xref: /freebsd/sys/dev/bwn/if_bwn.c (revision 0957b409)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
5  * Copyright (c) 2016 Landon Fuller <landonf@FreeBSD.org>
6  * Copyright (c) 2017 The FreeBSD Foundation
7  * All rights reserved.
8  *
9  * Portions of this software were developed by Landon Fuller
10  * under sponsorship from the FreeBSD Foundation.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer,
17  *    without modification.
18  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
19  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
20  *    redistribution must be conditioned upon including a substantially
21  *    similar Disclaimer requirement for further binary redistribution.
22  *
23  * NO WARRANTY
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34  * THE POSSIBILITY OF SUCH DAMAGES.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 /*
41  * The Broadcom Wireless LAN controller driver.
42  */
43 
44 #include "opt_bwn.h"
45 #include "opt_wlan.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/kernel.h>
50 #include <sys/gpio.h>
51 #include <sys/malloc.h>
52 #include <sys/module.h>
53 #include <sys/endian.h>
54 #include <sys/errno.h>
55 #include <sys/firmware.h>
56 #include <sys/lock.h>
57 #include <sys/mutex.h>
58 #include <machine/bus.h>
59 #include <machine/resource.h>
60 #include <sys/bus.h>
61 #include <sys/rman.h>
62 #include <sys/socket.h>
63 #include <sys/sockio.h>
64 
65 #include <net/ethernet.h>
66 #include <net/if.h>
67 #include <net/if_var.h>
68 #include <net/if_arp.h>
69 #include <net/if_dl.h>
70 #include <net/if_llc.h>
71 #include <net/if_media.h>
72 #include <net/if_types.h>
73 
74 #include <net80211/ieee80211_var.h>
75 #include <net80211/ieee80211_radiotap.h>
76 #include <net80211/ieee80211_regdomain.h>
77 #include <net80211/ieee80211_phy.h>
78 #include <net80211/ieee80211_ratectl.h>
79 
80 #include <dev/bhnd/bhnd.h>
81 #include <dev/bhnd/bhnd_ids.h>
82 
83 #include <dev/bhnd/cores/chipc/chipc.h>
84 #include <dev/bhnd/cores/pmu/bhnd_pmu.h>
85 
86 #include <dev/bwn/if_bwnreg.h>
87 #include <dev/bwn/if_bwnvar.h>
88 
89 #include <dev/bwn/if_bwn_debug.h>
90 #include <dev/bwn/if_bwn_misc.h>
91 #include <dev/bwn/if_bwn_util.h>
92 #include <dev/bwn/if_bwn_phy_common.h>
93 #include <dev/bwn/if_bwn_phy_g.h>
94 #include <dev/bwn/if_bwn_phy_lp.h>
95 #include <dev/bwn/if_bwn_phy_n.h>
96 
97 #include "bhnd_nvram_map.h"
98 
99 #include "gpio_if.h"
100 
101 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
102     "Broadcom driver parameters");
103 
104 /*
105  * Tunable & sysctl variables.
106  */
107 
108 #ifdef BWN_DEBUG
109 static	int bwn_debug = 0;
110 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
111     "Broadcom debugging printfs");
112 #endif
113 
114 static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
115 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
116     "uses Bad Frames Preemption");
117 static int	bwn_bluetooth = 1;
118 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
119     "turns on Bluetooth Coexistence");
120 static int	bwn_hwpctl = 0;
121 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
122     "uses H/W power control");
123 static int	bwn_usedma = 1;
124 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
125     "uses DMA");
126 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
127 static int	bwn_wme = 1;
128 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
129     "uses WME support");
130 
131 static void	bwn_attach_pre(struct bwn_softc *);
132 static int	bwn_attach_post(struct bwn_softc *);
133 static int	bwn_retain_bus_providers(struct bwn_softc *sc);
134 static void	bwn_release_bus_providers(struct bwn_softc *sc);
135 static void	bwn_sprom_bugfixes(device_t);
136 static int	bwn_init(struct bwn_softc *);
137 static void	bwn_parent(struct ieee80211com *);
138 static void	bwn_start(struct bwn_softc *);
139 static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
140 static int	bwn_attach_core(struct bwn_mac *);
141 static int	bwn_phy_getinfo(struct bwn_mac *, int);
142 static int	bwn_chiptest(struct bwn_mac *);
143 static int	bwn_setup_channels(struct bwn_mac *, int, int);
144 static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
145 		    uint16_t);
146 static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
147 		    const struct bwn_channelinfo *, const uint8_t []);
148 static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
149 		    const struct ieee80211_bpf_params *);
150 static void	bwn_updateslot(struct ieee80211com *);
151 static void	bwn_update_promisc(struct ieee80211com *);
152 static void	bwn_wme_init(struct bwn_mac *);
153 static int	bwn_wme_update(struct ieee80211com *);
154 static void	bwn_wme_clear(struct bwn_softc *);
155 static void	bwn_wme_load(struct bwn_mac *);
156 static void	bwn_wme_loadparams(struct bwn_mac *,
157 		    const struct wmeParams *, uint16_t);
158 static void	bwn_scan_start(struct ieee80211com *);
159 static void	bwn_scan_end(struct ieee80211com *);
160 static void	bwn_set_channel(struct ieee80211com *);
161 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
162 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
163 		    const uint8_t [IEEE80211_ADDR_LEN],
164 		    const uint8_t [IEEE80211_ADDR_LEN]);
165 static void	bwn_vap_delete(struct ieee80211vap *);
166 static void	bwn_stop(struct bwn_softc *);
167 static int	bwn_core_forceclk(struct bwn_mac *, bool);
168 static int	bwn_core_init(struct bwn_mac *);
169 static void	bwn_core_start(struct bwn_mac *);
170 static void	bwn_core_exit(struct bwn_mac *);
171 static void	bwn_bt_disable(struct bwn_mac *);
172 static int	bwn_chip_init(struct bwn_mac *);
173 static void	bwn_set_txretry(struct bwn_mac *, int, int);
174 static void	bwn_rate_init(struct bwn_mac *);
175 static void	bwn_set_phytxctl(struct bwn_mac *);
176 static void	bwn_spu_setdelay(struct bwn_mac *, int);
177 static void	bwn_bt_enable(struct bwn_mac *);
178 static void	bwn_set_macaddr(struct bwn_mac *);
179 static void	bwn_crypt_init(struct bwn_mac *);
180 static void	bwn_chip_exit(struct bwn_mac *);
181 static int	bwn_fw_fillinfo(struct bwn_mac *);
182 static int	bwn_fw_loaducode(struct bwn_mac *);
183 static int	bwn_gpio_init(struct bwn_mac *);
184 static int	bwn_fw_loadinitvals(struct bwn_mac *);
185 static int	bwn_phy_init(struct bwn_mac *);
186 static void	bwn_set_txantenna(struct bwn_mac *, int);
187 static void	bwn_set_opmode(struct bwn_mac *);
188 static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
189 static uint8_t	bwn_plcp_getcck(const uint8_t);
190 static uint8_t	bwn_plcp_getofdm(const uint8_t);
191 static void	bwn_pio_init(struct bwn_mac *);
192 static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
193 static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
194 		    int);
195 static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
196 		    struct bwn_pio_rxqueue *, int);
197 static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
198 static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
199 		    uint16_t);
200 static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
201 static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
202 static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
203 static void	bwn_pio_handle_txeof(struct bwn_mac *,
204 		    const struct bwn_txstatus *);
205 static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
206 static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
207 static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
208 		    uint16_t);
209 static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
210 		    uint32_t);
211 static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
212 		    struct mbuf **);
213 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
214 static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
215 		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
216 static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
217 		    uint16_t, uint32_t);
218 static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
219 		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
220 static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
221 		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
222 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
223 		    uint16_t, struct bwn_pio_txpkt **);
224 static void	bwn_dma_init(struct bwn_mac *);
225 static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
226 static uint16_t	bwn_dma_base(int, int);
227 static void	bwn_dma_ringfree(struct bwn_dma_ring **);
228 static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
229 		    int, struct bwn_dmadesc_generic **,
230 		    struct bwn_dmadesc_meta **);
231 static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
232 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233 		    int, int);
234 static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
235 static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
236 static void	bwn_dma_32_resume(struct bwn_dma_ring *);
237 static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
238 static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
239 static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
240 		    int, struct bwn_dmadesc_generic **,
241 		    struct bwn_dmadesc_meta **);
242 static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
243 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
244 		    int, int);
245 static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
246 static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
247 static void	bwn_dma_64_resume(struct bwn_dma_ring *);
248 static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
249 static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
250 static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
251 static void	bwn_dma_setup(struct bwn_dma_ring *);
252 static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
253 static void	bwn_dma_cleanup(struct bwn_dma_ring *);
254 static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
255 static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
256 static void	bwn_dma_rx(struct bwn_dma_ring *);
257 static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
258 static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
259 		    struct bwn_dmadesc_meta *);
260 static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
261 static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
262 static int	bwn_dma_freeslot(struct bwn_dma_ring *);
263 static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
264 static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
265 static int	bwn_dma_newbuf(struct bwn_dma_ring *,
266 		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
267 		    int);
268 static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
269 		    bus_size_t, int);
270 static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
271 static void	bwn_ratectl_tx_complete(const struct ieee80211_node *,
272 		    const struct bwn_txstatus *);
273 static void	bwn_dma_handle_txeof(struct bwn_mac *,
274 		    const struct bwn_txstatus *);
275 static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
276 		    struct mbuf **);
277 static int	bwn_dma_getslot(struct bwn_dma_ring *);
278 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
279 		    uint8_t);
280 static int	bwn_dma_attach(struct bwn_mac *);
281 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
282 		    int, int);
283 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
284 		    const struct bwn_txstatus *, uint16_t, int *);
285 static void	bwn_dma_free(struct bwn_mac *);
286 static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
287 static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
288 		    const char *, struct bwn_fwfile *);
289 static void	bwn_release_firmware(struct bwn_mac *);
290 static void	bwn_do_release_fw(struct bwn_fwfile *);
291 static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
292 static int	bwn_fwinitvals_write(struct bwn_mac *,
293 		    const struct bwn_fwinitvals *, size_t, size_t);
294 static uint16_t	bwn_ant2phy(int);
295 static void	bwn_mac_write_bssid(struct bwn_mac *);
296 static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
297 		    const uint8_t *);
298 static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
299 		    const uint8_t *, size_t, const uint8_t *);
300 static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
301 		    const uint8_t *);
302 static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
303 		    const uint8_t *);
304 static void	bwn_phy_exit(struct bwn_mac *);
305 static void	bwn_core_stop(struct bwn_mac *);
306 static int	bwn_switch_band(struct bwn_softc *,
307 		    struct ieee80211_channel *);
308 static int	bwn_phy_reset(struct bwn_mac *);
309 static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
310 static void	bwn_set_pretbtt(struct bwn_mac *);
311 static int	bwn_intr(void *);
312 static void	bwn_intrtask(void *, int);
313 static void	bwn_restart(struct bwn_mac *, const char *);
314 static void	bwn_intr_ucode_debug(struct bwn_mac *);
315 static void	bwn_intr_tbtt_indication(struct bwn_mac *);
316 static void	bwn_intr_atim_end(struct bwn_mac *);
317 static void	bwn_intr_beacon(struct bwn_mac *);
318 static void	bwn_intr_pmq(struct bwn_mac *);
319 static void	bwn_intr_noise(struct bwn_mac *);
320 static void	bwn_intr_txeof(struct bwn_mac *);
321 static void	bwn_hwreset(void *, int);
322 static void	bwn_handle_fwpanic(struct bwn_mac *);
323 static void	bwn_load_beacon0(struct bwn_mac *);
324 static void	bwn_load_beacon1(struct bwn_mac *);
325 static uint32_t	bwn_jssi_read(struct bwn_mac *);
326 static void	bwn_noise_gensample(struct bwn_mac *);
327 static void	bwn_handle_txeof(struct bwn_mac *,
328 		    const struct bwn_txstatus *);
329 static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
330 static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
331 static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
332 		    struct mbuf *);
333 static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
334 static int	bwn_set_txhdr(struct bwn_mac *,
335 		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
336 		    uint16_t);
337 static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
338 		    const uint8_t);
339 static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
340 static uint8_t	bwn_get_fbrate(uint8_t);
341 static void	bwn_txpwr(void *, int);
342 static void	bwn_tasks(void *);
343 static void	bwn_task_15s(struct bwn_mac *);
344 static void	bwn_task_30s(struct bwn_mac *);
345 static void	bwn_task_60s(struct bwn_mac *);
346 static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
347 		    uint8_t);
348 static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
349 static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
350 		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
351 		    int, int);
352 static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
353 static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
354 static void	bwn_watchdog(void *);
355 static void	bwn_dma_stop(struct bwn_mac *);
356 static void	bwn_pio_stop(struct bwn_mac *);
357 static void	bwn_dma_ringstop(struct bwn_dma_ring **);
358 static int	bwn_led_attach(struct bwn_mac *);
359 static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
360 static void	bwn_led_event(struct bwn_mac *, int);
361 static void	bwn_led_blink_start(struct bwn_mac *, int, int);
362 static void	bwn_led_blink_next(void *);
363 static void	bwn_led_blink_end(void *);
364 static void	bwn_rfswitch(void *);
365 static void	bwn_rf_turnon(struct bwn_mac *);
366 static void	bwn_rf_turnoff(struct bwn_mac *);
367 static void	bwn_sysctl_node(struct bwn_softc *);
368 
369 static const struct bwn_channelinfo bwn_chantable_bg = {
370 	.channels = {
371 		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
372 		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
373 		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
374 		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
375 		{ 2472, 13, 30 }, { 2484, 14, 30 } },
376 	.nchannels = 14
377 };
378 
379 static const struct bwn_channelinfo bwn_chantable_a = {
380 	.channels = {
381 		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
382 		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
383 		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
384 		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
385 		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
386 		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
387 		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
388 		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
389 		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
390 		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
391 		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
392 		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
393 		{ 6080, 216, 30 } },
394 	.nchannels = 37
395 };
396 
397 #if 0
398 static const struct bwn_channelinfo bwn_chantable_n = {
399 	.channels = {
400 		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
401 		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
402 		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
403 		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
404 		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
405 		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
406 		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
407 		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
408 		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
409 		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
410 		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
411 		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
412 		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
413 		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
414 		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
415 		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
416 		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
417 		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
418 		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
419 		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
420 		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
421 		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
422 		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
423 		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
424 		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
425 		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
426 		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
427 		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
428 		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
429 		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
430 		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
431 		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
432 		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
433 		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
434 		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
435 		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
436 		{ 6130, 226, 30 }, { 6140, 228, 30 } },
437 	.nchannels = 110
438 };
439 #endif
440 
441 #define	VENDOR_LED_ACT(vendor)				\
442 {							\
443 	.vid = PCI_VENDOR_##vendor,			\
444 	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
445 }
446 
447 static const struct {
448 	uint16_t	vid;
449 	uint8_t		led_act[BWN_LED_MAX];
450 } bwn_vendor_led_act[] = {
451 	VENDOR_LED_ACT(HP_COMPAQ),
452 	VENDOR_LED_ACT(ASUSTEK)
453 };
454 
455 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
456 	{ BWN_VENDOR_LED_ACT_DEFAULT };
457 
458 #undef VENDOR_LED_ACT
459 
460 static const char *bwn_led_vars[] = {
461 	BHND_NVAR_LEDBH0,
462 	BHND_NVAR_LEDBH1,
463 	BHND_NVAR_LEDBH2,
464 	BHND_NVAR_LEDBH3
465 };
466 
467 static const struct {
468 	int		on_dur;
469 	int		off_dur;
470 } bwn_led_duration[109] = {
471 	[0]	= { 400, 100 },
472 	[2]	= { 150, 75 },
473 	[4]	= { 90, 45 },
474 	[11]	= { 66, 34 },
475 	[12]	= { 53, 26 },
476 	[18]	= { 42, 21 },
477 	[22]	= { 35, 17 },
478 	[24]	= { 32, 16 },
479 	[36]	= { 21, 10 },
480 	[48]	= { 16, 8 },
481 	[72]	= { 11, 5 },
482 	[96]	= { 9, 4 },
483 	[108]	= { 7, 3 }
484 };
485 
486 static const uint16_t bwn_wme_shm_offsets[] = {
487 	[0] = BWN_WME_BESTEFFORT,
488 	[1] = BWN_WME_BACKGROUND,
489 	[2] = BWN_WME_VOICE,
490 	[3] = BWN_WME_VIDEO,
491 };
492 
493 /* Supported D11 core revisions */
494 #define	BWN_DEV(_hwrev)	{{					\
495 	BHND_MATCH_CORE(BHND_MFGID_BCM, BHND_COREID_D11),	\
496 	BHND_MATCH_CORE_REV(_hwrev),				\
497 }}
498 static const struct bhnd_device bwn_devices[] = {
499 	BWN_DEV(HWREV_RANGE(5, 16)),
500 	BWN_DEV(HWREV_EQ(23)),
501 	BHND_DEVICE_END
502 };
503 
504 /* D11 quirks when bridged via a PCI host bridge core */
505 static const struct bhnd_device_quirk pci_bridge_quirks[] = {
506 	BHND_CORE_QUIRK	(HWREV_LTE(10),	BWN_QUIRK_UCODE_SLOWCLOCK_WAR),
507 	BHND_DEVICE_QUIRK_END
508 };
509 
510 /* D11 quirks when bridged via a PCMCIA host bridge core */
511 static const struct bhnd_device_quirk pcmcia_bridge_quirks[] = {
512 	BHND_CORE_QUIRK	(HWREV_ANY,	BWN_QUIRK_NODMA),
513 	BHND_DEVICE_QUIRK_END
514 };
515 
516 /* Host bridge cores for which D11 quirk flags should be applied */
517 static const struct bhnd_device bridge_devices[] = {
518 	BHND_DEVICE(BCM, PCI,		NULL, pci_bridge_quirks),
519 	BHND_DEVICE(BCM, PCMCIA,	NULL, pcmcia_bridge_quirks),
520 	BHND_DEVICE_END
521 };
522 
523 static int
524 bwn_probe(device_t dev)
525 {
526 	const struct bhnd_device *id;
527 
528 	id = bhnd_device_lookup(dev, bwn_devices, sizeof(bwn_devices[0]));
529 	if (id == NULL)
530 		return (ENXIO);
531 
532 	bhnd_set_default_core_desc(dev);
533 	return (BUS_PROBE_DEFAULT);
534 }
535 
536 static int
537 bwn_attach(device_t dev)
538 {
539 	struct bwn_mac		*mac;
540 	struct bwn_softc	*sc;
541 	device_t		 parent, hostb;
542 	char			 chip_name[BHND_CHIPID_MAX_NAMELEN];
543 	int			 error;
544 
545 	sc = device_get_softc(dev);
546 	sc->sc_dev = dev;
547 #ifdef BWN_DEBUG
548 	sc->sc_debug = bwn_debug;
549 #endif
550 
551 	mac = NULL;
552 
553 	/* Determine the driver quirks applicable to this device, including any
554 	 * quirks specific to the bus host bridge core (if any) */
555 	sc->sc_quirks = bhnd_device_quirks(dev, bwn_devices,
556 	    sizeof(bwn_devices[0]));
557 
558 	parent = device_get_parent(dev);
559 	if ((hostb = bhnd_bus_find_hostb_device(parent)) != NULL) {
560 		sc->sc_quirks |= bhnd_device_quirks(hostb, bridge_devices,
561 		    sizeof(bridge_devices[0]));
562 	}
563 
564 	/* DMA explicitly disabled? */
565 	if (!bwn_usedma)
566 		sc->sc_quirks |= BWN_QUIRK_NODMA;
567 
568 	/* Fetch our chip identification and board info */
569 	sc->sc_cid = *bhnd_get_chipid(dev);
570 	if ((error = bhnd_read_board_info(dev, &sc->sc_board_info))) {
571 		device_printf(sc->sc_dev, "couldn't read board info\n");
572 		return (error);
573 	}
574 
575 	/* Allocate our D11 register block and PMU state */
576 	sc->sc_mem_rid = 0;
577 	sc->sc_mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
578 	    &sc->sc_mem_rid, RF_ACTIVE);
579 	if (sc->sc_mem_res == NULL) {
580 		device_printf(sc->sc_dev, "couldn't allocate registers\n");
581 		return (error);
582 	}
583 
584 	if ((error = bhnd_alloc_pmu(sc->sc_dev))) {
585 		bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
586 		    sc->sc_mem_rid, sc->sc_mem_res);
587 		return (error);
588 	}
589 
590 	/* Retain references to all required bus service providers */
591 	if ((error = bwn_retain_bus_providers(sc)))
592 		goto fail;
593 
594 	/* Fetch mask of available antennas */
595 	error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA2G,
596 	    &sc->sc_ant2g);
597 	if (error) {
598 		device_printf(sc->sc_dev, "error determining 2GHz antenna "
599 		    "availability from NVRAM: %d\n", error);
600 		goto fail;
601 	}
602 
603 	error = bhnd_nvram_getvar_uint8(sc->sc_dev, BHND_NVAR_AA5G,
604 	    &sc->sc_ant5g);
605 	if (error) {
606 		device_printf(sc->sc_dev, "error determining 5GHz antenna "
607 		    "availability from NVRAM: %d\n", error);
608 		goto fail;
609 	}
610 
611 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
612 		bwn_attach_pre(sc);
613 		bwn_sprom_bugfixes(dev);
614 		sc->sc_flags |= BWN_FLAG_ATTACHED;
615 	}
616 
617 	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
618 	mac->mac_sc = sc;
619 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
620 	if (bwn_bfp != 0)
621 		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
622 
623 	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
624 	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
625 	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
626 
627 	error = bwn_attach_core(mac);
628 	if (error)
629 		goto fail;
630 	error = bwn_led_attach(mac);
631 	if (error)
632 		goto fail;
633 
634 	bhnd_format_chip_id(chip_name, sizeof(chip_name), sc->sc_cid.chip_id);
635 	device_printf(sc->sc_dev, "WLAN (%s rev %u) "
636 	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
637 	    chip_name, bhnd_get_hwrev(sc->sc_dev), mac->mac_phy.analog,
638 	    mac->mac_phy.type, mac->mac_phy.rev, mac->mac_phy.rf_manuf,
639 	    mac->mac_phy.rf_ver, mac->mac_phy.rf_rev);
640 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
641 		device_printf(sc->sc_dev, "DMA (%d bits)\n", mac->mac_dmatype);
642 	else
643 		device_printf(sc->sc_dev, "PIO\n");
644 
645 #ifdef	BWN_GPL_PHY
646 	device_printf(sc->sc_dev,
647 	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
648 #endif
649 
650 	mac->mac_rid_irq = 0;
651 	mac->mac_res_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ,
652 	    &mac->mac_rid_irq, RF_ACTIVE | RF_SHAREABLE);
653 
654 	if (mac->mac_res_irq == NULL) {
655 		device_printf(sc->sc_dev, "couldn't allocate IRQ resource\n");
656 		error = ENXIO;
657 		goto fail;
658 	}
659 
660 	error = bus_setup_intr(dev, mac->mac_res_irq,
661 	    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
662 	    &mac->mac_intrhand);
663 	if (error != 0) {
664 		device_printf(sc->sc_dev, "couldn't setup interrupt (%d)\n",
665 		    error);
666 		goto fail;
667 	}
668 
669 	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
670 
671 	/*
672 	 * calls attach-post routine
673 	 */
674 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
675 		bwn_attach_post(sc);
676 
677 	return (0);
678 fail:
679 	if (mac != NULL && mac->mac_res_irq != NULL) {
680 		bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
681 		    mac->mac_res_irq);
682 	}
683 
684 	free(mac, M_DEVBUF);
685 	bhnd_release_pmu(dev);
686 	bwn_release_bus_providers(sc);
687 
688 	if (sc->sc_mem_res != NULL) {
689 		bus_release_resource(sc->sc_dev, SYS_RES_MEMORY,
690 		    sc->sc_mem_rid, sc->sc_mem_res);
691 	}
692 
693 	return (error);
694 }
695 
696 static int
697 bwn_retain_bus_providers(struct bwn_softc *sc)
698 {
699 	struct chipc_caps *ccaps;
700 
701 	sc->sc_chipc = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_CHIPC);
702 	if (sc->sc_chipc == NULL) {
703 		device_printf(sc->sc_dev, "ChipCommon device not found\n");
704 		goto failed;
705 	}
706 
707 	ccaps = BHND_CHIPC_GET_CAPS(sc->sc_chipc);
708 
709 	sc->sc_gpio = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_GPIO);
710 	if (sc->sc_gpio == NULL) {
711 		device_printf(sc->sc_dev, "GPIO device not found\n");
712 		goto failed;
713 	}
714 
715 	if (ccaps->pmu) {
716 		sc->sc_pmu = bhnd_retain_provider(sc->sc_dev, BHND_SERVICE_PMU);
717 		if (sc->sc_pmu == NULL) {
718 			device_printf(sc->sc_dev, "PMU device not found\n");
719 			goto failed;
720 		}
721 	}
722 
723 	return (0);
724 
725 failed:
726 	bwn_release_bus_providers(sc);
727 	return (ENXIO);
728 }
729 
730 static void
731 bwn_release_bus_providers(struct bwn_softc *sc)
732 {
733 #define	BWN_RELEASE_PROV(_sc, _prov, _service)	do {			\
734 	if ((_sc)-> _prov != NULL) {					\
735 		bhnd_release_provider((_sc)->sc_dev, (_sc)-> _prov,	\
736 		    (_service));					\
737 		(_sc)-> _prov = NULL;					\
738 	}								\
739 } while (0)
740 
741 	BWN_RELEASE_PROV(sc, sc_chipc, BHND_SERVICE_CHIPC);
742 	BWN_RELEASE_PROV(sc, sc_gpio, BHND_SERVICE_GPIO);
743 	BWN_RELEASE_PROV(sc, sc_pmu, BHND_SERVICE_PMU);
744 
745 #undef	BWN_RELEASE_PROV
746 }
747 
748 static int
749 bwn_attach_post(struct bwn_softc *sc)
750 {
751 	struct ieee80211com	*ic;
752 	const char		*mac_varname;
753 	u_int			 core_unit;
754 	int			 error;
755 
756 	ic = &sc->sc_ic;
757 
758 	ic->ic_softc = sc;
759 	ic->ic_name = device_get_nameunit(sc->sc_dev);
760 	/* XXX not right but it's not used anywhere important */
761 	ic->ic_phytype = IEEE80211_T_OFDM;
762 	ic->ic_opmode = IEEE80211_M_STA;
763 	ic->ic_caps =
764 		  IEEE80211_C_STA		/* station mode supported */
765 		| IEEE80211_C_MONITOR		/* monitor mode */
766 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
767 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
768 		| IEEE80211_C_SHSLOT		/* short slot time supported */
769 		| IEEE80211_C_WME		/* WME/WMM supported */
770 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
771 #if 0
772 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
773 #endif
774 		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
775 		;
776 
777 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
778 
779 	/* Determine the NVRAM variable containing our MAC address */
780 	core_unit = bhnd_get_core_unit(sc->sc_dev);
781 	mac_varname = NULL;
782 	if (sc->sc_board_info.board_srom_rev <= 2) {
783 		if (core_unit == 0) {
784 			mac_varname = BHND_NVAR_IL0MACADDR;
785 		} else if (core_unit == 1) {
786 			mac_varname = BHND_NVAR_ET1MACADDR;
787 		}
788 	} else {
789 		if (core_unit == 0) {
790 			mac_varname = BHND_NVAR_MACADDR;
791 		}
792 	}
793 
794 	if (mac_varname == NULL) {
795 		device_printf(sc->sc_dev, "missing MAC address variable for "
796 		    "D11 core %u", core_unit);
797 		return (ENXIO);
798 	}
799 
800 	/* Read the MAC address from NVRAM */
801 	error = bhnd_nvram_getvar_array(sc->sc_dev, mac_varname, ic->ic_macaddr,
802 	    sizeof(ic->ic_macaddr), BHND_NVRAM_TYPE_UINT8_ARRAY);
803 	if (error) {
804 		device_printf(sc->sc_dev, "error reading %s: %d\n", mac_varname,
805 		    error);
806 		return (error);
807 	}
808 
809 	/* call MI attach routine. */
810 	ieee80211_ifattach(ic);
811 
812 	ic->ic_headroom = sizeof(struct bwn_txhdr);
813 
814 	/* override default methods */
815 	ic->ic_raw_xmit = bwn_raw_xmit;
816 	ic->ic_updateslot = bwn_updateslot;
817 	ic->ic_update_promisc = bwn_update_promisc;
818 	ic->ic_wme.wme_update = bwn_wme_update;
819 	ic->ic_scan_start = bwn_scan_start;
820 	ic->ic_scan_end = bwn_scan_end;
821 	ic->ic_set_channel = bwn_set_channel;
822 	ic->ic_vap_create = bwn_vap_create;
823 	ic->ic_vap_delete = bwn_vap_delete;
824 	ic->ic_transmit = bwn_transmit;
825 	ic->ic_parent = bwn_parent;
826 
827 	ieee80211_radiotap_attach(ic,
828 	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
829 	    BWN_TX_RADIOTAP_PRESENT,
830 	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
831 	    BWN_RX_RADIOTAP_PRESENT);
832 
833 	bwn_sysctl_node(sc);
834 
835 	if (bootverbose)
836 		ieee80211_announce(ic);
837 	return (0);
838 }
839 
840 static void
841 bwn_phy_detach(struct bwn_mac *mac)
842 {
843 
844 	if (mac->mac_phy.detach != NULL)
845 		mac->mac_phy.detach(mac);
846 }
847 
848 static int
849 bwn_detach(device_t dev)
850 {
851 	struct bwn_softc *sc = device_get_softc(dev);
852 	struct bwn_mac *mac = sc->sc_curmac;
853 	struct ieee80211com *ic = &sc->sc_ic;
854 
855 	sc->sc_flags |= BWN_FLAG_INVALID;
856 
857 	if (device_is_attached(sc->sc_dev)) {
858 		BWN_LOCK(sc);
859 		bwn_stop(sc);
