sys/dev/bwn/if_bwn.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   3  *
   4  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
   5  * Copyright (c) 2016 Landon Fuller <landonf@FreeBSD.org>
   6  * Copyright (c) 2017 The FreeBSD Foundation
   7  * All rights reserved.
   8  *
   9  * Portions of this software were developed by Landon Fuller
  10  * under sponsorship from the FreeBSD Foundation.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer,
  17  *    without modification.
  18  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  19  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
  20  *    redistribution must be conditioned upon including a substantially
  21  *    similar Disclaimer requirement for further binary redistribution.
  22  *
  23  * NO WARRANTY
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
  27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
  28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
  29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  34  * THE POSSIBILITY OF SUCH DAMAGES.
  35  */
  36
  37 #include <sys/cdefs.h>
  38 __FBSDID("$FreeBSD$");
  39
  40 /*
  41  * The Broadcom Wireless LAN controller driver.
  42  */
  43
  44 #include "opt_bwn.h"
  45 #include "opt_wlan.h"
  46
  47 #include <sys/param.h>
  48 #include <sys/systm.h>
  49 #include <sys/kernel.h>
  50 #include <sys/gpio.h>
  51 #include <sys/malloc.h>
  52 #include <sys/module.h>
  53 #include <sys/endian.h>
  54 #include <sys/errno.h>
  55 #include <sys/firmware.h>
  56 #include <sys/lock.h>
  57 #include <sys/mutex.h>
  58 #include <machine/bus.h>
  59 #include <machine/resource.h>
  60 #include <sys/bus.h>
  61 #include <sys/rman.h>
  62 #include <sys/socket.h>
  63 #include <sys/sockio.h>
  64
  65 #include <net/ethernet.h>
  66 #include <net/if.h>
  67 #include <net/if_var.h>
  68 #include <net/if_arp.h>
  69 #include <net/if_dl.h>
  70 #include <net/if_llc.h>
  71 #include <net/if_media.h>
  72 #include <net/if_types.h>
  73
  74 #include <net80211/ieee80211_var.h>
  75 #include <net80211/ieee80211_radiotap.h>
  76 #include <net80211/ieee80211_regdomain.h>
  77 #include <net80211/ieee80211_phy.h>
  78 #include <net80211/ieee80211_ratectl.h>
  79
  80 #include <dev/bhnd/bhnd.h>
  81 #include <dev/bhnd/bhnd_ids.h>
  82
  83 #include <dev/bhnd/cores/chipc/chipc.h>
  84 #include <dev/bhnd/cores/pmu/bhnd_pmu.h>
  85
  86 #include <dev/bwn/if_bwnreg.h>
  87 #include <dev/bwn/if_bwnvar.h>
  88
  89 #include <dev/bwn/if_bwn_debug.h>
  90 #include <dev/bwn/if_bwn_misc.h>
  91 #include <dev/bwn/if_bwn_util.h>
  92 #include <dev/bwn/if_bwn_phy_common.h>
  93 #include <dev/bwn/if_bwn_phy_g.h>
  94 #include <dev/bwn/if_bwn_phy_lp.h>
  95 #include <dev/bwn/if_bwn_phy_n.h>
  96
  97 #include "bhnd_nvram_map.h"
  98
  99 #include "gpio_if.h"
 100
 101 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
 102     "Broadcom driver parameters");
 103
 104 /*
 105  * Tunable & sysctl variables.
 106  */
 107
 108 #ifdef BWN_DEBUG
 109 static  int bwn_debug = 0;
 110 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
 111     "Broadcom debugging printfs");
 112 #endif
 113
 114 static int      bwn_bfp = 0;            /* use "Bad Frames Preemption" */
 115 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
 116     "uses Bad Frames Preemption");
 117 static int      bwn_bluetooth = 1;
 118 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
 119     "turns on Bluetooth Coexistence");
 120 static int      bwn_hwpctl = 0;
 121 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
 122     "uses H/W power control");
 123 static int      bwn_usedma = 1;
 124 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
 125     "uses DMA");
 126 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
 127 static int      bwn_wme = 1;
 128 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
 129     "uses WME support");
 130
 131 static void     bwn_attach_pre(struct bwn_softc *);
 132 static int      bwn_attach_post(struct bwn_softc *);
 133 static int      bwn_retain_bus_providers(struct bwn_softc *sc);
 134 static void     bwn_release_bus_providers(struct bwn_softc *sc);
 135 static void     bwn_sprom_bugfixes(device_t);
 136 static int      bwn_init(struct bwn_softc *);
 137 static void     bwn_parent(struct ieee80211com *);
 138 static void     bwn_start(struct bwn_softc *);
 139 static int      bwn_transmit(struct ieee80211com *, struct mbuf *);
 140 static int      bwn_attach_core(struct bwn_mac *);
 141 static int      bwn_phy_getinfo(struct bwn_mac *, int);
 142 static int      bwn_chiptest(struct bwn_mac *);
 143 static int      bwn_setup_channels(struct bwn_mac *, int, int);
 144 static void     bwn_shm_ctlword(struct bwn_mac *, uint16_t,
 145                     uint16_t);
 146 static void     bwn_addchannels(struct ieee80211_channel [], int, int *,
 147                     const struct bwn_channelinfo *, const uint8_t []);
 148 static int      bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 149                     const struct ieee80211_bpf_params *);
 150 static void     bwn_updateslot(struct ieee80211com *);
 151 static void     bwn_update_promisc(struct ieee80211com *);
 152 static void     bwn_wme_init(struct bwn_mac *);
 153 static int      bwn_wme_update(struct ieee80211com *);
 154 static void     bwn_wme_clear(struct bwn_softc *);
 155 static void     bwn_wme_load(struct bwn_mac *);
 156 static void     bwn_wme_loadparams(struct bwn_mac *,
 157                     const struct wmeParams *, uint16_t);
 158 static void     bwn_scan_start(struct ieee80211com *);
 159 static void     bwn_scan_end(struct ieee80211com *);
 160 static void     bwn_set_channel(struct ieee80211com *);
 161 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
 162                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 163                     const uint8_t [IEEE80211_ADDR_LEN],
 164                     const uint8_t [IEEE80211_ADDR_LEN]);
 165 static void     bwn_vap_delete(struct ieee80211vap *);
 166 static void     bwn_stop(struct bwn_softc *);
 167 static int      bwn_core_forceclk(struct bwn_mac *, bool);
 168 static int      bwn_core_init(struct bwn_mac *);
 169 static void     bwn_core_start(struct bwn_mac *);
 170 static void     bwn_core_exit(struct bwn_mac *);
 171 static void     bwn_bt_disable(struct bwn_mac *);
 172 static int      bwn_chip_init(struct bwn_mac *);
 173 static void     bwn_set_txretry(struct bwn_mac *, int, int);
 174 static void     bwn_rate_init(struct bwn_mac *);
 175 static void     bwn_set_phytxctl(struct bwn_mac *);
 176 static void     bwn_spu_setdelay(struct bwn_mac *, int);
 177 static void     bwn_bt_enable(struct bwn_mac *);
 178 static void     bwn_set_macaddr(struct bwn_mac *);
 179 static void     bwn_crypt_init(struct bwn_mac *);
 180 static void     bwn_chip_exit(struct bwn_mac *);
 181 static int      bwn_fw_fillinfo(struct bwn_mac *);
 182 static int      bwn_fw_loaducode(struct bwn_mac *);
 183 static int      bwn_gpio_init(struct bwn_mac *);
 184 static int      bwn_fw_loadinitvals(struct bwn_mac *);
 185 static int      bwn_phy_init(struct bwn_mac *);
 186 static void     bwn_set_txantenna(struct bwn_mac *, int);
 187 static void     bwn_set_opmode(struct bwn_mac *);
 188 static void     bwn_rate_write(struct bwn_mac *, uint16_t, int);
 189 static uint8_t  bwn_plcp_getcck(const uint8_t);
 190 static uint8_t  bwn_plcp_getofdm(const uint8_t);
 191 static void     bwn_pio_init(struct bwn_mac *);
 192 static uint16_t bwn_pio_idx2base(struct bwn_mac *, int);
 193 static void     bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
 194                     int);
 195 static void     bwn_pio_setupqueue_rx(struct bwn_mac *,
 196                     struct bwn_pio_rxqueue *, int);
 197 static void     bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
 198 static uint16_t bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
 199                     uint16_t);
 200 static void     bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
 201 static int      bwn_pio_rx(struct bwn_pio_rxqueue *);
 202 static uint8_t  bwn_pio_rxeof(struct bwn_pio_rxqueue *);
 203 static void     bwn_pio_handle_txeof(struct bwn_mac *,
 204                     const struct bwn_txstatus *);
 205 static uint16_t bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
 206 static uint32_t bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
 207 static void     bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
 208                     uint16_t);
 209 static void     bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
 210                     uint32_t);
 211 static int      bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
 212                     struct mbuf **);
 213 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
 214 static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
 215                     struct bwn_pio_txqueue *, uint32_t, const void *, int);
 216 static void     bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
 217                     uint16_t, uint32_t);
 218 static uint16_t bwn_pio_write_multi_2(struct bwn_mac *,
 219                     struct bwn_pio_txqueue *, uint16_t, const void *, int);
 220 static uint16_t bwn_pio_write_mbuf_2(struct bwn_mac *,
 221                     struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
 222 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
 223                     uint16_t, struct bwn_pio_txpkt **);
 224 static void     bwn_dma_init(struct bwn_mac *);
 225 static void     bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
 226 static uint16_t bwn_dma_base(int, int);
 227 static void     bwn_dma_ringfree(struct bwn_dma_ring **);
 228 static void     bwn_dma_32_getdesc(struct bwn_dma_ring *,
 229                     int, struct bwn_dmadesc_generic **,
 230                     struct bwn_dmadesc_meta **);
 231 static void     bwn_dma_32_setdesc(struct bwn_dma_ring *,
 232                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 233                     int, int);
 234 static void     bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
 235 static void     bwn_dma_32_suspend(struct bwn_dma_ring *);
 236 static void     bwn_dma_32_resume(struct bwn_dma_ring *);
 237 static int      bwn_dma_32_get_curslot(struct bwn_dma_ring *);
 238 static void     bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
 239 static void     bwn_dma_64_getdesc(struct bwn_dma_ring *,
 240                     int, struct bwn_dmadesc_generic **,
 241                     struct bwn_dmadesc_meta **);
 242 static void     bwn_dma_64_setdesc(struct bwn_dma_ring *,
 243                     struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
 244                     int, int);
 245 static void     bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
 246 static void     bwn_dma_64_suspend(struct bwn_dma_ring *);
 247 static void     bwn_dma_64_resume(struct bwn_dma_ring *);
 248 static int      bwn_dma_64_get_curslot(struct bwn_dma_ring *);
 249 static void     bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
 250 static int      bwn_dma_allocringmemory(struct bwn_dma_ring *);
 251 static void     bwn_dma_setup(struct bwn_dma_ring *);
 252 static void     bwn_dma_free_ringmemory(struct bwn_dma_ring *);
 253 static void     bwn_dma_cleanup(struct bwn_dma_ring *);
 254 static void     bwn_dma_free_descbufs(struct bwn_dma_ring *);
 255 static int      bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
 256 static void     bwn_dma_rx(struct bwn_dma_ring *);
 257 static int      bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
 258 static void     bwn_dma_free_descbuf(struct bwn_dma_ring *,
 259                     struct bwn_dmadesc_meta *);
 260 static void     bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
 261 static void     bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
 262 static int      bwn_dma_freeslot(struct bwn_dma_ring *);
 263 static int      bwn_dma_nextslot(struct bwn_dma_ring *, int);
 264 static void     bwn_dma_rxeof(struct bwn_dma_ring *, int *);
 265 static int      bwn_dma_newbuf(struct bwn_dma_ring *,
 266                     struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
 267                     int);
 268 static void     bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
 269                     bus_size_t, int);
 270 static uint8_t  bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
 271 static void     bwn_ratectl_tx_complete(const struct ieee80211_node *,
 272                     const struct bwn_txstatus *);
 273 static void     bwn_dma_handle_txeof(struct bwn_mac *,
 274                     const struct bwn_txstatus *);
 275 static int      bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
 276                     struct mbuf **);
 277 static int      bwn_dma_getslot(struct bwn_dma_ring *);
 278 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
 279                     uint8_t);
 280 static int      bwn_dma_attach(struct bwn_mac *);
 281 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
 282                     int, int);
 283 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
 284                     const struct bwn_txstatus *, uint16_t, int *);
 285 static void     bwn_dma_free(struct bwn_mac *);
 286 static int      bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
 287 static int      bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
 288                     const char *, struct bwn_fwfile *);
 289 static void     bwn_release_firmware(struct bwn_mac *);
 290 static void     bwn_do_release_fw(struct bwn_fwfile *);
 291 static uint16_t bwn_fwcaps_read(struct bwn_mac *);
 292 static int      bwn_fwinitvals_write(struct bwn_mac *,
 293                     const struct bwn_fwinitvals *, size_t, size_t);
 294 static uint16_t bwn_ant2phy(int);
 295 static void     bwn_mac_write_bssid(struct bwn_mac *);
 296 static void     bwn_mac_setfilter(struct bwn_mac *, uint16_t,
 297                     const uint8_t *);
 298 static void     bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
 299                     const uint8_t *, size_t, const uint8_t *);
 300 static void     bwn_key_macwrite(struct bwn_mac *, uint8_t,
 301                     const uint8_t *);
 302 static void     bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
 303                     const uint8_t *);
 304 static void     bwn_phy_exit(struct bwn_mac *);
 305 static void     bwn_core_stop(struct bwn_mac *);
 306 static int      bwn_switch_band(struct bwn_softc *,
 307                     struct ieee80211_channel *);
 308 static int      bwn_phy_reset(struct bwn_mac *);
 309 static int      bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 310 static void     bwn_set_pretbtt(struct bwn_mac *);
 311 static int      bwn_intr(void *);
 312 static void     bwn_intrtask(void *, int);
 313 static void     bwn_restart(struct bwn_mac *, const char *);
 314 static void     bwn_intr_ucode_debug(struct bwn_mac *);
 315 static void     bwn_intr_tbtt_indication(struct bwn_mac *);
 316 static void     bwn_intr_atim_end(struct bwn_mac *);
 317 static void     bwn_intr_beacon(struct bwn_mac *);
 318 static void     bwn_intr_pmq(struct bwn_mac *);
 319 static void     bwn_intr_noise(struct bwn_mac *);
 320 static void     bwn_intr_txeof(struct bwn_mac *);
 321 static void     bwn_hwreset(void *, int);
 322 static void     bwn_handle_fwpanic(struct bwn_mac *);
 323 static void     bwn_load_beacon0(struct bwn_mac *);
 324 static void     bwn_load_beacon1(struct bwn_mac *);
 325 static uint32_t bwn_jssi_read(struct bwn_mac *);
 326 static void     bwn_noise_gensample(struct bwn_mac *);
 327 static void     bwn_handle_txeof(struct bwn_mac *,
 328                     const struct bwn_txstatus *);
 329 static void     bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
 330 static void     bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
 331 static int      bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
 332                     struct mbuf *);
 333 static int      bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
 334 static int      bwn_set_txhdr(struct bwn_mac *,
 335                     struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
 336                     uint16_t);
 337 static void     bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
 338                     const uint8_t);
 339 static uint8_t  bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
 340 static uint8_t  bwn_get_fbrate(uint8_t);
 341 static void     bwn_txpwr(void *, int);
 342 static void     bwn_tasks(void *);
 343 static void     bwn_task_15s(struct bwn_mac *);
 344 static void     bwn_task_30s(struct bwn_mac *);
 345 static void     bwn_task_60s(struct bwn_mac *);
 346 static int      bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
 347                     uint8_t);
 348 static int      bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
 349 static void     bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
 350                     const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
 351                     int, int);
 352 static void     bwn_tsf_read(struct bwn_mac *, uint64_t *);
 353 static void     bwn_set_slot_time(struct bwn_mac *, uint16_t);
 354 static void     bwn_watchdog(void *);
 355 static void     bwn_dma_stop(struct bwn_mac *);
 356 static void     bwn_pio_stop(struct bwn_mac *);
 357 static void     bwn_dma_ringstop(struct bwn_dma_ring **);
 358 static int      bwn_led_attach(struct bwn_mac *);
 359 static void     bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
 360 static void     bwn_led_event(struct bwn_mac *, int);
 361 static void     bwn_led_blink_start(struct bwn_mac *, int, int);
 362 static void     bwn_led_blink_next(void *);
 363 static void     bwn_led_blink_end(void *);
 364 static void     bwn_rfswitch(void *);
 365 static void     bwn_rf_turnon(struct bwn_mac *);
 366 static void     bwn_rf_turnoff(struct bwn_mac *);
 367 static void     bwn_sysctl_node(struct bwn_softc *);
 368
 369 static const struct bwn_channelinfo bwn_chantable_bg = {
 370         .channels = {
 371                 { 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
 372                 { 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
 373                 { 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
 374                 { 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
 375                 { 2472, 13, 30 }, { 2484, 14, 30 } },
 376         .nchannels = 14
 377 };
 378
 379 static const struct bwn_channelinfo bwn_chantable_a = {
 380         .channels = {
 381                 { 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
 382                 { 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
 383                 { 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
 384                 { 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
 385                 { 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
 386                 { 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
 387                 { 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
 388                 { 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
 389                 { 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
 390                 { 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
 391                 { 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
 392                 { 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
 393                 { 6080, 216, 30 } },
 394         .nchannels = 37
 395 };
 396
 397 #if 0
 398 static const struct bwn_channelinfo bwn_chantable_n = {
 399         .channels = {
 400                 { 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
 401                 { 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
 402                 { 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
 403                 { 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
 404                 { 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
 405                 { 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
 406                 { 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
 407                 { 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
 408                 { 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
 409                 { 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
 410                 { 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
 411                 { 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
 412                 { 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
 413                 { 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
 414                 { 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
 415                 { 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
 416                 { 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
 417                 { 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
 418                 { 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
 419                 { 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
 420                 { 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
 421                 { 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
 422                 { 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
 423                 { 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
 424                 { 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
 425                 { 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
 426                 { 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
 427                 { 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
 428                 { 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
 429                 { 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
 430                 { 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
 431                 { 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
 432                 { 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
 433                 { 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
 434                 { 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
 435                 { 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
 436                 { 6130, 226, 30 }, { 6140, 228, 30 } },
 437         .nchannels = 110
 438 };
 439 #endif
 440
 441 #define VENDOR_LED_ACT(vendor)                          \
 442 {                                                       \
 443         .vid = PCI_VENDOR_##vendor,                     \
 444         .led_act = { BWN_VENDOR_LED_ACT_##vendor }      \
 445 }
 446
 447 static const struct {
 448         uint16_t        vid;
 449         uint8_t         led_act[BWN_LED_MAX];
 450 } bwn_vendor_led_act[] = {
 451         VENDOR_LED_ACT(HP_COMPAQ),
 452         VENDOR_LED_ACT(ASUSTEK)
 453 };
 454
 455 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
 456         { BWN_VENDOR_LED_ACT_DEFAULT };
 457
 458 #undef VENDOR_LED_ACT
 459
 460 static const char *bwn_led_vars[] = {
 461         BHND_NVAR_LEDBH0,
 462         BHND_NVAR_LEDBH1,
 463         BHND_NVAR_LEDBH2,
 464         BHND_NVAR_LEDBH3
 465 };
 466
 467 static const struct {
 468         int             on_dur;
 469         int             off_dur;
 470 } bwn_led_duration[109] = {
 471         [0]     = { 400, 100 },
 472         [2]     = { 150, 75 },
 473         [4]     = { 90, 45 },
 474         [11]    = { 66, 34 },
 475         [12]    = { 53, 26 },
 476         [18]    = { 42, 21 },
 477         [22]    = { 35, 17 },
 478         [24]    = { 32, 16 },
 479         [36]    = { 21, 10 },
 480         [48]    = { 16, 8 },
 481         [72]    = { 11, 5 },
 482         [96]    = { 9, 4 },
 483         [108]   = { 7, 3 }
 484 };
 485
 486 static const uint16_t bwn_wme_shm_offsets[] = {
 487         [0] = BWN_WME_BESTEFFORT,
 488         [1] = BWN_WME_BACKGROUND,
 489         [2] = BWN_WME_VOICE,
 490         [3] = BWN_WME_VIDEO,
 491 };
 492
 493 /* Supported D11 core revisions */
 494 #define BWN_DEV(_hwrev) {{                                      \
 495         BHND_MATCH_CORE(BHND_MFGID_BCM, BHND_COREID_D11),       \
 496         BHND_MATCH_CORE_REV(_hwrev),                            \
 497 }}
 498 static const struct bhnd_device bwn_devices[] = {
 499         BWN_DEV(HWREV_RANGE(5, 16)),
 500         BWN_DEV(HWREV_EQ(23)),
 501         BHND_DEVICE_END
 502 };
 503
 504 /* D11 quirks when bridged via a PCI host bridge core */
 505 static const struct bhnd_device_quirk pci_bridge_quirks[] = {
 506         BHND_CORE_QUIRK (HWREV_LTE(10), BWN_QUIRK_UCODE_SLOWCLOCK_WAR),
 507         BHND_DEVICE_QUIRK_END
 508 };
 509
 510 /* D11 quirks when bridged via a PCMCIA host bridge core */
 511 static const struct bhnd_device_quirk pcmcia_bridge_quirks[] = {
 512         BHND_CORE_QUIRK (HWREV_ANY,     BWN_QUIRK_NODMA),
 513         BHND_DEVICE_QUIRK_END
 514 };
 515
 516 /* Host bridge cores for which D11 quirk flags should be applied */
 517 static const struct bhnd_device bridge_devices[] = {
 518         BHND_DEVICE(BCM, PCI,           NULL, pci_bridge_quirks),
 519         BHND_DEVICE(BCM, PCMCIA,        NULL, pcmcia_bridge_quirks),
 520         BHND_DEVICE_END
 521 };
 522
 523 static int
 524 bwn_probe(device_t dev)
 525 {
 526         const struct bhnd_device *id;
 527
 528         id = bhnd_device_lookup(dev, bwn_devices, sizeof(bwn_devices[0]));
 529         if (id == NULL)
 530                 return (ENXIO);
 531
 532         bhnd_set_default_core_desc(dev);
 533         return (BUS_PROBE_DEFAULT);
 534 }
 535
 536 static int
 537 bwn_attach(device_t dev)
 538 {
 539         struct bwn_mac          *mac;
 540         struct bwn_softc        *sc;
 541         device_t                 parent, hostb;
 542         char                     chip_name[BHND_CHIPID_MAX_NAMELEN];
 543         int                      error;
 544
 545         sc = device_get_softc(dev);
 546         sc->sc_dev = dev;
 547 #ifdef BWN_DEBUG
 548         sc->sc_debug = bwn_debug;
 549 #endif
 550
 551         mac = NULL;
 552
 553         /* Determine the driver quirks applicable to this device, including any
 554          * quirks specific to the bus host bridge core (if any) */
 555         sc->sc_quirks = bhnd_device_quirks(dev, bwn_devices,
 556             sizeof(bwn_devices[0]));
 557
 558         parent = device_get_parent(dev);
 559         if ((hostb = bhnd_bus_find_hostb_device(parent)) != NULL) {
 560                 sc->sc_quirks |= bhnd_device_quirks(hostb, bridge_devices,
 561                     sizeof(bridge_devices[0]));
 562         }
 563
 564         /* DMA explicitly disabled? */
 565         if (!bwn_usedma)
 566                 sc->sc_quirks |= BWN_QUIRK_NODMA;
 567
 568         /* Fetch our chip identification and board info */
 569         sc->sc_cid = *bhnd_get_chipid(dev);
 570         if ((error = bhnd_read_board_info(dev, &sc->sc_board_info))) {
 571                 device_printf(sc->sc_dev, "couldn't read board info\n");
 572                 return (error);
 573         }
 574
 575         /* Allocate our D11 register block and PMU state */
 576         sc->sc_mem_rid = 0;
 577         sc->sc_mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 578             &sc->sc_mem_rid, RF_ACTIVE);
 579         if (sc->sc_mem_res == NULL) {
 580                 device_printf(sc->sc_dev, "couldn't allocate registers\n");
 581                 return (error);
 582         }
 583
 584         if ((error = bhnd_alloc_pmu(sc->sc_dev))) {
 585                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
 586                     sc->sc_mem_rid, sc->sc_mem_res);
 587                 return (error);
 588         }
 589
 590         /* Retain references to all required bus service providers */
 591         if ((error = bwn_retain_bus_providers(sc)))
 592                 goto fail;
 593
 594         /* Fetch mask of available antennas */
 595         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA2G,
 596             &sc->sc_ant2g);
 597         if (error) {
 598                 device_printf(sc->sc_dev, "error determining 2GHz antenna "
 599                     "availability from NVRAM: %d\n", error);
 600                 goto fail;
 601         }
 602
 603         error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA5G,
 604             &sc->sc_ant5g);
 605         if (error) {
 606                 device_printf(sc->sc_dev, "error determining 5GHz antenna "
 607                     "availability from NVRAM: %d\n", error);
 608                 goto fail;
 609         }
 610
 611         if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
 612                 bwn_attach_pre(sc);
 613                 bwn_sprom_bugfixes(dev);
 614                 sc->sc_flags |= BWN_FLAG_ATTACHED;
 615         }
 616
 617         mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
 618         mac->mac_sc = sc;
 619         mac->mac_status = BWN_MAC_STATUS_UNINIT;
 620         if (bwn_bfp != 0)
 621                 mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
 622
 623         TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
 624         TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
 625         TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
 626
 627         error = bwn_attach_core(mac);
 628         if (error)
 629                 goto fail;
 630         error = bwn_led_attach(mac);
 631         if (error)
 632                 goto fail;
 633
 634         bhnd_format_chip_id(chip_name, sizeof(chip_name), sc->sc_cid.chip_id);
 635         device_printf(sc->sc_dev, "WLAN (%s rev %u) "
 636             "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
 637             chip_name, bhnd_get_hwrev(sc->sc_dev), mac->mac_phy.analog,
 638             mac->mac_phy.type, mac->mac_phy.rev, mac->mac_phy.rf_manuf,
 639             mac->mac_phy.rf_ver, mac->mac_phy.rf_rev);
 640         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
 641                 device_printf(sc->sc_dev, "DMA (%d bits)\n", mac->mac_dmatype);
 642         else
 643                 device_printf(sc->sc_dev, "PIO\n");
 644
 645 #ifdef  BWN_GPL_PHY
 646         device_printf(sc->sc_dev,
 647             "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
 648 #endif
 649
 650         mac->mac_rid_irq = 0;
 651         mac->mac_res_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 652             &mac->mac_rid_irq, RF_ACTIVE | RF_SHAREABLE);
 653
 654         if (mac->mac_res_irq == NULL) {
 655                 device_printf(sc->sc_dev, "couldn't allocate IRQ resource\n");
 656                 error = ENXIO;
 657                 goto fail;
 658         }
 659
 660         error = bus_setup_intr(dev, mac->mac_res_irq,
 661             INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
 662             &mac->mac_intrhand);
 663         if (error != 0) {
 664                 device_printf(sc->sc_dev, "couldn't setup interrupt (%d)\n",
 665                     error);
 666                 goto fail;
 667         }
 668
 669         TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
 670
 671         /*
 672          * calls attach-post routine
 673          */
 674         if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
 675                 bwn_attach_post(sc);
 676
 677         return (0);
 678 fail:
 679         if (mac != NULL && mac->mac_res_irq != NULL) {
 680                 bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
 681                     mac->mac_res_irq);
 682         }
 683
 684         free(mac, M_DEVBUF);
 685         bhnd_release_pmu(dev);
 686         bwn_release_bus_providers(sc);
 687
 688         if (sc->sc_mem_res != NULL) {
 689                 bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
 690                     sc->sc_mem_rid, sc->sc_mem_res);
 691         }
 692
 693         return (error);
 694 }
 695
 696 static int
 697 bwn_retain_bus_providers(struct bwn_softc *sc)
 698 {
 699         struct chipc_caps *ccaps;
 700
 701         sc->sc_chipc = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_CHIPC);
 702         if (sc->sc_chipc == NULL) {
 703                 device_printf(sc->sc_dev, "ChipCommon device not found\n");
 704                 goto failed;
 705         }
 706
 707         ccaps = BHND_CHIPC_GET_CAPS(sc->sc_chipc);
 708
 709         sc->sc_gpio = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_GPIO);
 710         if (sc->sc_gpio == NULL) {
 711                 device_printf(sc->sc_dev, "GPIO device not found\n");
 712                 goto failed;
 713         }
 714
 715         if (ccaps->pmu) {
 716                 sc->sc_pmu = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_PMU);
 717                 if (sc->sc_pmu == NULL) {
 718                         device_printf(sc->sc_dev, "PMU device not found\n");
 719                         goto failed;
 720                 }
 721         }
 722
 723         return (0);
 724
 725 failed:
 726         bwn_release_bus_providers(sc);
 727         return (ENXIO);
 728 }
 729
 730 static void
 731 bwn_release_bus_providers(struct bwn_softc *sc)
 732 {
 733 #define BWN_RELEASE_PROV(_sc, _prov, _service)  do {                    \
 734         if ((_sc)-> _prov != NULL) {                                    \
 735                 bhnd_release_provider((_sc)->sc_dev, (_sc)-> _prov,     \
 736                     (_service));                                        \
 737                 (_sc)-> _prov = NULL;                                   \
 738         }                                                               \
 739 } while (0)
 740
 741         BWN_RELEASE_PROV(sc, sc_chipc, BHND_SERVICE_CHIPC);
 742         BWN_RELEASE_PROV(sc, sc_gpio, BHND_SERVICE_GPIO);
 743         BWN_RELEASE_PROV(sc, sc_pmu, BHND_SERVICE_PMU);
 744
 745 #undef  BWN_RELEASE_PROV
 746 }
 747
 748 static int
 749 bwn_attach_post(struct bwn_softc *sc)
 750 {
 751         struct ieee80211com     *ic;
 752         const char              *mac_varname;
 753         u_int                    core_unit;
 754         int                      error;
 755
 756         ic = &sc->sc_ic;
 757
 758         ic->ic_softc = sc;
 759         ic->ic_name = device_get_nameunit(sc->sc_dev);
 760         /* XXX not right but it's not used anywhere important */
 761         ic->ic_phytype = IEEE80211_T_OFDM;
 762         ic->ic_opmode = IEEE80211_M_STA;
 763         ic->ic_caps =
 764                   IEEE80211_C_STA               /* station mode supported */
 765                 | IEEE80211_C_MONITOR           /* monitor mode */
 766                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
 767                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 768                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 769                 | IEEE80211_C_WME               /* WME/WMM supported */
 770                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 771 #if 0
 772                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 773 #endif
 774                 | IEEE80211_C_TXPMGT            /* capable of txpow mgt */
 775                 ;
 776
 777         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;     /* s/w bmiss */
 778
 779         /* Determine the NVRAM variable containing our MAC address */
 780         core_unit = bhnd_get_core_unit(sc->sc_dev);
 781         mac_varname = NULL;
 782         if (sc->sc_board_info.board_srom_rev <= 2) {
 783                 if (core_unit == 0) {
 784                         mac_varname = BHND_NVAR_IL0MACADDR;
 785                 } else if (core_unit == 1) {
 786                         mac_varname = BHND_NVAR_ET1MACADDR;
 787                 }
 788         } else {
 789                 if (core_unit == 0) {
 790                         mac_varname = BHND_NVAR_MACADDR;
 791                 }
 792         }
 793
 794         if (mac_varname == NULL) {
 795                 device_printf(sc->sc_dev, "missing MAC address variable for "
 796                     "D11 core %u", core_unit);
 797                 return (ENXIO);
 798         }
 799
 800         /* Read the MAC address from NVRAM */
 801         error = bhnd_nvram_getvar_array(sc->sc_dev, mac_varname, ic->ic_macaddr,
 802             sizeof(ic->ic_macaddr), BHND_NVRAM_TYPE_UINT8_ARRAY);
 803         if (error) {
 804                 device_printf(sc->sc_dev, "error reading %s: %d\n", mac_varname,
 805                     error);
 806                 return (error);
 807         }
 808
 809         /* call MI attach routine. */
 810         ieee80211_ifattach(ic);
 811
 812         ic->ic_headroom = sizeof(struct bwn_txhdr);
 813
 814         /* override default methods */
 815         ic->ic_raw_xmit = bwn_raw_xmit;
 816         ic->ic_updateslot = bwn_updateslot;
 817         ic->ic_update_promisc = bwn_update_promisc;
 818         ic->ic_wme.wme_update = bwn_wme_update;
 819         ic->ic_scan_start = bwn_scan_start;
 820         ic->ic_scan_end = bwn_scan_end;
 821         ic->ic_set_channel = bwn_set_channel;
 822         ic->ic_vap_create = bwn_vap_create;
 823         ic->ic_vap_delete = bwn_vap_delete;
 824         ic->ic_transmit = bwn_transmit;
 825         ic->ic_parent = bwn_parent;
 826
 827         ieee80211_radiotap_attach(ic,
 828             &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
 829             BWN_TX_RADIOTAP_PRESENT,
 830             &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
 831             BWN_RX_RADIOTAP_PRESENT);
 832
 833         bwn_sysctl_node(sc);
 834
 835         if (bootverbose)
 836                 ieee80211_announce(ic);
 837         return (0);
 838 }
 839
 840 static void
 841 bwn_phy_detach(struct bwn_mac *mac)
 842 {
 843
 844         if (mac->mac_phy.detach != NULL)
 845                 mac->mac_phy.detach(mac);
 846 }
 847
 848 static int
 849 bwn_detach(device_t dev)
 850 {
 851         struct bwn_softc *sc = device_get_softc(dev);
 852         struct bwn_mac *mac = sc->sc_curmac;
 853         struct ieee80211com *ic = &sc->sc_ic;
 854
 855         sc->sc_flags |= BWN_FLAG_INVALID;
 856
 857         if (device_is_attached(sc->sc_dev)) {
 858                 BWN_LOCK(sc);
 859                 bwn_stop(sc);
 860                 BWN_UNLOCK(sc);
 861                 bwn_dma_free(mac);
 862                 callout_drain(&sc->sc_led_blink_ch);
 863                 callout_drain(&sc->sc_rfswitch_ch);
 864                 callout_drain(&sc->sc_task_ch);
 865                 callout_drain(&sc->sc_watchdog_ch);
 866                 bwn_phy_detach(mac);
 867                 ieee80211_draintask(ic, &mac->mac_hwreset);
 868                 ieee80211_draintask(ic, &mac->mac_txpower);
 869                 ieee80211_ifdetach(ic);
 870         }
 871         taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
 872         taskqueue_free(sc->sc_tq);
 873
 874         if (mac->mac_intrhand != NULL) {
