phy_dacctl_hwpctl);
-               b43_phy_write(dev, B43_PHY_BASE(0x14), sav->phy_base_14);
+               b43_phy_write(dev, B43_PHY_CCK(0x14), sav->phy_cck_14);
                b43_phy_write(dev, B43_PHY_HPWR_TSSICTL, sav->phy_hpwr_tssictl);
        }
        b43_radio_selectchannel(dev, sav->old_channel, 1);
index 9f8175c..afb1094 100644 (file)
@@ -3,7 +3,7 @@
   Broadcom B43 wireless driver
 
   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
-  Copyright (c) 2005 Stefano Brivio <st3@riseup.net>
+  Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
@@ -46,7 +46,6 @@
 #include "debugfs.h"
 #include "phy.h"
 #include "dma.h"
-#include "pio.h"
 #include "sysfs.h"
 #include "xmit.h"
 #include "lo.h"
@@ -58,31 +57,12 @@ MODULE_AUTHOR("Stefano Brivio");
 MODULE_AUTHOR("Michael Buesch");
 MODULE_LICENSE("GPL");
 
-extern char *nvram_get(char *name);
-
-#if defined(CONFIG_B43_DMA) && defined(CONFIG_B43_PIO)
-static int modparam_pio;
-module_param_named(pio, modparam_pio, int, 0444);
-MODULE_PARM_DESC(pio, "enable(1) / disable(0) PIO mode");
-#elif defined(CONFIG_B43_DMA)
-# define modparam_pio  0
-#elif defined(CONFIG_B43_PIO)
-# define modparam_pio  1
-#endif
 
 static int modparam_bad_frames_preempt;
 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
 MODULE_PARM_DESC(bad_frames_preempt,
                 "enable(1) / disable(0) Bad Frames Preemption");
 
-static int modparam_short_retry = B43_DEFAULT_SHORT_RETRY_LIMIT;
-module_param_named(short_retry, modparam_short_retry, int, 0444);
-MODULE_PARM_DESC(short_retry, "Short-Retry-Limit (0 - 15)");
-
-static int modparam_long_retry = B43_DEFAULT_LONG_RETRY_LIMIT;
-module_param_named(long_retry, modparam_long_retry, int, 0444);
-MODULE_PARM_DESC(long_retry, "Long-Retry-Limit (0 - 15)");
-
 static char modparam_fwpostfix[16];
 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
@@ -101,52 +81,41 @@ static const struct ssb_device_id b43_ssb_tbl[] = {
        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
+       SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
+       SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
        SSB_DEVTABLE_END
 };
 
 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 
-static const struct pci_device_id b43_pci_bridge_tbl[] = {
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4311) },
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) },
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4324) },
-       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4325) },
-       { 0, },
-};
-MODULE_DEVICE_TABLE(pci, b43_pci_bridge_tbl);
-
-static struct pci_driver b43_pci_bridge_driver = {
-       .name = "b43-pci-bridge",
-       .id_table = b43_pci_bridge_tbl,
-};
 /* Channel and ratetables are shared for all devices.
  * They can't be const, because ieee80211 puts some precalculated
  * data in there. This data is the same for all devices, so we don't
  * get concurrency issues */
 #define RATETAB_ENT(_rateid, _flags) \
-       {                                                       \
-               .rate   = B43_RATE_TO_BASE100KBPS(_rateid),     \
-               .val    = (_rateid),                            \
-               .val2   = (_rateid),                            \
-               .flags  = (_flags),                             \
+       {                                                               \
+               .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
+               .hw_value       = (_rateid),                            \
+               .flags          = (_flags),                             \
        }
+
+/*
+ * NOTE: When changing this, sync with xmit.c's
+ *      b43_plcp_get_bitrate_idx_* functions!
+ */
 static struct ieee80211_rate __b43_ratetable[] = {
-       RATETAB_ENT(B43_CCK_RATE_1MB, IEEE80211_RATE_CCK),
-       RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_CCK_2),
-       RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_CCK_2),
-       RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_CCK_2),
-       RATETAB_ENT(B43_OFDM_RATE_6MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43_OFDM_RATE_9MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43_OFDM_RATE_12MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43_OFDM_RATE_18MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43_OFDM_RATE_24MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43_OFDM_RATE_36MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43_OFDM_RATE_48MB, IEEE80211_RATE_OFDM),
-       RATETAB_ENT(B43_OFDM_RATE_54MB, IEEE80211_RATE_OFDM),
+       RATETAB_ENT(B43_CCK_RATE_1MB, 0),
+       RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
+       RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
+       RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
+       RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
+       RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
+       RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
+       RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
+       RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 };
 
 #define b43_a_ratetable                (__b43_ratetable + 4)
@@ -158,16 +127,10 @@ static struct ieee80211_rate __b43_ratetable[] = {
 
 #define CHANTAB_ENT(_chanid, _freq) \
        {                                                       \
-               .chan   = (_chanid),                            \
-               .freq   = (_freq),                              \
-               .val    = (_chanid),                            \
-               .flag   = IEEE80211_CHAN_W_SCAN |               \
-                         IEEE80211_CHAN_W_ACTIVE_SCAN |        \
-                         IEEE80211_CHAN_W_IBSS,                \
-               .power_level    = 0xFF,                         \
-               .antenna_max    = 0xFF,                         \
+               .center_freq    = (_freq),                      \
+               .hw_value       = (_chanid),                    \
        }
-static struct ieee80211_channel b43_bg_chantable[] = {
+static struct ieee80211_channel b43_2ghz_chantable[] = {
        CHANTAB_ENT(1, 2412),
        CHANTAB_ENT(2, 2417),
        CHANTAB_ENT(3, 2422),
@@ -184,8 +147,8 @@ static struct ieee80211_channel b43_bg_chantable[] = {
        CHANTAB_ENT(14, 2484),
 };
 
-#define b43_bg_chantable_size  ARRAY_SIZE(b43_bg_chantable)
-static struct ieee80211_channel b43_a_chantable[] = {
+#ifdef NOTYET
+static struct ieee80211_channel b43_5ghz_chantable[] = {
        CHANTAB_ENT(36, 5180),
        CHANTAB_ENT(40, 5200),
        CHANTAB_ENT(44, 5220),
@@ -201,7 +164,20 @@ static struct ieee80211_channel b43_a_chantable[] = {
        CHANTAB_ENT(165, 5825),
 };
 
-#define b43_a_chantable_size   ARRAY_SIZE(b43_a_chantable)
+static struct ieee80211_supported_band b43_band_5GHz = {
+       .channels = b43_5ghz_chantable,
+       .n_channels = ARRAY_SIZE(b43_5ghz_chantable),
+       .bitrates = b43_a_ratetable,
+       .n_bitrates = b43_a_ratetable_size,
+};
+#endif
+
+static struct ieee80211_supported_band b43_band_2GHz = {
+       .channels = b43_2ghz_chantable,
+       .n_channels = ARRAY_SIZE(b43_2ghz_chantable),
+       .bitrates = b43_g_ratetable,
+       .n_bitrates = b43_g_ratetable_size,
+};
 
 static void b43_wireless_core_exit(struct b43_wldev *dev);
 static int b43_wireless_core_init(struct b43_wldev *dev);
@@ -286,13 +262,12 @@ static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
        b43_write32(dev, B43_MMIO_RAM_DATA, val);
 }
 
-static inline
-    void b43_shm_control_word(struct b43_wldev *dev, u16 routing, u16 offset)
+static inline void b43_shm_control_word(struct b43_wldev *dev,
+                                       u16 routing, u16 offset)
 {
        u32 control;
 
        /* "offset" is the WORD offset. */
-
        control = routing;
        control <<= 16;
        control |= offset;
@@ -301,8 +276,11 @@ static inline
 
 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 {
+       struct b43_wl *wl = dev->wl;
+       unsigned long flags;
        u32 ret;
 
+       spin_lock_irqsave(&wl->shm_lock, flags);
        if (routing == B43_SHM_SHARED) {
                B43_WARN_ON(offset & 0x0001);
                if (offset & 0x0003) {
@@ -313,20 +291,25 @@ u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
                        b43_shm_control_word(dev, routing, (offset >> 2) + 1);
                        ret |= b43_read16(dev, B43_MMIO_SHM_DATA);
 
-                       return ret;
+                       goto out;
                }
                offset >>= 2;
        }
        b43_shm_control_word(dev, routing, offset);
        ret = b43_read32(dev, B43_MMIO_SHM_DATA);
+out:
+       spin_unlock_irqrestore(&wl->shm_lock, flags);
 
        return ret;
 }
 
 u16 b43_shm_read16(struct b43_wldev * dev, u16 routing, u16 offset)
 {
+       struct b43_wl *wl = dev->wl;
+       unsigned long flags;
        u16 ret;
 
+       spin_lock_irqsave(&wl->shm_lock, flags);
        if (routing == B43_SHM_SHARED) {
                B43_WARN_ON(offset & 0x0001);
                if (offset & 0x0003) {
@@ -334,55 +317,63 @@ u16 b43_shm_read16(struct b43_wldev * dev, u16 routing, u16 offset)
                        b43_shm_control_word(dev, routing, offset >> 2);
                        ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 
-                       return ret;
+                       goto out;
                }
                offset >>= 2;
        }
        b43_shm_control_word(dev, routing, offset);
        ret = b43_read16(dev, B43_MMIO_SHM_DATA);
+out:
+       spin_unlock_irqrestore(&wl->shm_lock, flags);
 
        return ret;
 }
 
 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 {
+       struct b43_wl *wl = dev->wl;
+       unsigned long flags;
+
+       spin_lock_irqsave(&wl->shm_lock, flags);
        if (routing == B43_SHM_SHARED) {
                B43_WARN_ON(offset & 0x0001);
                if (offset & 0x0003) {
                        /* Unaligned access */
                        b43_shm_control_word(dev, routing, offset >> 2);
-                       mmiowb();
                        b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
                                    (value >> 16) & 0xffff);
-                       mmiowb();
                        b43_shm_control_word(dev, routing, (offset >> 2) + 1);
-                       mmiowb();
                        b43_write16(dev, B43_MMIO_SHM_DATA, value & 0xffff);
-                       return;
+                       goto out;
                }
                offset >>= 2;
        }
        b43_shm_control_word(dev, routing, offset);
-       mmiowb();
        b43_write32(dev, B43_MMIO_SHM_DATA, value);
+out:
+       spin_unlock_irqrestore(&wl->shm_lock, flags);
 }
 
 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 {
+       struct b43_wl *wl = dev->wl;
+       unsigned long flags;
+
+       spin_lock_irqsave(&wl->shm_lock, flags);
        if (routing == B43_SHM_SHARED) {
                B43_WARN_ON(offset & 0x0001);
                if (offset & 0x0003) {
                        /* Unaligned access */
                        b43_shm_control_word(dev, routing, offset >> 2);
-                       mmiowb();
                        b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
-                       return;
+                       goto out;
                }
                offset >>= 2;
        }
        b43_shm_control_word(dev, routing, offset);
-       mmiowb();
        b43_write16(dev, B43_MMIO_SHM_DATA, value);
+out:
+       spin_unlock_irqrestore(&wl->shm_lock, flags);
 }
 
 /* Read HostFlags */
@@ -1029,9 +1020,8 @@ static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
 static void b43_generate_noise_sample(struct b43_wldev *dev)
 {
        b43_jssi_write(dev, 0x7F7F7F7F);
-       b43_write32(dev, B43_MMIO_STATUS2_BITFIELD,
-                   b43_read32(dev, B43_MMIO_STATUS2_BITFIELD)
-                   | (1 << 4));
+       b43_write32(dev, B43_MMIO_MACCMD,
+                   b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
        B43_WARN_ON(dev->noisecalc.channel_at_start != dev->phy.channel);
 }
 
@@ -1117,18 +1107,18 @@ static void handle_irq_tbtt_indication(struct b43_wldev *dev)
                if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
                        b43_power_saving_ctl_bits(dev, 0);
        }
-       dev->reg124_set_0x4 = 0;
        if (b43_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
-               dev->reg124_set_0x4 = 1;
+               dev->dfq_valid = 1;
 }
 
 static void handle_irq_atim_end(struct b43_wldev *dev)
 {
-       if (!dev->reg124_set_0x4 /*FIXME rename this variable */ )
-               return;
-       b43_write32(dev, B43_MMIO_STATUS2_BITFIELD,
-                   b43_read32(dev, B43_MMIO_STATUS2_BITFIELD)
-                   | 0x4);
+       if (dev->dfq_valid) {
+               b43_write32(dev, B43_MMIO_MACCMD,
+                           b43_read32(dev, B43_MMIO_MACCMD)
+                           | B43_MACCMD_DFQ_VALID);
+               dev->dfq_valid = 0;
+       }
 }
 
 static void handle_irq_pmq(struct b43_wldev *dev)
@@ -1183,29 +1173,74 @@ static void b43_write_beacon_template(struct b43_wldev *dev,
                                      u16 ram_offset,
                                      u16 shm_size_offset, u8 rate)
 {
-       int len;
-       const u8 *data;
+       unsigned int i, len, variable_len;
+       const struct ieee80211_mgmt *bcn;
+       const u8 *ie;
+       bool tim_found = 0;
 
-       B43_WARN_ON(!dev->cached_beacon);
-       len = min((size_t) dev->cached_beacon->len,
+       bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
+       len = min((size_t) dev->wl->current_beacon->len,
                  0x200 - sizeof(struct b43_plcp_hdr6));
-       data = (const u8 *)(dev->cached_beacon->data);
-       b43_write_template_common(dev, data,
+
+       b43_write_template_common(dev, (const u8 *)bcn,
                                  len, ram_offset, shm_size_offset, rate);
+
+       /* Find the position of the TIM and the DTIM_period value
+        * and write them to SHM. */
+       ie = bcn->u.beacon.variable;
+       variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
+       for (i = 0; i < variable_len - 2; ) {
+               uint8_t ie_id, ie_len;
+
+               ie_id = ie[i];
+               ie_len = ie[i + 1];
+               if (ie_id == 5) {
+                       u16 tim_position;
+                       u16 dtim_period;
+                       /* This is the TIM Information Element */
+
+                       /* Check whether the ie_len is in the beacon data range. */
+                       if (variable_len < ie_len + 2 + i)
+                               break;
+                       /* A valid TIM is at least 4 bytes long. */
+                       if (ie_len < 4)
+                               break;
+                       tim_found = 1;
+
+                       tim_position = sizeof(struct b43_plcp_hdr6);
+                       tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
+                       tim_position += i;
+
+                       dtim_period = ie[i + 3];
+
+                       b43_shm_write16(dev, B43_SHM_SHARED,
+                                       B43_SHM_SH_TIMBPOS, tim_position);
+                       b43_shm_write16(dev, B43_SHM_SHARED,
+                                       B43_SHM_SH_DTIMPER, dtim_period);
+                       break;
+               }
+               i += ie_len + 2;
+       }
+       if (!tim_found) {
+               b43warn(dev->wl, "Did not find a valid TIM IE in "
+                       "the beacon template packet. AP or IBSS operation "
+                       "may be broken.\n");
+       }
 }
 
 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
-                                     u16 shm_offset, u16 size, u8 rate)
+                                     u16 shm_offset, u16 size,
+                                     struct ieee80211_rate *rate)
 {
        struct b43_plcp_hdr4 plcp;
        u32 tmp;
        __le16 dur;
 
        plcp.data = 0;
-       b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
+       b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
        dur = ieee80211_generic_frame_duration(dev->wl->hw,
-                                              dev->wl->if_id, size,
-                                              B43_RATE_TO_BASE100KBPS(rate));
+                                              dev->wl->vif, size,
+                                              rate);
        /* Write PLCP in two parts and timing for packet transfer */
        tmp = le32_to_cpu(plcp.data);
        b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
@@ -1219,40 +1254,44 @@ static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
  * 2) Patching duration field
  * 3) Stripping TIM
  */
-static u8 *b43_generate_probe_resp(struct b43_wldev *dev,
-                                  u16 * dest_size, u8 rate)
+static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
+                                         u16 *dest_size,
+                                         struct ieee80211_rate *rate)
 {
        const u8 *src_data;
        u8 *dest_data;
        u16 src_size, elem_size, src_pos, dest_pos;
        __le16 dur;
        struct ieee80211_hdr *hdr;
+       size_t ie_start;
+
+       src_size = dev->wl->current_beacon->len;
+       src_data = (const u8 *)dev->wl->current_beacon->data;
 
-       B43_WARN_ON(!dev->cached_beacon);
-       src_size = dev->cached_beacon->len;
-       src_data = (const u8 *)dev->cached_beacon->data;
+       /* Get the start offset of the variable IEs in the packet. */
+       ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+       B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
 
-       if (unlikely(src_size < 0x24)) {
-               b43dbg(dev->wl, "b43_generate_probe_resp: " "invalid beacon\n");
+       if (B43_WARN_ON(src_size < ie_start))
                return NULL;
-       }
 
        dest_data = kmalloc(src_size, GFP_ATOMIC);
        if (unlikely(!dest_data))
                return NULL;
 
-       /* 0x24 is offset of first variable-len Information-Element
-        * in beacon frame.
-        */
-       memcpy(dest_data, src_data, 0x24);
-       src_pos = dest_pos = 0x24;
-       for (; src_pos < src_size - 2; src_pos += elem_size) {
+       /* Copy the static data and all Information Elements, except the TIM. */
+       memcpy(dest_data, src_data, ie_start);
+       src_pos = ie_start;
+       dest_pos = ie_start;
+       for ( ; src_pos < src_size - 2; src_pos += elem_size) {
                elem_size = src_data[src_pos + 1] + 2;
-               if (src_data[src_pos] != 0x05) {        /* TIM */
-                       memcpy(dest_data + dest_pos, src_data + src_pos,
-                              elem_size);
-                       dest_pos += elem_size;
+               if (src_data[src_pos] == 5) {
+                       /* This is the TIM. */
+                       continue;
                }
+               memcpy(dest_data + dest_pos, src_data + src_pos,
+                      elem_size);
+               dest_pos += elem_size;
        }
        *dest_size = dest_pos;
        hdr = (struct ieee80211_hdr *)dest_data;
@@ -1261,8 +1300,8 @@ static u8 *b43_generate_probe_resp(struct b43_wldev *dev,
        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                         IEEE80211_STYPE_PROBE_RESP);
        dur = ieee80211_generic_frame_duration(dev->wl->hw,
-                                              dev->wl->if_id, *dest_size,
-                                              B43_RATE_TO_BASE100KBPS(rate));
+                                              dev->wl->vif, *dest_size,
+                                              rate);
        hdr->duration_id = dur;
 
        return dest_data;
@@ -1270,13 +1309,13 @@ static u8 *b43_generate_probe_resp(struct b43_wldev *dev,
 
 static void b43_write_probe_resp_template(struct b43_wldev *dev,
                                          u16 ram_offset,
-                                         u16 shm_size_offset, u8 rate)
+                                         u16 shm_size_offset,
+                                         struct ieee80211_rate *rate)
 {
-       u8 *probe_resp_data;
+       const u8 *probe_resp_data;
        u16 size;
 
-       B43_WARN_ON(!dev->cached_beacon);
-       size = dev->cached_beacon->len;
+       size = dev->wl->current_beacon->len;
        probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
        if (unlikely(!probe_resp_data))
                return;
@@ -1284,50 +1323,33 @@ static void b43_write_probe_resp_template(struct b43_wldev *dev,
        /* Looks like PLCP headers plus packet timings are stored for
         * all possible basic rates
         */
-       b43_write_probe_resp_plcp(dev, 0x31A, size, B43_CCK_RATE_1MB);
-       b43_write_probe_resp_plcp(dev, 0x32C, size, B43_CCK_RATE_2MB);
-       b43_write_probe_resp_plcp(dev, 0x33E, size, B43_CCK_RATE_5MB);
-       b43_write_probe_resp_plcp(dev, 0x350, size, B43_CCK_RATE_11MB);
+       b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
+       b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
+       b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
+       b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
 
        size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
        b43_write_template_common(dev, probe_resp_data,
-                                 size, ram_offset, shm_size_offset, rate);
+                                 size, ram_offset, shm_size_offset,
+                                 rate->hw_value);
        kfree(probe_resp_data);
 }
 
-static int b43_refresh_cached_beacon(struct b43_wldev *dev,
-                                    struct sk_buff *beacon)
-{
-       if (dev->cached_beacon)
-               kfree_skb(dev->cached_beacon);
-       dev->cached_beacon = beacon;
-
-       return 0;
-}
-
-static void b43_update_templates(struct b43_wldev *dev)
-{
-       u32 status;
-
-       B43_WARN_ON(!dev->cached_beacon);
-
-       b43_write_beacon_template(dev, 0x68, 0x18, B43_CCK_RATE_1MB);
-       b43_write_beacon_template(dev, 0x468, 0x1A, B43_CCK_RATE_1MB);
-       b43_write_probe_resp_template(dev, 0x268, 0x4A, B43_CCK_RATE_11MB);
-
-       status = b43_read32(dev, B43_MMIO_STATUS2_BITFIELD);
-       status |= 0x03;
-       b43_write32(dev, B43_MMIO_STATUS2_BITFIELD, status);
-}
-
-static void b43_refresh_templates(struct b43_wldev *dev, struct sk_buff *beacon)
+/* Asynchronously update the packet templates in template RAM.
+ * Locking: Requires wl->irq_lock to be locked. */
+static void b43_update_templates(struct b43_wl *wl, struct sk_buff *beacon)
 {
-       int err;
+       /* This is the top half of the ansynchronous beacon update.
+        * The bottom half is the beacon IRQ.
+        * Beacon update must be asynchronous to avoid sending an
+        * invalid beacon. This can happen for example, if the firmware
+        * transmits a beacon while we are updating it. */
 
-       err = b43_refresh_cached_beacon(dev, beacon);
-       if (unlikely(err))
-               return;
-       b43_update_templates(dev);
+       if (wl->current_beacon)
+               dev_kfree_skb_any(wl->current_beacon);
+       wl->current_beacon = beacon;
+       wl->beacon0_uploaded = 0;
+       wl->beacon1_uploaded = 0;
 }
 
 static void b43_set_ssid(struct b43_wldev *dev, const u8 * ssid, u8 ssid_len)
@@ -1363,33 +1385,34 @@ static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
 
 static void handle_irq_beacon(struct b43_wldev *dev)
 {
-       u32 status;
+       struct b43_wl *wl = dev->wl;
+       u32 cmd;
 
-       if (!b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP))
+       if (!b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
                return;
 
-       dev->irq_savedstate &= ~B43_IRQ_BEACON;
-       status = b43_read32(dev, B43_MMIO_STATUS2_BITFIELD);
+       /* This is the bottom half of the asynchronous beacon update. */
 
-       if (!dev->cached_beacon || ((status & 0x1) && (status & 0x2))) {
-               /* ACK beacon IRQ. */
-               b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
-               dev->irq_savedstate |= B43_IRQ_BEACON;
-               if (dev->cached_beacon)
-                       kfree_skb(dev->cached_beacon);
-               dev->cached_beacon = NULL;
-               return;
-       }
-       if (!(status & 0x1)) {
-               b43_write_beacon_template(dev, 0x68, 0x18, B43_CCK_RATE_1MB);
-               status |= 0x1;
-               b43_write32(dev, B43_MMIO_STATUS2_BITFIELD, status);
+       cmd = b43_read32(dev, B43_MMIO_MACCMD);
+       if (!(cmd & B43_MACCMD_BEACON0_VALID)) {
+               if (!wl->beacon0_uploaded) {
+                       b43_write_beacon_template(dev, 0x68, 0x18,
+                                                 B43_CCK_RATE_1MB);
+                       b43_write_probe_resp_template(dev, 0x268, 0x4A,
+                                                     &__b43_ratetable[3]);
+                       wl->beacon0_uploaded = 1;
+               }
+               cmd |= B43_MACCMD_BEACON0_VALID;
        }
-       if (!(status & 0x2)) {
-               b43_write_beacon_template(dev, 0x468, 0x1A, B43_CCK_RATE_1MB);
-               status |= 0x2;
-               b43_write32(dev, B43_MMIO_STATUS2_BITFIELD, status);
+       if (!(cmd & B43_MACCMD_BEACON1_VALID)) {
+               if (!wl->beacon1_uploaded) {
+                       b43_write_beacon_template(dev, 0x468, 0x1A,
+                                                 B43_CCK_RATE_1MB);
+                       wl->beacon1_uploaded = 1;
+               }
+               cmd |= B43_MACCMD_BEACON1_VALID;
        }
+       b43_write32(dev, B43_MMIO_MACCMD, cmd);
 }
 
 static void handle_irq_ucode_debug(struct b43_wldev *dev)
@@ -1419,8 +1442,17 @@ static void b43_interrupt_tasklet(struct b43_wldev *dev)
        if (unlikely(reason & B43_IRQ_MAC_TXERR))
                b43err(dev->wl, "MAC transmission error\n");
 
-       if (unlikely(reason & B43_IRQ_PHY_TXERR))
+       if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
                b43err(dev->wl, "PHY transmission error\n");
+               rmb();
+               if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
+                       atomic_set(&dev->phy.txerr_cnt,
+                                  B43_PHY_TX_BADNESS_LIMIT);
+                       b43err(dev->wl, "Too many PHY TX errors, "
+                                       "restarting the controller\n");
+                       b43_controller_restart(dev, "PHY TX errors");
+               }
+       }
 
        if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
                                          B43_DMAIRQ_NONFATALMASK))) {
@@ -1462,20 +1494,12 @@ static void b43_interrupt_tasklet(struct b43_wldev *dev)
                handle_irq_noise(dev);
 
        /* Check the DMA reason registers for received data. */
-       if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
-               if (b43_using_pio(dev))
-                       b43_pio_rx(dev->pio.queue0);
-               else
-                       b43_dma_rx(dev->dma.rx_ring0);
-       }
+       if (dma_reason[0] & B43_DMAIRQ_RX_DONE)
+               b43_dma_rx(dev->dma.rx_ring0);
+       if (dma_reason[3] & B43_DMAIRQ_RX_DONE)
+               b43_dma_rx(dev->dma.rx_ring3);
        B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
        B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
-       if (dma_reason[3] & B43_DMAIRQ_RX_DONE) {
-               if (b43_using_pio(dev))
-                       b43_pio_rx(dev->pio.queue3);
-               else
-                       b43_dma_rx(dev->dma.rx_ring3);
-       }
        B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
        B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
 
@@ -1487,29 +1511,8 @@ static void b43_interrupt_tasklet(struct b43_wldev *dev)
        spin_unlock_irqrestore(&dev->wl->irq_lock, flags);
 }
 
-static void pio_irq_workaround(struct b43_wldev *dev, u16 base, int queueidx)
-{
-       u16 rxctl;
-
-       rxctl = b43_read16(dev, base + B43_PIO_RXCTL);
-       if (rxctl & B43_PIO_RXCTL_DATAAVAILABLE)
-               dev->dma_reason[queueidx] |= B43_DMAIRQ_RX_DONE;
-       else
-               dev->dma_reason[queueidx] &= ~B43_DMAIRQ_RX_DONE;
-}
-
 static void b43_interrupt_ack(struct b43_wldev *dev, u32 reason)
 {
-       if (b43_using_pio(dev) &&
-           (dev->dev->id.revision < 3) &&
-           (!(reason & B43_IRQ_PIO_WORKAROUND))) {
-               /* Apply a PIO specific workaround to the dma_reasons */
-               pio_irq_workaround(dev, B43_MMIO_PIO1_BASE, 0);
-               pio_irq_workaround(dev, B43_MMIO_PIO2_BASE, 1);
-               pio_irq_workaround(dev, B43_MMIO_PIO3_BASE, 2);
-               pio_irq_workaround(dev, B43_MMIO_PIO4_BASE, 3);
-       }
-
        b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
 
        b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
@@ -1568,54 +1571,73 @@ static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
        return ret;
 }
 
+static void do_release_fw(struct b43_firmware_file *fw)
+{
+       release_firmware(fw->data);
+       fw->data = NULL;
+       fw->filename = NULL;
+}
+
 static void b43_release_firmware(struct b43_wldev *dev)
 {
-       release_firmware(dev->fw.ucode);
-       dev->fw.ucode = NULL;
-       release_firmware(dev->fw.pcm);
-       dev->fw.pcm = NULL;
-       release_firmware(dev->fw.initvals);
-       dev->fw.initvals = NULL;
-       release_firmware(dev->fw.initvals_band);
-       dev->fw.initvals_band = NULL;
+       do_release_fw(&dev->fw.ucode);
+       do_release_fw(&dev->fw.pcm);
+       do_release_fw(&dev->fw.initvals);
+       do_release_fw(&dev->fw.initvals_band);
 }
 
-static void b43_print_fw_helptext(struct b43_wl *wl)
+static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
 {
-       b43err(wl, "You must go to "
-              "http://linuxwireless.org/en/users/Drivers/bcm43xx#devicefirmware "
-              "and download the correct firmware (version 4).\n");
+       const char *text;
+
+       text = "You must go to "
+              "http://linuxwireless.org/en/users/Drivers/b43#devicefirmware "
+              "and download the latest firmware (version 4).\n";
+       if (error)
+               b43err(wl, text);
+       else
+               b43warn(wl, text);
 }
 
 static int do_request_fw(struct b43_wldev *dev,
                         const char *name,
-                        const struct firmware **fw)
+                        struct b43_firmware_file *fw)
 {
        char path[sizeof(modparam_fwpostfix) + 32];
+       const struct firmware *blob;
        struct b43_fw_header *hdr;
        u32 size;
        int err;
 
