WorkStruct: make allyesconfig
[safe/jmp/linux-2.6] / drivers / net / wireless / bcm43xx / bcm43xx_main.c
index 6da0beb..728a9b7 100644 (file)
@@ -38,6 +38,7 @@
 #include <linux/wireless.h>
 #include <linux/workqueue.h>
 #include <linux/skbuff.h>
+#include <linux/dma-mapping.h>
 #include <net/iw_handler.h>
 
 #include "bcm43xx.h"
@@ -51,6 +52,7 @@
 #include "bcm43xx_wx.h"
 #include "bcm43xx_ethtool.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_sysfs.h"
 
 
 MODULE_DESCRIPTION("Broadcom BCM43xx wireless driver");
@@ -126,13 +128,15 @@ MODULE_PARM_DESC(fwpostfix, "Postfix for .fw files. Useful for debugging.");
        static struct pci_device_id bcm43xx_pci_tbl[] = {
        /* Broadcom 4303 802.11b */
        { PCI_VENDOR_ID_BROADCOM, 0x4301, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-               /* Broadcom 4307 802.11b */
+       /* Broadcom 4307 802.11b */
        { PCI_VENDOR_ID_BROADCOM, 0x4307, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-               /* Broadcom 4318 802.11b/g */
+       /* Broadcom 4318 802.11b/g */
        { PCI_VENDOR_ID_BROADCOM, 0x4318, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+       /* Broadcom 4319 802.11a/b/g */
+       { PCI_VENDOR_ID_BROADCOM, 0x4319, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
        /* Broadcom 4306 802.11b/g */
        { PCI_VENDOR_ID_BROADCOM, 0x4320, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-               /* Broadcom 4306 802.11a */
+       /* Broadcom 4306 802.11a */
 //     { PCI_VENDOR_ID_BROADCOM, 0x4321, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
        /* Broadcom 4309 802.11a/b/g */
        { PCI_VENDOR_ID_BROADCOM, 0x4324, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
@@ -155,6 +159,7 @@ static void bcm43xx_ram_write(struct bcm43xx_private *bcm, u16 offset, u32 val)
                val = swab32(val);
 
        bcm43xx_write32(bcm, BCM43xx_MMIO_RAM_CONTROL, offset);
+       mmiowb();
        bcm43xx_write32(bcm, BCM43xx_MMIO_RAM_DATA, val);
 }
 
@@ -225,9 +230,12 @@ void bcm43xx_shm_write32(struct bcm43xx_private *bcm,
                if (offset & 0x0003) {
                        /* Unaligned access */
                        bcm43xx_shm_control_word(bcm, routing, offset >> 2);
+                       mmiowb();
                        bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED,
                                        (value >> 16) & 0xffff);
+                       mmiowb();
                        bcm43xx_shm_control_word(bcm, routing, (offset >> 2) + 1);
+                       mmiowb();
                        bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA,
                                        value & 0xffff);
                        return;
@@ -235,6 +243,7 @@ void bcm43xx_shm_write32(struct bcm43xx_private *bcm,
                offset >>= 2;
        }
        bcm43xx_shm_control_word(bcm, routing, offset);
+       mmiowb();
        bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA, value);
 }
 
@@ -246,6 +255,7 @@ void bcm43xx_shm_write16(struct bcm43xx_private *bcm,
                if (offset & 0x0003) {
                        /* Unaligned access */
                        bcm43xx_shm_control_word(bcm, routing, offset >> 2);
+                       mmiowb();
                        bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA_UNALIGNED,
                                        value);
                        return;
@@ -253,6 +263,7 @@ void bcm43xx_shm_write16(struct bcm43xx_private *bcm,
                offset >>= 2;
        }
        bcm43xx_shm_control_word(bcm, routing, offset);
+       mmiowb();
        bcm43xx_write16(bcm, BCM43xx_MMIO_SHM_DATA, value);
 }
 
@@ -311,6 +322,7 @@ void bcm43xx_tsf_write(struct bcm43xx_private *bcm, u64 tsf)
        status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
        status |= BCM43xx_SBF_TIME_UPDATE;
        bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
+       mmiowb();
 
        /* Be careful with the in-progress timer.
         * First zero out the low register, so we have a full
@@ -320,9 +332,10 @@ void bcm43xx_tsf_write(struct bcm43xx_private *bcm, u64 tsf)
                u32 lo = (tsf & 0x00000000FFFFFFFFULL);
                u32 hi = (tsf & 0xFFFFFFFF00000000ULL) >> 32;
 
-               barrier();
                bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW, 0);
+               mmiowb();
                bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_HIGH, hi);
+               mmiowb();
                bcm43xx_write32(bcm, BCM43xx_MMIO_REV3PLUS_TSF_LOW, lo);
        } else {
                u16 v0 = (tsf & 0x000000000000FFFFULL);
@@ -330,11 +343,14 @@ void bcm43xx_tsf_write(struct bcm43xx_private *bcm, u64 tsf)
                u16 v2 = (tsf & 0x0000FFFF00000000ULL) >> 32;
                u16 v3 = (tsf & 0xFFFF000000000000ULL) >> 48;
 
-               barrier();
                bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_0, 0);
+               mmiowb();
                bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_3, v3);
+               mmiowb();
                bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_2, v2);
+               mmiowb();
                bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_1, v1);
+               mmiowb();
                bcm43xx_write16(bcm, BCM43xx_MMIO_TSF_0, v0);
        }
 
@@ -391,10 +407,12 @@ static void bcm43xx_write_mac_bssid_templates(struct bcm43xx_private *bcm)
                bcm43xx_ram_write(bcm, 0x478 + i, *((u32 *)(mac_bssid + i)));
 }
 
+//FIXME: Well, we should probably call them from somewhere.
+#if 0
 static void bcm43xx_set_slot_time(struct bcm43xx_private *bcm, u16 slot_time)
 {
        /* slot_time is in usec. */
-       if (bcm->current_core->phy->type != BCM43xx_PHYTYPE_G)
+       if (bcm43xx_current_phy(bcm)->type != BCM43xx_PHYTYPE_G)
                return;
        bcm43xx_write16(bcm, 0x684, 510 + slot_time);
        bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0010, slot_time);
@@ -409,8 +427,12 @@ static void bcm43xx_short_slot_timing_disable(struct bcm43xx_private *bcm)
 {
        bcm43xx_set_slot_time(bcm, 20);
 }
+#endif
 
-//FIXME: rename this func?
+/* FIXME: To get the MAC-filter working, we need to implement the
+ *        following functions (and rename them :)
+ */
+#if 0
 static void bcm43xx_disassociate(struct bcm43xx_private *bcm)
 {
        bcm43xx_mac_suspend(bcm);
@@ -431,14 +453,13 @@ static void bcm43xx_disassociate(struct bcm43xx_private *bcm)
 
        bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0004, 0x000003ff);
 
-       if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_G &&
+       if (bcm43xx_current_phy(bcm)->type == BCM43xx_PHYTYPE_G &&
            ieee80211_is_ofdm_rate(bcm->softmac->txrates.default_rate))
                bcm43xx_short_slot_timing_enable(bcm);
 
        bcm43xx_mac_enable(bcm);
 }
 
-//FIXME: rename this func?
 static void bcm43xx_associate(struct bcm43xx_private *bcm,
                              const u8 *mac)
 {
@@ -449,6 +470,7 @@ static void bcm43xx_associate(struct bcm43xx_private *bcm,
        bcm43xx_write_mac_bssid_templates(bcm);
        bcm43xx_mac_enable(bcm);
 }
+#endif
 
 /* Enable a Generic IRQ. "mask" is the mask of which IRQs to enable.
  * Returns the _previously_ enabled IRQ mask.
@@ -476,35 +498,42 @@ static inline u32 bcm43xx_interrupt_disable(struct bcm43xx_private *bcm, u32 mas
        return old_mask;
 }
 
+/* Synchronize IRQ top- and bottom-half.
+ * IRQs must be masked before calling this.
+ * This must not be called with the irq_lock held.
+ */
+static void bcm43xx_synchronize_irq(struct bcm43xx_private *bcm)
+{
+       synchronize_irq(bcm->irq);
+       tasklet_disable(&bcm->isr_tasklet);
+}
+
 /* Make sure we don't receive more data from the device. */
-static int bcm43xx_disable_interrupts_sync(struct bcm43xx_private *bcm, u32 *oldstate)
+static int bcm43xx_disable_interrupts_sync(struct bcm43xx_private *bcm)
 {
-       u32 old;
        unsigned long flags;
 
-       spin_lock_irqsave(&bcm->lock, flags);
-       if (bcm43xx_is_initializing(bcm) || bcm->shutting_down) {
-               spin_unlock_irqrestore(&bcm->lock, flags);
+       spin_lock_irqsave(&bcm->irq_lock, flags);
+       if (unlikely(bcm43xx_status(bcm) != BCM43xx_STAT_INITIALIZED)) {
+               spin_unlock_irqrestore(&bcm->irq_lock, flags);
                return -EBUSY;
        }
-       old = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
-       tasklet_disable(&bcm->isr_tasklet);
-       spin_unlock_irqrestore(&bcm->lock, flags);
-       if (oldstate)
-               *oldstate = old;
+       bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+       bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK); /* flush */
+       spin_unlock_irqrestore(&bcm->irq_lock, flags);
+       bcm43xx_synchronize_irq(bcm);
 
        return 0;
 }
 
 static int bcm43xx_read_radioinfo(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_radioinfo *radio = bcm->current_core->radio;
-       struct bcm43xx_phyinfo *phy = bcm->current_core->phy;
+       struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
        u32 radio_id;
        u16 manufact;
        u16 version;
        u8 revision;
-       s8 i;
 
        if (bcm->chip_id == 0x4317) {
                if (bcm->chip_rev == 0x00)
@@ -547,21 +576,10 @@ static int bcm43xx_read_radioinfo(struct bcm43xx_private *bcm)
        radio->version = version;
        radio->revision = revision;
 
-       /* Set default attenuation values. */
-       radio->txpower[0] = 2;
-       radio->txpower[1] = 2;
-       if (revision == 1)
-               radio->txpower[2] = 3;
-       else
-               radio->txpower[2] = 0;
-       if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_A)
+       if (phy->type == BCM43xx_PHYTYPE_A)
                radio->txpower_desired = bcm->sprom.maxpower_aphy;
        else
-               bcm->current_core->radio->txpower_desired = bcm->sprom.maxpower_bgphy;
-
-       /* Initialize the in-memory nrssi Lookup Table. */
-       for (i = 0; i < 64; i++)
-               radio->nrssi_lt[i] = i;
+               radio->txpower_desired = bcm->sprom.maxpower_bgphy;
 
        return 0;
 
@@ -728,7 +746,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
        if (err)
                goto err_ctlreg;
        spromctl |= 0x10; /* SPROM WRITE enable. */
-       bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+       err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
        if (err)
                goto err_ctlreg;
        /* We must burn lots of CPU cycles here, but that does not
@@ -746,10 +764,11 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
                else if (i % 2)
                        printk(".");
                bcm43xx_write16(bcm, BCM43xx_SPROM_BASE + (i * 2), sprom[i]);
+               mmiowb();
                mdelay(20);
        }
        spromctl &= ~0x10; /* SPROM WRITE enable. */
-       bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+       err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
        if (err)
                goto err_ctlreg;
        mdelay(500);
@@ -897,6 +916,15 @@ static int bcm43xx_sprom_extract(struct bcm43xx_private *bcm)
        if (value == 0xFFFF)
                value = 0x0000;
        bcm->sprom.boardflags = value;
+       /* boardflags workarounds */
+       if (bcm->board_vendor == PCI_VENDOR_ID_DELL &&
+           bcm->chip_id == 0x4301 &&
+           bcm->board_revision == 0x74)
+               bcm->sprom.boardflags |= BCM43xx_BFL_BTCOEXIST;
+       if (bcm->board_vendor == PCI_VENDOR_ID_APPLE &&
+           bcm->board_type == 0x4E &&
+           bcm->board_revision > 0x40)
+               bcm->sprom.boardflags |= BCM43xx_BFL_PACTRL;
 
        /* antenna gain */
        value = sprom[BCM43xx_SPROM_ANTENNA_GAIN];
@@ -911,20 +939,22 @@ static int bcm43xx_sprom_extract(struct bcm43xx_private *bcm)
        return 0;
 }
 
-static void bcm43xx_geo_init(struct bcm43xx_private *bcm)
+static int bcm43xx_geo_init(struct bcm43xx_private *bcm)
 {
-       struct ieee80211_geo geo;
+       struct ieee80211_geo *geo;
        struct ieee80211_channel *chan;
        int have_a = 0, have_bg = 0;
-       int i, num80211;
+       int i;
        u8 channel;
        struct bcm43xx_phyinfo *phy;
        const char *iso_country;
 
-       memset(&geo, 0, sizeof(geo));
-       num80211 = bcm43xx_num_80211_cores(bcm);
-       for (i = 0; i < num80211; i++) {
-               phy = bcm->phy + i;
+       geo = kzalloc(sizeof(*geo), GFP_KERNEL);
+       if (!geo)
+               return -ENOMEM;
+
+       for (i = 0; i < bcm->nr_80211_available; i++) {
+               phy = &(bcm->core_80211_ext[i].phy);
                switch (phy->type) {
                case BCM43xx_PHYTYPE_B:
                case BCM43xx_PHYTYPE_G:
@@ -940,31 +970,36 @@ static void bcm43xx_geo_init(struct bcm43xx_private *bcm)
        iso_country = bcm43xx_locale_iso(bcm->sprom.locale);
 
        if (have_a) {
-               for (i = 0, channel = 0; channel < 201; channel++) {
-                       chan = &geo.a[i++];
+               for (i = 0, channel = IEEE80211_52GHZ_MIN_CHANNEL;
+                     channel <= IEEE80211_52GHZ_MAX_CHANNEL; channel++) {
+                       chan = &geo->a[i++];
                        chan->freq = bcm43xx_channel_to_freq_a(channel);
                        chan->channel = channel;
                }
-               geo.a_channels = i;
+               geo->a_channels = i;
        }
        if (have_bg) {
-               for (i = 0, channel = 1; channel < 15; channel++) {
-                       chan = &geo.bg[i++];
+               for (i = 0, channel = IEEE80211_24GHZ_MIN_CHANNEL;
+                     channel <= IEEE80211_24GHZ_MAX_CHANNEL; channel++) {
+                       chan = &geo->bg[i++];
                        chan->freq = bcm43xx_channel_to_freq_bg(channel);
                        chan->channel = channel;
                }
-               geo.bg_channels = i;
+               geo->bg_channels = i;
        }
-       memcpy(geo.name, iso_country, 2);
+       memcpy(geo->name, iso_country, 2);
        if (0 /*TODO: Outdoor use only */)
-               geo.name[2] = 'O';
+               geo->name[2] = 'O';
        else if (0 /*TODO: Indoor use only */)
-               geo.name[2] = 'I';
+               geo->name[2] = 'I';
        else
-               geo.name[2] = ' ';
-       geo.name[3] = '\0';
+               geo->name[2] = ' ';
+       geo->name[3] = '\0';
+
+       ieee80211_set_geo(bcm->ieee, geo);
+       kfree(geo);
 