 875                 bus_teardown_intr(dev, mac->mac_res_irq, mac->mac_intrhand);
 876                 mac->mac_intrhand = NULL;
 877         }
 878
 879         bhnd_release_pmu(dev);
 880         bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_mem_rid,
 881             sc->sc_mem_res);
 882         bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
 883             mac->mac_res_irq);
 884         mbufq_drain(&sc->sc_snd);
 885         bwn_release_firmware(mac);
 886         BWN_LOCK_DESTROY(sc);
 887
 888         bwn_release_bus_providers(sc);
 889
 890         return (0);
 891 }
 892
 893 static void
 894 bwn_attach_pre(struct bwn_softc *sc)
 895 {
 896
 897         BWN_LOCK_INIT(sc);
 898         TAILQ_INIT(&sc->sc_maclist);
 899         callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
 900         callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
 901         callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
 902         mbufq_init(&sc->sc_snd, ifqmaxlen);
 903         sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
 904                 taskqueue_thread_enqueue, &sc->sc_tq);
 905         taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
 906                 "%s taskq", device_get_nameunit(sc->sc_dev));
 907 }
 908
 909 static void
 910 bwn_sprom_bugfixes(device_t dev)
 911 {
 912         struct bwn_softc *sc = device_get_softc(dev);
 913
 914 #define BWN_ISDEV(_device, _subvendor, _subdevice)              \
 915         ((sc->sc_board_info.board_devid == PCI_DEVID_##_device) &&      \
 916          (sc->sc_board_info.board_vendor == PCI_VENDOR_##_subvendor) && \
 917          (sc->sc_board_info.board_type == _subdevice))
 918
 919          /* A subset of Apple Airport Extreme (BCM4306 rev 2) devices
 920           * were programmed with a missing PACTRL boardflag */
 921          if (sc->sc_board_info.board_vendor == PCI_VENDOR_APPLE &&
 922              sc->sc_board_info.board_type == 0x4e &&
 923              sc->sc_board_info.board_rev > 0x40)
 924                  sc->sc_board_info.board_flags |= BHND_BFL_PACTRL;
 925
 926         if (BWN_ISDEV(BCM4318_D11G, ASUSTEK, 0x100f) ||
 927             BWN_ISDEV(BCM4306_D11G, DELL, 0x0003) ||
 928             BWN_ISDEV(BCM4306_D11G, HP, 0x12f8) ||
 929             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0013) ||
 930             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0014) ||
 931             BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0015) ||
 932             BWN_ISDEV(BCM4306_D11G, MOTOROLA, 0x7010))
 933                 sc->sc_board_info.board_flags &= ~BHND_BFL_BTCOEX;
 934 #undef  BWN_ISDEV
 935 }
 936
 937 static void
 938 bwn_parent(struct ieee80211com *ic)
 939 {
 940         struct bwn_softc *sc = ic->ic_softc;
 941         int startall = 0;
 942
 943         BWN_LOCK(sc);
 944         if (ic->ic_nrunning > 0) {
 945                 if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 946                         bwn_init(sc);
 947                         startall = 1;
 948                 } else
 949                         bwn_update_promisc(ic);
 950         } else if (sc->sc_flags & BWN_FLAG_RUNNING)
 951                 bwn_stop(sc);
 952         BWN_UNLOCK(sc);
 953
 954         if (startall)
 955                 ieee80211_start_all(ic);
 956 }
 957
 958 static int
 959 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
 960 {
 961         struct bwn_softc *sc = ic->ic_softc;
 962         int error;
 963
 964         BWN_LOCK(sc);
 965         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
 966                 BWN_UNLOCK(sc);
 967                 return (ENXIO);
 968         }
 969         error = mbufq_enqueue(&sc->sc_snd, m);
 970         if (error) {
 971                 BWN_UNLOCK(sc);
 972                 return (error);
 973         }
 974         bwn_start(sc);
 975         BWN_UNLOCK(sc);
 976         return (0);
 977 }
 978
 979 static void
 980 bwn_start(struct bwn_softc *sc)
 981 {
 982         struct bwn_mac *mac = sc->sc_curmac;
 983         struct ieee80211_frame *wh;
 984         struct ieee80211_node *ni;
 985         struct ieee80211_key *k;
 986         struct mbuf *m;
 987
 988         BWN_ASSERT_LOCKED(sc);
 989
 990         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
 991             mac->mac_status < BWN_MAC_STATUS_STARTED)
 992                 return;
 993
 994         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 995                 if (bwn_tx_isfull(sc, m))
 996                         break;
 997                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 998                 if (ni == NULL) {
 999                         device_printf(sc->sc_dev, "unexpected NULL ni\n");
1000                         m_freem(m);
1001                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1002                         continue;
1003                 }
1004                 wh = mtod(m, struct ieee80211_frame *);
1005                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1006                         k = ieee80211_crypto_encap(ni, m);
1007                         if (k == NULL) {
1008                                 if_inc_counter(ni->ni_vap->iv_ifp,
1009                                     IFCOUNTER_OERRORS, 1);
1010                                 ieee80211_free_node(ni);
1011                                 m_freem(m);
1012                                 continue;
1013                         }
1014                 }
1015                 wh = NULL;      /* Catch any invalid use */
1016                 if (bwn_tx_start(sc, ni, m) != 0) {
1017                         if (ni != NULL) {
1018                                 if_inc_counter(ni->ni_vap->iv_ifp,
1019                                     IFCOUNTER_OERRORS, 1);
1020                                 ieee80211_free_node(ni);
1021                         }
1022                         continue;
1023                 }
1024                 sc->sc_watchdog_timer = 5;
1025         }
1026 }
1027
1028 static int
1029 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
1030 {
1031         struct bwn_dma_ring *dr;
1032         struct bwn_mac *mac = sc->sc_curmac;
1033         struct bwn_pio_txqueue *tq;
1034         int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1035
1036         BWN_ASSERT_LOCKED(sc);
1037
1038         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
1039                 dr = bwn_dma_select(mac, M_WME_GETAC(m));
1040                 if (dr->dr_stop == 1 ||
1041                     bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
1042                         dr->dr_stop = 1;
1043                         goto full;
1044                 }
1045         } else {
1046                 tq = bwn_pio_select(mac, M_WME_GETAC(m));
1047                 if (tq->tq_free == 0 || pktlen > tq->tq_size ||
1048                     pktlen > (tq->tq_size - tq->tq_used))
1049                         goto full;
1050         }
1051         return (0);
1052 full:
1053         mbufq_prepend(&sc->sc_snd, m);
1054         return (1);
1055 }
1056
1057 static int
1058 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
1059 {
1060         struct bwn_mac *mac = sc->sc_curmac;
1061         int error;
1062
1063         BWN_ASSERT_LOCKED(sc);
1064
1065         if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
1066                 m_freem(m);
1067                 return (ENXIO);
1068         }
1069
1070         error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
1071             bwn_dma_tx_start(mac, ni, &m) : bwn_pio_tx_start(mac, ni, &m);
1072         if (error) {
1073                 m_freem(m);
1074                 return (error);
1075         }
1076         return (0);
1077 }
1078
1079 static int
1080 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1081     struct mbuf **mp)
1082 {
1083         struct bwn_pio_txpkt *tp;
1084         struct bwn_pio_txqueue *tq;
1085         struct bwn_softc *sc = mac->mac_sc;
1086         struct bwn_txhdr txhdr;
1087         struct mbuf *m, *m_new;
1088         uint32_t ctl32;
1089         int error;
1090         uint16_t ctl16;
1091
1092         BWN_ASSERT_LOCKED(sc);
1093
1094         /* XXX TODO send packets after DTIM */
1095
1096         m = *mp;
1097         tq = bwn_pio_select(mac, M_WME_GETAC(m));
1098         KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
1099         tp = TAILQ_FIRST(&tq->tq_pktlist);
1100         tp->tp_ni = ni;
1101         tp->tp_m = m;
1102
1103         error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1104         if (error) {
1105                 device_printf(sc->sc_dev, "tx fail\n");
1106                 return (error);
1107         }
1108
1109         TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1110         tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1111         tq->tq_free--;
1112
1113         if (bhnd_get_hwrev(sc->sc_dev) >= 8) {
1114                 /*
1115                  * XXX please removes m_defrag(9)
1116                  */
1117                 m_new = m_defrag(*mp, M_NOWAIT);
1118                 if (m_new == NULL) {
1119                         device_printf(sc->sc_dev,
1120                             "%s: can't defrag TX buffer\n",
1121                             __func__);
1122                         return (ENOBUFS);
1123                 }
1124                 *mp = m_new;
1125                 if (m_new->m_next != NULL)
1126                         device_printf(sc->sc_dev,
1127                             "TODO: fragmented packets for PIO\n");
1128                 tp->tp_m = m_new;
1129
1130                 /* send HEADER */
1131                 ctl32 = bwn_pio_write_multi_4(mac, tq,
1132                     (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1133                         BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1134                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1135                 /* send BODY */
1136                 ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1137                     mtod(m_new, const void *), m_new->m_pkthdr.len);
1138                 bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1139                     ctl32 | BWN_PIO8_TXCTL_EOF);
1140         } else {
1141                 ctl16 = bwn_pio_write_multi_2(mac, tq,
1142                     (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1143                         BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1144                     (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1145                 ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1146                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1147                     ctl16 | BWN_PIO_TXCTL_EOF);
1148         }
1149
1150         return (0);
1151 }
1152
1153 static struct bwn_pio_txqueue *
1154 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1155 {
1156
1157         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1158                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1159
1160         switch (prio) {
1161         case 0:
1162                 return (&mac->mac_method.pio.wme[WME_AC_BE]);
1163         case 1:
1164                 return (&mac->mac_method.pio.wme[WME_AC_BK]);
1165         case 2:
1166                 return (&mac->mac_method.pio.wme[WME_AC_VI]);
1167         case 3:
1168                 return (&mac->mac_method.pio.wme[WME_AC_VO]);
1169         }
1170         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1171         return (NULL);
1172 }
1173
1174 static int
1175 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1176     struct mbuf **mp)
1177 {
1178 #define BWN_GET_TXHDRCACHE(slot)                                        \
1179         &(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1180         struct bwn_dma *dma = &mac->mac_method.dma;
1181         struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(*mp));
1182         struct bwn_dmadesc_generic *desc;
1183         struct bwn_dmadesc_meta *mt;
1184         struct bwn_softc *sc = mac->mac_sc;
1185         struct mbuf *m;
1186         uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1187         int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1188
1189         BWN_ASSERT_LOCKED(sc);
1190         KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1191
1192         /* XXX send after DTIM */
1193
1194         m = *mp;
1195         slot = bwn_dma_getslot(dr);
1196         dr->getdesc(dr, slot, &desc, &mt);
1197         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1198             ("%s:%d: fail", __func__, __LINE__));
1199
1200         error = bwn_set_txhdr(dr->dr_mac, ni, m,
1201             (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1202             BWN_DMA_COOKIE(dr, slot));
1203         if (error)
1204                 goto fail;
1205         error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1206             BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1207             &mt->mt_paddr, BUS_DMA_NOWAIT);
1208         if (error) {
1209                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1210                     __func__, error);
1211                 goto fail;
1212         }
1213         bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1214             BUS_DMASYNC_PREWRITE);
1215         dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1216         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1217             BUS_DMASYNC_PREWRITE);
1218
1219         slot = bwn_dma_getslot(dr);
1220         dr->getdesc(dr, slot, &desc, &mt);
1221         KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1222             mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1223         mt->mt_m = m;
1224         mt->mt_ni = ni;
1225
1226         error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1227             bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1228         if (error && error != EFBIG) {
1229                 device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1230                     __func__, error);
1231                 goto fail;
1232         }
1233         if (error) {    /* error == EFBIG */
1234                 struct mbuf *m_new;
1235
1236                 m_new = m_defrag(m, M_NOWAIT);
1237                 if (m_new == NULL) {
1238                         device_printf(sc->sc_dev,
1239                             "%s: can't defrag TX buffer\n",
1240                             __func__);
1241                         error = ENOBUFS;
1242                         goto fail;
1243                 }
1244                 *mp = m = m_new;
1245
1246                 mt->mt_m = m;
1247                 error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1248                     m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1249                 if (error) {
1250                         device_printf(sc->sc_dev,
1251                             "%s: can't load TX buffer (2) %d\n",
1252                             __func__, error);
1253                         goto fail;
1254                 }
1255         }
1256         bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1257         dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1258         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1259             BUS_DMASYNC_PREWRITE);
1260
1261         /* XXX send after DTIM */
1262
1263         dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1264         return (0);
1265 fail:
1266         dr->dr_curslot = backup[0];
1267         dr->dr_usedslot = backup[1];
1268         return (error);
1269 #undef BWN_GET_TXHDRCACHE
1270 }
1271
1272 static void
1273 bwn_watchdog(void *arg)
1274 {
1275         struct bwn_softc *sc = arg;
1276
1277         if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1278                 device_printf(sc->sc_dev, "device timeout\n");
1279                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1280         }
1281         callout_schedule(&sc->sc_watchdog_ch, hz);
1282 }
1283
1284 static int
1285 bwn_attach_core(struct bwn_mac *mac)
1286 {
1287         struct bwn_softc *sc = mac->mac_sc;
1288         int error, have_bg = 0, have_a = 0;
1289         uint16_t iost;
1290
1291         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5,
1292             ("unsupported revision %d", bhnd_get_hwrev(sc->sc_dev)));
1293
1294         if ((error = bwn_core_forceclk(mac, true)))
1295                 return (error);
1296
1297         if ((error = bhnd_read_iost(sc->sc_dev, &iost))) {
1298                 device_printf(sc->sc_dev, "error reading I/O status flags: "
1299                     "%d\n", error);
1300                 return (error);
1301         }
1302
1303         have_a = (iost & BWN_IOST_HAVE_5GHZ) ? 1 : 0;
1304         have_bg = (iost & BWN_IOST_HAVE_2GHZ) ? 1 : 0;
1305         if (iost & BWN_IOST_DUALPHY) {
1306                 have_bg = 1;
1307                 have_a = 1;
1308         }
1309
1310
1311 #if 0
1312         device_printf(sc->sc_dev, "%s: iost=0x%04hx, have_a=%d, have_bg=%d,"
1313             " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1314             __func__,
1315             iost,
1316             have_a,
1317             have_bg,
1318             sc->sc_board_info.board_devid,
1319             sc->sc_cid.chip_id);
1320 #endif
1321
1322         /*
1323          * Guess at whether it has A-PHY or G-PHY.
1324          * This is just used for resetting the core to probe things;
1325          * we will re-guess once it's all up and working.
1326          */
1327         error = bwn_reset_core(mac, have_bg);
1328         if (error)
1329                 goto fail;
1330
1331         /*
1332          * Determine the DMA engine type
1333          */
1334         if (iost & BHND_IOST_DMA64) {
1335                 mac->mac_dmatype = BHND_DMA_ADDR_64BIT;
1336         } else {
1337                 uint32_t tmp;
1338                 uint16_t base;
1339
1340                 base = bwn_dma_base(0, 0);
1341                 BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL,
1342                     BWN_DMA32_TXADDREXT_MASK);
1343                 tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
1344                 if (tmp & BWN_DMA32_TXADDREXT_MASK) {
1345                         mac->mac_dmatype = BHND_DMA_ADDR_32BIT;
1346                 } else {
1347                         mac->mac_dmatype = BHND_DMA_ADDR_30BIT;
1348                 }
1349         }
1350
1351         /*
1352          * Get the PHY version.
1353          */
1354         error = bwn_phy_getinfo(mac, have_bg);
1355         if (error)
1356                 goto fail;
1357
1358         /*
1359          * This is the whitelist of devices which we "believe"
1360          * the SPROM PHY config from.  The rest are "guessed".
1361          */
1362         if (sc->sc_board_info.board_devid != PCI_DEVID_BCM4311_D11DUAL &&
1363             sc->sc_board_info.board_devid != PCI_DEVID_BCM4328_D11G &&
1364             sc->sc_board_info.board_devid != PCI_DEVID_BCM4318_D11DUAL &&
1365             sc->sc_board_info.board_devid != PCI_DEVID_BCM4306_D11DUAL &&
1366             sc->sc_board_info.board_devid != PCI_DEVID_BCM4321_D11N &&
1367             sc->sc_board_info.board_devid != PCI_DEVID_BCM4322_D11N) {
1368                 have_a = have_bg = 0;
1369                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
1370                         have_a = 1;
1371                 else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1372                     mac->mac_phy.type == BWN_PHYTYPE_N ||
1373                     mac->mac_phy.type == BWN_PHYTYPE_LP)
1374                         have_bg = 1;
1375                 else
1376                         KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1377                             mac->mac_phy.type));
1378         }
1379
1380         /*
1381          * XXX The PHY-G support doesn't do 5GHz operation.
1382          */
1383         if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1384             mac->mac_phy.type != BWN_PHYTYPE_N) {
1385                 device_printf(sc->sc_dev,
1386                     "%s: forcing 2GHz only; no dual-band support for PHY\n",
1387                     __func__);
1388                 have_a = 0;
1389                 have_bg = 1;
1390         }
1391
1392         mac->mac_phy.phy_n = NULL;
1393
1394         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1395                 mac->mac_phy.attach = bwn_phy_g_attach;
1396                 mac->mac_phy.detach = bwn_phy_g_detach;
1397                 mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1398                 mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1399                 mac->mac_phy.init = bwn_phy_g_init;
1400                 mac->mac_phy.exit = bwn_phy_g_exit;
1401                 mac->mac_phy.phy_read = bwn_phy_g_read;
1402                 mac->mac_phy.phy_write = bwn_phy_g_write;
1403                 mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1404                 mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1405                 mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1406                 mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1407                 mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1408                 mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1409                 mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1410                 mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1411                 mac->mac_phy.set_im = bwn_phy_g_im;
1412                 mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1413                 mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1414                 mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1415                 mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1416         } else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1417                 mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1418                 mac->mac_phy.init = bwn_phy_lp_init;
1419                 mac->mac_phy.phy_read = bwn_phy_lp_read;
1420                 mac->mac_phy.phy_write = bwn_phy_lp_write;
1421                 mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1422                 mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1423                 mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1424                 mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1425                 mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1426                 mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1427                 mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1428                 mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1429                 mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1430         } else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1431                 mac->mac_phy.attach = bwn_phy_n_attach;
1432                 mac->mac_phy.detach = bwn_phy_n_detach;
1433                 mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1434                 mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1435                 mac->mac_phy.init = bwn_phy_n_init;
1436                 mac->mac_phy.exit = bwn_phy_n_exit;
1437                 mac->mac_phy.phy_read = bwn_phy_n_read;
1438                 mac->mac_phy.phy_write = bwn_phy_n_write;
1439                 mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1440                 mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1441                 mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1442                 mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1443                 mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1444                 mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1445                 mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1446                 mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1447                 mac->mac_phy.set_im = bwn_phy_n_im;
1448                 mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1449                 mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1450                 mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1451                 mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1452         } else {
1453                 device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1454                     mac->mac_phy.type);
1455                 error = ENXIO;
1456                 goto fail;
1457         }
1458
1459         mac->mac_phy.gmode = have_bg;
1460         if (mac->mac_phy.attach != NULL) {
1461                 error = mac->mac_phy.attach(mac);
1462                 if (error) {
1463                         device_printf(sc->sc_dev, "failed\n");
1464                         goto fail;
1465                 }
1466         }
1467
1468         error = bwn_reset_core(mac, have_bg);
1469         if (error)
1470                 goto fail;
1471
1472         error = bwn_chiptest(mac);
1473         if (error)
1474                 goto fail;
1475         error = bwn_setup_channels(mac, have_bg, have_a);
1476         if (error) {
1477                 device_printf(sc->sc_dev, "failed to setup channels\n");
1478                 goto fail;
1479         }
1480
1481         if (sc->sc_curmac == NULL)
1482                 sc->sc_curmac = mac;
1483
1484         error = bwn_dma_attach(mac);
1485         if (error != 0) {
1486                 device_printf(sc->sc_dev, "failed to initialize DMA\n");
1487                 goto fail;
1488         }
1489
1490         mac->mac_phy.switch_analog(mac, 0);
1491
1492 fail:
1493         bhnd_suspend_hw(sc->sc_dev, 0);
1494         bwn_release_firmware(mac);
1495         return (error);
1496 }
1497
1498 /*
1499  * Reset
1500  */
1501 int
1502 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1503 {
1504         struct bwn_softc        *sc;
1505         uint32_t                 ctl;
1506         uint16_t                 ioctl, ioctl_mask;
1507         int                      error;
1508
1509         sc = mac->mac_sc;
1510
1511         DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1512
1513         /* Reset core */
1514         ioctl = (BWN_IOCTL_PHYCLOCK_ENABLE | BWN_IOCTL_PHYRESET);
1515         if (g_mode)
1516                 ioctl |= BWN_IOCTL_SUPPORT_G;
1517
1518         /* XXX N-PHY only; and hard-code to 20MHz for now */
1519         if (mac->mac_phy.type == BWN_PHYTYPE_N)
1520                 ioctl |= BWN_IOCTL_PHY_BANDWIDTH_20MHZ;
1521
1522         if ((error = bhnd_reset_hw(sc->sc_dev, ioctl, ioctl))) {
1523                 device_printf(sc->sc_dev, "core reset failed: %d", error);
1524                 return (error);
1525         }
1526
1527         DELAY(2000);
1528
1529         /* Take PHY out of reset */
1530         ioctl = BHND_IOCTL_CLK_FORCE;
1531         ioctl_mask = BHND_IOCTL_CLK_FORCE |
1532                      BWN_IOCTL_PHYRESET |
1533                      BWN_IOCTL_PHYCLOCK_ENABLE;
1534
1535         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1536                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1537                     "%d\n", error);
1538                 return (error);
1539         }
1540
1541         DELAY(2000);
1542
1543         ioctl = BWN_IOCTL_PHYCLOCK_ENABLE;
1544         if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1545                 device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1546                     "%d\n", error);
1547                 return (error);
1548         }
1549
1550         DELAY(2000);
1551
1552         if (mac->mac_phy.switch_analog != NULL)
1553                 mac->mac_phy.switch_analog(mac, 1);
1554
1555         ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1556         if (g_mode)
1557                 ctl |= BWN_MACCTL_GMODE;
1558         BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1559
1560         return (0);
1561 }
1562
1563 static int
1564 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1565 {
1566         struct bwn_phy *phy = &mac->mac_phy;
1567         struct bwn_softc *sc = mac->mac_sc;
1568         uint32_t tmp;
1569
1570         /* PHY */
1571         tmp = BWN_READ_2(mac, BWN_PHYVER);
1572         phy->gmode = gmode;
1573         phy->rf_on = 1;
1574         phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1575         phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1576         phy->rev = (tmp & BWN_PHYVER_VERSION);
1577         if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1578             (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1579                 phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1580             (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1581             (phy->type == BWN_PHYTYPE_N && phy->rev > 6) ||
1582             (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1583                 goto unsupphy;
1584
1585         /* RADIO */
1586         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1587         tmp = BWN_READ_2(mac, BWN_RFDATALO);
1588         BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1589         tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1590
1591         phy->rf_rev = (tmp & 0xf0000000) >> 28;
1592         phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1593         phy->rf_manuf = (tmp & 0x00000fff);
1594
1595         /*
1596          * For now, just always do full init (ie, what bwn has traditionally
1597          * done)
1598          */
1599         phy->phy_do_full_init = 1;
1600
1601         if (phy->rf_manuf != 0x17f)     /* 0x17f is broadcom */
1602                 goto unsupradio;
1603         if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1604              phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1605             (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1606             (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1607             (phy->type == BWN_PHYTYPE_N &&
1608              phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1609             (phy->type == BWN_PHYTYPE_LP &&
1610              phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1611                 goto unsupradio;
1612
1613         return (0);
1614 unsupphy:
1615         device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1616             "analog %#x)\n",
1617             phy->type, phy->rev, phy->analog);
1618         return (ENXIO);
1619 unsupradio:
1620         device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1621             "rev %#x)\n",
1622             phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1623         return (ENXIO);
1624 }
1625
1626 static int
1627 bwn_chiptest(struct bwn_mac *mac)
1628 {
1629 #define TESTVAL0        0x55aaaa55
1630 #define TESTVAL1        0xaa5555aa
1631         struct bwn_softc *sc = mac->mac_sc;
1632         uint32_t v, backup;
1633
1634         BWN_LOCK(sc);
1635
1636         backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1637
1638         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1639         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1640                 goto error;
1641         bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1642         if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1643                 goto error;
1644
1645         bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1646
1647         if ((bhnd_get_hwrev(sc->sc_dev) >= 3) &&
1648             (bhnd_get_hwrev(sc->sc_dev) <= 10)) {
1649                 BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1650                 BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1651                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1652                         goto error;
1653                 if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1654                         goto error;
1655         }
1656         BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1657
1658         v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1659         if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1660                 goto error;
1661
1662         BWN_UNLOCK(sc);
1663         return (0);
1664 error:
1665         BWN_UNLOCK(sc);
1666         device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1667         return (ENODEV);
1668 }
1669
1670 static int
1671 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1672 {
1673         struct bwn_softc *sc = mac->mac_sc;
1674         struct ieee80211com *ic = &sc->sc_ic;
1675         uint8_t bands[IEEE80211_MODE_BYTES];
1676
1677         memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1678         ic->ic_nchans = 0;
1679
1680         DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1681             __func__,
1682             have_bg,
1683             have_a);
1684
1685         if (have_bg) {
1686                 memset(bands, 0, sizeof(bands));
1687                 setbit(bands, IEEE80211_MODE_11B);
1688                 setbit(bands, IEEE80211_MODE_11G);
1689                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1690                     &ic->ic_nchans, &bwn_chantable_bg, bands);
1691         }
1692
1693         if (have_a) {
1694                 memset(bands, 0, sizeof(bands));
1695                 setbit(bands, IEEE80211_MODE_11A);
1696                 bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1697                     &ic->ic_nchans, &bwn_chantable_a, bands);
1698         }
1699
1700         mac->mac_phy.supports_2ghz = have_bg;
1701         mac->mac_phy.supports_5ghz = have_a;
1702
1703         return (ic->ic_nchans == 0 ? ENXIO : 0);
1704 }
1705
1706 uint32_t
1707 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1708 {
1709         uint32_t ret;
1710
1711         BWN_ASSERT_LOCKED(mac->mac_sc);
1712
1713         if (way == BWN_SHARED) {
1714                 KASSERT((offset & 0x0001) == 0,
1715                     ("%s:%d warn", __func__, __LINE__));
1716                 if (offset & 0x0003) {
1717                         bwn_shm_ctlword(mac, way, offset >> 2);
1718                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1719                         ret <<= 16;
1720                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1721                         ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1722                         goto out;
1723                 }
1724                 offset >>= 2;
1725         }
1726         bwn_shm_ctlword(mac, way, offset);
1727         ret = BWN_READ_4(mac, BWN_SHM_DATA);
1728 out:
1729         return (ret);
1730 }
1731
1732 uint16_t
1733 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1734 {
1735         uint16_t ret;
1736
1737         BWN_ASSERT_LOCKED(mac->mac_sc);
1738
1739         if (way == BWN_SHARED) {
1740                 KASSERT((offset & 0x0001) == 0,
1741                     ("%s:%d warn", __func__, __LINE__));
1742                 if (offset & 0x0003) {
1743                         bwn_shm_ctlword(mac, way, offset >> 2);
1744                         ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1745                         goto out;
1746                 }
1747                 offset >>= 2;
1748         }
1749         bwn_shm_ctlword(mac, way, offset);
1750         ret = BWN_READ_2(mac, BWN_SHM_DATA);
1751 out:
1752
1753         return (ret);
1754 }
1755
1756 static void
1757 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1758     uint16_t offset)
1759 {
1760         uint32_t control;
1761
1762         control = way;
1763         control <<= 16;
1764         control |= offset;
1765         BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1766 }
1767
1768 void
1769 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1770     uint32_t value)
1771 {
1772         BWN_ASSERT_LOCKED(mac->mac_sc);
1773
1774         if (way == BWN_SHARED) {
1775                 KASSERT((offset & 0x0001) == 0,
1776                     ("%s:%d warn", __func__, __LINE__));
1777                 if (offset & 0x0003) {
1778                         bwn_shm_ctlword(mac, way, offset >> 2);
1779                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1780                                     (value >> 16) & 0xffff);
1781                         bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1782                         BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1783                         return;
1784                 }
1785                 offset >>= 2;
1786         }
1787         bwn_shm_ctlword(mac, way, offset);
1788         BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1789 }
1790
1791 void
1792 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1793     uint16_t value)
1794 {
1795         BWN_ASSERT_LOCKED(mac->mac_sc);
1796
1797         if (way == BWN_SHARED) {
1798                 KASSERT((offset & 0x0001) == 0,
1799                     ("%s:%d warn", __func__, __LINE__));
1800                 if (offset & 0x0003) {
1801                         bwn_shm_ctlword(mac, way, offset >> 2);
1802                         BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1803                         return;
1804                 }
1805                 offset >>= 2;
1806         }
1807         bwn_shm_ctlword(mac, way, offset);
1808         BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1809 }
1810
1811 static void
1812 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1813     const struct bwn_channelinfo *ci, const uint8_t bands[])
1814 {
1815         int i, error;
1816
1817         for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1818                 const struct bwn_channel *hc = &ci->channels[i];
1819
1820                 error = ieee80211_add_channel(chans, maxchans, nchans,
1821                     hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1822         }
1823 }
1824
1825 static int
1826 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1827         const struct ieee80211_bpf_params *params)
1828 {
1829         struct ieee80211com *ic = ni->ni_ic;
1830         struct bwn_softc *sc = ic->ic_softc;
1831         struct bwn_mac *mac = sc->sc_curmac;
1832         int error;
1833
1834         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1835             mac->mac_status < BWN_MAC_STATUS_STARTED) {
1836                 m_freem(m);
1837                 return (ENETDOWN);
1838         }
1839
1840         BWN_LOCK(sc);
1841         if (bwn_tx_isfull(sc, m)) {
1842                 m_freem(m);
1843                 BWN_UNLOCK(sc);
1844                 return (ENOBUFS);
1845         }
1846
1847         error = bwn_tx_start(sc, ni, m);
1848         if (error == 0)
1849                 sc->sc_watchdog_timer = 5;
1850         BWN_UNLOCK(sc);
1851         return (error);
1852 }
1853
1854 /*
1855  * Callback from the 802.11 layer to update the slot time
1856  * based on the current setting.  We use it to notify the
1857  * firmware of ERP changes and the f/w takes care of things
1858  * like slot time and preamble.