860 		BWN_UNLOCK(sc);
861 		bwn_dma_free(mac);
862 		callout_drain(&sc->sc_led_blink_ch);
863 		callout_drain(&sc->sc_rfswitch_ch);
864 		callout_drain(&sc->sc_task_ch);
865 		callout_drain(&sc->sc_watchdog_ch);
866 		bwn_phy_detach(mac);
867 		ieee80211_draintask(ic, &mac->mac_hwreset);
868 		ieee80211_draintask(ic, &mac->mac_txpower);
869 		ieee80211_ifdetach(ic);
870 	}
871 	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
872 	taskqueue_free(sc->sc_tq);
873 
874 	if (mac->mac_intrhand != NULL) {
875 		bus_teardown_intr(dev, mac->mac_res_irq, mac->mac_intrhand);
876 		mac->mac_intrhand = NULL;
877 	}
878 
879 	bhnd_release_pmu(dev);
880 	bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_mem_rid,
881 	    sc->sc_mem_res);
882 	bus_release_resource(dev, SYS_RES_IRQ, mac->mac_rid_irq,
883 	    mac->mac_res_irq);
884 	mbufq_drain(&sc->sc_snd);
885 	bwn_release_firmware(mac);
886 	BWN_LOCK_DESTROY(sc);
887 
888 	bwn_release_bus_providers(sc);
889 
890 	return (0);
891 }
892 
893 static void
894 bwn_attach_pre(struct bwn_softc *sc)
895 {
896 
897 	BWN_LOCK_INIT(sc);
898 	TAILQ_INIT(&sc->sc_maclist);
899 	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
900 	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
901 	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
902 	mbufq_init(&sc->sc_snd, ifqmaxlen);
903 	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
904 		taskqueue_thread_enqueue, &sc->sc_tq);
905 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
906 		"%s taskq", device_get_nameunit(sc->sc_dev));
907 }
908 
909 static void
910 bwn_sprom_bugfixes(device_t dev)
911 {
912 	struct bwn_softc *sc = device_get_softc(dev);
913 
914 #define	BWN_ISDEV(_device, _subvendor, _subdevice)		\
915 	((sc->sc_board_info.board_devid == PCI_DEVID_##_device) &&	\
916 	 (sc->sc_board_info.board_vendor == PCI_VENDOR_##_subvendor) &&	\
917 	 (sc->sc_board_info.board_type == _subdevice))
918 
919 	 /* A subset of Apple Airport Extreme (BCM4306 rev 2) devices
920 	  * were programmed with a missing PACTRL boardflag */
921 	 if (sc->sc_board_info.board_vendor == PCI_VENDOR_APPLE &&
922 	     sc->sc_board_info.board_type == 0x4e &&
923 	     sc->sc_board_info.board_rev > 0x40)
924 		 sc->sc_board_info.board_flags |= BHND_BFL_PACTRL;
925 
926 	if (BWN_ISDEV(BCM4318_D11G, ASUSTEK, 0x100f) ||
927 	    BWN_ISDEV(BCM4306_D11G, DELL, 0x0003) ||
928 	    BWN_ISDEV(BCM4306_D11G, HP, 0x12f8) ||
929 	    BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0013) ||
930 	    BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0014) ||
931 	    BWN_ISDEV(BCM4306_D11G, LINKSYS, 0x0015) ||
932 	    BWN_ISDEV(BCM4306_D11G, MOTOROLA, 0x7010))
933 		sc->sc_board_info.board_flags &= ~BHND_BFL_BTCOEX;
934 #undef	BWN_ISDEV
935 }
936 
937 static void
938 bwn_parent(struct ieee80211com *ic)
939 {
940 	struct bwn_softc *sc = ic->ic_softc;
941 	int startall = 0;
942 
943 	BWN_LOCK(sc);
944 	if (ic->ic_nrunning > 0) {
945 		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
946 			bwn_init(sc);
947 			startall = 1;
948 		} else
949 			bwn_update_promisc(ic);
950 	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
951 		bwn_stop(sc);
952 	BWN_UNLOCK(sc);
953 
954 	if (startall)
955 		ieee80211_start_all(ic);
956 }
957 
958 static int
959 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
960 {
961 	struct bwn_softc *sc = ic->ic_softc;
962 	int error;
963 
964 	BWN_LOCK(sc);
965 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
966 		BWN_UNLOCK(sc);
967 		return (ENXIO);
968 	}
969 	error = mbufq_enqueue(&sc->sc_snd, m);
970 	if (error) {
971 		BWN_UNLOCK(sc);
972 		return (error);
973 	}
974 	bwn_start(sc);
975 	BWN_UNLOCK(sc);
976 	return (0);
977 }
978 
979 static void
980 bwn_start(struct bwn_softc *sc)
981 {
982 	struct bwn_mac *mac = sc->sc_curmac;
983 	struct ieee80211_frame *wh;
984 	struct ieee80211_node *ni;
985 	struct ieee80211_key *k;
986 	struct mbuf *m;
987 
988 	BWN_ASSERT_LOCKED(sc);
989 
990 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
991 	    mac->mac_status < BWN_MAC_STATUS_STARTED)
992 		return;
993 
994 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
995 		if (bwn_tx_isfull(sc, m))
996 			break;
997 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
998 		if (ni == NULL) {
999 			device_printf(sc->sc_dev, "unexpected NULL ni\n");
1000 			m_freem(m);
1001 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1002 			continue;
1003 		}
1004 		wh = mtod(m, struct ieee80211_frame *);
1005 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1006 			k = ieee80211_crypto_encap(ni, m);
1007 			if (k == NULL) {
1008 				if_inc_counter(ni->ni_vap->iv_ifp,
1009 				    IFCOUNTER_OERRORS, 1);
1010 				ieee80211_free_node(ni);
1011 				m_freem(m);
1012 				continue;
1013 			}
1014 		}
1015 		wh = NULL;	/* Catch any invalid use */
1016 		if (bwn_tx_start(sc, ni, m) != 0) {
1017 			if (ni != NULL) {
1018 				if_inc_counter(ni->ni_vap->iv_ifp,
1019 				    IFCOUNTER_OERRORS, 1);
1020 				ieee80211_free_node(ni);
1021 			}
1022 			continue;
1023 		}
1024 		sc->sc_watchdog_timer = 5;
1025 	}
1026 }
1027 
1028 static int
1029 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
1030 {
1031 	struct bwn_dma_ring *dr;
1032 	struct bwn_mac *mac = sc->sc_curmac;
1033 	struct bwn_pio_txqueue *tq;
1034 	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1035 
1036 	BWN_ASSERT_LOCKED(sc);
1037 
1038 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
1039 		dr = bwn_dma_select(mac, M_WME_GETAC(m));
1040 		if (dr->dr_stop == 1 ||
1041 		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
1042 			dr->dr_stop = 1;
1043 			goto full;
1044 		}
1045 	} else {
1046 		tq = bwn_pio_select(mac, M_WME_GETAC(m));
1047 		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
1048 		    pktlen > (tq->tq_size - tq->tq_used))
1049 			goto full;
1050 	}
1051 	return (0);
1052 full:
1053 	mbufq_prepend(&sc->sc_snd, m);
1054 	return (1);
1055 }
1056 
1057 static int
1058 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
1059 {
1060 	struct bwn_mac *mac = sc->sc_curmac;
1061 	int error;
1062 
1063 	BWN_ASSERT_LOCKED(sc);
1064 
1065 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
1066 		m_freem(m);
1067 		return (ENXIO);
1068 	}
1069 
1070 	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
1071 	    bwn_dma_tx_start(mac, ni, &m) : bwn_pio_tx_start(mac, ni, &m);
1072 	if (error) {
1073 		m_freem(m);
1074 		return (error);
1075 	}
1076 	return (0);
1077 }
1078 
1079 static int
1080 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1081     struct mbuf **mp)
1082 {
1083 	struct bwn_pio_txpkt *tp;
1084 	struct bwn_pio_txqueue *tq;
1085 	struct bwn_softc *sc = mac->mac_sc;
1086 	struct bwn_txhdr txhdr;
1087 	struct mbuf *m, *m_new;
1088 	uint32_t ctl32;
1089 	int error;
1090 	uint16_t ctl16;
1091 
1092 	BWN_ASSERT_LOCKED(sc);
1093 
1094 	/* XXX TODO send packets after DTIM */
1095 
1096 	m = *mp;
1097 	tq = bwn_pio_select(mac, M_WME_GETAC(m));
1098 	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
1099 	tp = TAILQ_FIRST(&tq->tq_pktlist);
1100 	tp->tp_ni = ni;
1101 	tp->tp_m = m;
1102 
1103 	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
1104 	if (error) {
1105 		device_printf(sc->sc_dev, "tx fail\n");
1106 		return (error);
1107 	}
1108 
1109 	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
1110 	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
1111 	tq->tq_free--;
1112 
1113 	if (bhnd_get_hwrev(sc->sc_dev) >= 8) {
1114 		/*
1115 		 * XXX please removes m_defrag(9)
1116 		 */
1117 		m_new = m_defrag(*mp, M_NOWAIT);
1118 		if (m_new == NULL) {
1119 			device_printf(sc->sc_dev,
1120 			    "%s: can't defrag TX buffer\n",
1121 			    __func__);
1122 			return (ENOBUFS);
1123 		}
1124 		*mp = m_new;
1125 		if (m_new->m_next != NULL)
1126 			device_printf(sc->sc_dev,
1127 			    "TODO: fragmented packets for PIO\n");
1128 		tp->tp_m = m_new;
1129 
1130 		/* send HEADER */
1131 		ctl32 = bwn_pio_write_multi_4(mac, tq,
1132 		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
1133 			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
1134 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1135 		/* send BODY */
1136 		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1137 		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1138 		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1139 		    ctl32 | BWN_PIO8_TXCTL_EOF);
1140 	} else {
1141 		ctl16 = bwn_pio_write_multi_2(mac, tq,
1142 		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1143 			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1144 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1145 		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1146 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1147 		    ctl16 | BWN_PIO_TXCTL_EOF);
1148 	}
1149 
1150 	return (0);
1151 }
1152 
1153 static struct bwn_pio_txqueue *
1154 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1155 {
1156 
1157 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1158 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1159 
1160 	switch (prio) {
1161 	case 0:
1162 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1163 	case 1:
1164 		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1165 	case 2:
1166 		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1167 	case 3:
1168 		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1169 	}
1170 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1171 	return (NULL);
1172 }
1173 
1174 static int
1175 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
1176     struct mbuf **mp)
1177 {
1178 #define	BWN_GET_TXHDRCACHE(slot)					\
1179 	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1180 	struct bwn_dma *dma = &mac->mac_method.dma;
1181 	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(*mp));
1182 	struct bwn_dmadesc_generic *desc;
1183 	struct bwn_dmadesc_meta *mt;
1184 	struct bwn_softc *sc = mac->mac_sc;
1185 	struct mbuf *m;
1186 	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1187 	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1188 
1189 	BWN_ASSERT_LOCKED(sc);
1190 	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1191 
1192 	/* XXX send after DTIM */
1193 
1194 	m = *mp;
1195 	slot = bwn_dma_getslot(dr);
1196 	dr->getdesc(dr, slot, &desc, &mt);
1197 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1198 	    ("%s:%d: fail", __func__, __LINE__));
1199 
1200 	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1201 	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1202 	    BWN_DMA_COOKIE(dr, slot));
1203 	if (error)
1204 		goto fail;
1205 	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1206 	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1207 	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1208 	if (error) {
1209 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1210 		    __func__, error);
1211 		goto fail;
1212 	}
1213 	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1214 	    BUS_DMASYNC_PREWRITE);
1215 	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1216 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1217 	    BUS_DMASYNC_PREWRITE);
1218 
1219 	slot = bwn_dma_getslot(dr);
1220 	dr->getdesc(dr, slot, &desc, &mt);
1221 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1222 	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1223 	mt->mt_m = m;
1224 	mt->mt_ni = ni;
1225 
1226 	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1227 	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1228 	if (error && error != EFBIG) {
1229 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1230 		    __func__, error);
1231 		goto fail;
1232 	}
1233 	if (error) {    /* error == EFBIG */
1234 		struct mbuf *m_new;
1235 
1236 		m_new = m_defrag(m, M_NOWAIT);
1237 		if (m_new == NULL) {
1238 			device_printf(sc->sc_dev,
1239 			    "%s: can't defrag TX buffer\n",
1240 			    __func__);
1241 			error = ENOBUFS;
1242 			goto fail;
1243 		}
1244 		*mp = m = m_new;
1245 
1246 		mt->mt_m = m;
1247 		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1248 		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1249 		if (error) {
1250 			device_printf(sc->sc_dev,
1251 			    "%s: can't load TX buffer (2) %d\n",
1252 			    __func__, error);
1253 			goto fail;
1254 		}
1255 	}
1256 	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1257 	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1258 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1259 	    BUS_DMASYNC_PREWRITE);
1260 
1261 	/* XXX send after DTIM */
1262 
1263 	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1264 	return (0);
1265 fail:
1266 	dr->dr_curslot = backup[0];
1267 	dr->dr_usedslot = backup[1];
1268 	return (error);
1269 #undef BWN_GET_TXHDRCACHE
1270 }
1271 
1272 static void
1273 bwn_watchdog(void *arg)
1274 {
1275 	struct bwn_softc *sc = arg;
1276 
1277 	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1278 		device_printf(sc->sc_dev, "device timeout\n");
1279 		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1280 	}
1281 	callout_schedule(&sc->sc_watchdog_ch, hz);
1282 }
1283 
1284 static int
1285 bwn_attach_core(struct bwn_mac *mac)
1286 {
1287 	struct bwn_softc *sc = mac->mac_sc;
1288 	int error, have_bg = 0, have_a = 0;
1289 	uint16_t iost;
1290 
1291 	KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5,
1292 	    ("unsupported revision %d", bhnd_get_hwrev(sc->sc_dev)));
1293 
1294 	if ((error = bwn_core_forceclk(mac, true)))
1295 		return (error);
1296 
1297 	if ((error = bhnd_read_iost(sc->sc_dev, &iost))) {
1298 		device_printf(sc->sc_dev, "error reading I/O status flags: "
1299 		    "%d\n", error);
1300 		return (error);
1301 	}
1302 
1303 	have_a = (iost & BWN_IOST_HAVE_5GHZ) ? 1 : 0;
1304 	have_bg = (iost & BWN_IOST_HAVE_2GHZ) ? 1 : 0;
1305 	if (iost & BWN_IOST_DUALPHY) {
1306 		have_bg = 1;
1307 		have_a = 1;
1308 	}
1309 
1310 
1311 #if 0
1312 	device_printf(sc->sc_dev, "%s: iost=0x%04hx, have_a=%d, have_bg=%d,"
1313 	    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1314 	    __func__,
1315 	    iost,
1316 	    have_a,
1317 	    have_bg,
1318 	    sc->sc_board_info.board_devid,
1319 	    sc->sc_cid.chip_id);
1320 #endif
1321 
1322 	/*
1323 	 * Guess at whether it has A-PHY or G-PHY.
1324 	 * This is just used for resetting the core to probe things;
1325 	 * we will re-guess once it's all up and working.
1326 	 */
1327 	error = bwn_reset_core(mac, have_bg);
1328 	if (error)
1329 		goto fail;
1330 
1331 	/*
1332 	 * Determine the DMA engine type
1333 	 */
1334 	if (iost & BHND_IOST_DMA64) {
1335 		mac->mac_dmatype = BHND_DMA_ADDR_64BIT;
1336 	} else {
1337 		uint32_t tmp;
1338 		uint16_t base;
1339 
1340 		base = bwn_dma_base(0, 0);
1341 		BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL,
1342 		    BWN_DMA32_TXADDREXT_MASK);
1343 		tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
1344 		if (tmp & BWN_DMA32_TXADDREXT_MASK) {
1345 			mac->mac_dmatype = BHND_DMA_ADDR_32BIT;
1346 		} else {
1347 			mac->mac_dmatype = BHND_DMA_ADDR_30BIT;
1348 		}
1349 	}
1350 
1351 	/*
1352 	 * Get the PHY version.
1353 	 */
1354 	error = bwn_phy_getinfo(mac, have_bg);
1355 	if (error)
1356 		goto fail;
1357 
1358 	/*
1359 	 * This is the whitelist of devices which we "believe"
1360 	 * the SPROM PHY config from.  The rest are "guessed".
1361 	 */
1362 	if (sc->sc_board_info.board_devid != PCI_DEVID_BCM4311_D11DUAL &&
1363 	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4328_D11G &&
1364 	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4318_D11DUAL &&
1365 	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4306_D11DUAL &&
1366 	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4321_D11N &&
1367 	    sc->sc_board_info.board_devid != PCI_DEVID_BCM4322_D11N) {
1368 		have_a = have_bg = 0;
1369 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1370 			have_a = 1;
1371 		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1372 		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1373 		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1374 			have_bg = 1;
1375 		else
1376 			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1377 			    mac->mac_phy.type));
1378 	}
1379 
1380 	/*
1381 	 * XXX The PHY-G support doesn't do 5GHz operation.
1382 	 */
1383 	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1384 	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1385 		device_printf(sc->sc_dev,
1386 		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1387 		    __func__);
1388 		have_a = 0;
1389 		have_bg = 1;
1390 	}
1391 
1392 	mac->mac_phy.phy_n = NULL;
1393 
1394 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1395 		mac->mac_phy.attach = bwn_phy_g_attach;
1396 		mac->mac_phy.detach = bwn_phy_g_detach;
1397 		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1398 		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1399 		mac->mac_phy.init = bwn_phy_g_init;
1400 		mac->mac_phy.exit = bwn_phy_g_exit;
1401 		mac->mac_phy.phy_read = bwn_phy_g_read;
1402 		mac->mac_phy.phy_write = bwn_phy_g_write;
1403 		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1404 		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1405 		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1406 		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1407 		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1408 		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1409 		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1410 		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1411 		mac->mac_phy.set_im = bwn_phy_g_im;
1412 		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1413 		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1414 		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1415 		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1416 	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1417 		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1418 		mac->mac_phy.init = bwn_phy_lp_init;
1419 		mac->mac_phy.phy_read = bwn_phy_lp_read;
1420 		mac->mac_phy.phy_write = bwn_phy_lp_write;
1421 		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1422 		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1423 		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1424 		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1425 		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1426 		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1427 		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1428 		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1429 		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1430 	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1431 		mac->mac_phy.attach = bwn_phy_n_attach;
1432 		mac->mac_phy.detach = bwn_phy_n_detach;
1433 		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1434 		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1435 		mac->mac_phy.init = bwn_phy_n_init;
1436 		mac->mac_phy.exit = bwn_phy_n_exit;
1437 		mac->mac_phy.phy_read = bwn_phy_n_read;
1438 		mac->mac_phy.phy_write = bwn_phy_n_write;
1439 		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1440 		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1441 		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1442 		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1443 		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1444 		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1445 		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1446 		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1447 		mac->mac_phy.set_im = bwn_phy_n_im;
1448 		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1449 		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1450 		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1451 		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1452 	} else {
1453 		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1454 		    mac->mac_phy.type);
1455 		error = ENXIO;
1456 		goto fail;
1457 	}
1458 
1459 	mac->mac_phy.gmode = have_bg;
1460 	if (mac->mac_phy.attach != NULL) {
1461 		error = mac->mac_phy.attach(mac);
1462 		if (error) {
1463 			device_printf(sc->sc_dev, "failed\n");
1464 			goto fail;
1465 		}
1466 	}
1467 
1468 	error = bwn_reset_core(mac, have_bg);
1469 	if (error)
1470 		goto fail;
1471 
1472 	error = bwn_chiptest(mac);
1473 	if (error)
1474 		goto fail;
1475 	error = bwn_setup_channels(mac, have_bg, have_a);
1476 	if (error) {
1477 		device_printf(sc->sc_dev, "failed to setup channels\n");
1478 		goto fail;
1479 	}
1480 
1481 	if (sc->sc_curmac == NULL)
1482 		sc->sc_curmac = mac;
1483 
1484 	error = bwn_dma_attach(mac);
1485 	if (error != 0) {
1486 		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1487 		goto fail;
1488 	}
1489 
1490 	mac->mac_phy.switch_analog(mac, 0);
1491 
1492 fail:
1493 	bhnd_suspend_hw(sc->sc_dev, 0);
1494 	bwn_release_firmware(mac);
1495 	return (error);
1496 }
1497 
1498 /*
1499  * Reset
1500  */
1501 int
1502 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1503 {
1504 	struct bwn_softc	*sc;
1505 	uint32_t		 ctl;
1506 	uint16_t		 ioctl, ioctl_mask;
1507 	int			 error;
1508 
1509 	sc = mac->mac_sc;
1510 
1511 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1512 
1513 	/* Reset core */
1514 	ioctl = (BWN_IOCTL_PHYCLOCK_ENABLE | BWN_IOCTL_PHYRESET);
1515 	if (g_mode)
1516 		ioctl |= BWN_IOCTL_SUPPORT_G;
1517 
1518 	/* XXX N-PHY only; and hard-code to 20MHz for now */
1519 	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1520 		ioctl |= BWN_IOCTL_PHY_BANDWIDTH_20MHZ;
1521 
1522 	if ((error = bhnd_reset_hw(sc->sc_dev, ioctl, ioctl))) {
1523 		device_printf(sc->sc_dev, "core reset failed: %d", error);
1524 		return (error);
1525 	}
1526 
1527 	DELAY(2000);
1528 
1529 	/* Take PHY out of reset */
1530 	ioctl = BHND_IOCTL_CLK_FORCE;
1531 	ioctl_mask = BHND_IOCTL_CLK_FORCE |
1532 		     BWN_IOCTL_PHYRESET |
1533 		     BWN_IOCTL_PHYCLOCK_ENABLE;
1534 
1535 	if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1536 		device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1537 		    "%d\n", error);
1538 		return (error);
1539 	}
1540 
1541 	DELAY(2000);
1542 
1543 	ioctl = BWN_IOCTL_PHYCLOCK_ENABLE;
1544 	if ((error = bhnd_write_ioctl(sc->sc_dev, ioctl, ioctl_mask))) {
1545 		device_printf(sc->sc_dev, "failed to set core ioctl flags: "
1546 		    "%d\n", error);
1547 		return (error);
1548 	}
1549 
1550 	DELAY(2000);
1551 
1552 	if (mac->mac_phy.switch_analog != NULL)
1553 		mac->mac_phy.switch_analog(mac, 1);
1554 
1555 	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1556 	if (g_mode)
1557 		ctl |= BWN_MACCTL_GMODE;
1558 	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1559 
1560 	return (0);
1561 }
1562 
1563 static int
1564 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1565 {
1566 	struct bwn_phy *phy = &mac->mac_phy;
1567 	struct bwn_softc *sc = mac->mac_sc;
1568 	uint32_t tmp;
1569 
1570 	/* PHY */
1571 	tmp = BWN_READ_2(mac, BWN_PHYVER);
1572 	phy->gmode = gmode;
1573 	phy->rf_on = 1;
1574 	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1575 	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1576 	phy->rev = (tmp & BWN_PHYVER_VERSION);
1577 	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1578 	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1579 		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1580 	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1581 	    (phy->type == BWN_PHYTYPE_N && phy->rev > 6) ||
1582 	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1583 		goto unsupphy;
1584 
1585 	/* RADIO */
1586 	BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1587 	tmp = BWN_READ_2(mac, BWN_RFDATALO);
1588 	BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1589 	tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1590 
1591 	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1592 	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1593 	phy->rf_manuf = (tmp & 0x00000fff);
1594 
1595 	/*
1596 	 * For now, just always do full init (ie, what bwn has traditionally
1597 	 * done)
1598 	 */
1599 	phy->phy_do_full_init = 1;
1600 
1601 	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1602 		goto unsupradio;
1603 	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1604 	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1605 	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1606 	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1607 	    (phy->type == BWN_PHYTYPE_N &&
1608 	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1609 	    (phy->type == BWN_PHYTYPE_LP &&
1610 	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1611 		goto unsupradio;
1612 
1613 	return (0);
1614 unsupphy:
1615 	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1616 	    "analog %#x)\n",
1617 	    phy->type, phy->rev, phy->analog);
1618 	return (ENXIO);
1619 unsupradio:
1620 	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1621 	    "rev %#x)\n",
1622 	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1623 	return (ENXIO);
1624 }
1625 
1626 static int
1627 bwn_chiptest(struct bwn_mac *mac)
1628 {
1629 #define	TESTVAL0	0x55aaaa55
1630 #define	TESTVAL1	0xaa5555aa
1631 	struct bwn_softc *sc = mac->mac_sc;
1632 	uint32_t v, backup;
1633 
1634 	BWN_LOCK(sc);
1635 
1636 	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1637 
1638 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1639 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1640 		goto error;
1641 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1642 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1643 		goto error;
1644 
1645 	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1646 
1647 	if ((bhnd_get_hwrev(sc->sc_dev) >= 3) &&
1648 	    (bhnd_get_hwrev(sc->sc_dev) <= 10)) {
1649 		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1650 		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1651 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1652 			goto error;
1653 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1654 			goto error;
1655 	}
1656 	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1657 
1658 	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1659 	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1660 		goto error;
1661 
1662 	BWN_UNLOCK(sc);
1663 	return (0);
1664 error:
1665 	BWN_UNLOCK(sc);
1666 	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1667 	return (ENODEV);
1668 }
1669 
1670 static int
1671 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1672 {
1673 	struct bwn_softc *sc = mac->mac_sc;
1674 	struct ieee80211com *ic = &sc->sc_ic;
1675 	uint8_t bands[IEEE80211_MODE_BYTES];
1676 
1677 	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1678 	ic->ic_nchans = 0;
1679 
1680 	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1681 	    __func__,
1682 	    have_bg,
1683 	    have_a);
1684 
1685 	if (have_bg) {
1686 		memset(bands, 0, sizeof(bands));
1687 		setbit(bands, IEEE80211_MODE_11B);
1688 		setbit(bands, IEEE80211_MODE_11G);
1689 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1690 		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1691 	}
1692 
1693 	if (have_a) {
1694 		memset(bands, 0, sizeof(bands));
1695 		setbit(bands, IEEE80211_MODE_11A);
1696 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1697 		    &ic->ic_nchans, &bwn_chantable_a, bands);
1698 	}
1699 
1700 	mac->mac_phy.supports_2ghz = have_bg;
1701 	mac->mac_phy.supports_5ghz = have_a;
1702 
1703 	return (ic->ic_nchans == 0 ? ENXIO : 0);
1704 }
1705 
1706 uint32_t
1707 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1708 {
1709 	uint32_t ret;
1710 
1711 	BWN_ASSERT_LOCKED(mac->mac_sc);
1712 
1713 	if (way == BWN_SHARED) {
1714 		KASSERT((offset & 0x0001) == 0,
1715 		    ("%s:%d warn", __func__, __LINE__));
1716 		if (offset & 0x0003) {
1717 			bwn_shm_ctlword(mac, way, offset >> 2);
1718 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1719 			ret <<= 16;
1720 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1721 			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1722 			goto out;
1723 		}
1724 		offset >>= 2;
1725 	}
1726 	bwn_shm_ctlword(mac, way, offset);
1727 	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1728 out:
1729 	return (ret);
1730 }
1731 
1732 uint16_t
1733 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1734 {
1735 	uint16_t ret;
1736 
1737 	BWN_ASSERT_LOCKED(mac->mac_sc);
1738 
1739 	if (way == BWN_SHARED) {
1740 		KASSERT((offset & 0x0001) == 0,
1741 		    ("%s:%d warn", __func__, __LINE__));
1742 		if (offset & 0x0003) {
1743 			bwn_shm_ctlword(mac, way, offset >> 2);
1744 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1745 			goto out;
1746 		}
1747 		offset >>= 2;
1748 	}
1749 	bwn_shm_ctlword(mac, way, offset);
1750 	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1751 out:
1752 
1753 	return (ret);
1754 }
1755 
1756 static void
1757 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1758     uint16_t offset)
1759 {
1760 	uint32_t control;
1761 
1762 	control = way;
1763 	control <<= 16;
1764 	control |= offset;
1765 	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1766 }
1767 
1768 void
1769 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1770     uint32_t value)
1771 {
1772 	BWN_ASSERT_LOCKED(mac->mac_sc);
1773 
1774 	if (way == BWN_SHARED) {
1775 		KASSERT((offset & 0x0001) == 0,
1776 		    ("%s:%d warn", __func__, __LINE__));
1777 		if (offset & 0x0003) {
1778 			bwn_shm_ctlword(mac, way, offset >> 2);
1779 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1780 				    (value >> 16) & 0xffff);
1781 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1782 			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1783 			return;
1784 		}
1785 		offset >>= 2;
1786 	}
1787 	bwn_shm_ctlword(mac, way, offset);
1788 	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1789 }
1790 
1791 void
1792 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1793     uint16_t value)
1794 {
1795 	BWN_ASSERT_LOCKED(mac->mac_sc);
1796 
1797 	if (way == BWN_SHARED) {
1798 		KASSERT((offset & 0x0001) == 0,
1799 		    ("%s:%d warn", __func__, __LINE__));
1800 		if (offset & 0x0003) {
1801 			bwn_shm_ctlword(mac, way, offset >> 2);
1802 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1803 			return;
1804 		}
1805 		offset >>= 2;
1806 	}
1807 	bwn_shm_ctlword(mac, way, offset);
1808 	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1809 }
1810 
1811 static void
1812 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1813     const struct bwn_channelinfo *ci, const uint8_t bands[])
1814 {
1815 	int i, error;
1816 
1817 	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1818 		const struct bwn_channel *hc = &ci->channels[i];
1819 
1820 		error = ieee80211_add_channel(chans, maxchans, nchans,
1821 		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1822 	}
1823 }
1824 
1825 static int
1826 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1827 	const struct ieee80211_bpf_params *params)
1828 {
1829 	struct ieee80211com *ic = ni->ni_ic;
1830 	struct bwn_softc *sc = ic->ic_softc;
1831 	struct bwn_mac *mac = sc->sc_curmac;
1832 	int error;
1833 
1834 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1835 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1836 		m_freem(m);
1837 		return (ENETDOWN);
1838 	}
1839 
1840 	BWN_LOCK(sc);
1841 	if (bwn_tx_isfull(sc, m)) {
1842 		m_freem(m);
1843 		BWN_UNLOCK(sc);
1844 		return (ENOBUFS);
1845 	}
1846 
1847 	error = bwn_tx_start(sc, ni, m);
1848 	if (error == 0)
1849 		sc->sc_watchdog_timer = 5;
1850 	BWN_UNLOCK(sc);
1851 	return (error);
1852 }
1853 
1854 /*
1855  * Callback from the 802.11 layer to update the slot time
1856  * based on the current setting.  We use it to notify the
1857  * firmware of ERP changes and the f/w takes care of things
1858  * like slot time and preamble.