-       ieee80211_set_geo(bcm->ieee, &geo);
+       return 0;
 }
 
 /* DummyTransmission function, as documented on 
@@ -972,7 +1007,8 @@ static void bcm43xx_geo_init(struct bcm43xx_private *bcm)
  */
 void bcm43xx_dummy_transmission(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_phyinfo *phy = bcm->current_core->phy;
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
+       struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
        unsigned int i, max_loop;
        u16 value = 0;
        u32 buffer[5] = {
@@ -1014,24 +1050,28 @@ void bcm43xx_dummy_transmission(struct bcm43xx_private *bcm)
        bcm43xx_write16(bcm, 0x0500, 0x0000);
        bcm43xx_write16(bcm, 0x0502, 0x0030);
 
+       if (radio->version == 0x2050 && radio->revision <= 0x5)
+               bcm43xx_radio_write16(bcm, 0x0051, 0x0017);
        for (i = 0x00; i < max_loop; i++) {
                value = bcm43xx_read16(bcm, 0x050E);
-               if ((value & 0x0080) != 0)
+               if (value & 0x0080)
                        break;
                udelay(10);
        }
        for (i = 0x00; i < 0x0A; i++) {
                value = bcm43xx_read16(bcm, 0x050E);
-               if ((value & 0x0400) != 0)
+               if (value & 0x0400)
                        break;
                udelay(10);
        }
        for (i = 0x00; i < 0x0A; i++) {
                value = bcm43xx_read16(bcm, 0x0690);
-               if ((value & 0x0100) == 0)
+               if (!(value & 0x0100))
                        break;
                udelay(10);
        }
+       if (radio->version == 0x2050 && radio->revision <= 0x5)
+               bcm43xx_radio_write16(bcm, 0x0051, 0x0037);
 }
 
 static void key_write(struct bcm43xx_private *bcm,
@@ -1188,14 +1228,16 @@ int bcm43xx_switch_core(struct bcm43xx_private *bcm, struct bcm43xx_coreinfo *ne
 
        if (unlikely(!new_core))
                return 0;
-       if (!(new_core->flags & BCM43xx_COREFLAG_AVAILABLE))
+       if (!new_core->available)
                return -ENODEV;
        if (bcm->current_core == new_core)
                return 0;
        err = _switch_core(bcm, new_core->index);
-       if (likely(!err))
-               bcm->current_core = new_core;
+       if (unlikely(err))
+               goto out;
 
+       bcm->current_core = new_core;
+out:
        return err;
 }
 
@@ -1270,7 +1312,8 @@ static int bcm43xx_core_disable(struct bcm43xx_private *bcm, u32 core_flags)
        bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
 
 out:
-       bcm->current_core->flags &= ~ BCM43xx_COREFLAG_ENABLED;
+       bcm->current_core->enabled = 0;
+
        return 0;
 }
 
@@ -1315,7 +1358,7 @@ static int bcm43xx_core_enable(struct bcm43xx_private *bcm, u32 core_flags)
        bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
        udelay(1);
 
-       bcm->current_core->flags |= BCM43xx_COREFLAG_ENABLED;
+       bcm->current_core->enabled = 1;
        assert(err == 0);
 out:
        return err;
@@ -1329,6 +1372,7 @@ void bcm43xx_wireless_core_reset(struct bcm43xx_private *bcm, int connect_phy)
        if ((bcm43xx_core_enabled(bcm)) &&
            !bcm43xx_using_pio(bcm)) {
 //FIXME: Do we _really_ want #ifndef CONFIG_BCM947XX here?
+#if 0
 #ifndef CONFIG_BCM947XX
                /* reset all used DMA controllers. */
                bcm43xx_dmacontroller_tx_reset(bcm, BCM43xx_MMIO_DMA1_BASE);
@@ -1339,8 +1383,9 @@ void bcm43xx_wireless_core_reset(struct bcm43xx_private *bcm, int connect_phy)
                if (bcm->current_core->rev < 5)
                        bcm43xx_dmacontroller_rx_reset(bcm, BCM43xx_MMIO_DMA4_BASE);
 #endif
+#endif
        }
-       if (bcm->shutting_down) {
+       if (bcm43xx_status(bcm) == BCM43xx_STAT_SHUTTINGDOWN) {
                bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
                                bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
                                & ~(BCM43xx_SBF_MAC_ENABLED | 0x00000002));
@@ -1363,43 +1408,23 @@ static void bcm43xx_wireless_core_disable(struct bcm43xx_private *bcm)
        bcm43xx_core_disable(bcm, 0);
 }
 
-/* Mark the current 80211 core inactive.
- * "active_80211_core" is the other 80211 core, which is used.
- */
-static int bcm43xx_wireless_core_mark_inactive(struct bcm43xx_private *bcm,
-                                              struct bcm43xx_coreinfo *active_80211_core)
+/* Mark the current 80211 core inactive. */
+static void bcm43xx_wireless_core_mark_inactive(struct bcm43xx_private *bcm)
 {
        u32 sbtmstatelow;
-       struct bcm43xx_coreinfo *old_core;
-       int err = 0;
 
        bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
        bcm43xx_radio_turn_off(bcm);
        sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
-       sbtmstatelow &= ~0x200a0000;
-       sbtmstatelow |= 0xa0000;
+       sbtmstatelow &= 0xDFF5FFFF;
+       sbtmstatelow |= 0x000A0000;
        bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
        udelay(1);
        sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
-       sbtmstatelow &= ~0xa0000;
-       sbtmstatelow |= 0x80000;
+       sbtmstatelow &= 0xFFF5FFFF;
+       sbtmstatelow |= 0x00080000;
        bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
        udelay(1);
-
-       if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_G) {
-               old_core = bcm->current_core;
-               err = bcm43xx_switch_core(bcm, active_80211_core);
-               if (err)
-                       goto out;
-               sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
-               sbtmstatelow &= ~0x20000000;
-               sbtmstatelow |= 0x20000000;
-               bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
-               err = bcm43xx_switch_core(bcm, old_core);
-       }
-
-out:
-       return err;
 }
 
 static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
@@ -1408,9 +1433,6 @@ static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
        u16 tmp;
        struct bcm43xx_xmitstatus stat;
 
-       assert(bcm->current_core->id == BCM43xx_COREID_80211);
-       assert(bcm->current_core->rev >= 5);
-
        while (1) {
                v0 = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
                if (!v0)
@@ -1441,6 +1463,23 @@ static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
        }
 }
 
+static void drain_txstatus_queue(struct bcm43xx_private *bcm)
+{
+       u32 dummy;
+
+       if (bcm->current_core->rev < 5)
+               return;
+       /* Read all entries from the microcode TXstatus FIFO
+        * and throw them away.
+        */
+       while (1) {
+               dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
+               if (!dummy)
+                       break;
+               dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
+       }
+}
+
 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
 {
        bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
@@ -1448,7 +1487,7 @@ static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
        bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD,
                        bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS2_BITFIELD) | (1 << 4));
        assert(bcm->noisecalc.core_at_start == bcm->current_core);
-       assert(bcm->noisecalc.channel_at_start == bcm->current_core->radio->channel);
+       assert(bcm->noisecalc.channel_at_start == bcm43xx_current_radio(bcm)->channel);
 }
 
 static void bcm43xx_calculate_link_quality(struct bcm43xx_private *bcm)
@@ -1458,7 +1497,7 @@ static void bcm43xx_calculate_link_quality(struct bcm43xx_private *bcm)
        if (bcm->noisecalc.calculation_running)
                return;
        bcm->noisecalc.core_at_start = bcm->current_core;
-       bcm->noisecalc.channel_at_start = bcm->current_core->radio->channel;
+       bcm->noisecalc.channel_at_start = bcm43xx_current_radio(bcm)->channel;
        bcm->noisecalc.calculation_running = 1;
        bcm->noisecalc.nr_samples = 0;
 
@@ -1467,7 +1506,7 @@ static void bcm43xx_calculate_link_quality(struct bcm43xx_private *bcm)
 
 static void handle_irq_noise(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_radioinfo *radio = bcm->current_core->radio;
+       struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
        u16 tmp;
        u8 noise[4];
        u8 i, j;
@@ -1490,7 +1529,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm)
                goto generate_new;
 
        /* Get the noise samples. */
-       assert(bcm->noisecalc.nr_samples <= 8);
+       assert(bcm->noisecalc.nr_samples < 8);
        i = bcm->noisecalc.nr_samples;
        noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
        noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
@@ -1512,6 +1551,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm)
                average *= 125;
                average += 64;
                average /= 128;
+
                tmp = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED, 0x40C);
                tmp = (tmp / 128) & 0x1F;
                if (tmp >= 8)
@@ -1523,15 +1563,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm)
                else
                        average -= 48;
 
-               if (average > -65)
-                       bcm->stats.link_quality = 0;
-               else if (average > -75)
-                       bcm->stats.link_quality = 1;
-               else if (average > -85)
-                       bcm->stats.link_quality = 2;
-               else
-                       bcm->stats.link_quality = 3;
-//             dprintk(KERN_INFO PFX "Link Quality: %u (avg was %d)\n", bcm->stats.link_quality, average);
+               bcm->stats.noise = average;
 drop_calculation:
                bcm->noisecalc.calculation_running = 0;
                return;
@@ -1645,28 +1677,13 @@ static void handle_irq_beacon(struct bcm43xx_private *bcm)
        }
 }
 
-/* Debug helper for irq bottom-half to print all reason registers. */
-#define bcmirq_print_reasons(description) \
-       do {                                                                                    \
-               dprintkl(KERN_ERR PFX description "\n"                                          \
-                        KERN_ERR PFX "  Generic Reason: 0x%08x\n"                              \
-                        KERN_ERR PFX "  DMA reasons:    0x%08x, 0x%08x, 0x%08x, 0x%08x\n"      \
-                        KERN_ERR PFX "  DMA TX status:  0x%08x, 0x%08x, 0x%08x, 0x%08x\n",     \
-                        reason,                                                                \
-                        dma_reason[0], dma_reason[1],                                          \
-                        dma_reason[2], dma_reason[3],                                          \
-                        bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_BASE + BCM43xx_DMA_TX_STATUS),   \
-                        bcm43xx_read32(bcm, BCM43xx_MMIO_DMA2_BASE + BCM43xx_DMA_TX_STATUS),   \
-                        bcm43xx_read32(bcm, BCM43xx_MMIO_DMA3_BASE + BCM43xx_DMA_TX_STATUS),   \
-                        bcm43xx_read32(bcm, BCM43xx_MMIO_DMA4_BASE + BCM43xx_DMA_TX_STATUS));  \
-       } while (0)
-
 /* Interrupt handler bottom-half */
 static void bcm43xx_interrupt_tasklet(struct bcm43xx_private *bcm)
 {
        u32 reason;
-       u32 dma_reason[4];
-       int activity = 0;
+       u32 dma_reason[6];
+       u32 merged_dma_reason = 0;
+       int i, activity = 0;
        unsigned long flags;
 
 #ifdef CONFIG_BCM43XX_DEBUG
@@ -1676,12 +1693,12 @@ static void bcm43xx_interrupt_tasklet(struct bcm43xx_private *bcm)
 # define bcmirq_handled(irq)   do { /* nothing */ } while (0)
 #endif /* CONFIG_BCM43XX_DEBUG*/
 
-       spin_lock_irqsave(&bcm->lock, flags);
+       spin_lock_irqsave(&bcm->irq_lock, flags);
        reason = bcm->irq_reason;
-       dma_reason[0] = bcm->dma_reason[0];
-       dma_reason[1] = bcm->dma_reason[1];
-       dma_reason[2] = bcm->dma_reason[2];
-       dma_reason[3] = bcm->dma_reason[3];
+       for (i = 5; i >= 0; i--) {
+               dma_reason[i] = bcm->dma_reason[i];
+               merged_dma_reason |= dma_reason[i];
+       }
 
        if (unlikely(reason & BCM43xx_IRQ_XMIT_ERROR)) {
                /* TX error. We get this when Template Ram is written in wrong endianess
@@ -1689,9 +1706,29 @@ static void bcm43xx_interrupt_tasklet(struct bcm43xx_private *bcm)
                 * on DMA or PIO queues.
                 * Maybe we get this in other error conditions, too.
                 */
-               bcmirq_print_reasons("XMIT ERROR");
+               printkl(KERN_ERR PFX "FATAL ERROR: BCM43xx_IRQ_XMIT_ERROR\n");
                bcmirq_handled(BCM43xx_IRQ_XMIT_ERROR);
        }
+       if (unlikely(merged_dma_reason & BCM43xx_DMAIRQ_FATALMASK)) {
+               printkl(KERN_ERR PFX "FATAL ERROR: Fatal DMA error: "
+                                    "0x%08X, 0x%08X, 0x%08X, "
+                                    "0x%08X, 0x%08X, 0x%08X\n",
+                       dma_reason[0], dma_reason[1],
+                       dma_reason[2], dma_reason[3],
+                       dma_reason[4], dma_reason[5]);
+               bcm43xx_controller_restart(bcm, "DMA error");
+               mmiowb();
+               spin_unlock_irqrestore(&bcm->irq_lock, flags);
+               return;
+       }
+       if (unlikely(merged_dma_reason & BCM43xx_DMAIRQ_NONFATALMASK)) {
+               printkl(KERN_ERR PFX "DMA error: "
+                                    "0x%08X, 0x%08X, 0x%08X, "
+                                    "0x%08X, 0x%08X, 0x%08X\n",
+                       dma_reason[0], dma_reason[1],
+                       dma_reason[2], dma_reason[3],
+                       dma_reason[4], dma_reason[5]);
+       }
 
        if (reason & BCM43xx_IRQ_PS) {
                handle_irq_ps(bcm);
@@ -1725,40 +1762,33 @@ static void bcm43xx_interrupt_tasklet(struct bcm43xx_private *bcm)
        }
 
