sys/dev/bwn/if_bwn.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   3  *
   4  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   5  * Copyright (c) 2016 Landon Fuller <landonf@FreeBSD.org>
   6  * Copyright (c) 2017 The FreeBSD Foundation
   7  * All rights reserved.
   8  *
   9  * Portions of this software were developed by Landon Fuller
  10  * under sponsorship from the FreeBSD Foundation.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer,
  17  *    without modification.
  18  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  19  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  20  *    redistribution must be conditioned upon including a substantially
  21  *    similar Disclaimer requirement for further binary redistribution.
  22  *
  23  * NO WARRANTY
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  34  * THE POSSIBILITY OF SUCH DAMAGES.
  35  */
  36
  37 #include <sys/cdefs.h>
  38 __FBSDID("$FreeBSD$");
  39
  40 /*
  41  * The Broadcom Wireless LAN controller driver.
  42  */
  43
  44 #include "opt_bwn.h"
  45 #include "opt_wlan.h"
  46
  47 #include <sys/param.h>
  48 #include <sys/systm.h>
  49 #include <sys/kernel.h>
  50 #include <sys/gpio.h>
  51 #include <sys/malloc.h>
  52 #include <sys/module.h>
  53 #include <sys/endian.h>
  54 #include <sys/errno.h>
  55 #include <sys/firmware.h>
  56 #include <sys/lock.h>
  57 #include <sys/mutex.h>
  58 #include <machine/bus.h>
  59 #include <machine/resource.h>
  60 #include <sys/bus.h>
  61 #include <sys/rman.h>
  62 #include <sys/socket.h>
  63 #include <sys/sockio.h>
  64
  65 #include <net/ethernet.h>
  66 #include <net/if.h>
  67 #include <net/if_var.h>
  68 #include <net/if_arp.h>
  69 #include <net/if_dl.h>
  70 #include <net/if_llc.h>
  71 #include <net/if_media.h>
  72 #include <net/if_types.h>
  73
  74 #include <net80211/ieee80211_var.h>
  75 #include <net80211/ieee80211_radiotap.h>
  76 #include <net80211/ieee80211_regdomain.h>
  77 #include <net80211/ieee80211_phy.h>
  78 #include <net80211/ieee80211_ratectl.h>
  79
  80 #include <dev/bhnd/bhnd.h>
  81 #include <dev/bhnd/bhnd_ids.h>
  82
  83 #include <dev/bhnd/cores/chipc/chipc.h>
  84 #include <dev/bhnd/cores/pmu/bhnd_pmu.h>
  85
  86 #include <dev/bwn/if_bwnreg.h>
  87 #include <dev/bwn/if_bwnvar.h>
  88
  89 #include <dev/bwn/if_bwn_debug.h>
  90 #include <dev/bwn/if_bwn_misc.h>
  91 #include <dev/bwn/if_bwn_util.h>
  92 #include <dev/bwn/if_bwn_phy_common.h>
  93 #include <dev/bwn/if_bwn_phy_g.h>
  94 #include <dev/bwn/if_bwn_phy_lp.h>
  95 #include <dev/bwn/if_bwn_phy_n.h>
  96
  97 #include "bhnd_nvram_map.h"
  98
  99 #include "gpio_if.h"
 100
 101 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
 102     "Broadcom driver parameters");
 103
 104 /*
 105  * Tunable & sysctl variables.
 106  */
 107
 108 #ifdef BWN_DEBUG
 109 static  int bwn_debug = 0;
 110 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
 111     "Broadcom debugging printfs");
 112 #endif
 113
 114 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
 115 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
 116     "uses Bad Frames Preemption");
 117 static int      bwn_bluetooth = 1;
 118 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 119     "turns on Bluetooth Coexistence");
 120 static int      bwn_hwpctl = 0;
 121 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 122     "uses H/W power control");
 123 static int      bwn_usedma = 1;
 124 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 125     "uses DMA");
 126 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 127 static int      bwn_wme = 1;
 128 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 129     "uses WME support");
 130
 131 static void     bwn_attach_pre(struct bwn_softc *);
 132 static int      bwn_attach_post(struct bwn_softc *);
 133 static int      bwn_retain_bus_providers(struct bwn_softc *sc);
 134 static void     bwn_release_bus_providers(struct bwn_softc *sc);
 135 static void     bwn_sprom_bugfixes(device_t);
 136 static int      bwn_init(struct bwn_softc *);
 137 static void     bwn_parent(struct ieee80211com *);
 138 static void     bwn_start(struct bwn_softc *);
 139 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 140 static int      bwn_attach_core(struct bwn_mac *);
 141 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 142 static int      bwn_chiptest(struct bwn_mac *);
 143 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 144 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 145                     uint16_t);
 146 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 147                     const struct bwn_channelinfo *, const uint8_t []);
 148 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 149                     const struct ieee80211_bpf_params *);
 150 static void     bwn_updateslot(struct ieee80211com *);
 151 static void     bwn_update_promisc(struct ieee80211com *);
 152 static void     bwn_wme_init(struct bwn_mac *);
 153 static int      bwn_wme_update(struct ieee80211com *);
 154 static void     bwn_wme_clear(struct bwn_softc *);
 155 static void     bwn_wme_load(struct bwn_mac *);
 156 static void     bwn_wme_loadparams(struct bwn_mac *,
 157                     const struct wmeParams *, uint16_t);
 158 static void     bwn_scan_start(struct ieee80211com *);
 159 static void     bwn_scan_end(struct ieee80211com *);
 160 static void     bwn_set_channel(struct ieee80211com *);
 161 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 162                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 163                     const uint8_t [IEEE80211_ADDR_LEN],
 164                     const uint8_t [IEEE80211_ADDR_LEN]);
 165 static void     bwn_vap_delete(struct ieee80211vap *);
 166 static void     bwn_stop(struct bwn_softc *);
 167 static int      bwn_core_forceclk(struct bwn_mac *, bool);
 168 static int      bwn_core_init(struct bwn_mac *);
 169 static void     bwn_core_start(struct bwn_mac *);
 170 static void     bwn_core_exit(struct bwn_mac *);
 171 static void     bwn_bt_disable(struct bwn_mac *);
 172 static int      bwn_chip_init(struct bwn_mac *);
 173 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 174 static void     bwn_rate_init(struct bwn_mac *);
 175 static void     bwn_set_phytxctl(struct bwn_mac *);
 176 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 177 static void     bwn_bt_enable(struct bwn_mac *);
 178 static void     bwn_set_macaddr(struct bwn_mac *);
 179 static void     bwn_crypt_init(struct bwn_mac *);
 180 static void     bwn_chip_exit(struct bwn_mac *);
 181 static int      bwn_fw_fillinfo(struct bwn_mac *);
 182 static int      bwn_fw_loaducode(struct bwn_mac *);
 183 static int      bwn_gpio_init(struct bwn_mac *);
 184 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 185 static int      bwn_phy_init(struct bwn_mac *);
 186 static void     bwn_set_txantenna(struct bwn_mac *, int);
 187 static void     bwn_set_opmode(struct bwn_mac *);
 188 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 189 static uint8_t  bwn_plcp_getcck(const uint8_t);
 190 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 191 static void     bwn_pio_init(struct bwn_mac *);
 192 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 193 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 194                     int);
 195 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 196                     struct bwn_pio_rxqueue *, int);
 197 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 198 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 199                     uint16_t);
 200 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 201 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 202 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 203 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 204                     const struct bwn_txstatus *);
 205 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 206 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 207 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 208                     uint16_t);
 209 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 210                     uint32_t);
 211 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 212                     struct mbuf **);
 213 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 214 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 215                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 216 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 217                     uint16_t, uint32_t);
 218 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 219                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 220 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 221                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 222 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 223                     uint16_t, struct bwn_pio_txpkt **);
 224 static void     bwn_dma_init(struct bwn_mac *);
 225 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 226 static uint16_t bwn_dma_base(int, int);
 227 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 228 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 229                     int, struct bwn_dmadesc_generic **,
 230                     struct bwn_dmadesc_meta **);
 231 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 232                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 233                     int, int);
 234 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 235 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 236 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 237 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 238 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 239 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 240                     int, struct bwn_dmadesc_generic **,
 241                     struct bwn_dmadesc_meta **);
 242 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 243                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 244                     int, int);
 245 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 246 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 247 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 248 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 249 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 250 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 251 static void     bwn_dma_setup(struct bwn_dma_ring *);
 252 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 253 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 254 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 255 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 256 static void     bwn_dma_rx(struct bwn_dma_ring *);
 257 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 258 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 259                     struct bwn_dmadesc_meta *);
 260 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 261 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 262 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 263 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 264 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 265 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 266                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 267                     int);
 268 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 269                     bus_size_t, int);
 270 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 271 static void     bwn_ratectl_tx_complete(const struct ieee80211_node *,
 272                     const struct bwn_txstatus *);
 273 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 274                     const struct bwn_txstatus *);
 275 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 276                     struct mbuf **);
 277 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 278 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 279                     uint8_t);
 280 static int      bwn_dma_attach(struct bwn_mac *);
 281 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 282                     int, int);
 283 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 284                     const struct bwn_txstatus *, uint16_t, int *);
 285 static void     bwn_dma_free(struct bwn_mac *);
 286 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 287 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 288                     const char *, struct bwn_fwfile *);
 289 static void     bwn_release_firmware(struct bwn_mac *);
 290 static void     bwn_do_release_fw(struct bwn_fwfile *);
 291 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 292 static int      bwn_fwinitvals_write(struct bwn_mac *,
 293                     const struct bwn_fwinitvals *, size_t, size_t);
 294 static uint16_t bwn_ant2phy(int);
 295 static void     bwn_mac_write_bssid(struct bwn_mac *);
 296 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 297                     const uint8_t *);
 298 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 299                     const uint8_t *, size_t, const uint8_t *);
 300 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 301                     const uint8_t *);
 302 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 303                     const uint8_t *);
 304 static void     bwn_phy_exit(struct bwn_mac *);
 305 static void     bwn_core_stop(struct bwn_mac *);
 306 static int      bwn_switch_band(struct bwn_softc *,
 307                     struct ieee80211_channel *);
 308 static int      bwn_phy_reset(struct bwn_mac *);
 309 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 310 static void     bwn_set_pretbtt(struct bwn_mac *);
 311 static int      bwn_intr(void *);
 312 static void     bwn_intrtask(void *, int);
 313 static void     bwn_restart(struct bwn_mac *, const char *);
 314 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 315 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 316 static void     bwn_intr_atim_end(struct bwn_mac *);
 317 static void     bwn_intr_beacon(struct bwn_mac *);
 318 static void     bwn_intr_pmq(struct bwn_mac *);
 319 static void     bwn_intr_noise(struct bwn_mac *);
 320 static void     bwn_intr_txeof(struct bwn_mac *);
 321 static void     bwn_hwreset(void *, int);
 322 static void     bwn_handle_fwpanic(struct bwn_mac *);
 323 static void     bwn_load_beacon0(struct bwn_mac *);
 324 static void     bwn_load_beacon1(struct bwn_mac *);
 325 static uint32_t bwn_jssi_read(struct bwn_mac *);
 326 static void     bwn_noise_gensample(struct bwn_mac *);
 327 static void     bwn_handle_txeof(struct bwn_mac *,
 328                     const struct bwn_txstatus *);
 329 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 330 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 331 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 332                     struct mbuf *);
 333 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 334 static int      bwn_set_txhdr(struct bwn_mac *,
 335                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 336                     uint16_t);
 337 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 338                     const uint8_t);
 339 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 340 static uint8_t  bwn_get_fbrate(uint8_t);
 341 static void     bwn_txpwr(void *, int);
 342 static void     bwn_tasks(void *);
 343 static void     bwn_task_15s(struct bwn_mac *);
 344 static void     bwn_task_30s(struct bwn_mac *);
 345 static void     bwn_task_60s(struct bwn_mac *);
 346 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 347                     uint8_t);
 348 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 349 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 350                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 351                     int, int);
 352 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 353 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 354 static void     bwn_watchdog(void *);
 355 static void     bwn_dma_stop(struct bwn_mac *);
 356 static void     bwn_pio_stop(struct bwn_mac *);
 357 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 358 static int      bwn_led_attach(struct bwn_mac *);
 359 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 360 static void     bwn_led_event(struct bwn_mac *, int);
 361 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 362 static void     bwn_led_blink_next(void *);
 363 static void     bwn_led_blink_end(void *);
 364 static void     bwn_rfswitch(void *);
 365 static void     bwn_rf_turnon(struct bwn_mac *);
 366 static void     bwn_rf_turnoff(struct bwn_mac *);
 367 static void     bwn_sysctl_node(struct bwn_softc *);
 368
 369 static const struct bwn_channelinfo bwn_chantable_bg = {
 370         .channels = {
 371                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 372                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 373                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 374                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 375                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 376         .nchannels = 14
 377 };
 378
 379 static const struct bwn_channelinfo bwn_chantable_a = {
 380         .channels = {
 381                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 382                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 383                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 384                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 385                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 386                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 387                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 388                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 389                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 390                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 391                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 392                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 393                 { 6080, 216, 30 } },
 394         .nchannels = 37
 395 };
 396
 397 #if 0
 398 static const struct bwn_channelinfo bwn_chantable_n = {
 399         .channels = {
 400                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 401                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 402                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 403                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 404                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 405                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 406                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 407                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 408                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 409                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 410                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 411                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 412                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 413                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 414                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 415                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 416                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 417                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 418                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 419                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 420                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 421                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 422                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 423                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 424                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 425                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 426                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 427                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 428                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 429                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 430                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 431                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 432                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 433                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 434                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 435                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 436                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 437         .nchannels = 110
 438 };
 439 #endif
 440
 441 #define VENDOR_LED_ACT(vendor)                          \
 442 {                                                       \
 443         .vid = PCI_VENDOR_##vendor,                     \
 444         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 445 }
 446
 447 static const struct {
 448         uint16_t        vid;
 449         uint8_t         led_act[BWN_LED_MAX];
 450 } bwn_vendor_led_act[] = {
 451         VENDOR_LED_ACT(HP_COMPAQ),
 452         VENDOR_LED_ACT(ASUSTEK)
 453 };
 454
 455 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 456         { BWN_VENDOR_LED_ACT_DEFAULT };
 457
 458 #undef VENDOR_LED_ACT
 459
 460 static const char *bwn_led_vars[] = {
 461         BHND_NVAR_LEDBH0,
 462         BHND_NVAR_LEDBH1,
 463         BHND_NVAR_LEDBH2,
 464         BHND_NVAR_LEDBH3
 465 };
 466
 467 static const struct {
 468         int             on_dur;
 469         int             off_dur;
 470 } bwn_led_duration[109] = {
 471         [0]     = { 400, 100 },
 472         [2]     = { 150, 75 },
 473         [4]     = { 90, 45 },
 474         [11]    = { 66, 34 },
 475         [12]    = { 53, 26 },
 476         [18]    = { 42, 21 },
 477         [22]    = { 35, 17 },
 478         [24]    = { 32, 16 },
 479         [36]    = { 21, 10 },
 480         [48]    = { 16, 8 },
 481         [72]    = { 11, 5 },
 482         [96]    = { 9, 4 },
 483         [108]   = { 7, 3 }
 484 };
 485
 486 static const uint16_t bwn_wme_shm_offsets[] = {
 487         [0] = BWN_WME_BESTEFFORT,
 488         [1] = BWN_WME_BACKGROUND,
 489         [2] = BWN_WME_VOICE,
 490         [3] = BWN_WME_VIDEO,
 491 };
 492
 493 /* Supported D11 core revisions */
 494 #define BWN_DEV(_hwrev) {{                                      \
 495         BHND_MATCH_CORE(BHND_MFGID_BCM, BHND_COREID_D11),       \
 496         BHND_MATCH_CORE_REV(_hwrev),                            \
 497 }}
 498 static const struct bhnd_device bwn_devices[] = {
 499         BWN_DEV(HWREV_RANGE(5, 16)),
 500         BWN_DEV(HWREV_EQ(23)),
 501         BHND_DEVICE_END
 502 };
 503
 504 /* D11 quirks when bridged via a PCI host bridge core */
 505 static const struct bhnd_device_quirk pci_bridge_quirks[] = {
 506         BHND_CORE_QUIRK (HWREV_LTE(10), BWN_QUIRK_UCODE_SLOWCLOCK_WAR),
 507         BHND_DEVICE_QUIRK_END
 508 };
 509
 510 /* D11 quirks when bridged via a PCMCIA host bridge core */
 511 static const struct bhnd_device_quirk pcmcia_bridge_quirks[] = {
 512         BHND_CORE_QUIRK (HWREV_ANY,     BWN_QUIRK_NODMA),
 513         BHND_DEVICE_QUIRK_END
 514 };
 515
 516 /* Host bridge cores for which D11 quirk flags should be applied */
 517 static const struct bhnd_device bridge_devices[] = {
 518         BHND_DEVICE(BCM, PCI,           NULL, pci_bridge_quirks),
 519         BHND_DEVICE(BCM, PCMCIA,        NULL, pcmcia_bridge_quirks),
 520         BHND_DEVICE_END
 521 };
 522
 523 static int
 524 bwn_probe(device_t dev)
 525 {
 526         const struct bhnd_device *id;
 527
 528         id = bhnd_device_lookup(dev, bwn_devices, sizeof(bwn_devices[0]));
 529         if (id == NULL)
 530                 return (ENXIO);
 531
 532         bhnd_set_default_core_desc(dev);
 533         return (BUS_PROBE_DEFAULT);
 534 }
 535
 536 static int
 537 bwn_attach(device_t dev)
 538 {
 539         struct bwn_mac          *mac;
 540         struct bwn_softc        *sc;
 541         device_t                 parent, hostb;
 542         char                     chip_name[BHND_CHIPID_MAX_NAMELEN];
 543         int                      error;
 544
 545         sc = device_get_softc(dev);
 546         sc->sc_dev = dev;
 547 #ifdef BWN_DEBUG
 548         sc->sc_debug = bwn_debug;
 549 #endif
 550
 551         mac = NULL;
 552
 553         /* Determine the driver quirks applicable to this device, including any
 554          * quirks specific to the bus host bridge core (if any) */
 555         sc->sc_quirks = bhnd_device_quirks(dev, bwn_devices,
 556             sizeof(bwn_devices[0]));
 557
 558         parent = device_get_parent(dev);
 559         if ((hostb = bhnd_bus_find_hostb_device(parent)) != NULL) {
 560                 sc->sc_quirks |= bhnd_device_quirks(hostb, bridge_devices,
 561                     sizeof(bridge_devices[0]));
 562         }
 563
 564         /* DMA explicitly disabled? */
 565         if (!bwn_usedma)
 566                 sc->sc_quirks |= BWN_QUIRK_NODMA;
 567
 568         /* Fetch our chip identification and board info */
 569         sc->sc_cid = *bhnd_get_chipid(dev);
 570         if ((error = bhnd_read_board_info(dev, &sc->sc_board_info))) {
 571                 device_printf(sc->sc_dev, "couldn't read board info\n");
 572                 return (error);
 573         }
 574
 575         /* Allocate our D11 register block and PMU state */
 576         sc->sc_mem_rid = 0;
 577         sc->sc_mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 578             &sc->sc_mem_rid, RF_ACTIVE);
 579         if (sc->sc_mem_res == NULL) {
 580                 device_printf(sc->sc_dev, "couldn't allocate registers\n");
 581                 return (error);
 582         }
 583
 584         if ((error = bhnd_alloc_pmu(sc->sc_dev))) {
 585                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
 586                     sc->sc_mem_rid, sc->sc_mem_res);
 587                 return (error);
 588         }
 589
 590         /* Retain references to all required bus service providers */
 591         if ((error = bwn_retain_bus_providers(sc)))
 592                 goto fail;
 593
 594         /* Fetch mask of available antennas */
 595         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA2G,
 596             &sc->sc_ant2g);
 597         if (error) {
 598                 device_printf(sc->sc_dev, "error determining 2GHz antenna "
 599                     "availability from NVRAM: %d\n", error);
 600                 goto fail;
 601         }
 602
 603         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA5G,
 604             &sc->sc_ant5g);
 605         if (error) {
 606                 device_printf(sc->sc_dev, "error determining 5GHz antenna "
 607                     "availability from NVRAM: %d\n", error);
 608                 goto fail;
 609         }
 610
 611         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 612                 bwn_attach_pre(sc);
 613                 bwn_sprom_bugfixes(dev);
 614                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 615         }
 616
 617         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 618         mac->mac_sc = sc;
 619         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 620         if (bwn_bfp != 0)
 621                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 622
 623         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 624         TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 625         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 626
 627         error = bwn_attach_core(mac);
 628         if (error)
 629                 goto fail;
 630         error = bwn_led_attach(mac);
 631         if (error)
 632                 goto fail;
 633
 634         bhnd_format_chip_id(chip_name, sizeof(chip_name), sc->sc_cid.chip_id);
 635         device_printf(sc->sc_dev, "WLAN (%s rev %u) "
 636             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 637             chip_name, bhnd_get_hwrev(sc->sc_dev), mac->mac_phy.analog,
 638             mac->mac_phy.type, mac->mac_phy.rev, mac->mac_phy.rf_manuf,
 639             mac->mac_phy.rf_ver, mac->mac_phy.rf_rev);
 640         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 641                 device_printf(sc->sc_dev, "DMA (%d bits)\n", mac->mac_dmatype);
 642         else
 643                 device_printf(sc->sc_dev, "PIO\n");
 644
 645 #ifdef  BWN_GPL_PHY
 646         device_printf(sc->sc_dev,
 647             "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
 648 #endif
 649
 650         mac->mac_rid_irq = 0;
 651         mac->mac_res_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 652             &mac->mac_rid_irq, RF_ACTIVE | RF_SHAREABLE);
 653
 654         if (mac->mac_res_irq == NULL) {
 655                 device_printf(sc->sc_dev, "couldn't allocate IRQ resource\n");
 656                 error = ENXIO;
 657                 goto fail;
 658         }
 659
 660         error = bus_setup_intr(dev, mac->mac_res_irq,
 661             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 662             &mac->mac_intrhand);
 663         if (error != 0) {
 664                 device_printf(sc->sc_dev, "couldn't setup interrupt (%d)\n",
 665                     error);
 666                 goto fail;
 667         }
 668
 669         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 670
 671         /*
 672          * calls attach-post routine
 673          */
 674         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 675                 bwn_attach_post(sc);
 676
 677         return (0);
 678 fail:
 679         if (mac != NULL && mac->mac_res_irq != NULL) {
 680                 bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
 681                     mac->mac_res_irq);
 682         }
 683
 684         free(mac, M_DEVBUF);
 685         bhnd_release_pmu(dev);
 686         bwn_release_bus_providers(sc);
 687
 688         if (sc->sc_mem_res != NULL) {
 689                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
 690                     sc->sc_mem_rid, sc->sc_mem_res);
 691         }
 692
 693         return (error);
 694 }
 695
 696 static int
 697 bwn_retain_bus_providers(struct bwn_softc *sc)
 698 {
 699         struct chipc_caps *ccaps;
 700
 701         sc->sc_chipc = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_CHIPC);
 702         if (sc->sc_chipc == NULL) {
 703                 device_printf(sc->sc_dev, "ChipCommon device not found\n");
 704                 goto failed;
 705         }
 706
 707         ccaps = BHND_CHIPC_GET_CAPS(sc->sc_chipc);
 708
 709         sc->sc_gpio = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_GPIO);
 710         if (sc->sc_gpio == NULL) {
 711                 device_printf(sc->sc_dev, "GPIO device not found\n");
 712                 goto failed;
 713         }
 714
 715         if (ccaps->pmu) {
 716                 sc->sc_pmu = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_PMU);
 717                 if (sc->sc_pmu == NULL) {
 718                         device_printf(sc->sc_dev, "PMU device not found\n");
 719                         goto failed;
 720                 }
 721         }
 722
 723         return (0);
 724
 725 failed:
 726         bwn_release_bus_providers(sc);
 727         return (ENXIO);
 728 }
 729
 730 static void
 731 bwn_release_bus_providers(struct bwn_softc *sc)
 732 {
 733 #define BWN_RELEASE_PROV(_sc, _prov, _service)  do {                    \
 734         if ((_sc)-> _prov != NULL) {                                    \
 735                 bhnd_release_provider((_sc)->sc_dev, (_sc)-> _prov,     \
 736                     (_service));                                        \
 737                 (_sc)-> _prov = NULL;                                   \
 738         }                                                               \
 739 } while (0)
 740
 741         BWN_RELEASE_PROV(sc, sc_chipc, BHND_SERVICE_CHIPC);
 742         BWN_RELEASE_PROV(sc, sc_gpio, BHND_SERVICE_GPIO);
 743         BWN_RELEASE_PROV(sc, sc_pmu, BHND_SERVICE_PMU);
 744
 745 #undef  BWN_RELEASE_PROV
 746 }
 747
 748 static int
 749 bwn_attach_post(struct bwn_softc *sc)
 750 {
 751         struct ieee80211com     *ic;
 752         const char              *mac_varname;
 753         u_int                    core_unit;
 754         int                      error;
 755
 756         ic = &sc->sc_ic;
 757
 758         ic->ic_softc = sc;
 759         ic->ic_name = device_get_nameunit(sc->sc_dev);
 760         /* XXX not right but it's not used anywhere important */
 761         ic->ic_phytype = IEEE80211_T_OFDM;
 762         ic->ic_opmode = IEEE80211_M_STA;
 763         ic->ic_caps =
 764                   IEEE80211_C_STA               /* station mode supported */
 765                 | IEEE80211_C_MONITOR           /* monitor mode */
 766                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 767                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 768                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 769                 | IEEE80211_C_WME               /* WME/WMM supported */
 770                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 771 #if 0
 772                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 773 #endif
 774                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 775                 ;
 776
 777         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 778
 779         /* Determine the NVRAM variable containing our MAC address */
 780         core_unit = bhnd_get_core_unit(sc->sc_dev);
 781         mac_varname = NULL;
 782         if (sc->sc_board_info.board_srom_rev <= 2) {
 783                 if (core_unit == 0) {
 784                         mac_varname = BHND_NVAR_IL0MACADDR;
 785                 } else if (core_unit == 1) {
 786                         mac_varname = BHND_NVAR_ET1MACADDR;
 787                 }
 788         } else {
 789                 if (core_unit == 0) {
 790                         mac_varname = BHND_NVAR_MACADDR;
 791                 }
 792         }
 793
 794         if (mac_varname == NULL) {
 795                 device_printf(sc->sc_dev, "missing MAC address variable for "
 796                     "D11 core %u", core_unit);
 797                 return (ENXIO);
 798         }
 799
 800         /* Read the MAC address from NVRAM */
 801         error = bhnd_nvram_getvar_array(sc->sc_dev, mac_varname, ic->ic_macaddr,
 802             sizeof(ic->ic_macaddr), BHND_NVRAM_TYPE_UINT8_ARRAY);
 803         if (error) {
 804                 device_printf(sc->sc_dev, "error reading %s: %d\n", mac_varname,
 805                     error);
 806                 return (error);
 807         }
 808
 809         /* call MI attach routine. */
 810         ieee80211_ifattach(ic);
 811
 812         ic->ic_headroom = sizeof(struct bwn_txhdr);
 813
 814         /* override default methods */
 815         ic->ic_raw_xmit = bwn_raw_xmit;
 816         ic->ic_updateslot = bwn_updateslot;
 817         ic->ic_update_promisc = bwn_update_promisc;
 818         ic->ic_wme.wme_update = bwn_wme_update;
 819         ic->ic_scan_start = bwn_scan_start;
 820         ic->ic_scan_end = bwn_scan_end;
 821         ic->ic_set_channel = bwn_set_channel;
 822         ic->ic_vap_create = bwn_vap_create;
 823         ic->ic_vap_delete = bwn_vap_delete;
 824         ic->ic_transmit = bwn_transmit;
 825         ic->ic_parent = bwn_parent;
 826
 827         ieee80211_radiotap_attach(ic,
 828             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 829             BWN_TX_RADIOTAP_PRESENT,
 830             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 831             BWN_RX_RADIOTAP_PRESENT);
 832
 833         bwn_sysctl_node(sc);
 834
 835         if (bootverbose)
 836                 ieee80211_announce(ic);
 837         return (0);
 838 }
 839
 840 static void
 841 bwn_phy_detach(struct bwn_mac *mac)
 842 {
 843
 844         if (mac->mac_phy.detach != NULL)
 845                 mac->mac_phy.detach(mac);
 846 }
 847
 848 static int
 849 bwn_detach(device_t dev)
 850 {
 851         struct bwn_softc *sc = device_get_softc(dev);
 852         struct bwn_mac *mac = sc->sc_curmac;
 853         struct ieee80211com *ic = &sc->sc_ic;
 854
 855         sc->sc_flags |= BWN_FLAG_INVALID;
 856
 857         if (device_is_attached(sc->sc_dev)) {
 858                 BWN_LOCK(sc);
 859                 bwn_stop(sc);
 860                 BWN_UNLOCK(sc);
 861                 bwn_dma_free(mac);
 862                 callout_drain(&sc->sc_led_blink_ch);
 863                 callout_drain(&sc->sc_rfswitch_ch);
 864                 callout_drain(&sc->sc_task_ch);
 865                 callout_drain(&sc->sc_watchdog_ch);
 866                 bwn_phy_detach(mac);
 867                 ieee80211_draintask(ic, &mac->mac_hwreset);
 868                 ieee80211_draintask(ic, &mac->mac_txpower);
 869                 ieee80211_ifdetach(ic);
 870         }
 871         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 872         taskqueue_free(sc->sc_tq);
 873
 874         if (mac->mac_intrhand != NULL) {
 875                 bus_teardown_intr(dev, mac->mac_res_irq, mac->mac_intrhand);
 876                 mac->mac_intrhand = NULL;
 877         }
 878
 879         bhnd_release_pmu(dev);
 880         bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_mem_rid,
 881             sc->sc_mem_res);
 882         bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
 883             mac->mac_res_irq);
 884         mbufq_drain(&sc->sc_snd);
 885         bwn_release_firmware(mac);
 886         BWN_LOCK_DESTROY(sc);
 887
 888         bwn_release_bus_providers(sc);
 889
 890         return (0);
 891 }
 892
 893 static void
 894 bwn_attach_pre(struct bwn_softc *sc)
 895 {
 896