1859  */
1860 static void
1861 bwn_updateslot(struct ieee80211com *ic)
1862 {
1863         struct bwn_softc *sc = ic->ic_softc;
1864         struct bwn_mac *mac;
1865
1866         BWN_LOCK(sc);
1867         if (sc->sc_flags & BWN_FLAG_RUNNING) {
1868                 mac = (struct bwn_mac *)sc->sc_curmac;
1869                 bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1870         }
1871         BWN_UNLOCK(sc);
1872 }
1873
1874 /*
1875  * Callback from the 802.11 layer after a promiscuous mode change.
1876  * Note this interface does not check the operating mode as this
1877  * is an internal callback and we are expected to honor the current
1878  * state (e.g. this is used for setting the interface in promiscuous
1879  * mode when operating in hostap mode to do ACS).
1880  */
1881 static void
1882 bwn_update_promisc(struct ieee80211com *ic)
1883 {
1884         struct bwn_softc *sc = ic->ic_softc;
1885         struct bwn_mac *mac = sc->sc_curmac;
1886
1887         BWN_LOCK(sc);
1888         mac = sc->sc_curmac;
1889         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1890                 if (ic->ic_promisc > 0)
1891                         sc->sc_filters |= BWN_MACCTL_PROMISC;
1892                 else
1893                         sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1894                 bwn_set_opmode(mac);
1895         }
1896         BWN_UNLOCK(sc);
1897 }
1898
1899 /*
1900  * Callback from the 802.11 layer to update WME parameters.
1901  */
1902 static int
1903 bwn_wme_update(struct ieee80211com *ic)
1904 {
1905         struct bwn_softc *sc = ic->ic_softc;
1906         struct bwn_mac *mac = sc->sc_curmac;
1907         struct chanAccParams chp;
1908         struct wmeParams *wmep;
1909         int i;
1910
1911         ieee80211_wme_ic_getparams(ic, &chp);
1912
1913         BWN_LOCK(sc);
1914         mac = sc->sc_curmac;
1915         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1916                 bwn_mac_suspend(mac);
1917                 for (i = 0; i < N(sc->sc_wmeParams); i++) {
1918                         wmep = &chp.cap_wmeParams[i];
1919                         bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1920                 }
1921                 bwn_mac_enable(mac);
1922         }
1923         BWN_UNLOCK(sc);
1924         return (0);
1925 }
1926
1927 static void
1928 bwn_scan_start(struct ieee80211com *ic)
1929 {
1930         struct bwn_softc *sc = ic->ic_softc;
1931         struct bwn_mac *mac;
1932
1933         BWN_LOCK(sc);
1934         mac = sc->sc_curmac;
1935         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1936                 sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1937                 bwn_set_opmode(mac);
1938                 /* disable CFP update during scan */
1939                 bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1940         }
1941         BWN_UNLOCK(sc);
1942 }
1943
1944 static void
1945 bwn_scan_end(struct ieee80211com *ic)
1946 {
1947         struct bwn_softc *sc = ic->ic_softc;
1948         struct bwn_mac *mac;
1949
1950         BWN_LOCK(sc);
1951         mac = sc->sc_curmac;
1952         if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1953                 sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1954                 bwn_set_opmode(mac);
1955                 bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1956         }
1957         BWN_UNLOCK(sc);
1958 }
1959
1960 static void
1961 bwn_set_channel(struct ieee80211com *ic)
1962 {
1963         struct bwn_softc *sc = ic->ic_softc;
1964         struct bwn_mac *mac = sc->sc_curmac;
1965         struct bwn_phy *phy = &mac->mac_phy;
1966         int chan, error;
1967
1968         BWN_LOCK(sc);
1969
1970         error = bwn_switch_band(sc, ic->ic_curchan);
1971         if (error)
1972                 goto fail;
1973         bwn_mac_suspend(mac);
1974         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1975         chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1976         if (chan != phy->chan)
1977                 bwn_switch_channel(mac, chan);
1978
1979         /* TX power level */
1980         if (ic->ic_curchan->ic_maxpower != 0 &&
1981             ic->ic_curchan->ic_maxpower != phy->txpower) {
1982                 phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1983                 bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1984                     BWN_TXPWR_IGNORE_TSSI);
1985         }
1986
1987         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1988         if (phy->set_antenna)
1989                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
1990
1991         if (sc->sc_rf_enabled != phy->rf_on) {
1992                 if (sc->sc_rf_enabled) {
1993                         bwn_rf_turnon(mac);
1994                         if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1995                                 device_printf(sc->sc_dev,
1996                                     "please turn on the RF switch\n");
1997                 } else
1998                         bwn_rf_turnoff(mac);
1999         }
2000
2001         bwn_mac_enable(mac);
2002
2003 fail:
2004         BWN_UNLOCK(sc);
2005 }
2006
2007 static struct ieee80211vap *
2008 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2009     enum ieee80211_opmode opmode, int flags,
2010     const uint8_t bssid[IEEE80211_ADDR_LEN],
2011     const uint8_t mac[IEEE80211_ADDR_LEN])
2012 {
2013         struct ieee80211vap *vap;
2014         struct bwn_vap *bvp;
2015
2016         switch (opmode) {
2017         case IEEE80211_M_HOSTAP:
2018         case IEEE80211_M_MBSS:
2019         case IEEE80211_M_STA:
2020         case IEEE80211_M_WDS:
2021         case IEEE80211_M_MONITOR:
2022         case IEEE80211_M_IBSS:
2023         case IEEE80211_M_AHDEMO:
2024                 break;
2025         default:
2026                 return (NULL);
2027         }
2028
2029         bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
2030         vap = &bvp->bv_vap;
2031         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
2032         /* override with driver methods */
2033         bvp->bv_newstate = vap->iv_newstate;
2034         vap->iv_newstate = bwn_newstate;
2035
2036         /* override max aid so sta's cannot assoc when we're out of sta id's */
2037         vap->iv_max_aid = BWN_STAID_MAX;
2038
2039         ieee80211_ratectl_init(vap);
2040
2041         /* complete setup */
2042         ieee80211_vap_attach(vap, ieee80211_media_change,
2043             ieee80211_media_status, mac);
2044         return (vap);
2045 }
2046
2047 static void
2048 bwn_vap_delete(struct ieee80211vap *vap)
2049 {
2050         struct bwn_vap *bvp = BWN_VAP(vap);
2051
2052         ieee80211_ratectl_deinit(vap);
2053         ieee80211_vap_detach(vap);
2054         free(bvp, M_80211_VAP);
2055 }
2056
2057 static int
2058 bwn_init(struct bwn_softc *sc)
2059 {
2060         struct bwn_mac *mac;
2061         int error;
2062
2063         BWN_ASSERT_LOCKED(sc);
2064
2065         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2066
2067         bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
2068         sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
2069         sc->sc_filters = 0;
2070         bwn_wme_clear(sc);
2071         sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
2072         sc->sc_rf_enabled = 1;
2073
2074         mac = sc->sc_curmac;
2075         if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
2076                 error = bwn_core_init(mac);
2077                 if (error != 0)
2078                         return (error);
2079         }
2080         if (mac->mac_status == BWN_MAC_STATUS_INITED)
2081                 bwn_core_start(mac);
2082
2083         bwn_set_opmode(mac);
2084         bwn_set_pretbtt(mac);
2085         bwn_spu_setdelay(mac, 0);
2086         bwn_set_macaddr(mac);
2087
2088         sc->sc_flags |= BWN_FLAG_RUNNING;
2089         callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
2090         callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
2091
2092         return (0);
2093 }
2094
2095 static void
2096 bwn_stop(struct bwn_softc *sc)
2097 {
2098         struct bwn_mac *mac = sc->sc_curmac;
2099
2100         BWN_ASSERT_LOCKED(sc);
2101
2102         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2103
2104         if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
2105                 /* XXX FIXME opmode not based on VAP */
2106                 bwn_set_opmode(mac);
2107                 bwn_set_macaddr(mac);
2108         }
2109
2110         if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
2111                 bwn_core_stop(mac);
2112
2113         callout_stop(&sc->sc_led_blink_ch);
2114         sc->sc_led_blinking = 0;
2115
2116         bwn_core_exit(mac);
2117         sc->sc_rf_enabled = 0;
2118
2119         sc->sc_flags &= ~BWN_FLAG_RUNNING;
2120 }
2121
2122 static void
2123 bwn_wme_clear(struct bwn_softc *sc)
2124 {
2125 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
2126         struct wmeParams *p;
2127         unsigned int i;
2128
2129         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
2130             ("%s:%d: fail", __func__, __LINE__));
2131
2132         for (i = 0; i < N(sc->sc_wmeParams); i++) {
2133                 p = &(sc->sc_wmeParams[i]);
2134
2135                 switch (bwn_wme_shm_offsets[i]) {
2136                 case BWN_WME_VOICE:
2137                         p->wmep_txopLimit = 0;
2138                         p->wmep_aifsn = 2;
2139                         /* XXX FIXME: log2(cwmin) */
2140                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2141                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2142                         break;
2143                 case BWN_WME_VIDEO:
2144                         p->wmep_txopLimit = 0;
2145                         p->wmep_aifsn = 2;
2146                         /* XXX FIXME: log2(cwmin) */
2147                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2148                         p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2149                         break;
2150                 case BWN_WME_BESTEFFORT:
2151                         p->wmep_txopLimit = 0;
2152                         p->wmep_aifsn = 3;
2153                         /* XXX FIXME: log2(cwmin) */
2154                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2155                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2156                         break;
2157                 case BWN_WME_BACKGROUND:
2158                         p->wmep_txopLimit = 0;
2159                         p->wmep_aifsn = 7;
2160                         /* XXX FIXME: log2(cwmin) */
2161                         p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2162                         p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2163                         break;
2164                 default:
2165                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2166                 }
2167         }
2168 }
2169
2170 static int
2171 bwn_core_forceclk(struct bwn_mac *mac, bool force)
2172 {
2173         struct bwn_softc        *sc;
2174         bhnd_clock               clock;
2175         int                      error;
2176
2177         sc = mac->mac_sc;
2178
2179         /* On PMU equipped devices, we do not need to force the HT clock */
2180         if (sc->sc_pmu != NULL)
2181                 return (0);
2182
2183         /* Issue a PMU clock request */
2184         if (force)
2185                 clock = BHND_CLOCK_HT;
2186         else
2187                 clock = BHND_CLOCK_DYN;
2188
2189         if ((error = bhnd_request_clock(sc->sc_dev, clock))) {
2190                 device_printf(sc->sc_dev, "%d clock request failed: %d\n",
2191                     clock, error);
2192                 return (error);
2193         }
2194
2195         return (0);
2196 }
2197
2198 static int
2199 bwn_core_init(struct bwn_mac *mac)
2200 {
2201         struct bwn_softc *sc = mac->mac_sc;
2202         uint64_t hf;
2203         int error;
2204
2205         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2206             ("%s:%d: fail", __func__, __LINE__));
2207
2208         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2209
2210         if ((error = bwn_core_forceclk(mac, true)))
2211                 return (error);
2212
2213         if (bhnd_is_hw_suspended(sc->sc_dev)) {
2214                 if ((error = bwn_reset_core(mac, mac->mac_phy.gmode)))
2215                         goto fail0;
2216         }
2217
2218         mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2219         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2220         mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2221         BWN_GETTIME(mac->mac_phy.nexttime);
2222         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2223         bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2224         mac->mac_stats.link_noise = -95;
2225         mac->mac_reason_intr = 0;
2226         bzero(mac->mac_reason, sizeof(mac->mac_reason));
2227         mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2228 #ifdef BWN_DEBUG
2229         if (sc->sc_debug & BWN_DEBUG_XMIT)
2230                 mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2231 #endif
2232         mac->mac_suspended = 1;
2233         mac->mac_task_state = 0;
2234         memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2235
2236         mac->mac_phy.init_pre(mac);
2237
2238         bwn_bt_disable(mac);
2239         if (mac->mac_phy.prepare_hw) {
2240                 error = mac->mac_phy.prepare_hw(mac);
2241                 if (error)
2242                         goto fail0;
2243         }
2244         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2245         error = bwn_chip_init(mac);
2246         if (error)
2247                 goto fail0;
2248         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2249             bhnd_get_hwrev(sc->sc_dev));
2250         hf = bwn_hf_read(mac);
2251         if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2252                 hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2253                 if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL)
2254                         hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2255                 if (mac->mac_phy.rev == 1)
2256                         hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2257         }
2258         if (mac->mac_phy.rf_ver == 0x2050) {
2259                 if (mac->mac_phy.rf_rev < 6)
2260                         hf |= BWN_HF_FORCE_VCO_RECALC;
2261                 if (mac->mac_phy.rf_rev == 6)
2262                         hf |= BWN_HF_4318_TSSI;
2263         }
2264         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2265                 hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2266         if (sc->sc_quirks & BWN_QUIRK_UCODE_SLOWCLOCK_WAR)
2267                 hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2268         hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2269         bwn_hf_write(mac, hf);
2270
2271         /* Tell the firmware about the MAC capabilities */
2272         if (bhnd_get_hwrev(sc->sc_dev) >= 13) {
2273                 uint32_t cap;
2274                 cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2275                 DPRINTF(sc, BWN_DEBUG_RESET,
2276                     "%s: hw capabilities: 0x%08x\n",
2277                     __func__, cap);
2278                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2279                     cap & 0xffff);
2280                 bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2281                     (cap >> 16) & 0xffff);
2282         }
2283
2284         bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2285         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2286         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2287         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2288
2289         bwn_rate_init(mac);
2290         bwn_set_phytxctl(mac);
2291
2292         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2293             (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2294         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2295
2296         if (sc->sc_quirks & BWN_QUIRK_NODMA)
2297                 bwn_pio_init(mac);
2298         else
2299                 bwn_dma_init(mac);
2300         bwn_wme_init(mac);
2301         bwn_spu_setdelay(mac, 1);
2302         bwn_bt_enable(mac);
2303
2304         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2305         if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2306                 bwn_core_forceclk(mac, true);
2307         else
2308                 bwn_core_forceclk(mac, false);
2309
2310         bwn_set_macaddr(mac);
2311         bwn_crypt_init(mac);
2312
2313         /* XXX LED initializatin */
2314
2315         mac->mac_status = BWN_MAC_STATUS_INITED;
2316
2317         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2318         return (error);
2319
2320 fail0:
2321         bhnd_suspend_hw(sc->sc_dev, 0);
2322         KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2323             ("%s:%d: fail", __func__, __LINE__));
2324         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2325         return (error);
2326 }
2327
2328 static void
2329 bwn_core_start(struct bwn_mac *mac)
2330 {
2331         struct bwn_softc *sc = mac->mac_sc;
2332         uint32_t tmp;
2333
2334         KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2335             ("%s:%d: fail", __func__, __LINE__));
2336
2337         if (bhnd_get_hwrev(sc->sc_dev) < 5)
2338                 return;
2339
2340         while (1) {
2341                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2342                 if (!(tmp & 0x00000001))
2343                         break;
2344                 tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2345         }
2346
2347         bwn_mac_enable(mac);
2348         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2349         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2350
2351         mac->mac_status = BWN_MAC_STATUS_STARTED;
2352 }
2353
2354 static void
2355 bwn_core_exit(struct bwn_mac *mac)
2356 {
2357         struct bwn_softc *sc = mac->mac_sc;
2358         uint32_t macctl;
2359
2360         BWN_ASSERT_LOCKED(mac->mac_sc);
2361
2362         KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2363             ("%s:%d: fail", __func__, __LINE__));
2364
2365         if (mac->mac_status != BWN_MAC_STATUS_INITED)
2366                 return;
2367         mac->mac_status = BWN_MAC_STATUS_UNINIT;
2368
2369         macctl = BWN_READ_4(mac, BWN_MACCTL);
2370         macctl &= ~BWN_MACCTL_MCODE_RUN;
2371         macctl |= BWN_MACCTL_MCODE_JMP0;
2372         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2373
2374         bwn_dma_stop(mac);
2375         bwn_pio_stop(mac);
2376         bwn_chip_exit(mac);
2377         mac->mac_phy.switch_analog(mac, 0);
2378         bhnd_suspend_hw(sc->sc_dev, 0);
2379 }
2380
2381 static void
2382 bwn_bt_disable(struct bwn_mac *mac)
2383 {
2384         struct bwn_softc *sc = mac->mac_sc;
2385
2386         (void)sc;
2387         /* XXX do nothing yet */
2388 }
2389
2390 static int
2391 bwn_chip_init(struct bwn_mac *mac)
2392 {
2393         struct bwn_softc *sc = mac->mac_sc;
2394         struct bwn_phy *phy = &mac->mac_phy;
2395         uint32_t macctl;
2396         u_int delay;
2397         int error;
2398
2399         macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2400         if (phy->gmode)
2401                 macctl |= BWN_MACCTL_GMODE;
2402         BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2403
2404         error = bwn_fw_fillinfo(mac);
2405         if (error)
2406                 return (error);
2407         error = bwn_fw_loaducode(mac);
2408         if (error)
2409                 return (error);
2410
2411         error = bwn_gpio_init(mac);
2412         if (error)
2413                 return (error);
2414
2415         error = bwn_fw_loadinitvals(mac);
2416         if (error)
2417                 return (error);
2418
2419         phy->switch_analog(mac, 1);
2420         error = bwn_phy_init(mac);
2421         if (error)
2422                 return (error);
2423
2424         if (phy->set_im)
2425                 phy->set_im(mac, BWN_IMMODE_NONE);
2426         if (phy->set_antenna)
2427                 phy->set_antenna(mac, BWN_ANT_DEFAULT);
2428         bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2429
2430         if (phy->type == BWN_PHYTYPE_B)
2431                 BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2432         BWN_WRITE_4(mac, 0x0100, 0x01000000);
2433         if (bhnd_get_hwrev(sc->sc_dev) < 5)
2434                 BWN_WRITE_4(mac, 0x010c, 0x01000000);
2435
2436         BWN_WRITE_4(mac, BWN_MACCTL,
2437             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2438         BWN_WRITE_4(mac, BWN_MACCTL,
2439             BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2440         bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2441
2442         bwn_set_opmode(mac);
2443         if (bhnd_get_hwrev(sc->sc_dev) < 3) {
2444                 BWN_WRITE_2(mac, 0x060e, 0x0000);
2445                 BWN_WRITE_2(mac, 0x0610, 0x8000);
2446                 BWN_WRITE_2(mac, 0x0604, 0x0000);
2447                 BWN_WRITE_2(mac, 0x0606, 0x0200);
2448         } else {
2449                 BWN_WRITE_4(mac, 0x0188, 0x80000000);
2450                 BWN_WRITE_4(mac, 0x018c, 0x02000000);
2451         }
2452         BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2453         BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2454         BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2455         BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2456         BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2457         BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2458         BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2459
2460         bwn_mac_phy_clock_set(mac, true);
2461
2462         /* Provide the HT clock transition latency to the MAC core */
2463         error = bhnd_get_clock_latency(sc->sc_dev, BHND_CLOCK_HT, &delay);
2464         if (error) {
2465                 device_printf(sc->sc_dev, "failed to fetch HT clock latency: "
2466                     "%d\n", error);
2467                 return (error);
2468         }
2469
2470         if (delay > UINT16_MAX) {
2471                 device_printf(sc->sc_dev, "invalid HT clock latency: %u\n",
2472                     delay);
2473                 return (ENXIO);
2474         }
2475
2476         BWN_WRITE_2(mac, BWN_POWERUP_DELAY, delay);
2477         return (0);
2478 }
2479
2480 /* read hostflags */
2481 uint64_t
2482 bwn_hf_read(struct bwn_mac *mac)
2483 {
2484         uint64_t ret;
2485
2486         ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2487         ret <<= 16;
2488         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2489         ret <<= 16;
2490         ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2491         return (ret);
2492 }
2493
2494 void
2495 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2496 {
2497
2498         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2499             (value & 0x00000000ffffull));
2500         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2501             (value & 0x0000ffff0000ull) >> 16);
2502         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2503             (value & 0xffff00000000ULL) >> 32);
2504 }
2505
2506 static void
2507 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2508 {
2509
2510         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2511         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2512 }
2513
2514 static void
2515 bwn_rate_init(struct bwn_mac *mac)
2516 {
2517
2518         switch (mac->mac_phy.type) {
2519         case BWN_PHYTYPE_A:
2520         case BWN_PHYTYPE_G:
2521         case BWN_PHYTYPE_LP:
2522         case BWN_PHYTYPE_N:
2523                 bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2524                 bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2525                 bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2526                 bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2527                 bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2528                 bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2529                 bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2530                 if (mac->mac_phy.type == BWN_PHYTYPE_A)
2531                         break;
2532                 /* FALLTHROUGH */
2533         case BWN_PHYTYPE_B:
2534                 bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2535                 bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2536                 bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2537                 bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2538                 break;
2539         default:
2540                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2541         }
2542 }
2543
2544 static void
2545 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2546 {
2547         uint16_t offset;
2548
2549         if (ofdm) {
2550                 offset = 0x480;
2551                 offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2552         } else {
2553                 offset = 0x4c0;
2554                 offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2555         }
2556         bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2557             bwn_shm_read_2(mac, BWN_SHARED, offset));
2558 }
2559
2560 static uint8_t
2561 bwn_plcp_getcck(const uint8_t bitrate)
2562 {
2563
2564         switch (bitrate) {
2565         case BWN_CCK_RATE_1MB:
2566                 return (0x0a);
2567         case BWN_CCK_RATE_2MB:
2568                 return (0x14);
2569         case BWN_CCK_RATE_5MB:
2570                 return (0x37);
2571         case BWN_CCK_RATE_11MB:
2572                 return (0x6e);
2573         }
2574         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2575         return (0);
2576 }
2577
2578 static uint8_t
2579 bwn_plcp_getofdm(const uint8_t bitrate)
2580 {
2581
2582         switch (bitrate) {
2583         case BWN_OFDM_RATE_6MB:
2584                 return (0xb);
2585         case BWN_OFDM_RATE_9MB:
2586                 return (0xf);
2587         case BWN_OFDM_RATE_12MB:
2588                 return (0xa);
2589         case BWN_OFDM_RATE_18MB:
2590                 return (0xe);
2591         case BWN_OFDM_RATE_24MB:
2592                 return (0x9);
2593         case BWN_OFDM_RATE_36MB:
2594                 return (0xd);
2595         case BWN_OFDM_RATE_48MB:
2596                 return (0x8);
2597         case BWN_OFDM_RATE_54MB:
2598                 return (0xc);
2599         }
2600         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2601         return (0);
2602 }
2603
2604 static void
2605 bwn_set_phytxctl(struct bwn_mac *mac)
2606 {
2607         uint16_t ctl;
2608
2609         ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2610             BWN_TX_PHY_TXPWR);
2611         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2612         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2613         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2614 }
2615
2616 static void
2617 bwn_pio_init(struct bwn_mac *mac)
2618 {
2619         struct bwn_pio *pio = &mac->mac_method.pio;
2620
2621         BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2622             & ~BWN_MACCTL_BIGENDIAN);
2623         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2624
2625         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2626         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2627         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2628         bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2629         bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2630         bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2631 }
2632
2633 static void
2634 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2635     int index)
2636 {
2637         struct bwn_pio_txpkt *tp;
2638         struct bwn_softc *sc = mac->mac_sc;
2639         unsigned int i;
2640
2641         tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2642         tq->tq_index = index;
2643
2644         tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2645         if (bhnd_get_hwrev(sc->sc_dev) >= 8)
2646                 tq->tq_size = 1920;
2647         else {
2648                 tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2649                 tq->tq_size -= 80;
2650         }
2651
2652         TAILQ_INIT(&tq->tq_pktlist);
2653         for (i = 0; i < N(tq->tq_pkts); i++) {
2654                 tp = &(tq->tq_pkts[i]);
2655                 tp->tp_index = i;
2656                 tp->tp_queue = tq;
2657                 TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2658         }
2659 }
2660
2661 static uint16_t
2662 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2663 {
2664         struct bwn_softc *sc = mac->mac_sc;
2665         static const uint16_t bases[] = {
2666                 BWN_PIO_BASE0,
2667                 BWN_PIO_BASE1,
2668                 BWN_PIO_BASE2,
2669                 BWN_PIO_BASE3,
2670                 BWN_PIO_BASE4,
2671                 BWN_PIO_BASE5,
2672                 BWN_PIO_BASE6,
2673                 BWN_PIO_BASE7,
2674         };
2675         static const uint16_t bases_rev11[] = {
2676                 BWN_PIO11_BASE0,
2677                 BWN_PIO11_BASE1,
2678                 BWN_PIO11_BASE2,
2679                 BWN_PIO11_BASE3,
2680                 BWN_PIO11_BASE4,
2681                 BWN_PIO11_BASE5,
2682         };
2683
2684         if (bhnd_get_hwrev(sc->sc_dev) >= 11) {
2685                 if (index >= N(bases_rev11))
2686                         device_printf(sc->sc_dev, "%s: warning\n", __func__);
2687                 return (bases_rev11[index]);
2688         }
2689         if (index >= N(bases))
2690                 device_printf(sc->sc_dev, "%s: warning\n", __func__);
2691         return (bases[index]);
2692 }
2693
2694 static void
2695 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2696     int index)
2697 {
2698         struct bwn_softc *sc = mac->mac_sc;
2699
2700         prq->prq_mac = mac;
2701         prq->prq_rev = bhnd_get_hwrev(sc->sc_dev);
2702         prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2703         bwn_dma_rxdirectfifo(mac, index, 1);
2704 }
2705
2706 static void
2707 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2708 {
2709         if (tq == NULL)
2710                 return;
2711         bwn_pio_cancel_tx_packets(tq);
2712 }
2713
2714 static void
2715 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2716 {
2717
2718         bwn_destroy_pioqueue_tx(pio);
2719 }
2720
2721 static uint16_t
2722 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2723     uint16_t offset)
2724 {
2725
2726         return (BWN_READ_2(mac, tq->tq_base + offset));
2727 }
2728
2729 static void
2730 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2731 {
2732         uint32_t ctl;
2733         uint16_t base;
2734
2735         base = bwn_dma_base(mac->mac_dmatype, idx);
2736         if (mac->mac_dmatype == BHND_DMA_ADDR_64BIT) {
2737                 ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2738                 ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2739                 if (enable)
2740                         ctl |= BWN_DMA64_RXDIRECTFIFO;
2741                 BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2742         } else {
2743                 ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2744                 ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2745                 if (enable)
2746                         ctl |= BWN_DMA32_RXDIRECTFIFO;
2747                 BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2748         }
2749 }
2750
2751 static void
2752 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2753 {
2754         struct bwn_pio_txpkt *tp;
2755         unsigned int i;
2756
2757         for (i = 0; i < N(tq->tq_pkts); i++) {
2758                 tp = &(tq->tq_pkts[i]);
2759                 if (tp->tp_m) {
2760                         m_freem(tp->tp_m);
2761                         tp->tp_m = NULL;
2762                 }
2763         }
2764 }
2765
2766 static uint16_t
2767 bwn_dma_base(int type, int controller_idx)
2768 {
2769         static const uint16_t map64[] = {
2770                 BWN_DMA64_BASE0,
2771                 BWN_DMA64_BASE1,
2772                 BWN_DMA64_BASE2,
2773                 BWN_DMA64_BASE3,
2774                 BWN_DMA64_BASE4,
2775                 BWN_DMA64_BASE5,
2776         };
2777         static const uint16_t map32[] = {
2778                 BWN_DMA32_BASE0,
2779                 BWN_DMA32_BASE1,
2780                 BWN_DMA32_BASE2,
2781                 BWN_DMA32_BASE3,
2782                 BWN_DMA32_BASE4,
2783                 BWN_DMA32_BASE5,
2784         };
2785
2786         if (type == BHND_DMA_ADDR_64BIT) {
2787                 KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2788                     ("%s:%d: fail", __func__, __LINE__));
2789                 return (map64[controller_idx]);