-       if (!name)
+       if (!name) {
+               /* Don't fetch anything. Free possibly cached firmware. */
+               do_release_fw(fw);
                return 0;
+       }
+       if (fw->filename) {
+               if (strcmp(fw->filename, name) == 0)
+                       return 0; /* Already have this fw. */
+               /* Free the cached firmware first. */
+               do_release_fw(fw);
+       }
 
        snprintf(path, ARRAY_SIZE(path),
                 "b43%s/%s.fw",
                 modparam_fwpostfix, name);
-       err = request_firmware(fw, path, dev->dev->dev);
+       err = request_firmware(&blob, path, dev->dev->dev);
        if (err) {
                b43err(dev->wl, "Firmware file \"%s\" not found "
                       "or load failed.\n", path);
                return err;
        }
-       if ((*fw)->size < sizeof(struct b43_fw_header))
+       if (blob->size < sizeof(struct b43_fw_header))
                goto err_format;
-       hdr = (struct b43_fw_header *)((*fw)->data);
+       hdr = (struct b43_fw_header *)(blob->data);
        switch (hdr->type) {
        case B43_FW_TYPE_UCODE:
        case B43_FW_TYPE_PCM:
                size = be32_to_cpu(hdr->size);
-               if (size != (*fw)->size - sizeof(struct b43_fw_header))
+               if (size != blob->size - sizeof(struct b43_fw_header))
                        goto err_format;
                /* fallthrough */
        case B43_FW_TYPE_IV:
@@ -1626,10 +1648,15 @@ static int do_request_fw(struct b43_wldev *dev,
                goto err_format;
        }
 
-       return err;
+       fw->data = blob;
+       fw->filename = name;
+
+       return 0;
 
 err_format:
        b43err(dev->wl, "Firmware file \"%s\" format error.\n", path);
+       release_firmware(blob);
+
        return -EPROTO;
 }
 
@@ -1641,90 +1668,101 @@ static int b43_request_firmware(struct b43_wldev *dev)
        u32 tmshigh;
        int err;
 
+       /* Get microcode */
        tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
-       if (!fw->ucode) {
+       if ((rev >= 5) && (rev <= 10))
+               filename = "ucode5";
+       else if ((rev >= 11) && (rev <= 12))
+               filename = "ucode11";
+       else if (rev >= 13)
+               filename = "ucode13";
+       else
+               goto err_no_ucode;
+       err = do_request_fw(dev, filename, &fw->ucode);
+       if (err)
+               goto err_load;
+
+       /* Get PCM code */
+       if ((rev >= 5) && (rev <= 10))
+               filename = "pcm5";
+       else if (rev >= 11)
+               filename = NULL;
+       else
+               goto err_no_pcm;
+       err = do_request_fw(dev, filename, &fw->pcm);
+       if (err)
+               goto err_load;
+
+       /* Get initvals */
+       switch (dev->phy.type) {
+       case B43_PHYTYPE_A:
+               if ((rev >= 5) && (rev <= 10)) {
+                       if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
+                               filename = "a0g1initvals5";
+                       else
+                               filename = "a0g0initvals5";
+               } else
+                       goto err_no_initvals;
+               break;
+       case B43_PHYTYPE_G:
                if ((rev >= 5) && (rev <= 10))
-                       filename = "ucode5";
-               else if ((rev >= 11) && (rev <= 12))
-                       filename = "ucode11";
+                       filename = "b0g0initvals5";
                else if (rev >= 13)
-                       filename = "ucode13";
+                       filename = "lp0initvals13";
                else
-                       goto err_no_ucode;
-               err = do_request_fw(dev, filename, &fw->ucode);
-               if (err)
-                       goto err_load;
+                       goto err_no_initvals;
+               break;
+       case B43_PHYTYPE_N:
+               if ((rev >= 11) && (rev <= 12))
+                       filename = "n0initvals11";
+               else
+                       goto err_no_initvals;
+               break;
+       default:
+               goto err_no_initvals;
        }
-       if (!fw->pcm) {
+       err = do_request_fw(dev, filename, &fw->initvals);
+       if (err)
+               goto err_load;
+
+       /* Get bandswitch initvals */
+       switch (dev->phy.type) {
+       case B43_PHYTYPE_A:
+               if ((rev >= 5) && (rev <= 10)) {
+                       if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
+                               filename = "a0g1bsinitvals5";
+                       else
+                               filename = "a0g0bsinitvals5";
+               } else if (rev >= 11)
+                       filename = NULL;
+               else
+                       goto err_no_initvals;
+               break;
+       case B43_PHYTYPE_G:
                if ((rev >= 5) && (rev <= 10))
-                       filename = "pcm5";
+                       filename = "b0g0bsinitvals5";
                else if (rev >= 11)
                        filename = NULL;
                else
-                       goto err_no_pcm;
-               err = do_request_fw(dev, filename, &fw->pcm);
-               if (err)
-                       goto err_load;
-       }
-       if (!fw->initvals) {
-               switch (dev->phy.type) {
-               case B43_PHYTYPE_A:
-                       if ((rev >= 5) && (rev <= 10)) {
-                               if (tmshigh & B43_TMSHIGH_GPHY)
-                                       filename = "a0g1initvals5";
-                               else
-                                       filename = "a0g0initvals5";
-                       } else
-                               goto err_no_initvals;
-                       break;
-               case B43_PHYTYPE_G:
-                       if ((rev >= 5) && (rev <= 10))
-                               filename = "b0g0initvals5";
-                       else if (rev >= 13)
-                               filename = "lp0initvals13";
-                       else
-                               goto err_no_initvals;
-                       break;
-               default:
                        goto err_no_initvals;
-               }
-               err = do_request_fw(dev, filename, &fw->initvals);
-               if (err)
-                       goto err_load;
-       }
-       if (!fw->initvals_band) {
-               switch (dev->phy.type) {
-               case B43_PHYTYPE_A:
-                       if ((rev >= 5) && (rev <= 10)) {
-                               if (tmshigh & B43_TMSHIGH_GPHY)
-                                       filename = "a0g1bsinitvals5";
-                               else
-                                       filename = "a0g0bsinitvals5";
-                       } else if (rev >= 11)
-                               filename = NULL;
-                       else
-                               goto err_no_initvals;
-                       break;
-               case B43_PHYTYPE_G:
-                       if ((rev >= 5) && (rev <= 10))
-                               filename = "b0g0bsinitvals5";
-                       else if (rev >= 11)
-                               filename = NULL;
-                       else
-                               goto err_no_initvals;
-                       break;
-               default:
+               break;
+       case B43_PHYTYPE_N:
+               if ((rev >= 11) && (rev <= 12))
+                       filename = "n0bsinitvals11";
+               else
                        goto err_no_initvals;
-               }
-               err = do_request_fw(dev, filename, &fw->initvals_band);
-               if (err)
-                       goto err_load;
+               break;
+       default:
+               goto err_no_initvals;
        }
+       err = do_request_fw(dev, filename, &fw->initvals_band);
+       if (err)
+               goto err_load;
 
        return 0;
 
 err_load:
-       b43_print_fw_helptext(dev->wl);
+       b43_print_fw_helptext(dev->wl, 1);
        goto error;
 
 err_no_ucode:
@@ -1754,22 +1792,33 @@ static int b43_upload_microcode(struct b43_wldev *dev)
        const __be32 *data;
        unsigned int i, len;
        u16 fwrev, fwpatch, fwdate, fwtime;
-       u32 tmp;
+       u32 tmp, macctl;
        int err = 0;
 
+       /* Jump the microcode PSM to offset 0 */
+       macctl = b43_read32(dev, B43_MMIO_MACCTL);
+       B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
+       macctl |= B43_MACCTL_PSM_JMP0;
+       b43_write32(dev, B43_MMIO_MACCTL, macctl);
+       /* Zero out all microcode PSM registers and shared memory. */
+       for (i = 0; i < 64; i++)
+               b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
+       for (i = 0; i < 4096; i += 2)
+               b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
+
        /* Upload Microcode. */
-       data = (__be32 *) (dev->fw.ucode->data + hdr_len);
-       len = (dev->fw.ucode->size - hdr_len) / sizeof(__be32);
+       data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
+       len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
        b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
        for (i = 0; i < len; i++) {
                b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
                udelay(10);
        }
 
-       if (dev->fw.pcm) {
+       if (dev->fw.pcm.data) {
                /* Upload PCM data. */
-               data = (__be32 *) (dev->fw.pcm->data + hdr_len);
-               len = (dev->fw.pcm->size - hdr_len) / sizeof(__be32);
+               data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
+               len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
                b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
                b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
                /* No need for autoinc bit in SHM_HW */
@@ -1781,9 +1830,12 @@ static int b43_upload_microcode(struct b43_wldev *dev)
        }
 
        b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
-       b43_write32(dev, B43_MMIO_MACCTL,
-                   B43_MACCTL_PSM_RUN |
-                   B43_MACCTL_IHR_ENABLED | B43_MACCTL_INFRA);
+
+       /* Start the microcode PSM */
+       macctl = b43_read32(dev, B43_MMIO_MACCTL);
+       macctl &= ~B43_MACCTL_PSM_JMP0;
+       macctl |= B43_MACCTL_PSM_RUN;
+       b43_write32(dev, B43_MMIO_MACCTL, macctl);
 
        /* Wait for the microcode to load and respond */
        i = 0;
@@ -1792,13 +1844,17 @@ static int b43_upload_microcode(struct b43_wldev *dev)
                if (tmp == B43_IRQ_MAC_SUSPENDED)
                        break;
                i++;
-               if (i >= 50) {
+               if (i >= 20) {
                        b43err(dev->wl, "Microcode not responding\n");
-                       b43_print_fw_helptext(dev->wl);
+                       b43_print_fw_helptext(dev->wl, 1);
                        err = -ENODEV;
-                       goto out;
+                       goto error;
+               }
+               msleep_interruptible(50);
+               if (signal_pending(current)) {
+                       err = -EINTR;
+                       goto error;
                }
-               udelay(10);
        }
        b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
 
@@ -1812,10 +1868,9 @@ static int b43_upload_microcode(struct b43_wldev *dev)
                b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
                       "binary drivers older than version 4.x is unsupported. "
                       "You must upgrade your firmware files.\n");
-               b43_print_fw_helptext(dev->wl);
-               b43_write32(dev, B43_MMIO_MACCTL, 0);
+               b43_print_fw_helptext(dev->wl, 1);
                err = -EOPNOTSUPP;
-               goto out;
+               goto error;
        }
        b43dbg(dev->wl, "Loading firmware version %u.%u "
               "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
@@ -1826,7 +1881,20 @@ static int b43_upload_microcode(struct b43_wldev *dev)
        dev->fw.rev = fwrev;
        dev->fw.patch = fwpatch;
 
-      out:
+       if (b43_is_old_txhdr_format(dev)) {
+               b43warn(dev->wl, "You are using an old firmware image. "
+                       "Support for old firmware will be removed in July 2008.\n");
+               b43_print_fw_helptext(dev->wl, 0);
+       }
+
+       return 0;
+
+error:
+       macctl = b43_read32(dev, B43_MMIO_MACCTL);
+       macctl &= ~B43_MACCTL_PSM_RUN;
+       macctl |= B43_MACCTL_PSM_JMP0;
+       b43_write32(dev, B43_MMIO_MACCTL, macctl);
+
        return err;
 }
 
@@ -1886,7 +1954,7 @@ static int b43_write_initvals(struct b43_wldev *dev,
 
 err_format:
        b43err(dev->wl, "Initial Values Firmware file-format error.\n");
-       b43_print_fw_helptext(dev->wl);
+       b43_print_fw_helptext(dev->wl, 1);
 
        return -EPROTO;
 }
@@ -1900,19 +1968,19 @@ static int b43_upload_initvals(struct b43_wldev *dev)
        size_t count;
        int err;
 
-       hdr = (const struct b43_fw_header *)(fw->initvals->data);
-       ivals = (const struct b43_iv *)(fw->initvals->data + hdr_len);
+       hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
+       ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
        count = be32_to_cpu(hdr->size);
        err = b43_write_initvals(dev, ivals, count,
-                                fw->initvals->size - hdr_len);
+                                fw->initvals.data->size - hdr_len);
        if (err)
                goto out;
-       if (fw->initvals_band) {
-               hdr = (const struct b43_fw_header *)(fw->initvals_band->data);
-               ivals = (const struct b43_iv *)(fw->initvals_band->data + hdr_len);
+       if (fw->initvals_band.data) {
+               hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
+               ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
                count = be32_to_cpu(hdr->size);
                err = b43_write_initvals(dev, ivals, count,
-                                        fw->initvals_band->size - hdr_len);
+                                        fw->initvals_band.data->size - hdr_len);
                if (err)
                        goto out;
        }
@@ -1949,7 +2017,7 @@ static int b43_gpio_init(struct b43_wldev *dev)
                mask |= 0x0180;
                set |= 0x0180;
        }
-       if (dev->dev->bus->sprom.r1.boardflags_lo & B43_BFL_PACTRL) {
+       if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_PACTRL) {
                b43_write16(dev, B43_MMIO_GPIO_MASK,
                            b43_read16(dev, B43_MMIO_GPIO_MASK)
                            | 0x0200);
@@ -2119,6 +2187,7 @@ static void b43_rate_memory_init(struct b43_wldev *dev)
        switch (dev->phy.type) {
        case B43_PHYTYPE_A:
        case B43_PHYTYPE_G:
+       case B43_PHYTYPE_N:
                b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
                b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
                b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
@@ -2148,13 +2217,19 @@ static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
 
        switch (antenna) {
        case B43_ANTENNA0:
-               ant |= B43_TX4_PHY_ANT0;
+               ant |= B43_TXH_PHY_ANT0;
                break;
        case B43_ANTENNA1:
-               ant |= B43_TX4_PHY_ANT1;
+               ant |= B43_TXH_PHY_ANT1;
+               break;
+       case B43_ANTENNA2:
+               ant |= B43_TXH_PHY_ANT2;
+               break;
+       case B43_ANTENNA3:
+               ant |= B43_TXH_PHY_ANT3;
                break;
        case B43_ANTENNA_AUTO:
-               ant |= B43_TX4_PHY_ANTLAST;
+               ant |= B43_TXH_PHY_ANT01AUTO;
                break;
        default:
                B43_WARN_ON(1);
@@ -2164,15 +2239,15 @@ static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
 
        /* For Beacons */
        tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
-       tmp = (tmp & ~B43_TX4_PHY_ANT) | ant;
+       tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, tmp);
        /* For ACK/CTS */
        tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
-       tmp = (tmp & ~B43_TX4_PHY_ANT) | ant;
+       tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
        /* For Probe Resposes */
        tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
-       tmp = (tmp & ~B43_TX4_PHY_ANT) | ant;
+       tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
 }
 
@@ -2180,7 +2255,6 @@ static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
 static void b43_chip_exit(struct b43_wldev *dev)
 {
        b43_radio_turn_off(dev, 1);
-       b43_leds_exit(dev);
        b43_gpio_cleanup(dev);
        /* firmware is released later */
 }
@@ -2192,11 +2266,15 @@ static int b43_chip_init(struct b43_wldev *dev)
 {
        struct b43_phy *phy = &dev->phy;
        int err, tmp;
-       u32 value32;
+       u32 value32, macctl;
        u16 value16;
 
-       b43_write32(dev, B43_MMIO_MACCTL,
-                   B43_MACCTL_PSM_JMP0 | B43_MACCTL_IHR_ENABLED);
+       /* Initialize the MAC control */
+       macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
+       if (dev->phy.gmode)
+               macctl |= B43_MACCTL_GMODE;
+       macctl |= B43_MACCTL_INFRA;
+       b43_write32(dev, B43_MMIO_MACCTL, macctl);
 
        err = b43_request_firmware(dev);
        if (err)
@@ -2208,11 +2286,10 @@ static int b43_chip_init(struct b43_wldev *dev)
        err = b43_gpio_init(dev);
        if (err)
                goto out;       /* firmware is released later */
-       b43_leds_init(dev);
 
        err = b43_upload_initvals(dev);
        if (err)
-               goto err_leds_exit;
+               goto err_gpio_clean;
        b43_radio_turn_on(dev);
 
        b43_write16(dev, 0x03E6, 0x0000);
@@ -2242,14 +2319,6 @@ static int b43_chip_init(struct b43_wldev *dev)
        b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
                    | B43_MACCTL_INFRA);
 
-       if (b43_using_pio(dev)) {
-               b43_write32(dev, 0x0210, 0x00000100);
-               b43_write32(dev, 0x0230, 0x00000100);
-               b43_write32(dev, 0x0250, 0x00000100);
-               b43_write32(dev, 0x0270, 0x00000100);
-               b43_shm_write16(dev, B43_SHM_SHARED, 0x0034, 0x0000);
-       }
-
        /* Probe Response Timeout value */
        /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
        b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
@@ -2288,8 +2357,7 @@ out:
 
 err_radio_off:
        b43_radio_turn_off(dev, 1);
-err_leds_exit:
-       b43_leds_exit(dev);
+err_gpio_clean:
        b43_gpio_cleanup(dev);
        return err;
 }
@@ -2312,9 +2380,11 @@ static void b43_periodic_every60sec(struct b43_wldev *dev)
 {
        struct b43_phy *phy = &dev->phy;
 
+       if (phy->type != B43_PHYTYPE_G)
+               return;
        if (!b43_has_hardware_pctl(phy))
                b43_lo_g_ctl_mark_all_unused(dev);
-       if (dev->dev->bus->sprom.r1.boardflags_lo & B43_BFL_RSSI) {
+       if (dev->dev->bus->sprom.boardflags_lo & B43_BFL_RSSI) {
                b43_mac_suspend(dev);
                b43_calc_nrssi_slope(dev);
                if ((phy->radio_ver == 0x2050) && (phy->radio_rev == 8)) {
@@ -2366,6 +2436,9 @@ static void b43_periodic_every15sec(struct b43_wldev *dev)
        }
        b43_phy_xmitpower(dev); //FIXME: unless scanning?
        //TODO for APHY (temperature?)
+
+       atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
+       wmb();
 }
 
 static void do_periodic_work(struct b43_wldev *dev)
@@ -2423,32 +2496,42 @@ static void b43_periodic_tasks_setup(struct b43_wldev *dev)
        queue_delayed_work(dev->wl->hw->workqueue, work, 0);
 }
 
-/* Validate access to the chip (SHM) */
+/* Check if communication with the device works correctly. */
 static int b43_validate_chipaccess(struct b43_wldev *dev)
 {
-       u32 value;
-       u32 shm_backup;
+       u32 v, backup;
 
-       shm_backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
-       b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
-       if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
-               goto error;
+       backup = b43_shm_read32(dev, B43_SHM_SHARED, 0);
+
+       /* Check for read/write and endianness problems. */
        b43_shm_write32(dev, B43_SHM_SHARED, 0, 0x55AAAA55);
        if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0x55AAAA55)
                goto error;
-       b43_shm_write32(dev, B43_SHM_SHARED, 0, shm_backup);
-
-       value = b43_read32(dev, B43_MMIO_MACCTL);
-       if ((value | B43_MACCTL_GMODE) !=
-           (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
+       b43_shm_write32(dev, B43_SHM_SHARED, 0, 0xAA5555AA);
+       if (b43_shm_read32(dev, B43_SHM_SHARED, 0) != 0xAA5555AA)
                goto error;
 
-       value = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
-       if (value)
+       b43_shm_write32(dev, B43_SHM_SHARED, 0, backup);
+
+       if ((dev->dev->id.revision >= 3) && (dev->dev->id.revision <= 10)) {
+               /* The 32bit register shadows the two 16bit registers
+                * with update sideeffects. Validate this. */
+               b43_write16(dev, B43_MMIO_TSF_CFP_START, 0xAAAA);
+               b43_write32(dev, B43_MMIO_TSF_CFP_START, 0xCCCCBBBB);
+               if (b43_read16(dev, B43_MMIO_TSF_CFP_START_LOW) != 0xBBBB)
+                       goto error;
+               if (b43_read16(dev, B43_MMIO_TSF_CFP_START_HIGH) != 0xCCCC)
+                       goto error;
+       }
+       b43_write32(dev, B43_MMIO_TSF_CFP_START, 0);
+
+       v = b43_read32(dev, B43_MMIO_MACCTL);
+       v |= B43_MACCTL_GMODE;
+       if (v != (B43_MACCTL_GMODE | B43_MACCTL_IHR_ENABLED))
                goto error;
 
        return 0;
-      error:
+error:
        b43err(dev->wl, "Failed to validate the chipaccess\n");
        return -ENODEV;
 }
@@ -2511,40 +2594,35 @@ static int b43_rng_init(struct b43_wl *wl)
        return err;
 }
 
-static int b43_tx(struct ieee80211_hw *hw,
-                 struct sk_buff *skb, struct ieee80211_tx_control *ctl)
+static int b43_op_tx(struct ieee80211_hw *hw,
+                    struct sk_buff *skb,
+                    struct ieee80211_tx_control *ctl)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
        int err = -ENODEV;
-       unsigned long flags;
 
        if (unlikely(!dev))
                goto out;
        if (unlikely(b43_status(dev) < B43_STAT_STARTED))
                goto out;
        /* DMA-TX is done without a global lock. */
-       if (b43_using_pio(dev)) {
-               spin_lock_irqsave(&wl->irq_lock, flags);
-               err = b43_pio_tx(dev, skb, ctl);
-               spin_unlock_irqrestore(&wl->irq_lock, flags);
-       } else
-               err = b43_dma_tx(dev, skb, ctl);
-      out:
+       err = b43_dma_tx(dev, skb, ctl);
+out:
        if (unlikely(err))
                return NETDEV_TX_BUSY;
        return NETDEV_TX_OK;
 }
 
-static int b43_conf_tx(struct ieee80211_hw *hw,
-                      int queue,
-                      const struct ieee80211_tx_queue_params *params)
+static int b43_op_conf_tx(struct ieee80211_hw *hw,
+                         int queue,
+                         const struct ieee80211_tx_queue_params *params)
 {
        return 0;
 }
 
-static int b43_get_tx_stats(struct ieee80211_hw *hw,
-                           struct ieee80211_tx_queue_stats *stats)
+static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
+                              struct ieee80211_tx_queue_stats *stats)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
@@ -2555,19 +2633,16 @@ static int b43_get_tx_stats(struct ieee80211_hw *hw,
                goto out;
        spin_lock_irqsave(&wl->irq_lock, flags);
        if (likely(b43_status(dev) >= B43_STAT_STARTED)) {
-               if (b43_using_pio(dev))
-                       b43_pio_get_tx_stats(dev, stats);
-               else
-                       b43_dma_get_tx_stats(dev, stats);
+               b43_dma_get_tx_stats(dev, stats);
                err = 0;
        }
        spin_unlock_irqrestore(&wl->irq_lock, flags);
-      out:
+out:
        return err;
 }
 
-static int b43_get_stats(struct ieee80211_hw *hw,
-                        struct ieee80211_low_level_stats *stats)
+static int b43_op_get_stats(struct ieee80211_hw *hw,
+                           struct ieee80211_low_level_stats *stats)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        unsigned long flags;
@@ -2706,8 +2781,36 @@ static int b43_switch_phymode(struct b43_wl *wl, unsigned int new_mode)
        return err;
 }
 
-static int b43_antenna_from_ieee80211(u8 antenna)
+/* Check if the use of the antenna that ieee80211 told us to
+ * use is possible. This will fall back to DEFAULT.
+ * "antenna_nr" is the antenna identifier we got from ieee80211. */
+u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
+                                 u8 antenna_nr)
 {
+       u8 antenna_mask;
+
+       if (antenna_nr == 0) {
+               /* Zero means "use default antenna". That's always OK. */
+               return 0;
+       }
+
+       /* Get the mask of available antennas. */
+       if (dev->phy.gmode)
+               antenna_mask = dev->dev->bus->sprom.ant_available_bg;
+       else
+               antenna_mask = dev->dev->bus->sprom.ant_available_a;
+
+       if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
+               /* This antenna is not available. Fall back to default. */
+               return 0;
+       }
+
+       return antenna_nr;
+}
+
+static int b43_antenna_from_ieee80211(struct b43_wldev *dev, u8 antenna)
+{
+       antenna = b43_ieee80211_antenna_sanitize(dev, antenna);
        switch (antenna) {
        case 0:         /* default/diversity */
                return B43_ANTENNA_DEFAULT;
@@ -2715,37 +2818,34 @@ static int b43_antenna_from_ieee80211(u8 antenna)
                return B43_ANTENNA0;
        case 2:         /* Antenna 1 */
                return B43_ANTENNA1;
+       case 3:         /* Antenna 2 */
+               return B43_ANTENNA2;
+       case 4:         /* Antenna 3 */
+               return B43_ANTENNA3;
        default:
                return B43_ANTENNA_DEFAULT;
        }
 }
 
-static int b43_dev_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
+static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev;
        struct b43_phy *phy;
        unsigned long flags;
        unsigned int new_phymode = 0xFFFF;
-       int antenna_tx;
-       int antenna_rx;
+       int antenna;
        int err = 0;
        u32 savedirqs;
 
-       antenna_tx = b43_antenna_from_ieee80211(conf->antenna_sel_tx);
-       antenna_rx = b43_antenna_from_ieee80211(conf->antenna_sel_rx);
-
        mutex_lock(&wl->mutex);
 
        /* Switch the PHY mode (if necessary). */
-       switch (conf->phymode) {
-       case MODE_IEEE80211A:
+       switch (conf->channel->band) {
+       case IEEE80211_BAND_5GHZ:
                new_phymode = B43_PHYMODE_A;
                break;
-       case MODE_IEEE80211B:
-               new_phymode = B43_PHYMODE_B;
-               break;
-       case MODE_IEEE80211G:
+       case IEEE80211_BAND_2GHZ:
                new_phymode = B43_PHYMODE_G;
                break;
        default:
@@ -2771,8 +2871,8 @@ static int b43_dev_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
 
        /* Switch to the requested channel.
         * The firmware takes care of races with the TX handler. */
-       if (conf->channel_val != phy->channel)
-               b43_radio_selectchannel(dev, conf->channel_val, 0);
+       if (conf->channel->hw_value != phy->channel)
+               b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
 
        /* Enable/Disable ShortSlot timing. */
        if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
@@ -2784,6 +2884,8 @@ static int b43_dev_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
                        b43_short_slot_timing_disable(dev);
        }
 
+       dev->wl->radiotap_enabled = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
+
        /* Adjust the desired TX power level. */
        if (conf->power_level != 0) {
                if (conf->power_level != phy->power_level) {
@@ -2793,8 +2895,10 @@ static int b43_dev_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
        }
 
        /* Antennas for RX and management frame TX. */
-       b43_mgmtframe_txantenna(dev, antenna_tx);
-       b43_set_rx_antenna(dev, antenna_rx);
+       antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_tx);
+       b43_mgmtframe_txantenna(dev, antenna);
+       antenna = b43_antenna_from_ieee80211(dev, conf->antenna_sel_rx);
+       b43_set_rx_antenna(dev, antenna);
 
        /* Update templates for AP mode. */
        if (b43_is_mode(wl, IEEE80211_IF_TYPE_AP))
@@ -2825,22 +2929,30 @@ static int b43_dev_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
        return err;
 }
 
-static int b43_dev_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+static int b43_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                           const u8 *local_addr, const u8 *addr,
                           struct ieee80211_key_conf *key)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
-       struct b43_wldev *dev = wl->current_dev;
+       struct b43_wldev *dev;
        unsigned long flags;
        u8 algorithm;
        u8 index;
-       int err = -EINVAL;
+       int err;
+       DECLARE_MAC_BUF(mac);
 
        if (modparam_nohwcrypt)
                return -ENOSPC; /* User disabled HW-crypto */
 
-       if (!dev)
-               return -ENODEV;
+       mutex_lock(&wl->mutex);
+       spin_lock_irqsave(&wl->irq_lock, flags);
+
+       dev = wl->current_dev;
+       err = -ENODEV;
+       if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
+               goto out_unlock;
+
+       err = -EINVAL;
        switch (key->alg) {
        case ALG_WEP:
                if (key->keylen == 5)
@@ -2856,20 +2968,11 @@ static int b43_dev_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                break;
        default:
                B43_WARN_ON(1);
-               goto out;
+               goto out_unlock;
        }
-
        index = (u8) (key->keyidx);
        if (index > 3)
-               goto out;
-
-       mutex_lock(&wl->mutex);
-       spin_lock_irqsave(&wl->irq_lock, flags);
-
-       if (b43_status(dev) < B43_STAT_INITIALIZED) {
-               err = -ENODEV;
                goto out_unlock;
-       }
 
        switch (cmd) {
        case SET_KEY:
@@ -2915,19 +3018,18 @@ static int b43_dev_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 out_unlock:
        spin_unlock_irqrestore(&wl->irq_lock, flags);
        mutex_unlock(&wl->mutex);
-out:
        if (!err) {
                b43dbg(wl, "%s hardware based encryption for keyidx: %d, "
-                      "mac: " MAC_FMT "\n",
+                      "mac: %s\n",
                       cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
-                      MAC_ARG(addr));
+                      print_mac(mac, addr));
        }
        return err;
 }
 
-static void b43_configure_filter(struct ieee80211_hw *hw,
-                                unsigned int changed, unsigned int *fflags,
-                                int mc_count, struct dev_addr_list *mc_list)
+static void b43_op_configure_filter(struct ieee80211_hw *hw,
+                                   unsigned int changed, unsigned int *fflags,
+                                   int mc_count, struct dev_addr_list *mc_list)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
@@ -2962,8 +3064,9 @@ static void b43_configure_filter(struct ieee80211_hw *hw,
        spin_unlock_irqrestore(&wl->irq_lock, flags);
 }
 
-static int b43_config_interface(struct ieee80211_hw *hw,
-                               int if_id, struct ieee80211_if_conf *conf)
+static int b43_op_config_interface(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_if_conf *conf)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
@@ -2973,7 +3076,7 @@ static int b43_config_interface(struct ieee80211_hw *hw,
                return -ENODEV;
        mutex_lock(&wl->mutex);
        spin_lock_irqsave(&wl->irq_lock, flags);
-       B43_WARN_ON(wl->if_id != if_id);
+       B43_WARN_ON(wl->vif != vif);
        if (conf->bssid)
                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
        else
@@ -2983,7 +3086,7 @@ static int b43_config_interface(struct ieee80211_hw *hw,
                        B43_WARN_ON(conf->type != IEEE80211_IF_TYPE_AP);
                        b43_set_ssid(dev, conf->ssid, conf->ssid_len);
                        if (conf->beacon)
-                               b43_refresh_templates(dev, conf->beacon);
+                               b43_update_templates(wl, conf->beacon);
                }
                b43_write_mac_bssid_templates(dev);
        }
@@ -3001,6 +3104,16 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
 
        if (b43_status(dev) < B43_STAT_STARTED)
                return;
+
+       /* Disable and sync interrupts. We must do this before than
+        * setting the status to INITIALIZED, as the interrupt handler
+        * won't care about IRQs then. */
+       spin_lock_irqsave(&wl->irq_lock, flags);
+       dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
+       b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
+       spin_unlock_irqrestore(&wl->irq_lock, flags);
+       b43_synchronize_irq(dev);
+
        b43_set_status(dev, B43_STAT_INITIALIZED);
 
        mutex_unlock(&wl->mutex);
@@ -3011,13 +3124,6 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
 
        ieee80211_stop_queues(wl->hw);  //FIXME this could cause a deadlock, as mac80211 seems buggy.
 