 897         BWN_LOCK_INIT(sc);
 898         TAILQ_INIT(&sc->sc_maclist);
 899         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 900         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 901         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 902         mbufq_init(&sc->sc_snd, ifqmaxlen);
 903         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 904                 taskqueue_thread_enqueue, &sc->sc_tq);
 905         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 906                 "%s taskq", device_get_nameunit(sc->sc_dev));
 907 }
 908
 909 static void
 910 bwn_sprom_bugfixes(device_t dev)
 911 {
 912         struct bwn_softc *sc = device_get_softc(dev);
 913
 914 #define BWN_ISDEV(_device, _subvendor, _subdevice)              \
 915         ((sc->sc_board_info.board_devid == PCI_DEVID_##_device) &&      \
 916          (sc->sc_board_info.board_vendor == PCI_VENDOR_##_subvendor) && \
 917          (sc->sc_board_info.board_type == _subdevice))
 918
 919          /* A subset of Apple Airport Extreme (BCM4306 rev 2) devices
 920           * were programmed with a missing PACTRL boardflag */
 921          if (sc->sc_board_info.board_vendor == PCI_VENDOR_APPLE &&
 922              sc->sc_board_info.board_type == 0x4e &&
 923              sc->sc_board_info.board_rev > 0x40)
 924                  sc->sc_board_info.board_flags |= BHND_BFL_PACTRL;
 925
 926         if (BWN_ISDEV(BCM4318_D11G, ASUSTEK, 0x100f) ||
 927             BWN_ISDEV(BCM4306_D11G, DELL, 0x0003) ||
 928             BWN_ISDEV(BCM4306_D11G, HP, 0x12f8) ||
 929             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0013) ||
 930             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0014) ||
 931             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0015) ||
 932             BWN_ISDEV(BCM4306_D11G, MOTOROLA, 0x7010))
 933                 sc->sc_board_info.board_flags &= ~BHND_BFL_BTCOEX;
 934 #undef  BWN_ISDEV
 935 }
 936
 937 static void
 938 bwn_parent(struct ieee80211com *ic)
 939 {
 940         struct bwn_softc *sc = ic->ic_softc;
 941         int startall = 0;
 942
 943         BWN_LOCK(sc);
 944         if (ic->ic_nrunning > 0) {
 945                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 946                         bwn_init(sc);
 947                         startall = 1;
 948                 } else
 949                         bwn_update_promisc(ic);
 950         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 951                 bwn_stop(sc);
 952         BWN_UNLOCK(sc);
 953
 954         if (startall)
 955                 ieee80211_start_all(ic);
 956 }
 957
 958 static int
 959 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 960 {
 961         struct bwn_softc *sc = ic->ic_softc;
 962         int error;
 963
 964         BWN_LOCK(sc);
 965         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 966                 BWN_UNLOCK(sc);
 967                 return (ENXIO);
 968         }
 969         error = mbufq_enqueue(&sc->sc_snd, m);
 970         if (error) {
 971                 BWN_UNLOCK(sc);
 972                 return (error);
 973         }
 974         bwn_start(sc);
 975         BWN_UNLOCK(sc);
 976         return (0);
 977 }
 978
 979 static void
 980 bwn_start(struct bwn_softc *sc)
 981 {
 982         struct bwn_mac *mac = sc->sc_curmac;
 983         struct ieee80211_frame *wh;
 984         struct ieee80211_node *ni;
 985         struct ieee80211_key *k;
 986         struct mbuf *m;
 987
 988         BWN_ASSERT_LOCKED(sc);
 989
 990         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 991             mac->mac_status < BWN_MAC_STATUS_STARTED)
 992                 return;
 993
 994         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 995                 if (bwn_tx_isfull(sc, m))
 996                         break;
 997                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 998                 if (ni == NULL) {
 999                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
1000                         m_freem(m);
1001                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1002                         continue;
1003                 }
1004                 wh = mtod(m, struct ieee80211_frame *);
1005                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1006                         k = ieee80211_crypto_encap(ni, m);
1007                         if (k == NULL) {
1008                                 if_inc_counter(ni->ni_vap->iv_ifp,
1009                                     IFCOUNTER_OERRORS, 1);
1010                                 ieee80211_free_node(ni);
1011                                 m_freem(m);
1012                                 continue;
1013                         }
1014                 }
1015                 wh = NULL;      /* Catch any invalid use */
1016                 if (bwn_tx_start(sc, ni, m) != 0) {
1017                         if (ni != NULL) {
1018                                 if_inc_counter(ni->ni_vap->iv_ifp,
1019                                     IFCOUNTER_OERRORS, 1);
1020                                 ieee80211_free_node(ni);
1021                         }
1022                         continue;
1023                 }
1024                 sc->sc_watchdog_timer = 5;
1025         }
1026 }
1027
1028 static int
1029 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
1030 {
1031         struct bwn_dma_ring *dr;
1032         struct bwn_mac *mac = sc->sc_curmac;
1033         struct bwn_pio_txqueue *tq;
1034         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1035
1036         BWN_ASSERT_LOCKED(sc);
1037
1038         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
1039                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
1040                 if (dr->dr_stop == 1 ||
1041                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
1042                         dr->dr_stop = 1;
1043                         goto full;
1044                 }
1045         } else {
1046                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
1047                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
1048                     pktlen > (tq->tq_size - tq->tq_used))
1049                         goto full;
1050         }
1051         return (0);
1052 full:
1053         mbufq_prepend(&sc->sc_snd, m);
1054         return (1);
1055 }
1056
1057 static int
1058 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
1059 {
1060         struct bwn_mac *mac = sc->sc_curmac;
1061         int error;
1062
1063         BWN_ASSERT_LOCKED(sc);
1064
1065         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
1066                 m_freem(m);
1067                 return (ENXIO);
1068         }
1069
1070         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
1071             bwn_dma_tx_start(mac, ni, &m) : bwn_pio_tx_start(mac, ni, &m);
1072         if (error) {
1073                 m_freem(m);
1074                 return (error);
1075         }
1076         return (0);
1077 }
1078
1079 static int
1080 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1081     struct mbuf **mp)
1082 {
1083         struct bwn_pio_txpkt *tp;
1084         struct bwn_pio_txqueue *tq;
1085         struct bwn_softc *sc = mac->mac_sc;
1086         struct bwn_txhdr txhdr;
1087         struct mbuf *m, *m_new;
1088         uint32_t ctl32;
1089         int error;
1090         uint16_t ctl16;
1091
1092         BWN_ASSERT_LOCKED(sc);
1093
1094         /* XXX TODO send packets after DTIM */
1095
1096         m = *mp;
1097         tq = bwn_pio_select(mac, M_WME_GETAC(m));
1098         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
1099         tp = TAILQ_FIRST(&tq->tq_pktlist);
1100         tp->tp_ni = ni;
1101         tp->tp_m = m;
1102
1103         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1104         if (error) {
1105                 device_printf(sc->sc_dev, "tx fail\n");
1106                 return (error);
1107         }
1108
1109         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1110         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1111         tq->tq_free--;
1112
1113         if (bhnd_get_hwrev(sc->sc_dev) >= 8) {
1114                 /*
1115                  * XXX please removes m_defrag(9)
1116                  */
1117                 m_new = m_defrag(*mp, M_NOWAIT);
1118                 if (m_new == NULL) {
1119                         device_printf(sc->sc_dev,
1120                             "%s: can't defrag TX buffer\n",
1121                             __func__);
1122                         return (ENOBUFS);
1123                 }
1124                 *mp = m_new;
1125                 if (m_new->m_next != NULL)
1126                         device_printf(sc->sc_dev,
1127                             "TODO: fragmented packets for PIO\n");
1128                 tp->tp_m = m_new;
1129
1130                 /* send HEADER */
1131                 ctl32 = bwn_pio_write_multi_4(mac, tq,
1132                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1133                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1134                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1135                 /* send BODY */
1136                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1137                     mtod(m_new, const void *), m_new->m_pkthdr.len);
1138                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1139                     ctl32 | BWN_PIO8_TXCTL_EOF);
1140         } else {
1141                 ctl16 = bwn_pio_write_multi_2(mac, tq,
1142                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1143                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1144                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1145                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1146                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1147                     ctl16 | BWN_PIO_TXCTL_EOF);
1148         }
1149
1150         return (0);
1151 }
1152
1153 static struct bwn_pio_txqueue *
1154 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1155 {
1156
1157         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1158                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1159
1160         switch (prio) {
1161         case 0:
1162                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1163         case 1:
1164                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1165         case 2:
1166                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1167         case 3:
1168                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1169         }
1170         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1171         return (NULL);
1172 }
1173
1174 static int
1175 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1176     struct mbuf **mp)
1177 {
1178 #define BWN_GET_TXHDRCACHE(slot)                                        \
1179         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1180         struct bwn_dma *dma = &mac->mac_method.dma;
1181         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(*mp));
1182         struct bwn_dmadesc_generic *desc;
1183         struct bwn_dmadesc_meta *mt;
1184         struct bwn_softc *sc = mac->mac_sc;
1185         struct mbuf *m;
1186         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1187         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1188
1189         BWN_ASSERT_LOCKED(sc);
1190         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1191
1192         /* XXX send after DTIM */
1193
1194         m = *mp;
1195         slot = bwn_dma_getslot(dr);
1196         dr->getdesc(dr, slot, &desc, &mt);
1197         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1198             ("%s:%d: fail", __func__, __LINE__));
1199
1200         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1201             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1202             BWN_DMA_COOKIE(dr, slot));
1203         if (error)
1204                 goto fail;
1205         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1206             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1207             &mt->mt_paddr, BUS_DMA_NOWAIT);
1208         if (error) {
1209                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1210                     __func__, error);
1211                 goto fail;
1212         }
1213         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1214             BUS_DMASYNC_PREWRITE);
1215         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1216         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1217             BUS_DMASYNC_PREWRITE);
1218
1219         slot = bwn_dma_getslot(dr);
1220         dr->getdesc(dr, slot, &desc, &mt);
1221         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1222             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1223         mt->mt_m = m;
1224         mt->mt_ni = ni;
1225
1226         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1227             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1228         if (error && error != EFBIG) {
1229                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1230                     __func__, error);
1231                 goto fail;
1232         }
1233         if (error) {    /* error == EFBIG */
1234                 struct mbuf *m_new;
1235
1236                 m_new = m_defrag(m, M_NOWAIT);
1237                 if (m_new == NULL) {
1238                         device_printf(sc->sc_dev,
1239                             "%s: can't defrag TX buffer\n",
1240                             __func__);
1241                         error = ENOBUFS;
1242                         goto fail;
1243                 }
1244                 *mp = m = m_new;
1245
1246                 mt->mt_m = m;
1247                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1248                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1249                 if (error) {
1250                         device_printf(sc->sc_dev,
1251                             "%s: can't load TX buffer (2) %d\n",
1252                             __func__, error);
1253                         goto fail;
1254                 }
1255         }
1256         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1257         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1258         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1259             BUS_DMASYNC_PREWRITE);
1260
1261         /* XXX send after DTIM */
1262
1263         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1264         return (0);
1265 fail:
1266         dr->dr_curslot = backup[0];
1267         dr->dr_usedslot = backup[1];
1268         return (error);
1269 #undef BWN_GET_TXHDRCACHE
1270 }
1271
1272 static void
1273 bwn_watchdog(void *arg)
1274 {
1275         struct bwn_softc *sc = arg;
1276
1277         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1278                 device_printf(sc->sc_dev, "device timeout\n");
1279                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1280         }
1281         callout_schedule(&sc->sc_watchdog_ch, hz);
1282 }
1283
1284 static int
1285 bwn_attach_core(struct bwn_mac *mac)
1286 {
1287         struct bwn_softc *sc = mac->mac_sc;
1288         int error, have_bg = 0, have_a = 0;
1289         uint16_t iost;
1290
1291         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5,
1292             ("unsupported revision %d", bhnd_get_hwrev(sc->sc_dev)));
1293
1294         if ((error = bwn_core_forceclk(mac, true)))
1295                 return (error);
1296
1297         if ((error = bhnd_read_iost(sc->sc_dev, &iost))) {
1298                 device_printf(sc->sc_dev, "error reading I/O status flags: "
1299                     "%d\n", error);
1300                 return (error);
1301         }
1302
1303         have_a = (iost & BWN_IOST_HAVE_5GHZ) ? 1 : 0;
1304         have_bg = (iost & BWN_IOST_HAVE_2GHZ) ? 1 : 0;
1305         if (iost & BWN_IOST_DUALPHY) {
1306                 have_bg = 1;
1307                 have_a = 1;
1308         }
1309
1310
1311 #if 0
1312         device_printf(sc->sc_dev, "%s: iost=0x%04hx, have_a=%d, have_bg=%d,"
1313             " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1314             __func__,
1315             iost,
1316             have_a,
1317             have_bg,
1318             sc->sc_board_info.board_devid,
1319             sc->sc_cid.chip_id);
1320 #endif
1321
1322         /*
1323          * Guess at whether it has A-PHY or G-PHY.
1324          * This is just used for resetting the core to probe things;
1325          * we will re-guess once it's all up and working.
1326          */
1327         error = bwn_reset_core(mac, have_bg);
1328         if (error)
1329                 goto fail;
1330
1331         /*
1332          * Determine the DMA engine type
1333          */
1334         if (iost & BHND_IOST_DMA64) {
1335                 mac->mac_dmatype = BHND_DMA_ADDR_64BIT;
1336         } else {
1337                 uint32_t tmp;
1338                 uint16_t base;
1339
1340                 base = bwn_dma_base(0, 0);
1341                 BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL,
1342                     BWN_DMA32_TXADDREXT_MASK);
1343                 tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
1344                 if (tmp & BWN_DMA32_TXADDREXT_MASK) {
1345                         mac->mac_dmatype = BHND_DMA_ADDR_32BIT;
1346                 } else {
1347                         mac->mac_dmatype = BHND_DMA_ADDR_30BIT;
1348                 }
1349         }
1350
1351         /*
1352          * Get the PHY version.
1353          */
1354         error = bwn_phy_getinfo(mac, have_bg);
1355         if (error)
1356                 goto fail;
1357
1358         /*
1359          * This is the whitelist of devices which we "believe"
1360          * the SPROM PHY config from.  The rest are "guessed".
1361          */
1362         if (sc->sc_board_info.board_devid != PCI_DEVID_BCM4311_D11DUAL &&
1363             sc->sc_board_info.board_devid != PCI_DEVID_BCM4328_D11G &&
1364             sc->sc_board_info.board_devid != PCI_DEVID_BCM4318_D11DUAL &&
1365             sc->sc_board_info.board_devid != PCI_DEVID_BCM4306_D11DUAL &&
1366             sc->sc_board_info.board_devid != PCI_DEVID_BCM4321_D11N &&
1367             sc->sc_board_info.board_devid != PCI_DEVID_BCM4322_D11N) {
1368                 have_a = have_bg = 0;
1369                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1370                         have_a = 1;
1371                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1372                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1373                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1374                         have_bg = 1;
1375                 else
1376                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1377                             mac->mac_phy.type));
1378         }
1379
1380         /*
1381          * XXX The PHY-G support doesn't do 5GHz operation.
1382          */
1383         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1384             mac->mac_phy.type != BWN_PHYTYPE_N) {
1385                 device_printf(sc->sc_dev,
1386                     "%s: forcing 2GHz only; no dual-band support for PHY\n",
1387                     __func__);
1388                 have_a = 0;
1389                 have_bg = 1;
1390         }
1391
1392         mac->mac_phy.phy_n = NULL;
1393
1394         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1395                 mac->mac_phy.attach = bwn_phy_g_attach;
1396                 mac->mac_phy.detach = bwn_phy_g_detach;
1397                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1398                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1399                 mac->mac_phy.init = bwn_phy_g_init;
1400                 mac->mac_phy.exit = bwn_phy_g_exit;
1401                 mac->mac_phy.phy_read = bwn_phy_g_read;
1402                 mac->mac_phy.phy_write = bwn_phy_g_write;
1403                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1404                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1405                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1406                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1407                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1408                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1409                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1410                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1411                 mac->mac_phy.set_im = bwn_phy_g_im;
1412                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1413                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1414                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1415                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1416         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1417                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1418                 mac->mac_phy.init = bwn_phy_lp_init;
1419                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1420                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1421                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1422                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1423                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1424                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1425                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1426                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1427                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1428                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1429                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1430         } else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1431                 mac->mac_phy.attach = bwn_phy_n_attach;
1432                 mac->mac_phy.detach = bwn_phy_n_detach;
1433                 mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1434                 mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1435                 mac->mac_phy.init = bwn_phy_n_init;
1436                 mac->mac_phy.exit = bwn_phy_n_exit;
1437                 mac->mac_phy.phy_read = bwn_phy_n_read;
1438                 mac->mac_phy.phy_write = bwn_phy_n_write;
1439                 mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1440                 mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1441                 mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1442                 mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1443                 mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1444                 mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1445                 mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1446                 mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1447                 mac->mac_phy.set_im = bwn_phy_n_im;
1448                 mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1449                 mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1450                 mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1451                 mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1452         } else {
1453                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1454                     mac->mac_phy.type);
1455                 error = ENXIO;
1456                 goto fail;
1457         }
1458
1459         mac->mac_phy.gmode = have_bg;
1460         if (mac->mac_phy.attach != NULL) {
1461                 error = mac->mac_phy.attach(mac);
1462                 if (error) {
1463                         device_printf(sc->sc_dev, "failed\n");
1464                         goto fail;
1465                 }
1466         }
1467
1468         error = bwn_reset_core(mac, have_bg);
1469         if (error)
1470                 goto fail;
1471
1472         error = bwn_chiptest(mac);
1473         if (error)
1474                 goto fail;
1475         error = bwn_setup_channels(mac, have_bg, have_a);
1476         if (error) {
1477                 device_printf(sc->sc_dev, "failed to setup channels\n");
1478                 goto fail;
1479         }
1480
1481         if (sc->sc_curmac == NULL)
1482                 sc->sc_curmac = mac;
1483
1484         error = bwn_dma_attach(mac);
1485         if (error != 0) {
1486                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1487                 goto fail;
1488         }
1489
1490         mac->mac_phy.switch_analog(mac, 0);
1491
1492 fail:
1493         bhnd_suspend_hw(sc->sc_dev, 0);
1494         bwn_release_firmware(mac);
1495         return (error);
1496 }
1497
1498 /*
1499  * Reset
1500  */
1501 int
1502 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1503 {
1504         struct bwn_softc        *sc;
1505         uint32_t                 ctl;
1506         uint16_t                 ioctl, ioctl_mask;
1507         int                      error;
1508
1509         sc = mac->mac_sc;
1510
1511         DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1512
1513         /* Reset core */
1514         ioctl = (BWN_IOCTL_PHYCLOCK_ENABLE | BWN_IOCTL_PHYRESET);
1515         if (g_mode)
1516                 ioctl |= BWN_IOCTL_SUPPORT_G;
1517
1518         /* XXX N-PHY only; and hard-code to 20MHz for now */
1519         if (mac->mac_phy.type == BWN_PHYTYPE_N)
1520                 ioctl |= BWN_IOCTL_PHY_BANDWIDTH_20MHZ;
1521
1522         if ((error = bhnd_reset_hw(sc->sc_dev, ioctl, ioctl))) {
1523                 device_printf(sc->sc_dev, "core reset failed: %d", error);
1524                 return (error);
1525         }
1526
1527         DELAY(2000);
1528
1529         /* Take PHY out of reset */
1530         ioctl = BHND_IOCTL_CLK_FORCE;
1531         ioctl_mask = BHND_IOCTL_CLK_FORCE |
1532                      BWN_IOCTL_PHYRESET |
1533                      BWN_IOCTL_PHYCLOCK_ENABLE;
1534
1535         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1536                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1537                     "%d\n", error);
1538                 return (error);
1539         }
1540
1541         DELAY(2000);
1542
1543         ioctl = BWN_IOCTL_PHYCLOCK_ENABLE;
1544         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1545                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1546                     "%d\n", error);
1547                 return (error);
1548         }
1549
1550         DELAY(2000);
1551
1552         if (mac->mac_phy.switch_analog != NULL)
1553                 mac->mac_phy.switch_analog(mac, 1);
1554
1555         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1556         if (g_mode)
1557                 ctl |= BWN_MACCTL_GMODE;
1558         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1559
1560         return (0);
1561 }
1562
1563 static int
1564 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1565 {
1566         struct bwn_phy *phy = &mac->mac_phy;
1567         struct bwn_softc *sc = mac->mac_sc;
1568         uint32_t tmp;
1569
1570         /* PHY */
1571         tmp = BWN_READ_2(mac, BWN_PHYVER);
1572         phy->gmode = gmode;
1573         phy->rf_on = 1;
1574         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1575         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1576         phy->rev = (tmp & BWN_PHYVER_VERSION);
1577         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1578             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1579                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1580             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1581             (phy->type == BWN_PHYTYPE_N && phy->rev > 6) ||
1582             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1583                 goto unsupphy;
1584
1585         /* RADIO */
1586         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1587         tmp = BWN_READ_2(mac, BWN_RFDATALO);
1588         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1589         tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1590
1591         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1592         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1593         phy->rf_manuf = (tmp & 0x00000fff);
1594
1595         /*
1596          * For now, just always do full init (ie, what bwn has traditionally
1597          * done)
1598          */
1599         phy->phy_do_full_init = 1;
1600
1601         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1602                 goto unsupradio;
1603         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1604              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1605             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1606             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1607             (phy->type == BWN_PHYTYPE_N &&
1608              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1609             (phy->type == BWN_PHYTYPE_LP &&
1610              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1611                 goto unsupradio;
1612
1613         return (0);
1614 unsupphy:
1615         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1616             "analog %#x)\n",
1617             phy->type, phy->rev, phy->analog);
1618         return (ENXIO);
1619 unsupradio:
1620         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1621             "rev %#x)\n",
1622             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1623         return (ENXIO);
1624 }
1625
1626 static int
1627 bwn_chiptest(struct bwn_mac *mac)
1628 {
1629 #define TESTVAL0        0x55aaaa55
1630 #define TESTVAL1        0xaa5555aa
1631         struct bwn_softc *sc = mac->mac_sc;
1632         uint32_t v, backup;
1633
1634         BWN_LOCK(sc);
1635
1636         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1637
1638         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1639         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1640                 goto error;
1641         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1642         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1643                 goto error;
1644
1645         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1646
1647         if ((bhnd_get_hwrev(sc->sc_dev) >= 3) &&
1648             (bhnd_get_hwrev(sc->sc_dev) <= 10)) {
1649                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1650                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1651                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1652                         goto error;
1653                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1654                         goto error;
1655         }
1656         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1657
1658         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1659         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1660                 goto error;
1661
1662         BWN_UNLOCK(sc);
1663         return (0);
1664 error:
1665         BWN_UNLOCK(sc);
1666         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1667         return (ENODEV);
1668 }
1669
1670 static int
1671 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1672 {
1673         struct bwn_softc *sc = mac->mac_sc;
1674         struct ieee80211com *ic = &sc->sc_ic;
1675         uint8_t bands[IEEE80211_MODE_BYTES];
1676
1677         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1678         ic->ic_nchans = 0;
1679
1680         DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1681             __func__,
1682             have_bg,
1683             have_a);
1684
1685         if (have_bg) {
1686                 memset(bands, 0, sizeof(bands));
1687                 setbit(bands, IEEE80211_MODE_11B);
1688                 setbit(bands, IEEE80211_MODE_11G);
1689                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1690                     &ic->ic_nchans, &bwn_chantable_bg, bands);
1691         }
1692
1693         if (have_a) {
1694                 memset(bands, 0, sizeof(bands));
1695                 setbit(bands, IEEE80211_MODE_11A);
1696                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1697                     &ic->ic_nchans, &bwn_chantable_a, bands);
1698         }
1699
1700         mac->mac_phy.supports_2ghz = have_bg;
1701         mac->mac_phy.supports_5ghz = have_a;
1702
1703         return (ic->ic_nchans == 0 ? ENXIO : 0);
1704 }
1705
1706 uint32_t
1707 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1708 {
1709         uint32_t ret;
1710
1711         BWN_ASSERT_LOCKED(mac->mac_sc);
1712
1713         if (way == BWN_SHARED) {
1714                 KASSERT((offset & 0x0001) == 0,
1715                     ("%s:%d warn", __func__, __LINE__));
1716                 if (offset & 0x0003) {
1717                         bwn_shm_ctlword(mac, way, offset >> 2);
1718                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1719                         ret <<= 16;
1720                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1721                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1722                         goto out;
1723                 }
1724                 offset >>= 2;
1725         }
1726         bwn_shm_ctlword(mac, way, offset);
1727         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1728 out:
1729         return (ret);
1730 }
1731
1732 uint16_t
1733 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1734 {
1735         uint16_t ret;
1736
1737         BWN_ASSERT_LOCKED(mac->mac_sc);
1738
1739         if (way == BWN_SHARED) {
1740                 KASSERT((offset & 0x0001) == 0,
1741                     ("%s:%d warn", __func__, __LINE__));
1742                 if (offset & 0x0003) {
1743                         bwn_shm_ctlword(mac, way, offset >> 2);
1744                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1745                         goto out;
1746                 }
1747                 offset >>= 2;
1748         }
1749         bwn_shm_ctlword(mac, way, offset);
1750         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1751 out:
1752
1753         return (ret);
1754 }
1755
1756 static void
1757 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1758     uint16_t offset)
1759 {
1760         uint32_t control;
1761
1762         control = way;
1763         control <<= 16;
1764         control |= offset;
1765         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1766 }
1767
1768 void
1769 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1770     uint32_t value)
1771 {
1772         BWN_ASSERT_LOCKED(mac->mac_sc);
1773
1774         if (way == BWN_SHARED) {
1775                 KASSERT((offset & 0x0001) == 0,
1776                     ("%s:%d warn", __func__, __LINE__));
1777                 if (offset & 0x0003) {
1778                         bwn_shm_ctlword(mac, way, offset >> 2);
1779                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1780                                     (value >> 16) & 0xffff);
1781                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1782                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1783                         return;
1784                 }
1785                 offset >>= 2;
1786         }
1787         bwn_shm_ctlword(mac, way, offset);
1788         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1789 }
1790
1791 void
1792 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1793     uint16_t value)
1794 {
1795         BWN_ASSERT_LOCKED(mac->mac_sc);
1796
1797         if (way == BWN_SHARED) {
1798                 KASSERT((offset & 0x0001) == 0,
1799                     ("%s:%d warn", __func__, __LINE__));
1800                 if (offset & 0x0003) {
1801                         bwn_shm_ctlword(mac, way, offset >> 2);
1802                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1803                         return;
1804                 }
1805                 offset >>= 2;
1806         }
1807         bwn_shm_ctlword(mac, way, offset);
1808         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1809 }
1810
1811 static void
1812 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1813     const struct bwn_channelinfo *ci, const uint8_t bands[])
1814 {
1815         int i, error;
1816
1817         for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1818                 const struct bwn_channel *hc = &ci->channels[i];
1819
1820                 error = ieee80211_add_channel(chans, maxchans, nchans,
1821                     hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1822         }
1823 }
1824
1825 static int
1826 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1827         const struct ieee80211_bpf_params *params)
1828 {
1829         struct ieee80211com *ic = ni->ni_ic;
1830         struct bwn_softc *sc = ic->ic_softc;
1831         struct bwn_mac *mac = sc->sc_curmac;
1832         int error;
1833
1834         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1835             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1836                 m_freem(m);
1837                 return (ENETDOWN);
1838         }
1839
1840         BWN_LOCK(sc);
1841         if (bwn_tx_isfull(sc, m)) {
1842                 m_freem(m);
1843                 BWN_UNLOCK(sc);
1844                 return (ENOBUFS);
1845         }
1846
1847         error = bwn_tx_start(sc, ni, m);
1848         if (error == 0)
1849                 sc->sc_watchdog_timer = 5;
1850         BWN_UNLOCK(sc);
1851         return (error);
1852 }
1853
1854 /*
1855  * Callback from the 802.11 layer to update the slot time
1856  * based on the current setting.  We use it to notify the
1857  * firmware of ERP changes and the f/w takes care of things
1858  * like slot time and preamble.
