sys/dev/bwn/if_bwn.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   3  *
   4  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   5  * Copyright (c) 2016 Landon Fuller <landonf@FreeBSD.org>
   6  * Copyright (c) 2017 The FreeBSD Foundation
   7  * All rights reserved.
   8  *
   9  * Portions of this software were developed by Landon Fuller
  10  * under sponsorship from the FreeBSD Foundation.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer,
  17  *    without modification.
  18  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  19  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  20  *    redistribution must be conditioned upon including a substantially
  21  *    similar Disclaimer requirement for further binary redistribution.
  22  *
  23  * NO WARRANTY
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  34  * THE POSSIBILITY OF SUCH DAMAGES.
  35  */
  36
  37 #include <sys/cdefs.h>
  38 __FBSDID("$FreeBSD$");
  39
  40 /*
  41  * The Broadcom Wireless LAN controller driver.
  42  */
  43
  44 #include "opt_bwn.h"
  45 #include "opt_wlan.h"
  46
  47 #include <sys/param.h>
  48 #include <sys/systm.h>
  49 #include <sys/kernel.h>
  50 #include <sys/gpio.h>
  51 #include <sys/malloc.h>
  52 #include <sys/module.h>
  53 #include <sys/endian.h>
  54 #include <sys/errno.h>
  55 #include <sys/firmware.h>
  56 #include <sys/lock.h>
  57 #include <sys/mutex.h>
  58 #include <machine/bus.h>
  59 #include <machine/resource.h>
  60 #include <sys/bus.h>
  61 #include <sys/rman.h>
  62 #include <sys/socket.h>
  63 #include <sys/sockio.h>
  64
  65 #include <net/ethernet.h>
  66 #include <net/if.h>
  67 #include <net/if_var.h>
  68 #include <net/if_arp.h>
  69 #include <net/if_dl.h>
  70 #include <net/if_llc.h>
  71 #include <net/if_media.h>
  72 #include <net/if_types.h>
  73
  74 #include <net80211/ieee80211_var.h>
  75 #include <net80211/ieee80211_radiotap.h>
  76 #include <net80211/ieee80211_regdomain.h>
  77 #include <net80211/ieee80211_phy.h>
  78 #include <net80211/ieee80211_ratectl.h>
  79
  80 #include <dev/bhnd/bhnd.h>
  81 #include <dev/bhnd/bhnd_ids.h>
  82
  83 #include <dev/bhnd/cores/chipc/chipc.h>
  84 #include <dev/bhnd/cores/pmu/bhnd_pmu.h>
  85
  86 #include <dev/bwn/if_bwnreg.h>
  87 #include <dev/bwn/if_bwnvar.h>
  88
  89 #include <dev/bwn/if_bwn_debug.h>
  90 #include <dev/bwn/if_bwn_misc.h>
  91 #include <dev/bwn/if_bwn_util.h>
  92 #include <dev/bwn/if_bwn_phy_common.h>
  93 #include <dev/bwn/if_bwn_phy_g.h>
  94 #include <dev/bwn/if_bwn_phy_lp.h>
  95 #include <dev/bwn/if_bwn_phy_n.h>
  96
  97 #include "bhnd_nvram_map.h"
  98
  99 #include "gpio_if.h"
 100
 101 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
 102     "Broadcom driver parameters");
 103
 104 /*
 105  * Tunable & sysctl variables.
 106  */
 107
 108 #ifdef BWN_DEBUG
 109 static  int bwn_debug = 0;
 110 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
 111     "Broadcom debugging printfs");
 112 #endif
 113
 114 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
 115 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
 116     "uses Bad Frames Preemption");
 117 static int      bwn_bluetooth = 1;
 118 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 119     "turns on Bluetooth Coexistence");
 120 static int      bwn_hwpctl = 0;
 121 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 122     "uses H/W power control");
 123 static int      bwn_usedma = 1;
 124 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 125     "uses DMA");
 126 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 127 static int      bwn_wme = 1;
 128 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 129     "uses WME support");
 130
 131 static void     bwn_attach_pre(struct bwn_softc *);
 132 static int      bwn_attach_post(struct bwn_softc *);
 133 static int      bwn_retain_bus_providers(struct bwn_softc *sc);
 134 static void     bwn_release_bus_providers(struct bwn_softc *sc);
 135 static void     bwn_sprom_bugfixes(device_t);
 136 static int      bwn_init(struct bwn_softc *);
 137 static void     bwn_parent(struct ieee80211com *);
 138 static void     bwn_start(struct bwn_softc *);
 139 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 140 static int      bwn_attach_core(struct bwn_mac *);
 141 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 142 static int      bwn_chiptest(struct bwn_mac *);
 143 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 144 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 145                     uint16_t);
 146 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 147                     const struct bwn_channelinfo *, const uint8_t []);
 148 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 149                     const struct ieee80211_bpf_params *);
 150 static void     bwn_updateslot(struct ieee80211com *);
 151 static void     bwn_update_promisc(struct ieee80211com *);
 152 static void     bwn_wme_init(struct bwn_mac *);
 153 static int      bwn_wme_update(struct ieee80211com *);
 154 static void     bwn_wme_clear(struct bwn_softc *);
 155 static void     bwn_wme_load(struct bwn_mac *);
 156 static void     bwn_wme_loadparams(struct bwn_mac *,
 157                     const struct wmeParams *, uint16_t);
 158 static void     bwn_scan_start(struct ieee80211com *);
 159 static void     bwn_scan_end(struct ieee80211com *);
 160 static void     bwn_set_channel(struct ieee80211com *);
 161 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 162                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 163                     const uint8_t [IEEE80211_ADDR_LEN],
 164                     const uint8_t [IEEE80211_ADDR_LEN]);
 165 static void     bwn_vap_delete(struct ieee80211vap *);
 166 static void     bwn_stop(struct bwn_softc *);
 167 static int      bwn_core_forceclk(struct bwn_mac *, bool);
 168 static int      bwn_core_init(struct bwn_mac *);
 169 static void     bwn_core_start(struct bwn_mac *);
 170 static void     bwn_core_exit(struct bwn_mac *);
 171 static void     bwn_bt_disable(struct bwn_mac *);
 172 static int      bwn_chip_init(struct bwn_mac *);
 173 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 174 static void     bwn_rate_init(struct bwn_mac *);
 175 static void     bwn_set_phytxctl(struct bwn_mac *);
 176 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 177 static void     bwn_bt_enable(struct bwn_mac *);
 178 static void     bwn_set_macaddr(struct bwn_mac *);
 179 static void     bwn_crypt_init(struct bwn_mac *);
 180 static void     bwn_chip_exit(struct bwn_mac *);
 181 static int      bwn_fw_fillinfo(struct bwn_mac *);
 182 static int      bwn_fw_loaducode(struct bwn_mac *);
 183 static int      bwn_gpio_init(struct bwn_mac *);
 184 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 185 static int      bwn_phy_init(struct bwn_mac *);
 186 static void     bwn_set_txantenna(struct bwn_mac *, int);
 187 static void     bwn_set_opmode(struct bwn_mac *);
 188 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 189 static uint8_t  bwn_plcp_getcck(const uint8_t);
 190 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 191 static void     bwn_pio_init(struct bwn_mac *);
 192 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 193 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 194                     int);
 195 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 196                     struct bwn_pio_rxqueue *, int);
 197 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 198 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 199                     uint16_t);
 200 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 201 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 202 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 203 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 204                     const struct bwn_txstatus *);
 205 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 206 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 207 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 208                     uint16_t);
 209 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 210                     uint32_t);
 211 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 212                     struct mbuf **);
 213 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 214 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 215                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 216 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 217                     uint16_t, uint32_t);
 218 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 219                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 220 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 221                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 222 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 223                     uint16_t, struct bwn_pio_txpkt **);
 224 static void     bwn_dma_init(struct bwn_mac *);
 225 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 226 static uint16_t bwn_dma_base(int, int);
 227 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 228 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 229                     int, struct bwn_dmadesc_generic **,
 230                     struct bwn_dmadesc_meta **);
 231 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 232                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 233                     int, int);
 234 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 235 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 236 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 237 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 238 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 239 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 240                     int, struct bwn_dmadesc_generic **,
 241                     struct bwn_dmadesc_meta **);
 242 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 243                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 244                     int, int);
 245 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 246 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 247 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 248 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 249 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 250 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 251 static void     bwn_dma_setup(struct bwn_dma_ring *);
 252 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 253 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 254 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 255 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 256 static void     bwn_dma_rx(struct bwn_dma_ring *);
 257 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 258 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 259                     struct bwn_dmadesc_meta *);
 260 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 261 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 262 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 263 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 264 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 265 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 266                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 267                     int);
 268 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 269                     bus_size_t, int);
 270 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 271 static void     bwn_ratectl_tx_complete(const struct ieee80211_node *,
 272                     const struct bwn_txstatus *);
 273 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 274                     const struct bwn_txstatus *);
 275 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 276                     struct mbuf **);
 277 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 278 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 279                     uint8_t);
 280 static int      bwn_dma_attach(struct bwn_mac *);
 281 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 282                     int, int);
 283 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 284                     const struct bwn_txstatus *, uint16_t, int *);
 285 static void     bwn_dma_free(struct bwn_mac *);
 286 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 287 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 288                     const char *, struct bwn_fwfile *);
 289 static void     bwn_release_firmware(struct bwn_mac *);
 290 static void     bwn_do_release_fw(struct bwn_fwfile *);
 291 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 292 static int      bwn_fwinitvals_write(struct bwn_mac *,
 293                     const struct bwn_fwinitvals *, size_t, size_t);
 294 static uint16_t bwn_ant2phy(int);
 295 static void     bwn_mac_write_bssid(struct bwn_mac *);
 296 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 297                     const uint8_t *);
 298 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 299                     const uint8_t *, size_t, const uint8_t *);
 300 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 301                     const uint8_t *);
 302 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 303                     const uint8_t *);
 304 static void     bwn_phy_exit(struct bwn_mac *);
 305 static void     bwn_core_stop(struct bwn_mac *);
 306 static int      bwn_switch_band(struct bwn_softc *,
 307                     struct ieee80211_channel *);
 308 static int      bwn_phy_reset(struct bwn_mac *);
 309 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 310 static void     bwn_set_pretbtt(struct bwn_mac *);
 311 static int      bwn_intr(void *);
 312 static void     bwn_intrtask(void *, int);
 313 static void     bwn_restart(struct bwn_mac *, const char *);
 314 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 315 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 316 static void     bwn_intr_atim_end(struct bwn_mac *);
 317 static void     bwn_intr_beacon(struct bwn_mac *);
 318 static void     bwn_intr_pmq(struct bwn_mac *);
 319 static void     bwn_intr_noise(struct bwn_mac *);
 320 static void     bwn_intr_txeof(struct bwn_mac *);
 321 static void     bwn_hwreset(void *, int);
 322 static void     bwn_handle_fwpanic(struct bwn_mac *);
 323 static void     bwn_load_beacon0(struct bwn_mac *);
 324 static void     bwn_load_beacon1(struct bwn_mac *);
 325 static uint32_t bwn_jssi_read(struct bwn_mac *);
 326 static void     bwn_noise_gensample(struct bwn_mac *);
 327 static void     bwn_handle_txeof(struct bwn_mac *,
 328                     const struct bwn_txstatus *);
 329 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 330 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 331 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 332                     struct mbuf *);
 333 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 334 static int      bwn_set_txhdr(struct bwn_mac *,
 335                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 336                     uint16_t);
 337 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 338                     const uint8_t);
 339 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 340 static uint8_t  bwn_get_fbrate(uint8_t);
 341 static void     bwn_txpwr(void *, int);
 342 static void     bwn_tasks(void *);
 343 static void     bwn_task_15s(struct bwn_mac *);
 344 static void     bwn_task_30s(struct bwn_mac *);
 345 static void     bwn_task_60s(struct bwn_mac *);
 346 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 347                     uint8_t);
 348 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 349 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 350                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 351                     int, int);
 352 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 353 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 354 static void     bwn_watchdog(void *);
 355 static void     bwn_dma_stop(struct bwn_mac *);
 356 static void     bwn_pio_stop(struct bwn_mac *);
 357 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 358 static int      bwn_led_attach(struct bwn_mac *);
 359 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 360 static void     bwn_led_event(struct bwn_mac *, int);
 361 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 362 static void     bwn_led_blink_next(void *);
 363 static void     bwn_led_blink_end(void *);
 364 static void     bwn_rfswitch(void *);
 365 static void     bwn_rf_turnon(struct bwn_mac *);
 366 static void     bwn_rf_turnoff(struct bwn_mac *);
 367 static void     bwn_sysctl_node(struct bwn_softc *);
 368
 369 static const struct bwn_channelinfo bwn_chantable_bg = {
 370         .channels = {
 371                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 372                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 373                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 374                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 375                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 376         .nchannels = 14
 377 };
 378
 379 static const struct bwn_channelinfo bwn_chantable_a = {
 380         .channels = {
 381                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 382                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 383                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 384                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 385                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 386                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 387                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 388                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 389                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 390                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 391                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 392                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 393                 { 6080, 216, 30 } },
 394         .nchannels = 37
 395 };
 396
 397 #if 0
 398 static const struct bwn_channelinfo bwn_chantable_n = {
 399         .channels = {
 400                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 401                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 402                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 403                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 404                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 405                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 406                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 407                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 408                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 409                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 410                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 411                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 412                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 413                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 414                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 415                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 416                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 417                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 418                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 419                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 420                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 421                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 422                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 423                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 424                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 425                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 426                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 427                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 428                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 429                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 430                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 431                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 432                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 433                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 434                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 435                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 436                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 437         .nchannels = 110
 438 };
 439 #endif
 440
 441 #define VENDOR_LED_ACT(vendor)                          \
 442 {                                                       \
 443         .vid = PCI_VENDOR_##vendor,                     \
 444         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 445 }
 446
 447 static const struct {
 448         uint16_t        vid;
 449         uint8_t         led_act[BWN_LED_MAX];
 450 } bwn_vendor_led_act[] = {
 451         VENDOR_LED_ACT(HP_COMPAQ),
 452         VENDOR_LED_ACT(ASUSTEK)
 453 };
 454
 455 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 456         { BWN_VENDOR_LED_ACT_DEFAULT };
 457
 458 #undef VENDOR_LED_ACT
 459
 460 static const char *bwn_led_vars[] = {
 461         BHND_NVAR_LEDBH0,
 462         BHND_NVAR_LEDBH1,
 463         BHND_NVAR_LEDBH2,
 464         BHND_NVAR_LEDBH3
 465 };
 466
 467 static const struct {
 468         int             on_dur;
 469         int             off_dur;
 470 } bwn_led_duration[109] = {
 471         [0]     = { 400, 100 },
 472         [2]     = { 150, 75 },
 473         [4]     = { 90, 45 },
 474         [11]    = { 66, 34 },
 475         [12]    = { 53, 26 },
 476         [18]    = { 42, 21 },
 477         [22]    = { 35, 17 },
 478         [24]    = { 32, 16 },
 479         [36]    = { 21, 10 },
 480         [48]    = { 16, 8 },
 481         [72]    = { 11, 5 },
 482         [96]    = { 9, 4 },
 483         [108]   = { 7, 3 }
 484 };
 485
 486 static const uint16_t bwn_wme_shm_offsets[] = {
 487         [0] = BWN_WME_BESTEFFORT,
 488         [1] = BWN_WME_BACKGROUND,
 489         [2] = BWN_WME_VOICE,
 490         [3] = BWN_WME_VIDEO,
 491 };
 492
 493 /* Supported D11 core revisions */
 494 #define BWN_DEV(_hwrev) {{                                      \
 495         BHND_MATCH_CORE(BHND_MFGID_BCM, BHND_COREID_D11),       \
 496         BHND_MATCH_CORE_REV(_hwrev),                            \
 497 }}
 498 static const struct bhnd_device bwn_devices[] = {
 499         BWN_DEV(HWREV_RANGE(5, 16)),
 500         BWN_DEV(HWREV_EQ(23)),
 501         BHND_DEVICE_END
 502 };
 503
 504 /* D11 quirks when bridged via a PCI host bridge core */
 505 static const struct bhnd_device_quirk pci_bridge_quirks[] = {
 506         BHND_CORE_QUIRK (HWREV_LTE(10), BWN_QUIRK_UCODE_SLOWCLOCK_WAR),
 507         BHND_DEVICE_QUIRK_END
 508 };
 509
 510 /* D11 quirks when bridged via a PCMCIA host bridge core */
 511 static const struct bhnd_device_quirk pcmcia_bridge_quirks[] = {
 512         BHND_CORE_QUIRK (HWREV_ANY,     BWN_QUIRK_NODMA),
 513         BHND_DEVICE_QUIRK_END
 514 };
 515
 516 /* Host bridge cores for which D11 quirk flags should be applied */
 517 static const struct bhnd_device bridge_devices[] = {
 518         BHND_DEVICE(BCM, PCI,           NULL, pci_bridge_quirks),
 519         BHND_DEVICE(BCM, PCMCIA,        NULL, pcmcia_bridge_quirks),
 520         BHND_DEVICE_END
 521 };
 522
 523 static int
 524 bwn_probe(device_t dev)
 525 {
 526         const struct bhnd_device *id;
 527
 528         id = bhnd_device_lookup(dev, bwn_devices, sizeof(bwn_devices[0]));
 529         if (id == NULL)
 530                 return (ENXIO);
 531
 532         bhnd_set_default_core_desc(dev);
 533         return (BUS_PROBE_DEFAULT);
 534 }
 535
 536 static int
 537 bwn_attach(device_t dev)
 538 {
 539         struct bwn_mac          *mac;
 540         struct bwn_softc        *sc;
 541         device_t                 parent, hostb;
 542         char                     chip_name[BHND_CHIPID_MAX_NAMELEN];
 543         int                      error;
 544
 545         sc = device_get_softc(dev);
 546         sc->sc_dev = dev;
 547 #ifdef BWN_DEBUG
 548         sc->sc_debug = bwn_debug;
 549 #endif
 550
 551         mac = NULL;
 552
 553         /* Determine the driver quirks applicable to this device, including any
 554          * quirks specific to the bus host bridge core (if any) */
 555         sc->sc_quirks = bhnd_device_quirks(dev, bwn_devices,
 556             sizeof(bwn_devices[0]));
 557
 558         parent = device_get_parent(dev);
 559         if ((hostb = bhnd_bus_find_hostb_device(parent)) != NULL) {
 560                 sc->sc_quirks |= bhnd_device_quirks(hostb, bridge_devices,
 561                     sizeof(bridge_devices[0]));
 562         }
 563
 564         /* DMA explicitly disabled? */
 565         if (!bwn_usedma)
 566                 sc->sc_quirks |= BWN_QUIRK_NODMA;
 567
 568         /* Fetch our chip identification and board info */
 569         sc->sc_cid = *bhnd_get_chipid(dev);
 570         if ((error = bhnd_read_board_info(dev, &sc->sc_board_info))) {
 571                 device_printf(sc->sc_dev, "couldn't read board info\n");
 572                 return (error);
 573         }
 574
 575         /* Allocate our D11 register block and PMU state */
 576         sc->sc_mem_rid = 0;
 577         sc->sc_mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 578             &sc->sc_mem_rid, RF_ACTIVE);
 579         if (sc->sc_mem_res == NULL) {
 580                 device_printf(sc->sc_dev, "couldn't allocate registers\n");
 581                 return (error);
 582         }
 583
 584         if ((error = bhnd_alloc_pmu(sc->sc_dev))) {
 585                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
 586                     sc->sc_mem_rid, sc->sc_mem_res);
 587                 return (error);
 588         }
 589
 590         /* Retain references to all required bus service providers */
 591         if ((error = bwn_retain_bus_providers(sc)))
 592                 goto fail;
 593
 594         /* Fetch mask of available antennas */
 595         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA2G,
 596             &sc->sc_ant2g);
 597         if (error) {
 598                 device_printf(sc->sc_dev, "error determining 2GHz antenna "
 599                     "availability from NVRAM: %d\n", error);
 600                 goto fail;
 601         }
 602
 603         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA5G,
 604             &sc->sc_ant5g);
 605         if (error) {
 606                 device_printf(sc->sc_dev, "error determining 5GHz antenna "
 607                     "availability from NVRAM: %d\n", error);
 608                 goto fail;
 609         }
 610
 611         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 612                 bwn_attach_pre(sc);
 613                 bwn_sprom_bugfixes(dev);
 614                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 615         }
 616
 617         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 618         mac->mac_sc = sc;
 619         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 620         if (bwn_bfp != 0)
 621                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 622
 623         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 624         NET_TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 625         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 626
 627         error = bwn_attach_core(mac);
 628         if (error)
 629                 goto fail;
 630         error = bwn_led_attach(mac);
 631         if (error)
 632                 goto fail;
 633
 634         bhnd_format_chip_id(chip_name, sizeof(chip_name), sc->sc_cid.chip_id);
 635         device_printf(sc->sc_dev, "WLAN (%s rev %u sromrev %u) "
 636             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 637             chip_name, bhnd_get_hwrev(sc->sc_dev),
 638             sc->sc_board_info.board_srom_rev, mac->mac_phy.analog,
 639             mac->mac_phy.type, mac->mac_phy.rev, mac->mac_phy.rf_manuf,
 640             mac->mac_phy.rf_ver, mac->mac_phy.rf_rev);
 641         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 642                 device_printf(sc->sc_dev, "DMA (%d bits)\n", mac->mac_dmatype);
 643         else
 644                 device_printf(sc->sc_dev, "PIO\n");
 645
 646 #ifdef  BWN_GPL_PHY
 647         device_printf(sc->sc_dev,
 648             "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
 649 #endif
 650
 651         mac->mac_rid_irq = 0;
 652         mac->mac_res_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 653             &mac->mac_rid_irq, RF_ACTIVE | RF_SHAREABLE);
 654
 655         if (mac->mac_res_irq == NULL) {
 656                 device_printf(sc->sc_dev, "couldn't allocate IRQ resource\n");
 657                 error = ENXIO;
 658                 goto fail;
 659         }
 660
 661         error = bus_setup_intr(dev, mac->mac_res_irq,
 662             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 663             &mac->mac_intrhand);
 664         if (error != 0) {
 665                 device_printf(sc->sc_dev, "couldn't setup interrupt (%d)\n",
 666                     error);
 667                 goto fail;
 668         }
 669
 670         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 671
 672         /*
 673          * calls attach-post routine
 674          */
 675         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 676                 bwn_attach_post(sc);
 677
 678         return (0);
 679 fail:
 680         if (mac != NULL && mac->mac_res_irq != NULL) {
 681                 bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
 682                     mac->mac_res_irq);
 683         }
 684
 685         free(mac, M_DEVBUF);
 686         bhnd_release_pmu(dev);
 687         bwn_release_bus_providers(sc);
 688
 689         if (sc->sc_mem_res != NULL) {
 690                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
 691                     sc->sc_mem_rid, sc->sc_mem_res);
 692         }
 693
 694         return (error);
 695 }
 696
 697 static int
 698 bwn_retain_bus_providers(struct bwn_softc *sc)
 699 {
 700         struct chipc_caps *ccaps;
 701
 702         sc->sc_chipc = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_CHIPC);
 703         if (sc->sc_chipc == NULL) {
 704                 device_printf(sc->sc_dev, "ChipCommon device not found\n");
 705                 goto failed;
 706         }
 707
 708         ccaps = BHND_CHIPC_GET_CAPS(sc->sc_chipc);
 709
 710         sc->sc_gpio = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_GPIO);
 711         if (sc->sc_gpio == NULL) {
 712                 device_printf(sc->sc_dev, "GPIO device not found\n");
 713                 goto failed;
 714         }
 715
 716         if (ccaps->pmu) {
 717                 sc->sc_pmu = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_PMU);
 718                 if (sc->sc_pmu == NULL) {
 719                         device_printf(sc->sc_dev, "PMU device not found\n");
 720                         goto failed;
 721                 }
 722         }
 723
 724         return (0);
 725
 726 failed:
 727         bwn_release_bus_providers(sc);
 728         return (ENXIO);
 729 }
 730
 731 static void
 732 bwn_release_bus_providers(struct bwn_softc *sc)
 733 {
 734 #define BWN_RELEASE_PROV(_sc, _prov, _service)  do {                    \
 735         if ((_sc)-> _prov != NULL) {                                    \
 736                 bhnd_release_provider((_sc)->sc_dev, (_sc)-> _prov,     \
 737                     (_service));                                        \
 738                 (_sc)-> _prov = NULL;                                   \
 739         }                                                               \
 740 } while (0)
 741
 742         BWN_RELEASE_PROV(sc, sc_chipc, BHND_SERVICE_CHIPC);
 743         BWN_RELEASE_PROV(sc, sc_gpio, BHND_SERVICE_GPIO);
 744         BWN_RELEASE_PROV(sc, sc_pmu, BHND_SERVICE_PMU);
 745
 746 #undef  BWN_RELEASE_PROV
 747 }
 748
 749 static int
 750 bwn_attach_post(struct bwn_softc *sc)
 751 {
 752         struct ieee80211com     *ic;
 753         const char              *mac_varname;
 754         u_int                    core_unit;
 755         int                      error;
 756
 757         ic = &sc->sc_ic;
 758
 759         ic->ic_softc = sc;
 760         ic->ic_name = device_get_nameunit(sc->sc_dev);
 761         /* XXX not right but it's not used anywhere important */
 762         ic->ic_phytype = IEEE80211_T_OFDM;
 763         ic->ic_opmode = IEEE80211_M_STA;
 764         ic->ic_caps =
 765                   IEEE80211_C_STA               /* station mode supported */
 766                 | IEEE80211_C_MONITOR           /* monitor mode */
 767                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 768                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 769                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 770                 | IEEE80211_C_WME               /* WME/WMM supported */
 771                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 772 #if 0
 773                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 774 #endif
 775                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 776                 ;
 777
 778         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 779
 780         /* Determine the NVRAM variable containing our MAC address */
 781         core_unit = bhnd_get_core_unit(sc->sc_dev);
 782         mac_varname = NULL;
 783         if (sc->sc_board_info.board_srom_rev <= 2) {
 784                 if (core_unit == 0) {
 785                         mac_varname = BHND_NVAR_IL0MACADDR;
 786                 } else if (core_unit == 1) {
 787                         mac_varname = BHND_NVAR_ET1MACADDR;
 788                 }
 789         } else {
 790                 if (core_unit == 0) {
 791                         mac_varname = BHND_NVAR_MACADDR;
 792                 }
 793         }
 794
 795         if (mac_varname == NULL) {
 796                 device_printf(sc->sc_dev, "missing MAC address variable for "
 797                     "D11 core %u", core_unit);
 798                 return (ENXIO);
 799         }
 800
 801         /* Read the MAC address from NVRAM */
 802         error = bhnd_nvram_getvar_array(sc->sc_dev, mac_varname, ic->ic_macaddr,
 803             sizeof(ic->ic_macaddr), BHND_NVRAM_TYPE_UINT8_ARRAY);
 804         if (error) {
 805                 device_printf(sc->sc_dev, "error reading %s: %d\n", mac_varname,
 806                     error);
 807                 return (error);
 808         }
 809
 810         /* call MI attach routine. */
 811         ieee80211_ifattach(ic);
 812
 813         ic->ic_headroom = sizeof(struct bwn_txhdr);
 814
 815         /* override default methods */
 816         ic->ic_raw_xmit = bwn_raw_xmit;
 817         ic->ic_updateslot = bwn_updateslot;
 818         ic->ic_update_promisc = bwn_update_promisc;
 819         ic->ic_wme.wme_update = bwn_wme_update;
 820         ic->ic_scan_start = bwn_scan_start;
 821         ic->ic_scan_end = bwn_scan_end;
 822         ic->ic_set_channel = bwn_set_channel;
 823         ic->ic_vap_create = bwn_vap_create;
 824         ic->ic_vap_delete = bwn_vap_delete;
 825         ic->ic_transmit = bwn_transmit;
 826         ic->ic_parent = bwn_parent;
 827
 828         ieee80211_radiotap_attach(ic,
 829             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 830             BWN_TX_RADIOTAP_PRESENT,
 831             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 832             BWN_RX_RADIOTAP_PRESENT);
 833
 834         bwn_sysctl_node(sc);
 835
 836         if (bootverbose)
 837                 ieee80211_announce(ic);
 838         return (0);
 839 }
 840
 841 static void
 842 bwn_phy_detach(struct bwn_mac *mac)
 843 {
 844
 845         if (mac->mac_phy.detach != NULL)
 846                 mac->mac_phy.detach(mac);
 847 }
 848
 849 static int
 850 bwn_detach(device_t dev)
 851 {
 852         struct bwn_softc *sc = device_get_softc(dev);
 853         struct bwn_mac *mac = sc->sc_curmac;
 854         struct ieee80211com *ic = &sc->sc_ic;
 855
 856         sc->sc_flags |= BWN_FLAG_INVALID;
 857
 858         if (device_is_attached(sc->sc_dev)) {
 859                 BWN_LOCK(sc);
 860                 bwn_stop(sc);
 861                 BWN_UNLOCK(sc);
 862                 bwn_dma_free(mac);
 863                 callout_drain(&sc->sc_led_blink_ch);
 864                 callout_drain(&sc->sc_rfswitch_ch);
 865                 callout_drain(&sc->sc_task_ch);
 866                 callout_drain(&sc->sc_watchdog_ch);
 867                 bwn_phy_detach(mac);
 868                 ieee80211_draintask(ic, &mac->mac_hwreset);
 869                 ieee80211_draintask(ic, &mac->mac_txpower);
 870                 ieee80211_ifdetach(ic);
 871         }
 872         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 873         taskqueue_free(sc->sc_tq);
 874
 875         if (mac->mac_intrhand != NULL) {
 876                 bus_teardown_intr(dev, mac->mac_res_irq, mac->mac_intrhand);
 877                 mac->mac_intrhand = NULL;
 878         }
 879
 880         bhnd_release_pmu(dev);
 881         bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_mem_rid,
 882             sc->sc_mem_res);
 883         bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
 884             mac->mac_res_irq);
 885         mbufq_drain(&sc->sc_snd);
 886         bwn_release_firmware(mac);
 887         BWN_LOCK_DESTROY(sc);
 888
 889         bwn_release_bus_providers(sc);
 890
 891         return (0);
 892 }
 893
 894 static void