1859  */
1860 static void
1861 bwn_updateslot(struct ieee80211com *ic)
1862 {
1863 	struct bwn_softc *sc = ic->ic_softc;
1864 	struct bwn_mac *mac;
1865 
1866 	BWN_LOCK(sc);
1867 	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1868 		mac = (struct bwn_mac *)sc->sc_curmac;
1869 		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1870 	}
1871 	BWN_UNLOCK(sc);
1872 }
1873 
1874 /*
1875  * Callback from the 802.11 layer after a promiscuous mode change.
1876  * Note this interface does not check the operating mode as this
1877  * is an internal callback and we are expected to honor the current
1878  * state (e.g. this is used for setting the interface in promiscuous
1879  * mode when operating in hostap mode to do ACS).
1880  */
1881 static void
1882 bwn_update_promisc(struct ieee80211com *ic)
1883 {
1884 	struct bwn_softc *sc = ic->ic_softc;
1885 	struct bwn_mac *mac = sc->sc_curmac;
1886 
1887 	BWN_LOCK(sc);
1888 	mac = sc->sc_curmac;
1889 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1890 		if (ic->ic_promisc > 0)
1891 			sc->sc_filters |= BWN_MACCTL_PROMISC;
1892 		else
1893 			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1894 		bwn_set_opmode(mac);
1895 	}
1896 	BWN_UNLOCK(sc);
1897 }
1898 
1899 /*
1900  * Callback from the 802.11 layer to update WME parameters.
1901  */
1902 static int
1903 bwn_wme_update(struct ieee80211com *ic)
1904 {
1905 	struct bwn_softc *sc = ic->ic_softc;
1906 	struct bwn_mac *mac = sc->sc_curmac;
1907 	struct chanAccParams chp;
1908 	struct wmeParams *wmep;
1909 	int i;
1910 
1911 	ieee80211_wme_ic_getparams(ic, &chp);
1912 
1913 	BWN_LOCK(sc);
1914 	mac = sc->sc_curmac;
1915 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1916 		bwn_mac_suspend(mac);
1917 		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1918 			wmep = &chp.cap_wmeParams[i];
1919 			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1920 		}
1921 		bwn_mac_enable(mac);
1922 	}
1923 	BWN_UNLOCK(sc);
1924 	return (0);
1925 }
1926 
1927 static void
1928 bwn_scan_start(struct ieee80211com *ic)
1929 {
1930 	struct bwn_softc *sc = ic->ic_softc;
1931 	struct bwn_mac *mac;
1932 
1933 	BWN_LOCK(sc);
1934 	mac = sc->sc_curmac;
1935 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1936 		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1937 		bwn_set_opmode(mac);
1938 		/* disable CFP update during scan */
1939 		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1940 	}
1941 	BWN_UNLOCK(sc);
1942 }
1943 
1944 static void
1945 bwn_scan_end(struct ieee80211com *ic)
1946 {
1947 	struct bwn_softc *sc = ic->ic_softc;
1948 	struct bwn_mac *mac;
1949 
1950 	BWN_LOCK(sc);
1951 	mac = sc->sc_curmac;
1952 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1953 		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1954 		bwn_set_opmode(mac);
1955 		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1956 	}
1957 	BWN_UNLOCK(sc);
1958 }
1959 
1960 static void
1961 bwn_set_channel(struct ieee80211com *ic)
1962 {
1963 	struct bwn_softc *sc = ic->ic_softc;
1964 	struct bwn_mac *mac = sc->sc_curmac;
1965 	struct bwn_phy *phy = &mac->mac_phy;
1966 	int chan, error;
1967 
1968 	BWN_LOCK(sc);
1969 
1970 	error = bwn_switch_band(sc, ic->ic_curchan);
1971 	if (error)
1972 		goto fail;
1973 	bwn_mac_suspend(mac);
1974 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1975 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1976 	if (chan != phy->chan)
1977 		bwn_switch_channel(mac, chan);
1978 
1979 	/* TX power level */
1980 	if (ic->ic_curchan->ic_maxpower != 0 &&
1981 	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1982 		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1983 		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1984 		    BWN_TXPWR_IGNORE_TSSI);
1985 	}
1986 
1987 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1988 	if (phy->set_antenna)
1989 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1990 
1991 	if (sc->sc_rf_enabled != phy->rf_on) {
1992 		if (sc->sc_rf_enabled) {
1993 			bwn_rf_turnon(mac);
1994 			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1995 				device_printf(sc->sc_dev,
1996 				    "please turn on the RF switch\n");
1997 		} else
1998 			bwn_rf_turnoff(mac);
1999 	}
2000 
2001 	bwn_mac_enable(mac);
2002 
2003 fail:
2004 	/*
2005 	 * Setup radio tap channel freq and flags
2006 	 */
2007 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
2008 		htole16(ic->ic_curchan->ic_freq);
2009 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
2010 		htole16(ic->ic_curchan->ic_flags & 0xffff);
2011 
2012 	BWN_UNLOCK(sc);
2013 }
2014 
2015 static struct ieee80211vap *
2016 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2017     enum ieee80211_opmode opmode, int flags,
2018     const uint8_t bssid[IEEE80211_ADDR_LEN],
2019     const uint8_t mac[IEEE80211_ADDR_LEN])
2020 {
2021 	struct ieee80211vap *vap;
2022 	struct bwn_vap *bvp;
2023 
2024 	switch (opmode) {
2025 	case IEEE80211_M_HOSTAP:
2026 	case IEEE80211_M_MBSS:
2027 	case IEEE80211_M_STA:
2028 	case IEEE80211_M_WDS:
2029 	case IEEE80211_M_MONITOR:
2030 	case IEEE80211_M_IBSS:
2031 	case IEEE80211_M_AHDEMO:
2032 		break;
2033 	default:
2034 		return (NULL);
2035 	}
2036 
2037 	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
2038 	vap = &bvp->bv_vap;
2039 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
2040 	/* override with driver methods */
2041 	bvp->bv_newstate = vap->iv_newstate;
2042 	vap->iv_newstate = bwn_newstate;
2043 
2044 	/* override max aid so sta's cannot assoc when we're out of sta id's */
2045 	vap->iv_max_aid = BWN_STAID_MAX;
2046 
2047 	ieee80211_ratectl_init(vap);
2048 
2049 	/* complete setup */
2050 	ieee80211_vap_attach(vap, ieee80211_media_change,
2051 	    ieee80211_media_status, mac);
2052 	return (vap);
2053 }
2054 
2055 static void
2056 bwn_vap_delete(struct ieee80211vap *vap)
2057 {
2058 	struct bwn_vap *bvp = BWN_VAP(vap);
2059 
2060 	ieee80211_ratectl_deinit(vap);
2061 	ieee80211_vap_detach(vap);
2062 	free(bvp, M_80211_VAP);
2063 }
2064 
2065 static int
2066 bwn_init(struct bwn_softc *sc)
2067 {
2068 	struct bwn_mac *mac;
2069 	int error;
2070 
2071 	BWN_ASSERT_LOCKED(sc);
2072 
2073 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2074 
2075 	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
2076 	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
2077 	sc->sc_filters = 0;
2078 	bwn_wme_clear(sc);
2079 	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
2080 	sc->sc_rf_enabled = 1;
2081 
2082 	mac = sc->sc_curmac;
2083 	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
2084 		error = bwn_core_init(mac);
2085 		if (error != 0)
2086 			return (error);
2087 	}
2088 	if (mac->mac_status == BWN_MAC_STATUS_INITED)
2089 		bwn_core_start(mac);
2090 
2091 	bwn_set_opmode(mac);
2092 	bwn_set_pretbtt(mac);
2093 	bwn_spu_setdelay(mac, 0);
2094 	bwn_set_macaddr(mac);
2095 
2096 	sc->sc_flags |= BWN_FLAG_RUNNING;
2097 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
2098 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
2099 
2100 	return (0);
2101 }
2102 
2103 static void
2104 bwn_stop(struct bwn_softc *sc)
2105 {
2106 	struct bwn_mac *mac = sc->sc_curmac;
2107 
2108 	BWN_ASSERT_LOCKED(sc);
2109 
2110 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2111 
2112 	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
2113 		/* XXX FIXME opmode not based on VAP */
2114 		bwn_set_opmode(mac);
2115 		bwn_set_macaddr(mac);
2116 	}
2117 
2118 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
2119 		bwn_core_stop(mac);
2120 
2121 	callout_stop(&sc->sc_led_blink_ch);
2122 	sc->sc_led_blinking = 0;
2123 
2124 	bwn_core_exit(mac);
2125 	sc->sc_rf_enabled = 0;
2126 
2127 	sc->sc_flags &= ~BWN_FLAG_RUNNING;
2128 }
2129 
2130 static void
2131 bwn_wme_clear(struct bwn_softc *sc)
2132 {
2133 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
2134 	struct wmeParams *p;
2135 	unsigned int i;
2136 
2137 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
2138 	    ("%s:%d: fail", __func__, __LINE__));
2139 
2140 	for (i = 0; i < N(sc->sc_wmeParams); i++) {
2141 		p = &(sc->sc_wmeParams[i]);
2142 
2143 		switch (bwn_wme_shm_offsets[i]) {
2144 		case BWN_WME_VOICE:
2145 			p->wmep_txopLimit = 0;
2146 			p->wmep_aifsn = 2;
2147 			/* XXX FIXME: log2(cwmin) */
2148 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2149 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2150 			break;
2151 		case BWN_WME_VIDEO:
2152 			p->wmep_txopLimit = 0;
2153 			p->wmep_aifsn = 2;
2154 			/* XXX FIXME: log2(cwmin) */
2155 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2156 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
2157 			break;
2158 		case BWN_WME_BESTEFFORT:
2159 			p->wmep_txopLimit = 0;
2160 			p->wmep_aifsn = 3;
2161 			/* XXX FIXME: log2(cwmin) */
2162 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2163 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2164 			break;
2165 		case BWN_WME_BACKGROUND:
2166 			p->wmep_txopLimit = 0;
2167 			p->wmep_aifsn = 7;
2168 			/* XXX FIXME: log2(cwmin) */
2169 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
2170 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
2171 			break;
2172 		default:
2173 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2174 		}
2175 	}
2176 }
2177 
2178 static int
2179 bwn_core_forceclk(struct bwn_mac *mac, bool force)
2180 {
2181 	struct bwn_softc	*sc;
2182 	bhnd_clock		 clock;
2183 	int			 error;
2184 
2185 	sc = mac->mac_sc;
2186 
2187 	/* On PMU equipped devices, we do not need to force the HT clock */
2188 	if (sc->sc_pmu != NULL)
2189 		return (0);
2190 
2191 	/* Issue a PMU clock request */
2192 	if (force)
2193 		clock = BHND_CLOCK_HT;
2194 	else
2195 		clock = BHND_CLOCK_DYN;
2196 
2197 	if ((error = bhnd_request_clock(sc->sc_dev, clock))) {
2198 		device_printf(sc->sc_dev, "%d clock request failed: %d\n",
2199 		    clock, error);
2200 		return (error);
2201 	}
2202 
2203 	return (0);
2204 }
2205 
2206 static int
2207 bwn_core_init(struct bwn_mac *mac)
2208 {
2209 	struct bwn_softc *sc = mac->mac_sc;
2210 	uint64_t hf;
2211 	int error;
2212 
2213 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2214 	    ("%s:%d: fail", __func__, __LINE__));
2215 
2216 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2217 
2218 	if ((error = bwn_core_forceclk(mac, true)))
2219 		return (error);
2220 
2221 	if (bhnd_is_hw_suspended(sc->sc_dev)) {
2222 		if ((error = bwn_reset_core(mac, mac->mac_phy.gmode)))
2223 			goto fail0;
2224 	}
2225 
2226 	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2227 	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2228 	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2229 	BWN_GETTIME(mac->mac_phy.nexttime);
2230 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2231 	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2232 	mac->mac_stats.link_noise = -95;
2233 	mac->mac_reason_intr = 0;
2234 	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2235 	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2236 #ifdef BWN_DEBUG
2237 	if (sc->sc_debug & BWN_DEBUG_XMIT)
2238 		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2239 #endif
2240 	mac->mac_suspended = 1;
2241 	mac->mac_task_state = 0;
2242 	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2243 
2244 	mac->mac_phy.init_pre(mac);
2245 
2246 	bwn_bt_disable(mac);
2247 	if (mac->mac_phy.prepare_hw) {
2248 		error = mac->mac_phy.prepare_hw(mac);
2249 		if (error)
2250 			goto fail0;
2251 	}
2252 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2253 	error = bwn_chip_init(mac);
2254 	if (error)
2255 		goto fail0;
2256 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2257 	    bhnd_get_hwrev(sc->sc_dev));
2258 	hf = bwn_hf_read(mac);
2259 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2260 		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2261 		if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL)
2262 			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2263 		if (mac->mac_phy.rev == 1)
2264 			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2265 	}
2266 	if (mac->mac_phy.rf_ver == 0x2050) {
2267 		if (mac->mac_phy.rf_rev < 6)
2268 			hf |= BWN_HF_FORCE_VCO_RECALC;
2269 		if (mac->mac_phy.rf_rev == 6)
2270 			hf |= BWN_HF_4318_TSSI;
2271 	}
2272 	if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2273 		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2274 	if (sc->sc_quirks & BWN_QUIRK_UCODE_SLOWCLOCK_WAR)
2275 		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2276 	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2277 	bwn_hf_write(mac, hf);
2278 
2279 	/* Tell the firmware about the MAC capabilities */
2280 	if (bhnd_get_hwrev(sc->sc_dev) >= 13) {
2281 		uint32_t cap;
2282 		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2283 		DPRINTF(sc, BWN_DEBUG_RESET,
2284 		    "%s: hw capabilities: 0x%08x\n",
2285 		    __func__, cap);
2286 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2287 		    cap & 0xffff);
2288 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2289 		    (cap >> 16) & 0xffff);
2290 	}
2291 
2292 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2293 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2294 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2295 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2296 
2297 	bwn_rate_init(mac);
2298 	bwn_set_phytxctl(mac);
2299 
2300 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2301 	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2302 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2303 
2304 	if (sc->sc_quirks & BWN_QUIRK_NODMA)
2305 		bwn_pio_init(mac);
2306 	else
2307 		bwn_dma_init(mac);
2308 	bwn_wme_init(mac);
2309 	bwn_spu_setdelay(mac, 1);
2310 	bwn_bt_enable(mac);
2311 
2312 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2313 	if (sc->sc_board_info.board_flags & BHND_BFL_NOPLLDOWN)
2314 		bwn_core_forceclk(mac, true);
2315 	else
2316 		bwn_core_forceclk(mac, false);
2317 
2318 	bwn_set_macaddr(mac);
2319 	bwn_crypt_init(mac);
2320 
2321 	/* XXX LED initializatin */
2322 
2323 	mac->mac_status = BWN_MAC_STATUS_INITED;
2324 
2325 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2326 	return (error);
2327 
2328 fail0:
2329 	bhnd_suspend_hw(sc->sc_dev, 0);
2330 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2331 	    ("%s:%d: fail", __func__, __LINE__));
2332 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2333 	return (error);
2334 }
2335 
2336 static void
2337 bwn_core_start(struct bwn_mac *mac)
2338 {
2339 	struct bwn_softc *sc = mac->mac_sc;
2340 	uint32_t tmp;
2341 
2342 	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2343 	    ("%s:%d: fail", __func__, __LINE__));
2344 
2345 	if (bhnd_get_hwrev(sc->sc_dev) < 5)
2346 		return;
2347 
2348 	while (1) {
2349 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2350 		if (!(tmp & 0x00000001))
2351 			break;
2352 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2353 	}
2354 
2355 	bwn_mac_enable(mac);
2356 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2357 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2358 
2359 	mac->mac_status = BWN_MAC_STATUS_STARTED;
2360 }
2361 
2362 static void
2363 bwn_core_exit(struct bwn_mac *mac)
2364 {
2365 	struct bwn_softc *sc = mac->mac_sc;
2366 	uint32_t macctl;
2367 
2368 	BWN_ASSERT_LOCKED(mac->mac_sc);
2369 
2370 	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2371 	    ("%s:%d: fail", __func__, __LINE__));
2372 
2373 	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2374 		return;
2375 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2376 
2377 	macctl = BWN_READ_4(mac, BWN_MACCTL);
2378 	macctl &= ~BWN_MACCTL_MCODE_RUN;
2379 	macctl |= BWN_MACCTL_MCODE_JMP0;
2380 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2381 
2382 	bwn_dma_stop(mac);
2383 	bwn_pio_stop(mac);
2384 	bwn_chip_exit(mac);
2385 	mac->mac_phy.switch_analog(mac, 0);
2386 	bhnd_suspend_hw(sc->sc_dev, 0);
2387 }
2388 
2389 static void
2390 bwn_bt_disable(struct bwn_mac *mac)
2391 {
2392 	struct bwn_softc *sc = mac->mac_sc;
2393 
2394 	(void)sc;
2395 	/* XXX do nothing yet */
2396 }
2397 
2398 static int
2399 bwn_chip_init(struct bwn_mac *mac)
2400 {
2401 	struct bwn_softc *sc = mac->mac_sc;
2402 	struct bwn_phy *phy = &mac->mac_phy;
2403 	uint32_t macctl;
2404 	u_int delay;
2405 	int error;
2406 
2407 	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2408 	if (phy->gmode)
2409 		macctl |= BWN_MACCTL_GMODE;
2410 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2411 
2412 	error = bwn_fw_fillinfo(mac);
2413 	if (error)
2414 		return (error);
2415 	error = bwn_fw_loaducode(mac);
2416 	if (error)
2417 		return (error);
2418 
2419 	error = bwn_gpio_init(mac);
2420 	if (error)
2421 		return (error);
2422 
2423 	error = bwn_fw_loadinitvals(mac);
2424 	if (error)
2425 		return (error);
2426 
2427 	phy->switch_analog(mac, 1);
2428 	error = bwn_phy_init(mac);
2429 	if (error)
2430 		return (error);
2431 
2432 	if (phy->set_im)
2433 		phy->set_im(mac, BWN_IMMODE_NONE);
2434 	if (phy->set_antenna)
2435 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2436 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2437 
2438 	if (phy->type == BWN_PHYTYPE_B)
2439 		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2440 	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2441 	if (bhnd_get_hwrev(sc->sc_dev) < 5)
2442 		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2443 
2444 	BWN_WRITE_4(mac, BWN_MACCTL,
2445 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2446 	BWN_WRITE_4(mac, BWN_MACCTL,
2447 	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2448 	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2449 
2450 	bwn_set_opmode(mac);
2451 	if (bhnd_get_hwrev(sc->sc_dev) < 3) {
2452 		BWN_WRITE_2(mac, 0x060e, 0x0000);
2453 		BWN_WRITE_2(mac, 0x0610, 0x8000);
2454 		BWN_WRITE_2(mac, 0x0604, 0x0000);
2455 		BWN_WRITE_2(mac, 0x0606, 0x0200);
2456 	} else {
2457 		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2458 		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2459 	}
2460 	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2461 	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2462 	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2463 	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2464 	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2465 	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2466 	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2467 
2468 	bwn_mac_phy_clock_set(mac, true);
2469 
2470 	/* Provide the HT clock transition latency to the MAC core */
2471 	error = bhnd_get_clock_latency(sc->sc_dev, BHND_CLOCK_HT, &delay);
2472 	if (error) {
2473 		device_printf(sc->sc_dev, "failed to fetch HT clock latency: "
2474 		    "%d\n", error);
2475 		return (error);
2476 	}
2477 
2478 	if (delay > UINT16_MAX) {
2479 		device_printf(sc->sc_dev, "invalid HT clock latency: %u\n",
2480 		    delay);
2481 		return (ENXIO);
2482 	}
2483 
2484 	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, delay);
2485 	return (0);
2486 }
2487 
2488 /* read hostflags */
2489 uint64_t
2490 bwn_hf_read(struct bwn_mac *mac)
2491 {
2492 	uint64_t ret;
2493 
2494 	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2495 	ret <<= 16;
2496 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2497 	ret <<= 16;
2498 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2499 	return (ret);
2500 }
2501 
2502 void
2503 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2504 {
2505 
2506 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2507 	    (value & 0x00000000ffffull));
2508 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2509 	    (value & 0x0000ffff0000ull) >> 16);
2510 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2511 	    (value & 0xffff00000000ULL) >> 32);
2512 }
2513 
2514 static void
2515 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2516 {
2517 
2518 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2519 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2520 }
2521 
2522 static void
2523 bwn_rate_init(struct bwn_mac *mac)
2524 {
2525 
2526 	switch (mac->mac_phy.type) {
2527 	case BWN_PHYTYPE_A:
2528 	case BWN_PHYTYPE_G:
2529 	case BWN_PHYTYPE_LP:
2530 	case BWN_PHYTYPE_N:
2531 		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2532 		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2533 		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2534 		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2535 		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2536 		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2537 		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2538 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2539 			break;
2540 		/* FALLTHROUGH */
2541 	case BWN_PHYTYPE_B:
2542 		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2543 		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2544 		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2545 		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2546 		break;
2547 	default:
2548 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2549 	}
2550 }
2551 
2552 static void
2553 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2554 {
2555 	uint16_t offset;
2556 
2557 	if (ofdm) {
2558 		offset = 0x480;
2559 		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2560 	} else {
2561 		offset = 0x4c0;
2562 		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2563 	}
2564 	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2565 	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2566 }
2567 
2568 static uint8_t
2569 bwn_plcp_getcck(const uint8_t bitrate)
2570 {
2571 
2572 	switch (bitrate) {
2573 	case BWN_CCK_RATE_1MB:
2574 		return (0x0a);
2575 	case BWN_CCK_RATE_2MB:
2576 		return (0x14);
2577 	case BWN_CCK_RATE_5MB:
2578 		return (0x37);
2579 	case BWN_CCK_RATE_11MB:
2580 		return (0x6e);
2581 	}
2582 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2583 	return (0);
2584 }
2585 
2586 static uint8_t
2587 bwn_plcp_getofdm(const uint8_t bitrate)
2588 {
2589 
2590 	switch (bitrate) {
2591 	case BWN_OFDM_RATE_6MB:
2592 		return (0xb);
2593 	case BWN_OFDM_RATE_9MB:
2594 		return (0xf);
2595 	case BWN_OFDM_RATE_12MB:
2596 		return (0xa);
2597 	case BWN_OFDM_RATE_18MB:
2598 		return (0xe);
2599 	case BWN_OFDM_RATE_24MB:
2600 		return (0x9);
2601 	case BWN_OFDM_RATE_36MB:
2602 		return (0xd);
2603 	case BWN_OFDM_RATE_48MB:
2604 		return (0x8);
2605 	case BWN_OFDM_RATE_54MB:
2606 		return (0xc);
2607 	}
2608 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2609 	return (0);
2610 }
2611 
2612 static void
2613 bwn_set_phytxctl(struct bwn_mac *mac)
2614 {
2615 	uint16_t ctl;
2616 
2617 	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2618 	    BWN_TX_PHY_TXPWR);
2619 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2620 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2621 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2622 }
2623 
2624 static void
2625 bwn_pio_init(struct bwn_mac *mac)
2626 {
2627 	struct bwn_pio *pio = &mac->mac_method.pio;
2628 
2629 	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2630 	    & ~BWN_MACCTL_BIGENDIAN);
2631 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2632 
2633 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2634 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2635 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2636 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2637 	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2638 	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2639 }
2640 
2641 static void
2642 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2643     int index)
2644 {
2645 	struct bwn_pio_txpkt *tp;
2646 	struct bwn_softc *sc = mac->mac_sc;
2647 	unsigned int i;
2648 
2649 	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2650 	tq->tq_index = index;
2651 
2652 	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2653 	if (bhnd_get_hwrev(sc->sc_dev) >= 8)
2654 		tq->tq_size = 1920;
2655 	else {
2656 		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2657 		tq->tq_size -= 80;
2658 	}
2659 
2660 	TAILQ_INIT(&tq->tq_pktlist);
2661 	for (i = 0; i < N(tq->tq_pkts); i++) {
2662 		tp = &(tq->tq_pkts[i]);
2663 		tp->tp_index = i;
2664 		tp->tp_queue = tq;
2665 		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2666 	}
2667 }
2668 
2669 static uint16_t
2670 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2671 {
2672 	struct bwn_softc *sc = mac->mac_sc;
2673 	static const uint16_t bases[] = {
2674 		BWN_PIO_BASE0,
2675 		BWN_PIO_BASE1,
2676 		BWN_PIO_BASE2,
2677 		BWN_PIO_BASE3,
2678 		BWN_PIO_BASE4,
2679 		BWN_PIO_BASE5,
2680 		BWN_PIO_BASE6,
2681 		BWN_PIO_BASE7,
2682 	};
2683 	static const uint16_t bases_rev11[] = {
2684 		BWN_PIO11_BASE0,
2685 		BWN_PIO11_BASE1,
2686 		BWN_PIO11_BASE2,
2687 		BWN_PIO11_BASE3,
2688 		BWN_PIO11_BASE4,
2689 		BWN_PIO11_BASE5,
2690 	};
2691 
2692 	if (bhnd_get_hwrev(sc->sc_dev) >= 11) {
2693 		if (index >= N(bases_rev11))
2694 			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2695 		return (bases_rev11[index]);
2696 	}
2697 	if (index >= N(bases))
2698 		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2699 	return (bases[index]);
2700 }
2701 
2702 static void
2703 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2704     int index)
2705 {
2706 	struct bwn_softc *sc = mac->mac_sc;
2707 
2708 	prq->prq_mac = mac;
2709 	prq->prq_rev = bhnd_get_hwrev(sc->sc_dev);
2710 	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2711 	bwn_dma_rxdirectfifo(mac, index, 1);
2712 }
2713 
2714 static void
2715 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2716 {
2717 	if (tq == NULL)
2718 		return;
2719 	bwn_pio_cancel_tx_packets(tq);
2720 }
2721 
2722 static void
2723 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2724 {
2725 
2726 	bwn_destroy_pioqueue_tx(pio);
2727 }
2728 
2729 static uint16_t
2730 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2731     uint16_t offset)
2732 {
2733 
2734 	return (BWN_READ_2(mac, tq->tq_base + offset));
2735 }
2736 
2737 static void
2738 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2739 {
2740 	uint32_t ctl;
2741 	uint16_t base;
2742 
2743 	base = bwn_dma_base(mac->mac_dmatype, idx);
2744 	if (mac->mac_dmatype == BHND_DMA_ADDR_64BIT) {
2745 		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2746 		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2747 		if (enable)
2748 			ctl |= BWN_DMA64_RXDIRECTFIFO;
2749 		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2750 	} else {
2751 		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2752 		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2753 		if (enable)
2754 			ctl |= BWN_DMA32_RXDIRECTFIFO;
2755 		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2756 	}
2757 }
2758 
2759 static void
2760 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2761 {
2762 	struct bwn_pio_txpkt *tp;