2790         }
2791         KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2792             ("%s:%d: fail", __func__, __LINE__));
2793         return (map32[controller_idx]);
2794 }
2795
2796 static void
2797 bwn_dma_init(struct bwn_mac *mac)
2798 {
2799         struct bwn_dma *dma = &mac->mac_method.dma;
2800
2801         /* setup TX DMA channels. */
2802         bwn_dma_setup(dma->wme[WME_AC_BK]);
2803         bwn_dma_setup(dma->wme[WME_AC_BE]);
2804         bwn_dma_setup(dma->wme[WME_AC_VI]);
2805         bwn_dma_setup(dma->wme[WME_AC_VO]);
2806         bwn_dma_setup(dma->mcast);
2807         /* setup RX DMA channel. */
2808         bwn_dma_setup(dma->rx);
2809 }
2810
2811 static struct bwn_dma_ring *
2812 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2813     int for_tx)
2814 {
2815         struct bwn_dma *dma = &mac->mac_method.dma;
2816         struct bwn_dma_ring *dr;
2817         struct bwn_dmadesc_generic *desc;
2818         struct bwn_dmadesc_meta *mt;
2819         struct bwn_softc *sc = mac->mac_sc;
2820         int error, i;
2821
2822         dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2823         if (dr == NULL)
2824                 goto out;
2825         dr->dr_numslots = BWN_RXRING_SLOTS;
2826         if (for_tx)
2827                 dr->dr_numslots = BWN_TXRING_SLOTS;
2828
2829         dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2830             M_DEVBUF, M_NOWAIT | M_ZERO);
2831         if (dr->dr_meta == NULL)
2832                 goto fail0;
2833
2834         dr->dr_type = mac->mac_dmatype;
2835         dr->dr_mac = mac;
2836         dr->dr_base = bwn_dma_base(dr->dr_type, controller_index);
2837         dr->dr_index = controller_index;
2838         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
2839                 dr->getdesc = bwn_dma_64_getdesc;
2840                 dr->setdesc = bwn_dma_64_setdesc;
2841                 dr->start_transfer = bwn_dma_64_start_transfer;
2842                 dr->suspend = bwn_dma_64_suspend;
2843                 dr->resume = bwn_dma_64_resume;
2844                 dr->get_curslot = bwn_dma_64_get_curslot;
2845                 dr->set_curslot = bwn_dma_64_set_curslot;
2846         } else {
2847                 dr->getdesc = bwn_dma_32_getdesc;
2848                 dr->setdesc = bwn_dma_32_setdesc;
2849                 dr->start_transfer = bwn_dma_32_start_transfer;
2850                 dr->suspend = bwn_dma_32_suspend;
2851                 dr->resume = bwn_dma_32_resume;
2852                 dr->get_curslot = bwn_dma_32_get_curslot;
2853                 dr->set_curslot = bwn_dma_32_set_curslot;
2854         }
2855         if (for_tx) {
2856                 dr->dr_tx = 1;
2857                 dr->dr_curslot = -1;
2858         } else {
2859                 if (dr->dr_index == 0) {
2860                         switch (mac->mac_fw.fw_hdr_format) {
2861                         case BWN_FW_HDR_351:
2862                         case BWN_FW_HDR_410:
2863                                 dr->dr_rx_bufsize =
2864                                     BWN_DMA0_RX_BUFFERSIZE_FW351;
2865                                 dr->dr_frameoffset =
2866                                     BWN_DMA0_RX_FRAMEOFFSET_FW351;
2867                                 break;
2868                         case BWN_FW_HDR_598:
2869                                 dr->dr_rx_bufsize =
2870                                     BWN_DMA0_RX_BUFFERSIZE_FW598;
2871                                 dr->dr_frameoffset =
2872                                     BWN_DMA0_RX_FRAMEOFFSET_FW598;
2873                                 break;
2874                         }
2875                 } else
2876                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2877         }
2878
2879         error = bwn_dma_allocringmemory(dr);
2880         if (error)
2881                 goto fail2;
2882
2883         if (for_tx) {
2884                 /*
2885                  * Assumption: BWN_TXRING_SLOTS can be divided by
2886                  * BWN_TX_SLOTS_PER_FRAME
2887                  */
2888                 KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2889                     ("%s:%d: fail", __func__, __LINE__));
2890
2891                 dr->dr_txhdr_cache = contigmalloc(
2892                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2893                     BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2894                     0, BUS_SPACE_MAXADDR, 8, 0);
2895                 if (dr->dr_txhdr_cache == NULL) {
2896                         device_printf(sc->sc_dev,
2897                             "can't allocate TX header DMA memory\n");
2898                         goto fail1;
2899                 }
2900
2901                 /*
2902                  * Create TX ring DMA stuffs
2903                  */
2904                 error = bus_dma_tag_create(dma->parent_dtag,
2905                                     BWN_ALIGN, 0,
2906                                     BUS_SPACE_MAXADDR,
2907                                     BUS_SPACE_MAXADDR,
2908                                     NULL, NULL,
2909                                     BWN_HDRSIZE(mac),
2910                                     1,
2911                                     BUS_SPACE_MAXSIZE_32BIT,
2912                                     0,
2913                                     NULL, NULL,
2914                                     &dr->dr_txring_dtag);
2915                 if (error) {
2916                         device_printf(sc->sc_dev,
2917                             "can't create TX ring DMA tag: TODO frees\n");
2918                         goto fail2;
2919                 }
2920
2921                 for (i = 0; i < dr->dr_numslots; i += 2) {
2922                         dr->getdesc(dr, i, &desc, &mt);
2923
2924                         mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2925                         mt->mt_m = NULL;
2926                         mt->mt_ni = NULL;
2927                         mt->mt_islast = 0;
2928                         error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2929                             &mt->mt_dmap);
2930                         if (error) {
2931                                 device_printf(sc->sc_dev,
2932                                      "can't create RX buf DMA map\n");
2933                                 goto fail2;
2934                         }
2935
2936                         dr->getdesc(dr, i + 1, &desc, &mt);
2937
2938                         mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2939                         mt->mt_m = NULL;
2940                         mt->mt_ni = NULL;
2941                         mt->mt_islast = 1;
2942                         error = bus_dmamap_create(dma->txbuf_dtag, 0,
2943                             &mt->mt_dmap);
2944                         if (error) {
2945                                 device_printf(sc->sc_dev,
2946                                      "can't create RX buf DMA map\n");
2947                                 goto fail2;
2948                         }
2949                 }
2950         } else {
2951                 error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2952                     &dr->dr_spare_dmap);
2953                 if (error) {
2954                         device_printf(sc->sc_dev,
2955                             "can't create RX buf DMA map\n");
2956                         goto out;               /* XXX wrong! */
2957                 }
2958
2959                 for (i = 0; i < dr->dr_numslots; i++) {
2960                         dr->getdesc(dr, i, &desc, &mt);
2961
2962                         error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2963                             &mt->mt_dmap);
2964                         if (error) {
2965                                 device_printf(sc->sc_dev,
2966                                     "can't create RX buf DMA map\n");
2967                                 goto out;       /* XXX wrong! */
2968                         }
2969                         error = bwn_dma_newbuf(dr, desc, mt, 1);
2970                         if (error) {
2971                                 device_printf(sc->sc_dev,
2972                                     "failed to allocate RX buf\n");
2973                                 goto out;       /* XXX wrong! */
2974                         }
2975                 }
2976
2977                 bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2978                     BUS_DMASYNC_PREWRITE);
2979
2980                 dr->dr_usedslot = dr->dr_numslots;
2981         }
2982
2983       out:
2984         return (dr);
2985
2986 fail2:
2987         if (dr->dr_txhdr_cache != NULL) {
2988                 contigfree(dr->dr_txhdr_cache,
2989                     (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2990                     BWN_MAXTXHDRSIZE, M_DEVBUF);
2991         }
2992 fail1:
2993         free(dr->dr_meta, M_DEVBUF);
2994 fail0:
2995         free(dr, M_DEVBUF);
2996         return (NULL);
2997 }
2998
2999 static void
3000 bwn_dma_ringfree(struct bwn_dma_ring **dr)
3001 {
3002
3003         if (dr == NULL)
3004                 return;
3005
3006         bwn_dma_free_descbufs(*dr);
3007         bwn_dma_free_ringmemory(*dr);
3008
3009         if ((*dr)->dr_txhdr_cache != NULL) {
3010                 contigfree((*dr)->dr_txhdr_cache,
3011                     ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
3012                     BWN_MAXTXHDRSIZE, M_DEVBUF);
3013         }
3014         free((*dr)->dr_meta, M_DEVBUF);
3015         free(*dr, M_DEVBUF);
3016
3017         *dr = NULL;
3018 }
3019
3020 static void
3021 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
3022     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3023 {
3024         struct bwn_dmadesc32 *desc;
3025
3026         *meta = &(dr->dr_meta[slot]);
3027         desc = dr->dr_ring_descbase;
3028         desc = &(desc[slot]);
3029
3030         *gdesc = (struct bwn_dmadesc_generic *)desc;
3031 }
3032
3033 static void
3034 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
3035     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3036     int start, int end, int irq)
3037 {
3038         struct bwn_dmadesc32            *descbase;
3039         struct bwn_dma                  *dma;
3040         struct bhnd_dma_translation     *dt;
3041         uint32_t                         addr, addrext, ctl;
3042         int                              slot;
3043
3044         descbase = dr->dr_ring_descbase;
3045         dma = &dr->dr_mac->mac_method.dma;
3046         dt = &dma->translation;
3047
3048         slot = (int)(&(desc->dma.dma32) - descbase);
3049         KASSERT(slot >= 0 && slot < dr->dr_numslots,
3050             ("%s:%d: fail", __func__, __LINE__));
3051
3052         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3053         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3054         ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
3055         if (slot == dr->dr_numslots - 1)
3056                 ctl |= BWN_DMA32_DCTL_DTABLEEND;
3057         if (start)
3058                 ctl |= BWN_DMA32_DCTL_FRAMESTART;
3059         if (end)
3060                 ctl |= BWN_DMA32_DCTL_FRAMEEND;
3061         if (irq)
3062                 ctl |= BWN_DMA32_DCTL_IRQ;
3063         ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
3064             & BWN_DMA32_DCTL_ADDREXT_MASK;
3065
3066         desc->dma.dma32.control = htole32(ctl);
3067         desc->dma.dma32.address = htole32(addr);
3068 }
3069
3070 static void
3071 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
3072 {
3073
3074         BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
3075             (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
3076 }
3077
3078 static void
3079 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
3080 {
3081
3082         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3083             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
3084 }
3085
3086 static void
3087 bwn_dma_32_resume(struct bwn_dma_ring *dr)
3088 {
3089
3090         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3091             BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
3092 }
3093
3094 static int
3095 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
3096 {
3097         uint32_t val;
3098
3099         val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
3100         val &= BWN_DMA32_RXDPTR;
3101
3102         return (val / sizeof(struct bwn_dmadesc32));
3103 }
3104
3105 static void
3106 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
3107 {
3108
3109         BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
3110             (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
3111 }
3112
3113 static void
3114 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
3115     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3116 {
3117         struct bwn_dmadesc64 *desc;
3118
3119         *meta = &(dr->dr_meta[slot]);
3120         desc = dr->dr_ring_descbase;
3121         desc = &(desc[slot]);
3122
3123         *gdesc = (struct bwn_dmadesc_generic *)desc;
3124 }
3125
3126 static void
3127 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
3128     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3129     int start, int end, int irq)
3130 {
3131         struct bwn_dmadesc64            *descbase;
3132         struct bwn_dma                  *dma;
3133         struct bhnd_dma_translation     *dt;
3134         bhnd_addr_t                      addr;
3135         uint32_t                         addrhi, addrlo;
3136         uint32_t                         addrext;
3137         uint32_t                         ctl0, ctl1;
3138         int                              slot;
3139
3140
3141         descbase = dr->dr_ring_descbase;
3142         dma = &dr->dr_mac->mac_method.dma;
3143         dt = &dma->translation;
3144
3145         slot = (int)(&(desc->dma.dma64) - descbase);
3146         KASSERT(slot >= 0 && slot < dr->dr_numslots,
3147             ("%s:%d: fail", __func__, __LINE__));
3148
3149         addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3150         addrhi = (addr >> 32);
3151         addrlo = (addr & UINT32_MAX);
3152         addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3153
3154         ctl0 = 0;
3155         if (slot == dr->dr_numslots - 1)
3156                 ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
3157         if (start)
3158                 ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
3159         if (end)
3160                 ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3161         if (irq)
3162                 ctl0 |= BWN_DMA64_DCTL0_IRQ;
3163
3164         ctl1 = 0;
3165         ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3166         ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3167             & BWN_DMA64_DCTL1_ADDREXT_MASK;
3168
3169         desc->dma.dma64.control0 = htole32(ctl0);
3170         desc->dma.dma64.control1 = htole32(ctl1);
3171         desc->dma.dma64.address_low = htole32(addrlo);
3172         desc->dma.dma64.address_high = htole32(addrhi);
3173 }
3174
3175 static void
3176 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3177 {
3178
3179         BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3180             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3181 }
3182
3183 static void
3184 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3185 {
3186
3187         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3188             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3189 }
3190
3191 static void
3192 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3193 {
3194
3195         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3196             BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3197 }
3198
3199 static int
3200 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3201 {
3202         uint32_t val;
3203
3204         val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3205         val &= BWN_DMA64_RXSTATDPTR;
3206
3207         return (val / sizeof(struct bwn_dmadesc64));
3208 }
3209
3210 static void
3211 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3212 {
3213
3214         BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3215             (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3216 }
3217
3218 static int
3219 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3220 {
3221         struct bwn_mac *mac = dr->dr_mac;
3222         struct bwn_dma *dma = &mac->mac_method.dma;
3223         struct bwn_softc *sc = mac->mac_sc;
3224         int error;
3225
3226         error = bus_dma_tag_create(dma->parent_dtag,
3227                             BWN_ALIGN, 0,
3228                             BUS_SPACE_MAXADDR,
3229                             BUS_SPACE_MAXADDR,
3230                             NULL, NULL,
3231                             BWN_DMA_RINGMEMSIZE,
3232                             1,
3233                             BUS_SPACE_MAXSIZE_32BIT,
3234                             0,
3235                             NULL, NULL,
3236                             &dr->dr_ring_dtag);
3237         if (error) {
3238                 device_printf(sc->sc_dev,
3239                     "can't create TX ring DMA tag: TODO frees\n");
3240                 return (-1);
3241         }
3242
3243         error = bus_dmamem_alloc(dr->dr_ring_dtag,
3244             &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3245             &dr->dr_ring_dmap);
3246         if (error) {
3247                 device_printf(sc->sc_dev,
3248                     "can't allocate DMA mem: TODO frees\n");
3249                 return (-1);
3250         }
3251         error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3252             dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3253             bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3254         if (error) {
3255                 device_printf(sc->sc_dev,
3256                     "can't load DMA mem: TODO free\n");
3257                 return (-1);
3258         }
3259
3260         return (0);
3261 }
3262
3263 static void
3264 bwn_dma_setup(struct bwn_dma_ring *dr)
3265 {
3266         struct bwn_mac                  *mac;
3267         struct bwn_dma                  *dma;
3268         struct bhnd_dma_translation     *dt;
3269         bhnd_addr_t                      addr, paddr;
3270         uint32_t                         addrhi, addrlo, addrext, value;
3271
3272         mac = dr->dr_mac;
3273         dma = &mac->mac_method.dma;
3274         dt = &dma->translation;
3275
3276         paddr = dr->dr_ring_dmabase;
3277         addr = (paddr & dt->addr_mask) | dt->base_addr;
3278         addrhi = (addr >> 32);
3279         addrlo = (addr & UINT32_MAX);
3280         addrext = ((paddr & dt->addrext_mask) >> dma->addrext_shift);
3281
3282         if (dr->dr_tx) {
3283                 dr->dr_curslot = -1;
3284
3285                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3286                         value = BWN_DMA64_TXENABLE;
3287                         value |= BWN_DMA64_TXPARITY_DISABLE;
3288                         value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3289                             & BWN_DMA64_TXADDREXT_MASK;
3290                         BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3291                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, addrlo);
3292                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, addrhi);
3293                 } else {
3294                         value = BWN_DMA32_TXENABLE;
3295                         value |= BWN_DMA32_TXPARITY_DISABLE;
3296                         value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3297                             & BWN_DMA32_TXADDREXT_MASK;
3298                         BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3299                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, addrlo);
3300                 }
3301                 return;
3302         }
3303
3304         /*
3305          * set for RX
3306          */
3307         dr->dr_usedslot = dr->dr_numslots;
3308
3309         if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3310                 value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3311                 value |= BWN_DMA64_RXENABLE;
3312                 value |= BWN_DMA64_RXPARITY_DISABLE;
3313                 value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3314                     & BWN_DMA64_RXADDREXT_MASK;
3315                 BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3316                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, addrlo);
3317                 BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, addrhi);
3318                 BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3319                     sizeof(struct bwn_dmadesc64));
3320         } else {
3321                 value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3322                 value |= BWN_DMA32_RXENABLE;
3323                 value |= BWN_DMA32_RXPARITY_DISABLE;
3324                 value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3325                     & BWN_DMA32_RXADDREXT_MASK;
3326                 BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3327                 BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, addrlo);
3328                 BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3329                     sizeof(struct bwn_dmadesc32));
3330         }
3331 }
3332
3333 static void
3334 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3335 {
3336
3337         bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3338         bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3339             dr->dr_ring_dmap);
3340 }
3341
3342 static void
3343 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3344 {
3345
3346         if (dr->dr_tx) {
3347                 bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3348                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3349                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3350                         BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3351                 } else
3352                         BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3353         } else {
3354                 bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3355                 if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3356                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3357                         BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3358                 } else
3359                         BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3360         }
3361 }
3362
3363 static void
3364 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3365 {
3366         struct bwn_dmadesc_generic *desc;
3367         struct bwn_dmadesc_meta *meta;
3368         struct bwn_mac *mac = dr->dr_mac;
3369         struct bwn_dma *dma = &mac->mac_method.dma;
3370         struct bwn_softc *sc = mac->mac_sc;
3371         int i;
3372
3373         if (!dr->dr_usedslot)
3374                 return;
3375         for (i = 0; i < dr->dr_numslots; i++) {
3376                 dr->getdesc(dr, i, &desc, &meta);
3377
3378                 if (meta->mt_m == NULL) {
3379                         if (!dr->dr_tx)
3380                                 device_printf(sc->sc_dev, "%s: not TX?\n",
3381                                     __func__);
3382                         continue;
3383                 }
3384                 if (dr->dr_tx) {
3385                         if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3386                                 bus_dmamap_unload(dr->dr_txring_dtag,
3387                                     meta->mt_dmap);
3388                         else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3389                                 bus_dmamap_unload(dma->txbuf_dtag,
3390                                     meta->mt_dmap);
3391                 } else
3392                         bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3393                 bwn_dma_free_descbuf(dr, meta);
3394         }
3395 }
3396
3397 static int
3398 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3399     int type)
3400 {
3401         struct bwn_softc *sc = mac->mac_sc;
3402         uint32_t value;
3403         int i;
3404         uint16_t offset;
3405
3406         for (i = 0; i < 10; i++) {
3407                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3408                     BWN_DMA32_TXSTATUS;
3409                 value = BWN_READ_4(mac, base + offset);
3410                 if (type == BHND_DMA_ADDR_64BIT) {
3411                         value &= BWN_DMA64_TXSTAT;
3412                         if (value == BWN_DMA64_TXSTAT_DISABLED ||
3413                             value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3414                             value == BWN_DMA64_TXSTAT_STOPPED)
3415                                 break;
3416                 } else {
3417                         value &= BWN_DMA32_TXSTATE;
3418                         if (value == BWN_DMA32_TXSTAT_DISABLED ||
3419                             value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3420                             value == BWN_DMA32_TXSTAT_STOPPED)
3421                                 break;
3422                 }
3423                 DELAY(1000);
3424         }
3425         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXCTL :
3426             BWN_DMA32_TXCTL;
3427         BWN_WRITE_4(mac, base + offset, 0);
3428         for (i = 0; i < 10; i++) {
3429                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3430                     BWN_DMA32_TXSTATUS;
3431                 value = BWN_READ_4(mac, base + offset);
3432                 if (type == BHND_DMA_ADDR_64BIT) {
3433                         value &= BWN_DMA64_TXSTAT;
3434                         if (value == BWN_DMA64_TXSTAT_DISABLED) {
3435                                 i = -1;
3436                                 break;
3437                         }
3438                 } else {
3439                         value &= BWN_DMA32_TXSTATE;
3440                         if (value == BWN_DMA32_TXSTAT_DISABLED) {
3441                                 i = -1;
3442                                 break;
3443                         }
3444                 }
3445                 DELAY(1000);
3446         }
3447         if (i != -1) {
3448                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3449                 return (ENODEV);
3450         }
3451         DELAY(1000);
3452
3453         return (0);
3454 }
3455
3456 static int
3457 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3458     int type)
3459 {
3460         struct bwn_softc *sc = mac->mac_sc;
3461         uint32_t value;
3462         int i;
3463         uint16_t offset;
3464
3465         offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXCTL :
3466             BWN_DMA32_RXCTL;
3467         BWN_WRITE_4(mac, base + offset, 0);
3468         for (i = 0; i < 10; i++) {
3469                 offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXSTATUS :
3470                     BWN_DMA32_RXSTATUS;
3471                 value = BWN_READ_4(mac, base + offset);
3472                 if (type == BHND_DMA_ADDR_64BIT) {
3473                         value &= BWN_DMA64_RXSTAT;
3474                         if (value == BWN_DMA64_RXSTAT_DISABLED) {
3475                                 i = -1;
3476                                 break;
3477                         }
3478                 } else {
3479                         value &= BWN_DMA32_RXSTATE;
3480                         if (value == BWN_DMA32_RXSTAT_DISABLED) {
3481                                 i = -1;
3482                                 break;
3483                         }
3484                 }
3485                 DELAY(1000);
3486         }
3487         if (i != -1) {
3488                 device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3489                 return (ENODEV);
3490         }
3491
3492         return (0);
3493 }
3494
3495 static void
3496 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3497     struct bwn_dmadesc_meta *meta)
3498 {
3499
3500         if (meta->mt_m != NULL) {
3501                 m_freem(meta->mt_m);
3502                 meta->mt_m = NULL;
3503         }
3504         if (meta->mt_ni != NULL) {
3505                 ieee80211_free_node(meta->mt_ni);
3506                 meta->mt_ni = NULL;
3507         }
3508 }
3509
3510 static void
3511 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3512 {
3513         struct bwn_rxhdr4 *rxhdr;
3514         unsigned char *frame;
3515
3516         rxhdr = mtod(m, struct bwn_rxhdr4 *);
3517         rxhdr->frame_len = 0;
3518
3519         KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3520             sizeof(struct bwn_plcp6) + 2,
3521             ("%s:%d: fail", __func__, __LINE__));
3522         frame = mtod(m, char *) + dr->dr_frameoffset;
3523         memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3524 }
3525
3526 static uint8_t
3527 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3528 {
3529         unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3530
3531         return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3532             == 0xff);
3533 }
3534
3535 static void
3536 bwn_wme_init(struct bwn_mac *mac)
3537 {
3538
3539         bwn_wme_load(mac);
3540
3541         /* enable WME support. */
3542         bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3543         BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3544             BWN_IFSCTL_USE_EDCF);
3545 }
3546
3547 static void
3548 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3549 {
3550         struct bwn_softc *sc = mac->mac_sc;
3551         struct ieee80211com *ic = &sc->sc_ic;
3552         uint16_t delay; /* microsec */
3553
3554         delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3555         if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3556                 delay = 500;
3557         if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3558                 delay = max(delay, (uint16_t)2400);
3559
3560         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3561 }
3562
3563 static void
3564 bwn_bt_enable(struct bwn_mac *mac)
3565 {
3566         struct bwn_softc *sc = mac->mac_sc;
3567         uint64_t hf;
3568
3569         if (bwn_bluetooth == 0)
3570                 return;
3571         if ((sc->sc_board_info.board_flags & BHND_BFL_BTCOEX) == 0)
3572                 return;
3573         if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3574                 return;
3575
3576         hf = bwn_hf_read(mac);
3577         if (sc->sc_board_info.board_flags & BHND_BFL_BTC2WIRE_ALTGPIO)
3578                 hf |= BWN_HF_BT_COEXISTALT;
3579         else
3580                 hf |= BWN_HF_BT_COEXIST;
3581         bwn_hf_write(mac, hf);
3582 }
3583
3584 static void
3585 bwn_set_macaddr(struct bwn_mac *mac)
3586 {
3587
3588         bwn_mac_write_bssid(mac);
3589         bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3590             mac->mac_sc->sc_ic.ic_macaddr);
3591 }
3592
3593 static void
3594 bwn_clear_keys(struct bwn_mac *mac)
3595 {
3596         int i;
3597
3598         for (i = 0; i < mac->mac_max_nr_keys; i++) {
3599                 KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3600                     ("%s:%d: fail", __func__, __LINE__));
3601
3602                 bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3603                     NULL, BWN_SEC_KEYSIZE, NULL);
3604                 if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3605                         bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3606                             NULL, BWN_SEC_KEYSIZE, NULL);
3607                 }
3608                 mac->mac_key[i].keyconf = NULL;
3609         }
3610 }
3611
3612 static void
3613 bwn_crypt_init(struct bwn_mac *mac)
3614 {
3615         struct bwn_softc *sc = mac->mac_sc;
3616
3617         mac->mac_max_nr_keys = (bhnd_get_hwrev(sc->sc_dev) >= 5) ? 58 : 20;
3618         KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3619             ("%s:%d: fail", __func__, __LINE__));
3620         mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3621         mac->mac_ktp *= 2;
3622         if (bhnd_get_hwrev(sc->sc_dev) >= 5)
3623                 BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3624         bwn_clear_keys(mac);
3625 }
3626
3627 static void
3628 bwn_chip_exit(struct bwn_mac *mac)
3629 {
3630         bwn_phy_exit(mac);
3631 }
3632
3633 static int
3634 bwn_fw_fillinfo(struct bwn_mac *mac)
3635 {
3636         int error;
3637
3638         error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3639         if (error == 0)
3640                 return (0);
3641         error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3642         if (error == 0)
3643                 return (0);
3644         return (error);
3645 }
3646
3647 /**
3648  * Request that the GPIO controller tristate all pins set in @p mask, granting
3649  * the MAC core control over the pins.
3650  *
3651  * @param mac   bwn MAC state.
3652  * @param pins  If the bit position for a pin number is set to one, tristate the
3653  *              pin.