 895 bwn_attach_pre(struct bwn_softc *sc)
 896 {
 897
 898         BWN_LOCK_INIT(sc);
 899         TAILQ_INIT(&sc->sc_maclist);
 900         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 901         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 902         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 903         mbufq_init(&sc->sc_snd, ifqmaxlen);
 904         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 905                 taskqueue_thread_enqueue, &sc->sc_tq);
 906         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 907                 "%s taskq", device_get_nameunit(sc->sc_dev));
 908 }
 909
 910 static void
 911 bwn_sprom_bugfixes(device_t dev)
 912 {
 913         struct bwn_softc *sc = device_get_softc(dev);
 914
 915 #define BWN_ISDEV(_device, _subvendor, _subdevice)              \
 916         ((sc->sc_board_info.board_devid == PCI_DEVID_##_device) &&      \
 917          (sc->sc_board_info.board_vendor == PCI_VENDOR_##_subvendor) && \
 918          (sc->sc_board_info.board_type == _subdevice))
 919
 920          /* A subset of Apple Airport Extreme (BCM4306 rev 2) devices
 921           * were programmed with a missing PACTRL boardflag */
 922          if (sc->sc_board_info.board_vendor == PCI_VENDOR_APPLE &&
 923              sc->sc_board_info.board_type == 0x4e &&
 924              sc->sc_board_info.board_rev > 0x40)
 925                  sc->sc_board_info.board_flags |= BHND_BFL_PACTRL;
 926
 927         if (BWN_ISDEV(BCM4318_D11G, ASUSTEK, 0x100f) ||
 928             BWN_ISDEV(BCM4306_D11G, DELL, 0x0003) ||
 929             BWN_ISDEV(BCM4306_D11G, HP, 0x12f8) ||
 930             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0013) ||
 931             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0014) ||
 932             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0015) ||
 933             BWN_ISDEV(BCM4306_D11G, MOTOROLA, 0x7010))
 934                 sc->sc_board_info.board_flags &= ~BHND_BFL_BTCOEX;
 935 #undef  BWN_ISDEV
 936 }
 937
 938 static void
 939 bwn_parent(struct ieee80211com *ic)
 940 {
 941         struct bwn_softc *sc = ic->ic_softc;
 942         int startall = 0;
 943
 944         BWN_LOCK(sc);
 945         if (ic->ic_nrunning > 0) {
 946                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 947                         bwn_init(sc);
 948                         startall = 1;
 949                 } else
 950                         bwn_update_promisc(ic);
 951         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 952                 bwn_stop(sc);
 953         BWN_UNLOCK(sc);
 954
 955         if (startall)
 956                 ieee80211_start_all(ic);
 957 }
 958
 959 static int
 960 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 961 {
 962         struct bwn_softc *sc = ic->ic_softc;
 963         int error;
 964
 965         BWN_LOCK(sc);
 966         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 967                 BWN_UNLOCK(sc);
 968                 return (ENXIO);
 969         }
 970         error = mbufq_enqueue(&sc->sc_snd, m);
 971         if (error) {
 972                 BWN_UNLOCK(sc);
 973                 return (error);
 974         }
 975         bwn_start(sc);
 976         BWN_UNLOCK(sc);
 977         return (0);
 978 }
 979
 980 static void
 981 bwn_start(struct bwn_softc *sc)
 982 {
 983         struct bwn_mac *mac = sc->sc_curmac;
 984         struct ieee80211_frame *wh;
 985         struct ieee80211_node *ni;
 986         struct ieee80211_key *k;
 987         struct mbuf *m;
 988
 989         BWN_ASSERT_LOCKED(sc);
 990
 991         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 992             mac->mac_status < BWN_MAC_STATUS_STARTED)
 993                 return;
 994
 995         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 996                 if (bwn_tx_isfull(sc, m))
 997                         break;
 998                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 999                 if (ni == NULL) {
1000                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
1001                         m_freem(m);
1002                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1003                         continue;
1004                 }
1005                 wh = mtod(m, struct ieee80211_frame *);
1006                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1007                         k = ieee80211_crypto_encap(ni, m);
1008                         if (k == NULL) {
1009                                 if_inc_counter(ni->ni_vap->iv_ifp,
1010                                     IFCOUNTER_OERRORS, 1);
1011                                 ieee80211_free_node(ni);
1012                                 m_freem(m);
1013                                 continue;
1014                         }
1015                 }
1016                 wh = NULL;      /* Catch any invalid use */
1017                 if (bwn_tx_start(sc, ni, m) != 0) {
1018                         if (ni != NULL) {
1019                                 if_inc_counter(ni->ni_vap->iv_ifp,
1020                                     IFCOUNTER_OERRORS, 1);
1021                                 ieee80211_free_node(ni);
1022                         }
1023                         continue;
1024                 }
1025                 sc->sc_watchdog_timer = 5;
1026         }
1027 }
1028
1029 static int
1030 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
1031 {
1032         struct bwn_dma_ring *dr;
1033         struct bwn_mac *mac = sc->sc_curmac;
1034         struct bwn_pio_txqueue *tq;
1035         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1036
1037         BWN_ASSERT_LOCKED(sc);
1038
1039         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
1040                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
1041                 if (dr->dr_stop == 1 ||
1042                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
1043                         dr->dr_stop = 1;
1044                         goto full;
1045                 }
1046         } else {
1047                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
1048                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
1049                     pktlen > (tq->tq_size - tq->tq_used))
1050                         goto full;
1051         }
1052         return (0);
1053 full:
1054         mbufq_prepend(&sc->sc_snd, m);
1055         return (1);
1056 }
1057
1058 static int
1059 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
1060 {
1061         struct bwn_mac *mac = sc->sc_curmac;
1062         int error;
1063
1064         BWN_ASSERT_LOCKED(sc);
1065
1066         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
1067                 m_freem(m);
1068                 return (ENXIO);
1069         }
1070
1071         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
1072             bwn_dma_tx_start(mac, ni, &m) : bwn_pio_tx_start(mac, ni, &m);
1073         if (error) {
1074                 m_freem(m);
1075                 return (error);
1076         }
1077         return (0);
1078 }
1079
1080 static int
1081 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1082     struct mbuf **mp)
1083 {
1084         struct bwn_pio_txpkt *tp;
1085         struct bwn_pio_txqueue *tq;
1086         struct bwn_softc *sc = mac->mac_sc;
1087         struct bwn_txhdr txhdr;
1088         struct mbuf *m, *m_new;
1089         uint32_t ctl32;
1090         int error;
1091         uint16_t ctl16;
1092
1093         BWN_ASSERT_LOCKED(sc);
1094
1095         /* XXX TODO send packets after DTIM */
1096
1097         m = *mp;
1098         tq = bwn_pio_select(mac, M_WME_GETAC(m));
1099         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
1100         tp = TAILQ_FIRST(&tq->tq_pktlist);
1101         tp->tp_ni = ni;
1102         tp->tp_m = m;
1103
1104         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1105         if (error) {
1106                 device_printf(sc->sc_dev, "tx fail\n");
1107                 return (error);
1108         }
1109
1110         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1111         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1112         tq->tq_free--;
1113
1114         if (bhnd_get_hwrev(sc->sc_dev) >= 8) {
1115                 /*
1116                  * XXX please removes m_defrag(9)
1117                  */
1118                 m_new = m_defrag(*mp, M_NOWAIT);
1119                 if (m_new == NULL) {
1120                         device_printf(sc->sc_dev,
1121                             "%s: can't defrag TX buffer\n",
1122                             __func__);
1123                         return (ENOBUFS);
1124                 }
1125                 *mp = m_new;
1126                 if (m_new->m_next != NULL)
1127                         device_printf(sc->sc_dev,
1128                             "TODO: fragmented packets for PIO\n");
1129                 tp->tp_m = m_new;
1130
1131                 /* send HEADER */
1132                 ctl32 = bwn_pio_write_multi_4(mac, tq,
1133                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1134                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1135                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1136                 /* send BODY */
1137                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1138                     mtod(m_new, const void *), m_new->m_pkthdr.len);
1139                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1140                     ctl32 | BWN_PIO8_TXCTL_EOF);
1141         } else {
1142                 ctl16 = bwn_pio_write_multi_2(mac, tq,
1143                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1144                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1145                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1146                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1147                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1148                     ctl16 | BWN_PIO_TXCTL_EOF);
1149         }
1150
1151         return (0);
1152 }
1153
1154 static struct bwn_pio_txqueue *
1155 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1156 {
1157
1158         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1159                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1160
1161         switch (prio) {
1162         case 0:
1163                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1164         case 1:
1165                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1166         case 2:
1167                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1168         case 3:
1169                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1170         }
1171         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1172         return (NULL);
1173 }
1174
1175 static int
1176 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1177     struct mbuf **mp)
1178 {
1179 #define BWN_GET_TXHDRCACHE(slot)                                        \
1180         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1181         struct bwn_dma *dma = &mac->mac_method.dma;
1182         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(*mp));
1183         struct bwn_dmadesc_generic *desc;
1184         struct bwn_dmadesc_meta *mt;
1185         struct bwn_softc *sc = mac->mac_sc;
1186         struct mbuf *m;
1187         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1188         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1189
1190         BWN_ASSERT_LOCKED(sc);
1191         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1192
1193         /* XXX send after DTIM */
1194
1195         m = *mp;
1196         slot = bwn_dma_getslot(dr);
1197         dr->getdesc(dr, slot, &desc, &mt);
1198         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1199             ("%s:%d: fail", __func__, __LINE__));
1200
1201         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1202             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1203             BWN_DMA_COOKIE(dr, slot));
1204         if (error)
1205                 goto fail;
1206         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1207             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1208             &mt->mt_paddr, BUS_DMA_NOWAIT);
1209         if (error) {
1210                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1211                     __func__, error);
1212                 goto fail;
1213         }
1214         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1215             BUS_DMASYNC_PREWRITE);
1216         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1217         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1218             BUS_DMASYNC_PREWRITE);
1219
1220         slot = bwn_dma_getslot(dr);
1221         dr->getdesc(dr, slot, &desc, &mt);
1222         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1223             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1224         mt->mt_m = m;
1225         mt->mt_ni = ni;
1226
1227         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1228             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1229         if (error && error != EFBIG) {
1230                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1231                     __func__, error);
1232                 goto fail;
1233         }
1234         if (error) {    /* error == EFBIG */
1235                 struct mbuf *m_new;
1236
1237                 m_new = m_defrag(m, M_NOWAIT);
1238                 if (m_new == NULL) {
1239                         device_printf(sc->sc_dev,
1240                             "%s: can't defrag TX buffer\n",
1241                             __func__);
1242                         error = ENOBUFS;
1243                         goto fail;
1244                 }
1245                 *mp = m = m_new;
1246
1247                 mt->mt_m = m;
1248                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1249                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1250                 if (error) {
1251                         device_printf(sc->sc_dev,
1252                             "%s: can't load TX buffer (2) %d\n",
1253                             __func__, error);
1254                         goto fail;
1255                 }
1256         }
1257         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1258         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1259         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1260             BUS_DMASYNC_PREWRITE);
1261
1262         /* XXX send after DTIM */
1263
1264         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1265         return (0);
1266 fail:
1267         dr->dr_curslot = backup[0];
1268         dr->dr_usedslot = backup[1];
1269         return (error);
1270 #undef BWN_GET_TXHDRCACHE
1271 }
1272
1273 static void
1274 bwn_watchdog(void *arg)
1275 {
1276         struct bwn_softc *sc = arg;
1277
1278         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1279                 device_printf(sc->sc_dev, "device timeout\n");
1280                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1281         }
1282         callout_schedule(&sc->sc_watchdog_ch, hz);
1283 }
1284
1285 static int
1286 bwn_attach_core(struct bwn_mac *mac)
1287 {
1288         struct bwn_softc *sc = mac->mac_sc;
1289         int error, have_bg = 0, have_a = 0;
1290         uint16_t iost;
1291
1292         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5,
1293             ("unsupported revision %d", bhnd_get_hwrev(sc->sc_dev)));
1294
1295         if ((error = bwn_core_forceclk(mac, true)))
1296                 return (error);
1297
1298         if ((error = bhnd_read_iost(sc->sc_dev, &iost))) {
1299                 device_printf(sc->sc_dev, "error reading I/O status flags: "
1300                     "%d\n", error);
1301                 return (error);
1302         }
1303
1304         have_a = (iost & BWN_IOST_HAVE_5GHZ) ? 1 : 0;
1305         have_bg = (iost & BWN_IOST_HAVE_2GHZ) ? 1 : 0;
1306         if (iost & BWN_IOST_DUALPHY) {
1307                 have_bg = 1;
1308                 have_a = 1;
1309         }
1310
1311 #if 0
1312         device_printf(sc->sc_dev, "%s: iost=0x%04hx, have_a=%d, have_bg=%d,"
1313             " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1314             __func__,
1315             iost,
1316             have_a,
1317             have_bg,
1318             sc->sc_board_info.board_devid,
1319             sc->sc_cid.chip_id);
1320 #endif
1321
1322         /*
1323          * Guess at whether it has A-PHY or G-PHY.
1324          * This is just used for resetting the core to probe things;
1325          * we will re-guess once it's all up and working.
1326          */
1327         error = bwn_reset_core(mac, have_bg);
1328         if (error)
1329                 goto fail;
1330
1331         /*
1332          * Determine the DMA engine type
1333          */
1334         if (iost & BHND_IOST_DMA64) {
1335                 mac->mac_dmatype = BHND_DMA_ADDR_64BIT;
1336         } else {
1337                 uint32_t tmp;
1338                 uint16_t base;
1339
1340                 base = bwn_dma_base(0, 0);
1341                 BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL,
1342                     BWN_DMA32_TXADDREXT_MASK);
1343                 tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
1344                 if (tmp & BWN_DMA32_TXADDREXT_MASK) {
1345                         mac->mac_dmatype = BHND_DMA_ADDR_32BIT;
1346                 } else {
1347                         mac->mac_dmatype = BHND_DMA_ADDR_30BIT;
1348                 }
1349         }
1350
1351         /*
1352          * Get the PHY version.
1353          */
1354         error = bwn_phy_getinfo(mac, have_bg);
1355         if (error)
1356                 goto fail;
1357
1358         /*
1359          * This is the whitelist of devices which we "believe"
1360          * the SPROM PHY config from.  The rest are "guessed".
1361          */
1362         if (sc->sc_board_info.board_devid != PCI_DEVID_BCM4311_D11DUAL &&
1363             sc->sc_board_info.board_devid != PCI_DEVID_BCM4328_D11G &&
1364             sc->sc_board_info.board_devid != PCI_DEVID_BCM4318_D11DUAL &&
1365             sc->sc_board_info.board_devid != PCI_DEVID_BCM4306_D11DUAL &&
1366             sc->sc_board_info.board_devid != PCI_DEVID_BCM4321_D11N &&
1367             sc->sc_board_info.board_devid != PCI_DEVID_BCM4322_D11N) {
1368                 have_a = have_bg = 0;
1369                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1370                         have_a = 1;
1371                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1372                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1373                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1374                         have_bg = 1;
1375                 else
1376                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1377                             mac->mac_phy.type));
1378         }
1379
1380         /*
1381          * XXX The PHY-G support doesn't do 5GHz operation.
1382          */
1383         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1384             mac->mac_phy.type != BWN_PHYTYPE_N) {
1385                 device_printf(sc->sc_dev,
1386                     "%s: forcing 2GHz only; no dual-band support for PHY\n",
1387                     __func__);
1388                 have_a = 0;
1389                 have_bg = 1;
1390         }
1391
1392         mac->mac_phy.phy_n = NULL;
1393
1394         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1395                 mac->mac_phy.attach = bwn_phy_g_attach;
1396                 mac->mac_phy.detach = bwn_phy_g_detach;
1397                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1398                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1399                 mac->mac_phy.init = bwn_phy_g_init;
1400                 mac->mac_phy.exit = bwn_phy_g_exit;
1401                 mac->mac_phy.phy_read = bwn_phy_g_read;
1402                 mac->mac_phy.phy_write = bwn_phy_g_write;
1403                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1404                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1405                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1406                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1407                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1408                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1409                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1410                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1411                 mac->mac_phy.set_im = bwn_phy_g_im;
1412                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1413                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1414                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1415                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1416         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1417                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1418                 mac->mac_phy.init = bwn_phy_lp_init;
1419                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1420                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1421                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1422                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1423                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1424                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1425                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1426                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1427                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1428                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1429                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1430         } else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1431                 mac->mac_phy.attach = bwn_phy_n_attach;
1432                 mac->mac_phy.detach = bwn_phy_n_detach;
1433                 mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1434                 mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1435                 mac->mac_phy.init = bwn_phy_n_init;
1436                 mac->mac_phy.exit = bwn_phy_n_exit;
1437                 mac->mac_phy.phy_read = bwn_phy_n_read;
1438                 mac->mac_phy.phy_write = bwn_phy_n_write;
1439                 mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1440                 mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1441                 mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1442                 mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1443                 mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1444                 mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1445                 mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1446                 mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1447                 mac->mac_phy.set_im = bwn_phy_n_im;
1448                 mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1449                 mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1450                 mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1451                 mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1452         } else {
1453                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1454                     mac->mac_phy.type);
1455                 error = ENXIO;
1456                 goto fail;
1457         }
1458
1459         mac->mac_phy.gmode = have_bg;
1460         if (mac->mac_phy.attach != NULL) {
1461                 error = mac->mac_phy.attach(mac);
1462                 if (error) {
1463                         device_printf(sc->sc_dev, "failed\n");
1464                         goto fail;
1465                 }
1466         }
1467
1468         error = bwn_reset_core(mac, have_bg);
1469         if (error)
1470                 goto fail;
1471
1472         error = bwn_chiptest(mac);
1473         if (error)
1474                 goto fail;
1475         error = bwn_setup_channels(mac, have_bg, have_a);
1476         if (error) {
1477                 device_printf(sc->sc_dev, "failed to setup channels\n");
1478                 goto fail;
1479         }
1480
1481         if (sc->sc_curmac == NULL)
1482                 sc->sc_curmac = mac;
1483
1484         error = bwn_dma_attach(mac);
1485         if (error != 0) {
1486                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1487                 goto fail;
1488         }
1489
1490         mac->mac_phy.switch_analog(mac, 0);
1491
1492 fail:
1493         bhnd_suspend_hw(sc->sc_dev, 0);
1494         bwn_release_firmware(mac);
1495         return (error);
1496 }
1497
1498 /*
1499  * Reset
1500  */
1501 int
1502 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1503 {
1504         struct bwn_softc        *sc;
1505         uint32_t                 ctl;
1506         uint16_t                 ioctl, ioctl_mask;
1507         int                      error;
1508
1509         sc = mac->mac_sc;
1510
1511         DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1512
1513         /* Reset core */
1514         ioctl = (BWN_IOCTL_PHYCLOCK_ENABLE | BWN_IOCTL_PHYRESET);
1515         if (g_mode)
1516                 ioctl |= BWN_IOCTL_SUPPORT_G;
1517
1518         /* XXX N-PHY only; and hard-code to 20MHz for now */
1519         if (mac->mac_phy.type == BWN_PHYTYPE_N)
1520                 ioctl |= BWN_IOCTL_PHY_BANDWIDTH_20MHZ;
1521
1522         if ((error = bhnd_reset_hw(sc->sc_dev, ioctl, ioctl))) {
1523                 device_printf(sc->sc_dev, "core reset failed: %d", error);
1524                 return (error);
1525         }
1526
1527         DELAY(2000);
1528
1529         /* Take PHY out of reset */
1530         ioctl = BHND_IOCTL_CLK_FORCE;
1531         ioctl_mask = BHND_IOCTL_CLK_FORCE |
1532                      BWN_IOCTL_PHYRESET |
1533                      BWN_IOCTL_PHYCLOCK_ENABLE;
1534
1535         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1536                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1537                     "%d\n", error);
1538                 return (error);
1539         }
1540
1541         DELAY(2000);
1542
1543         ioctl = BWN_IOCTL_PHYCLOCK_ENABLE;
1544         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1545                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1546                     "%d\n", error);
1547                 return (error);
1548         }
1549
1550         DELAY(2000);
1551
1552         if (mac->mac_phy.switch_analog != NULL)
1553                 mac->mac_phy.switch_analog(mac, 1);
1554
1555         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1556         if (g_mode)
1557                 ctl |= BWN_MACCTL_GMODE;
1558         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1559
1560         return (0);
1561 }
1562
1563 static int
1564 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1565 {
1566         struct bwn_phy *phy = &mac->mac_phy;
1567         struct bwn_softc *sc = mac->mac_sc;
1568         uint32_t tmp;
1569
1570         /* PHY */
1571         tmp = BWN_READ_2(mac, BWN_PHYVER);
1572         phy->gmode = gmode;
1573         phy->rf_on = 1;
1574         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1575         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1576         phy->rev = (tmp & BWN_PHYVER_VERSION);
1577         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1578             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1579                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1580             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1581             (phy->type == BWN_PHYTYPE_N && phy->rev > 6) ||
1582             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1583                 goto unsupphy;
1584
1585         /* RADIO */
1586         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1587         tmp = BWN_READ_2(mac, BWN_RFDATALO);
1588         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1589         tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1590
1591         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1592         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1593         phy->rf_manuf = (tmp & 0x00000fff);
1594
1595         /*
1596          * For now, just always do full init (ie, what bwn has traditionally
1597          * done)
1598          */
1599         phy->phy_do_full_init = 1;
1600
1601         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1602                 goto unsupradio;
1603         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1604              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1605             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1606             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1607             (phy->type == BWN_PHYTYPE_N &&
1608              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1609             (phy->type == BWN_PHYTYPE_LP &&
1610              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1611                 goto unsupradio;
1612
1613         return (0);
1614 unsupphy:
1615         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1616             "analog %#x)\n",
1617             phy->type, phy->rev, phy->analog);
1618         return (ENXIO);
1619 unsupradio:
1620         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1621             "rev %#x)\n",
1622             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1623         return (ENXIO);
1624 }
1625
1626 static int
1627 bwn_chiptest(struct bwn_mac *mac)
1628 {
1629 #define TESTVAL0        0x55aaaa55
1630 #define TESTVAL1        0xaa5555aa
1631         struct bwn_softc *sc = mac->mac_sc;
1632         uint32_t v, backup;
1633
1634         BWN_LOCK(sc);
1635
1636         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1637
1638         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1639         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1640                 goto error;
1641         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1642         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1643                 goto error;
1644
1645         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1646
1647         if ((bhnd_get_hwrev(sc->sc_dev) >= 3) &&
1648             (bhnd_get_hwrev(sc->sc_dev) <= 10)) {
1649                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1650                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1651                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1652                         goto error;
1653                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1654                         goto error;
1655         }
1656         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1657
1658         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1659         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1660                 goto error;
1661
1662         BWN_UNLOCK(sc);
1663         return (0);
1664 error:
1665         BWN_UNLOCK(sc);
1666         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1667         return (ENODEV);
1668 }
1669
1670 static int
1671 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1672 {
1673         struct bwn_softc *sc = mac->mac_sc;
1674         struct ieee80211com *ic = &sc->sc_ic;
1675         uint8_t bands[IEEE80211_MODE_BYTES];
1676
1677         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1678         ic->ic_nchans = 0;
1679
1680         DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1681             __func__,
1682             have_bg,
1683             have_a);
1684
1685         if (have_bg) {
1686                 memset(bands, 0, sizeof(bands));
1687                 setbit(bands, IEEE80211_MODE_11B);
1688                 setbit(bands, IEEE80211_MODE_11G);
1689                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1690                     &ic->ic_nchans, &bwn_chantable_bg, bands);
1691         }
1692
1693         if (have_a) {
1694                 memset(bands, 0, sizeof(bands));
1695                 setbit(bands, IEEE80211_MODE_11A);
1696                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1697                     &ic->ic_nchans, &bwn_chantable_a, bands);
1698         }
1699
1700         mac->mac_phy.supports_2ghz = have_bg;
1701         mac->mac_phy.supports_5ghz = have_a;
1702
1703         return (ic->ic_nchans == 0 ? ENXIO : 0);
1704 }
1705
1706 uint32_t
1707 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1708 {
1709         uint32_t ret;
1710
1711         BWN_ASSERT_LOCKED(mac->mac_sc);
1712
1713         if (way == BWN_SHARED) {
1714                 KASSERT((offset & 0x0001) == 0,
1715                     ("%s:%d warn", __func__, __LINE__));
1716                 if (offset & 0x0003) {
1717                         bwn_shm_ctlword(mac, way, offset >> 2);
1718                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1719                         ret <<= 16;
1720                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1721                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1722                         goto out;
1723                 }
1724                 offset >>= 2;
1725         }
1726         bwn_shm_ctlword(mac, way, offset);
1727         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1728 out:
1729         return (ret);
1730 }
1731
1732 uint16_t
1733 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1734 {
1735         uint16_t ret;
1736
1737         BWN_ASSERT_LOCKED(mac->mac_sc);
1738
1739         if (way == BWN_SHARED) {
1740                 KASSERT((offset & 0x0001) == 0,
1741                     ("%s:%d warn", __func__, __LINE__));
1742                 if (offset & 0x0003) {
1743                         bwn_shm_ctlword(mac, way, offset >> 2);
1744                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1745                         goto out;
1746                 }
1747                 offset >>= 2;
1748         }
1749         bwn_shm_ctlword(mac, way, offset);
1750         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1751 out:
1752
1753         return (ret);
1754 }
1755
1756 static void
1757 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1758     uint16_t offset)
1759 {
1760         uint32_t control;
1761
1762         control = way;
1763         control <<= 16;
1764         control |= offset;
1765         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1766 }
1767
1768 void
1769 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1770     uint32_t value)
1771 {
1772         BWN_ASSERT_LOCKED(mac->mac_sc);
1773
1774         if (way == BWN_SHARED) {
1775                 KASSERT((offset & 0x0001) == 0,
1776                     ("%s:%d warn", __func__, __LINE__));
1777                 if (offset & 0x0003) {
1778                         bwn_shm_ctlword(mac, way, offset >> 2);
1779                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1780                                     (value >> 16) & 0xffff);
1781                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1782                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1783                         return;
1784                 }
1785                 offset >>= 2;
1786         }
1787         bwn_shm_ctlword(mac, way, offset);
1788         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1789 }
1790
1791 void
1792 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1793     uint16_t value)
1794 {
1795         BWN_ASSERT_LOCKED(mac->mac_sc);
1796
1797         if (way == BWN_SHARED) {
1798                 KASSERT((offset & 0x0001) == 0,
1799                     ("%s:%d warn", __func__, __LINE__));
1800                 if (offset & 0x0003) {
1801                         bwn_shm_ctlword(mac, way, offset >> 2);
1802                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1803                         return;
1804                 }
1805                 offset >>= 2;
1806         }
1807         bwn_shm_ctlword(mac, way, offset);
1808         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1809 }
1810
1811 static void
1812 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1813     const struct bwn_channelinfo *ci, const uint8_t bands[])
1814 {
1815         int i, error;
1816
1817         for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1818                 const struct bwn_channel *hc = &ci->channels[i];
1819
1820                 error = ieee80211_add_channel(chans, maxchans, nchans,
1821                     hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1822         }
1823 }
1824
1825 static int
1826 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1827         const struct ieee80211_bpf_params *params)
1828 {
1829         struct ieee80211com *ic = ni->ni_ic;
1830         struct bwn_softc *sc = ic->ic_softc;
1831         struct bwn_mac *mac = sc->sc_curmac;
1832         int error;
1833
1834         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1835             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1836                 m_freem(m);
1837                 return (ENETDOWN);
1838         }
1839
1840         BWN_LOCK(sc);
1841         if (bwn_tx_isfull(sc, m)) {
1842                 m_freem(m);
1843                 BWN_UNLOCK(sc);
1844                 return (ENOBUFS);
1845         }
1846
1847         error = bwn_tx_start(sc, ni, m);
1848         if (error == 0)
1849                 sc->sc_watchdog_timer = 5;
1850         BWN_UNLOCK(sc);
1851         return (error);
1852 }
1853
1854 /*
1855  * Callback from the 802.11 layer to update the slot time
1856  * based on the current setting.  We use it to notify the
1857  * firmware of ERP changes and the f/w takes care of things
1858  * like slot time and preamble.