1859  */
1860 static void
1861 bwn_updateslot(struct ieee80211com *ic)
1862 {
1863         struct bwn_softc *sc = ic->ic_softc;
1864         struct bwn_mac *mac;
1865
1866         BWN_LOCK(sc);
1867         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1868                 mac = (struct bwn_mac *)sc->sc_curmac;
1869                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1870         }
1871         BWN_UNLOCK(sc);
1872 }
1873
1874 /*
1875  * Callback from the 802.11 layer after a promiscuous mode change.
1876  * Note this interface does not check the operating mode as this
1877  * is an internal callback and we are expected to honor the current
1878  * state (e.g. this is used for setting the interface in promiscuous
1879  * mode when operating in hostap mode to do ACS).
1880  */
1881 static void
1882 bwn_update_promisc(struct ieee80211com *ic)
1883 {
1884         struct bwn_softc *sc = ic->ic_softc;
1885         struct bwn_mac *mac = sc->sc_curmac;
1886
1887         BWN_LOCK(sc);
1888         mac = sc->sc_curmac;
1889         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1890                 if (ic->ic_promisc > 0)
1891                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1892                 else
1893                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1894                 bwn_set_opmode(mac);
1895         }
1896         BWN_UNLOCK(sc);
1897 }
1898
1899 /*
1900  * Callback from the 802.11 layer to update WME parameters.
1901  */
1902 static int
1903 bwn_wme_update(struct ieee80211com *ic)
1904 {
1905         struct bwn_softc *sc = ic->ic_softc;
1906         struct bwn_mac *mac = sc->sc_curmac;
1907         struct chanAccParams chp;
1908         struct wmeParams *wmep;
1909         int i;
1910
1911         ieee80211_wme_ic_getparams(ic, &chp);
1912
1913         BWN_LOCK(sc);
1914         mac = sc->sc_curmac;
1915         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1916                 bwn_mac_suspend(mac);
1917                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1918                         wmep = &chp.cap_wmeParams[i];
1919                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1920                 }
1921                 bwn_mac_enable(mac);
1922         }
1923         BWN_UNLOCK(sc);
1924         return (0);
1925 }
1926
1927 static void
1928 bwn_scan_start(struct ieee80211com *ic)
1929 {
1930         struct bwn_softc *sc = ic->ic_softc;
1931         struct bwn_mac *mac;
1932
1933         BWN_LOCK(sc);
1934         mac = sc->sc_curmac;
1935         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1936                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1937                 bwn_set_opmode(mac);
1938                 /* disable CFP update during scan */
1939                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1940         }
1941         BWN_UNLOCK(sc);
1942 }
1943
1944 static void
1945 bwn_scan_end(struct ieee80211com *ic)
1946 {
1947         struct bwn_softc *sc = ic->ic_softc;
1948         struct bwn_mac *mac;
1949
1950         BWN_LOCK(sc);
1951         mac = sc->sc_curmac;
1952         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1953                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1954                 bwn_set_opmode(mac);
1955                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1956         }
1957         BWN_UNLOCK(sc);
1958 }
1959
1960 static void
1961 bwn_set_channel(struct ieee80211com *ic)
1962 {
1963         struct bwn_softc *sc = ic->ic_softc;
1964         struct bwn_mac *mac = sc->sc_curmac;
1965         struct bwn_phy *phy = &mac->mac_phy;
1966         int chan, error;
1967
1968         BWN_LOCK(sc);
1969
1970         error = bwn_switch_band(sc, ic->ic_curchan);
1971         if (error)
1972                 goto fail;
1973         bwn_mac_suspend(mac);
1974         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1975         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1976         if (chan != phy->chan)
1977                 bwn_switch_channel(mac, chan);
1978
1979         /* TX power level */
1980         if (ic->ic_curchan->ic_maxpower != 0 &&
1981             ic->ic_curchan->ic_maxpower != phy->txpower) {
1982                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1983                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1984                     BWN_TXPWR_IGNORE_TSSI);
1985         }
1986
1987         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1988         if (phy->set_antenna)
1989                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1990
1991         if (sc->sc_rf_enabled != phy->rf_on) {
1992                 if (sc->sc_rf_enabled) {
1993                         bwn_rf_turnon(mac);
1994                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1995                                 device_printf(sc->sc_dev,
1996                                     "please turn on the RF switch\n");
1997                 } else
1998                         bwn_rf_turnoff(mac);
1999         }
2000
2001         bwn_mac_enable(mac);
2002
2003 fail:
2004         /*
2005          * Setup radio tap channel freq and flags
2006          */
2007         sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
2008                 htole16(ic->ic_curchan->ic_freq);
2009         sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
2010                 htole16(ic->ic_curchan->ic_flags & 0xffff);
2011
2012         BWN_UNLOCK(sc);
2013 }
2014
2015 static struct ieee80211vap *
2016 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2017     enum ieee80211_opmode opmode, int flags,
2018     const uint8_t bssid[IEEE80211_ADDR_LEN],
2019     const uint8_t mac[IEEE80211_ADDR_LEN])
2020 {
2021         struct ieee80211vap *vap;
2022         struct bwn_vap *bvp;
2023
2024         switch (opmode) {
2025         case IEEE80211_M_HOSTAP:
2026         case IEEE80211_M_MBSS:
2027         case IEEE80211_M_STA:
2028         case IEEE80211_M_WDS:
2029         case IEEE80211_M_MONITOR:
2030         case IEEE80211_M_IBSS:
2031         case IEEE80211_M_AHDEMO:
2032                 break;
2033         default:
2034                 return (NULL);
2035         }
2036
2037         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
2038         vap = &bvp->bv_vap;
2039         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
2040         /* override with driver methods */
2041         bvp->bv_newstate = vap->iv_newstate;
2042         vap->iv_newstate = bwn_newstate;
2043
2044         /* override max aid so sta's cannot assoc when we're out of sta id's */
2045         vap->iv_max_aid = BWN_STAID_MAX;
2046
2047         ieee80211_ratectl_init(vap);
2048
2049         /* complete setup */
2050         ieee80211_vap_attach(vap, ieee80211_media_change,
2051             ieee80211_media_status, mac);
2052         return (vap);
2053 }
2054
2055 static void
2056 bwn_vap_delete(struct ieee80211vap *vap)
2057 {
2058         struct bwn_vap *bvp = BWN_VAP(vap);
2059
2060         ieee80211_ratectl_deinit(vap);
2061         ieee80211_vap_detach(vap);
2062         free(bvp, M_80211_VAP);
2063 }
2064
2065 static int
2066 bwn_init(struct bwn_softc *sc)
2067 {
2068         struct bwn_mac *mac;
2069         int error;
2070
2071         BWN_ASSERT_LOCKED(sc);
2072
2073         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2074
2075         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
2076         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
2077         sc->sc_filters = 0;
2078         bwn_wme_clear(sc);
2079         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
2080         sc->sc_rf_enabled = 1;
2081
2082         mac = sc->sc_curmac;
2083         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
2084                 error = bwn_core_init(mac);
2085                 if (error != 0)
2086                         return (error);
2087         }
2088         if (mac->mac_status == BWN_MAC_STATUS_INITED)
2089                 bwn_core_start(mac);
2090
2091         bwn_set_opmode(mac);
2092         bwn_set_pretbtt(mac);
2093         bwn_spu_setdelay(mac, 0);
2094         bwn_set_macaddr(mac);
2095
2096         sc->sc_flags |= BWN_FLAG_RUNNING;
2097         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
2098         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
2099
2100         return (0);
2101 }
2102
2103 static void
2104 bwn_stop(struct bwn_softc *sc)
2105 {
2106         struct bwn_mac *mac = sc->sc_curmac;
2107
2108         BWN_ASSERT_LOCKED(sc);
2109
2110         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2111
2112         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
2113                 /* XXX FIXME opmode not based on VAP */
2114                 bwn_set_opmode(mac);
2115                 bwn_set_macaddr(mac);
2116         }
2117
2118         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
2119                 bwn_core_stop(mac);
2120
2121         callout_stop(&sc->sc_led_blink_ch);
2122         sc->sc_led_blinking = 0;
2123
2124         bwn_core_exit(mac);
2125         sc->sc_rf_enabled = 0;
2126
2127         sc->sc_flags &= ~BWN_FLAG_RUNNING;
2128 }
2129
2130 static void
2131 bwn_wme_clear(struct bwn_softc *sc)
2132 {
2133 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
2134         struct wmeParams *p;
2135         unsigned int i;
2136
2137         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
2138             ("%s:%d: fail", __func__, __LINE__));
2139
2140         for (i = 0; i < N(sc->sc_wmeParams); i++) {
2141                 p = &(sc->sc_wmeParams[i]);
2142
2143                 switch (bwn_wme_shm_offsets[i]) {
2144                 case BWN_WME_VOICE:
2145                         p->wmep_txopLimit = 0;
2146                         p->wmep_aifsn = 2;
2147                         /* XXX FIXME: log2(cwmin) */
2148                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2149                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2150                         break;
2151                 case BWN_WME_VIDEO:
2152                         p->wmep_txopLimit = 0;
2153                         p->wmep_aifsn = 2;
2154                         /* XXX FIXME: log2(cwmin) */
2155                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2156                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2157                         break;
2158                 case BWN_WME_BESTEFFORT:
2159                         p->wmep_txopLimit = 0;
2160                         p->wmep_aifsn = 3;
2161                         /* XXX FIXME: log2(cwmin) */
2162                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2163                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2164                         break;
2165                 case BWN_WME_BACKGROUND:
2166                         p->wmep_txopLimit = 0;
2167                         p->wmep_aifsn = 7;
2168                         /* XXX FIXME: log2(cwmin) */
2169                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2170                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2171                         break;
2172                 default:
2173                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2174                 }
2175         }
2176 }
2177
2178 static int
2179 bwn_core_forceclk(struct bwn_mac *mac, bool force)
2180 {
2181         struct bwn_softc        *sc;
2182         bhnd_clock               clock;
2183         int                      error;
2184
2185         sc = mac->mac_sc;
2186
2187         /* On PMU equipped devices, we do not need to force the HT clock */
2188         if (sc->sc_pmu != NULL)
2189                 return (0);
2190
2191         /* Issue a PMU clock request */
2192         if (force)
2193                 clock = BHND_CLOCK_HT;
2194         else
2195                 clock = BHND_CLOCK_DYN;
2196
2197         if ((error = bhnd_request_clock(sc->sc_dev, clock))) {
2198                 device_printf(sc->sc_dev, "%d clock request failed: %d\n",
2199                     clock, error);
2200                 return (error);
2201         }
2202
2203         return (0);
2204 }
2205
2206 static int
2207 bwn_core_init(struct bwn_mac *mac)
2208 {
2209         struct bwn_softc *sc = mac->mac_sc;
2210         uint64_t hf;
2211         int error;
2212
2213         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2214             ("%s:%d: fail", __func__, __LINE__));
2215
2216         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2217
2218         if ((error = bwn_core_forceclk(mac, true)))
2219                 return (error);
2220
2221         if (bhnd_is_hw_suspended(sc->sc_dev)) {
2222                 if ((error = bwn_reset_core(mac, mac->mac_phy.gmode)))
2223                         goto fail0;
2224         }
2225
2226         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2227         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2228         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2229         BWN_GETTIME(mac->mac_phy.nexttime);
2230         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2231         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2232         mac->mac_stats.link_noise = -95;
2233         mac->mac_reason_intr = 0;
2234         bzero(mac->mac_reason, sizeof(mac->mac_reason));
2235         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2236 #ifdef BWN_DEBUG
2237         if (sc->sc_debug & BWN_DEBUG_XMIT)
2238                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2239 #endif
2240         mac->mac_suspended = 1;
2241         mac->mac_task_state = 0;
2242         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2243
2244         mac->mac_phy.init_pre(mac);
2245
2246         bwn_bt_disable(mac);
2247         if (mac->mac_phy.prepare_hw) {
2248                 error = mac->mac_phy.prepare_hw(mac);
2249                 if (error)
2250                         goto fail0;
2251         }
2252         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2253         error = bwn_chip_init(mac);
2254         if (error)
2255                 goto fail0;
2256         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2257             bhnd_get_hwrev(sc->sc_dev));
2258         hf = bwn_hf_read(mac);
2259         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2260                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2261                 if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL)
2262                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2263                 if (mac->mac_phy.rev == 1)
2264                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2265         }
2266         if (mac->mac_phy.rf_ver == 0x2050) {
2267                 if (mac->mac_phy.rf_rev < 6)
2268                         hf |= BWN_HF_FORCE_VCO_RECALC;
2269                 if (mac->mac_phy.rf_rev == 6)
2270                         hf |= BWN_HF_4318_TSSI;
2271         }
2272         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2273                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2274         if (sc->sc_quirks & BWN_QUIRK_UCODE_SLOWCLOCK_WAR)
2275                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2276         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2277         bwn_hf_write(mac, hf);
2278
2279         /* Tell the firmware about the MAC capabilities */
2280         if (bhnd_get_hwrev(sc->sc_dev) >= 13) {
2281                 uint32_t cap;
2282                 cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2283                 DPRINTF(sc, BWN_DEBUG_RESET,
2284                     "%s: hw capabilities: 0x%08x\n",
2285                     __func__, cap);
2286                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2287                     cap & 0xffff);
2288                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2289                     (cap >> 16) & 0xffff);
2290         }
2291
2292         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2293         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2294         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2295         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2296
2297         bwn_rate_init(mac);
2298         bwn_set_phytxctl(mac);
2299
2300         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2301             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2302         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2303
2304         if (sc->sc_quirks & BWN_QUIRK_NODMA)
2305                 bwn_pio_init(mac);
2306         else
2307                 bwn_dma_init(mac);
2308         bwn_wme_init(mac);
2309         bwn_spu_setdelay(mac, 1);
2310         bwn_bt_enable(mac);
2311
2312         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2313         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2314                 bwn_core_forceclk(mac, true);
2315         else
2316                 bwn_core_forceclk(mac, false);
2317
2318         bwn_set_macaddr(mac);
2319         bwn_crypt_init(mac);
2320
2321         /* XXX LED initializatin */
2322
2323         mac->mac_status = BWN_MAC_STATUS_INITED;
2324
2325         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2326         return (error);
2327
2328 fail0:
2329         bhnd_suspend_hw(sc->sc_dev, 0);
2330         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2331             ("%s:%d: fail", __func__, __LINE__));
2332         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2333         return (error);
2334 }
2335
2336 static void
2337 bwn_core_start(struct bwn_mac *mac)
2338 {
2339         struct bwn_softc *sc = mac->mac_sc;
2340         uint32_t tmp;
2341
2342         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2343             ("%s:%d: fail", __func__, __LINE__));
2344
2345         if (bhnd_get_hwrev(sc->sc_dev) < 5)
2346                 return;
2347
2348         while (1) {
2349                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2350                 if (!(tmp & 0x00000001))
2351                         break;
2352                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2353         }
2354
2355         bwn_mac_enable(mac);
2356         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2357         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2358
2359         mac->mac_status = BWN_MAC_STATUS_STARTED;
2360 }
2361
2362 static void
2363 bwn_core_exit(struct bwn_mac *mac)
2364 {
2365         struct bwn_softc *sc = mac->mac_sc;
2366         uint32_t macctl;
2367
2368         BWN_ASSERT_LOCKED(mac->mac_sc);
2369
2370         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2371             ("%s:%d: fail", __func__, __LINE__));
2372
2373         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2374                 return;
2375         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2376
2377         macctl = BWN_READ_4(mac, BWN_MACCTL);
2378         macctl &= ~BWN_MACCTL_MCODE_RUN;
2379         macctl |= BWN_MACCTL_MCODE_JMP0;
2380         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2381
2382         bwn_dma_stop(mac);
2383         bwn_pio_stop(mac);
2384         bwn_chip_exit(mac);
2385         mac->mac_phy.switch_analog(mac, 0);
2386         bhnd_suspend_hw(sc->sc_dev, 0);
2387 }
2388
2389 static void
2390 bwn_bt_disable(struct bwn_mac *mac)
2391 {
2392         struct bwn_softc *sc = mac->mac_sc;
2393
2394         (void)sc;
2395         /* XXX do nothing yet */
2396 }
2397
2398 static int
2399 bwn_chip_init(struct bwn_mac *mac)
2400 {
2401         struct bwn_softc *sc = mac->mac_sc;
2402         struct bwn_phy *phy = &mac->mac_phy;
2403         uint32_t macctl;
2404         u_int delay;
2405         int error;
2406
2407         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2408         if (phy->gmode)
2409                 macctl |= BWN_MACCTL_GMODE;
2410         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2411
2412         error = bwn_fw_fillinfo(mac);
2413         if (error)
2414                 return (error);
2415         error = bwn_fw_loaducode(mac);
2416         if (error)
2417                 return (error);
2418
2419         error = bwn_gpio_init(mac);
2420         if (error)
2421                 return (error);
2422
2423         error = bwn_fw_loadinitvals(mac);
2424         if (error)
2425                 return (error);
2426
2427         phy->switch_analog(mac, 1);
2428         error = bwn_phy_init(mac);
2429         if (error)
2430                 return (error);
2431
2432         if (phy->set_im)
2433                 phy->set_im(mac, BWN_IMMODE_NONE);
2434         if (phy->set_antenna)
2435                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2436         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2437
2438         if (phy->type == BWN_PHYTYPE_B)
2439                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2440         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2441         if (bhnd_get_hwrev(sc->sc_dev) < 5)
2442                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2443
2444         BWN_WRITE_4(mac, BWN_MACCTL,
2445             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2446         BWN_WRITE_4(mac, BWN_MACCTL,
2447             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2448         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2449
2450         bwn_set_opmode(mac);
2451         if (bhnd_get_hwrev(sc->sc_dev) < 3) {
2452                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2453                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2454                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2455                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2456         } else {
2457                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2458                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2459         }
2460         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2461         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2462         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2463         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2464         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2465         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2466         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2467
2468         bwn_mac_phy_clock_set(mac, true);
2469
2470         /* Provide the HT clock transition latency to the MAC core */
2471         error = bhnd_get_clock_latency(sc->sc_dev, BHND_CLOCK_HT, &delay);
2472         if (error) {
2473                 device_printf(sc->sc_dev, "failed to fetch HT clock latency: "
2474                     "%d\n", error);
2475                 return (error);
2476         }
2477
2478         if (delay > UINT16_MAX) {
2479                 device_printf(sc->sc_dev, "invalid HT clock latency: %u\n",
2480                     delay);
2481                 return (ENXIO);
2482         }
2483
2484         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, delay);
2485         return (0);
2486 }
2487
2488 /* read hostflags */
2489 uint64_t
2490 bwn_hf_read(struct bwn_mac *mac)
2491 {
2492         uint64_t ret;
2493
2494         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2495         ret <<= 16;
2496         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2497         ret <<= 16;
2498         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2499         return (ret);
2500 }
2501
2502 void
2503 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2504 {
2505
2506         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2507             (value & 0x00000000ffffull));
2508         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2509             (value & 0x0000ffff0000ull) >> 16);
2510         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2511             (value & 0xffff00000000ULL) >> 32);
2512 }
2513
2514 static void
2515 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2516 {
2517
2518         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2519         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2520 }
2521
2522 static void
2523 bwn_rate_init(struct bwn_mac *mac)
2524 {
2525
2526         switch (mac->mac_phy.type) {
2527         case BWN_PHYTYPE_A:
2528         case BWN_PHYTYPE_G:
2529         case BWN_PHYTYPE_LP:
2530         case BWN_PHYTYPE_N:
2531                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2532                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2533                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2534                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2535                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2536                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2537                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2538                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2539                         break;
2540                 /* FALLTHROUGH */
2541         case BWN_PHYTYPE_B:
2542                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2543                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2544                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2545                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2546                 break;
2547         default:
2548                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2549         }
2550 }
2551
2552 static void
2553 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2554 {
2555         uint16_t offset;
2556
2557         if (ofdm) {
2558                 offset = 0x480;
2559                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2560         } else {
2561                 offset = 0x4c0;
2562                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2563         }
2564         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2565             bwn_shm_read_2(mac, BWN_SHARED, offset));
2566 }
2567
2568 static uint8_t
2569 bwn_plcp_getcck(const uint8_t bitrate)
2570 {
2571
2572         switch (bitrate) {
2573         case BWN_CCK_RATE_1MB:
2574                 return (0x0a);
2575         case BWN_CCK_RATE_2MB:
2576                 return (0x14);
2577         case BWN_CCK_RATE_5MB:
2578                 return (0x37);
2579         case BWN_CCK_RATE_11MB:
2580                 return (0x6e);
2581         }
2582         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2583         return (0);
2584 }
2585
2586 static uint8_t
2587 bwn_plcp_getofdm(const uint8_t bitrate)
2588 {
2589
2590         switch (bitrate) {
2591         case BWN_OFDM_RATE_6MB:
2592                 return (0xb);
2593         case BWN_OFDM_RATE_9MB:
2594                 return (0xf);
2595         case BWN_OFDM_RATE_12MB:
2596                 return (0xa);
2597         case BWN_OFDM_RATE_18MB:
2598                 return (0xe);
2599         case BWN_OFDM_RATE_24MB:
2600                 return (0x9);
2601         case BWN_OFDM_RATE_36MB:
2602                 return (0xd);
2603         case BWN_OFDM_RATE_48MB:
2604                 return (0x8);
2605         case BWN_OFDM_RATE_54MB:
2606                 return (0xc);
2607         }
2608         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2609         return (0);
2610 }
2611
2612 static void
2613 bwn_set_phytxctl(struct bwn_mac *mac)
2614 {
2615         uint16_t ctl;
2616
2617         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2618             BWN_TX_PHY_TXPWR);
2619         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2620         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2621         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2622 }
2623
2624 static void
2625 bwn_pio_init(struct bwn_mac *mac)
2626 {
2627         struct bwn_pio *pio = &mac->mac_method.pio;
2628
2629         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2630             & ~BWN_MACCTL_BIGENDIAN);
2631         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2632
2633         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2634         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2635         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2636         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2637         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2638         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2639 }
2640
2641 static void
2642 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2643     int index)
2644 {
2645         struct bwn_pio_txpkt *tp;
2646         struct bwn_softc *sc = mac->mac_sc;
2647         unsigned int i;
2648
2649         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2650         tq->tq_index = index;
2651
2652         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2653         if (bhnd_get_hwrev(sc->sc_dev) >= 8)
2654                 tq->tq_size = 1920;
2655         else {
2656                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2657                 tq->tq_size -= 80;
2658         }
2659
2660         TAILQ_INIT(&tq->tq_pktlist);
2661         for (i = 0; i < N(tq->tq_pkts); i++) {
2662                 tp = &(tq->tq_pkts[i]);
2663                 tp->tp_index = i;
2664                 tp->tp_queue = tq;
2665                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2666         }
2667 }
2668
2669 static uint16_t
2670 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2671 {
2672         struct bwn_softc *sc = mac->mac_sc;
2673         static const uint16_t bases[] = {
2674                 BWN_PIO_BASE0,
2675                 BWN_PIO_BASE1,
2676                 BWN_PIO_BASE2,
2677                 BWN_PIO_BASE3,
2678                 BWN_PIO_BASE4,
2679                 BWN_PIO_BASE5,
2680                 BWN_PIO_BASE6,
2681                 BWN_PIO_BASE7,
2682         };
2683         static const uint16_t bases_rev11[] = {
2684                 BWN_PIO11_BASE0,
2685                 BWN_PIO11_BASE1,
2686                 BWN_PIO11_BASE2,
2687                 BWN_PIO11_BASE3,
2688                 BWN_PIO11_BASE4,
2689                 BWN_PIO11_BASE5,
2690         };
2691
2692         if (bhnd_get_hwrev(sc->sc_dev) >= 11) {
2693                 if (index >= N(bases_rev11))
2694                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2695                 return (bases_rev11[index]);
2696         }
2697         if (index >= N(bases))
2698                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2699         return (bases[index]);
2700 }
2701
2702 static void
2703 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2704     int index)
2705 {
2706         struct bwn_softc *sc = mac->mac_sc;
2707
2708         prq->prq_mac = mac;
2709         prq->prq_rev = bhnd_get_hwrev(sc->sc_dev);
2710         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2711         bwn_dma_rxdirectfifo(mac, index, 1);
2712 }
2713
2714 static void
2715 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2716 {
2717         if (tq == NULL)
2718                 return;
2719         bwn_pio_cancel_tx_packets(tq);
2720 }
2721
2722 static void
2723 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2724 {
2725
2726         bwn_destroy_pioqueue_tx(pio);
2727 }
2728
2729 static uint16_t
2730 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2731     uint16_t offset)
2732 {
2733
2734         return (BWN_READ_2(mac, tq->tq_base + offset));
2735 }
2736
2737 static void
2738 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2739 {
2740         uint32_t ctl;
2741         uint16_t base;
2742
2743         base = bwn_dma_base(mac->mac_dmatype, idx);
2744         if (mac->mac_dmatype == BHND_DMA_ADDR_64BIT) {
2745                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2746                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2747                 if (enable)
2748                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2749                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2750         } else {
2751                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2752                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2753                 if (enable)
2754                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2755                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2756         }
2757 }
2758
2759 static void
2760 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2761 {
2762         struct bwn_pio_txpkt *tp;
2763         unsigned int i;
2764
2765         for (i = 0; i < N(tq->tq_pkts); i++) {
2766                 tp = &(tq->tq_pkts[i]);
2767                 if (tp->tp_m) {
2768                         m_freem(tp->tp_m);
2769                         tp->tp_m = NULL;
2770                 }
2771         }
2772 }
2773
2774 static uint16_t
2775 bwn_dma_base(int type, int controller_idx)
2776 {
2777         static const uint16_t map64[] = {
2778                 BWN_DMA64_BASE0,
2779                 BWN_DMA64_BASE1,
2780                 BWN_DMA64_BASE2,
2781                 BWN_DMA64_BASE3,
2782                 BWN_DMA64_BASE4,
2783                 BWN_DMA64_BASE5,
2784         };
2785         static const uint16_t map32[] = {
2786                 BWN_DMA32_BASE0,
2787                 BWN_DMA32_BASE1,
2788                 BWN_DMA32_BASE2,
2789                 BWN_DMA32_BASE3,
2790                 BWN_DMA32_BASE4,