-       /* Disable and sync interrupts. */
-       spin_lock_irqsave(&wl->irq_lock, flags);
-       dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
-       b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
-       spin_unlock_irqrestore(&wl->irq_lock, flags);
-       b43_synchronize_irq(dev);
-
        b43_mac_suspend(dev);
        free_irq(dev->dev->irq, dev);
        b43dbg(wl, "Wireless interface stopped\n");
@@ -3083,9 +3189,15 @@ static int b43_phy_versioning(struct b43_wldev *dev)
                        unsupported = 1;
                break;
        case B43_PHYTYPE_G:
-               if (phy_rev > 8)
+               if (phy_rev > 9)
+                       unsupported = 1;
+               break;
+#ifdef CONFIG_B43_NPHY
+       case B43_PHYTYPE_N:
+               if (phy_rev > 1)
                        unsupported = 1;
                break;
+#endif
        default:
                unsupported = 1;
        };
@@ -3108,14 +3220,15 @@ static int b43_phy_versioning(struct b43_wldev *dev)
                        tmp = 0x5205017F;
        } else {
                b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
-               tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH);
-               tmp <<= 16;
+               tmp = b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
                b43_write16(dev, B43_MMIO_RADIO_CONTROL, B43_RADIOCTL_ID);
-               tmp |= b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
+               tmp |= (u32)b43_read16(dev, B43_MMIO_RADIO_DATA_HIGH) << 16;
        }
        radio_manuf = (tmp & 0x00000FFF);
        radio_ver = (tmp & 0x0FFFF000) >> 12;
        radio_rev = (tmp & 0xF0000000) >> 28;
+       if (radio_manuf != 0x17F /* Broadcom */)
+               unsupported = 1;
        switch (phy_type) {
        case B43_PHYTYPE_A:
                if (radio_ver != 0x2060)
@@ -3133,6 +3246,10 @@ static int b43_phy_versioning(struct b43_wldev *dev)
                if (radio_ver != 0x2050)
                        unsupported = 1;
                break;
+       case B43_PHYTYPE_N:
+               if (radio_ver != 0x2055)
+                       unsupported = 1;
+               break;
        default:
                B43_WARN_ON(1);
        }
@@ -3165,9 +3282,6 @@ static void setup_struct_phy_for_init(struct b43_wldev *dev,
        memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
        memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
 
-       /* Flags */
-       phy->locked = 0;
-
        phy->aci_enable = 0;
        phy->aci_wlan_automatic = 0;
        phy->aci_hw_rssi = 0;
@@ -3194,17 +3308,22 @@ static void setup_struct_phy_for_init(struct b43_wldev *dev,
        phy->lofcal = 0xFFFF;
        phy->initval = 0xFFFF;
 
-       spin_lock_init(&phy->lock);
        phy->interfmode = B43_INTERFMODE_NONE;
        phy->channel = 0xFF;
 
        phy->hardware_power_control = !!modparam_hwpctl;
+
+       /* PHY TX errors counter. */
+       atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
+
+       /* OFDM-table address caching. */
+       phy->ofdmtab_addr_direction = B43_OFDMTAB_DIRECTION_UNKNOWN;
 }
 
 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
 {
-       /* Flags */
-       dev->reg124_set_0x4 = 0;
+       dev->dfq_valid = 0;
+
        /* Assume the radio is enabled. If it's not enabled, the state will
         * immediately get fixed on the first periodic work run. */
        dev->radio_hw_enable = 1;
@@ -3230,13 +3349,13 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev)
        struct ssb_sprom *sprom = &dev->dev->bus->sprom;
        u32 hf;
 
-       if (!(sprom->r1.boardflags_lo & B43_BFL_BTCOEXIST))
+       if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
                return;
        if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
                return;
 
        hf = b43_hf_read(dev);
-       if (sprom->r1.boardflags_lo & B43_BFL_BTCMOD)
+       if (sprom->boardflags_lo & B43_BFL_BTCMOD)
                hf |= B43_HF_BTCOEXALT;
        else
                hf |= B43_HF_BTCOEX;
@@ -3275,23 +3394,42 @@ static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
 #endif /* CONFIG_SSB_DRIVER_PCICORE */
 }
 
+/* Write the short and long frame retry limit values. */
+static void b43_set_retry_limits(struct b43_wldev *dev,
+                                unsigned int short_retry,
+                                unsigned int long_retry)
+{
+       /* The retry limit is a 4-bit counter. Enforce this to avoid overflowing
+        * the chip-internal counter. */
+       short_retry = min(short_retry, (unsigned int)0xF);
+       long_retry = min(long_retry, (unsigned int)0xF);
+
+       b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT,
+                       short_retry);
+       b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT,
+                       long_retry);
+}
+
 /* Shutdown a wireless core */
 /* Locking: wl->mutex */
 static void b43_wireless_core_exit(struct b43_wldev *dev)
 {
        struct b43_phy *phy = &dev->phy;
+       u32 macctl;
 
        B43_WARN_ON(b43_status(dev) > B43_STAT_INITIALIZED);
        if (b43_status(dev) != B43_STAT_INITIALIZED)
                return;
        b43_set_status(dev, B43_STAT_UNINIT);
 
-       mutex_unlock(&dev->wl->mutex);
-       b43_rfkill_exit(dev);
-       mutex_lock(&dev->wl->mutex);
+       /* Stop the microcode PSM. */
+       macctl = b43_read32(dev, B43_MMIO_MACCTL);
+       macctl &= ~B43_MACCTL_PSM_RUN;
+       macctl |= B43_MACCTL_PSM_JMP0;
+       b43_write32(dev, B43_MMIO_MACCTL, macctl);
 
+       b43_leds_exit(dev);
        b43_rng_exit(dev->wl);
-       b43_pio_free(dev);
        b43_dma_free(dev);
        b43_chip_exit(dev);
        b43_radio_turn_off(dev, 1);
@@ -3300,6 +3438,11 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
                kfree(phy->tssi2dbm);
        kfree(phy->lo_control);
        phy->lo_control = NULL;
+       if (dev->wl->current_beacon) {
+               dev_kfree_skb_any(dev->wl->current_beacon);
+               dev->wl->current_beacon = NULL;
+       }
+
        ssb_device_disable(dev->dev, 0);
        ssb_bus_may_powerdown(dev->dev->bus);
 }
@@ -3354,7 +3497,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
                hf |= B43_HF_SYMW;
                if (phy->rev == 1)
                        hf |= B43_HF_GDCW;
-               if (sprom->r1.boardflags_lo & B43_BFL_PACTRL)
+               if (sprom->boardflags_lo & B43_BFL_PACTRL)
                        hf |= B43_HF_OFDMPABOOST;
        } else if (phy->type == B43_PHYTYPE_B) {
                hf |= B43_HF_SYMW;
@@ -3363,15 +3506,8 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
        }
        b43_hf_write(dev, hf);
 
-       /* Short/Long Retry Limit.
-        * The retry-limit is a 4-bit counter. Enforce this to avoid overflowing
-        * the chip-internal counter.
-        */
-       tmp = limit_value(modparam_short_retry, 0, 0xF);
-       b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_SRLIMIT, tmp);
-       tmp = limit_value(modparam_long_retry, 0, 0xF);
-       b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_LRLIMIT, tmp);
-
+       b43_set_retry_limits(dev, B43_DEFAULT_SHORT_RETRY_LIMIT,
+                            B43_DEFAULT_LONG_RETRY_LIMIT);
        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_SFFBLIM, 3);
        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_LFFBLIM, 2);
 
@@ -3392,17 +3528,10 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
        /* Maximum Contention Window */
        b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
 
-       do {
-               if (b43_using_pio(dev)) {
-                       err = b43_pio_init(dev);
-               } else {
-                       err = b43_dma_init(dev);
-                       if (!err)
-                               b43_qos_init(dev);
-               }
-       } while (err == -EAGAIN);
+       err = b43_dma_init(dev);
        if (err)
                goto err_chip_exit;
+       b43_qos_init(dev);
 
 //FIXME
 #if 1
@@ -3414,16 +3543,14 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
        b43_bluetooth_coext_enable(dev);
 
        ssb_bus_powerup(bus, 1);        /* Enable dynamic PCTL */
-       memset(wl->bssid, 0, ETH_ALEN);
-       memset(wl->mac_addr, 0, ETH_ALEN);
        b43_upload_card_macaddress(dev);
        b43_security_init(dev);
-       b43_rfkill_init(dev);
        b43_rng_init(wl);
 
        b43_set_status(dev, B43_STAT_INITIALIZED);
 
-      out:
+       b43_leds_init(dev);
+out:
        return err;
 
       err_chip_exit:
@@ -3440,8 +3567,8 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
        return err;
 }
 
-static int b43_add_interface(struct ieee80211_hw *hw,
-                            struct ieee80211_if_init_conf *conf)
+static int b43_op_add_interface(struct ieee80211_hw *hw,
+                               struct ieee80211_if_init_conf *conf)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev;
@@ -3464,7 +3591,7 @@ static int b43_add_interface(struct ieee80211_hw *hw,
 
        dev = wl->current_dev;
        wl->operating = 1;
-       wl->if_id = conf->if_id;
+       wl->vif = conf->vif;
        wl->if_type = conf->type;
        memcpy(wl->mac_addr, conf->mac_addr, ETH_ALEN);
 
@@ -3480,8 +3607,8 @@ static int b43_add_interface(struct ieee80211_hw *hw,
        return err;
 }
 
-static void b43_remove_interface(struct ieee80211_hw *hw,
-                                struct ieee80211_if_init_conf *conf)
+static void b43_op_remove_interface(struct ieee80211_hw *hw,
+                                   struct ieee80211_if_init_conf *conf)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
@@ -3492,7 +3619,8 @@ static void b43_remove_interface(struct ieee80211_hw *hw,
        mutex_lock(&wl->mutex);
 
        B43_WARN_ON(!wl->operating);
-       B43_WARN_ON(wl->if_id != conf->if_id);
+       B43_WARN_ON(wl->vif != conf->vif);
+       wl->vif = NULL;
 
        wl->operating = 0;
 
@@ -3505,19 +3633,34 @@ static void b43_remove_interface(struct ieee80211_hw *hw,
        mutex_unlock(&wl->mutex);
 }
 
-static int b43_start(struct ieee80211_hw *hw)
+static int b43_op_start(struct ieee80211_hw *hw)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
        int did_init = 0;
        int err = 0;
+       bool do_rfkill_exit = 0;
+
+       /* Kill all old instance specific information to make sure
+        * the card won't use it in the short timeframe between start
+        * and mac80211 reconfiguring it. */
+       memset(wl->bssid, 0, ETH_ALEN);
+       memset(wl->mac_addr, 0, ETH_ALEN);
+       wl->filter_flags = 0;
+       wl->radiotap_enabled = 0;
+
+       /* First register RFkill.
+        * LEDs that are registered later depend on it. */
+       b43_rfkill_init(dev);
 
        mutex_lock(&wl->mutex);
 
        if (b43_status(dev) < B43_STAT_INITIALIZED) {
                err = b43_wireless_core_init(dev);
-               if (err)
+               if (err) {
+                       do_rfkill_exit = 1;
                        goto out_mutex_unlock;
+               }
                did_init = 1;
        }
 
@@ -3526,6 +3669,7 @@ static int b43_start(struct ieee80211_hw *hw)
                if (err) {
                        if (did_init)
                                b43_wireless_core_exit(dev);
+                       do_rfkill_exit = 1;
                        goto out_mutex_unlock;
                }
        }
@@ -3533,14 +3677,19 @@ static int b43_start(struct ieee80211_hw *hw)
  out_mutex_unlock:
        mutex_unlock(&wl->mutex);
 
+       if (do_rfkill_exit)
+               b43_rfkill_exit(dev);
+
        return err;
 }
 
-static void b43_stop(struct ieee80211_hw *hw)
+static void b43_op_stop(struct ieee80211_hw *hw)
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
        struct b43_wldev *dev = wl->current_dev;
 
+       b43_rfkill_exit(dev);
+
        mutex_lock(&wl->mutex);
        if (b43_status(dev) >= B43_STAT_STARTED)
                b43_wireless_core_stop(dev);
@@ -3548,19 +3697,76 @@ static void b43_stop(struct ieee80211_hw *hw)
        mutex_unlock(&wl->mutex);
 }
 
+static int b43_op_set_retry_limit(struct ieee80211_hw *hw,
+                                 u32 short_retry_limit, u32 long_retry_limit)
+{
+       struct b43_wl *wl = hw_to_b43_wl(hw);
+       struct b43_wldev *dev;
+       int err = 0;
+
+       mutex_lock(&wl->mutex);
+       dev = wl->current_dev;
+       if (unlikely(!dev || (b43_status(dev) < B43_STAT_INITIALIZED))) {
+               err = -ENODEV;
+               goto out_unlock;
+       }
+       b43_set_retry_limits(dev, short_retry_limit, long_retry_limit);
+out_unlock:
+       mutex_unlock(&wl->mutex);
+
+       return err;
+}
+
+static int b43_op_beacon_set_tim(struct ieee80211_hw *hw, int aid, int set)
+{
+       struct b43_wl *wl = hw_to_b43_wl(hw);
+       struct sk_buff *beacon;
+       unsigned long flags;
+
+       /* We could modify the existing beacon and set the aid bit in
+        * the TIM field, but that would probably require resizing and
+        * moving of data within the beacon template.
+        * Simply request a new beacon and let mac80211 do the hard work. */
+       beacon = ieee80211_beacon_get(hw, wl->vif, NULL);
+       if (unlikely(!beacon))
+               return -ENOMEM;
+       spin_lock_irqsave(&wl->irq_lock, flags);
+       b43_update_templates(wl, beacon);
+       spin_unlock_irqrestore(&wl->irq_lock, flags);
+
+       return 0;
+}
+
+static int b43_op_ibss_beacon_update(struct ieee80211_hw *hw,
+                                    struct sk_buff *beacon,
+                                    struct ieee80211_tx_control *ctl)
+{
+       struct b43_wl *wl = hw_to_b43_wl(hw);
+       unsigned long flags;
+
+       spin_lock_irqsave(&wl->irq_lock, flags);
+       b43_update_templates(wl, beacon);
+       spin_unlock_irqrestore(&wl->irq_lock, flags);
+
+       return 0;
+}
+
 static const struct ieee80211_ops b43_hw_ops = {
-       .tx = b43_tx,
-       .conf_tx = b43_conf_tx,
-       .add_interface = b43_add_interface,
-       .remove_interface = b43_remove_interface,
-       .config = b43_dev_config,
-       .config_interface = b43_config_interface,
-       .configure_filter = b43_configure_filter,
-       .set_key = b43_dev_set_key,
-       .get_stats = b43_get_stats,
-       .get_tx_stats = b43_get_tx_stats,
-       .start = b43_start,
-       .stop = b43_stop,
+       .tx                     = b43_op_tx,
+       .conf_tx                = b43_op_conf_tx,
+       .add_interface          = b43_op_add_interface,
+       .remove_interface       = b43_op_remove_interface,
+       .config                 = b43_op_config,
+       .config_interface       = b43_op_config_interface,
+       .configure_filter       = b43_op_configure_filter,
+       .set_key                = b43_op_set_key,
+       .get_stats              = b43_op_get_stats,
+       .get_tx_stats           = b43_op_get_tx_stats,
+       .start                  = b43_op_start,
+       .stop                   = b43_op_stop,
+       .set_retry_limit        = b43_op_set_retry_limit,
+       .set_tim                = b43_op_beacon_set_tim,
+       .beacon_update          = b43_op_ibss_beacon_update,
 };
 
 /* Hard-reset the chip. Do not call this directly.
@@ -3605,79 +3811,26 @@ static void b43_chip_reset(struct work_struct *work)
 }
 
 static int b43_setup_modes(struct b43_wldev *dev,
-                          int have_aphy, int have_bphy, int have_gphy)
+                          bool have_2ghz_phy, bool have_5ghz_phy)
 {
        struct ieee80211_hw *hw = dev->wl->hw;
-       struct ieee80211_hw_mode *mode;
        struct b43_phy *phy = &dev->phy;
-       int cnt = 0;
-       int err;
 
-/*FIXME: Don't tell ieee80211 about an A-PHY, because we currently don't support A-PHY. */
-       have_aphy = 0;
-
-       phy->possible_phymodes = 0;
-       for (; 1; cnt++) {
-               if (have_aphy) {
-                       B43_WARN_ON(cnt >= B43_MAX_PHYHWMODES);
-                       mode = &phy->hwmodes[cnt];
-
-                       mode->mode = MODE_IEEE80211A;
-                       mode->num_channels = b43_a_chantable_size;
-                       mode->channels = b43_a_chantable;
-                       mode->num_rates = b43_a_ratetable_size;
-                       mode->rates = b43_a_ratetable;
-                       err = ieee80211_register_hwmode(hw, mode);
-                       if (err)
-                               return err;
-
-                       phy->possible_phymodes |= B43_PHYMODE_A;
-                       have_aphy = 0;
-                       continue;
-               }
-               if (have_bphy) {
-                       B43_WARN_ON(cnt >= B43_MAX_PHYHWMODES);
-                       mode = &phy->hwmodes[cnt];
-
-                       mode->mode = MODE_IEEE80211B;
-                       mode->num_channels = b43_bg_chantable_size;
-                       mode->channels = b43_bg_chantable;
-                       mode->num_rates = b43_b_ratetable_size;
-                       mode->rates = b43_b_ratetable;
-                       err = ieee80211_register_hwmode(hw, mode);
-                       if (err)
-                               return err;
-
-                       phy->possible_phymodes |= B43_PHYMODE_B;
-                       have_bphy = 0;
-                       continue;
-               }
-               if (have_gphy) {
-                       B43_WARN_ON(cnt >= B43_MAX_PHYHWMODES);
-                       mode = &phy->hwmodes[cnt];
-
-                       mode->mode = MODE_IEEE80211G;
-                       mode->num_channels = b43_bg_chantable_size;
-                       mode->channels = b43_bg_chantable;
-                       mode->num_rates = b43_g_ratetable_size;
-                       mode->rates = b43_g_ratetable;
-                       err = ieee80211_register_hwmode(hw, mode);
-                       if (err)
-                               return err;
-
-                       phy->possible_phymodes |= B43_PHYMODE_G;
-                       have_gphy = 0;
-                       continue;
-               }
-               break;
-       }
+       /* XXX: This function will go away soon, when mac80211
+        *      band stuff is rewritten. So this is just a hack.
+        *      For now we always claim GPHY mode, as there is no
+        *      support for NPHY and APHY in the device, yet.
+        *      This assumption is OK, as any B, N or A PHY will already
+        *      have died a horrible sanity check death earlier. */
+
+       hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
+       phy->possible_phymodes |= B43_PHYMODE_G;
 
        return 0;
 }
 
 static void b43_wireless_core_detach(struct b43_wldev *dev)
 {
-       b43_rfkill_free(dev);
        /* We release firmware that late to not be required to re-request
         * is all the time when we reinit the core. */
        b43_release_firmware(dev);
@@ -3689,7 +3842,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
        struct ssb_bus *bus = dev->dev->bus;
        struct pci_dev *pdev = bus->host_pci;
        int err;
-       int have_aphy = 0, have_bphy = 0, have_gphy = 0;
+       bool have_2ghz_phy = 0, have_5ghz_phy = 0;
        u32 tmp;
 
        /* Do NOT do any device initialization here.
@@ -3709,17 +3862,12 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
                u32 tmshigh;
 
                tmshigh = ssb_read32(dev->dev, SSB_TMSHIGH);
-               have_aphy = !!(tmshigh & B43_TMSHIGH_APHY);
-               have_gphy = !!(tmshigh & B43_TMSHIGH_GPHY);
-               if (!have_aphy && !have_gphy)
-                       have_bphy = 1;
-       } else if (dev->dev->id.revision == 4) {
-               have_gphy = 1;
-               have_aphy = 1;
+               have_2ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY);
+               have_5ghz_phy = !!(tmshigh & B43_TMSHIGH_HAVE_5GHZ_PHY);
        } else
-               have_bphy = 1;
+               B43_WARN_ON(1);
 
-       dev->phy.gmode = (have_gphy || have_bphy);
+       dev->phy.gmode = have_2ghz_phy;
        tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
        b43_wireless_core_reset(dev, tmp);
 
@@ -3731,31 +3879,34 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
            (pdev->device != 0x4312 &&
             pdev->device != 0x4319 && pdev->device != 0x4324)) {
                /* No multiband support. */
-               have_aphy = 0;
-               have_bphy = 0;
-               have_gphy = 0;
+               have_2ghz_phy = 0;
+               have_5ghz_phy = 0;
                switch (dev->phy.type) {
                case B43_PHYTYPE_A:
-                       have_aphy = 1;
-                       break;
-               case B43_PHYTYPE_B:
-                       have_bphy = 1;
+                       have_5ghz_phy = 1;
                        break;
                case B43_PHYTYPE_G:
-                       have_gphy = 1;
+               case B43_PHYTYPE_N:
+                       have_2ghz_phy = 1;
                        break;
                default:
                        B43_WARN_ON(1);
                }
        }
-       dev->phy.gmode = (have_gphy || have_bphy);
+       if (dev->phy.type == B43_PHYTYPE_A) {
+               /* FIXME */
+               b43err(wl, "IEEE 802.11a devices are unsupported\n");
+               err = -EOPNOTSUPP;
+               goto err_powerdown;
+       }
+       dev->phy.gmode = have_2ghz_phy;
        tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
        b43_wireless_core_reset(dev, tmp);
 
        err = b43_validate_chipaccess(dev);
        if (err)
                goto err_powerdown;
-       err = b43_setup_modes(dev, have_aphy, have_bphy, have_gphy);
+       err = b43_setup_modes(dev, have_2ghz_phy, have_5ghz_phy);
        if (err)
                goto err_powerdown;
 
@@ -3763,7 +3914,6 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
        if (!wl->current_dev)
                wl->current_dev = dev;
        INIT_WORK(&dev->restart_work, b43_chip_reset);
-       b43_rfkill_alloc(dev);
 
        b43_radio_turn_off(dev, 1);
        b43_switch_analog(dev, 0);
@@ -3827,8 +3977,6 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
        tasklet_init(&wldev->isr_tasklet,
                     (void (*)(unsigned long))b43_interrupt_tasklet,
                     (unsigned long)wldev);
-       if (modparam_pio)
-               wldev->__using_pio = 1;
        INIT_LIST_HEAD(&wldev->list);
 
        err = b43_wireless_core_attach(wldev);
@@ -3853,20 +4001,10 @@ static void b43_sprom_fixup(struct ssb_bus *bus)
        /* boardflags workarounds */
        if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
            bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
-               bus->sprom.r1.boardflags_lo |= B43_BFL_BTCOEXIST;
+               bus->sprom.boardflags_lo |= B43_BFL_BTCOEXIST;
        if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
            bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
-               bus->sprom.r1.boardflags_lo |= B43_BFL_PACTRL;
-
-       /* Handle case when gain is not set in sprom */
-       if (bus->sprom.r1.antenna_gain_a == 0xFF)
-               bus->sprom.r1.antenna_gain_a = 2;
-       if (bus->sprom.r1.antenna_gain_bg == 0xFF)
-               bus->sprom.r1.antenna_gain_bg = 2;
-
-       /* Convert Antennagain values to Q5.2 */
-       bus->sprom.r1.antenna_gain_a <<= 2;
-       bus->sprom.r1.antenna_gain_bg <<= 2;
+               bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
 }
 
 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
@@ -3893,16 +4031,17 @@ static int b43_wireless_init(struct ssb_device *dev)
        }
 
        /* fill hw info */
-       hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE;
+       hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
+                   IEEE80211_HW_RX_INCLUDES_FCS;
        hw->max_signal = 100;
        hw->max_rssi = -110;
        hw->max_noise = -110;
        hw->queues = 1;         /* FIXME: hardware has more queues */
        SET_IEEE80211_DEV(hw, dev->dev);
-       if (is_valid_ether_addr(sprom->r1.et1mac))
-               SET_IEEE80211_PERM_ADDR(hw, sprom->r1.et1mac);
+       if (is_valid_ether_addr(sprom->et1mac))
+               SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
        else
-               SET_IEEE80211_PERM_ADDR(hw, sprom->r1.il0mac);
+               SET_IEEE80211_PERM_ADDR(hw, sprom->il0mac);
 
        /* Get and initialize struct b43_wl */
        wl = hw_to_b43_wl(hw);
@@ -3910,6 +4049,7 @@ static int b43_wireless_init(struct ssb_device *dev)
        wl->hw = hw;
        spin_lock_init(&wl->irq_lock);
        spin_lock_init(&wl->leds_lock);
+       spin_lock_init(&wl->shm_lock);
        mutex_init(&wl->mutex);
        INIT_LIST_HEAD(&wl->devlist);
 
@@ -4053,16 +4193,6 @@ static struct ssb_driver b43_ssb_driver = {
        .resume         = b43_resume,
 };
 
-inline int b43_pci_ssb_bridge_init(void)
-{
-       return ssb_pcihost_register(&b43_pci_bridge_driver);
-}
-
-inline void b43_pci_ssb_bridge_exit(void)
-{
-       ssb_pcihost_unregister(&b43_pci_bridge_driver);
-}
-
 static int __init b43_init(void)
 {
        int err;
@@ -4071,19 +4201,12 @@ static int __init b43_init(void)
        err = b43_pcmcia_init();
        if (err)
                goto err_dfs_exit;
-
-       err = b43_pci_ssb_bridge_init();
-       if (err)
-               goto err_pcmcia_exit;
-
        err = ssb_driver_register(&b43_ssb_driver);
        if (err)
-               goto err_pci_exit;
+               goto err_pcmcia_exit;
 
        return err;
 
-err_pci_exit:
-       b43_pci_ssb_bridge_exit();
 err_pcmcia_exit:
        b43_pcmcia_exit();
 err_dfs_exit:
@@ -4094,7 +4217,6 @@ err_dfs_exit:
 static void __exit b43_exit(void)
 {
        ssb_driver_unregister(&b43_ssb_driver);
-       b43_pci_ssb_bridge_exit();
        b43_pcmcia_exit();
        b43_debugfs_exit();
 }
index 284d17d..2d52d9d 100644 (file)
@@ -3,7 +3,7 @@
   Broadcom B43 wireless driver
 
   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>,
-                     Stefano Brivio <st3@riseup.net>
+                     Stefano Brivio <stefano.brivio@polimi.it>
                      Michael Buesch <mb@bu3sch.de>
                      Danny van Dyk <kugelfang@gentoo.org>
                      Andreas Jaggi <andreas.jaggi@waterwave.ch>
 #define PAD_BYTES(nr_bytes)            P4D_BYTES( __LINE__ , (nr_bytes))
 
 /* Lightweight function to convert a frequency (in Mhz) to a channel number. */
-static inline u8 b43_freq_to_channel_a(int freq)
+static inline u8 b43_freq_to_channel_5ghz(int freq)
 {
        return ((freq - 5000) / 5);
 }
-static inline u8 b43_freq_to_channel_bg(int freq)
+static inline u8 b43_freq_to_channel_2ghz(int freq)
 {
        u8 channel;
 
@@ -54,19 +54,13 @@ static inline u8 b43_freq_to_channel_bg(int freq)
 
        return channel;
 }
-static inline u8 b43_freq_to_channel(struct b43_wldev *dev, int freq)
-{
-       if (dev->phy.type == B43_PHYTYPE_A)
-               return b43_freq_to_channel_a(freq);
-       return b43_freq_to_channel_bg(freq);
-}
 
 /* Lightweight function to convert a channel number to a frequency (in Mhz). */
-static inline int b43_channel_to_freq_a(u8 channel)
+static inline int b43_channel_to_freq_5ghz(u8 channel)
 {
        return (5000 + (5 * channel));
 }
-static inline int b43_channel_to_freq_bg(u8 channel)
+static inline int b43_channel_to_freq_2ghz(u8 channel)
 {
        int freq;
 
@@ -77,12 +71,6 @@ static inline int b43_channel_to_freq_bg(u8 channel)
 
        return freq;
 }
-static inline int b43_channel_to_freq(struct b43_wldev *dev, u8 channel)
-{
-       if (dev->phy.type == B43_PHYTYPE_A)
-               return b43_channel_to_freq_a(channel);
-       return b43_channel_to_freq_bg(channel);
-}
 
 static inline int b43_is_cck_rate(int rate)
 {
@@ -96,6 +84,9 @@ static inline int b43_is_ofdm_rate(int rate)
        return !b43_is_cck_rate(rate);
 }
 