1859  */
1860 static void
1861 bwn_updateslot(struct ieee80211com *ic)
1862 {
1863         struct bwn_softc *sc = ic->ic_softc;
1864         struct bwn_mac *mac;
1865
1866         BWN_LOCK(sc);
1867         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1868                 mac = (struct bwn_mac *)sc->sc_curmac;
1869                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1870         }
1871         BWN_UNLOCK(sc);
1872 }
1873
1874 /*
1875  * Callback from the 802.11 layer after a promiscuous mode change.
1876  * Note this interface does not check the operating mode as this
1877  * is an internal callback and we are expected to honor the current
1878  * state (e.g. this is used for setting the interface in promiscuous
1879  * mode when operating in hostap mode to do ACS).
1880  */
1881 static void
1882 bwn_update_promisc(struct ieee80211com *ic)
1883 {
1884         struct bwn_softc *sc = ic->ic_softc;
1885         struct bwn_mac *mac = sc->sc_curmac;
1886
1887         BWN_LOCK(sc);
1888         mac = sc->sc_curmac;
1889         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1890                 if (ic->ic_promisc > 0)
1891                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1892                 else
1893                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1894                 bwn_set_opmode(mac);
1895         }
1896         BWN_UNLOCK(sc);
1897 }
1898
1899 /*
1900  * Callback from the 802.11 layer to update WME parameters.
1901  */
1902 static int
1903 bwn_wme_update(struct ieee80211com *ic)
1904 {
1905         struct bwn_softc *sc = ic->ic_softc;
1906         struct bwn_mac *mac = sc->sc_curmac;
1907         struct chanAccParams chp;
1908         struct wmeParams *wmep;
1909         int i;
1910
1911         ieee80211_wme_ic_getparams(ic, &chp);
1912
1913         BWN_LOCK(sc);
1914         mac = sc->sc_curmac;
1915         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1916                 bwn_mac_suspend(mac);
1917                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1918                         wmep = &chp.cap_wmeParams[i];
1919                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1920                 }
1921                 bwn_mac_enable(mac);
1922         }
1923         BWN_UNLOCK(sc);
1924         return (0);
1925 }
1926
1927 static void
1928 bwn_scan_start(struct ieee80211com *ic)
1929 {
1930         struct bwn_softc *sc = ic->ic_softc;
1931         struct bwn_mac *mac;
1932
1933         BWN_LOCK(sc);
1934         mac = sc->sc_curmac;
1935         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1936                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1937                 bwn_set_opmode(mac);
1938                 /* disable CFP update during scan */
1939                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1940         }
1941         BWN_UNLOCK(sc);
1942 }
1943
1944 static void
1945 bwn_scan_end(struct ieee80211com *ic)
1946 {
1947         struct bwn_softc *sc = ic->ic_softc;
1948         struct bwn_mac *mac;
1949
1950         BWN_LOCK(sc);
1951         mac = sc->sc_curmac;
1952         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1953                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1954                 bwn_set_opmode(mac);
1955                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1956         }
1957         BWN_UNLOCK(sc);
1958 }
1959
1960 static void
1961 bwn_set_channel(struct ieee80211com *ic)
1962 {
1963         struct bwn_softc *sc = ic->ic_softc;
1964         struct bwn_mac *mac = sc->sc_curmac;
1965         struct bwn_phy *phy = &mac->mac_phy;
1966         int chan, error;
1967
1968         BWN_LOCK(sc);
1969
1970         error = bwn_switch_band(sc, ic->ic_curchan);
1971         if (error)
1972                 goto fail;
1973         bwn_mac_suspend(mac);
1974         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1975         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1976         if (chan != phy->chan)
1977                 bwn_switch_channel(mac, chan);
1978
1979         /* TX power level */
1980         if (ic->ic_curchan->ic_maxpower != 0 &&
1981             ic->ic_curchan->ic_maxpower != phy->txpower) {
1982                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1983                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1984                     BWN_TXPWR_IGNORE_TSSI);
1985         }
1986
1987         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1988         if (phy->set_antenna)
1989                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1990
1991         if (sc->sc_rf_enabled != phy->rf_on) {
1992                 if (sc->sc_rf_enabled) {
1993                         bwn_rf_turnon(mac);
1994                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1995                                 device_printf(sc->sc_dev,
1996                                     "please turn on the RF switch\n");
1997                 } else
1998                         bwn_rf_turnoff(mac);
1999         }
2000
2001         bwn_mac_enable(mac);
2002
2003 fail:
2004         BWN_UNLOCK(sc);
2005 }
2006
2007 static struct ieee80211vap *
2008 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2009     enum ieee80211_opmode opmode, int flags,
2010     const uint8_t bssid[IEEE80211_ADDR_LEN],
2011     const uint8_t mac[IEEE80211_ADDR_LEN])
2012 {
2013         struct ieee80211vap *vap;
2014         struct bwn_vap *bvp;
2015
2016         switch (opmode) {
2017         case IEEE80211_M_HOSTAP:
2018         case IEEE80211_M_MBSS:
2019         case IEEE80211_M_STA:
2020         case IEEE80211_M_WDS:
2021         case IEEE80211_M_MONITOR:
2022         case IEEE80211_M_IBSS:
2023         case IEEE80211_M_AHDEMO:
2024                 break;
2025         default:
2026                 return (NULL);
2027         }
2028
2029         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
2030         vap = &bvp->bv_vap;
2031         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
2032         /* override with driver methods */
2033         bvp->bv_newstate = vap->iv_newstate;
2034         vap->iv_newstate = bwn_newstate;
2035
2036         /* override max aid so sta's cannot assoc when we're out of sta id's */
2037         vap->iv_max_aid = BWN_STAID_MAX;
2038
2039         ieee80211_ratectl_init(vap);
2040
2041         /* complete setup */
2042         ieee80211_vap_attach(vap, ieee80211_media_change,
2043             ieee80211_media_status, mac);
2044         return (vap);
2045 }
2046
2047 static void
2048 bwn_vap_delete(struct ieee80211vap *vap)
2049 {
2050         struct bwn_vap *bvp = BWN_VAP(vap);
2051
2052         ieee80211_ratectl_deinit(vap);
2053         ieee80211_vap_detach(vap);
2054         free(bvp, M_80211_VAP);
2055 }
2056
2057 static int
2058 bwn_init(struct bwn_softc *sc)
2059 {
2060         struct bwn_mac *mac;
2061         int error;
2062
2063         BWN_ASSERT_LOCKED(sc);
2064
2065         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2066
2067         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
2068         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
2069         sc->sc_filters = 0;
2070         bwn_wme_clear(sc);
2071         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
2072         sc->sc_rf_enabled = 1;
2073
2074         mac = sc->sc_curmac;
2075         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
2076                 error = bwn_core_init(mac);
2077                 if (error != 0)
2078                         return (error);
2079         }
2080         if (mac->mac_status == BWN_MAC_STATUS_INITED)
2081                 bwn_core_start(mac);
2082
2083         bwn_set_opmode(mac);
2084         bwn_set_pretbtt(mac);
2085         bwn_spu_setdelay(mac, 0);
2086         bwn_set_macaddr(mac);
2087
2088         sc->sc_flags |= BWN_FLAG_RUNNING;
2089         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
2090         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
2091
2092         return (0);
2093 }
2094
2095 static void
2096 bwn_stop(struct bwn_softc *sc)
2097 {
2098         struct bwn_mac *mac = sc->sc_curmac;
2099
2100         BWN_ASSERT_LOCKED(sc);
2101
2102         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2103
2104         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
2105                 /* XXX FIXME opmode not based on VAP */
2106                 bwn_set_opmode(mac);
2107                 bwn_set_macaddr(mac);
2108         }
2109
2110         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
2111                 bwn_core_stop(mac);
2112
2113         callout_stop(&sc->sc_led_blink_ch);
2114         sc->sc_led_blinking = 0;
2115
2116         bwn_core_exit(mac);
2117         sc->sc_rf_enabled = 0;
2118
2119         sc->sc_flags &= ~BWN_FLAG_RUNNING;
2120 }
2121
2122 static void
2123 bwn_wme_clear(struct bwn_softc *sc)
2124 {
2125         struct wmeParams *p;
2126         unsigned int i;
2127
2128         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
2129             ("%s:%d: fail", __func__, __LINE__));
2130
2131         for (i = 0; i < N(sc->sc_wmeParams); i++) {
2132                 p = &(sc->sc_wmeParams[i]);
2133
2134                 switch (bwn_wme_shm_offsets[i]) {
2135                 case BWN_WME_VOICE:
2136                         p->wmep_txopLimit = 0;
2137                         p->wmep_aifsn = 2;
2138                         /* XXX FIXME: log2(cwmin) */
2139                         p->wmep_logcwmin =
2140                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2141                         p->wmep_logcwmax =
2142                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMAX);
2143                         break;
2144                 case BWN_WME_VIDEO:
2145                         p->wmep_txopLimit = 0;
2146                         p->wmep_aifsn = 2;
2147                         /* XXX FIXME: log2(cwmin) */
2148                         p->wmep_logcwmin =
2149                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2150                         p->wmep_logcwmax =
2151                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMAX);
2152                         break;
2153                 case BWN_WME_BESTEFFORT:
2154                         p->wmep_txopLimit = 0;
2155                         p->wmep_aifsn = 3;
2156                         /* XXX FIXME: log2(cwmin) */
2157                         p->wmep_logcwmin =
2158                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2159                         p->wmep_logcwmax =
2160                             _IEEE80211_MASKSHIFT(0x03ff, WME_PARAM_LOGCWMAX);
2161                         break;
2162                 case BWN_WME_BACKGROUND:
2163                         p->wmep_txopLimit = 0;
2164                         p->wmep_aifsn = 7;
2165                         /* XXX FIXME: log2(cwmin) */
2166                         p->wmep_logcwmin =
2167                             _IEEE80211_MASKSHIFT(0x0001, WME_PARAM_LOGCWMIN);
2168                         p->wmep_logcwmax =
2169                             _IEEE80211_MASKSHIFT(0x03ff, WME_PARAM_LOGCWMAX);
2170                         break;
2171                 default:
2172                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2173                 }
2174         }
2175 }
2176
2177 static int
2178 bwn_core_forceclk(struct bwn_mac *mac, bool force)
2179 {
2180         struct bwn_softc        *sc;
2181         bhnd_clock               clock;
2182         int                      error;
2183
2184         sc = mac->mac_sc;
2185
2186         /* On PMU equipped devices, we do not need to force the HT clock */
2187         if (sc->sc_pmu != NULL)
2188                 return (0);
2189
2190         /* Issue a PMU clock request */
2191         if (force)
2192                 clock = BHND_CLOCK_HT;
2193         else
2194                 clock = BHND_CLOCK_DYN;
2195
2196         if ((error = bhnd_request_clock(sc->sc_dev, clock))) {
2197                 device_printf(sc->sc_dev, "%d clock request failed: %d\n",
2198                     clock, error);
2199                 return (error);
2200         }
2201
2202         return (0);
2203 }
2204
2205 static int
2206 bwn_core_init(struct bwn_mac *mac)
2207 {
2208         struct bwn_softc *sc = mac->mac_sc;
2209         uint64_t hf;
2210         int error;
2211
2212         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2213             ("%s:%d: fail", __func__, __LINE__));
2214
2215         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2216
2217         if ((error = bwn_core_forceclk(mac, true)))
2218                 return (error);
2219
2220         if (bhnd_is_hw_suspended(sc->sc_dev)) {
2221                 if ((error = bwn_reset_core(mac, mac->mac_phy.gmode)))
2222                         goto fail0;
2223         }
2224
2225         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2226         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2227         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2228         BWN_GETTIME(mac->mac_phy.nexttime);
2229         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2230         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2231         mac->mac_stats.link_noise = -95;
2232         mac->mac_reason_intr = 0;
2233         bzero(mac->mac_reason, sizeof(mac->mac_reason));
2234         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2235 #ifdef BWN_DEBUG
2236         if (sc->sc_debug & BWN_DEBUG_XMIT)
2237                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2238 #endif
2239         mac->mac_suspended = 1;
2240         mac->mac_task_state = 0;
2241         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2242
2243         mac->mac_phy.init_pre(mac);
2244
2245         bwn_bt_disable(mac);
2246         if (mac->mac_phy.prepare_hw) {
2247                 error = mac->mac_phy.prepare_hw(mac);
2248                 if (error)
2249                         goto fail0;
2250         }
2251         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2252         error = bwn_chip_init(mac);
2253         if (error)
2254                 goto fail0;
2255         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2256             bhnd_get_hwrev(sc->sc_dev));
2257         hf = bwn_hf_read(mac);
2258         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2259                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2260                 if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL)
2261                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2262                 if (mac->mac_phy.rev == 1)
2263                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2264         }
2265         if (mac->mac_phy.rf_ver == 0x2050) {
2266                 if (mac->mac_phy.rf_rev < 6)
2267                         hf |= BWN_HF_FORCE_VCO_RECALC;
2268                 if (mac->mac_phy.rf_rev == 6)
2269                         hf |= BWN_HF_4318_TSSI;
2270         }
2271         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2272                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2273         if (sc->sc_quirks & BWN_QUIRK_UCODE_SLOWCLOCK_WAR)
2274                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2275         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2276         bwn_hf_write(mac, hf);
2277
2278         /* Tell the firmware about the MAC capabilities */
2279         if (bhnd_get_hwrev(sc->sc_dev) >= 13) {
2280                 uint32_t cap;
2281                 cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2282                 DPRINTF(sc, BWN_DEBUG_RESET,
2283                     "%s: hw capabilities: 0x%08x\n",
2284                     __func__, cap);
2285                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2286                     cap & 0xffff);
2287                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2288                     (cap >> 16) & 0xffff);
2289         }
2290
2291         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2292         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2293         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2294         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2295
2296         bwn_rate_init(mac);
2297         bwn_set_phytxctl(mac);
2298
2299         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2300             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2301         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2302
2303         if (sc->sc_quirks & BWN_QUIRK_NODMA)
2304                 bwn_pio_init(mac);
2305         else
2306                 bwn_dma_init(mac);
2307         bwn_wme_init(mac);
2308         bwn_spu_setdelay(mac, 1);
2309         bwn_bt_enable(mac);
2310
2311         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2312         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2313                 bwn_core_forceclk(mac, true);
2314         else
2315                 bwn_core_forceclk(mac, false);
2316
2317         bwn_set_macaddr(mac);
2318         bwn_crypt_init(mac);
2319
2320         /* XXX LED initializatin */
2321
2322         mac->mac_status = BWN_MAC_STATUS_INITED;
2323
2324         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2325         return (error);
2326
2327 fail0:
2328         bhnd_suspend_hw(sc->sc_dev, 0);
2329         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2330             ("%s:%d: fail", __func__, __LINE__));
2331         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2332         return (error);
2333 }
2334
2335 static void
2336 bwn_core_start(struct bwn_mac *mac)
2337 {
2338         struct bwn_softc *sc = mac->mac_sc;
2339         uint32_t tmp;
2340
2341         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2342             ("%s:%d: fail", __func__, __LINE__));
2343
2344         if (bhnd_get_hwrev(sc->sc_dev) < 5)
2345                 return;
2346
2347         while (1) {
2348                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2349                 if (!(tmp & 0x00000001))
2350                         break;
2351                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2352         }
2353
2354         bwn_mac_enable(mac);
2355         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2356         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2357
2358         mac->mac_status = BWN_MAC_STATUS_STARTED;
2359 }
2360
2361 static void
2362 bwn_core_exit(struct bwn_mac *mac)
2363 {
2364         struct bwn_softc *sc = mac->mac_sc;
2365         uint32_t macctl;
2366
2367         BWN_ASSERT_LOCKED(mac->mac_sc);
2368
2369         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2370             ("%s:%d: fail", __func__, __LINE__));
2371
2372         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2373                 return;
2374         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2375
2376         macctl = BWN_READ_4(mac, BWN_MACCTL);
2377         macctl &= ~BWN_MACCTL_MCODE_RUN;
2378         macctl |= BWN_MACCTL_MCODE_JMP0;
2379         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2380
2381         bwn_dma_stop(mac);
2382         bwn_pio_stop(mac);
2383         bwn_chip_exit(mac);
2384         mac->mac_phy.switch_analog(mac, 0);
2385         bhnd_suspend_hw(sc->sc_dev, 0);
2386 }
2387
2388 static void
2389 bwn_bt_disable(struct bwn_mac *mac)
2390 {
2391         struct bwn_softc *sc = mac->mac_sc;
2392
2393         (void)sc;
2394         /* XXX do nothing yet */
2395 }
2396
2397 static int
2398 bwn_chip_init(struct bwn_mac *mac)
2399 {
2400         struct bwn_softc *sc = mac->mac_sc;
2401         struct bwn_phy *phy = &mac->mac_phy;
2402         uint32_t macctl;
2403         u_int delay;
2404         int error;
2405
2406         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2407         if (phy->gmode)
2408                 macctl |= BWN_MACCTL_GMODE;
2409         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2410
2411         error = bwn_fw_fillinfo(mac);
2412         if (error)
2413                 return (error);
2414         error = bwn_fw_loaducode(mac);
2415         if (error)
2416                 return (error);
2417
2418         error = bwn_gpio_init(mac);
2419         if (error)
2420                 return (error);
2421
2422         error = bwn_fw_loadinitvals(mac);
2423         if (error)
2424                 return (error);
2425
2426         phy->switch_analog(mac, 1);
2427         error = bwn_phy_init(mac);
2428         if (error)
2429                 return (error);
2430
2431         if (phy->set_im)
2432                 phy->set_im(mac, BWN_IMMODE_NONE);
2433         if (phy->set_antenna)
2434                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2435         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2436
2437         if (phy->type == BWN_PHYTYPE_B)
2438                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2439         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2440         if (bhnd_get_hwrev(sc->sc_dev) < 5)
2441                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2442
2443         BWN_WRITE_4(mac, BWN_MACCTL,
2444             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2445         BWN_WRITE_4(mac, BWN_MACCTL,
2446             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2447         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2448
2449         bwn_set_opmode(mac);
2450         if (bhnd_get_hwrev(sc->sc_dev) < 3) {
2451                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2452                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2453                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2454                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2455         } else {
2456                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2457                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2458         }
2459         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2460         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2461         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2462         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2463         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2464         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2465         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2466
2467         bwn_mac_phy_clock_set(mac, true);
2468
2469         /* Provide the HT clock transition latency to the MAC core */
2470         error = bhnd_get_clock_latency(sc->sc_dev, BHND_CLOCK_HT, &delay);
2471         if (error) {
2472                 device_printf(sc->sc_dev, "failed to fetch HT clock latency: "
2473                     "%d\n", error);
2474                 return (error);
2475         }
2476
2477         if (delay > UINT16_MAX) {
2478                 device_printf(sc->sc_dev, "invalid HT clock latency: %u\n",
2479                     delay);
2480                 return (ENXIO);
2481         }
2482
2483         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, delay);
2484         return (0);
2485 }
2486
2487 /* read hostflags */
2488 uint64_t
2489 bwn_hf_read(struct bwn_mac *mac)
2490 {
2491         uint64_t ret;
2492
2493         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2494         ret <<= 16;
2495         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2496         ret <<= 16;
2497         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2498         return (ret);
2499 }
2500
2501 void
2502 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2503 {
2504
2505         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2506             (value & 0x00000000ffffull));
2507         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2508             (value & 0x0000ffff0000ull) >> 16);
2509         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2510             (value & 0xffff00000000ULL) >> 32);
2511 }
2512
2513 static void
2514 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2515 {
2516
2517         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2518         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2519 }
2520
2521 static void
2522 bwn_rate_init(struct bwn_mac *mac)
2523 {
2524
2525         switch (mac->mac_phy.type) {
2526         case BWN_PHYTYPE_A:
2527         case BWN_PHYTYPE_G:
2528         case BWN_PHYTYPE_LP:
2529         case BWN_PHYTYPE_N:
2530                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2531                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2532                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2533                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2534                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2535                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2536                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2537                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2538                         break;
2539                 /* FALLTHROUGH */
2540         case BWN_PHYTYPE_B:
2541                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2542                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2543                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2544                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2545                 break;
2546         default:
2547                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2548         }
2549 }
2550
2551 static void
2552 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2553 {
2554         uint16_t offset;
2555
2556         if (ofdm) {
2557                 offset = 0x480;
2558                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2559         } else {
2560                 offset = 0x4c0;
2561                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2562         }
2563         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2564             bwn_shm_read_2(mac, BWN_SHARED, offset));
2565 }
2566
2567 static uint8_t
2568 bwn_plcp_getcck(const uint8_t bitrate)
2569 {
2570
2571         switch (bitrate) {
2572         case BWN_CCK_RATE_1MB:
2573                 return (0x0a);
2574         case BWN_CCK_RATE_2MB:
2575                 return (0x14);
2576         case BWN_CCK_RATE_5MB:
2577                 return (0x37);
2578         case BWN_CCK_RATE_11MB:
2579                 return (0x6e);
2580         }
2581         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2582         return (0);
2583 }
2584
2585 static uint8_t
2586 bwn_plcp_getofdm(const uint8_t bitrate)
2587 {
2588
2589         switch (bitrate) {
2590         case BWN_OFDM_RATE_6MB:
2591                 return (0xb);
2592         case BWN_OFDM_RATE_9MB:
2593                 return (0xf);
2594         case BWN_OFDM_RATE_12MB:
2595                 return (0xa);
2596         case BWN_OFDM_RATE_18MB:
2597                 return (0xe);
2598         case BWN_OFDM_RATE_24MB:
2599                 return (0x9);
2600         case BWN_OFDM_RATE_36MB:
2601                 return (0xd);
2602         case BWN_OFDM_RATE_48MB:
2603                 return (0x8);
2604         case BWN_OFDM_RATE_54MB:
2605                 return (0xc);
2606         }
2607         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2608         return (0);
2609 }
2610
2611 static void
2612 bwn_set_phytxctl(struct bwn_mac *mac)
2613 {
2614         uint16_t ctl;
2615
2616         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2617             BWN_TX_PHY_TXPWR);
2618         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2619         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2620         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2621 }
2622
2623 static void
2624 bwn_pio_init(struct bwn_mac *mac)
2625 {
2626         struct bwn_pio *pio = &mac->mac_method.pio;
2627
2628         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2629             & ~BWN_MACCTL_BIGENDIAN);
2630         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2631
2632         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2633         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2634         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2635         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2636         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2637         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2638 }
2639
2640 static void
2641 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2642     int index)
2643 {
2644         struct bwn_pio_txpkt *tp;
2645         struct bwn_softc *sc = mac->mac_sc;
2646         unsigned int i;
2647
2648         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2649         tq->tq_index = index;
2650
2651         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2652         if (bhnd_get_hwrev(sc->sc_dev) >= 8)
2653                 tq->tq_size = 1920;
2654         else {
2655                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2656                 tq->tq_size -= 80;
2657         }
2658
2659         TAILQ_INIT(&tq->tq_pktlist);
2660         for (i = 0; i < N(tq->tq_pkts); i++) {
2661                 tp = &(tq->tq_pkts[i]);
2662                 tp->tp_index = i;
2663                 tp->tp_queue = tq;
2664                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2665         }
2666 }
2667
2668 static uint16_t
2669 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2670 {
2671         struct bwn_softc *sc = mac->mac_sc;
2672         static const uint16_t bases[] = {
2673                 BWN_PIO_BASE0,
2674                 BWN_PIO_BASE1,
2675                 BWN_PIO_BASE2,
2676                 BWN_PIO_BASE3,
2677                 BWN_PIO_BASE4,
2678                 BWN_PIO_BASE5,
2679                 BWN_PIO_BASE6,
2680                 BWN_PIO_BASE7,
2681         };
2682         static const uint16_t bases_rev11[] = {
2683                 BWN_PIO11_BASE0,
2684                 BWN_PIO11_BASE1,
2685                 BWN_PIO11_BASE2,
2686                 BWN_PIO11_BASE3,
2687                 BWN_PIO11_BASE4,
2688                 BWN_PIO11_BASE5,
2689         };
2690
2691         if (bhnd_get_hwrev(sc->sc_dev) >= 11) {
2692                 if (index >= N(bases_rev11))
2693                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2694                 return (bases_rev11[index]);
2695         }
2696         if (index >= N(bases))
2697                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2698         return (bases[index]);
2699 }
2700
2701 static void
2702 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2703     int index)
2704 {
2705         struct bwn_softc *sc = mac->mac_sc;
2706
2707         prq->prq_mac = mac;
2708         prq->prq_rev = bhnd_get_hwrev(sc->sc_dev);
2709         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2710         bwn_dma_rxdirectfifo(mac, index, 1);
2711 }
2712
2713 static void
2714 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2715 {
2716         if (tq == NULL)
2717                 return;
2718         bwn_pio_cancel_tx_packets(tq);
2719 }
2720
2721 static void
2722 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2723 {
2724
2725         bwn_destroy_pioqueue_tx(pio);
2726 }
2727
2728 static uint16_t
2729 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2730     uint16_t offset)
2731 {
2732
2733         return (BWN_READ_2(mac, tq->tq_base + offset));
2734 }
2735
2736 static void
2737 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2738 {
2739         uint32_t ctl;
2740         uint16_t base;
2741
2742         base = bwn_dma_base(mac->mac_dmatype, idx);
2743         if (mac->mac_dmatype == BHND_DMA_ADDR_64BIT) {
2744                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2745                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2746                 if (enable)
2747                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2748                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2749         } else {
2750                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2751                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2752                 if (enable)
2753                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2754                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2755         }
2756 }
2757
2758 static void
2759 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2760 {
2761         struct bwn_pio_txpkt *tp;
2762         unsigned int i;
2763
2764         for (i = 0; i < N(tq->tq_pkts); i++) {
2765                 tp = &(tq->tq_pkts[i]);
2766                 if (tp->tp_m) {
2767                         m_freem(tp->tp_m);
2768                         tp->tp_m = NULL;
2769                 }
2770         }
2771 }
2772
2773 static uint16_t
2774 bwn_dma_base(int type, int controller_idx)
2775 {
2776         static const uint16_t map64[] = {
2777                 BWN_DMA64_BASE0,
2778                 BWN_DMA64_BASE1,
2779                 BWN_DMA64_BASE2,
2780                 BWN_DMA64_BASE3,
2781                 BWN_DMA64_BASE4,
2782                 BWN_DMA64_BASE5,
2783         };
2784         static const uint16_t map32[] = {
2785                 BWN_DMA32_BASE0,
2786                 BWN_DMA32_BASE1,
2787                 BWN_DMA32_BASE2,
2788                 BWN_DMA32_BASE3,