2791                 BWN_DMA32_BASE5,
2792         };
2793
2794         if (type == BHND_DMA_ADDR_64BIT) {
2795                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2796                     ("%s:%d: fail", __func__, __LINE__));
2797                 return (map64[controller_idx]);
2798         }
2799         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2800             ("%s:%d: fail", __func__, __LINE__));
2801         return (map32[controller_idx]);
2802 }
2803
2804 static void
2805 bwn_dma_init(struct bwn_mac *mac)
2806 {
2807         struct bwn_dma *dma = &mac->mac_method.dma;
2808
2809         /* setup TX DMA channels. */
2810         bwn_dma_setup(dma->wme[WME_AC_BK]);
2811         bwn_dma_setup(dma->wme[WME_AC_BE]);
2812         bwn_dma_setup(dma->wme[WME_AC_VI]);
2813         bwn_dma_setup(dma->wme[WME_AC_VO]);
2814         bwn_dma_setup(dma->mcast);
2815         /* setup RX DMA channel. */
2816         bwn_dma_setup(dma->rx);
2817 }
2818
2819 static struct bwn_dma_ring *
2820 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2821     int for_tx)
2822 {
2823         struct bwn_dma *dma = &mac->mac_method.dma;
2824         struct bwn_dma_ring *dr;
2825         struct bwn_dmadesc_generic *desc;
2826         struct bwn_dmadesc_meta *mt;
2827         struct bwn_softc *sc = mac->mac_sc;
2828         int error, i;
2829
2830         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2831         if (dr == NULL)
2832                 goto out;
2833         dr->dr_numslots = BWN_RXRING_SLOTS;
2834         if (for_tx)
2835                 dr->dr_numslots = BWN_TXRING_SLOTS;
2836
2837         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2838             M_DEVBUF, M_NOWAIT | M_ZERO);
2839         if (dr->dr_meta == NULL)
2840                 goto fail0;
2841
2842         dr->dr_type = mac->mac_dmatype;
2843         dr->dr_mac = mac;
2844         dr->dr_base = bwn_dma_base(dr->dr_type, controller_index);
2845         dr->dr_index = controller_index;
2846         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
2847                 dr->getdesc = bwn_dma_64_getdesc;
2848                 dr->setdesc = bwn_dma_64_setdesc;
2849                 dr->start_transfer = bwn_dma_64_start_transfer;
2850                 dr->suspend = bwn_dma_64_suspend;
2851                 dr->resume = bwn_dma_64_resume;
2852                 dr->get_curslot = bwn_dma_64_get_curslot;
2853                 dr->set_curslot = bwn_dma_64_set_curslot;
2854         } else {
2855                 dr->getdesc = bwn_dma_32_getdesc;
2856                 dr->setdesc = bwn_dma_32_setdesc;
2857                 dr->start_transfer = bwn_dma_32_start_transfer;
2858                 dr->suspend = bwn_dma_32_suspend;
2859                 dr->resume = bwn_dma_32_resume;
2860                 dr->get_curslot = bwn_dma_32_get_curslot;
2861                 dr->set_curslot = bwn_dma_32_set_curslot;
2862         }
2863         if (for_tx) {
2864                 dr->dr_tx = 1;
2865                 dr->dr_curslot = -1;
2866         } else {
2867                 if (dr->dr_index == 0) {
2868                         switch (mac->mac_fw.fw_hdr_format) {
2869                         case BWN_FW_HDR_351:
2870                         case BWN_FW_HDR_410:
2871                                 dr->dr_rx_bufsize =
2872                                     BWN_DMA0_RX_BUFFERSIZE_FW351;
2873                                 dr->dr_frameoffset =
2874                                     BWN_DMA0_RX_FRAMEOFFSET_FW351;
2875                                 break;
2876                         case BWN_FW_HDR_598:
2877                                 dr->dr_rx_bufsize =
2878                                     BWN_DMA0_RX_BUFFERSIZE_FW598;
2879                                 dr->dr_frameoffset =
2880                                     BWN_DMA0_RX_FRAMEOFFSET_FW598;
2881                                 break;
2882                         }
2883                 } else
2884                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2885         }
2886
2887         error = bwn_dma_allocringmemory(dr);
2888         if (error)
2889                 goto fail2;
2890
2891         if (for_tx) {
2892                 /*
2893                  * Assumption: BWN_TXRING_SLOTS can be divided by
2894                  * BWN_TX_SLOTS_PER_FRAME
2895                  */
2896                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2897                     ("%s:%d: fail", __func__, __LINE__));
2898
2899                 dr->dr_txhdr_cache = contigmalloc(
2900                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2901                     BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2902                     0, BUS_SPACE_MAXADDR, 8, 0);
2903                 if (dr->dr_txhdr_cache == NULL) {
2904                         device_printf(sc->sc_dev,
2905                             "can't allocate TX header DMA memory\n");
2906                         goto fail1;
2907                 }
2908
2909                 /*
2910                  * Create TX ring DMA stuffs
2911                  */
2912                 error = bus_dma_tag_create(dma->parent_dtag,
2913                                     BWN_ALIGN, 0,
2914                                     BUS_SPACE_MAXADDR,
2915                                     BUS_SPACE_MAXADDR,
2916                                     NULL, NULL,
2917                                     BWN_HDRSIZE(mac),
2918                                     1,
2919                                     BUS_SPACE_MAXSIZE_32BIT,
2920                                     0,
2921                                     NULL, NULL,
2922                                     &dr->dr_txring_dtag);
2923                 if (error) {
2924                         device_printf(sc->sc_dev,
2925                             "can't create TX ring DMA tag: TODO frees\n");
2926                         goto fail2;
2927                 }
2928
2929                 for (i = 0; i < dr->dr_numslots; i += 2) {
2930                         dr->getdesc(dr, i, &desc, &mt);
2931
2932                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2933                         mt->mt_m = NULL;
2934                         mt->mt_ni = NULL;
2935                         mt->mt_islast = 0;
2936                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2937                             &mt->mt_dmap);
2938                         if (error) {
2939                                 device_printf(sc->sc_dev,
2940                                      "can't create RX buf DMA map\n");
2941                                 goto fail2;
2942                         }
2943
2944                         dr->getdesc(dr, i + 1, &desc, &mt);
2945
2946                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2947                         mt->mt_m = NULL;
2948                         mt->mt_ni = NULL;
2949                         mt->mt_islast = 1;
2950                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2951                             &mt->mt_dmap);
2952                         if (error) {
2953                                 device_printf(sc->sc_dev,
2954                                      "can't create RX buf DMA map\n");
2955                                 goto fail2;
2956                         }
2957                 }
2958         } else {
2959                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2960                     &dr->dr_spare_dmap);
2961                 if (error) {
2962                         device_printf(sc->sc_dev,
2963                             "can't create RX buf DMA map\n");
2964                         goto out;               /* XXX wrong! */
2965                 }
2966
2967                 for (i = 0; i < dr->dr_numslots; i++) {
2968                         dr->getdesc(dr, i, &desc, &mt);
2969
2970                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2971                             &mt->mt_dmap);
2972                         if (error) {
2973                                 device_printf(sc->sc_dev,
2974                                     "can't create RX buf DMA map\n");
2975                                 goto out;       /* XXX wrong! */
2976                         }
2977                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2978                         if (error) {
2979                                 device_printf(sc->sc_dev,
2980                                     "failed to allocate RX buf\n");
2981                                 goto out;       /* XXX wrong! */
2982                         }
2983                 }
2984
2985                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2986                     BUS_DMASYNC_PREWRITE);
2987
2988                 dr->dr_usedslot = dr->dr_numslots;
2989         }
2990
2991       out:
2992         return (dr);
2993
2994 fail2:
2995         if (dr->dr_txhdr_cache != NULL) {
2996                 contigfree(dr->dr_txhdr_cache,
2997                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2998                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2999         }
3000 fail1:
3001         free(dr->dr_meta, M_DEVBUF);
3002 fail0:
3003         free(dr, M_DEVBUF);
3004         return (NULL);
3005 }
3006
3007 static void
3008 bwn_dma_ringfree(struct bwn_dma_ring **dr)
3009 {
3010
3011         if (dr == NULL)
3012                 return;
3013
3014         bwn_dma_free_descbufs(*dr);
3015         bwn_dma_free_ringmemory(*dr);
3016
3017         if ((*dr)->dr_txhdr_cache != NULL) {
3018                 contigfree((*dr)->dr_txhdr_cache,
3019                     ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
3020                     BWN_MAXTXHDRSIZE, M_DEVBUF);
3021         }
3022         free((*dr)->dr_meta, M_DEVBUF);
3023         free(*dr, M_DEVBUF);
3024
3025         *dr = NULL;
3026 }
3027
3028 static void
3029 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
3030     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3031 {
3032         struct bwn_dmadesc32 *desc;
3033
3034         *meta = &(dr->dr_meta[slot]);
3035         desc = dr->dr_ring_descbase;
3036         desc = &(desc[slot]);
3037
3038         *gdesc = (struct bwn_dmadesc_generic *)desc;
3039 }
3040
3041 static void
3042 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
3043     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3044     int start, int end, int irq)
3045 {
3046         struct bwn_dmadesc32            *descbase;
3047         struct bwn_dma                  *dma;
3048         struct bhnd_dma_translation     *dt;
3049         uint32_t                         addr, addrext, ctl;
3050         int                              slot;
3051
3052         descbase = dr->dr_ring_descbase;
3053         dma = &dr->dr_mac->mac_method.dma;
3054         dt = &dma->translation;
3055
3056         slot = (int)(&(desc->dma.dma32) - descbase);
3057         KASSERT(slot >= 0 && slot < dr->dr_numslots,
3058             ("%s:%d: fail", __func__, __LINE__));
3059
3060         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3061         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3062         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
3063         if (slot == dr->dr_numslots - 1)
3064                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
3065         if (start)
3066                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
3067         if (end)
3068                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
3069         if (irq)
3070                 ctl |= BWN_DMA32_DCTL_IRQ;
3071         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
3072             & BWN_DMA32_DCTL_ADDREXT_MASK;
3073
3074         desc->dma.dma32.control = htole32(ctl);
3075         desc->dma.dma32.address = htole32(addr);
3076 }
3077
3078 static void
3079 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
3080 {
3081
3082         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
3083             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
3084 }
3085
3086 static void
3087 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
3088 {
3089
3090         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3091             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
3092 }
3093
3094 static void
3095 bwn_dma_32_resume(struct bwn_dma_ring *dr)
3096 {
3097
3098         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3099             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
3100 }
3101
3102 static int
3103 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
3104 {
3105         uint32_t val;
3106
3107         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
3108         val &= BWN_DMA32_RXDPTR;
3109
3110         return (val / sizeof(struct bwn_dmadesc32));
3111 }
3112
3113 static void
3114 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
3115 {
3116
3117         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
3118             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
3119 }
3120
3121 static void
3122 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
3123     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3124 {
3125         struct bwn_dmadesc64 *desc;
3126
3127         *meta = &(dr->dr_meta[slot]);
3128         desc = dr->dr_ring_descbase;
3129         desc = &(desc[slot]);
3130
3131         *gdesc = (struct bwn_dmadesc_generic *)desc;
3132 }
3133
3134 static void
3135 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
3136     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3137     int start, int end, int irq)
3138 {
3139         struct bwn_dmadesc64            *descbase;
3140         struct bwn_dma                  *dma;
3141         struct bhnd_dma_translation     *dt;
3142         bhnd_addr_t                      addr;
3143         uint32_t                         addrhi, addrlo;
3144         uint32_t                         addrext;
3145         uint32_t                         ctl0, ctl1;
3146         int                              slot;
3147
3148
3149         descbase = dr->dr_ring_descbase;
3150         dma = &dr->dr_mac->mac_method.dma;
3151         dt = &dma->translation;
3152
3153         slot = (int)(&(desc->dma.dma64) - descbase);
3154         KASSERT(slot >= 0 && slot < dr->dr_numslots,
3155             ("%s:%d: fail", __func__, __LINE__));
3156
3157         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3158         addrhi = (addr >> 32);
3159         addrlo = (addr & UINT32_MAX);
3160         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3161
3162         ctl0 = 0;
3163         if (slot == dr->dr_numslots - 1)
3164                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
3165         if (start)
3166                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
3167         if (end)
3168                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3169         if (irq)
3170                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
3171
3172         ctl1 = 0;
3173         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3174         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3175             & BWN_DMA64_DCTL1_ADDREXT_MASK;
3176
3177         desc->dma.dma64.control0 = htole32(ctl0);
3178         desc->dma.dma64.control1 = htole32(ctl1);
3179         desc->dma.dma64.address_low = htole32(addrlo);
3180         desc->dma.dma64.address_high = htole32(addrhi);
3181 }
3182
3183 static void
3184 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3185 {
3186
3187         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3188             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3189 }
3190
3191 static void
3192 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3193 {
3194
3195         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3196             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3197 }
3198
3199 static void
3200 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3201 {
3202
3203         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3204             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3205 }
3206
3207 static int
3208 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3209 {
3210         uint32_t val;
3211
3212         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3213         val &= BWN_DMA64_RXSTATDPTR;
3214
3215         return (val / sizeof(struct bwn_dmadesc64));
3216 }
3217
3218 static void
3219 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3220 {
3221
3222         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3223             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3224 }
3225
3226 static int
3227 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3228 {
3229         struct bwn_mac *mac = dr->dr_mac;
3230         struct bwn_dma *dma = &mac->mac_method.dma;
3231         struct bwn_softc *sc = mac->mac_sc;
3232         int error;
3233
3234         error = bus_dma_tag_create(dma->parent_dtag,
3235                             BWN_ALIGN, 0,
3236                             BUS_SPACE_MAXADDR,
3237                             BUS_SPACE_MAXADDR,
3238                             NULL, NULL,
3239                             BWN_DMA_RINGMEMSIZE,
3240                             1,
3241                             BUS_SPACE_MAXSIZE_32BIT,
3242                             0,
3243                             NULL, NULL,
3244                             &dr->dr_ring_dtag);
3245         if (error) {
3246                 device_printf(sc->sc_dev,
3247                     "can't create TX ring DMA tag: TODO frees\n");
3248                 return (-1);
3249         }
3250
3251         error = bus_dmamem_alloc(dr->dr_ring_dtag,
3252             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3253             &dr->dr_ring_dmap);
3254         if (error) {
3255                 device_printf(sc->sc_dev,
3256                     "can't allocate DMA mem: TODO frees\n");
3257                 return (-1);
3258         }
3259         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3260             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3261             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3262         if (error) {
3263                 device_printf(sc->sc_dev,
3264                     "can't load DMA mem: TODO free\n");
3265                 return (-1);
3266         }
3267
3268         return (0);
3269 }
3270
3271 static void
3272 bwn_dma_setup(struct bwn_dma_ring *dr)
3273 {
3274         struct bwn_mac                  *mac;
3275         struct bwn_dma                  *dma;
3276         struct bhnd_dma_translation     *dt;
3277         bhnd_addr_t                      addr, paddr;
3278         uint32_t                         addrhi, addrlo, addrext, value;
3279
3280         mac = dr->dr_mac;
3281         dma = &mac->mac_method.dma;
3282         dt = &dma->translation;
3283
3284         paddr = dr->dr_ring_dmabase;
3285         addr = (paddr & dt->addr_mask) | dt->base_addr;
3286         addrhi = (addr >> 32);
3287         addrlo = (addr & UINT32_MAX);
3288         addrext = ((paddr & dt->addrext_mask) >> dma->addrext_shift);
3289
3290         if (dr->dr_tx) {
3291                 dr->dr_curslot = -1;
3292
3293                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3294                         value = BWN_DMA64_TXENABLE;
3295                         value |= BWN_DMA64_TXPARITY_DISABLE;
3296                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3297                             & BWN_DMA64_TXADDREXT_MASK;
3298                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3299                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, addrlo);
3300                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, addrhi);
3301                 } else {
3302                         value = BWN_DMA32_TXENABLE;
3303                         value |= BWN_DMA32_TXPARITY_DISABLE;
3304                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3305                             & BWN_DMA32_TXADDREXT_MASK;
3306                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3307                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, addrlo);
3308                 }
3309                 return;
3310         }
3311
3312         /*
3313          * set for RX
3314          */
3315         dr->dr_usedslot = dr->dr_numslots;
3316
3317         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3318                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3319                 value |= BWN_DMA64_RXENABLE;
3320                 value |= BWN_DMA64_RXPARITY_DISABLE;
3321                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3322                     & BWN_DMA64_RXADDREXT_MASK;
3323                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3324                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, addrlo);
3325                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, addrhi);
3326                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3327                     sizeof(struct bwn_dmadesc64));
3328         } else {
3329                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3330                 value |= BWN_DMA32_RXENABLE;
3331                 value |= BWN_DMA32_RXPARITY_DISABLE;
3332                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3333                     & BWN_DMA32_RXADDREXT_MASK;
3334                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3335                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, addrlo);
3336                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3337                     sizeof(struct bwn_dmadesc32));
3338         }
3339 }
3340
3341 static void
3342 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3343 {
3344
3345         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3346         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3347             dr->dr_ring_dmap);
3348 }
3349
3350 static void
3351 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3352 {
3353
3354         if (dr->dr_tx) {
3355                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3356                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3357                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3358                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3359                 } else
3360                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3361         } else {
3362                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3363                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3364                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3365                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3366                 } else
3367                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3368         }
3369 }
3370
3371 static void
3372 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3373 {
3374         struct bwn_dmadesc_generic *desc;
3375         struct bwn_dmadesc_meta *meta;
3376         struct bwn_mac *mac = dr->dr_mac;
3377         struct bwn_dma *dma = &mac->mac_method.dma;
3378         struct bwn_softc *sc = mac->mac_sc;
3379         int i;
3380
3381         if (!dr->dr_usedslot)
3382                 return;
3383         for (i = 0; i < dr->dr_numslots; i++) {
3384                 dr->getdesc(dr, i, &desc, &meta);
3385
3386                 if (meta->mt_m == NULL) {
3387                         if (!dr->dr_tx)
3388                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3389                                     __func__);
3390                         continue;
3391                 }
3392                 if (dr->dr_tx) {
3393                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3394                                 bus_dmamap_unload(dr->dr_txring_dtag,
3395                                     meta->mt_dmap);
3396                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3397                                 bus_dmamap_unload(dma->txbuf_dtag,
3398                                     meta->mt_dmap);
3399                 } else
3400                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3401                 bwn_dma_free_descbuf(dr, meta);
3402         }
3403 }
3404
3405 static int
3406 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3407     int type)
3408 {
3409         struct bwn_softc *sc = mac->mac_sc;
3410         uint32_t value;
3411         int i;
3412         uint16_t offset;
3413
3414         for (i = 0; i < 10; i++) {
3415                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3416                     BWN_DMA32_TXSTATUS;
3417                 value = BWN_READ_4(mac, base + offset);
3418                 if (type == BHND_DMA_ADDR_64BIT) {
3419                         value &= BWN_DMA64_TXSTAT;
3420                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3421                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3422                             value == BWN_DMA64_TXSTAT_STOPPED)
3423                                 break;
3424                 } else {
3425                         value &= BWN_DMA32_TXSTATE;
3426                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3427                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3428                             value == BWN_DMA32_TXSTAT_STOPPED)
3429                                 break;
3430                 }
3431                 DELAY(1000);
3432         }
3433         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXCTL :
3434             BWN_DMA32_TXCTL;
3435         BWN_WRITE_4(mac, base + offset, 0);
3436         for (i = 0; i < 10; i++) {
3437                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3438                     BWN_DMA32_TXSTATUS;
3439                 value = BWN_READ_4(mac, base + offset);
3440                 if (type == BHND_DMA_ADDR_64BIT) {
3441                         value &= BWN_DMA64_TXSTAT;
3442                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3443                                 i = -1;
3444                                 break;
3445                         }
3446                 } else {
3447                         value &= BWN_DMA32_TXSTATE;
3448                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3449                                 i = -1;
3450                                 break;
3451                         }
3452                 }
3453                 DELAY(1000);
3454         }
3455         if (i != -1) {
3456                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3457                 return (ENODEV);
3458         }
3459         DELAY(1000);
3460
3461         return (0);
3462 }
3463
3464 static int
3465 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3466     int type)
3467 {
3468         struct bwn_softc *sc = mac->mac_sc;
3469         uint32_t value;
3470         int i;
3471         uint16_t offset;
3472
3473         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXCTL :
3474             BWN_DMA32_RXCTL;
3475         BWN_WRITE_4(mac, base + offset, 0);
3476         for (i = 0; i < 10; i++) {
3477                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXSTATUS :
3478                     BWN_DMA32_RXSTATUS;
3479                 value = BWN_READ_4(mac, base + offset);
3480                 if (type == BHND_DMA_ADDR_64BIT) {
3481                         value &= BWN_DMA64_RXSTAT;
3482                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3483                                 i = -1;
3484                                 break;
3485                         }
3486                 } else {
3487                         value &= BWN_DMA32_RXSTATE;
3488                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3489                                 i = -1;
3490                                 break;
3491                         }
3492                 }
3493                 DELAY(1000);
3494         }
3495         if (i != -1) {
3496                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3497                 return (ENODEV);
3498         }
3499
3500         return (0);
3501 }
3502
3503 static void
3504 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3505     struct bwn_dmadesc_meta *meta)
3506 {
3507
3508         if (meta->mt_m != NULL) {
3509                 m_freem(meta->mt_m);
3510                 meta->mt_m = NULL;
3511         }
3512         if (meta->mt_ni != NULL) {
3513                 ieee80211_free_node(meta->mt_ni);
3514                 meta->mt_ni = NULL;
3515         }
3516 }
3517
3518 static void
3519 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3520 {
3521         struct bwn_rxhdr4 *rxhdr;
3522         unsigned char *frame;
3523
3524         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3525         rxhdr->frame_len = 0;
3526
3527         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3528             sizeof(struct bwn_plcp6) + 2,
3529             ("%s:%d: fail", __func__, __LINE__));
3530         frame = mtod(m, char *) + dr->dr_frameoffset;
3531         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3532 }
3533
3534 static uint8_t
3535 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3536 {
3537         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3538
3539         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3540             == 0xff);
3541 }
3542
3543 static void
3544 bwn_wme_init(struct bwn_mac *mac)
3545 {
3546
3547         bwn_wme_load(mac);
3548
3549         /* enable WME support. */
3550         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3551         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3552             BWN_IFSCTL_USE_EDCF);
3553 }
3554
3555 static void
3556 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3557 {
3558         struct bwn_softc *sc = mac->mac_sc;
3559         struct ieee80211com *ic = &sc->sc_ic;
3560         uint16_t delay; /* microsec */
3561
3562         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3563         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3564                 delay = 500;
3565         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3566                 delay = max(delay, (uint16_t)2400);
3567
3568         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3569 }
3570
3571 static void
3572 bwn_bt_enable(struct bwn_mac *mac)
3573 {
3574         struct bwn_softc *sc = mac->mac_sc;
3575         uint64_t hf;
3576
3577         if (bwn_bluetooth == 0)
3578                 return;
3579         if ((sc->sc_board_info.board_flags & BHND_BFL_BTCOEX) == 0)
3580                 return;
3581         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3582                 return;
3583
3584         hf = bwn_hf_read(mac);
3585         if (sc->sc_board_info.board_flags & BHND_BFL_BTC2WIRE_ALTGPIO)
3586                 hf |= BWN_HF_BT_COEXISTALT;
3587         else
3588                 hf |= BWN_HF_BT_COEXIST;
3589         bwn_hf_write(mac, hf);
3590 }
3591
3592 static void
3593 bwn_set_macaddr(struct bwn_mac *mac)
3594 {
3595
3596         bwn_mac_write_bssid(mac);
3597         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3598             mac->mac_sc->sc_ic.ic_macaddr);
3599 }
3600
3601 static void
3602 bwn_clear_keys(struct bwn_mac *mac)
3603 {
3604         int i;
3605
3606         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3607                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3608                     ("%s:%d: fail", __func__, __LINE__));
3609
3610                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3611                     NULL, BWN_SEC_KEYSIZE, NULL);
3612                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3613                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3614                             NULL, BWN_SEC_KEYSIZE, NULL);
3615                 }
3616                 mac->mac_key[i].keyconf = NULL;
3617         }
3618 }
3619
3620 static void
3621 bwn_crypt_init(struct bwn_mac *mac)
3622 {
3623         struct bwn_softc *sc = mac->mac_sc;
3624
3625         mac->mac_max_nr_keys = (bhnd_get_hwrev(sc->sc_dev) >= 5) ? 58 : 20;
3626         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3627             ("%s:%d: fail", __func__, __LINE__));
3628         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3629         mac->mac_ktp *= 2;
3630         if (bhnd_get_hwrev(sc->sc_dev) >= 5)
3631                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3632         bwn_clear_keys(mac);
3633 }
3634
3635 static void
3636 bwn_chip_exit(struct bwn_mac *mac)
3637 {
3638         bwn_phy_exit(mac);
3639 }
3640
3641 static int
3642 bwn_fw_fillinfo(struct bwn_mac *mac)
3643 {
3644         int error;
3645
3646         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3647         if (error == 0)
3648                 return (0);
3649         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3650         if (error == 0)
3651                 return (0);
3652         return (error);
3653 }
3654
3655 /**
3656  * Request that the GPIO controller tristate all pins set in @p mask, granting
3657  * the MAC core control over the pins.
3658  *
3659  * @param mac   bwn MAC state.
3660  * @param pins  If the bit position for a pin number is set to one, tristate the
3661  *              pin.