+u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
+                                 u8 antenna_nr);
+
 void b43_tsf_read(struct b43_wldev *dev, u64 * tsf);
 void b43_tsf_write(struct b43_wldev *dev, u64 tsf);
 
diff --git a/package/b43/src/nphy.c b/package/b43/src/nphy.c
new file mode 100644 (file)
index 0000000..705131e
--- /dev/null
@@ -0,0 +1,489 @@
+/*
+
+  Broadcom B43 wireless driver
+  IEEE 802.11n PHY support
+
+  Copyright (c) 2008 Michael Buesch <mb@bu3sch.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; see the file COPYING.  If not, write to
+  the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
+  Boston, MA 02110-1301, USA.
+
+*/
+
+#include <linux/delay.h>
+#include <linux/types.h>
+
+#include "b43.h"
+#include "nphy.h"
+#include "tables_nphy.h"
+
+#include <linux/delay.h>
+
+
+void b43_nphy_set_rxantenna(struct b43_wldev *dev, int antenna)
+{//TODO
+}
+
+void b43_nphy_xmitpower(struct b43_wldev *dev)
+{//TODO
+}
+
+static void b43_chantab_radio_upload(struct b43_wldev *dev,
+                                    const struct b43_nphy_channeltab_entry *e)
+{
+       b43_radio_write16(dev, B2055_PLL_REF, e->radio_pll_ref);
+       b43_radio_write16(dev, B2055_RF_PLLMOD0, e->radio_rf_pllmod0);
+       b43_radio_write16(dev, B2055_RF_PLLMOD1, e->radio_rf_pllmod1);
+       b43_radio_write16(dev, B2055_VCO_CAPTAIL, e->radio_vco_captail);
+       b43_radio_write16(dev, B2055_VCO_CAL1, e->radio_vco_cal1);
+       b43_radio_write16(dev, B2055_VCO_CAL2, e->radio_vco_cal2);
+       b43_radio_write16(dev, B2055_PLL_LFC1, e->radio_pll_lfc1);
+       b43_radio_write16(dev, B2055_PLL_LFR1, e->radio_pll_lfr1);
+       b43_radio_write16(dev, B2055_PLL_LFC2, e->radio_pll_lfc2);
+       b43_radio_write16(dev, B2055_LGBUF_CENBUF, e->radio_lgbuf_cenbuf);
+       b43_radio_write16(dev, B2055_LGEN_TUNE1, e->radio_lgen_tune1);
+       b43_radio_write16(dev, B2055_LGEN_TUNE2, e->radio_lgen_tune2);
+       b43_radio_write16(dev, B2055_C1_LGBUF_ATUNE, e->radio_c1_lgbuf_atune);
+       b43_radio_write16(dev, B2055_C1_LGBUF_GTUNE, e->radio_c1_lgbuf_gtune);
+       b43_radio_write16(dev, B2055_C1_RX_RFR1, e->radio_c1_rx_rfr1);
+       b43_radio_write16(dev, B2055_C1_TX_PGAPADTN, e->radio_c1_tx_pgapadtn);
+       b43_radio_write16(dev, B2055_C1_TX_MXBGTRIM, e->radio_c1_tx_mxbgtrim);
+       b43_radio_write16(dev, B2055_C2_LGBUF_ATUNE, e->radio_c2_lgbuf_atune);
+       b43_radio_write16(dev, B2055_C2_LGBUF_GTUNE, e->radio_c2_lgbuf_gtune);
+       b43_radio_write16(dev, B2055_C2_RX_RFR1, e->radio_c2_rx_rfr1);
+       b43_radio_write16(dev, B2055_C2_TX_PGAPADTN, e->radio_c2_tx_pgapadtn);
+       b43_radio_write16(dev, B2055_C2_TX_MXBGTRIM, e->radio_c2_tx_mxbgtrim);
+}
+
+static void b43_chantab_phy_upload(struct b43_wldev *dev,
+                                  const struct b43_nphy_channeltab_entry *e)
+{
+       b43_phy_write(dev, B43_NPHY_BW1A, e->phy_bw1a);
+       b43_phy_write(dev, B43_NPHY_BW2, e->phy_bw2);
+       b43_phy_write(dev, B43_NPHY_BW3, e->phy_bw3);
+       b43_phy_write(dev, B43_NPHY_BW4, e->phy_bw4);
+       b43_phy_write(dev, B43_NPHY_BW5, e->phy_bw5);
+       b43_phy_write(dev, B43_NPHY_BW6, e->phy_bw6);
+}
+
+static void b43_nphy_tx_power_fix(struct b43_wldev *dev)
+{
+       //TODO
+}
+
+/* Tune the hardware to a new channel. Don't call this directly.
+ * Use b43_radio_selectchannel() */
+int b43_nphy_selectchannel(struct b43_wldev *dev, u8 channel)
+{
+       const struct b43_nphy_channeltab_entry *tabent;
+
+       tabent = b43_nphy_get_chantabent(dev, channel);
+       if (!tabent)
+               return -ESRCH;
+
+       //FIXME enable/disable band select upper20 in RXCTL
+       if (0 /*FIXME 5Ghz*/)
+               b43_radio_maskset(dev, B2055_MASTER1, 0xFF8F, 0x20);
+       else
+               b43_radio_maskset(dev, B2055_MASTER1, 0xFF8F, 0x50);
+       b43_chantab_radio_upload(dev, tabent);
+       udelay(50);
+       b43_radio_write16(dev, B2055_VCO_CAL10, 5);
+       b43_radio_write16(dev, B2055_VCO_CAL10, 45);
+       b43_radio_write16(dev, B2055_VCO_CAL10, 65);
+       udelay(300);
+       if (0 /*FIXME 5Ghz*/)
+               b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ);
+       else
+               b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ);
+       b43_chantab_phy_upload(dev, tabent);
+       b43_nphy_tx_power_fix(dev);
+
+       return 0;
+}
+
+static void b43_radio_init2055_pre(struct b43_wldev *dev)
+{
+       b43_phy_mask(dev, B43_NPHY_RFCTL_CMD,
+                    ~B43_NPHY_RFCTL_CMD_PORFORCE);
+       b43_phy_set(dev, B43_NPHY_RFCTL_CMD,
+                   B43_NPHY_RFCTL_CMD_CHIP0PU |
+                   B43_NPHY_RFCTL_CMD_OEPORFORCE);
+       b43_phy_set(dev, B43_NPHY_RFCTL_CMD,
+                   B43_NPHY_RFCTL_CMD_PORFORCE);
+}
+
+static void b43_radio_init2055_post(struct b43_wldev *dev)
+{
+       struct ssb_sprom *sprom = &(dev->dev->bus->sprom);
+       struct ssb_boardinfo *binfo = &(dev->dev->bus->boardinfo);
+       int i;
+       u16 val;
+
+       b43_radio_mask(dev, B2055_MASTER1, 0xFFF3);
+       msleep(1);
+       if ((sprom->revision != 4) || !(sprom->boardflags_hi & 0x0002)) {
+               if ((binfo->vendor != PCI_VENDOR_ID_BROADCOM) ||
+                   (binfo->type != 0x46D) ||
+                   (binfo->rev < 0x41)) {
+                       b43_radio_mask(dev, B2055_C1_RX_BB_REG, 0x7F);
+                       b43_radio_mask(dev, B2055_C1_RX_BB_REG, 0x7F);
+                       msleep(1);
+               }
+       }
+       b43_radio_maskset(dev, B2055_RRCCAL_NOPTSEL, 0x3F, 0x2C);
+       msleep(1);
+       b43_radio_write16(dev, B2055_CAL_MISC, 0x3C);
+       msleep(1);
+       b43_radio_mask(dev, B2055_CAL_MISC, 0xFFBE);
+       msleep(1);
+       b43_radio_set(dev, B2055_CAL_LPOCTL, 0x80);
+       msleep(1);
+       b43_radio_set(dev, B2055_CAL_MISC, 0x1);
+       msleep(1);
+       b43_radio_set(dev, B2055_CAL_MISC, 0x40);
+       msleep(1);
+       for (i = 0; i < 100; i++) {
+               val = b43_radio_read16(dev, B2055_CAL_COUT2);
+               if (val & 0x80)
+                       break;
+               udelay(10);
+       }
+       msleep(1);
+       b43_radio_mask(dev, B2055_CAL_LPOCTL, 0xFF7F);
+       msleep(1);
+       b43_radio_selectchannel(dev, dev->phy.channel, 0);
+       b43_radio_write16(dev, B2055_C1_RX_BB_LPF, 0x9);
+       b43_radio_write16(dev, B2055_C2_RX_BB_LPF, 0x9);
+       b43_radio_write16(dev, B2055_C1_RX_BB_MIDACHP, 0x83);
+       b43_radio_write16(dev, B2055_C2_RX_BB_MIDACHP, 0x83);
+}
+
+/* Initialize a Broadcom 2055 N-radio */
+static void b43_radio_init2055(struct b43_wldev *dev)
+{
+       b43_radio_init2055_pre(dev);
+       if (b43_status(dev) < B43_STAT_INITIALIZED)
+               b2055_upload_inittab(dev, 0, 1);
+       else
+               b2055_upload_inittab(dev, 0/*FIXME on 5ghz band*/, 0);
+       b43_radio_init2055_post(dev);
+}
+
+void b43_nphy_radio_turn_on(struct b43_wldev *dev)
+{
+       b43_radio_init2055(dev);
+}
+
+void b43_nphy_radio_turn_off(struct b43_wldev *dev)
+{
+       b43_phy_mask(dev, B43_NPHY_RFCTL_CMD,
+                    ~B43_NPHY_RFCTL_CMD_EN);
+}
+
+#define ntab_upload(dev, offset, data) do { \
+               unsigned int i;                                         \
+               for (i = 0; i < (offset##_SIZE); i++)                   \
+                       b43_ntab_write(dev, (offset) + i, (data)[i]);   \
+       } while (0)
+
+/* Upload the N-PHY tables. */
+static void b43_nphy_tables_init(struct b43_wldev *dev)
+{
+       /* Static tables */
+       ntab_upload(dev, B43_NTAB_FRAMESTRUCT, b43_ntab_framestruct);
+       ntab_upload(dev, B43_NTAB_FRAMELT, b43_ntab_framelookup);
+       ntab_upload(dev, B43_NTAB_TMAP, b43_ntab_tmap);
+       ntab_upload(dev, B43_NTAB_TDTRN, b43_ntab_tdtrn);
+       ntab_upload(dev, B43_NTAB_INTLEVEL, b43_ntab_intlevel);
+       ntab_upload(dev, B43_NTAB_PILOT, b43_ntab_pilot);
+       ntab_upload(dev, B43_NTAB_PILOTLT, b43_ntab_pilotlt);
+       ntab_upload(dev, B43_NTAB_TDI20A0, b43_ntab_tdi20a0);
+       ntab_upload(dev, B43_NTAB_TDI20A1, b43_ntab_tdi20a1);
+       ntab_upload(dev, B43_NTAB_TDI40A0, b43_ntab_tdi40a0);
+       ntab_upload(dev, B43_NTAB_TDI40A1, b43_ntab_tdi40a1);
+       ntab_upload(dev, B43_NTAB_BDI, b43_ntab_bdi);
+       ntab_upload(dev, B43_NTAB_CHANEST, b43_ntab_channelest);
+       ntab_upload(dev, B43_NTAB_MCS, b43_ntab_mcs);
+
+       /* Volatile tables */
+       ntab_upload(dev, B43_NTAB_NOISEVAR10, b43_ntab_noisevar10);
+       ntab_upload(dev, B43_NTAB_NOISEVAR11, b43_ntab_noisevar11);
+       ntab_upload(dev, B43_NTAB_C0_ESTPLT, b43_ntab_estimatepowerlt0);
+       ntab_upload(dev, B43_NTAB_C1_ESTPLT, b43_ntab_estimatepowerlt1);
+       ntab_upload(dev, B43_NTAB_C0_ADJPLT, b43_ntab_adjustpower0);
+       ntab_upload(dev, B43_NTAB_C1_ADJPLT, b43_ntab_adjustpower1);
+       ntab_upload(dev, B43_NTAB_C0_GAINCTL, b43_ntab_gainctl0);
+       ntab_upload(dev, B43_NTAB_C1_GAINCTL, b43_ntab_gainctl1);
+       ntab_upload(dev, B43_NTAB_C0_IQLT, b43_ntab_iqlt0);
+       ntab_upload(dev, B43_NTAB_C1_IQLT, b43_ntab_iqlt1);
+       ntab_upload(dev, B43_NTAB_C0_LOFEEDTH, b43_ntab_loftlt0);
+       ntab_upload(dev, B43_NTAB_C1_LOFEEDTH, b43_ntab_loftlt1);
+}
+
+static void b43_nphy_workarounds(struct b43_wldev *dev)
+{
+       struct b43_phy *phy = &dev->phy;
+       unsigned int i;
+
+       b43_phy_set(dev, B43_NPHY_IQFLIP,
+                   B43_NPHY_IQFLIP_ADC1 | B43_NPHY_IQFLIP_ADC2);
+       //FIXME the following condition is different in the specs.
+       if (1 /* FIXME band is 2.4GHz */) {
+               b43_phy_set(dev, B43_NPHY_CLASSCTL,
+                           B43_NPHY_CLASSCTL_CCKEN);
+       } else {
+               b43_phy_mask(dev, B43_NPHY_CLASSCTL,
+                            ~B43_NPHY_CLASSCTL_CCKEN);
+       }
+       b43_radio_set(dev, B2055_C1_TX_RF_SPARE, 0x8);
+       b43_phy_write(dev, B43_NPHY_TXFRAMEDELAY, 8);
+
+       /* Fixup some tables */
+       b43_ntab_write(dev, B43_NTAB16(8, 0x00), 0xA);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x10), 0xA);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x02), 0xCDAA);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x12), 0xCDAA);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x08), 0);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x18), 0);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x07), 0x7AAB);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x17), 0x7AAB);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x06), 0x800);
+       b43_ntab_write(dev, B43_NTAB16(8, 0x16), 0x800);
+
+       b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO1, 0x2D8);
+       b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP1, 0x301);
+       b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO2, 0x2D8);
+       b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP2, 0x301);
+
+       //TODO set RF sequence
+
+       /* Set narrowband clip threshold */
+       b43_phy_write(dev, B43_NPHY_C1_NBCLIPTHRES, 66);
+       b43_phy_write(dev, B43_NPHY_C2_NBCLIPTHRES, 66);
+
+       /* Set wideband clip 2 threshold */
+       b43_phy_maskset(dev, B43_NPHY_C1_CLIPWBTHRES,
+                       ~B43_NPHY_C1_CLIPWBTHRES_CLIP2,
+                       21 << B43_NPHY_C1_CLIPWBTHRES_CLIP2_SHIFT);
+       b43_phy_maskset(dev, B43_NPHY_C2_CLIPWBTHRES,
+                       ~B43_NPHY_C2_CLIPWBTHRES_CLIP2,
+                       21 << B43_NPHY_C2_CLIPWBTHRES_CLIP2_SHIFT);
+
+       /* Set Clip 2 detect */
+       b43_phy_set(dev, B43_NPHY_C1_CGAINI,
+                   B43_NPHY_C1_CGAINI_CL2DETECT);
+       b43_phy_set(dev, B43_NPHY_C2_CGAINI,
+                   B43_NPHY_C2_CGAINI_CL2DETECT);
+
+       if (0 /*FIXME*/) {
+               /* Set dwell lengths */
+               b43_phy_write(dev, B43_NPHY_CLIP1_NBDWELL_LEN, 43);
+               b43_phy_write(dev, B43_NPHY_CLIP2_NBDWELL_LEN, 43);
+               b43_phy_write(dev, B43_NPHY_W1CLIP1_DWELL_LEN, 9);
+               b43_phy_write(dev, B43_NPHY_W1CLIP2_DWELL_LEN, 9);
+
+               /* Set gain backoff */
+               b43_phy_maskset(dev, B43_NPHY_C1_CGAINI,
+                               ~B43_NPHY_C1_CGAINI_GAINBKOFF,
+                               1 << B43_NPHY_C1_CGAINI_GAINBKOFF_SHIFT);
+               b43_phy_maskset(dev, B43_NPHY_C2_CGAINI,
+                               ~B43_NPHY_C2_CGAINI_GAINBKOFF,
+                               1 << B43_NPHY_C2_CGAINI_GAINBKOFF_SHIFT);
+
+               /* Set HPVGA2 index */
+               b43_phy_maskset(dev, B43_NPHY_C1_INITGAIN,
+                               ~B43_NPHY_C1_INITGAIN_HPVGA2,
+                               6 << B43_NPHY_C1_INITGAIN_HPVGA2_SHIFT);
+               b43_phy_maskset(dev, B43_NPHY_C2_INITGAIN,
+                               ~B43_NPHY_C2_INITGAIN_HPVGA2,
+                               6 << B43_NPHY_C2_INITGAIN_HPVGA2_SHIFT);
+
+               //FIXME verify that the specs really mean to use autoinc here.
+               for (i = 0; i < 3; i++)
+                       b43_ntab_write(dev, B43_NTAB16(7, 0x106) + i, 0x673);
+       }
+
+       /* Set minimum gain value */
+       b43_phy_maskset(dev, B43_NPHY_C1_MINMAX_GAIN,
+                       ~B43_NPHY_C1_MINGAIN,
+                       23 << B43_NPHY_C1_MINGAIN_SHIFT);
+       b43_phy_maskset(dev, B43_NPHY_C2_MINMAX_GAIN,
+                       ~B43_NPHY_C2_MINGAIN,
+                       23 << B43_NPHY_C2_MINGAIN_SHIFT);
+
+       if (phy->rev < 2) {
+               b43_phy_mask(dev, B43_NPHY_SCRAM_SIGCTL,
+                            ~B43_NPHY_SCRAM_SIGCTL_SCM);
+       }
+
+       /* Set phase track alpha and beta */
+       b43_phy_write(dev, B43_NPHY_PHASETR_A0, 0x125);
+       b43_phy_write(dev, B43_NPHY_PHASETR_A1, 0x1B3);
+       b43_phy_write(dev, B43_NPHY_PHASETR_A2, 0x105);
+       b43_phy_write(dev, B43_NPHY_PHASETR_B0, 0x16E);
+       b43_phy_write(dev, B43_NPHY_PHASETR_B1, 0xCD);
+       b43_phy_write(dev, B43_NPHY_PHASETR_B2, 0x20);
+}
+
+static void b43_nphy_reset_cca(struct b43_wldev *dev)
+{
+       u16 bbcfg;
+
+       ssb_write32(dev->dev, SSB_TMSLOW,
+                   ssb_read32(dev->dev, SSB_TMSLOW) | SSB_TMSLOW_FGC);
+       bbcfg = b43_phy_read(dev, B43_NPHY_BBCFG);
+       b43_phy_set(dev, B43_NPHY_BBCFG, B43_NPHY_BBCFG_RSTCCA);
+       b43_phy_write(dev, B43_NPHY_BBCFG,
+                     bbcfg & ~B43_NPHY_BBCFG_RSTCCA);
+       ssb_write32(dev->dev, SSB_TMSLOW,
+                   ssb_read32(dev->dev, SSB_TMSLOW) & ~SSB_TMSLOW_FGC);
+}
+
+enum b43_nphy_rf_sequence {
+       B43_RFSEQ_RX2TX,
+       B43_RFSEQ_TX2RX,
+       B43_RFSEQ_RESET2RX,
+       B43_RFSEQ_UPDATE_GAINH,
+       B43_RFSEQ_UPDATE_GAINL,
+       B43_RFSEQ_UPDATE_GAINU,
+};
+
+static void b43_nphy_force_rf_sequence(struct b43_wldev *dev,
+                                      enum b43_nphy_rf_sequence seq)
+{
+       static const u16 trigger[] = {
+               [B43_RFSEQ_RX2TX]               = B43_NPHY_RFSEQTR_RX2TX,
+               [B43_RFSEQ_TX2RX]               = B43_NPHY_RFSEQTR_TX2RX,
+               [B43_RFSEQ_RESET2RX]            = B43_NPHY_RFSEQTR_RST2RX,
+               [B43_RFSEQ_UPDATE_GAINH]        = B43_NPHY_RFSEQTR_UPGH,
+               [B43_RFSEQ_UPDATE_GAINL]        = B43_NPHY_RFSEQTR_UPGL,
+               [B43_RFSEQ_UPDATE_GAINU]        = B43_NPHY_RFSEQTR_UPGU,
+       };
+       int i;
+
+       B43_WARN_ON(seq >= ARRAY_SIZE(trigger));
+
+       b43_phy_set(dev, B43_NPHY_RFSEQMODE,
+                   B43_NPHY_RFSEQMODE_CAOVER | B43_NPHY_RFSEQMODE_TROVER);
+       b43_phy_set(dev, B43_NPHY_RFSEQTR, trigger[seq]);
+       for (i = 0; i < 200; i++) {
+               if (!(b43_phy_read(dev, B43_NPHY_RFSEQST) & trigger[seq]))
+                       goto ok;
+               msleep(1);
+       }
+       b43err(dev->wl, "RF sequence status timeout\n");
+ok:
+       b43_phy_mask(dev, B43_NPHY_RFSEQMODE,
+                    ~(B43_NPHY_RFSEQMODE_CAOVER | B43_NPHY_RFSEQMODE_TROVER));
+}
+
+static void b43_nphy_bphy_init(struct b43_wldev *dev)
+{
+       unsigned int i;
+       u16 val;
+
+       val = 0x1E1F;
+       for (i = 0; i < 14; i++) {
+               b43_phy_write(dev, B43_PHY_N_BMODE(0x88 + i), val);
+               val -= 0x202;
+       }
+       val = 0x3E3F;
+       for (i = 0; i < 16; i++) {
+               b43_phy_write(dev, B43_PHY_N_BMODE(0x97 + i), val);
+               val -= 0x202;
+       }
+       b43_phy_write(dev, B43_PHY_N_BMODE(0x38), 0x668);
+}
+
+/* RSSI Calibration */
+static void b43_nphy_rssi_cal(struct b43_wldev *dev, u8 type)
+{
+       //TODO
+}
+
+int b43_phy_initn(struct b43_wldev *dev)
+{
+       struct b43_phy *phy = &dev->phy;
+       u16 tmp;
+
+       //TODO: Spectral management
+       b43_nphy_tables_init(dev);
+
+       /* Clear all overrides */
+       b43_phy_write(dev, B43_NPHY_RFCTL_OVER, 0);
+       b43_phy_write(dev, B43_NPHY_RFCTL_INTC1, 0);
+       b43_phy_write(dev, B43_NPHY_RFCTL_INTC2, 0);
+       b43_phy_write(dev, B43_NPHY_RFCTL_INTC3, 0);
+       b43_phy_write(dev, B43_NPHY_RFCTL_INTC4, 0);
+       b43_phy_mask(dev, B43_NPHY_RFSEQMODE,
+                    ~(B43_NPHY_RFSEQMODE_CAOVER |
+                      B43_NPHY_RFSEQMODE_TROVER));
+       b43_phy_write(dev, B43_NPHY_AFECTL_OVER, 0);
+
+       tmp = (phy->rev < 2) ? 64 : 59;
+       b43_phy_maskset(dev, B43_NPHY_BPHY_CTL3,
+                       ~B43_NPHY_BPHY_CTL3_SCALE,
+                       tmp << B43_NPHY_BPHY_CTL3_SCALE_SHIFT);
+
+       b43_phy_write(dev, B43_NPHY_AFESEQ_TX2RX_PUD_20M, 0x20);
+       b43_phy_write(dev, B43_NPHY_AFESEQ_TX2RX_PUD_40M, 0x20);
+
+       b43_phy_write(dev, B43_NPHY_TXREALFD, 184);
+       b43_phy_write(dev, B43_NPHY_MIMO_CRSTXEXT, 200);
+       b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 80);
+       b43_phy_write(dev, B43_NPHY_C2_BCLIPBKOFF, 511);
+
+       //TODO MIMO-Config
+       //TODO Update TX/RX chain
+
+       if (phy->rev < 2) {
+               b43_phy_write(dev, B43_NPHY_DUP40_GFBL, 0xAA8);
+               b43_phy_write(dev, B43_NPHY_DUP40_BL, 0x9A4);
+       }
+       b43_nphy_workarounds(dev);
+       b43_nphy_reset_cca(dev);
+
+       ssb_write32(dev->dev, SSB_TMSLOW,
+                   ssb_read32(dev->dev, SSB_TMSLOW) | B43_TMSLOW_MACPHYCLKEN);
+       b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RX2TX);
+       b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+
+       b43_phy_read(dev, B43_NPHY_CLASSCTL); /* dummy read */
+       //TODO read core1/2 clip1 thres regs
+
+       if (1 /* FIXME Band is 2.4GHz */)
+               b43_nphy_bphy_init(dev);
+       //TODO disable TX power control
+       //TODO Fix the TX power settings
+       //TODO Init periodic calibration with reason 3
+       b43_nphy_rssi_cal(dev, 2);
+       b43_nphy_rssi_cal(dev, 0);
+       b43_nphy_rssi_cal(dev, 1);
+       //TODO get TX gain
+       //TODO init superswitch
+       //TODO calibrate LO
+       //TODO idle TSSI TX pctl
+       //TODO TX power control power setup
+       //TODO table writes
+       //TODO TX power control coefficients
+       //TODO enable TX power control
+       //TODO control antenna selection
+       //TODO init radar detection
+       //TODO reset channel if changed
+
+       b43err(dev->wl, "IEEE 802.11n devices are not supported, yet.\n");
+       return 0;
+}
diff --git a/package/b43/src/nphy.h b/package/b43/src/nphy.h
new file mode 100644 (file)
index 0000000..5d95118
--- /dev/null
@@ -0,0 +1,932 @@
+#ifndef B43_NPHY_H_
+#define B43_NPHY_H_
+
+#include "phy.h"
+
+
+/* N-PHY registers. */
+
+#define B43_NPHY_BBCFG                         B43_PHY_N(0x001) /* BB config */
+#define  B43_NPHY_BBCFG_RSTCCA                 0x4000 /* Reset CCA */
+#define  B43_NPHY_BBCFG_RSTRX                  0x8000 /* Reset RX */
+#define B43_NPHY_CHANNEL                       B43_PHY_N(0x005) /* Channel */
+#define B43_NPHY_TXERR                         B43_PHY_N(0x007) /* TX error */
+#define B43_NPHY_BANDCTL                       B43_PHY_N(0x009) /* Band control */
+#define  B43_NPHY_BANDCTL_5GHZ                 0x0001 /* Use the 5GHz band */
+#define B43_NPHY_4WI_ADDR                      B43_PHY_N(0x00B) /* Four-wire bus address */
+#define B43_NPHY_4WI_DATAHI                    B43_PHY_N(0x00C) /* Four-wire bus data high */
+#define B43_NPHY_4WI_DATALO                    B43_PHY_N(0x00D) /* Four-wire bus data low */
+#define B43_NPHY_BIST_STAT0                    B43_PHY_N(0x00E) /* Built-in self test status 0 */
+#define B43_NPHY_BIST_STAT1                    B43_PHY_N(0x00F) /* Built-in self test status 1 */
+
+#define B43_NPHY_C1_DESPWR                     B43_PHY_N(0x018) /* Core 1 desired power */
+#define B43_NPHY_C1_CCK_DESPWR                 B43_PHY_N(0x019) /* Core 1 CCK desired power */
+#define B43_NPHY_C1_BCLIPBKOFF                 B43_PHY_N(0x01A) /* Core 1 barely clip backoff */
+#define B43_NPHY_C1_CCK_BCLIPBKOFF             B43_PHY_N(0x01B) /* Core 1 CCK barely clip backoff */
+#define B43_NPHY_C1_CGAINI                     B43_PHY_N(0x01C) /* Core 1 compute gain info */
+#define  B43_NPHY_C1_CGAINI_GAINBKOFF          0x001F /* Gain backoff */
+#define  B43_NPHY_C1_CGAINI_GAINBKOFF_SHIFT    0
+#define  B43_NPHY_C1_CGAINI_CLIPGBKOFF         0x03E0 /* Clip gain backoff */
+#define  B43_NPHY_C1_CGAINI_CLIPGBKOFF_SHIFT   5
+#define  B43_NPHY_C1_CGAINI_GAINSTEP           0x1C00 /* Gain step */
+#define  B43_NPHY_C1_CGAINI_GAINSTEP_SHIFT     10
+#define  B43_NPHY_C1_CGAINI_CL2DETECT          0x2000 /* Clip 2 detect mask */
+#define B43_NPHY_C1_CCK_CGAINI                 B43_PHY_N(0x01D) /* Core 1 CCK compute gain info */
+#define  B43_NPHY_C1_CCK_CGAINI_GAINBKOFF      0x001F /* Gain backoff */
+#define  B43_NPHY_C1_CCK_CGAINI_CLIPGBKOFF     0x01E0 /* CCK barely clip gain backoff */
+#define B43_NPHY_C1_MINMAX_GAIN                        B43_PHY_N(0x01E) /* Core 1 min/max gain */
+#define  B43_NPHY_C1_MINGAIN                   0x00FF /* Minimum gain */
+#define  B43_NPHY_C1_MINGAIN_SHIFT             0
+#define  B43_NPHY_C1_MAXGAIN                   0xFF00 /* Maximum gain */
+#define  B43_NPHY_C1_MAXGAIN_SHIFT             8
+#define B43_NPHY_C1_CCK_MINMAX_GAIN            B43_PHY_N(0x01F) /* Core 1 CCK min/max gain */
+#define  B43_NPHY_C1_CCK_MINGAIN               0x00FF /* Minimum gain */
+#define  B43_NPHY_C1_CCK_MINGAIN_SHIFT         0
+#define  B43_NPHY_C1_CCK_MAXGAIN               0xFF00 /* Maximum gain */
+#define  B43_NPHY_C1_CCK_MAXGAIN_SHIFT         8
+#define B43_NPHY_C1_INITGAIN                   B43_PHY_N(0x020) /* Core 1 initial gain code */
+#define  B43_NPHY_C1_INITGAIN_EXTLNA           0x0001 /* External LNA index */
+#define  B43_NPHY_C1_INITGAIN_LNA              0x0006 /* LNA index */
+#define  B43_NPHY_C1_INITGAIN_LNAIDX_SHIFT     1
+#define  B43_NPHY_C1_INITGAIN_HPVGA1           0x0078 /* HPVGA1 index */
+#define  B43_NPHY_C1_INITGAIN_HPVGA1_SHIFT     3
+#define  B43_NPHY_C1_INITGAIN_HPVGA2           0x0F80 /* HPVGA2 index */
+#define  B43_NPHY_C1_INITGAIN_HPVGA2_SHIFT     7
+#define  B43_NPHY_C1_INITGAIN_TRRX             0x1000 /* TR RX index */
+#define  B43_NPHY_C1_INITGAIN_TRTX             0x2000 /* TR TX index */
+#define B43_NPHY_C1_CLIP1_HIGAIN               B43_PHY_N(0x021) /* Core 1 clip1 high gain code */
+#define B43_NPHY_C1_CLIP1_MEDGAIN              B43_PHY_N(0x022) /* Core 1 clip1 medium gain code */
+#define B43_NPHY_C1_CLIP1_LOGAIN               B43_PHY_N(0x023) /* Core 1 clip1 low gain code */
+#define B43_NPHY_C1_CLIP2_GAIN                 B43_PHY_N(0x024) /* Core 1 clip2 gain code */
+#define B43_NPHY_C1_FILTERGAIN                 B43_PHY_N(0x025) /* Core 1 filter gain */
+#define B43_NPHY_C1_LPF_QHPF_BW                        B43_PHY_N(0x026) /* Core 1 LPF Q HP F bandwidth */
+#define B43_NPHY_C1_CLIPWBTHRES                        B43_PHY_N(0x027) /* Core 1 clip wideband threshold */