2789                 BWN_DMA32_BASE4,
2790                 BWN_DMA32_BASE5,
2791         };
2792
2793         if (type == BHND_DMA_ADDR_64BIT) {
2794                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2795                     ("%s:%d: fail", __func__, __LINE__));
2796                 return (map64[controller_idx]);
2797         }
2798         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2799             ("%s:%d: fail", __func__, __LINE__));
2800         return (map32[controller_idx]);
2801 }
2802
2803 static void
2804 bwn_dma_init(struct bwn_mac *mac)
2805 {
2806         struct bwn_dma *dma = &mac->mac_method.dma;
2807
2808         /* setup TX DMA channels. */
2809         bwn_dma_setup(dma->wme[WME_AC_BK]);
2810         bwn_dma_setup(dma->wme[WME_AC_BE]);
2811         bwn_dma_setup(dma->wme[WME_AC_VI]);
2812         bwn_dma_setup(dma->wme[WME_AC_VO]);
2813         bwn_dma_setup(dma->mcast);
2814         /* setup RX DMA channel. */
2815         bwn_dma_setup(dma->rx);
2816 }
2817
2818 static struct bwn_dma_ring *
2819 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2820     int for_tx)
2821 {
2822         struct bwn_dma *dma = &mac->mac_method.dma;
2823         struct bwn_dma_ring *dr;
2824         struct bwn_dmadesc_generic *desc;
2825         struct bwn_dmadesc_meta *mt;
2826         struct bwn_softc *sc = mac->mac_sc;
2827         int error, i;
2828
2829         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2830         if (dr == NULL)
2831                 goto out;
2832         dr->dr_numslots = BWN_RXRING_SLOTS;
2833         if (for_tx)
2834                 dr->dr_numslots = BWN_TXRING_SLOTS;
2835
2836         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2837             M_DEVBUF, M_NOWAIT | M_ZERO);
2838         if (dr->dr_meta == NULL)
2839                 goto fail0;
2840
2841         dr->dr_type = mac->mac_dmatype;
2842         dr->dr_mac = mac;
2843         dr->dr_base = bwn_dma_base(dr->dr_type, controller_index);
2844         dr->dr_index = controller_index;
2845         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
2846                 dr->getdesc = bwn_dma_64_getdesc;
2847                 dr->setdesc = bwn_dma_64_setdesc;
2848                 dr->start_transfer = bwn_dma_64_start_transfer;
2849                 dr->suspend = bwn_dma_64_suspend;
2850                 dr->resume = bwn_dma_64_resume;
2851                 dr->get_curslot = bwn_dma_64_get_curslot;
2852                 dr->set_curslot = bwn_dma_64_set_curslot;
2853         } else {
2854                 dr->getdesc = bwn_dma_32_getdesc;
2855                 dr->setdesc = bwn_dma_32_setdesc;
2856                 dr->start_transfer = bwn_dma_32_start_transfer;
2857                 dr->suspend = bwn_dma_32_suspend;
2858                 dr->resume = bwn_dma_32_resume;
2859                 dr->get_curslot = bwn_dma_32_get_curslot;
2860                 dr->set_curslot = bwn_dma_32_set_curslot;
2861         }
2862         if (for_tx) {
2863                 dr->dr_tx = 1;
2864                 dr->dr_curslot = -1;
2865         } else {
2866                 if (dr->dr_index == 0) {
2867                         switch (mac->mac_fw.fw_hdr_format) {
2868                         case BWN_FW_HDR_351:
2869                         case BWN_FW_HDR_410:
2870                                 dr->dr_rx_bufsize =
2871                                     BWN_DMA0_RX_BUFFERSIZE_FW351;
2872                                 dr->dr_frameoffset =
2873                                     BWN_DMA0_RX_FRAMEOFFSET_FW351;
2874                                 break;
2875                         case BWN_FW_HDR_598:
2876                                 dr->dr_rx_bufsize =
2877                                     BWN_DMA0_RX_BUFFERSIZE_FW598;
2878                                 dr->dr_frameoffset =
2879                                     BWN_DMA0_RX_FRAMEOFFSET_FW598;
2880                                 break;
2881                         }
2882                 } else
2883                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2884         }
2885
2886         error = bwn_dma_allocringmemory(dr);
2887         if (error)
2888                 goto fail2;
2889
2890         if (for_tx) {
2891                 /*
2892                  * Assumption: BWN_TXRING_SLOTS can be divided by
2893                  * BWN_TX_SLOTS_PER_FRAME
2894                  */
2895                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2896                     ("%s:%d: fail", __func__, __LINE__));
2897
2898                 dr->dr_txhdr_cache = contigmalloc(
2899                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2900                     BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2901                     0, BUS_SPACE_MAXADDR, 8, 0);
2902                 if (dr->dr_txhdr_cache == NULL) {
2903                         device_printf(sc->sc_dev,
2904                             "can't allocate TX header DMA memory\n");
2905                         goto fail1;
2906                 }
2907
2908                 /*
2909                  * Create TX ring DMA stuffs
2910                  */
2911                 error = bus_dma_tag_create(dma->parent_dtag,
2912                                     BWN_ALIGN, 0,
2913                                     BUS_SPACE_MAXADDR,
2914                                     BUS_SPACE_MAXADDR,
2915                                     NULL, NULL,
2916                                     BWN_HDRSIZE(mac),
2917                                     1,
2918                                     BUS_SPACE_MAXSIZE_32BIT,
2919                                     0,
2920                                     NULL, NULL,
2921                                     &dr->dr_txring_dtag);
2922                 if (error) {
2923                         device_printf(sc->sc_dev,
2924                             "can't create TX ring DMA tag: TODO frees\n");
2925                         goto fail2;
2926                 }
2927
2928                 for (i = 0; i < dr->dr_numslots; i += 2) {
2929                         dr->getdesc(dr, i, &desc, &mt);
2930
2931                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2932                         mt->mt_m = NULL;
2933                         mt->mt_ni = NULL;
2934                         mt->mt_islast = 0;
2935                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2936                             &mt->mt_dmap);
2937                         if (error) {
2938                                 device_printf(sc->sc_dev,
2939                                      "can't create RX buf DMA map\n");
2940                                 goto fail2;
2941                         }
2942
2943                         dr->getdesc(dr, i + 1, &desc, &mt);
2944
2945                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2946                         mt->mt_m = NULL;
2947                         mt->mt_ni = NULL;
2948                         mt->mt_islast = 1;
2949                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2950                             &mt->mt_dmap);
2951                         if (error) {
2952                                 device_printf(sc->sc_dev,
2953                                      "can't create RX buf DMA map\n");
2954                                 goto fail2;
2955                         }
2956                 }
2957         } else {
2958                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2959                     &dr->dr_spare_dmap);
2960                 if (error) {
2961                         device_printf(sc->sc_dev,
2962                             "can't create RX buf DMA map\n");
2963                         goto out;               /* XXX wrong! */
2964                 }
2965
2966                 for (i = 0; i < dr->dr_numslots; i++) {
2967                         dr->getdesc(dr, i, &desc, &mt);
2968
2969                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2970                             &mt->mt_dmap);
2971                         if (error) {
2972                                 device_printf(sc->sc_dev,
2973                                     "can't create RX buf DMA map\n");
2974                                 goto out;       /* XXX wrong! */
2975                         }
2976                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2977                         if (error) {
2978                                 device_printf(sc->sc_dev,
2979                                     "failed to allocate RX buf\n");
2980                                 goto out;       /* XXX wrong! */
2981                         }
2982                 }
2983
2984                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2985                     BUS_DMASYNC_PREWRITE);
2986
2987                 dr->dr_usedslot = dr->dr_numslots;
2988         }
2989
2990       out:
2991         return (dr);
2992
2993 fail2:
2994         if (dr->dr_txhdr_cache != NULL) {
2995                 contigfree(dr->dr_txhdr_cache,
2996                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2997                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2998         }
2999 fail1:
3000         free(dr->dr_meta, M_DEVBUF);
3001 fail0:
3002         free(dr, M_DEVBUF);
3003         return (NULL);
3004 }
3005
3006 static void
3007 bwn_dma_ringfree(struct bwn_dma_ring **dr)
3008 {
3009
3010         if (dr == NULL)
3011                 return;
3012
3013         bwn_dma_free_descbufs(*dr);
3014         bwn_dma_free_ringmemory(*dr);
3015
3016         if ((*dr)->dr_txhdr_cache != NULL) {
3017                 contigfree((*dr)->dr_txhdr_cache,
3018                     ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
3019                     BWN_MAXTXHDRSIZE, M_DEVBUF);
3020         }
3021         free((*dr)->dr_meta, M_DEVBUF);
3022         free(*dr, M_DEVBUF);
3023
3024         *dr = NULL;
3025 }
3026
3027 static void
3028 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
3029     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3030 {
3031         struct bwn_dmadesc32 *desc;
3032
3033         *meta = &(dr->dr_meta[slot]);
3034         desc = dr->dr_ring_descbase;
3035         desc = &(desc[slot]);
3036
3037         *gdesc = (struct bwn_dmadesc_generic *)desc;
3038 }
3039
3040 static void
3041 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
3042     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3043     int start, int end, int irq)
3044 {
3045         struct bwn_dmadesc32            *descbase;
3046         struct bwn_dma                  *dma;
3047         struct bhnd_dma_translation     *dt;
3048         uint32_t                         addr, addrext, ctl;
3049         int                              slot;
3050
3051         descbase = dr->dr_ring_descbase;
3052         dma = &dr->dr_mac->mac_method.dma;
3053         dt = &dma->translation;
3054
3055         slot = (int)(&(desc->dma.dma32) - descbase);
3056         KASSERT(slot >= 0 && slot < dr->dr_numslots,
3057             ("%s:%d: fail", __func__, __LINE__));
3058
3059         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3060         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3061         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
3062         if (slot == dr->dr_numslots - 1)
3063                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
3064         if (start)
3065                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
3066         if (end)
3067                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
3068         if (irq)
3069                 ctl |= BWN_DMA32_DCTL_IRQ;
3070         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
3071             & BWN_DMA32_DCTL_ADDREXT_MASK;
3072
3073         desc->dma.dma32.control = htole32(ctl);
3074         desc->dma.dma32.address = htole32(addr);
3075 }
3076
3077 static void
3078 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
3079 {
3080
3081         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
3082             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
3083 }
3084
3085 static void
3086 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
3087 {
3088
3089         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3090             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
3091 }
3092
3093 static void
3094 bwn_dma_32_resume(struct bwn_dma_ring *dr)
3095 {
3096
3097         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3098             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
3099 }
3100
3101 static int
3102 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
3103 {
3104         uint32_t val;
3105
3106         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
3107         val &= BWN_DMA32_RXDPTR;
3108
3109         return (val / sizeof(struct bwn_dmadesc32));
3110 }
3111
3112 static void
3113 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
3114 {
3115
3116         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
3117             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
3118 }
3119
3120 static void
3121 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
3122     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3123 {
3124         struct bwn_dmadesc64 *desc;
3125
3126         *meta = &(dr->dr_meta[slot]);
3127         desc = dr->dr_ring_descbase;
3128         desc = &(desc[slot]);
3129
3130         *gdesc = (struct bwn_dmadesc_generic *)desc;
3131 }
3132
3133 static void
3134 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
3135     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3136     int start, int end, int irq)
3137 {
3138         struct bwn_dmadesc64            *descbase;
3139         struct bwn_dma                  *dma;
3140         struct bhnd_dma_translation     *dt;
3141         bhnd_addr_t                      addr;
3142         uint32_t                         addrhi, addrlo;
3143         uint32_t                         addrext;
3144         uint32_t                         ctl0, ctl1;
3145         int                              slot;
3146
3147         descbase = dr->dr_ring_descbase;
3148         dma = &dr->dr_mac->mac_method.dma;
3149         dt = &dma->translation;
3150
3151         slot = (int)(&(desc->dma.dma64) - descbase);
3152         KASSERT(slot >= 0 && slot < dr->dr_numslots,
3153             ("%s:%d: fail", __func__, __LINE__));
3154
3155         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3156         addrhi = (addr >> 32);
3157         addrlo = (addr & UINT32_MAX);
3158         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3159
3160         ctl0 = 0;
3161         if (slot == dr->dr_numslots - 1)
3162                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
3163         if (start)
3164                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
3165         if (end)
3166                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3167         if (irq)
3168                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
3169
3170         ctl1 = 0;
3171         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3172         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3173             & BWN_DMA64_DCTL1_ADDREXT_MASK;
3174
3175         desc->dma.dma64.control0 = htole32(ctl0);
3176         desc->dma.dma64.control1 = htole32(ctl1);
3177         desc->dma.dma64.address_low = htole32(addrlo);
3178         desc->dma.dma64.address_high = htole32(addrhi);
3179 }
3180
3181 static void
3182 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3183 {
3184
3185         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3186             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3187 }
3188
3189 static void
3190 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3191 {
3192
3193         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3194             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3195 }
3196
3197 static void
3198 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3199 {
3200
3201         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3202             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3203 }
3204
3205 static int
3206 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3207 {
3208         uint32_t val;
3209
3210         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3211         val &= BWN_DMA64_RXSTATDPTR;
3212
3213         return (val / sizeof(struct bwn_dmadesc64));
3214 }
3215
3216 static void
3217 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3218 {
3219
3220         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3221             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3222 }
3223
3224 static int
3225 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3226 {
3227         struct bwn_mac *mac = dr->dr_mac;
3228         struct bwn_dma *dma = &mac->mac_method.dma;
3229         struct bwn_softc *sc = mac->mac_sc;
3230         int error;
3231
3232         error = bus_dma_tag_create(dma->parent_dtag,
3233                             BWN_ALIGN, 0,
3234                             BUS_SPACE_MAXADDR,
3235                             BUS_SPACE_MAXADDR,
3236                             NULL, NULL,
3237                             BWN_DMA_RINGMEMSIZE,
3238                             1,
3239                             BUS_SPACE_MAXSIZE_32BIT,
3240                             0,
3241                             NULL, NULL,
3242                             &dr->dr_ring_dtag);
3243         if (error) {
3244                 device_printf(sc->sc_dev,
3245                     "can't create TX ring DMA tag: TODO frees\n");
3246                 return (-1);
3247         }
3248
3249         error = bus_dmamem_alloc(dr->dr_ring_dtag,
3250             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3251             &dr->dr_ring_dmap);
3252         if (error) {
3253                 device_printf(sc->sc_dev,
3254                     "can't allocate DMA mem: TODO frees\n");
3255                 return (-1);
3256         }
3257         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3258             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3259             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3260         if (error) {
3261                 device_printf(sc->sc_dev,
3262                     "can't load DMA mem: TODO free\n");
3263                 return (-1);
3264         }
3265
3266         return (0);
3267 }
3268
3269 static void
3270 bwn_dma_setup(struct bwn_dma_ring *dr)
3271 {
3272         struct bwn_mac                  *mac;
3273         struct bwn_dma                  *dma;
3274         struct bhnd_dma_translation     *dt;
3275         bhnd_addr_t                      addr, paddr;
3276         uint32_t                         addrhi, addrlo, addrext, value;
3277
3278         mac = dr->dr_mac;
3279         dma = &mac->mac_method.dma;
3280         dt = &dma->translation;
3281
3282         paddr = dr->dr_ring_dmabase;
3283         addr = (paddr & dt->addr_mask) | dt->base_addr;
3284         addrhi = (addr >> 32);
3285         addrlo = (addr & UINT32_MAX);
3286         addrext = ((paddr & dt->addrext_mask) >> dma->addrext_shift);
3287
3288         if (dr->dr_tx) {
3289                 dr->dr_curslot = -1;
3290
3291                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3292                         value = BWN_DMA64_TXENABLE;
3293                         value |= BWN_DMA64_TXPARITY_DISABLE;
3294                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3295                             & BWN_DMA64_TXADDREXT_MASK;
3296                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3297                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, addrlo);
3298                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, addrhi);
3299                 } else {
3300                         value = BWN_DMA32_TXENABLE;
3301                         value |= BWN_DMA32_TXPARITY_DISABLE;
3302                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3303                             & BWN_DMA32_TXADDREXT_MASK;
3304                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3305                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, addrlo);
3306                 }
3307                 return;
3308         }
3309
3310         /*
3311          * set for RX
3312          */
3313         dr->dr_usedslot = dr->dr_numslots;
3314
3315         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3316                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3317                 value |= BWN_DMA64_RXENABLE;
3318                 value |= BWN_DMA64_RXPARITY_DISABLE;
3319                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3320                     & BWN_DMA64_RXADDREXT_MASK;
3321                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3322                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, addrlo);
3323                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, addrhi);
3324                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3325                     sizeof(struct bwn_dmadesc64));
3326         } else {
3327                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3328                 value |= BWN_DMA32_RXENABLE;
3329                 value |= BWN_DMA32_RXPARITY_DISABLE;
3330                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3331                     & BWN_DMA32_RXADDREXT_MASK;
3332                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3333                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, addrlo);
3334                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3335                     sizeof(struct bwn_dmadesc32));
3336         }
3337 }
3338
3339 static void
3340 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3341 {
3342
3343         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3344         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3345             dr->dr_ring_dmap);
3346 }
3347
3348 static void
3349 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3350 {
3351
3352         if (dr->dr_tx) {
3353                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3354                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3355                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3356                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3357                 } else
3358                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3359         } else {
3360                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3361                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3362                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3363                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3364                 } else
3365                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3366         }
3367 }
3368
3369 static void
3370 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3371 {
3372         struct bwn_dmadesc_generic *desc;
3373         struct bwn_dmadesc_meta *meta;
3374         struct bwn_mac *mac = dr->dr_mac;
3375         struct bwn_dma *dma = &mac->mac_method.dma;
3376         struct bwn_softc *sc = mac->mac_sc;
3377         int i;
3378
3379         if (!dr->dr_usedslot)
3380                 return;
3381         for (i = 0; i < dr->dr_numslots; i++) {
3382                 dr->getdesc(dr, i, &desc, &meta);
3383
3384                 if (meta->mt_m == NULL) {
3385                         if (!dr->dr_tx)
3386                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3387                                     __func__);
3388                         continue;
3389                 }
3390                 if (dr->dr_tx) {
3391                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3392                                 bus_dmamap_unload(dr->dr_txring_dtag,
3393                                     meta->mt_dmap);
3394                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3395                                 bus_dmamap_unload(dma->txbuf_dtag,
3396                                     meta->mt_dmap);
3397                 } else
3398                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3399                 bwn_dma_free_descbuf(dr, meta);
3400         }
3401 }
3402
3403 static int
3404 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3405     int type)
3406 {
3407         struct bwn_softc *sc = mac->mac_sc;
3408         uint32_t value;
3409         int i;
3410         uint16_t offset;
3411
3412         for (i = 0; i < 10; i++) {
3413                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3414                     BWN_DMA32_TXSTATUS;
3415                 value = BWN_READ_4(mac, base + offset);
3416                 if (type == BHND_DMA_ADDR_64BIT) {
3417                         value &= BWN_DMA64_TXSTAT;
3418                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3419                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3420                             value == BWN_DMA64_TXSTAT_STOPPED)
3421                                 break;
3422                 } else {
3423                         value &= BWN_DMA32_TXSTATE;
3424                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3425                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3426                             value == BWN_DMA32_TXSTAT_STOPPED)
3427                                 break;
3428                 }
3429                 DELAY(1000);
3430         }
3431         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXCTL :
3432             BWN_DMA32_TXCTL;
3433         BWN_WRITE_4(mac, base + offset, 0);
3434         for (i = 0; i < 10; i++) {
3435                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3436                     BWN_DMA32_TXSTATUS;
3437                 value = BWN_READ_4(mac, base + offset);
3438                 if (type == BHND_DMA_ADDR_64BIT) {
3439                         value &= BWN_DMA64_TXSTAT;
3440                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3441                                 i = -1;
3442                                 break;
3443                         }
3444                 } else {
3445                         value &= BWN_DMA32_TXSTATE;
3446                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3447                                 i = -1;
3448                                 break;
3449                         }
3450                 }
3451                 DELAY(1000);
3452         }
3453         if (i != -1) {
3454                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3455                 return (ENODEV);
3456         }
3457         DELAY(1000);
3458
3459         return (0);
3460 }
3461
3462 static int
3463 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3464     int type)
3465 {
3466         struct bwn_softc *sc = mac->mac_sc;
3467         uint32_t value;
3468         int i;
3469         uint16_t offset;
3470
3471         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXCTL :
3472             BWN_DMA32_RXCTL;
3473         BWN_WRITE_4(mac, base + offset, 0);
3474         for (i = 0; i < 10; i++) {
3475                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXSTATUS :
3476                     BWN_DMA32_RXSTATUS;
3477                 value = BWN_READ_4(mac, base + offset);
3478                 if (type == BHND_DMA_ADDR_64BIT) {
3479                         value &= BWN_DMA64_RXSTAT;
3480                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3481                                 i = -1;
3482                                 break;
3483                         }
3484                 } else {
3485                         value &= BWN_DMA32_RXSTATE;
3486                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3487                                 i = -1;
3488                                 break;
3489                         }
3490                 }
3491                 DELAY(1000);
3492         }
3493         if (i != -1) {
3494                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3495                 return (ENODEV);
3496         }
3497
3498         return (0);
3499 }
3500
3501 static void
3502 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3503     struct bwn_dmadesc_meta *meta)
3504 {
3505
3506         if (meta->mt_m != NULL) {
3507                 m_freem(meta->mt_m);
3508                 meta->mt_m = NULL;
3509         }
3510         if (meta->mt_ni != NULL) {
3511                 ieee80211_free_node(meta->mt_ni);
3512                 meta->mt_ni = NULL;
3513         }
3514 }
3515
3516 static void
3517 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3518 {
3519         struct bwn_rxhdr4 *rxhdr;
3520         unsigned char *frame;
3521
3522         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3523         rxhdr->frame_len = 0;
3524
3525         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3526             sizeof(struct bwn_plcp6) + 2,
3527             ("%s:%d: fail", __func__, __LINE__));
3528         frame = mtod(m, char *) + dr->dr_frameoffset;
3529         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3530 }
3531
3532 static uint8_t
3533 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3534 {
3535         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3536
3537         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3538             == 0xff);
3539 }
3540
3541 static void
3542 bwn_wme_init(struct bwn_mac *mac)
3543 {
3544
3545         bwn_wme_load(mac);
3546
3547         /* enable WME support. */
3548         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3549         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3550             BWN_IFSCTL_USE_EDCF);
3551 }
3552
3553 static void
3554 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3555 {
3556         struct bwn_softc *sc = mac->mac_sc;
3557         struct ieee80211com *ic = &sc->sc_ic;
3558         uint16_t delay; /* microsec */
3559
3560         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3561         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3562                 delay = 500;
3563         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3564                 delay = max(delay, (uint16_t)2400);
3565
3566         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3567 }
3568
3569 static void
3570 bwn_bt_enable(struct bwn_mac *mac)
3571 {
3572         struct bwn_softc *sc = mac->mac_sc;
3573         uint64_t hf;
3574
3575         if (bwn_bluetooth == 0)
3576                 return;
3577         if ((sc->sc_board_info.board_flags & BHND_BFL_BTCOEX) == 0)
3578                 return;
3579         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3580                 return;
3581
3582         hf = bwn_hf_read(mac);
3583         if (sc->sc_board_info.board_flags & BHND_BFL_BTC2WIRE_ALTGPIO)
3584                 hf |= BWN_HF_BT_COEXISTALT;
3585         else
3586                 hf |= BWN_HF_BT_COEXIST;
3587         bwn_hf_write(mac, hf);
3588 }
3589
3590 static void
3591 bwn_set_macaddr(struct bwn_mac *mac)
3592 {
3593
3594         bwn_mac_write_bssid(mac);
3595         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3596             mac->mac_sc->sc_ic.ic_macaddr);
3597 }
3598
3599 static void
3600 bwn_clear_keys(struct bwn_mac *mac)
3601 {
3602         int i;
3603
3604         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3605                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3606                     ("%s:%d: fail", __func__, __LINE__));
3607
3608                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3609                     NULL, BWN_SEC_KEYSIZE, NULL);
3610                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3611                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3612                             NULL, BWN_SEC_KEYSIZE, NULL);
3613                 }
3614                 mac->mac_key[i].keyconf = NULL;
3615         }
3616 }
3617
3618 static void
3619 bwn_crypt_init(struct bwn_mac *mac)
3620 {
3621         struct bwn_softc *sc = mac->mac_sc;
3622
3623         mac->mac_max_nr_keys = (bhnd_get_hwrev(sc->sc_dev) >= 5) ? 58 : 20;
3624         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3625             ("%s:%d: fail", __func__, __LINE__));
3626         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3627         mac->mac_ktp *= 2;
3628         if (bhnd_get_hwrev(sc->sc_dev) >= 5)
3629                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3630         bwn_clear_keys(mac);
3631 }
3632
3633 static void
3634 bwn_chip_exit(struct bwn_mac *mac)
3635 {
3636         bwn_phy_exit(mac);
3637 }
3638
3639 static int
3640 bwn_fw_fillinfo(struct bwn_mac *mac)
3641 {
3642         int error;
3643
3644         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3645         if (error == 0)
3646                 return (0);
3647         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3648         if (error == 0)
3649                 return (0);
3650         return (error);
3651 }
3652
3653 /**
3654  * Request that the GPIO controller tristate all pins set in @p mask, granting
3655  * the MAC core control over the pins.
3656  *
3657  * @param mac   bwn MAC state.
3658  * @param pins  If the bit position for a pin number is set to one, tristate the
3659  *              pin.