3662  */
3663 int
3664 bwn_gpio_control(struct bwn_mac *mac, uint32_t pins)
3665 {
3666         struct bwn_softc        *sc;
3667         uint32_t                 flags[32];
3668         int                      error;
3669
3670         sc = mac->mac_sc;
3671
3672         /* Determine desired pin flags */
3673         for (size_t pin = 0; pin < nitems(flags); pin++) {
3674                 uint32_t pinbit = (1 << pin);
3675
3676                 if (pins & pinbit) {
3677                         /* Tristate output */
3678                         flags[pin] = GPIO_PIN_OUTPUT|GPIO_PIN_TRISTATE;
3679                 } else {
3680                         /* Leave unmodified */
3681                         flags[pin] = 0;
3682                 }
3683         }
3684
3685         /* Configure all pins */
3686         error = GPIO_PIN_CONFIG_32(sc->sc_gpio, 0, nitems(flags), flags);
3687         if (error) {
3688                 device_printf(sc->sc_dev, "error configuring %s pin flags: "
3689                     "%d\n", device_get_nameunit(sc->sc_gpio), error);
3690                 return (error);
3691         }
3692
3693         return (0);
3694 }
3695
3696
3697 static int
3698 bwn_gpio_init(struct bwn_mac *mac)
3699 {
3700         struct bwn_softc        *sc;
3701         uint32_t                 pins;
3702
3703         sc = mac->mac_sc;
3704
3705         pins = 0xF;
3706
3707         BWN_WRITE_4(mac, BWN_MACCTL,
3708             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3709         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3710             BWN_READ_2(mac, BWN_GPIO_MASK) | pins);
3711
3712         if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL) {
3713                 /* MAC core is responsible for toggling PAREF via gpio9 */
3714                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3715                     BWN_READ_2(mac, BWN_GPIO_MASK) | BHND_GPIO_BOARD_PACTRL);
3716
3717                 pins |= BHND_GPIO_BOARD_PACTRL;
3718         }
3719
3720         return (bwn_gpio_control(mac, pins));
3721 }
3722
3723 static int
3724 bwn_fw_loadinitvals(struct bwn_mac *mac)
3725 {
3726 #define GETFWOFFSET(fwp, offset)                                \
3727         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3728         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3729         const struct bwn_fwhdr *hdr;
3730         struct bwn_fw *fw = &mac->mac_fw;
3731         int error;
3732
3733         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3734         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3735             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3736         if (error)
3737                 return (error);
3738         if (fw->initvals_band.fw) {
3739                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3740                 error = bwn_fwinitvals_write(mac,
3741                     GETFWOFFSET(fw->initvals_band, hdr_len),
3742                     be32toh(hdr->size),
3743                     fw->initvals_band.fw->datasize - hdr_len);
3744         }
3745         return (error);
3746 #undef GETFWOFFSET
3747 }
3748
3749 static int
3750 bwn_phy_init(struct bwn_mac *mac)
3751 {
3752         struct bwn_softc *sc = mac->mac_sc;
3753         int error;
3754
3755         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3756         mac->mac_phy.rf_onoff(mac, 1);
3757         error = mac->mac_phy.init(mac);
3758         if (error) {
3759                 device_printf(sc->sc_dev, "PHY init failed\n");
3760                 goto fail0;
3761         }
3762         error = bwn_switch_channel(mac,
3763             mac->mac_phy.get_default_chan(mac));
3764         if (error) {
3765                 device_printf(sc->sc_dev,
3766                     "failed to switch default channel\n");
3767                 goto fail1;
3768         }
3769         return (0);
3770 fail1:
3771         if (mac->mac_phy.exit)
3772                 mac->mac_phy.exit(mac);
3773 fail0:
3774         mac->mac_phy.rf_onoff(mac, 0);
3775
3776         return (error);
3777 }
3778
3779 static void
3780 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3781 {
3782         uint16_t ant;
3783         uint16_t tmp;
3784
3785         ant = bwn_ant2phy(antenna);
3786
3787         /* For ACK/CTS */
3788         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3789         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3790         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3791         /* For Probe Resposes */
3792         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3793         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3794         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3795 }
3796
3797 static void
3798 bwn_set_opmode(struct bwn_mac *mac)
3799 {
3800         struct bwn_softc *sc = mac->mac_sc;
3801         struct ieee80211com *ic = &sc->sc_ic;
3802         uint32_t ctl;
3803         uint16_t cfp_pretbtt;
3804
3805         ctl = BWN_READ_4(mac, BWN_MACCTL);
3806         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3807             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3808             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3809         ctl |= BWN_MACCTL_STA;
3810
3811         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3812             ic->ic_opmode == IEEE80211_M_MBSS)
3813                 ctl |= BWN_MACCTL_HOSTAP;
3814         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3815                 ctl &= ~BWN_MACCTL_STA;
3816         ctl |= sc->sc_filters;
3817
3818         if (bhnd_get_hwrev(sc->sc_dev) <= 4)
3819                 ctl |= BWN_MACCTL_PROMISC;
3820
3821         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3822
3823         cfp_pretbtt = 2;
3824         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3825                 if (sc->sc_cid.chip_id == BHND_CHIPID_BCM4306 &&
3826                     sc->sc_cid.chip_rev == 3)
3827                         cfp_pretbtt = 100;
3828                 else
3829                         cfp_pretbtt = 50;
3830         }
3831         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3832 }
3833
3834 static void
3835 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3836 {
3837         if (!error) {
3838                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3839                 *((bus_addr_t *)arg) = seg->ds_addr;
3840         }
3841 }
3842
3843 void
3844 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3845 {
3846         struct bwn_phy *phy = &mac->mac_phy;
3847         struct bwn_softc *sc = mac->mac_sc;
3848         unsigned int i, max_loop;
3849         uint16_t value;
3850         uint32_t buffer[5] = {
3851                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3852         };
3853
3854         if (ofdm) {
3855                 max_loop = 0x1e;
3856                 buffer[0] = 0x000201cc;
3857         } else {
3858                 max_loop = 0xfa;
3859                 buffer[0] = 0x000b846e;
3860         }
3861
3862         BWN_ASSERT_LOCKED(mac->mac_sc);
3863
3864         for (i = 0; i < 5; i++)
3865                 bwn_ram_write(mac, i * 4, buffer[i]);
3866
3867         BWN_WRITE_2(mac, 0x0568, 0x0000);
3868         BWN_WRITE_2(mac, 0x07c0,
3869             (bhnd_get_hwrev(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3870
3871         value = (ofdm ? 0x41 : 0x40);
3872         BWN_WRITE_2(mac, 0x050c, value);
3873
3874         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3875             phy->type == BWN_PHYTYPE_LCN)
3876                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3877         BWN_WRITE_2(mac, 0x0508, 0x0000);
3878         BWN_WRITE_2(mac, 0x050a, 0x0000);
3879         BWN_WRITE_2(mac, 0x054c, 0x0000);
3880         BWN_WRITE_2(mac, 0x056a, 0x0014);
3881         BWN_WRITE_2(mac, 0x0568, 0x0826);
3882         BWN_WRITE_2(mac, 0x0500, 0x0000);
3883
3884         /* XXX TODO: n phy pa override? */
3885
3886         switch (phy->type) {
3887         case BWN_PHYTYPE_N:
3888         case BWN_PHYTYPE_LCN:
3889                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
3890                 break;
3891         case BWN_PHYTYPE_LP:
3892                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3893                 break;
3894         default:
3895                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3896                 break;
3897         }
3898
3899         /* flush */
3900         BWN_READ_2(mac, 0x0502);
3901
3902         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3903                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3904         for (i = 0x00; i < max_loop; i++) {
3905                 value = BWN_READ_2(mac, 0x050e);
3906                 if (value & 0x0080)
3907                         break;
3908                 DELAY(10);
3909         }
3910         for (i = 0x00; i < 0x0a; i++) {
3911                 value = BWN_READ_2(mac, 0x050e);
3912                 if (value & 0x0400)
3913                         break;
3914                 DELAY(10);
3915         }
3916         for (i = 0x00; i < 0x19; i++) {
3917                 value = BWN_READ_2(mac, 0x0690);
3918                 if (!(value & 0x0100))
3919                         break;
3920                 DELAY(10);
3921         }
3922         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3923                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3924 }
3925
3926 void
3927 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3928 {
3929         uint32_t macctl;
3930
3931         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3932
3933         macctl = BWN_READ_4(mac, BWN_MACCTL);
3934         if (macctl & BWN_MACCTL_BIGENDIAN)
3935                 printf("TODO: need swap\n");
3936
3937         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3938         BWN_BARRIER(mac, BWN_RAM_CONTROL, 4, BUS_SPACE_BARRIER_WRITE);
3939         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3940 }
3941
3942 void
3943 bwn_mac_suspend(struct bwn_mac *mac)
3944 {
3945         struct bwn_softc *sc = mac->mac_sc;
3946         int i;
3947         uint32_t tmp;
3948
3949         KASSERT(mac->mac_suspended >= 0,
3950             ("%s:%d: fail", __func__, __LINE__));
3951
3952         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3953             __func__, mac->mac_suspended);
3954
3955         if (mac->mac_suspended == 0) {
3956                 bwn_psctl(mac, BWN_PS_AWAKE);
3957                 BWN_WRITE_4(mac, BWN_MACCTL,
3958                             BWN_READ_4(mac, BWN_MACCTL)
3959                             & ~BWN_MACCTL_ON);
3960                 BWN_READ_4(mac, BWN_MACCTL);
3961                 for (i = 35; i; i--) {
3962                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3963                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3964                                 goto out;
3965                         DELAY(10);
3966                 }
3967                 for (i = 40; i; i--) {
3968                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3969                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3970                                 goto out;
3971                         DELAY(1000);
3972                 }
3973                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3974         }
3975 out:
3976         mac->mac_suspended++;
3977 }
3978
3979 void
3980 bwn_mac_enable(struct bwn_mac *mac)
3981 {
3982         struct bwn_softc *sc = mac->mac_sc;
3983         uint16_t state;
3984
3985         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3986             __func__, mac->mac_suspended);
3987
3988         state = bwn_shm_read_2(mac, BWN_SHARED,
3989             BWN_SHARED_UCODESTAT);
3990         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3991             state != BWN_SHARED_UCODESTAT_SLEEP) {
3992                 DPRINTF(sc, BWN_DEBUG_FW,
3993                     "%s: warn: firmware state (%d)\n",
3994                     __func__, state);
3995         }
3996
3997         mac->mac_suspended--;
3998         KASSERT(mac->mac_suspended >= 0,
3999             ("%s:%d: fail", __func__, __LINE__));
4000         if (mac->mac_suspended == 0) {
4001                 BWN_WRITE_4(mac, BWN_MACCTL,
4002                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
4003                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
4004                 BWN_READ_4(mac, BWN_MACCTL);
4005                 BWN_READ_4(mac, BWN_INTR_REASON);
4006                 bwn_psctl(mac, 0);
4007         }
4008 }
4009
4010 void
4011 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
4012 {
4013         struct bwn_softc *sc = mac->mac_sc;
4014         int i;
4015         uint16_t ucstat;
4016
4017         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
4018             ("%s:%d: fail", __func__, __LINE__));
4019         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
4020             ("%s:%d: fail", __func__, __LINE__));
4021
4022         /* XXX forcibly awake and hwps-off */
4023
4024         BWN_WRITE_4(mac, BWN_MACCTL,
4025             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
4026             ~BWN_MACCTL_HWPS);
4027         BWN_READ_4(mac, BWN_MACCTL);
4028         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4029                 for (i = 0; i < 100; i++) {
4030                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
4031                             BWN_SHARED_UCODESTAT);
4032                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
4033                                 break;
4034                         DELAY(10);
4035                 }
4036         }
4037         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
4038             ucstat);
4039 }
4040
4041 static int
4042 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
4043 {
4044         struct bwn_softc *sc = mac->mac_sc;
4045         struct bwn_fw *fw = &mac->mac_fw;
4046         const uint8_t rev = bhnd_get_hwrev(sc->sc_dev);
4047         const char *filename;
4048         uint16_t iost;
4049         int error;
4050
4051         /* microcode */
4052         filename = NULL;
4053         switch (rev) {
4054         case 42:
4055                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4056                         filename = "ucode42";
4057                 break;
4058         case 40:
4059                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4060                         filename = "ucode40";
4061                 break;
4062         case 33:
4063                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
4064                         filename = "ucode33_lcn40";
4065                 break;
4066         case 30:
4067                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4068                         filename = "ucode30_mimo";
4069                 break;
4070         case 29:
4071                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4072                         filename = "ucode29_mimo";
4073                 break;
4074         case 26:
4075                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4076                         filename = "ucode26_mimo";
4077                 break;
4078         case 28:
4079         case 25:
4080                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4081                         filename = "ucode25_mimo";
4082                 else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4083                         filename = "ucode25_lcn";
4084                 break;
4085         case 24:
4086                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4087                         filename = "ucode24_lcn";
4088                 break;
4089         case 23:
4090                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4091                         filename = "ucode16_mimo";
4092                 break;
4093         case 16:
4094         case 17:
4095         case 18:
4096         case 19:
4097                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4098                         filename = "ucode16_mimo";
4099                 else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
4100                         filename = "ucode16_lp";
4101                 break;
4102         case 15:
4103                 filename = "ucode15";
4104                 break;
4105         case 14:
4106                 filename = "ucode14";
4107                 break;
4108         case 13:
4109                 filename = "ucode13";
4110                 break;
4111         case 12:
4112         case 11:
4113                 filename = "ucode11";
4114                 break;
4115         case 10:
4116         case 9:
4117         case 8:
4118         case 7:
4119         case 6:
4120         case 5:
4121                 filename = "ucode5";
4122                 break;
4123         default:
4124                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
4125                 bwn_release_firmware(mac);
4126                 return (EOPNOTSUPP);
4127         }
4128
4129         device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
4130         error = bwn_fw_get(mac, type, filename, &fw->ucode);
4131         if (error) {
4132                 bwn_release_firmware(mac);
4133                 return (error);
4134         }
4135
4136         /* PCM */
4137         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
4138         if (rev >= 5 && rev <= 10) {
4139                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
4140                 if (error == ENOENT)
4141                         fw->no_pcmfile = 1;
4142                 else if (error) {
4143                         bwn_release_firmware(mac);
4144                         return (error);
4145                 }
4146         } else if (rev < 11) {
4147                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
4148                 bwn_release_firmware(mac);
4149                 return (EOPNOTSUPP);
4150         }
4151
4152         /* initvals */
4153         error = bhnd_read_iost(sc->sc_dev, &iost);
4154         if (error)
4155                 goto fail1;
4156
4157         switch (mac->mac_phy.type) {
4158         case BWN_PHYTYPE_A:
4159                 if (rev < 5 || rev > 10)
4160                         goto fail1;
4161                 if (iost & BWN_IOST_HAVE_2GHZ)
4162                         filename = "a0g1initvals5";
4163                 else
4164                         filename = "a0g0initvals5";
4165                 break;
4166         case BWN_PHYTYPE_G:
4167                 if (rev >= 5 && rev <= 10)
4168                         filename = "b0g0initvals5";
4169                 else if (rev >= 13)
4170                         filename = "b0g0initvals13";
4171                 else
4172                         goto fail1;
4173                 break;
4174         case BWN_PHYTYPE_LP:
4175                 if (rev == 13)
4176                         filename = "lp0initvals13";
4177                 else if (rev == 14)
4178                         filename = "lp0initvals14";
4179                 else if (rev >= 15)
4180                         filename = "lp0initvals15";
4181                 else
4182                         goto fail1;
4183                 break;
4184         case BWN_PHYTYPE_N:
4185                 if (rev == 30)
4186                         filename = "n16initvals30";
4187                 else if (rev == 28 || rev == 25)
4188                         filename = "n0initvals25";
4189                 else if (rev == 24)
4190                         filename = "n0initvals24";
4191                 else if (rev == 23)
4192                         filename = "n0initvals16";
4193                 else if (rev >= 16 && rev <= 18)
4194                         filename = "n0initvals16";
4195                 else if (rev >= 11 && rev <= 12)
4196                         filename = "n0initvals11";
4197                 else
4198                         goto fail1;
4199                 break;
4200         default:
4201                 goto fail1;
4202         }
4203         error = bwn_fw_get(mac, type, filename, &fw->initvals);
4204         if (error) {
4205                 bwn_release_firmware(mac);
4206                 return (error);
4207         }
4208
4209         /* bandswitch initvals */
4210         switch (mac->mac_phy.type) {
4211         case BWN_PHYTYPE_A:
4212                 if (rev >= 5 && rev <= 10) {
4213                         if (iost & BWN_IOST_HAVE_2GHZ)
4214                                 filename = "a0g1bsinitvals5";
4215                         else
4216                                 filename = "a0g0bsinitvals5";
4217                 } else if (rev >= 11)
4218                         filename = NULL;
4219                 else
4220                         goto fail1;
4221                 break;
4222         case BWN_PHYTYPE_G:
4223                 if (rev >= 5 && rev <= 10)
4224                         filename = "b0g0bsinitvals5";
4225                 else if (rev >= 11)
4226                         filename = NULL;
4227                 else
4228                         goto fail1;
4229                 break;
4230         case BWN_PHYTYPE_LP:
4231                 if (rev == 13)
4232                         filename = "lp0bsinitvals13";
4233                 else if (rev == 14)
4234                         filename = "lp0bsinitvals14";
4235                 else if (rev >= 15)
4236                         filename = "lp0bsinitvals15";
4237                 else
4238                         goto fail1;
4239                 break;
4240         case BWN_PHYTYPE_N:
4241                 if (rev == 30)
4242                         filename = "n16bsinitvals30";
4243                 else if (rev == 28 || rev == 25)
4244                         filename = "n0bsinitvals25";
4245                 else if (rev == 24)
4246                         filename = "n0bsinitvals24";
4247                 else if (rev == 23)
4248                         filename = "n0bsinitvals16";
4249                 else if (rev >= 16 && rev <= 18)
4250                         filename = "n0bsinitvals16";
4251                 else if (rev >= 11 && rev <= 12)
4252                         filename = "n0bsinitvals11";
4253                 else
4254                         goto fail1;
4255                 break;
4256         default:
4257                 device_printf(sc->sc_dev, "unknown phy (%d)\n",
4258                     mac->mac_phy.type);
4259                 goto fail1;
4260         }
4261         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4262         if (error) {
4263                 bwn_release_firmware(mac);
4264                 return (error);
4265         }
4266         return (0);
4267 fail1:
4268         device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4269             rev, mac->mac_phy.type);
4270         bwn_release_firmware(mac);
4271         return (EOPNOTSUPP);
4272 }
4273
4274 static int
4275 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4276     const char *name, struct bwn_fwfile *bfw)
4277 {
4278         const struct bwn_fwhdr *hdr;
4279         struct bwn_softc *sc = mac->mac_sc;
4280         const struct firmware *fw;
4281         char namebuf[64];
4282
4283         if (name == NULL) {
4284                 bwn_do_release_fw(bfw);
4285                 return (0);
4286         }
4287         if (bfw->filename != NULL) {
4288                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4289                         return (0);
4290                 bwn_do_release_fw(bfw);
4291         }
4292
4293         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4294             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4295             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4296         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
4297         fw = firmware_get(namebuf);
4298         if (fw == NULL) {
4299                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4300                     namebuf);
4301                 return (ENOENT);
4302         }
4303         if (fw->datasize < sizeof(struct bwn_fwhdr))
4304                 goto fail;
4305         hdr = (const struct bwn_fwhdr *)(fw->data);
4306         switch (hdr->type) {
4307         case BWN_FWTYPE_UCODE:
4308         case BWN_FWTYPE_PCM:
4309                 if (be32toh(hdr->size) !=
4310                     (fw->datasize - sizeof(struct bwn_fwhdr)))
4311                         goto fail;
4312                 /* FALLTHROUGH */
4313         case BWN_FWTYPE_IV:
4314                 if (hdr->ver != 1)
4315                         goto fail;
4316                 break;
4317         default:
4318                 goto fail;
4319         }
4320         bfw->filename = name;
4321         bfw->fw = fw;
4322         bfw->type = type;
4323         return (0);
4324 fail:
4325         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4326         if (fw != NULL)
4327                 firmware_put(fw, FIRMWARE_UNLOAD);
4328         return (EPROTO);
4329 }
4330
4331 static void
4332 bwn_release_firmware(struct bwn_mac *mac)
4333 {
4334
4335         bwn_do_release_fw(&mac->mac_fw.ucode);
4336         bwn_do_release_fw(&mac->mac_fw.pcm);
4337         bwn_do_release_fw(&mac->mac_fw.initvals);
4338         bwn_do_release_fw(&mac->mac_fw.initvals_band);
4339 }
4340
4341 static void
4342 bwn_do_release_fw(struct bwn_fwfile *bfw)
4343 {
4344
4345         if (bfw->fw != NULL)
4346                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4347         bfw->fw = NULL;
4348         bfw->filename = NULL;
4349 }
4350
4351 static int
4352 bwn_fw_loaducode(struct bwn_mac *mac)
4353 {
4354 #define GETFWOFFSET(fwp, offset)        \
4355         ((const uint32_t *)((const char *)fwp.fw->data + offset))
4356 #define GETFWSIZE(fwp, offset)  \
4357         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
4358         struct bwn_softc *sc = mac->mac_sc;
4359         const uint32_t *data;
4360         unsigned int i;
4361         uint32_t ctl;
4362         uint16_t date, fwcaps, time;
4363         int error = 0;
4364
4365         ctl = BWN_READ_4(mac, BWN_MACCTL);
4366         ctl |= BWN_MACCTL_MCODE_JMP0;
4367         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4368             __LINE__));
4369         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4370         for (i = 0; i < 64; i++)
4371                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4372         for (i = 0; i < 4096; i += 2)
4373                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4374
4375         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4376         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4377         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4378              i++) {
4379                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4380                 DELAY(10);
4381         }
4382
4383         if (mac->mac_fw.pcm.fw) {
4384                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4385                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4386                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4387                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4388                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4389                     sizeof(struct bwn_fwhdr)); i++) {
4390                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4391                         DELAY(10);
4392                 }
4393         }
4394
4395         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4396         BWN_WRITE_4(mac, BWN_MACCTL,
4397             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4398             BWN_MACCTL_MCODE_RUN);
4399
4400         for (i = 0; i < 21; i++) {
4401                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4402                         break;
4403                 if (i >= 20) {
4404                         device_printf(sc->sc_dev, "ucode timeout\n");
4405                         error = ENXIO;
4406                         goto error;
4407                 }
4408                 DELAY(50000);
4409         }
4410         BWN_READ_4(mac, BWN_INTR_REASON);
4411
4412         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4413         if (mac->mac_fw.rev <= 0x128) {
4414                 device_printf(sc->sc_dev, "the firmware is too old\n");
4415                 error = EOPNOTSUPP;
4416                 goto error;
4417         }
4418
4419         /*
4420          * Determine firmware header version; needed for TX/RX packet
4421          * handling.
4422          */
4423         if (mac->mac_fw.rev >= 598)
4424                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4425         else if (mac->mac_fw.rev >= 410)
4426                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4427         else
4428                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4429
4430         /*
4431          * We don't support rev 598 or later; that requires
4432          * another round of changes to the TX/RX descriptor
4433          * and status layout.
4434          *
4435          * So, complain this is the case and exit out, rather
4436          * than attaching and then failing.
4437          */
4438 #if 0
4439         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4440                 device_printf(sc->sc_dev,
4441                     "firmware is too new (>=598); not supported\n");
4442                 error = EOPNOTSUPP;
4443                 goto error;
4444         }
4445 #endif
4446
4447         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4448             BWN_SHARED_UCODE_PATCH);
4449         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4450         mac->mac_fw.opensource = (date == 0xffff);
4451         if (bwn_wme != 0)
4452                 mac->mac_flags |= BWN_MAC_FLAG_WME;
4453         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4454
4455         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4456         if (mac->mac_fw.opensource == 0) {
4457                 device_printf(sc->sc_dev,
4458                     "firmware version (rev %u patch %u date %#x time %#x)\n",
4459                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4460                 if (mac->mac_fw.no_pcmfile)
4461                         device_printf(sc->sc_dev,
4462                             "no HW crypto acceleration due to pcm5\n");
4463         } else {
4464                 mac->mac_fw.patch = time;
4465                 fwcaps = bwn_fwcaps_read(mac);
4466                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4467                         device_printf(sc->sc_dev,
4468                             "disabling HW crypto acceleration\n");
4469                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4470                 }
4471                 if (!(fwcaps & BWN_FWCAPS_WME)) {
4472                         device_printf(sc->sc_dev, "disabling WME support\n");
4473                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4474                 }
4475         }
4476
4477         if (BWN_ISOLDFMT(mac))
4478                 device_printf(sc->sc_dev, "using old firmware image\n");
4479
4480         return (0);
4481
4482 error:
4483         BWN_WRITE_4(mac, BWN_MACCTL,
4484             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4485             BWN_MACCTL_MCODE_JMP0);
4486
4487         return (error);
4488 #undef GETFWSIZE
4489 #undef GETFWOFFSET
4490 }
4491
4492 /* OpenFirmware only */
4493 static uint16_t
4494 bwn_fwcaps_read(struct bwn_mac *mac)
4495 {
4496
4497         KASSERT(mac->mac_fw.opensource == 1,
4498             ("%s:%d: fail", __func__, __LINE__));
4499         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4500 }
4501
4502 static int
4503 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4504     size_t count, size_t array_size)
4505 {
4506 #define GET_NEXTIV16(iv)                                                \
4507         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4508             sizeof(uint16_t) + sizeof(uint16_t)))
4509 #define GET_NEXTIV32(iv)                                                \
4510         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4511             sizeof(uint16_t) + sizeof(uint32_t)))
4512         struct bwn_softc *sc = mac->mac_sc;
4513         const struct bwn_fwinitvals *iv;
4514         uint16_t offset;
4515         size_t i;
4516         uint8_t bit32;
4517
4518         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4519             ("%s:%d: fail", __func__, __LINE__));
4520         iv = ivals;
4521         for (i = 0; i < count; i++) {
4522                 if (array_size < sizeof(iv->offset_size))
4523                         goto fail;
4524                 array_size -= sizeof(iv->offset_size);
4525                 offset = be16toh(iv->offset_size);
4526                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4527                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4528                 if (offset >= 0x1000)
4529                         goto fail;
4530                 if (bit32) {
4531                         if (array_size < sizeof(iv->data.d32))
4532                                 goto fail;
4533                         array_size -= sizeof(iv->data.d32);
4534                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4535                         iv = GET_NEXTIV32(iv);
4536                 } else {
4537
4538                         if (array_size < sizeof(iv->data.d16))
4539                                 goto fail;
4540                         array_size -= sizeof(iv->data.d16);
4541                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4542
4543                         iv = GET_NEXTIV16(iv);
4544                 }
4545         }
4546         if (array_size != 0)
4547                 goto fail;
4548         return (0);
4549 fail:
4550         device_printf(sc->sc_dev, "initvals: invalid format\n");
4551         return (EPROTO);
4552 #undef GET_NEXTIV16
4553 #undef GET_NEXTIV32
4554 }
4555
4556 int
4557 bwn_switch_channel(struct bwn_mac *mac, int chan)
4558 {
4559         struct bwn_phy *phy = &(mac->mac_phy);
4560         struct bwn_softc *sc = mac->mac_sc;
4561         struct ieee80211com *ic = &sc->sc_ic;
4562         uint16_t channelcookie, savedcookie;
4563         int error;
4564
4565         if (chan == 0xffff)
4566                 chan = phy->get_default_chan(mac);
4567
4568         channelcookie = chan;
4569         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4570                 channelcookie |= 0x100;
4571         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4572         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4573         error = phy->switch_channel(mac, chan);
4574         if (error)
4575                 goto fail;
4576
4577         mac->mac_phy.chan = chan;
4578         DELAY(8000);
4579         return (0);
4580 fail:
4581         device_printf(sc->sc_dev, "failed to switch channel\n");
4582         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4583         return (error);
4584 }
4585
4586 static uint16_t
4587 bwn_ant2phy(int antenna)
4588 {
4589
4590         switch (antenna) {
4591         case BWN_ANT0:
4592                 return (BWN_TX_PHY_ANT0);
4593         case BWN_ANT1:
4594                 return (BWN_TX_PHY_ANT1);
4595         case BWN_ANT2:
4596                 return (BWN_TX_PHY_ANT2);
4597         case BWN_ANT3:
4598                 return (BWN_TX_PHY_ANT3);
4599         case BWN_ANTAUTO:
4600                 return (BWN_TX_PHY_ANT01AUTO);
4601         }
4602         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4603         return (0);
4604 }
4605
4606 static void
4607 bwn_wme_load(struct bwn_mac *mac)
4608 {
4609         struct bwn_softc *sc = mac->mac_sc;
4610         int i;
4611
4612         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4613             ("%s:%d: fail", __func__, __LINE__));
4614
4615         bwn_mac_suspend(mac);
4616         for (i = 0; i < N(sc->sc_wmeParams); i++)
4617                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4618                     bwn_wme_shm_offsets[i]);
4619         bwn_mac_enable(mac);
4620 }
4621
4622 static void
4623 bwn_wme_loadparams(struct bwn_mac *mac,
4624     const struct wmeParams *p, uint16_t shm_offset)
4625 {
4626 #define SM(_v, _f)      (((_v) << _f##_S) & _f)
4627         struct bwn_softc *sc = mac->mac_sc;
4628         uint16_t params[BWN_NR_WMEPARAMS];
4629         int slot, tmp;
4630         unsigned int i;
4631
4632         slot = BWN_READ_2(mac, BWN_RNG) &
4633             SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4634
4635         memset(&params, 0, sizeof(params));
4636
4637         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4638             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4639             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4640
4641         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4642         params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4643         params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4644         params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4645         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4646         params[BWN_WMEPARAM_BSLOTS] = slot;
4647         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4648
4649         for (i = 0; i < N(params); i++) {
4650                 if (i == BWN_WMEPARAM_STATUS) {
4651                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4652                             shm_offset + (i * 2));
4653                         tmp |= 0x100;
4654                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4655                             tmp);
4656                 } else {
4657                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4658                             params[i]);
4659                 }
4660         }
4661 }
4662
4663 static void
4664 bwn_mac_write_bssid(struct bwn_mac *mac)
4665 {
4666         struct bwn_softc *sc = mac->mac_sc;
4667         uint32_t tmp;
4668         int i;
4669         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4670
4671         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4672         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4673         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4674             IEEE80211_ADDR_LEN);
4675
4676         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4677                 tmp = (uint32_t) (mac_bssid[i + 0]);
4678                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4679                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4680                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4681                 bwn_ram_write(mac, 0x20 + i, tmp);
4682         }
4683 }
4684
4685 static void
4686 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4687     const uint8_t *macaddr)
4688 {
4689         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4690         uint16_t data;
4691
4692         if (!mac)
4693                 macaddr = zero;
4694
4695         offset |= 0x0020;
4696         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4697
4698         data = macaddr[0];
4699         data |= macaddr[1] << 8;
4700         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4701         data = macaddr[2];
4702         data |= macaddr[3] << 8;
4703         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4704         data = macaddr[4];
4705         data |= macaddr[5] << 8;
4706         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4707 }
4708
4709 static void
4710 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4711     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4712 {
4713         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4714         uint8_t per_sta_keys_start = 8;
4715
4716         if (BWN_SEC_NEWAPI(mac))
4717                 per_sta_keys_start = 4;
4718
4719         KASSERT(index < mac->mac_max_nr_keys,
4720             ("%s:%d: fail", __func__, __LINE__));
4721         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4722             ("%s:%d: fail", __func__, __LINE__));
4723
4724         if (index >= per_sta_keys_start)
4725                 bwn_key_macwrite(mac, index, NULL);
4726         if (key)
4727                 memcpy(buf, key, key_len);
4728         bwn_key_write(mac, index, algorithm, buf);
4729         if (index >= per_sta_keys_start)
4730                 bwn_key_macwrite(mac, index, mac_addr);
4731
4732         mac->mac_key[index].algorithm = algorithm;
4733 }
4734
4735 static void
4736 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4737 {
4738         struct bwn_softc *sc = mac->mac_sc;
4739         uint32_t addrtmp[2] = { 0, 0 };
4740         uint8_t start = 8;
4741
4742         if (BWN_SEC_NEWAPI(mac))
4743                 start = 4;
4744
4745         KASSERT(index >= start,
4746             ("%s:%d: fail", __func__, __LINE__));
4747         index -= start;
4748
4749         if (addr) {
4750                 addrtmp[0] = addr[0];
4751                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4752                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4753                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4754                 addrtmp[1] = addr[4];
4755                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4756         }
4757
4758         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4759                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4760                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4761         } else {
4762                 if (index >= 8) {
4763                         bwn_shm_write_4(mac, BWN_SHARED,
4764                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4765                         bwn_shm_write_2(mac, BWN_SHARED,
4766                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4767                 }
4768         }
4769 }
4770
4771 static void
4772 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4773     const uint8_t *key)
4774 {
4775         unsigned int i;
4776         uint32_t offset;
4777         uint16_t kidx, value;
4778
4779         kidx = BWN_SEC_KEY2FW(mac, index);
4780         bwn_shm_write_2(mac, BWN_SHARED,
4781             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4782
4783         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4784         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4785                 value = key[i];
4786                 value |= (uint16_t)(key[i + 1]) << 8;
4787                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4788         }
4789 }
4790
4791 static void
4792 bwn_phy_exit(struct bwn_mac *mac)
4793 {
4794
4795         mac->mac_phy.rf_onoff(mac, 0);
4796         if (mac->mac_phy.exit != NULL)
4797                 mac->mac_phy.exit(mac);
4798 }
4799
4800 static void
4801 bwn_dma_free(struct bwn_mac *mac)
4802 {
4803         struct bwn_dma *dma;
4804
4805         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4806                 return;
4807         dma = &mac->mac_method.dma;
4808
4809         bwn_dma_ringfree(&dma->rx);
4810         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4811         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4812         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4813         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4814         bwn_dma_ringfree(&dma->mcast);
4815 }
4816
4817 static void
4818 bwn_core_stop(struct bwn_mac *mac)
4819 {
4820         struct bwn_softc *sc = mac->mac_sc;
4821
4822         BWN_ASSERT_LOCKED(sc);
4823
4824         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4825                 return;
4826
4827         callout_stop(&sc->sc_rfswitch_ch);
4828         callout_stop(&sc->sc_task_ch);
4829         callout_stop(&sc->sc_watchdog_ch);
4830         sc->sc_watchdog_timer = 0;
4831         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4832         BWN_READ_4(mac, BWN_INTR_MASK);
4833         bwn_mac_suspend(mac);
4834
4835         mac->mac_status = BWN_MAC_STATUS_INITED;
4836 }
4837
4838 static int
4839 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4840 {
4841         struct bwn_mac *up_dev = NULL;
4842         struct bwn_mac *down_dev;
4843         struct bwn_mac *mac;
4844         int err, status;
4845         uint8_t gmode;
4846
4847         BWN_ASSERT_LOCKED(sc);
4848
4849         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4850                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4851                     mac->mac_phy.supports_2ghz) {
4852                         up_dev = mac;
4853                         gmode = 1;
4854                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4855                     mac->mac_phy.supports_5ghz) {
4856                         up_dev = mac;
4857                         gmode = 0;
4858                 } else {
4859                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4860                         return (EINVAL);
4861                 }
4862                 if (up_dev != NULL)
4863                         break;
4864         }
4865         if (up_dev == NULL) {
4866                 device_printf(sc->sc_dev, "Could not find a device\n");
4867                 return (ENODEV);
4868         }
4869         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4870                 return (0);
4871
4872         DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4873             "switching to %s-GHz band\n",
4874             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4875
4876         down_dev = sc->sc_curmac;
4877         status = down_dev->mac_status;
4878         if (status >= BWN_MAC_STATUS_STARTED)
4879                 bwn_core_stop(down_dev);
4880         if (status >= BWN_MAC_STATUS_INITED)
4881                 bwn_core_exit(down_dev);
4882
4883         if (down_dev != up_dev) {
4884                 err = bwn_phy_reset(down_dev);
4885                 if (err)
4886                         goto fail;
4887         }
4888
4889         up_dev->mac_phy.gmode = gmode;
4890         if (status >= BWN_MAC_STATUS_INITED) {
4891                 err = bwn_core_init(up_dev);
4892                 if (err) {
4893                         device_printf(sc->sc_dev,
4894                             "fatal: failed to initialize for %s-GHz\n",
4895                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4896                         goto fail;
4897                 }
4898         }
4899         if (status >= BWN_MAC_STATUS_STARTED)
4900                 bwn_core_start(up_dev);
4901         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4902         sc->sc_curmac = up_dev;
4903
4904         return (0);
4905 fail:
4906         sc->sc_curmac = NULL;
4907         return (err);
4908 }
4909
4910 static void
4911 bwn_rf_turnon(struct bwn_mac *mac)
4912 {
4913
4914         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4915
4916         bwn_mac_suspend(mac);
4917         mac->mac_phy.rf_onoff(mac, 1);
4918         mac->mac_phy.rf_on = 1;
4919         bwn_mac_enable(mac);
4920 }
4921
4922 static void
4923 bwn_rf_turnoff(struct bwn_mac *mac)
4924 {
4925
4926         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4927
4928         bwn_mac_suspend(mac);
4929         mac->mac_phy.rf_onoff(mac, 0);
4930         mac->mac_phy.rf_on = 0;
4931         bwn_mac_enable(mac);
4932 }
4933
4934 /*
4935  * PHY reset.