3654  */
3655 int
3656 bwn_gpio_control(struct bwn_mac *mac, uint32_t pins)
3657 {
3658         struct bwn_softc        *sc;
3659         uint32_t                 flags[32];
3660         int                      error;
3661
3662         sc = mac->mac_sc;
3663
3664         /* Determine desired pin flags */
3665         for (size_t pin = 0; pin < nitems(flags); pin++) {
3666                 uint32_t pinbit = (1 << pin);
3667
3668                 if (pins & pinbit) {
3669                         /* Tristate output */
3670                         flags[pin] = GPIO_PIN_OUTPUT|GPIO_PIN_TRISTATE;
3671                 } else {
3672                         /* Leave unmodified */
3673                         flags[pin] = 0;
3674                 }
3675         }
3676
3677         /* Configure all pins */
3678         error = GPIO_PIN_CONFIG_32(sc->sc_gpio, 0, nitems(flags), flags);
3679         if (error) {
3680                 device_printf(sc->sc_dev, "error configuring %s pin flags: "
3681                     "%d\n", device_get_nameunit(sc->sc_gpio), error);
3682                 return (error);
3683         }
3684
3685         return (0);
3686 }
3687
3688
3689 static int
3690 bwn_gpio_init(struct bwn_mac *mac)
3691 {
3692         struct bwn_softc        *sc;
3693         uint32_t                 pins;
3694
3695         sc = mac->mac_sc;
3696
3697         pins = 0xF;
3698
3699         BWN_WRITE_4(mac, BWN_MACCTL,
3700             BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3701         BWN_WRITE_2(mac, BWN_GPIO_MASK,
3702             BWN_READ_2(mac, BWN_GPIO_MASK) | pins);
3703
3704         if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL) {
3705                 /* MAC core is responsible for toggling PAREF via gpio9 */
3706                 BWN_WRITE_2(mac, BWN_GPIO_MASK,
3707                     BWN_READ_2(mac, BWN_GPIO_MASK) | BHND_GPIO_BOARD_PACTRL);
3708
3709                 pins |= BHND_GPIO_BOARD_PACTRL;
3710         }
3711
3712         return (bwn_gpio_control(mac, pins));
3713 }
3714
3715 static int
3716 bwn_fw_loadinitvals(struct bwn_mac *mac)
3717 {
3718 #define GETFWOFFSET(fwp, offset)                                \
3719         ((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3720         const size_t hdr_len = sizeof(struct bwn_fwhdr);
3721         const struct bwn_fwhdr *hdr;
3722         struct bwn_fw *fw = &mac->mac_fw;
3723         int error;
3724
3725         hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3726         error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3727             be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3728         if (error)
3729                 return (error);
3730         if (fw->initvals_band.fw) {
3731                 hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3732                 error = bwn_fwinitvals_write(mac,
3733                     GETFWOFFSET(fw->initvals_band, hdr_len),
3734                     be32toh(hdr->size),
3735                     fw->initvals_band.fw->datasize - hdr_len);
3736         }
3737         return (error);
3738 #undef GETFWOFFSET
3739 }
3740
3741 static int
3742 bwn_phy_init(struct bwn_mac *mac)
3743 {
3744         struct bwn_softc *sc = mac->mac_sc;
3745         int error;
3746
3747         mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3748         mac->mac_phy.rf_onoff(mac, 1);
3749         error = mac->mac_phy.init(mac);
3750         if (error) {
3751                 device_printf(sc->sc_dev, "PHY init failed\n");
3752                 goto fail0;
3753         }
3754         error = bwn_switch_channel(mac,
3755             mac->mac_phy.get_default_chan(mac));
3756         if (error) {
3757                 device_printf(sc->sc_dev,
3758                     "failed to switch default channel\n");
3759                 goto fail1;
3760         }
3761         return (0);
3762 fail1:
3763         if (mac->mac_phy.exit)
3764                 mac->mac_phy.exit(mac);
3765 fail0:
3766         mac->mac_phy.rf_onoff(mac, 0);
3767
3768         return (error);
3769 }
3770
3771 static void
3772 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3773 {
3774         uint16_t ant;
3775         uint16_t tmp;
3776
3777         ant = bwn_ant2phy(antenna);
3778
3779         /* For ACK/CTS */
3780         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3781         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3782         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3783         /* For Probe Resposes */
3784         tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3785         tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3786         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3787 }
3788
3789 static void
3790 bwn_set_opmode(struct bwn_mac *mac)
3791 {
3792         struct bwn_softc *sc = mac->mac_sc;
3793         struct ieee80211com *ic = &sc->sc_ic;
3794         uint32_t ctl;
3795         uint16_t cfp_pretbtt;
3796
3797         ctl = BWN_READ_4(mac, BWN_MACCTL);
3798         ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3799             BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3800             BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3801         ctl |= BWN_MACCTL_STA;
3802
3803         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3804             ic->ic_opmode == IEEE80211_M_MBSS)
3805                 ctl |= BWN_MACCTL_HOSTAP;
3806         else if (ic->ic_opmode == IEEE80211_M_IBSS)
3807                 ctl &= ~BWN_MACCTL_STA;
3808         ctl |= sc->sc_filters;
3809
3810         if (bhnd_get_hwrev(sc->sc_dev) <= 4)
3811                 ctl |= BWN_MACCTL_PROMISC;
3812
3813         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3814
3815         cfp_pretbtt = 2;
3816         if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3817                 if (sc->sc_cid.chip_id == BHND_CHIPID_BCM4306 &&
3818                     sc->sc_cid.chip_rev == 3)
3819                         cfp_pretbtt = 100;
3820                 else
3821                         cfp_pretbtt = 50;
3822         }
3823         BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3824 }
3825
3826 static void
3827 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3828 {
3829         if (!error) {
3830                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3831                 *((bus_addr_t *)arg) = seg->ds_addr;
3832         }
3833 }
3834
3835 void
3836 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3837 {
3838         struct bwn_phy *phy = &mac->mac_phy;
3839         struct bwn_softc *sc = mac->mac_sc;
3840         unsigned int i, max_loop;
3841         uint16_t value;
3842         uint32_t buffer[5] = {
3843                 0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3844         };
3845
3846         if (ofdm) {
3847                 max_loop = 0x1e;
3848                 buffer[0] = 0x000201cc;
3849         } else {
3850                 max_loop = 0xfa;
3851                 buffer[0] = 0x000b846e;
3852         }
3853
3854         BWN_ASSERT_LOCKED(mac->mac_sc);
3855
3856         for (i = 0; i < 5; i++)
3857                 bwn_ram_write(mac, i * 4, buffer[i]);
3858
3859         BWN_WRITE_2(mac, 0x0568, 0x0000);
3860         BWN_WRITE_2(mac, 0x07c0,
3861             (bhnd_get_hwrev(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3862
3863         value = (ofdm ? 0x41 : 0x40);
3864         BWN_WRITE_2(mac, 0x050c, value);
3865
3866         if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3867             phy->type == BWN_PHYTYPE_LCN)
3868                 BWN_WRITE_2(mac, 0x0514, 0x1a02);
3869         BWN_WRITE_2(mac, 0x0508, 0x0000);
3870         BWN_WRITE_2(mac, 0x050a, 0x0000);
3871         BWN_WRITE_2(mac, 0x054c, 0x0000);
3872         BWN_WRITE_2(mac, 0x056a, 0x0014);
3873         BWN_WRITE_2(mac, 0x0568, 0x0826);
3874         BWN_WRITE_2(mac, 0x0500, 0x0000);
3875
3876         /* XXX TODO: n phy pa override? */
3877
3878         switch (phy->type) {
3879         case BWN_PHYTYPE_N:
3880         case BWN_PHYTYPE_LCN:
3881                 BWN_WRITE_2(mac, 0x0502, 0x00d0);
3882                 break;
3883         case BWN_PHYTYPE_LP:
3884                 BWN_WRITE_2(mac, 0x0502, 0x0050);
3885                 break;
3886         default:
3887                 BWN_WRITE_2(mac, 0x0502, 0x0030);
3888                 break;
3889         }
3890
3891         /* flush */
3892         BWN_READ_2(mac, 0x0502);
3893
3894         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3895                 BWN_RF_WRITE(mac, 0x0051, 0x0017);
3896         for (i = 0x00; i < max_loop; i++) {
3897                 value = BWN_READ_2(mac, 0x050e);
3898                 if (value & 0x0080)
3899                         break;
3900                 DELAY(10);
3901         }
3902         for (i = 0x00; i < 0x0a; i++) {
3903                 value = BWN_READ_2(mac, 0x050e);
3904                 if (value & 0x0400)
3905                         break;
3906                 DELAY(10);
3907         }
3908         for (i = 0x00; i < 0x19; i++) {
3909                 value = BWN_READ_2(mac, 0x0690);
3910                 if (!(value & 0x0100))
3911                         break;
3912                 DELAY(10);
3913         }
3914         if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3915                 BWN_RF_WRITE(mac, 0x0051, 0x0037);
3916 }
3917
3918 void
3919 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3920 {
3921         uint32_t macctl;
3922
3923         KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3924
3925         macctl = BWN_READ_4(mac, BWN_MACCTL);
3926         if (macctl & BWN_MACCTL_BIGENDIAN)
3927                 printf("TODO: need swap\n");
3928
3929         BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3930         BWN_BARRIER(mac, BWN_RAM_CONTROL, 4, BUS_SPACE_BARRIER_WRITE);
3931         BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3932 }
3933
3934 void
3935 bwn_mac_suspend(struct bwn_mac *mac)
3936 {
3937         struct bwn_softc *sc = mac->mac_sc;
3938         int i;
3939         uint32_t tmp;
3940
3941         KASSERT(mac->mac_suspended >= 0,
3942             ("%s:%d: fail", __func__, __LINE__));
3943
3944         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3945             __func__, mac->mac_suspended);
3946
3947         if (mac->mac_suspended == 0) {
3948                 bwn_psctl(mac, BWN_PS_AWAKE);
3949                 BWN_WRITE_4(mac, BWN_MACCTL,
3950                             BWN_READ_4(mac, BWN_MACCTL)
3951                             & ~BWN_MACCTL_ON);
3952                 BWN_READ_4(mac, BWN_MACCTL);
3953                 for (i = 35; i; i--) {
3954                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3955                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3956                                 goto out;
3957                         DELAY(10);
3958                 }
3959                 for (i = 40; i; i--) {
3960                         tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3961                         if (tmp & BWN_INTR_MAC_SUSPENDED)
3962                                 goto out;
3963                         DELAY(1000);
3964                 }
3965                 device_printf(sc->sc_dev, "MAC suspend failed\n");
3966         }
3967 out:
3968         mac->mac_suspended++;
3969 }
3970
3971 void
3972 bwn_mac_enable(struct bwn_mac *mac)
3973 {
3974         struct bwn_softc *sc = mac->mac_sc;
3975         uint16_t state;
3976
3977         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3978             __func__, mac->mac_suspended);
3979
3980         state = bwn_shm_read_2(mac, BWN_SHARED,
3981             BWN_SHARED_UCODESTAT);
3982         if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3983             state != BWN_SHARED_UCODESTAT_SLEEP) {
3984                 DPRINTF(sc, BWN_DEBUG_FW,
3985                     "%s: warn: firmware state (%d)\n",
3986                     __func__, state);
3987         }
3988
3989         mac->mac_suspended--;
3990         KASSERT(mac->mac_suspended >= 0,
3991             ("%s:%d: fail", __func__, __LINE__));
3992         if (mac->mac_suspended == 0) {
3993                 BWN_WRITE_4(mac, BWN_MACCTL,
3994                     BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3995                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3996                 BWN_READ_4(mac, BWN_MACCTL);
3997                 BWN_READ_4(mac, BWN_INTR_REASON);
3998                 bwn_psctl(mac, 0);
3999         }
4000 }
4001
4002 void
4003 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
4004 {
4005         struct bwn_softc *sc = mac->mac_sc;
4006         int i;
4007         uint16_t ucstat;
4008
4009         KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
4010             ("%s:%d: fail", __func__, __LINE__));
4011         KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
4012             ("%s:%d: fail", __func__, __LINE__));
4013
4014         /* XXX forcibly awake and hwps-off */
4015
4016         BWN_WRITE_4(mac, BWN_MACCTL,
4017             (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
4018             ~BWN_MACCTL_HWPS);
4019         BWN_READ_4(mac, BWN_MACCTL);
4020         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4021                 for (i = 0; i < 100; i++) {
4022                         ucstat = bwn_shm_read_2(mac, BWN_SHARED,
4023                             BWN_SHARED_UCODESTAT);
4024                         if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
4025                                 break;
4026                         DELAY(10);
4027                 }
4028         }
4029         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
4030             ucstat);
4031 }
4032
4033 static int
4034 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
4035 {
4036         struct bwn_softc *sc = mac->mac_sc;
4037         struct bwn_fw *fw = &mac->mac_fw;
4038         const uint8_t rev = bhnd_get_hwrev(sc->sc_dev);
4039         const char *filename;
4040         uint16_t iost;
4041         int error;
4042
4043         /* microcode */
4044         filename = NULL;
4045         switch (rev) {
4046         case 42:
4047                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4048                         filename = "ucode42";
4049                 break;
4050         case 40:
4051                 if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4052                         filename = "ucode40";
4053                 break;
4054         case 33:
4055                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
4056                         filename = "ucode33_lcn40";
4057                 break;
4058         case 30:
4059                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4060                         filename = "ucode30_mimo";
4061                 break;
4062         case 29:
4063                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4064                         filename = "ucode29_mimo";
4065                 break;
4066         case 26:
4067                 if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4068                         filename = "ucode26_mimo";
4069                 break;
4070         case 28:
4071         case 25:
4072                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4073                         filename = "ucode25_mimo";
4074                 else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4075                         filename = "ucode25_lcn";
4076                 break;
4077         case 24:
4078                 if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4079                         filename = "ucode24_lcn";
4080                 break;
4081         case 23:
4082                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4083                         filename = "ucode16_mimo";
4084                 break;
4085         case 16:
4086         case 17:
4087         case 18:
4088         case 19:
4089                 if (mac->mac_phy.type == BWN_PHYTYPE_N)
4090                         filename = "ucode16_mimo";
4091                 else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
4092                         filename = "ucode16_lp";
4093                 break;
4094         case 15:
4095                 filename = "ucode15";
4096                 break;
4097         case 14:
4098                 filename = "ucode14";
4099                 break;
4100         case 13:
4101                 filename = "ucode13";
4102                 break;
4103         case 12:
4104         case 11:
4105                 filename = "ucode11";
4106                 break;
4107         case 10:
4108         case 9:
4109         case 8:
4110         case 7:
4111         case 6:
4112         case 5:
4113                 filename = "ucode5";
4114                 break;
4115         default:
4116                 device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
4117                 bwn_release_firmware(mac);
4118                 return (EOPNOTSUPP);
4119         }
4120
4121         device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
4122         error = bwn_fw_get(mac, type, filename, &fw->ucode);
4123         if (error) {
4124                 bwn_release_firmware(mac);
4125                 return (error);
4126         }
4127
4128         /* PCM */
4129         KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
4130         if (rev >= 5 && rev <= 10) {
4131                 error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
4132                 if (error == ENOENT)
4133                         fw->no_pcmfile = 1;
4134                 else if (error) {
4135                         bwn_release_firmware(mac);
4136                         return (error);
4137                 }
4138         } else if (rev < 11) {
4139                 device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
4140                 bwn_release_firmware(mac);
4141                 return (EOPNOTSUPP);
4142         }
4143
4144         /* initvals */
4145         error = bhnd_read_iost(sc->sc_dev, &iost);
4146         if (error)
4147                 goto fail1;
4148
4149         switch (mac->mac_phy.type) {
4150         case BWN_PHYTYPE_A:
4151                 if (rev < 5 || rev > 10)
4152                         goto fail1;
4153                 if (iost & BWN_IOST_HAVE_2GHZ)
4154                         filename = "a0g1initvals5";
4155                 else
4156                         filename = "a0g0initvals5";
4157                 break;
4158         case BWN_PHYTYPE_G:
4159                 if (rev >= 5 && rev <= 10)
4160                         filename = "b0g0initvals5";
4161                 else if (rev >= 13)
4162                         filename = "b0g0initvals13";
4163                 else
4164                         goto fail1;
4165                 break;
4166         case BWN_PHYTYPE_LP:
4167                 if (rev == 13)
4168                         filename = "lp0initvals13";
4169                 else if (rev == 14)
4170                         filename = "lp0initvals14";
4171                 else if (rev >= 15)
4172                         filename = "lp0initvals15";
4173                 else
4174                         goto fail1;
4175                 break;
4176         case BWN_PHYTYPE_N:
4177                 if (rev == 30)
4178                         filename = "n16initvals30";
4179                 else if (rev == 28 || rev == 25)
4180                         filename = "n0initvals25";
4181                 else if (rev == 24)
4182                         filename = "n0initvals24";
4183                 else if (rev == 23)
4184                         filename = "n0initvals16";
4185                 else if (rev >= 16 && rev <= 18)
4186                         filename = "n0initvals16";
4187                 else if (rev >= 11 && rev <= 12)
4188                         filename = "n0initvals11";
4189                 else
4190                         goto fail1;
4191                 break;
4192         default:
4193                 goto fail1;
4194         }
4195         error = bwn_fw_get(mac, type, filename, &fw->initvals);
4196         if (error) {
4197                 bwn_release_firmware(mac);
4198                 return (error);
4199         }
4200
4201         /* bandswitch initvals */
4202         switch (mac->mac_phy.type) {
4203         case BWN_PHYTYPE_A:
4204                 if (rev >= 5 && rev <= 10) {
4205                         if (iost & BWN_IOST_HAVE_2GHZ)
4206                                 filename = "a0g1bsinitvals5";
4207                         else
4208                                 filename = "a0g0bsinitvals5";
4209                 } else if (rev >= 11)
4210                         filename = NULL;
4211                 else
4212                         goto fail1;
4213                 break;
4214         case BWN_PHYTYPE_G:
4215                 if (rev >= 5 && rev <= 10)
4216                         filename = "b0g0bsinitvals5";
4217                 else if (rev >= 11)
4218                         filename = NULL;
4219                 else
4220                         goto fail1;
4221                 break;
4222         case BWN_PHYTYPE_LP:
4223                 if (rev == 13)
4224                         filename = "lp0bsinitvals13";
4225                 else if (rev == 14)
4226                         filename = "lp0bsinitvals14";
4227                 else if (rev >= 15)
4228                         filename = "lp0bsinitvals15";
4229                 else
4230                         goto fail1;
4231                 break;
4232         case BWN_PHYTYPE_N:
4233                 if (rev == 30)
4234                         filename = "n16bsinitvals30";
4235                 else if (rev == 28 || rev == 25)
4236                         filename = "n0bsinitvals25";
4237                 else if (rev == 24)
4238                         filename = "n0bsinitvals24";
4239                 else if (rev == 23)
4240                         filename = "n0bsinitvals16";
4241                 else if (rev >= 16 && rev <= 18)
4242                         filename = "n0bsinitvals16";
4243                 else if (rev >= 11 && rev <= 12)
4244                         filename = "n0bsinitvals11";
4245                 else
4246                         goto fail1;
4247                 break;
4248         default:
4249                 device_printf(sc->sc_dev, "unknown phy (%d)\n",
4250                     mac->mac_phy.type);
4251                 goto fail1;
4252         }
4253         error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4254         if (error) {
4255                 bwn_release_firmware(mac);
4256                 return (error);
4257         }
4258         return (0);
4259 fail1:
4260         device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4261             rev, mac->mac_phy.type);
4262         bwn_release_firmware(mac);
4263         return (EOPNOTSUPP);
4264 }
4265
4266 static int
4267 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4268     const char *name, struct bwn_fwfile *bfw)
4269 {
4270         const struct bwn_fwhdr *hdr;
4271         struct bwn_softc *sc = mac->mac_sc;
4272         const struct firmware *fw;
4273         char namebuf[64];
4274
4275         if (name == NULL) {
4276                 bwn_do_release_fw(bfw);
4277                 return (0);
4278         }
4279         if (bfw->filename != NULL) {
4280                 if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4281                         return (0);
4282                 bwn_do_release_fw(bfw);
4283         }
4284
4285         snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4286             (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4287             (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4288         /* XXX Sleeping on "fwload" with the non-sleepable locks held */
4289         fw = firmware_get(namebuf);
4290         if (fw == NULL) {
4291                 device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4292                     namebuf);
4293                 return (ENOENT);
4294         }
4295         if (fw->datasize < sizeof(struct bwn_fwhdr))
4296                 goto fail;
4297         hdr = (const struct bwn_fwhdr *)(fw->data);
4298         switch (hdr->type) {
4299         case BWN_FWTYPE_UCODE:
4300         case BWN_FWTYPE_PCM:
4301                 if (be32toh(hdr->size) !=
4302                     (fw->datasize - sizeof(struct bwn_fwhdr)))
4303                         goto fail;
4304                 /* FALLTHROUGH */
4305         case BWN_FWTYPE_IV:
4306                 if (hdr->ver != 1)
4307                         goto fail;
4308                 break;
4309         default:
4310                 goto fail;
4311         }
4312         bfw->filename = name;
4313         bfw->fw = fw;
4314         bfw->type = type;
4315         return (0);
4316 fail:
4317         device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4318         if (fw != NULL)
4319                 firmware_put(fw, FIRMWARE_UNLOAD);
4320         return (EPROTO);
4321 }
4322
4323 static void
4324 bwn_release_firmware(struct bwn_mac *mac)
4325 {
4326
4327         bwn_do_release_fw(&mac->mac_fw.ucode);
4328         bwn_do_release_fw(&mac->mac_fw.pcm);
4329         bwn_do_release_fw(&mac->mac_fw.initvals);
4330         bwn_do_release_fw(&mac->mac_fw.initvals_band);
4331 }
4332
4333 static void
4334 bwn_do_release_fw(struct bwn_fwfile *bfw)
4335 {
4336
4337         if (bfw->fw != NULL)
4338                 firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4339         bfw->fw = NULL;
4340         bfw->filename = NULL;
4341 }
4342
4343 static int
4344 bwn_fw_loaducode(struct bwn_mac *mac)
4345 {
4346 #define GETFWOFFSET(fwp, offset)        \
4347         ((const uint32_t *)((const char *)fwp.fw->data + offset))
4348 #define GETFWSIZE(fwp, offset)  \
4349         ((fwp.fw->datasize - offset) / sizeof(uint32_t))
4350         struct bwn_softc *sc = mac->mac_sc;
4351         const uint32_t *data;
4352         unsigned int i;
4353         uint32_t ctl;
4354         uint16_t date, fwcaps, time;
4355         int error = 0;
4356
4357         ctl = BWN_READ_4(mac, BWN_MACCTL);
4358         ctl |= BWN_MACCTL_MCODE_JMP0;
4359         KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4360             __LINE__));
4361         BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4362         for (i = 0; i < 64; i++)
4363                 bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4364         for (i = 0; i < 4096; i += 2)
4365                 bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4366
4367         data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4368         bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4369         for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4370              i++) {
4371                 BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4372                 DELAY(10);
4373         }
4374
4375         if (mac->mac_fw.pcm.fw) {
4376                 data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4377                 bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4378                 BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4379                 bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4380                 for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4381                     sizeof(struct bwn_fwhdr)); i++) {
4382                         BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4383                         DELAY(10);
4384                 }
4385         }
4386
4387         BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4388         BWN_WRITE_4(mac, BWN_MACCTL,
4389             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4390             BWN_MACCTL_MCODE_RUN);
4391
4392         for (i = 0; i < 21; i++) {
4393                 if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4394                         break;
4395                 if (i >= 20) {
4396                         device_printf(sc->sc_dev, "ucode timeout\n");
4397                         error = ENXIO;
4398                         goto error;
4399                 }
4400                 DELAY(50000);
4401         }
4402         BWN_READ_4(mac, BWN_INTR_REASON);
4403
4404         mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4405         if (mac->mac_fw.rev <= 0x128) {
4406                 device_printf(sc->sc_dev, "the firmware is too old\n");
4407                 error = EOPNOTSUPP;
4408                 goto error;
4409         }
4410
4411         /*
4412          * Determine firmware header version; needed for TX/RX packet
4413          * handling.
4414          */
4415         if (mac->mac_fw.rev >= 598)
4416                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4417         else if (mac->mac_fw.rev >= 410)
4418                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4419         else
4420                 mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4421
4422         /*
4423          * We don't support rev 598 or later; that requires
4424          * another round of changes to the TX/RX descriptor
4425          * and status layout.
4426          *
4427          * So, complain this is the case and exit out, rather
4428          * than attaching and then failing.
4429          */
4430 #if 0
4431         if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4432                 device_printf(sc->sc_dev,
4433                     "firmware is too new (>=598); not supported\n");
4434                 error = EOPNOTSUPP;
4435                 goto error;
4436         }
4437 #endif
4438
4439         mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4440             BWN_SHARED_UCODE_PATCH);
4441         date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4442         mac->mac_fw.opensource = (date == 0xffff);
4443         if (bwn_wme != 0)
4444                 mac->mac_flags |= BWN_MAC_FLAG_WME;
4445         mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4446
4447         time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4448         if (mac->mac_fw.opensource == 0) {
4449                 device_printf(sc->sc_dev,
4450                     "firmware version (rev %u patch %u date %#x time %#x)\n",
4451                     mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4452                 if (mac->mac_fw.no_pcmfile)
4453                         device_printf(sc->sc_dev,
4454                             "no HW crypto acceleration due to pcm5\n");
4455         } else {
4456                 mac->mac_fw.patch = time;
4457                 fwcaps = bwn_fwcaps_read(mac);
4458                 if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4459                         device_printf(sc->sc_dev,
4460                             "disabling HW crypto acceleration\n");
4461                         mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4462                 }
4463                 if (!(fwcaps & BWN_FWCAPS_WME)) {
4464                         device_printf(sc->sc_dev, "disabling WME support\n");
4465                         mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4466                 }
4467         }
4468
4469         if (BWN_ISOLDFMT(mac))
4470                 device_printf(sc->sc_dev, "using old firmware image\n");
4471
4472         return (0);
4473
4474 error:
4475         BWN_WRITE_4(mac, BWN_MACCTL,
4476             (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4477             BWN_MACCTL_MCODE_JMP0);
4478
4479         return (error);
4480 #undef GETFWSIZE
4481 #undef GETFWOFFSET
4482 }
4483
4484 /* OpenFirmware only */
4485 static uint16_t
4486 bwn_fwcaps_read(struct bwn_mac *mac)
4487 {
4488
4489         KASSERT(mac->mac_fw.opensource == 1,
4490             ("%s:%d: fail", __func__, __LINE__));
4491         return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4492 }
4493
4494 static int
4495 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4496     size_t count, size_t array_size)
4497 {
4498 #define GET_NEXTIV16(iv)                                                \
4499         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4500             sizeof(uint16_t) + sizeof(uint16_t)))
4501 #define GET_NEXTIV32(iv)                                                \
4502         ((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +        \
4503             sizeof(uint16_t) + sizeof(uint32_t)))
4504         struct bwn_softc *sc = mac->mac_sc;
4505         const struct bwn_fwinitvals *iv;
4506         uint16_t offset;
4507         size_t i;
4508         uint8_t bit32;
4509
4510         KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4511             ("%s:%d: fail", __func__, __LINE__));
4512         iv = ivals;
4513         for (i = 0; i < count; i++) {
4514                 if (array_size < sizeof(iv->offset_size))
4515                         goto fail;
4516                 array_size -= sizeof(iv->offset_size);
4517                 offset = be16toh(iv->offset_size);
4518                 bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4519                 offset &= BWN_FWINITVALS_OFFSET_MASK;
4520                 if (offset >= 0x1000)
4521                         goto fail;
4522                 if (bit32) {
4523                         if (array_size < sizeof(iv->data.d32))
4524                                 goto fail;
4525                         array_size -= sizeof(iv->data.d32);
4526                         BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4527                         iv = GET_NEXTIV32(iv);
4528                 } else {
4529
4530                         if (array_size < sizeof(iv->data.d16))
4531                                 goto fail;
4532                         array_size -= sizeof(iv->data.d16);
4533                         BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4534
4535                         iv = GET_NEXTIV16(iv);
4536                 }
4537         }
4538         if (array_size != 0)
4539                 goto fail;
4540         return (0);
4541 fail:
4542         device_printf(sc->sc_dev, "initvals: invalid format\n");
4543         return (EPROTO);
4544 #undef GET_NEXTIV16
4545 #undef GET_NEXTIV32
4546 }
4547
4548 int
4549 bwn_switch_channel(struct bwn_mac *mac, int chan)
4550 {
4551         struct bwn_phy *phy = &(mac->mac_phy);
4552         struct bwn_softc *sc = mac->mac_sc;
4553         struct ieee80211com *ic = &sc->sc_ic;
4554         uint16_t channelcookie, savedcookie;
4555         int error;
4556
4557         if (chan == 0xffff)
4558                 chan = phy->get_default_chan(mac);
4559
4560         channelcookie = chan;
4561         if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4562                 channelcookie |= 0x100;
4563         savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4564         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4565         error = phy->switch_channel(mac, chan);
4566         if (error)
4567                 goto fail;
4568
4569         mac->mac_phy.chan = chan;
4570         DELAY(8000);
4571         return (0);
4572 fail:
4573         device_printf(sc->sc_dev, "failed to switch channel\n");
4574         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4575         return (error);
4576 }
4577
4578 static uint16_t
4579 bwn_ant2phy(int antenna)
4580 {
4581
4582         switch (antenna) {
4583         case BWN_ANT0:
4584                 return (BWN_TX_PHY_ANT0);
4585         case BWN_ANT1:
4586                 return (BWN_TX_PHY_ANT1);
4587         case BWN_ANT2:
4588                 return (BWN_TX_PHY_ANT2);
4589         case BWN_ANT3:
4590                 return (BWN_TX_PHY_ANT3);
4591         case BWN_ANTAUTO:
4592                 return (BWN_TX_PHY_ANT01AUTO);
4593         }
4594         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4595         return (0);
4596 }
4597
4598 static void
4599 bwn_wme_load(struct bwn_mac *mac)
4600 {
4601         struct bwn_softc *sc = mac->mac_sc;
4602         int i;
4603
4604         KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4605             ("%s:%d: fail", __func__, __LINE__));
4606
4607         bwn_mac_suspend(mac);
4608         for (i = 0; i < N(sc->sc_wmeParams); i++)
4609                 bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4610                     bwn_wme_shm_offsets[i]);
4611         bwn_mac_enable(mac);
4612 }
4613
4614 static void
4615 bwn_wme_loadparams(struct bwn_mac *mac,
4616     const struct wmeParams *p, uint16_t shm_offset)
4617 {
4618 #define SM(_v, _f)      (((_v) << _f##_S) & _f)
4619         struct bwn_softc *sc = mac->mac_sc;
4620         uint16_t params[BWN_NR_WMEPARAMS];
4621         int slot, tmp;
4622         unsigned int i;
4623
4624         slot = BWN_READ_2(mac, BWN_RNG) &
4625             SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4626
4627         memset(&params, 0, sizeof(params));
4628
4629         DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4630             "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4631             p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4632
4633         params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4634         params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4635         params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4636         params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4637         params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4638         params[BWN_WMEPARAM_BSLOTS] = slot;
4639         params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4640
4641         for (i = 0; i < N(params); i++) {
4642                 if (i == BWN_WMEPARAM_STATUS) {
4643                         tmp = bwn_shm_read_2(mac, BWN_SHARED,
4644                             shm_offset + (i * 2));
4645                         tmp |= 0x100;
4646                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4647                             tmp);
4648                 } else {
4649                         bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4650                             params[i]);
4651                 }
4652         }
4653 }
4654
4655 static void
4656 bwn_mac_write_bssid(struct bwn_mac *mac)
4657 {
4658         struct bwn_softc *sc = mac->mac_sc;
4659         uint32_t tmp;
4660         int i;
4661         uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4662
4663         bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4664         memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4665         memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4666             IEEE80211_ADDR_LEN);
4667
4668         for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4669                 tmp = (uint32_t) (mac_bssid[i + 0]);
4670                 tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4671                 tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4672                 tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4673                 bwn_ram_write(mac, 0x20 + i, tmp);
4674         }
4675 }
4676
4677 static void
4678 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4679     const uint8_t *macaddr)
4680 {
4681         static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4682         uint16_t data;
4683
4684         if (!mac)
4685                 macaddr = zero;
4686
4687         offset |= 0x0020;
4688         BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4689
4690         data = macaddr[0];
4691         data |= macaddr[1] << 8;
4692         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4693         data = macaddr[2];
4694         data |= macaddr[3] << 8;
4695         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4696         data = macaddr[4];
4697         data |= macaddr[5] << 8;
4698         BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4699 }
4700
4701 static void
4702 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4703     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4704 {
4705         uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4706         uint8_t per_sta_keys_start = 8;
4707
4708         if (BWN_SEC_NEWAPI(mac))
4709                 per_sta_keys_start = 4;
4710
4711         KASSERT(index < mac->mac_max_nr_keys,
4712             ("%s:%d: fail", __func__, __LINE__));
4713         KASSERT(key_len <= BWN_SEC_KEYSIZE,
4714             ("%s:%d: fail", __func__, __LINE__));
4715
4716         if (index >= per_sta_keys_start)
4717                 bwn_key_macwrite(mac, index, NULL);
4718         if (key)
4719                 memcpy(buf, key, key_len);
4720         bwn_key_write(mac, index, algorithm, buf);
4721         if (index >= per_sta_keys_start)
4722                 bwn_key_macwrite(mac, index, mac_addr);
4723
4724         mac->mac_key[index].algorithm = algorithm;
4725 }
4726
4727 static void
4728 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4729 {
4730         struct bwn_softc *sc = mac->mac_sc;
4731         uint32_t addrtmp[2] = { 0, 0 };
4732         uint8_t start = 8;
4733
4734         if (BWN_SEC_NEWAPI(mac))
4735                 start = 4;
4736
4737         KASSERT(index >= start,
4738             ("%s:%d: fail", __func__, __LINE__));
4739         index -= start;
4740
4741         if (addr) {
4742                 addrtmp[0] = addr[0];
4743                 addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4744                 addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4745                 addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4746                 addrtmp[1] = addr[4];
4747                 addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4748         }
4749
4750         if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4751                 bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4752                 bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4753         } else {
4754                 if (index >= 8) {
4755                         bwn_shm_write_4(mac, BWN_SHARED,
4756                             BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4757                         bwn_shm_write_2(mac, BWN_SHARED,
4758                             BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4759                 }
4760         }
4761 }
4762
4763 static void
4764 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4765     const uint8_t *key)
4766 {
4767         unsigned int i;
4768         uint32_t offset;
4769         uint16_t kidx, value;
4770
4771         kidx = BWN_SEC_KEY2FW(mac, index);
4772         bwn_shm_write_2(mac, BWN_SHARED,
4773             BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4774
4775         offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4776         for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4777                 value = key[i];
4778                 value |= (uint16_t)(key[i + 1]) << 8;
4779                 bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4780         }
4781 }
4782
4783 static void
4784 bwn_phy_exit(struct bwn_mac *mac)
4785 {
4786
4787         mac->mac_phy.rf_onoff(mac, 0);
4788         if (mac->mac_phy.exit != NULL)
4789                 mac->mac_phy.exit(mac);
4790 }
4791
4792 static void
4793 bwn_dma_free(struct bwn_mac *mac)
4794 {
4795         struct bwn_dma *dma;
4796
4797         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4798                 return;
4799         dma = &mac->mac_method.dma;
4800
4801         bwn_dma_ringfree(&dma->rx);
4802         bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4803         bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4804         bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4805         bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4806         bwn_dma_ringfree(&dma->mcast);
4807 }
4808
4809 static void
4810 bwn_core_stop(struct bwn_mac *mac)
4811 {
4812         struct bwn_softc *sc = mac->mac_sc;
4813
4814         BWN_ASSERT_LOCKED(sc);
4815
4816         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4817                 return;
4818
4819         callout_stop(&sc->sc_rfswitch_ch);
4820         callout_stop(&sc->sc_task_ch);
4821         callout_stop(&sc->sc_watchdog_ch);
4822         sc->sc_watchdog_timer = 0;
4823         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4824         BWN_READ_4(mac, BWN_INTR_MASK);
4825         bwn_mac_suspend(mac);
4826
4827         mac->mac_status = BWN_MAC_STATUS_INITED;
4828 }
4829
4830 static int
4831 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4832 {
4833         struct bwn_mac *up_dev = NULL;
4834         struct bwn_mac *down_dev;
4835         struct bwn_mac *mac;
4836         int err, status;
4837         uint8_t gmode;
4838
4839         BWN_ASSERT_LOCKED(sc);
4840
4841         TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4842                 if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4843                     mac->mac_phy.supports_2ghz) {
4844                         up_dev = mac;
4845                         gmode = 1;
4846                 } else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4847                     mac->mac_phy.supports_5ghz) {
4848                         up_dev = mac;
4849                         gmode = 0;
4850                 } else {
4851                         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4852                         return (EINVAL);
4853                 }
4854                 if (up_dev != NULL)
4855                         break;
4856         }
4857         if (up_dev == NULL) {
4858                 device_printf(sc->sc_dev, "Could not find a device\n");
4859                 return (ENODEV);
4860         }
4861         if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4862                 return (0);
4863
4864         DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4865             "switching to %s-GHz band\n",
4866             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4867
4868         down_dev = sc->sc_curmac;
4869         status = down_dev->mac_status;
4870         if (status >= BWN_MAC_STATUS_STARTED)
4871                 bwn_core_stop(down_dev);
4872         if (status >= BWN_MAC_STATUS_INITED)
4873                 bwn_core_exit(down_dev);
4874
4875         if (down_dev != up_dev) {
4876                 err = bwn_phy_reset(down_dev);
4877                 if (err)
4878                         goto fail;
4879         }
4880
4881         up_dev->mac_phy.gmode = gmode;
4882         if (status >= BWN_MAC_STATUS_INITED) {
4883                 err = bwn_core_init(up_dev);
4884                 if (err) {
4885                         device_printf(sc->sc_dev,
4886                             "fatal: failed to initialize for %s-GHz\n",
4887                             IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4888                         goto fail;
4889                 }
4890         }
4891         if (status >= BWN_MAC_STATUS_STARTED)
4892                 bwn_core_start(up_dev);
4893         KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4894         sc->sc_curmac = up_dev;
4895
4896         return (0);
4897 fail:
4898         sc->sc_curmac = NULL;
4899         return (err);
4900 }
4901
4902 static void
4903 bwn_rf_turnon(struct bwn_mac *mac)
4904 {
4905
4906         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4907
4908         bwn_mac_suspend(mac);
4909         mac->mac_phy.rf_onoff(mac, 1);
4910         mac->mac_phy.rf_on = 1;
4911         bwn_mac_enable(mac);
4912 }
4913
4914 static void
4915 bwn_rf_turnoff(struct bwn_mac *mac)
4916 {
4917
4918         DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4919
4920         bwn_mac_suspend(mac);
4921         mac->mac_phy.rf_onoff(mac, 0);
4922         mac->mac_phy.rf_on = 0;
4923         bwn_mac_enable(mac);
4924 }
4925
4926 /*
4927  * PHY reset.