        /* Check the DMA reason registers for received data. */
-       assert(!(dma_reason[1] & BCM43xx_DMAIRQ_RX_DONE));
-       assert(!(dma_reason[2] & BCM43xx_DMAIRQ_RX_DONE));
        if (dma_reason[0] & BCM43xx_DMAIRQ_RX_DONE) {
                if (bcm43xx_using_pio(bcm))
-                       bcm43xx_pio_rx(bcm->current_core->pio->queue0);
+                       bcm43xx_pio_rx(bcm43xx_current_pio(bcm)->queue0);
                else
-                       bcm43xx_dma_rx(bcm->current_core->dma->rx_ring0);
+                       bcm43xx_dma_rx(bcm43xx_current_dma(bcm)->rx_ring0);
                /* We intentionally don't set "activity" to 1, here. */
        }
+       assert(!(dma_reason[1] & BCM43xx_DMAIRQ_RX_DONE));
+       assert(!(dma_reason[2] & BCM43xx_DMAIRQ_RX_DONE));
        if (dma_reason[3] & BCM43xx_DMAIRQ_RX_DONE) {
-               if (likely(bcm->current_core->rev < 5)) {
-                       if (bcm43xx_using_pio(bcm))
-                               bcm43xx_pio_rx(bcm->current_core->pio->queue3);
-                       else
-                               bcm43xx_dma_rx(bcm->current_core->dma->rx_ring1);
-                       activity = 1;
-               } else
-                       assert(0);
+               if (bcm43xx_using_pio(bcm))
+                       bcm43xx_pio_rx(bcm43xx_current_pio(bcm)->queue3);
+               else
+                       bcm43xx_dma_rx(bcm43xx_current_dma(bcm)->rx_ring3);
+               activity = 1;
        }
+       assert(!(dma_reason[4] & BCM43xx_DMAIRQ_RX_DONE));
+       assert(!(dma_reason[5] & BCM43xx_DMAIRQ_RX_DONE));
        bcmirq_handled(BCM43xx_IRQ_RX);
 
        if (reason & BCM43xx_IRQ_XMIT_STATUS) {
-               if (bcm->current_core->rev >= 5) {
-                       handle_irq_transmit_status(bcm);
-                       activity = 1;
-               }
+               handle_irq_transmit_status(bcm);
+               activity = 1;
                //TODO: In AP mode, this also causes sending of powersave responses.
                bcmirq_handled(BCM43xx_IRQ_XMIT_STATUS);
        }
 
-       /* We get spurious IRQs, althought they are masked.
-        * Assume they are void and ignore them.
-        */
-       bcmirq_handled(~(bcm->irq_savedstate));
        /* IRQ_PIO_WORKAROUND is handled in the top-half. */
        bcmirq_handled(BCM43xx_IRQ_PIO_WORKAROUND);
 #ifdef CONFIG_BCM43XX_DEBUG
@@ -1776,128 +1806,132 @@ static void bcm43xx_interrupt_tasklet(struct bcm43xx_private *bcm)
        if (!modparam_noleds)
                bcm43xx_leds_update(bcm, activity);
        bcm43xx_interrupt_enable(bcm, bcm->irq_savedstate);
-       spin_unlock_irqrestore(&bcm->lock, flags);
+       mmiowb();
+       spin_unlock_irqrestore(&bcm->irq_lock, flags);
 }
 
-#undef bcmirq_print_reasons
-
-static void bcm43xx_interrupt_ack(struct bcm43xx_private *bcm,
-                                 u32 reason, u32 mask)
+static void pio_irq_workaround(struct bcm43xx_private *bcm,
+                              u16 base, int queueidx)
 {
-       bcm->dma_reason[0] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_REASON)
-                            & 0x0001dc00;
-       bcm->dma_reason[1] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA2_REASON)
-                            & 0x0000dc00;
-       bcm->dma_reason[2] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA3_REASON)
-                            & 0x0000dc00;
-       bcm->dma_reason[3] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA4_REASON)
-                            & 0x0001dc00;
+       u16 rxctl;
+
+       rxctl = bcm43xx_read16(bcm, base + BCM43xx_PIO_RXCTL);
+       if (rxctl & BCM43xx_PIO_RXCTL_DATAAVAILABLE)
+               bcm->dma_reason[queueidx] |= BCM43xx_DMAIRQ_RX_DONE;
+       else
+               bcm->dma_reason[queueidx] &= ~BCM43xx_DMAIRQ_RX_DONE;
+}
 
+static void bcm43xx_interrupt_ack(struct bcm43xx_private *bcm, u32 reason)
+{
        if (bcm43xx_using_pio(bcm) &&
            (bcm->current_core->rev < 3) &&
            (!(reason & BCM43xx_IRQ_PIO_WORKAROUND))) {
                /* Apply a PIO specific workaround to the dma_reasons */
-
-#define apply_pio_workaround(BASE, QNUM) \
-       do {                                                                                    \
-       if (bcm43xx_read16(bcm, BASE + BCM43xx_PIO_RXCTL) & BCM43xx_PIO_RXCTL_DATAAVAILABLE)    \
-               bcm->dma_reason[QNUM] |= 0x00010000;                                            \
-       else                                                                                    \
-               bcm->dma_reason[QNUM] &= ~0x00010000;                                           \
-       } while (0)
-
-               apply_pio_workaround(BCM43xx_MMIO_PIO1_BASE, 0);
-               apply_pio_workaround(BCM43xx_MMIO_PIO2_BASE, 1);
-               apply_pio_workaround(BCM43xx_MMIO_PIO3_BASE, 2);
-               apply_pio_workaround(BCM43xx_MMIO_PIO4_BASE, 3);
-
-#undef apply_pio_workaround
+               pio_irq_workaround(bcm, BCM43xx_MMIO_PIO1_BASE, 0);
+               pio_irq_workaround(bcm, BCM43xx_MMIO_PIO2_BASE, 1);
+               pio_irq_workaround(bcm, BCM43xx_MMIO_PIO3_BASE, 2);
+               pio_irq_workaround(bcm, BCM43xx_MMIO_PIO4_BASE, 3);
        }
 
-       bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON,
-                       reason & mask);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, reason);
 
-       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_REASON,
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA0_REASON,
                        bcm->dma_reason[0]);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA2_REASON,
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_REASON,
                        bcm->dma_reason[1]);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_REASON,
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA2_REASON,
                        bcm->dma_reason[2]);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_REASON,
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_REASON,
                        bcm->dma_reason[3]);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_REASON,
+                       bcm->dma_reason[4]);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA5_REASON,
+                       bcm->dma_reason[5]);
 }
 
 /* Interrupt handler top-half */
-static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id)
 {
+       irqreturn_t ret = IRQ_HANDLED;
        struct bcm43xx_private *bcm = dev_id;
-       u32 reason, mask;
+       u32 reason;
 
        if (!bcm)
                return IRQ_NONE;
 
-       spin_lock(&bcm->lock);
+       spin_lock(&bcm->irq_lock);
+
+       assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
+       assert(bcm->current_core->id == BCM43xx_COREID_80211);
 
        reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
        if (reason == 0xffffffff) {
                /* irq not for us (shared irq) */
-               spin_unlock(&bcm->lock);
-               return IRQ_NONE;
-       }
-       mask = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
-       if (!(reason & mask)) {
-               spin_unlock(&bcm->lock);
-               return IRQ_HANDLED;
+               ret = IRQ_NONE;
+               goto out;
        }
+       reason &= bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_MASK);
+       if (!reason)
+               goto out;
 
-       bcm43xx_interrupt_ack(bcm, reason, mask);
-
-       /* Only accept IRQs, if we are initialized properly.
-        * This avoids an RX race while initializing.
-        * We should probably not enable IRQs before we are initialized
-        * completely, but some careful work is needed to fix this. I think it
-        * is best to stay with this cheap workaround for now... .
-        */
-       if (likely(bcm->initialized)) {
-               /* disable all IRQs. They are enabled again in the bottom half. */
-               bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
-               /* save the reason code and call our bottom half. */
-               bcm->irq_reason = reason;
-               tasklet_schedule(&bcm->isr_tasklet);
-       }
+       bcm->dma_reason[0] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA0_REASON)
+                            & 0x0001DC00;
+       bcm->dma_reason[1] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_REASON)
+                            & 0x0000DC00;
+       bcm->dma_reason[2] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA2_REASON)
+                            & 0x0000DC00;
+       bcm->dma_reason[3] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA3_REASON)
+                            & 0x0001DC00;
+       bcm->dma_reason[4] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA4_REASON)
+                            & 0x0000DC00;
+       bcm->dma_reason[5] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA5_REASON)
+                            & 0x0000DC00;
+
+       bcm43xx_interrupt_ack(bcm, reason);
+
+       /* disable all IRQs. They are enabled again in the bottom half. */
+       bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+       /* save the reason code and call our bottom half. */
+       bcm->irq_reason = reason;
+       tasklet_schedule(&bcm->isr_tasklet);
 
-       spin_unlock(&bcm->lock);
+out:
+       mmiowb();
+       spin_unlock(&bcm->irq_lock);
 
-       return IRQ_HANDLED;
+       return ret;
 }
 
 static void bcm43xx_release_firmware(struct bcm43xx_private *bcm, int force)
 {
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
+
        if (bcm->firmware_norelease && !force)
                return; /* Suspending or controller reset. */
-       release_firmware(bcm->ucode);
-       bcm->ucode = NULL;
-       release_firmware(bcm->pcm);
-       bcm->pcm = NULL;
-       release_firmware(bcm->initvals0);
-       bcm->initvals0 = NULL;
-       release_firmware(bcm->initvals1);
-       bcm->initvals1 = NULL;
+       release_firmware(phy->ucode);
+       phy->ucode = NULL;
+       release_firmware(phy->pcm);
+       phy->pcm = NULL;
+       release_firmware(phy->initvals0);
+       phy->initvals0 = NULL;
+       release_firmware(phy->initvals1);
+       phy->initvals1 = NULL;
 }
 
 static int bcm43xx_request_firmware(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_phyinfo *phy = bcm->current_core->phy;
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
        u8 rev = bcm->current_core->rev;
        int err = 0;
        int nr;
        char buf[22 + sizeof(modparam_fwpostfix) - 1] = { 0 };
 
-       if (!bcm->ucode) {
+       if (!phy->ucode) {
                snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_microcode%d%s.fw",
                         (rev >= 5 ? 5 : rev),
                         modparam_fwpostfix);
-               err = request_firmware(&bcm->ucode, buf, &bcm->pci_dev->dev);
+               err = request_firmware(&phy->ucode, buf, &bcm->pci_dev->dev);
                if (err) {
                        printk(KERN_ERR PFX 
                               "Error: Microcode \"%s\" not available or load failed.\n",
@@ -1906,12 +1940,12 @@ static int bcm43xx_request_firmware(struct bcm43xx_private *bcm)
                }
        }
 
-       if (!bcm->pcm) {
+       if (!phy->pcm) {
                snprintf(buf, ARRAY_SIZE(buf),
                         "bcm43xx_pcm%d%s.fw",
                         (rev < 5 ? 4 : 5),
                         modparam_fwpostfix);
-               err = request_firmware(&bcm->pcm, buf, &bcm->pci_dev->dev);
+               err = request_firmware(&phy->pcm, buf, &bcm->pci_dev->dev);
                if (err) {
                        printk(KERN_ERR PFX
                               "Error: PCM \"%s\" not available or load failed.\n",
@@ -1920,7 +1954,7 @@ static int bcm43xx_request_firmware(struct bcm43xx_private *bcm)
                }
        }
 
-       if (!bcm->initvals0) {
+       if (!phy->initvals0) {
                if (rev == 2 || rev == 4) {
                        switch (phy->type) {
                        case BCM43xx_PHYTYPE_A:
@@ -1951,20 +1985,20 @@ static int bcm43xx_request_firmware(struct bcm43xx_private *bcm)
                snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_initval%02d%s.fw",
                         nr, modparam_fwpostfix);
 
-               err = request_firmware(&bcm->initvals0, buf, &bcm->pci_dev->dev);
+               err = request_firmware(&phy->initvals0, buf, &bcm->pci_dev->dev);
                if (err) {
                        printk(KERN_ERR PFX 
                               "Error: InitVals \"%s\" not available or load failed.\n",
                                buf);
                        goto error;
                }
-               if (bcm->initvals0->size % sizeof(struct bcm43xx_initval)) {
+               if (phy->initvals0->size % sizeof(struct bcm43xx_initval)) {
                        printk(KERN_ERR PFX "InitVals fileformat error.\n");
                        goto error;
                }
        }
 
-       if (!bcm->initvals1) {
+       if (!phy->initvals1) {
                if (rev >= 5) {
                        u32 sbtmstatehigh;
 
@@ -1986,14 +2020,14 @@ static int bcm43xx_request_firmware(struct bcm43xx_private *bcm)
                        snprintf(buf, ARRAY_SIZE(buf), "bcm43xx_initval%02d%s.fw",
                                 nr, modparam_fwpostfix);
 
-                       err = request_firmware(&bcm->initvals1, buf, &bcm->pci_dev->dev);
+                       err = request_firmware(&phy->initvals1, buf, &bcm->pci_dev->dev);
                        if (err) {
                                printk(KERN_ERR PFX 
                                       "Error: InitVals \"%s\" not available or load failed.\n",
                                        buf);
                                goto error;
                        }
-                       if (bcm->initvals1->size % sizeof(struct bcm43xx_initval)) {
+                       if (phy->initvals1->size % sizeof(struct bcm43xx_initval)) {
                                printk(KERN_ERR PFX "InitVals fileformat error.\n");
                                goto error;
                        }
@@ -2013,18 +2047,13 @@ err_noinitval:
 
 static void bcm43xx_upload_microcode(struct bcm43xx_private *bcm)
 {
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
        const u32 *data;
        unsigned int i, len;
 
-#ifdef DEBUG_ENABLE_UCODE_MMIO_PRINT
-       bcm43xx_mmioprint_enable(bcm);
-#else
-       bcm43xx_mmioprint_disable(bcm);
-#endif
-
        /* Upload Microcode. */
-       data = (u32 *)(bcm->ucode->data);
-       len = bcm->ucode->size / sizeof(u32);
+       data = (u32 *)(phy->ucode->data);
+       len = phy->ucode->size / sizeof(u32);
        bcm43xx_shm_control_word(bcm, BCM43xx_SHM_UCODE, 0x0000);
        for (i = 0; i < len; i++) {
                bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA,
@@ -2033,8 +2062,8 @@ static void bcm43xx_upload_microcode(struct bcm43xx_private *bcm)
        }
 
        /* Upload PCM data. */
-       data = (u32 *)(bcm->pcm->data);
-       len = bcm->pcm->size / sizeof(u32);
+       data = (u32 *)(phy->pcm->data);
+       len = phy->pcm->size / sizeof(u32);
        bcm43xx_shm_control_word(bcm, BCM43xx_SHM_PCM, 0x01ea);
        bcm43xx_write32(bcm, BCM43xx_MMIO_SHM_DATA, 0x00004000);
        bcm43xx_shm_control_word(bcm, BCM43xx_SHM_PCM, 0x01eb);
@@ -2043,12 +2072,6 @@ static void bcm43xx_upload_microcode(struct bcm43xx_private *bcm)
                                be32_to_cpu(data[i]));
                udelay(10);
        }
-
-#ifdef DEBUG_ENABLE_UCODE_MMIO_PRINT
-       bcm43xx_mmioprint_disable(bcm);
-#else
-       bcm43xx_mmioprint_enable(bcm);
-#endif
 }
 
 static int bcm43xx_write_initvals(struct bcm43xx_private *bcm,
@@ -2086,77 +2109,55 @@ err_format:
 
 static int bcm43xx_upload_initvals(struct bcm43xx_private *bcm)
 {
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
        int err;
 