3660  */
3661 int
3662 bwn_gpio_control(struct bwn_mac *mac, uint32_t pins)
3663 {
3664         struct bwn_softc        *sc;
3665         uint32_t                 flags[32];
3666         int                      error;
3667
3668         sc = mac->mac_sc;
3669
3670         /* Determine desired pin flags */
3671         for (size_t pin = 0; pin < nitems(flags); pin++) {
3672                 uint32_t pinbit = (1 << pin);
3673
3674                 if (pins & pinbit) {
3675                         /* Tristate output */
3676                         flags[pin] = GPIO_PIN_OUTPUT|GPIO_PIN_TRISTATE;
3677                 } else {
3678                         /* Leave unmodified */
3679                         flags[pin] = 0;
3680                 }
3681         }
3682
3683         /* Configure all pins */
3684         error = GPIO_PIN_CONFIG_32(sc->sc_gpio, 0, nitems(flags), flags);
3685         if (error) {
3686                 device_printf(sc->sc_dev, "error configuring %s pin flags: "
3687                     "%d\n", device_get_nameunit(sc->sc_gpio), error);
3688                 return (error);
3689         }
3690
3691         return (0);
3692 }
3693
3694 static int
3695 bwn_gpio_init(struct bwn_mac *mac)
3696 {
3697         struct bwn_softc        *sc;
3698         uint32_t                 pins;
3699
3700         sc = mac->mac_sc;
3701
3702         pins = 0xF;
3703
3704         BWN_WRITE_4(mac, BWN_MACCTL,
3705             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3706         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3707             BWN_READ_2(mac, BWN_GPIO_MASK) | pins);
3708
3709         if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL) {
3710                 /* MAC core is responsible for toggling PAREF via gpio9 */
3711                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3712                     BWN_READ_2(mac, BWN_GPIO_MASK) | BHND_GPIO_BOARD_PACTRL);
3713
3714                 pins |= BHND_GPIO_BOARD_PACTRL;
3715         }
3716
3717         return (bwn_gpio_control(mac, pins));
3718 }
3719
3720 static int
3721 bwn_fw_loadinitvals(struct bwn_mac *mac)
3722 {
3723 #define GETFWOFFSET(fwp, offset)                                \
3724         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3725         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3726         const struct bwn_fwhdr *hdr;
3727         struct bwn_fw *fw = &mac->mac_fw;
3728         int error;
3729
3730         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3731         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3732             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3733         if (error)
3734                 return (error);
3735         if (fw->initvals_band.fw) {
3736                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3737                 error = bwn_fwinitvals_write(mac,
3738                     GETFWOFFSET(fw->initvals_band, hdr_len),
3739                     be32toh(hdr->size),
3740                     fw->initvals_band.fw->datasize - hdr_len);
3741         }
3742         return (error);
3743 #undef GETFWOFFSET
3744 }
3745
3746 static int
3747 bwn_phy_init(struct bwn_mac *mac)
3748 {
3749         struct bwn_softc *sc = mac->mac_sc;
3750         int error;
3751
3752         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3753         mac->mac_phy.rf_onoff(mac, 1);
3754         error = mac->mac_phy.init(mac);
3755         if (error) {
3756                 device_printf(sc->sc_dev, "PHY init failed\n");
3757                 goto fail0;
3758         }
3759         error = bwn_switch_channel(mac,
3760             mac->mac_phy.get_default_chan(mac));
3761         if (error) {
3762                 device_printf(sc->sc_dev,
3763                     "failed to switch default channel\n");
3764                 goto fail1;
3765         }
3766         return (0);
3767 fail1:
3768         if (mac->mac_phy.exit)
3769                 mac->mac_phy.exit(mac);
3770 fail0:
3771         mac->mac_phy.rf_onoff(mac, 0);
3772
3773         return (error);
3774 }
3775
3776 static void
3777 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3778 {
3779         uint16_t ant;
3780         uint16_t tmp;
3781
3782         ant = bwn_ant2phy(antenna);
3783
3784         /* For ACK/CTS */
3785         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3786         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3787         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3788         /* For Probe Resposes */
3789         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3790         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3791         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3792 }
3793
3794 static void
3795 bwn_set_opmode(struct bwn_mac *mac)
3796 {
3797         struct bwn_softc *sc = mac->mac_sc;
3798         struct ieee80211com *ic = &sc->sc_ic;
3799         uint32_t ctl;
3800         uint16_t cfp_pretbtt;
3801
3802         ctl = BWN_READ_4(mac, BWN_MACCTL);
3803         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3804             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3805             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3806         ctl |= BWN_MACCTL_STA;
3807
3808         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3809             ic->ic_opmode == IEEE80211_M_MBSS)
3810                 ctl |= BWN_MACCTL_HOSTAP;
3811         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3812                 ctl &= ~BWN_MACCTL_STA;
3813         ctl |= sc->sc_filters;
3814
3815         if (bhnd_get_hwrev(sc->sc_dev) <= 4)
3816                 ctl |= BWN_MACCTL_PROMISC;
3817
3818         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3819
3820         cfp_pretbtt = 2;
3821         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3822                 if (sc->sc_cid.chip_id == BHND_CHIPID_BCM4306 &&
3823                     sc->sc_cid.chip_rev == 3)
3824                         cfp_pretbtt = 100;
3825                 else
3826                         cfp_pretbtt = 50;
3827         }
3828         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3829 }
3830
3831 static void
3832 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3833 {
3834         if (!error) {
3835                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3836                 *((bus_addr_t *)arg) = seg->ds_addr;
3837         }
3838 }
3839
3840 void
3841 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3842 {
3843         struct bwn_phy *phy = &mac->mac_phy;
3844         struct bwn_softc *sc = mac->mac_sc;
3845         unsigned int i, max_loop;
3846         uint16_t value;
3847         uint32_t buffer[5] = {
3848                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3849         };
3850
3851         if (ofdm) {
3852                 max_loop = 0x1e;
3853                 buffer[0] = 0x000201cc;
3854         } else {
3855                 max_loop = 0xfa;
3856                 buffer[0] = 0x000b846e;
3857         }
3858
3859         BWN_ASSERT_LOCKED(mac->mac_sc);
3860
3861         for (i = 0; i < 5; i++)
3862                 bwn_ram_write(mac, i * 4, buffer[i]);
3863
3864         BWN_WRITE_2(mac, 0x0568, 0x0000);
3865         BWN_WRITE_2(mac, 0x07c0,
3866             (bhnd_get_hwrev(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3867
3868         value = (ofdm ? 0x41 : 0x40);
3869         BWN_WRITE_2(mac, 0x050c, value);
3870
3871         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3872             phy->type == BWN_PHYTYPE_LCN)
3873                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3874         BWN_WRITE_2(mac, 0x0508, 0x0000);
3875         BWN_WRITE_2(mac, 0x050a, 0x0000);
3876         BWN_WRITE_2(mac, 0x054c, 0x0000);
3877         BWN_WRITE_2(mac, 0x056a, 0x0014);
3878         BWN_WRITE_2(mac, 0x0568, 0x0826);
3879         BWN_WRITE_2(mac, 0x0500, 0x0000);
3880
3881         /* XXX TODO: n phy pa override? */
3882
3883         switch (phy->type) {
3884         case BWN_PHYTYPE_N:
3885         case BWN_PHYTYPE_LCN:
3886                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
3887                 break;
3888         case BWN_PHYTYPE_LP:
3889                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3890                 break;
3891         default:
3892                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3893                 break;
3894         }
3895
3896         /* flush */
3897         BWN_READ_2(mac, 0x0502);
3898
3899         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3900                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3901         for (i = 0x00; i < max_loop; i++) {
3902                 value = BWN_READ_2(mac, 0x050e);
3903                 if (value & 0x0080)
3904                         break;
3905                 DELAY(10);
3906         }
3907         for (i = 0x00; i < 0x0a; i++) {
3908                 value = BWN_READ_2(mac, 0x050e);
3909                 if (value & 0x0400)
3910                         break;
3911                 DELAY(10);
3912         }
3913         for (i = 0x00; i < 0x19; i++) {
3914                 value = BWN_READ_2(mac, 0x0690);
3915                 if (!(value & 0x0100))
3916                         break;
3917                 DELAY(10);
3918         }
3919         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3920                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3921 }
3922
3923 void
3924 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3925 {
3926         uint32_t macctl;
3927
3928         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3929
3930         macctl = BWN_READ_4(mac, BWN_MACCTL);
3931         if (macctl & BWN_MACCTL_BIGENDIAN)
3932                 printf("TODO: need swap\n");
3933
3934         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3935         BWN_BARRIER(mac, BWN_RAM_CONTROL, 4, BUS_SPACE_BARRIER_WRITE);
3936         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3937 }
3938
3939 void
3940 bwn_mac_suspend(struct bwn_mac *mac)
3941 {
3942         struct bwn_softc *sc = mac->mac_sc;
3943         int i;
3944         uint32_t tmp;
3945
3946         KASSERT(mac->mac_suspended >= 0,
3947             ("%s:%d: fail", __func__, __LINE__));
3948
3949         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3950             __func__, mac->mac_suspended);
3951
3952         if (mac->mac_suspended == 0) {
3953                 bwn_psctl(mac, BWN_PS_AWAKE);
3954                 BWN_WRITE_4(mac, BWN_MACCTL,
3955                             BWN_READ_4(mac, BWN_MACCTL)
3956                             & ~BWN_MACCTL_ON);
3957                 BWN_READ_4(mac, BWN_MACCTL);
3958                 for (i = 35; i; i--) {
3959                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3960                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3961                                 goto out;
3962                         DELAY(10);
3963                 }
3964                 for (i = 40; i; i--) {
3965                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3966                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3967                                 goto out;
3968                         DELAY(1000);
3969                 }
3970                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3971         }
3972 out:
3973         mac->mac_suspended++;
3974 }
3975
3976 void
3977 bwn_mac_enable(struct bwn_mac *mac)
3978 {
3979         struct bwn_softc *sc = mac->mac_sc;
3980         uint16_t state;
3981
3982         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3983             __func__, mac->mac_suspended);
3984
3985         state = bwn_shm_read_2(mac, BWN_SHARED,
3986             BWN_SHARED_UCODESTAT);
3987         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3988             state != BWN_SHARED_UCODESTAT_SLEEP) {
3989                 DPRINTF(sc, BWN_DEBUG_FW,
3990                     "%s: warn: firmware state (%d)\n",
3991                     __func__, state);
3992         }
3993
3994         mac->mac_suspended--;
3995         KASSERT(mac->mac_suspended >= 0,
3996             ("%s:%d: fail", __func__, __LINE__));
3997         if (mac->mac_suspended == 0) {
3998                 BWN_WRITE_4(mac, BWN_MACCTL,
3999                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
4000                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
4001                 BWN_READ_4(mac, BWN_MACCTL);
4002                 BWN_READ_4(mac, BWN_INTR_REASON);
4003                 bwn_psctl(mac, 0);
4004         }
4005 }
4006
4007 void
4008 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
4009 {
4010         struct bwn_softc *sc = mac->mac_sc;
4011         int i;
4012         uint16_t ucstat;
4013
4014         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
4015             ("%s:%d: fail", __func__, __LINE__));
4016         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
4017             ("%s:%d: fail", __func__, __LINE__));
4018
4019         /* XXX forcibly awake and hwps-off */
4020
4021         BWN_WRITE_4(mac, BWN_MACCTL,
4022             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
4023             ~BWN_MACCTL_HWPS);
4024         BWN_READ_4(mac, BWN_MACCTL);
4025         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4026                 for (i = 0; i < 100; i++) {
4027                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
4028                             BWN_SHARED_UCODESTAT);
4029                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
4030                                 break;
4031                         DELAY(10);
4032                 }
4033         }
4034         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
4035             ucstat);
4036 }
4037
4038 static int
4039 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
4040 {
4041         struct bwn_softc *sc = mac->mac_sc;
4042         struct bwn_fw *fw = &mac->mac_fw;
4043         const uint8_t rev = bhnd_get_hwrev(sc->sc_dev);
4044         const char *filename;
4045         uint16_t iost;
4046         int error;
4047
4048         /* microcode */
4049         filename = NULL;
4050         switch (rev) {
4051         case 42:
4052                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4053                         filename = "ucode42";
4054                 break;
4055         case 40:
4056                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4057                         filename = "ucode40";
4058                 break;
4059         case 33:
4060                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
4061                         filename = "ucode33_lcn40";
4062                 break;
4063         case 30:
4064                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4065                         filename = "ucode30_mimo";
4066                 break;
4067         case 29:
4068                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4069                         filename = "ucode29_mimo";
4070                 break;
4071         case 26:
4072                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4073                         filename = "ucode26_mimo";
4074                 break;
4075         case 28:
4076         case 25:
4077                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4078                         filename = "ucode25_mimo";
4079                 else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4080                         filename = "ucode25_lcn";
4081                 break;
4082         case 24:
4083                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4084                         filename = "ucode24_lcn";
4085                 break;
4086         case 23:
4087                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4088                         filename = "ucode16_mimo";
4089                 break;
4090         case 16:
4091         case 17:
4092         case 18:
4093         case 19:
4094                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4095                         filename = "ucode16_mimo";
4096                 else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
4097                         filename = "ucode16_lp";
4098                 break;
4099         case 15:
4100                 filename = "ucode15";
4101                 break;
4102         case 14:
4103                 filename = "ucode14";
4104                 break;
4105         case 13:
4106                 filename = "ucode13";
4107                 break;
4108         case 12:
4109         case 11:
4110                 filename = "ucode11";
4111                 break;
4112         case 10:
4113         case 9:
4114         case 8:
4115         case 7:
4116         case 6:
4117         case 5:
4118                 filename = "ucode5";
4119                 break;
4120         default:
4121                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
4122                 bwn_release_firmware(mac);
4123                 return (EOPNOTSUPP);
4124         }
4125
4126         device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
4127         error = bwn_fw_get(mac, type, filename, &fw->ucode);
4128         if (error) {
4129                 bwn_release_firmware(mac);
4130                 return (error);
4131         }
4132
4133         /* PCM */
4134         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
4135         if (rev >= 5 && rev <= 10) {
4136                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
4137                 if (error == ENOENT)
4138                         fw->no_pcmfile = 1;
4139                 else if (error) {
4140                         bwn_release_firmware(mac);
4141                         return (error);
4142                 }
4143         } else if (rev < 11) {
4144                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
4145                 bwn_release_firmware(mac);
4146                 return (EOPNOTSUPP);
4147         }
4148
4149         /* initvals */
4150         error = bhnd_read_iost(sc->sc_dev, &iost);
4151         if (error)
4152                 goto fail1;
4153
4154         switch (mac->mac_phy.type) {
4155         case BWN_PHYTYPE_A:
4156                 if (rev < 5 || rev > 10)
4157                         goto fail1;
4158                 if (iost & BWN_IOST_HAVE_2GHZ)
4159                         filename = "a0g1initvals5";
4160                 else
4161                         filename = "a0g0initvals5";
4162                 break;
4163         case BWN_PHYTYPE_G:
4164                 if (rev >= 5 && rev <= 10)
4165                         filename = "b0g0initvals5";
4166                 else if (rev >= 13)
4167                         filename = "b0g0initvals13";
4168                 else
4169                         goto fail1;
4170                 break;
4171         case BWN_PHYTYPE_LP:
4172                 if (rev == 13)
4173                         filename = "lp0initvals13";
4174                 else if (rev == 14)
4175                         filename = "lp0initvals14";
4176                 else if (rev >= 15)
4177                         filename = "lp0initvals15";
4178                 else
4179                         goto fail1;
4180                 break;
4181         case BWN_PHYTYPE_N:
4182                 if (rev == 30)
4183                         filename = "n16initvals30";
4184                 else if (rev == 28 || rev == 25)
4185                         filename = "n0initvals25";
4186                 else if (rev == 24)
4187                         filename = "n0initvals24";
4188                 else if (rev == 23)
4189                         filename = "n0initvals16";
4190                 else if (rev >= 16 && rev <= 18)
4191                         filename = "n0initvals16";
4192                 else if (rev >= 11 && rev <= 12)
4193                         filename = "n0initvals11";
4194                 else
4195                         goto fail1;
4196                 break;
4197         default:
4198                 goto fail1;
4199         }
4200         error = bwn_fw_get(mac, type, filename, &fw->initvals);
4201         if (error) {
4202                 bwn_release_firmware(mac);
4203                 return (error);
4204         }
4205
4206         /* bandswitch initvals */
4207         switch (mac->mac_phy.type) {
4208         case BWN_PHYTYPE_A:
4209                 if (rev >= 5 && rev <= 10) {
4210                         if (iost & BWN_IOST_HAVE_2GHZ)
4211                                 filename = "a0g1bsinitvals5";
4212                         else
4213                                 filename = "a0g0bsinitvals5";
4214                 } else if (rev >= 11)
4215                         filename = NULL;
4216                 else
4217                         goto fail1;
4218                 break;
4219         case BWN_PHYTYPE_G:
4220                 if (rev >= 5 && rev <= 10)
4221                         filename = "b0g0bsinitvals5";
4222                 else if (rev >= 11)
4223                         filename = NULL;
4224                 else
4225                         goto fail1;
4226                 break;
4227         case BWN_PHYTYPE_LP:
4228                 if (rev == 13)
4229                         filename = "lp0bsinitvals13";
4230                 else if (rev == 14)
4231                         filename = "lp0bsinitvals14";
4232                 else if (rev >= 15)
4233                         filename = "lp0bsinitvals15";
4234                 else
4235                         goto fail1;
4236                 break;
4237         case BWN_PHYTYPE_N:
4238                 if (rev == 30)
4239                         filename = "n16bsinitvals30";
4240                 else if (rev == 28 || rev == 25)
4241                         filename = "n0bsinitvals25";
4242                 else if (rev == 24)
4243                         filename = "n0bsinitvals24";
4244                 else if (rev == 23)
4245                         filename = "n0bsinitvals16";
4246                 else if (rev >= 16 && rev <= 18)
4247                         filename = "n0bsinitvals16";
4248                 else if (rev >= 11 && rev <= 12)
4249                         filename = "n0bsinitvals11";
4250                 else
4251                         goto fail1;
4252                 break;
4253         default:
4254                 device_printf(sc->sc_dev, "unknown phy (%d)\n",
4255                     mac->mac_phy.type);
4256                 goto fail1;
4257         }
4258         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4259         if (error) {
4260                 bwn_release_firmware(mac);
4261                 return (error);
4262         }
4263         return (0);
4264 fail1:
4265         device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4266             rev, mac->mac_phy.type);
4267         bwn_release_firmware(mac);
4268         return (EOPNOTSUPP);
4269 }
4270
4271 static int
4272 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4273     const char *name, struct bwn_fwfile *bfw)
4274 {
4275         const struct bwn_fwhdr *hdr;
4276         struct bwn_softc *sc = mac->mac_sc;
4277         const struct firmware *fw;
4278         char namebuf[64];
4279
4280         if (name == NULL) {
4281                 bwn_do_release_fw(bfw);
4282                 return (0);
4283         }
4284         if (bfw->filename != NULL) {
4285                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4286                         return (0);
4287                 bwn_do_release_fw(bfw);
4288         }
4289
4290         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4291             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4292             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4293         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
4294         fw = firmware_get(namebuf);
4295         if (fw == NULL) {
4296                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4297                     namebuf);
4298                 return (ENOENT);
4299         }
4300         if (fw->datasize < sizeof(struct bwn_fwhdr))
4301                 goto fail;
4302         hdr = (const struct bwn_fwhdr *)(fw->data);
4303         switch (hdr->type) {
4304         case BWN_FWTYPE_UCODE:
4305         case BWN_FWTYPE_PCM:
4306                 if (be32toh(hdr->size) !=
4307                     (fw->datasize - sizeof(struct bwn_fwhdr)))
4308                         goto fail;
4309                 /* FALLTHROUGH */
4310         case BWN_FWTYPE_IV:
4311                 if (hdr->ver != 1)
4312                         goto fail;
4313                 break;
4314         default:
4315                 goto fail;
4316         }
4317         bfw->filename = name;
4318         bfw->fw = fw;
4319         bfw->type = type;
4320         return (0);
4321 fail:
4322         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4323         if (fw != NULL)
4324                 firmware_put(fw, FIRMWARE_UNLOAD);
4325         return (EPROTO);
4326 }
4327
4328 static void
4329 bwn_release_firmware(struct bwn_mac *mac)
4330 {
4331
4332         bwn_do_release_fw(&mac->mac_fw.ucode);
4333         bwn_do_release_fw(&mac->mac_fw.pcm);
4334         bwn_do_release_fw(&mac->mac_fw.initvals);
4335         bwn_do_release_fw(&mac->mac_fw.initvals_band);
4336 }
4337
4338 static void
4339 bwn_do_release_fw(struct bwn_fwfile *bfw)
4340 {
4341
4342         if (bfw->fw != NULL)
4343                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4344         bfw->fw = NULL;
4345         bfw->filename = NULL;
4346 }
4347
4348 static int
4349 bwn_fw_loaducode(struct bwn_mac *mac)
4350 {
4351 #define GETFWOFFSET(fwp, offset)        \
4352         ((const uint32_t *)((const char *)fwp.fw->data + offset))
4353 #define GETFWSIZE(fwp, offset)  \
4354         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
4355         struct bwn_softc *sc = mac->mac_sc;
4356         const uint32_t *data;
4357         unsigned int i;
4358         uint32_t ctl;
4359         uint16_t date, fwcaps, time;
4360         int error = 0;
4361
4362         ctl = BWN_READ_4(mac, BWN_MACCTL);
4363         ctl |= BWN_MACCTL_MCODE_JMP0;
4364         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4365             __LINE__));
4366         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4367         for (i = 0; i < 64; i++)
4368                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4369         for (i = 0; i < 4096; i += 2)
4370                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4371
4372         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4373         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4374         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4375              i++) {
4376                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4377                 DELAY(10);
4378         }
4379
4380         if (mac->mac_fw.pcm.fw) {
4381                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4382                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4383                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4384                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4385                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4386                     sizeof(struct bwn_fwhdr)); i++) {
4387                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4388                         DELAY(10);
4389                 }
4390         }
4391
4392         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4393         BWN_WRITE_4(mac, BWN_MACCTL,
4394             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4395             BWN_MACCTL_MCODE_RUN);
4396
4397         for (i = 0; i < 21; i++) {
4398                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4399                         break;
4400                 if (i >= 20) {
4401                         device_printf(sc->sc_dev, "ucode timeout\n");
4402                         error = ENXIO;
4403                         goto error;
4404                 }
4405                 DELAY(50000);
4406         }
4407         BWN_READ_4(mac, BWN_INTR_REASON);
4408
4409         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4410         if (mac->mac_fw.rev <= 0x128) {
4411                 device_printf(sc->sc_dev, "the firmware is too old\n");
4412                 error = EOPNOTSUPP;
4413                 goto error;
4414         }
4415
4416         /*
4417          * Determine firmware header version; needed for TX/RX packet
4418          * handling.
4419          */
4420         if (mac->mac_fw.rev >= 598)
4421                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4422         else if (mac->mac_fw.rev >= 410)
4423                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4424         else
4425                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4426
4427         /*
4428          * We don't support rev 598 or later; that requires
4429          * another round of changes to the TX/RX descriptor
4430          * and status layout.
4431          *
4432          * So, complain this is the case and exit out, rather
4433          * than attaching and then failing.
4434          */
4435 #if 0
4436         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4437                 device_printf(sc->sc_dev,
4438                     "firmware is too new (>=598); not supported\n");
4439                 error = EOPNOTSUPP;
4440                 goto error;
4441         }
4442 #endif
4443
4444         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4445             BWN_SHARED_UCODE_PATCH);
4446         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4447         mac->mac_fw.opensource = (date == 0xffff);
4448         if (bwn_wme != 0)
4449                 mac->mac_flags |= BWN_MAC_FLAG_WME;
4450         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4451
4452         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4453         if (mac->mac_fw.opensource == 0) {
4454                 device_printf(sc->sc_dev,
4455                     "firmware version (rev %u patch %u date %#x time %#x)\n",
4456                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4457                 if (mac->mac_fw.no_pcmfile)
4458                         device_printf(sc->sc_dev,
4459                             "no HW crypto acceleration due to pcm5\n");
4460         } else {
4461                 mac->mac_fw.patch = time;
4462                 fwcaps = bwn_fwcaps_read(mac);
4463                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4464                         device_printf(sc->sc_dev,
4465                             "disabling HW crypto acceleration\n");
4466                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4467                 }
4468                 if (!(fwcaps & BWN_FWCAPS_WME)) {
4469                         device_printf(sc->sc_dev, "disabling WME support\n");
4470                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4471                 }
4472         }
4473
4474         if (BWN_ISOLDFMT(mac))
4475                 device_printf(sc->sc_dev, "using old firmware image\n");
4476
4477         return (0);
4478
4479 error:
4480         BWN_WRITE_4(mac, BWN_MACCTL,
4481             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4482             BWN_MACCTL_MCODE_JMP0);
4483
4484         return (error);
4485 #undef GETFWSIZE
4486 #undef GETFWOFFSET
4487 }
4488
4489 /* OpenFirmware only */
4490 static uint16_t
4491 bwn_fwcaps_read(struct bwn_mac *mac)
4492 {
4493
4494         KASSERT(mac->mac_fw.opensource == 1,
4495             ("%s:%d: fail", __func__, __LINE__));
4496         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4497 }
4498
4499 static int
4500 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4501     size_t count, size_t array_size)
4502 {
4503 #define GET_NEXTIV16(iv)                                                \
4504         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4505             sizeof(uint16_t) + sizeof(uint16_t)))
4506 #define GET_NEXTIV32(iv)                                                \
4507         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4508             sizeof(uint16_t) + sizeof(uint32_t)))
4509         struct bwn_softc *sc = mac->mac_sc;
4510         const struct bwn_fwinitvals *iv;
4511         uint16_t offset;
4512         size_t i;
4513         uint8_t bit32;
4514
4515         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4516             ("%s:%d: fail", __func__, __LINE__));
4517         iv = ivals;
4518         for (i = 0; i < count; i++) {
4519                 if (array_size < sizeof(iv->offset_size))
4520                         goto fail;
4521                 array_size -= sizeof(iv->offset_size);
4522                 offset = be16toh(iv->offset_size);
4523                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4524                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4525                 if (offset >= 0x1000)
4526                         goto fail;
4527                 if (bit32) {
4528                         if (array_size < sizeof(iv->data.d32))
4529                                 goto fail;
4530                         array_size -= sizeof(iv->data.d32);
4531                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4532                         iv = GET_NEXTIV32(iv);
4533                 } else {
4534                         if (array_size < sizeof(iv->data.d16))
4535                                 goto fail;
4536                         array_size -= sizeof(iv->data.d16);
4537                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4538
4539                         iv = GET_NEXTIV16(iv);
4540                 }
4541         }
4542         if (array_size != 0)
4543                 goto fail;
4544         return (0);
4545 fail:
4546         device_printf(sc->sc_dev, "initvals: invalid format\n");
4547         return (EPROTO);
4548 #undef GET_NEXTIV16
4549 #undef GET_NEXTIV32
4550 }
4551
4552 int
4553 bwn_switch_channel(struct bwn_mac *mac, int chan)
4554 {
4555         struct bwn_phy *phy = &(mac->mac_phy);
4556         struct bwn_softc *sc = mac->mac_sc;
4557         struct ieee80211com *ic = &sc->sc_ic;
4558         uint16_t channelcookie, savedcookie;
4559         int error;
4560
4561         if (chan == 0xffff)
4562                 chan = phy->get_default_chan(mac);
4563
4564         channelcookie = chan;
4565         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4566                 channelcookie |= 0x100;
4567         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4568         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4569         error = phy->switch_channel(mac, chan);
4570         if (error)
4571                 goto fail;
4572
4573         mac->mac_phy.chan = chan;
4574         DELAY(8000);
4575         return (0);
4576 fail:
4577         device_printf(sc->sc_dev, "failed to switch channel\n");
4578         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4579         return (error);
4580 }
4581
4582 static uint16_t
4583 bwn_ant2phy(int antenna)
4584 {
4585
4586         switch (antenna) {
4587         case BWN_ANT0:
4588                 return (BWN_TX_PHY_ANT0);
4589         case BWN_ANT1:
4590                 return (BWN_TX_PHY_ANT1);
4591         case BWN_ANT2:
4592                 return (BWN_TX_PHY_ANT2);
4593         case BWN_ANT3:
4594                 return (BWN_TX_PHY_ANT3);
4595         case BWN_ANTAUTO:
4596                 return (BWN_TX_PHY_ANT01AUTO);
4597         }
4598         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4599         return (0);
4600 }
4601
4602 static void
4603 bwn_wme_load(struct bwn_mac *mac)
4604 {
4605         struct bwn_softc *sc = mac->mac_sc;
4606         int i;
4607
4608         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4609             ("%s:%d: fail", __func__, __LINE__));
4610
4611         bwn_mac_suspend(mac);
4612         for (i = 0; i < N(sc->sc_wmeParams); i++)
4613                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4614                     bwn_wme_shm_offsets[i]);
4615         bwn_mac_enable(mac);
4616 }
4617
4618 static void
4619 bwn_wme_loadparams(struct bwn_mac *mac,
4620     const struct wmeParams *p, uint16_t shm_offset)
4621 {
4622         struct bwn_softc *sc = mac->mac_sc;
4623         uint16_t params[BWN_NR_WMEPARAMS];
4624         int slot, tmp;
4625         unsigned int i;
4626
4627         slot = BWN_READ_2(mac, BWN_RNG) &
4628             _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4629
4630         memset(&params, 0, sizeof(params));
4631
4632         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4633             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4634             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4635
4636         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4637         params[BWN_WMEPARAM_CWMIN] =
4638             _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4639         params[BWN_WMEPARAM_CWMAX] =
4640              _IEEE80211_SHIFTMASK(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4641         params[BWN_WMEPARAM_CWCUR] =
4642              _IEEE80211_SHIFTMASK(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4643         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4644         params[BWN_WMEPARAM_BSLOTS] = slot;
4645         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4646
4647         for (i = 0; i < N(params); i++) {
4648                 if (i == BWN_WMEPARAM_STATUS) {
4649                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4650                             shm_offset + (i * 2));
4651                         tmp |= 0x100;
4652                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4653                             tmp);
4654                 } else {
4655                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4656                             params[i]);
4657                 }
4658         }
4659 }
4660
4661 static void
4662 bwn_mac_write_bssid(struct bwn_mac *mac)
4663 {
4664         struct bwn_softc *sc = mac->mac_sc;
4665         uint32_t tmp;
4666         int i;
4667         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4668
4669         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4670         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4671         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4672             IEEE80211_ADDR_LEN);
4673
4674         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4675                 tmp = (uint32_t) (mac_bssid[i + 0]);
4676                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4677                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4678                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4679                 bwn_ram_write(mac, 0x20 + i, tmp);
4680         }
4681 }
4682
4683 static void
4684 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4685     const uint8_t *macaddr)
4686 {
4687         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4688         uint16_t data;
4689
4690         if (!mac)
4691                 macaddr = zero;
4692
4693         offset |= 0x0020;
4694         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4695
4696         data = macaddr[0];
4697         data |= macaddr[1] << 8;
4698         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4699         data = macaddr[2];
4700         data |= macaddr[3] << 8;
4701         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4702         data = macaddr[4];
4703         data |= macaddr[5] << 8;
4704         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4705 }
4706
4707 static void
4708 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4709     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4710 {
4711         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4712         uint8_t per_sta_keys_start = 8;
4713
4714         if (BWN_SEC_NEWAPI(mac))
4715                 per_sta_keys_start = 4;
4716
4717         KASSERT(index < mac->mac_max_nr_keys,
4718             ("%s:%d: fail", __func__, __LINE__));
4719         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4720             ("%s:%d: fail", __func__, __LINE__));
4721
4722         if (index >= per_sta_keys_start)
4723                 bwn_key_macwrite(mac, index, NULL);
4724         if (key)
4725                 memcpy(buf, key, key_len);
4726         bwn_key_write(mac, index, algorithm, buf);
4727         if (index >= per_sta_keys_start)
4728                 bwn_key_macwrite(mac, index, mac_addr);
4729
4730         mac->mac_key[index].algorithm = algorithm;
4731 }
4732
4733 static void
4734 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4735 {
4736         struct bwn_softc *sc = mac->mac_sc;
4737         uint32_t addrtmp[2] = { 0, 0 };
4738         uint8_t start = 8;
4739
4740         if (BWN_SEC_NEWAPI(mac))
4741                 start = 4;
4742
4743         KASSERT(index >= start,
4744             ("%s:%d: fail", __func__, __LINE__));
4745         index -= start;
4746
4747         if (addr) {
4748                 addrtmp[0] = addr[0];
4749                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4750                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4751                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4752                 addrtmp[1] = addr[4];
4753                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4754         }
4755
4756         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4757                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4758                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4759         } else {
4760                 if (index >= 8) {
4761                         bwn_shm_write_4(mac, BWN_SHARED,
4762                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4763                         bwn_shm_write_2(mac, BWN_SHARED,
4764                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4765                 }
4766         }
4767 }
4768
4769 static void
4770 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4771     const uint8_t *key)
4772 {
4773         unsigned int i;
4774         uint32_t offset;
4775         uint16_t kidx, value;
4776
4777         kidx = BWN_SEC_KEY2FW(mac, index);
4778         bwn_shm_write_2(mac, BWN_SHARED,
4779             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4780
4781         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4782         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4783                 value = key[i];
4784                 value |= (uint16_t)(key[i + 1]) << 8;
4785                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4786         }
4787 }
4788
4789 static void
4790 bwn_phy_exit(struct bwn_mac *mac)
4791 {
4792
4793         mac->mac_phy.rf_onoff(mac, 0);
4794         if (mac->mac_phy.exit != NULL)
4795                 mac->mac_phy.exit(mac);
4796 }
4797
4798 static void
4799 bwn_dma_free(struct bwn_mac *mac)
4800 {
4801         struct bwn_dma *dma;
4802
4803         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4804                 return;
4805         dma = &mac->mac_method.dma;
4806
4807         bwn_dma_ringfree(&dma->rx);
4808         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4809         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4810         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4811         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4812         bwn_dma_ringfree(&dma->mcast);
4813 }
4814
4815 static void
4816 bwn_core_stop(struct bwn_mac *mac)
4817 {
4818         struct bwn_softc *sc = mac->mac_sc;
4819
4820         BWN_ASSERT_LOCKED(sc);
4821
4822         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4823                 return;
4824
4825         callout_stop(&sc->sc_rfswitch_ch);
4826         callout_stop(&sc->sc_task_ch);
4827         callout_stop(&sc->sc_watchdog_ch);
4828         sc->sc_watchdog_timer = 0;
4829         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4830         BWN_READ_4(mac, BWN_INTR_MASK);
4831         bwn_mac_suspend(mac);
4832
4833         mac->mac_status = BWN_MAC_STATUS_INITED;
4834 }
4835
4836 static int
4837 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4838 {
4839         struct bwn_mac *up_dev = NULL;
4840         struct bwn_mac *down_dev;
4841         struct bwn_mac *mac;
4842         int err, status;
4843         uint8_t gmode;
4844
4845         BWN_ASSERT_LOCKED(sc);
4846
4847         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4848                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4849                     mac->mac_phy.supports_2ghz) {
4850                         up_dev = mac;
4851                         gmode = 1;
4852                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4853                     mac->mac_phy.supports_5ghz) {
4854                         up_dev = mac;
4855                         gmode = 0;
4856                 } else {
4857                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4858                         return (EINVAL);
4859                 }
4860                 if (up_dev != NULL)
4861                         break;
4862         }
4863         if (up_dev == NULL) {
4864                 device_printf(sc->sc_dev, "Could not find a device\n");
4865                 return (ENODEV);
4866         }
4867         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4868                 return (0);
4869
4870         DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4871             "switching to %s-GHz band\n",
4872             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4873
4874         down_dev = sc->sc_curmac;
4875         status = down_dev->mac_status;
4876         if (status >= BWN_MAC_STATUS_STARTED)
4877                 bwn_core_stop(down_dev);
4878         if (status >= BWN_MAC_STATUS_INITED)
4879                 bwn_core_exit(down_dev);
4880
4881         if (down_dev != up_dev) {
4882                 err = bwn_phy_reset(down_dev);
4883                 if (err)
4884                         goto fail;
4885         }
4886
4887         up_dev->mac_phy.gmode = gmode;
4888         if (status >= BWN_MAC_STATUS_INITED) {
4889                 err = bwn_core_init(up_dev);
4890                 if (err) {
4891                         device_printf(sc->sc_dev,
4892                             "fatal: failed to initialize for %s-GHz\n",
4893                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4894                         goto fail;
4895                 }
4896         }
4897         if (status >= BWN_MAC_STATUS_STARTED)
4898                 bwn_core_start(up_dev);
4899         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4900         sc->sc_curmac = up_dev;
4901
4902         return (0);
4903 fail:
4904         sc->sc_curmac = NULL;
4905         return (err);
4906 }
4907
4908 static void
4909 bwn_rf_turnon(struct bwn_mac *mac)
4910 {
4911
4912         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4913
4914         bwn_mac_suspend(mac);
4915         mac->mac_phy.rf_onoff(mac, 1);
4916         mac->mac_phy.rf_on = 1;
4917         bwn_mac_enable(mac);
4918 }
4919
4920 static void
4921 bwn_rf_turnoff(struct bwn_mac *mac)
4922 {
4923
4924         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4925
4926         bwn_mac_suspend(mac);
4927         mac->mac_phy.rf_onoff(mac, 0);
4928         mac->mac_phy.rf_on = 0;
4929         bwn_mac_enable(mac);
4930 }
4931
4932 /*
4933  * PHY reset.