4928  */
4929 static int
4930 bwn_phy_reset(struct bwn_mac *mac)
4931 {
4932         struct bwn_softc        *sc;
4933         uint16_t                 iost, mask;
4934         int                      error;
4935
4936         sc = mac->mac_sc;
4937
4938         iost = BWN_IOCTL_PHYRESET | BHND_IOCTL_CLK_FORCE;
4939         mask = iost | BWN_IOCTL_SUPPORT_G;
4940
4941         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4942                 return (error);
4943
4944         DELAY(1000);
4945
4946         iost &= ~BHND_IOCTL_CLK_FORCE;
4947
4948         if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4949                 return (error);
4950
4951         DELAY(1000);
4952
4953         return (0);
4954 }
4955
4956 static int
4957 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4958 {
4959         struct bwn_vap *bvp = BWN_VAP(vap);
4960         struct ieee80211com *ic= vap->iv_ic;
4961         enum ieee80211_state ostate = vap->iv_state;
4962         struct bwn_softc *sc = ic->ic_softc;
4963         struct bwn_mac *mac = sc->sc_curmac;
4964         int error;
4965
4966         DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4967             ieee80211_state_name[vap->iv_state],
4968             ieee80211_state_name[nstate]);
4969
4970         error = bvp->bv_newstate(vap, nstate, arg);
4971         if (error != 0)
4972                 return (error);
4973
4974         BWN_LOCK(sc);
4975
4976         bwn_led_newstate(mac, nstate);
4977
4978         /*
4979          * Clear the BSSID when we stop a STA
4980          */
4981         if (vap->iv_opmode == IEEE80211_M_STA) {
4982                 if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4983                         /*
4984                          * Clear out the BSSID.  If we reassociate to
4985                          * the same AP, this will reinialize things
4986                          * correctly...
4987                          */
4988                         if (ic->ic_opmode == IEEE80211_M_STA &&
4989                             (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4990                                 memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4991                                 bwn_set_macaddr(mac);
4992                         }
4993                 }
4994         }
4995
4996         if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4997             vap->iv_opmode == IEEE80211_M_AHDEMO) {
4998                 /* XXX nothing to do? */
4999         } else if (nstate == IEEE80211_S_RUN) {
5000                 memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
5001                 bwn_set_opmode(mac);
5002                 bwn_set_pretbtt(mac);
5003                 bwn_spu_setdelay(mac, 0);
5004                 bwn_set_macaddr(mac);
5005         }
5006
5007         BWN_UNLOCK(sc);
5008
5009         return (error);
5010 }
5011
5012 static void
5013 bwn_set_pretbtt(struct bwn_mac *mac)
5014 {
5015         struct bwn_softc *sc = mac->mac_sc;
5016         struct ieee80211com *ic = &sc->sc_ic;
5017         uint16_t pretbtt;
5018
5019         if (ic->ic_opmode == IEEE80211_M_IBSS)
5020                 pretbtt = 2;
5021         else
5022                 pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
5023         bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
5024         BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
5025 }
5026
5027 static int
5028 bwn_intr(void *arg)
5029 {
5030         struct bwn_mac *mac = arg;
5031         struct bwn_softc *sc = mac->mac_sc;
5032         uint32_t reason;
5033
5034         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5035             (sc->sc_flags & BWN_FLAG_INVALID))
5036                 return (FILTER_STRAY);
5037
5038         DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
5039
5040         reason = BWN_READ_4(mac, BWN_INTR_REASON);
5041         if (reason == 0xffffffff)       /* shared IRQ */
5042                 return (FILTER_STRAY);
5043         reason &= mac->mac_intr_mask;
5044         if (reason == 0)
5045                 return (FILTER_HANDLED);
5046         DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
5047
5048         mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
5049         mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
5050         mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
5051         mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
5052         mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
5053         BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
5054         BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
5055         BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
5056         BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
5057         BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
5058         BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
5059
5060         /* Disable interrupts. */
5061         BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
5062
5063         mac->mac_reason_intr = reason;
5064
5065         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5066
5067         taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
5068         return (FILTER_HANDLED);
5069 }
5070
5071 static void
5072 bwn_intrtask(void *arg, int npending)
5073 {
5074         struct bwn_mac *mac = arg;
5075         struct bwn_softc *sc = mac->mac_sc;
5076         uint32_t merged = 0;
5077         int i, tx = 0, rx = 0;
5078
5079         BWN_LOCK(sc);
5080         if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5081             (sc->sc_flags & BWN_FLAG_INVALID)) {
5082                 BWN_UNLOCK(sc);
5083                 return;
5084         }
5085
5086         for (i = 0; i < N(mac->mac_reason); i++)
5087                 merged |= mac->mac_reason[i];
5088
5089         if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
5090                 device_printf(sc->sc_dev, "MAC trans error\n");
5091
5092         if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
5093                 DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
5094                 mac->mac_phy.txerrors--;
5095                 if (mac->mac_phy.txerrors == 0) {
5096                         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
5097                         bwn_restart(mac, "PHY TX errors");
5098                 }
5099         }
5100
5101         if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
5102                 if (merged & BWN_DMAINTR_FATALMASK) {
5103                         device_printf(sc->sc_dev,
5104                             "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
5105                             mac->mac_reason[0], mac->mac_reason[1],
5106                             mac->mac_reason[2], mac->mac_reason[3],
5107                             mac->mac_reason[4], mac->mac_reason[5]);
5108                         bwn_restart(mac, "DMA error");
5109                         BWN_UNLOCK(sc);
5110                         return;
5111                 }
5112                 if (merged & BWN_DMAINTR_NONFATALMASK) {
5113                         device_printf(sc->sc_dev,
5114                             "DMA error: %#x %#x %#x %#x %#x %#x\n",
5115                             mac->mac_reason[0], mac->mac_reason[1],
5116                             mac->mac_reason[2], mac->mac_reason[3],
5117                             mac->mac_reason[4], mac->mac_reason[5]);
5118                 }
5119         }
5120
5121         if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
5122                 bwn_intr_ucode_debug(mac);
5123         if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
5124                 bwn_intr_tbtt_indication(mac);
5125         if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
5126                 bwn_intr_atim_end(mac);
5127         if (mac->mac_reason_intr & BWN_INTR_BEACON)
5128                 bwn_intr_beacon(mac);
5129         if (mac->mac_reason_intr & BWN_INTR_PMQ)
5130                 bwn_intr_pmq(mac);
5131         if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
5132                 bwn_intr_noise(mac);
5133
5134         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5135                 if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
5136                         bwn_dma_rx(mac->mac_method.dma.rx);
5137                         rx = 1;
5138                 }
5139         } else
5140                 rx = bwn_pio_rx(&mac->mac_method.pio.rx);
5141
5142         KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5143         KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5144         KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5145         KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5146         KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5147
5148         if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
5149                 bwn_intr_txeof(mac);
5150                 tx = 1;
5151         }
5152
5153         BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
5154
5155         if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
5156                 int evt = BWN_LED_EVENT_NONE;
5157
5158                 if (tx && rx) {
5159                         if (sc->sc_rx_rate > sc->sc_tx_rate)
5160                                 evt = BWN_LED_EVENT_RX;
5161                         else
5162                                 evt = BWN_LED_EVENT_TX;
5163                 } else if (tx) {
5164                         evt = BWN_LED_EVENT_TX;
5165                 } else if (rx) {
5166                         evt = BWN_LED_EVENT_RX;
5167                 } else if (rx == 0) {
5168                         evt = BWN_LED_EVENT_POLL;
5169                 }
5170
5171                 if (evt != BWN_LED_EVENT_NONE)
5172                         bwn_led_event(mac, evt);
5173        }
5174
5175         if (mbufq_first(&sc->sc_snd) != NULL)
5176                 bwn_start(sc);
5177
5178         BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5179
5180         BWN_UNLOCK(sc);
5181 }
5182
5183 static void
5184 bwn_restart(struct bwn_mac *mac, const char *msg)
5185 {
5186         struct bwn_softc *sc = mac->mac_sc;
5187         struct ieee80211com *ic = &sc->sc_ic;
5188
5189         if (mac->mac_status < BWN_MAC_STATUS_INITED)
5190                 return;
5191
5192         device_printf(sc->sc_dev, "HW reset: %s\n", msg);
5193         ieee80211_runtask(ic, &mac->mac_hwreset);
5194 }
5195
5196 static void
5197 bwn_intr_ucode_debug(struct bwn_mac *mac)
5198 {
5199         struct bwn_softc *sc = mac->mac_sc;
5200         uint16_t reason;
5201
5202         if (mac->mac_fw.opensource == 0)
5203                 return;
5204
5205         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
5206         switch (reason) {
5207         case BWN_DEBUGINTR_PANIC:
5208                 bwn_handle_fwpanic(mac);
5209                 break;
5210         case BWN_DEBUGINTR_DUMP_SHM:
5211                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5212                 break;
5213         case BWN_DEBUGINTR_DUMP_REGS:
5214                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5215                 break;
5216         case BWN_DEBUGINTR_MARKER:
5217                 device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5218                 break;
5219         default:
5220                 device_printf(sc->sc_dev,
5221                     "ucode debug unknown reason: %#x\n", reason);
5222         }
5223
5224         bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5225             BWN_DEBUGINTR_ACK);
5226 }
5227
5228 static void
5229 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5230 {
5231         struct bwn_softc *sc = mac->mac_sc;
5232         struct ieee80211com *ic = &sc->sc_ic;
5233
5234         if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5235                 bwn_psctl(mac, 0);
5236         if (ic->ic_opmode == IEEE80211_M_IBSS)
5237                 mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5238 }
5239
5240 static void
5241 bwn_intr_atim_end(struct bwn_mac *mac)
5242 {
5243
5244         if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5245                 BWN_WRITE_4(mac, BWN_MACCMD,
5246                     BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5247                 mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5248         }
5249 }
5250
5251 static void
5252 bwn_intr_beacon(struct bwn_mac *mac)
5253 {
5254         struct bwn_softc *sc = mac->mac_sc;
5255         struct ieee80211com *ic = &sc->sc_ic;
5256         uint32_t cmd, beacon0, beacon1;
5257
5258         if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5259             ic->ic_opmode == IEEE80211_M_MBSS)
5260                 return;
5261
5262         mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5263
5264         cmd = BWN_READ_4(mac, BWN_MACCMD);
5265         beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5266         beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5267
5268         if (beacon0 && beacon1) {
5269                 BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5270                 mac->mac_intr_mask |= BWN_INTR_BEACON;
5271                 return;
5272         }
5273
5274         if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5275                 sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5276                 bwn_load_beacon0(mac);
5277                 bwn_load_beacon1(mac);
5278                 cmd = BWN_READ_4(mac, BWN_MACCMD);
5279                 cmd |= BWN_MACCMD_BEACON0_VALID;
5280                 BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5281         } else {
5282                 if (!beacon0) {
5283                         bwn_load_beacon0(mac);
5284                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5285                         cmd |= BWN_MACCMD_BEACON0_VALID;
5286                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5287                 } else if (!beacon1) {
5288                         bwn_load_beacon1(mac);
5289                         cmd = BWN_READ_4(mac, BWN_MACCMD);
5290                         cmd |= BWN_MACCMD_BEACON1_VALID;
5291                         BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5292                 }
5293         }
5294 }
5295
5296 static void
5297 bwn_intr_pmq(struct bwn_mac *mac)
5298 {
5299         uint32_t tmp;
5300
5301         while (1) {
5302                 tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5303                 if (!(tmp & 0x00000008))
5304                         break;
5305         }
5306         BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5307 }
5308
5309 static void
5310 bwn_intr_noise(struct bwn_mac *mac)
5311 {
5312         struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5313         uint16_t tmp;
5314         uint8_t noise[4];
5315         uint8_t i, j;
5316         int32_t average;
5317
5318         if (mac->mac_phy.type != BWN_PHYTYPE_G)
5319                 return;
5320
5321         KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5322         *((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5323         if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5324             noise[3] == 0x7f)
5325                 goto new;
5326
5327         KASSERT(mac->mac_noise.noi_nsamples < 8,
5328             ("%s:%d: fail", __func__, __LINE__));
5329         i = mac->mac_noise.noi_nsamples;
5330         noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5331         noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5332         noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5333         noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5334         mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5335         mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5336         mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5337         mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5338         mac->mac_noise.noi_nsamples++;
5339         if (mac->mac_noise.noi_nsamples == 8) {
5340                 average = 0;
5341                 for (i = 0; i < 8; i++) {
5342                         for (j = 0; j < 4; j++)
5343                                 average += mac->mac_noise.noi_samples[i][j];
5344                 }
5345                 average = (((average / 32) * 125) + 64) / 128;
5346                 tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5347                 if (tmp >= 8)
5348                         average += 2;
5349                 else
5350                         average -= 25;
5351                 average -= (tmp == 8) ? 72 : 48;
5352
5353                 mac->mac_stats.link_noise = average;
5354                 mac->mac_noise.noi_running = 0;
5355                 return;
5356         }
5357 new:
5358         bwn_noise_gensample(mac);
5359 }
5360
5361 static int
5362 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5363 {
5364         struct bwn_mac *mac = prq->prq_mac;
5365         struct bwn_softc *sc = mac->mac_sc;
5366         unsigned int i;
5367
5368         BWN_ASSERT_LOCKED(sc);
5369
5370         if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5371                 return (0);
5372
5373         for (i = 0; i < 5000; i++) {
5374                 if (bwn_pio_rxeof(prq) == 0)
5375                         break;
5376         }
5377         if (i >= 5000)
5378                 device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5379         return ((i > 0) ? 1 : 0);
5380 }
5381
5382 static void
5383 bwn_dma_rx(struct bwn_dma_ring *dr)
5384 {
5385         int slot, curslot;
5386
5387         KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5388         curslot = dr->get_curslot(dr);
5389         KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5390             ("%s:%d: fail", __func__, __LINE__));
5391
5392         slot = dr->dr_curslot;
5393         for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5394                 bwn_dma_rxeof(dr, &slot);
5395
5396         bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5397             BUS_DMASYNC_PREWRITE);
5398
5399         dr->set_curslot(dr, slot);
5400         dr->dr_curslot = slot;
5401 }
5402
5403 static void
5404 bwn_intr_txeof(struct bwn_mac *mac)
5405 {
5406         struct bwn_txstatus stat;
5407         uint32_t stat0, stat1;
5408         uint16_t tmp;
5409
5410         BWN_ASSERT_LOCKED(mac->mac_sc);
5411
5412         while (1) {
5413                 stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5414                 if (!(stat0 & 0x00000001))
5415                         break;
5416                 stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5417
5418                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5419                     "%s: stat0=0x%08x, stat1=0x%08x\n",
5420                     __func__,
5421                     stat0,
5422                     stat1);
5423
5424                 stat.cookie = (stat0 >> 16);
5425                 stat.seq = (stat1 & 0x0000ffff);
5426                 stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5427                 tmp = (stat0 & 0x0000ffff);
5428                 stat.framecnt = ((tmp & 0xf000) >> 12);
5429                 stat.rtscnt = ((tmp & 0x0f00) >> 8);
5430                 stat.sreason = ((tmp & 0x001c) >> 2);
5431                 stat.pm = (tmp & 0x0080) ? 1 : 0;
5432                 stat.im = (tmp & 0x0040) ? 1 : 0;
5433                 stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5434                 stat.ack = (tmp & 0x0002) ? 1 : 0;
5435
5436                 DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5437                     "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5438                     "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5439                     __func__,
5440                     stat.cookie,
5441                     stat.seq,
5442                     stat.phy_stat,
5443                     stat.framecnt,
5444                     stat.rtscnt,
5445                     stat.sreason,
5446                     stat.pm,
5447                     stat.im,
5448                     stat.ampdu,
5449                     stat.ack);
5450
5451                 bwn_handle_txeof(mac, &stat);
5452         }
5453 }
5454
5455 static void
5456 bwn_hwreset(void *arg, int npending)
5457 {
5458         struct bwn_mac *mac = arg;
5459         struct bwn_softc *sc = mac->mac_sc;
5460         int error = 0;
5461         int prev_status;
5462
5463         BWN_LOCK(sc);
5464
5465         prev_status = mac->mac_status;
5466         if (prev_status >= BWN_MAC_STATUS_STARTED)
5467                 bwn_core_stop(mac);
5468         if (prev_status >= BWN_MAC_STATUS_INITED)
5469                 bwn_core_exit(mac);
5470
5471         if (prev_status >= BWN_MAC_STATUS_INITED) {
5472                 error = bwn_core_init(mac);
5473                 if (error)
5474                         goto out;
5475         }
5476         if (prev_status >= BWN_MAC_STATUS_STARTED)
5477                 bwn_core_start(mac);
5478 out:
5479         if (error) {
5480                 device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5481                 sc->sc_curmac = NULL;
5482         }
5483         BWN_UNLOCK(sc);
5484 }
5485
5486 static void
5487 bwn_handle_fwpanic(struct bwn_mac *mac)
5488 {
5489         struct bwn_softc *sc = mac->mac_sc;
5490         uint16_t reason;
5491
5492         reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5493         device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5494
5495         if (reason == BWN_FWPANIC_RESTART)
5496                 bwn_restart(mac, "ucode panic");
5497 }
5498
5499 static void
5500 bwn_load_beacon0(struct bwn_mac *mac)
5501 {
5502
5503         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5504 }
5505
5506 static void
5507 bwn_load_beacon1(struct bwn_mac *mac)
5508 {
5509
5510         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5511 }
5512
5513 static uint32_t
5514 bwn_jssi_read(struct bwn_mac *mac)
5515 {
5516         uint32_t val = 0;
5517
5518         val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5519         val <<= 16;
5520         val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5521
5522         return (val);
5523 }
5524
5525 static void
5526 bwn_noise_gensample(struct bwn_mac *mac)
5527 {
5528         uint32_t jssi = 0x7f7f7f7f;
5529
5530         bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5531         bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5532         BWN_WRITE_4(mac, BWN_MACCMD,
5533             BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5534 }
5535
5536 static int
5537 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5538 {
5539         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5540
5541         return (dr->dr_numslots - dr->dr_usedslot);
5542 }
5543
5544 static int
5545 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5546 {
5547         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5548
5549         KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5550             ("%s:%d: fail", __func__, __LINE__));
5551         if (slot == dr->dr_numslots - 1)
5552                 return (0);
5553         return (slot + 1);
5554 }
5555
5556 static void
5557 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5558 {
5559         struct bwn_mac *mac = dr->dr_mac;
5560         struct bwn_softc *sc = mac->mac_sc;
5561         struct bwn_dma *dma = &mac->mac_method.dma;
5562         struct bwn_dmadesc_generic *desc;
5563         struct bwn_dmadesc_meta *meta;
5564         struct bwn_rxhdr4 *rxhdr;
5565         struct mbuf *m;
5566         uint32_t macstat;
5567         int32_t tmp;
5568         int cnt = 0;
5569         uint16_t len;
5570
5571         dr->getdesc(dr, *slot, &desc, &meta);
5572
5573         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5574         m = meta->mt_m;
5575
5576         if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5577                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5578                 return;
5579         }
5580
5581         rxhdr = mtod(m, struct bwn_rxhdr4 *);
5582         len = le16toh(rxhdr->frame_len);
5583         if (len <= 0) {
5584                 counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5585                 return;
5586         }
5587         if (bwn_dma_check_redzone(dr, m)) {
5588                 device_printf(sc->sc_dev, "redzone error.\n");
5589                 bwn_dma_set_redzone(dr, m);
5590                 bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5591                     BUS_DMASYNC_PREWRITE);
5592                 return;
5593         }
5594         if (len > dr->dr_rx_bufsize) {
5595                 tmp = len;
5596                 while (1) {
5597                         dr->getdesc(dr, *slot, &desc, &meta);
5598                         bwn_dma_set_redzone(dr, meta->mt_m);
5599                         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5600                             BUS_DMASYNC_PREWRITE);
5601                         *slot = bwn_dma_nextslot(dr, *slot);
5602                         cnt++;
5603                         tmp -= dr->dr_rx_bufsize;
5604                         if (tmp <= 0)
5605                                 break;
5606                 }
5607                 device_printf(sc->sc_dev, "too small buffer "
5608                        "(len %u buffer %u dropped %d)\n",
5609                        len, dr->dr_rx_bufsize, cnt);
5610                 return;
5611         }
5612
5613         switch (mac->mac_fw.fw_hdr_format) {
5614         case BWN_FW_HDR_351:
5615         case BWN_FW_HDR_410:
5616                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5617                 break;
5618         case BWN_FW_HDR_598:
5619                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
5620                 break;
5621         }
5622
5623         if (macstat & BWN_RX_MAC_FCSERR) {
5624                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5625                         device_printf(sc->sc_dev, "RX drop\n");
5626                         return;
5627                 }
5628         }
5629
5630         m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5631         m_adj(m, dr->dr_frameoffset);
5632
5633         bwn_rxeof(dr->dr_mac, m, rxhdr);
5634 }
5635
5636 static void
5637 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5638 {
5639         struct bwn_softc *sc = mac->mac_sc;
5640         struct bwn_stats *stats = &mac->mac_stats;
5641
5642         BWN_ASSERT_LOCKED(mac->mac_sc);
5643
5644         if (status->im)
5645                 device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5646         if (status->ampdu)
5647                 device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5648         if (status->rtscnt) {
5649                 if (status->rtscnt == 0xf)
5650                         stats->rtsfail++;
5651                 else
5652                         stats->rts++;
5653         }
5654
5655         if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5656                 bwn_dma_handle_txeof(mac, status);
5657         } else {
5658                 bwn_pio_handle_txeof(mac, status);
5659         }
5660
5661         bwn_phy_txpower_check(mac, 0);
5662 }
5663
5664 static uint8_t
5665 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5666 {
5667         struct bwn_mac *mac = prq->prq_mac;
5668         struct bwn_softc *sc = mac->mac_sc;
5669         struct bwn_rxhdr4 rxhdr;
5670         struct mbuf *m;
5671         uint32_t ctl32, macstat, v32;
5672         unsigned int i, padding;
5673         uint16_t ctl16, len, totlen, v16;
5674         unsigned char *mp;
5675         char *data;
5676
5677         memset(&rxhdr, 0, sizeof(rxhdr));
5678
5679         if (prq->prq_rev >= 8) {
5680                 ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5681                 if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5682                         return (0);
5683                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5684                     BWN_PIO8_RXCTL_FRAMEREADY);
5685                 for (i = 0; i < 10; i++) {
5686                         ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5687                         if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5688                                 goto ready;
5689                         DELAY(10);
5690                 }
5691         } else {
5692                 ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5693                 if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5694                         return (0);
5695                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5696                     BWN_PIO_RXCTL_FRAMEREADY);
5697                 for (i = 0; i < 10; i++) {
5698                         ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5699                         if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5700                                 goto ready;
5701                         DELAY(10);
5702                 }
5703         }
5704         device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5705         return (1);
5706 ready:
5707         if (prq->prq_rev >= 8) {
5708                 bus_read_multi_4(sc->sc_mem_res,
5709                     prq->prq_base + BWN_PIO8_RXDATA, (void *)&rxhdr,
5710                     sizeof(rxhdr));
5711         } else {
5712                 bus_read_multi_2(sc->sc_mem_res,
5713                     prq->prq_base + BWN_PIO_RXDATA, (void *)&rxhdr,
5714                     sizeof(rxhdr));
5715         }
5716         len = le16toh(rxhdr.frame_len);
5717         if (len > 0x700) {
5718                 device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5719                 goto error;
5720         }
5721         if (len == 0) {
5722                 device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5723                 goto error;
5724         }
5725
5726         switch (mac->mac_fw.fw_hdr_format) {
5727         case BWN_FW_HDR_351:
5728         case BWN_FW_HDR_410:
5729                 macstat = le32toh(rxhdr.ps4.r351.mac_status);
5730                 break;
5731         case BWN_FW_HDR_598:
5732                 macstat = le32toh(rxhdr.ps4.r598.mac_status);
5733                 break;
5734         }
5735
5736         if (macstat & BWN_RX_MAC_FCSERR) {
5737                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5738                         device_printf(sc->sc_dev, "%s: FCS error", __func__);
5739                         goto error;
5740                 }
5741         }
5742
5743         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5744         totlen = len + padding;
5745         KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5746         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5747         if (m == NULL) {
5748                 device_printf(sc->sc_dev, "%s: out of memory", __func__);
5749                 goto error;
5750         }
5751         mp = mtod(m, unsigned char *);
5752         if (prq->prq_rev >= 8) {
5753                 bus_read_multi_4(sc->sc_mem_res,
5754                     prq->prq_base + BWN_PIO8_RXDATA, (void *)mp, (totlen & ~3));
5755                 if (totlen & 3) {
5756                         v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5757                         data = &(mp[totlen - 1]);
5758                         switch (totlen & 3) {
5759                         case 3:
5760                                 *data = (v32 >> 16);
5761                                 data--;
5762                         case 2:
5763                                 *data = (v32 >> 8);
5764                                 data--;
5765                         case 1:
5766                                 *data = v32;
5767                         }
5768                 }
5769         } else {
5770                 bus_read_multi_2(sc->sc_mem_res,
5771                     prq->prq_base + BWN_PIO_RXDATA, (void *)mp, (totlen & ~1));
5772                 if (totlen & 1) {
5773                         v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5774                         mp[totlen - 1] = v16;
5775                 }
5776         }
5777
5778         m->m_len = m->m_pkthdr.len = totlen;
5779
5780         bwn_rxeof(prq->prq_mac, m, &rxhdr);
5781
5782         return (1);
5783 error:
5784         if (prq->prq_rev >= 8)
5785                 bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5786                     BWN_PIO8_RXCTL_DATAREADY);
5787         else
5788                 bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5789         return (1);
5790 }
5791
5792 static int
5793 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5794     struct bwn_dmadesc_meta *meta, int init)
5795 {
5796         struct bwn_mac *mac = dr->dr_mac;
5797         struct bwn_dma *dma = &mac->mac_method.dma;
5798         struct bwn_rxhdr4 *hdr;
5799         bus_dmamap_t map;
5800         bus_addr_t paddr;
5801         struct mbuf *m;
5802         int error;
5803
5804         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5805         if (m == NULL) {
5806                 error = ENOBUFS;
5807
5808                 /*
5809                  * If the NIC is up and running, we need to:
5810                  * - Clear RX buffer's header.