-#ifdef DEBUG_ENABLE_UCODE_MMIO_PRINT
-       bcm43xx_mmioprint_enable(bcm);
-#else
-       bcm43xx_mmioprint_disable(bcm);
-#endif
-
-       err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)bcm->initvals0->data,
-                                    bcm->initvals0->size / sizeof(struct bcm43xx_initval));
+       err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)phy->initvals0->data,
+                                    phy->initvals0->size / sizeof(struct bcm43xx_initval));
        if (err)
                goto out;
-       if (bcm->initvals1) {
-               err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)bcm->initvals1->data,
-                                            bcm->initvals1->size / sizeof(struct bcm43xx_initval));
+       if (phy->initvals1) {
+               err = bcm43xx_write_initvals(bcm, (struct bcm43xx_initval *)phy->initvals1->data,
+                                            phy->initvals1->size / sizeof(struct bcm43xx_initval));
                if (err)
                        goto out;
        }
-
 out:
-#ifdef DEBUG_ENABLE_UCODE_MMIO_PRINT
-       bcm43xx_mmioprint_disable(bcm);
-#else
-       bcm43xx_mmioprint_enable(bcm);
-#endif
        return err;
 }
 
+#ifdef CONFIG_BCM947XX
+static struct pci_device_id bcm43xx_47xx_ids[] = {
+       { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4324) },
+       { 0 }
+};
+#endif
+
 static int bcm43xx_initialize_irq(struct bcm43xx_private *bcm)
 {
-       int res;
-       unsigned int i;
-       u32 data;
+       int err;
 
        bcm->irq = bcm->pci_dev->irq;
 #ifdef CONFIG_BCM947XX
        if (bcm->pci_dev->bus->number == 0) {
-               struct pci_dev *d = NULL;
-               /* FIXME: we will probably need more device IDs here... */
-               d = pci_find_device(PCI_VENDOR_ID_BROADCOM, 0x4324, NULL);
-               if (d != NULL) {
-                       bcm->irq = d->irq;
+               struct pci_dev *d;
+               struct pci_device_id *id;
+               for (id = bcm43xx_47xx_ids; id->vendor; id++) {
+                       d = pci_get_device(id->vendor, id->device, NULL);
+                       if (d != NULL) {
+                               bcm->irq = d->irq;
+                               pci_dev_put(d);
+                               break;
+                       }
                }
        }
 #endif
-       res = request_irq(bcm->irq, bcm43xx_interrupt_handler,
-                         SA_SHIRQ, KBUILD_MODNAME, bcm);
-       if (res) {
+       err = request_irq(bcm->irq, bcm43xx_interrupt_handler,
+                         IRQF_SHARED, KBUILD_MODNAME, bcm);
+       if (err)
                printk(KERN_ERR PFX "Cannot register IRQ%d\n", bcm->irq);
-               return -ENODEV;
-       }
-       bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, 0xffffffff);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, 0x00020402);
-       i = 0;
-       while (1) {
-               data = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
-               if (data == BCM43xx_IRQ_READY)
-                       break;
-               i++;
-               if (i >= BCM43xx_IRQWAIT_MAX_RETRIES) {
-                       printk(KERN_ERR PFX "Card IRQ register not responding. "
-                                           "Giving up.\n");
-                       free_irq(bcm->irq, bcm);
-                       return -ENODEV;
-               }
-               udelay(10);
-       }
-       // dummy read
-       bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
 
-       return 0;
+       return err;
 }
 
 /* Switch to the core used to write the GPIO register.
@@ -2177,13 +2178,10 @@ static int switch_to_gpio_core(struct bcm43xx_private *bcm)
                if (unlikely(err == -ENODEV)) {
                        printk(KERN_ERR PFX "gpio error: "
                               "Neither ChipCommon nor PCI core available!\n");
-                       return -ENODEV;
-               } else if (unlikely(err != 0))
-                       return -ENODEV;
-       } else if (unlikely(err != 0))
-               return -ENODEV;
+               }
+       }
 
-       return 0;
+       return err;
 }
 
 /* Initialize the GPIOs
@@ -2193,45 +2191,48 @@ static int bcm43xx_gpio_init(struct bcm43xx_private *bcm)
 {
        struct bcm43xx_coreinfo *old_core;
        int err;
-       u32 mask, value;
+       u32 mask, set;
 
-       value = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
-       value &= ~0xc000;
-       bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
+                       bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
+                       & 0xFFFF3FFF);
 
-       mask = 0x0000001F;
-       value = 0x0000000F;
-       bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_CONTROL,
-                       bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_CONTROL) & 0xFFF0);
+       bcm43xx_leds_switch_all(bcm, 0);
        bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
                        bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK) | 0x000F);
 
-       old_core = bcm->current_core;
-       
-       err = switch_to_gpio_core(bcm);
-       if (err)
-               return err;
-
-       if (bcm->current_core->rev >= 2){
-               mask  |= 0x10;
-               value |= 0x10;
-       }
+       mask = 0x0000001F;
+       set = 0x0000000F;
        if (bcm->chip_id == 0x4301) {
-               mask  |= 0x60;
-               value |= 0x60;
+               mask |= 0x0060;
+               set |= 0x0060;
+       }
+       if (0 /* FIXME: conditional unknown */) {
+               bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
+                               bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK)
+                               | 0x0100);
+               mask |= 0x0180;
+               set |= 0x0180;
        }
        if (bcm->sprom.boardflags & BCM43xx_BFL_PACTRL) {
-               mask  |= 0x200;
-               value |= 0x200;
+               bcm43xx_write16(bcm, BCM43xx_MMIO_GPIO_MASK,
+                               bcm43xx_read16(bcm, BCM43xx_MMIO_GPIO_MASK)
+                               | 0x0200);
+               mask |= 0x0200;
+               set |= 0x0200;
        }
+       if (bcm->current_core->rev >= 2)
+               mask  |= 0x0010; /* FIXME: This is redundant. */
 
+       old_core = bcm->current_core;
+       err = switch_to_gpio_core(bcm);
+       if (err)
+               goto out;
        bcm43xx_write32(bcm, BCM43xx_GPIO_CONTROL,
-                       (bcm43xx_read32(bcm, BCM43xx_GPIO_CONTROL) & mask) | value);
-
+                       (bcm43xx_read32(bcm, BCM43xx_GPIO_CONTROL) & mask) | set);
        err = bcm43xx_switch_core(bcm, old_core);
-       assert(err == 0);
-
-       return 0;
+out:
+       return err;
 }
 
 /* Turn off all GPIO stuff. Call this on module unload, for example. */
@@ -2254,13 +2255,17 @@ static int bcm43xx_gpio_cleanup(struct bcm43xx_private *bcm)
 /* http://bcm-specs.sipsolutions.net/EnableMac */
 void bcm43xx_mac_enable(struct bcm43xx_private *bcm)
 {
-       bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
-                       bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
-                       | BCM43xx_SBF_MAC_ENABLED);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, BCM43xx_IRQ_READY);
-       bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD); /* dummy read */
-       bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
-       bcm43xx_power_saving_ctl_bits(bcm, -1, -1);
+       bcm->mac_suspended--;
+       assert(bcm->mac_suspended >= 0);
+       if (bcm->mac_suspended == 0) {
+               bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
+                               bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
+                               | BCM43xx_SBF_MAC_ENABLED);
+               bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, BCM43xx_IRQ_READY);
+               bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD); /* dummy read */
+               bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
+               bcm43xx_power_saving_ctl_bits(bcm, -1, -1);
+       }
 }
 
 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
@@ -2269,68 +2274,83 @@ void bcm43xx_mac_suspend(struct bcm43xx_private *bcm)
        int i;
        u32 tmp;
 
-       bcm43xx_power_saving_ctl_bits(bcm, -1, 1);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
-                       bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
-                       & ~BCM43xx_SBF_MAC_ENABLED);
-       bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
-       for (i = 100000; i; i--) {
-               tmp = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
-               if (tmp & BCM43xx_IRQ_READY)
-                       return;
-               udelay(10);
+       assert(bcm->mac_suspended >= 0);
+       if (bcm->mac_suspended == 0) {
+               bcm43xx_power_saving_ctl_bits(bcm, -1, 1);
+               bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD,
+                               bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD)
+                               & ~BCM43xx_SBF_MAC_ENABLED);
+               bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
+               for (i = 10000; i; i--) {
+                       tmp = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
+                       if (tmp & BCM43xx_IRQ_READY)
+                               goto out;
+                       udelay(1);
+               }
+               printkl(KERN_ERR PFX "MAC suspend failed\n");
        }
-       printkl(KERN_ERR PFX "MAC suspend failed\n");
+out:
+       bcm->mac_suspended++;
 }
 
 void bcm43xx_set_iwmode(struct bcm43xx_private *bcm,
                        int iw_mode)
 {
        unsigned long flags;
+       struct net_device *net_dev = bcm->net_dev;
        u32 status;
+       u16 value;
 
        spin_lock_irqsave(&bcm->ieee->lock, flags);
        bcm->ieee->iw_mode = iw_mode;
        spin_unlock_irqrestore(&bcm->ieee->lock, flags);
        if (iw_mode == IW_MODE_MONITOR)
-               bcm->net_dev->type = ARPHRD_IEEE80211;
+               net_dev->type = ARPHRD_IEEE80211;
        else
-               bcm->net_dev->type = ARPHRD_ETHER;
-
-       if (!bcm->initialized)
-               return;
+               net_dev->type = ARPHRD_ETHER;
 
-       bcm43xx_mac_suspend(bcm);
        status = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
        /* Reset status to infrastructured mode */
        status &= ~(BCM43xx_SBF_MODE_AP | BCM43xx_SBF_MODE_MONITOR);
-       /*FIXME: We actually set promiscuous mode as well, until we don't
-        * get the HW mac filter working */
-       status |= BCM43xx_SBF_MODE_NOTADHOC | BCM43xx_SBF_MODE_PROMISC;
+       status &= ~BCM43xx_SBF_MODE_PROMISC;
+       status |= BCM43xx_SBF_MODE_NOTADHOC;
+
+/* FIXME: Always enable promisc mode, until we get the MAC filters working correctly. */
+status |= BCM43xx_SBF_MODE_PROMISC;
 
        switch (iw_mode) {
        case IW_MODE_MONITOR:
-               status |= (BCM43xx_SBF_MODE_PROMISC |
-                          BCM43xx_SBF_MODE_MONITOR);
+               status |= BCM43xx_SBF_MODE_MONITOR;
+               status |= BCM43xx_SBF_MODE_PROMISC;
                break;
        case IW_MODE_ADHOC:
                status &= ~BCM43xx_SBF_MODE_NOTADHOC;
                break;
        case IW_MODE_MASTER:
+               status |= BCM43xx_SBF_MODE_AP;
+               break;
        case IW_MODE_SECOND:
        case IW_MODE_REPEAT:
-               /* TODO: No AP/Repeater mode for now :-/ */
-               TODO();
+               TODO(); /* TODO */
                break;
        case IW_MODE_INFRA:
                /* nothing to be done here... */
                break;
        default:
-               printk(KERN_ERR PFX "Unknown iwmode %d\n", iw_mode);
+               dprintk(KERN_ERR PFX "Unknown mode in set_iwmode: %d\n", iw_mode);
        }
-
+       if (net_dev->flags & IFF_PROMISC)
+               status |= BCM43xx_SBF_MODE_PROMISC;
        bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, status);
-       bcm43xx_mac_enable(bcm);
+
+       value = 0x0002;
+       if (iw_mode != IW_MODE_ADHOC && iw_mode != IW_MODE_MASTER) {
+               if (bcm->chip_id == 0x4306 && bcm->chip_rev == 3)
+                       value = 0x0064;
+               else
+                       value = 0x0032;
+       }
+       bcm43xx_write16(bcm, 0x0612, value);
 }
 
 /* This is the opposite of bcm43xx_chip_init() */
@@ -2340,7 +2360,6 @@ static void bcm43xx_chip_cleanup(struct bcm43xx_private *bcm)
        if (!modparam_noleds)
                bcm43xx_leds_exit(bcm);
        bcm43xx_gpio_cleanup(bcm);
-       free_irq(bcm->irq, bcm);
        bcm43xx_release_firmware(bcm, 0);
 }
 
@@ -2349,9 +2368,10 @@ static void bcm43xx_chip_cleanup(struct bcm43xx_private *bcm)
  */
 static int bcm43xx_chip_init(struct bcm43xx_private *bcm)
 {
+       struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
        int err;
-       int iw_mode = bcm->ieee->iw_mode;
-       int tmp;
+       int i, tmp;
        u32 value32;
        u16 value16;
 
@@ -2364,37 +2384,73 @@ static int bcm43xx_chip_init(struct bcm43xx_private *bcm)
                goto out;
        bcm43xx_upload_microcode(bcm);
 
-       err = bcm43xx_initialize_irq(bcm);
-       if (err)
+       bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, 0xFFFFFFFF);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, 0x00020402);
+       i = 0;
+       while (1) {
+               value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
+               if (value32 == BCM43xx_IRQ_READY)
+                       break;
+               i++;
+               if (i >= BCM43xx_IRQWAIT_MAX_RETRIES) {
+                       printk(KERN_ERR PFX "IRQ_READY timeout\n");
+                       err = -ENODEV;
+                       goto err_release_fw;
+               }
+               udelay(10);
+       }
+       bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
+
+       value16 = bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                    BCM43xx_UCODE_REVISION);
+
+       dprintk(KERN_INFO PFX "Microcode rev 0x%x, pl 0x%x "
+               "(20%.2i-%.2i-%.2i  %.2i:%.2i:%.2i)\n", value16,
+               bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                  BCM43xx_UCODE_PATCHLEVEL),
+               (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                   BCM43xx_UCODE_DATE) >> 12) & 0xf,
+               (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                   BCM43xx_UCODE_DATE) >> 8) & 0xf,
+               bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                  BCM43xx_UCODE_DATE) & 0xff,
+               (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                  BCM43xx_UCODE_TIME) >> 11) & 0x1f,
+               (bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                  BCM43xx_UCODE_TIME) >> 5) & 0x3f,
+               bcm43xx_shm_read16(bcm, BCM43xx_SHM_SHARED,
+                                  BCM43xx_UCODE_TIME) & 0x1f);
+
+       if ( value16 > 0x128 ) {
+               printk(KERN_ERR PFX
+                       "Firmware: no support for microcode extracted "
+                       "from version 4.x binary drivers.\n");
+               err = -EOPNOTSUPP;
                goto err_release_fw;
+       }
 
        err = bcm43xx_gpio_init(bcm);
        if (err)
-               goto err_free_irq;
+               goto err_release_fw;
 
        err = bcm43xx_upload_initvals(bcm);
        if (err)
                goto err_gpio_cleanup;
        bcm43xx_radio_turn_on(bcm);
 
-       if (modparam_noleds)
-               bcm43xx_leds_turn_off(bcm);
-       else
-               bcm43xx_leds_update(bcm, 0);
-
        bcm43xx_write16(bcm, 0x03E6, 0x0000);
        err = bcm43xx_phy_init(bcm);
        if (err)
                goto err_radio_off;
 