2763 	unsigned int i;
2764 
2765 	for (i = 0; i < N(tq->tq_pkts); i++) {
2766 		tp = &(tq->tq_pkts[i]);
2767 		if (tp->tp_m) {
2768 			m_freem(tp->tp_m);
2769 			tp->tp_m = NULL;
2770 		}
2771 	}
2772 }
2773 
2774 static uint16_t
2775 bwn_dma_base(int type, int controller_idx)
2776 {
2777 	static const uint16_t map64[] = {
2778 		BWN_DMA64_BASE0,
2779 		BWN_DMA64_BASE1,
2780 		BWN_DMA64_BASE2,
2781 		BWN_DMA64_BASE3,
2782 		BWN_DMA64_BASE4,
2783 		BWN_DMA64_BASE5,
2784 	};
2785 	static const uint16_t map32[] = {
2786 		BWN_DMA32_BASE0,
2787 		BWN_DMA32_BASE1,
2788 		BWN_DMA32_BASE2,
2789 		BWN_DMA32_BASE3,
2790 		BWN_DMA32_BASE4,
2791 		BWN_DMA32_BASE5,
2792 	};
2793 
2794 	if (type == BHND_DMA_ADDR_64BIT) {
2795 		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2796 		    ("%s:%d: fail", __func__, __LINE__));
2797 		return (map64[controller_idx]);
2798 	}
2799 	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2800 	    ("%s:%d: fail", __func__, __LINE__));
2801 	return (map32[controller_idx]);
2802 }
2803 
2804 static void
2805 bwn_dma_init(struct bwn_mac *mac)
2806 {
2807 	struct bwn_dma *dma = &mac->mac_method.dma;
2808 
2809 	/* setup TX DMA channels. */
2810 	bwn_dma_setup(dma->wme[WME_AC_BK]);
2811 	bwn_dma_setup(dma->wme[WME_AC_BE]);
2812 	bwn_dma_setup(dma->wme[WME_AC_VI]);
2813 	bwn_dma_setup(dma->wme[WME_AC_VO]);
2814 	bwn_dma_setup(dma->mcast);
2815 	/* setup RX DMA channel. */
2816 	bwn_dma_setup(dma->rx);
2817 }
2818 
2819 static struct bwn_dma_ring *
2820 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2821     int for_tx)
2822 {
2823 	struct bwn_dma *dma = &mac->mac_method.dma;
2824 	struct bwn_dma_ring *dr;
2825 	struct bwn_dmadesc_generic *desc;
2826 	struct bwn_dmadesc_meta *mt;
2827 	struct bwn_softc *sc = mac->mac_sc;
2828 	int error, i;
2829 
2830 	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2831 	if (dr == NULL)
2832 		goto out;
2833 	dr->dr_numslots = BWN_RXRING_SLOTS;
2834 	if (for_tx)
2835 		dr->dr_numslots = BWN_TXRING_SLOTS;
2836 
2837 	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2838 	    M_DEVBUF, M_NOWAIT | M_ZERO);
2839 	if (dr->dr_meta == NULL)
2840 		goto fail0;
2841 
2842 	dr->dr_type = mac->mac_dmatype;
2843 	dr->dr_mac = mac;
2844 	dr->dr_base = bwn_dma_base(dr->dr_type, controller_index);
2845 	dr->dr_index = controller_index;
2846 	if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
2847 		dr->getdesc = bwn_dma_64_getdesc;
2848 		dr->setdesc = bwn_dma_64_setdesc;
2849 		dr->start_transfer = bwn_dma_64_start_transfer;
2850 		dr->suspend = bwn_dma_64_suspend;
2851 		dr->resume = bwn_dma_64_resume;
2852 		dr->get_curslot = bwn_dma_64_get_curslot;
2853 		dr->set_curslot = bwn_dma_64_set_curslot;
2854 	} else {
2855 		dr->getdesc = bwn_dma_32_getdesc;
2856 		dr->setdesc = bwn_dma_32_setdesc;
2857 		dr->start_transfer = bwn_dma_32_start_transfer;
2858 		dr->suspend = bwn_dma_32_suspend;
2859 		dr->resume = bwn_dma_32_resume;
2860 		dr->get_curslot = bwn_dma_32_get_curslot;
2861 		dr->set_curslot = bwn_dma_32_set_curslot;
2862 	}
2863 	if (for_tx) {
2864 		dr->dr_tx = 1;
2865 		dr->dr_curslot = -1;
2866 	} else {
2867 		if (dr->dr_index == 0) {
2868 			switch (mac->mac_fw.fw_hdr_format) {
2869 			case BWN_FW_HDR_351:
2870 			case BWN_FW_HDR_410:
2871 				dr->dr_rx_bufsize =
2872 				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2873 				dr->dr_frameoffset =
2874 				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2875 				break;
2876 			case BWN_FW_HDR_598:
2877 				dr->dr_rx_bufsize =
2878 				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2879 				dr->dr_frameoffset =
2880 				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2881 				break;
2882 			}
2883 		} else
2884 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2885 	}
2886 
2887 	error = bwn_dma_allocringmemory(dr);
2888 	if (error)
2889 		goto fail2;
2890 
2891 	if (for_tx) {
2892 		/*
2893 		 * Assumption: BWN_TXRING_SLOTS can be divided by
2894 		 * BWN_TX_SLOTS_PER_FRAME
2895 		 */
2896 		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2897 		    ("%s:%d: fail", __func__, __LINE__));
2898 
2899 		dr->dr_txhdr_cache = contigmalloc(
2900 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2901 		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2902 		    0, BUS_SPACE_MAXADDR, 8, 0);
2903 		if (dr->dr_txhdr_cache == NULL) {
2904 			device_printf(sc->sc_dev,
2905 			    "can't allocate TX header DMA memory\n");
2906 			goto fail1;
2907 		}
2908 
2909 		/*
2910 		 * Create TX ring DMA stuffs
2911 		 */
2912 		error = bus_dma_tag_create(dma->parent_dtag,
2913 				    BWN_ALIGN, 0,
2914 				    BUS_SPACE_MAXADDR,
2915 				    BUS_SPACE_MAXADDR,
2916 				    NULL, NULL,
2917 				    BWN_HDRSIZE(mac),
2918 				    1,
2919 				    BUS_SPACE_MAXSIZE_32BIT,
2920 				    0,
2921 				    NULL, NULL,
2922 				    &dr->dr_txring_dtag);
2923 		if (error) {
2924 			device_printf(sc->sc_dev,
2925 			    "can't create TX ring DMA tag: TODO frees\n");
2926 			goto fail2;
2927 		}
2928 
2929 		for (i = 0; i < dr->dr_numslots; i += 2) {
2930 			dr->getdesc(dr, i, &desc, &mt);
2931 
2932 			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2933 			mt->mt_m = NULL;
2934 			mt->mt_ni = NULL;
2935 			mt->mt_islast = 0;
2936 			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2937 			    &mt->mt_dmap);
2938 			if (error) {
2939 				device_printf(sc->sc_dev,
2940 				     "can't create RX buf DMA map\n");
2941 				goto fail2;
2942 			}
2943 
2944 			dr->getdesc(dr, i + 1, &desc, &mt);
2945 
2946 			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2947 			mt->mt_m = NULL;
2948 			mt->mt_ni = NULL;
2949 			mt->mt_islast = 1;
2950 			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2951 			    &mt->mt_dmap);
2952 			if (error) {
2953 				device_printf(sc->sc_dev,
2954 				     "can't create RX buf DMA map\n");
2955 				goto fail2;
2956 			}
2957 		}
2958 	} else {
2959 		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2960 		    &dr->dr_spare_dmap);
2961 		if (error) {
2962 			device_printf(sc->sc_dev,
2963 			    "can't create RX buf DMA map\n");
2964 			goto out;		/* XXX wrong! */
2965 		}
2966 
2967 		for (i = 0; i < dr->dr_numslots; i++) {
2968 			dr->getdesc(dr, i, &desc, &mt);
2969 
2970 			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2971 			    &mt->mt_dmap);
2972 			if (error) {
2973 				device_printf(sc->sc_dev,
2974 				    "can't create RX buf DMA map\n");
2975 				goto out;	/* XXX wrong! */
2976 			}
2977 			error = bwn_dma_newbuf(dr, desc, mt, 1);
2978 			if (error) {
2979 				device_printf(sc->sc_dev,
2980 				    "failed to allocate RX buf\n");
2981 				goto out;	/* XXX wrong! */
2982 			}
2983 		}
2984 
2985 		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2986 		    BUS_DMASYNC_PREWRITE);
2987 
2988 		dr->dr_usedslot = dr->dr_numslots;
2989 	}
2990 
2991       out:
2992 	return (dr);
2993 
2994 fail2:
2995 	if (dr->dr_txhdr_cache != NULL) {
2996 		contigfree(dr->dr_txhdr_cache,
2997 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2998 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2999 	}
3000 fail1:
3001 	free(dr->dr_meta, M_DEVBUF);
3002 fail0:
3003 	free(dr, M_DEVBUF);
3004 	return (NULL);
3005 }
3006 
3007 static void
3008 bwn_dma_ringfree(struct bwn_dma_ring **dr)
3009 {
3010 
3011 	if (dr == NULL)
3012 		return;
3013 
3014 	bwn_dma_free_descbufs(*dr);
3015 	bwn_dma_free_ringmemory(*dr);
3016 
3017 	if ((*dr)->dr_txhdr_cache != NULL) {
3018 		contigfree((*dr)->dr_txhdr_cache,
3019 		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
3020 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
3021 	}
3022 	free((*dr)->dr_meta, M_DEVBUF);
3023 	free(*dr, M_DEVBUF);
3024 
3025 	*dr = NULL;
3026 }
3027 
3028 static void
3029 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
3030     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3031 {
3032 	struct bwn_dmadesc32 *desc;
3033 
3034 	*meta = &(dr->dr_meta[slot]);
3035 	desc = dr->dr_ring_descbase;
3036 	desc = &(desc[slot]);
3037 
3038 	*gdesc = (struct bwn_dmadesc_generic *)desc;
3039 }
3040 
3041 static void
3042 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
3043     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3044     int start, int end, int irq)
3045 {
3046 	struct bwn_dmadesc32		*descbase;
3047 	struct bwn_dma			*dma;
3048 	struct bhnd_dma_translation	*dt;
3049 	uint32_t			 addr, addrext, ctl;
3050 	int				 slot;
3051 
3052 	descbase = dr->dr_ring_descbase;
3053 	dma = &dr->dr_mac->mac_method.dma;
3054 	dt = &dma->translation;
3055 
3056 	slot = (int)(&(desc->dma.dma32) - descbase);
3057 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
3058 	    ("%s:%d: fail", __func__, __LINE__));
3059 
3060 	addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3061 	addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3062 	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
3063 	if (slot == dr->dr_numslots - 1)
3064 		ctl |= BWN_DMA32_DCTL_DTABLEEND;
3065 	if (start)
3066 		ctl |= BWN_DMA32_DCTL_FRAMESTART;
3067 	if (end)
3068 		ctl |= BWN_DMA32_DCTL_FRAMEEND;
3069 	if (irq)
3070 		ctl |= BWN_DMA32_DCTL_IRQ;
3071 	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
3072 	    & BWN_DMA32_DCTL_ADDREXT_MASK;
3073 
3074 	desc->dma.dma32.control = htole32(ctl);
3075 	desc->dma.dma32.address = htole32(addr);
3076 }
3077 
3078 static void
3079 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
3080 {
3081 
3082 	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
3083 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
3084 }
3085 
3086 static void
3087 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
3088 {
3089 
3090 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3091 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
3092 }
3093 
3094 static void
3095 bwn_dma_32_resume(struct bwn_dma_ring *dr)
3096 {
3097 
3098 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
3099 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
3100 }
3101 
3102 static int
3103 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
3104 {
3105 	uint32_t val;
3106 
3107 	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
3108 	val &= BWN_DMA32_RXDPTR;
3109 
3110 	return (val / sizeof(struct bwn_dmadesc32));
3111 }
3112 
3113 static void
3114 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
3115 {
3116 
3117 	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
3118 	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
3119 }
3120 
3121 static void
3122 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
3123     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
3124 {
3125 	struct bwn_dmadesc64 *desc;
3126 
3127 	*meta = &(dr->dr_meta[slot]);
3128 	desc = dr->dr_ring_descbase;
3129 	desc = &(desc[slot]);
3130 
3131 	*gdesc = (struct bwn_dmadesc_generic *)desc;
3132 }
3133 
3134 static void
3135 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
3136     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
3137     int start, int end, int irq)
3138 {
3139 	struct bwn_dmadesc64		*descbase;
3140 	struct bwn_dma			*dma;
3141 	struct bhnd_dma_translation	*dt;
3142 	bhnd_addr_t			 addr;
3143 	uint32_t			 addrhi, addrlo;
3144 	uint32_t			 addrext;
3145 	uint32_t			 ctl0, ctl1;
3146 	int				 slot;
3147 
3148 
3149 	descbase = dr->dr_ring_descbase;
3150 	dma = &dr->dr_mac->mac_method.dma;
3151 	dt = &dma->translation;
3152 
3153 	slot = (int)(&(desc->dma.dma64) - descbase);
3154 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
3155 	    ("%s:%d: fail", __func__, __LINE__));
3156 
3157 	addr = (dmaaddr & dt->addr_mask) | dt->base_addr;
3158 	addrhi = (addr >> 32);
3159 	addrlo = (addr & UINT32_MAX);
3160 	addrext = ((dmaaddr & dt->addrext_mask) >> dma->addrext_shift);
3161 
3162 	ctl0 = 0;
3163 	if (slot == dr->dr_numslots - 1)
3164 		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
3165 	if (start)
3166 		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
3167 	if (end)
3168 		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
3169 	if (irq)
3170 		ctl0 |= BWN_DMA64_DCTL0_IRQ;
3171 
3172 	ctl1 = 0;
3173 	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
3174 	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
3175 	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
3176 
3177 	desc->dma.dma64.control0 = htole32(ctl0);
3178 	desc->dma.dma64.control1 = htole32(ctl1);
3179 	desc->dma.dma64.address_low = htole32(addrlo);
3180 	desc->dma.dma64.address_high = htole32(addrhi);
3181 }
3182 
3183 static void
3184 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
3185 {
3186 
3187 	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
3188 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3189 }
3190 
3191 static void
3192 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
3193 {
3194 
3195 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3196 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3197 }
3198 
3199 static void
3200 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3201 {
3202 
3203 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3204 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3205 }
3206 
3207 static int
3208 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3209 {
3210 	uint32_t val;
3211 
3212 	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3213 	val &= BWN_DMA64_RXSTATDPTR;
3214 
3215 	return (val / sizeof(struct bwn_dmadesc64));
3216 }
3217 
3218 static void
3219 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3220 {
3221 
3222 	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3223 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3224 }
3225 
3226 static int
3227 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3228 {
3229 	struct bwn_mac *mac = dr->dr_mac;
3230 	struct bwn_dma *dma = &mac->mac_method.dma;
3231 	struct bwn_softc *sc = mac->mac_sc;
3232 	int error;
3233 
3234 	error = bus_dma_tag_create(dma->parent_dtag,
3235 			    BWN_ALIGN, 0,
3236 			    BUS_SPACE_MAXADDR,
3237 			    BUS_SPACE_MAXADDR,
3238 			    NULL, NULL,
3239 			    BWN_DMA_RINGMEMSIZE,
3240 			    1,
3241 			    BUS_SPACE_MAXSIZE_32BIT,
3242 			    0,
3243 			    NULL, NULL,
3244 			    &dr->dr_ring_dtag);
3245 	if (error) {
3246 		device_printf(sc->sc_dev,
3247 		    "can't create TX ring DMA tag: TODO frees\n");
3248 		return (-1);
3249 	}
3250 
3251 	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3252 	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3253 	    &dr->dr_ring_dmap);
3254 	if (error) {
3255 		device_printf(sc->sc_dev,
3256 		    "can't allocate DMA mem: TODO frees\n");
3257 		return (-1);
3258 	}
3259 	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3260 	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3261 	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3262 	if (error) {
3263 		device_printf(sc->sc_dev,
3264 		    "can't load DMA mem: TODO free\n");
3265 		return (-1);
3266 	}
3267 
3268 	return (0);
3269 }
3270 
3271 static void
3272 bwn_dma_setup(struct bwn_dma_ring *dr)
3273 {
3274 	struct bwn_mac			*mac;
3275 	struct bwn_dma			*dma;
3276 	struct bhnd_dma_translation	*dt;
3277 	bhnd_addr_t			 addr, paddr;
3278 	uint32_t			 addrhi, addrlo, addrext, value;
3279 
3280 	mac = dr->dr_mac;
3281 	dma = &mac->mac_method.dma;
3282 	dt = &dma->translation;
3283 
3284 	paddr = dr->dr_ring_dmabase;
3285 	addr = (paddr & dt->addr_mask) | dt->base_addr;
3286 	addrhi = (addr >> 32);
3287 	addrlo = (addr & UINT32_MAX);
3288 	addrext = ((paddr & dt->addrext_mask) >> dma->addrext_shift);
3289 
3290 	if (dr->dr_tx) {
3291 		dr->dr_curslot = -1;
3292 
3293 		if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3294 			value = BWN_DMA64_TXENABLE;
3295 			value |= BWN_DMA64_TXPARITY_DISABLE;
3296 			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3297 			    & BWN_DMA64_TXADDREXT_MASK;
3298 			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3299 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, addrlo);
3300 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, addrhi);
3301 		} else {
3302 			value = BWN_DMA32_TXENABLE;
3303 			value |= BWN_DMA32_TXPARITY_DISABLE;
3304 			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3305 			    & BWN_DMA32_TXADDREXT_MASK;
3306 			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3307 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, addrlo);
3308 		}
3309 		return;
3310 	}
3311 
3312 	/*
3313 	 * set for RX
3314 	 */
3315 	dr->dr_usedslot = dr->dr_numslots;
3316 
3317 	if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3318 		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3319 		value |= BWN_DMA64_RXENABLE;
3320 		value |= BWN_DMA64_RXPARITY_DISABLE;
3321 		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3322 		    & BWN_DMA64_RXADDREXT_MASK;
3323 		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3324 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, addrlo);
3325 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, addrhi);
3326 		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3327 		    sizeof(struct bwn_dmadesc64));
3328 	} else {
3329 		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3330 		value |= BWN_DMA32_RXENABLE;
3331 		value |= BWN_DMA32_RXPARITY_DISABLE;
3332 		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3333 		    & BWN_DMA32_RXADDREXT_MASK;
3334 		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3335 		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, addrlo);
3336 		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3337 		    sizeof(struct bwn_dmadesc32));
3338 	}
3339 }
3340 
3341 static void
3342 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3343 {
3344 
3345 	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3346 	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3347 	    dr->dr_ring_dmap);
3348 }
3349 
3350 static void
3351 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3352 {
3353 
3354 	if (dr->dr_tx) {
3355 		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3356 		if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3357 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3358 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3359 		} else
3360 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3361 	} else {
3362 		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3363 		if (dr->dr_type == BHND_DMA_ADDR_64BIT) {
3364 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3365 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3366 		} else
3367 			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3368 	}
3369 }
3370 
3371 static void
3372 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3373 {
3374 	struct bwn_dmadesc_generic *desc;
3375 	struct bwn_dmadesc_meta *meta;
3376 	struct bwn_mac *mac = dr->dr_mac;
3377 	struct bwn_dma *dma = &mac->mac_method.dma;
3378 	struct bwn_softc *sc = mac->mac_sc;
3379 	int i;
3380 
3381 	if (!dr->dr_usedslot)
3382 		return;
3383 	for (i = 0; i < dr->dr_numslots; i++) {
3384 		dr->getdesc(dr, i, &desc, &meta);
3385 
3386 		if (meta->mt_m == NULL) {
3387 			if (!dr->dr_tx)
3388 				device_printf(sc->sc_dev, "%s: not TX?\n",
3389 				    __func__);
3390 			continue;
3391 		}
3392 		if (dr->dr_tx) {
3393 			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3394 				bus_dmamap_unload(dr->dr_txring_dtag,
3395 				    meta->mt_dmap);
3396 			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3397 				bus_dmamap_unload(dma->txbuf_dtag,
3398 				    meta->mt_dmap);
3399 		} else
3400 			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3401 		bwn_dma_free_descbuf(dr, meta);
3402 	}
3403 }
3404 
3405 static int
3406 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3407     int type)
3408 {
3409 	struct bwn_softc *sc = mac->mac_sc;
3410 	uint32_t value;
3411 	int i;
3412 	uint16_t offset;
3413 
3414 	for (i = 0; i < 10; i++) {
3415 		offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3416 		    BWN_DMA32_TXSTATUS;
3417 		value = BWN_READ_4(mac, base + offset);
3418 		if (type == BHND_DMA_ADDR_64BIT) {
3419 			value &= BWN_DMA64_TXSTAT;
3420 			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3421 			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3422 			    value == BWN_DMA64_TXSTAT_STOPPED)
3423 				break;
3424 		} else {
3425 			value &= BWN_DMA32_TXSTATE;
3426 			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3427 			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3428 			    value == BWN_DMA32_TXSTAT_STOPPED)
3429 				break;
3430 		}
3431 		DELAY(1000);
3432 	}
3433 	offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXCTL :
3434 	    BWN_DMA32_TXCTL;
3435 	BWN_WRITE_4(mac, base + offset, 0);
3436 	for (i = 0; i < 10; i++) {
3437 		offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_TXSTATUS :
3438 		    BWN_DMA32_TXSTATUS;
3439 		value = BWN_READ_4(mac, base + offset);
3440 		if (type == BHND_DMA_ADDR_64BIT) {
3441 			value &= BWN_DMA64_TXSTAT;
3442 			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3443 				i = -1;
3444 				break;
3445 			}
3446 		} else {
3447 			value &= BWN_DMA32_TXSTATE;
3448 			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3449 				i = -1;
3450 				break;
3451 			}
3452 		}
3453 		DELAY(1000);
3454 	}
3455 	if (i != -1) {
3456 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3457 		return (ENODEV);
3458 	}
3459 	DELAY(1000);
3460 
3461 	return (0);
3462 }
3463 
3464 static int
3465 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3466     int type)
3467 {
3468 	struct bwn_softc *sc = mac->mac_sc;
3469 	uint32_t value;
3470 	int i;
3471 	uint16_t offset;
3472 
3473 	offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXCTL :
3474 	    BWN_DMA32_RXCTL;
3475 	BWN_WRITE_4(mac, base + offset, 0);
3476 	for (i = 0; i < 10; i++) {
3477 		offset = (type == BHND_DMA_ADDR_64BIT) ? BWN_DMA64_RXSTATUS :
3478 		    BWN_DMA32_RXSTATUS;
3479 		value = BWN_READ_4(mac, base + offset);
3480 		if (type == BHND_DMA_ADDR_64BIT) {
3481 			value &= BWN_DMA64_RXSTAT;
3482 			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3483 				i = -1;
3484 				break;
3485 			}
3486 		} else {
3487 			value &= BWN_DMA32_RXSTATE;
3488 			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3489 				i = -1;
3490 				break;
3491 			}
3492 		}
3493 		DELAY(1000);
3494 	}
3495 	if (i != -1) {
3496 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3497 		return (ENODEV);
3498 	}
3499 
3500 	return (0);
3501 }
3502 
3503 static void
3504 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3505     struct bwn_dmadesc_meta *meta)
3506 {
3507 
3508 	if (meta->mt_m != NULL) {
3509 		m_freem(meta->mt_m);
3510 		meta->mt_m = NULL;
3511 	}
3512 	if (meta->mt_ni != NULL) {
3513 		ieee80211_free_node(meta->mt_ni);
3514 		meta->mt_ni = NULL;
3515 	}
3516 }
3517 
3518 static void
3519 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3520 {
3521 	struct bwn_rxhdr4 *rxhdr;
3522 	unsigned char *frame;
3523 
3524 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3525 	rxhdr->frame_len = 0;
3526 
3527 	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3528 	    sizeof(struct bwn_plcp6) + 2,
3529 	    ("%s:%d: fail", __func__, __LINE__));
3530 	frame = mtod(m, char *) + dr->dr_frameoffset;
3531 	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3532 }
3533 
3534 static uint8_t
3535 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3536 {
3537 	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3538 
3539 	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3540 	    == 0xff);
3541 }
3542 
3543 static void
3544 bwn_wme_init(struct bwn_mac *mac)
3545 {
3546 
3547 	bwn_wme_load(mac);
3548 
3549 	/* enable WME support. */
3550 	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3551 	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3552 	    BWN_IFSCTL_USE_EDCF);
3553 }
3554 
3555 static void
3556 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3557 {
3558 	struct bwn_softc *sc = mac->mac_sc;
3559 	struct ieee80211com *ic = &sc->sc_ic;
3560 	uint16_t delay;	/* microsec */
3561 
3562 	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3563 	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3564 		delay = 500;
3565 	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3566 		delay = max(delay, (uint16_t)2400);
3567 
3568 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3569 }
3570 
3571 static void
3572 bwn_bt_enable(struct bwn_mac *mac)
3573 {
3574 	struct bwn_softc *sc = mac->mac_sc;
3575 	uint64_t hf;
3576 
3577 	if (bwn_bluetooth == 0)
3578 		return;
3579 	if ((sc->sc_board_info.board_flags & BHND_BFL_BTCOEX) == 0)
3580 		return;
3581 	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3582 		return;
3583 
3584 	hf = bwn_hf_read(mac);
3585 	if (sc->sc_board_info.board_flags & BHND_BFL_BTC2WIRE_ALTGPIO)
3586 		hf |= BWN_HF_BT_COEXISTALT;
3587 	else
3588 		hf |= BWN_HF_BT_COEXIST;
3589 	bwn_hf_write(mac, hf);
3590 }
3591 
3592 static void
3593 bwn_set_macaddr(struct bwn_mac *mac)
3594 {
3595 
3596 	bwn_mac_write_bssid(mac);
3597 	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3598 	    mac->mac_sc->sc_ic.ic_macaddr);
3599 }
3600 
3601 static void
3602 bwn_clear_keys(struct bwn_mac *mac)
3603 {
3604 	int i;
3605 
3606 	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3607 		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3608 		    ("%s:%d: fail", __func__, __LINE__));
3609 
3610 		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3611 		    NULL, BWN_SEC_KEYSIZE, NULL);
3612 		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3613 			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3614 			    NULL, BWN_SEC_KEYSIZE, NULL);
3615 		}
3616 		mac->mac_key[i].keyconf = NULL;
3617 	}
3618 }
3619 
3620 static void
3621 bwn_crypt_init(struct bwn_mac *mac)
3622 {
3623 	struct bwn_softc *sc = mac->mac_sc;
3624 
3625 	mac->mac_max_nr_keys = (bhnd_get_hwrev(sc->sc_dev) >= 5) ? 58 : 20;
3626 	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3627 	    ("%s:%d: fail", __func__, __LINE__));
3628 	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3629 	mac->mac_ktp *= 2;
3630 	if (bhnd_get_hwrev(sc->sc_dev) >= 5)
3631 		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3632 	bwn_clear_keys(mac);
3633 }
3634 
3635 static void
3636 bwn_chip_exit(struct bwn_mac *mac)
3637 {
3638 	bwn_phy_exit(mac);
3639 }
3640 
3641 static int
3642 bwn_fw_fillinfo(struct bwn_mac *mac)
3643 {
3644 	int error;
3645 
3646 	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3647 	if (error == 0)
3648 		return (0);
3649 	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3650 	if (error == 0)
3651 		return (0);
3652 	return (error);
3653 }
3654 
3655 /**
3656  * Request that the GPIO controller tristate all pins set in @p mask, granting
3657  * the MAC core control over the pins.
3658  *
3659  * @param mac	bwn MAC state.
3660  * @param pins	If the bit position for a pin number is set to one, tristate the
3661  *		pin.