+#define  B43_NPHY_C1_CLIPWBTHRES_CLIP2         0x003F /* Clip 2 */
+#define  B43_NPHY_C1_CLIPWBTHRES_CLIP2_SHIFT   0
+#define  B43_NPHY_C1_CLIPWBTHRES_CLIP1         0x0FC0 /* Clip 1 */
+#define  B43_NPHY_C1_CLIPWBTHRES_CLIP1_SHIFT   6
+#define B43_NPHY_C1_W1THRES                    B43_PHY_N(0x028) /* Core 1 W1 threshold */
+#define B43_NPHY_C1_EDTHRES                    B43_PHY_N(0x029) /* Core 1 ED threshold */
+#define B43_NPHY_C1_SMSIGTHRES                 B43_PHY_N(0x02A) /* Core 1 small sig threshold */
+#define B43_NPHY_C1_NBCLIPTHRES                        B43_PHY_N(0x02B) /* Core 1 NB clip threshold */
+#define B43_NPHY_C1_CLIP1THRES                 B43_PHY_N(0x02C) /* Core 1 clip1 threshold */
+#define B43_NPHY_C1_CLIP2THRES                 B43_PHY_N(0x02D) /* Core 1 clip2 threshold */
+
+#define B43_NPHY_C2_DESPWR                     B43_PHY_N(0x02E) /* Core 2 desired power */
+#define B43_NPHY_C2_CCK_DESPWR                 B43_PHY_N(0x02F) /* Core 2 CCK desired power */
+#define B43_NPHY_C2_BCLIPBKOFF                 B43_PHY_N(0x030) /* Core 2 barely clip backoff */
+#define B43_NPHY_C2_CCK_BCLIPBKOFF             B43_PHY_N(0x031) /* Core 2 CCK barely clip backoff */
+#define B43_NPHY_C2_CGAINI                     B43_PHY_N(0x032) /* Core 2 compute gain info */
+#define  B43_NPHY_C2_CGAINI_GAINBKOFF          0x001F /* Gain backoff */
+#define  B43_NPHY_C2_CGAINI_GAINBKOFF_SHIFT    0
+#define  B43_NPHY_C2_CGAINI_CLIPGBKOFF         0x03E0 /* Clip gain backoff */
+#define  B43_NPHY_C2_CGAINI_CLIPGBKOFF_SHIFT   5
+#define  B43_NPHY_C2_CGAINI_GAINSTEP           0x1C00 /* Gain step */
+#define  B43_NPHY_C2_CGAINI_GAINSTEP_SHIFT     10
+#define  B43_NPHY_C2_CGAINI_CL2DETECT          0x2000 /* Clip 2 detect mask */
+#define B43_NPHY_C2_CCK_CGAINI                 B43_PHY_N(0x033) /* Core 2 CCK compute gain info */
+#define  B43_NPHY_C2_CCK_CGAINI_GAINBKOFF      0x001F /* Gain backoff */
+#define  B43_NPHY_C2_CCK_CGAINI_CLIPGBKOFF     0x01E0 /* CCK barely clip gain backoff */
+#define B43_NPHY_C2_MINMAX_GAIN                        B43_PHY_N(0x034) /* Core 2 min/max gain */
+#define  B43_NPHY_C2_MINGAIN                   0x00FF /* Minimum gain */
+#define  B43_NPHY_C2_MINGAIN_SHIFT             0
+#define  B43_NPHY_C2_MAXGAIN                   0xFF00 /* Maximum gain */
+#define  B43_NPHY_C2_MAXGAIN_SHIFT             8
+#define B43_NPHY_C2_CCK_MINMAX_GAIN            B43_PHY_N(0x035) /* Core 2 CCK min/max gain */
+#define  B43_NPHY_C2_CCK_MINGAIN               0x00FF /* Minimum gain */
+#define  B43_NPHY_C2_CCK_MINGAIN_SHIFT         0
+#define  B43_NPHY_C2_CCK_MAXGAIN               0xFF00 /* Maximum gain */
+#define  B43_NPHY_C2_CCK_MAXGAIN_SHIFT         8
+#define B43_NPHY_C2_INITGAIN                   B43_PHY_N(0x036) /* Core 2 initial gain code */
+#define  B43_NPHY_C2_INITGAIN_EXTLNA           0x0001 /* External LNA index */
+#define  B43_NPHY_C2_INITGAIN_LNA              0x0006 /* LNA index */
+#define  B43_NPHY_C2_INITGAIN_LNAIDX_SHIFT     1
+#define  B43_NPHY_C2_INITGAIN_HPVGA1           0x0078 /* HPVGA1 index */
+#define  B43_NPHY_C2_INITGAIN_HPVGA1_SHIFT     3
+#define  B43_NPHY_C2_INITGAIN_HPVGA2           0x0F80 /* HPVGA2 index */
+#define  B43_NPHY_C2_INITGAIN_HPVGA2_SHIFT     7
+#define  B43_NPHY_C2_INITGAIN_TRRX             0x1000 /* TR RX index */
+#define  B43_NPHY_C2_INITGAIN_TRTX             0x2000 /* TR TX index */
+#define B43_NPHY_C2_CLIP1_HIGAIN               B43_PHY_N(0x037) /* Core 2 clip1 high gain code */
+#define B43_NPHY_C2_CLIP1_MEDGAIN              B43_PHY_N(0x038) /* Core 2 clip1 medium gain code */
+#define B43_NPHY_C2_CLIP1_LOGAIN               B43_PHY_N(0x039) /* Core 2 clip1 low gain code */
+#define B43_NPHY_C2_CLIP2_GAIN                 B43_PHY_N(0x03A) /* Core 2 clip2 gain code */
+#define B43_NPHY_C2_FILTERGAIN                 B43_PHY_N(0x03B) /* Core 2 filter gain */
+#define B43_NPHY_C2_LPF_QHPF_BW                        B43_PHY_N(0x03C) /* Core 2 LPF Q HP F bandwidth */
+#define B43_NPHY_C2_CLIPWBTHRES                        B43_PHY_N(0x03D) /* Core 2 clip wideband threshold */
+#define  B43_NPHY_C2_CLIPWBTHRES_CLIP2         0x003F /* Clip 2 */
+#define  B43_NPHY_C2_CLIPWBTHRES_CLIP2_SHIFT   0
+#define  B43_NPHY_C2_CLIPWBTHRES_CLIP1         0x0FC0 /* Clip 1 */
+#define  B43_NPHY_C2_CLIPWBTHRES_CLIP1_SHIFT   6
+#define B43_NPHY_C2_W1THRES                    B43_PHY_N(0x03E) /* Core 2 W1 threshold */
+#define B43_NPHY_C2_EDTHRES                    B43_PHY_N(0x03F) /* Core 2 ED threshold */
+#define B43_NPHY_C2_SMSIGTHRES                 B43_PHY_N(0x040) /* Core 2 small sig threshold */
+#define B43_NPHY_C2_NBCLIPTHRES                        B43_PHY_N(0x041) /* Core 2 NB clip threshold */
+#define B43_NPHY_C2_CLIP1THRES                 B43_PHY_N(0x042) /* Core 2 clip1 threshold */
+#define B43_NPHY_C2_CLIP2THRES                 B43_PHY_N(0x043) /* Core 2 clip2 threshold */
+
+#define B43_NPHY_CRS_THRES1                    B43_PHY_N(0x044) /* CRS threshold 1 */
+#define B43_NPHY_CRS_THRES2                    B43_PHY_N(0x045) /* CRS threshold 2 */
+#define B43_NPHY_CRS_THRES3                    B43_PHY_N(0x046) /* CRS threshold 3 */
+#define B43_NPHY_CRSCTL                                B43_PHY_N(0x047) /* CRS control */
+#define B43_NPHY_DCFADDR                       B43_PHY_N(0x048) /* DC filter address */
+#define B43_NPHY_RXF20_NUM0                    B43_PHY_N(0x049) /* RX filter 20 numerator 0 */
+#define B43_NPHY_RXF20_NUM1                    B43_PHY_N(0x04A) /* RX filter 20 numerator 1 */
+#define B43_NPHY_RXF20_NUM2                    B43_PHY_N(0x04B) /* RX filter 20 numerator 2 */
+#define B43_NPHY_RXF20_DENOM0                  B43_PHY_N(0x04C) /* RX filter 20 denominator 0 */
+#define B43_NPHY_RXF20_DENOM1                  B43_PHY_N(0x04D) /* RX filter 20 denominator 1 */
+#define B43_NPHY_RXF20_NUM10                   B43_PHY_N(0x04E) /* RX filter 20 numerator 10 */
+#define B43_NPHY_RXF20_NUM11                   B43_PHY_N(0x04F) /* RX filter 20 numerator 11 */
+#define B43_NPHY_RXF20_NUM12                   B43_PHY_N(0x050) /* RX filter 20 numerator 12 */
+#define B43_NPHY_RXF20_DENOM10                 B43_PHY_N(0x051) /* RX filter 20 denominator 10 */
+#define B43_NPHY_RXF20_DENOM11                 B43_PHY_N(0x052) /* RX filter 20 denominator 11 */
+#define B43_NPHY_RXF40_NUM0                    B43_PHY_N(0x053) /* RX filter 40 numerator 0 */
+#define B43_NPHY_RXF40_NUM1                    B43_PHY_N(0x054) /* RX filter 40 numerator 1 */
+#define B43_NPHY_RXF40_NUM2                    B43_PHY_N(0x055) /* RX filter 40 numerator 2 */
+#define B43_NPHY_RXF40_DENOM0                  B43_PHY_N(0x056) /* RX filter 40 denominator 0 */
+#define B43_NPHY_RXF40_DENOM1                  B43_PHY_N(0x057) /* RX filter 40 denominator 1 */
+#define B43_NPHY_RXF40_NUM10                   B43_PHY_N(0x058) /* RX filter 40 numerator 10 */
+#define B43_NPHY_RXF40_NUM11                   B43_PHY_N(0x059) /* RX filter 40 numerator 11 */
+#define B43_NPHY_RXF40_NUM12                   B43_PHY_N(0x05A) /* RX filter 40 numerator 12 */
+#define B43_NPHY_RXF40_DENOM10                 B43_PHY_N(0x05B) /* RX filter 40 denominator 10 */
+#define B43_NPHY_RXF40_DENOM11                 B43_PHY_N(0x05C) /* RX filter 40 denominator 11 */
+#define B43_NPHY_PPROC_RSTLEN                  B43_PHY_N(0x060) /* Packet processing reset length */
+#define B43_NPHY_INITCARR_DLEN                 B43_PHY_N(0x061) /* Initial carrier detection length */
+#define B43_NPHY_CLIP1CARR_DLEN                        B43_PHY_N(0x062) /* Clip1 carrier detection length */
+#define B43_NPHY_CLIP2CARR_DLEN                        B43_PHY_N(0x063) /* Clip2 carrier detection length */
+#define B43_NPHY_INITGAIN_SLEN                 B43_PHY_N(0x064) /* Initial gain settle length */
+#define B43_NPHY_CLIP1GAIN_SLEN                        B43_PHY_N(0x065) /* Clip1 gain settle length */
+#define B43_NPHY_CLIP2GAIN_SLEN                        B43_PHY_N(0x066) /* Clip2 gain settle length */
+#define B43_NPHY_PACKGAIN_SLEN                 B43_PHY_N(0x067) /* Packet gain settle length */
+#define B43_NPHY_CARRSRC_TLEN                  B43_PHY_N(0x068) /* Carrier search timeout length */
+#define B43_NPHY_TISRC_TLEN                    B43_PHY_N(0x069) /* Timing search timeout length */
+#define B43_NPHY_ENDROP_TLEN                   B43_PHY_N(0x06A) /* Energy drop timeout length */
+#define B43_NPHY_CLIP1_NBDWELL_LEN             B43_PHY_N(0x06B) /* Clip1 NB dwell length */
+#define B43_NPHY_CLIP2_NBDWELL_LEN             B43_PHY_N(0x06C) /* Clip2 NB dwell length */
+#define B43_NPHY_W1CLIP1_DWELL_LEN             B43_PHY_N(0x06D) /* W1 clip1 dwell length */
+#define B43_NPHY_W1CLIP2_DWELL_LEN             B43_PHY_N(0x06E) /* W1 clip2 dwell length */
+#define B43_NPHY_W2CLIP1_DWELL_LEN             B43_PHY_N(0x06F) /* W2 clip1 dwell length */
+#define B43_NPHY_PLOAD_CSENSE_EXTLEN           B43_PHY_N(0x070) /* Payload carrier sense extension length */
+#define B43_NPHY_EDROP_CSENSE_EXTLEN           B43_PHY_N(0x071) /* Energy drop carrier sense extension length */
+#define B43_NPHY_TABLE_ADDR                    B43_PHY_N(0x072) /* Table address */
+#define B43_NPHY_TABLE_DATALO                  B43_PHY_N(0x073) /* Table data low */
+#define B43_NPHY_TABLE_DATAHI                  B43_PHY_N(0x074) /* Table data high */
+#define B43_NPHY_WWISE_LENIDX                  B43_PHY_N(0x075) /* WWiSE length index */
+#define B43_NPHY_TGNSYNC_LENIDX                        B43_PHY_N(0x076) /* TGNsync length index */
+#define B43_NPHY_TXMACIF_HOLDOFF               B43_PHY_N(0x077) /* TX MAC IF Hold off */
+#define B43_NPHY_RFCTL_CMD                     B43_PHY_N(0x078) /* RF control (command) */
+#define  B43_NPHY_RFCTL_CMD_START              0x0001 /* Start sequence */
+#define  B43_NPHY_RFCTL_CMD_RXTX               0x0002 /* RX/TX */
+#define  B43_NPHY_RFCTL_CMD_CORESEL            0x0038 /* Core select */
+#define  B43_NPHY_RFCTL_CMD_CORESEL_SHIFT      3
+#define  B43_NPHY_RFCTL_CMD_PORFORCE           0x0040 /* POR force */
+#define  B43_NPHY_RFCTL_CMD_OEPORFORCE         0x0080 /* OE POR force */
+#define  B43_NPHY_RFCTL_CMD_RXEN               0x0100 /* RX enable */
+#define  B43_NPHY_RFCTL_CMD_TXEN               0x0200 /* TX enable */
+#define  B43_NPHY_RFCTL_CMD_CHIP0PU            0x0400 /* Chip0 PU */
+#define  B43_NPHY_RFCTL_CMD_EN                 0x0800 /* Radio enabled */
+#define  B43_NPHY_RFCTL_CMD_SEQENCORE          0xF000 /* Seq en core */
+#define  B43_NPHY_RFCTL_CMD_SEQENCORE_SHIFT    12
+#define B43_NPHY_RFCTL_RSSIO1                  B43_PHY_N(0x07A) /* RF control (RSSI others 1) */
+#define  B43_NPHY_RFCTL_RSSIO1_RXPD            0x0001 /* RX PD */
+#define  B43_NPHY_RFCTL_RSSIO1_TXPD            0x0002 /* TX PD */
+#define  B43_NPHY_RFCTL_RSSIO1_PAPD            0x0004 /* PA PD */
+#define  B43_NPHY_RFCTL_RSSIO1_RSSICTL         0x0030 /* RSSI control */
+#define  B43_NPHY_RFCTL_RSSIO1_LPFBW           0x00C0 /* LPF bandwidth */
+#define  B43_NPHY_RFCTL_RSSIO1_HPFBWHI         0x0100 /* HPF bandwidth high */
+#define  B43_NPHY_RFCTL_RSSIO1_HIQDISCO                0x0200 /* HIQ dis core */
+#define B43_NPHY_RFCTL_RXG1                    B43_PHY_N(0x07B) /* RF control (RX gain 1) */
+#define B43_NPHY_RFCTL_TXG1                    B43_PHY_N(0x07C) /* RF control (TX gain 1) */
+#define B43_NPHY_RFCTL_RSSIO2                  B43_PHY_N(0x07D) /* RF control (RSSI others 2) */
+#define  B43_NPHY_RFCTL_RSSIO2_RXPD            0x0001 /* RX PD */
+#define  B43_NPHY_RFCTL_RSSIO2_TXPD            0x0002 /* TX PD */
+#define  B43_NPHY_RFCTL_RSSIO2_PAPD            0x0004 /* PA PD */
+#define  B43_NPHY_RFCTL_RSSIO2_RSSICTL         0x0030 /* RSSI control */
+#define  B43_NPHY_RFCTL_RSSIO2_LPFBW           0x00C0 /* LPF bandwidth */
+#define  B43_NPHY_RFCTL_RSSIO2_HPFBWHI         0x0100 /* HPF bandwidth high */
+#define  B43_NPHY_RFCTL_RSSIO2_HIQDISCO                0x0200 /* HIQ dis core */
+#define B43_NPHY_RFCTL_RXG2                    B43_PHY_N(0x07E) /* RF control (RX gain 2) */
+#define B43_NPHY_RFCTL_TXG2                    B43_PHY_N(0x07F) /* RF control (TX gain 2) */
+#define B43_NPHY_RFCTL_RSSIO3                  B43_PHY_N(0x080) /* RF control (RSSI others 3) */
+#define  B43_NPHY_RFCTL_RSSIO3_RXPD            0x0001 /* RX PD */
+#define  B43_NPHY_RFCTL_RSSIO3_TXPD            0x0002 /* TX PD */
+#define  B43_NPHY_RFCTL_RSSIO3_PAPD            0x0004 /* PA PD */
+#define  B43_NPHY_RFCTL_RSSIO3_RSSICTL         0x0030 /* RSSI control */
+#define  B43_NPHY_RFCTL_RSSIO3_LPFBW           0x00C0 /* LPF bandwidth */
+#define  B43_NPHY_RFCTL_RSSIO3_HPFBWHI         0x0100 /* HPF bandwidth high */
+#define  B43_NPHY_RFCTL_RSSIO3_HIQDISCO                0x0200 /* HIQ dis core */
+#define B43_NPHY_RFCTL_RXG3                    B43_PHY_N(0x081) /* RF control (RX gain 3) */
+#define B43_NPHY_RFCTL_TXG3                    B43_PHY_N(0x082) /* RF control (TX gain 3) */
+#define B43_NPHY_RFCTL_RSSIO4                  B43_PHY_N(0x083) /* RF control (RSSI others 4) */
+#define  B43_NPHY_RFCTL_RSSIO4_RXPD            0x0001 /* RX PD */
+#define  B43_NPHY_RFCTL_RSSIO4_TXPD            0x0002 /* TX PD */
+#define  B43_NPHY_RFCTL_RSSIO4_PAPD            0x0004 /* PA PD */
+#define  B43_NPHY_RFCTL_RSSIO4_RSSICTL         0x0030 /* RSSI control */
+#define  B43_NPHY_RFCTL_RSSIO4_LPFBW           0x00C0 /* LPF bandwidth */
+#define  B43_NPHY_RFCTL_RSSIO4_HPFBWHI         0x0100 /* HPF bandwidth high */
+#define  B43_NPHY_RFCTL_RSSIO4_HIQDISCO                0x0200 /* HIQ dis core */
+#define B43_NPHY_RFCTL_RXG4                    B43_PHY_N(0x084) /* RF control (RX gain 4) */
+#define B43_NPHY_RFCTL_TXG4                    B43_PHY_N(0x085) /* RF control (TX gain 4) */
+#define B43_NPHY_C1_TXIQ_COMP_OFF              B43_PHY_N(0x087) /* Core 1 TX I/Q comp offset */
+#define B43_NPHY_C2_TXIQ_COMP_OFF              B43_PHY_N(0x088) /* Core 2 TX I/Q comp offset */
+#define B43_NPHY_C1_TXCTL                      B43_PHY_N(0x08B) /* Core 1 TX control */
+#define B43_NPHY_C2_TXCTL                      B43_PHY_N(0x08C) /* Core 2 TX control */
+#define B43_NPHY_SCRAM_SIGCTL                  B43_PHY_N(0x090) /* Scram signal control */
+#define  B43_NPHY_SCRAM_SIGCTL_INITST          0x007F /* Initial state value */
+#define  B43_NPHY_SCRAM_SIGCTL_INITST_SHIFT    0
+#define  B43_NPHY_SCRAM_SIGCTL_SCM             0x0080 /* Scram control mode */
+#define  B43_NPHY_SCRAM_SIGCTL_SICE            0x0100 /* Scram index control enable */
+#define  B43_NPHY_SCRAM_SIGCTL_START           0xFE00 /* Scram start bit */
+#define  B43_NPHY_SCRAM_SIGCTL_START_SHIFT     9
+#define B43_NPHY_RFCTL_INTC1                   B43_PHY_N(0x091) /* RF control (intc 1) */
+#define B43_NPHY_RFCTL_INTC2                   B43_PHY_N(0x092) /* RF control (intc 2) */
+#define B43_NPHY_RFCTL_INTC3                   B43_PHY_N(0x093) /* RF control (intc 3) */
+#define B43_NPHY_RFCTL_INTC4                   B43_PHY_N(0x094) /* RF control (intc 4) */
+#define B43_NPHY_NRDTO_WWISE                   B43_PHY_N(0x095) /* # datatones WWiSE */
+#define B43_NPHY_NRDTO_TGNSYNC                 B43_PHY_N(0x096) /* # datatones TGNsync */
+#define B43_NPHY_SIGFMOD_WWISE                 B43_PHY_N(0x097) /* Signal field mod WWiSE */
+#define B43_NPHY_LEG_SIGFMOD_11N               B43_PHY_N(0x098) /* Legacy signal field mod 11n */
+#define B43_NPHY_HT_SIGFMOD_11N                        B43_PHY_N(0x099) /* HT signal field mod 11n */
+#define B43_NPHY_C1_RXIQ_COMPA0                        B43_PHY_N(0x09A) /* Core 1 RX I/Q comp A0 */
+#define B43_NPHY_C1_RXIQ_COMPB0                        B43_PHY_N(0x09B) /* Core 1 RX I/Q comp B0 */
+#define B43_NPHY_C2_RXIQ_COMPA1                        B43_PHY_N(0x09C) /* Core 2 RX I/Q comp A1 */
+#define B43_NPHY_C2_RXIQ_COMPB1                        B43_PHY_N(0x09D) /* Core 2 RX I/Q comp B1 */
+#define B43_NPHY_RXCTL                         B43_PHY_N(0x0A0) /* RX control */
+#define  B43_NPHY_RXCTL_BSELU20                        0x0010 /* Band select upper 20 */
+#define  B43_NPHY_RXCTL_RIFSEN                 0x0080 /* RIFS enable */
+#define B43_NPHY_RFSEQMODE                     B43_PHY_N(0x0A1) /* RF seq mode */
+#define  B43_NPHY_RFSEQMODE_CAOVER             0x0001 /* Core active override */
+#define  B43_NPHY_RFSEQMODE_TROVER             0x0002 /* Trigger override */
+#define B43_NPHY_RFSEQCA                       B43_PHY_N(0x0A2) /* RF seq core active */
+#define  B43_NPHY_RFSEQCA_TXEN                 0x000F /* TX enable */
+#define  B43_NPHY_RFSEQCA_TXEN_SHIFT           0
+#define  B43_NPHY_RFSEQCA_RXEN                 0x00F0 /* RX enable */
+#define  B43_NPHY_RFSEQCA_RXEN_SHIFT           4
+#define  B43_NPHY_RFSEQCA_TXDIS                        0x0F00 /* TX disable */
+#define  B43_NPHY_RFSEQCA_TXDIS_SHIFT          8
+#define  B43_NPHY_RFSEQCA_RXDIS                        0xF000 /* RX disable */
+#define  B43_NPHY_RFSEQCA_RXDIS_SHIFT          12
+#define B43_NPHY_RFSEQTR                       B43_PHY_N(0x0A3) /* RF seq trigger */
+#define  B43_NPHY_RFSEQTR_RX2TX                        0x0001 /* RX2TX */
+#define  B43_NPHY_RFSEQTR_TX2RX                        0x0002 /* TX2RX */
+#define  B43_NPHY_RFSEQTR_UPGH                 0x0004 /* Update gain H */
+#define  B43_NPHY_RFSEQTR_UPGL                 0x0008 /* Update gain L */
+#define  B43_NPHY_RFSEQTR_UPGU                 0x0010 /* Update gain U */
+#define  B43_NPHY_RFSEQTR_RST2RX               0x0020 /* Reset to RX */
+#define B43_NPHY_RFSEQST                       B43_PHY_N(0x0A4) /* RF seq status. Values same as trigger. */
+#define B43_NPHY_AFECTL_OVER                   B43_PHY_N(0x0A5) /* AFE control override */
+#define B43_NPHY_AFECTL_C1                     B43_PHY_N(0x0A6) /* AFE control core 1 */
+#define B43_NPHY_AFECTL_C2                     B43_PHY_N(0x0A7) /* AFE control core 2 */
+#define B43_NPHY_AFECTL_C3                     B43_PHY_N(0x0A8) /* AFE control core 3 */
+#define B43_NPHY_AFECTL_C4                     B43_PHY_N(0x0A9) /* AFE control core 4 */
+#define B43_NPHY_AFECTL_DACGAIN1               B43_PHY_N(0x0AA) /* AFE control DAC gain 1 */
+#define B43_NPHY_AFECTL_DACGAIN2               B43_PHY_N(0x0AB) /* AFE control DAC gain 2 */
+#define B43_NPHY_AFECTL_DACGAIN3               B43_PHY_N(0x0AC) /* AFE control DAC gain 3 */
+#define B43_NPHY_AFECTL_DACGAIN4               B43_PHY_N(0x0AD) /* AFE control DAC gain 4 */
+#define B43_NPHY_STR_ADDR1                     B43_PHY_N(0x0AE) /* STR address 1 */
+#define B43_NPHY_STR_ADDR2                     B43_PHY_N(0x0AF) /* STR address 2 */
+#define B43_NPHY_CLASSCTL                      B43_PHY_N(0x0B0) /* Classifier control */
+#define  B43_NPHY_CLASSCTL_CCKEN               0x0001 /* CCK enable */
+#define  B43_NPHY_CLASSCTL_OFDMEN              0x0002 /* OFDM enable */
+#define  B43_NPHY_CLASSCTL_WAITEDEN            0x0004 /* Waited enable */
+#define B43_NPHY_IQFLIP                                B43_PHY_N(0x0B1) /* I/Q flip */
+#define  B43_NPHY_IQFLIP_ADC1                  0x0001 /* ADC1 */
+#define  B43_NPHY_IQFLIP_ADC2                  0x0010 /* ADC2 */
+#define B43_NPHY_SISO_SNR_THRES                        B43_PHY_N(0x0B2) /* SISO SNR threshold */
+#define B43_NPHY_SIGMA_N_MULT                  B43_PHY_N(0x0B3) /* Sigma N multiplier */
+#define B43_NPHY_TXMACDELAY                    B43_PHY_N(0x0B4) /* TX MAC delay */
+#define B43_NPHY_TXFRAMEDELAY                  B43_PHY_N(0x0B5) /* TX frame delay */
+#define B43_NPHY_MLPARM                                B43_PHY_N(0x0B6) /* ML parameters */
+#define B43_NPHY_MLCTL                         B43_PHY_N(0x0B7) /* ML control */
+#define B43_NPHY_WWISE_20NCYCDAT               B43_PHY_N(0x0B8) /* WWiSE 20 N cyc data */
+#define B43_NPHY_WWISE_40NCYCDAT               B43_PHY_N(0x0B9) /* WWiSE 40 N cyc data */
+#define B43_NPHY_TGNSYNC_20NCYCDAT             B43_PHY_N(0x0BA) /* TGNsync 20 N cyc data */
+#define B43_NPHY_TGNSYNC_40NCYCDAT             B43_PHY_N(0x0BB) /* TGNsync 40 N cyc data */
+#define B43_NPHY_INITSWIZP                     B43_PHY_N(0x0BC) /* Initial swizzle pattern */
+#define B43_NPHY_TXTAILCNT                     B43_PHY_N(0x0BD) /* TX tail count value */
+#define B43_NPHY_BPHY_CTL1                     B43_PHY_N(0x0BE) /* B PHY control 1 */
+#define B43_NPHY_BPHY_CTL2                     B43_PHY_N(0x0BF) /* B PHY control 2 */
+#define  B43_NPHY_BPHY_CTL2_LUT                        0x001F /* LUT index */
+#define  B43_NPHY_BPHY_CTL2_LUT_SHIFT          0
+#define  B43_NPHY_BPHY_CTL2_MACDEL             0x7FE0 /* MAC delay */
+#define  B43_NPHY_BPHY_CTL2_MACDEL_SHIFT       5
+#define B43_NPHY_IQLOCAL_CMD                   B43_PHY_N(0x0C0) /* I/Q LO cal command */
+#define  B43_NPHY_IQLOCAL_CMD_EN               0x8000
+#define B43_NPHY_IQLOCAL_CMDNNUM               B43_PHY_N(0x0C1) /* I/Q LO cal command N num */
+#define B43_NPHY_IQLOCAL_CMDGCTL               B43_PHY_N(0x0C2) /* I/Q LO cal command G control */
+#define B43_NPHY_SAMP_CMD                      B43_PHY_N(0x0C3) /* Sample command */
+#define  B43_NPHY_SAMP_CMD_STOP                        0x0002 /* Stop */
+#define B43_NPHY_SAMP_LOOPCNT                  B43_PHY_N(0x0C4) /* Sample loop count */
+#define B43_NPHY_SAMP_WAITCNT                  B43_PHY_N(0x0C5) /* Sample wait count */
+#define B43_NPHY_SAMP_DEPCNT                   B43_PHY_N(0x0C6) /* Sample depth count */
+#define B43_NPHY_SAMP_STAT                     B43_PHY_N(0x0C7) /* Sample status */
+#define B43_NPHY_GPIO_LOOEN                    B43_PHY_N(0x0C8) /* GPIO low out enable */
+#define B43_NPHY_GPIO_HIOEN                    B43_PHY_N(0x0C9) /* GPIO high out enable */
+#define B43_NPHY_GPIO_SEL                      B43_PHY_N(0x0CA) /* GPIO select */
+#define B43_NPHY_GPIO_CLKCTL                   B43_PHY_N(0x0CB) /* GPIO clock control */
+#define B43_NPHY_TXF_20CO_AS0                  B43_PHY_N(0x0CC) /* TX filter 20 coeff A stage 0 */
+#define B43_NPHY_TXF_20CO_AS1                  B43_PHY_N(0x0CD) /* TX filter 20 coeff A stage 1 */
+#define B43_NPHY_TXF_20CO_AS2                  B43_PHY_N(0x0CE) /* TX filter 20 coeff A stage 2 */
+#define B43_NPHY_TXF_20CO_B32S0                        B43_PHY_N(0x0CF) /* TX filter 20 coeff B32 stage 0 */
+#define B43_NPHY_TXF_20CO_B1S0                 B43_PHY_N(0x0D0) /* TX filter 20 coeff B1 stage 0 */
+#define B43_NPHY_TXF_20CO_B32S1                        B43_PHY_N(0x0D1) /* TX filter 20 coeff B32 stage 1 */
+#define B43_NPHY_TXF_20CO_B1S1                 B43_PHY_N(0x0D2) /* TX filter 20 coeff B1 stage 1 */
+#define B43_NPHY_TXF_20CO_B32S2                        B43_PHY_N(0x0D3) /* TX filter 20 coeff B32 stage 2 */
+#define B43_NPHY_TXF_20CO_B1S2                 B43_PHY_N(0x0D4) /* TX filter 20 coeff B1 stage 2 */
+#define B43_NPHY_SIGFLDTOL                     B43_PHY_N(0x0D5) /* Signal fld tolerance */
+#define B43_NPHY_TXSERFLD                      B43_PHY_N(0x0D6) /* TX service field */
+#define B43_NPHY_AFESEQ_RX2TX_PUD              B43_PHY_N(0x0D7) /* AFE seq RX2TX power up/down delay */
+#define B43_NPHY_AFESEQ_TX2RX_PUD              B43_PHY_N(0x0D8) /* AFE seq TX2RX power up/down delay */
+#define B43_NPHY_TGNSYNC_SCRAMI0               B43_PHY_N(0x0D9) /* TGNsync scram init 0 */
+#define B43_NPHY_TGNSYNC_SCRAMI1               B43_PHY_N(0x0DA) /* TGNsync scram init 1 */
+#define B43_NPHY_INITSWIZPATTLEG               B43_PHY_N(0x0DB) /* Initial swizzle pattern leg */
+#define B43_NPHY_BPHY_CTL3                     B43_PHY_N(0x0DC) /* B PHY control 3 */
+#define  B43_NPHY_BPHY_CTL3_SCALE              0x00FF /* Scale */
+#define  B43_NPHY_BPHY_CTL3_SCALE_SHIFT                0
+#define  B43_NPHY_BPHY_CTL3_FSC                        0xFF00 /* Frame start count value */
+#define  B43_NPHY_BPHY_CTL3_FSC_SHIFT          8
+#define B43_NPHY_BPHY_CTL4                     B43_PHY_N(0x0DD) /* B PHY control 4 */