        /* Select initial Interference Mitigation. */
-       tmp = bcm->current_core->radio->interfmode;
-       bcm->current_core->radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
+       tmp = radio->interfmode;
+       radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
        bcm43xx_radio_set_interference_mitigation(bcm, tmp);
 
        bcm43xx_phy_set_antenna_diversity(bcm);
        bcm43xx_radio_set_txantenna(bcm, BCM43xx_RADIO_TXANTENNA_DEFAULT);
-       if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_B) {
+       if (phy->type == BCM43xx_PHYTYPE_B) {
                value16 = bcm43xx_read16(bcm, 0x005E);
                value16 |= 0x0004;
                bcm43xx_write16(bcm, 0x005E, value16);
@@ -2409,20 +2465,9 @@ static int bcm43xx_chip_init(struct bcm43xx_private *bcm)
        value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
        value32 |= BCM43xx_SBF_MODE_NOTADHOC;
        bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
-       /*FIXME: For now, use promiscuous mode at all times; otherwise we don't
-          get broadcast or multicast packets */
-       value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
-       value32 |= BCM43xx_SBF_MODE_PROMISC;
-       bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
 
-       if (iw_mode == IW_MODE_MONITOR) {
-               value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
-               value32 |= BCM43xx_SBF_MODE_PROMISC;
-               value32 |= BCM43xx_SBF_MODE_MONITOR;
-               bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
-       }
        value32 = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
-       value32 |= 0x100000; //FIXME: What's this? Is this correct?
+       value32 |= 0x100000;
        bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value32);
 
        if (bcm43xx_using_pio(bcm)) {
@@ -2437,13 +2482,8 @@ static int bcm43xx_chip_init(struct bcm43xx_private *bcm)
        /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
        bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0074, 0x0000);
 
-       if (iw_mode != IW_MODE_ADHOC && iw_mode != IW_MODE_MASTER) {
-               if ((bcm->chip_id == 0x4306) && (bcm->chip_rev == 3))
-                       bcm43xx_write16(bcm, 0x0612, 0x0064);
-               else
-                       bcm43xx_write16(bcm, 0x0612, 0x0032);
-       } else
-               bcm43xx_write16(bcm, 0x0612, 0x0002);
+       /* Initially set the wireless operation mode. */
+       bcm43xx_set_iwmode(bcm, bcm->ieee->iw_mode);
 
        if (bcm->current_core->rev < 3) {
                bcm43xx_write16(bcm, 0x060E, 0x0000);
@@ -2455,10 +2495,12 @@ static int bcm43xx_chip_init(struct bcm43xx_private *bcm)
                bcm43xx_write32(bcm, 0x018C, 0x02000000);
        }
        bcm43xx_write32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON, 0x00004000);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_IRQ_MASK, 0x0001DC00);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
        bcm43xx_write32(bcm, BCM43xx_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_IRQ_MASK, 0x0000DC00);
-       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_IRQ_MASK, 0x0001DC00);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
+       bcm43xx_write32(bcm, BCM43xx_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
 
        value32 = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
        value32 |= 0x00100000;
@@ -2475,8 +2517,6 @@ err_radio_off:
        bcm43xx_radio_turn_off(bcm);
 err_gpio_cleanup:
        bcm43xx_gpio_cleanup(bcm);
-err_free_irq:
-       free_irq(bcm->irq, bcm);
 err_release_fw:
        bcm43xx_release_firmware(bcm, 1);
        goto out;
@@ -2512,6 +2552,27 @@ error:
        return -ENODEV;
 }
 
+static void bcm43xx_init_struct_phyinfo(struct bcm43xx_phyinfo *phy)
+{
+       /* Initialize a "phyinfo" structure. The structure is already
+        * zeroed out.
+        * This is called on insmod time to initialize members.
+        */
+       phy->savedpctlreg = 0xFFFF;
+       spin_lock_init(&phy->lock);
+}
+
+static void bcm43xx_init_struct_radioinfo(struct bcm43xx_radioinfo *radio)
+{
+       /* Initialize a "radioinfo" structure. The structure is already
+        * zeroed out.
+        * This is called on insmod time to initialize members.
+        */
+       radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
+       radio->channel = 0xFF;
+       radio->initial_channel = 0xFF;
+}
+
 static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
 {
        int err, i;
@@ -2523,15 +2584,13 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
 
        memset(&bcm->core_chipcommon, 0, sizeof(struct bcm43xx_coreinfo));
        memset(&bcm->core_pci, 0, sizeof(struct bcm43xx_coreinfo));
-       memset(&bcm->core_v90, 0, sizeof(struct bcm43xx_coreinfo));
-       memset(&bcm->core_pcmcia, 0, sizeof(struct bcm43xx_coreinfo));
        memset(&bcm->core_80211, 0, sizeof(struct bcm43xx_coreinfo)
                                    * BCM43xx_MAX_80211_CORES);
-
-       memset(&bcm->phy, 0, sizeof(struct bcm43xx_phyinfo)
-                            * BCM43xx_MAX_80211_CORES);
-       memset(&bcm->radio, 0, sizeof(struct bcm43xx_radioinfo)
-                              * BCM43xx_MAX_80211_CORES);
+       memset(&bcm->core_80211_ext, 0, sizeof(struct bcm43xx_coreinfo_80211)
+                                       * BCM43xx_MAX_80211_CORES);
+       bcm->nr_80211_available = 0;
+       bcm->current_core = NULL;
+       bcm->active_80211_core = NULL;
 
        /* map core 0 */
        err = _switch_core(bcm, 0);
@@ -2549,7 +2608,7 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
        if (core_id == BCM43xx_COREID_CHIPCOMMON) {
                chip_id_32 = bcm43xx_read32(bcm, 0);
                chip_id_16 = chip_id_32 & 0xFFFF;
-               bcm->core_chipcommon.flags |= BCM43xx_COREFLAG_AVAILABLE;
+               bcm->core_chipcommon.available = 1;
                bcm->core_chipcommon.id = core_id;
                bcm->core_chipcommon.rev = core_rev;
                bcm->core_chipcommon.index = 0;
@@ -2613,23 +2672,25 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
        }
 
        bcm->chip_id = chip_id_16;
-       bcm->chip_rev = (chip_id_32 & 0x000f0000) >> 16;
+       bcm->chip_rev = (chip_id_32 & 0x000F0000) >> 16;
+       bcm->chip_package = (chip_id_32 & 0x00F00000) >> 20;
 
        dprintk(KERN_INFO PFX "Chip ID 0x%x, rev 0x%x\n",
                bcm->chip_id, bcm->chip_rev);
        dprintk(KERN_INFO PFX "Number of cores: %d\n", core_count);
-       if (bcm->core_chipcommon.flags & BCM43xx_COREFLAG_AVAILABLE) {
+       if (bcm->core_chipcommon.available) {
                dprintk(KERN_INFO PFX "Core 0: ID 0x%x, rev 0x%x, vendor 0x%x, %s\n",
                        core_id, core_rev, core_vendor,
                        bcm43xx_core_enabled(bcm) ? "enabled" : "disabled");
        }
 
-       if (bcm->core_chipcommon.flags & BCM43xx_COREFLAG_AVAILABLE)
+       if (bcm->core_chipcommon.available)
                current_core = 1;
        else
                current_core = 0;
        for ( ; current_core < core_count; current_core++) {
                struct bcm43xx_coreinfo *core;
+               struct bcm43xx_coreinfo_80211 *ext_80211;
 
                err = _switch_core(bcm, current_core);
                if (err)
@@ -2651,36 +2712,16 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
                switch (core_id) {
                case BCM43xx_COREID_PCI:
                        core = &bcm->core_pci;
-                       if (core->flags & BCM43xx_COREFLAG_AVAILABLE) {
+                       if (core->available) {
                                printk(KERN_WARNING PFX "Multiple PCI cores found.\n");
                                continue;
                        }
                        break;
-               case BCM43xx_COREID_V90:
-                       core = &bcm->core_v90;
-                       if (core->flags & BCM43xx_COREFLAG_AVAILABLE) {
-                               printk(KERN_WARNING PFX "Multiple V90 cores found.\n");
-                               continue;
-                       }
-                       break;
-               case BCM43xx_COREID_PCMCIA:
-                       core = &bcm->core_pcmcia;
-                       if (core->flags & BCM43xx_COREFLAG_AVAILABLE) {
-                               printk(KERN_WARNING PFX "Multiple PCMCIA cores found.\n");
-                               continue;
-                       }
-                       break;
-               case BCM43xx_COREID_ETHERNET:
-                       core = &bcm->core_ethernet;
-                       if (core->flags & BCM43xx_COREFLAG_AVAILABLE) {
-                               printk(KERN_WARNING PFX "Multiple Ethernet cores found.\n");
-                               continue;
-                       }
-                       break;
                case BCM43xx_COREID_80211:
                        for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
                                core = &(bcm->core_80211[i]);
-                               if (!(core->flags & BCM43xx_COREFLAG_AVAILABLE))
+                               ext_80211 = &(bcm->core_80211_ext[i]);
+                               if (!core->available)
                                        break;
                                core = NULL;
                        }
@@ -2715,40 +2756,24 @@ static int bcm43xx_probe_cores(struct bcm43xx_private *bcm)
                                err = -ENODEV;
                                goto out;
                        }
-                       core->phy = &bcm->phy[i];
-                       core->phy->antenna_diversity = 0xffff;
-                       core->phy->savedpctlreg = 0xFFFF;
-                       core->phy->minlowsig[0] = 0xFFFF;
-                       core->phy->minlowsig[1] = 0xFFFF;
-                       core->phy->minlowsigpos[0] = 0;
-                       core->phy->minlowsigpos[1] = 0;
-                       spin_lock_init(&core->phy->lock);
-                       core->radio = &bcm->radio[i];
-                       core->radio->interfmode = BCM43xx_RADIO_INTERFMODE_NONE;
-                       core->radio->channel = 0xFF;
-                       core->radio->initial_channel = 0xFF;
-                       core->radio->lofcal = 0xFFFF;
-                       core->radio->initval = 0xFFFF;
-                       core->radio->nrssi[0] = -1000;
-                       core->radio->nrssi[1] = -1000;
-                       core->dma = &bcm->dma[i];
-                       core->pio = &bcm->pio[i];
+                       bcm->nr_80211_available++;
+                       core->priv = ext_80211;
+                       bcm43xx_init_struct_phyinfo(&ext_80211->phy);
+                       bcm43xx_init_struct_radioinfo(&ext_80211->radio);
                        break;
                case BCM43xx_COREID_CHIPCOMMON:
                        printk(KERN_WARNING PFX "Multiple CHIPCOMMON cores found.\n");
                        break;
-               default:
-                       printk(KERN_WARNING PFX "Unknown core found (ID 0x%x)\n", core_id);
                }
                if (core) {
-                       core->flags |= BCM43xx_COREFLAG_AVAILABLE;
+                       core->available = 1;
                        core->id = core_id;
                        core->rev = core_rev;
                        core->index = current_core;
                }
        }
 
-       if (!(bcm->core_80211[0].flags & BCM43xx_COREFLAG_AVAILABLE)) {
+       if (!bcm->core_80211[0].available) {
                printk(KERN_ERR PFX "Error: No 80211 core found!\n");
                err = -ENODEV;
                goto out;
@@ -2802,7 +2827,7 @@ static void bcm43xx_rate_memory_write(struct bcm43xx_private *bcm,
 
 static void bcm43xx_rate_memory_init(struct bcm43xx_private *bcm)
 {
-       switch (bcm->current_core->phy->type) {
+       switch (bcm43xx_current_phy(bcm)->type) {
        case BCM43xx_PHYTYPE_A:
        case BCM43xx_PHYTYPE_G:
                bcm43xx_rate_memory_write(bcm, IEEE80211_OFDM_RATE_6MB, 1);
@@ -2829,12 +2854,15 @@ static void bcm43xx_wireless_core_cleanup(struct bcm43xx_private *bcm)
        bcm43xx_pio_free(bcm);
        bcm43xx_dma_free(bcm);
 
-       bcm->current_core->flags &= ~ BCM43xx_COREFLAG_INITIALIZED;
+       bcm->current_core->initialized = 0;
 }
 
 /* http://bcm-specs.sipsolutions.net/80211Init */
-static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm)
+static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm,
+                                     int active_wlcore)
 {
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
+       struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
        u32 ucodeflags;
        int err;
        u32 sbimconfiglow;
@@ -2867,16 +2895,15 @@ static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm)
        /* HW decryption needs to be set now */
        ucodeflags |= 0x40000000;
        
-       if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_G) {
+       if (phy->type == BCM43xx_PHYTYPE_G) {
                ucodeflags |= BCM43xx_UCODEFLAG_UNKBGPHY;
-               if (bcm->current_core->phy->rev == 1)
+               if (phy->rev == 1)
                        ucodeflags |= BCM43xx_UCODEFLAG_UNKGPHY;
                if (bcm->sprom.boardflags & BCM43xx_BFL_PACTRL)
                        ucodeflags |= BCM43xx_UCODEFLAG_UNKPACTRL;
-       } else if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_B) {
+       } else if (phy->type == BCM43xx_PHYTYPE_B) {
                ucodeflags |= BCM43xx_UCODEFLAG_UNKBGPHY;
-               if ((bcm->current_core->phy->rev >= 2) &&
-                   (bcm->current_core->radio->version == 0x2050))
+               if (phy->rev >= 2 && radio->version == 0x2050)
                        ucodeflags &= ~BCM43xx_UCODEFLAG_UNKGPHY;
        }
 
@@ -2901,7 +2928,7 @@ static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm)
        bcm43xx_rate_memory_init(bcm);
 
        /* Minimum Contention Window */
-       if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_B)
+       if (phy->type == BCM43xx_PHYTYPE_B)
                bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0003, 0x0000001f);
        else
                bcm43xx_shm_write32(bcm, BCM43xx_SHM_WIRELESS, 0x0003, 0x0000000f);
@@ -2914,20 +2941,30 @@ static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm)
        if (bcm->current_core->rev >= 5)
                bcm43xx_write16(bcm, 0x043C, 0x000C);
 
-       if (bcm43xx_using_pio(bcm))
-               err = bcm43xx_pio_init(bcm);
-       else
-               err = bcm43xx_dma_init(bcm);
-       if (err)
-               goto err_chip_cleanup;
+       if (active_wlcore) {
+               if (bcm43xx_using_pio(bcm)) {
+                       err = bcm43xx_pio_init(bcm);
+               } else {
+                       err = bcm43xx_dma_init(bcm);
+                       if (err == -ENOSYS)
+                               err = bcm43xx_pio_init(bcm);
+               }
+               if (err)
+                       goto err_chip_cleanup;
+       }
        bcm43xx_write16(bcm, 0x0612, 0x0050);
        bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0416, 0x0050);
        bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x0414, 0x01F4);
 
-       bcm43xx_mac_enable(bcm);
-       bcm43xx_interrupt_enable(bcm, bcm->irq_savedstate);
+       if (active_wlcore) {
+               if (radio->initial_channel != 0xFF)
+                       bcm43xx_radio_selectchannel(bcm, radio->initial_channel, 0);
+       }
 
-       bcm->current_core->flags |= BCM43xx_COREFLAG_INITIALIZED;
+       /* Don't enable MAC/IRQ here, as it will race with the IRQ handler.
+        * We enable it later.
+        */
+       bcm->current_core->initialized = 1;
 out:
        return err;
 