3662  */
3663 int
3664 bwn_gpio_control(struct bwn_mac *mac, uint32_t pins)
3665 {
3666 	struct bwn_softc	*sc;
3667 	uint32_t		 flags[32];
3668 	int			 error;
3669 
3670 	sc = mac->mac_sc;
3671 
3672 	/* Determine desired pin flags */
3673 	for (size_t pin = 0; pin < nitems(flags); pin++) {
3674 		uint32_t pinbit = (1 << pin);
3675 
3676 		if (pins & pinbit) {
3677 			/* Tristate output */
3678 			flags[pin] = GPIO_PIN_OUTPUT|GPIO_PIN_TRISTATE;
3679 		} else {
3680 			/* Leave unmodified */
3681 			flags[pin] = 0;
3682 		}
3683 	}
3684 
3685 	/* Configure all pins */
3686 	error = GPIO_PIN_CONFIG_32(sc->sc_gpio, 0, nitems(flags), flags);
3687 	if (error) {
3688 		device_printf(sc->sc_dev, "error configuring %s pin flags: "
3689 		    "%d\n", device_get_nameunit(sc->sc_gpio), error);
3690 		return (error);
3691 	}
3692 
3693 	return (0);
3694 }
3695 
3696 
3697 static int
3698 bwn_gpio_init(struct bwn_mac *mac)
3699 {
3700 	struct bwn_softc	*sc;
3701 	uint32_t		 pins;
3702 
3703 	sc = mac->mac_sc;
3704 
3705 	pins = 0xF;
3706 
3707 	BWN_WRITE_4(mac, BWN_MACCTL,
3708 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3709 	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3710 	    BWN_READ_2(mac, BWN_GPIO_MASK) | pins);
3711 
3712 	if (sc->sc_board_info.board_flags & BHND_BFL_PACTRL) {
3713 		/* MAC core is responsible for toggling PAREF via gpio9 */
3714 		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3715 		    BWN_READ_2(mac, BWN_GPIO_MASK) | BHND_GPIO_BOARD_PACTRL);
3716 
3717 		pins |= BHND_GPIO_BOARD_PACTRL;
3718 	}
3719 
3720 	return (bwn_gpio_control(mac, pins));
3721 }
3722 
3723 static int
3724 bwn_fw_loadinitvals(struct bwn_mac *mac)
3725 {
3726 #define	GETFWOFFSET(fwp, offset)				\
3727 	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3728 	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3729 	const struct bwn_fwhdr *hdr;
3730 	struct bwn_fw *fw = &mac->mac_fw;
3731 	int error;
3732 
3733 	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3734 	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3735 	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3736 	if (error)
3737 		return (error);
3738 	if (fw->initvals_band.fw) {
3739 		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3740 		error = bwn_fwinitvals_write(mac,
3741 		    GETFWOFFSET(fw->initvals_band, hdr_len),
3742 		    be32toh(hdr->size),
3743 		    fw->initvals_band.fw->datasize - hdr_len);
3744 	}
3745 	return (error);
3746 #undef GETFWOFFSET
3747 }
3748 
3749 static int
3750 bwn_phy_init(struct bwn_mac *mac)
3751 {
3752 	struct bwn_softc *sc = mac->mac_sc;
3753 	int error;
3754 
3755 	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3756 	mac->mac_phy.rf_onoff(mac, 1);
3757 	error = mac->mac_phy.init(mac);
3758 	if (error) {
3759 		device_printf(sc->sc_dev, "PHY init failed\n");
3760 		goto fail0;
3761 	}
3762 	error = bwn_switch_channel(mac,
3763 	    mac->mac_phy.get_default_chan(mac));
3764 	if (error) {
3765 		device_printf(sc->sc_dev,
3766 		    "failed to switch default channel\n");
3767 		goto fail1;
3768 	}
3769 	return (0);
3770 fail1:
3771 	if (mac->mac_phy.exit)
3772 		mac->mac_phy.exit(mac);
3773 fail0:
3774 	mac->mac_phy.rf_onoff(mac, 0);
3775 
3776 	return (error);
3777 }
3778 
3779 static void
3780 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3781 {
3782 	uint16_t ant;
3783 	uint16_t tmp;
3784 
3785 	ant = bwn_ant2phy(antenna);
3786 
3787 	/* For ACK/CTS */
3788 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3789 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3790 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3791 	/* For Probe Resposes */
3792 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3793 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3794 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3795 }
3796 
3797 static void
3798 bwn_set_opmode(struct bwn_mac *mac)
3799 {
3800 	struct bwn_softc *sc = mac->mac_sc;
3801 	struct ieee80211com *ic = &sc->sc_ic;
3802 	uint32_t ctl;
3803 	uint16_t cfp_pretbtt;
3804 
3805 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3806 	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3807 	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3808 	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3809 	ctl |= BWN_MACCTL_STA;
3810 
3811 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3812 	    ic->ic_opmode == IEEE80211_M_MBSS)
3813 		ctl |= BWN_MACCTL_HOSTAP;
3814 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3815 		ctl &= ~BWN_MACCTL_STA;
3816 	ctl |= sc->sc_filters;
3817 
3818 	if (bhnd_get_hwrev(sc->sc_dev) <= 4)
3819 		ctl |= BWN_MACCTL_PROMISC;
3820 
3821 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3822 
3823 	cfp_pretbtt = 2;
3824 	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3825 		if (sc->sc_cid.chip_id == BHND_CHIPID_BCM4306 &&
3826 		    sc->sc_cid.chip_rev == 3)
3827 			cfp_pretbtt = 100;
3828 		else
3829 			cfp_pretbtt = 50;
3830 	}
3831 	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3832 }
3833 
3834 static void
3835 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3836 {
3837 	if (!error) {
3838 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3839 		*((bus_addr_t *)arg) = seg->ds_addr;
3840 	}
3841 }
3842 
3843 void
3844 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3845 {
3846 	struct bwn_phy *phy = &mac->mac_phy;
3847 	struct bwn_softc *sc = mac->mac_sc;
3848 	unsigned int i, max_loop;
3849 	uint16_t value;
3850 	uint32_t buffer[5] = {
3851 		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3852 	};
3853 
3854 	if (ofdm) {
3855 		max_loop = 0x1e;
3856 		buffer[0] = 0x000201cc;
3857 	} else {
3858 		max_loop = 0xfa;
3859 		buffer[0] = 0x000b846e;
3860 	}
3861 
3862 	BWN_ASSERT_LOCKED(mac->mac_sc);
3863 
3864 	for (i = 0; i < 5; i++)
3865 		bwn_ram_write(mac, i * 4, buffer[i]);
3866 
3867 	BWN_WRITE_2(mac, 0x0568, 0x0000);
3868 	BWN_WRITE_2(mac, 0x07c0,
3869 	    (bhnd_get_hwrev(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3870 
3871 	value = (ofdm ? 0x41 : 0x40);
3872 	BWN_WRITE_2(mac, 0x050c, value);
3873 
3874 	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3875 	    phy->type == BWN_PHYTYPE_LCN)
3876 		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3877 	BWN_WRITE_2(mac, 0x0508, 0x0000);
3878 	BWN_WRITE_2(mac, 0x050a, 0x0000);
3879 	BWN_WRITE_2(mac, 0x054c, 0x0000);
3880 	BWN_WRITE_2(mac, 0x056a, 0x0014);
3881 	BWN_WRITE_2(mac, 0x0568, 0x0826);
3882 	BWN_WRITE_2(mac, 0x0500, 0x0000);
3883 
3884 	/* XXX TODO: n phy pa override? */
3885 
3886 	switch (phy->type) {
3887 	case BWN_PHYTYPE_N:
3888 	case BWN_PHYTYPE_LCN:
3889 		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3890 		break;
3891 	case BWN_PHYTYPE_LP:
3892 		BWN_WRITE_2(mac, 0x0502, 0x0050);
3893 		break;
3894 	default:
3895 		BWN_WRITE_2(mac, 0x0502, 0x0030);
3896 		break;
3897 	}
3898 
3899 	/* flush */
3900 	BWN_READ_2(mac, 0x0502);
3901 
3902 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3903 		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3904 	for (i = 0x00; i < max_loop; i++) {
3905 		value = BWN_READ_2(mac, 0x050e);
3906 		if (value & 0x0080)
3907 			break;
3908 		DELAY(10);
3909 	}
3910 	for (i = 0x00; i < 0x0a; i++) {
3911 		value = BWN_READ_2(mac, 0x050e);
3912 		if (value & 0x0400)
3913 			break;
3914 		DELAY(10);
3915 	}
3916 	for (i = 0x00; i < 0x19; i++) {
3917 		value = BWN_READ_2(mac, 0x0690);
3918 		if (!(value & 0x0100))
3919 			break;
3920 		DELAY(10);
3921 	}
3922 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3923 		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3924 }
3925 
3926 void
3927 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3928 {
3929 	uint32_t macctl;
3930 
3931 	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3932 
3933 	macctl = BWN_READ_4(mac, BWN_MACCTL);
3934 	if (macctl & BWN_MACCTL_BIGENDIAN)
3935 		printf("TODO: need swap\n");
3936 
3937 	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3938 	BWN_BARRIER(mac, BWN_RAM_CONTROL, 4, BUS_SPACE_BARRIER_WRITE);
3939 	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3940 }
3941 
3942 void
3943 bwn_mac_suspend(struct bwn_mac *mac)
3944 {
3945 	struct bwn_softc *sc = mac->mac_sc;
3946 	int i;
3947 	uint32_t tmp;
3948 
3949 	KASSERT(mac->mac_suspended >= 0,
3950 	    ("%s:%d: fail", __func__, __LINE__));
3951 
3952 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3953 	    __func__, mac->mac_suspended);
3954 
3955 	if (mac->mac_suspended == 0) {
3956 		bwn_psctl(mac, BWN_PS_AWAKE);
3957 		BWN_WRITE_4(mac, BWN_MACCTL,
3958 			    BWN_READ_4(mac, BWN_MACCTL)
3959 			    & ~BWN_MACCTL_ON);
3960 		BWN_READ_4(mac, BWN_MACCTL);
3961 		for (i = 35; i; i--) {
3962 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3963 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3964 				goto out;
3965 			DELAY(10);
3966 		}
3967 		for (i = 40; i; i--) {
3968 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3969 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3970 				goto out;
3971 			DELAY(1000);
3972 		}
3973 		device_printf(sc->sc_dev, "MAC suspend failed\n");
3974 	}
3975 out:
3976 	mac->mac_suspended++;
3977 }
3978 
3979 void
3980 bwn_mac_enable(struct bwn_mac *mac)
3981 {
3982 	struct bwn_softc *sc = mac->mac_sc;
3983 	uint16_t state;
3984 
3985 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3986 	    __func__, mac->mac_suspended);
3987 
3988 	state = bwn_shm_read_2(mac, BWN_SHARED,
3989 	    BWN_SHARED_UCODESTAT);
3990 	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3991 	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3992 		DPRINTF(sc, BWN_DEBUG_FW,
3993 		    "%s: warn: firmware state (%d)\n",
3994 		    __func__, state);
3995 	}
3996 
3997 	mac->mac_suspended--;
3998 	KASSERT(mac->mac_suspended >= 0,
3999 	    ("%s:%d: fail", __func__, __LINE__));
4000 	if (mac->mac_suspended == 0) {
4001 		BWN_WRITE_4(mac, BWN_MACCTL,
4002 		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
4003 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
4004 		BWN_READ_4(mac, BWN_MACCTL);
4005 		BWN_READ_4(mac, BWN_INTR_REASON);
4006 		bwn_psctl(mac, 0);
4007 	}
4008 }
4009 
4010 void
4011 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
4012 {
4013 	struct bwn_softc *sc = mac->mac_sc;
4014 	int i;
4015 	uint16_t ucstat;
4016 
4017 	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
4018 	    ("%s:%d: fail", __func__, __LINE__));
4019 	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
4020 	    ("%s:%d: fail", __func__, __LINE__));
4021 
4022 	/* XXX forcibly awake and hwps-off */
4023 
4024 	BWN_WRITE_4(mac, BWN_MACCTL,
4025 	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
4026 	    ~BWN_MACCTL_HWPS);
4027 	BWN_READ_4(mac, BWN_MACCTL);
4028 	if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4029 		for (i = 0; i < 100; i++) {
4030 			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
4031 			    BWN_SHARED_UCODESTAT);
4032 			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
4033 				break;
4034 			DELAY(10);
4035 		}
4036 	}
4037 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
4038 	    ucstat);
4039 }
4040 
4041 static int
4042 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
4043 {
4044 	struct bwn_softc *sc = mac->mac_sc;
4045 	struct bwn_fw *fw = &mac->mac_fw;
4046 	const uint8_t rev = bhnd_get_hwrev(sc->sc_dev);
4047 	const char *filename;
4048 	uint16_t iost;
4049 	int error;
4050 
4051 	/* microcode */
4052 	filename = NULL;
4053 	switch (rev) {
4054 	case 42:
4055 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4056 			filename = "ucode42";
4057 		break;
4058 	case 40:
4059 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
4060 			filename = "ucode40";
4061 		break;
4062 	case 33:
4063 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
4064 			filename = "ucode33_lcn40";
4065 		break;
4066 	case 30:
4067 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4068 			filename = "ucode30_mimo";
4069 		break;
4070 	case 29:
4071 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4072 			filename = "ucode29_mimo";
4073 		break;
4074 	case 26:
4075 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
4076 			filename = "ucode26_mimo";
4077 		break;
4078 	case 28:
4079 	case 25:
4080 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4081 			filename = "ucode25_mimo";
4082 		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4083 			filename = "ucode25_lcn";
4084 		break;
4085 	case 24:
4086 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
4087 			filename = "ucode24_lcn";
4088 		break;
4089 	case 23:
4090 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4091 			filename = "ucode16_mimo";
4092 		break;
4093 	case 16:
4094 	case 17:
4095 	case 18:
4096 	case 19:
4097 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
4098 			filename = "ucode16_mimo";
4099 		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
4100 			filename = "ucode16_lp";
4101 		break;
4102 	case 15:
4103 		filename = "ucode15";
4104 		break;
4105 	case 14:
4106 		filename = "ucode14";
4107 		break;
4108 	case 13:
4109 		filename = "ucode13";
4110 		break;
4111 	case 12:
4112 	case 11:
4113 		filename = "ucode11";
4114 		break;
4115 	case 10:
4116 	case 9:
4117 	case 8:
4118 	case 7:
4119 	case 6:
4120 	case 5:
4121 		filename = "ucode5";
4122 		break;
4123 	default:
4124 		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
4125 		bwn_release_firmware(mac);
4126 		return (EOPNOTSUPP);
4127 	}
4128 
4129 	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
4130 	error = bwn_fw_get(mac, type, filename, &fw->ucode);
4131 	if (error) {
4132 		bwn_release_firmware(mac);
4133 		return (error);
4134 	}
4135 
4136 	/* PCM */
4137 	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
4138 	if (rev >= 5 && rev <= 10) {
4139 		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
4140 		if (error == ENOENT)
4141 			fw->no_pcmfile = 1;
4142 		else if (error) {
4143 			bwn_release_firmware(mac);
4144 			return (error);
4145 		}
4146 	} else if (rev < 11) {
4147 		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
4148 		bwn_release_firmware(mac);
4149 		return (EOPNOTSUPP);
4150 	}
4151 
4152 	/* initvals */
4153 	error = bhnd_read_iost(sc->sc_dev, &iost);
4154 	if (error)
4155 		goto fail1;
4156 
4157 	switch (mac->mac_phy.type) {
4158 	case BWN_PHYTYPE_A:
4159 		if (rev < 5 || rev > 10)
4160 			goto fail1;
4161 		if (iost & BWN_IOST_HAVE_2GHZ)
4162 			filename = "a0g1initvals5";
4163 		else
4164 			filename = "a0g0initvals5";
4165 		break;
4166 	case BWN_PHYTYPE_G:
4167 		if (rev >= 5 && rev <= 10)
4168 			filename = "b0g0initvals5";
4169 		else if (rev >= 13)
4170 			filename = "b0g0initvals13";
4171 		else
4172 			goto fail1;
4173 		break;
4174 	case BWN_PHYTYPE_LP:
4175 		if (rev == 13)
4176 			filename = "lp0initvals13";
4177 		else if (rev == 14)
4178 			filename = "lp0initvals14";
4179 		else if (rev >= 15)
4180 			filename = "lp0initvals15";
4181 		else
4182 			goto fail1;
4183 		break;
4184 	case BWN_PHYTYPE_N:
4185 		if (rev == 30)
4186 			filename = "n16initvals30";
4187 		else if (rev == 28 || rev == 25)
4188 			filename = "n0initvals25";
4189 		else if (rev == 24)
4190 			filename = "n0initvals24";
4191 		else if (rev == 23)
4192 			filename = "n0initvals16";
4193 		else if (rev >= 16 && rev <= 18)
4194 			filename = "n0initvals16";
4195 		else if (rev >= 11 && rev <= 12)
4196 			filename = "n0initvals11";
4197 		else
4198 			goto fail1;
4199 		break;
4200 	default:
4201 		goto fail1;
4202 	}
4203 	error = bwn_fw_get(mac, type, filename, &fw->initvals);
4204 	if (error) {
4205 		bwn_release_firmware(mac);
4206 		return (error);
4207 	}
4208 
4209 	/* bandswitch initvals */
4210 	switch (mac->mac_phy.type) {
4211 	case BWN_PHYTYPE_A:
4212 		if (rev >= 5 && rev <= 10) {
4213 			if (iost & BWN_IOST_HAVE_2GHZ)
4214 				filename = "a0g1bsinitvals5";
4215 			else
4216 				filename = "a0g0bsinitvals5";
4217 		} else if (rev >= 11)
4218 			filename = NULL;
4219 		else
4220 			goto fail1;
4221 		break;
4222 	case BWN_PHYTYPE_G:
4223 		if (rev >= 5 && rev <= 10)
4224 			filename = "b0g0bsinitvals5";
4225 		else if (rev >= 11)
4226 			filename = NULL;
4227 		else
4228 			goto fail1;
4229 		break;
4230 	case BWN_PHYTYPE_LP:
4231 		if (rev == 13)
4232 			filename = "lp0bsinitvals13";
4233 		else if (rev == 14)
4234 			filename = "lp0bsinitvals14";
4235 		else if (rev >= 15)
4236 			filename = "lp0bsinitvals15";
4237 		else
4238 			goto fail1;
4239 		break;
4240 	case BWN_PHYTYPE_N:
4241 		if (rev == 30)
4242 			filename = "n16bsinitvals30";
4243 		else if (rev == 28 || rev == 25)
4244 			filename = "n0bsinitvals25";
4245 		else if (rev == 24)
4246 			filename = "n0bsinitvals24";
4247 		else if (rev == 23)
4248 			filename = "n0bsinitvals16";
4249 		else if (rev >= 16 && rev <= 18)
4250 			filename = "n0bsinitvals16";
4251 		else if (rev >= 11 && rev <= 12)
4252 			filename = "n0bsinitvals11";
4253 		else
4254 			goto fail1;
4255 		break;
4256 	default:
4257 		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4258 		    mac->mac_phy.type);
4259 		goto fail1;
4260 	}
4261 	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4262 	if (error) {
4263 		bwn_release_firmware(mac);
4264 		return (error);
4265 	}
4266 	return (0);
4267 fail1:
4268 	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4269 	    rev, mac->mac_phy.type);
4270 	bwn_release_firmware(mac);
4271 	return (EOPNOTSUPP);
4272 }
4273 
4274 static int
4275 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4276     const char *name, struct bwn_fwfile *bfw)
4277 {
4278 	const struct bwn_fwhdr *hdr;
4279 	struct bwn_softc *sc = mac->mac_sc;
4280 	const struct firmware *fw;
4281 	char namebuf[64];
4282 
4283 	if (name == NULL) {
4284 		bwn_do_release_fw(bfw);
4285 		return (0);
4286 	}
4287 	if (bfw->filename != NULL) {
4288 		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4289 			return (0);
4290 		bwn_do_release_fw(bfw);
4291 	}
4292 
4293 	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4294 	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4295 	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4296 	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4297 	fw = firmware_get(namebuf);
4298 	if (fw == NULL) {
4299 		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4300 		    namebuf);
4301 		return (ENOENT);
4302 	}
4303 	if (fw->datasize < sizeof(struct bwn_fwhdr))
4304 		goto fail;
4305 	hdr = (const struct bwn_fwhdr *)(fw->data);
4306 	switch (hdr->type) {
4307 	case BWN_FWTYPE_UCODE:
4308 	case BWN_FWTYPE_PCM:
4309 		if (be32toh(hdr->size) !=
4310 		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4311 			goto fail;
4312 		/* FALLTHROUGH */
4313 	case BWN_FWTYPE_IV:
4314 		if (hdr->ver != 1)
4315 			goto fail;
4316 		break;
4317 	default:
4318 		goto fail;
4319 	}
4320 	bfw->filename = name;
4321 	bfw->fw = fw;
4322 	bfw->type = type;
4323 	return (0);
4324 fail:
4325 	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4326 	if (fw != NULL)
4327 		firmware_put(fw, FIRMWARE_UNLOAD);
4328 	return (EPROTO);
4329 }
4330 
4331 static void
4332 bwn_release_firmware(struct bwn_mac *mac)
4333 {
4334 
4335 	bwn_do_release_fw(&mac->mac_fw.ucode);
4336 	bwn_do_release_fw(&mac->mac_fw.pcm);
4337 	bwn_do_release_fw(&mac->mac_fw.initvals);
4338 	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4339 }
4340 
4341 static void
4342 bwn_do_release_fw(struct bwn_fwfile *bfw)
4343 {
4344 
4345 	if (bfw->fw != NULL)
4346 		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4347 	bfw->fw = NULL;
4348 	bfw->filename = NULL;
4349 }
4350 
4351 static int
4352 bwn_fw_loaducode(struct bwn_mac *mac)
4353 {
4354 #define	GETFWOFFSET(fwp, offset)	\
4355 	((const uint32_t *)((const char *)fwp.fw->data + offset))
4356 #define	GETFWSIZE(fwp, offset)	\
4357 	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4358 	struct bwn_softc *sc = mac->mac_sc;
4359 	const uint32_t *data;
4360 	unsigned int i;
4361 	uint32_t ctl;
4362 	uint16_t date, fwcaps, time;
4363 	int error = 0;
4364 
4365 	ctl = BWN_READ_4(mac, BWN_MACCTL);
4366 	ctl |= BWN_MACCTL_MCODE_JMP0;
4367 	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4368 	    __LINE__));
4369 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4370 	for (i = 0; i < 64; i++)
4371 		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4372 	for (i = 0; i < 4096; i += 2)
4373 		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4374 
4375 	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4376 	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4377 	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4378 	     i++) {
4379 		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4380 		DELAY(10);
4381 	}
4382 
4383 	if (mac->mac_fw.pcm.fw) {
4384 		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4385 		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4386 		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4387 		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4388 		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4389 		    sizeof(struct bwn_fwhdr)); i++) {
4390 			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4391 			DELAY(10);
4392 		}
4393 	}
4394 
4395 	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4396 	BWN_WRITE_4(mac, BWN_MACCTL,
4397 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4398 	    BWN_MACCTL_MCODE_RUN);
4399 
4400 	for (i = 0; i < 21; i++) {
4401 		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4402 			break;
4403 		if (i >= 20) {
4404 			device_printf(sc->sc_dev, "ucode timeout\n");
4405 			error = ENXIO;
4406 			goto error;
4407 		}
4408 		DELAY(50000);
4409 	}
4410 	BWN_READ_4(mac, BWN_INTR_REASON);
4411 
4412 	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4413 	if (mac->mac_fw.rev <= 0x128) {
4414 		device_printf(sc->sc_dev, "the firmware is too old\n");
4415 		error = EOPNOTSUPP;
4416 		goto error;
4417 	}
4418 
4419 	/*
4420 	 * Determine firmware header version; needed for TX/RX packet
4421 	 * handling.
4422 	 */
4423 	if (mac->mac_fw.rev >= 598)
4424 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4425 	else if (mac->mac_fw.rev >= 410)
4426 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4427 	else
4428 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4429 
4430 	/*
4431 	 * We don't support rev 598 or later; that requires
4432 	 * another round of changes to the TX/RX descriptor
4433 	 * and status layout.
4434 	 *
4435 	 * So, complain this is the case and exit out, rather
4436 	 * than attaching and then failing.
4437 	 */
4438 #if 0
4439 	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4440 		device_printf(sc->sc_dev,
4441 		    "firmware is too new (>=598); not supported\n");
4442 		error = EOPNOTSUPP;
4443 		goto error;
4444 	}
4445 #endif
4446 
4447 	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4448 	    BWN_SHARED_UCODE_PATCH);
4449 	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4450 	mac->mac_fw.opensource = (date == 0xffff);
4451 	if (bwn_wme != 0)
4452 		mac->mac_flags |= BWN_MAC_FLAG_WME;
4453 	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4454 
4455 	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4456 	if (mac->mac_fw.opensource == 0) {
4457 		device_printf(sc->sc_dev,
4458 		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4459 		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4460 		if (mac->mac_fw.no_pcmfile)
4461 			device_printf(sc->sc_dev,
4462 			    "no HW crypto acceleration due to pcm5\n");
4463 	} else {
4464 		mac->mac_fw.patch = time;
4465 		fwcaps = bwn_fwcaps_read(mac);
4466 		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4467 			device_printf(sc->sc_dev,
4468 			    "disabling HW crypto acceleration\n");
4469 			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4470 		}
4471 		if (!(fwcaps & BWN_FWCAPS_WME)) {
4472 			device_printf(sc->sc_dev, "disabling WME support\n");
4473 			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4474 		}
4475 	}
4476 
4477 	if (BWN_ISOLDFMT(mac))
4478 		device_printf(sc->sc_dev, "using old firmware image\n");
4479 
4480 	return (0);
4481 
4482 error:
4483 	BWN_WRITE_4(mac, BWN_MACCTL,
4484 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4485 	    BWN_MACCTL_MCODE_JMP0);
4486 
4487 	return (error);
4488 #undef GETFWSIZE
4489 #undef GETFWOFFSET
4490 }
4491 
4492 /* OpenFirmware only */
4493 static uint16_t
4494 bwn_fwcaps_read(struct bwn_mac *mac)
4495 {
4496 
4497 	KASSERT(mac->mac_fw.opensource == 1,
4498 	    ("%s:%d: fail", __func__, __LINE__));
4499 	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4500 }
4501 
4502 static int
4503 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4504     size_t count, size_t array_size)
4505 {
4506 #define	GET_NEXTIV16(iv)						\
4507 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4508 	    sizeof(uint16_t) + sizeof(uint16_t)))
4509 #define	GET_NEXTIV32(iv)						\
4510 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4511 	    sizeof(uint16_t) + sizeof(uint32_t)))
4512 	struct bwn_softc *sc = mac->mac_sc;
4513 	const struct bwn_fwinitvals *iv;
4514 	uint16_t offset;
4515 	size_t i;
4516 	uint8_t bit32;
4517 
4518 	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4519 	    ("%s:%d: fail", __func__, __LINE__));
4520 	iv = ivals;
4521 	for (i = 0; i < count; i++) {
4522 		if (array_size < sizeof(iv->offset_size))
4523 			goto fail;
4524 		array_size -= sizeof(iv->offset_size);
4525 		offset = be16toh(iv->offset_size);
4526 		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4527 		offset &= BWN_FWINITVALS_OFFSET_MASK;
4528 		if (offset >= 0x1000)
4529 			goto fail;
4530 		if (bit32) {
4531 			if (array_size < sizeof(iv->data.d32))
4532 				goto fail;
4533 			array_size -= sizeof(iv->data.d32);
4534 			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4535 			iv = GET_NEXTIV32(iv);
4536 		} else {
4537 
4538 			if (array_size < sizeof(iv->data.d16))
4539 				goto fail;
4540 			array_size -= sizeof(iv->data.d16);
4541 			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4542 
4543 			iv = GET_NEXTIV16(iv);
4544 		}
4545 	}
4546 	if (array_size != 0)
4547 		goto fail;
4548 	return (0);
4549 fail:
4550 	device_printf(sc->sc_dev, "initvals: invalid format\n");
4551 	return (EPROTO);
4552 #undef GET_NEXTIV16
4553 #undef GET_NEXTIV32
4554 }
4555 
4556 int
4557 bwn_switch_channel(struct bwn_mac *mac, int chan)
4558 {
4559 	struct bwn_phy *phy = &(mac->mac_phy);
4560 	struct bwn_softc *sc = mac->mac_sc;
4561 	struct ieee80211com *ic = &sc->sc_ic;
4562 	uint16_t channelcookie, savedcookie;
4563 	int error;
4564 
4565 	if (chan == 0xffff)
4566 		chan = phy->get_default_chan(mac);
4567 
4568 	channelcookie = chan;
4569 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4570 		channelcookie |= 0x100;
4571 	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4572 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4573 	error = phy->switch_channel(mac, chan);
4574 	if (error)
4575 		goto fail;
4576 
4577 	mac->mac_phy.chan = chan;
4578 	DELAY(8000);
4579 	return (0);
4580 fail:
4581 	device_printf(sc->sc_dev, "failed to switch channel\n");
4582 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4583 	return (error);
4584 }
4585 
4586 static uint16_t
4587 bwn_ant2phy(int antenna)
4588 {
4589 
4590 	switch (antenna) {
4591 	case BWN_ANT0:
4592 		return (BWN_TX_PHY_ANT0);
4593 	case BWN_ANT1:
4594 		return (BWN_TX_PHY_ANT1);
4595 	case BWN_ANT2:
4596 		return (BWN_TX_PHY_ANT2);
4597 	case BWN_ANT3:
4598 		return (BWN_TX_PHY_ANT3);
4599 	case BWN_ANTAUTO:
4600 		return (BWN_TX_PHY_ANT01AUTO);
4601 	}
4602 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4603 	return (0);
4604 }
4605 
4606 static void
4607 bwn_wme_load(struct bwn_mac *mac)
4608 {
4609 	struct bwn_softc *sc = mac->mac_sc;
4610 	int i;
4611 
4612 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4613 	    ("%s:%d: fail", __func__, __LINE__));
4614 
4615 	bwn_mac_suspend(mac);
4616 	for (i = 0; i < N(sc->sc_wmeParams); i++)
4617 		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4618 		    bwn_wme_shm_offsets[i]);
4619 	bwn_mac_enable(mac);
4620 }
4621 
4622 static void
4623 bwn_wme_loadparams(struct bwn_mac *mac,
4624     const struct wmeParams *p, uint16_t shm_offset)
4625 {
4626 #define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4627 	struct bwn_softc *sc = mac->mac_sc;
4628 	uint16_t params[BWN_NR_WMEPARAMS];
4629 	int slot, tmp;
4630 	unsigned int i;
4631 
4632 	slot = BWN_READ_2(mac, BWN_RNG) &
4633 	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4634 
4635 	memset(&params, 0, sizeof(params));
4636 
4637 	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4638 	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4639 	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4640 
4641 	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4642 	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4643 	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4644 	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4645 	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4646 	params[BWN_WMEPARAM_BSLOTS] = slot;
4647 	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4648 
4649 	for (i = 0; i < N(params); i++) {
4650 		if (i == BWN_WMEPARAM_STATUS) {
4651 			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4652 			    shm_offset + (i * 2));
4653 			tmp |= 0x100;
4654 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4655 			    tmp);
4656 		} else {
4657 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4658 			    params[i]);
4659 		}
4660 	}
4661 }
4662 
4663 static void
4664 bwn_mac_write_bssid(struct bwn_mac *mac)
4665 {
4666 	struct bwn_softc *sc = mac->mac_sc;
4667 	uint32_t tmp;
4668 	int i;
4669 	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4670 
4671 	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4672 	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4673 	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4674 	    IEEE80211_ADDR_LEN);
4675 
4676 	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4677 		tmp = (uint32_t) (mac_bssid[i + 0]);
4678 		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4679 		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4680 		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4681 		bwn_ram_write(mac, 0x20 + i, tmp);
4682 	}
4683 }
4684 
4685 static void
4686 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4687     const uint8_t *macaddr)
4688 {
4689 	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4690 	uint16_t data;
4691 
4692 	if (!mac)
4693 		macaddr = zero;
4694 
4695 	offset |= 0x0020;
4696 	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4697 
4698 	data = macaddr[0];
4699 	data |= macaddr[1] << 8;
4700 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4701 	data = macaddr[2];
4702 	data |= macaddr[3] << 8;
4703 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4704 	data = macaddr[4];
4705 	data |= macaddr[5] << 8;
4706 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4707 }
4708 
4709 static void
4710 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4711     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4712 {
4713 	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4714 	uint8_t per_sta_keys_start = 8;
4715 
4716 	if (BWN_SEC_NEWAPI(mac))
4717 		per_sta_keys_start = 4;
4718 
4719 	KASSERT(index < mac->mac_max_nr_keys,
4720 	    ("%s:%d: fail", __func__, __LINE__));
4721 	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4722 	    ("%s:%d: fail", __func__, __LINE__));
4723 
4724 	if (index >= per_sta_keys_start)
4725 		bwn_key_macwrite(mac, index, NULL);
4726 	if (key)
4727 		memcpy(buf, key, key_len);
4728 	bwn_key_write(mac, index, algorithm, buf);
4729 	if (index >= per_sta_keys_start)
4730 		bwn_key_macwrite(mac, index, mac_addr);
4731 
4732 	mac->mac_key[index].algorithm = algorithm;
4733 }
4734 
4735 static void
4736 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4737 {
4738 	struct bwn_softc *sc = mac->mac_sc;
4739 	uint32_t addrtmp[2] = { 0, 0 };
4740 	uint8_t start = 8;
4741 
4742 	if (BWN_SEC_NEWAPI(mac))
4743 		start = 4;
4744 
4745 	KASSERT(index >= start,
4746 	    ("%s:%d: fail", __func__, __LINE__));
4747 	index -= start;
4748 
4749 	if (addr) {
4750 		addrtmp[0] = addr[0];
4751 		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4752 		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4753 		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4754 		addrtmp[1] = addr[4];
4755 		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4756 	}
4757 
4758 	if (bhnd_get_hwrev(sc->sc_dev) >= 5) {
4759 		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4760 		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4761 	} else {
4762 		if (index >= 8) {
4763 			bwn_shm_write_4(mac, BWN_SHARED,
4764 			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4765 			bwn_shm_write_2(mac, BWN_SHARED,
4766 			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4767 		}
4768 	}
4769 }
4770 
4771 static void
4772 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4773     const uint8_t *key)
4774 {
4775 	unsigned int i;
4776 	uint32_t offset;
4777 	uint16_t kidx, value;
4778 
4779 	kidx = BWN_SEC_KEY2FW(mac, index);
4780 	bwn_shm_write_2(mac, BWN_SHARED,
4781 	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4782 
4783 	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4784 	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4785 		value = key[i];
4786 		value |= (uint16_t)(key[i + 1]) << 8;
4787 		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4788 	}
4789 }
4790 
4791 static void
4792 bwn_phy_exit(struct bwn_mac *mac)
4793 {
4794 
4795 	mac->mac_phy.rf_onoff(mac, 0);
4796 	if (mac->mac_phy.exit != NULL)
4797 		mac->mac_phy.exit(mac);
4798 }
4799 
4800 static void
4801 bwn_dma_free(struct bwn_mac *mac)
4802 {
4803 	struct bwn_dma *dma;
4804 
4805 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4806 		return;
4807 	dma = &mac->mac_method.dma;
4808 
4809 	bwn_dma_ringfree(&dma->rx);
4810 	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4811 	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4812 	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4813 	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4814 	bwn_dma_ringfree(&dma->mcast);
4815 }
4816 
4817 static void
4818 bwn_core_stop(struct bwn_mac *mac)
4819 {
4820 	struct bwn_softc *sc = mac->mac_sc;
4821 
4822 	BWN_ASSERT_LOCKED(sc);
4823 
4824 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4825 		return;
4826 
4827 	callout_stop(&sc->sc_rfswitch_ch);
4828 	callout_stop(&sc->sc_task_ch);
4829 	callout_stop(&sc->sc_watchdog_ch);
4830 	sc->sc_watchdog_timer = 0;
4831 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4832 	BWN_READ_4(mac, BWN_INTR_MASK);
4833 	bwn_mac_suspend(mac);
4834 
4835 	mac->mac_status = BWN_MAC_STATUS_INITED;
4836 }
4837 
4838 static int
4839 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4840 {
4841 	struct bwn_mac *up_dev = NULL;
4842 	struct bwn_mac *down_dev;
4843 	struct bwn_mac *mac;
4844 	int err, status;
4845 	uint8_t gmode;
4846 
4847 	BWN_ASSERT_LOCKED(sc);
4848 
4849 	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4850 		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4851 		    mac->mac_phy.supports_2ghz) {
4852 			up_dev = mac;
4853 			gmode = 1;
4854 		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4855 		    mac->mac_phy.supports_5ghz) {
4856 			up_dev = mac;
4857 			gmode = 0;
4858 		} else {
4859 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4860 			return (EINVAL);
4861 		}
4862 		if (up_dev != NULL)
4863 			break;
4864 	}
4865 	if (up_dev == NULL) {
4866 		device_printf(sc->sc_dev, "Could not find a device\n");
4867 		return (ENODEV);
4868 	}
4869 	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4870 		return (0);
4871 
4872 	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4873 	    "switching to %s-GHz band\n",
4874 	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4875 
4876 	down_dev = sc->sc_curmac;
4877 	status = down_dev->mac_status;
4878 	if (status >= BWN_MAC_STATUS_STARTED)
4879 		bwn_core_stop(down_dev);
4880 	if (status >= BWN_MAC_STATUS_INITED)
4881 		bwn_core_exit(down_dev);
4882 
4883 	if (down_dev != up_dev) {
4884 		err = bwn_phy_reset(down_dev);
4885 		if (err)
4886 			goto fail;
4887 	}
4888 
4889 	up_dev->mac_phy.gmode = gmode;
4890 	if (status >= BWN_MAC_STATUS_INITED) {
4891 		err = bwn_core_init(up_dev);
4892 		if (err) {
4893 			device_printf(sc->sc_dev,
4894 			    "fatal: failed to initialize for %s-GHz\n",
4895 			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4896 			goto fail;
4897 		}
4898 	}
4899 	if (status >= BWN_MAC_STATUS_STARTED)
4900 		bwn_core_start(up_dev);
4901 	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4902 	sc->sc_curmac = up_dev;
4903 
4904 	return (0);
4905 fail:
4906 	sc->sc_curmac = NULL;
4907 	return (err);
4908 }
4909 
4910 static void
4911 bwn_rf_turnon(struct bwn_mac *mac)
4912 {
4913 
4914 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4915 
4916 	bwn_mac_suspend(mac);
4917 	mac->mac_phy.rf_onoff(mac, 1);
4918 	mac->mac_phy.rf_on = 1;
4919 	bwn_mac_enable(mac);
4920 }
4921 
4922 static void
4923 bwn_rf_turnoff(struct bwn_mac *mac)
4924 {
4925 
4926 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4927 
4928 	bwn_mac_suspend(mac);
4929 	mac->mac_phy.rf_onoff(mac, 0);
4930 	mac->mac_phy.rf_on = 0;
4931 	bwn_mac_enable(mac);
4932 }
4933 
4934 /*
4935  * PHY reset.