5811                  * - Restore RX descriptor settings.
5812                  */
5813                 if (init)
5814                         return (error);
5815                 else
5816                         goto back;
5817         }
5818         m->m_len = m->m_pkthdr.len = MCLBYTES;
5819
5820         bwn_dma_set_redzone(dr, m);
5821
5822         /*
5823          * Try to load RX buf into temporary DMA map
5824          */
5825         error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5826             bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5827         if (error) {
5828                 m_freem(m);
5829
5830                 /*
5831                  * See the comment above
5832                  */
5833                 if (init)
5834                         return (error);
5835                 else
5836                         goto back;
5837         }
5838
5839         if (!init)
5840                 bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5841         meta->mt_m = m;
5842         meta->mt_paddr = paddr;
5843
5844         /*
5845          * Swap RX buf's DMA map with the loaded temporary one
5846          */
5847         map = meta->mt_dmap;
5848         meta->mt_dmap = dr->dr_spare_dmap;
5849         dr->dr_spare_dmap = map;
5850
5851 back:
5852         /*
5853          * Clear RX buf header
5854          */
5855         hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5856         bzero(hdr, sizeof(*hdr));
5857         bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5858             BUS_DMASYNC_PREWRITE);
5859
5860         /*
5861          * Setup RX buf descriptor
5862          */
5863         dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5864             sizeof(*hdr), 0, 0, 0);
5865         return (error);
5866 }
5867
5868 static void
5869 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5870                  bus_size_t mapsz __unused, int error)
5871 {
5872
5873         if (!error) {
5874                 KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5875                 *((bus_addr_t *)arg) = seg->ds_addr;
5876         }
5877 }
5878
5879 static int
5880 bwn_hwrate2ieeerate(int rate)
5881 {
5882
5883         switch (rate) {
5884         case BWN_CCK_RATE_1MB:
5885                 return (2);
5886         case BWN_CCK_RATE_2MB:
5887                 return (4);
5888         case BWN_CCK_RATE_5MB:
5889                 return (11);
5890         case BWN_CCK_RATE_11MB:
5891                 return (22);
5892         case BWN_OFDM_RATE_6MB:
5893                 return (12);
5894         case BWN_OFDM_RATE_9MB:
5895                 return (18);
5896         case BWN_OFDM_RATE_12MB:
5897                 return (24);
5898         case BWN_OFDM_RATE_18MB:
5899                 return (36);
5900         case BWN_OFDM_RATE_24MB:
5901                 return (48);
5902         case BWN_OFDM_RATE_36MB:
5903                 return (72);
5904         case BWN_OFDM_RATE_48MB:
5905                 return (96);
5906         case BWN_OFDM_RATE_54MB:
5907                 return (108);
5908         default:
5909                 printf("Ooops\n");
5910                 return (0);
5911         }
5912 }
5913
5914 /*
5915  * Post process the RX provided RSSI.
5916  *
5917  * Valid for A, B, G, LP PHYs.
5918  */
5919 static int8_t
5920 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5921     int ofdm, int adjust_2053, int adjust_2050)
5922 {
5923         struct bwn_phy *phy = &mac->mac_phy;
5924         struct bwn_phy_g *gphy = &phy->phy_g;
5925         int tmp;
5926
5927         switch (phy->rf_ver) {
5928         case 0x2050:
5929                 if (ofdm) {
5930                         tmp = in_rssi;
5931                         if (tmp > 127)
5932                                 tmp -= 256;
5933                         tmp = tmp * 73 / 64;
5934                         if (adjust_2050)
5935                                 tmp += 25;
5936                         else
5937                                 tmp -= 3;
5938                 } else {
5939                         if (mac->mac_sc->sc_board_info.board_flags
5940                             & BHND_BFL_ADCDIV) {
5941                                 if (in_rssi > 63)
5942                                         in_rssi = 63;
5943                                 tmp = gphy->pg_nrssi_lt[in_rssi];
5944                                 tmp = (31 - tmp) * -131 / 128 - 57;
5945                         } else {
5946                                 tmp = in_rssi;
5947                                 tmp = (31 - tmp) * -149 / 128 - 68;
5948                         }
5949                         if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5950                                 tmp += 25;
5951                 }
5952                 break;
5953         case 0x2060:
5954                 if (in_rssi > 127)
5955                         tmp = in_rssi - 256;
5956                 else
5957                         tmp = in_rssi;
5958                 break;
5959         default:
5960                 tmp = in_rssi;
5961                 tmp = (tmp - 11) * 103 / 64;
5962                 if (adjust_2053)
5963                         tmp -= 109;
5964                 else
5965                         tmp -= 83;
5966         }
5967
5968         return (tmp);
5969 }
5970
5971 static void
5972 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5973 {
5974         const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5975         struct bwn_plcp6 *plcp;
5976         struct bwn_softc *sc = mac->mac_sc;
5977         struct ieee80211_frame_min *wh;
5978         struct ieee80211_node *ni;
5979         struct ieee80211com *ic = &sc->sc_ic;
5980         uint32_t macstat;
5981         int padding, rate, rssi = 0, noise = 0, type;
5982         uint16_t phytype, phystat0, phystat3, chanstat;
5983         unsigned char *mp = mtod(m, unsigned char *);
5984
5985         BWN_ASSERT_LOCKED(sc);
5986
5987         phystat0 = le16toh(rxhdr->phy_status0);
5988
5989         /*
5990          * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5991          * used for LP-PHY.
5992          */
5993         phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5994
5995         switch (mac->mac_fw.fw_hdr_format) {
5996         case BWN_FW_HDR_351:
5997         case BWN_FW_HDR_410:
5998                 macstat = le32toh(rxhdr->ps4.r351.mac_status);
5999                 chanstat = le16toh(rxhdr->ps4.r351.channel);
6000                 break;
6001         case BWN_FW_HDR_598:
6002                 macstat = le32toh(rxhdr->ps4.r598.mac_status);
6003                 chanstat = le16toh(rxhdr->ps4.r598.channel);
6004                 break;
6005         }
6006
6007
6008         phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
6009
6010         if (macstat & BWN_RX_MAC_FCSERR)
6011                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
6012         if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
6013                 device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
6014         if (macstat & BWN_RX_MAC_DECERR)
6015                 goto drop;
6016
6017         padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
6018         if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
6019                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6020                     m->m_pkthdr.len);
6021                 goto drop;
6022         }
6023         plcp = (struct bwn_plcp6 *)(mp + padding);
6024         m_adj(m, sizeof(struct bwn_plcp6) + padding);
6025         if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
6026                 device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6027                     m->m_pkthdr.len);
6028                 goto drop;
6029         }
6030         wh = mtod(m, struct ieee80211_frame_min *);
6031
6032         if (macstat & BWN_RX_MAC_DEC) {
6033                 DPRINTF(sc, BWN_DEBUG_HWCRYPTO,
6034                     "RX decryption attempted (old %d keyidx %#x)\n",
6035                     BWN_ISOLDFMT(mac),
6036                     (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
6037         }
6038
6039         if (phystat0 & BWN_RX_PHYST0_OFDM)
6040                 rate = bwn_plcp_get_ofdmrate(mac, plcp,
6041                     phytype == BWN_PHYTYPE_A);
6042         else
6043                 rate = bwn_plcp_get_cckrate(mac, plcp);
6044         if (rate == -1) {
6045                 if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
6046                         goto drop;
6047         }
6048         sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
6049
6050         /* rssi/noise */
6051         switch (phytype) {
6052         case BWN_PHYTYPE_A:
6053         case BWN_PHYTYPE_B:
6054         case BWN_PHYTYPE_G:
6055         case BWN_PHYTYPE_LP:
6056                 rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
6057                     !! (phystat0 & BWN_RX_PHYST0_OFDM),
6058                     !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
6059                     !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
6060                 break;
6061         case BWN_PHYTYPE_N:
6062                 /* Broadcom has code for min/avg, but always used max */
6063                 if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
6064                         rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
6065                 else
6066                         rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
6067 #if 0
6068                 DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
6069                     "%s: power0=%d, power1=%d, power2=%d\n",
6070                     __func__,
6071                     rxhdr->phy.n.power0,
6072                     rxhdr->phy.n.power1,
6073                     rxhdr->ps2.n.power2);
6074 #endif
6075                 break;
6076         default:
6077                 /* XXX TODO: implement rssi for other PHYs */
6078                 break;
6079         }
6080
6081         /*
6082          * RSSI here is absolute, not relative to the noise floor.
6083          */
6084         noise = mac->mac_stats.link_noise;
6085         rssi = rssi - noise;
6086
6087         /* RX radio tap */
6088         if (ieee80211_radiotap_active(ic))
6089                 bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
6090         m_adj(m, -IEEE80211_CRC_LEN);
6091
6092         BWN_UNLOCK(sc);
6093
6094         ni = ieee80211_find_rxnode(ic, wh);
6095         if (ni != NULL) {
6096                 type = ieee80211_input(ni, m, rssi, noise);
6097                 ieee80211_free_node(ni);
6098         } else
6099                 type = ieee80211_input_all(ic, m, rssi, noise);
6100
6101         BWN_LOCK(sc);
6102         return;
6103 drop:
6104         device_printf(sc->sc_dev, "%s: dropped\n", __func__);
6105 }
6106
6107 static void
6108 bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
6109     const struct bwn_txstatus *status)
6110 {
6111         struct ieee80211_ratectl_tx_status txs;
6112         int retrycnt = 0;
6113
6114         /*
6115          * If we don't get an ACK, then we should log the
6116          * full framecnt.  That may be 0 if it's a PHY
6117          * failure, so ensure that gets logged as some
6118          * retry attempt.
6119          */
6120         txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
6121         if (status->ack) {
6122                 txs.status = IEEE80211_RATECTL_TX_SUCCESS;
6123                 retrycnt = status->framecnt - 1;
6124         } else {
6125                 txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
6126                 retrycnt = status->framecnt;
6127                 if (retrycnt == 0)
6128                         retrycnt = 1;
6129         }
6130         txs.long_retries = retrycnt;
6131         ieee80211_ratectl_tx_complete(ni, &txs);
6132 }
6133
6134 static void
6135 bwn_dma_handle_txeof(struct bwn_mac *mac,
6136     const struct bwn_txstatus *status)
6137 {
6138         struct bwn_dma *dma = &mac->mac_method.dma;
6139         struct bwn_dma_ring *dr;
6140         struct bwn_dmadesc_generic *desc;
6141         struct bwn_dmadesc_meta *meta;
6142         struct bwn_softc *sc = mac->mac_sc;
6143         int slot;
6144
6145         BWN_ASSERT_LOCKED(sc);
6146
6147         dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
6148         if (dr == NULL) {
6149                 device_printf(sc->sc_dev, "failed to parse cookie\n");
6150                 return;
6151         }
6152         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6153
6154         while (1) {
6155                 KASSERT(slot >= 0 && slot < dr->dr_numslots,
6156                     ("%s:%d: fail", __func__, __LINE__));
6157                 dr->getdesc(dr, slot, &desc, &meta);
6158
6159                 if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
6160                         bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
6161                 else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
6162                         bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
6163
6164                 if (meta->mt_islast) {
6165                         KASSERT(meta->mt_m != NULL,
6166                             ("%s:%d: fail", __func__, __LINE__));
6167
6168                         bwn_ratectl_tx_complete(meta->mt_ni, status);
6169                         ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
6170                         meta->mt_ni = NULL;
6171                         meta->mt_m = NULL;
6172                 } else
6173                         KASSERT(meta->mt_m == NULL,
6174                             ("%s:%d: fail", __func__, __LINE__));
6175
6176                 dr->dr_usedslot--;
6177                 if (meta->mt_islast)
6178                         break;
6179                 slot = bwn_dma_nextslot(dr, slot);
6180         }
6181         sc->sc_watchdog_timer = 0;
6182         if (dr->dr_stop) {
6183                 KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
6184                     ("%s:%d: fail", __func__, __LINE__));
6185                 dr->dr_stop = 0;
6186         }
6187 }
6188
6189 static void
6190 bwn_pio_handle_txeof(struct bwn_mac *mac,
6191     const struct bwn_txstatus *status)
6192 {
6193         struct bwn_pio_txqueue *tq;
6194         struct bwn_pio_txpkt *tp = NULL;
6195         struct bwn_softc *sc = mac->mac_sc;
6196
6197         BWN_ASSERT_LOCKED(sc);
6198
6199         tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
6200         if (tq == NULL)
6201                 return;
6202
6203         tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
6204         tq->tq_free++;
6205
6206         if (tp->tp_ni != NULL) {
6207                 /*
6208                  * Do any tx complete callback.  Note this must
6209                  * be done before releasing the node reference.
6210                  */
6211                 bwn_ratectl_tx_complete(tp->tp_ni, status);
6212         }
6213         ieee80211_tx_complete(tp->tp_ni, tp->tp_m, 0);
6214         tp->tp_ni = NULL;
6215         tp->tp_m = NULL;
6216         TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6217
6218         sc->sc_watchdog_timer = 0;
6219 }
6220
6221 static void
6222 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6223 {
6224         struct bwn_softc *sc = mac->mac_sc;
6225         struct bwn_phy *phy = &mac->mac_phy;
6226         struct ieee80211com *ic = &sc->sc_ic;
6227         unsigned long now;
6228         bwn_txpwr_result_t result;
6229
6230         BWN_GETTIME(now);
6231
6232         if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6233                 return;
6234         phy->nexttime = now + 2 * 1000;
6235
6236         if (sc->sc_board_info.board_vendor == PCI_VENDOR_BROADCOM &&
6237             sc->sc_board_info.board_type == BHND_BOARD_BU4306)
6238                 return;
6239
6240         if (phy->recalc_txpwr != NULL) {
6241                 result = phy->recalc_txpwr(mac,
6242                     (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6243                 if (result == BWN_TXPWR_RES_DONE)
6244                         return;
6245                 KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6246                     ("%s: fail", __func__));
6247                 KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6248
6249                 ieee80211_runtask(ic, &mac->mac_txpower);
6250         }
6251 }
6252
6253 static uint16_t
6254 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6255 {
6256
6257         return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6258 }
6259
6260 static uint32_t
6261 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6262 {
6263
6264         return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6265 }
6266
6267 static void
6268 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6269 {
6270
6271         BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6272 }
6273
6274 static void
6275 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6276 {
6277
6278         BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6279 }
6280
6281 static int
6282 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6283 {
6284
6285         switch (rate) {
6286         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6287         case 12:
6288                 return (BWN_OFDM_RATE_6MB);
6289         case 18:
6290                 return (BWN_OFDM_RATE_9MB);
6291         case 24:
6292                 return (BWN_OFDM_RATE_12MB);
6293         case 36:
6294                 return (BWN_OFDM_RATE_18MB);
6295         case 48:
6296                 return (BWN_OFDM_RATE_24MB);
6297         case 72:
6298                 return (BWN_OFDM_RATE_36MB);
6299         case 96:
6300                 return (BWN_OFDM_RATE_48MB);
6301         case 108:
6302                 return (BWN_OFDM_RATE_54MB);
6303         /* CCK rates (NB: not IEEE std, device-specific) */
6304         case 2:
6305                 return (BWN_CCK_RATE_1MB);
6306         case 4:
6307                 return (BWN_CCK_RATE_2MB);
6308         case 11:
6309                 return (BWN_CCK_RATE_5MB);
6310         case 22:
6311                 return (BWN_CCK_RATE_11MB);
6312         }
6313
6314         device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6315         return (BWN_CCK_RATE_1MB);
6316 }
6317
6318 static uint16_t
6319 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6320 {
6321         struct bwn_phy *phy = &mac->mac_phy;
6322         uint16_t control = 0;
6323         uint16_t bw;
6324
6325         /* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6326         bw = BWN_TXH_PHY1_BW_20;
6327
6328         if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6329                 control = bw;
6330         } else {
6331                 control = bw;
6332                 /* Figure out coding rate and modulation */
6333                 /* XXX TODO: table-ize, for MCS transmit */
6334                 /* Note: this is BWN_*_RATE values */
6335                 switch (bitrate) {
6336                 case BWN_CCK_RATE_1MB:
6337                         control |= 0;
6338                         break;
6339                 case BWN_CCK_RATE_2MB:
6340                         control |= 1;
6341                         break;
6342                 case BWN_CCK_RATE_5MB:
6343                         control |= 2;
6344                         break;
6345                 case BWN_CCK_RATE_11MB:
6346                         control |= 3;
6347                         break;
6348                 case BWN_OFDM_RATE_6MB:
6349                         control |= BWN_TXH_PHY1_CRATE_1_2;
6350                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6351                         break;
6352                 case BWN_OFDM_RATE_9MB:
6353                         control |= BWN_TXH_PHY1_CRATE_3_4;
6354                         control |= BWN_TXH_PHY1_MODUL_BPSK;
6355                         break;
6356                 case BWN_OFDM_RATE_12MB:
6357                         control |= BWN_TXH_PHY1_CRATE_1_2;
6358                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6359                         break;
6360                 case BWN_OFDM_RATE_18MB:
6361                         control |= BWN_TXH_PHY1_CRATE_3_4;
6362                         control |= BWN_TXH_PHY1_MODUL_QPSK;
6363                         break;
6364                 case BWN_OFDM_RATE_24MB:
6365                         control |= BWN_TXH_PHY1_CRATE_1_2;
6366                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6367                         break;
6368                 case BWN_OFDM_RATE_36MB:
6369                         control |= BWN_TXH_PHY1_CRATE_3_4;
6370                         control |= BWN_TXH_PHY1_MODUL_QAM16;
6371                         break;
6372                 case BWN_OFDM_RATE_48MB:
6373                         control |= BWN_TXH_PHY1_CRATE_1_2;
6374                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6375                         break;
6376                 case BWN_OFDM_RATE_54MB:
6377                         control |= BWN_TXH_PHY1_CRATE_3_4;
6378                         control |= BWN_TXH_PHY1_MODUL_QAM64;
6379                         break;
6380                 default:
6381                         break;
6382                 }
6383                 control |= BWN_TXH_PHY1_MODE_SISO;
6384         }
6385
6386         return control;
6387 }
6388
6389 static int
6390 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6391     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6392 {
6393         const struct bwn_phy *phy = &mac->mac_phy;
6394         struct bwn_softc *sc = mac->mac_sc;
6395         struct ieee80211_frame *wh;
6396         struct ieee80211_frame *protwh;
6397         const struct ieee80211_txparam *tp = ni->ni_txparms;
6398         struct ieee80211vap *vap = ni->ni_vap;
6399         struct ieee80211com *ic = &sc->sc_ic;
6400         struct mbuf *mprot;
6401         uint8_t *prot_ptr;
6402         unsigned int len;
6403         uint32_t macctl = 0;
6404         int rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6405         uint16_t phyctl = 0;
6406         uint8_t rate, rate_fb;
6407         int fill_phy_ctl1 = 0;
6408
6409         wh = mtod(m, struct ieee80211_frame *);
6410         memset(txhdr, 0, sizeof(*txhdr));
6411
6412         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6413         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6414         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6415
6416         if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6417             || (phy->type == BWN_PHYTYPE_HT))
6418                 fill_phy_ctl1 = 1;
6419
6420         /*
6421          * Find TX rate
6422          */
6423         if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6424                 rate = rate_fb = tp->mgmtrate;
6425         else if (ismcast)
6426                 rate = rate_fb = tp->mcastrate;
6427         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6428                 rate = rate_fb = tp->ucastrate;
6429         else {
6430                 rix = ieee80211_ratectl_rate(ni, NULL, 0);
6431                 rate = ni->ni_txrate;
6432
6433                 if (rix > 0)
6434                         rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6435                             IEEE80211_RATE_VAL;
6436                 else
6437                         rate_fb = rate;
6438         }
6439
6440         sc->sc_tx_rate = rate;
6441
6442         /* Note: this maps the select ieee80211 rate to hardware rate */
6443         rate = bwn_ieeerate2hwrate(sc, rate);
6444         rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6445
6446         txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6447             bwn_plcp_getcck(rate);
6448         bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6449         bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6450
6451         /* XXX rate/rate_fb is the hardware rate */
6452         if ((rate_fb == rate) ||
6453             (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6454             (*(u_int16_t *)wh->i_dur == htole16(0)))
6455                 txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6456         else
6457                 txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6458                     m->m_pkthdr.len, rate, isshort);
6459
6460         /* XXX TX encryption */
6461
6462         switch (mac->mac_fw.fw_hdr_format) {
6463         case BWN_FW_HDR_351:
6464                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6465                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6466                 break;
6467         case BWN_FW_HDR_410:
6468                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6469                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6470                 break;
6471         case BWN_FW_HDR_598:
6472                 bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6473                     m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6474                 break;
6475         }
6476
6477         bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6478             m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6479
6480         txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6481             BWN_TX_EFT_FB_CCK;
6482         txhdr->chan = phy->chan;
6483         phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6484             BWN_TX_PHY_ENC_CCK;
6485         /* XXX preamble? obey net80211 */
6486         if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6487              rate == BWN_CCK_RATE_11MB))
6488                 phyctl |= BWN_TX_PHY_SHORTPRMBL;
6489
6490         if (! phy->gmode)
6491                 macctl |= BWN_TX_MAC_5GHZ;
6492
6493         /* XXX TX antenna selection */
6494
6495         switch (bwn_antenna_sanitize(mac, 0)) {
6496         case 0:
6497                 phyctl |= BWN_TX_PHY_ANT01AUTO;
6498                 break;
6499         case 1:
6500                 phyctl |= BWN_TX_PHY_ANT0;
6501                 break;
6502         case 2:
6503                 phyctl |= BWN_TX_PHY_ANT1;
6504                 break;
6505         case 3:
6506                 phyctl |= BWN_TX_PHY_ANT2;
6507                 break;
6508         case 4:
6509                 phyctl |= BWN_TX_PHY_ANT3;
6510                 break;
6511         default:
6512                 KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6513         }
6514
6515         if (!ismcast)
6516                 macctl |= BWN_TX_MAC_ACK;
6517
6518         macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6519         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6520             m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6521                 macctl |= BWN_TX_MAC_LONGFRAME;
6522
6523         if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
6524             ic->ic_protmode != IEEE80211_PROT_NONE) {
6525                 /* Note: don't fall back to CCK rates for 5G */
6526                 if (phy->gmode)
6527                         rts_rate = BWN_CCK_RATE_1MB;
6528                 else
6529                         rts_rate = BWN_OFDM_RATE_6MB;
6530                 rts_rate_fb = bwn_get_fbrate(rts_rate);
6531
6532                 /* XXX 'rate' here is hardware rate now, not the net80211 rate */
6533                 mprot = ieee80211_alloc_prot(ni, m, rate, ic->ic_protmode);
6534                 if (mprot == NULL) {
6535                         if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
6536                         device_printf(sc->sc_dev,
6537                             "could not allocate mbuf for protection mode %d\n",
6538                             ic->ic_protmode);
6539                         return (ENOBUFS);
6540                 }
6541
6542                 switch (mac->mac_fw.fw_hdr_format) {
6543                 case BWN_FW_HDR_351:
6544                         prot_ptr = txhdr->body.r351.rts_frame;
6545                         break;
6546                 case BWN_FW_HDR_410:
6547                         prot_ptr = txhdr->body.r410.rts_frame;
6548                         break;
6549                 case BWN_FW_HDR_598:
6550                         prot_ptr = txhdr->body.r598.rts_frame;
6551                         break;
6552                 }
6553
6554                 bcopy(mtod(mprot, uint8_t *), prot_ptr, mprot->m_pkthdr.len);
6555                 m_freem(mprot);
6556
6557                 if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6558                         macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6559                         len = sizeof(struct ieee80211_frame_cts);
6560                 } else {
6561                         macctl |= BWN_TX_MAC_SEND_RTSCTS;
6562                         len = sizeof(struct ieee80211_frame_rts);
6563                 }
6564                 len += IEEE80211_CRC_LEN;
6565
6566                 switch (mac->mac_fw.fw_hdr_format) {
6567                 case BWN_FW_HDR_351:
6568                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6569                             &txhdr->body.r351.rts_plcp, len, rts_rate);
6570                         break;
6571                 case BWN_FW_HDR_410:
6572                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6573                             &txhdr->body.r410.rts_plcp, len, rts_rate);
6574                         break;
6575                 case BWN_FW_HDR_598:
6576                         bwn_plcp_genhdr((struct bwn_plcp4 *)
6577                             &txhdr->body.r598.rts_plcp, len, rts_rate);
6578                         break;
6579                 }
6580
6581                 bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6582                     rts_rate_fb);
6583
6584                 switch (mac->mac_fw.fw_hdr_format) {
6585                 case BWN_FW_HDR_351:
6586                         protwh = (struct ieee80211_frame *)
6587                             &txhdr->body.r351.rts_frame;
6588                         break;
6589                 case BWN_FW_HDR_410:
6590                         protwh = (struct ieee80211_frame *)
6591                             &txhdr->body.r410.rts_frame;
6592                         break;
6593                 case BWN_FW_HDR_598:
6594                         protwh = (struct ieee80211_frame *)
6595                             &txhdr->body.r598.rts_frame;
6596                         break;
6597                 }
6598
6599                 txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6600
6601                 if (BWN_ISOFDMRATE(rts_rate)) {
6602                         txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6603                         txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6604                 } else {
6605                         txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6606                         txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6607                 }
6608                 txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6609                     BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6610
6611                 if (fill_phy_ctl1) {
6612                         txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6613                         txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6614                 }
6615         }
6616
6617         if (fill_phy_ctl1) {
6618                 txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6619                 txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6620         }
6621
6622         switch (mac->mac_fw.fw_hdr_format) {
6623         case BWN_FW_HDR_351:
6624                 txhdr->body.r351.cookie = htole16(cookie);
6625                 break;
6626         case BWN_FW_HDR_410:
6627                 txhdr->body.r410.cookie = htole16(cookie);
6628                 break;
6629         case BWN_FW_HDR_598:
6630                 txhdr->body.r598.cookie = htole16(cookie);
6631                 break;
6632         }
6633
6634         txhdr->macctl = htole32(macctl);
6635         txhdr->phyctl = htole16(phyctl);
6636
6637         /*
6638          * TX radio tap
6639          */
6640         if (ieee80211_radiotap_active_vap(vap)) {
6641                 sc->sc_tx_th.wt_flags = 0;
6642                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6643                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6644                 if (isshort &&
6645                     (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6646                      rate == BWN_CCK_RATE_11MB))
6647                         sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6648                 sc->sc_tx_th.wt_rate = rate;
6649
6650                 ieee80211_radiotap_tx(vap, m);
6651         }
6652
6653         return (0);
6654 }
6655
6656 static void
6657 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6658     const uint8_t rate)
6659 {
6660         uint32_t d, plen;
6661         uint8_t *raw = plcp->o.raw;
6662
6663         if (BWN_ISOFDMRATE(rate)) {
6664                 d = bwn_plcp_getofdm(rate);
6665                 KASSERT(!(octets & 0xf000),
6666                     ("%s:%d: fail", __func__, __LINE__));
6667                 d |= (octets << 5);
6668                 plcp->o.data = htole32(d);
6669         } else {
6670                 plen = octets * 16 / rate;
6671                 if ((octets * 16 % rate) > 0) {
6672                         plen++;
6673                         if ((rate == BWN_CCK_RATE_11MB)
6674                             && ((octets * 8 % 11) < 4)) {
6675                                 raw[1] = 0x84;
6676                         } else
6677                                 raw[1] = 0x04;
6678                 } else
6679                         raw[1] = 0x04;
6680                 plcp->o.data |= htole32(plen << 16);
6681                 raw[0] = bwn_plcp_getcck(rate);
6682         }
6683 }
6684
6685 static uint8_t
6686 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6687 {
6688         struct bwn_softc *sc = mac->mac_sc;
6689         uint8_t mask;
6690
6691         if (n == 0)
6692                 return (0);
6693         if (mac->mac_phy.gmode)
6694                 mask = sc->sc_ant2g;
6695         else
6696                 mask = sc->sc_ant5g;
6697         if (!(mask & (1 << (n - 1))))
6698                 return (0);
6699         return (n);
6700 }
6701
6702 /*
6703  * Return a fallback rate for the given rate.
6704  *
6705  * Note: Don't fall back from OFDM to CCK.