4936  */
4937 static int
4938 bwn_phy_reset(struct bwn_mac *mac)
4939 {
4940         struct bwn_softc        *sc;
4941         uint16_t                 iost, mask;
4942         int                      error;
4943
4944         sc = mac->mac_sc;
4945
4946         iost = BWN_IOCTL_PHYRESET | BHND_IOCTL_CLK_FORCE;
4947         mask = iost | BWN_IOCTL_SUPPORT_G;
4948
4949         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4950                 return (error);
4951
4952         DELAY(1000);
4953
4954         iost &= ~BHND_IOCTL_CLK_FORCE;
4955
4956         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4957                 return (error);
4958
4959         DELAY(1000);
4960
4961         return (0);
4962 }
4963
4964 static int
4965 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4966 {
4967         struct bwn_vap *bvp = BWN_VAP(vap);
4968         struct ieee80211com *ic= vap->iv_ic;
4969         enum ieee80211_state ostate = vap->iv_state;
4970         struct bwn_softc *sc = ic->ic_softc;
4971         struct bwn_mac *mac = sc->sc_curmac;
4972         int error;
4973
4974         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4975             ieee80211_state_name[vap->iv_state],
4976             ieee80211_state_name[nstate]);
4977
4978         error = bvp->bv_newstate(vap, nstate, arg);
4979         if (error != 0)
4980                 return (error);
4981
4982         BWN_LOCK(sc);
4983
4984         bwn_led_newstate(mac, nstate);
4985
4986         /*
4987          * Clear the BSSID when we stop a STA
4988          */
4989         if (vap->iv_opmode == IEEE80211_M_STA) {
4990                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4991                         /*
4992                          * Clear out the BSSID.  If we reassociate to
4993                          * the same AP, this will reinialize things
4994                          * correctly...
4995                          */
4996                         if (ic->ic_opmode == IEEE80211_M_STA &&
4997                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4998                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4999                                 bwn_set_macaddr(mac);
5000                         }
5001                 }
5002         }
5003
5004         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
5005             vap->iv_opmode == IEEE80211_M_AHDEMO) {
5006                 /* XXX nothing to do? */
5007         } else if (nstate == IEEE80211_S_RUN) {
5008                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
5009                 bwn_set_opmode(mac);
5010                 bwn_set_pretbtt(mac);
5011                 bwn_spu_setdelay(mac, 0);
5012                 bwn_set_macaddr(mac);
5013         }
5014
5015         BWN_UNLOCK(sc);
5016
5017         return (error);
5018 }
5019
5020 static void
5021 bwn_set_pretbtt(struct bwn_mac *mac)
5022 {
5023         struct bwn_softc *sc = mac->mac_sc;
5024         struct ieee80211com *ic = &sc->sc_ic;
5025         uint16_t pretbtt;
5026
5027         if (ic->ic_opmode == IEEE80211_M_IBSS)
5028                 pretbtt = 2;
5029         else
5030                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
5031         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
5032         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
5033 }
5034
5035 static int
5036 bwn_intr(void *arg)
5037 {
5038         struct bwn_mac *mac = arg;
5039         struct bwn_softc *sc = mac->mac_sc;
5040         uint32_t reason;
5041
5042         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5043             (sc->sc_flags & BWN_FLAG_INVALID))
5044                 return (FILTER_STRAY);
5045
5046         DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
5047
5048         reason = BWN_READ_4(mac, BWN_INTR_REASON);
5049         if (reason == 0xffffffff)       /* shared IRQ */
5050                 return (FILTER_STRAY);
5051         reason &= mac->mac_intr_mask;
5052         if (reason == 0)
5053                 return (FILTER_HANDLED);
5054         DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
5055
5056         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
5057         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
5058         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
5059         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
5060         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
5061         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
5062         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
5063         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
5064         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
5065         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
5066         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
5067
5068         /* Disable interrupts. */
5069         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
5070
5071         mac->mac_reason_intr = reason;
5072
5073         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5074
5075         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
5076         return (FILTER_HANDLED);
5077 }
5078
5079 static void
5080 bwn_intrtask(void *arg, int npending)
5081 {
5082         struct bwn_mac *mac = arg;
5083         struct bwn_softc *sc = mac->mac_sc;
5084         uint32_t merged = 0;
5085         int i, tx = 0, rx = 0;
5086
5087         BWN_LOCK(sc);
5088         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5089             (sc->sc_flags & BWN_FLAG_INVALID)) {
5090                 BWN_UNLOCK(sc);
5091                 return;
5092         }
5093
5094         for (i = 0; i < N(mac->mac_reason); i++)
5095                 merged |= mac->mac_reason[i];
5096
5097         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
5098                 device_printf(sc->sc_dev, "MAC trans error\n");
5099
5100         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
5101                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
5102                 mac->mac_phy.txerrors--;
5103                 if (mac->mac_phy.txerrors == 0) {
5104                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
5105                         bwn_restart(mac, "PHY TX errors");
5106                 }
5107         }
5108
5109         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
5110                 if (merged & BWN_DMAINTR_FATALMASK) {
5111                         device_printf(sc->sc_dev,
5112                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
5113                             mac->mac_reason[0], mac->mac_reason[1],
5114                             mac->mac_reason[2], mac->mac_reason[3],
5115                             mac->mac_reason[4], mac->mac_reason[5]);
5116                         bwn_restart(mac, "DMA error");
5117                         BWN_UNLOCK(sc);
5118                         return;
5119                 }
5120                 if (merged & BWN_DMAINTR_NONFATALMASK) {
5121                         device_printf(sc->sc_dev,
5122                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
5123                             mac->mac_reason[0], mac->mac_reason[1],
5124                             mac->mac_reason[2], mac->mac_reason[3],
5125                             mac->mac_reason[4], mac->mac_reason[5]);
5126                 }
5127         }
5128
5129         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
5130                 bwn_intr_ucode_debug(mac);
5131         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
5132                 bwn_intr_tbtt_indication(mac);
5133         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
5134                 bwn_intr_atim_end(mac);
5135         if (mac->mac_reason_intr & BWN_INTR_BEACON)
5136                 bwn_intr_beacon(mac);
5137         if (mac->mac_reason_intr & BWN_INTR_PMQ)
5138                 bwn_intr_pmq(mac);
5139         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
5140                 bwn_intr_noise(mac);
5141
5142         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5143                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
5144                         bwn_dma_rx(mac->mac_method.dma.rx);
5145                         rx = 1;
5146                 }
5147         } else
5148                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
5149
5150         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5151         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5152         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5153         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5154         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5155
5156         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
5157                 bwn_intr_txeof(mac);
5158                 tx = 1;
5159         }
5160
5161         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
5162
5163         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
5164                 int evt = BWN_LED_EVENT_NONE;
5165
5166                 if (tx && rx) {
5167                         if (sc->sc_rx_rate > sc->sc_tx_rate)
5168                                 evt = BWN_LED_EVENT_RX;
5169                         else
5170                                 evt = BWN_LED_EVENT_TX;
5171                 } else if (tx) {
5172                         evt = BWN_LED_EVENT_TX;
5173                 } else if (rx) {
5174                         evt = BWN_LED_EVENT_RX;
5175                 } else if (rx == 0) {
5176                         evt = BWN_LED_EVENT_POLL;
5177                 }
5178
5179                 if (evt != BWN_LED_EVENT_NONE)
5180                         bwn_led_event(mac, evt);
5181        }
5182
5183         if (mbufq_first(&sc->sc_snd) != NULL)
5184                 bwn_start(sc);
5185
5186         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5187
5188         BWN_UNLOCK(sc);
5189 }
5190
5191 static void
5192 bwn_restart(struct bwn_mac *mac, const char *msg)
5193 {
5194         struct bwn_softc *sc = mac->mac_sc;
5195         struct ieee80211com *ic = &sc->sc_ic;
5196
5197         if (mac->mac_status < BWN_MAC_STATUS_INITED)
5198                 return;
5199
5200         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
5201         ieee80211_runtask(ic, &mac->mac_hwreset);
5202 }
5203
5204 static void
5205 bwn_intr_ucode_debug(struct bwn_mac *mac)
5206 {
5207         struct bwn_softc *sc = mac->mac_sc;
5208         uint16_t reason;
5209
5210         if (mac->mac_fw.opensource == 0)
5211                 return;
5212
5213         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
5214         switch (reason) {
5215         case BWN_DEBUGINTR_PANIC:
5216                 bwn_handle_fwpanic(mac);
5217                 break;
5218         case BWN_DEBUGINTR_DUMP_SHM:
5219                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5220                 break;
5221         case BWN_DEBUGINTR_DUMP_REGS:
5222                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5223                 break;
5224         case BWN_DEBUGINTR_MARKER:
5225                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5226                 break;
5227         default:
5228                 device_printf(sc->sc_dev,
5229                     "ucode debug unknown reason: %#x\n", reason);
5230         }
5231
5232         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5233             BWN_DEBUGINTR_ACK);
5234 }
5235
5236 static void
5237 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5238 {
5239         struct bwn_softc *sc = mac->mac_sc;
5240         struct ieee80211com *ic = &sc->sc_ic;
5241
5242         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5243                 bwn_psctl(mac, 0);
5244         if (ic->ic_opmode == IEEE80211_M_IBSS)
5245                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5246 }
5247
5248 static void
5249 bwn_intr_atim_end(struct bwn_mac *mac)
5250 {
5251
5252         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5253                 BWN_WRITE_4(mac, BWN_MACCMD,
5254                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5255                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5256         }
5257 }
5258
5259 static void
5260 bwn_intr_beacon(struct bwn_mac *mac)
5261 {
5262         struct bwn_softc *sc = mac->mac_sc;
5263         struct ieee80211com *ic = &sc->sc_ic;
5264         uint32_t cmd, beacon0, beacon1;
5265
5266         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5267             ic->ic_opmode == IEEE80211_M_MBSS)
5268                 return;
5269
5270         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5271
5272         cmd = BWN_READ_4(mac, BWN_MACCMD);
5273         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5274         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5275
5276         if (beacon0 && beacon1) {
5277                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5278                 mac->mac_intr_mask |= BWN_INTR_BEACON;
5279                 return;
5280         }
5281
5282         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5283                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5284                 bwn_load_beacon0(mac);
5285                 bwn_load_beacon1(mac);
5286                 cmd = BWN_READ_4(mac, BWN_MACCMD);
5287                 cmd |= BWN_MACCMD_BEACON0_VALID;
5288                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5289         } else {
5290                 if (!beacon0) {
5291                         bwn_load_beacon0(mac);
5292                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5293                         cmd |= BWN_MACCMD_BEACON0_VALID;
5294                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5295                 } else if (!beacon1) {
5296                         bwn_load_beacon1(mac);
5297                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5298                         cmd |= BWN_MACCMD_BEACON1_VALID;
5299                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5300                 }
5301         }
5302 }
5303
5304 static void
5305 bwn_intr_pmq(struct bwn_mac *mac)
5306 {
5307         uint32_t tmp;
5308
5309         while (1) {
5310                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5311                 if (!(tmp & 0x00000008))
5312                         break;
5313         }
5314         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5315 }
5316
5317 static void
5318 bwn_intr_noise(struct bwn_mac *mac)
5319 {
5320         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5321         uint16_t tmp;
5322         uint8_t noise[4];
5323         uint8_t i, j;
5324         int32_t average;
5325
5326         if (mac->mac_phy.type != BWN_PHYTYPE_G)
5327                 return;
5328
5329         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5330         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5331         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5332             noise[3] == 0x7f)
5333                 goto new;
5334
5335         KASSERT(mac->mac_noise.noi_nsamples < 8,
5336             ("%s:%d: fail", __func__, __LINE__));
5337         i = mac->mac_noise.noi_nsamples;
5338         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5339         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5340         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5341         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5342         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5343         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5344         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5345         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5346         mac->mac_noise.noi_nsamples++;
5347         if (mac->mac_noise.noi_nsamples == 8) {
5348                 average = 0;
5349                 for (i = 0; i < 8; i++) {
5350                         for (j = 0; j < 4; j++)
5351                                 average += mac->mac_noise.noi_samples[i][j];
5352                 }
5353                 average = (((average / 32) * 125) + 64) / 128;
5354                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5355                 if (tmp >= 8)
5356                         average += 2;
5357                 else
5358                         average -= 25;
5359                 average -= (tmp == 8) ? 72 : 48;
5360
5361                 mac->mac_stats.link_noise = average;
5362                 mac->mac_noise.noi_running = 0;
5363                 return;
5364         }
5365 new:
5366         bwn_noise_gensample(mac);
5367 }
5368
5369 static int
5370 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5371 {
5372         struct bwn_mac *mac = prq->prq_mac;
5373         struct bwn_softc *sc = mac->mac_sc;
5374         unsigned int i;
5375
5376         BWN_ASSERT_LOCKED(sc);
5377
5378         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5379                 return (0);
5380
5381         for (i = 0; i < 5000; i++) {
5382                 if (bwn_pio_rxeof(prq) == 0)
5383                         break;
5384         }
5385         if (i >= 5000)
5386                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5387         return ((i > 0) ? 1 : 0);
5388 }
5389
5390 static void
5391 bwn_dma_rx(struct bwn_dma_ring *dr)
5392 {
5393         int slot, curslot;
5394
5395         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5396         curslot = dr->get_curslot(dr);
5397         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5398             ("%s:%d: fail", __func__, __LINE__));
5399
5400         slot = dr->dr_curslot;
5401         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5402                 bwn_dma_rxeof(dr, &slot);
5403
5404         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5405             BUS_DMASYNC_PREWRITE);
5406
5407         dr->set_curslot(dr, slot);
5408         dr->dr_curslot = slot;
5409 }
5410
5411 static void
5412 bwn_intr_txeof(struct bwn_mac *mac)
5413 {
5414         struct bwn_txstatus stat;
5415         uint32_t stat0, stat1;
5416         uint16_t tmp;
5417
5418         BWN_ASSERT_LOCKED(mac->mac_sc);
5419
5420         while (1) {
5421                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5422                 if (!(stat0 & 0x00000001))
5423                         break;
5424                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5425
5426                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5427                     "%s: stat0=0x%08x, stat1=0x%08x\n",
5428                     __func__,
5429                     stat0,
5430                     stat1);
5431
5432                 stat.cookie = (stat0 >> 16);
5433                 stat.seq = (stat1 & 0x0000ffff);
5434                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5435                 tmp = (stat0 & 0x0000ffff);
5436                 stat.framecnt = ((tmp & 0xf000) >> 12);
5437                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
5438                 stat.sreason = ((tmp & 0x001c) >> 2);
5439                 stat.pm = (tmp & 0x0080) ? 1 : 0;
5440                 stat.im = (tmp & 0x0040) ? 1 : 0;
5441                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5442                 stat.ack = (tmp & 0x0002) ? 1 : 0;
5443
5444                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5445                     "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5446                     "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5447                     __func__,
5448                     stat.cookie,
5449                     stat.seq,
5450                     stat.phy_stat,
5451                     stat.framecnt,
5452                     stat.rtscnt,
5453                     stat.sreason,
5454                     stat.pm,
5455                     stat.im,
5456                     stat.ampdu,
5457                     stat.ack);
5458
5459                 bwn_handle_txeof(mac, &stat);
5460         }
5461 }
5462
5463 static void
5464 bwn_hwreset(void *arg, int npending)
5465 {
5466         struct bwn_mac *mac = arg;
5467         struct bwn_softc *sc = mac->mac_sc;
5468         int error = 0;
5469         int prev_status;
5470
5471         BWN_LOCK(sc);
5472
5473         prev_status = mac->mac_status;
5474         if (prev_status >= BWN_MAC_STATUS_STARTED)
5475                 bwn_core_stop(mac);
5476         if (prev_status >= BWN_MAC_STATUS_INITED)
5477                 bwn_core_exit(mac);
5478
5479         if (prev_status >= BWN_MAC_STATUS_INITED) {
5480                 error = bwn_core_init(mac);
5481                 if (error)
5482                         goto out;
5483         }
5484         if (prev_status >= BWN_MAC_STATUS_STARTED)
5485                 bwn_core_start(mac);
5486 out:
5487         if (error) {
5488                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5489                 sc->sc_curmac = NULL;
5490         }
5491         BWN_UNLOCK(sc);
5492 }
5493
5494 static void
5495 bwn_handle_fwpanic(struct bwn_mac *mac)
5496 {
5497         struct bwn_softc *sc = mac->mac_sc;
5498         uint16_t reason;
5499
5500         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5501         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5502
5503         if (reason == BWN_FWPANIC_RESTART)
5504                 bwn_restart(mac, "ucode panic");
5505 }
5506
5507 static void
5508 bwn_load_beacon0(struct bwn_mac *mac)
5509 {
5510
5511         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5512 }
5513
5514 static void
5515 bwn_load_beacon1(struct bwn_mac *mac)
5516 {
5517
5518         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5519 }
5520
5521 static uint32_t
5522 bwn_jssi_read(struct bwn_mac *mac)
5523 {
5524         uint32_t val = 0;
5525
5526         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5527         val <<= 16;
5528         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5529
5530         return (val);
5531 }
5532
5533 static void
5534 bwn_noise_gensample(struct bwn_mac *mac)
5535 {
5536         uint32_t jssi = 0x7f7f7f7f;
5537
5538         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5539         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5540         BWN_WRITE_4(mac, BWN_MACCMD,
5541             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5542 }
5543
5544 static int
5545 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5546 {
5547         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5548
5549         return (dr->dr_numslots - dr->dr_usedslot);
5550 }
5551
5552 static int
5553 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5554 {
5555         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5556
5557         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5558             ("%s:%d: fail", __func__, __LINE__));
5559         if (slot == dr->dr_numslots - 1)
5560                 return (0);
5561         return (slot + 1);
5562 }
5563
5564 static void
5565 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5566 {
5567         struct bwn_mac *mac = dr->dr_mac;
5568         struct bwn_softc *sc = mac->mac_sc;
5569         struct bwn_dma *dma = &mac->mac_method.dma;
5570         struct bwn_dmadesc_generic *desc;
5571         struct bwn_dmadesc_meta *meta;
5572         struct bwn_rxhdr4 *rxhdr;
5573         struct mbuf *m;
5574         uint32_t macstat;
5575         int32_t tmp;
5576         int cnt = 0;
5577         uint16_t len;
5578
5579         dr->getdesc(dr, *slot, &desc, &meta);
5580
5581         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5582         m = meta->mt_m;
5583
5584         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5585                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5586                 return;
5587         }
5588
5589         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5590         len = le16toh(rxhdr->frame_len);
5591         if (len <= 0) {
5592                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5593                 return;
5594         }
5595         if (bwn_dma_check_redzone(dr, m)) {
5596                 device_printf(sc->sc_dev, "redzone error.\n");
5597                 bwn_dma_set_redzone(dr, m);
5598                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5599                     BUS_DMASYNC_PREWRITE);
5600                 return;
5601         }
5602         if (len > dr->dr_rx_bufsize) {
5603                 tmp = len;
5604                 while (1) {
5605                         dr->getdesc(dr, *slot, &desc, &meta);
5606                         bwn_dma_set_redzone(dr, meta->mt_m);
5607                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5608                             BUS_DMASYNC_PREWRITE);
5609                         *slot = bwn_dma_nextslot(dr, *slot);
5610                         cnt++;
5611                         tmp -= dr->dr_rx_bufsize;
5612                         if (tmp <= 0)
5613                                 break;
5614                 }
5615                 device_printf(sc->sc_dev, "too small buffer "
5616                        "(len %u buffer %u dropped %d)\n",
5617                        len, dr->dr_rx_bufsize, cnt);
5618                 return;
5619         }
5620
5621         switch (mac->mac_fw.fw_hdr_format) {
5622         case BWN_FW_HDR_351:
5623         case BWN_FW_HDR_410:
5624                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5625                 break;
5626         case BWN_FW_HDR_598:
5627                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5628                 break;
5629         }
5630
5631         if (macstat & BWN_RX_MAC_FCSERR) {
5632                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5633                         device_printf(sc->sc_dev, "RX drop\n");
5634                         return;
5635                 }
5636         }
5637
5638         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5639         m_adj(m, dr->dr_frameoffset);
5640
5641         bwn_rxeof(dr->dr_mac, m, rxhdr);
5642 }
5643
5644 static void
5645 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5646 {
5647         struct bwn_softc *sc = mac->mac_sc;
5648         struct bwn_stats *stats = &mac->mac_stats;
5649
5650         BWN_ASSERT_LOCKED(mac->mac_sc);
5651
5652         if (status->im)
5653                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5654         if (status->ampdu)
5655                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5656         if (status->rtscnt) {
5657                 if (status->rtscnt == 0xf)
5658                         stats->rtsfail++;
5659                 else
5660                         stats->rts++;
5661         }
5662
5663         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5664                 bwn_dma_handle_txeof(mac, status);
5665         } else {
5666                 bwn_pio_handle_txeof(mac, status);
5667         }
5668
5669         bwn_phy_txpower_check(mac, 0);
5670 }
5671
5672 static uint8_t
5673 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5674 {
5675         struct bwn_mac *mac = prq->prq_mac;
5676         struct bwn_softc *sc = mac->mac_sc;
5677         struct bwn_rxhdr4 rxhdr;
5678         struct mbuf *m;
5679         uint32_t ctl32, macstat, v32;
5680         unsigned int i, padding;
5681         uint16_t ctl16, len, totlen, v16;
5682         unsigned char *mp;
5683         char *data;
5684
5685         memset(&rxhdr, 0, sizeof(rxhdr));
5686
5687         if (prq->prq_rev >= 8) {
5688                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5689                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5690                         return (0);
5691                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5692                     BWN_PIO8_RXCTL_FRAMEREADY);
5693                 for (i = 0; i < 10; i++) {
5694                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5695                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5696                                 goto ready;
5697                         DELAY(10);
5698                 }
5699         } else {
5700                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5701                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5702                         return (0);
5703                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5704                     BWN_PIO_RXCTL_FRAMEREADY);
5705                 for (i = 0; i < 10; i++) {
5706                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5707                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5708                                 goto ready;
5709                         DELAY(10);
5710                 }
5711         }
5712         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5713         return (1);
5714 ready:
5715         if (prq->prq_rev >= 8) {
5716                 bus_read_multi_4(sc->sc_mem_res,
5717                     prq->prq_base + BWN_PIO8_RXDATA, (void *)&rxhdr,
5718                     sizeof(rxhdr));
5719         } else {
5720                 bus_read_multi_2(sc->sc_mem_res,
5721                     prq->prq_base + BWN_PIO_RXDATA, (void *)&rxhdr,
5722                     sizeof(rxhdr));
5723         }
5724         len = le16toh(rxhdr.frame_len);
5725         if (len > 0x700) {
5726                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5727                 goto error;
5728         }
5729         if (len == 0) {
5730                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5731                 goto error;
5732         }
5733
5734         switch (mac->mac_fw.fw_hdr_format) {
5735         case BWN_FW_HDR_351:
5736         case BWN_FW_HDR_410:
5737                 macstat = le32toh(rxhdr.ps4.r351.mac_status);
5738                 break;
5739         case BWN_FW_HDR_598:
5740                 macstat = le32toh(rxhdr.ps4.r598.mac_status);
5741                 break;
5742         }
5743
5744         if (macstat & BWN_RX_MAC_FCSERR) {
5745                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5746                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5747                         goto error;
5748                 }
5749         }
5750
5751         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5752         totlen = len + padding;
5753         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5754         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5755         if (m == NULL) {
5756                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5757                 goto error;
5758         }
5759         mp = mtod(m, unsigned char *);
5760         if (prq->prq_rev >= 8) {
5761                 bus_read_multi_4(sc->sc_mem_res,
5762                     prq->prq_base + BWN_PIO8_RXDATA, (void *)mp, (totlen & ~3));
5763                 if (totlen & 3) {
5764                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5765                         data = &(mp[totlen - 1]);
5766                         switch (totlen & 3) {
5767                         case 3:
5768                                 *data = (v32 >> 16);
5769                                 data--;
5770                         case 2:
5771                                 *data = (v32 >> 8);
5772                                 data--;
5773                         case 1:
5774                                 *data = v32;
5775                         }
5776                 }
5777         } else {
5778                 bus_read_multi_2(sc->sc_mem_res,
5779                     prq->prq_base + BWN_PIO_RXDATA, (void *)mp, (totlen & ~1));
5780                 if (totlen & 1) {
5781                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5782                         mp[totlen - 1] = v16;
5783                 }
5784         }
5785
5786         m->m_len = m->m_pkthdr.len = totlen;
5787
5788         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5789
5790         return (1);
5791 error:
5792         if (prq->prq_rev >= 8)
5793                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5794                     BWN_PIO8_RXCTL_DATAREADY);
5795         else
5796                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5797         return (1);
5798 }
5799
5800 static int
5801 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5802     struct bwn_dmadesc_meta *meta, int init)
5803 {
5804         struct bwn_mac *mac = dr->dr_mac;
5805         struct bwn_dma *dma = &mac->mac_method.dma;
5806         struct bwn_rxhdr4 *hdr;
5807         bus_dmamap_t map;
5808         bus_addr_t paddr;
5809         struct mbuf *m;
5810         int error;
5811
5812         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5813         if (m == NULL) {
5814                 error = ENOBUFS;
5815
5816                 /*
5817                  * If the NIC is up and running, we need to:
5818                  * - Clear RX buffer's header.
5819                  * - Restore RX descriptor settings.