4936  */
4937 static int
4938 bwn_phy_reset(struct bwn_mac *mac)
4939 {
4940 	struct bwn_softc	*sc;
4941 	uint16_t		 iost, mask;
4942 	int			 error;
4943 
4944 	sc = mac->mac_sc;
4945 
4946 	iost = BWN_IOCTL_PHYRESET | BHND_IOCTL_CLK_FORCE;
4947 	mask = iost | BWN_IOCTL_SUPPORT_G;
4948 
4949 	if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4950 		return (error);
4951 
4952 	DELAY(1000);
4953 
4954 	iost &= ~BHND_IOCTL_CLK_FORCE;
4955 
4956 	if ((error = bhnd_write_ioctl(sc->sc_dev, iost, mask)))
4957 		return (error);
4958 
4959 	DELAY(1000);
4960 
4961 	return (0);
4962 }
4963 
4964 static int
4965 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4966 {
4967 	struct bwn_vap *bvp = BWN_VAP(vap);
4968 	struct ieee80211com *ic= vap->iv_ic;
4969 	enum ieee80211_state ostate = vap->iv_state;
4970 	struct bwn_softc *sc = ic->ic_softc;
4971 	struct bwn_mac *mac = sc->sc_curmac;
4972 	int error;
4973 
4974 	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4975 	    ieee80211_state_name[vap->iv_state],
4976 	    ieee80211_state_name[nstate]);
4977 
4978 	error = bvp->bv_newstate(vap, nstate, arg);
4979 	if (error != 0)
4980 		return (error);
4981 
4982 	BWN_LOCK(sc);
4983 
4984 	bwn_led_newstate(mac, nstate);
4985 
4986 	/*
4987 	 * Clear the BSSID when we stop a STA
4988 	 */
4989 	if (vap->iv_opmode == IEEE80211_M_STA) {
4990 		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4991 			/*
4992 			 * Clear out the BSSID.  If we reassociate to
4993 			 * the same AP, this will reinialize things
4994 			 * correctly...
4995 			 */
4996 			if (ic->ic_opmode == IEEE80211_M_STA &&
4997 			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4998 				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4999 				bwn_set_macaddr(mac);
5000 			}
5001 		}
5002 	}
5003 
5004 	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
5005 	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
5006 		/* XXX nothing to do? */
5007 	} else if (nstate == IEEE80211_S_RUN) {
5008 		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
5009 		bwn_set_opmode(mac);
5010 		bwn_set_pretbtt(mac);
5011 		bwn_spu_setdelay(mac, 0);
5012 		bwn_set_macaddr(mac);
5013 	}
5014 
5015 	BWN_UNLOCK(sc);
5016 
5017 	return (error);
5018 }
5019 
5020 static void
5021 bwn_set_pretbtt(struct bwn_mac *mac)
5022 {
5023 	struct bwn_softc *sc = mac->mac_sc;
5024 	struct ieee80211com *ic = &sc->sc_ic;
5025 	uint16_t pretbtt;
5026 
5027 	if (ic->ic_opmode == IEEE80211_M_IBSS)
5028 		pretbtt = 2;
5029 	else
5030 		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
5031 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
5032 	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
5033 }
5034 
5035 static int
5036 bwn_intr(void *arg)
5037 {
5038 	struct bwn_mac *mac = arg;
5039 	struct bwn_softc *sc = mac->mac_sc;
5040 	uint32_t reason;
5041 
5042 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5043 	    (sc->sc_flags & BWN_FLAG_INVALID))
5044 		return (FILTER_STRAY);
5045 
5046 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
5047 
5048 	reason = BWN_READ_4(mac, BWN_INTR_REASON);
5049 	if (reason == 0xffffffff)	/* shared IRQ */
5050 		return (FILTER_STRAY);
5051 	reason &= mac->mac_intr_mask;
5052 	if (reason == 0)
5053 		return (FILTER_HANDLED);
5054 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
5055 
5056 	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
5057 	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
5058 	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
5059 	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
5060 	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
5061 	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
5062 	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
5063 	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
5064 	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
5065 	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
5066 	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
5067 
5068 	/* Disable interrupts. */
5069 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
5070 
5071 	mac->mac_reason_intr = reason;
5072 
5073 	BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5074 
5075 	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
5076 	return (FILTER_HANDLED);
5077 }
5078 
5079 static void
5080 bwn_intrtask(void *arg, int npending)
5081 {
5082 	struct bwn_mac *mac = arg;
5083 	struct bwn_softc *sc = mac->mac_sc;
5084 	uint32_t merged = 0;
5085 	int i, tx = 0, rx = 0;
5086 
5087 	BWN_LOCK(sc);
5088 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
5089 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
5090 		BWN_UNLOCK(sc);
5091 		return;
5092 	}
5093 
5094 	for (i = 0; i < N(mac->mac_reason); i++)
5095 		merged |= mac->mac_reason[i];
5096 
5097 	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
5098 		device_printf(sc->sc_dev, "MAC trans error\n");
5099 
5100 	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
5101 		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
5102 		mac->mac_phy.txerrors--;
5103 		if (mac->mac_phy.txerrors == 0) {
5104 			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
5105 			bwn_restart(mac, "PHY TX errors");
5106 		}
5107 	}
5108 
5109 	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
5110 		if (merged & BWN_DMAINTR_FATALMASK) {
5111 			device_printf(sc->sc_dev,
5112 			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
5113 			    mac->mac_reason[0], mac->mac_reason[1],
5114 			    mac->mac_reason[2], mac->mac_reason[3],
5115 			    mac->mac_reason[4], mac->mac_reason[5]);
5116 			bwn_restart(mac, "DMA error");
5117 			BWN_UNLOCK(sc);
5118 			return;
5119 		}
5120 		if (merged & BWN_DMAINTR_NONFATALMASK) {
5121 			device_printf(sc->sc_dev,
5122 			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
5123 			    mac->mac_reason[0], mac->mac_reason[1],
5124 			    mac->mac_reason[2], mac->mac_reason[3],
5125 			    mac->mac_reason[4], mac->mac_reason[5]);
5126 		}
5127 	}
5128 
5129 	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
5130 		bwn_intr_ucode_debug(mac);
5131 	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
5132 		bwn_intr_tbtt_indication(mac);
5133 	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
5134 		bwn_intr_atim_end(mac);
5135 	if (mac->mac_reason_intr & BWN_INTR_BEACON)
5136 		bwn_intr_beacon(mac);
5137 	if (mac->mac_reason_intr & BWN_INTR_PMQ)
5138 		bwn_intr_pmq(mac);
5139 	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
5140 		bwn_intr_noise(mac);
5141 
5142 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5143 		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
5144 			bwn_dma_rx(mac->mac_method.dma.rx);
5145 			rx = 1;
5146 		}
5147 	} else
5148 		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
5149 
5150 	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5151 	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5152 	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5153 	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5154 	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
5155 
5156 	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
5157 		bwn_intr_txeof(mac);
5158 		tx = 1;
5159 	}
5160 
5161 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
5162 
5163 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
5164 		int evt = BWN_LED_EVENT_NONE;
5165 
5166 		if (tx && rx) {
5167 			if (sc->sc_rx_rate > sc->sc_tx_rate)
5168 				evt = BWN_LED_EVENT_RX;
5169 			else
5170 				evt = BWN_LED_EVENT_TX;
5171 		} else if (tx) {
5172 			evt = BWN_LED_EVENT_TX;
5173 		} else if (rx) {
5174 			evt = BWN_LED_EVENT_RX;
5175 		} else if (rx == 0) {
5176 			evt = BWN_LED_EVENT_POLL;
5177 		}
5178 
5179 		if (evt != BWN_LED_EVENT_NONE)
5180 			bwn_led_event(mac, evt);
5181        }
5182 
5183 	if (mbufq_first(&sc->sc_snd) != NULL)
5184 		bwn_start(sc);
5185 
5186 	BWN_BARRIER(mac, 0, 0, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE);
5187 
5188 	BWN_UNLOCK(sc);
5189 }
5190 
5191 static void
5192 bwn_restart(struct bwn_mac *mac, const char *msg)
5193 {
5194 	struct bwn_softc *sc = mac->mac_sc;
5195 	struct ieee80211com *ic = &sc->sc_ic;
5196 
5197 	if (mac->mac_status < BWN_MAC_STATUS_INITED)
5198 		return;
5199 
5200 	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
5201 	ieee80211_runtask(ic, &mac->mac_hwreset);
5202 }
5203 
5204 static void
5205 bwn_intr_ucode_debug(struct bwn_mac *mac)
5206 {
5207 	struct bwn_softc *sc = mac->mac_sc;
5208 	uint16_t reason;
5209 
5210 	if (mac->mac_fw.opensource == 0)
5211 		return;
5212 
5213 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
5214 	switch (reason) {
5215 	case BWN_DEBUGINTR_PANIC:
5216 		bwn_handle_fwpanic(mac);
5217 		break;
5218 	case BWN_DEBUGINTR_DUMP_SHM:
5219 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5220 		break;
5221 	case BWN_DEBUGINTR_DUMP_REGS:
5222 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5223 		break;
5224 	case BWN_DEBUGINTR_MARKER:
5225 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5226 		break;
5227 	default:
5228 		device_printf(sc->sc_dev,
5229 		    "ucode debug unknown reason: %#x\n", reason);
5230 	}
5231 
5232 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5233 	    BWN_DEBUGINTR_ACK);
5234 }
5235 
5236 static void
5237 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5238 {
5239 	struct bwn_softc *sc = mac->mac_sc;
5240 	struct ieee80211com *ic = &sc->sc_ic;
5241 
5242 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5243 		bwn_psctl(mac, 0);
5244 	if (ic->ic_opmode == IEEE80211_M_IBSS)
5245 		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5246 }
5247 
5248 static void
5249 bwn_intr_atim_end(struct bwn_mac *mac)
5250 {
5251 
5252 	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5253 		BWN_WRITE_4(mac, BWN_MACCMD,
5254 		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5255 		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5256 	}
5257 }
5258 
5259 static void
5260 bwn_intr_beacon(struct bwn_mac *mac)
5261 {
5262 	struct bwn_softc *sc = mac->mac_sc;
5263 	struct ieee80211com *ic = &sc->sc_ic;
5264 	uint32_t cmd, beacon0, beacon1;
5265 
5266 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5267 	    ic->ic_opmode == IEEE80211_M_MBSS)
5268 		return;
5269 
5270 	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5271 
5272 	cmd = BWN_READ_4(mac, BWN_MACCMD);
5273 	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5274 	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5275 
5276 	if (beacon0 && beacon1) {
5277 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5278 		mac->mac_intr_mask |= BWN_INTR_BEACON;
5279 		return;
5280 	}
5281 
5282 	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5283 		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5284 		bwn_load_beacon0(mac);
5285 		bwn_load_beacon1(mac);
5286 		cmd = BWN_READ_4(mac, BWN_MACCMD);
5287 		cmd |= BWN_MACCMD_BEACON0_VALID;
5288 		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5289 	} else {
5290 		if (!beacon0) {
5291 			bwn_load_beacon0(mac);
5292 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5293 			cmd |= BWN_MACCMD_BEACON0_VALID;
5294 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5295 		} else if (!beacon1) {
5296 			bwn_load_beacon1(mac);
5297 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5298 			cmd |= BWN_MACCMD_BEACON1_VALID;
5299 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5300 		}
5301 	}
5302 }
5303 
5304 static void
5305 bwn_intr_pmq(struct bwn_mac *mac)
5306 {
5307 	uint32_t tmp;
5308 
5309 	while (1) {
5310 		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5311 		if (!(tmp & 0x00000008))
5312 			break;
5313 	}
5314 	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5315 }
5316 
5317 static void
5318 bwn_intr_noise(struct bwn_mac *mac)
5319 {
5320 	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5321 	uint16_t tmp;
5322 	uint8_t noise[4];
5323 	uint8_t i, j;
5324 	int32_t average;
5325 
5326 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5327 		return;
5328 
5329 	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5330 	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5331 	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5332 	    noise[3] == 0x7f)
5333 		goto new;
5334 
5335 	KASSERT(mac->mac_noise.noi_nsamples < 8,
5336 	    ("%s:%d: fail", __func__, __LINE__));
5337 	i = mac->mac_noise.noi_nsamples;
5338 	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5339 	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5340 	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5341 	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5342 	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5343 	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5344 	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5345 	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5346 	mac->mac_noise.noi_nsamples++;
5347 	if (mac->mac_noise.noi_nsamples == 8) {
5348 		average = 0;
5349 		for (i = 0; i < 8; i++) {
5350 			for (j = 0; j < 4; j++)
5351 				average += mac->mac_noise.noi_samples[i][j];
5352 		}
5353 		average = (((average / 32) * 125) + 64) / 128;
5354 		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5355 		if (tmp >= 8)
5356 			average += 2;
5357 		else
5358 			average -= 25;
5359 		average -= (tmp == 8) ? 72 : 48;
5360 
5361 		mac->mac_stats.link_noise = average;
5362 		mac->mac_noise.noi_running = 0;
5363 		return;
5364 	}
5365 new:
5366 	bwn_noise_gensample(mac);
5367 }
5368 
5369 static int
5370 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5371 {
5372 	struct bwn_mac *mac = prq->prq_mac;
5373 	struct bwn_softc *sc = mac->mac_sc;
5374 	unsigned int i;
5375 
5376 	BWN_ASSERT_LOCKED(sc);
5377 
5378 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5379 		return (0);
5380 
5381 	for (i = 0; i < 5000; i++) {
5382 		if (bwn_pio_rxeof(prq) == 0)
5383 			break;
5384 	}
5385 	if (i >= 5000)
5386 		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5387 	return ((i > 0) ? 1 : 0);
5388 }
5389 
5390 static void
5391 bwn_dma_rx(struct bwn_dma_ring *dr)
5392 {
5393 	int slot, curslot;
5394 
5395 	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5396 	curslot = dr->get_curslot(dr);
5397 	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5398 	    ("%s:%d: fail", __func__, __LINE__));
5399 
5400 	slot = dr->dr_curslot;
5401 	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5402 		bwn_dma_rxeof(dr, &slot);
5403 
5404 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5405 	    BUS_DMASYNC_PREWRITE);
5406 
5407 	dr->set_curslot(dr, slot);
5408 	dr->dr_curslot = slot;
5409 }
5410 
5411 static void
5412 bwn_intr_txeof(struct bwn_mac *mac)
5413 {
5414 	struct bwn_txstatus stat;
5415 	uint32_t stat0, stat1;
5416 	uint16_t tmp;
5417 
5418 	BWN_ASSERT_LOCKED(mac->mac_sc);
5419 
5420 	while (1) {
5421 		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5422 		if (!(stat0 & 0x00000001))
5423 			break;
5424 		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5425 
5426 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5427 		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5428 		    __func__,
5429 		    stat0,
5430 		    stat1);
5431 
5432 		stat.cookie = (stat0 >> 16);
5433 		stat.seq = (stat1 & 0x0000ffff);
5434 		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5435 		tmp = (stat0 & 0x0000ffff);
5436 		stat.framecnt = ((tmp & 0xf000) >> 12);
5437 		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5438 		stat.sreason = ((tmp & 0x001c) >> 2);
5439 		stat.pm = (tmp & 0x0080) ? 1 : 0;
5440 		stat.im = (tmp & 0x0040) ? 1 : 0;
5441 		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5442 		stat.ack = (tmp & 0x0002) ? 1 : 0;
5443 
5444 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5445 		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5446 		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5447 		    __func__,
5448 		    stat.cookie,
5449 		    stat.seq,
5450 		    stat.phy_stat,
5451 		    stat.framecnt,
5452 		    stat.rtscnt,
5453 		    stat.sreason,
5454 		    stat.pm,
5455 		    stat.im,
5456 		    stat.ampdu,
5457 		    stat.ack);
5458 
5459 		bwn_handle_txeof(mac, &stat);
5460 	}
5461 }
5462 
5463 static void
5464 bwn_hwreset(void *arg, int npending)
5465 {
5466 	struct bwn_mac *mac = arg;
5467 	struct bwn_softc *sc = mac->mac_sc;
5468 	int error = 0;
5469 	int prev_status;
5470 
5471 	BWN_LOCK(sc);
5472 
5473 	prev_status = mac->mac_status;
5474 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5475 		bwn_core_stop(mac);
5476 	if (prev_status >= BWN_MAC_STATUS_INITED)
5477 		bwn_core_exit(mac);
5478 
5479 	if (prev_status >= BWN_MAC_STATUS_INITED) {
5480 		error = bwn_core_init(mac);
5481 		if (error)
5482 			goto out;
5483 	}
5484 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5485 		bwn_core_start(mac);
5486 out:
5487 	if (error) {
5488 		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5489 		sc->sc_curmac = NULL;
5490 	}
5491 	BWN_UNLOCK(sc);
5492 }
5493 
5494 static void
5495 bwn_handle_fwpanic(struct bwn_mac *mac)
5496 {
5497 	struct bwn_softc *sc = mac->mac_sc;
5498 	uint16_t reason;
5499 
5500 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5501 	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5502 
5503 	if (reason == BWN_FWPANIC_RESTART)
5504 		bwn_restart(mac, "ucode panic");
5505 }
5506 
5507 static void
5508 bwn_load_beacon0(struct bwn_mac *mac)
5509 {
5510 
5511 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5512 }
5513 
5514 static void
5515 bwn_load_beacon1(struct bwn_mac *mac)
5516 {
5517 
5518 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5519 }
5520 
5521 static uint32_t
5522 bwn_jssi_read(struct bwn_mac *mac)
5523 {
5524 	uint32_t val = 0;
5525 
5526 	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5527 	val <<= 16;
5528 	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5529 
5530 	return (val);
5531 }
5532 
5533 static void
5534 bwn_noise_gensample(struct bwn_mac *mac)
5535 {
5536 	uint32_t jssi = 0x7f7f7f7f;
5537 
5538 	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5539 	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5540 	BWN_WRITE_4(mac, BWN_MACCMD,
5541 	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5542 }
5543 
5544 static int
5545 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5546 {
5547 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5548 
5549 	return (dr->dr_numslots - dr->dr_usedslot);
5550 }
5551 
5552 static int
5553 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5554 {
5555 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5556 
5557 	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5558 	    ("%s:%d: fail", __func__, __LINE__));
5559 	if (slot == dr->dr_numslots - 1)
5560 		return (0);
5561 	return (slot + 1);
5562 }
5563 
5564 static void
5565 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5566 {
5567 	struct bwn_mac *mac = dr->dr_mac;
5568 	struct bwn_softc *sc = mac->mac_sc;
5569 	struct bwn_dma *dma = &mac->mac_method.dma;
5570 	struct bwn_dmadesc_generic *desc;
5571 	struct bwn_dmadesc_meta *meta;
5572 	struct bwn_rxhdr4 *rxhdr;
5573 	struct mbuf *m;
5574 	uint32_t macstat;
5575 	int32_t tmp;
5576 	int cnt = 0;
5577 	uint16_t len;
5578 
5579 	dr->getdesc(dr, *slot, &desc, &meta);
5580 
5581 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5582 	m = meta->mt_m;
5583 
5584 	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5585 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5586 		return;
5587 	}
5588 
5589 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5590 	len = le16toh(rxhdr->frame_len);
5591 	if (len <= 0) {
5592 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5593 		return;
5594 	}
5595 	if (bwn_dma_check_redzone(dr, m)) {
5596 		device_printf(sc->sc_dev, "redzone error.\n");
5597 		bwn_dma_set_redzone(dr, m);
5598 		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5599 		    BUS_DMASYNC_PREWRITE);
5600 		return;
5601 	}
5602 	if (len > dr->dr_rx_bufsize) {
5603 		tmp = len;
5604 		while (1) {
5605 			dr->getdesc(dr, *slot, &desc, &meta);
5606 			bwn_dma_set_redzone(dr, meta->mt_m);
5607 			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5608 			    BUS_DMASYNC_PREWRITE);
5609 			*slot = bwn_dma_nextslot(dr, *slot);
5610 			cnt++;
5611 			tmp -= dr->dr_rx_bufsize;
5612 			if (tmp <= 0)
5613 				break;
5614 		}
5615 		device_printf(sc->sc_dev, "too small buffer "
5616 		       "(len %u buffer %u dropped %d)\n",
5617 		       len, dr->dr_rx_bufsize, cnt);
5618 		return;
5619 	}
5620 
5621 	switch (mac->mac_fw.fw_hdr_format) {
5622 	case BWN_FW_HDR_351:
5623 	case BWN_FW_HDR_410:
5624 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5625 		break;
5626 	case BWN_FW_HDR_598:
5627 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5628 		break;
5629 	}
5630 
5631 	if (macstat & BWN_RX_MAC_FCSERR) {
5632 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5633 			device_printf(sc->sc_dev, "RX drop\n");
5634 			return;
5635 		}
5636 	}
5637 
5638 	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5639 	m_adj(m, dr->dr_frameoffset);
5640 
5641 	bwn_rxeof(dr->dr_mac, m, rxhdr);
5642 }
5643 
5644 static void
5645 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5646 {
5647 	struct bwn_softc *sc = mac->mac_sc;
5648 	struct bwn_stats *stats = &mac->mac_stats;
5649 
5650 	BWN_ASSERT_LOCKED(mac->mac_sc);
5651 
5652 	if (status->im)
5653 		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5654 	if (status->ampdu)
5655 		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5656 	if (status->rtscnt) {
5657 		if (status->rtscnt == 0xf)
5658 			stats->rtsfail++;
5659 		else
5660 			stats->rts++;
5661 	}
5662 
5663 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5664 		bwn_dma_handle_txeof(mac, status);
5665 	} else {
5666 		bwn_pio_handle_txeof(mac, status);
5667 	}
5668 
5669 	bwn_phy_txpower_check(mac, 0);
5670 }
5671 
5672 static uint8_t
5673 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5674 {
5675 	struct bwn_mac *mac = prq->prq_mac;
5676 	struct bwn_softc *sc = mac->mac_sc;
5677 	struct bwn_rxhdr4 rxhdr;
5678 	struct mbuf *m;
5679 	uint32_t ctl32, macstat, v32;
5680 	unsigned int i, padding;
5681 	uint16_t ctl16, len, totlen, v16;
5682 	unsigned char *mp;
5683 	char *data;
5684 
5685 	memset(&rxhdr, 0, sizeof(rxhdr));
5686 
5687 	if (prq->prq_rev >= 8) {
5688 		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5689 		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5690 			return (0);
5691 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5692 		    BWN_PIO8_RXCTL_FRAMEREADY);
5693 		for (i = 0; i < 10; i++) {
5694 			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5695 			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5696 				goto ready;
5697 			DELAY(10);
5698 		}
5699 	} else {
5700 		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5701 		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5702 			return (0);
5703 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5704 		    BWN_PIO_RXCTL_FRAMEREADY);
5705 		for (i = 0; i < 10; i++) {
5706 			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5707 			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5708 				goto ready;
5709 			DELAY(10);
5710 		}
5711 	}
5712 	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5713 	return (1);
5714 ready:
5715 	if (prq->prq_rev >= 8) {
5716 		bus_read_multi_4(sc->sc_mem_res,
5717 		    prq->prq_base + BWN_PIO8_RXDATA, (void *)&rxhdr,
5718 		    sizeof(rxhdr));
5719 	} else {
5720 		bus_read_multi_2(sc->sc_mem_res,
5721 		    prq->prq_base + BWN_PIO_RXDATA, (void *)&rxhdr,
5722 		    sizeof(rxhdr));
5723 	}
5724 	len = le16toh(rxhdr.frame_len);
5725 	if (len > 0x700) {
5726 		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5727 		goto error;
5728 	}
5729 	if (len == 0) {
5730 		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5731 		goto error;
5732 	}
5733 
5734 	switch (mac->mac_fw.fw_hdr_format) {
5735 	case BWN_FW_HDR_351:
5736 	case BWN_FW_HDR_410:
5737 		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5738 		break;
5739 	case BWN_FW_HDR_598:
5740 		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5741 		break;
5742 	}
5743 
5744 	if (macstat & BWN_RX_MAC_FCSERR) {
5745 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5746 			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5747 			goto error;
5748 		}
5749 	}
5750 
5751 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5752 	totlen = len + padding;
5753 	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5754 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5755 	if (m == NULL) {
5756 		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5757 		goto error;
5758 	}
5759 	mp = mtod(m, unsigned char *);
5760 	if (prq->prq_rev >= 8) {
5761 		bus_read_multi_4(sc->sc_mem_res,
5762 		    prq->prq_base + BWN_PIO8_RXDATA, (void *)mp, (totlen & ~3));
5763 		if (totlen & 3) {
5764 			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5765 			data = &(mp[totlen - 1]);
5766 			switch (totlen & 3) {
5767 			case 3:
5768 				*data = (v32 >> 16);
5769 				data--;
5770 			case 2:
5771 				*data = (v32 >> 8);
5772 				data--;
5773 			case 1:
5774 				*data = v32;
5775 			}
5776 		}
5777 	} else {
5778 		bus_read_multi_2(sc->sc_mem_res,
5779 		    prq->prq_base + BWN_PIO_RXDATA, (void *)mp, (totlen & ~1));
5780 		if (totlen & 1) {
5781 			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5782 			mp[totlen - 1] = v16;
5783 		}
5784 	}
5785 
5786 	m->m_len = m->m_pkthdr.len = totlen;
5787 
5788 	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5789 
5790 	return (1);
5791 error:
5792 	if (prq->prq_rev >= 8)
5793 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5794 		    BWN_PIO8_RXCTL_DATAREADY);
5795 	else
5796 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5797 	return (1);
5798 }
5799 
5800 static int
5801 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5802     struct bwn_dmadesc_meta *meta, int init)
5803 {
5804 	struct bwn_mac *mac = dr->dr_mac;
5805 	struct bwn_dma *dma = &mac->mac_method.dma;
5806 	struct bwn_rxhdr4 *hdr;
5807 	bus_dmamap_t map;
5808 	bus_addr_t paddr;
5809 	struct mbuf *m;
5810 	int error;
5811 
5812 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5813 	if (m == NULL) {
5814 		error = ENOBUFS;
5815 
5816 		/*
5817 		 * If the NIC is up and running, we need to:
5818 		 * - Clear RX buffer's header.
5819 		 * - Restore RX descriptor settings.