4934  */
4935 static int
4936 bwn_phy_reset(struct bwn_mac *mac)
4937 {
4938         struct bwn_softc        *sc;
4939         uint16_t                 iost, mask;
4940         int                      error;
4941
4942         sc = mac->mac_sc;
4943
4944         iost = BWN_IOCTL_PHYRESET | BHND_IOCTL_CLK_FORCE;
4945         mask = iost | BWN_IOCTL_SUPPORT_G;
4946
4947         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4948                 return (error);
4949
4950         DELAY(1000);
4951
4952         iost &= ~BHND_IOCTL_CLK_FORCE;
4953
4954         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4955                 return (error);
4956
4957         DELAY(1000);
4958
4959         return (0);
4960 }
4961
4962 static int
4963 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4964 {
4965         struct bwn_vap *bvp = BWN_VAP(vap);
4966         struct ieee80211com *ic= vap->iv_ic;
4967         enum ieee80211_state ostate = vap->iv_state;
4968         struct bwn_softc *sc = ic->ic_softc;
4969         struct bwn_mac *mac = sc->sc_curmac;
4970         int error;
4971
4972         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4973             ieee80211_state_name[vap->iv_state],
4974             ieee80211_state_name[nstate]);
4975
4976         error = bvp->bv_newstate(vap, nstate, arg);
4977         if (error != 0)
4978                 return (error);
4979
4980         BWN_LOCK(sc);
4981
4982         bwn_led_newstate(mac, nstate);
4983
4984         /*
4985          * Clear the BSSID when we stop a STA
4986          */
4987         if (vap->iv_opmode == IEEE80211_M_STA) {
4988                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4989                         /*
4990                          * Clear out the BSSID.  If we reassociate to
4991                          * the same AP, this will reinialize things
4992                          * correctly...
4993                          */
4994                         if (ic->ic_opmode == IEEE80211_M_STA &&
4995                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4996                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4997                                 bwn_set_macaddr(mac);
4998                         }
4999                 }
5000         }
5001
5002         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
5003             vap->iv_opmode == IEEE80211_M_AHDEMO) {
5004                 /* XXX nothing to do? */
5005         } else if (nstate == IEEE80211_S_RUN) {
5006                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
5007                 bwn_set_opmode(mac);
5008                 bwn_set_pretbtt(mac);
5009                 bwn_spu_setdelay(mac, 0);
5010                 bwn_set_macaddr(mac);
5011         }
5012
5013         BWN_UNLOCK(sc);
5014
5015         return (error);
5016 }
5017
5018 static void
5019 bwn_set_pretbtt(struct bwn_mac *mac)
5020 {
5021         struct bwn_softc *sc = mac->mac_sc;
5022         struct ieee80211com *ic = &sc->sc_ic;
5023         uint16_t pretbtt;
5024
5025         if (ic->ic_opmode == IEEE80211_M_IBSS)
5026                 pretbtt = 2;
5027         else
5028                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
5029         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
5030         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
5031 }
5032
5033 static int
5034 bwn_intr(void *arg)
5035 {
5036         struct bwn_mac *mac = arg;
5037         struct bwn_softc *sc = mac->mac_sc;
5038         uint32_t reason;
5039
5040         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5041             (sc->sc_flags & BWN_FLAG_INVALID))
5042                 return (FILTER_STRAY);
5043
5044         DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
5045
5046         reason = BWN_READ_4(mac, BWN_INTR_REASON);
5047         if (reason == 0xffffffff)       /* shared IRQ */
5048                 return (FILTER_STRAY);
5049         reason &= mac->mac_intr_mask;
5050         if (reason == 0)
5051                 return (FILTER_HANDLED);
5052         DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
5053
5054         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
5055         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
5056         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
5057         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
5058         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
5059         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
5060         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
5061         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
5062         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
5063         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
5064         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
5065
5066         /* Disable interrupts. */
5067         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
5068
5069         mac->mac_reason_intr = reason;
5070
5071         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5072
5073         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
5074         return (FILTER_HANDLED);
5075 }
5076
5077 static void
5078 bwn_intrtask(void *arg, int npending)
5079 {
5080         struct epoch_tracker et;
5081         struct bwn_mac *mac = arg;
5082         struct bwn_softc *sc = mac->mac_sc;
5083         uint32_t merged = 0;
5084         int i, tx = 0, rx = 0;
5085
5086         BWN_LOCK(sc);
5087         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5088             (sc->sc_flags & BWN_FLAG_INVALID)) {
5089                 BWN_UNLOCK(sc);
5090                 return;
5091         }
5092
5093         for (i = 0; i < N(mac->mac_reason); i++)
5094                 merged |= mac->mac_reason[i];
5095
5096         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
5097                 device_printf(sc->sc_dev, "MAC trans error\n");
5098
5099         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
5100                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
5101                 mac->mac_phy.txerrors--;
5102                 if (mac->mac_phy.txerrors == 0) {
5103                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
5104                         bwn_restart(mac, "PHY TX errors");
5105                 }
5106         }
5107
5108         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
5109                 if (merged & BWN_DMAINTR_FATALMASK) {
5110                         device_printf(sc->sc_dev,
5111                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
5112                             mac->mac_reason[0], mac->mac_reason[1],
5113                             mac->mac_reason[2], mac->mac_reason[3],
5114                             mac->mac_reason[4], mac->mac_reason[5]);
5115                         bwn_restart(mac, "DMA error");
5116                         BWN_UNLOCK(sc);
5117                         return;
5118                 }
5119                 if (merged & BWN_DMAINTR_NONFATALMASK) {
5120                         device_printf(sc->sc_dev,
5121                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
5122                             mac->mac_reason[0], mac->mac_reason[1],
5123                             mac->mac_reason[2], mac->mac_reason[3],
5124                             mac->mac_reason[4], mac->mac_reason[5]);
5125                 }
5126         }
5127
5128         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
5129                 bwn_intr_ucode_debug(mac);
5130         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
5131                 bwn_intr_tbtt_indication(mac);
5132         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
5133                 bwn_intr_atim_end(mac);
5134         if (mac->mac_reason_intr & BWN_INTR_BEACON)
5135                 bwn_intr_beacon(mac);
5136         if (mac->mac_reason_intr & BWN_INTR_PMQ)
5137                 bwn_intr_pmq(mac);
5138         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
5139                 bwn_intr_noise(mac);
5140
5141         NET_EPOCH_ENTER(et);
5142         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5143                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
5144                         bwn_dma_rx(mac->mac_method.dma.rx);
5145                         rx = 1;
5146                 }
5147         } else
5148                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
5149         NET_EPOCH_EXIT(et);
5150
5151         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5152         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5153         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5154         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5155         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5156
5157         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
5158                 bwn_intr_txeof(mac);
5159                 tx = 1;
5160         }
5161
5162         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
5163
5164         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
5165                 int evt = BWN_LED_EVENT_NONE;
5166
5167                 if (tx && rx) {
5168                         if (sc->sc_rx_rate > sc->sc_tx_rate)
5169                                 evt = BWN_LED_EVENT_RX;
5170                         else
5171                                 evt = BWN_LED_EVENT_TX;
5172                 } else if (tx) {
5173                         evt = BWN_LED_EVENT_TX;
5174                 } else if (rx) {
5175                         evt = BWN_LED_EVENT_RX;
5176                 } else if (rx == 0) {
5177                         evt = BWN_LED_EVENT_POLL;
5178                 }
5179
5180                 if (evt != BWN_LED_EVENT_NONE)
5181                         bwn_led_event(mac, evt);
5182        }
5183
5184         if (mbufq_first(&sc->sc_snd) != NULL)
5185                 bwn_start(sc);
5186
5187         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5188
5189         BWN_UNLOCK(sc);
5190 }
5191
5192 static void
5193 bwn_restart(struct bwn_mac *mac, const char *msg)
5194 {
5195         struct bwn_softc *sc = mac->mac_sc;
5196         struct ieee80211com *ic = &sc->sc_ic;
5197
5198         if (mac->mac_status < BWN_MAC_STATUS_INITED)
5199                 return;
5200
5201         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
5202         ieee80211_runtask(ic, &mac->mac_hwreset);
5203 }
5204
5205 static void
5206 bwn_intr_ucode_debug(struct bwn_mac *mac)
5207 {
5208         struct bwn_softc *sc = mac->mac_sc;
5209         uint16_t reason;
5210
5211         if (mac->mac_fw.opensource == 0)
5212                 return;
5213
5214         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
5215         switch (reason) {
5216         case BWN_DEBUGINTR_PANIC:
5217                 bwn_handle_fwpanic(mac);
5218                 break;
5219         case BWN_DEBUGINTR_DUMP_SHM:
5220                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5221                 break;
5222         case BWN_DEBUGINTR_DUMP_REGS:
5223                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5224                 break;
5225         case BWN_DEBUGINTR_MARKER:
5226                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5227                 break;
5228         default:
5229                 device_printf(sc->sc_dev,
5230                     "ucode debug unknown reason: %#x\n", reason);
5231         }
5232
5233         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5234             BWN_DEBUGINTR_ACK);
5235 }
5236
5237 static void
5238 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5239 {
5240         struct bwn_softc *sc = mac->mac_sc;
5241         struct ieee80211com *ic = &sc->sc_ic;
5242
5243         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5244                 bwn_psctl(mac, 0);
5245         if (ic->ic_opmode == IEEE80211_M_IBSS)
5246                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5247 }
5248
5249 static void
5250 bwn_intr_atim_end(struct bwn_mac *mac)
5251 {
5252
5253         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5254                 BWN_WRITE_4(mac, BWN_MACCMD,
5255                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5256                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5257         }
5258 }
5259
5260 static void
5261 bwn_intr_beacon(struct bwn_mac *mac)
5262 {
5263         struct bwn_softc *sc = mac->mac_sc;
5264         struct ieee80211com *ic = &sc->sc_ic;
5265         uint32_t cmd, beacon0, beacon1;
5266
5267         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5268             ic->ic_opmode == IEEE80211_M_MBSS)
5269                 return;
5270
5271         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5272
5273         cmd = BWN_READ_4(mac, BWN_MACCMD);
5274         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5275         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5276
5277         if (beacon0 && beacon1) {
5278                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5279                 mac->mac_intr_mask |= BWN_INTR_BEACON;
5280                 return;
5281         }
5282
5283         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5284                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5285                 bwn_load_beacon0(mac);
5286                 bwn_load_beacon1(mac);
5287                 cmd = BWN_READ_4(mac, BWN_MACCMD);
5288                 cmd |= BWN_MACCMD_BEACON0_VALID;
5289                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5290         } else {
5291                 if (!beacon0) {
5292                         bwn_load_beacon0(mac);
5293                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5294                         cmd |= BWN_MACCMD_BEACON0_VALID;
5295                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5296                 } else if (!beacon1) {
5297                         bwn_load_beacon1(mac);
5298                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5299                         cmd |= BWN_MACCMD_BEACON1_VALID;
5300                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5301                 }
5302         }
5303 }
5304
5305 static void
5306 bwn_intr_pmq(struct bwn_mac *mac)
5307 {
5308         uint32_t tmp;
5309
5310         while (1) {
5311                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5312                 if (!(tmp & 0x00000008))
5313                         break;
5314         }
5315         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5316 }
5317
5318 static void
5319 bwn_intr_noise(struct bwn_mac *mac)
5320 {
5321         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5322         uint16_t tmp;
5323         uint8_t noise[4];
5324         uint8_t i, j;
5325         int32_t average;
5326
5327         if (mac->mac_phy.type != BWN_PHYTYPE_G)
5328                 return;
5329
5330         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5331         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5332         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5333             noise[3] == 0x7f)
5334                 goto new;
5335
5336         KASSERT(mac->mac_noise.noi_nsamples < 8,
5337             ("%s:%d: fail", __func__, __LINE__));
5338         i = mac->mac_noise.noi_nsamples;
5339         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5340         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5341         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5342         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5343         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5344         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5345         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5346         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5347         mac->mac_noise.noi_nsamples++;
5348         if (mac->mac_noise.noi_nsamples == 8) {
5349                 average = 0;
5350                 for (i = 0; i < 8; i++) {
5351                         for (j = 0; j < 4; j++)
5352                                 average += mac->mac_noise.noi_samples[i][j];
5353                 }
5354                 average = (((average / 32) * 125) + 64) / 128;
5355                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5356                 if (tmp >= 8)
5357                         average += 2;
5358                 else
5359                         average -= 25;
5360                 average -= (tmp == 8) ? 72 : 48;
5361
5362                 mac->mac_stats.link_noise = average;
5363                 mac->mac_noise.noi_running = 0;
5364                 return;
5365         }
5366 new:
5367         bwn_noise_gensample(mac);
5368 }
5369
5370 static int
5371 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5372 {
5373         struct bwn_mac *mac = prq->prq_mac;
5374         struct bwn_softc *sc = mac->mac_sc;
5375         unsigned int i;
5376
5377         BWN_ASSERT_LOCKED(sc);
5378
5379         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5380                 return (0);
5381
5382         for (i = 0; i < 5000; i++) {
5383                 if (bwn_pio_rxeof(prq) == 0)
5384                         break;
5385         }
5386         if (i >= 5000)
5387                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5388         return ((i > 0) ? 1 : 0);
5389 }
5390
5391 static void
5392 bwn_dma_rx(struct bwn_dma_ring *dr)
5393 {
5394         int slot, curslot;
5395
5396         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5397         curslot = dr->get_curslot(dr);
5398         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5399             ("%s:%d: fail", __func__, __LINE__));
5400
5401         slot = dr->dr_curslot;
5402         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5403                 bwn_dma_rxeof(dr, &slot);
5404
5405         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5406             BUS_DMASYNC_PREWRITE);
5407
5408         dr->set_curslot(dr, slot);
5409         dr->dr_curslot = slot;
5410 }
5411
5412 static void
5413 bwn_intr_txeof(struct bwn_mac *mac)
5414 {
5415         struct bwn_txstatus stat;
5416         uint32_t stat0, stat1;
5417         uint16_t tmp;
5418
5419         BWN_ASSERT_LOCKED(mac->mac_sc);
5420
5421         while (1) {
5422                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5423                 if (!(stat0 & 0x00000001))
5424                         break;
5425                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5426
5427                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5428                     "%s: stat0=0x%08x, stat1=0x%08x\n",
5429                     __func__,
5430                     stat0,
5431                     stat1);
5432
5433                 stat.cookie = (stat0 >> 16);
5434                 stat.seq = (stat1 & 0x0000ffff);
5435                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5436                 tmp = (stat0 & 0x0000ffff);
5437                 stat.framecnt = ((tmp & 0xf000) >> 12);
5438                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
5439                 stat.sreason = ((tmp & 0x001c) >> 2);
5440                 stat.pm = (tmp & 0x0080) ? 1 : 0;
5441                 stat.im = (tmp & 0x0040) ? 1 : 0;
5442                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5443                 stat.ack = (tmp & 0x0002) ? 1 : 0;
5444
5445                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5446                     "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5447                     "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5448                     __func__,
5449                     stat.cookie,
5450                     stat.seq,
5451                     stat.phy_stat,
5452                     stat.framecnt,
5453                     stat.rtscnt,
5454                     stat.sreason,
5455                     stat.pm,
5456                     stat.im,
5457                     stat.ampdu,
5458                     stat.ack);
5459
5460                 bwn_handle_txeof(mac, &stat);
5461         }
5462 }
5463
5464 static void
5465 bwn_hwreset(void *arg, int npending)
5466 {
5467         struct bwn_mac *mac = arg;
5468         struct bwn_softc *sc = mac->mac_sc;
5469         int error = 0;
5470         int prev_status;
5471
5472         BWN_LOCK(sc);
5473
5474         prev_status = mac->mac_status;
5475         if (prev_status >= BWN_MAC_STATUS_STARTED)
5476                 bwn_core_stop(mac);
5477         if (prev_status >= BWN_MAC_STATUS_INITED)
5478                 bwn_core_exit(mac);
5479
5480         if (prev_status >= BWN_MAC_STATUS_INITED) {
5481                 error = bwn_core_init(mac);
5482                 if (error)
5483                         goto out;
5484         }
5485         if (prev_status >= BWN_MAC_STATUS_STARTED)
5486                 bwn_core_start(mac);
5487 out:
5488         if (error) {
5489                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5490                 sc->sc_curmac = NULL;
5491         }
5492         BWN_UNLOCK(sc);
5493 }
5494
5495 static void
5496 bwn_handle_fwpanic(struct bwn_mac *mac)
5497 {
5498         struct bwn_softc *sc = mac->mac_sc;
5499         uint16_t reason;
5500
5501         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5502         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5503
5504         if (reason == BWN_FWPANIC_RESTART)
5505                 bwn_restart(mac, "ucode panic");
5506 }
5507
5508 static void
5509 bwn_load_beacon0(struct bwn_mac *mac)
5510 {
5511
5512         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5513 }
5514
5515 static void
5516 bwn_load_beacon1(struct bwn_mac *mac)
5517 {
5518
5519         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5520 }
5521
5522 static uint32_t
5523 bwn_jssi_read(struct bwn_mac *mac)
5524 {
5525         uint32_t val = 0;
5526
5527         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5528         val <<= 16;
5529         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5530
5531         return (val);
5532 }
5533
5534 static void
5535 bwn_noise_gensample(struct bwn_mac *mac)
5536 {
5537         uint32_t jssi = 0x7f7f7f7f;
5538
5539         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5540         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5541         BWN_WRITE_4(mac, BWN_MACCMD,
5542             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5543 }
5544
5545 static int
5546 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5547 {
5548         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5549
5550         return (dr->dr_numslots - dr->dr_usedslot);
5551 }
5552
5553 static int
5554 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5555 {
5556         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5557
5558         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5559             ("%s:%d: fail", __func__, __LINE__));
5560         if (slot == dr->dr_numslots - 1)
5561                 return (0);
5562         return (slot + 1);
5563 }
5564
5565 static void
5566 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5567 {
5568         struct bwn_mac *mac = dr->dr_mac;
5569         struct bwn_softc *sc = mac->mac_sc;
5570         struct bwn_dma *dma = &mac->mac_method.dma;
5571         struct bwn_dmadesc_generic *desc;
5572         struct bwn_dmadesc_meta *meta;
5573         struct bwn_rxhdr4 *rxhdr;
5574         struct mbuf *m;
5575         uint32_t macstat;
5576         int32_t tmp;
5577         int cnt = 0;
5578         uint16_t len;
5579
5580         dr->getdesc(dr, *slot, &desc, &meta);
5581
5582         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5583         m = meta->mt_m;
5584
5585         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5586                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5587                 return;
5588         }
5589
5590         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5591         len = le16toh(rxhdr->frame_len);
5592         if (len <= 0) {
5593                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5594                 return;
5595         }
5596         if (bwn_dma_check_redzone(dr, m)) {
5597                 device_printf(sc->sc_dev, "redzone error.\n");
5598                 bwn_dma_set_redzone(dr, m);
5599                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5600                     BUS_DMASYNC_PREWRITE);
5601                 return;
5602         }
5603         if (len > dr->dr_rx_bufsize) {
5604                 tmp = len;
5605                 while (1) {
5606                         dr->getdesc(dr, *slot, &desc, &meta);
5607                         bwn_dma_set_redzone(dr, meta->mt_m);
5608                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5609                             BUS_DMASYNC_PREWRITE);
5610                         *slot = bwn_dma_nextslot(dr, *slot);
5611                         cnt++;
5612                         tmp -= dr->dr_rx_bufsize;
5613                         if (tmp <= 0)
5614                                 break;
5615                 }
5616                 device_printf(sc->sc_dev, "too small buffer "
5617                        "(len %u buffer %u dropped %d)\n",
5618                        len, dr->dr_rx_bufsize, cnt);
5619                 return;
5620         }
5621
5622         switch (mac->mac_fw.fw_hdr_format) {
5623         case BWN_FW_HDR_351:
5624         case BWN_FW_HDR_410:
5625                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5626                 break;
5627         case BWN_FW_HDR_598:
5628                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5629                 break;
5630         }
5631
5632         if (macstat & BWN_RX_MAC_FCSERR) {
5633                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5634                         device_printf(sc->sc_dev, "RX drop\n");
5635                         return;
5636                 }
5637         }
5638
5639         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5640         m_adj(m, dr->dr_frameoffset);
5641
5642         bwn_rxeof(dr->dr_mac, m, rxhdr);
5643 }
5644
5645 static void
5646 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5647 {
5648         struct bwn_softc *sc = mac->mac_sc;
5649         struct bwn_stats *stats = &mac->mac_stats;
5650
5651         BWN_ASSERT_LOCKED(mac->mac_sc);
5652
5653         if (status->im)
5654                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5655         if (status->ampdu)
5656                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5657         if (status->rtscnt) {
5658                 if (status->rtscnt == 0xf)
5659                         stats->rtsfail++;
5660                 else
5661                         stats->rts++;
5662         }
5663
5664         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5665                 bwn_dma_handle_txeof(mac, status);
5666         } else {
5667                 bwn_pio_handle_txeof(mac, status);
5668         }
5669
5670         bwn_phy_txpower_check(mac, 0);
5671 }
5672
5673 static uint8_t
5674 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5675 {
5676         struct bwn_mac *mac = prq->prq_mac;
5677         struct bwn_softc *sc = mac->mac_sc;
5678         struct bwn_rxhdr4 rxhdr;
5679         struct mbuf *m;
5680         uint32_t ctl32, macstat, v32;
5681         unsigned int i, padding;
5682         uint16_t ctl16, len, totlen, v16;
5683         unsigned char *mp;
5684         char *data;
5685
5686         memset(&rxhdr, 0, sizeof(rxhdr));
5687
5688         if (prq->prq_rev >= 8) {
5689                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5690                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5691                         return (0);
5692                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5693                     BWN_PIO8_RXCTL_FRAMEREADY);
5694                 for (i = 0; i < 10; i++) {
5695                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5696                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5697                                 goto ready;
5698                         DELAY(10);
5699                 }
5700         } else {
5701                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5702                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5703                         return (0);
5704                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5705                     BWN_PIO_RXCTL_FRAMEREADY);
5706                 for (i = 0; i < 10; i++) {
5707                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5708                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5709                                 goto ready;
5710                         DELAY(10);
5711                 }
5712         }
5713         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5714         return (1);
5715 ready:
5716         if (prq->prq_rev >= 8) {
5717                 bus_read_multi_4(sc->sc_mem_res,
5718                     prq->prq_base + BWN_PIO8_RXDATA, (void *)&rxhdr,
5719                     sizeof(rxhdr));
5720         } else {
5721                 bus_read_multi_2(sc->sc_mem_res,
5722                     prq->prq_base + BWN_PIO_RXDATA, (void *)&rxhdr,
5723                     sizeof(rxhdr));
5724         }
5725         len = le16toh(rxhdr.frame_len);
5726         if (len > 0x700) {
5727                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5728                 goto error;
5729         }
5730         if (len == 0) {
5731                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5732                 goto error;
5733         }
5734
5735         switch (mac->mac_fw.fw_hdr_format) {
5736         case BWN_FW_HDR_351:
5737         case BWN_FW_HDR_410:
5738                 macstat = le32toh(rxhdr.ps4.r351.mac_status);
5739                 break;
5740         case BWN_FW_HDR_598:
5741                 macstat = le32toh(rxhdr.ps4.r598.mac_status);
5742                 break;
5743         }
5744
5745         if (macstat & BWN_RX_MAC_FCSERR) {
5746                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5747                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5748                         goto error;
5749                 }
5750         }
5751
5752         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5753         totlen = len + padding;
5754         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5755         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5756         if (m == NULL) {
5757                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5758                 goto error;
5759         }
5760         mp = mtod(m, unsigned char *);
5761         if (prq->prq_rev >= 8) {
5762                 bus_read_multi_4(sc->sc_mem_res,
5763                     prq->prq_base + BWN_PIO8_RXDATA, (void *)mp, (totlen & ~3));
5764                 if (totlen & 3) {
5765                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5766                         data = &(mp[totlen - 1]);
5767                         switch (totlen & 3) {
5768                         case 3:
5769                                 *data = (v32 >> 16);
5770                                 data--;
5771                         case 2:
5772                                 *data = (v32 >> 8);
5773                                 data--;
5774                         case 1:
5775                                 *data = v32;
5776                         }
5777                 }
5778         } else {
5779                 bus_read_multi_2(sc->sc_mem_res,
5780                     prq->prq_base + BWN_PIO_RXDATA, (void *)mp, (totlen & ~1));
5781                 if (totlen & 1) {
5782                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5783                         mp[totlen - 1] = v16;
5784                 }
5785         }
5786
5787         m->m_len = m->m_pkthdr.len = totlen;
5788
5789         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5790
5791         return (1);
5792 error:
5793         if (prq->prq_rev >= 8)
5794                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5795                     BWN_PIO8_RXCTL_DATAREADY);
5796         else
5797                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5798         return (1);
5799 }
5800
5801 static int
5802 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5803     struct bwn_dmadesc_meta *meta, int init)
5804 {
5805         struct bwn_mac *mac = dr->dr_mac;
5806         struct bwn_dma *dma = &mac->mac_method.dma;
5807         struct bwn_rxhdr4 *hdr;
5808         bus_dmamap_t map;
5809         bus_addr_t paddr;
5810         struct mbuf *m;
5811         int error;
5812
5813         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5814         if (m == NULL) {
5815                 error = ENOBUFS;
5816
5817                 /*
5818                  * If the NIC is up and running, we need to:
5819                  * - Clear RX buffer's header.
5820                  * - Restore RX descriptor settings.