@@ -3041,14 +3078,9 @@ out:
        return err;
 }
 
-static void bcm43xx_softmac_init(struct bcm43xx_private *bcm)
-{
-       ieee80211softmac_start(bcm->net_dev);
-}
-
 static void bcm43xx_periodic_every120sec(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_phyinfo *phy = bcm->current_core->phy;
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
 
        if (phy->type != BCM43xx_PHYTYPE_G || phy->rev < 2)
                return;
@@ -3076,8 +3108,8 @@ static void bcm43xx_periodic_every30sec(struct bcm43xx_private *bcm)
 
 static void bcm43xx_periodic_every15sec(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_phyinfo *phy = bcm->current_core->phy;
-       struct bcm43xx_radioinfo *radio = bcm->current_core->radio;
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
+       struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
 
        if (phy->type == BCM43xx_PHYTYPE_G) {
                //TODO: update_aci_moving_average
@@ -3106,15 +3138,10 @@ static void bcm43xx_periodic_every15sec(struct bcm43xx_private *bcm)
        //TODO for APHY (temperature?)
 }
 
-static void bcm43xx_periodic_task_handler(unsigned long d)
+static void do_periodic_work(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_private *bcm = (struct bcm43xx_private *)d;
-       unsigned long flags;
        unsigned int state;
 
-       spin_lock_irqsave(&bcm->lock, flags);
-
-       assert(bcm->initialized);
        state = bcm->periodic_state;
        if (state % 8 == 0)
                bcm43xx_periodic_every120sec(bcm);
@@ -3122,30 +3149,106 @@ static void bcm43xx_periodic_task_handler(unsigned long d)
                bcm43xx_periodic_every60sec(bcm);
        if (state % 2 == 0)
                bcm43xx_periodic_every30sec(bcm);
-       bcm43xx_periodic_every15sec(bcm);
+       if (state % 1 == 0)
+               bcm43xx_periodic_every15sec(bcm);
        bcm->periodic_state = state + 1;
 
-       mod_timer(&bcm->periodic_tasks, jiffies + (HZ * 15));
-
-       spin_unlock_irqrestore(&bcm->lock, flags);
+       schedule_delayed_work(&bcm->periodic_work, HZ * 15);
 }
 
-static void bcm43xx_periodic_tasks_delete(struct bcm43xx_private *bcm)
+/* Estimate a "Badness" value based on the periodic work
+ * state-machine state. "Badness" is worse (bigger), if the
+ * periodic work will take longer.
+ */
+static int estimate_periodic_work_badness(unsigned int state)
 {
-       del_timer_sync(&bcm->periodic_tasks);
+       int badness = 0;
+
+       if (state % 8 == 0) /* every 120 sec */
+               badness += 10;
+       if (state % 4 == 0) /* every 60 sec */
+               badness += 5;
+       if (state % 2 == 0) /* every 30 sec */
+               badness += 1;
+       if (state % 1 == 0) /* every 15 sec */
+               badness += 1;
+
+#define BADNESS_LIMIT  4
+       return badness;
 }
 
-static void bcm43xx_periodic_tasks_setup(struct bcm43xx_private *bcm)
+static void bcm43xx_periodic_work_handler(struct work_struct *work)
 {
-       struct timer_list *timer = &(bcm->periodic_tasks);
+       struct bcm43xx_private *bcm =
+               container_of(work, struct bcm43xx_private, periodic_work.work);
+       struct net_device *net_dev = bcm->net_dev;
+       unsigned long flags;
+       u32 savedirqs = 0;
+       int badness;
+       unsigned long orig_trans_start = 0;
+
+       mutex_lock(&bcm->mutex);
+       badness = estimate_periodic_work_badness(bcm->periodic_state);
+       if (badness > BADNESS_LIMIT) {
+               /* Periodic work will take a long time, so we want it to
+                * be preemtible.
+                */
 
-       assert(bcm->initialized);
-       setup_timer(timer,
-                   bcm43xx_periodic_task_handler,
-                   (unsigned long)bcm);
-       timer->expires = jiffies;
-       add_timer(timer);
-}
+               netif_tx_lock_bh(net_dev);
+               /* We must fake a started transmission here, as we are going to
+                * disable TX. If we wouldn't fake a TX, it would be possible to
+                * trigger the netdev watchdog, if the last real TX is already
+                * some time on the past (slightly less than 5secs)
+                */
+               orig_trans_start = net_dev->trans_start;
+               net_dev->trans_start = jiffies;
+               netif_stop_queue(net_dev);
+               netif_tx_unlock_bh(net_dev);
+
+               spin_lock_irqsave(&bcm->irq_lock, flags);
+               bcm43xx_mac_suspend(bcm);
+               if (bcm43xx_using_pio(bcm))
+                       bcm43xx_pio_freeze_txqueues(bcm);
+               savedirqs = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+               spin_unlock_irqrestore(&bcm->irq_lock, flags);
+               bcm43xx_synchronize_irq(bcm);
+       } else {
+               /* Periodic work should take short time, so we want low
+                * locking overhead.
+                */
+               spin_lock_irqsave(&bcm->irq_lock, flags);
+       }
+
+       do_periodic_work(bcm);
+
+       if (badness > BADNESS_LIMIT) {
+               spin_lock_irqsave(&bcm->irq_lock, flags);
+               tasklet_enable(&bcm->isr_tasklet);
+               bcm43xx_interrupt_enable(bcm, savedirqs);
+               if (bcm43xx_using_pio(bcm))
+                       bcm43xx_pio_thaw_txqueues(bcm);
+               bcm43xx_mac_enable(bcm);
+               netif_wake_queue(bcm->net_dev);
+               net_dev->trans_start = orig_trans_start;
+       }
+       mmiowb();
+       spin_unlock_irqrestore(&bcm->irq_lock, flags);
+       mutex_unlock(&bcm->mutex);
+}
+
+void bcm43xx_periodic_tasks_delete(struct bcm43xx_private *bcm)
+{
+       cancel_rearming_delayed_work(&bcm->periodic_work);
+}
+
+void bcm43xx_periodic_tasks_setup(struct bcm43xx_private *bcm)
+{
+       struct delayed_work *work = &bcm->periodic_work;
+
+       assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
+       INIT_DELAYED_WORK(work, bcm43xx_periodic_work_handler);
+       schedule_delayed_work(work, 0);
+}
 
 static void bcm43xx_security_init(struct bcm43xx_private *bcm)
 {
@@ -3154,142 +3257,363 @@ static void bcm43xx_security_init(struct bcm43xx_private *bcm)
        bcm43xx_clear_keys(bcm);
 }
 
-/* This is the opposite of bcm43xx_init_board() */
-static void bcm43xx_free_board(struct bcm43xx_private *bcm)
+static int bcm43xx_rng_read(struct hwrng *rng, u32 *data)
 {
-       int i, err;
+       struct bcm43xx_private *bcm = (struct bcm43xx_private *)rng->priv;
        unsigned long flags;
 
-       bcm43xx_sysfs_unregister(bcm);
+       spin_lock_irqsave(&(bcm)->irq_lock, flags);
+       *data = bcm43xx_read16(bcm, BCM43xx_MMIO_RNG);
+       spin_unlock_irqrestore(&(bcm)->irq_lock, flags);
 
-       bcm43xx_periodic_tasks_delete(bcm);
+       return (sizeof(u16));
+}
 
-       spin_lock_irqsave(&bcm->lock, flags);
-       bcm->initialized = 0;
-       bcm->shutting_down = 1;
-       spin_unlock_irqrestore(&bcm->lock, flags);
+static void bcm43xx_rng_exit(struct bcm43xx_private *bcm)
+{
+       hwrng_unregister(&bcm->rng);
+}
 
-       for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
-               if (!(bcm->core_80211[i].flags & BCM43xx_COREFLAG_AVAILABLE))
+static int bcm43xx_rng_init(struct bcm43xx_private *bcm)
+{
+       int err;
+
+       snprintf(bcm->rng_name, ARRAY_SIZE(bcm->rng_name),
+                "%s_%s", KBUILD_MODNAME, bcm->net_dev->name);
+       bcm->rng.name = bcm->rng_name;
+       bcm->rng.data_read = bcm43xx_rng_read;
+       bcm->rng.priv = (unsigned long)bcm;
+       err = hwrng_register(&bcm->rng);
+       if (err)
+               printk(KERN_ERR PFX "RNG init failed (%d)\n", err);
+
+       return err;
+}
+
+static int bcm43xx_shutdown_all_wireless_cores(struct bcm43xx_private *bcm)
+{
+       int ret = 0;
+       int i, err;
+       struct bcm43xx_coreinfo *core;
+
+       bcm43xx_set_status(bcm, BCM43xx_STAT_SHUTTINGDOWN);
+       for (i = 0; i < bcm->nr_80211_available; i++) {
+               core = &(bcm->core_80211[i]);
+               assert(core->available);
+               if (!core->initialized)
                        continue;
-               if (!(bcm->core_80211[i].flags & BCM43xx_COREFLAG_INITIALIZED))
+               err = bcm43xx_switch_core(bcm, core);
+               if (err) {
+                       dprintk(KERN_ERR PFX "shutdown_all_wireless_cores "
+                                            "switch_core failed (%d)\n", err);
+                       ret = err;
                        continue;
-
-               err = bcm43xx_switch_core(bcm, &bcm->core_80211[i]);
-               assert(err == 0);
+               }
+               bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+               bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON); /* dummy read */
                bcm43xx_wireless_core_cleanup(bcm);
+               if (core == bcm->active_80211_core)
+                       bcm->active_80211_core = NULL;
        }
+       free_irq(bcm->irq, bcm);
+       bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
+
+       return ret;
+}
+
+/* This is the opposite of bcm43xx_init_board() */
+static void bcm43xx_free_board(struct bcm43xx_private *bcm)
+{
+       bcm43xx_rng_exit(bcm);
+       bcm43xx_sysfs_unregister(bcm);
+       bcm43xx_periodic_tasks_delete(bcm);
 
+       mutex_lock(&(bcm)->mutex);
+       bcm43xx_shutdown_all_wireless_cores(bcm);
        bcm43xx_pctl_set_crystal(bcm, 0);
+       mutex_unlock(&(bcm)->mutex);
+}
 
-       spin_lock_irqsave(&bcm->lock, flags);
-       bcm->shutting_down = 0;
-       spin_unlock_irqrestore(&bcm->lock, flags);
+static void prepare_phydata_for_init(struct bcm43xx_phyinfo *phy)
+{
+       phy->antenna_diversity = 0xFFFF;
+       memset(phy->minlowsig, 0xFF, sizeof(phy->minlowsig));
+       memset(phy->minlowsigpos, 0, sizeof(phy->minlowsigpos));
+
+       /* Flags */
+       phy->calibrated = 0;
+       phy->is_locked = 0;
+
+       if (phy->_lo_pairs) {
+               memset(phy->_lo_pairs, 0,
+                      sizeof(struct bcm43xx_lopair) * BCM43xx_LO_COUNT);
+       }
+       memset(phy->loopback_gain, 0, sizeof(phy->loopback_gain));
 }
 
-static int bcm43xx_init_board(struct bcm43xx_private *bcm)
+static void prepare_radiodata_for_init(struct bcm43xx_private *bcm,
+                                      struct bcm43xx_radioinfo *radio)
 {
-       int i, err;
-       int num_80211_cores;
-       int connect_phy;
-       unsigned long flags;
+       int i;
 
-       might_sleep();
+       /* Set default attenuation values. */
+       radio->baseband_atten = bcm43xx_default_baseband_attenuation(bcm);
+       radio->radio_atten = bcm43xx_default_radio_attenuation(bcm);
+       radio->txctl1 = bcm43xx_default_txctl1(bcm);
+       radio->txctl2 = 0xFFFF;
+       radio->txpwr_offset = 0;
+
+       /* NRSSI */
+       radio->nrssislope = 0;
+       for (i = 0; i < ARRAY_SIZE(radio->nrssi); i++)
+               radio->nrssi[i] = -1000;
+       for (i = 0; i < ARRAY_SIZE(radio->nrssi_lt); i++)
+               radio->nrssi_lt[i] = i;
 
-       spin_lock_irqsave(&bcm->lock, flags);
-       bcm->initialized = 0;
-       bcm->shutting_down = 0;
-       spin_unlock_irqrestore(&bcm->lock, flags);
+       radio->lofcal = 0xFFFF;
+       radio->initval = 0xFFFF;
 
-       err = bcm43xx_pctl_set_crystal(bcm, 1);
+       radio->aci_enable = 0;
+       radio->aci_wlan_automatic = 0;
+       radio->aci_hw_rssi = 0;
+}
+
+static void prepare_priv_for_init(struct bcm43xx_private *bcm)
+{
+       int i;
+       struct bcm43xx_coreinfo *core;
+       struct bcm43xx_coreinfo_80211 *wlext;
+
+       assert(!bcm->active_80211_core);
+
+       bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZING);
+
+       /* Flags */
+       bcm->was_initialized = 0;
+       bcm->reg124_set_0x4 = 0;
+
+       /* Stats */
+       memset(&bcm->stats, 0, sizeof(bcm->stats));
+
+       /* Wireless core data */
+       for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
+               core = &(bcm->core_80211[i]);
+               wlext = core->priv;
+
+               if (!core->available)
+                       continue;
+               assert(wlext == &(bcm->core_80211_ext[i]));
+
+               prepare_phydata_for_init(&wlext->phy);
+               prepare_radiodata_for_init(bcm, &wlext->radio);
+       }
+
+       /* IRQ related flags */
+       bcm->irq_reason = 0;
+       memset(bcm->dma_reason, 0, sizeof(bcm->dma_reason));
+       bcm->irq_savedstate = BCM43xx_IRQ_INITIAL;
+
+       bcm->mac_suspended = 1;
+
+       /* Noise calculation context */
+       memset(&bcm->noisecalc, 0, sizeof(bcm->noisecalc));
+
+       /* Periodic work context */
+       bcm->periodic_state = 0;
+}
+
+static int wireless_core_up(struct bcm43xx_private *bcm,
+                           int active_wlcore)
+{
+       int err;
+
+       if (!bcm43xx_core_enabled(bcm))
+               bcm43xx_wireless_core_reset(bcm, 1);
+       if (!active_wlcore)
+               bcm43xx_wireless_core_mark_inactive(bcm);
+       err = bcm43xx_wireless_core_init(bcm, active_wlcore);
        if (err)
                goto out;
-       err = bcm43xx_pctl_init(bcm);
-       if (err)
-               goto err_crystal_off;
-       err = bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_FAST);
-       if (err)
-               goto err_crystal_off;
+       if (!active_wlcore)
+               bcm43xx_radio_turn_off(bcm);
+out:
+       return err;
+}
 