5820 		 */
5821 		if (init)
5822 			return (error);
5823 		else
5824 			goto back;
5825 	}
5826 	m->m_len = m->m_pkthdr.len = MCLBYTES;
5827 
5828 	bwn_dma_set_redzone(dr, m);
5829 
5830 	/*
5831 	 * Try to load RX buf into temporary DMA map
5832 	 */
5833 	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5834 	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5835 	if (error) {
5836 		m_freem(m);
5837 
5838 		/*
5839 		 * See the comment above
5840 		 */
5841 		if (init)
5842 			return (error);
5843 		else
5844 			goto back;
5845 	}
5846 
5847 	if (!init)
5848 		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5849 	meta->mt_m = m;
5850 	meta->mt_paddr = paddr;
5851 
5852 	/*
5853 	 * Swap RX buf's DMA map with the loaded temporary one
5854 	 */
5855 	map = meta->mt_dmap;
5856 	meta->mt_dmap = dr->dr_spare_dmap;
5857 	dr->dr_spare_dmap = map;
5858 
5859 back:
5860 	/*
5861 	 * Clear RX buf header
5862 	 */
5863 	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5864 	bzero(hdr, sizeof(*hdr));
5865 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5866 	    BUS_DMASYNC_PREWRITE);
5867 
5868 	/*
5869 	 * Setup RX buf descriptor
5870 	 */
5871 	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5872 	    sizeof(*hdr), 0, 0, 0);
5873 	return (error);
5874 }
5875 
5876 static void
5877 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5878 		 bus_size_t mapsz __unused, int error)
5879 {
5880 
5881 	if (!error) {
5882 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5883 		*((bus_addr_t *)arg) = seg->ds_addr;
5884 	}
5885 }
5886 
5887 static int
5888 bwn_hwrate2ieeerate(int rate)
5889 {
5890 
5891 	switch (rate) {
5892 	case BWN_CCK_RATE_1MB:
5893 		return (2);
5894 	case BWN_CCK_RATE_2MB:
5895 		return (4);
5896 	case BWN_CCK_RATE_5MB:
5897 		return (11);
5898 	case BWN_CCK_RATE_11MB:
5899 		return (22);
5900 	case BWN_OFDM_RATE_6MB:
5901 		return (12);
5902 	case BWN_OFDM_RATE_9MB:
5903 		return (18);
5904 	case BWN_OFDM_RATE_12MB:
5905 		return (24);
5906 	case BWN_OFDM_RATE_18MB:
5907 		return (36);
5908 	case BWN_OFDM_RATE_24MB:
5909 		return (48);
5910 	case BWN_OFDM_RATE_36MB:
5911 		return (72);
5912 	case BWN_OFDM_RATE_48MB:
5913 		return (96);
5914 	case BWN_OFDM_RATE_54MB:
5915 		return (108);
5916 	default:
5917 		printf("Ooops\n");
5918 		return (0);
5919 	}
5920 }
5921 
5922 /*
5923  * Post process the RX provided RSSI.
5924  *
5925  * Valid for A, B, G, LP PHYs.
5926  */
5927 static int8_t
5928 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5929     int ofdm, int adjust_2053, int adjust_2050)
5930 {
5931 	struct bwn_phy *phy = &mac->mac_phy;
5932 	struct bwn_phy_g *gphy = &phy->phy_g;
5933 	int tmp;
5934 
5935 	switch (phy->rf_ver) {
5936 	case 0x2050:
5937 		if (ofdm) {
5938 			tmp = in_rssi;
5939 			if (tmp > 127)
5940 				tmp -= 256;
5941 			tmp = tmp * 73 / 64;
5942 			if (adjust_2050)
5943 				tmp += 25;
5944 			else
5945 				tmp -= 3;
5946 		} else {
5947 			if (mac->mac_sc->sc_board_info.board_flags
5948 			    & BHND_BFL_ADCDIV) {
5949 				if (in_rssi > 63)
5950 					in_rssi = 63;
5951 				tmp = gphy->pg_nrssi_lt[in_rssi];
5952 				tmp = (31 - tmp) * -131 / 128 - 57;
5953 			} else {
5954 				tmp = in_rssi;
5955 				tmp = (31 - tmp) * -149 / 128 - 68;
5956 			}
5957 			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5958 				tmp += 25;
5959 		}
5960 		break;
5961 	case 0x2060:
5962 		if (in_rssi > 127)
5963 			tmp = in_rssi - 256;
5964 		else
5965 			tmp = in_rssi;
5966 		break;
5967 	default:
5968 		tmp = in_rssi;
5969 		tmp = (tmp - 11) * 103 / 64;
5970 		if (adjust_2053)
5971 			tmp -= 109;
5972 		else
5973 			tmp -= 83;
5974 	}
5975 
5976 	return (tmp);
5977 }
5978 
5979 static void
5980 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5981 {
5982 	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5983 	struct bwn_plcp6 *plcp;
5984 	struct bwn_softc *sc = mac->mac_sc;
5985 	struct ieee80211_frame_min *wh;
5986 	struct ieee80211_node *ni;
5987 	struct ieee80211com *ic = &sc->sc_ic;
5988 	uint32_t macstat;
5989 	int padding, rate, rssi = 0, noise = 0, type;
5990 	uint16_t phytype, phystat0, phystat3, chanstat;
5991 	unsigned char *mp = mtod(m, unsigned char *);
5992 
5993 	BWN_ASSERT_LOCKED(sc);
5994 
5995 	phystat0 = le16toh(rxhdr->phy_status0);
5996 
5997 	/*
5998 	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5999 	 * used for LP-PHY.
6000 	 */
6001 	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
6002 
6003 	switch (mac->mac_fw.fw_hdr_format) {
6004 	case BWN_FW_HDR_351:
6005 	case BWN_FW_HDR_410:
6006 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
6007 		chanstat = le16toh(rxhdr->ps4.r351.channel);
6008 		break;
6009 	case BWN_FW_HDR_598:
6010 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
6011 		chanstat = le16toh(rxhdr->ps4.r598.channel);
6012 		break;
6013 	}
6014 
6015 
6016 	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
6017 
6018 	if (macstat & BWN_RX_MAC_FCSERR)
6019 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
6020 	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
6021 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
6022 	if (macstat & BWN_RX_MAC_DECERR)
6023 		goto drop;
6024 
6025 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
6026 	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
6027 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6028 		    m->m_pkthdr.len);
6029 		goto drop;
6030 	}
6031 	plcp = (struct bwn_plcp6 *)(mp + padding);
6032 	m_adj(m, sizeof(struct bwn_plcp6) + padding);
6033 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
6034 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
6035 		    m->m_pkthdr.len);
6036 		goto drop;
6037 	}
6038 	wh = mtod(m, struct ieee80211_frame_min *);
6039 
6040 	if (macstat & BWN_RX_MAC_DEC) {
6041 		DPRINTF(sc, BWN_DEBUG_HWCRYPTO,
6042 		    "RX decryption attempted (old %d keyidx %#x)\n",
6043 		    BWN_ISOLDFMT(mac),
6044 		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
6045 	}
6046 
6047 	if (phystat0 & BWN_RX_PHYST0_OFDM)
6048 		rate = bwn_plcp_get_ofdmrate(mac, plcp,
6049 		    phytype == BWN_PHYTYPE_A);
6050 	else
6051 		rate = bwn_plcp_get_cckrate(mac, plcp);
6052 	if (rate == -1) {
6053 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
6054 			goto drop;
6055 	}
6056 	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
6057 
6058 	/* rssi/noise */
6059 	switch (phytype) {
6060 	case BWN_PHYTYPE_A:
6061 	case BWN_PHYTYPE_B:
6062 	case BWN_PHYTYPE_G:
6063 	case BWN_PHYTYPE_LP:
6064 		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
6065 		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
6066 		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
6067 		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
6068 		break;
6069 	case BWN_PHYTYPE_N:
6070 		/* Broadcom has code for min/avg, but always used max */
6071 		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
6072 			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
6073 		else
6074 			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
6075 #if 0
6076 		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
6077 		    "%s: power0=%d, power1=%d, power2=%d\n",
6078 		    __func__,
6079 		    rxhdr->phy.n.power0,
6080 		    rxhdr->phy.n.power1,
6081 		    rxhdr->ps2.n.power2);
6082 #endif
6083 		break;
6084 	default:
6085 		/* XXX TODO: implement rssi for other PHYs */
6086 		break;
6087 	}
6088 
6089 	/*
6090 	 * RSSI here is absolute, not relative to the noise floor.
6091 	 */
6092 	noise = mac->mac_stats.link_noise;
6093 	rssi = rssi - noise;
6094 
6095 	/* RX radio tap */
6096 	if (ieee80211_radiotap_active(ic))
6097 		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
6098 	m_adj(m, -IEEE80211_CRC_LEN);
6099 
6100 	BWN_UNLOCK(sc);
6101 
6102 	ni = ieee80211_find_rxnode(ic, wh);
6103 	if (ni != NULL) {
6104 		type = ieee80211_input(ni, m, rssi, noise);
6105 		ieee80211_free_node(ni);
6106 	} else
6107 		type = ieee80211_input_all(ic, m, rssi, noise);
6108 
6109 	BWN_LOCK(sc);
6110 	return;
6111 drop:
6112 	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
6113 }
6114 
6115 static void
6116 bwn_ratectl_tx_complete(const struct ieee80211_node *ni,
6117     const struct bwn_txstatus *status)
6118 {
6119 	struct ieee80211_ratectl_tx_status txs;
6120 	int retrycnt = 0;
6121 
6122 	/*
6123 	 * If we don't get an ACK, then we should log the
6124 	 * full framecnt.  That may be 0 if it's a PHY
6125 	 * failure, so ensure that gets logged as some
6126 	 * retry attempt.
6127 	 */
6128 	txs.flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
6129 	if (status->ack) {
6130 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
6131 		retrycnt = status->framecnt - 1;
6132 	} else {
6133 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
6134 		retrycnt = status->framecnt;
6135 		if (retrycnt == 0)
6136 			retrycnt = 1;
6137 	}
6138 	txs.long_retries = retrycnt;
6139 	ieee80211_ratectl_tx_complete(ni, &txs);
6140 }
6141 
6142 static void
6143 bwn_dma_handle_txeof(struct bwn_mac *mac,
6144     const struct bwn_txstatus *status)
6145 {
6146 	struct bwn_dma *dma = &mac->mac_method.dma;
6147 	struct bwn_dma_ring *dr;
6148 	struct bwn_dmadesc_generic *desc;
6149 	struct bwn_dmadesc_meta *meta;
6150 	struct bwn_softc *sc = mac->mac_sc;
6151 	int slot;
6152 
6153 	BWN_ASSERT_LOCKED(sc);
6154 
6155 	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
6156 	if (dr == NULL) {
6157 		device_printf(sc->sc_dev, "failed to parse cookie\n");
6158 		return;
6159 	}
6160 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6161 
6162 	while (1) {
6163 		KASSERT(slot >= 0 && slot < dr->dr_numslots,
6164 		    ("%s:%d: fail", __func__, __LINE__));
6165 		dr->getdesc(dr, slot, &desc, &meta);
6166 
6167 		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
6168 			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
6169 		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
6170 			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
6171 
6172 		if (meta->mt_islast) {
6173 			KASSERT(meta->mt_m != NULL,
6174 			    ("%s:%d: fail", __func__, __LINE__));
6175 
6176 			bwn_ratectl_tx_complete(meta->mt_ni, status);
6177 			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
6178 			meta->mt_ni = NULL;
6179 			meta->mt_m = NULL;
6180 		} else
6181 			KASSERT(meta->mt_m == NULL,
6182 			    ("%s:%d: fail", __func__, __LINE__));
6183 
6184 		dr->dr_usedslot--;
6185 		if (meta->mt_islast)
6186 			break;
6187 		slot = bwn_dma_nextslot(dr, slot);
6188 	}
6189 	sc->sc_watchdog_timer = 0;
6190 	if (dr->dr_stop) {
6191 		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
6192 		    ("%s:%d: fail", __func__, __LINE__));
6193 		dr->dr_stop = 0;
6194 	}
6195 }
6196 
6197 static void
6198 bwn_pio_handle_txeof(struct bwn_mac *mac,
6199     const struct bwn_txstatus *status)
6200 {
6201 	struct bwn_pio_txqueue *tq;
6202 	struct bwn_pio_txpkt *tp = NULL;
6203 	struct bwn_softc *sc = mac->mac_sc;
6204 
6205 	BWN_ASSERT_LOCKED(sc);
6206 
6207 	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
6208 	if (tq == NULL)
6209 		return;
6210 
6211 	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
6212 	tq->tq_free++;
6213 
6214 	if (tp->tp_ni != NULL) {
6215 		/*
6216 		 * Do any tx complete callback.  Note this must
6217 		 * be done before releasing the node reference.
6218 		 */
6219 		bwn_ratectl_tx_complete(tp->tp_ni, status);
6220 	}
6221 	ieee80211_tx_complete(tp->tp_ni, tp->tp_m, 0);
6222 	tp->tp_ni = NULL;
6223 	tp->tp_m = NULL;
6224 	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6225 
6226 	sc->sc_watchdog_timer = 0;
6227 }
6228 
6229 static void
6230 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6231 {
6232 	struct bwn_softc *sc = mac->mac_sc;
6233 	struct bwn_phy *phy = &mac->mac_phy;
6234 	struct ieee80211com *ic = &sc->sc_ic;
6235 	unsigned long now;
6236 	bwn_txpwr_result_t result;
6237 
6238 	BWN_GETTIME(now);
6239 
6240 	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6241 		return;
6242 	phy->nexttime = now + 2 * 1000;
6243 
6244 	if (sc->sc_board_info.board_vendor == PCI_VENDOR_BROADCOM &&
6245 	    sc->sc_board_info.board_type == BHND_BOARD_BU4306)
6246 		return;
6247 
6248 	if (phy->recalc_txpwr != NULL) {
6249 		result = phy->recalc_txpwr(mac,
6250 		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6251 		if (result == BWN_TXPWR_RES_DONE)
6252 			return;
6253 		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6254 		    ("%s: fail", __func__));
6255 		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6256 
6257 		ieee80211_runtask(ic, &mac->mac_txpower);
6258 	}
6259 }
6260 
6261 static uint16_t
6262 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6263 {
6264 
6265 	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6266 }
6267 
6268 static uint32_t
6269 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6270 {
6271 
6272 	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6273 }
6274 
6275 static void
6276 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6277 {
6278 
6279 	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6280 }
6281 
6282 static void
6283 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6284 {
6285 
6286 	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6287 }
6288 
6289 static int
6290 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6291 {
6292 
6293 	switch (rate) {
6294 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6295 	case 12:
6296 		return (BWN_OFDM_RATE_6MB);
6297 	case 18:
6298 		return (BWN_OFDM_RATE_9MB);
6299 	case 24:
6300 		return (BWN_OFDM_RATE_12MB);
6301 	case 36:
6302 		return (BWN_OFDM_RATE_18MB);
6303 	case 48:
6304 		return (BWN_OFDM_RATE_24MB);
6305 	case 72:
6306 		return (BWN_OFDM_RATE_36MB);
6307 	case 96:
6308 		return (BWN_OFDM_RATE_48MB);
6309 	case 108:
6310 		return (BWN_OFDM_RATE_54MB);
6311 	/* CCK rates (NB: not IEEE std, device-specific) */
6312 	case 2:
6313 		return (BWN_CCK_RATE_1MB);
6314 	case 4:
6315 		return (BWN_CCK_RATE_2MB);
6316 	case 11:
6317 		return (BWN_CCK_RATE_5MB);
6318 	case 22:
6319 		return (BWN_CCK_RATE_11MB);
6320 	}
6321 
6322 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6323 	return (BWN_CCK_RATE_1MB);
6324 }
6325 
6326 static uint16_t
6327 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6328 {
6329 	struct bwn_phy *phy = &mac->mac_phy;
6330 	uint16_t control = 0;
6331 	uint16_t bw;
6332 
6333 	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6334 	bw = BWN_TXH_PHY1_BW_20;
6335 
6336 	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6337 		control = bw;
6338 	} else {
6339 		control = bw;
6340 		/* Figure out coding rate and modulation */
6341 		/* XXX TODO: table-ize, for MCS transmit */
6342 		/* Note: this is BWN_*_RATE values */
6343 		switch (bitrate) {
6344 		case BWN_CCK_RATE_1MB:
6345 			control |= 0;
6346 			break;
6347 		case BWN_CCK_RATE_2MB:
6348 			control |= 1;
6349 			break;
6350 		case BWN_CCK_RATE_5MB:
6351 			control |= 2;
6352 			break;
6353 		case BWN_CCK_RATE_11MB:
6354 			control |= 3;
6355 			break;
6356 		case BWN_OFDM_RATE_6MB:
6357 			control |= BWN_TXH_PHY1_CRATE_1_2;
6358 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6359 			break;
6360 		case BWN_OFDM_RATE_9MB:
6361 			control |= BWN_TXH_PHY1_CRATE_3_4;
6362 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6363 			break;
6364 		case BWN_OFDM_RATE_12MB:
6365 			control |= BWN_TXH_PHY1_CRATE_1_2;
6366 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6367 			break;
6368 		case BWN_OFDM_RATE_18MB:
6369 			control |= BWN_TXH_PHY1_CRATE_3_4;
6370 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6371 			break;
6372 		case BWN_OFDM_RATE_24MB:
6373 			control |= BWN_TXH_PHY1_CRATE_1_2;
6374 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6375 			break;
6376 		case BWN_OFDM_RATE_36MB:
6377 			control |= BWN_TXH_PHY1_CRATE_3_4;
6378 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6379 			break;
6380 		case BWN_OFDM_RATE_48MB:
6381 			control |= BWN_TXH_PHY1_CRATE_1_2;
6382 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6383 			break;
6384 		case BWN_OFDM_RATE_54MB:
6385 			control |= BWN_TXH_PHY1_CRATE_3_4;
6386 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6387 			break;
6388 		default:
6389 			break;
6390 		}
6391 		control |= BWN_TXH_PHY1_MODE_SISO;
6392 	}
6393 
6394 	return control;
6395 }
6396 
6397 static int
6398 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6399     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6400 {
6401 	const struct bwn_phy *phy = &mac->mac_phy;
6402 	struct bwn_softc *sc = mac->mac_sc;
6403 	struct ieee80211_frame *wh;
6404 	struct ieee80211_frame *protwh;
6405 	const struct ieee80211_txparam *tp = ni->ni_txparms;
6406 	struct ieee80211vap *vap = ni->ni_vap;
6407 	struct ieee80211com *ic = &sc->sc_ic;
6408 	struct mbuf *mprot;
6409 	uint8_t *prot_ptr;
6410 	unsigned int len;
6411 	uint32_t macctl = 0;
6412 	int rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6413 	uint16_t phyctl = 0;
6414 	uint8_t rate, rate_fb;
6415 	int fill_phy_ctl1 = 0;
6416 
6417 	wh = mtod(m, struct ieee80211_frame *);
6418 	memset(txhdr, 0, sizeof(*txhdr));
6419 
6420 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6421 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6422 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6423 
6424 	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6425 	    || (phy->type == BWN_PHYTYPE_HT))
6426 		fill_phy_ctl1 = 1;
6427 
6428 	/*
6429 	 * Find TX rate
6430 	 */
6431 	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6432 		rate = rate_fb = tp->mgmtrate;
6433 	else if (ismcast)
6434 		rate = rate_fb = tp->mcastrate;
6435 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6436 		rate = rate_fb = tp->ucastrate;
6437 	else {
6438 		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6439 		rate = ni->ni_txrate;
6440 
6441 		if (rix > 0)
6442 			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6443 			    IEEE80211_RATE_VAL;
6444 		else
6445 			rate_fb = rate;
6446 	}
6447 
6448 	sc->sc_tx_rate = rate;
6449 
6450 	/* Note: this maps the select ieee80211 rate to hardware rate */
6451 	rate = bwn_ieeerate2hwrate(sc, rate);
6452 	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6453 
6454 	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6455 	    bwn_plcp_getcck(rate);
6456 	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6457 	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6458 
6459 	/* XXX rate/rate_fb is the hardware rate */
6460 	if ((rate_fb == rate) ||
6461 	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6462 	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6463 		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6464 	else
6465 		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6466 		    m->m_pkthdr.len, rate, isshort);
6467 
6468 	/* XXX TX encryption */
6469 
6470 	switch (mac->mac_fw.fw_hdr_format) {
6471 	case BWN_FW_HDR_351:
6472 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6473 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6474 		break;
6475 	case BWN_FW_HDR_410:
6476 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6477 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6478 		break;
6479 	case BWN_FW_HDR_598:
6480 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6481 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6482 		break;
6483 	}
6484 
6485 	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6486 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6487 
6488 	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6489 	    BWN_TX_EFT_FB_CCK;
6490 	txhdr->chan = phy->chan;
6491 	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6492 	    BWN_TX_PHY_ENC_CCK;
6493 	/* XXX preamble? obey net80211 */
6494 	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6495 	     rate == BWN_CCK_RATE_11MB))
6496 		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6497 
6498 	if (! phy->gmode)
6499 		macctl |= BWN_TX_MAC_5GHZ;
6500 
6501 	/* XXX TX antenna selection */
6502 
6503 	switch (bwn_antenna_sanitize(mac, 0)) {
6504 	case 0:
6505 		phyctl |= BWN_TX_PHY_ANT01AUTO;
6506 		break;
6507 	case 1:
6508 		phyctl |= BWN_TX_PHY_ANT0;
6509 		break;
6510 	case 2:
6511 		phyctl |= BWN_TX_PHY_ANT1;
6512 		break;
6513 	case 3:
6514 		phyctl |= BWN_TX_PHY_ANT2;
6515 		break;
6516 	case 4:
6517 		phyctl |= BWN_TX_PHY_ANT3;
6518 		break;
6519 	default:
6520 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6521 	}
6522 
6523 	if (!ismcast)
6524 		macctl |= BWN_TX_MAC_ACK;
6525 
6526 	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6527 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6528 	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6529 		macctl |= BWN_TX_MAC_LONGFRAME;
6530 
6531 	if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
6532 	    ic->ic_protmode != IEEE80211_PROT_NONE) {
6533 		/* Note: don't fall back to CCK rates for 5G */
6534 		if (phy->gmode)
6535 			rts_rate = BWN_CCK_RATE_1MB;
6536 		else
6537 			rts_rate = BWN_OFDM_RATE_6MB;
6538 		rts_rate_fb = bwn_get_fbrate(rts_rate);
6539 
6540 		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6541 		mprot = ieee80211_alloc_prot(ni, m, rate, ic->ic_protmode);
6542 		if (mprot == NULL) {
6543 			if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
6544 			device_printf(sc->sc_dev,
6545 			    "could not allocate mbuf for protection mode %d\n",
6546 			    ic->ic_protmode);
6547 			return (ENOBUFS);
6548 		}
6549 
6550 		switch (mac->mac_fw.fw_hdr_format) {
6551 		case BWN_FW_HDR_351:
6552 			prot_ptr = txhdr->body.r351.rts_frame;
6553 			break;
6554 		case BWN_FW_HDR_410:
6555 			prot_ptr = txhdr->body.r410.rts_frame;
6556 			break;
6557 		case BWN_FW_HDR_598:
6558 			prot_ptr = txhdr->body.r598.rts_frame;
6559 			break;
6560 		}
6561 
6562 		bcopy(mtod(mprot, uint8_t *), prot_ptr, mprot->m_pkthdr.len);
6563 		m_freem(mprot);
6564 
6565 		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6566 			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6567 			len = sizeof(struct ieee80211_frame_cts);
6568 		} else {
6569 			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6570 			len = sizeof(struct ieee80211_frame_rts);
6571 		}
6572 		len += IEEE80211_CRC_LEN;
6573 
6574 		switch (mac->mac_fw.fw_hdr_format) {
6575 		case BWN_FW_HDR_351:
6576 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6577 			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6578 			break;
6579 		case BWN_FW_HDR_410:
6580 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6581 			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6582 			break;
6583 		case BWN_FW_HDR_598:
6584 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6585 			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6586 			break;
6587 		}
6588 
6589 		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6590 		    rts_rate_fb);
6591 
6592 		switch (mac->mac_fw.fw_hdr_format) {
6593 		case BWN_FW_HDR_351:
6594 			protwh = (struct ieee80211_frame *)
6595 			    &txhdr->body.r351.rts_frame;
6596 			break;
6597 		case BWN_FW_HDR_410:
6598 			protwh = (struct ieee80211_frame *)
6599 			    &txhdr->body.r410.rts_frame;
6600 			break;
6601 		case BWN_FW_HDR_598:
6602 			protwh = (struct ieee80211_frame *)
6603 			    &txhdr->body.r598.rts_frame;
6604 			break;
6605 		}
6606 
6607 		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6608 
6609 		if (BWN_ISOFDMRATE(rts_rate)) {
6610 			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6611 			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6612 		} else {
6613 			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6614 			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6615 		}
6616 		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6617 		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6618 
6619 		if (fill_phy_ctl1) {
6620 			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6621 			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6622 		}
6623 	}
6624 
6625 	if (fill_phy_ctl1) {
6626 		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6627 		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6628 	}
6629 
6630 	switch (mac->mac_fw.fw_hdr_format) {
6631 	case BWN_FW_HDR_351:
6632 		txhdr->body.r351.cookie = htole16(cookie);
6633 		break;
6634 	case BWN_FW_HDR_410:
6635 		txhdr->body.r410.cookie = htole16(cookie);
6636 		break;
6637 	case BWN_FW_HDR_598:
6638 		txhdr->body.r598.cookie = htole16(cookie);
6639 		break;
6640 	}
6641 
6642 	txhdr->macctl = htole32(macctl);
6643 	txhdr->phyctl = htole16(phyctl);
6644 
6645 	/*
6646 	 * TX radio tap
6647 	 */
6648 	if (ieee80211_radiotap_active_vap(vap)) {
6649 		sc->sc_tx_th.wt_flags = 0;
6650 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6651 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6652 		if (isshort &&
6653 		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6654 		     rate == BWN_CCK_RATE_11MB))
6655 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6656 		sc->sc_tx_th.wt_rate = rate;
6657 
6658 		ieee80211_radiotap_tx(vap, m);
6659 	}
6660 
6661 	return (0);
6662 }
6663 
6664 static void
6665 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6666     const uint8_t rate)
6667 {
6668 	uint32_t d, plen;
6669 	uint8_t *raw = plcp->o.raw;
6670 
6671 	if (BWN_ISOFDMRATE(rate)) {
6672 		d = bwn_plcp_getofdm(rate);
6673 		KASSERT(!(octets & 0xf000),
6674 		    ("%s:%d: fail", __func__, __LINE__));
6675 		d |= (octets << 5);
6676 		plcp->o.data = htole32(d);
6677 	} else {
6678 		plen = octets * 16 / rate;
6679 		if ((octets * 16 % rate) > 0) {
6680 			plen++;
6681 			if ((rate == BWN_CCK_RATE_11MB)
6682 			    && ((octets * 8 % 11) < 4)) {
6683 				raw[1] = 0x84;
6684 			} else
6685 				raw[1] = 0x04;
6686 		} else
6687 			raw[1] = 0x04;
6688 		plcp->o.data |= htole32(plen << 16);
6689 		raw[0] = bwn_plcp_getcck(rate);
6690 	}
6691 }
6692 
6693 static uint8_t
6694 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6695 {
6696 	struct bwn_softc *sc = mac->mac_sc;
6697 	uint8_t mask;
6698 
6699 	if (n == 0)
6700 		return (0);
6701 	if (mac->mac_phy.gmode)
6702 		mask = sc->sc_ant2g;
6703 	else
6704 		mask = sc->sc_ant5g;
6705 	if (!(mask & (1 << (n - 1))))
6706 		return (0);
6707 	return (n);
6708 }
6709 
6710 /*
6711  * Return a fallback rate for the given rate.
6712  *
6713  * Note: Don't fall back from OFDM to CCK.