6706  */
6707 static uint8_t
6708 bwn_get_fbrate(uint8_t bitrate)
6709 {
6710         switch (bitrate) {
6711         /* CCK */
6712         case BWN_CCK_RATE_1MB:
6713                 return (BWN_CCK_RATE_1MB);
6714         case BWN_CCK_RATE_2MB:
6715                 return (BWN_CCK_RATE_1MB);
6716         case BWN_CCK_RATE_5MB:
6717                 return (BWN_CCK_RATE_2MB);
6718         case BWN_CCK_RATE_11MB:
6719                 return (BWN_CCK_RATE_5MB);
6720
6721         /* OFDM */
6722         case BWN_OFDM_RATE_6MB:
6723                 return (BWN_OFDM_RATE_6MB);
6724         case BWN_OFDM_RATE_9MB:
6725                 return (BWN_OFDM_RATE_6MB);
6726         case BWN_OFDM_RATE_12MB:
6727                 return (BWN_OFDM_RATE_9MB);
6728         case BWN_OFDM_RATE_18MB:
6729                 return (BWN_OFDM_RATE_12MB);
6730         case BWN_OFDM_RATE_24MB:
6731                 return (BWN_OFDM_RATE_18MB);
6732         case BWN_OFDM_RATE_36MB:
6733                 return (BWN_OFDM_RATE_24MB);
6734         case BWN_OFDM_RATE_48MB:
6735                 return (BWN_OFDM_RATE_36MB);
6736         case BWN_OFDM_RATE_54MB:
6737                 return (BWN_OFDM_RATE_48MB);
6738         }
6739         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6740         return (0);
6741 }
6742
6743 static uint32_t
6744 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6745     uint32_t ctl, const void *_data, int len)
6746 {
6747         struct bwn_softc *sc = mac->mac_sc;
6748         uint32_t value = 0;
6749         const uint8_t *data = _data;
6750
6751         ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6752             BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6753         bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6754
6755         bus_write_multi_4(sc->sc_mem_res, tq->tq_base + BWN_PIO8_TXDATA,
6756             __DECONST(void *, data), (len & ~3));
6757         if (len & 3) {
6758                 ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6759                     BWN_PIO8_TXCTL_24_31);
6760                 data = &(data[len - 1]);
6761                 switch (len & 3) {
6762                 case 3:
6763                         ctl |= BWN_PIO8_TXCTL_16_23;
6764                         value |= (uint32_t)(*data) << 16;
6765                         data--;
6766                 case 2:
6767                         ctl |= BWN_PIO8_TXCTL_8_15;
6768                         value |= (uint32_t)(*data) << 8;
6769                         data--;
6770                 case 1:
6771                         value |= (uint32_t)(*data);
6772                 }
6773                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6774                 bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6775         }
6776
6777         return (ctl);
6778 }
6779
6780 static void
6781 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6782     uint16_t offset, uint32_t value)
6783 {
6784
6785         BWN_WRITE_4(mac, tq->tq_base + offset, value);
6786 }
6787
6788 static uint16_t
6789 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6790     uint16_t ctl, const void *_data, int len)
6791 {
6792         struct bwn_softc *sc = mac->mac_sc;
6793         const uint8_t *data = _data;
6794
6795         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6796         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6797
6798         bus_write_multi_2(sc->sc_mem_res, tq->tq_base + BWN_PIO_TXDATA,
6799             __DECONST(void *, data), (len & ~1));
6800         if (len & 1) {
6801                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6802                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6803                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6804         }
6805
6806         return (ctl);
6807 }
6808
6809 static uint16_t
6810 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6811     uint16_t ctl, struct mbuf *m0)
6812 {
6813         int i, j = 0;
6814         uint16_t data = 0;
6815         const uint8_t *buf;
6816         struct mbuf *m = m0;
6817
6818         ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6819         BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6820
6821         for (; m != NULL; m = m->m_next) {
6822                 buf = mtod(m, const uint8_t *);
6823                 for (i = 0; i < m->m_len; i++) {
6824                         if (!((j++) % 2))
6825                                 data |= buf[i];
6826                         else {
6827                                 data |= (buf[i] << 8);
6828                                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6829                                 data = 0;
6830                         }
6831                 }
6832         }
6833         if (m0->m_pkthdr.len % 2) {
6834                 ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6835                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6836                 BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6837         }
6838
6839         return (ctl);
6840 }
6841
6842 static void
6843 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6844 {
6845
6846         /* XXX should exit if 5GHz band .. */
6847         if (mac->mac_phy.type != BWN_PHYTYPE_G)
6848                 return;
6849
6850         BWN_WRITE_2(mac, 0x684, 510 + time);
6851         /* Disabled in Linux b43, can adversely effect performance */
6852 #if 0
6853         bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6854 #endif
6855 }
6856
6857 static struct bwn_dma_ring *
6858 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6859 {
6860
6861         if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6862                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6863
6864         switch (prio) {
6865         case 3:
6866                 return (mac->mac_method.dma.wme[WME_AC_VO]);
6867         case 2:
6868                 return (mac->mac_method.dma.wme[WME_AC_VI]);
6869         case 0:
6870                 return (mac->mac_method.dma.wme[WME_AC_BE]);
6871         case 1:
6872                 return (mac->mac_method.dma.wme[WME_AC_BK]);
6873         }
6874         KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6875         return (NULL);
6876 }
6877
6878 static int
6879 bwn_dma_getslot(struct bwn_dma_ring *dr)
6880 {
6881         int slot;
6882
6883         BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6884
6885         KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6886         KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6887         KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6888
6889         slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6890         KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6891         dr->dr_curslot = slot;
6892         dr->dr_usedslot++;
6893
6894         return (slot);
6895 }
6896
6897 static struct bwn_pio_txqueue *
6898 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6899     struct bwn_pio_txpkt **pack)
6900 {
6901         struct bwn_pio *pio = &mac->mac_method.pio;
6902         struct bwn_pio_txqueue *tq = NULL;
6903         unsigned int index;
6904
6905         switch (cookie & 0xf000) {
6906         case 0x1000:
6907                 tq = &pio->wme[WME_AC_BK];
6908                 break;
6909         case 0x2000:
6910                 tq = &pio->wme[WME_AC_BE];
6911                 break;
6912         case 0x3000:
6913                 tq = &pio->wme[WME_AC_VI];
6914                 break;
6915         case 0x4000:
6916                 tq = &pio->wme[WME_AC_VO];
6917                 break;
6918         case 0x5000:
6919                 tq = &pio->mcast;
6920                 break;
6921         }
6922         KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6923         if (tq == NULL)
6924                 return (NULL);
6925         index = (cookie & 0x0fff);
6926         KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6927         if (index >= N(tq->tq_pkts))
6928                 return (NULL);
6929         *pack = &tq->tq_pkts[index];
6930         KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6931         return (tq);
6932 }
6933
6934 static void
6935 bwn_txpwr(void *arg, int npending)
6936 {
6937         struct bwn_mac *mac = arg;
6938         struct bwn_softc *sc;
6939
6940         if (mac == NULL)
6941                 return;
6942
6943         sc = mac->mac_sc;
6944
6945         BWN_LOCK(sc);
6946         if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6947             mac->mac_phy.set_txpwr != NULL)
6948                 mac->mac_phy.set_txpwr(mac);
6949         BWN_UNLOCK(sc);
6950 }
6951
6952 static void
6953 bwn_task_15s(struct bwn_mac *mac)
6954 {
6955         uint16_t reg;
6956
6957         if (mac->mac_fw.opensource) {
6958                 reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6959                 if (reg) {
6960                         bwn_restart(mac, "fw watchdog");
6961                         return;
6962                 }
6963                 bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6964         }
6965         if (mac->mac_phy.task_15s)
6966                 mac->mac_phy.task_15s(mac);
6967
6968         mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6969 }
6970
6971 static void
6972 bwn_task_30s(struct bwn_mac *mac)
6973 {
6974
6975         if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6976                 return;
6977         mac->mac_noise.noi_running = 1;
6978         mac->mac_noise.noi_nsamples = 0;
6979
6980         bwn_noise_gensample(mac);
6981 }
6982
6983 static void
6984 bwn_task_60s(struct bwn_mac *mac)
6985 {
6986
6987         if (mac->mac_phy.task_60s)
6988                 mac->mac_phy.task_60s(mac);
6989         bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6990 }
6991
6992 static void
6993 bwn_tasks(void *arg)
6994 {
6995         struct bwn_mac *mac = arg;
6996         struct bwn_softc *sc = mac->mac_sc;
6997
6998         BWN_ASSERT_LOCKED(sc);
6999         if (mac->mac_status != BWN_MAC_STATUS_STARTED)
7000                 return;
7001
7002         if (mac->mac_task_state % 4 == 0)
7003                 bwn_task_60s(mac);
7004         if (mac->mac_task_state % 2 == 0)
7005                 bwn_task_30s(mac);
7006         bwn_task_15s(mac);
7007
7008         mac->mac_task_state++;
7009         callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
7010 }
7011
7012 static int
7013 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
7014 {
7015         struct bwn_softc *sc = mac->mac_sc;
7016
7017         KASSERT(a == 0, ("not support APHY\n"));
7018
7019         switch (plcp->o.raw[0] & 0xf) {
7020         case 0xb:
7021                 return (BWN_OFDM_RATE_6MB);
7022         case 0xf:
7023                 return (BWN_OFDM_RATE_9MB);
7024         case 0xa:
7025                 return (BWN_OFDM_RATE_12MB);
7026         case 0xe:
7027                 return (BWN_OFDM_RATE_18MB);
7028         case 0x9:
7029                 return (BWN_OFDM_RATE_24MB);
7030         case 0xd:
7031                 return (BWN_OFDM_RATE_36MB);
7032         case 0x8:
7033                 return (BWN_OFDM_RATE_48MB);
7034         case 0xc:
7035                 return (BWN_OFDM_RATE_54MB);
7036         }
7037         device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
7038             plcp->o.raw[0] & 0xf);
7039         return (-1);
7040 }
7041
7042 static int
7043 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
7044 {
7045         struct bwn_softc *sc = mac->mac_sc;
7046
7047         switch (plcp->o.raw[0]) {
7048         case 0x0a:
7049                 return (BWN_CCK_RATE_1MB);
7050         case 0x14:
7051                 return (BWN_CCK_RATE_2MB);
7052         case 0x37:
7053                 return (BWN_CCK_RATE_5MB);
7054         case 0x6e:
7055                 return (BWN_CCK_RATE_11MB);
7056         }
7057         device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
7058         return (-1);
7059 }
7060
7061 static void
7062 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
7063     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
7064     int rssi, int noise)
7065 {
7066         struct bwn_softc *sc = mac->mac_sc;
7067         const struct ieee80211_frame_min *wh;
7068         uint64_t tsf;
7069         uint16_t low_mactime_now;
7070         uint16_t mt;
7071
7072         if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
7073                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7074
7075         wh = mtod(m, const struct ieee80211_frame_min *);
7076         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
7077                 sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
7078
7079         bwn_tsf_read(mac, &tsf);
7080         low_mactime_now = tsf;
7081         tsf = tsf & ~0xffffULL;
7082
7083         switch (mac->mac_fw.fw_hdr_format) {
7084         case BWN_FW_HDR_351:
7085         case BWN_FW_HDR_410:
7086                 mt = le16toh(rxhdr->ps4.r351.mac_time);
7087                 break;
7088         case BWN_FW_HDR_598:
7089                 mt = le16toh(rxhdr->ps4.r598.mac_time);
7090                 break;
7091         }
7092
7093         tsf += mt;
7094         if (low_mactime_now < mt)
7095                 tsf -= 0x10000;
7096
7097         sc->sc_rx_th.wr_tsf = tsf;
7098         sc->sc_rx_th.wr_rate = rate;
7099         sc->sc_rx_th.wr_antsignal = rssi;
7100         sc->sc_rx_th.wr_antnoise = noise;
7101 }
7102
7103 static void
7104 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
7105 {
7106         uint32_t low, high;
7107
7108         KASSERT(bhnd_get_hwrev(mac->mac_sc->sc_dev) >= 3,
7109             ("%s:%d: fail", __func__, __LINE__));
7110
7111         low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
7112         high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
7113         *tsf = high;
7114         *tsf <<= 32;
7115         *tsf |= low;
7116 }
7117
7118 static int
7119 bwn_dma_attach(struct bwn_mac *mac)
7120 {
7121         struct bwn_dma                  *dma;
7122         struct bwn_softc                *sc;
7123         struct bhnd_dma_translation     *dt, dma_translation;
7124         bhnd_addr_t                      addrext_req;
7125         bus_dma_tag_t                    dmat;
7126         bus_addr_t                       lowaddr;
7127         u_int                            addrext_shift, addr_width;
7128         int                              error;
7129
7130         dma = &mac->mac_method.dma;
7131         sc = mac->mac_sc;
7132         dt = NULL;
7133
7134         if (sc->sc_quirks & BWN_QUIRK_NODMA)
7135                 return (0);
7136
7137         KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5, ("%s: fail", __func__));
7138
7139         /* Use the DMA engine's maximum host address width to determine the
7140          * addrext constraints, and supported device address width. */
7141         switch (mac->mac_dmatype) {
7142         case BHND_DMA_ADDR_30BIT:
7143                 /* 32-bit engine without addrext support */
7144                 addrext_req = 0x0;
7145                 addrext_shift = 0;
7146
7147                 /* We can address the full 32-bit device address space */
7148                 addr_width = BHND_DMA_ADDR_32BIT;
7149                 break;
7150
7151         case BHND_DMA_ADDR_32BIT:
7152                 /* 32-bit engine with addrext support */
7153                 addrext_req = BWN_DMA32_ADDREXT_MASK;
7154                 addrext_shift = BWN_DMA32_ADDREXT_SHIFT;
7155                 addr_width = BHND_DMA_ADDR_32BIT;
7156                 break;
7157
7158         case BHND_DMA_ADDR_64BIT:
7159                 /* 64-bit engine with addrext support */
7160                 addrext_req = BWN_DMA64_ADDREXT_MASK;
7161                 addrext_shift = BWN_DMA64_ADDREXT_SHIFT;
7162                 addr_width = BHND_DMA_ADDR_64BIT;
7163                 break;
7164
7165         default:
7166                 device_printf(sc->sc_dev, "unsupported DMA address width: %d\n",
7167                     mac->mac_dmatype);
7168                 return (ENXIO);
7169         }
7170
7171
7172         /* Fetch our device->host DMA translation and tag */
7173         error = bhnd_get_dma_translation(sc->sc_dev, addr_width, 0, &dmat,
7174             &dma_translation);
7175         if (error) {
7176                 device_printf(sc->sc_dev, "error fetching DMA translation: "
7177                     "%d\n", error);
7178                 return (error);
7179         }
7180
7181         /* Verify that our DMA engine's addrext constraints are compatible with
7182          * our DMA translation */
7183         if (addrext_req != 0x0 &&
7184             (dma_translation.addrext_mask & addrext_req) != addrext_req)
7185         {
7186                 device_printf(sc->sc_dev, "bus addrext mask %#jx incompatible "
7187                     "with device addrext mask %#jx, disabling extended address "
7188                     "support\n", (uintmax_t)dma_translation.addrext_mask,
7189                     (uintmax_t)addrext_req);
7190
7191                 addrext_req = 0x0;
7192                 addrext_shift = 0;
7193         }
7194
7195         /* Apply our addrext translation constraint */
7196         dma_translation.addrext_mask = addrext_req;
7197
7198         /* Initialize our DMA engine configuration */
7199         mac->mac_flags |= BWN_MAC_FLAG_DMA;
7200
7201         dma->addrext_shift = addrext_shift;
7202         dma->translation = dma_translation;
7203
7204         dt = &dma->translation;
7205
7206         /* Dermine our translation's maximum supported address */
7207         lowaddr = MIN((dt->addr_mask | dt->addrext_mask), BUS_SPACE_MAXADDR);
7208
7209         /*
7210          * Create top level DMA tag
7211          */
7212         error = bus_dma_tag_create(dmat,                /* parent */
7213                                BWN_ALIGN, 0,            /* alignment, bounds */
7214                                lowaddr,                 /* lowaddr */
7215                                BUS_SPACE_MAXADDR,       /* highaddr */
7216                                NULL, NULL,              /* filter, filterarg */
7217                                BUS_SPACE_MAXSIZE,       /* maxsize */
7218                                BUS_SPACE_UNRESTRICTED,  /* nsegments */
7219                                BUS_SPACE_MAXSIZE,       /* maxsegsize */
7220                                0,                       /* flags */
7221                                NULL, NULL,              /* lockfunc, lockarg */
7222                                &dma->parent_dtag);
7223         if (error) {
7224                 device_printf(sc->sc_dev, "can't create parent DMA tag\n");
7225                 return (error);
7226         }
7227
7228         /*
7229          * Create TX/RX mbuf DMA tag
7230          */
7231         error = bus_dma_tag_create(dma->parent_dtag,
7232                                 1,
7233                                 0,
7234                                 BUS_SPACE_MAXADDR,
7235                                 BUS_SPACE_MAXADDR,
7236                                 NULL, NULL,
7237                                 MCLBYTES,
7238                                 1,
7239                                 BUS_SPACE_MAXSIZE_32BIT,
7240                                 0,
7241                                 NULL, NULL,
7242                                 &dma->rxbuf_dtag);
7243         if (error) {
7244                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7245                 goto fail0;
7246         }
7247         error = bus_dma_tag_create(dma->parent_dtag,
7248                                 1,
7249                                 0,
7250                                 BUS_SPACE_MAXADDR,
7251                                 BUS_SPACE_MAXADDR,
7252                                 NULL, NULL,
7253                                 MCLBYTES,
7254                                 1,
7255                                 BUS_SPACE_MAXSIZE_32BIT,
7256                                 0,
7257                                 NULL, NULL,
7258                                 &dma->txbuf_dtag);
7259         if (error) {
7260                 device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7261                 goto fail1;
7262         }
7263
7264         dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1);
7265         if (!dma->wme[WME_AC_BK])
7266                 goto fail2;
7267
7268         dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1);
7269         if (!dma->wme[WME_AC_BE])
7270                 goto fail3;
7271
7272         dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1);
7273         if (!dma->wme[WME_AC_VI])
7274                 goto fail4;
7275
7276         dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1);
7277         if (!dma->wme[WME_AC_VO])
7278                 goto fail5;
7279
7280         dma->mcast = bwn_dma_ringsetup(mac, 4, 1);
7281         if (!dma->mcast)
7282                 goto fail6;
7283         dma->rx = bwn_dma_ringsetup(mac, 0, 0);
7284         if (!dma->rx)
7285                 goto fail7;
7286
7287         return (error);
7288
7289 fail7:  bwn_dma_ringfree(&dma->mcast);
7290 fail6:  bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7291 fail5:  bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7292 fail4:  bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7293 fail3:  bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7294 fail2:  bus_dma_tag_destroy(dma->txbuf_dtag);
7295 fail1:  bus_dma_tag_destroy(dma->rxbuf_dtag);
7296 fail0:  bus_dma_tag_destroy(dma->parent_dtag);
7297         return (error);
7298 }
7299
7300 static struct bwn_dma_ring *
7301 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7302     uint16_t cookie, int *slot)
7303 {
7304         struct bwn_dma *dma = &mac->mac_method.dma;
7305         struct bwn_dma_ring *dr;
7306         struct bwn_softc *sc = mac->mac_sc;
7307
7308         BWN_ASSERT_LOCKED(mac->mac_sc);
7309
7310         switch (cookie & 0xf000) {
7311         case 0x1000:
7312                 dr = dma->wme[WME_AC_BK];
7313                 break;
7314         case 0x2000:
7315                 dr = dma->wme[WME_AC_BE];
7316                 break;
7317         case 0x3000:
7318                 dr = dma->wme[WME_AC_VI];
7319                 break;
7320         case 0x4000:
7321                 dr = dma->wme[WME_AC_VO];
7322                 break;
7323         case 0x5000:
7324                 dr = dma->mcast;
7325                 break;
7326         default:
7327                 dr = NULL;
7328                 KASSERT(0 == 1,
7329                     ("invalid cookie value %d", cookie & 0xf000));
7330         }
7331         *slot = (cookie & 0x0fff);
7332         if (*slot < 0 || *slot >= dr->dr_numslots) {
7333                 /*
7334                  * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7335                  * that it occurs events which have same H/W sequence numbers.
7336                  * When it's occurred just prints a WARNING msgs and ignores.
7337                  */
7338                 KASSERT(status->seq == dma->lastseq,
7339                     ("%s:%d: fail", __func__, __LINE__));
7340                 device_printf(sc->sc_dev,
7341                     "out of slot ranges (0 < %d < %d)\n", *slot,
7342                     dr->dr_numslots);
7343                 return (NULL);
7344         }
7345         dma->lastseq = status->seq;
7346         return (dr);
7347 }
7348
7349 static void
7350 bwn_dma_stop(struct bwn_mac *mac)
7351 {
7352         struct bwn_dma *dma;
7353
7354         if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7355                 return;
7356         dma = &mac->mac_method.dma;
7357
7358         bwn_dma_ringstop(&dma->rx);
7359         bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7360         bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7361         bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7362         bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7363         bwn_dma_ringstop(&dma->mcast);
7364 }
7365
7366 static void
7367 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7368 {
7369
7370         if (dr == NULL)
7371                 return;
7372
7373         bwn_dma_cleanup(*dr);
7374 }
7375
7376 static void
7377 bwn_pio_stop(struct bwn_mac *mac)
7378 {
7379         struct bwn_pio *pio;
7380
7381         if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7382                 return;
7383         pio = &mac->mac_method.pio;
7384
7385         bwn_destroy_queue_tx(&pio->mcast);
7386         bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7387         bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7388         bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7389         bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7390 }
7391
7392 static int
7393 bwn_led_attach(struct bwn_mac *mac)
7394 {
7395         struct bwn_softc *sc = mac->mac_sc;
7396         const uint8_t *led_act = NULL;
7397         int error;
7398         int i;
7399
7400         sc->sc_led_idle = (2350 * hz) / 1000;
7401         sc->sc_led_blink = 1;
7402
7403         for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7404                 if (sc->sc_board_info.board_vendor ==
7405                     bwn_vendor_led_act[i].vid) {
7406                         led_act = bwn_vendor_led_act[i].led_act;
7407                         break;
7408                 }
7409         }
7410         if (led_act == NULL)
7411                 led_act = bwn_default_led_act;
7412
7413         _Static_assert(nitems(bwn_led_vars) == BWN_LED_MAX,
7414             "invalid NVRAM variable name array");
7415
7416         for (i = 0; i < BWN_LED_MAX; ++i) {
7417                 struct bwn_led  *led;
7418                 uint8_t          val;
7419
7420                 led = &sc->sc_leds[i];
7421
7422                 KASSERT(i < nitems(bwn_led_vars), ("unknown LED index"));
7423                 error = bhnd_nvram_getvar_uint8(sc->sc_dev, bwn_led_vars[i],
7424                     &val);
7425                 if (error) {
7426                         if (error != ENOENT) {
7427                                 device_printf(sc->sc_dev, "NVRAM variable %s "
7428                                     "unreadable: %d", bwn_led_vars[i], error);
7429                                 return (error);
7430                         }
7431
7432                         /* Not found; use default */
7433                         led->led_act = led_act[i];
7434                 } else {
7435                         if (val & BWN_LED_ACT_LOW)
7436                                 led->led_flags |= BWN_LED_F_ACTLOW;
7437                         led->led_act = val & BWN_LED_ACT_MASK;
7438                 }
7439                 led->led_mask = (1 << i);
7440
7441                 if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7442                     led->led_act == BWN_LED_ACT_BLINK_POLL ||
7443                     led->led_act == BWN_LED_ACT_BLINK) {
7444                         led->led_flags |= BWN_LED_F_BLINK;
7445                         if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7446                                 led->led_flags |= BWN_LED_F_POLLABLE;
7447                         else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7448                                 led->led_flags |= BWN_LED_F_SLOW;
7449
7450                         if (sc->sc_blink_led == NULL) {
7451                                 sc->sc_blink_led = led;
7452                                 if (led->led_flags & BWN_LED_F_SLOW)
7453                                         BWN_LED_SLOWDOWN(sc->sc_led_idle);
7454                         }
7455                 }
7456
7457                 DPRINTF(sc, BWN_DEBUG_LED,
7458                     "%dth led, act %d, lowact %d\n", i,
7459                     led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7460         }
7461         callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7462
7463         return (0);
7464 }
7465
7466 static __inline uint16_t
7467 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7468 {
7469
7470         if (led->led_flags & BWN_LED_F_ACTLOW)
7471                 on = !on;
7472         if (on)
7473                 val |= led->led_mask;
7474         else
7475                 val &= ~led->led_mask;
7476         return val;
7477 }
7478
7479 static void
7480 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7481 {
7482         struct bwn_softc *sc = mac->mac_sc;
7483         struct ieee80211com *ic = &sc->sc_ic;
7484         uint16_t val;
7485         int i;
7486
7487         if (nstate == IEEE80211_S_INIT) {
7488                 callout_stop(&sc->sc_led_blink_ch);
7489                 sc->sc_led_blinking = 0;
7490         }
7491
7492         if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7493                 return;
7494
7495         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7496         for (i = 0; i < BWN_LED_MAX; ++i) {
7497                 struct bwn_led *led = &sc->sc_leds[i];
7498                 int on;
7499
7500                 if (led->led_act == BWN_LED_ACT_UNKN ||
7501                     led->led_act == BWN_LED_ACT_NULL)
7502                         continue;
7503
7504                 if ((led->led_flags & BWN_LED_F_BLINK) &&
7505                     nstate != IEEE80211_S_INIT)
7506                         continue;
7507
7508                 switch (led->led_act) {
7509                 case BWN_LED_ACT_ON:    /* Always on */
7510                         on = 1;
7511                         break;
7512                 case BWN_LED_ACT_OFF:   /* Always off */
7513                 case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7514                         on = 0;
7515                         break;
7516                 default:
7517                         on = 1;
7518                         switch (nstate) {
7519                         case IEEE80211_S_INIT:
7520                                 on = 0;
7521                                 break;
7522                         case IEEE80211_S_RUN:
7523                                 if (led->led_act == BWN_LED_ACT_11G &&
7524                                     ic->ic_curmode != IEEE80211_MODE_11G)
7525                                         on = 0;
7526                                 break;
7527                         default:
7528                                 if (led->led_act == BWN_LED_ACT_ASSOC)
7529                                         on = 0;
7530                                 break;
7531                         }
7532                         break;
7533                 }
7534
7535                 val = bwn_led_onoff(led, val, on);
7536         }
7537         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7538 }
7539
7540 static void
7541 bwn_led_event(struct bwn_mac *mac, int event)
7542 {
7543         struct bwn_softc *sc = mac->mac_sc;
7544         struct bwn_led *led = sc->sc_blink_led;
7545         int rate;
7546
7547         if (event == BWN_LED_EVENT_POLL) {
7548                 if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7549                         return;
7550                 if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7551                         return;
7552         }
7553
7554         sc->sc_led_ticks = ticks;
7555         if (sc->sc_led_blinking)
7556                 return;
7557
7558         switch (event) {
7559         case BWN_LED_EVENT_RX:
7560                 rate = sc->sc_rx_rate;
7561                 break;
7562         case BWN_LED_EVENT_TX:
7563                 rate = sc->sc_tx_rate;
7564                 break;
7565         case BWN_LED_EVENT_POLL:
7566                 rate = 0;
7567                 break;
7568         default:
7569                 panic("unknown LED event %d\n", event);
7570                 break;
7571         }
7572         bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7573             bwn_led_duration[rate].off_dur);
7574 }
7575
7576 static void
7577 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7578 {
7579         struct bwn_softc *sc = mac->mac_sc;
7580         struct bwn_led *led = sc->sc_blink_led;
7581         uint16_t val;
7582
7583         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7584         val = bwn_led_onoff(led, val, 1);
7585         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7586
7587         if (led->led_flags & BWN_LED_F_SLOW) {
7588                 BWN_LED_SLOWDOWN(on_dur);
7589                 BWN_LED_SLOWDOWN(off_dur);
7590         }
7591
7592         sc->sc_led_blinking = 1;
7593         sc->sc_led_blink_offdur = off_dur;
7594
7595         callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7596 }
7597
7598 static void
7599 bwn_led_blink_next(void *arg)
7600 {
7601         struct bwn_mac *mac = arg;
7602         struct bwn_softc *sc = mac->mac_sc;
7603         uint16_t val;
7604
7605         val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7606         val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7607         BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7608
7609         callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7610             bwn_led_blink_end, mac);
7611 }
7612
7613 static void
7614 bwn_led_blink_end(void *arg)
7615 {
7616         struct bwn_mac *mac = arg;
7617         struct bwn_softc *sc = mac->mac_sc;
7618
7619         sc->sc_led_blinking = 0;
7620 }
7621
7622 static int
7623 bwn_suspend(device_t dev)
7624 {
7625         struct bwn_softc *sc = device_get_softc(dev);
7626
7627         BWN_LOCK(sc);
7628         bwn_stop(sc);
7629         BWN_UNLOCK(sc);
7630         return (0);
7631 }
7632
7633 static int
7634 bwn_resume(device_t dev)
7635 {
7636         struct bwn_softc *sc = device_get_softc(dev);
7637         int error = EDOOFUS;
7638
7639         BWN_LOCK(sc);
7640         if (sc->sc_ic.ic_nrunning > 0)
7641                 error = bwn_init(sc);
7642         BWN_UNLOCK(sc);
7643         if (error == 0)
7644                 ieee80211_start_all(&sc->sc_ic);
7645         return (0);
7646 }
7647
7648 static void
7649 bwn_rfswitch(void *arg)
7650 {
7651         struct bwn_softc *sc = arg;
7652         struct bwn_mac *mac = sc->sc_curmac;
7653         int cur = 0, prev = 0;
7654
7655         KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7656             ("%s: invalid MAC status %d", __func__, mac->mac_status));
7657
7658         if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7659             || mac->mac_phy.type == BWN_PHYTYPE_N) {
7660                 if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7661                         & BWN_RF_HWENABLED_HI_MASK))
7662                         cur = 1;
7663         } else {
7664                 if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7665                     & BWN_RF_HWENABLED_LO_MASK)
7666                         cur = 1;
7667         }
7668
7669         if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7670                 prev = 1;
7671
7672         DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7673             __func__, cur, prev);
7674
7675         if (cur != prev) {
7676                 if (cur)
7677                         mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7678                 else
7679                         mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7680
7681                 device_printf(sc->sc_dev,
7682                     "status of RF switch is changed to %s\n",
7683                     cur ? "ON" : "OFF");
7684                 if (cur != mac->mac_phy.rf_on) {
7685                         if (cur)
7686                                 bwn_rf_turnon(mac);
7687                         else
7688                                 bwn_rf_turnoff(mac);
7689                 }
7690         }
7691
7692         callout_schedule(&sc->sc_rfswitch_ch, hz);
7693 }
7694
7695 static void
7696 bwn_sysctl_node(struct bwn_softc *sc)
7697 {
7698         device_t dev = sc->sc_dev;
7699         struct bwn_mac *mac;
7700         struct bwn_stats *stats;
7701
7702         /* XXX assume that count of MAC is only 1. */
7703
7704         if ((mac = sc->sc_curmac) == NULL)
7705                 return;
7706         stats = &mac->mac_stats;
7707
7708         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7709             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7710             "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7711         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7712             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7713             "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7714         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7715             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7716             "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7717
7718 #ifdef BWN_DEBUG
7719         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7720             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7721             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7722 #endif
7723 }
7724
7725 static device_method_t bwn_methods[] = {
7726         /* Device interface */
7727         DEVMETHOD(device_probe,         bwn_probe),
7728         DEVMETHOD(device_attach,        bwn_attach),
7729         DEVMETHOD(device_detach,        bwn_detach),
7730         DEVMETHOD(device_suspend,       bwn_suspend),
7731         DEVMETHOD(device_resume,        bwn_resume),
7732         DEVMETHOD_END
7733 };
7734 static driver_t bwn_driver = {
7735         "bwn",
7736         bwn_methods,
7737         sizeof(struct bwn_softc)
7738 };
7739 static devclass_t bwn_devclass;
7740 DRIVER_MODULE(bwn, bhnd, bwn_driver, bwn_devclass, 0, 0);
7741 MODULE_DEPEND(bwn, bhnd, 1, 1, 1);
7742 MODULE_DEPEND(bwn, gpiobus, 1, 1, 1);
7743 MODULE_DEPEND(bwn, wlan, 1, 1, 1);              /* 802.11 media layer */
7744 MODULE_DEPEND(bwn, firmware, 1, 1, 1);          /* firmware support */
7745 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7746 MODULE_VERSION(bwn, 1);