5821                  */
5822                 if (init)
5823                         return (error);
5824                 else
5825                         goto back;
5826         }
5827         m->m_len = m->m_pkthdr.len = MCLBYTES;
5828
5829         bwn_dma_set_redzone(dr, m);
5830
5831         /*
5832          * Try to load RX buf into temporary DMA map
5833          */
5834         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5835             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5836         if (error) {
5837                 m_freem(m);
5838
5839                 /*
5840                  * See the comment above
5841                  */
5842                 if (init)
5843                         return (error);
5844                 else
5845                         goto back;
5846         }
5847
5848         if (!init)
5849                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5850         meta->mt_m = m;
5851         meta->mt_paddr = paddr;
5852
5853         /*
5854          * Swap RX buf's DMA map with the loaded temporary one
5855          */
5856         map = meta->mt_dmap;
5857         meta->mt_dmap = dr->dr_spare_dmap;
5858         dr->dr_spare_dmap = map;
5859
5860 back:
5861         /*
5862          * Clear RX buf header
5863          */
5864         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5865         bzero(hdr, sizeof(*hdr));
5866         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5867             BUS_DMASYNC_PREWRITE);
5868
5869         /*
5870          * Setup RX buf descriptor
5871          */
5872         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5873             sizeof(*hdr), 0, 0, 0);
5874         return (error);
5875 }
5876
5877 static void
5878 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5879                  bus_size_t mapsz __unused, int error)
5880 {
5881
5882         if (!error) {
5883                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5884                 *((bus_addr_t *)arg) = seg->ds_addr;
5885         }
5886 }
5887
5888 static int
5889 bwn_hwrate2ieeerate(int rate)
5890 {
5891
5892         switch (rate) {
5893         case BWN_CCK_RATE_1MB:
5894                 return (2);
5895         case BWN_CCK_RATE_2MB:
5896                 return (4);
5897         case BWN_CCK_RATE_5MB:
5898                 return (11);
5899         case BWN_CCK_RATE_11MB:
5900                 return (22);
5901         case BWN_OFDM_RATE_6MB:
5902                 return (12);
5903         case BWN_OFDM_RATE_9MB:
5904                 return (18);
5905         case BWN_OFDM_RATE_12MB:
5906                 return (24);
5907         case BWN_OFDM_RATE_18MB:
5908                 return (36);
5909         case BWN_OFDM_RATE_24MB:
5910                 return (48);
5911         case BWN_OFDM_RATE_36MB:
5912                 return (72);
5913         case BWN_OFDM_RATE_48MB:
5914                 return (96);
5915         case BWN_OFDM_RATE_54MB:
5916                 return (108);
5917         default:
5918                 printf("Ooops\n");
5919                 return (0);
5920         }
5921 }
5922
5923 /*
5924  * Post process the RX provided RSSI.
5925  *
5926  * Valid for A, B, G, LP PHYs.
5927  */
5928 static int8_t
5929 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5930     int ofdm, int adjust_2053, int adjust_2050)
5931 {
5932         struct bwn_phy *phy = &mac->mac_phy;
5933         struct bwn_phy_g *gphy = &phy->phy_g;
5934         int tmp;
5935
5936         switch (phy->rf_ver) {
5937         case 0x2050:
5938                 if (ofdm) {
5939                         tmp = in_rssi;
5940                         if (tmp > 127)
5941                                 tmp -= 256;
5942                         tmp = tmp * 73 / 64;
5943                         if (adjust_2050)
5944                                 tmp += 25;
5945                         else
5946                                 tmp -= 3;
5947                 } else {
5948                         if (mac->mac_sc->sc_board_info.board_flags
5949                             & BHND_BFL_ADCDIV) {
5950                                 if (in_rssi > 63)
5951                                         in_rssi = 63;
5952                                 tmp = gphy->pg_nrssi_lt[in_rssi];
5953                                 tmp = (31 - tmp) * -131 / 128 - 57;
5954                         } else {
5955                                 tmp = in_rssi;
5956                                 tmp = (31 - tmp) * -149 / 128 - 68;
5957                         }
5958                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5959                                 tmp += 25;
5960                 }
5961                 break;
5962         case 0x2060:
5963                 if (in_rssi > 127)
5964                         tmp = in_rssi - 256;
5965                 else
5966                         tmp = in_rssi;
5967                 break;
5968         default:
5969                 tmp = in_rssi;
5970                 tmp = (tmp - 11) * 103 / 64;
5971                 if (adjust_2053)
5972                         tmp -= 109;
5973                 else
5974                         tmp -= 83;
5975         }
5976
5977         return (tmp);
5978 }
5979
5980 static void
5981 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5982 {
5983         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5984         struct bwn_plcp6 *plcp;
5985         struct bwn_softc *sc = mac->mac_sc;
5986         struct ieee80211_frame_min *wh;
5987         struct ieee80211_node *ni;
5988         struct ieee80211com *ic = &sc->sc_ic;
5989         uint32_t macstat;
5990         int padding, rate, rssi = 0, noise = 0, type;
5991         uint16_t phytype, phystat0, phystat3, chanstat;
5992         unsigned char *mp = mtod(m, unsigned char *);
5993
5994         BWN_ASSERT_LOCKED(sc);
5995
5996         phystat0 = le16toh(rxhdr->phy_status0);
5997
5998         /*
5999          * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
6000          * used for LP-PHY.
6001          */
6002         phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
6003
6004         switch (mac->mac_fw.fw_hdr_format) {
6005         case BWN_FW_HDR_351:
6006         case BWN_FW_HDR_410:
6007                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
6008                 chanstat = le16toh(rxhdr->ps4.r351.channel);
6009                 break;
6010         case BWN_FW_HDR_598:
6011                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
6012                 chanstat = le16toh(rxhdr->ps4.r598.channel);
6013                 break;
6014         }
6015
6016         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
6017
6018         if (macstat & BWN_RX_MAC_FCSERR)
6019                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
6020         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
6021                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
6022         if (macstat & BWN_RX_MAC_DECERR)
6023                 goto drop;
6024
6025         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
6026         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
6027                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6028                     m->m_pkthdr.len);
6029                 goto drop;
6030         }
6031         plcp = (struct bwn_plcp6 *)(mp + padding);
6032         m_adj(m, sizeof(struct bwn_plcp6) + padding);
6033         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
6034                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6035                     m->m_pkthdr.len);
6036                 goto drop;
6037         }
6038         wh = mtod(m, struct ieee80211_frame_min *);
6039
6040         if (macstat & BWN_RX_MAC_DEC) {
6041                 DPRINTF(sc, BWN_DEBUG_HWCRYPTO,
6042                     "RX decryption attempted (old %d keyidx %#x)\n",
6043                     BWN_ISOLDFMT(mac),
6044                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
6045         }
6046
6047         if (phystat0 & BWN_RX_PHYST0_OFDM)
6048                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
6049                     phytype == BWN_PHYTYPE_A);
6050         else
6051                 rate = bwn_plcp_get_cckrate(mac, plcp);
6052         if (rate == -1) {
6053                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
6054                         goto drop;
6055         }
6056         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
6057
6058         /* rssi/noise */
6059         switch (phytype) {
6060         case BWN_PHYTYPE_A:
6061         case BWN_PHYTYPE_B:
6062         case BWN_PHYTYPE_G:
6063         case BWN_PHYTYPE_LP:
6064                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
6065                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
6066                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
6067                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
6068                 break;
6069         case BWN_PHYTYPE_N:
6070                 /* Broadcom has code for min/avg, but always used max */
6071                 if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
6072                         rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
6073                 else
6074                         rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
6075 #if 0
6076                 DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
6077                     "%s: power0=%d, power1=%d, power2=%d\n",
6078                     __func__,
6079                     rxhdr->phy.n.power0,
6080                     rxhdr->phy.n.power1,
6081                     rxhdr->ps2.n.power2);
6082 #endif
6083                 break;
6084         default:
6085                 /* XXX TODO: implement rssi for other PHYs */
6086                 break;
6087         }
6088
6089         /*
6090          * RSSI here is absolute, not relative to the noise floor.
6091          */
6092         noise = mac->mac_stats.link_noise;
6093         rssi = rssi - noise;
6094
6095         /* RX radio tap */
6096         if (ieee80211_radiotap_active(ic))
6097                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
6098         m_adj(m, -IEEE80211_CRC_LEN);
6099
6100         BWN_UNLOCK(sc);
6101
6102         ni = ieee80211_find_rxnode(ic, wh);
6103         if (ni != NULL) {
6104                 type = ieee80211_input(ni, m, rssi, noise);
6105                 ieee80211_free_node(ni);
6106         } else
6107                 type = ieee80211_input_all(ic, m, rssi, noise);
6108
6109         BWN_LOCK(sc);
6110         return;
6111 drop:
6112         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
6113 }
6114
6115 static void
6116 bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
6117     const struct bwn_txstatus *status)
6118 {
6119         struct ieee80211_ratectl_tx_status txs;
6120         int retrycnt = 0;
6121
6122         /*
6123          * If we don't get an ACK, then we should log the
6124          * full framecnt.  That may be 0 if it's a PHY
6125          * failure, so ensure that gets logged as some
6126          * retry attempt.
6127          */
6128         txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
6129         if (status->ack) {
6130                 txs.status = IEEE80211_RATECTL_TX_SUCCESS;
6131                 retrycnt = status->framecnt - 1;
6132         } else {
6133                 txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
6134                 retrycnt = status->framecnt;
6135                 if (retrycnt == 0)
6136                         retrycnt = 1;
6137         }
6138         txs.long_retries = retrycnt;
6139         ieee80211_ratectl_tx_complete(ni, &txs);
6140 }
6141
6142 static void
6143 bwn_dma_handle_txeof(struct bwn_mac *mac,
6144     const struct bwn_txstatus *status)
6145 {
6146         struct bwn_dma *dma = &mac->mac_method.dma;
6147         struct bwn_dma_ring *dr;
6148         struct bwn_dmadesc_generic *desc;
6149         struct bwn_dmadesc_meta *meta;
6150         struct bwn_softc *sc = mac->mac_sc;
6151         int slot;
6152
6153         BWN_ASSERT_LOCKED(sc);
6154
6155         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
6156         if (dr == NULL) {
6157                 device_printf(sc->sc_dev, "failed to parse cookie\n");
6158                 return;
6159         }
6160         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6161
6162         while (1) {
6163                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
6164                     ("%s:%d: fail", __func__, __LINE__));
6165                 dr->getdesc(dr, slot, &desc, &meta);
6166
6167                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
6168                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
6169                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
6170                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
6171
6172                 if (meta->mt_islast) {
6173                         KASSERT(meta->mt_m != NULL,
6174                             ("%s:%d: fail", __func__, __LINE__));
6175
6176                         bwn_ratectl_tx_complete(meta->mt_ni, status);
6177                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
6178                         meta->mt_ni = NULL;
6179                         meta->mt_m = NULL;
6180                 } else
6181                         KASSERT(meta->mt_m == NULL,
6182                             ("%s:%d: fail", __func__, __LINE__));
6183
6184                 dr->dr_usedslot--;
6185                 if (meta->mt_islast)
6186                         break;
6187                 slot = bwn_dma_nextslot(dr, slot);
6188         }
6189         sc->sc_watchdog_timer = 0;
6190         if (dr->dr_stop) {
6191                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
6192                     ("%s:%d: fail", __func__, __LINE__));
6193                 dr->dr_stop = 0;
6194         }
6195 }
6196
6197 static void
6198 bwn_pio_handle_txeof(struct bwn_mac *mac,
6199     const struct bwn_txstatus *status)
6200 {
6201         struct bwn_pio_txqueue *tq;
6202         struct bwn_pio_txpkt *tp = NULL;
6203         struct bwn_softc *sc = mac->mac_sc;
6204
6205         BWN_ASSERT_LOCKED(sc);
6206
6207         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
6208         if (tq == NULL)
6209                 return;
6210
6211         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
6212         tq->tq_free++;
6213
6214         if (tp->tp_ni != NULL) {
6215                 /*
6216                  * Do any tx complete callback.  Note this must
6217                  * be done before releasing the node reference.
6218                  */
6219                 bwn_ratectl_tx_complete(tp->tp_ni, status);
6220         }
6221         ieee80211_tx_complete(tp->tp_ni, tp->tp_m, 0);
6222         tp->tp_ni = NULL;
6223         tp->tp_m = NULL;
6224         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6225
6226         sc->sc_watchdog_timer = 0;
6227 }
6228
6229 static void
6230 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6231 {
6232         struct bwn_softc *sc = mac->mac_sc;
6233         struct bwn_phy *phy = &mac->mac_phy;
6234         struct ieee80211com *ic = &sc->sc_ic;
6235         unsigned long now;
6236         bwn_txpwr_result_t result;
6237
6238         BWN_GETTIME(now);
6239
6240         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6241                 return;
6242         phy->nexttime = now + 2 * 1000;
6243
6244         if (sc->sc_board_info.board_vendor == PCI_VENDOR_BROADCOM &&
6245             sc->sc_board_info.board_type == BHND_BOARD_BU4306)
6246                 return;
6247
6248         if (phy->recalc_txpwr != NULL) {
6249                 result = phy->recalc_txpwr(mac,
6250                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6251                 if (result == BWN_TXPWR_RES_DONE)
6252                         return;
6253                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6254                     ("%s: fail", __func__));
6255                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6256
6257                 ieee80211_runtask(ic, &mac->mac_txpower);
6258         }
6259 }
6260
6261 static uint16_t
6262 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6263 {
6264
6265         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6266 }
6267
6268 static uint32_t
6269 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6270 {
6271
6272         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6273 }
6274
6275 static void
6276 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6277 {
6278
6279         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6280 }
6281
6282 static void
6283 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6284 {
6285
6286         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6287 }
6288
6289 static int
6290 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6291 {
6292
6293         switch (rate) {
6294         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6295         case 12:
6296                 return (BWN_OFDM_RATE_6MB);
6297         case 18:
6298                 return (BWN_OFDM_RATE_9MB);
6299         case 24:
6300                 return (BWN_OFDM_RATE_12MB);
6301         case 36:
6302                 return (BWN_OFDM_RATE_18MB);
6303         case 48:
6304                 return (BWN_OFDM_RATE_24MB);
6305         case 72:
6306                 return (BWN_OFDM_RATE_36MB);
6307         case 96:
6308                 return (BWN_OFDM_RATE_48MB);
6309         case 108:
6310                 return (BWN_OFDM_RATE_54MB);
6311         /* CCK rates (NB: not IEEE std, device-specific) */
6312         case 2:
6313                 return (BWN_CCK_RATE_1MB);
6314         case 4:
6315                 return (BWN_CCK_RATE_2MB);
6316         case 11:
6317                 return (BWN_CCK_RATE_5MB);
6318         case 22:
6319                 return (BWN_CCK_RATE_11MB);
6320         }
6321
6322         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6323         return (BWN_CCK_RATE_1MB);
6324 }
6325
6326 static uint16_t
6327 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6328 {
6329         struct bwn_phy *phy = &mac->mac_phy;
6330         uint16_t control = 0;
6331         uint16_t bw;
6332
6333         /* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6334         bw = BWN_TXH_PHY1_BW_20;
6335
6336         if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6337                 control = bw;
6338         } else {
6339                 control = bw;
6340                 /* Figure out coding rate and modulation */
6341                 /* XXX TODO: table-ize, for MCS transmit */
6342                 /* Note: this is BWN_*_RATE values */
6343                 switch (bitrate) {
6344                 case BWN_CCK_RATE_1MB:
6345                         control |= 0;
6346                         break;
6347                 case BWN_CCK_RATE_2MB:
6348                         control |= 1;
6349                         break;
6350                 case BWN_CCK_RATE_5MB:
6351                         control |= 2;
6352                         break;
6353                 case BWN_CCK_RATE_11MB:
6354                         control |= 3;
6355                         break;
6356                 case BWN_OFDM_RATE_6MB:
6357                         control |= BWN_TXH_PHY1_CRATE_1_2;
6358                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6359                         break;
6360                 case BWN_OFDM_RATE_9MB:
6361                         control |= BWN_TXH_PHY1_CRATE_3_4;
6362                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6363                         break;
6364                 case BWN_OFDM_RATE_12MB:
6365                         control |= BWN_TXH_PHY1_CRATE_1_2;
6366                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6367                         break;
6368                 case BWN_OFDM_RATE_18MB:
6369                         control |= BWN_TXH_PHY1_CRATE_3_4;
6370                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6371                         break;
6372                 case BWN_OFDM_RATE_24MB:
6373                         control |= BWN_TXH_PHY1_CRATE_1_2;
6374                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6375                         break;
6376                 case BWN_OFDM_RATE_36MB:
6377                         control |= BWN_TXH_PHY1_CRATE_3_4;
6378                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6379                         break;
6380                 case BWN_OFDM_RATE_48MB:
6381                         control |= BWN_TXH_PHY1_CRATE_1_2;
6382                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6383                         break;
6384                 case BWN_OFDM_RATE_54MB:
6385                         control |= BWN_TXH_PHY1_CRATE_3_4;
6386                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6387                         break;
6388                 default:
6389                         break;
6390                 }
6391                 control |= BWN_TXH_PHY1_MODE_SISO;
6392         }
6393
6394         return control;
6395 }
6396
6397 static int
6398 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6399     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6400 {
6401         const struct bwn_phy *phy = &mac->mac_phy;
6402         struct bwn_softc *sc = mac->mac_sc;
6403         struct ieee80211_frame *wh;
6404         struct ieee80211_frame *protwh;
6405         const struct ieee80211_txparam *tp = ni->ni_txparms;
6406         struct ieee80211vap *vap = ni->ni_vap;
6407         struct ieee80211com *ic = &sc->sc_ic;
6408         struct mbuf *mprot;
6409         uint8_t *prot_ptr;
6410         unsigned int len;
6411         uint32_t macctl = 0;
6412         int rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6413         uint16_t phyctl = 0;
6414         uint8_t rate, rate_fb;
6415         int fill_phy_ctl1 = 0;
6416
6417         wh = mtod(m, struct ieee80211_frame *);
6418         memset(txhdr, 0, sizeof(*txhdr));
6419
6420         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6421         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6422         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6423
6424         if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6425             || (phy->type == BWN_PHYTYPE_HT))
6426                 fill_phy_ctl1 = 1;
6427
6428         /*
6429          * Find TX rate
6430          */
6431         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6432                 rate = rate_fb = tp->mgmtrate;
6433         else if (ismcast)
6434                 rate = rate_fb = tp->mcastrate;
6435         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6436                 rate = rate_fb = tp->ucastrate;
6437         else {
6438                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
6439                 rate = ni->ni_txrate;
6440
6441                 if (rix > 0)
6442                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6443                             IEEE80211_RATE_VAL;
6444                 else
6445                         rate_fb = rate;
6446         }
6447
6448         sc->sc_tx_rate = rate;
6449
6450         /* Note: this maps the select ieee80211 rate to hardware rate */
6451         rate = bwn_ieeerate2hwrate(sc, rate);
6452         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6453
6454         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6455             bwn_plcp_getcck(rate);
6456         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6457         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6458
6459         /* XXX rate/rate_fb is the hardware rate */
6460         if ((rate_fb == rate) ||
6461             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6462             (*(u_int16_t *)wh->i_dur == htole16(0)))
6463                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6464         else
6465                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6466                     m->m_pkthdr.len, rate, isshort);
6467
6468         /* XXX TX encryption */
6469
6470         switch (mac->mac_fw.fw_hdr_format) {
6471         case BWN_FW_HDR_351:
6472                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6473                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6474                 break;
6475         case BWN_FW_HDR_410:
6476                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6477                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6478                 break;
6479         case BWN_FW_HDR_598:
6480                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6481                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6482                 break;
6483         }
6484
6485         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6486             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6487
6488         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6489             BWN_TX_EFT_FB_CCK;
6490         txhdr->chan = phy->chan;
6491         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6492             BWN_TX_PHY_ENC_CCK;
6493         /* XXX preamble? obey net80211 */
6494         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6495              rate == BWN_CCK_RATE_11MB))
6496                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
6497
6498         if (! phy->gmode)
6499                 macctl |= BWN_TX_MAC_5GHZ;
6500
6501         /* XXX TX antenna selection */
6502
6503         switch (bwn_antenna_sanitize(mac, 0)) {
6504         case 0:
6505                 phyctl |= BWN_TX_PHY_ANT01AUTO;
6506                 break;
6507         case 1:
6508                 phyctl |= BWN_TX_PHY_ANT0;
6509                 break;
6510         case 2:
6511                 phyctl |= BWN_TX_PHY_ANT1;
6512                 break;
6513         case 3:
6514                 phyctl |= BWN_TX_PHY_ANT2;
6515                 break;
6516         case 4:
6517                 phyctl |= BWN_TX_PHY_ANT3;
6518                 break;
6519         default:
6520                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6521         }
6522
6523         if (!ismcast)
6524                 macctl |= BWN_TX_MAC_ACK;
6525
6526         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6527         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6528             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6529                 macctl |= BWN_TX_MAC_LONGFRAME;
6530
6531         if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
6532             ic->ic_protmode != IEEE80211_PROT_NONE) {
6533                 /* Note: don't fall back to CCK rates for 5G */
6534                 if (phy->gmode)
6535                         rts_rate = BWN_CCK_RATE_1MB;
6536                 else
6537                         rts_rate = BWN_OFDM_RATE_6MB;
6538                 rts_rate_fb = bwn_get_fbrate(rts_rate);
6539
6540                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
6541                 mprot = ieee80211_alloc_prot(ni, m, rate, ic->ic_protmode);
6542                 if (mprot == NULL) {
6543                         if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
6544                         device_printf(sc->sc_dev,
6545                             "could not allocate mbuf for protection mode %d\n",
6546                             ic->ic_protmode);
6547                         return (ENOBUFS);
6548                 }
6549
6550                 switch (mac->mac_fw.fw_hdr_format) {
6551                 case BWN_FW_HDR_351:
6552                         prot_ptr = txhdr->body.r351.rts_frame;
6553                         break;
6554                 case BWN_FW_HDR_410:
6555                         prot_ptr = txhdr->body.r410.rts_frame;
6556                         break;
6557                 case BWN_FW_HDR_598:
6558                         prot_ptr = txhdr->body.r598.rts_frame;
6559                         break;
6560                 }
6561
6562                 bcopy(mtod(mprot, uint8_t *), prot_ptr, mprot->m_pkthdr.len);
6563                 m_freem(mprot);
6564
6565                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6566                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6567                         len = sizeof(struct ieee80211_frame_cts);
6568                 } else {
6569                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
6570                         len = sizeof(struct ieee80211_frame_rts);
6571                 }
6572                 len += IEEE80211_CRC_LEN;
6573
6574                 switch (mac->mac_fw.fw_hdr_format) {
6575                 case BWN_FW_HDR_351:
6576                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6577                             &txhdr->body.r351.rts_plcp, len, rts_rate);
6578                         break;
6579                 case BWN_FW_HDR_410:
6580                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6581                             &txhdr->body.r410.rts_plcp, len, rts_rate);
6582                         break;
6583                 case BWN_FW_HDR_598:
6584                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6585                             &txhdr->body.r598.rts_plcp, len, rts_rate);
6586                         break;
6587                 }
6588
6589                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6590                     rts_rate_fb);
6591
6592                 switch (mac->mac_fw.fw_hdr_format) {
6593                 case BWN_FW_HDR_351:
6594                         protwh = (struct ieee80211_frame *)
6595                             &txhdr->body.r351.rts_frame;
6596                         break;
6597                 case BWN_FW_HDR_410:
6598                         protwh = (struct ieee80211_frame *)
6599                             &txhdr->body.r410.rts_frame;
6600                         break;
6601                 case BWN_FW_HDR_598:
6602                         protwh = (struct ieee80211_frame *)
6603                             &txhdr->body.r598.rts_frame;
6604                         break;
6605                 }
6606
6607                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6608
6609                 if (BWN_ISOFDMRATE(rts_rate)) {
6610                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6611                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6612                 } else {
6613                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6614                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6615                 }
6616                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6617                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6618
6619                 if (fill_phy_ctl1) {
6620                         txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6621                         txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6622                 }
6623         }
6624
6625         if (fill_phy_ctl1) {
6626                 txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6627                 txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6628         }
6629
6630         switch (mac->mac_fw.fw_hdr_format) {
6631         case BWN_FW_HDR_351:
6632                 txhdr->body.r351.cookie = htole16(cookie);
6633                 break;
6634         case BWN_FW_HDR_410:
6635                 txhdr->body.r410.cookie = htole16(cookie);
6636                 break;
6637         case BWN_FW_HDR_598:
6638                 txhdr->body.r598.cookie = htole16(cookie);
6639                 break;
6640         }
6641
6642         txhdr->macctl = htole32(macctl);
6643         txhdr->phyctl = htole16(phyctl);
6644
6645         /*
6646          * TX radio tap
6647          */
6648         if (ieee80211_radiotap_active_vap(vap)) {
6649                 sc->sc_tx_th.wt_flags = 0;
6650                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6651                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6652                 if (isshort &&
6653                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6654                      rate == BWN_CCK_RATE_11MB))
6655                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6656                 sc->sc_tx_th.wt_rate = rate;
6657
6658                 ieee80211_radiotap_tx(vap, m);
6659         }
6660
6661         return (0);
6662 }
6663
6664 static void
6665 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6666     const uint8_t rate)
6667 {
6668         uint32_t d, plen;
6669         uint8_t *raw = plcp->o.raw;
6670
6671         if (BWN_ISOFDMRATE(rate)) {
6672                 d = bwn_plcp_getofdm(rate);
6673                 KASSERT(!(octets & 0xf000),
6674                     ("%s:%d: fail", __func__, __LINE__));
6675                 d |= (octets << 5);
6676                 plcp->o.data = htole32(d);
6677         } else {
6678                 plen = octets * 16 / rate;
6679                 if ((octets * 16 % rate) > 0) {
6680                         plen++;
6681                         if ((rate == BWN_CCK_RATE_11MB)
6682                             && ((octets * 8 % 11) < 4)) {
6683                                 raw[1] = 0x84;
6684                         } else
6685                                 raw[1] = 0x04;
6686                 } else
6687                         raw[1] = 0x04;
6688                 plcp->o.data |= htole32(plen << 16);
6689                 raw[0] = bwn_plcp_getcck(rate);
6690         }
6691 }
6692
6693 static uint8_t
6694 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6695 {
6696         struct bwn_softc *sc = mac->mac_sc;
6697         uint8_t mask;
6698
6699         if (n == 0)
6700                 return (0);
6701         if (mac->mac_phy.gmode)
6702                 mask = sc->sc_ant2g;
6703         else
6704                 mask = sc->sc_ant5g;
6705         if (!(mask & (1 << (n - 1))))
6706                 return (0);
6707         return (n);
6708 }
6709
6710 /*
6711  * Return a fallback rate for the given rate.
6712  *
6713  * Note: Don't fall back from OFDM to CCK.