6714  */
6715 static uint8_t
6716 bwn_get_fbrate(uint8_t bitrate)
6717 {
6718 	switch (bitrate) {
6719 	/* CCK */
6720 	case BWN_CCK_RATE_1MB:
6721 		return (BWN_CCK_RATE_1MB);
6722 	case BWN_CCK_RATE_2MB:
6723 		return (BWN_CCK_RATE_1MB);
6724 	case BWN_CCK_RATE_5MB:
6725 		return (BWN_CCK_RATE_2MB);
6726 	case BWN_CCK_RATE_11MB:
6727 		return (BWN_CCK_RATE_5MB);
6728 
6729 	/* OFDM */
6730 	case BWN_OFDM_RATE_6MB:
6731 		return (BWN_OFDM_RATE_6MB);
6732 	case BWN_OFDM_RATE_9MB:
6733 		return (BWN_OFDM_RATE_6MB);
6734 	case BWN_OFDM_RATE_12MB:
6735 		return (BWN_OFDM_RATE_9MB);
6736 	case BWN_OFDM_RATE_18MB:
6737 		return (BWN_OFDM_RATE_12MB);
6738 	case BWN_OFDM_RATE_24MB:
6739 		return (BWN_OFDM_RATE_18MB);
6740 	case BWN_OFDM_RATE_36MB:
6741 		return (BWN_OFDM_RATE_24MB);
6742 	case BWN_OFDM_RATE_48MB:
6743 		return (BWN_OFDM_RATE_36MB);
6744 	case BWN_OFDM_RATE_54MB:
6745 		return (BWN_OFDM_RATE_48MB);
6746 	}
6747 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6748 	return (0);
6749 }
6750 
6751 static uint32_t
6752 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6753     uint32_t ctl, const void *_data, int len)
6754 {
6755 	struct bwn_softc *sc = mac->mac_sc;
6756 	uint32_t value = 0;
6757 	const uint8_t *data = _data;
6758 
6759 	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6760 	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6761 	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6762 
6763 	bus_write_multi_4(sc->sc_mem_res, tq->tq_base + BWN_PIO8_TXDATA,
6764 	    __DECONST(void *, data), (len & ~3));
6765 	if (len & 3) {
6766 		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6767 		    BWN_PIO8_TXCTL_24_31);
6768 		data = &(data[len - 1]);
6769 		switch (len & 3) {
6770 		case 3:
6771 			ctl |= BWN_PIO8_TXCTL_16_23;
6772 			value |= (uint32_t)(*data) << 16;
6773 			data--;
6774 		case 2:
6775 			ctl |= BWN_PIO8_TXCTL_8_15;
6776 			value |= (uint32_t)(*data) << 8;
6777 			data--;
6778 		case 1:
6779 			value |= (uint32_t)(*data);
6780 		}
6781 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6782 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6783 	}
6784 
6785 	return (ctl);
6786 }
6787 
6788 static void
6789 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6790     uint16_t offset, uint32_t value)
6791 {
6792 
6793 	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6794 }
6795 
6796 static uint16_t
6797 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6798     uint16_t ctl, const void *_data, int len)
6799 {
6800 	struct bwn_softc *sc = mac->mac_sc;
6801 	const uint8_t *data = _data;
6802 
6803 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6804 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6805 
6806 	bus_write_multi_2(sc->sc_mem_res, tq->tq_base + BWN_PIO_TXDATA,
6807 	    __DECONST(void *, data), (len & ~1));
6808 	if (len & 1) {
6809 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6810 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6811 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6812 	}
6813 
6814 	return (ctl);
6815 }
6816 
6817 static uint16_t
6818 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6819     uint16_t ctl, struct mbuf *m0)
6820 {
6821 	int i, j = 0;
6822 	uint16_t data = 0;
6823 	const uint8_t *buf;
6824 	struct mbuf *m = m0;
6825 
6826 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6827 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6828 
6829 	for (; m != NULL; m = m->m_next) {
6830 		buf = mtod(m, const uint8_t *);
6831 		for (i = 0; i < m->m_len; i++) {
6832 			if (!((j++) % 2))
6833 				data |= buf[i];
6834 			else {
6835 				data |= (buf[i] << 8);
6836 				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6837 				data = 0;
6838 			}
6839 		}
6840 	}
6841 	if (m0->m_pkthdr.len % 2) {
6842 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6843 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6844 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6845 	}
6846 
6847 	return (ctl);
6848 }
6849 
6850 static void
6851 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6852 {
6853 
6854 	/* XXX should exit if 5GHz band .. */
6855 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6856 		return;
6857 
6858 	BWN_WRITE_2(mac, 0x684, 510 + time);
6859 	/* Disabled in Linux b43, can adversely effect performance */
6860 #if 0
6861 	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6862 #endif
6863 }
6864 
6865 static struct bwn_dma_ring *
6866 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6867 {
6868 
6869 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6870 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6871 
6872 	switch (prio) {
6873 	case 3:
6874 		return (mac->mac_method.dma.wme[WME_AC_VO]);
6875 	case 2:
6876 		return (mac->mac_method.dma.wme[WME_AC_VI]);
6877 	case 0:
6878 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6879 	case 1:
6880 		return (mac->mac_method.dma.wme[WME_AC_BK]);
6881 	}
6882 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6883 	return (NULL);
6884 }
6885 
6886 static int
6887 bwn_dma_getslot(struct bwn_dma_ring *dr)
6888 {
6889 	int slot;
6890 
6891 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6892 
6893 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6894 	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6895 	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6896 
6897 	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6898 	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6899 	dr->dr_curslot = slot;
6900 	dr->dr_usedslot++;
6901 
6902 	return (slot);
6903 }
6904 
6905 static struct bwn_pio_txqueue *
6906 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6907     struct bwn_pio_txpkt **pack)
6908 {
6909 	struct bwn_pio *pio = &mac->mac_method.pio;
6910 	struct bwn_pio_txqueue *tq = NULL;
6911 	unsigned int index;
6912 
6913 	switch (cookie & 0xf000) {
6914 	case 0x1000:
6915 		tq = &pio->wme[WME_AC_BK];
6916 		break;
6917 	case 0x2000:
6918 		tq = &pio->wme[WME_AC_BE];
6919 		break;
6920 	case 0x3000:
6921 		tq = &pio->wme[WME_AC_VI];
6922 		break;
6923 	case 0x4000:
6924 		tq = &pio->wme[WME_AC_VO];
6925 		break;
6926 	case 0x5000:
6927 		tq = &pio->mcast;
6928 		break;
6929 	}
6930 	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6931 	if (tq == NULL)
6932 		return (NULL);
6933 	index = (cookie & 0x0fff);
6934 	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6935 	if (index >= N(tq->tq_pkts))
6936 		return (NULL);
6937 	*pack = &tq->tq_pkts[index];
6938 	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6939 	return (tq);
6940 }
6941 
6942 static void
6943 bwn_txpwr(void *arg, int npending)
6944 {
6945 	struct bwn_mac *mac = arg;
6946 	struct bwn_softc *sc;
6947 
6948 	if (mac == NULL)
6949 		return;
6950 
6951 	sc = mac->mac_sc;
6952 
6953 	BWN_LOCK(sc);
6954 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6955 	    mac->mac_phy.set_txpwr != NULL)
6956 		mac->mac_phy.set_txpwr(mac);
6957 	BWN_UNLOCK(sc);
6958 }
6959 
6960 static void
6961 bwn_task_15s(struct bwn_mac *mac)
6962 {
6963 	uint16_t reg;
6964 
6965 	if (mac->mac_fw.opensource) {
6966 		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6967 		if (reg) {
6968 			bwn_restart(mac, "fw watchdog");
6969 			return;
6970 		}
6971 		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6972 	}
6973 	if (mac->mac_phy.task_15s)
6974 		mac->mac_phy.task_15s(mac);
6975 
6976 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6977 }
6978 
6979 static void
6980 bwn_task_30s(struct bwn_mac *mac)
6981 {
6982 
6983 	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6984 		return;
6985 	mac->mac_noise.noi_running = 1;
6986 	mac->mac_noise.noi_nsamples = 0;
6987 
6988 	bwn_noise_gensample(mac);
6989 }
6990 
6991 static void
6992 bwn_task_60s(struct bwn_mac *mac)
6993 {
6994 
6995 	if (mac->mac_phy.task_60s)
6996 		mac->mac_phy.task_60s(mac);
6997 	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6998 }
6999 
7000 static void
7001 bwn_tasks(void *arg)
7002 {
7003 	struct bwn_mac *mac = arg;
7004 	struct bwn_softc *sc = mac->mac_sc;
7005 
7006 	BWN_ASSERT_LOCKED(sc);
7007 	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
7008 		return;
7009 
7010 	if (mac->mac_task_state % 4 == 0)
7011 		bwn_task_60s(mac);
7012 	if (mac->mac_task_state % 2 == 0)
7013 		bwn_task_30s(mac);
7014 	bwn_task_15s(mac);
7015 
7016 	mac->mac_task_state++;
7017 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
7018 }
7019 
7020 static int
7021 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
7022 {
7023 	struct bwn_softc *sc = mac->mac_sc;
7024 
7025 	KASSERT(a == 0, ("not support APHY\n"));
7026 
7027 	switch (plcp->o.raw[0] & 0xf) {
7028 	case 0xb:
7029 		return (BWN_OFDM_RATE_6MB);
7030 	case 0xf:
7031 		return (BWN_OFDM_RATE_9MB);
7032 	case 0xa:
7033 		return (BWN_OFDM_RATE_12MB);
7034 	case 0xe:
7035 		return (BWN_OFDM_RATE_18MB);
7036 	case 0x9:
7037 		return (BWN_OFDM_RATE_24MB);
7038 	case 0xd:
7039 		return (BWN_OFDM_RATE_36MB);
7040 	case 0x8:
7041 		return (BWN_OFDM_RATE_48MB);
7042 	case 0xc:
7043 		return (BWN_OFDM_RATE_54MB);
7044 	}
7045 	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
7046 	    plcp->o.raw[0] & 0xf);
7047 	return (-1);
7048 }
7049 
7050 static int
7051 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
7052 {
7053 	struct bwn_softc *sc = mac->mac_sc;
7054 
7055 	switch (plcp->o.raw[0]) {
7056 	case 0x0a:
7057 		return (BWN_CCK_RATE_1MB);
7058 	case 0x14:
7059 		return (BWN_CCK_RATE_2MB);
7060 	case 0x37:
7061 		return (BWN_CCK_RATE_5MB);
7062 	case 0x6e:
7063 		return (BWN_CCK_RATE_11MB);
7064 	}
7065 	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
7066 	return (-1);
7067 }
7068 
7069 static void
7070 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
7071     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
7072     int rssi, int noise)
7073 {
7074 	struct bwn_softc *sc = mac->mac_sc;
7075 	const struct ieee80211_frame_min *wh;
7076 	uint64_t tsf;
7077 	uint16_t low_mactime_now;
7078 	uint16_t mt;
7079 
7080 	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
7081 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7082 
7083 	wh = mtod(m, const struct ieee80211_frame_min *);
7084 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
7085 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
7086 
7087 	bwn_tsf_read(mac, &tsf);
7088 	low_mactime_now = tsf;
7089 	tsf = tsf & ~0xffffULL;
7090 
7091 	switch (mac->mac_fw.fw_hdr_format) {
7092 	case BWN_FW_HDR_351:
7093 	case BWN_FW_HDR_410:
7094 		mt = le16toh(rxhdr->ps4.r351.mac_time);
7095 		break;
7096 	case BWN_FW_HDR_598:
7097 		mt = le16toh(rxhdr->ps4.r598.mac_time);
7098 		break;
7099 	}
7100 
7101 	tsf += mt;
7102 	if (low_mactime_now < mt)
7103 		tsf -= 0x10000;
7104 
7105 	sc->sc_rx_th.wr_tsf = tsf;
7106 	sc->sc_rx_th.wr_rate = rate;
7107 	sc->sc_rx_th.wr_antsignal = rssi;
7108 	sc->sc_rx_th.wr_antnoise = noise;
7109 }
7110 
7111 static void
7112 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
7113 {
7114 	uint32_t low, high;
7115 
7116 	KASSERT(bhnd_get_hwrev(mac->mac_sc->sc_dev) >= 3,
7117 	    ("%s:%d: fail", __func__, __LINE__));
7118 
7119 	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
7120 	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
7121 	*tsf = high;
7122 	*tsf <<= 32;
7123 	*tsf |= low;
7124 }
7125 
7126 static int
7127 bwn_dma_attach(struct bwn_mac *mac)
7128 {
7129 	struct bwn_dma			*dma;
7130 	struct bwn_softc		*sc;
7131 	struct bhnd_dma_translation	*dt, dma_translation;
7132 	bhnd_addr_t			 addrext_req;
7133 	bus_dma_tag_t			 dmat;
7134 	bus_addr_t			 lowaddr;
7135 	u_int				 addrext_shift, addr_width;
7136 	int				 error;
7137 
7138 	dma = &mac->mac_method.dma;
7139 	sc = mac->mac_sc;
7140 	dt = NULL;
7141 
7142 	if (sc->sc_quirks & BWN_QUIRK_NODMA)
7143 		return (0);
7144 
7145 	KASSERT(bhnd_get_hwrev(sc->sc_dev) >= 5, ("%s: fail", __func__));
7146 
7147 	/* Use the DMA engine's maximum host address width to determine the
7148 	 * addrext constraints, and supported device address width. */
7149 	switch (mac->mac_dmatype) {
7150 	case BHND_DMA_ADDR_30BIT:
7151 		/* 32-bit engine without addrext support */
7152 		addrext_req = 0x0;
7153 		addrext_shift = 0;
7154 
7155 		/* We can address the full 32-bit device address space */
7156 		addr_width = BHND_DMA_ADDR_32BIT;
7157 		break;
7158 
7159 	case BHND_DMA_ADDR_32BIT:
7160 		/* 32-bit engine with addrext support */
7161 		addrext_req = BWN_DMA32_ADDREXT_MASK;
7162 		addrext_shift = BWN_DMA32_ADDREXT_SHIFT;
7163 		addr_width = BHND_DMA_ADDR_32BIT;
7164 		break;
7165 
7166 	case BHND_DMA_ADDR_64BIT:
7167 		/* 64-bit engine with addrext support */
7168 		addrext_req = BWN_DMA64_ADDREXT_MASK;
7169 		addrext_shift = BWN_DMA64_ADDREXT_SHIFT;
7170 		addr_width = BHND_DMA_ADDR_64BIT;
7171 		break;
7172 
7173 	default:
7174 		device_printf(sc->sc_dev, "unsupported DMA address width: %d\n",
7175 		    mac->mac_dmatype);
7176 		return (ENXIO);
7177 	}
7178 
7179 
7180 	/* Fetch our device->host DMA translation and tag */
7181 	error = bhnd_get_dma_translation(sc->sc_dev, addr_width, 0, &dmat,
7182 	    &dma_translation);
7183 	if (error) {
7184 		device_printf(sc->sc_dev, "error fetching DMA translation: "
7185 		    "%d\n", error);
7186 		return (error);
7187 	}
7188 
7189 	/* Verify that our DMA engine's addrext constraints are compatible with
7190 	 * our DMA translation */
7191 	if (addrext_req != 0x0 &&
7192 	    (dma_translation.addrext_mask & addrext_req) != addrext_req)
7193 	{
7194 		device_printf(sc->sc_dev, "bus addrext mask %#jx incompatible "
7195 		    "with device addrext mask %#jx, disabling extended address "
7196 		    "support\n", (uintmax_t)dma_translation.addrext_mask,
7197 		    (uintmax_t)addrext_req);
7198 
7199 		addrext_req = 0x0;
7200 		addrext_shift = 0;
7201 	}
7202 
7203 	/* Apply our addrext translation constraint */
7204 	dma_translation.addrext_mask = addrext_req;
7205 
7206 	/* Initialize our DMA engine configuration */
7207 	mac->mac_flags |= BWN_MAC_FLAG_DMA;
7208 
7209 	dma->addrext_shift = addrext_shift;
7210 	dma->translation = dma_translation;
7211 
7212 	dt = &dma->translation;
7213 
7214 	/* Dermine our translation's maximum supported address */
7215 	lowaddr = MIN((dt->addr_mask | dt->addrext_mask), BUS_SPACE_MAXADDR);
7216 
7217 	/*
7218 	 * Create top level DMA tag
7219 	 */
7220 	error = bus_dma_tag_create(dmat,		/* parent */
7221 			       BWN_ALIGN, 0,		/* alignment, bounds */
7222 			       lowaddr,			/* lowaddr */
7223 			       BUS_SPACE_MAXADDR,	/* highaddr */
7224 			       NULL, NULL,		/* filter, filterarg */
7225 			       BUS_SPACE_MAXSIZE,	/* maxsize */
7226 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
7227 			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
7228 			       0,			/* flags */
7229 			       NULL, NULL,		/* lockfunc, lockarg */
7230 			       &dma->parent_dtag);
7231 	if (error) {
7232 		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
7233 		return (error);
7234 	}
7235 
7236 	/*
7237 	 * Create TX/RX mbuf DMA tag
7238 	 */
7239 	error = bus_dma_tag_create(dma->parent_dtag,
7240 				1,
7241 				0,
7242 				BUS_SPACE_MAXADDR,
7243 				BUS_SPACE_MAXADDR,
7244 				NULL, NULL,
7245 				MCLBYTES,
7246 				1,
7247 				BUS_SPACE_MAXSIZE_32BIT,
7248 				0,
7249 				NULL, NULL,
7250 				&dma->rxbuf_dtag);
7251 	if (error) {
7252 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7253 		goto fail0;
7254 	}
7255 	error = bus_dma_tag_create(dma->parent_dtag,
7256 				1,
7257 				0,
7258 				BUS_SPACE_MAXADDR,
7259 				BUS_SPACE_MAXADDR,
7260 				NULL, NULL,
7261 				MCLBYTES,
7262 				1,
7263 				BUS_SPACE_MAXSIZE_32BIT,
7264 				0,
7265 				NULL, NULL,
7266 				&dma->txbuf_dtag);
7267 	if (error) {
7268 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7269 		goto fail1;
7270 	}
7271 
7272 	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1);
7273 	if (!dma->wme[WME_AC_BK])
7274 		goto fail2;
7275 
7276 	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1);
7277 	if (!dma->wme[WME_AC_BE])
7278 		goto fail3;
7279 
7280 	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1);
7281 	if (!dma->wme[WME_AC_VI])
7282 		goto fail4;
7283 
7284 	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1);
7285 	if (!dma->wme[WME_AC_VO])
7286 		goto fail5;
7287 
7288 	dma->mcast = bwn_dma_ringsetup(mac, 4, 1);
7289 	if (!dma->mcast)
7290 		goto fail6;
7291 	dma->rx = bwn_dma_ringsetup(mac, 0, 0);
7292 	if (!dma->rx)
7293 		goto fail7;
7294 
7295 	return (error);
7296 
7297 fail7:	bwn_dma_ringfree(&dma->mcast);
7298 fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7299 fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7300 fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7301 fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7302 fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7303 fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7304 fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7305 	return (error);
7306 }
7307 
7308 static struct bwn_dma_ring *
7309 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7310     uint16_t cookie, int *slot)
7311 {
7312 	struct bwn_dma *dma = &mac->mac_method.dma;
7313 	struct bwn_dma_ring *dr;
7314 	struct bwn_softc *sc = mac->mac_sc;
7315 
7316 	BWN_ASSERT_LOCKED(mac->mac_sc);
7317 
7318 	switch (cookie & 0xf000) {
7319 	case 0x1000:
7320 		dr = dma->wme[WME_AC_BK];
7321 		break;
7322 	case 0x2000:
7323 		dr = dma->wme[WME_AC_BE];
7324 		break;
7325 	case 0x3000:
7326 		dr = dma->wme[WME_AC_VI];
7327 		break;
7328 	case 0x4000:
7329 		dr = dma->wme[WME_AC_VO];
7330 		break;
7331 	case 0x5000:
7332 		dr = dma->mcast;
7333 		break;
7334 	default:
7335 		dr = NULL;
7336 		KASSERT(0 == 1,
7337 		    ("invalid cookie value %d", cookie & 0xf000));
7338 	}
7339 	*slot = (cookie & 0x0fff);
7340 	if (*slot < 0 || *slot >= dr->dr_numslots) {
7341 		/*
7342 		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7343 		 * that it occurs events which have same H/W sequence numbers.
7344 		 * When it's occurred just prints a WARNING msgs and ignores.
7345 		 */
7346 		KASSERT(status->seq == dma->lastseq,
7347 		    ("%s:%d: fail", __func__, __LINE__));
7348 		device_printf(sc->sc_dev,
7349 		    "out of slot ranges (0 < %d < %d)\n", *slot,
7350 		    dr->dr_numslots);
7351 		return (NULL);
7352 	}
7353 	dma->lastseq = status->seq;
7354 	return (dr);
7355 }
7356 
7357 static void
7358 bwn_dma_stop(struct bwn_mac *mac)
7359 {
7360 	struct bwn_dma *dma;
7361 
7362 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7363 		return;
7364 	dma = &mac->mac_method.dma;
7365 
7366 	bwn_dma_ringstop(&dma->rx);
7367 	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7368 	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7369 	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7370 	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7371 	bwn_dma_ringstop(&dma->mcast);
7372 }
7373 
7374 static void
7375 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7376 {
7377 
7378 	if (dr == NULL)
7379 		return;
7380 
7381 	bwn_dma_cleanup(*dr);
7382 }
7383 
7384 static void
7385 bwn_pio_stop(struct bwn_mac *mac)
7386 {
7387 	struct bwn_pio *pio;
7388 
7389 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7390 		return;
7391 	pio = &mac->mac_method.pio;
7392 
7393 	bwn_destroy_queue_tx(&pio->mcast);
7394 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7395 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7396 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7397 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7398 }
7399 
7400 static int
7401 bwn_led_attach(struct bwn_mac *mac)
7402 {
7403 	struct bwn_softc *sc = mac->mac_sc;
7404 	const uint8_t *led_act = NULL;
7405 	int error;
7406 	int i;
7407 
7408 	sc->sc_led_idle = (2350 * hz) / 1000;
7409 	sc->sc_led_blink = 1;
7410 
7411 	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7412 		if (sc->sc_board_info.board_vendor ==
7413 		    bwn_vendor_led_act[i].vid) {
7414 			led_act = bwn_vendor_led_act[i].led_act;
7415 			break;
7416 		}
7417 	}
7418 	if (led_act == NULL)
7419 		led_act = bwn_default_led_act;
7420 
7421 	_Static_assert(nitems(bwn_led_vars) == BWN_LED_MAX,
7422 	    "invalid NVRAM variable name array");
7423 
7424 	for (i = 0; i < BWN_LED_MAX; ++i) {
7425 		struct bwn_led	*led;
7426 		uint8_t		 val;
7427 
7428 		led = &sc->sc_leds[i];
7429 
7430 		KASSERT(i < nitems(bwn_led_vars), ("unknown LED index"));
7431 		error = bhnd_nvram_getvar_uint8(sc->sc_dev, bwn_led_vars[i],
7432 		    &val);
7433 		if (error) {
7434 			if (error != ENOENT) {
7435 				device_printf(sc->sc_dev, "NVRAM variable %s "
7436 				    "unreadable: %d", bwn_led_vars[i], error);
7437 				return (error);
7438 			}
7439 
7440 			/* Not found; use default */
7441 			led->led_act = led_act[i];
7442 		} else {
7443 			if (val & BWN_LED_ACT_LOW)
7444 				led->led_flags |= BWN_LED_F_ACTLOW;
7445 			led->led_act = val & BWN_LED_ACT_MASK;
7446 		}
7447 		led->led_mask = (1 << i);
7448 
7449 		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7450 		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7451 		    led->led_act == BWN_LED_ACT_BLINK) {
7452 			led->led_flags |= BWN_LED_F_BLINK;
7453 			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7454 				led->led_flags |= BWN_LED_F_POLLABLE;
7455 			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7456 				led->led_flags |= BWN_LED_F_SLOW;
7457 
7458 			if (sc->sc_blink_led == NULL) {
7459 				sc->sc_blink_led = led;
7460 				if (led->led_flags & BWN_LED_F_SLOW)
7461 					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7462 			}
7463 		}
7464 
7465 		DPRINTF(sc, BWN_DEBUG_LED,
7466 		    "%dth led, act %d, lowact %d\n", i,
7467 		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7468 	}
7469 	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7470 
7471 	return (0);
7472 }
7473 
7474 static __inline uint16_t
7475 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7476 {
7477 
7478 	if (led->led_flags & BWN_LED_F_ACTLOW)
7479 		on = !on;
7480 	if (on)
7481 		val |= led->led_mask;
7482 	else
7483 		val &= ~led->led_mask;
7484 	return val;
7485 }
7486 
7487 static void
7488 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7489 {
7490 	struct bwn_softc *sc = mac->mac_sc;
7491 	struct ieee80211com *ic = &sc->sc_ic;
7492 	uint16_t val;
7493 	int i;
7494 
7495 	if (nstate == IEEE80211_S_INIT) {
7496 		callout_stop(&sc->sc_led_blink_ch);
7497 		sc->sc_led_blinking = 0;
7498 	}
7499 
7500 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7501 		return;
7502 
7503 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7504 	for (i = 0; i < BWN_LED_MAX; ++i) {
7505 		struct bwn_led *led = &sc->sc_leds[i];
7506 		int on;
7507 
7508 		if (led->led_act == BWN_LED_ACT_UNKN ||
7509 		    led->led_act == BWN_LED_ACT_NULL)
7510 			continue;
7511 
7512 		if ((led->led_flags & BWN_LED_F_BLINK) &&
7513 		    nstate != IEEE80211_S_INIT)
7514 			continue;
7515 
7516 		switch (led->led_act) {
7517 		case BWN_LED_ACT_ON:    /* Always on */
7518 			on = 1;
7519 			break;
7520 		case BWN_LED_ACT_OFF:   /* Always off */
7521 		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7522 			on = 0;
7523 			break;
7524 		default:
7525 			on = 1;
7526 			switch (nstate) {
7527 			case IEEE80211_S_INIT:
7528 				on = 0;
7529 				break;
7530 			case IEEE80211_S_RUN:
7531 				if (led->led_act == BWN_LED_ACT_11G &&
7532 				    ic->ic_curmode != IEEE80211_MODE_11G)
7533 					on = 0;
7534 				break;
7535 			default:
7536 				if (led->led_act == BWN_LED_ACT_ASSOC)
7537 					on = 0;
7538 				break;
7539 			}
7540 			break;
7541 		}
7542 
7543 		val = bwn_led_onoff(led, val, on);
7544 	}
7545 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7546 }
7547 
7548 static void
7549 bwn_led_event(struct bwn_mac *mac, int event)
7550 {
7551 	struct bwn_softc *sc = mac->mac_sc;
7552 	struct bwn_led *led = sc->sc_blink_led;
7553 	int rate;
7554 
7555 	if (event == BWN_LED_EVENT_POLL) {
7556 		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7557 			return;
7558 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7559 			return;
7560 	}
7561 
7562 	sc->sc_led_ticks = ticks;
7563 	if (sc->sc_led_blinking)
7564 		return;
7565 
7566 	switch (event) {
7567 	case BWN_LED_EVENT_RX:
7568 		rate = sc->sc_rx_rate;
7569 		break;
7570 	case BWN_LED_EVENT_TX:
7571 		rate = sc->sc_tx_rate;
7572 		break;
7573 	case BWN_LED_EVENT_POLL:
7574 		rate = 0;
7575 		break;
7576 	default:
7577 		panic("unknown LED event %d\n", event);
7578 		break;
7579 	}
7580 	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7581 	    bwn_led_duration[rate].off_dur);
7582 }
7583 
7584 static void
7585 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7586 {
7587 	struct bwn_softc *sc = mac->mac_sc;
7588 	struct bwn_led *led = sc->sc_blink_led;
7589 	uint16_t val;
7590 
7591 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7592 	val = bwn_led_onoff(led, val, 1);
7593 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7594 
7595 	if (led->led_flags & BWN_LED_F_SLOW) {
7596 		BWN_LED_SLOWDOWN(on_dur);
7597 		BWN_LED_SLOWDOWN(off_dur);
7598 	}
7599 
7600 	sc->sc_led_blinking = 1;
7601 	sc->sc_led_blink_offdur = off_dur;
7602 
7603 	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7604 }
7605 
7606 static void
7607 bwn_led_blink_next(void *arg)
7608 {
7609 	struct bwn_mac *mac = arg;
7610 	struct bwn_softc *sc = mac->mac_sc;
7611 	uint16_t val;
7612 
7613 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7614 	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7615 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7616 
7617 	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7618 	    bwn_led_blink_end, mac);
7619 }
7620 
7621 static void
7622 bwn_led_blink_end(void *arg)
7623 {
7624 	struct bwn_mac *mac = arg;
7625 	struct bwn_softc *sc = mac->mac_sc;
7626 
7627 	sc->sc_led_blinking = 0;
7628 }
7629 
7630 static int
7631 bwn_suspend(device_t dev)
7632 {
7633 	struct bwn_softc *sc = device_get_softc(dev);
7634 
7635 	BWN_LOCK(sc);
7636 	bwn_stop(sc);
7637 	BWN_UNLOCK(sc);
7638 	return (0);
7639 }
7640 
7641 static int
7642 bwn_resume(device_t dev)
7643 {
7644 	struct bwn_softc *sc = device_get_softc(dev);
7645 	int error = EDOOFUS;
7646 
7647 	BWN_LOCK(sc);
7648 	if (sc->sc_ic.ic_nrunning > 0)
7649 		error = bwn_init(sc);
7650 	BWN_UNLOCK(sc);
7651 	if (error == 0)
7652 		ieee80211_start_all(&sc->sc_ic);
7653 	return (0);
7654 }
7655 
7656 static void
7657 bwn_rfswitch(void *arg)
7658 {
7659 	struct bwn_softc *sc = arg;
7660 	struct bwn_mac *mac = sc->sc_curmac;
7661 	int cur = 0, prev = 0;
7662 
7663 	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7664 	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7665 
7666 	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7667 	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7668 		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7669 			& BWN_RF_HWENABLED_HI_MASK))
7670 			cur = 1;
7671 	} else {
7672 		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7673 		    & BWN_RF_HWENABLED_LO_MASK)
7674 			cur = 1;
7675 	}
7676 
7677 	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7678 		prev = 1;
7679 
7680 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7681 	    __func__, cur, prev);
7682 
7683 	if (cur != prev) {
7684 		if (cur)
7685 			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7686 		else
7687 			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7688 
7689 		device_printf(sc->sc_dev,
7690 		    "status of RF switch is changed to %s\n",
7691 		    cur ? "ON" : "OFF");
7692 		if (cur != mac->mac_phy.rf_on) {
7693 			if (cur)
7694 				bwn_rf_turnon(mac);
7695 			else
7696 				bwn_rf_turnoff(mac);
7697 		}
7698 	}
7699 
7700 	callout_schedule(&sc->sc_rfswitch_ch, hz);
7701 }
7702 
7703 static void
7704 bwn_sysctl_node(struct bwn_softc *sc)
7705 {
7706 	device_t dev = sc->sc_dev;
7707 	struct bwn_mac *mac;
7708 	struct bwn_stats *stats;
7709 
7710 	/* XXX assume that count of MAC is only 1. */
7711 
7712 	if ((mac = sc->sc_curmac) == NULL)
7713 		return;
7714 	stats = &mac->mac_stats;
7715 
7716 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7717 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7718 	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7719 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7720 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7721 	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7722 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7723 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7724 	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7725 
7726 #ifdef BWN_DEBUG
7727 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7728 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7729 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7730 #endif
7731 }
7732 
7733 static device_method_t bwn_methods[] = {
7734 	/* Device interface */
7735 	DEVMETHOD(device_probe,		bwn_probe),
7736 	DEVMETHOD(device_attach,	bwn_attach),
7737 	DEVMETHOD(device_detach,	bwn_detach),
7738 	DEVMETHOD(device_suspend,	bwn_suspend),
7739 	DEVMETHOD(device_resume,	bwn_resume),
7740 	DEVMETHOD_END
7741 };
7742 static driver_t bwn_driver = {
7743 	"bwn",
7744 	bwn_methods,
7745 	sizeof(struct bwn_softc)
7746 };
7747 static devclass_t bwn_devclass;
7748 DRIVER_MODULE(bwn, bhnd, bwn_driver, bwn_devclass, 0, 0);
7749 MODULE_DEPEND(bwn, bhnd, 1, 1, 1);
7750 MODULE_DEPEND(bwn, gpiobus, 1, 1, 1);
7751 MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7752 MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7753 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7754 MODULE_VERSION(bwn, 1);
7755