-       tasklet_enable(&bcm->isr_tasklet);
-       num_80211_cores = bcm43xx_num_80211_cores(bcm);
-       for (i = 0; i < num_80211_cores; i++) {
-               err = bcm43xx_switch_core(bcm, &bcm->core_80211[i]);
-               assert(err != -ENODEV);
-               if (err)
-                       goto err_80211_unwind;
+/* Select and enable the "to be used" wireless core.
+ * Locking: bcm->mutex must be aquired before calling this.
+ *          bcm->irq_lock must not be aquired.
+ */
+int bcm43xx_select_wireless_core(struct bcm43xx_private *bcm,
+                                int phytype)
+{
+       int i, err;
+       struct bcm43xx_coreinfo *active_core = NULL;
+       struct bcm43xx_coreinfo_80211 *active_wlext = NULL;
+       struct bcm43xx_coreinfo *core;
+       struct bcm43xx_coreinfo_80211 *wlext;
+       int adjust_active_sbtmstatelow = 0;
 
-               /* Enable the selected wireless core.
-                * Connect PHY only on the first core.
-                */
-               if (!bcm43xx_core_enabled(bcm)) {
-                       if (num_80211_cores == 1) {
-                               connect_phy = bcm->current_core->phy->connected;
-                       } else {
-                               if (i == 0)
-                                       connect_phy = 1;
-                               else
-                                       connect_phy = 0;
-                       }
-                       bcm43xx_wireless_core_reset(bcm, connect_phy);
-               }
+       might_sleep();
 
-               if (i != 0)
-                       bcm43xx_wireless_core_mark_inactive(bcm, &bcm->core_80211[0]);
+       if (phytype < 0) {
+               /* If no phytype is requested, select the first core. */
+               assert(bcm->core_80211[0].available);
+               wlext = bcm->core_80211[0].priv;
+               phytype = wlext->phy.type;
+       }
+       /* Find the requested core. */
+       for (i = 0; i < bcm->nr_80211_available; i++) {
+               core = &(bcm->core_80211[i]);
+               wlext = core->priv;
+               if (wlext->phy.type == phytype) {
+                       active_core = core;
+                       active_wlext = wlext;
+                       break;
+               }
+       }
+       if (!active_core)
+               return -ESRCH; /* No such PHYTYPE on this board. */
 
-               err = bcm43xx_wireless_core_init(bcm);
+       if (bcm->active_80211_core) {
+               /* We already selected a wl core in the past.
+                * So first clean up everything.
+                */
+               dprintk(KERN_INFO PFX "select_wireless_core: cleanup\n");
+               ieee80211softmac_stop(bcm->net_dev);
+               bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZED);
+               err = bcm43xx_disable_interrupts_sync(bcm);
+               assert(!err);
+               tasklet_enable(&bcm->isr_tasklet);
+               err = bcm43xx_shutdown_all_wireless_cores(bcm);
                if (err)
-                       goto err_80211_unwind;
+                       goto error;
+               /* Ok, everything down, continue to re-initialize. */
+               bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZING);
+       }
 
-               if (i != 0) {
-                       bcm43xx_mac_suspend(bcm);
-                       bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
-                       bcm43xx_radio_turn_off(bcm);
+       /* Reset all data structures. */
+       prepare_priv_for_init(bcm);
+
+       err = bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_FAST);
+       if (err)
+               goto error;
+
+       /* Mark all unused cores "inactive". */
+       for (i = 0; i < bcm->nr_80211_available; i++) {
+               core = &(bcm->core_80211[i]);
+               wlext = core->priv;
+
+               if (core == active_core)
+                       continue;
+               err = bcm43xx_switch_core(bcm, core);
+               if (err) {
+                       dprintk(KERN_ERR PFX "Could not switch to inactive "
+                                            "802.11 core (%d)\n", err);
+                       goto error;
+               }
+               err = wireless_core_up(bcm, 0);
+               if (err) {
+                       dprintk(KERN_ERR PFX "core_up for inactive 802.11 core "
+                                            "failed (%d)\n", err);
+                       goto error;
                }
+               adjust_active_sbtmstatelow = 1;
        }
-       bcm->active_80211_core = &bcm->core_80211[0];
-       if (num_80211_cores >= 2) {
-               bcm43xx_switch_core(bcm, &bcm->core_80211[0]);
-               bcm43xx_mac_enable(bcm);
+
+       /* Now initialize the active 802.11 core. */
+       err = bcm43xx_switch_core(bcm, active_core);
+       if (err) {
+               dprintk(KERN_ERR PFX "Could not switch to active "
+                                    "802.11 core (%d)\n", err);
+               goto error;
+       }
+       if (adjust_active_sbtmstatelow &&
+           active_wlext->phy.type == BCM43xx_PHYTYPE_G) {
+               u32 sbtmstatelow;
+
+               sbtmstatelow = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATELOW);
+               sbtmstatelow |= 0x20000000;
+               bcm43xx_write32(bcm, BCM43xx_CIR_SBTMSTATELOW, sbtmstatelow);
        }
+       err = wireless_core_up(bcm, 1);
+       if (err) {
+               dprintk(KERN_ERR PFX "core_up for active 802.11 core "
+                                    "failed (%d)\n", err);
+               goto error;
+       }
+       err = bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_DYNAMIC);
+       if (err)
+               goto error;
+       bcm->active_80211_core = active_core;
+
        bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
        bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_SELF, (u8 *)(bcm->net_dev->dev_addr));
-       dprintk(KERN_INFO PFX "80211 cores initialized\n");
        bcm43xx_security_init(bcm);
-       bcm43xx_softmac_init(bcm);
+       drain_txstatus_queue(bcm);
+       ieee80211softmac_start(bcm->net_dev);
 
-       bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_DYNAMIC);
+       /* Let's go! Be careful after enabling the IRQs.
+        * Don't switch cores, for example.
+        */
+       bcm43xx_mac_enable(bcm);
+       bcm43xx_set_status(bcm, BCM43xx_STAT_INITIALIZED);
+       err = bcm43xx_initialize_irq(bcm);
+       if (err)
+               goto error;
+       bcm43xx_interrupt_enable(bcm, bcm->irq_savedstate);
 
-       if (bcm->current_core->radio->initial_channel != 0xFF) {
-               bcm43xx_mac_suspend(bcm);
-               bcm43xx_radio_selectchannel(bcm, bcm->current_core->radio->initial_channel, 0);
-               bcm43xx_mac_enable(bcm);
-       }
+       dprintk(KERN_INFO PFX "Selected 802.11 core (phytype %d)\n",
+               active_wlext->phy.type);
 
-       /* Initialization of the board is done. Flag it as such. */
-       spin_lock_irqsave(&bcm->lock, flags);
-       bcm->initialized = 1;
-       spin_unlock_irqrestore(&bcm->lock, flags);
+       return 0;
 
+error:
+       bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
+       bcm43xx_pctl_set_clock(bcm, BCM43xx_PCTL_CLK_SLOW);
+       return err;
+}
+
+static int bcm43xx_init_board(struct bcm43xx_private *bcm)
+{
+       int err;
+
+       mutex_lock(&(bcm)->mutex);
+
+       tasklet_enable(&bcm->isr_tasklet);
+       err = bcm43xx_pctl_set_crystal(bcm, 1);
+       if (err)
+               goto err_tasklet;
+       err = bcm43xx_pctl_init(bcm);
+       if (err)
+               goto err_crystal_off;
+       err = bcm43xx_select_wireless_core(bcm, -1);
+       if (err)
+               goto err_crystal_off;
+       err = bcm43xx_sysfs_register(bcm);
+       if (err)
+               goto err_wlshutdown;
+       err = bcm43xx_rng_init(bcm);
+       if (err)
+               goto err_sysfs_unreg;
        bcm43xx_periodic_tasks_setup(bcm);
-       bcm43xx_sysfs_register(bcm);
-       //FIXME: check for bcm43xx_sysfs_register failure. This function is a bit messy regarding unwinding, though...
 
-       assert(err == 0);
+       /*FIXME: This should be handled by softmac instead. */
+       schedule_delayed_work(&bcm->softmac->associnfo.work, 0);
+
 out:
+       mutex_unlock(&(bcm)->mutex);
+
        return err;
 
-err_80211_unwind:
-       tasklet_disable(&bcm->isr_tasklet);
-       /* unwind all 80211 initialization */
-       for (i = 0; i < num_80211_cores; i++) {
-               if (!(bcm->core_80211[i].flags & BCM43xx_COREFLAG_INITIALIZED))
-                       continue;
-               bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
-               bcm43xx_wireless_core_cleanup(bcm);
-       }
+err_sysfs_unreg:
+       bcm43xx_sysfs_unregister(bcm);
+err_wlshutdown:
+       bcm43xx_shutdown_all_wireless_cores(bcm);
 err_crystal_off:
        bcm43xx_pctl_set_crystal(bcm, 0);
+err_tasklet:
+       tasklet_disable(&bcm->isr_tasklet);
        goto out;
 }
 
@@ -3300,22 +3624,21 @@ static void bcm43xx_detach_board(struct bcm43xx_private *bcm)
 
        bcm43xx_chipset_detach(bcm);
        /* Do _not_ access the chip, after it is detached. */
-       iounmap(bcm->mmio_addr);
-       
+       pci_iounmap(pci_dev, bcm->mmio_addr);
        pci_release_regions(pci_dev);
        pci_disable_device(pci_dev);
 
        /* Free allocated structures/fields */
        for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
-               kfree(bcm->phy[i]._lo_pairs);
-               if (bcm->phy[i].dyn_tssi_tbl)
-                       kfree(bcm->phy[i].tssi2dbm);
+               kfree(bcm->core_80211_ext[i].phy._lo_pairs);
+               if (bcm->core_80211_ext[i].phy.dyn_tssi_tbl)
+                       kfree(bcm->core_80211_ext[i].phy.tssi2dbm);
        }
 }      
 
 static int bcm43xx_read_phyinfo(struct bcm43xx_private *bcm)
 {
-       struct bcm43xx_phyinfo *phy = bcm->current_core->phy;
+       struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
        u16 value;
        u8 phy_version;
        u8 phy_type;
@@ -3391,64 +3714,27 @@ static int bcm43xx_attach_board(struct bcm43xx_private *bcm)
        struct net_device *net_dev = bcm->net_dev;
        int err;
        int i;
-       void __iomem *ioaddr;
-       unsigned long mmio_start, mmio_end, mmio_flags, mmio_len;
-       int num_80211_cores;
        u32 coremask;
 
        err = pci_enable_device(pci_dev);
        if (err) {
-               printk(KERN_ERR PFX "unable to wake up pci device (%i)\n", err);
-               err = -ENODEV;
+               printk(KERN_ERR PFX "pci_enable_device() failed\n");
                goto out;
        }
-
-       mmio_start = pci_resource_start(pci_dev, 0);
-       mmio_end = pci_resource_end(pci_dev, 0);
-       mmio_flags = pci_resource_flags(pci_dev, 0);
-       mmio_len = pci_resource_len(pci_dev, 0);
-
-       /* make sure PCI base addr is MMIO */
-       if (!(mmio_flags & IORESOURCE_MEM)) {
-               printk(KERN_ERR PFX
-                      "%s, region #0 not an MMIO resource, aborting\n",
-                      pci_name(pci_dev));
-               err = -ENODEV;
-               goto err_pci_disable;
-       }
-//FIXME: Why is this check disabled for BCM947XX? What is the IO_SIZE there?
-#ifndef CONFIG_BCM947XX
-       if (mmio_len != BCM43xx_IO_SIZE) {
-               printk(KERN_ERR PFX
-                      "%s: invalid PCI mem region size(s), aborting\n",
-                      pci_name(pci_dev));
-               err = -ENODEV;
-               goto err_pci_disable;
-       }
-#endif
-
        err = pci_request_regions(pci_dev, KBUILD_MODNAME);
        if (err) {
-               printk(KERN_ERR PFX
-                      "could not access PCI resources (%i)\n", err);
+               printk(KERN_ERR PFX "pci_request_regions() failed\n");
                goto err_pci_disable;
        }
-
        /* enable PCI bus-mastering */
        pci_set_master(pci_dev);
-
-       /* ioremap MMIO region */
-       ioaddr = ioremap(mmio_start, mmio_len);
-       if (!ioaddr) {
-               printk(KERN_ERR PFX "%s: cannot remap MMIO, aborting\n",
-                      pci_name(pci_dev));
+       bcm->mmio_addr = pci_iomap(pci_dev, 0, ~0UL);
+       if (!bcm->mmio_addr) {
+               printk(KERN_ERR PFX "pci_iomap() failed\n");
                err = -EIO;
                goto err_pci_release;
        }
-
-       net_dev->base_addr = (unsigned long)ioaddr;
-       bcm->mmio_addr = ioaddr;
-       bcm->mmio_len = mmio_len;
+       net_dev->base_addr = (unsigned long)bcm->mmio_addr;
 
        bcm43xx_pci_read_config16(bcm, PCI_SUBSYSTEM_VENDOR_ID,
                                  &bcm->board_vendor);
@@ -3467,11 +3753,9 @@ static int bcm43xx_attach_board(struct bcm43xx_private *bcm)
        if (err)
                goto err_chipset_detach;
        
-       num_80211_cores = bcm43xx_num_80211_cores(bcm);
-
        /* Attach all IO cores to the backplane. */
        coremask = 0;
-       for (i = 0; i < num_80211_cores; i++)
+       for (i = 0; i < bcm->nr_80211_available; i++)
                coremask |= (1 << bcm->core_80211[i].index);
        //FIXME: Also attach some non80211 cores?
        err = bcm43xx_setup_backplane_pci_connection(bcm, coremask);
@@ -3487,7 +3771,7 @@ static int bcm43xx_attach_board(struct bcm43xx_private *bcm)
        if (err)
                goto err_chipset_detach;
 
-       for (i = 0; i < num_80211_cores; i++) {
+       for (i = 0; i < bcm->nr_80211_available; i++) {
                err = bcm43xx_switch_core(bcm, &bcm->core_80211[i]);
                assert(err != -ENODEV);
                if (err)
@@ -3516,16 +3800,17 @@ static int bcm43xx_attach_board(struct bcm43xx_private *bcm)
                        goto err_80211_unwind;
                bcm43xx_wireless_core_disable(bcm);
        }
+       err = bcm43xx_geo_init(bcm);
+       if (err)
+               goto err_80211_unwind;
        bcm43xx_pctl_set_crystal(bcm, 0);
 
        /* Set the MAC address in the networking subsystem */
-       if (bcm->current_core->phy->type == BCM43xx_PHYTYPE_A)
+       if (is_valid_ether_addr(bcm->sprom.et1macaddr))
                memcpy(bcm->net_dev->dev_addr, bcm->sprom.et1macaddr, 6);
        else
                memcpy(bcm->net_dev->dev_addr, bcm->sprom.il0macaddr, 6);
 
-       bcm43xx_geo_init(bcm);
-
        snprintf(bcm->nick, IW_ESSID_MAX_SIZE,
                 "Broadcom %04X", bcm->chip_id);
 