5820                  */
5821                 if (init)
5822                         return (error);
5823                 else
5824                         goto back;
5825         }
5826         m->m_len = m->m_pkthdr.len = MCLBYTES;
5827
5828         bwn_dma_set_redzone(dr, m);
5829
5830         /*
5831          * Try to load RX buf into temporary DMA map
5832          */
5833         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5834             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5835         if (error) {
5836                 m_freem(m);
5837
5838                 /*
5839                  * See the comment above
5840                  */
5841                 if (init)
5842                         return (error);
5843                 else
5844                         goto back;
5845         }
5846
5847         if (!init)
5848                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5849         meta->mt_m = m;
5850         meta->mt_paddr = paddr;
5851
5852         /*
5853          * Swap RX buf's DMA map with the loaded temporary one
5854          */
5855         map = meta->mt_dmap;
5856         meta->mt_dmap = dr->dr_spare_dmap;
5857         dr->dr_spare_dmap = map;
5858
5859 back:
5860         /*
5861          * Clear RX buf header
5862          */
5863         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5864         bzero(hdr, sizeof(*hdr));
5865         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5866             BUS_DMASYNC_PREWRITE);
5867
5868         /*
5869          * Setup RX buf descriptor
5870          */
5871         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5872             sizeof(*hdr), 0, 0, 0);
5873         return (error);
5874 }
5875
5876 static void
5877 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5878                  bus_size_t mapsz __unused, int error)
5879 {
5880
5881         if (!error) {
5882                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5883                 *((bus_addr_t *)arg) = seg->ds_addr;
5884         }
5885 }
5886
5887 static int
5888 bwn_hwrate2ieeerate(int rate)
5889 {
5890
5891         switch (rate) {
5892         case BWN_CCK_RATE_1MB:
5893                 return (2);
5894         case BWN_CCK_RATE_2MB:
5895                 return (4);
5896         case BWN_CCK_RATE_5MB:
5897                 return (11);
5898         case BWN_CCK_RATE_11MB:
5899                 return (22);
5900         case BWN_OFDM_RATE_6MB:
5901                 return (12);
5902         case BWN_OFDM_RATE_9MB:
5903                 return (18);
5904         case BWN_OFDM_RATE_12MB:
5905                 return (24);
5906         case BWN_OFDM_RATE_18MB:
5907                 return (36);
5908         case BWN_OFDM_RATE_24MB:
5909                 return (48);
5910         case BWN_OFDM_RATE_36MB:
5911                 return (72);
5912         case BWN_OFDM_RATE_48MB:
5913                 return (96);
5914         case BWN_OFDM_RATE_54MB:
5915                 return (108);
5916         default:
5917                 printf("Ooops\n");
5918                 return (0);
5919         }
5920 }
5921
5922 /*
5923  * Post process the RX provided RSSI.
5924  *
5925  * Valid for A, B, G, LP PHYs.
5926  */
5927 static int8_t
5928 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5929     int ofdm, int adjust_2053, int adjust_2050)
5930 {
5931         struct bwn_phy *phy = &mac->mac_phy;
5932         struct bwn_phy_g *gphy = &phy->phy_g;
5933         int tmp;
5934
5935         switch (phy->rf_ver) {
5936         case 0x2050:
5937                 if (ofdm) {
5938                         tmp = in_rssi;
5939                         if (tmp > 127)
5940                                 tmp -= 256;
5941                         tmp = tmp * 73 / 64;
5942                         if (adjust_2050)
5943                                 tmp += 25;
5944                         else
5945                                 tmp -= 3;
5946                 } else {
5947                         if (mac->mac_sc->sc_board_info.board_flags
5948                             & BHND_BFL_ADCDIV) {
5949                                 if (in_rssi > 63)
5950                                         in_rssi = 63;
5951                                 tmp = gphy->pg_nrssi_lt[in_rssi];
5952                                 tmp = (31 - tmp) * -131 / 128 - 57;
5953                         } else {
5954                                 tmp = in_rssi;
5955                                 tmp = (31 - tmp) * -149 / 128 - 68;
5956                         }
5957                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5958                                 tmp += 25;
5959                 }
5960                 break;
5961         case 0x2060:
5962                 if (in_rssi > 127)
5963                         tmp = in_rssi - 256;
5964                 else
5965                         tmp = in_rssi;
5966                 break;
5967         default:
5968                 tmp = in_rssi;
5969                 tmp = (tmp - 11) * 103 / 64;
5970                 if (adjust_2053)
5971                         tmp -= 109;
5972                 else
5973                         tmp -= 83;
5974         }
5975
5976         return (tmp);
5977 }
5978
5979 static void
5980 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5981 {
5982         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5983         struct bwn_plcp6 *plcp;
5984         struct bwn_softc *sc = mac->mac_sc;
5985         struct ieee80211_frame_min *wh;
5986         struct ieee80211_node *ni;
5987         struct ieee80211com *ic = &sc->sc_ic;
5988         uint32_t macstat;
5989         int padding, rate, rssi = 0, noise = 0, type;
5990         uint16_t phytype, phystat0, phystat3, chanstat;
5991         unsigned char *mp = mtod(m, unsigned char *);
5992
5993         BWN_ASSERT_LOCKED(sc);
5994
5995         phystat0 = le16toh(rxhdr->phy_status0);
5996
5997         /*
5998          * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5999          * used for LP-PHY.
6000          */
6001         phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
6002
6003         switch (mac->mac_fw.fw_hdr_format) {
6004         case BWN_FW_HDR_351:
6005         case BWN_FW_HDR_410:
6006                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
6007                 chanstat = le16toh(rxhdr->ps4.r351.channel);
6008                 break;
6009         case BWN_FW_HDR_598:
6010                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
6011                 chanstat = le16toh(rxhdr->ps4.r598.channel);
6012                 break;
6013         }
6014
6015
6016         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
6017
6018         if (macstat & BWN_RX_MAC_FCSERR)
6019                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
6020         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
6021                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
6022         if (macstat & BWN_RX_MAC_DECERR)
6023                 goto drop;
6024
6025         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
6026         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
6027                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6028                     m->m_pkthdr.len);
6029                 goto drop;
6030         }
6031         plcp = (struct bwn_plcp6 *)(mp + padding);
6032         m_adj(m, sizeof(struct bwn_plcp6) + padding);
6033         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
6034                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6035                     m->m_pkthdr.len);
6036                 goto drop;
6037         }
6038         wh = mtod(m, struct ieee80211_frame_min *);
6039
6040         if (macstat & BWN_RX_MAC_DEC) {
6041                 DPRINTF(sc, BWN_DEBUG_HWCRYPTO,
6042                     "RX decryption attempted (old %d keyidx %#x)\n",
6043                     BWN_ISOLDFMT(mac),
6044                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
6045         }
6046
6047         if (phystat0 & BWN_RX_PHYST0_OFDM)
6048                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
6049                     phytype == BWN_PHYTYPE_A);
6050         else
6051                 rate = bwn_plcp_get_cckrate(mac, plcp);
6052         if (rate == -1) {
6053                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
6054                         goto drop;
6055         }
6056         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
6057
6058         /* rssi/noise */
6059         switch (phytype) {
6060         case BWN_PHYTYPE_A:
6061         case BWN_PHYTYPE_B:
6062         case BWN_PHYTYPE_G:
6063         case BWN_PHYTYPE_LP:
6064                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
6065                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
6066                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
6067                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
6068                 break;
6069         case BWN_PHYTYPE_N:
6070                 /* Broadcom has code for min/avg, but always used max */
6071                 if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
6072                         rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
6073                 else
6074                         rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
6075 #if 0
6076                 DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
6077                     "%s: power0=%d, power1=%d, power2=%d\n",
6078                     __func__,
6079                     rxhdr->phy.n.power0,
6080                     rxhdr->phy.n.power1,
6081                     rxhdr->ps2.n.power2);
6082 #endif
6083                 break;
6084         default:
6085                 /* XXX TODO: implement rssi for other PHYs */
6086                 break;
6087         }
6088
6089         /*
6090          * RSSI here is absolute, not relative to the noise floor.
6091          */
6092         noise = mac->mac_stats.link_noise;
6093         rssi = rssi - noise;
6094
6095         /* RX radio tap */
6096         if (ieee80211_radiotap_active(ic))
6097                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
6098         m_adj(m, -IEEE80211_CRC_LEN);
6099
6100         BWN_UNLOCK(sc);
6101
6102         ni = ieee80211_find_rxnode(ic, wh);
6103         if (ni != NULL) {
6104                 type = ieee80211_input(ni, m, rssi, noise);
6105                 ieee80211_free_node(ni);
6106         } else
6107                 type = ieee80211_input_all(ic, m, rssi, noise);
6108
6109         BWN_LOCK(sc);
6110         return;
6111 drop:
6112         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
6113 }
6114
6115 static void
6116 bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
6117     const struct bwn_txstatus *status)
6118 {
6119         struct ieee80211_ratectl_tx_status txs;
6120         int retrycnt = 0;
6121
6122         /*
6123          * If we don't get an ACK, then we should log the
6124          * full framecnt.  That may be 0 if it's a PHY
6125          * failure, so ensure that gets logged as some
6126          * retry attempt.
6127          */
6128         txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
6129         if (status->ack) {
6130                 txs.status = IEEE80211_RATECTL_TX_SUCCESS;
6131                 retrycnt = status->framecnt - 1;
6132         } else {
6133                 txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
6134                 retrycnt = status->framecnt;
6135                 if (retrycnt == 0)
6136                         retrycnt = 1;
6137         }
6138         txs.long_retries = retrycnt;
6139         ieee80211_ratectl_tx_complete(ni, &txs);
6140 }
6141
6142 static void
6143 bwn_dma_handle_txeof(struct bwn_mac *mac,
6144     const struct bwn_txstatus *status)
6145 {
6146         struct bwn_dma *dma = &mac->mac_method.dma;
6147         struct bwn_dma_ring *dr;
6148         struct bwn_dmadesc_generic *desc;
6149         struct bwn_dmadesc_meta *meta;
6150         struct bwn_softc *sc = mac->mac_sc;
6151         int slot;
6152
6153         BWN_ASSERT_LOCKED(sc);
6154
6155         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
6156         if (dr == NULL) {
6157                 device_printf(sc->sc_dev, "failed to parse cookie\n");
6158                 return;
6159         }
6160         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6161
6162         while (1) {
6163                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
6164                     ("%s:%d: fail", __func__, __LINE__));
6165                 dr->getdesc(dr, slot, &desc, &meta);
6166
6167                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
6168                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
6169                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
6170                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
6171
6172                 if (meta->mt_islast) {
6173                         KASSERT(meta->mt_m != NULL,
6174                             ("%s:%d: fail", __func__, __LINE__));
6175
6176                         bwn_ratectl_tx_complete(meta->mt_ni, status);
6177                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
6178                         meta->mt_ni = NULL;
6179                         meta->mt_m = NULL;
6180                 } else
6181                         KASSERT(meta->mt_m == NULL,
6182                             ("%s:%d: fail", __func__, __LINE__));
6183
6184                 dr->dr_usedslot--;
6185                 if (meta->mt_islast)
6186                         break;
6187                 slot = bwn_dma_nextslot(dr, slot);
6188         }
6189         sc->sc_watchdog_timer = 0;
6190         if (dr->dr_stop) {
6191                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
6192                     ("%s:%d: fail", __func__, __LINE__));
6193                 dr->dr_stop = 0;
6194         }
6195 }
6196
6197 static void
6198 bwn_pio_handle_txeof(struct bwn_mac *mac,
6199     const struct bwn_txstatus *status)
6200 {
6201         struct bwn_pio_txqueue *tq;
6202         struct bwn_pio_txpkt *tp = NULL;
6203         struct bwn_softc *sc = mac->mac_sc;
6204
6205         BWN_ASSERT_LOCKED(sc);
6206
6207         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
6208         if (tq == NULL)
6209                 return;
6210
6211         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
6212         tq->tq_free++;
6213
6214         if (tp->tp_ni != NULL) {
6215                 /*
6216                  * Do any tx complete callback.  Note this must
6217                  * be done before releasing the node reference.
6218                  */
6219                 bwn_ratectl_tx_complete(tp->tp_ni, status);
6220         }
6221         ieee80211_tx_complete(tp->tp_ni, tp->tp_m, 0);
6222         tp->tp_ni = NULL;
6223         tp->tp_m = NULL;
6224         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6225
6226         sc->sc_watchdog_timer = 0;
6227 }
6228
6229 static void
6230 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6231 {
6232         struct bwn_softc *sc = mac->mac_sc;
6233         struct bwn_phy *phy = &mac->mac_phy;
6234         struct ieee80211com *ic = &sc->sc_ic;
6235         unsigned long now;
6236         bwn_txpwr_result_t result;
6237
6238         BWN_GETTIME(now);
6239
6240         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6241                 return;
6242         phy->nexttime = now + 2 * 1000;
6243
6244         if (sc->sc_board_info.board_vendor == PCI_VENDOR_BROADCOM &&
6245             sc->sc_board_info.board_type == BHND_BOARD_BU4306)
6246                 return;
6247
6248         if (phy->recalc_txpwr != NULL) {
6249                 result = phy->recalc_txpwr(mac,
6250                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6251                 if (result == BWN_TXPWR_RES_DONE)
6252                         return;
6253                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6254                     ("%s: fail", __func__));
6255                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6256
6257                 ieee80211_runtask(ic, &mac->mac_txpower);
6258         }
6259 }
6260
6261 static uint16_t
6262 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6263 {
6264
6265         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6266 }
6267
6268 static uint32_t
6269 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6270 {
6271
6272         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6273 }
6274
6275 static void
6276 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6277 {
6278
6279         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6280 }
6281
6282 static void
6283 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6284 {
6285
6286         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6287 }
6288
6289 static int
6290 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6291 {
6292
6293         switch (rate) {
6294         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6295         case 12:
6296                 return (BWN_OFDM_RATE_6MB);
6297         case 18:
6298                 return (BWN_OFDM_RATE_9MB);
6299         case 24:
6300                 return (BWN_OFDM_RATE_12MB);
6301         case 36:
6302                 return (BWN_OFDM_RATE_18MB);
6303         case 48:
6304                 return (BWN_OFDM_RATE_24MB);
6305         case 72:
6306                 return (BWN_OFDM_RATE_36MB);
6307         case 96:
6308                 return (BWN_OFDM_RATE_48MB);
6309         case 108:
6310                 return (BWN_OFDM_RATE_54MB);
6311         /* CCK rates (NB: not IEEE std, device-specific) */
6312         case 2:
6313                 return (BWN_CCK_RATE_1MB);
6314         case 4:
6315                 return (BWN_CCK_RATE_2MB);
6316         case 11:
6317                 return (BWN_CCK_RATE_5MB);
6318         case 22:
6319                 return (BWN_CCK_RATE_11MB);
6320         }
6321
6322         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6323         return (BWN_CCK_RATE_1MB);
6324 }
6325
6326 static uint16_t
6327 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6328 {
6329         struct bwn_phy *phy = &mac->mac_phy;
6330         uint16_t control = 0;
6331         uint16_t bw;
6332
6333         /* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6334         bw = BWN_TXH_PHY1_BW_20;
6335
6336         if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6337                 control = bw;
6338         } else {
6339                 control = bw;
6340                 /* Figure out coding rate and modulation */
6341                 /* XXX TODO: table-ize, for MCS transmit */
6342                 /* Note: this is BWN_*_RATE values */
6343                 switch (bitrate) {
6344                 case BWN_CCK_RATE_1MB:
6345                         control |= 0;
6346                         break;
6347                 case BWN_CCK_RATE_2MB:
6348                         control |= 1;
6349                         break;
6350                 case BWN_CCK_RATE_5MB:
6351                         control |= 2;
6352                         break;
6353                 case BWN_CCK_RATE_11MB:
6354                         control |= 3;
6355                         break;
6356                 case BWN_OFDM_RATE_6MB:
6357                         control |= BWN_TXH_PHY1_CRATE_1_2;
6358                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6359                         break;
6360                 case BWN_OFDM_RATE_9MB:
6361                         control |= BWN_TXH_PHY1_CRATE_3_4;
6362                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6363                         break;
6364                 case BWN_OFDM_RATE_12MB:
6365                         control |= BWN_TXH_PHY1_CRATE_1_2;
6366                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6367                         break;
6368                 case BWN_OFDM_RATE_18MB:
6369                         control |= BWN_TXH_PHY1_CRATE_3_4;
6370                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6371                         break;
6372                 case BWN_OFDM_RATE_24MB:
6373                         control |= BWN_TXH_PHY1_CRATE_1_2;
6374                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6375                         break;
6376                 case BWN_OFDM_RATE_36MB:
6377                         control |= BWN_TXH_PHY1_CRATE_3_4;
6378                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6379                         break;
6380                 case BWN_OFDM_RATE_48MB:
6381                         control |= BWN_TXH_PHY1_CRATE_1_2;
6382                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6383                         break;
6384                 case BWN_OFDM_RATE_54MB:
6385                         control |= BWN_TXH_PHY1_CRATE_3_4;
6386                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6387                         break;
6388                 default:
6389                         break;
6390                 }
6391                 control |= BWN_TXH_PHY1_MODE_SISO;
6392         }
6393
6394         return control;
6395 }
6396
6397 static int
6398 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6399     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6400 {
6401         const struct bwn_phy *phy = &mac->mac_phy;
6402         struct bwn_softc *sc = mac->mac_sc;
6403         struct ieee80211_frame *wh;
6404         struct ieee80211_frame *protwh;
6405         const struct ieee80211_txparam *tp = ni->ni_txparms;
6406         struct ieee80211vap *vap = ni->ni_vap;
6407         struct ieee80211com *ic = &sc->sc_ic;
6408         struct mbuf *mprot;
6409         uint8_t *prot_ptr;
6410         unsigned int len;
6411         uint32_t macctl = 0;
6412         int rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6413         uint16_t phyctl = 0;
6414         uint8_t rate, rate_fb;
6415         int fill_phy_ctl1 = 0;
6416
6417         wh = mtod(m, struct ieee80211_frame *);
6418         memset(txhdr, 0, sizeof(*txhdr));
6419
6420         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6421         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6422         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6423
6424         if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6425             || (phy->type == BWN_PHYTYPE_HT))
6426                 fill_phy_ctl1 = 1;
6427
6428         /*
6429          * Find TX rate
6430          */
6431         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6432                 rate = rate_fb = tp->mgmtrate;
6433         else if (ismcast)
6434                 rate = rate_fb = tp->mcastrate;
6435         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6436                 rate = rate_fb = tp->ucastrate;
6437         else {
6438                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
6439                 rate = ni->ni_txrate;
6440
6441                 if (rix > 0)
6442                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6443                             IEEE80211_RATE_VAL;
6444                 else
6445                         rate_fb = rate;
6446         }
6447
6448         sc->sc_tx_rate = rate;
6449
6450         /* Note: this maps the select ieee80211 rate to hardware rate */
6451         rate = bwn_ieeerate2hwrate(sc, rate);
6452         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6453
6454         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6455             bwn_plcp_getcck(rate);
6456         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6457         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6458
6459         /* XXX rate/rate_fb is the hardware rate */
6460         if ((rate_fb == rate) ||
6461             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6462             (*(u_int16_t *)wh->i_dur == htole16(0)))
6463                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6464         else
6465                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6466                     m->m_pkthdr.len, rate, isshort);
6467
6468         /* XXX TX encryption */
6469
6470         switch (mac->mac_fw.fw_hdr_format) {
6471         case BWN_FW_HDR_351:
6472                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6473                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6474                 break;
6475         case BWN_FW_HDR_410:
6476                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6477                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6478                 break;
6479         case BWN_FW_HDR_598:
6480                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6481                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6482                 break;
6483         }
6484
6485         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6486             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6487
6488         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6489             BWN_TX_EFT_FB_CCK;
6490         txhdr->chan = phy->chan;
6491         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6492             BWN_TX_PHY_ENC_CCK;
6493         /* XXX preamble? obey net80211 */
6494         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6495              rate == BWN_CCK_RATE_11MB))
6496                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
6497
6498         if (! phy->gmode)
6499                 macctl |= BWN_TX_MAC_5GHZ;
6500
6501         /* XXX TX antenna selection */
6502
6503         switch (bwn_antenna_sanitize(mac, 0)) {
6504         case 0:
6505                 phyctl |= BWN_TX_PHY_ANT01AUTO;
6506                 break;
6507         case 1:
6508                 phyctl |= BWN_TX_PHY_ANT0;
6509                 break;
6510         case 2:
6511                 phyctl |= BWN_TX_PHY_ANT1;
6512                 break;
6513         case 3:
6514                 phyctl |= BWN_TX_PHY_ANT2;
6515                 break;
6516         case 4:
6517                 phyctl |= BWN_TX_PHY_ANT3;
6518                 break;
6519         default:
6520                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6521         }
6522
6523         if (!ismcast)
6524                 macctl |= BWN_TX_MAC_ACK;
6525
6526         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6527         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6528             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6529                 macctl |= BWN_TX_MAC_LONGFRAME;
6530
6531         if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
6532             ic->ic_protmode != IEEE80211_PROT_NONE) {
6533                 /* Note: don't fall back to CCK rates for 5G */
6534                 if (phy->gmode)
6535                         rts_rate = BWN_CCK_RATE_1MB;
6536                 else
6537                         rts_rate = BWN_OFDM_RATE_6MB;
6538                 rts_rate_fb = bwn_get_fbrate(rts_rate);
6539
6540                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
6541                 mprot = ieee80211_alloc_prot(ni, m, rate, ic->ic_protmode);
6542                 if (mprot == NULL) {
6543                         if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
6544                         device_printf(sc->sc_dev,
6545                             "could not allocate mbuf for protection mode %d\n",
6546                             ic->ic_protmode);
6547                         return (ENOBUFS);
6548                 }
6549
6550                 switch (mac->mac_fw.fw_hdr_format) {
6551                 case BWN_FW_HDR_351:
6552                         prot_ptr = txhdr->body.r351.rts_frame;
6553                         break;
6554                 case BWN_FW_HDR_410:
6555                         prot_ptr = txhdr->body.r410.rts_frame;
6556                         break;
6557                 case BWN_FW_HDR_598:
6558                         prot_ptr = txhdr->body.r598.rts_frame;
6559                         break;
6560                 }
6561
6562                 bcopy(mtod(mprot, uint8_t *), prot_ptr, mprot->m_pkthdr.len);
6563                 m_freem(mprot);
6564
6565                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6566                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6567                         len = sizeof(struct ieee80211_frame_cts);
6568                 } else {
6569                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
6570                         len = sizeof(struct ieee80211_frame_rts);
6571                 }
6572                 len += IEEE80211_CRC_LEN;
6573
6574                 switch (mac->mac_fw.fw_hdr_format) {
6575                 case BWN_FW_HDR_351:
6576                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6577                             &txhdr->body.r351.rts_plcp, len, rts_rate);
6578                         break;
6579                 case BWN_FW_HDR_410:
6580                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6581                             &txhdr->body.r410.rts_plcp, len, rts_rate);
6582                         break;
6583                 case BWN_FW_HDR_598:
6584                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6585                             &txhdr->body.r598.rts_plcp, len, rts_rate);
6586                         break;
6587                 }
6588
6589                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6590                     rts_rate_fb);
6591
6592                 switch (mac->mac_fw.fw_hdr_format) {
6593                 case BWN_FW_HDR_351:
6594                         protwh = (struct ieee80211_frame *)
6595                             &txhdr->body.r351.rts_frame;
6596                         break;
6597                 case BWN_FW_HDR_410:
6598                         protwh = (struct ieee80211_frame *)
6599                             &txhdr->body.r410.rts_frame;
6600                         break;
6601                 case BWN_FW_HDR_598:
6602                         protwh = (struct ieee80211_frame *)
6603                             &txhdr->body.r598.rts_frame;
6604                         break;
6605                 }
6606
6607                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6608
6609                 if (BWN_ISOFDMRATE(rts_rate)) {
6610                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6611                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6612                 } else {
6613                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6614                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6615                 }
6616                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6617                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6618
6619                 if (fill_phy_ctl1) {
6620                         txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6621                         txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6622                 }
6623         }
6624
6625         if (fill_phy_ctl1) {
6626                 txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6627                 txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6628         }
6629
6630         switch (mac->mac_fw.fw_hdr_format) {
6631         case BWN_FW_HDR_351:
6632                 txhdr->body.r351.cookie = htole16(cookie);
6633                 break;
6634         case BWN_FW_HDR_410:
6635                 txhdr->body.r410.cookie = htole16(cookie);
6636                 break;
6637         case BWN_FW_HDR_598:
6638                 txhdr->body.r598.cookie = htole16(cookie);
6639                 break;
6640         }
6641
6642         txhdr->macctl = htole32(macctl);
6643         txhdr->phyctl = htole16(phyctl);
6644
6645         /*
6646          * TX radio tap
6647          */
6648         if (ieee80211_radiotap_active_vap(vap)) {
6649                 sc->sc_tx_th.wt_flags = 0;
6650                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6651                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6652                 if (isshort &&
6653                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6654                      rate == BWN_CCK_RATE_11MB))
6655                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6656                 sc->sc_tx_th.wt_rate = rate;
6657
6658                 ieee80211_radiotap_tx(vap, m);
6659         }
6660
6661         return (0);
6662 }
6663
6664 static void
6665 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6666     const uint8_t rate)
6667 {
6668         uint32_t d, plen;
6669         uint8_t *raw = plcp->o.raw;
6670
6671         if (BWN_ISOFDMRATE(rate)) {
6672                 d = bwn_plcp_getofdm(rate);
6673                 KASSERT(!(octets & 0xf000),
6674                     ("%s:%d: fail", __func__, __LINE__));
6675                 d |= (octets << 5);
6676                 plcp->o.data = htole32(d);
6677         } else {
6678                 plen = octets * 16 / rate;
6679                 if ((octets * 16 % rate) > 0) {
6680                         plen++;
6681                         if ((rate == BWN_CCK_RATE_11MB)
6682                             && ((octets * 8 % 11) < 4)) {
6683                                 raw[1] = 0x84;
6684                         } else
6685                                 raw[1] = 0x04;
6686                 } else
6687                         raw[1] = 0x04;
6688                 plcp->o.data |= htole32(plen << 16);
6689                 raw[0] = bwn_plcp_getcck(rate);
6690         }
6691 }
6692
6693 static uint8_t
6694 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6695 {
6696         struct bwn_softc *sc = mac->mac_sc;
6697         uint8_t mask;
6698
6699         if (n == 0)
6700                 return (0);
6701         if (mac->mac_phy.gmode)
6702                 mask = sc->sc_ant2g;
6703         else
6704                 mask = sc->sc_ant5g;
6705         if (!(mask & (1 << (n - 1))))
6706                 return (0);
6707         return (n);
6708 }
6709
6710 /*
6711  * Return a fallback rate for the given rate.
6712  *
6713  * Note: Don't fall back from OFDM to CCK.