+#define B43_NPHY_C1_TXBBMULT                   B43_PHY_N(0x0DE) /* Core 1 TX BB multiplier */
+#define B43_NPHY_C2_TXBBMULT                   B43_PHY_N(0x0DF) /* Core 2 TX BB multiplier */
+#define B43_NPHY_TXF_40CO_AS0                  B43_PHY_N(0x0E1) /* TX filter 40 coeff A stage 0 */
+#define B43_NPHY_TXF_40CO_AS1                  B43_PHY_N(0x0E2) /* TX filter 40 coeff A stage 1 */
+#define B43_NPHY_TXF_40CO_AS2                  B43_PHY_N(0x0E3) /* TX filter 40 coeff A stage 2 */
+#define B43_NPHY_TXF_40CO_B32S0                        B43_PHY_N(0x0E4) /* TX filter 40 coeff B32 stage 0 */
+#define B43_NPHY_TXF_40CO_B1S0                 B43_PHY_N(0x0E5) /* TX filter 40 coeff B1 stage 0 */
+#define B43_NPHY_TXF_40CO_B32S1                        B43_PHY_N(0x0E6) /* TX filter 40 coeff B32 stage 1 */
+#define B43_NPHY_TXF_40CO_B1S1                 B43_PHY_N(0x0E7) /* TX filter 40 coeff B1 stage 1 */
+#define B43_NPHY_TXF_40CO_B32S2                        B43_PHY_N(0x0E8) /* TX filter 40 coeff B32 stage 2 */
+#define B43_NPHY_TXF_40CO_B1S2                 B43_PHY_N(0x0E9) /* TX filter 40 coeff B1 stage 2 */
+#define B43_NPHY_BIST_STAT2                    B43_PHY_N(0x0EA) /* BIST status 2 */
+#define B43_NPHY_BIST_STAT3                    B43_PHY_N(0x0EB) /* BIST status 3 */
+#define B43_NPHY_RFCTL_OVER                    B43_PHY_N(0x0EC) /* RF control override */
+#define B43_NPHY_MIMOCFG                       B43_PHY_N(0x0ED) /* MIMO config */
+#define  B43_NPHY_MIMOCFG_GFMIX                        0x0004 /* Greenfield or mixed mode */
+#define  B43_NPHY_MIMOCFG_AUTO                 0x0100 /* Greenfield/mixed mode auto */
+#define B43_NPHY_RADAR_BLNKCTL                 B43_PHY_N(0x0EE) /* Radar blank control */
+#define B43_NPHY_A0RADAR_FIFOCTL               B43_PHY_N(0x0EF) /* Antenna 0 radar FIFO control */
+#define B43_NPHY_A1RADAR_FIFOCTL               B43_PHY_N(0x0F0) /* Antenna 1 radar FIFO control */
+#define B43_NPHY_A0RADAR_FIFODAT               B43_PHY_N(0x0F1) /* Antenna 0 radar FIFO data */
+#define B43_NPHY_A1RADAR_FIFODAT               B43_PHY_N(0x0F2) /* Antenna 1 radar FIFO data */
+#define B43_NPHY_RADAR_THRES0                  B43_PHY_N(0x0F3) /* Radar threshold 0 */
+#define B43_NPHY_RADAR_THRES1                  B43_PHY_N(0x0F4) /* Radar threshold 1 */
+#define B43_NPHY_RADAR_THRES0R                 B43_PHY_N(0x0F5) /* Radar threshold 0R */
+#define B43_NPHY_RADAR_THRES1R                 B43_PHY_N(0x0F6) /* Radar threshold 1R */
+#define B43_NPHY_CSEN_20IN40_DLEN              B43_PHY_N(0x0F7) /* Carrier sense 20 in 40 dwell length */
+#define B43_NPHY_RFCTL_LUT_TRSW_LO1            B43_PHY_N(0x0F8) /* RF control LUT TRSW lower 1 */
+#define B43_NPHY_RFCTL_LUT_TRSW_UP1            B43_PHY_N(0x0F9) /* RF control LUT TRSW upper 1 */
+#define B43_NPHY_RFCTL_LUT_TRSW_LO2            B43_PHY_N(0x0FA) /* RF control LUT TRSW lower 2 */
+#define B43_NPHY_RFCTL_LUT_TRSW_UP2            B43_PHY_N(0x0FB) /* RF control LUT TRSW upper 2 */
+#define B43_NPHY_RFCTL_LUT_TRSW_LO3            B43_PHY_N(0x0FC) /* RF control LUT TRSW lower 3 */
+#define B43_NPHY_RFCTL_LUT_TRSW_UP3            B43_PHY_N(0x0FD) /* RF control LUT TRSW upper 3 */
+#define B43_NPHY_RFCTL_LUT_TRSW_LO4            B43_PHY_N(0x0FE) /* RF control LUT TRSW lower 4 */
+#define B43_NPHY_RFCTL_LUT_TRSW_UP4            B43_PHY_N(0x0FF) /* RF control LUT TRSW upper 4 */
+#define B43_NPHY_RFCTL_LUT_LNAPA1              B43_PHY_N(0x100) /* RF control LUT LNA PA 1 */
+#define B43_NPHY_RFCTL_LUT_LNAPA2              B43_PHY_N(0x101) /* RF control LUT LNA PA 2 */
+#define B43_NPHY_RFCTL_LUT_LNAPA3              B43_PHY_N(0x102) /* RF control LUT LNA PA 3 */
+#define B43_NPHY_RFCTL_LUT_LNAPA4              B43_PHY_N(0x103) /* RF control LUT LNA PA 4 */
+#define B43_NPHY_TGNSYNC_CRCM0                 B43_PHY_N(0x104) /* TGNsync CRC mask 0 */
+#define B43_NPHY_TGNSYNC_CRCM1                 B43_PHY_N(0x105) /* TGNsync CRC mask 1 */
+#define B43_NPHY_TGNSYNC_CRCM2                 B43_PHY_N(0x106) /* TGNsync CRC mask 2 */
+#define B43_NPHY_TGNSYNC_CRCM3                 B43_PHY_N(0x107) /* TGNsync CRC mask 3 */
+#define B43_NPHY_TGNSYNC_CRCM4                 B43_PHY_N(0x108) /* TGNsync CRC mask 4 */
+#define B43_NPHY_CRCPOLY                       B43_PHY_N(0x109) /* CRC polynomial */
+#define B43_NPHY_SIGCNT                                B43_PHY_N(0x10A) /* # sig count */
+#define B43_NPHY_SIGSTARTBIT_CTL               B43_PHY_N(0x10B) /* Sig start bit control */
+#define B43_NPHY_CRCPOLY_ORDER                 B43_PHY_N(0x10C) /* CRC polynomial order */
+#define B43_NPHY_RFCTL_CST0                    B43_PHY_N(0x10D) /* RF control core swap table 0 */
+#define B43_NPHY_RFCTL_CST1                    B43_PHY_N(0x10E) /* RF control core swap table 1 */
+#define B43_NPHY_RFCTL_CST2O                   B43_PHY_N(0x10F) /* RF control core swap table 2 + others */
+#define B43_NPHY_BPHY_CTL5                     B43_PHY_N(0x111) /* B PHY control 5 */
+#define B43_NPHY_RFSEQ_LPFBW                   B43_PHY_N(0x112) /* RF seq LPF bandwidth */
+#define B43_NPHY_TSSIBIAS1                     B43_PHY_N(0x114) /* TSSI bias val 1 */
+#define B43_NPHY_TSSIBIAS2                     B43_PHY_N(0x115) /* TSSI bias val 2 */
+#define  B43_NPHY_TSSIBIAS_BIAS                        0x00FF /* Bias */
+#define  B43_NPHY_TSSIBIAS_BIAS_SHIFT          0
+#define  B43_NPHY_TSSIBIAS_VAL                 0xFF00 /* Value */
+#define  B43_NPHY_TSSIBIAS_VAL_SHIFT           8
+#define B43_NPHY_ESTPWR1                       B43_PHY_N(0x118) /* Estimated power 1 */
+#define B43_NPHY_ESTPWR2                       B43_PHY_N(0x119) /* Estimated power 2 */
+#define  B43_NPHY_ESTPWR_PWR                   0x00FF /* Estimated power */
+#define  B43_NPHY_ESTPWR_PWR_SHIFT             0
+#define  B43_NPHY_ESTPWR_VALID                 0x0100 /* Estimated power valid */
+#define B43_NPHY_TSSI_MAXTXFDT                 B43_PHY_N(0x11C) /* TSSI max TX frame delay time */
+#define  B43_NPHY_TSSI_MAXTXFDT_VAL            0x00FF /* max TX frame delay time */
+#define  B43_NPHY_TSSI_MAXTXFDT_VAL_SHIFT      0
+#define B43_NPHY_TSSI_MAXTDT                   B43_PHY_N(0x11D) /* TSSI max TSSI delay time */
+#define  B43_NPHY_TSSI_MAXTDT_VAL              0x00FF /* max TSSI delay time */
+#define  B43_NPHY_TSSI_MAXTDT_VAL_SHIFT                0
+#define B43_NPHY_ITSSI1                                B43_PHY_N(0x11E) /* TSSI idle 1 */
+#define B43_NPHY_ITSSI2                                B43_PHY_N(0x11F) /* TSSI idle 2 */
+#define  B43_NPHY_ITSSI_VAL                    0x00FF /* Idle TSSI */
+#define  B43_NPHY_ITSSI_VAL_SHIFT              0
+#define B43_NPHY_TSSIMODE                      B43_PHY_N(0x122) /* TSSI mode */
+#define  B43_NPHY_TSSIMODE_EN                  0x0001 /* TSSI enable */
+#define  B43_NPHY_TSSIMODE_PDEN                        0x0002 /* Power det enable */
+#define B43_NPHY_RXMACIFM                      B43_PHY_N(0x123) /* RX Macif mode */
+#define B43_NPHY_CRSIT_COCNT_LO                        B43_PHY_N(0x124) /* CRS idle time CRS-on count (low) */
+#define B43_NPHY_CRSIT_COCNT_HI                        B43_PHY_N(0x125) /* CRS idle time CRS-on count (high) */
+#define B43_NPHY_CRSIT_MTCNT_LO                        B43_PHY_N(0x126) /* CRS idle time measure time count (low) */
+#define B43_NPHY_CRSIT_MTCNT_HI                        B43_PHY_N(0x127) /* CRS idle time measure time count (high) */
+#define B43_NPHY_SAMTWC                                B43_PHY_N(0x128) /* Sample tail wait count */
+#define B43_NPHY_IQEST_CMD                     B43_PHY_N(0x129) /* I/Q estimate command */
+#define  B43_NPHY_IQEST_CMD_START              0x0001 /* Start */
+#define  B43_NPHY_IQEST_CMD_MODE               0x0002 /* Mode */
+#define B43_NPHY_IQEST_WT                      B43_PHY_N(0x12A) /* I/Q estimate wait time */
+#define  B43_NPHY_IQEST_WT_VAL                 0x00FF /* Wait time */
+#define  B43_NPHY_IQEST_WT_VAL_SHIFT           0
+#define B43_NPHY_IQEST_SAMCNT                  B43_PHY_N(0x12B) /* I/Q estimate sample count */
+#define B43_NPHY_IQEST_IQACC_LO0               B43_PHY_N(0x12C) /* I/Q estimate I/Q acc lo 0 */
+#define B43_NPHY_IQEST_IQACC_HI0               B43_PHY_N(0x12D) /* I/Q estimate I/Q acc hi 0 */
+#define B43_NPHY_IQEST_IPACC_LO0               B43_PHY_N(0x12E) /* I/Q estimate I power acc lo 0 */
+#define B43_NPHY_IQEST_IPACC_HI0               B43_PHY_N(0x12F) /* I/Q estimate I power acc hi 0 */
+#define B43_NPHY_IQEST_QPACC_LO0               B43_PHY_N(0x130) /* I/Q estimate Q power acc lo 0 */
+#define B43_NPHY_IQEST_QPACC_HI0               B43_PHY_N(0x131) /* I/Q estimate Q power acc hi 0 */
+#define B43_NPHY_IQEST_IQACC_LO1               B43_PHY_N(0x134) /* I/Q estimate I/Q acc lo 1 */
+#define B43_NPHY_IQEST_IQACC_HI1               B43_PHY_N(0x135) /* I/Q estimate I/Q acc hi 1 */
+#define B43_NPHY_IQEST_IPACC_LO1               B43_PHY_N(0x136) /* I/Q estimate I power acc lo 1 */
+#define B43_NPHY_IQEST_IPACC_HI1               B43_PHY_N(0x137) /* I/Q estimate I power acc hi 1 */
+#define B43_NPHY_IQEST_QPACC_LO1               B43_PHY_N(0x138) /* I/Q estimate Q power acc lo 1 */
+#define B43_NPHY_IQEST_QPACC_HI1               B43_PHY_N(0x139) /* I/Q estimate Q power acc hi 1 */
+#define B43_NPHY_MIMO_CRSTXEXT                 B43_PHY_N(0x13A) /* MIMO PHY CRS TX extension */
+#define B43_NPHY_PWRDET1                       B43_PHY_N(0x13B) /* Power det 1 */
+#define B43_NPHY_PWRDET2                       B43_PHY_N(0x13C) /* Power det 2 */
+#define B43_NPHY_MAXRSSI_DTIME                 B43_PHY_N(0x13F) /* RSSI max RSSI delay time */
+#define B43_NPHY_PIL_DW0                       B43_PHY_N(0x141) /* Pilot data weight 0 */
+#define B43_NPHY_PIL_DW1                       B43_PHY_N(0x142) /* Pilot data weight 1 */
+#define B43_NPHY_PIL_DW2                       B43_PHY_N(0x143) /* Pilot data weight 2 */
+#define  B43_NPHY_PIL_DW_BPSK                  0x000F /* BPSK */
+#define  B43_NPHY_PIL_DW_BPSK_SHIFT            0
+#define  B43_NPHY_PIL_DW_QPSK                  0x00F0 /* QPSK */
+#define  B43_NPHY_PIL_DW_QPSK_SHIFT            4
+#define  B43_NPHY_PIL_DW_16QAM                 0x0F00 /* 16-QAM */
+#define  B43_NPHY_PIL_DW_16QAM_SHIFT           8
+#define  B43_NPHY_PIL_DW_64QAM                 0xF000 /* 64-QAM */
+#define  B43_NPHY_PIL_DW_64QAM_SHIFT           12
+#define B43_NPHY_FMDEM_CFG                     B43_PHY_N(0x144) /* FM demodulation config */
+#define B43_NPHY_PHASETR_A0                    B43_PHY_N(0x145) /* Phase track alpha 0 */
+#define B43_NPHY_PHASETR_A1                    B43_PHY_N(0x146) /* Phase track alpha 1 */
+#define B43_NPHY_PHASETR_A2                    B43_PHY_N(0x147) /* Phase track alpha 2 */
+#define B43_NPHY_PHASETR_B0                    B43_PHY_N(0x148) /* Phase track beta 0 */
+#define B43_NPHY_PHASETR_B1                    B43_PHY_N(0x149) /* Phase track beta 1 */
+#define B43_NPHY_PHASETR_B2                    B43_PHY_N(0x14A) /* Phase track beta 2 */
+#define B43_NPHY_PHASETR_CHG0                  B43_PHY_N(0x14B) /* Phase track change 0 */
+#define B43_NPHY_PHASETR_CHG1                  B43_PHY_N(0x14C) /* Phase track change 1 */
+#define B43_NPHY_PHASETW_OFF                   B43_PHY_N(0x14D) /* Phase track offset */
+#define B43_NPHY_RFCTL_DBG                     B43_PHY_N(0x14E) /* RF control debug */
+#define B43_NPHY_CCK_SHIFTB_REF                        B43_PHY_N(0x150) /* CCK shiftbits reference var */
+#define B43_NPHY_OVER_DGAIN0                   B43_PHY_N(0x152) /* Override digital gain 0 */
+#define B43_NPHY_OVER_DGAIN1                   B43_PHY_N(0x153) /* Override digital gain 1 */
+#define  B43_NPHY_OVER_DGAIN_FDGV              0x0007 /* Force digital gain value */
+#define  B43_NPHY_OVER_DGAIN_FDGV_SHIFT                0
+#define  B43_NPHY_OVER_DGAIN_FDGEN             0x0008 /* Force digital gain enable */
+#define  B43_NPHY_OVER_DGAIN_CCKDGECV          0xFF00 /* CCK digital gain enable count value */
+#define  B43_NPHY_OVER_DGAIN_CCKDGECV_SHIFT    8
+#define B43_NPHY_BIST_STAT4                    B43_PHY_N(0x156) /* BIST status 4 */
+#define B43_NPHY_RADAR_MAL                     B43_PHY_N(0x157) /* Radar MA length */
+#define B43_NPHY_RADAR_SRCCTL                  B43_PHY_N(0x158) /* Radar search control */
+#define B43_NPHY_VLD_DTSIG                     B43_PHY_N(0x159) /* VLD data tones sig */
+#define B43_NPHY_VLD_DTDAT                     B43_PHY_N(0x15A) /* VLD data tones data */
+#define B43_NPHY_C1_BPHY_RXIQCA0               B43_PHY_N(0x15B) /* Core 1 B PHY RX I/Q comp A0 */
+#define B43_NPHY_C1_BPHY_RXIQCB0               B43_PHY_N(0x15C) /* Core 1 B PHY RX I/Q comp B0 */
+#define B43_NPHY_C2_BPHY_RXIQCA1               B43_PHY_N(0x15D) /* Core 2 B PHY RX I/Q comp A1 */
+#define B43_NPHY_C2_BPHY_RXIQCB1               B43_PHY_N(0x15E) /* Core 2 B PHY RX I/Q comp B1 */
+#define B43_NPHY_FREQGAIN0                     B43_PHY_N(0x160) /* Frequency gain 0 */
+#define B43_NPHY_FREQGAIN1                     B43_PHY_N(0x161) /* Frequency gain 1 */
+#define B43_NPHY_FREQGAIN2                     B43_PHY_N(0x162) /* Frequency gain 2 */
+#define B43_NPHY_FREQGAIN3                     B43_PHY_N(0x163) /* Frequency gain 3 */
+#define B43_NPHY_FREQGAIN4                     B43_PHY_N(0x164) /* Frequency gain 4 */
+#define B43_NPHY_FREQGAIN5                     B43_PHY_N(0x165) /* Frequency gain 5 */
+#define B43_NPHY_FREQGAIN6                     B43_PHY_N(0x166) /* Frequency gain 6 */
+#define B43_NPHY_FREQGAIN7                     B43_PHY_N(0x167) /* Frequency gain 7 */
+#define B43_NPHY_FREQGAIN_BYPASS               B43_PHY_N(0x168) /* Frequency gain bypass */
+#define B43_NPHY_TRLOSS                                B43_PHY_N(0x169) /* TR loss value */
+#define B43_NPHY_C1_ADCCLIP                    B43_PHY_N(0x16A) /* Core 1 ADC clip */
+#define B43_NPHY_C2_ADCCLIP                    B43_PHY_N(0x16B) /* Core 2 ADC clip */
+#define B43_NPHY_LTRN_OFFGAIN                  B43_PHY_N(0x16F) /* LTRN offset gain */
+#define B43_NPHY_LTRN_OFF                      B43_PHY_N(0x170) /* LTRN offset */
+#define B43_NPHY_NRDATAT_WWISE20SIG            B43_PHY_N(0x171) /* # data tones WWiSE 20 sig */
+#define B43_NPHY_NRDATAT_WWISE40SIG            B43_PHY_N(0x172) /* # data tones WWiSE 40 sig */
+#define B43_NPHY_NRDATAT_TGNSYNC20SIG          B43_PHY_N(0x173) /* # data tones TGNsync 20 sig */
+#define B43_NPHY_NRDATAT_TGNSYNC40SIG          B43_PHY_N(0x174) /* # data tones TGNsync 40 sig */
+#define B43_NPHY_WWISE_CRCM0                   B43_PHY_N(0x175) /* WWiSE CRC mask 0 */
+#define B43_NPHY_WWISE_CRCM1                   B43_PHY_N(0x176) /* WWiSE CRC mask 1 */
+#define B43_NPHY_WWISE_CRCM2                   B43_PHY_N(0x177) /* WWiSE CRC mask 2 */
+#define B43_NPHY_WWISE_CRCM3                   B43_PHY_N(0x178) /* WWiSE CRC mask 3 */
+#define B43_NPHY_WWISE_CRCM4                   B43_PHY_N(0x179) /* WWiSE CRC mask 4 */
+#define B43_NPHY_CHANEST_CDDSH                 B43_PHY_N(0x17A) /* Channel estimate CDD shift */
+#define B43_NPHY_HTAGC_WCNT                    B43_PHY_N(0x17B) /* HT ADC wait counters */
+#define B43_NPHY_SQPARM                                B43_PHY_N(0x17C) /* SQ params */
+#define B43_NPHY_MCSDUP6M                      B43_PHY_N(0x17D) /* MCS dup 6M */
+#define B43_NPHY_NDATAT_DUP40                  B43_PHY_N(0x17E) /* # data tones dup 40 */
+#define B43_NPHY_DUP40_TGNSYNC_CYCD            B43_PHY_N(0x17F) /* Dup40 TGNsync cycle data */
+#define B43_NPHY_DUP40_GFBL                    B43_PHY_N(0x180) /* Dup40 GF format BL address */
+#define B43_NPHY_DUP40_BL                      B43_PHY_N(0x181) /* Dup40 format BL address */
+#define B43_NPHY_LEGDUP_FTA                    B43_PHY_N(0x182) /* Legacy dup frm table address */
+#define B43_NPHY_PACPROC_DBG                   B43_PHY_N(0x183) /* Packet processing debug */
+#define B43_NPHY_PIL_CYC1                      B43_PHY_N(0x184) /* Pilot cycle counter 1 */
+#define B43_NPHY_PIL_CYC2                      B43_PHY_N(0x185) /* Pilot cycle counter 2 */
+#define B43_NPHY_TXF_20CO_S0A1                 B43_PHY_N(0x186) /* TX filter 20 coeff stage 0 A1 */
+#define B43_NPHY_TXF_20CO_S0A2                 B43_PHY_N(0x187) /* TX filter 20 coeff stage 0 A2 */
+#define B43_NPHY_TXF_20CO_S1A1                 B43_PHY_N(0x188) /* TX filter 20 coeff stage 1 A1 */
+#define B43_NPHY_TXF_20CO_S1A2                 B43_PHY_N(0x189) /* TX filter 20 coeff stage 1 A2 */
+#define B43_NPHY_TXF_20CO_S2A1                 B43_PHY_N(0x18A) /* TX filter 20 coeff stage 2 A1 */
+#define B43_NPHY_TXF_20CO_S2A2                 B43_PHY_N(0x18B) /* TX filter 20 coeff stage 2 A2 */
+#define B43_NPHY_TXF_20CO_S0B1                 B43_PHY_N(0x18C) /* TX filter 20 coeff stage 0 B1 */
+#define B43_NPHY_TXF_20CO_S0B2                 B43_PHY_N(0x18D) /* TX filter 20 coeff stage 0 B2 */
+#define B43_NPHY_TXF_20CO_S0B3                 B43_PHY_N(0x18E) /* TX filter 20 coeff stage 0 B3 */
+#define B43_NPHY_TXF_20CO_S1B1                 B43_PHY_N(0x18F) /* TX filter 20 coeff stage 1 B1 */
+#define B43_NPHY_TXF_20CO_S1B2                 B43_PHY_N(0x190) /* TX filter 20 coeff stage 1 B2 */
+#define B43_NPHY_TXF_20CO_S1B3                 B43_PHY_N(0x191) /* TX filter 20 coeff stage 1 B3 */
+#define B43_NPHY_TXF_20CO_S2B1                 B43_PHY_N(0x192) /* TX filter 20 coeff stage 2 B1 */
+#define B43_NPHY_TXF_20CO_S2B2                 B43_PHY_N(0x193) /* TX filter 20 coeff stage 2 B2 */
+#define B43_NPHY_TXF_20CO_S2B3                 B43_PHY_N(0x194) /* TX filter 20 coeff stage 2 B3 */
+#define B43_NPHY_TXF_40CO_S0A1                 B43_PHY_N(0x195) /* TX filter 40 coeff stage 0 A1 */
+#define B43_NPHY_TXF_40CO_S0A2                 B43_PHY_N(0x196) /* TX filter 40 coeff stage 0 A2 */
+#define B43_NPHY_TXF_40CO_S1A1                 B43_PHY_N(0x197) /* TX filter 40 coeff stage 1 A1 */
+#define B43_NPHY_TXF_40CO_S1A2                 B43_PHY_N(0x198) /* TX filter 40 coeff stage 1 A2 */
+#define B43_NPHY_TXF_40CO_S2A1                 B43_PHY_N(0x199) /* TX filter 40 coeff stage 2 A1 */
+#define B43_NPHY_TXF_40CO_S2A2                 B43_PHY_N(0x19A) /* TX filter 40 coeff stage 2 A2 */
+#define B43_NPHY_TXF_40CO_S0B1                 B43_PHY_N(0x19B) /* TX filter 40 coeff stage 0 B1 */
+#define B43_NPHY_TXF_40CO_S0B2                 B43_PHY_N(0x19C) /* TX filter 40 coeff stage 0 B2 */
+#define B43_NPHY_TXF_40CO_S0B3                 B43_PHY_N(0x19D) /* TX filter 40 coeff stage 0 B3 */
+#define B43_NPHY_TXF_40CO_S1B1                 B43_PHY_N(0x19E) /* TX filter 40 coeff stage 1 B1 */
+#define B43_NPHY_TXF_40CO_S1B2                 B43_PHY_N(0x19F) /* TX filter 40 coeff stage 1 B2 */
+#define B43_NPHY_TXF_40CO_S1B3                 B43_PHY_N(0x1A0) /* TX filter 40 coeff stage 1 B3 */
+#define B43_NPHY_TXF_40CO_S2B1                 B43_PHY_N(0x1A1) /* TX filter 40 coeff stage 2 B1 */
+#define B43_NPHY_TXF_40CO_S2B2                 B43_PHY_N(0x1A2) /* TX filter 40 coeff stage 2 B2 */
+#define B43_NPHY_TXF_40CO_S2B3                 B43_PHY_N(0x1A3) /* TX filter 40 coeff stage 2 B3 */
+#define B43_NPHY_RSSIMC_0I_RSSI_X              B43_PHY_N(0x1A4) /* RSSI multiplication coefficient 0 I RSSI X */
+#define B43_NPHY_RSSIMC_0I_RSSI_Y              B43_PHY_N(0x1A5) /* RSSI multiplication coefficient 0 I RSSI Y */
+#define B43_NPHY_RSSIMC_0I_RSSI_Z              B43_PHY_N(0x1A6) /* RSSI multiplication coefficient 0 I RSSI Z */
+#define B43_NPHY_RSSIMC_0I_TBD                 B43_PHY_N(0x1A7) /* RSSI multiplication coefficient 0 I TBD */
+#define B43_NPHY_RSSIMC_0I_PWRDET              B43_PHY_N(0x1A8) /* RSSI multiplication coefficient 0 I power det */
+#define B43_NPHY_RSSIMC_0I_TSSI                        B43_PHY_N(0x1A9) /* RSSI multiplication coefficient 0 I TSSI */
+#define B43_NPHY_RSSIMC_0Q_RSSI_X              B43_PHY_N(0x1AA) /* RSSI multiplication coefficient 0 Q RSSI X */
+#define B43_NPHY_RSSIMC_0Q_RSSI_Y              B43_PHY_N(0x1AB) /* RSSI multiplication coefficient 0 Q RSSI Y */
+#define B43_NPHY_RSSIMC_0Q_RSSI_Z              B43_PHY_N(0x1AC) /* RSSI multiplication coefficient 0 Q RSSI Z */
+#define B43_NPHY_RSSIMC_0Q_TBD                 B43_PHY_N(0x1AD) /* RSSI multiplication coefficient 0 Q TBD */
+#define B43_NPHY_RSSIMC_0Q_PWRDET              B43_PHY_N(0x1AE) /* RSSI multiplication coefficient 0 Q power det */
+#define B43_NPHY_RSSIMC_0Q_TSSI                        B43_PHY_N(0x1AF) /* RSSI multiplication coefficient 0 Q TSSI */
+#define B43_NPHY_RSSIMC_1I_RSSI_X              B43_PHY_N(0x1B0) /* RSSI multiplication coefficient 1 I RSSI X */
+#define B43_NPHY_RSSIMC_1I_RSSI_Y              B43_PHY_N(0x1B1) /* RSSI multiplication coefficient 1 I RSSI Y */
+#define B43_NPHY_RSSIMC_1I_RSSI_Z              B43_PHY_N(0x1B2) /* RSSI multiplication coefficient 1 I RSSI Z */
+#define B43_NPHY_RSSIMC_1I_TBD                 B43_PHY_N(0x1B3) /* RSSI multiplication coefficient 1 I TBD */
+#define B43_NPHY_RSSIMC_1I_PWRDET              B43_PHY_N(0x1B4) /* RSSI multiplication coefficient 1 I power det */
+#define B43_NPHY_RSSIMC_1I_TSSI                        B43_PHY_N(0x1B5) /* RSSI multiplication coefficient 1 I TSSI */
+#define B43_NPHY_RSSIMC_1Q_RSSI_X              B43_PHY_N(0x1B6) /* RSSI multiplication coefficient 1 Q RSSI X */
+#define B43_NPHY_RSSIMC_1Q_RSSI_Y              B43_PHY_N(0x1B7) /* RSSI multiplication coefficient 1 Q RSSI Y */
+#define B43_NPHY_RSSIMC_1Q_RSSI_Z              B43_PHY_N(0x1B8) /* RSSI multiplication coefficient 1 Q RSSI Z */
+#define B43_NPHY_RSSIMC_1Q_TBD                 B43_PHY_N(0x1B9) /* RSSI multiplication coefficient 1 Q TBD */
+#define B43_NPHY_RSSIMC_1Q_PWRDET              B43_PHY_N(0x1BA) /* RSSI multiplication coefficient 1 Q power det */
+#define B43_NPHY_RSSIMC_1Q_TSSI                        B43_PHY_N(0x1BB) /* RSSI multiplication coefficient 1 Q TSSI */
+#define B43_NPHY_SAMC_WCNT                     B43_PHY_N(0x1BC) /* Sample collect wait counter */
+#define B43_NPHY_PTHROUGH_CNT                  B43_PHY_N(0x1BD) /* Pass-through counter */
+#define B43_NPHY_LTRN_OFF_G20L                 B43_PHY_N(0x1C4) /* LTRN offset gain 20L */
+#define B43_NPHY_LTRN_OFF_20L                  B43_PHY_N(0x1C5) /* LTRN offset 20L */
+#define B43_NPHY_LTRN_OFF_G20U                 B43_PHY_N(0x1C6) /* LTRN offset gain 20U */
+#define B43_NPHY_LTRN_OFF_20U                  B43_PHY_N(0x1C7) /* LTRN offset 20U */
+#define B43_NPHY_DSSSCCK_GAINSL                        B43_PHY_N(0x1C8) /* DSSS/CCK gain settle length */
+#define B43_NPHY_GPIO_LOOUT                    B43_PHY_N(0x1C9) /* GPIO low out */
+#define B43_NPHY_GPIO_HIOUT                    B43_PHY_N(0x1CA) /* GPIO high out */
+#define B43_NPHY_CRS_CHECK                     B43_PHY_N(0x1CB) /* CRS check */
+#define B43_NPHY_ML_LOGSS_RAT                  B43_PHY_N(0x1CC) /* ML/logss ratio */
+#define B43_NPHY_DUPSCALE                      B43_PHY_N(0x1CD) /* Dup scale */
+#define B43_NPHY_BW1A                          B43_PHY_N(0x1CE) /* BW 1A */
+#define B43_NPHY_BW2                           B43_PHY_N(0x1CF) /* BW 2 */
+#define B43_NPHY_BW3                           B43_PHY_N(0x1D0) /* BW 3 */
+#define B43_NPHY_BW4                           B43_PHY_N(0x1D1) /* BW 4 */
+#define B43_NPHY_BW5                           B43_PHY_N(0x1D2) /* BW 5 */
+#define B43_NPHY_BW6                           B43_PHY_N(0x1D3) /* BW 6 */
+#define B43_NPHY_COALEN0                       B43_PHY_N(0x1D4) /* Coarse length 0 */
+#define B43_NPHY_COALEN1                       B43_PHY_N(0x1D5) /* Coarse length 1 */
+#define B43_NPHY_CRSTHRES_1U                   B43_PHY_N(0x1D6) /* CRS threshold 1 U */
+#define B43_NPHY_CRSTHRES_2U                   B43_PHY_N(0x1D7) /* CRS threshold 2 U */
+#define B43_NPHY_CRSTHRES_3U                   B43_PHY_N(0x1D8) /* CRS threshold 3 U */
+#define B43_NPHY_CRSCTL_U                      B43_PHY_N(0x1D9) /* CRS control U */