@@ -3535,14 +3820,14 @@ out:
 
 err_80211_unwind:
        for (i = 0; i < BCM43xx_MAX_80211_CORES; i++) {
-               kfree(bcm->phy[i]._lo_pairs);
-               if (bcm->phy[i].dyn_tssi_tbl)
-                       kfree(bcm->phy[i].tssi2dbm);
+               kfree(bcm->core_80211_ext[i].phy._lo_pairs);
+               if (bcm->core_80211_ext[i].phy.dyn_tssi_tbl)
+                       kfree(bcm->core_80211_ext[i].phy.tssi2dbm);
        }
 err_chipset_detach:
        bcm43xx_chipset_detach(bcm);
 err_iounmap:
-       iounmap(bcm->mmio_addr);
+       pci_iounmap(pci_dev, bcm->mmio_addr);
 err_pci_release:
        pci_release_regions(pci_dev);
 err_pci_disable:
@@ -3560,6 +3845,7 @@ static inline int bcm43xx_tx(struct bcm43xx_private *bcm,
                err = bcm43xx_pio_tx(bcm, txb);
        else
                err = bcm43xx_dma_tx(bcm, txb);
+       bcm->net_dev->trans_start = jiffies;
 
        return err;
 }
@@ -3568,13 +3854,21 @@ static void bcm43xx_ieee80211_set_chan(struct net_device *net_dev,
                                       u8 channel)
 {
        struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
+       struct bcm43xx_radioinfo *radio;
        unsigned long flags;
 
-       spin_lock_irqsave(&bcm->lock, flags);
-       bcm43xx_mac_suspend(bcm);
-       bcm43xx_radio_selectchannel(bcm, channel, 0);
-       bcm43xx_mac_enable(bcm);
-       spin_unlock_irqrestore(&bcm->lock, flags);
+       mutex_lock(&bcm->mutex);
+       spin_lock_irqsave(&bcm->irq_lock, flags);
+       if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED) {
+               bcm43xx_mac_suspend(bcm);
+               bcm43xx_radio_selectchannel(bcm, channel, 0);
+               bcm43xx_mac_enable(bcm);
+       } else {
+               radio = bcm43xx_current_radio(bcm);
+               radio->initial_channel = channel;
+       }
+       spin_unlock_irqrestore(&bcm->irq_lock, flags);
+       mutex_unlock(&bcm->mutex);
 }
 
 /* set_security() callback in struct ieee80211_device */
@@ -3586,10 +3880,11 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
        unsigned long flags;
        int keyidx;
        
-       dprintk(KERN_INFO PFX "set security called\n");
-       
-       spin_lock_irqsave(&bcm->lock, flags);
-       
+       dprintk(KERN_INFO PFX "set security called");
+
+       mutex_lock(&bcm->mutex);
+       spin_lock_irqsave(&bcm->irq_lock, flags);
+
        for (keyidx = 0; keyidx<WEP_KEYS; keyidx++)
                if (sec->flags & (1<<keyidx)) {
                        secinfo->encode_alg[keyidx] = sec->encode_alg[keyidx];
@@ -3599,25 +3894,31 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
        
        if (sec->flags & SEC_ACTIVE_KEY) {
                secinfo->active_key = sec->active_key;
-               dprintk(KERN_INFO PFX "   .active_key = %d\n", sec->active_key);
+               dprintk(", .active_key = %d", sec->active_key);
        }
        if (sec->flags & SEC_UNICAST_GROUP) {
                secinfo->unicast_uses_group = sec->unicast_uses_group;
-               dprintk(KERN_INFO PFX "   .unicast_uses_group = %d\n", sec->unicast_uses_group);
+               dprintk(", .unicast_uses_group = %d", sec->unicast_uses_group);
        }
        if (sec->flags & SEC_LEVEL) {
                secinfo->level = sec->level;
-               dprintk(KERN_INFO PFX "   .level = %d\n", sec->level);
+               dprintk(", .level = %d", sec->level);
        }
        if (sec->flags & SEC_ENABLED) {
                secinfo->enabled = sec->enabled;
-               dprintk(KERN_INFO PFX "   .enabled = %d\n", sec->enabled);
+               dprintk(", .enabled = %d", sec->enabled);
        }
        if (sec->flags & SEC_ENCRYPT) {
                secinfo->encrypt = sec->encrypt;
-               dprintk(KERN_INFO PFX "   .encrypt = %d\n", sec->encrypt);
+               dprintk(", .encrypt = %d", sec->encrypt);
        }
-       if (bcm->initialized && !bcm->ieee->host_encrypt) {
+       if (sec->flags & SEC_AUTH_MODE) {
+               secinfo->auth_mode = sec->auth_mode;
+               dprintk(", .auth_mode = %d", sec->auth_mode);
+       }
+       dprintk("\n");
+       if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED &&
+           !bcm->ieee->host_encrypt) {
                if (secinfo->enabled) {
                        /* upload WEP keys to hardware */
                        char null_address[6] = { 0 };
@@ -3651,7 +3952,8 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
                } else
                                bcm43xx_clear_keys(bcm);
        }
-       spin_unlock_irqrestore(&bcm->lock, flags);
+       spin_unlock_irqrestore(&bcm->irq_lock, flags);
+       mutex_unlock(&bcm->mutex);
 }
 
 /* hard_start_xmit() callback in struct ieee80211_device */
@@ -3663,12 +3965,14 @@ static int bcm43xx_ieee80211_hard_start_xmit(struct ieee80211_txb *txb,
        int err = -ENODEV;
        unsigned long flags;
 
-       spin_lock_irqsave(&bcm->lock, flags);
-       if (likely(bcm->initialized))
+       spin_lock_irqsave(&bcm->irq_lock, flags);
+       if (likely(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED))
                err = bcm43xx_tx(bcm, txb);
-       spin_unlock_irqrestore(&bcm->lock, flags);
+       spin_unlock_irqrestore(&bcm->irq_lock, flags);
 
-       return err;
+       if (unlikely(err))
+               return NETDEV_TX_BUSY;
+       return NETDEV_TX_OK;
 }
 
 static struct net_device_stats * bcm43xx_net_get_stats(struct net_device *net_dev)
@@ -3679,8 +3983,11 @@ static struct net_device_stats * bcm43xx_net_get_stats(struct net_device *net_de
 static void bcm43xx_net_tx_timeout(struct net_device *net_dev)
 {
        struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
+       unsigned long flags;
 
+       spin_lock_irqsave(&bcm->irq_lock, flags);
        bcm43xx_controller_restart(bcm, "TX timeout");
+       spin_unlock_irqrestore(&bcm->irq_lock, flags);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -3690,7 +3997,8 @@ static void bcm43xx_net_poll_controller(struct net_device *net_dev)
        unsigned long flags;
 
        local_irq_save(flags);
-       bcm43xx_interrupt_handler(bcm->irq, bcm, NULL);
+       if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED)
+               bcm43xx_interrupt_handler(bcm->irq, bcm);
        local_irq_restore(flags);
 }
 #endif /* CONFIG_NET_POLL_CONTROLLER */
@@ -3705,10 +4013,13 @@ static int bcm43xx_net_open(struct net_device *net_dev)
 static int bcm43xx_net_stop(struct net_device *net_dev)
 {
        struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
+       int err;
 
        ieee80211softmac_stop(net_dev);
-       bcm43xx_disable_interrupts_sync(bcm, NULL);
+       err = bcm43xx_disable_interrupts_sync(bcm);
+       assert(!err);
        bcm43xx_free_board(bcm);
+       flush_scheduled_work();
 
        return 0;
 }
@@ -3717,48 +4028,25 @@ static int bcm43xx_init_private(struct bcm43xx_private *bcm,
                                struct net_device *net_dev,
                                struct pci_dev *pci_dev)
 {
-       int err;
-
+       bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
        bcm->ieee = netdev_priv(net_dev);
        bcm->softmac = ieee80211_priv(net_dev);
        bcm->softmac->set_channel = bcm43xx_ieee80211_set_chan;
 
-#ifdef DEBUG_ENABLE_MMIO_PRINT
-       bcm43xx_mmioprint_initial(bcm, 1);
-#else
-       bcm43xx_mmioprint_initial(bcm, 0);
-#endif
-#ifdef DEBUG_ENABLE_PCILOG
-       bcm43xx_pciprint_initial(bcm, 1);
-#else
-       bcm43xx_pciprint_initial(bcm, 0);
-#endif
-
        bcm->irq_savedstate = BCM43xx_IRQ_INITIAL;
+       bcm->mac_suspended = 1;
        bcm->pci_dev = pci_dev;
        bcm->net_dev = net_dev;
        bcm->bad_frames_preempt = modparam_bad_frames_preempt;
-       spin_lock_init(&bcm->lock);
+       spin_lock_init(&bcm->irq_lock);
+       spin_lock_init(&bcm->leds_lock);
+       mutex_init(&bcm->mutex);
        tasklet_init(&bcm->isr_tasklet,
                     (void (*)(unsigned long))bcm43xx_interrupt_tasklet,
                     (unsigned long)bcm);
        tasklet_disable_nosync(&bcm->isr_tasklet);
-       if (modparam_pio) {
+       if (modparam_pio)
                bcm->__using_pio = 1;
-       } else {
-               err = pci_set_dma_mask(pci_dev, DMA_30BIT_MASK);
-               err |= pci_set_consistent_dma_mask(pci_dev, DMA_30BIT_MASK);
-               if (err) {
-#ifdef CONFIG_BCM43XX_PIO
-                       printk(KERN_WARNING PFX "DMA not supported. Falling back to PIO.\n");
-                       bcm->__using_pio = 1;
-#else
-                       printk(KERN_ERR PFX "FATAL: DMA not supported and PIO not configured. "
-                                           "Recompile the driver with PIO support, please.\n");
-                       return -ENODEV;
-#endif /* CONFIG_BCM43XX_PIO */
-               }
-       }
        bcm->rts_threshold = BCM43xx_DEFAULT_RTS_THRESHOLD;
 
        /* default to sw encryption for now */
@@ -3856,57 +4144,43 @@ static void __devexit bcm43xx_remove_one(struct pci_dev *pdev)
        bcm43xx_debugfs_remove_device(bcm);
        unregister_netdev(net_dev);
        bcm43xx_detach_board(bcm);
-       assert(bcm->ucode == NULL);
        free_ieee80211softmac(net_dev);
 }
 
 /* Hard-reset the chip. Do not call this directly.
  * Use bcm43xx_controller_restart()
  */
-static void bcm43xx_chip_reset(void *_bcm)
+static void bcm43xx_chip_reset(struct work_struct *work)
 {
-       struct bcm43xx_private *bcm = _bcm;
-       struct net_device *net_dev = bcm->net_dev;
-       struct pci_dev *pci_dev = bcm->pci_dev;
-       int err;
-       int was_initialized = bcm->initialized;
-
-       netif_stop_queue(bcm->net_dev);
-       tasklet_disable(&bcm->isr_tasklet);
+       struct bcm43xx_private *bcm =
+               container_of(work, struct bcm43xx_private, restart_work);
+       struct bcm43xx_phyinfo *phy;
+       int err = -ENODEV;
 
-       bcm->firmware_norelease = 1;
-       if (was_initialized)
-               bcm43xx_free_board(bcm);
-       bcm->firmware_norelease = 0;
-       bcm43xx_detach_board(bcm);
-       err = bcm43xx_init_private(bcm, net_dev, pci_dev);
-       if (err)
-               goto failure;
-       err = bcm43xx_attach_board(bcm);
-       if (err)
-               goto failure;
-       if (was_initialized) {
-               err = bcm43xx_init_board(bcm);
-               if (err)
-                       goto failure;
+       mutex_lock(&(bcm)->mutex);
+       if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED) {
+               bcm43xx_periodic_tasks_delete(bcm);
+               phy = bcm43xx_current_phy(bcm);
+               err = bcm43xx_select_wireless_core(bcm, phy->type);
+               if (!err)
+                       bcm43xx_periodic_tasks_setup(bcm);
        }
-       netif_wake_queue(bcm->net_dev);
-       printk(KERN_INFO PFX "Controller restarted\n");
+       mutex_unlock(&(bcm)->mutex);
 
-       return;
-failure:
-       printk(KERN_ERR PFX "Controller restart failed\n");
+       printk(KERN_ERR PFX "Controller restart%s\n",
+              (err == 0) ? "ed" : " failed");
 }
 
 /* Hard-reset the chip.
  * This can be called from interrupt or process context.
- * Make sure to _not_ re-enable device interrupts after this has been called.
-*/
+ * bcm->irq_lock must be locked.
+ */
 void bcm43xx_controller_restart(struct bcm43xx_private *bcm, const char *reason)
 {
-       bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+       if (bcm43xx_status(bcm) != BCM43xx_STAT_INITIALIZED)
+               return;
        printk(KERN_ERR PFX "Controller RESET (%s) ...\n", reason);
-       INIT_WORK(&bcm->restart_work, bcm43xx_chip_reset, bcm);
+       INIT_WORK(&bcm->restart_work, bcm43xx_chip_reset);
        schedule_work(&bcm->restart_work);
 }
 
@@ -3916,21 +4190,16 @@ static int bcm43xx_suspend(struct pci_dev *pdev, pm_message_t state)
 {
        struct net_device *net_dev = pci_get_drvdata(pdev);
        struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
-       unsigned long flags;
-       int try_to_shutdown = 0, err;
+       int err;
 
        dprintk(KERN_INFO PFX "Suspending...\n");
 
-       spin_lock_irqsave(&bcm->lock, flags);
-       bcm->was_initialized = bcm->initialized;
-       if (bcm->initialized)
-               try_to_shutdown = 1;
-       spin_unlock_irqrestore(&bcm->lock, flags);
-
        netif_device_detach(net_dev);
-       if (try_to_shutdown) {
+       bcm->was_initialized = 0;
+       if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED) {
+               bcm->was_initialized = 1;
                ieee80211softmac_stop(net_dev);
-               err = bcm43xx_disable_interrupts_sync(bcm, &bcm->irq_savedstate);
+               err = bcm43xx_disable_interrupts_sync(bcm);
                if (unlikely(err)) {
                        dprintk(KERN_ERR PFX "Suspend failed.\n");
                        return -EAGAIN;
@@ -3959,23 +4228,21 @@ static int bcm43xx_resume(struct pci_dev *pdev)
        dprintk(KERN_INFO PFX "Resuming...\n");
 
        pci_set_power_state(pdev, 0);
-       pci_enable_device(pdev);
+       err = pci_enable_device(pdev);
+       if (err) {
+               printk(KERN_ERR PFX "Failure with pci_enable_device!\n");
+               return err;
+       }
        pci_restore_state(pdev);
 
        bcm43xx_chipset_attach(bcm);
-       if (bcm->was_initialized) {
-               bcm->irq_savedstate = BCM43xx_IRQ_INITIAL;
+       if (bcm->was_initialized)
                err = bcm43xx_init_board(bcm);
-       }
        if (err) {
                printk(KERN_ERR PFX "Resume failed!\n");
                return err;
        }
-
        netif_device_attach(net_dev);
-       
-       /*FIXME: This should be handled by softmac instead. */
-       schedule_work(&bcm->softmac->associnfo.work);
 
        dprintk(KERN_INFO PFX "Device resumed.\n");
 
@@ -4010,5 +4277,3 @@ static void __exit bcm43xx_exit(void)
 
 module_init(bcm43xx_init)
 module_exit(bcm43xx_exit)
-
-/* vim: set ts=8 sw=8 sts=8: */