6714  */
6715 static uint8_t
6716 bwn_get_fbrate(uint8_t bitrate)
6717 {
6718         switch (bitrate) {
6719         /* CCK */
6720         case BWN_CCK_RATE_1MB:
6721                 return (BWN_CCK_RATE_1MB);
6722         case BWN_CCK_RATE_2MB:
6723                 return (BWN_CCK_RATE_1MB);
6724         case BWN_CCK_RATE_5MB:
6725                 return (BWN_CCK_RATE_2MB);
6726         case BWN_CCK_RATE_11MB:
6727                 return (BWN_CCK_RATE_5MB);
6728
6729         /* OFDM */
6730         case BWN_OFDM_RATE_6MB:
6731                 return (BWN_OFDM_RATE_6MB);
6732         case BWN_OFDM_RATE_9MB:
6733                 return (BWN_OFDM_RATE_6MB);
6734         case BWN_OFDM_RATE_12MB:
6735                 return (BWN_OFDM_RATE_9MB);
6736         case BWN_OFDM_RATE_18MB:
6737                 return (BWN_OFDM_RATE_12MB);
6738         case BWN_OFDM_RATE_24MB:
6739                 return (BWN_OFDM_RATE_18MB);
6740         case BWN_OFDM_RATE_36MB:
6741                 return (BWN_OFDM_RATE_24MB);
6742         case BWN_OFDM_RATE_48MB:
6743                 return (BWN_OFDM_RATE_36MB);
6744         case BWN_OFDM_RATE_54MB:
6745                 return (BWN_OFDM_RATE_48MB);
6746         }
6747         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6748         return (0);
6749 }
6750
6751 static uint32_t
6752 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6753     uint32_t ctl, const void *_data, int len)
6754 {
6755         struct bwn_softc *sc = mac->mac_sc;
6756         uint32_t value = 0;
6757         const uint8_t *data = _data;
6758
6759         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6760             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6761         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6762
6763         bus_write_multi_4(sc->sc_mem_res, tq->tq_base + BWN_PIO8_TXDATA,
6764             __DECONST(void *, data), (len & ~3));
6765         if (len & 3) {
6766                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6767                     BWN_PIO8_TXCTL_24_31);
6768                 data = &(data[len - 1]);
6769                 switch (len & 3) {
6770                 case 3:
6771                         ctl |= BWN_PIO8_TXCTL_16_23;
6772                         value |= (uint32_t)(*data) << 16;
6773                         data--;
6774                 case 2:
6775                         ctl |= BWN_PIO8_TXCTL_8_15;
6776                         value |= (uint32_t)(*data) << 8;
6777                         data--;
6778                 case 1:
6779                         value |= (uint32_t)(*data);
6780                 }
6781                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6782                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6783         }
6784
6785         return (ctl);
6786 }
6787
6788 static void
6789 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6790     uint16_t offset, uint32_t value)
6791 {
6792
6793         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6794 }
6795
6796 static uint16_t
6797 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6798     uint16_t ctl, const void *_data, int len)
6799 {
6800         struct bwn_softc *sc = mac->mac_sc;
6801         const uint8_t *data = _data;
6802
6803         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6804         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6805
6806         bus_write_multi_2(sc->sc_mem_res, tq->tq_base + BWN_PIO_TXDATA,
6807             __DECONST(void *, data), (len & ~1));
6808         if (len & 1) {
6809                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6810                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6811                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6812         }
6813
6814         return (ctl);
6815 }
6816
6817 static uint16_t
6818 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6819     uint16_t ctl, struct mbuf *m0)
6820 {
6821         int i, j = 0;
6822         uint16_t data = 0;
6823         const uint8_t *buf;
6824         struct mbuf *m = m0;
6825
6826         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6827         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6828
6829         for (; m != NULL; m = m->m_next) {
6830                 buf = mtod(m, const uint8_t *);
6831                 for (i = 0; i < m->m_len; i++) {
6832                         if (!((j++) % 2))
6833                                 data |= buf[i];
6834                         else {
6835                                 data |= (buf[i] << 8);
6836                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6837                                 data = 0;
6838                         }
6839                 }
6840         }
6841         if (m0->m_pkthdr.len % 2) {
6842                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6843                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6844                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6845         }
6846
6847         return (ctl);
6848 }
6849
6850 static void
6851 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6852 {
6853
6854         /* XXX should exit if 5GHz band .. */
6855         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6856                 return;
6857
6858         BWN_WRITE_2(mac, 0x684, 510 + time);
6859         /* Disabled in Linux b43, can adversely effect performance */
6860 #if 0
6861         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6862 #endif
6863 }
6864
6865 static struct bwn_dma_ring *
6866 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6867 {
6868
6869         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6870                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6871
6872         switch (prio) {
6873         case 3:
6874                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6875         case 2:
6876                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6877         case 0:
6878                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6879         case 1:
6880                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6881         }
6882         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6883         return (NULL);
6884 }
6885
6886 static int
6887 bwn_dma_getslot(struct bwn_dma_ring *dr)
6888 {
6889         int slot;
6890
6891         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6892
6893         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6894         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6895         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6896
6897         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6898         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6899         dr->dr_curslot = slot;
6900         dr->dr_usedslot++;
6901
6902         return (slot);
6903 }
6904
6905 static struct bwn_pio_txqueue *
6906 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6907     struct bwn_pio_txpkt **pack)
6908 {
6909         struct bwn_pio *pio = &mac->mac_method.pio;
6910         struct bwn_pio_txqueue *tq = NULL;
6911         unsigned int index;
6912
6913         switch (cookie & 0xf000) {
6914         case 0x1000:
6915                 tq = &pio->wme[WME_AC_BK];
6916                 break;
6917         case 0x2000:
6918                 tq = &pio->wme[WME_AC_BE];
6919                 break;
6920         case 0x3000:
6921                 tq = &pio->wme[WME_AC_VI];
6922                 break;
6923         case 0x4000:
6924                 tq = &pio->wme[WME_AC_VO];
6925                 break;
6926         case 0x5000:
6927                 tq = &pio->mcast;
6928                 break;
6929         }
6930         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6931         if (tq == NULL)
6932                 return (NULL);
6933         index = (cookie & 0x0fff);
6934         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6935         if (index >= N(tq->tq_pkts))
6936                 return (NULL);
6937         *pack = &tq->tq_pkts[index];
6938         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6939         return (tq);
6940 }
6941
6942 static void
6943 bwn_txpwr(void *arg, int npending)
6944 {
6945         struct bwn_mac *mac = arg;
6946         struct bwn_softc *sc;
6947
6948         if (mac == NULL)
6949                 return;
6950
6951         sc = mac->mac_sc;
6952
6953         BWN_LOCK(sc);
6954         if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6955             mac->mac_phy.set_txpwr != NULL)
6956                 mac->mac_phy.set_txpwr(mac);
6957         BWN_UNLOCK(sc);
6958 }
6959
6960 static void
6961 bwn_task_15s(struct bwn_mac *mac)
6962 {
6963         uint16_t reg;
6964
6965         if (mac->mac_fw.opensource) {
6966                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6967                 if (reg) {
6968                         bwn_restart(mac, "fw watchdog");
6969                         return;
6970                 }
6971                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6972         }
6973         if (mac->mac_phy.task_15s)
6974                 mac->mac_phy.task_15s(mac);
6975
6976         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6977 }
6978
6979 static void
6980 bwn_task_30s(struct bwn_mac *mac)
6981 {
6982
6983         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6984                 return;
6985         mac->mac_noise.noi_running = 1;
6986         mac->mac_noise.noi_nsamples = 0;
6987
6988         bwn_noise_gensample(mac);
6989 }
6990
6991 static void
6992 bwn_task_60s(struct bwn_mac *mac)
6993 {
6994
6995         if (mac->mac_phy.task_60s)
6996                 mac->mac_phy.task_60s(mac);
6997         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6998 }
6999
7000 static void
7001 bwn_tasks(void *arg)
7002 {
7003         struct bwn_mac *mac = arg;
7004         struct bwn_softc *sc = mac->mac_sc;
7005
7006         BWN_ASSERT_LOCKED(sc);
7007         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
7008                 return;
7009
7010         if (mac->mac_task_state % 4 == 0)
7011                 bwn_task_60s(mac);
7012         if (mac->mac_task_state % 2 == 0)
7013                 bwn_task_30s(mac);
7014         bwn_task_15s(mac);
7015
7016         mac->mac_task_state++;
7017         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
7018 }
7019
7020 static int
7021 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
7022 {
7023         struct bwn_softc *sc = mac->mac_sc;
7024
7025         KASSERT(a == 0, ("not support APHY\n"));
7026
7027         switch (plcp->o.raw[0] & 0xf) {
7028         case 0xb:
7029                 return (BWN_OFDM_RATE_6MB);
7030         case 0xf:
7031                 return (BWN_OFDM_RATE_9MB);
7032         case 0xa:
7033                 return (BWN_OFDM_RATE_12MB);
7034         case 0xe:
7035                 return (BWN_OFDM_RATE_18MB);
7036         case 0x9:
7037                 return (BWN_OFDM_RATE_24MB);
7038         case 0xd:
7039                 return (BWN_OFDM_RATE_36MB);
7040         case 0x8:
7041                 return (BWN_OFDM_RATE_48MB);
7042         case 0xc:
7043                 return (BWN_OFDM_RATE_54MB);
7044         }
7045         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
7046             plcp->o.raw[0] & 0xf);
7047         return (-1);
7048 }
7049
7050 static int
7051 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
7052 {
7053         struct bwn_softc *sc = mac->mac_sc;
7054
7055         switch (plcp->o.raw[0]) {
7056         case 0x0a:
7057                 return (BWN_CCK_RATE_1MB);
7058         case 0x14:
7059                 return (BWN_CCK_RATE_2MB);
7060         case 0x37:
7061                 return (BWN_CCK_RATE_5MB);
7062         case 0x6e:
7063                 return (BWN_CCK_RATE_11MB);
7064         }
7065         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
7066         return (-1);
7067 }
7068
7069 static void
7070 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
7071     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
7072     int rssi, int noise)
7073 {
7074         struct bwn_softc *sc = mac->mac_sc;
7075         const struct ieee80211_frame_min *wh;
7076         uint64_t tsf;
7077         uint16_t low_mactime_now;
7078         uint16_t mt;
7079
7080         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
7081                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7082
7083         wh = mtod(m, const struct ieee80211_frame_min *);
7084         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
7085                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
7086
7087         bwn_tsf_read(mac, &tsf);
7088         low_mactime_now = tsf;
7089         tsf = tsf & ~0xffffULL;
7090
7091         switch (mac->mac_fw.fw_hdr_format) {
7092         case BWN_FW_HDR_351:
7093         case BWN_FW_HDR_410:
7094                 mt = le16toh(rxhdr->ps4.r351.mac_time);
7095                 break;
7096         case BWN_FW_HDR_598:
7097                 mt = le16toh(rxhdr->ps4.r598.mac_time);
7098                 break;
7099         }
7100
7101         tsf += mt;
7102         if (low_mactime_now < mt)
7103                 tsf -= 0x10000;
7104
7105         sc->sc_rx_th.wr_tsf = tsf;
7106         sc->sc_rx_th.wr_rate = rate;
7107         sc->sc_rx_th.wr_antsignal = rssi;
7108         sc->sc_rx_th.wr_antnoise = noise;
7109 }
7110
7111 static void
7112 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
7113 {
7114         uint32_t low, high;
7115
7116         KASSERT(bhnd_get_hwrev(mac->mac_sc->sc_dev) >= 3,
7117             ("%s:%d: fail", __func__, __LINE__));
7118
7119         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
7120         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
7121         *tsf = high;
7122         *tsf <<= 32;
7123         *tsf |= low;
7124 }
7125
7126 static int
7127 bwn_dma_attach(struct bwn_mac *mac)
7128 {
7129         struct bwn_dma                  *dma;
7130         struct bwn_softc                *sc;
7131         struct bhnd_dma_translation     *dt, dma_translation;
7132         bhnd_addr_t                      addrext_req;
7133         bus_dma_tag_t                    dmat;
7134         bus_addr_t                       lowaddr;
7135         u_int                            addrext_shift, addr_width;
7136         int                              error;
7137
7138         dma = &mac->mac_method.dma;
7139         sc = mac->mac_sc;
7140         dt = NULL;
7141
7142         if (sc->sc_quirks & BWN_QUIRK_NODMA)
7143                 return (0);
7144
7145         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5, ("%s: fail", __func__));
7146
7147         /* Use the DMA engine's maximum host address width to determine the
7148          * addrext constraints, and supported device address width. */
7149         switch (mac->mac_dmatype) {
7150         case BHND_DMA_ADDR_30BIT:
7151                 /* 32-bit engine without addrext support */
7152                 addrext_req = 0x0;
7153                 addrext_shift = 0;
7154
7155                 /* We can address the full 32-bit device address space */
7156                 addr_width = BHND_DMA_ADDR_32BIT;
7157                 break;
7158
7159         case BHND_DMA_ADDR_32BIT:
7160                 /* 32-bit engine with addrext support */
7161                 addrext_req = BWN_DMA32_ADDREXT_MASK;
7162                 addrext_shift = BWN_DMA32_ADDREXT_SHIFT;
7163                 addr_width = BHND_DMA_ADDR_32BIT;
7164                 break;
7165
7166         case BHND_DMA_ADDR_64BIT:
7167                 /* 64-bit engine with addrext support */
7168                 addrext_req = BWN_DMA64_ADDREXT_MASK;
7169                 addrext_shift = BWN_DMA64_ADDREXT_SHIFT;
7170                 addr_width = BHND_DMA_ADDR_64BIT;
7171                 break;
7172
7173         default:
7174                 device_printf(sc->sc_dev, "unsupported DMA address width: %d\n",
7175                     mac->mac_dmatype);
7176                 return (ENXIO);
7177         }
7178
7179         /* Fetch our device->host DMA translation and tag */
7180         error = bhnd_get_dma_translation(sc->sc_dev, addr_width, 0, &dmat,
7181             &dma_translation);
7182         if (error) {
7183                 device_printf(sc->sc_dev, "error fetching DMA translation: "
7184                     "%d\n", error);
7185                 return (error);
7186         }
7187
7188         /* Verify that our DMA engine's addrext constraints are compatible with
7189          * our DMA translation */
7190         if (addrext_req != 0x0 &&
7191             (dma_translation.addrext_mask & addrext_req) != addrext_req)
7192         {
7193                 device_printf(sc->sc_dev, "bus addrext mask %#jx incompatible "
7194                     "with device addrext mask %#jx, disabling extended address "
7195                     "support\n", (uintmax_t)dma_translation.addrext_mask,
7196                     (uintmax_t)addrext_req);
7197
7198                 addrext_req = 0x0;
7199                 addrext_shift = 0;
7200         }
7201
7202         /* Apply our addrext translation constraint */
7203         dma_translation.addrext_mask = addrext_req;
7204
7205         /* Initialize our DMA engine configuration */
7206         mac->mac_flags |= BWN_MAC_FLAG_DMA;
7207
7208         dma->addrext_shift = addrext_shift;
7209         dma->translation = dma_translation;
7210
7211         dt = &dma->translation;
7212
7213         /* Dermine our translation's maximum supported address */
7214         lowaddr = MIN((dt->addr_mask | dt->addrext_mask), BUS_SPACE_MAXADDR);
7215
7216         /*
7217          * Create top level DMA tag
7218          */
7219         error = bus_dma_tag_create(dmat,                /* parent */
7220                                BWN_ALIGN, 0,            /* alignment, bounds */
7221                                lowaddr,                 /* lowaddr */
7222                                BUS_SPACE_MAXADDR,       /* highaddr */
7223                                NULL, NULL,              /* filter, filterarg */
7224                                BUS_SPACE_MAXSIZE,       /* maxsize */
7225                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
7226                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
7227                                0,                       /* flags */
7228                                NULL, NULL,              /* lockfunc, lockarg */
7229                                &dma->parent_dtag);
7230         if (error) {
7231                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
7232                 return (error);
7233         }
7234
7235         /*
7236          * Create TX/RX mbuf DMA tag
7237          */
7238         error = bus_dma_tag_create(dma->parent_dtag,
7239                                 1,
7240                                 0,
7241                                 BUS_SPACE_MAXADDR,
7242                                 BUS_SPACE_MAXADDR,
7243                                 NULL, NULL,
7244                                 MCLBYTES,
7245                                 1,
7246                                 BUS_SPACE_MAXSIZE_32BIT,
7247                                 0,
7248                                 NULL, NULL,
7249                                 &dma->rxbuf_dtag);
7250         if (error) {
7251                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7252                 goto fail0;
7253         }
7254         error = bus_dma_tag_create(dma->parent_dtag,
7255                                 1,
7256                                 0,
7257                                 BUS_SPACE_MAXADDR,
7258                                 BUS_SPACE_MAXADDR,
7259                                 NULL, NULL,
7260                                 MCLBYTES,
7261                                 1,
7262                                 BUS_SPACE_MAXSIZE_32BIT,
7263                                 0,
7264                                 NULL, NULL,
7265                                 &dma->txbuf_dtag);
7266         if (error) {
7267                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7268                 goto fail1;
7269         }
7270
7271         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1);
7272         if (!dma->wme[WME_AC_BK])
7273                 goto fail2;
7274
7275         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1);
7276         if (!dma->wme[WME_AC_BE])
7277                 goto fail3;
7278
7279         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1);
7280         if (!dma->wme[WME_AC_VI])
7281                 goto fail4;
7282
7283         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1);
7284         if (!dma->wme[WME_AC_VO])
7285                 goto fail5;
7286
7287         dma->mcast = bwn_dma_ringsetup(mac, 4, 1);
7288         if (!dma->mcast)
7289                 goto fail6;
7290         dma->rx = bwn_dma_ringsetup(mac, 0, 0);
7291         if (!dma->rx)
7292                 goto fail7;
7293
7294         return (error);
7295
7296 fail7:  bwn_dma_ringfree(&dma->mcast);
7297 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7298 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7299 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7300 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7301 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
7302 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
7303 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
7304         return (error);
7305 }
7306
7307 static struct bwn_dma_ring *
7308 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7309     uint16_t cookie, int *slot)
7310 {
7311         struct bwn_dma *dma = &mac->mac_method.dma;
7312         struct bwn_dma_ring *dr;
7313         struct bwn_softc *sc = mac->mac_sc;
7314
7315         BWN_ASSERT_LOCKED(mac->mac_sc);
7316
7317         switch (cookie & 0xf000) {
7318         case 0x1000:
7319                 dr = dma->wme[WME_AC_BK];
7320                 break;
7321         case 0x2000:
7322                 dr = dma->wme[WME_AC_BE];
7323                 break;
7324         case 0x3000:
7325                 dr = dma->wme[WME_AC_VI];
7326                 break;
7327         case 0x4000:
7328                 dr = dma->wme[WME_AC_VO];
7329                 break;
7330         case 0x5000:
7331                 dr = dma->mcast;
7332                 break;
7333         default:
7334                 dr = NULL;
7335                 KASSERT(0 == 1,
7336                     ("invalid cookie value %d", cookie & 0xf000));
7337         }
7338         *slot = (cookie & 0x0fff);
7339         if (*slot < 0 || *slot >= dr->dr_numslots) {
7340                 /*
7341                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7342                  * that it occurs events which have same H/W sequence numbers.
7343                  * When it's occurred just prints a WARNING msgs and ignores.
7344                  */
7345                 KASSERT(status->seq == dma->lastseq,
7346                     ("%s:%d: fail", __func__, __LINE__));
7347                 device_printf(sc->sc_dev,
7348                     "out of slot ranges (0 < %d < %d)\n", *slot,
7349                     dr->dr_numslots);
7350                 return (NULL);
7351         }
7352         dma->lastseq = status->seq;
7353         return (dr);
7354 }
7355
7356 static void
7357 bwn_dma_stop(struct bwn_mac *mac)
7358 {
7359         struct bwn_dma *dma;
7360
7361         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7362                 return;
7363         dma = &mac->mac_method.dma;
7364
7365         bwn_dma_ringstop(&dma->rx);
7366         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7367         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7368         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7369         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7370         bwn_dma_ringstop(&dma->mcast);
7371 }
7372
7373 static void
7374 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7375 {
7376
7377         if (dr == NULL)
7378                 return;
7379
7380         bwn_dma_cleanup(*dr);
7381 }
7382
7383 static void
7384 bwn_pio_stop(struct bwn_mac *mac)
7385 {
7386         struct bwn_pio *pio;
7387
7388         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7389                 return;
7390         pio = &mac->mac_method.pio;
7391
7392         bwn_destroy_queue_tx(&pio->mcast);
7393         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7394         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7395         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7396         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7397 }
7398
7399 static int
7400 bwn_led_attach(struct bwn_mac *mac)
7401 {
7402         struct bwn_softc *sc = mac->mac_sc;
7403         const uint8_t *led_act = NULL;
7404         int error;
7405         int i;
7406
7407         sc->sc_led_idle = (2350 * hz) / 1000;
7408         sc->sc_led_blink = 1;
7409
7410         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7411                 if (sc->sc_board_info.board_vendor ==
7412                     bwn_vendor_led_act[i].vid) {
7413                         led_act = bwn_vendor_led_act[i].led_act;
7414                         break;
7415                 }
7416         }
7417         if (led_act == NULL)
7418                 led_act = bwn_default_led_act;
7419
7420         _Static_assert(nitems(bwn_led_vars) == BWN_LED_MAX,
7421             "invalid NVRAM variable name array");
7422
7423         for (i = 0; i < BWN_LED_MAX; ++i) {
7424                 struct bwn_led  *led;
7425                 uint8_t          val;
7426
7427                 led = &sc->sc_leds[i];
7428
7429                 KASSERT(i < nitems(bwn_led_vars), ("unknown LED index"));
7430                 error = bhnd_nvram_getvar_uint8(sc->sc_dev, bwn_led_vars[i],
7431                     &val);
7432                 if (error) {
7433                         if (error != ENOENT) {
7434                                 device_printf(sc->sc_dev, "NVRAM variable %s "
7435                                     "unreadable: %d", bwn_led_vars[i], error);
7436                                 return (error);
7437                         }
7438
7439                         /* Not found; use default */
7440                         led->led_act = led_act[i];
7441                 } else {
7442                         if (val & BWN_LED_ACT_LOW)
7443                                 led->led_flags |= BWN_LED_F_ACTLOW;
7444                         led->led_act = val & BWN_LED_ACT_MASK;
7445                 }
7446                 led->led_mask = (1 << i);
7447
7448                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7449                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
7450                     led->led_act == BWN_LED_ACT_BLINK) {
7451                         led->led_flags |= BWN_LED_F_BLINK;
7452                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7453                                 led->led_flags |= BWN_LED_F_POLLABLE;
7454                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7455                                 led->led_flags |= BWN_LED_F_SLOW;
7456
7457                         if (sc->sc_blink_led == NULL) {
7458                                 sc->sc_blink_led = led;
7459                                 if (led->led_flags & BWN_LED_F_SLOW)
7460                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
7461                         }
7462                 }
7463
7464                 DPRINTF(sc, BWN_DEBUG_LED,
7465                     "%dth led, act %d, lowact %d\n", i,
7466                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7467         }
7468         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7469
7470         return (0);
7471 }
7472
7473 static __inline uint16_t
7474 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7475 {
7476
7477         if (led->led_flags & BWN_LED_F_ACTLOW)
7478                 on = !on;
7479         if (on)
7480                 val |= led->led_mask;
7481         else
7482                 val &= ~led->led_mask;
7483         return val;
7484 }
7485
7486 static void
7487 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7488 {
7489         struct bwn_softc *sc = mac->mac_sc;
7490         struct ieee80211com *ic = &sc->sc_ic;
7491         uint16_t val;
7492         int i;
7493
7494         if (nstate == IEEE80211_S_INIT) {
7495                 callout_stop(&sc->sc_led_blink_ch);
7496                 sc->sc_led_blinking = 0;
7497         }
7498
7499         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7500                 return;
7501
7502         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7503         for (i = 0; i < BWN_LED_MAX; ++i) {
7504                 struct bwn_led *led = &sc->sc_leds[i];
7505                 int on;
7506
7507                 if (led->led_act == BWN_LED_ACT_UNKN ||
7508                     led->led_act == BWN_LED_ACT_NULL)
7509                         continue;
7510
7511                 if ((led->led_flags & BWN_LED_F_BLINK) &&
7512                     nstate != IEEE80211_S_INIT)
7513                         continue;
7514
7515                 switch (led->led_act) {
7516                 case BWN_LED_ACT_ON:    /* Always on */
7517                         on = 1;
7518                         break;
7519                 case BWN_LED_ACT_OFF:   /* Always off */
7520                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7521                         on = 0;
7522                         break;
7523                 default:
7524                         on = 1;
7525                         switch (nstate) {
7526                         case IEEE80211_S_INIT:
7527                                 on = 0;
7528                                 break;
7529                         case IEEE80211_S_RUN:
7530                                 if (led->led_act == BWN_LED_ACT_11G &&
7531                                     ic->ic_curmode != IEEE80211_MODE_11G)
7532                                         on = 0;
7533                                 break;
7534                         default:
7535                                 if (led->led_act == BWN_LED_ACT_ASSOC)
7536                                         on = 0;
7537                                 break;
7538                         }
7539                         break;
7540                 }
7541
7542                 val = bwn_led_onoff(led, val, on);
7543         }
7544         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7545 }
7546
7547 static void
7548 bwn_led_event(struct bwn_mac *mac, int event)
7549 {
7550         struct bwn_softc *sc = mac->mac_sc;
7551         struct bwn_led *led = sc->sc_blink_led;
7552         int rate;
7553
7554         if (event == BWN_LED_EVENT_POLL) {
7555                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7556                         return;
7557                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7558                         return;
7559         }
7560
7561         sc->sc_led_ticks = ticks;
7562         if (sc->sc_led_blinking)
7563                 return;
7564
7565         switch (event) {
7566         case BWN_LED_EVENT_RX:
7567                 rate = sc->sc_rx_rate;
7568                 break;
7569         case BWN_LED_EVENT_TX:
7570                 rate = sc->sc_tx_rate;
7571                 break;
7572         case BWN_LED_EVENT_POLL:
7573                 rate = 0;
7574                 break;
7575         default:
7576                 panic("unknown LED event %d\n", event);
7577                 break;
7578         }
7579         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7580             bwn_led_duration[rate].off_dur);
7581 }
7582
7583 static void
7584 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7585 {
7586         struct bwn_softc *sc = mac->mac_sc;
7587         struct bwn_led *led = sc->sc_blink_led;
7588         uint16_t val;
7589
7590         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7591         val = bwn_led_onoff(led, val, 1);
7592         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7593
7594         if (led->led_flags & BWN_LED_F_SLOW) {
7595                 BWN_LED_SLOWDOWN(on_dur);
7596                 BWN_LED_SLOWDOWN(off_dur);
7597         }
7598
7599         sc->sc_led_blinking = 1;
7600         sc->sc_led_blink_offdur = off_dur;
7601
7602         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7603 }
7604
7605 static void
7606 bwn_led_blink_next(void *arg)
7607 {
7608         struct bwn_mac *mac = arg;
7609         struct bwn_softc *sc = mac->mac_sc;
7610         uint16_t val;
7611
7612         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7613         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7614         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7615
7616         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7617             bwn_led_blink_end, mac);
7618 }
7619
7620 static void
7621 bwn_led_blink_end(void *arg)
7622 {
7623         struct bwn_mac *mac = arg;
7624         struct bwn_softc *sc = mac->mac_sc;
7625
7626         sc->sc_led_blinking = 0;
7627 }
7628
7629 static int
7630 bwn_suspend(device_t dev)
7631 {
7632         struct bwn_softc *sc = device_get_softc(dev);
7633
7634         BWN_LOCK(sc);
7635         bwn_stop(sc);
7636         BWN_UNLOCK(sc);
7637         return (0);
7638 }
7639
7640 static int
7641 bwn_resume(device_t dev)
7642 {
7643         struct bwn_softc *sc = device_get_softc(dev);
7644         int error = EDOOFUS;
7645
7646         BWN_LOCK(sc);
7647         if (sc->sc_ic.ic_nrunning > 0)
7648                 error = bwn_init(sc);
7649         BWN_UNLOCK(sc);
7650         if (error == 0)
7651                 ieee80211_start_all(&sc->sc_ic);
7652         return (0);
7653 }
7654
7655 static void
7656 bwn_rfswitch(void *arg)
7657 {
7658         struct bwn_softc *sc = arg;
7659         struct bwn_mac *mac = sc->sc_curmac;
7660         int cur = 0, prev = 0;
7661
7662         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7663             ("%s: invalid MAC status %d", __func__, mac->mac_status));
7664
7665         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7666             || mac->mac_phy.type == BWN_PHYTYPE_N) {
7667                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7668                         & BWN_RF_HWENABLED_HI_MASK))
7669                         cur = 1;
7670         } else {
7671                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7672                     & BWN_RF_HWENABLED_LO_MASK)
7673                         cur = 1;
7674         }
7675
7676         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7677                 prev = 1;
7678
7679         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7680             __func__, cur, prev);
7681
7682         if (cur != prev) {
7683                 if (cur)
7684                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7685                 else
7686                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7687
7688                 device_printf(sc->sc_dev,
7689                     "status of RF switch is changed to %s\n",
7690                     cur ? "ON" : "OFF");
7691                 if (cur != mac->mac_phy.rf_on) {
7692                         if (cur)
7693                                 bwn_rf_turnon(mac);
7694                         else
7695                                 bwn_rf_turnoff(mac);
7696                 }
7697         }
7698
7699         callout_schedule(&sc->sc_rfswitch_ch, hz);
7700 }
7701
7702 static void
7703 bwn_sysctl_node(struct bwn_softc *sc)
7704 {
7705         device_t dev = sc->sc_dev;
7706         struct bwn_mac *mac;
7707         struct bwn_stats *stats;
7708
7709         /* XXX assume that count of MAC is only 1. */
7710
7711         if ((mac = sc->sc_curmac) == NULL)
7712                 return;
7713         stats = &mac->mac_stats;
7714
7715         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7716             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7717             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7718         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7719             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7720             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7721         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7722             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7723             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7724
7725 #ifdef BWN_DEBUG
7726         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7727             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7728             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7729 #endif
7730 }
7731
7732 static device_method_t bwn_methods[] = {
7733         /* Device interface */
7734         DEVMETHOD(device_probe,         bwn_probe),
7735         DEVMETHOD(device_attach,        bwn_attach),
7736         DEVMETHOD(device_detach,        bwn_detach),
7737         DEVMETHOD(device_suspend,       bwn_suspend),
7738         DEVMETHOD(device_resume,        bwn_resume),
7739         DEVMETHOD_END
7740 };
7741 static driver_t bwn_driver = {
7742         "bwn",
7743         bwn_methods,
7744         sizeof(struct bwn_softc)
7745 };
7746 static devclass_t bwn_devclass;
7747 DRIVER_MODULE(bwn, bhnd, bwn_driver, bwn_devclass, 0, 0);
7748 MODULE_DEPEND(bwn, bhnd, 1, 1, 1);
7749 MODULE_DEPEND(bwn, gpiobus, 1, 1, 1);
7750 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
7751 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
7752 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7753 MODULE_VERSION(bwn, 1);