+#define B43_NPHY_CRSTHRES_1L                   B43_PHY_N(0x1DA) /* CRS threshold 1 L */
+#define B43_NPHY_CRSTHRES_2L                   B43_PHY_N(0x1DB) /* CRS threshold 2 L */
+#define B43_NPHY_CRSTHRES_3L                   B43_PHY_N(0x1DC) /* CRS threshold 3 L */
+#define B43_NPHY_CRSCTL_L                      B43_PHY_N(0x1DD) /* CRS control L */
+#define B43_NPHY_STRA_1U                       B43_PHY_N(0x1DE) /* STR address 1 U */
+#define B43_NPHY_STRA_2U                       B43_PHY_N(0x1DF) /* STR address 2 U */
+#define B43_NPHY_STRA_1L                       B43_PHY_N(0x1E0) /* STR address 1 L */
+#define B43_NPHY_STRA_2L                       B43_PHY_N(0x1E1) /* STR address 2 L */
+#define B43_NPHY_CRSCHECK1                     B43_PHY_N(0x1E2) /* CRS check 1 */
+#define B43_NPHY_CRSCHECK2                     B43_PHY_N(0x1E3) /* CRS check 2 */
+#define B43_NPHY_CRSCHECK3                     B43_PHY_N(0x1E4) /* CRS check 3 */
+#define B43_NPHY_JMPSTP0                       B43_PHY_N(0x1E5) /* Jump step 0 */
+#define B43_NPHY_JMPSTP1                       B43_PHY_N(0x1E6) /* Jump step 1 */
+#define B43_NPHY_TXPCTL_CMD                    B43_PHY_N(0x1E7) /* TX power control command */
+#define  B43_NPHY_TXPCTL_CMD_INIT              0x007F /* Init */
+#define  B43_NPHY_TXPCTL_CMD_INIT_SHIFT                0
+#define  B43_NPHY_TXPCTL_CMD_COEFF             0x2000 /* Power control coefficients */
+#define  B43_NPHY_TXPCTL_CMD_HWPCTLEN          0x4000 /* Hardware TX power control enable */
+#define  B43_NPHY_TXPCTL_CMD_PCTLEN            0x8000 /* TX power control enable */
+#define B43_NPHY_TXPCTL_N                      B43_PHY_N(0x1E8) /* TX power control N num */
+#define  B43_NPHY_TXPCTL_N_TSSID               0x00FF /* N TSSI delay */
+#define  B43_NPHY_TXPCTL_N_TSSID_SHIFT         0
+#define  B43_NPHY_TXPCTL_N_NPTIL2              0x0700 /* N PT integer log2 */
+#define  B43_NPHY_TXPCTL_N_NPTIL2_SHIFT                8
+#define B43_NPHY_TXPCTL_ITSSI                  B43_PHY_N(0x1E9) /* TX power control idle TSSI */
+#define  B43_NPHY_TXPCTL_ITSSI_0               0x003F /* Idle TSSI 0 */
+#define  B43_NPHY_TXPCTL_ITSSI_0_SHIFT         0
+#define  B43_NPHY_TXPCTL_ITSSI_1               0x3F00 /* Idle TSSI 1 */
+#define  B43_NPHY_TXPCTL_ITSSI_1_SHIFT         8
+#define  B43_NPHY_TXPCTL_ITSSI_BINF            0x8000 /* Raw TSSI offset bin format */
+#define B43_NPHY_TXPCTL_TPWR                   B43_PHY_N(0x1EA) /* TX power control target power */
+#define  B43_NPHY_TXPCTL_TPWR_0                        0x00FF /* Power 0 */
+#define  B43_NPHY_TXPCTL_TPWR_0_SHIFT          0
+#define  B43_NPHY_TXPCTL_TPWR_1                        0xFF00 /* Power 1 */
+#define  B43_NPHY_TXPCTL_TPWR_1_SHIFT          8
+#define B43_NPHY_TXPCTL_BIDX                   B43_PHY_N(0x1EB) /* TX power control base index */
+#define  B43_NPHY_TXPCTL_BIDX_0                        0x007F /* uC base index 0 */
+#define  B43_NPHY_TXPCTL_BIDX_0_SHIFT          0
+#define  B43_NPHY_TXPCTL_BIDX_1                        0x7F00 /* uC base index 1 */
+#define  B43_NPHY_TXPCTL_BIDX_1_SHIFT          8
+#define  B43_NPHY_TXPCTL_BIDX_LOAD             0x8000 /* Load base index */
+#define B43_NPHY_TXPCTL_PIDX                   B43_PHY_N(0x1EC) /* TX power control power index */
+#define  B43_NPHY_TXPCTL_PIDX_0                        0x007F /* uC power index 0 */
+#define  B43_NPHY_TXPCTL_PIDX_0_SHIFT          0
+#define  B43_NPHY_TXPCTL_PIDX_1                        0x7F00 /* uC power index 1 */
+#define  B43_NPHY_TXPCTL_PIDX_1_SHIFT          8
+#define B43_NPHY_C1_TXPCTL_STAT                        B43_PHY_N(0x1ED) /* Core 1 TX power control status */
+#define B43_NPHY_C2_TXPCTL_STAT                        B43_PHY_N(0x1EE) /* Core 2 TX power control status */
+#define  B43_NPHY_TXPCTL_STAT_EST              0x00FF /* Estimated power */
+#define  B43_NPHY_TXPCTL_STAT_EST_SHIFT                0
+#define  B43_NPHY_TXPCTL_STAT_BIDX             0x7F00 /* Base index */
+#define  B43_NPHY_TXPCTL_STAT_BIDX_SHIFT       8
+#define  B43_NPHY_TXPCTL_STAT_ESTVALID         0x8000 /* Estimated power valid */
+#define B43_NPHY_SMALLSGS_LEN                  B43_PHY_N(0x1EF) /* Small sig gain settle length */
+#define B43_NPHY_PHYSTAT_GAIN0                 B43_PHY_N(0x1F0) /* PHY stats gain info 0 */
+#define B43_NPHY_PHYSTAT_GAIN1                 B43_PHY_N(0x1F1) /* PHY stats gain info 1 */
+#define B43_NPHY_PHYSTAT_FREQEST               B43_PHY_N(0x1F2) /* PHY stats frequency estimate */
+#define B43_NPHY_PHYSTAT_ADVRET                        B43_PHY_N(0x1F3) /* PHY stats ADV retard */
+#define B43_NPHY_PHYLB_MODE                    B43_PHY_N(0x1F4) /* PHY loopback mode */
+#define B43_NPHY_TONE_MIDX20_1                 B43_PHY_N(0x1F5) /* Tone map index 20/1 */
+#define B43_NPHY_TONE_MIDX20_2                 B43_PHY_N(0x1F6) /* Tone map index 20/2 */
+#define B43_NPHY_TONE_MIDX20_3                 B43_PHY_N(0x1F7) /* Tone map index 20/3 */
+#define B43_NPHY_TONE_MIDX40_1                 B43_PHY_N(0x1F8) /* Tone map index 40/1 */
+#define B43_NPHY_TONE_MIDX40_2                 B43_PHY_N(0x1F9) /* Tone map index 40/2 */
+#define B43_NPHY_TONE_MIDX40_3                 B43_PHY_N(0x1FA) /* Tone map index 40/3 */
+#define B43_NPHY_TONE_MIDX40_4                 B43_PHY_N(0x1FB) /* Tone map index 40/4 */
+#define B43_NPHY_PILTONE_MIDX1                 B43_PHY_N(0x1FC) /* Pilot tone map index 1 */
+#define B43_NPHY_PILTONE_MIDX2                 B43_PHY_N(0x1FD) /* Pilot tone map index 2 */
+#define B43_NPHY_PILTONE_MIDX3                 B43_PHY_N(0x1FE) /* Pilot tone map index 3 */
+#define B43_NPHY_TXRIFS_FRDEL                  B43_PHY_N(0x1FF) /* TX RIFS frame delay */
+#define B43_NPHY_AFESEQ_RX2TX_PUD_40M          B43_PHY_N(0x200) /* AFE seq rx2tx power up/down delay 40M */
+#define B43_NPHY_AFESEQ_TX2RX_PUD_40M          B43_PHY_N(0x201) /* AFE seq tx2rx power up/down delay 40M */
+#define B43_NPHY_AFESEQ_RX2TX_PUD_20M          B43_PHY_N(0x202) /* AFE seq rx2tx power up/down delay 20M */
+#define B43_NPHY_AFESEQ_TX2RX_PUD_20M          B43_PHY_N(0x203) /* AFE seq tx2rx power up/down delay 20M */
+#define B43_NPHY_RX_SIGCTL                     B43_PHY_N(0x204) /* RX signal control */
+#define B43_NPHY_RXPIL_CYCNT0                  B43_PHY_N(0x205) /* RX pilot cycle counter 0 */
+#define B43_NPHY_RXPIL_CYCNT1                  B43_PHY_N(0x206) /* RX pilot cycle counter 1 */
+#define B43_NPHY_RXPIL_CYCNT2                  B43_PHY_N(0x207) /* RX pilot cycle counter 2 */
+#define B43_NPHY_AFESEQ_RX2TX_PUD_10M          B43_PHY_N(0x208) /* AFE seq rx2tx power up/down delay 10M */
+#define B43_NPHY_AFESEQ_TX2RX_PUD_10M          B43_PHY_N(0x209) /* AFE seq tx2rx power up/down delay 10M */
+#define B43_NPHY_DSSSCCK_CRSEXTL               B43_PHY_N(0x20A) /* DSSS/CCK CRS extension length */
+#define B43_NPHY_ML_LOGSS_RATSLOPE             B43_PHY_N(0x20B) /* ML/logss ratio slope */
+#define B43_NPHY_RIFS_SRCTL                    B43_PHY_N(0x20C) /* RIFS search timeout length */
+#define B43_NPHY_TXREALFD                      B43_PHY_N(0x20D) /* TX real frame delay */
+#define B43_NPHY_HPANT_SWTHRES                 B43_PHY_N(0x20E) /* High power antenna switch threshold */
+#define B43_NPHY_EDCRS_ASSTHRES0               B43_PHY_N(0x210) /* ED CRS assert threshold 0 */
+#define B43_NPHY_EDCRS_ASSTHRES1               B43_PHY_N(0x211) /* ED CRS assert threshold 1 */
+#define B43_NPHY_EDCRS_DEASSTHRES0             B43_PHY_N(0x212) /* ED CRS deassert threshold 0 */
+#define B43_NPHY_EDCRS_DEASSTHRES1             B43_PHY_N(0x213) /* ED CRS deassert threshold 1 */
+#define B43_NPHY_STR_WTIME20U                  B43_PHY_N(0x214) /* STR wait time 20U */
+#define B43_NPHY_STR_WTIME20L                  B43_PHY_N(0x215) /* STR wait time 20L */
+#define B43_NPHY_TONE_MIDX657M                 B43_PHY_N(0x216) /* Tone map index 657M */
+#define B43_NPHY_HTSIGTONES                    B43_PHY_N(0x217) /* HT signal tones */
+#define B43_NPHY_RSSI1                         B43_PHY_N(0x219) /* RSSI value 1 */
+#define B43_NPHY_RSSI2                         B43_PHY_N(0x21A) /* RSSI value 2 */
+#define B43_NPHY_CHAN_ESTHANG                  B43_PHY_N(0x21D) /* Channel estimate hang */
+#define B43_NPHY_FINERX2_CGC                   B43_PHY_N(0x221) /* Fine RX 2 clock gate control */
+#define  B43_NPHY_FINERX2_CGC_DECGC            0x0008 /* Decode gated clocks */
+#define B43_NPHY_TXPCTL_INIT                   B43_PHY_N(0x222) /* TX power controll init */
+#define  B43_NPHY_TXPCTL_INIT_PIDXI1           0x00FF /* Power index init 1 */
+#define  B43_NPHY_TXPCTL_INIT_PIDXI1_SHIFT     0
+
+
+
+/* Broadcom 2055 radio registers */
+
+#define B2055_GEN_SPARE                        0x00 /* GEN spare */
+#define B2055_SP_PINPD                 0x02 /* SP PIN PD */
+#define B2055_C1_SP_RSSI               0x03 /* SP RSSI Core 1 */
+#define B2055_C1_SP_PDMISC             0x04 /* SP PD MISC Core 1 */
+#define B2055_C2_SP_RSSI               0x05 /* SP RSSI Core 2 */
+#define B2055_C2_SP_PDMISC             0x06 /* SP PD MISC Core 2 */
+#define B2055_C1_SP_RXGC1              0x07 /* SP RX GC1 Core 1 */
+#define B2055_C1_SP_RXGC2              0x08 /* SP RX GC2 Core 1 */
+#define B2055_C2_SP_RXGC1              0x09 /* SP RX GC1 Core 2 */
+#define B2055_C2_SP_RXGC2              0x0A /* SP RX GC2 Core 2 */
+#define B2055_C1_SP_LPFBWSEL           0x0B /* SP LPF BW select Core 1 */
+#define B2055_C2_SP_LPFBWSEL           0x0C /* SP LPF BW select Core 2 */
+#define B2055_C1_SP_TXGC1              0x0D /* SP TX GC1 Core 1 */
+#define B2055_C1_SP_TXGC2              0x0E /* SP TX GC2 Core 1 */
+#define B2055_C2_SP_TXGC1              0x0F /* SP TX GC1 Core 2 */
+#define B2055_C2_SP_TXGC2              0x10 /* SP TX GC2 Core 2 */
+#define B2055_MASTER1                  0x11 /* Master control 1 */
+#define B2055_MASTER2                  0x12 /* Master control 2 */
+#define B2055_PD_LGEN                  0x13 /* PD LGEN */
+#define B2055_PD_PLLTS                 0x14 /* PD PLL TS */
+#define B2055_C1_PD_LGBUF              0x15 /* PD Core 1 LGBUF */
+#define B2055_C1_PD_TX                 0x16 /* PD Core 1 TX */
+#define B2055_C1_PD_RXTX               0x17 /* PD Core 1 RXTX */
+#define B2055_C1_PD_RSSIMISC           0x18 /* PD Core 1 RSSI MISC */
+#define B2055_C2_PD_LGBUF              0x19 /* PD Core 2 LGBUF */
+#define B2055_C2_PD_TX                 0x1A /* PD Core 2 TX */
+#define B2055_C2_PD_RXTX               0x1B /* PD Core 2 RXTX */
+#define B2055_C2_PD_RSSIMISC           0x1C /* PD Core 2 RSSI MISC */
+#define B2055_PWRDET_LGEN              0x1D /* PWRDET LGEN */
+#define B2055_C1_PWRDET_LGBUF          0x1E /* PWRDET LGBUF Core 1 */
+#define B2055_C1_PWRDET_RXTX           0x1F /* PWRDET RXTX Core 1 */
+#define B2055_C2_PWRDET_LGBUF          0x20 /* PWRDET LGBUF Core 2 */
+#define B2055_C2_PWRDET_RXTX           0x21 /* PWRDET RXTX Core 2 */
+#define B2055_RRCCAL_CS                        0x22 /* RRCCAL Control spare */
+#define B2055_RRCCAL_NOPTSEL           0x23 /* RRCCAL N OPT SEL */
+#define B2055_CAL_MISC                 0x24 /* CAL MISC */
+#define B2055_CAL_COUT                 0x25 /* CAL Counter out */
+#define B2055_CAL_COUT2                        0x26 /* CAL Counter out 2 */
+#define B2055_CAL_CVARCTL              0x27 /* CAL CVAR Control */
+#define B2055_CAL_RVARCTL              0x28 /* CAL RVAR Control */
+#define B2055_CAL_LPOCTL               0x29 /* CAL LPO Control */
+#define B2055_CAL_TS                   0x2A /* CAL TS */
+#define B2055_CAL_RCCALRTS             0x2B /* CAL RCCAL READ TS */
+#define B2055_CAL_RCALRTS              0x2C /* CAL RCAL READ TS */
+#define B2055_PADDRV                   0x2D /* PAD driver */
+#define B2055_XOCTL1                   0x2E /* XO Control 1 */
+#define B2055_XOCTL2                   0x2F /* XO Control 2 */
+#define B2055_XOREGUL                  0x30 /* XO Regulator */
+#define B2055_XOMISC                   0x31 /* XO misc */
+#define B2055_PLL_LFC1                 0x32 /* PLL LF C1 */
+#define B2055_PLL_CALVTH               0x33 /* PLL CAL VTH */
+#define B2055_PLL_LFC2                 0x34 /* PLL LF C2 */
+#define B2055_PLL_REF                  0x35 /* PLL reference */
+#define B2055_PLL_LFR1                 0x36 /* PLL LF R1 */
+#define B2055_PLL_PFDCP                        0x37 /* PLL PFD CP */
+#define B2055_PLL_IDAC_CPOPAMP         0x38 /* PLL IDAC CPOPAMP */
+#define B2055_PLL_CPREG                        0x39 /* PLL CP Regulator */
+#define B2055_PLL_RCAL                 0x3A /* PLL RCAL */
+#define B2055_RF_PLLMOD0               0x3B /* RF PLL MOD0 */
+#define B2055_RF_PLLMOD1               0x3C /* RF PLL MOD1 */
+#define B2055_RF_MMDIDAC1              0x3D /* RF MMD IDAC 1 */
+#define B2055_RF_MMDIDAC0              0x3E /* RF MMD IDAC 0 */
+#define B2055_RF_MMDSP                 0x3F /* RF MMD spare */
+#define B2055_VCO_CAL1                 0x40 /* VCO cal 1 */
+#define B2055_VCO_CAL2                 0x41 /* VCO cal 2 */
+#define B2055_VCO_CAL3                 0x42 /* VCO cal 3 */
+#define B2055_VCO_CAL4                 0x43 /* VCO cal 4 */
+#define B2055_VCO_CAL5                 0x44 /* VCO cal 5 */
+#define B2055_VCO_CAL6                 0x45 /* VCO cal 6 */
+#define B2055_VCO_CAL7                 0x46 /* VCO cal 7 */
+#define B2055_VCO_CAL8                 0x47 /* VCO cal 8 */
+#define B2055_VCO_CAL9                 0x48 /* VCO cal 9 */
+#define B2055_VCO_CAL10                        0x49 /* VCO cal 10 */
+#define B2055_VCO_CAL11                        0x4A /* VCO cal 11 */
+#define B2055_VCO_CAL12                        0x4B /* VCO cal 12 */
+#define B2055_VCO_CAL13                        0x4C /* VCO cal 13 */
+#define B2055_VCO_CAL14                        0x4D /* VCO cal 14 */
+#define B2055_VCO_CAL15                        0x4E /* VCO cal 15 */
+#define B2055_VCO_CAL16                        0x4F /* VCO cal 16 */
+#define B2055_VCO_KVCO                 0x50 /* VCO KVCO */
+#define B2055_VCO_CAPTAIL              0x51 /* VCO CAP TAIL */
+#define B2055_VCO_IDACVCO              0x52 /* VCO IDAC VCO */
+#define B2055_VCO_REG                  0x53 /* VCO Regulator */
+#define B2055_PLL_RFVTH                        0x54 /* PLL RF VTH */
+#define B2055_LGBUF_CENBUF             0x55 /* LGBUF CEN BUF */
+#define B2055_LGEN_TUNE1               0x56 /* LGEN tune 1 */
+#define B2055_LGEN_TUNE2               0x57 /* LGEN tune 2 */
+#define B2055_LGEN_IDAC1               0x58 /* LGEN IDAC 1 */
+#define B2055_LGEN_IDAC2               0x59 /* LGEN IDAC 2 */
+#define B2055_LGEN_BIASC               0x5A /* LGEN BIAS counter */
+#define B2055_LGEN_BIASIDAC            0x5B /* LGEN BIAS IDAC */
+#define B2055_LGEN_RCAL                        0x5C /* LGEN RCAL */
+#define B2055_LGEN_DIV                 0x5D /* LGEN div */
+#define B2055_LGEN_SPARE2              0x5E /* LGEN spare 2 */
+#define B2055_C1_LGBUF_ATUNE           0x5F /* Core 1 LGBUF A tune */
+#define B2055_C1_LGBUF_GTUNE           0x60 /* Core 1 LGBUF G tune */
+#define B2055_C1_LGBUF_DIV             0x61 /* Core 1 LGBUF div */
+#define B2055_C1_LGBUF_AIDAC           0x62 /* Core 1 LGBUF A IDAC */
+#define B2055_C1_LGBUF_GIDAC           0x63 /* Core 1 LGBUF G IDAC */
+#define B2055_C1_LGBUF_IDACFO          0x64 /* Core 1 LGBUF IDAC filter override */
+#define B2055_C1_LGBUF_SPARE           0x65 /* Core 1 LGBUF spare */
+#define B2055_C1_RX_RFSPC1             0x66 /* Core 1 RX RF SPC1 */
+#define B2055_C1_RX_RFR1               0x67 /* Core 1 RX RF reg 1 */
+#define B2055_C1_RX_RFR2               0x68 /* Core 1 RX RF reg 2 */
+#define B2055_C1_RX_RFRCAL             0x69 /* Core 1 RX RF RCAL */
+#define B2055_C1_RX_BB_BLCMP           0x6A /* Core 1 RX Baseband BUFI LPF CMP */
+#define B2055_C1_RX_BB_LPF             0x6B /* Core 1 RX Baseband LPF */
+#define B2055_C1_RX_BB_MIDACHP         0x6C /* Core 1 RX Baseband MIDAC High-pass */
+#define B2055_C1_RX_BB_VGA1IDAC                0x6D /* Core 1 RX Baseband VGA1 IDAC */
+#define B2055_C1_RX_BB_VGA2IDAC                0x6E /* Core 1 RX Baseband VGA2 IDAC */
+#define B2055_C1_RX_BB_VGA3IDAC                0x6F /* Core 1 RX Baseband VGA3 IDAC */
+#define B2055_C1_RX_BB_BUFOCTL         0x70 /* Core 1 RX Baseband BUFO Control */
+#define B2055_C1_RX_BB_RCCALCTL                0x71 /* Core 1 RX Baseband RCCAL Control */
+#define B2055_C1_RX_BB_RSSICTL1                0x72 /* Core 1 RX Baseband RSSI Control 1 */
+#define B2055_C1_RX_BB_RSSICTL2                0x73 /* Core 1 RX Baseband RSSI Control 2 */
+#define B2055_C1_RX_BB_RSSICTL3                0x74 /* Core 1 RX Baseband RSSI Control 3 */
+#define B2055_C1_RX_BB_RSSICTL4                0x75 /* Core 1 RX Baseband RSSI Control 4 */
+#define B2055_C1_RX_BB_RSSICTL5                0x76 /* Core 1 RX Baseband RSSI Control 5 */
+#define B2055_C1_RX_BB_REG             0x77 /* Core 1 RX Baseband Regulator */
+#define B2055_C1_RX_BB_SPARE1          0x78 /* Core 1 RX Baseband spare 1 */
+#define B2055_C1_RX_TXBBRCAL           0x79 /* Core 1 RX TX BB RCAL */
+#define B2055_C1_TX_RF_SPGA            0x7A /* Core 1 TX RF SGM PGA */
+#define B2055_C1_TX_RF_SPAD            0x7B /* Core 1 TX RF SGM PAD */
+#define B2055_C1_TX_RF_CNTPGA1         0x7C /* Core 1 TX RF counter PGA 1 */
+#define B2055_C1_TX_RF_CNTPAD1         0x7D /* Core 1 TX RF counter PAD 1 */
+#define B2055_C1_TX_RF_PGAIDAC         0x7E /* Core 1 TX RF PGA IDAC */
+#define B2055_C1_TX_PGAPADTN           0x7F /* Core 1 TX PGA PAD TN */
+#define B2055_C1_TX_PADIDAC1           0x80 /* Core 1 TX PAD IDAC 1 */
+#define B2055_C1_TX_PADIDAC2           0x81 /* Core 1 TX PAD IDAC 2 */
+#define B2055_C1_TX_MXBGTRIM           0x82 /* Core 1 TX MX B/G TRIM */
+#define B2055_C1_TX_RF_RCAL            0x83 /* Core 1 TX RF RCAL */
+#define B2055_C1_TX_RF_PADTSSI1                0x84 /* Core 1 TX RF PAD TSSI1 */
+#define B2055_C1_TX_RF_PADTSSI2                0x85 /* Core 1 TX RF PAD TSSI2 */
+#define B2055_C1_TX_RF_SPARE           0x86 /* Core 1 TX RF spare */
+#define B2055_C1_TX_RF_IQCAL1          0x87 /* Core 1 TX RF I/Q CAL 1 */
+#define B2055_C1_TX_RF_IQCAL2          0x88 /* Core 1 TX RF I/Q CAL 2 */
+#define B2055_C1_TXBB_RCCAL            0x89 /* Core 1 TXBB RC CAL Control */
+#define B2055_C1_TXBB_LPF1             0x8A /* Core 1 TXBB LPF 1 */
+#define B2055_C1_TX_VOSCNCL            0x8B /* Core 1 TX VOS CNCL */
+#define B2055_C1_TX_LPF_MXGMIDAC       0x8C /* Core 1 TX LPF MXGM IDAC */
+#define B2055_C1_TX_BB_MXGM            0x8D /* Core 1 TX BB MXGM */
+#define B2055_C2_LGBUF_ATUNE           0x8E /* Core 2 LGBUF A tune */
+#define B2055_C2_LGBUF_GTUNE           0x8F /* Core 2 LGBUF G tune */
+#define B2055_C2_LGBUF_DIV             0x90 /* Core 2 LGBUF div */
+#define B2055_C2_LGBUF_AIDAC           0x91 /* Core 2 LGBUF A IDAC */
+#define B2055_C2_LGBUF_GIDAC           0x92 /* Core 2 LGBUF G IDAC */
+#define B2055_C2_LGBUF_IDACFO          0x93 /* Core 2 LGBUF IDAC filter override */
+#define B2055_C2_LGBUF_SPARE           0x94 /* Core 2 LGBUF spare */
+#define B2055_C2_RX_RFSPC1             0x95 /* Core 2 RX RF SPC1 */
+#define B2055_C2_RX_RFR1               0x96 /* Core 2 RX RF reg 1 */
+#define B2055_C2_RX_RFR2               0x97 /* Core 2 RX RF reg 2 */
+#define B2055_C2_RX_RFRCAL             0x98 /* Core 2 RX RF RCAL */
+#define B2055_C2_RX_BB_BLCMP           0x99 /* Core 2 RX Baseband BUFI LPF CMP */
+#define B2055_C2_RX_BB_LPF             0x9A /* Core 2 RX Baseband LPF */
+#define B2055_C2_RX_BB_MIDACHP         0x9B /* Core 2 RX Baseband MIDAC High-pass */
+#define B2055_C2_RX_BB_VGA1IDAC                0x9C /* Core 2 RX Baseband VGA1 IDAC */
+#define B2055_C2_RX_BB_VGA2IDAC                0x9D /* Core 2 RX Baseband VGA2 IDAC */
+#define B2055_C2_RX_BB_VGA3IDAC                0x9E /* Core 2 RX Baseband VGA3 IDAC */
+#define B2055_C2_RX_BB_BUFOCTL         0x9F /* Core 2 RX Baseband BUFO Control */
+#define B2055_C2_RX_BB_RCCALCTL                0xA0 /* Core 2 RX Baseband RCCAL Control */
+#define B2055_C2_RX_BB_RSSICTL1                0xA1 /* Core 2 RX Baseband RSSI Control 1 */
+#define B2055_C2_RX_BB_RSSICTL2                0xA2 /* Core 2 RX Baseband RSSI Control 2 */
+#define B2055_C2_RX_BB_RSSICTL3                0xA3 /* Core 2 RX Baseband RSSI Control 3 */
+#define B2055_C2_RX_BB_RSSICTL4                0xA4 /* Core 2 RX Baseband RSSI Control 4 */
+#define B2055_C2_RX_BB_RSSICTL5                0xA5 /* Core 2 RX Baseband RSSI Control 5 */
+#define B2055_C2_RX_BB_REG             0xA6 /* Core 2 RX Baseband Regulator */
+#define B2055_C2_RX_BB_SPARE1          0xA7 /* Core 2 RX Baseband spare 1 */
+#define B2055_C2_RX_TXBBRCAL           0xA8 /* Core 2 RX TX BB RCAL */
+#define B2055_C2_TX_RF_SPGA            0xA9 /* Core 2 TX RF SGM PGA */
+#define B2055_C2_TX_RF_SPAD            0xAA /* Core 2 TX RF SGM PAD */
+#define B2055_C2_TX_RF_CNTPGA1         0xAB /* Core 2 TX RF counter PGA 1 */
+#define B2055_C2_TX_RF_CNTPAD1         0xAC /* Core 2 TX RF counter PAD 1 */
+#define B2055_C2_TX_RF_PGAIDAC         0xAD /* Core 2 TX RF PGA IDAC */
+#define B2055_C2_TX_PGAPADTN           0xAE /* Core 2 TX PGA PAD TN */
+#define B2055_C2_TX_PADIDAC1           0xAF /* Core 2 TX PAD IDAC 1 */
+#define B2055_C2_TX_PADIDAC2           0xB0 /* Core 2 TX PAD IDAC 2 */
+#define B2055_C2_TX_MXBGTRIM           0xB1 /* Core 2 TX MX B/G TRIM */
+#define B2055_C2_TX_RF_RCAL            0xB2 /* Core 2 TX RF RCAL */
+#define B2055_C2_TX_RF_PADTSSI1                0xB3 /* Core 2 TX RF PAD TSSI1 */
+#define B2055_C2_TX_RF_PADTSSI2                0xB4 /* Core 2 TX RF PAD TSSI2 */
+#define B2055_C2_TX_RF_SPARE           0xB5 /* Core 2 TX RF spare */
+#define B2055_C2_TX_RF_IQCAL1          0xB6 /* Core 2 TX RF I/Q CAL 1 */
+#define B2055_C2_TX_RF_IQCAL2          0xB7 /* Core 2 TX RF I/Q CAL 2 */
+#define B2055_C2_TXBB_RCCAL            0xB8 /* Core 2 TXBB RC CAL Control */
+#define B2055_C2_TXBB_LPF1             0xB9 /* Core 2 TXBB LPF 1 */
+#define B2055_C2_TX_VOSCNCL            0xBA /* Core 2 TX VOS CNCL */
+#define B2055_C2_TX_LPF_MXGMIDAC       0xBB /* Core 2 TX LPF MXGM IDAC */
+#define B2055_C2_TX_BB_MXGM            0xBC /* Core 2 TX BB MXGM */
+#define B2055_PRG_GCHP21               0xBD /* PRG GC HPVGA23 21 */
+#define B2055_PRG_GCHP22               0xBE /* PRG GC HPVGA23 22 */
+#define B2055_PRG_GCHP23               0xBF /* PRG GC HPVGA23 23 */
+#define B2055_PRG_GCHP24               0xC0 /* PRG GC HPVGA23 24 */
+#define B2055_PRG_GCHP25               0xC1 /* PRG GC HPVGA23 25 */
+#define B2055_PRG_GCHP26               0xC2 /* PRG GC HPVGA23 26 */
+#define B2055_PRG_GCHP27               0xC3 /* PRG GC HPVGA23 27 */
+#define B2055_PRG_GCHP28               0xC4 /* PRG GC HPVGA23 28 */
+#define B2055_PRG_GCHP29               0xC5 /* PRG GC HPVGA23 29 */
+#define B2055_PRG_GCHP30               0xC6 /* PRG GC HPVGA23 30 */
+#define B2055_C1_LNA_GAINBST           0xCD /* Core 1 LNA GAINBST */
+#define B2055_C1_B0NB_RSSIVCM          0xD2 /* Core 1 B0 narrow-band RSSI VCM */
+#define B2055_C1_GENSPARE2             0xD6 /* Core 1 GEN spare 2 */
+#define B2055_C2_LNA_GAINBST           0xD9 /* Core 2 LNA GAINBST */
+#define B2055_C2_B0NB_RSSIVCM          0xDE /* Core 2 B0 narrow-band RSSI VCM */
+#define B2055_C2_GENSPARE2             0xE2 /* Core 2 GEN spare 2 */
+
+
+
+struct b43_wldev;
+
+int b43_phy_initn(struct b43_wldev *dev);
+
+void b43_nphy_radio_turn_on(struct b43_wldev *dev);
+void b43_nphy_radio_turn_off(struct b43_wldev *dev);
+
+int b43_nphy_selectchannel(struct b43_wldev *dev, u8 channel);
+
+void b43_nphy_xmitpower(struct b43_wldev *dev);
+void b43_nphy_set_rxantenna(struct b43_wldev *dev, int antenna);
+
+#endif /* B43_NPHY_H_ */
index b242a9a..b79a6bd 100644 (file)
@@ -65,12 +65,12 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
        tuple_t tuple;
        cisparse_t parse;
        int err = -ENOMEM;
-       int res;
+       int res = 0;
        unsigned char buf[64];
 