6714  */
6715 static uint8_t
6716 bwn_get_fbrate(uint8_t bitrate)
6717 {
6718         switch (bitrate) {
6719         /* CCK */
6720         case BWN_CCK_RATE_1MB:
6721                 return (BWN_CCK_RATE_1MB);
6722         case BWN_CCK_RATE_2MB:
6723                 return (BWN_CCK_RATE_1MB);
6724         case BWN_CCK_RATE_5MB:
6725                 return (BWN_CCK_RATE_2MB);
6726         case BWN_CCK_RATE_11MB:
6727                 return (BWN_CCK_RATE_5MB);
6728
6729         /* OFDM */
6730         case BWN_OFDM_RATE_6MB:
6731                 return (BWN_OFDM_RATE_6MB);
6732         case BWN_OFDM_RATE_9MB:
6733                 return (BWN_OFDM_RATE_6MB);
6734         case BWN_OFDM_RATE_12MB:
6735                 return (BWN_OFDM_RATE_9MB);
6736         case BWN_OFDM_RATE_18MB:
6737                 return (BWN_OFDM_RATE_12MB);
6738         case BWN_OFDM_RATE_24MB:
6739                 return (BWN_OFDM_RATE_18MB);
6740         case BWN_OFDM_RATE_36MB:
6741                 return (BWN_OFDM_RATE_24MB);
6742         case BWN_OFDM_RATE_48MB:
6743                 return (BWN_OFDM_RATE_36MB);
6744         case BWN_OFDM_RATE_54MB:
6745                 return (BWN_OFDM_RATE_48MB);
6746         }
6747         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6748         return (0);
6749 }
6750
6751 static uint32_t
6752 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6753     uint32_t ctl, const void *_data, int len)
6754 {
6755         struct bwn_softc *sc = mac->mac_sc;
6756         uint32_t value = 0;
6757         const uint8_t *data = _data;
6758
6759         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6760             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6761         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6762
6763         bus_write_multi_4(sc->sc_mem_res, tq->tq_base + BWN_PIO8_TXDATA,
6764             __DECONST(void *, data), (len & ~3));
6765         if (len & 3) {
6766                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6767                     BWN_PIO8_TXCTL_24_31);
6768                 data = &(data[len - 1]);
6769                 switch (len & 3) {
6770                 case 3:
6771                         ctl |= BWN_PIO8_TXCTL_16_23;
6772                         value |= (uint32_t)(*data) << 16;
6773                         data--;
6774                 case 2:
6775                         ctl |= BWN_PIO8_TXCTL_8_15;
6776                         value |= (uint32_t)(*data) << 8;
6777                         data--;
6778                 case 1:
6779                         value |= (uint32_t)(*data);
6780                 }
6781                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6782                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6783         }
6784
6785         return (ctl);
6786 }
6787
6788 static void
6789 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6790     uint16_t offset, uint32_t value)
6791 {
6792
6793         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6794 }
6795
6796 static uint16_t
6797 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6798     uint16_t ctl, const void *_data, int len)
6799 {
6800         struct bwn_softc *sc = mac->mac_sc;
6801         const uint8_t *data = _data;
6802
6803         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6804         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6805
6806         bus_write_multi_2(sc->sc_mem_res, tq->tq_base + BWN_PIO_TXDATA,
6807             __DECONST(void *, data), (len & ~1));
6808         if (len & 1) {
6809                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6810                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6811                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6812         }
6813
6814         return (ctl);
6815 }
6816
6817 static uint16_t
6818 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6819     uint16_t ctl, struct mbuf *m0)
6820 {
6821         int i, j = 0;
6822         uint16_t data = 0;
6823         const uint8_t *buf;
6824         struct mbuf *m = m0;
6825
6826         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6827         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6828
6829         for (; m != NULL; m = m->m_next) {
6830                 buf = mtod(m, const uint8_t *);
6831                 for (i = 0; i < m->m_len; i++) {
6832                         if (!((j++) % 2))
6833                                 data |= buf[i];
6834                         else {
6835                                 data |= (buf[i] << 8);
6836                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6837                                 data = 0;
6838                         }
6839                 }
6840         }
6841         if (m0->m_pkthdr.len % 2) {
6842                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6843                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6844                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6845         }
6846
6847         return (ctl);
6848 }
6849
6850 static void
6851 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6852 {
6853
6854         /* XXX should exit if 5GHz band .. */
6855         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6856                 return;
6857
6858         BWN_WRITE_2(mac, 0x684, 510 + time);
6859         /* Disabled in Linux b43, can adversely effect performance */
6860 #if 0
6861         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6862 #endif
6863 }
6864
6865 static struct bwn_dma_ring *
6866 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6867 {
6868
6869         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6870                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6871
6872         switch (prio) {
6873         case 3:
6874                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6875         case 2:
6876                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6877         case 0:
6878                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6879         case 1:
6880                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6881         }
6882         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6883         return (NULL);
6884 }
6885
6886 static int
6887 bwn_dma_getslot(struct bwn_dma_ring *dr)
6888 {
6889         int slot;
6890
6891         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6892
6893         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6894         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6895         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6896
6897         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6898         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6899         dr->dr_curslot = slot;
6900         dr->dr_usedslot++;
6901
6902         return (slot);
6903 }
6904
6905 static struct bwn_pio_txqueue *
6906 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6907     struct bwn_pio_txpkt **pack)
6908 {
6909         struct bwn_pio *pio = &mac->mac_method.pio;
6910         struct bwn_pio_txqueue *tq = NULL;
6911         unsigned int index;
6912
6913         switch (cookie & 0xf000) {
6914         case 0x1000:
6915                 tq = &pio->wme[WME_AC_BK];
6916                 break;
6917         case 0x2000:
6918                 tq = &pio->wme[WME_AC_BE];
6919                 break;
6920         case 0x3000:
6921                 tq = &pio->wme[WME_AC_VI];
6922                 break;
6923         case 0x4000:
6924                 tq = &pio->wme[WME_AC_VO];
6925                 break;
6926         case 0x5000:
6927                 tq = &pio->mcast;
6928                 break;
6929         }
6930         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6931         if (tq == NULL)
6932                 return (NULL);
6933         index = (cookie & 0x0fff);
6934         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6935         if (index >= N(tq->tq_pkts))
6936                 return (NULL);
6937         *pack = &tq->tq_pkts[index];
6938         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6939         return (tq);
6940 }
6941
6942 static void
6943 bwn_txpwr(void *arg, int npending)
6944 {
6945         struct bwn_mac *mac = arg;
6946         struct bwn_softc *sc;
6947
6948         if (mac == NULL)
6949                 return;
6950
6951         sc = mac->mac_sc;
6952
6953         BWN_LOCK(sc);
6954         if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6955             mac->mac_phy.set_txpwr != NULL)
6956                 mac->mac_phy.set_txpwr(mac);
6957         BWN_UNLOCK(sc);
6958 }
6959
6960 static void
6961 bwn_task_15s(struct bwn_mac *mac)
6962 {
6963         uint16_t reg;
6964
6965         if (mac->mac_fw.opensource) {
6966                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6967                 if (reg) {
6968                         bwn_restart(mac, "fw watchdog");
6969                         return;
6970                 }
6971                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6972         }
6973         if (mac->mac_phy.task_15s)
6974                 mac->mac_phy.task_15s(mac);
6975
6976         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6977 }
6978
6979 static void
6980 bwn_task_30s(struct bwn_mac *mac)
6981 {
6982
6983         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6984                 return;
6985         mac->mac_noise.noi_running = 1;
6986         mac->mac_noise.noi_nsamples = 0;
6987
6988         bwn_noise_gensample(mac);
6989 }
6990
6991 static void
6992 bwn_task_60s(struct bwn_mac *mac)
6993 {
6994
6995         if (mac->mac_phy.task_60s)
6996                 mac->mac_phy.task_60s(mac);
6997         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6998 }
6999
7000 static void
7001 bwn_tasks(void *arg)
7002 {
7003         struct bwn_mac *mac = arg;
7004         struct bwn_softc *sc = mac->mac_sc;
7005
7006         BWN_ASSERT_LOCKED(sc);
7007         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
7008                 return;
7009
7010         if (mac->mac_task_state % 4 == 0)
7011                 bwn_task_60s(mac);
7012         if (mac->mac_task_state % 2 == 0)
7013                 bwn_task_30s(mac);
7014         bwn_task_15s(mac);
7015
7016         mac->mac_task_state++;
7017         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
7018 }
7019
7020 static int
7021 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
7022 {
7023         struct bwn_softc *sc = mac->mac_sc;
7024
7025         KASSERT(a == 0, ("not support APHY\n"));
7026
7027         switch (plcp->o.raw[0] & 0xf) {
7028         case 0xb:
7029                 return (BWN_OFDM_RATE_6MB);
7030         case 0xf:
7031                 return (BWN_OFDM_RATE_9MB);
7032         case 0xa:
7033                 return (BWN_OFDM_RATE_12MB);
7034         case 0xe:
7035                 return (BWN_OFDM_RATE_18MB);
7036         case 0x9:
7037                 return (BWN_OFDM_RATE_24MB);
7038         case 0xd:
7039                 return (BWN_OFDM_RATE_36MB);
7040         case 0x8:
7041                 return (BWN_OFDM_RATE_48MB);
7042         case 0xc:
7043                 return (BWN_OFDM_RATE_54MB);
7044         }
7045         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
7046             plcp->o.raw[0] & 0xf);
7047         return (-1);
7048 }
7049
7050 static int
7051 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
7052 {
7053         struct bwn_softc *sc = mac->mac_sc;
7054
7055         switch (plcp->o.raw[0]) {
7056         case 0x0a:
7057                 return (BWN_CCK_RATE_1MB);
7058         case 0x14:
7059                 return (BWN_CCK_RATE_2MB);
7060         case 0x37:
7061                 return (BWN_CCK_RATE_5MB);
7062         case 0x6e:
7063                 return (BWN_CCK_RATE_11MB);
7064         }
7065         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
7066         return (-1);
7067 }
7068
7069 static void
7070 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
7071     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
7072     int rssi, int noise)
7073 {
7074         struct bwn_softc *sc = mac->mac_sc;
7075         const struct ieee80211_frame_min *wh;
7076         uint64_t tsf;
7077         uint16_t low_mactime_now;
7078         uint16_t mt;
7079
7080         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
7081                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7082
7083         wh = mtod(m, const struct ieee80211_frame_min *);
7084         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
7085                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
7086
7087         bwn_tsf_read(mac, &tsf);
7088         low_mactime_now = tsf;
7089         tsf = tsf & ~0xffffULL;
7090
7091         switch (mac->mac_fw.fw_hdr_format) {
7092         case BWN_FW_HDR_351:
7093         case BWN_FW_HDR_410:
7094                 mt = le16toh(rxhdr->ps4.r351.mac_time);
7095                 break;
7096         case BWN_FW_HDR_598:
7097                 mt = le16toh(rxhdr->ps4.r598.mac_time);
7098                 break;
7099         }
7100
7101         tsf += mt;
7102         if (low_mactime_now < mt)
7103                 tsf -= 0x10000;
7104
7105         sc->sc_rx_th.wr_tsf = tsf;
7106         sc->sc_rx_th.wr_rate = rate;
7107         sc->sc_rx_th.wr_antsignal = rssi;
7108         sc->sc_rx_th.wr_antnoise = noise;
7109 }
7110
7111 static void
7112 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
7113 {
7114         uint32_t low, high;
7115
7116         KASSERT(bhnd_get_hwrev(mac->mac_sc->sc_dev) >= 3,
7117             ("%s:%d: fail", __func__, __LINE__));
7118
7119         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
7120         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
7121         *tsf = high;
7122         *tsf <<= 32;
7123         *tsf |= low;
7124 }
7125
7126 static int
7127 bwn_dma_attach(struct bwn_mac *mac)
7128 {
7129         struct bwn_dma                  *dma;
7130         struct bwn_softc                *sc;
7131         struct bhnd_dma_translation     *dt, dma_translation;
7132         bhnd_addr_t                      addrext_req;
7133         bus_dma_tag_t                    dmat;
7134         bus_addr_t                       lowaddr;
7135         u_int                            addrext_shift, addr_width;
7136         int                              error;
7137
7138         dma = &mac->mac_method.dma;
7139         sc = mac->mac_sc;
7140         dt = NULL;
7141
7142         if (sc->sc_quirks & BWN_QUIRK_NODMA)
7143                 return (0);
7144
7145         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5, ("%s: fail", __func__));
7146
7147         /* Use the DMA engine's maximum host address width to determine the
7148          * addrext constraints, and supported device address width. */
7149         switch (mac->mac_dmatype) {
7150         case BHND_DMA_ADDR_30BIT:
7151                 /* 32-bit engine without addrext support */
7152                 addrext_req = 0x0;
7153                 addrext_shift = 0;
7154
7155                 /* We can address the full 32-bit device address space */
7156                 addr_width = BHND_DMA_ADDR_32BIT;
7157                 break;
7158
7159         case BHND_DMA_ADDR_32BIT:
7160                 /* 32-bit engine with addrext support */
7161                 addrext_req = BWN_DMA32_ADDREXT_MASK;
7162                 addrext_shift = BWN_DMA32_ADDREXT_SHIFT;
7163                 addr_width = BHND_DMA_ADDR_32BIT;
7164                 break;
7165
7166         case BHND_DMA_ADDR_64BIT:
7167                 /* 64-bit engine with addrext support */
7168                 addrext_req = BWN_DMA64_ADDREXT_MASK;
7169                 addrext_shift = BWN_DMA64_ADDREXT_SHIFT;
7170                 addr_width = BHND_DMA_ADDR_64BIT;
7171                 break;
7172
7173         default:
7174                 device_printf(sc->sc_dev, "unsupported DMA address width: %d\n",
7175                     mac->mac_dmatype);
7176                 return (ENXIO);
7177         }
7178
7179
7180         /* Fetch our device->host DMA translation and tag */
7181         error = bhnd_get_dma_translation(sc->sc_dev, addr_width, 0, &dmat,
7182             &dma_translation);
7183         if (error) {
7184                 device_printf(sc->sc_dev, "error fetching DMA translation: "
7185                     "%d\n", error);
7186                 return (error);
7187         }
7188
7189         /* Verify that our DMA engine's addrext constraints are compatible with
7190          * our DMA translation */
7191         if (addrext_req != 0x0 &&
7192             (dma_translation.addrext_mask & addrext_req) != addrext_req)
7193         {
7194                 device_printf(sc->sc_dev, "bus addrext mask %#jx incompatible "
7195                     "with device addrext mask %#jx, disabling extended address "
7196                     "support\n", (uintmax_t)dma_translation.addrext_mask,
7197                     (uintmax_t)addrext_req);
7198
7199                 addrext_req = 0x0;
7200                 addrext_shift = 0;
7201         }
7202
7203         /* Apply our addrext translation constraint */
7204         dma_translation.addrext_mask = addrext_req;
7205
7206         /* Initialize our DMA engine configuration */
7207         mac->mac_flags |= BWN_MAC_FLAG_DMA;
7208
7209         dma->addrext_shift = addrext_shift;
7210         dma->translation = dma_translation;
7211
7212         dt = &dma->translation;
7213
7214         /* Dermine our translation's maximum supported address */
7215         lowaddr = MIN((dt->addr_mask | dt->addrext_mask), BUS_SPACE_MAXADDR);
7216
7217         /*
7218          * Create top level DMA tag
7219          */
7220         error = bus_dma_tag_create(dmat,                /* parent */
7221                                BWN_ALIGN, 0,            /* alignment, bounds */
7222                                lowaddr,                 /* lowaddr */
7223                                BUS_SPACE_MAXADDR,       /* highaddr */
7224                                NULL, NULL,              /* filter, filterarg */
7225                                BUS_SPACE_MAXSIZE,       /* maxsize */
7226                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
7227                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
7228                                0,                       /* flags */
7229                                NULL, NULL,              /* lockfunc, lockarg */
7230                                &dma->parent_dtag);
7231         if (error) {
7232                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
7233                 return (error);
7234         }
7235
7236         /*
7237          * Create TX/RX mbuf DMA tag
7238          */
7239         error = bus_dma_tag_create(dma->parent_dtag,
7240                                 1,
7241                                 0,
7242                                 BUS_SPACE_MAXADDR,
7243                                 BUS_SPACE_MAXADDR,
7244                                 NULL, NULL,
7245                                 MCLBYTES,
7246                                 1,
7247                                 BUS_SPACE_MAXSIZE_32BIT,
7248                                 0,
7249                                 NULL, NULL,
7250                                 &dma->rxbuf_dtag);
7251         if (error) {
7252                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7253                 goto fail0;
7254         }
7255         error = bus_dma_tag_create(dma->parent_dtag,
7256                                 1,
7257                                 0,
7258                                 BUS_SPACE_MAXADDR,
7259                                 BUS_SPACE_MAXADDR,
7260                                 NULL, NULL,
7261                                 MCLBYTES,
7262                                 1,
7263                                 BUS_SPACE_MAXSIZE_32BIT,
7264                                 0,
7265                                 NULL, NULL,
7266                                 &dma->txbuf_dtag);
7267         if (error) {
7268                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7269                 goto fail1;
7270         }
7271
7272         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1);
7273         if (!dma->wme[WME_AC_BK])
7274                 goto fail2;
7275
7276         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1);
7277         if (!dma->wme[WME_AC_BE])
7278                 goto fail3;
7279
7280         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1);
7281         if (!dma->wme[WME_AC_VI])
7282                 goto fail4;
7283
7284         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1);
7285         if (!dma->wme[WME_AC_VO])
7286                 goto fail5;
7287
7288         dma->mcast = bwn_dma_ringsetup(mac, 4, 1);
7289         if (!dma->mcast)
7290                 goto fail6;
7291         dma->rx = bwn_dma_ringsetup(mac, 0, 0);
7292         if (!dma->rx)
7293                 goto fail7;
7294
7295         return (error);
7296
7297 fail7:  bwn_dma_ringfree(&dma->mcast);
7298 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7299 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7300 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7301 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7302 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
7303 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
7304 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
7305         return (error);
7306 }
7307
7308 static struct bwn_dma_ring *
7309 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7310     uint16_t cookie, int *slot)
7311 {
7312         struct bwn_dma *dma = &mac->mac_method.dma;
7313         struct bwn_dma_ring *dr;
7314         struct bwn_softc *sc = mac->mac_sc;
7315
7316         BWN_ASSERT_LOCKED(mac->mac_sc);
7317
7318         switch (cookie & 0xf000) {
7319         case 0x1000:
7320                 dr = dma->wme[WME_AC_BK];
7321                 break;
7322         case 0x2000:
7323                 dr = dma->wme[WME_AC_BE];
7324                 break;
7325         case 0x3000:
7326                 dr = dma->wme[WME_AC_VI];
7327                 break;
7328         case 0x4000:
7329                 dr = dma->wme[WME_AC_VO];
7330                 break;
7331         case 0x5000:
7332                 dr = dma->mcast;
7333                 break;
7334         default:
7335                 dr = NULL;
7336                 KASSERT(0 == 1,
7337                     ("invalid cookie value %d", cookie & 0xf000));
7338         }
7339         *slot = (cookie & 0x0fff);
7340         if (*slot < 0 || *slot >= dr->dr_numslots) {
7341                 /*
7342                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7343                  * that it occurs events which have same H/W sequence numbers.
7344                  * When it's occurred just prints a WARNING msgs and ignores.
7345                  */
7346                 KASSERT(status->seq == dma->lastseq,
7347                     ("%s:%d: fail", __func__, __LINE__));
7348                 device_printf(sc->sc_dev,
7349                     "out of slot ranges (0 < %d < %d)\n", *slot,
7350                     dr->dr_numslots);
7351                 return (NULL);
7352         }
7353         dma->lastseq = status->seq;
7354         return (dr);
7355 }
7356
7357 static void
7358 bwn_dma_stop(struct bwn_mac *mac)
7359 {
7360         struct bwn_dma *dma;
7361
7362         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7363                 return;
7364         dma = &mac->mac_method.dma;
7365
7366         bwn_dma_ringstop(&dma->rx);
7367         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7368         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7369         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7370         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7371         bwn_dma_ringstop(&dma->mcast);
7372 }
7373
7374 static void
7375 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7376 {
7377
7378         if (dr == NULL)
7379                 return;
7380
7381         bwn_dma_cleanup(*dr);
7382 }
7383
7384 static void
7385 bwn_pio_stop(struct bwn_mac *mac)
7386 {
7387         struct bwn_pio *pio;
7388
7389         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7390                 return;
7391         pio = &mac->mac_method.pio;
7392
7393         bwn_destroy_queue_tx(&pio->mcast);
7394         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7395         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7396         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7397         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7398 }
7399
7400 static int
7401 bwn_led_attach(struct bwn_mac *mac)
7402 {
7403         struct bwn_softc *sc = mac->mac_sc;
7404         const uint8_t *led_act = NULL;
7405         int error;
7406         int i;
7407
7408         sc->sc_led_idle = (2350 * hz) / 1000;
7409         sc->sc_led_blink = 1;
7410
7411         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7412                 if (sc->sc_board_info.board_vendor ==
7413                     bwn_vendor_led_act[i].vid) {
7414                         led_act = bwn_vendor_led_act[i].led_act;
7415                         break;
7416                 }
7417         }
7418         if (led_act == NULL)
7419                 led_act = bwn_default_led_act;
7420
7421         _Static_assert(nitems(bwn_led_vars) == BWN_LED_MAX,
7422             "invalid NVRAM variable name array");
7423
7424         for (i = 0; i < BWN_LED_MAX; ++i) {
7425                 struct bwn_led  *led;
7426                 uint8_t          val;
7427
7428                 led = &sc->sc_leds[i];
7429
7430                 KASSERT(i < nitems(bwn_led_vars), ("unknown LED index"));
7431                 error = bhnd_nvram_getvar_uint8(sc->sc_dev, bwn_led_vars[i],
7432                     &val);
7433                 if (error) {
7434                         if (error != ENOENT) {
7435                                 device_printf(sc->sc_dev, "NVRAM variable %s "
7436                                     "unreadable: %d", bwn_led_vars[i], error);
7437                                 return (error);
7438                         }
7439
7440                         /* Not found; use default */
7441                         led->led_act = led_act[i];
7442                 } else {
7443                         if (val & BWN_LED_ACT_LOW)
7444                                 led->led_flags |= BWN_LED_F_ACTLOW;
7445                         led->led_act = val & BWN_LED_ACT_MASK;
7446                 }
7447                 led->led_mask = (1 << i);
7448
7449                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7450                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
7451                     led->led_act == BWN_LED_ACT_BLINK) {
7452                         led->led_flags |= BWN_LED_F_BLINK;
7453                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7454                                 led->led_flags |= BWN_LED_F_POLLABLE;
7455                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7456                                 led->led_flags |= BWN_LED_F_SLOW;
7457
7458                         if (sc->sc_blink_led == NULL) {
7459                                 sc->sc_blink_led = led;
7460                                 if (led->led_flags & BWN_LED_F_SLOW)
7461                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
7462                         }
7463                 }
7464
7465                 DPRINTF(sc, BWN_DEBUG_LED,
7466                     "%dth led, act %d, lowact %d\n", i,
7467                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7468         }
7469         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7470
7471         return (0);
7472 }
7473
7474 static __inline uint16_t
7475 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7476 {
7477
7478         if (led->led_flags & BWN_LED_F_ACTLOW)
7479                 on = !on;
7480         if (on)
7481                 val |= led->led_mask;
7482         else
7483                 val &= ~led->led_mask;
7484         return val;
7485 }
7486
7487 static void
7488 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7489 {
7490         struct bwn_softc *sc = mac->mac_sc;
7491         struct ieee80211com *ic = &sc->sc_ic;
7492         uint16_t val;
7493         int i;
7494
7495         if (nstate == IEEE80211_S_INIT) {
7496                 callout_stop(&sc->sc_led_blink_ch);
7497                 sc->sc_led_blinking = 0;
7498         }
7499
7500         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7501                 return;
7502
7503         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7504         for (i = 0; i < BWN_LED_MAX; ++i) {
7505                 struct bwn_led *led = &sc->sc_leds[i];
7506                 int on;
7507
7508                 if (led->led_act == BWN_LED_ACT_UNKN ||
7509                     led->led_act == BWN_LED_ACT_NULL)
7510                         continue;
7511
7512                 if ((led->led_flags & BWN_LED_F_BLINK) &&
7513                     nstate != IEEE80211_S_INIT)
7514                         continue;
7515
7516                 switch (led->led_act) {
7517                 case BWN_LED_ACT_ON:    /* Always on */
7518                         on = 1;
7519                         break;
7520                 case BWN_LED_ACT_OFF:   /* Always off */
7521                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7522                         on = 0;
7523                         break;
7524                 default:
7525                         on = 1;
7526                         switch (nstate) {
7527                         case IEEE80211_S_INIT:
7528                                 on = 0;
7529                                 break;
7530                         case IEEE80211_S_RUN:
7531                                 if (led->led_act == BWN_LED_ACT_11G &&
7532                                     ic->ic_curmode != IEEE80211_MODE_11G)
7533                                         on = 0;
7534                                 break;
7535                         default:
7536                                 if (led->led_act == BWN_LED_ACT_ASSOC)
7537                                         on = 0;
7538                                 break;
7539                         }
7540                         break;
7541                 }
7542
7543                 val = bwn_led_onoff(led, val, on);
7544         }
7545         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7546 }
7547
7548 static void
7549 bwn_led_event(struct bwn_mac *mac, int event)
7550 {
7551         struct bwn_softc *sc = mac->mac_sc;
7552         struct bwn_led *led = sc->sc_blink_led;
7553         int rate;
7554
7555         if (event == BWN_LED_EVENT_POLL) {
7556                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7557                         return;
7558                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7559                         return;
7560         }
7561
7562         sc->sc_led_ticks = ticks;
7563         if (sc->sc_led_blinking)
7564                 return;
7565
7566         switch (event) {
7567         case BWN_LED_EVENT_RX:
7568                 rate = sc->sc_rx_rate;
7569                 break;
7570         case BWN_LED_EVENT_TX:
7571                 rate = sc->sc_tx_rate;
7572                 break;
7573         case BWN_LED_EVENT_POLL:
7574                 rate = 0;
7575                 break;
7576         default:
7577                 panic("unknown LED event %d\n", event);
7578                 break;
7579         }
7580         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7581             bwn_led_duration[rate].off_dur);
7582 }
7583
7584 static void
7585 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7586 {
7587         struct bwn_softc *sc = mac->mac_sc;
7588         struct bwn_led *led = sc->sc_blink_led;
7589         uint16_t val;
7590
7591         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7592         val = bwn_led_onoff(led, val, 1);
7593         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7594
7595         if (led->led_flags & BWN_LED_F_SLOW) {
7596                 BWN_LED_SLOWDOWN(on_dur);
7597                 BWN_LED_SLOWDOWN(off_dur);
7598         }
7599
7600         sc->sc_led_blinking = 1;
7601         sc->sc_led_blink_offdur = off_dur;
7602
7603         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7604 }
7605
7606 static void
7607 bwn_led_blink_next(void *arg)
7608 {
7609         struct bwn_mac *mac = arg;
7610         struct bwn_softc *sc = mac->mac_sc;
7611         uint16_t val;
7612
7613         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7614         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7615         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7616
7617         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7618             bwn_led_blink_end, mac);
7619 }
7620
7621 static void
7622 bwn_led_blink_end(void *arg)
7623 {
7624         struct bwn_mac *mac = arg;
7625         struct bwn_softc *sc = mac->mac_sc;
7626
7627         sc->sc_led_blinking = 0;
7628 }
7629
7630 static int
7631 bwn_suspend(device_t dev)
7632 {
7633         struct bwn_softc *sc = device_get_softc(dev);
7634
7635         BWN_LOCK(sc);
7636         bwn_stop(sc);
7637         BWN_UNLOCK(sc);
7638         return (0);
7639 }
7640
7641 static int
7642 bwn_resume(device_t dev)
7643 {
7644         struct bwn_softc *sc = device_get_softc(dev);
7645         int error = EDOOFUS;
7646
7647         BWN_LOCK(sc);
7648         if (sc->sc_ic.ic_nrunning > 0)
7649                 error = bwn_init(sc);
7650         BWN_UNLOCK(sc);
7651         if (error == 0)
7652                 ieee80211_start_all(&sc->sc_ic);
7653         return (0);
7654 }
7655
7656 static void
7657 bwn_rfswitch(void *arg)
7658 {
7659         struct bwn_softc *sc = arg;
7660         struct bwn_mac *mac = sc->sc_curmac;
7661         int cur = 0, prev = 0;
7662
7663         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7664             ("%s: invalid MAC status %d", __func__, mac->mac_status));
7665
7666         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7667             || mac->mac_phy.type == BWN_PHYTYPE_N) {
7668                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7669                         & BWN_RF_HWENABLED_HI_MASK))
7670                         cur = 1;
7671         } else {
7672                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7673                     & BWN_RF_HWENABLED_LO_MASK)
7674                         cur = 1;
7675         }
7676
7677         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7678                 prev = 1;
7679
7680         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7681             __func__, cur, prev);
7682
7683         if (cur != prev) {
7684                 if (cur)
7685                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7686                 else
7687                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7688
7689                 device_printf(sc->sc_dev,
7690                     "status of RF switch is changed to %s\n",
7691                     cur ? "ON" : "OFF");
7692                 if (cur != mac->mac_phy.rf_on) {
7693                         if (cur)
7694                                 bwn_rf_turnon(mac);
7695                         else
7696                                 bwn_rf_turnoff(mac);
7697                 }
7698         }
7699
7700         callout_schedule(&sc->sc_rfswitch_ch, hz);
7701 }
7702
7703 static void
7704 bwn_sysctl_node(struct bwn_softc *sc)
7705 {
7706         device_t dev = sc->sc_dev;
7707         struct bwn_mac *mac;
7708         struct bwn_stats *stats;
7709
7710         /* XXX assume that count of MAC is only 1. */
7711
7712         if ((mac = sc->sc_curmac) == NULL)
7713                 return;
7714         stats = &mac->mac_stats;
7715
7716         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7717             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7718             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7719         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7720             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7721             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7722         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7723             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7724             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7725
7726 #ifdef BWN_DEBUG
7727         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7728             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7729             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7730 #endif
7731 }
7732
7733 static device_method_t bwn_methods[] = {
7734         /* Device interface */
7735         DEVMETHOD(device_probe,         bwn_probe),
7736         DEVMETHOD(device_attach,        bwn_attach),
7737         DEVMETHOD(device_detach,        bwn_detach),
7738         DEVMETHOD(device_suspend,       bwn_suspend),
7739         DEVMETHOD(device_resume,        bwn_resume),
7740         DEVMETHOD_END
7741 };
7742 static driver_t bwn_driver = {
7743         "bwn",
7744         bwn_methods,
7745         sizeof(struct bwn_softc)
7746 };
7747 static devclass_t bwn_devclass;
7748 DRIVER_MODULE(bwn, bhnd, bwn_driver, bwn_devclass, 0, 0);
7749 MODULE_DEPEND(bwn, bhnd, 1, 1, 1);
7750 MODULE_DEPEND(bwn, gpiobus, 1, 1, 1);
7751 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
7752 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
7753 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7754 MODULE_VERSION(bwn, 1);