        ssb = kzalloc(sizeof(*ssb), GFP_KERNEL);
        if (!ssb)
-               goto out;
+               goto out_error;
 
        err = -ENODEV;
        tuple.DesiredTuple = CISTPL_CONFIG;
@@ -96,10 +96,12 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
        dev->io.NumPorts2 = 0;
        dev->io.Attributes2 = 0;
 
-       win.Attributes = WIN_MEMORY_TYPE_CM | WIN_ENABLE | WIN_USE_WAIT;
+       win.Attributes = WIN_ADDR_SPACE_MEM | WIN_MEMORY_TYPE_CM |
+                        WIN_ENABLE | WIN_DATA_WIDTH_16 |
+                        WIN_USE_WAIT;
        win.Base = 0;
        win.Size = SSB_CORE_SIZE;
-       win.AccessSpeed = 1000;
+       win.AccessSpeed = 250;
        res = pcmcia_request_window(&dev, &win, &dev->win);
        if (res != CS_SUCCESS)
                goto err_kfree_ssb;
@@ -108,21 +110,34 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
        mem.Page = 0;
        res = pcmcia_map_mem_page(dev->win, &mem);
        if (res != CS_SUCCESS)
-               goto err_kfree_ssb;
+               goto err_disable;
+
+       dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_FIRST_SHARED;
+       dev->irq.IRQInfo1 = IRQ_LEVEL_ID | IRQ_SHARE_ID;
+       dev->irq.Handler = NULL; /* The handler is registered later. */
+       dev->irq.Instance = NULL;
+       res = pcmcia_request_irq(dev, &dev->irq);
+       if (res != CS_SUCCESS)
+               goto err_disable;
 
        res = pcmcia_request_configuration(dev, &dev->conf);
        if (res != CS_SUCCESS)
                goto err_disable;
 
        err = ssb_bus_pcmciabus_register(ssb, dev, win.Base);
+       if (err)
+               goto err_disable;
        dev->priv = ssb;
 
-      out:
-       return err;
-      err_disable:
+       return 0;
+
+err_disable:
        pcmcia_disable_device(dev);
-      err_kfree_ssb:
+err_kfree_ssb:
        kfree(ssb);
+out_error:
+       printk(KERN_ERR "b43-pcmcia: Initialization failed (%d, %d)\n",
+              res, err);
        return err;
 }
 
@@ -131,22 +146,21 @@ static void __devexit b43_pcmcia_remove(struct pcmcia_device *dev)
        struct ssb_bus *ssb = dev->priv;
 
        ssb_bus_unregister(ssb);
-       pcmcia_release_window(dev->win);
        pcmcia_disable_device(dev);
        kfree(ssb);
        dev->priv = NULL;
 }
 
 static struct pcmcia_driver b43_pcmcia_driver = {
-       .owner = THIS_MODULE,
-       .drv = {
-               .name = "b43-pcmcia",
-               },
-       .id_table = b43_pcmcia_tbl,
-       .probe = b43_pcmcia_probe,
-       .remove = b43_pcmcia_remove,
-       .suspend = b43_pcmcia_suspend,
-       .resume = b43_pcmcia_resume,
+       .owner          = THIS_MODULE,
+       .drv            = {
+                               .name = "b43-pcmcia",
+                       },
+       .id_table       = b43_pcmcia_tbl,
+       .probe          = b43_pcmcia_probe,
+       .remove         = __devexit_p(b43_pcmcia_remove),
+       .suspend        = b43_pcmcia_suspend,
+       .resume         = b43_pcmcia_resume,
 };
 
 int b43_pcmcia_init(void)
index 3d4ed64..71507b2 100644 (file)
@@ -3,7 +3,7 @@
   Broadcom B43 wireless driver
 
   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>,
-  Copyright (c) 2005, 2006 Stefano Brivio <st3@riseup.net>
+  Copyright (c) 2005-2007 Stefano Brivio <stefano.brivio@polimi.it>
   Copyright (c) 2005, 2006 Michael Buesch <mb@bu3sch.de>
   Copyright (c) 2005, 2006 Danny van Dyk <kugelfang@gentoo.org>
   Copyright (c) 2005, 2006 Andreas Jaggi <andreas.jaggi@waterwave.ch>
 
 #include "b43.h"
 #include "phy.h"
+#include "nphy.h"
 #include "main.h"
 #include "tables.h"
 #include "lo.h"
+#include "wa.h"
+
 
 static const s8 b43_tssi2dbm_b_table[] = {
        0x4D, 0x4C, 0x4B, 0x4A,
@@ -225,42 +228,30 @@ static void b43_shm_clear_tssi(struct b43_wldev *dev)
        }
 }
 
-void b43_raw_phy_lock(struct b43_wldev *dev)
+/* Lock the PHY registers against concurrent access from the microcode.
+ * This lock is nonrecursive. */
+void b43_phy_lock(struct b43_wldev *dev)
 {
-       struct b43_phy *phy = &dev->phy;
-
-       B43_WARN_ON(!irqs_disabled());
-
-       /* We had a check for MACCTL==0 here, but I think that doesn't
-        * make sense, as MACCTL is never 0 when this is called.
-        *      --mb */
-       B43_WARN_ON(b43_read32(dev, B43_MMIO_MACCTL) == 0);
+#if B43_DEBUG
+       B43_WARN_ON(dev->phy.phy_locked);
+       dev->phy.phy_locked = 1;
+#endif
+       B43_WARN_ON(dev->dev->id.revision < 3);
 
-       if (dev->dev->id.revision < 3) {
-               b43_mac_suspend(dev);
-               spin_lock(&phy->lock);
-       } else {
-               if (!b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP))
-                       b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
-       }
-       phy->locked = 1;
+       if (!b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP))
+               b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
 }
 
-void b43_raw_phy_unlock(struct b43_wldev *dev)
+void b43_phy_unlock(struct b43_wldev *dev)
 {
-       struct b43_phy *phy = &dev->phy;
+#if B43_DEBUG
+       B43_WARN_ON(!dev->phy.phy_locked);
+       dev->phy.phy_locked = 0;
+#endif
+       B43_WARN_ON(dev->dev->id.revision < 3);
 
-       B43_WARN_ON(!irqs_disabled());
-       if (dev->dev->id.revision < 3) {
-               if (phy->locked) {
-                       spin_unlock(&phy->lock);
-                       b43_mac_enable(dev);
-               }
-       } else {
-               if (!b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP))
-                       b43_power_saving_ctl_bits(dev, 0);
-       }
-       phy->locked = 0;
+       if (!b43_is_mode(dev->wl, IEEE80211_IF_TYPE_AP))
+               b43_power_saving_ctl_bits(dev, 0);
 }
 
 /* Different PHYs require different register routing flags.
@@ -271,15 +262,30 @@ static inline u16 adjust_phyreg_for_phytype(struct b43_phy *phy,
 {
        if (phy->type == B43_PHYTYPE_A) {
                /* OFDM registers are base-registers for the A-PHY. */
-               offset &= ~B43_PHYROUTE_OFDM_GPHY;
+               if ((offset & B43_PHYROUTE) == B43_PHYROUTE_OFDM_GPHY) {
+                       offset &= ~B43_PHYROUTE;
+                       offset |= B43_PHYROUTE_BASE;
+               }
        }
-       if (offset & B43_PHYROUTE_EXT_GPHY) {
+
+#if B43_DEBUG
+       if ((offset & B43_PHYROUTE) == B43_PHYROUTE_EXT_GPHY) {
                /* Ext-G registers are only available on G-PHYs */
                if (phy->type != B43_PHYTYPE_G) {
-                       b43dbg(dev->wl, "EXT-G PHY access at "
-                              "0x%04X on %u type PHY\n", offset, phy->type);
+                       b43err(dev->wl, "Invalid EXT-G PHY access at "
+                              "0x%04X on PHY type %u\n", offset, phy->type);
+                       dump_stack();
                }
        }
+       if ((offset & B43_PHYROUTE) == B43_PHYROUTE_N_BMODE) {
+               /* N-BMODE registers are only available on N-PHYs */
+               if (phy->type != B43_PHYTYPE_N) {
+                       b43err(dev->wl, "Invalid N-BMODE PHY access at "
+                              "0x%04X on PHY type %u\n", offset, phy->type);
+                       dump_stack();
+               }
+       }
+#endif /* B43_DEBUG */
 
        return offset;
 }
@@ -299,11 +305,26 @@ void b43_phy_write(struct b43_wldev *dev, u16 offset, u16 val)
 
        offset = adjust_phyreg_for_phytype(phy, offset, dev);
        b43_write16(dev, B43_MMIO_PHY_CONTROL, offset);
-       mmiowb();
        b43_write16(dev, B43_MMIO_PHY_DATA, val);
 }
 
-static void b43_radio_set_txpower_a(struct b43_wldev *dev, u16 txpower);
+void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
+{
+       b43_phy_write(dev, offset,
+                     b43_phy_read(dev, offset) & mask);
+}
+
+void b43_phy_set(struct b43_wldev *dev, u16 offset, u16 set)
+{
+       b43_phy_write(dev, offset,
+                     b43_phy_read(dev, offset) | set);
+}
+
+void b43_phy_maskset(struct b43_wldev *dev, u16 offset, u16 mask, u16 set)
+{
+       b43_phy_write(dev, offset,
+                     (b43_phy_read(dev, offset) & mask) | set);
+}
 
 /* Adjust the transmission power output (G-PHY) */
 void b43_set_txpower_g(struct b43_wldev *dev,
@@ -763,366 +784,96 @@ static void b43_phy_init_pctl(struct b43_wldev *dev)
        b43_shm_clear_tssi(dev);
 }
 
-static void b43_phy_agcsetup(struct b43_wldev *dev)
-{
-       struct b43_phy *phy = &dev->phy;
-       u16 offset = 0x0000;
-
-       if (phy->rev == 1)
-               offset = 0x4C00;
-
-       b43_ofdmtab_write16(dev, offset, 0, 0x00FE);
-       b43_ofdmtab_write16(dev, offset, 1, 0x000D);
-       b43_ofdmtab_write16(dev, offset, 2, 0x0013);
-       b43_ofdmtab_write16(dev, offset, 3, 0x0019);
-
-       if (phy->rev == 1) {
-               b43_ofdmtab_write16(dev, 0x1800, 0, 0x2710);
-               b43_ofdmtab_write16(dev, 0x1801, 0, 0x9B83);
-               b43_ofdmtab_write16(dev, 0x1802, 0, 0x9B83);
-               b43_ofdmtab_write16(dev, 0x1803, 0, 0x0F8D);
-               b43_phy_write(dev, 0x0455, 0x0004);
-       }
-
-       b43_phy_write(dev, 0x04A5, (b43_phy_read(dev, 0x04A5)
-                                   & 0x00FF) | 0x5700);
-       b43_phy_write(dev, 0x041A, (b43_phy_read(dev, 0x041A)
-                                   & 0xFF80) | 0x000F);
-       b43_phy_write(dev, 0x041A, (b43_phy_read(dev, 0x041A)
-                                   & 0xC07F) | 0x2B80);
-       b43_phy_write(dev, 0x048C, (b43_phy_read(dev, 0x048C)
-                                   & 0xF0FF) | 0x0300);
-
-       b43_radio_write16(dev, 0x007A, b43_radio_read16(dev, 0x007A)
-                         | 0x0008);
-
-       b43_phy_write(dev, 0x04A0, (b43_phy_read(dev, 0x04A0)
-                                   & 0xFFF0) | 0x0008);
-       b43_phy_write(dev, 0x04A1, (b43_phy_read(dev, 0x04A1)
-                                   & 0xF0FF) | 0x0600);
-       b43_phy_write(dev, 0x04A2, (b43_phy_read(dev, 0x04A2)
-                                   & 0xF0FF) | 0x0700);
-       b43_phy_write(dev, 0x04A0, (b43_phy_read(dev, 0x04A0)
-                                   & 0xF0FF) | 0x0100);
-
-       if (phy->rev == 1) {
-               b43_phy_write(dev, 0x04A2, (b43_phy_read(dev, 0x04A2)
-                                           & 0xFFF0) | 0x0007);
-       }
-
-       b43_phy_write(dev, 0x0488, (b43_phy_read(dev, 0x0488)
-                                   & 0xFF00) | 0x001C);
-       b43_phy_write(dev, 0x0488, (b43_phy_read(dev, 0x0488)
-                                   & 0xC0FF) | 0x0200);
-       b43_phy_write(dev, 0x0496, (b43_phy_read(dev, 0x0496)
-                                   & 0xFF00) | 0x001C);
-       b43_phy_write(dev, 0x0489, (b43_phy_read(dev, 0x0489)
-                                   & 0xFF00) | 0x0020);
-       b43_phy_write(dev, 0x0489, (b43_phy_read(dev, 0x0489)
-                                   & 0xC0FF) | 0x0200);
-       b43_phy_write(dev, 0x0482, (b43_phy_read(dev, 0x0482)
-                                   & 0xFF00) | 0x002E);
-       b43_phy_write(dev, 0x0496, (b43_phy_read(dev, 0x0496)
-                                   & 0x00FF) | 0x1A00);
-       b43_phy_write(dev, 0x0481, (b43_phy_read(dev, 0x0481)
-                                   & 0xFF00) | 0x0028);
-       b43_phy_write(dev, 0x0481, (b43_phy_read(dev, 0x0481)
-                                   & 0x00FF) | 0x2C00);
-
-       if (phy->rev == 1) {
-               b43_phy_write(dev, 0x0430, 0x092B);
-               b43_phy_write(dev, 0x041B, (b43_phy_read(dev, 0x041B)
-                                           & 0xFFE1) | 0x0002);
-       } else {
-               b43_phy_write(dev, 0x041B, b43_phy_read(dev, 0x041B)
-                             & 0xFFE1);
-               b43_phy_write(dev, 0x041F, 0x287A);
-               b43_phy_write(dev, 0x0420, (b43_phy_read(dev, 0x0420)
-                                           & 0xFFF0) | 0x0004);
-       }
-
-       if (phy->rev >= 6) {
-               b43_phy_write(dev, 0x0422, 0x287A);
-               b43_phy_write(dev, 0x0420, (b43_phy_read(dev, 0x0420)
-                                           & 0x0FFF) | 0x3000);
-       }
-
-       b43_phy_write(dev, 0x04A8, (b43_phy_read(dev, 0x04A8)
-                                   & 0x8080) | 0x7874);
-       b43_phy_write(dev, 0x048E, 0x1C00);
-
-       offset = 0x0800;
-       if (phy->rev == 1) {
-               offset = 0x5400;
-               b43_phy_write(dev, 0x04AB, (b43_phy_read(dev, 0x04AB)
-                                           & 0xF0FF) | 0x0600);
-               b43_phy_write(dev, 0x048B, 0x005E);
-               b43_phy_write(dev, 0x048C, (b43_phy_read(dev, 0x048C)
-                                           & 0xFF00) | 0x001E);
-               b43_phy_write(dev, 0x048D, 0x0002);
-       }
-       b43_ofdmtab_write16(dev, offset, 0, 0x00);
-       b43_ofdmtab_write16(dev, offset, 1, 0x07);
-       b43_ofdmtab_write16(dev, offset, 2, 0x10);
-       b43_ofdmtab_write16(dev, offset, 3, 0x1C);
-
-       if (phy->rev >= 6) {
-               b43_phy_write(dev, 0x0426, b43_phy_read(dev, 0x0426)
-                             & 0xFFFC);
-               b43_phy_write(dev, 0x0426, b43_phy_read(dev, 0x0426)
-                             & 0xEFFF);
-       }
-}
-
-static void b43_phy_setupg(struct b43_wldev *dev)
+static void b43_phy_rssiagc(struct b43_wldev *dev, u8 enable)
 {
-       struct ssb_bus *bus = dev->dev->bus;
-       struct b43_phy *phy = &dev->phy;
-       u16 i;
-
-       B43_WARN_ON(phy->type != B43_PHYTYPE_G);
-       if (phy->rev == 1) {
-               b43_phy_write(dev, 0x0406, 0x4F19);
-               b43_phy_write(dev, B43_PHY_G_CRS,
-                             (b43_phy_read(dev, B43_PHY_G_CRS) & 0xFC3F) |
-                             0x0340);
-               b43_phy_write(dev, 0x042C, 0x005A);
-               b43_phy_write(dev, 0x0427, 0x001A);
-
-               for (i = 0; i < B43_TAB_FINEFREQG_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x5800, i,
-                                           b43_tab_finefreqg[i]);
-               for (i = 0; i < B43_TAB_NOISEG1_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x1800, i, b43_tab_noiseg1[i]);
-               for (i = 0; i < B43_TAB_ROTOR_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x2000, i, b43_tab_rotor[i]);
-       } else {
-               /* nrssi values are signed 6-bit values. Not sure why we write 0x7654 here... */
-               b43_nrssi_hw_write(dev, 0xBA98, (s16) 0x7654);
-
-               if (phy->rev == 2) {
-                       b43_phy_write(dev, 0x04C0, 0x1861);
-                       b43_phy_write(dev, 0x04C1, 0x0271);
-               } else if (phy->rev > 2) {
-                       b43_phy_write(dev, 0x04C0, 0x0098);
-                       b43_phy_write(dev, 0x04C1, 0x0070);
-                       b43_phy_write(dev, 0x04C9, 0x0080);
-               }
-               b43_phy_write(dev, 0x042B, b43_phy_read(dev, 0x042B) | 0x800);
-
-               for (i = 0; i < 64; i++)
-                       b43_ofdmtab_write16(dev, 0x4000, i, i);
-               for (i = 0; i < B43_TAB_NOISEG2_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x1800, i, b43_tab_noiseg2[i]);
-       }
-
-       if (phy->rev <= 2)
-               for (i = 0; i < B43_TAB_NOISESCALEG_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x1400, i,
-                                           b43_tab_noisescaleg1[i]);
-       else if ((phy->rev >= 7) && (b43_phy_read(dev, 0x0449) & 0x0200))
-               for (i = 0; i < B43_TAB_NOISESCALEG_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x1400, i,
-                                           b43_tab_noisescaleg3[i]);
-       else
-               for (i = 0; i < B43_TAB_NOISESCALEG_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x1400, i,
-                                           b43_tab_noisescaleg2[i]);
-
-       if (phy->rev == 2)
-               for (i = 0; i < B43_TAB_SIGMASQR_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x5000, i,
-                                           b43_tab_sigmasqr1[i]);
-       else if ((phy->rev > 2) && (phy->rev <= 8))
-               for (i = 0; i < B43_TAB_SIGMASQR_SIZE; i++)
-                       b43_ofdmtab_write16(dev, 0x5000, i,
-                                           b43_tab_sigmasqr2[i]);
-
-       if (phy->rev == 1) {
-               for (i = 0; i < B43_TAB_RETARD_SIZE; i++)
-                       b43_ofdmtab_write32(dev, 0x2400, i, b43_tab_retard[i]);
-               for (i = 4; i < 20; i++)
-                       b43_ofdmtab_write16(dev, 0x5400, i, 0x0020);
-               b43_phy_agcsetup(dev);
-
-               if ((bus->boardinfo.vendor == SSB_BOARDVENDOR_BCM) &&
-                   (bus->boardinfo.type == SSB_BOARD_BU4306) &&
-                   (bus->boardinfo.rev == 0x17))
-                       return;
-
-               b43_ofdmtab_write16(dev, 0x5001, 0, 0x0002);
-               b43_ofdmtab_write16(dev, 0x5002, 0, 0x0001);
-       } else {
-               for (i = 0; i < 0x20; i++)
-                       b43_ofdmtab_write16(dev, 0x1000, i, 0x0820);
-               b43_phy_agcsetup(dev);
-               b43_phy_read(dev, 0x0400);      /* dummy read */
-               b43_phy_write(dev, 0x0403, 0x1000);
-               b43_ofdmtab_write16(dev, 0x3C02, 0, 0x000F);
-               b43_ofdmtab_write16(dev, 0x3C03, 0, 0x0014);
-
-               if ((bus->boardinfo.vendor == SSB_BOARDVENDOR_BCM) &&
-                   (bus->boardinfo.type == SSB_BOARD_BU4306) &&
-                   (bus->boardinfo.rev == 0x17))
-                       return;
-
-               b43_ofdmtab_write16(dev, 0x0401, 0, 0x0002);
-               b43_ofdmtab_write16(dev, 0x0402, 0, 0x0001);
-       }
-}
-
-/* Initialize the noisescaletable for APHY */
-static void b43_phy_init_noisescaletbl(struct b43_wldev *dev)
-{
-       struct b43_phy *phy = &dev->phy;
        int i;
 
-       for (i = 0; i < 12; i++) {
-               if (phy->rev == 2)
-                       b43_ofdmtab_write16(dev, 0x1400, i, 0x6767);
+       if (dev->phy.rev < 3) {
+               if (enable)
+                       for (i = 0; i < B43_TAB_RSSIAGC1_SIZE; i++) {
+                               b43_ofdmtab_write16(dev,
+                                       B43_OFDMTAB_LNAHPFGAIN1, i, 0xFFF8);
+                               b43_ofdmtab_write16(dev,
+                                       B43_OFDMTAB_WRSSI, i, 0xFFF8);
+                       }
                else
-                       b43_ofdmtab_write16(dev, 0x1400, i, 0x2323);
-       }
-       if (phy->rev == 2)
-               b43_ofdmtab_write16(dev, 0x1400, i, 0x6700);
-       else
-               b43_ofdmtab_write16(dev, 0x1400, i, 0x2300);
-       for (i = 0; i < 11; i++) {
-